projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Remove link type check in hci_disconn_complete_evt()
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
56 int err, iv_len;
57 unsigned char iv[128];
58
59 if (tfm == NULL) {
60 BT_ERR("tfm %p", tfm);
61 return -EINVAL;
62 }
63
64 desc.tfm = tfm;
65 desc.flags = 0;
66
67 err = crypto_blkcipher_setkey(tfm, k, 16);
68 if (err) {
69 BT_ERR("cipher setkey failed: %d", err);
70 return err;
71 }
72
73 sg_init_one(&sg, r, 16);
74
75 iv_len = crypto_blkcipher_ivsize(tfm);
76 if (iv_len) {
77 memset(&iv, 0xff, iv_len);
78 crypto_blkcipher_set_iv(tfm, iv, iv_len);
79 }
80
81 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
82 if (err)
83 BT_ERR("Encrypt data error %d", err);
84
85 return err;
86}
87
88static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 89 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
90 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 91{
92 u8 p1[16], p2[16];
93 int err;
94
95 memset(p1, 0, 16);
96
97 /* p1 = pres || preq || _rat || _iat */
98 swap56(pres, p1);
99 swap56(preq, p1 + 7);
100 p1[14] = _rat;
101 p1[15] = _iat;
102
103 memset(p2, 0, 16);
104
105 /* p2 = padding || ia || ra */
106 baswap((bdaddr_t *) (p2 + 4), ia);
107 baswap((bdaddr_t *) (p2 + 10), ra);
108
109 /* res = r XOR p1 */
110 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
111
112 /* res = e(k, res) */
113 err = smp_e(tfm, k, res);
114 if (err) {
115 BT_ERR("Encrypt data error");
116 return err;
117 }
118
119 /* res = res XOR p2 */
120 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
121
122 /* res = e(k, res) */
123 err = smp_e(tfm, k, res);
124 if (err)
125 BT_ERR("Encrypt data error");
126
127 return err;
128}
129
f1560463
MH		 130static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
131 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 132{
133 int err;
134
135 /* Just least significant octets from r1 and r2 are considered */
136 memcpy(_r, r1 + 8, 8);
137 memcpy(_r + 8, r2 + 8, 8);
138
139 err = smp_e(tfm, k, _r);
140 if (err)
141 BT_ERR("Encrypt data error");
142
143 return err;
144}
145
146static int smp_rand(u8 *buf)
147{
148 get_random_bytes(buf, 16);
149
150 return 0;
151}
eb492e01
AB		 152
153static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 154 u16 dlen, void *data)
eb492e01
AB		 155{
156 struct sk_buff *skb;
157 struct l2cap_hdr *lh;
158 int len;
159
160 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
161
162 if (len > conn->mtu)
163 return NULL;
164
165 skb = bt_skb_alloc(len, GFP_ATOMIC);
166 if (!skb)
167 return NULL;
168
169 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
170 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 171 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 172
173 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
174
175 memcpy(skb_put(skb, dlen), data, dlen);
176
177 return skb;
178}
179
180static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
181{
182 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
183
184 BT_DBG("code 0x%2.2x", code);
185
186 if (!skb)
187 return;
188
73d80deb
LAD		 189 skb->priority = HCI_PRIO_MAX;
190 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 191
6c9d42a1 192 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 193 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 194}
195
2b64d153
BG		 196static __u8 authreq_to_seclevel(__u8 authreq)
197{
198 if (authreq & SMP_AUTH_MITM)
199 return BT_SECURITY_HIGH;
200 else
201 return BT_SECURITY_MEDIUM;
202}
203
204static __u8 seclevel_to_authreq(__u8 sec_level)
205{
206 switch (sec_level) {
207 case BT_SECURITY_HIGH:
208 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
209 case BT_SECURITY_MEDIUM:
210 return SMP_AUTH_BONDING;
211 default:
212 return SMP_AUTH_NONE;
213 }
214}
215
b8e66eac 216static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 217 struct smp_cmd_pairing *req,
218 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 219{
