projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add SMP flag for SC and set it when necessary.
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
b28b4943 34#define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
b28b4943 35
17b02e62 36#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 37
0edb14de
JH		 38#define AUTH_REQ_MASK(dev) (test_bit(HCI_SC_ENABLED, &(dev)->dev_flags) ? \
39 0x1f : 0x07)
40#define KEY_DIST_MASK 0x07
065a13e2 41
533e35d4
JH		 42enum {
43 SMP_FLAG_TK_VALID,
44 SMP_FLAG_CFM_PENDING,
45 SMP_FLAG_MITM_AUTH,
46 SMP_FLAG_COMPLETE,
47 SMP_FLAG_INITIATOR,
65668776 48 SMP_FLAG_SC,
533e35d4 49};
4bc58f51
JH		 50
51struct smp_chan {
b68fda68
JH		 52 struct l2cap_conn *conn;
53 struct delayed_work security_timer;
b28b4943 54 unsigned long allow_cmd; /* Bitmask of allowed commands */
b68fda68 55
4bc58f51
JH		 56 u8 preq[7]; /* SMP Pairing Request */
57 u8 prsp[7]; /* SMP Pairing Response */
58 u8 prnd[16]; /* SMP Pairing Random (local) */
59 u8 rrnd[16]; /* SMP Pairing Random (remote) */
60 u8 pcnf[16]; /* SMP Pairing Confirm */
61 u8 tk[16]; /* SMP Temporary Key */
62 u8 enc_key_size;
63 u8 remote_key_dist;
64 bdaddr_t id_addr;
65 u8 id_addr_type;
66 u8 irk[16];
67 struct smp_csrk *csrk;
68 struct smp_csrk *slave_csrk;
69 struct smp_ltk *ltk;
70 struct smp_ltk *slave_ltk;
71 struct smp_irk *remote_irk;
4a74d658 72 unsigned long flags;
6a7bd103
JH		 73
74 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 75};
76
8a2936f4 77static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 78{
8a2936f4 79 size_t i;
d22ef0bc 80
8a2936f4
JH		 81 for (i = 0; i < len; i++)
82 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 83}
84
85static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
86{
87 struct blkcipher_desc desc;
88 struct scatterlist sg;
943a732a 89 uint8_t tmp[16], data[16];
201a5929 90 int err;
d22ef0bc
AB		 91
92 if (tfm == NULL) {
93 BT_ERR("tfm %p", tfm);
94 return -EINVAL;
95 }
96
97 desc.tfm = tfm;
98 desc.flags = 0;
99
943a732a 100 /* The most significant octet of key corresponds to k[0] */
8a2936f4 101 swap_buf(k, tmp, 16);
943a732a
JH		 102
103 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 104 if (err) {
105 BT_ERR("cipher setkey failed: %d", err);
106 return err;
107 }
108
943a732a 109 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 110 swap_buf(r, data, 16);
943a732a
JH		 111
112 sg_init_one(&sg, data, 16);
d22ef0bc 113
d22ef0bc
AB		 114 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
115 if (err)
116 BT_ERR("Encrypt data error %d", err);
117
943a732a 118 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 119 swap_buf(data, r, 16);
943a732a 120
d22ef0bc
AB		 121 return err;
122}
123
60478054
JH		 124static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
125{
943a732a 126 u8 _res[16];
60478054
JH		 127 int err;
128
129 /* r' = padding || r */
943a732a
JH		 130 memcpy(_res, r, 3);
131 memset(_res + 3, 0, 13);
60478054 132
943a732a 133 err = smp_e(tfm, irk, _res);
60478054
JH		 134 if (err) {
135 BT_ERR("Encrypt error");
136 return err;
137 }
138
139 /* The output of the random address function ah is:
140 * ah(h, r) = e(k, r') mod 2^24
141 * The output of the security function e is then truncated to 24 bits
142 * by taking the least significant 24 bits of the output of e as the
143 * result of ah.
144 */
943a732a 145 memcpy(res, _res, 3);
60478054
JH		 146
147 return 0;
148}
149
defce9e8 150bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 151{
defce9e8
JH		 152 struct l2cap_chan *chan = hdev->smp_data;
153 struct crypto_blkcipher *tfm;
60478054
JH		 154 u8 hash[3];
155 int err;
156
defce9e8
JH		 157 if (!chan || !chan->data)
158 return false;
159
160 tfm = chan->data;
161
60478054
JH		 162 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
163
164 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
165 if (err)
166 return false;
167
168 return !memcmp(bdaddr->b, hash, 3);
169}
170
defce9e8 171int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 172{
defce9e8
JH		 173 struct l2cap_chan *chan = hdev->smp_data;
174 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 175 int err;
176
defce9e8
JH		 177 if (!chan || !chan->data)
178 return -EOPNOTSUPP;
179
180 tfm = chan->data;
181
b1e2b3ae
JH		 182 get_random_bytes(&rpa->b[3], 3);
183
184 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
185 rpa->b[5] |= 0x40; /* Set second most significant bit */
186
187 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
188 if (err < 0)
189 return err;
190
191 BT_DBG("RPA %pMR", rpa);
192
193 return 0;
194}
195
e491eaf3
JH		 196static int smp_c1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r[16],
197 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat,
198 bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 199{
200 u8 p1[16], p2[16];
201 int err;
202
203 memset(p1, 0, 16);
204
205 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 206 p1[0] = _iat;
207 p1[1] = _rat;
208 memcpy(p1 + 2, preq, 7);
209 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 210
211 /* p2 = padding || ia || ra */
943a732a
JH		 212 memcpy(p2, ra, 6);
213 memcpy(p2 + 6, ia, 6);
214 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 215
216 /* res = r XOR p1 */
217 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
218
219 /* res = e(k, res) */
e491eaf3 220 err = smp_e(tfm_aes, k, res);
d22ef0bc
AB		 221 if (err) {
222 BT_ERR("Encrypt data error");
223 return err;
224 }
225
226 /* res = res XOR p2 */
227 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
228
229 /* res = e(k, res) */
e491eaf3 230 err = smp_e(tfm_aes, k, res);
d22ef0bc
AB		 231 if (err)
232 BT_ERR("Encrypt data error");
233
234 return err;
235}
236
e491eaf3
JH		 237static int smp_s1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r1[16],
238 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 239{
240 int err;
241
242 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 243 memcpy(_r, r2, 8);
244 memcpy(_r + 8, r1, 8);
d22ef0bc 245
e491eaf3 246 err = smp_e(tfm_aes, k, _r);
d22ef0bc
AB		 247 if (err)
248 BT_ERR("Encrypt data error");
249
250 return err;
251}
252
5d88cc73 253static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 254{
5d88cc73 255 struct l2cap_chan *chan = conn->smp;
b68fda68 256 struct smp_chan *smp;
5d88cc73
JH		 257 struct kvec iv[2];
258 struct msghdr msg;
eb492e01 259
5d88cc73
JH		 260 if (!chan)
261 return;
eb492e01 262
5d88cc73 263 BT_DBG("code 0x%2.2x", code);
eb492e01 264
5d88cc73
JH		 265 iv[0].iov_base = &code;
266 iv[0].iov_len = 1;
eb492e01 267
5d88cc73
JH		 268 iv[1].iov_base = data;