2b64d153 220 u8 dist_keys = 0;
54790f73 221
a8b2d5c2 222 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
ca10b5ee 223 dist_keys = SMP_DIST_ENC_KEY;
54790f73 224 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 225 } else {
226 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 227 }
228
229 if (rsp == NULL) {
230 req->io_capability = conn->hcon->io_capability;
231 req->oob_flag = SMP_OOB_NOT_PRESENT;
232 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 233 req->init_key_dist = 0;
54790f73 234 req->resp_key_dist = dist_keys;
065a13e2 235 req->auth_req = (authreq & AUTH_REQ_MASK);
54790f73
VCG		 236 return;
237 }
238
239 rsp->io_capability = conn->hcon->io_capability;
240 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
241 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 242 rsp->init_key_dist = 0;
54790f73 243 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
065a13e2 244 rsp->auth_req = (authreq & AUTH_REQ_MASK);
b8e66eac
VCG		 245}
246
3158c50c
VCG		 247static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
248{
1c1def09
VCG		 249 struct smp_chan *smp = conn->smp_chan;
250
3158c50c 251 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 252 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 253 return SMP_ENC_KEY_SIZE;
254
f7aa611a 255 smp->enc_key_size = max_key_size;
3158c50c
VCG		 256
257 return 0;
258}
259
4f957a76
BG		 260static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
261{
bab73cb6
JH		 262 struct hci_conn *hcon = conn->hcon;
263
4f957a76
BG		 264 if (send)
265 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 266 &reason);
4f957a76 267
ce39fb4e
MH		 268 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
269 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
270 HCI_ERROR_AUTH_FAILURE);
f1c09c07 271
61a0cfb0
AG		 272 cancel_delayed_work_sync(&conn->security_timer);
273
ce39fb4e 274 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 275 smp_chan_destroy(conn);
4f957a76
BG		 276}
277
2b64d153
BG		 278#define JUST_WORKS 0x00
279#define JUST_CFM 0x01
280#define REQ_PASSKEY 0x02
281#define CFM_PASSKEY 0x03
282#define REQ_OOB 0x04
283#define OVERLAP 0xFF
284
285static const u8 gen_method[5][5] = {
286 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
287 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
288 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
289 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
290 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
291};
292
293static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
294 u8 local_io, u8 remote_io)
295{
296 struct hci_conn *hcon = conn->hcon;
297 struct smp_chan *smp = conn->smp_chan;
298 u8 method;
299 u32 passkey = 0;
300 int ret = 0;
301
302 /* Initialize key for JUST WORKS */
303 memset(smp->tk, 0, sizeof(smp->tk));
304 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
305
306 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
307
308 /* If neither side wants MITM, use JUST WORKS */
309 /* If either side has unknown io_caps, use JUST WORKS */
310 /* Otherwise, look up method from the table */
311 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 312 local_io > SMP_IO_KEYBOARD_DISPLAY ||
313 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 314 method = JUST_WORKS;
315 else
b3ff53ff 316 method = gen_method[remote_io][local_io];
2b64d153
BG		 317
318 /* If not bonding, don't ask user to confirm a Zero TK */
319 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
320 method = JUST_WORKS;
321
322 /* If Just Works, Continue with Zero TK */
323 if (method == JUST_WORKS) {
324 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
325 return 0;
326 }
327
328 /* Not Just Works/Confirm results in MITM Authentication */
329 if (method != JUST_CFM)
330 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
331
332 /* If both devices have Keyoard-Display I/O, the master
333 * Confirms and the slave Enters the passkey.
334 */
335 if (method == OVERLAP) {
336 if (hcon->link_mode & HCI_LM_MASTER)
337 method = CFM_PASSKEY;
338 else
339 method = REQ_PASSKEY;
340 }
341
342 /* Generate random passkey. Not valid until confirmed. */
343 if (method == CFM_PASSKEY) {
344 u8 key[16];
345
346 memset(key, 0, sizeof(key));
347 get_random_bytes(&passkey, sizeof(passkey));
348 passkey %= 1000000;
349 put_unaligned_le32(passkey, key);
350 swap128(key, smp->tk);
351 BT_DBG("PassKey: %d", passkey);
352 }
353
354 hci_dev_lock(hcon->hdev);
355
356 if (method == REQ_PASSKEY)
ce39fb4e 357 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 358 hcon->type, hcon->dst_type);
2b64d153 359 else
ce39fb4e 360 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 361 hcon->type, hcon->dst_type,
2b64d153
BG		 362 cpu_to_le32(passkey), 0);
363
364 hci_dev_unlock(hcon->hdev);
365
366 return ret;
367}
368
8aab4757
VCG		 369static void confirm_work(struct work_struct *work)
370{
371 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
372 struct l2cap_conn *conn = smp->conn;
373 struct crypto_blkcipher *tfm;
374 struct smp_cmd_pairing_confirm cp;
375 int ret;
376 u8 res[16], reason;
377
378 BT_DBG("conn %p", conn);
379
380 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
381 if (IS_ERR(tfm)) {
382 reason = SMP_UNSPECIFIED;
383 goto error;
384 }
385
386 smp->tfm = tfm;
387
388 if (conn->hcon->out)
c8462ca6
MH		 389 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
390 conn->hcon->src_type, &conn->hcon->src,
391 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 392 else
393 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 394 conn->hcon->dst_type, &conn->hcon->dst,
395 conn->hcon->src_type, &conn->hcon->src, res);
8aab4757
VCG		 396 if (ret) {
397 reason = SMP_UNSPECIFIED;
398 goto error;
399 }
400
2b64d153
BG		 401 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
402
8aab4757
VCG		 403 swap128(res, cp.confirm_val);
404 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
405
406 return;
407
408error:
4f957a76 409 smp_failure(conn, reason, 1);
8aab4757
VCG		 410}
411
412static void random_work(struct work_struct *work)
413{
414 struct smp_chan *smp = container_of(work, struct smp_chan, random);
415 struct l2cap_conn *conn = smp->conn;
416 struct hci_conn *hcon = conn->hcon;
417 struct crypto_blkcipher *tfm = smp->tfm;
418 u8 reason, confirm[16], res[16], key[16];
419 int ret;
420
421 if (IS_ERR_OR_NULL(tfm)) {
422 reason = SMP_UNSPECIFIED;
423 goto error;
424 }
425
426 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
427
428 if (hcon->out)
c8462ca6
MH		 429 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
430 hcon->src_type, &hcon->src,
431 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 432 else
433 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 434 hcon->dst_type, &hcon->dst,
435 hcon->src_type, &hcon->src, res);
8aab4757
VCG		 436 if (ret) {
437 reason = SMP_UNSPECIFIED;
438 goto error;
439 }
440
441 swap128(res, confirm);
442
443 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
444 BT_ERR("Pairing failed (confirmation values mismatch)");
445 reason = SMP_CONFIRM_FAILED;
446 goto error;
447 }
448
449 if (hcon->out) {
450 u8 stk[16], rand[8];
451 __le16 ediv;
452
453 memset(rand, 0, sizeof(rand));
454 ediv = 0;
455
456 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
457 swap128(key, stk);
458
f7aa611a 459 memset(stk + smp->enc_key_size, 0,
04124681 460 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 461
51a8efd7 462 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 463 reason = SMP_UNSPECIFIED;
464 goto error;
465 }
466
467 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 468 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 469 } else {
470 u8 stk[16], r[16], rand[8];
471 __le16 ediv;
472
473 memset(rand, 0, sizeof(rand));
474 ediv = 0;
475
476 swap128(smp->prnd, r);
477 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
478
479 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
480 swap128(key, stk);
481
f7aa611a 482 memset(stk + smp->enc_key_size, 0,