269 iv[1].iov_len = len;
eb492e01 270
5d88cc73 271 memset(&msg, 0, sizeof(msg));
eb492e01 272
5d88cc73
JH		 273 msg.msg_iov = (struct iovec *) &iv;
274 msg.msg_iovlen = 2;
eb492e01 275
5d88cc73 276 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 277
b68fda68
JH		 278 if (!chan->data)
279 return;
280
281 smp = chan->data;
282
283 cancel_delayed_work_sync(&smp->security_timer);
1b0921d6 284 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 285}
286
2b64d153
BG		 287static __u8 authreq_to_seclevel(__u8 authreq)
288{
289 if (authreq & SMP_AUTH_MITM)
290 return BT_SECURITY_HIGH;
291 else
292 return BT_SECURITY_MEDIUM;
293}
294
295static __u8 seclevel_to_authreq(__u8 sec_level)
296{
297 switch (sec_level) {
298 case BT_SECURITY_HIGH:
299 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
300 case BT_SECURITY_MEDIUM:
301 return SMP_AUTH_BONDING;
302 default:
303 return SMP_AUTH_NONE;
304 }
305}
306
b8e66eac 307static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 308 struct smp_cmd_pairing *req,
309 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 310{
5d88cc73
JH		 311 struct l2cap_chan *chan = conn->smp;
312 struct smp_chan *smp = chan->data;
fd349c02
JH		 313 struct hci_conn *hcon = conn->hcon;
314 struct hci_dev *hdev = hcon->hdev;
315 u8 local_dist = 0, remote_dist = 0;
54790f73 316
b6ae8457 317 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 318 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
319 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 320 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 321 } else {
322 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 323 }
324
fd349c02
JH		 325 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
326 remote_dist |= SMP_DIST_ID_KEY;
327
863efaf2
JH		 328 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
329 local_dist |= SMP_DIST_ID_KEY;
330
54790f73
VCG		 331 if (rsp == NULL) {
332 req->io_capability = conn->hcon->io_capability;
333 req->oob_flag = SMP_OOB_NOT_PRESENT;
334 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 335 req->init_key_dist = local_dist;
336 req->resp_key_dist = remote_dist;
0edb14de 337 req->auth_req = (authreq & AUTH_REQ_MASK(hdev));
fd349c02
JH		 338
339 smp->remote_key_dist = remote_dist;
54790f73
VCG		 340 return;
341 }
342
343 rsp->io_capability = conn->hcon->io_capability;
344 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
345 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 346 rsp->init_key_dist = req->init_key_dist & remote_dist;
347 rsp->resp_key_dist = req->resp_key_dist & local_dist;
0edb14de 348 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev));
fd349c02
JH		 349
350 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 351}
352
3158c50c
VCG		 353static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
354{
5d88cc73
JH		 355 struct l2cap_chan *chan = conn->smp;
356 struct smp_chan *smp = chan->data;
1c1def09 357
3158c50c 358 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 359 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 360 return SMP_ENC_KEY_SIZE;
361
f7aa611a 362 smp->enc_key_size = max_key_size;
3158c50c
VCG		 363
364 return 0;
365}
366
6f48e260
JH		 367static void smp_chan_destroy(struct l2cap_conn *conn)
368{
369 struct l2cap_chan *chan = conn->smp;
370 struct smp_chan *smp = chan->data;
371 bool complete;
372
373 BUG_ON(!smp);
374
375 cancel_delayed_work_sync(&smp->security_timer);
6f48e260 376
6f48e260
JH		 377 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
378 mgmt_smp_complete(conn->hcon, complete);
379
380 kfree(smp->csrk);
381 kfree(smp->slave_csrk);
382
383 crypto_free_blkcipher(smp->tfm_aes);
384
385 /* If pairing failed clean up any keys we might have */
386 if (!complete) {
387 if (smp->ltk) {
970d0f1b
JH		 388 list_del_rcu(&smp->ltk->list);
389 kfree_rcu(smp->ltk, rcu);
6f48e260
JH		 390 }
391
392 if (smp->slave_ltk) {
970d0f1b
JH		 393 list_del_rcu(&smp->slave_ltk->list);
394 kfree_rcu(smp->slave_ltk, rcu);
6f48e260
JH		 395 }
396
397 if (smp->remote_irk) {
adae20cb
JH		 398 list_del_rcu(&smp->remote_irk->list);
399 kfree_rcu(smp->remote_irk, rcu);
6f48e260
JH		 400 }
401 }
402
403 chan->data = NULL;
404 kfree(smp);
405 hci_conn_drop(conn->hcon);
406}
407
84794e11 408static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 409{
bab73cb6 410 struct hci_conn *hcon = conn->hcon;
b68fda68 411 struct l2cap_chan *chan = conn->smp;
bab73cb6 412
84794e11 413 if (reason)
4f957a76 414 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 415 &reason);
4f957a76 416
ce39fb4e 417 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
e1e930f5 418 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
f1c09c07 419
fc75cc86 420 if (chan->data)
f1c09c07 421 smp_chan_destroy(conn);
4f957a76
BG		 422}
423
2b64d153
BG		 424#define JUST_WORKS 0x00
425#define JUST_CFM 0x01
426#define REQ_PASSKEY 0x02
427#define CFM_PASSKEY 0x03
428#define REQ_OOB 0x04
429#define OVERLAP 0xFF
430
431static const u8 gen_method[5][5] = {
432 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
433 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
434 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
435 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
436 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
437};
438
581370cc
JH		 439static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
440{
2bcd4003
JH		 441 /* If either side has unknown io_caps, use JUST_CFM (which gets
442 * converted later to JUST_WORKS if we're initiators.
443 */
581370cc
JH		 444 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
445 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 446 return JUST_CFM;
581370cc
JH		 447
448 return gen_method[remote_io][local_io];
449}
450
2b64d153
BG		 451static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
452 u8 local_io, u8 remote_io)
453{
454 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 455 struct l2cap_chan *chan = conn->smp;
456 struct smp_chan *smp = chan->data;
2b64d153
BG		 457 u8 method;
458 u32 passkey = 0;
459 int ret = 0;
460
461 /* Initialize key for JUST WORKS */
462 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 463 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 464
465 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
466
2bcd4003
JH		 467 /* If neither side wants MITM, either "just" confirm an incoming
468 * request or use just-works for outgoing ones. The JUST_CFM
469 * will be converted to JUST_WORKS if necessary later in this
470 * function. If either side has MITM look up the method from the
471 * table.