f1560463 483 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 484
ce39fb4e 485 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
04124681
GP		 486 HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
487 ediv, rand);
8aab4757
VCG		 488 }
489
490 return;
491
492error:
4f957a76 493 smp_failure(conn, reason, 1);
8aab4757
VCG		 494}
495
496static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
497{
498 struct smp_chan *smp;
499
f1560463 500 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 501 if (!smp)
502 return NULL;
503
504 INIT_WORK(&smp->confirm, confirm_work);
505 INIT_WORK(&smp->random, random_work);
506
507 smp->conn = conn;
508 conn->smp_chan = smp;
2b64d153 509 conn->hcon->smp_conn = conn;
8aab4757
VCG		 510
511 hci_conn_hold(conn->hcon);
512
513 return smp;
514}
515
516void smp_chan_destroy(struct l2cap_conn *conn)
517{
c8eb9690
BG		 518 struct smp_chan *smp = conn->smp_chan;
519
f1c09c07 520 BUG_ON(!smp);
c8eb9690
BG		 521
522 if (smp->tfm)
523 crypto_free_blkcipher(smp->tfm);
524
525 kfree(smp);
526 conn->smp_chan = NULL;
2b64d153 527 conn->hcon->smp_conn = NULL;
76a68ba0 528 hci_conn_drop(conn->hcon);
8aab4757
VCG		 529}
530
2b64d153
BG		 531int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
532{
533 struct l2cap_conn *conn = hcon->smp_conn;
534 struct smp_chan *smp;
535 u32 value;
536 u8 key[16];
537
538 BT_DBG("");
539
540 if (!conn)
541 return -ENOTCONN;
542
543 smp = conn->smp_chan;
544
545 switch (mgmt_op) {
546 case MGMT_OP_USER_PASSKEY_REPLY:
547 value = le32_to_cpu(passkey);
548 memset(key, 0, sizeof(key));
549 BT_DBG("PassKey: %d", value);
550 put_unaligned_le32(value, key);
551 swap128(key, smp->tk);
552 /* Fall Through */
553 case MGMT_OP_USER_CONFIRM_REPLY:
554 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
555 break;
556 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
557 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
558 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
559 return 0;
560 default:
561 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
562 return -EOPNOTSUPP;
563 }
564
565 /* If it is our turn to send Pairing Confirm, do so now */
566 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
567 queue_work(hcon->hdev->workqueue, &smp->confirm);
568
569 return 0;
570}
571
da85e5e5 572static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 573{
3158c50c 574 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 575 struct smp_chan *smp;
3158c50c 576 u8 key_size;
2b64d153 577 u8 auth = SMP_AUTH_NONE;
8aab4757 578 int ret;
88ba43b6
AB		 579
580 BT_DBG("conn %p", conn);
581
2b64d153
BG		 582 if (conn->hcon->link_mode & HCI_LM_MASTER)
583 return SMP_CMD_NOTSUPP;
584
51a8efd7 585 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 586 smp = smp_chan_create(conn);
d08fd0e7
AE		 587 else
588 smp = conn->smp_chan;
8aab4757 589
d08fd0e7
AE		 590 if (!smp)
591 return SMP_UNSPECIFIED;
d26a2345 592
1c1def09
VCG		 593 smp->preq[0] = SMP_CMD_PAIRING_REQ;
594 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 595 skb_pull(skb, sizeof(*req));
88ba43b6 596
2b64d153
BG		 597 /* We didn't start the pairing, so match remote */
598 if (req->auth_req & SMP_AUTH_BONDING)
599 auth = req->auth_req;
da85e5e5 600
fdde0a26
IY		 601 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
602
2b64d153 603 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 604
605 key_size = min(req->max_key_size, rsp.max_key_size);
606 if (check_enc_key_size(conn, key_size))
607 return SMP_ENC_KEY_SIZE;
88ba43b6 608
8aab4757
VCG		 609 ret = smp_rand(smp->prnd);
610 if (ret)
611 return SMP_UNSPECIFIED;
612
1c1def09
VCG		 613 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
614 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 615
3158c50c 616 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 617
2b64d153
BG		 618 /* Request setup of TK */
619 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
620 if (ret)
621 return SMP_UNSPECIFIED;
622
da85e5e5 623 return 0;
88ba43b6
AB		 624}
625
da85e5e5 626static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 627{