472 */
581370cc 473 if (!(auth & SMP_AUTH_MITM))
2bcd4003 474 method = JUST_CFM;
2b64d153 475 else
581370cc 476 method = get_auth_method(smp, local_io, remote_io);
2b64d153 477
a82505c7 478 /* Don't confirm locally initiated pairing attempts */
4a74d658 479 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 480 method = JUST_WORKS;
481
02f3e254
JH		 482 /* Don't bother user space with no IO capabilities */
483 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
484 method = JUST_WORKS;
485
2b64d153
BG		 486 /* If Just Works, Continue with Zero TK */
487 if (method == JUST_WORKS) {
4a74d658 488 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 489 return 0;
490 }
491
492 /* Not Just Works/Confirm results in MITM Authentication */
5eb596f5 493 if (method != JUST_CFM) {
4a74d658 494 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
5eb596f5
JH		 495 if (hcon->pending_sec_level < BT_SECURITY_HIGH)
496 hcon->pending_sec_level = BT_SECURITY_HIGH;
497 }
2b64d153
BG		 498
499 /* If both devices have Keyoard-Display I/O, the master
500 * Confirms and the slave Enters the passkey.
501 */
502 if (method == OVERLAP) {
40bef302 503 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 504 method = CFM_PASSKEY;
505 else
506 method = REQ_PASSKEY;
507 }
508
01ad34d2 509 /* Generate random passkey. */
2b64d153 510 if (method == CFM_PASSKEY) {
943a732a 511 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 512 get_random_bytes(&passkey, sizeof(passkey));
513 passkey %= 1000000;
943a732a 514 put_unaligned_le32(passkey, smp->tk);
2b64d153 515 BT_DBG("PassKey: %d", passkey);
4a74d658 516 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 517 }
518
2b64d153 519 if (method == REQ_PASSKEY)
ce39fb4e 520 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 521 hcon->type, hcon->dst_type);
4eb65e66
JH		 522 else if (method == JUST_CFM)
523 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
524 hcon->type, hcon->dst_type,
525 passkey, 1);
2b64d153 526 else
01ad34d2 527 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 528 hcon->type, hcon->dst_type,
39adbffe 529 passkey, 0);
2b64d153 530
2b64d153
BG		 531 return ret;
532}
533
1cc61144 534static u8 smp_confirm(struct smp_chan *smp)
8aab4757 535{
8aab4757 536 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 537 struct smp_cmd_pairing_confirm cp;
538 int ret;
8aab4757
VCG		 539
540 BT_DBG("conn %p", conn);
541
e491eaf3 542 ret = smp_c1(smp->tfm_aes, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 543 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 544 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
545 cp.confirm_val);
1cc61144
JH		 546 if (ret)
547 return SMP_UNSPECIFIED;
8aab4757 548
4a74d658 549 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 550
8aab4757
VCG		 551 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
552
b28b4943
JH		 553 if (conn->hcon->out)
554 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
555 else
556 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
557
1cc61144 558 return 0;
8aab4757
VCG		 559}
560
861580a9 561static u8 smp_random(struct smp_chan *smp)
8aab4757 562{
8aab4757
VCG		 563 struct l2cap_conn *conn = smp->conn;
564 struct hci_conn *hcon = conn->hcon;
861580a9 565 u8 confirm[16];
8aab4757
VCG		 566 int ret;
567
ec70f36f 568 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 569 return SMP_UNSPECIFIED;
8aab4757
VCG		 570
571 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
572
e491eaf3 573 ret = smp_c1(smp->tfm_aes, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 574 hcon->init_addr_type, &hcon->init_addr,
943a732a 575 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 576 if (ret)
577 return SMP_UNSPECIFIED;
8aab4757 578
8aab4757
VCG		 579 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
580 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 581 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 582 }
583
584 if (hcon->out) {
fe39c7b2
MH		 585 u8 stk[16];
586 __le64 rand = 0;
587 __le16 ediv = 0;
8aab4757 588
e491eaf3 589 smp_s1(smp->tfm_aes, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 590
f7aa611a 591 memset(stk + smp->enc_key_size, 0,
04124681 592 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 593
861580a9
JH		 594 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
595 return SMP_UNSPECIFIED;
8aab4757
VCG		 596
597 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 598 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 599 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 600 } else {
fff3490f 601 u8 stk[16], auth;
fe39c7b2
MH		 602 __le64 rand = 0;
603 __le16 ediv = 0;
8aab4757 604
943a732a
JH		 605 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
606 smp->prnd);
8aab4757 607
e491eaf3 608 smp_s1(smp->tfm_aes, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 609
f7aa611a 610 memset(stk + smp->enc_key_size, 0,
f1560463 611 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 612
fff3490f
JH		 613 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
614 auth = 1;
615 else
616 auth = 0;
617
7d5843b7
JH		 618 /* Even though there's no _SLAVE suffix this is the
619 * slave STK we're adding for later lookup (the master
620 * STK never needs to be stored).
621 */
ce39fb4e 622 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 623 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 624 }
625
861580a9 626 return 0;
8aab4757
VCG		 627}
628
44f1a7ab
JH		 629static void smp_notify_keys(struct l2cap_conn *conn)
630{
631 struct l2cap_chan *chan = conn->smp;
632 struct smp_chan *smp = chan->data;
633 struct hci_conn *hcon = conn->hcon;
634 struct hci_dev *hdev = hcon->hdev;
635 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
636 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
637 bool persistent;
638
639 if (smp->remote_irk) {
640 mgmt_new_irk(hdev, smp->remote_irk);
641 /* Now that user space can be considered to know the
642 * identity address track the connection based on it
643 * from now on.
644 */
645 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
646 hcon->dst_type = smp->remote_irk->addr_type;
f3d82d0c 647 queue_work(hdev->workqueue, &conn->id_addr_update_work);
44f1a7ab
JH		 648
649 /* When receiving an indentity resolving key for
650 * a remote device that does not use a resolvable
651 * private address, just remove the key so that
652 * it is possible to use the controller white
653 * list for scanning.
654 *
655 * Userspace will have been told to not store
656 * this key at this point. So it is safe to
657 * just remove it.
658 */
659 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
adae20cb
JH		 660 list_del_rcu(&smp->remote_irk->list);
661 kfree_rcu(smp->remote_irk, rcu);
44f1a7ab
JH		 662 smp->remote_irk = NULL;
663 }
664 }
665
666 /* The LTKs and CSRKs should be persistent only if both sides
667 * had the bonding bit set in their authentication requests.
668 */
669 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
670
671 if (smp->csrk) {
672 smp->csrk->bdaddr_type = hcon->dst_type;
673 bacpy(&smp->csrk->bdaddr, &hcon->dst);
674 mgmt_new_csrk(hdev, smp->csrk, persistent);
675 }
676
677 if (smp->slave_csrk) {
678 smp->slave_csrk->bdaddr_type = hcon->dst_type;
679 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
680 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
681 }
682
683 if (smp->ltk) {
684 smp->ltk->bdaddr_type = hcon->dst_type;
685 bacpy(&smp->ltk->bdaddr, &hcon->dst);
686 mgmt_new_ltk(hdev, smp->ltk, persistent);
687 }
688
689 if (smp->slave_ltk) {
690 smp->slave_ltk->bdaddr_type = hcon->dst_type;
691 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
692 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
693 }
694}
695
b28b4943
JH		 696static void smp_allow_key_dist(struct smp_chan *smp)
697{
698 /* Allow the first expected phase 3 PDU. The rest of the PDUs
699 * will be allowed in each PDU handler to ensure we receive
700 * them in the correct order.