3158c50c 628 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 629 struct smp_chan *smp = conn->smp_chan;
8aab4757 630 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 631 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 632 int ret;
88ba43b6
AB		 633
634 BT_DBG("conn %p", conn);
635
2b64d153
BG		 636 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
637 return SMP_CMD_NOTSUPP;
638
3158c50c
VCG		 639 skb_pull(skb, sizeof(*rsp));
640
1c1def09 641 req = (void *) &smp->preq[1];
da85e5e5 642
3158c50c
VCG		 643 key_size = min(req->max_key_size, rsp->max_key_size);
644 if (check_enc_key_size(conn, key_size))
645 return SMP_ENC_KEY_SIZE;
646
1c1def09 647 ret = smp_rand(smp->prnd);
7d24ddcc 648 if (ret)
da85e5e5 649 return SMP_UNSPECIFIED;
7d24ddcc 650
8aab4757
VCG		 651 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
652 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 653
2b64d153 654 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 655 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 656 auth = SMP_AUTH_BONDING;
657
658 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
659
476585ec 660 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 661 if (ret)
662 return SMP_UNSPECIFIED;
663
664 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
665
666 /* Can't compose response until we have been confirmed */
667 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
668 return 0;
669
8aab4757 670 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 671
672 return 0;
88ba43b6
AB		 673}
674
da85e5e5 675static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 676{
1c1def09 677 struct smp_chan *smp = conn->smp_chan;
8aab4757 678 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 679
88ba43b6
AB		 680 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
681
1c1def09
VCG		 682 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
683 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 684
7d24ddcc
AB		 685 if (conn->hcon->out) {
686 u8 random[16];
88ba43b6 687
1c1def09 688 swap128(smp->prnd, random);
88ba43b6 689 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 690 random);
2b64d153 691 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 692 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 693 } else {
694 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 695 }
da85e5e5
VCG		 696
697 return 0;
88ba43b6
AB		 698}
699
da85e5e5 700static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 701{
1c1def09 702 struct smp_chan *smp = conn->smp_chan;
8aab4757 703 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 704
8aab4757 705 BT_DBG("conn %p", conn);
3158c50c 706
8aab4757
VCG		 707 swap128(skb->data, smp->rrnd);
708 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 709
8aab4757 710 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 711
712 return 0;
88ba43b6
AB		 713}
714
4dab7864 715static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 716{
c9839a11 717 struct smp_ltk *key;
988c5997
VCG		 718 struct hci_conn *hcon = conn->hcon;
719
ce39fb4e 720 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type);
988c5997
VCG		 721 if (!key)
722 return 0;
723
4dab7864
JH		 724 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
725 return 0;
726
51a8efd7 727 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 728 return 1;
729
c9839a11
VCG		 730 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
731 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 732
733 return 1;
988c5997 734}
f1560463 735
da85e5e5 736static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 737{
738 struct smp_cmd_security_req *rp = (void *) skb->data;
739 struct smp_cmd_pairing cp;
f1cb9af5 740 struct hci_conn *hcon = conn->hcon;
8aab4757 741 struct smp_chan *smp;
88ba43b6
AB		 742
743 BT_DBG("conn %p", conn);
744
86ca9eac
JH		 745 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
746 return SMP_CMD_NOTSUPP;
747
2b64d153 748 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 749
4dab7864 750 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 751 return 0;