701 */
702 if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
703 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
704 else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
705 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
706 else if (smp->remote_key_dist & SMP_DIST_SIGN)
707 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
708}
709
d6268e86 710static void smp_distribute_keys(struct smp_chan *smp)
44f1a7ab
JH		 711{
712 struct smp_cmd_pairing *req, *rsp;
86d1407c 713 struct l2cap_conn *conn = smp->conn;
44f1a7ab
JH		 714 struct hci_conn *hcon = conn->hcon;
715 struct hci_dev *hdev = hcon->hdev;
716 __u8 *keydist;
717
718 BT_DBG("conn %p", conn);
719
44f1a7ab
JH		 720 rsp = (void *) &smp->prsp[1];
721
722 /* The responder sends its keys first */
b28b4943
JH		 723 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
724 smp_allow_key_dist(smp);
86d1407c 725 return;
b28b4943 726 }
44f1a7ab
JH		 727
728 req = (void *) &smp->preq[1];
729
730 if (hcon->out) {
731 keydist = &rsp->init_key_dist;
732 *keydist &= req->init_key_dist;
733 } else {
734 keydist = &rsp->resp_key_dist;
735 *keydist &= req->resp_key_dist;
736 }
737
738 BT_DBG("keydist 0x%x", *keydist);
739
740 if (*keydist & SMP_DIST_ENC_KEY) {
741 struct smp_cmd_encrypt_info enc;
742 struct smp_cmd_master_ident ident;
743 struct smp_ltk *ltk;
744 u8 authenticated;
745 __le16 ediv;
746 __le64 rand;
747
748 get_random_bytes(enc.ltk, sizeof(enc.ltk));
749 get_random_bytes(&ediv, sizeof(ediv));
750 get_random_bytes(&rand, sizeof(rand));
751
752 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
753
754 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
755 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
756 SMP_LTK_SLAVE, authenticated, enc.ltk,
757 smp->enc_key_size, ediv, rand);
758 smp->slave_ltk = ltk;
759
760 ident.ediv = ediv;
761 ident.rand = rand;
762
763 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
764
765 *keydist &= ~SMP_DIST_ENC_KEY;
766 }
767
768 if (*keydist & SMP_DIST_ID_KEY) {
769 struct smp_cmd_ident_addr_info addrinfo;
770 struct smp_cmd_ident_info idinfo;
771
772 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
773
774 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
775
776 /* The hci_conn contains the local identity address
777 * after the connection has been established.
778 *
779 * This is true even when the connection has been
780 * established using a resolvable random address.
781 */
782 bacpy(&addrinfo.bdaddr, &hcon->src);
783 addrinfo.addr_type = hcon->src_type;
784
785 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
786 &addrinfo);
787
788 *keydist &= ~SMP_DIST_ID_KEY;
789 }
790
791 if (*keydist & SMP_DIST_SIGN) {
792 struct smp_cmd_sign_info sign;
793 struct smp_csrk *csrk;
794
795 /* Generate a new random key */
796 get_random_bytes(sign.csrk, sizeof(sign.csrk));
797
798 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
799 if (csrk) {
800 csrk->master = 0x00;
801 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
802 }
803 smp->slave_csrk = csrk;
804
805 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
806
807 *keydist &= ~SMP_DIST_SIGN;
808 }
809
810 /* If there are still keys to be received wait for them */
b28b4943
JH		 811 if (smp->remote_key_dist & KEY_DIST_MASK) {
812 smp_allow_key_dist(smp);
86d1407c 813 return;
b28b4943 814 }
44f1a7ab 815
44f1a7ab
JH		 816 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
817 smp_notify_keys(conn);
818
819 smp_chan_destroy(conn);
44f1a7ab
JH		 820}
821
b68fda68
JH		 822static void smp_timeout(struct work_struct *work)
823{
824 struct smp_chan *smp = container_of(work, struct smp_chan,
825 security_timer.work);
826 struct l2cap_conn *conn = smp->conn;
827
828 BT_DBG("conn %p", conn);
829
1e91c29e 830 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
b68fda68
JH		 831}
832
8aab4757
VCG		 833static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
834{
5d88cc73 835 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 836 struct smp_chan *smp;
837
f1560463 838 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
fc75cc86 839 if (!smp)
8aab4757
VCG		 840 return NULL;
841
6a7bd103
JH		 842 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
843 if (IS_ERR(smp->tfm_aes)) {
844 BT_ERR("Unable to create ECB crypto context");
845 kfree(smp);
846 return NULL;
847 }
848
8aab4757 849 smp->conn = conn;
5d88cc73 850 chan->data = smp;
8aab4757 851
b28b4943
JH		 852 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
853
b68fda68
JH		 854 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
855
8aab4757
VCG		 856 hci_conn_hold(conn->hcon);
857
858 return smp;
859}
860
2b64d153
BG		 861int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
862{
b10e8017 863 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 864 struct l2cap_chan *chan;
2b64d153
BG		 865 struct smp_chan *smp;
866 u32 value;
fc75cc86 867 int err;
2b64d153
BG		 868
869 BT_DBG("");
870
fc75cc86 871 if (!conn)
2b64d153
BG		 872 return -ENOTCONN;
873
5d88cc73
JH		 874 chan = conn->smp;
875 if (!chan)
876 return -ENOTCONN;
877
fc75cc86
JH		 878 l2cap_chan_lock(chan);
879 if (!chan->data) {
880 err = -ENOTCONN;
881 goto unlock;
882 }
883
5d88cc73 884 smp = chan->data;
2b64d153
BG		 885
886 switch (mgmt_op) {
887 case MGMT_OP_USER_PASSKEY_REPLY:
888 value = le32_to_cpu(passkey);
943a732a 889 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 890 BT_DBG("PassKey: %d", value);
943a732a 891 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 892 /* Fall Through */
893 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 894 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 895 break;
896 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
897 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 898 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 899 err = 0;
900 goto unlock;
2b64d153 901 default:
84794e11 902 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 903 err = -EOPNOTSUPP;
904 goto unlock;
2b64d153
BG		 905 }
906
fc75cc86
JH		 907 err = 0;
908
2b64d153 909 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 910 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
911 u8 rsp = smp_confirm(smp);
912 if (rsp)
913 smp_failure(conn, rsp);
914 }
2b64d153 915
fc75cc86
JH		 916unlock:
917 l2cap_chan_unlock(chan);
918 return err;
2b64d153
BG		 919}
920
da85e5e5 921static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 922{
3158c50c 923 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
fc75cc86 924 struct l2cap_chan *chan = conn->smp;
b3c6410b 925 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 926 struct smp_chan *smp;
c7262e71 927 u8 key_size, auth, sec_level;
8aab4757 928 int ret;
88ba43b6
AB		 929
930 BT_DBG("conn %p", conn);
931
c46b98be 932 if (skb->len < sizeof(*req))
38e4a915 933 return SMP_INVALID_PARAMS;
c46b98be 934
40bef302 935 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 936 return SMP_CMD_NOTSUPP;
937
fc75cc86 938 if (!chan->data)
8aab4757 939 smp = smp_chan_create(conn);
fc75cc86 940 else
5d88cc73 941 smp = chan->data;
8aab4757 942
d08fd0e7
AE		 943 if (!smp)
944 return SMP_UNSPECIFIED;
d26a2345 945
c05b9339 946 /* We didn't start the pairing, so match remote */
0edb14de 947 auth = req->auth_req & AUTH_REQ_MASK(hdev);
c05b9339 948
b6ae8457 949 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
c05b9339 950 (auth & SMP_AUTH_BONDING))
b3c6410b
JH		 951 return SMP_PAIRING_NOTSUPP;
952
1c1def09
VCG		 953 smp->preq[0] = SMP_CMD_PAIRING_REQ;
954 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 955 skb_pull(skb, sizeof(*req));
88ba43b6 956
5be5e275 957 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1afc2a1a
JH		 958 sec_level = BT_SECURITY_MEDIUM;
959 else
960 sec_level = authreq_to_seclevel(auth);
961
c7262e71
JH		 962 if (sec_level > conn->hcon->pending_sec_level)
963 conn->hcon->pending_sec_level = sec_level;
fdde0a26 964
49c922bb 965 /* If we need MITM check that it can be achieved */
2ed8f65c
JH		 966 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
967 u8 method;
968
969 method = get_auth_method(smp, conn->hcon->io_capability,
970 req->io_capability);
971 if (method == JUST_WORKS || method == JUST_CFM)
972 return SMP_AUTH_REQUIREMENTS;
973 }
974
2b64d153 975 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c 976
65668776
JH		 977 if (rsp.auth_req & SMP_AUTH_SC)
978 set_bit(SMP_FLAG_SC, &smp->flags);
979
3158c50c
VCG		 980 key_size = min(req->max_key_size, rsp.max_key_size);
981 if (check_enc_key_size(conn, key_size))
982 return SMP_ENC_KEY_SIZE;
88ba43b6 983
e84a6b13 984 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 985
1c1def09
VCG		 986 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
987 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 988
3158c50c 989 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
b28b4943 990 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
da85e5e5 991
2b64d153
BG		 992 /* Request setup of TK */
993 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
994 if (ret)
995 return SMP_UNSPECIFIED;
996
da85e5e5 997 return 0;
88ba43b6
AB		 998}
999
da85e5e5 1000static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1001{
3158c50c 1002 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 1003 struct l2cap_chan *chan = conn->smp;
1004 struct smp_chan *smp = chan->data;
0edb14de 1005 struct hci_dev *hdev = conn->hcon->hdev;
3a7dbfb8 1006 u8 key_size, auth;
7d24ddcc 1007 int ret;
88ba43b6
AB		 1008
1009 BT_DBG("conn %p", conn);
1010
c46b98be 1011 if (skb->len < sizeof(*rsp))
38e4a915 1012 return SMP_INVALID_PARAMS;
c46b98be 1013
40bef302 1014 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 1015 return SMP_CMD_NOTSUPP;
1016
3158c50c
VCG		 1017 skb_pull(skb, sizeof(*rsp));
1018
1c1def09 1019 req = (void *) &smp->preq[1];
da85e5e5 1020
3158c50c
VCG		 1021 key_size = min(req->max_key_size, rsp->max_key_size);
1022 if (check_enc_key_size(conn, key_size))
1023 return SMP_ENC_KEY_SIZE;
1024
0edb14de 1025 auth = rsp->auth_req & AUTH_REQ_MASK(hdev);
c05b9339 1026
65668776
JH		 1027 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC))
1028 set_bit(SMP_FLAG_SC, &smp->flags);
1029
49c922bb 1030 /* If we need MITM check that it can be achieved */
2ed8f65c
JH		 1031 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1032 u8 method;
1033
1034 method = get_auth_method(smp, req->io_capability,
1035 rsp->io_capability);
1036 if (method == JUST_WORKS || method == JUST_CFM)
1037 return SMP_AUTH_REQUIREMENTS;
1038 }
1039
e84a6b13 1040 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1041
8aab4757
VCG		 1042 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1043 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1044
fdcc4bec
JH		 1045 /* Update remote key distribution in case the remote cleared
1046 * some bits that we had enabled in our request.
1047 */
1048 smp->remote_key_dist &= rsp->resp_key_dist;
1049
c05b9339 1050 auth |= req->auth_req;
2b64d153 1051
476585ec 1052 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1053 if (ret)
1054 return SMP_UNSPECIFIED;
1055
4a74d658 1056 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1057
1058 /* Can't compose response until we have been confirmed */
4a74d658 1059 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1060 return smp_confirm(smp);
da85e5e5
VCG		 1061
1062 return 0;
88ba43b6
AB		 1063}
1064
da85e5e5 1065static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1066{
5d88cc73
JH		 1067 struct l2cap_chan *chan = conn->smp;
1068 struct smp_chan *smp = chan->data;
7d24ddcc 1069
88ba43b6
AB		 1070 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1071
c46b98be 1072 if (skb->len < sizeof(smp->pcnf))
38e4a915 1073 return SMP_INVALID_PARAMS;
c46b98be 1074
1c1def09
VCG		 1075 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1076 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1077
b28b4943 1078 if (conn->hcon->out) {
943a732a
JH		 1079 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1080 smp->prnd);
b28b4943
JH		 1081 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1082 return 0;
1083 }
1084
1085 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1086 return smp_confirm(smp);
943a732a 1087 else
4a74d658 1088 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1089
1090 return 0;
88ba43b6
AB		 1091}
1092
da85e5e5 1093static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1094{
5d88cc73
JH		 1095 struct l2cap_chan *chan = conn->smp;
1096 struct smp_chan *smp = chan->data;
7d24ddcc 1097
8aab4757 1098 BT_DBG("conn %p", conn);
3158c50c 1099
c46b98be 1100 if (skb->len < sizeof(smp->rrnd))
38e4a915 1101 return SMP_INVALID_PARAMS;
c46b98be 1102
943a732a 1103 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1104 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1105
861580a9 1106 return smp_random(smp);
88ba43b6
AB		 1107}
1108
f81cd823 1109static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1110{
c9839a11 1111 struct smp_ltk *key;
988c5997
VCG		 1112 struct hci_conn *hcon = conn->hcon;
1113
98a0b845 1114 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1115 hcon->role);
988c5997 1116 if (!key)
f81cd823 1117 return false;
988c5997 1118
a6f7833c 1119 if (smp_ltk_sec_level(key) < sec_level)
f81cd823 1120 return false;
4dab7864 1121
51a8efd7 1122 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1123 return true;
988c5997 1124
c9839a11
VCG		 1125 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1126 hcon->enc_key_size = key->enc_size;
988c5997 1127
fe59a05f
JH		 1128 /* We never store STKs for master role, so clear this flag */
1129 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1130
f81cd823 1131 return true;
988c5997 1132}
f1560463 1133
35dc6f83
JH		 1134bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
1135 enum smp_key_pref key_pref)
854f4727
JH		 1136{
1137 if (sec_level == BT_SECURITY_LOW)
1138 return true;
1139
35dc6f83
JH		 1140 /* If we're encrypted with an STK but the caller prefers using
1141 * LTK claim insufficient security. This way we allow the
1142 * connection to be re-encrypted with an LTK, even if the LTK
1143 * provides the same level of security. Only exception is if we
1144 * don't have an LTK (e.g. because of key distribution bits).