752
51a8efd7 753 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 754 return 0;
f1cb9af5 755
8aab4757 756 smp = smp_chan_create(conn);
d26a2345 757
88ba43b6 758 skb_pull(skb, sizeof(*rp));
88ba43b6 759
da85e5e5 760 memset(&cp, 0, sizeof(cp));
54790f73 761 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 762
1c1def09
VCG		 763 smp->preq[0] = SMP_CMD_PAIRING_REQ;
764 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 765
88ba43b6 766 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 767
da85e5e5 768 return 0;
88ba43b6
AB		 769}
770
cc110922 771int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 772{
cc110922 773 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 774 struct smp_chan *smp = conn->smp_chan;
2b64d153 775 __u8 authreq;
eb492e01 776
3a0259bb
VCG		 777 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
778
757aee0f 779 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 780 return 1;
781
f1cb9af5
VCG		 782 if (sec_level == BT_SECURITY_LOW)
783 return 1;
eb492e01 784
f1cb9af5 785 if (hcon->sec_level >= sec_level)
eb492e01 786 return 1;
f1cb9af5 787
988c5997 788 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 789 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 790 goto done;
d26a2345 791
51a8efd7 792 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 793 return 0;
794
8aab4757 795 smp = smp_chan_create(conn);
2b64d153
BG		 796 if (!smp)
797 return 1;
798
799 authreq = seclevel_to_authreq(sec_level);
d26a2345 800
d26a2345
VCG		 801 if (hcon->link_mode & HCI_LM_MASTER) {
802 struct smp_cmd_pairing cp;
f01ead31 803
2b64d153 804 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 805 smp->preq[0] = SMP_CMD_PAIRING_REQ;
806 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 807
eb492e01
AB		 808 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
809 } else {
810 struct smp_cmd_security_req cp;
2b64d153 811 cp.auth_req = authreq;
eb492e01
AB		 812 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
813 }
814
02bc7455 815done:
f1cb9af5 816 hcon->pending_sec_level = sec_level;
f1cb9af5 817
eb492e01
AB		 818 return 0;
819}
820
7034b911
VCG		 821static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
822{
16b90839 823 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 824 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 825
826 skb_pull(skb, sizeof(*rp));
827
1c1def09 828 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 829
7034b911
VCG		 830 return 0;
831}
832
833static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
834{
16b90839 835 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 836 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 837 struct hci_dev *hdev = conn->hcon->hdev;
838 struct hci_conn *hcon = conn->hcon;
839 u8 authenticated;
16b90839
VCG		 840
841 skb_pull(skb, sizeof(*rp));
7034b911 842
c9839a11 843 hci_dev_lock(hdev);
ce39fb4e
MH		 844 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
845 hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK, 1,
846 authenticated, smp->tk, smp->enc_key_size,
04124681 847 rp->ediv, rp->rand);
7034b911 848 smp_distribute_keys(conn, 1);
c9839a11 849 hci_dev_unlock(hdev);
7034b911
VCG		 850
851 return 0;
852}
853
eb492e01
AB		 854int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
855{
7b9899db 856 struct hci_conn *hcon = conn->hcon;
92381f5c 857 __u8 code, reason;
eb492e01
AB		 858 int err = 0;
859
7b9899db
MH		 860 if (hcon->type != LE_LINK) {
861 kfree_skb(skb);
3432711f 862 return 0;
7b9899db
MH		 863 }
864
92381f5c
MH		 865 if (skb->len < 1) {
866 kfree_skb(skb);
867 return -EILSEQ;
868 }
869
06ae3314 870 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 871 err = -ENOTSUPP;
872 reason = SMP_PAIRING_NOTSUPP;
873 goto done;
874 }
875
92381f5c 876 code = skb->data[0];
eb492e01
AB		 877 skb_pull(skb, sizeof(code));
878
8cf9fa12
JH		 879 /*
880 * The SMP context must be initialized for all other PDUs except
881 * pairing and security requests. If we get any other PDU when
882 * not initialized simply disconnect (done if this function
883 * returns an error).