9ab65d60 1145 */
35dc6f83
JH		 1146 if (key_pref == SMP_USE_LTK &&
1147 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
b2d5e254 1148 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1149 hcon->role))
9ab65d60
JH		 1150 return false;
1151
854f4727
JH		 1152 if (hcon->sec_level >= sec_level)
1153 return true;
1154
1155 return false;
1156}
1157
da85e5e5 1158static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1159{
1160 struct smp_cmd_security_req *rp = (void *) skb->data;
1161 struct smp_cmd_pairing cp;
f1cb9af5 1162 struct hci_conn *hcon = conn->hcon;
0edb14de 1163 struct hci_dev *hdev = hcon->hdev;
8aab4757 1164 struct smp_chan *smp;
c05b9339 1165 u8 sec_level, auth;
88ba43b6
AB		 1166
1167 BT_DBG("conn %p", conn);
1168
c46b98be 1169 if (skb->len < sizeof(*rp))
38e4a915 1170 return SMP_INVALID_PARAMS;
c46b98be 1171
40bef302 1172 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1173 return SMP_CMD_NOTSUPP;
1174
0edb14de 1175 auth = rp->auth_req & AUTH_REQ_MASK(hdev);
c05b9339 1176
5be5e275 1177 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1afc2a1a
JH		 1178 sec_level = BT_SECURITY_MEDIUM;
1179 else
1180 sec_level = authreq_to_seclevel(auth);
1181
35dc6f83 1182 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
854f4727
JH		 1183 return 0;
1184
c7262e71
JH		 1185 if (sec_level > hcon->pending_sec_level)
1186 hcon->pending_sec_level = sec_level;
feb45eb5 1187
4dab7864 1188 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1189 return 0;
1190
8aab4757 1191 smp = smp_chan_create(conn);
c29d2444
JH		 1192 if (!smp)
1193 return SMP_UNSPECIFIED;
d26a2345 1194
b6ae8457 1195 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
c05b9339 1196 (auth & SMP_AUTH_BONDING))
616d55be
JH		 1197 return SMP_PAIRING_NOTSUPP;
1198
88ba43b6 1199 skb_pull(skb, sizeof(*rp));
88ba43b6 1200
da85e5e5 1201 memset(&cp, 0, sizeof(cp));
c05b9339 1202 build_pairing_cmd(conn, &cp, NULL, auth);
88ba43b6 1203
1c1def09
VCG		 1204 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1205 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1206
88ba43b6 1207 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1208 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
f1cb9af5 1209
da85e5e5 1210 return 0;
88ba43b6
AB		 1211}
1212
cc110922 1213int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1214{
cc110922 1215 struct l2cap_conn *conn = hcon->l2cap_data;
c68b7f12 1216 struct l2cap_chan *chan;
0a66cf20 1217 struct smp_chan *smp;
2b64d153 1218 __u8 authreq;
fc75cc86 1219 int ret;
eb492e01 1220
3a0259bb
VCG		 1221 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1222
0a66cf20
JH		 1223 /* This may be NULL if there's an unexpected disconnection */
1224 if (!conn)
1225 return 1;
1226
c68b7f12
JH		 1227 chan = conn->smp;
1228
757aee0f 1229 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1230 return 1;
1231
35dc6f83 1232 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
eb492e01 1233 return 1;
f1cb9af5 1234
c7262e71
JH		 1235 if (sec_level > hcon->pending_sec_level)
1236 hcon->pending_sec_level = sec_level;
1237
40bef302 1238 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1239 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1240 return 0;
d26a2345 1241
fc75cc86
JH		 1242 l2cap_chan_lock(chan);
1243
1244 /* If SMP is already in progress ignore this request */
1245 if (chan->data) {
1246 ret = 0;
1247 goto unlock;
1248 }
d26a2345 1249
8aab4757 1250 smp = smp_chan_create(conn);
fc75cc86
JH		 1251 if (!smp) {
1252 ret = 1;
1253 goto unlock;
1254 }
2b64d153
BG		 1255
1256 authreq = seclevel_to_authreq(sec_level);
d26a2345 1257
79897d20
JH		 1258 /* Require MITM if IO Capability allows or the security level
1259 * requires it.
2e233644 1260 */
79897d20 1261 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1262 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1263 authreq |= SMP_AUTH_MITM;
1264
40bef302 1265 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1266 struct smp_cmd_pairing cp;
f01ead31 1267
2b64d153 1268 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1269 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1270 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1271
eb492e01 1272 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1273 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
eb492e01
AB		 1274 } else {
1275 struct smp_cmd_security_req cp;
2b64d153 1276 cp.auth_req = authreq;
eb492e01 1277 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
b28b4943 1278 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
eb492e01
AB		 1279 }
1280
4a74d658 1281 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
fc75cc86 1282 ret = 0;
edca792c 1283
fc75cc86
JH		 1284unlock:
1285 l2cap_chan_unlock(chan);
1286 return ret;
eb492e01
AB		 1287}
1288
7034b911
VCG		 1289static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1290{
16b90839 1291 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1292 struct l2cap_chan *chan = conn->smp;
1293 struct smp_chan *smp = chan->data;
16b90839 1294
c46b98be
JH		 1295 BT_DBG("conn %p", conn);
1296
1297 if (skb->len < sizeof(*rp))
38e4a915 1298 return SMP_INVALID_PARAMS;
c46b98be 1299
b28b4943 1300 SMP_ALLOW_CMD(smp, SMP_CMD_MASTER_IDENT);
6131ddc8 1301
16b90839
VCG		 1302 skb_pull(skb, sizeof(*rp));
1303
1c1def09 1304 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1305
7034b911
VCG		 1306 return 0;
1307}
1308
1309static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1310{
16b90839 1311 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1312 struct l2cap_chan *chan = conn->smp;
1313 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1314 struct hci_dev *hdev = conn->hcon->hdev;
1315 struct hci_conn *hcon = conn->hcon;
23d0e128 1316 struct smp_ltk *ltk;
c9839a11 1317 u8 authenticated;
16b90839 1318
c46b98be
JH		 1319 BT_DBG("conn %p", conn);
1320
1321 if (skb->len < sizeof(*rp))
38e4a915 1322 return SMP_INVALID_PARAMS;
c46b98be 1323
9747a9f3
JH		 1324 /* Mark the information as received */
1325 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1326
b28b4943
JH		 1327 if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1328 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
196332f5
JH		 1329 else if (smp->remote_key_dist & SMP_DIST_SIGN)
1330 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
b28b4943 1331
16b90839 1332 skb_pull(skb, sizeof(*rp));