884 */
885 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
886 !conn->smp_chan) {
887 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
888 kfree_skb(skb);
889 return -ENOTSUPP;
890 }
891
eb492e01
AB		 892 switch (code) {
893 case SMP_CMD_PAIRING_REQ:
da85e5e5 894 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 895 break;
896
897 case SMP_CMD_PAIRING_FAIL:
4f957a76 898 smp_failure(conn, skb->data[0], 0);
da85e5e5
VCG		 899 reason = 0;
900 err = -EPERM;
eb492e01
AB		 901 break;
902
903 case SMP_CMD_PAIRING_RSP:
da85e5e5 904 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 905 break;
906
907 case SMP_CMD_SECURITY_REQ:
da85e5e5 908 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 909 break;
910
eb492e01 911 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 912 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 913 break;
914
eb492e01 915 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 916 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 917 break;
918
eb492e01 919 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 920 reason = smp_cmd_encrypt_info(conn, skb);
921 break;
922
eb492e01 923 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 924 reason = smp_cmd_master_ident(conn, skb);
925 break;
926
eb492e01
AB		 927 case SMP_CMD_IDENT_INFO:
928 case SMP_CMD_IDENT_ADDR_INFO:
929 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 930 /* Just ignored */
931 reason = 0;
932 break;
933
eb492e01
AB		 934 default:
935 BT_DBG("Unknown command code 0x%2.2x", code);
936
937 reason = SMP_CMD_NOTSUPP;
eb492e01 938 err = -EOPNOTSUPP;
3a0259bb 939 goto done;
eb492e01
AB		 940 }
941
3a0259bb
VCG		 942done:
943 if (reason)
4f957a76 944 smp_failure(conn, reason, 1);
3a0259bb 945
eb492e01
AB		 946 kfree_skb(skb);
947 return err;
948}
7034b911
VCG		 949
950int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
951{
952 struct smp_cmd_pairing *req, *rsp;
1c1def09 953 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 954 __u8 *keydist;
955
956 BT_DBG("conn %p force %d", conn, force);
957
51a8efd7 958 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
d26a2345
VCG		 959 return 0;
960
1c1def09 961 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 962
963 /* The responder sends its keys first */
964 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
965 return 0;
966
1c1def09 967 req = (void *) &smp->preq[1];
7034b911
VCG		 968
969 if (conn->hcon->out) {
970 keydist = &rsp->init_key_dist;
971 *keydist &= req->init_key_dist;
972 } else {
973 keydist = &rsp->resp_key_dist;
974 *keydist &= req->resp_key_dist;
975 }
976
977
978 BT_DBG("keydist 0x%x", *keydist);
979
980 if (*keydist & SMP_DIST_ENC_KEY) {
981 struct smp_cmd_encrypt_info enc;
982 struct smp_cmd_master_ident ident;
c9839a11
VCG		 983 struct hci_conn *hcon = conn->hcon;
984 u8 authenticated;
7034b911
VCG		 985 __le16 ediv;
986
987 get_random_bytes(enc.ltk, sizeof(enc.ltk));
988 get_random_bytes(&ediv, sizeof(ediv));
989 get_random_bytes(ident.rand, sizeof(ident.rand));
990
991 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
992
c9839a11 993 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
ce39fb4e 994 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
04124681
GP		 995 HCI_SMP_LTK_SLAVE, 1, authenticated,
996 enc.ltk, smp->enc_key_size, ediv, ident.rand);
16b90839 997
58115373 998 ident.ediv = ediv;
7034b911
VCG		 999
1000 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1001
1002 *keydist &= ~SMP_DIST_ENC_KEY;
1003 }
1004
1005 if (*keydist & SMP_DIST_ID_KEY) {
1006 struct smp_cmd_ident_addr_info addrinfo;
1007 struct smp_cmd_ident_info idinfo;
1008
1009 /* Send a dummy key */
1010 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
1011
1012 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1013
1014 /* Just public address */
1015 memset(&addrinfo, 0, sizeof(addrinfo));
2b36a562 1016 bacpy(&addrinfo.bdaddr, &conn->hcon->src);
7034b911
VCG		 1017
1018 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1019 &addrinfo);
7034b911
VCG		 1020
1021 *keydist &= ~SMP_DIST_ID_KEY;
1022 }
1023
1024 if (*keydist & SMP_DIST_SIGN) {
1025 struct smp_cmd_sign_info sign;
1026
1027 /* Send a dummy key */
1028 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1029
1030 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1031
1032 *keydist &= ~SMP_DIST_SIGN;
1033 }
1034
d26a2345 1035 if (conn->hcon->out || force) {
51a8efd7 1036 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6c9d42a1 1037 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1038 smp_chan_destroy(conn);
d26a2345
VCG		 1039 }
1040
7034b911
VCG		 1041 return 0;
1042}
Linux kernel - Deliverables
This page took 0.205237 seconds and 5 git commands to generate.