7034b911 1333
ce39fb4e 1334 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1335 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1336 authenticated, smp->tk, smp->enc_key_size,
1337 rp->ediv, rp->rand);
1338 smp->ltk = ltk;
c6e81e9a 1339 if (!(smp->remote_key_dist & KEY_DIST_MASK))
d6268e86 1340 smp_distribute_keys(smp);
7034b911
VCG		 1341
1342 return 0;
1343}
1344
fd349c02
JH		 1345static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1346{
1347 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1348 struct l2cap_chan *chan = conn->smp;
1349 struct smp_chan *smp = chan->data;
fd349c02
JH		 1350
1351 BT_DBG("");
1352
1353 if (skb->len < sizeof(*info))
38e4a915 1354 return SMP_INVALID_PARAMS;
fd349c02 1355
b28b4943 1356 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
6131ddc8 1357
fd349c02
JH		 1358 skb_pull(skb, sizeof(*info));
1359
1360 memcpy(smp->irk, info->irk, 16);
1361
1362 return 0;
1363}
1364
1365static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1366 struct sk_buff *skb)
1367{
1368 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1369 struct l2cap_chan *chan = conn->smp;
1370 struct smp_chan *smp = chan->data;
fd349c02
JH		 1371 struct hci_conn *hcon = conn->hcon;
1372 bdaddr_t rpa;
1373
1374 BT_DBG("");
1375
1376 if (skb->len < sizeof(*info))
38e4a915 1377 return SMP_INVALID_PARAMS;
fd349c02 1378
9747a9f3
JH		 1379 /* Mark the information as received */
1380 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1381
b28b4943
JH		 1382 if (smp->remote_key_dist & SMP_DIST_SIGN)
1383 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1384
fd349c02
JH		 1385 skb_pull(skb, sizeof(*info));
1386
a9a58f86
JH		 1387 /* Strictly speaking the Core Specification (4.1) allows sending
1388 * an empty address which would force us to rely on just the IRK
1389 * as "identity information". However, since such
1390 * implementations are not known of and in order to not over
1391 * complicate our implementation, simply pretend that we never
1392 * received an IRK for such a device.
1393 */
1394 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1395 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1396 goto distribute;
a9a58f86
JH		 1397 }
1398
fd349c02
JH		 1399 bacpy(&smp->id_addr, &info->bdaddr);
1400 smp->id_addr_type = info->addr_type;
1401
1402 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1403 bacpy(&rpa, &hcon->dst);
1404 else
1405 bacpy(&rpa, BDADDR_ANY);
1406
23d0e128
JH		 1407 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1408 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1409
31dd624e 1410distribute:
c6e81e9a
JH		 1411 if (!(smp->remote_key_dist & KEY_DIST_MASK))
1412 smp_distribute_keys(smp);
fd349c02
JH		 1413
1414 return 0;
1415}
1416
7ee4ea36
MH		 1417static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1418{
1419 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1420 struct l2cap_chan *chan = conn->smp;
1421 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1422 struct smp_csrk *csrk;
1423
1424 BT_DBG("conn %p", conn);
1425
1426 if (skb->len < sizeof(*rp))
38e4a915 1427 return SMP_INVALID_PARAMS;
7ee4ea36 1428
7ee4ea36
MH		 1429 /* Mark the information as received */
1430 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1431
1432 skb_pull(skb, sizeof(*rp));
1433
7ee4ea36
MH		 1434 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1435 if (csrk) {
1436 csrk->master = 0x01;
1437 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1438 }
1439 smp->csrk = csrk;
d6268e86 1440 smp_distribute_keys(smp);
7ee4ea36
MH		 1441
1442 return 0;
1443}
1444
4befb867 1445static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1446{
5d88cc73 1447 struct l2cap_conn *conn = chan->conn;
7b9899db 1448 struct hci_conn *hcon = conn->hcon;
b28b4943 1449 struct smp_chan *smp;
92381f5c 1450 __u8 code, reason;
eb492e01
AB		 1451 int err = 0;
1452
7b9899db
MH		 1453 if (hcon->type != LE_LINK) {
1454 kfree_skb(skb);
3432711f 1455 return 0;
7b9899db
MH		 1456 }
1457
8ae9b984 1458 if (skb->len < 1)
92381f5c 1459 return -EILSEQ;
92381f5c 1460
06ae3314 1461 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1462 reason = SMP_PAIRING_NOTSUPP;
1463 goto done;
1464 }
1465
92381f5c 1466 code = skb->data[0];
eb492e01
AB		 1467 skb_pull(skb, sizeof(code));
1468
b28b4943
JH		 1469 smp = chan->data;
1470
1471 if (code > SMP_CMD_MAX)
1472 goto drop;
1473
24bd0bd9 1474 if (smp && !test_and_clear_bit(code, &smp->allow_cmd))
b28b4943
JH		 1475 goto drop;
1476
1477 /* If we don't have a context the only allowed commands are
1478 * pairing request and security request.
8cf9fa12 1479 */
b28b4943
JH		 1480 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
1481 goto drop;
8cf9fa12 1482
eb492e01
AB		 1483 switch (code) {
1484 case SMP_CMD_PAIRING_REQ:
da85e5e5 1485 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1486 break;
1487
1488 case SMP_CMD_PAIRING_FAIL:
84794e11 1489 smp_failure(conn, 0);
da85e5e5 1490 err = -EPERM;
eb492e01
AB		 1491 break;
1492
1493 case SMP_CMD_PAIRING_RSP:
da85e5e5 1494 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1495 break;
1496
1497 case SMP_CMD_SECURITY_REQ:
da85e5e5 1498 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1499 break;
1500
eb492e01 1501 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1502 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1503 break;
1504
eb492e01 1505 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1506 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1507 break;
1508
eb492e01 1509 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1510 reason = smp_cmd_encrypt_info(conn, skb);
1511 break;
1512
eb492e01 1513 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1514 reason = smp_cmd_master_ident(conn, skb);
1515 break;
1516
eb492e01 1517 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1518 reason = smp_cmd_ident_info(conn, skb);
1519 break;
1520
eb492e01 1521 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1522 reason = smp_cmd_ident_addr_info(conn, skb);
1523 break;
1524
eb492e01 1525 case SMP_CMD_SIGN_INFO:
7ee4ea36 1526 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1527 break;
1528
eb492e01
AB		 1529 default:
1530 BT_DBG("Unknown command code 0x%2.2x", code);
eb492e01 1531 reason = SMP_CMD_NOTSUPP;
3a0259bb 1532 goto done;
eb492e01
AB		 1533 }
1534
3a0259bb 1535done:
9b7b18ef
JH		 1536 if (!err) {
1537 if (reason)
1538 smp_failure(conn, reason);
8ae9b984 1539 kfree_skb(skb);
9b7b18ef
JH		 1540 }
1541
eb492e01 1542 return err;
b28b4943
JH		 1543
1544drop:
1545 BT_ERR("%s unexpected SMP command 0x%02x from %pMR", hcon->hdev->name,
1546 code, &hcon->dst);
1547 kfree_skb(skb);
1548 return 0;
eb492e01 1549}
7034b911 1550
70db83c4
JH		 1551static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1552{
1553 struct l2cap_conn *conn = chan->conn;
1554
1555 BT_DBG("chan %p", chan);
1556
fc75cc86 1557 if (chan->data)
5d88cc73 1558 smp_chan_destroy(conn);
5d88cc73 1559
70db83c4
JH		 1560 conn->smp = NULL;
1561 l2cap_chan_put(chan);
1562}
1563
44f1a7ab
JH		 1564static void smp_resume_cb(struct l2cap_chan *chan)
1565{
b68fda68 1566 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1567 struct l2cap_conn *conn = chan->conn;
1568 struct hci_conn *hcon = conn->hcon;
1569
1570 BT_DBG("chan %p", chan);
1571
86d1407c
JH		 1572 if (!smp)
1573 return;
b68fda68 1574
84bc0db5
JH		 1575 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1576 return;
1577
86d1407c
JH		 1578 cancel_delayed_work(&smp->security_timer);
1579
d6268e86 1580 smp_distribute_keys(smp);
44f1a7ab
JH		 1581}
1582
70db83c4
JH		 1583static void smp_ready_cb(struct l2cap_chan *chan)
1584{
1585 struct l2cap_conn *conn = chan->conn;
1586
1587 BT_DBG("chan %p", chan);
1588
1589 conn->smp = chan;
1590 l2cap_chan_hold(chan);
1591}
1592
4befb867
JH		 1593static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1594{
1595 int err;
1596
1597 BT_DBG("chan %p", chan);
1598
1599 err = smp_sig_channel(chan, skb);
1600 if (err) {
b68fda68 1601 struct smp_chan *smp = chan->data;
4befb867 1602
b68fda68
JH		 1603 if (smp)
1604 cancel_delayed_work_sync(&smp->security_timer);
4befb867 1605
1e91c29e 1606 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
4befb867
JH		 1607 }
1608
1609 return err;
1610}
1611
70db83c4
JH		 1612static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1613 unsigned long hdr_len,
1614 unsigned long len, int nb)
1615{
1616 struct sk_buff *skb;
1617
1618 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1619 if (!skb)
1620 return ERR_PTR(-ENOMEM);
1621
1622 skb->priority = HCI_PRIO_MAX;
1623 bt_cb(skb)->chan = chan;
1624
1625 return skb;
1626}
1627
1628static const struct l2cap_ops smp_chan_ops = {
1629 .name = "Security Manager",
1630 .ready = smp_ready_cb,
5d88cc73 1631 .recv = smp_recv_cb,
70db83c4
JH		 1632 .alloc_skb = smp_alloc_skb_cb,
1633 .teardown = smp_teardown_cb,
44f1a7ab 1634 .resume = smp_resume_cb,
70db83c4
JH		 1635
1636 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1637 .state_change = l2cap_chan_no_state_change,
1638 .close = l2cap_chan_no_close,
1639 .defer = l2cap_chan_no_defer,
1640 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1641 .set_shutdown = l2cap_chan_no_set_shutdown,
1642 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1643 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1644};
1645
1646static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1647{
1648 struct l2cap_chan *chan;
1649
1650 BT_DBG("pchan %p", pchan);
1651
1652 chan = l2cap_chan_create();
1653 if (!chan)
1654 return NULL;
1655
1656 chan->chan_type = pchan->chan_type;
1657 chan->ops = &smp_chan_ops;
1658 chan->scid = pchan->scid;
1659 chan->dcid = chan->scid;
1660 chan->imtu = pchan->imtu;
1661 chan->omtu = pchan->omtu;
1662 chan->mode = pchan->mode;
1663
abe84903
JH		 1664 /* Other L2CAP channels may request SMP routines in order to
1665 * change the security level. This means that the SMP channel
1666 * lock must be considered in its own category to avoid lockdep
1667 * warnings.
1668 */
1669 atomic_set(&chan->nesting, L2CAP_NESTING_SMP);
1670
70db83c4
JH		 1671 BT_DBG("created chan %p", chan);
1672
1673 return chan;
1674}
1675
1676static const struct l2cap_ops smp_root_chan_ops = {
1677 .name = "Security Manager Root",
1678 .new_connection = smp_new_conn_cb,
1679
1680 /* None of these are implemented for the root channel */
1681 .close = l2cap_chan_no_close,
1682 .alloc_skb = l2cap_chan_no_alloc_skb,
1683 .recv = l2cap_chan_no_recv,
1684 .state_change = l2cap_chan_no_state_change,
1685 .teardown = l2cap_chan_no_teardown,
1686 .ready = l2cap_chan_no_ready,
1687 .defer = l2cap_chan_no_defer,
1688 .suspend = l2cap_chan_no_suspend,
1689 .resume = l2cap_chan_no_resume,
1690 .set_shutdown = l2cap_chan_no_set_shutdown,
1691 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1692 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1693};
1694
711eafe3
JH		 1695int smp_register(struct hci_dev *hdev)
1696{
70db83c4 1697 struct l2cap_chan *chan;
defce9e8 1698 struct crypto_blkcipher *tfm_aes;
70db83c4 1699
711eafe3
JH		 1700 BT_DBG("%s", hdev->name);
1701
adae20cb 1702 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, 0);
defce9e8
JH		 1703 if (IS_ERR(tfm_aes)) {
1704 int err = PTR_ERR(tfm_aes);
711eafe3 1705 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1706 return err;
1707 }
1708
70db83c4
JH		 1709 chan = l2cap_chan_create();
1710 if (!chan) {
defce9e8 1711 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1712 return -ENOMEM;
1713 }
1714
defce9e8
JH		 1715 chan->data = tfm_aes;
1716
5d88cc73 1717 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1718
1719 l2cap_chan_set_defaults(chan);
1720
1721 bacpy(&chan->src, &hdev->bdaddr);
1722 chan->src_type = BDADDR_LE_PUBLIC;
1723 chan->state = BT_LISTEN;
1724 chan->mode = L2CAP_MODE_BASIC;
1725 chan->imtu = L2CAP_DEFAULT_MTU;
1726 chan->ops = &smp_root_chan_ops;
1727
abe84903
JH		 1728 /* Set correct nesting level for a parent/listening channel */
1729 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
1730
70db83c4
JH		 1731 hdev->smp_data = chan;
1732
711eafe3
JH		 1733 return 0;
1734}
1735
1736void smp_unregister(struct hci_dev *hdev)
1737{
70db83c4 1738 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1739 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1740
1741 if (!chan)
1742 return;
1743
1744 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1745
defce9e8
JH		 1746 tfm_aes = chan->data;
1747 if (tfm_aes) {
1748 chan->data = NULL;
1749 crypto_free_blkcipher(tfm_aes);
711eafe3 1750 }
70db83c4
JH		 1751
1752 hdev->smp_data = NULL;
1753 l2cap_chan_put(chan);
711eafe3 1754}
Linux kernel - Deliverables
This page took 0.42653 seconds and 5 git commands to generate.