projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix const declaration for swap function src parameter
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
66bed1a2 38static inline void swap128(const u8 src[16], u8 dst[16])
d22ef0bc
AB		 39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
66bed1a2 45static inline void swap56(const u8 src[7], u8 dst[7])
d22ef0bc
AB		 46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
b1e2b3ae
JH		 127int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
128{
129 int err;
130
131 get_random_bytes(&rpa->b[3], 3);
132
133 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
134 rpa->b[5] |= 0x40; /* Set second most significant bit */
135
136 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
137 if (err < 0)
138 return err;
139
140 BT_DBG("RPA %pMR", rpa);
141
142 return 0;
143}
144
d22ef0bc 145static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 146 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
147 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 148{
149 u8 p1[16], p2[16];
150 int err;
151
152 memset(p1, 0, 16);
153
154 /* p1 = pres || preq || _rat || _iat */
155 swap56(pres, p1);
156 swap56(preq, p1 + 7);
157 p1[14] = _rat;
158 p1[15] = _iat;
159
160 memset(p2, 0, 16);
161
162 /* p2 = padding || ia || ra */
163 baswap((bdaddr_t *) (p2 + 4), ia);
164 baswap((bdaddr_t *) (p2 + 10), ra);
165
166 /* res = r XOR p1 */
167 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
168
169 /* res = e(k, res) */
170 err = smp_e(tfm, k, res);
171 if (err) {
172 BT_ERR("Encrypt data error");
173 return err;
174 }
175
176 /* res = res XOR p2 */
177 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
178
179 /* res = e(k, res) */
180 err = smp_e(tfm, k, res);
181 if (err)
182 BT_ERR("Encrypt data error");
183
184 return err;
185}
186
f1560463
MH		 187static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
188 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 189{
190 int err;
191
192 /* Just least significant octets from r1 and r2 are considered */
193 memcpy(_r, r1 + 8, 8);
194 memcpy(_r + 8, r2 + 8, 8);
195
196 err = smp_e(tfm, k, _r);
197 if (err)
198 BT_ERR("Encrypt data error");
199
200 return err;
201}
202
eb492e01 203static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 204 u16 dlen, void *data)
eb492e01
AB		 205{
206 struct sk_buff *skb;
207 struct l2cap_hdr *lh;
208 int len;
209
210 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
211
212 if (len > conn->mtu)
213 return NULL;
214
215 skb = bt_skb_alloc(len, GFP_ATOMIC);
216 if (!skb)
217 return NULL;
218
219 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
220 lh->len = cpu_to_le16(sizeof(code) + dlen);
dcf4adbf 221 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 222
223 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
224
225 memcpy(skb_put(skb, dlen), data, dlen);
226
227 return skb;
228}
229
230static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
231{
232 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
233
234 BT_DBG("code 0x%2.2x", code);
235
236 if (!skb)
237 return;
238
73d80deb
LAD		 239 skb->priority = HCI_PRIO_MAX;
240 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 241
6c9d42a1 242 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 243 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 244}
245
2b64d153
BG		 246static __u8 authreq_to_seclevel(__u8 authreq)
247{
248 if (authreq & SMP_AUTH_MITM)
249 return BT_SECURITY_HIGH;
250 else
251 return BT_SECURITY_MEDIUM;
252}
253
254static __u8 seclevel_to_authreq(__u8 sec_level)
255{
256 switch (sec_level) {
257 case BT_SECURITY_HIGH:
258 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
259 case BT_SECURITY_MEDIUM:
260 return SMP_AUTH_BONDING;
261 default:
262 return SMP_AUTH_NONE;
263 }
264}
265
b8e66eac 266static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 267 struct smp_cmd_pairing *req,
268 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 269{
fd349c02
JH		 270 struct smp_chan *smp = conn->smp_chan;
271 struct hci_conn *hcon = conn->hcon;
272 struct hci_dev *hdev = hcon->hdev;
273 u8 local_dist = 0, remote_dist = 0;
54790f73 274
a8b2d5c2 275 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 276 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
277 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 278 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 279 } else {
280 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 281 }
282
fd349c02
JH		 283 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
284 remote_dist |= SMP_DIST_ID_KEY;
285
863efaf2
JH		 286 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
287 local_dist |= SMP_DIST_ID_KEY;
288
54790f73
VCG		 289 if (rsp == NULL) {
290 req->io_capability = conn->hcon->io_capability;
291 req->oob_flag = SMP_OOB_NOT_PRESENT;
292 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 293 req->init_key_dist = local_dist;
294 req->resp_key_dist = remote_dist;
065a13e2 295 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 296
297 smp->remote_key_dist = remote_dist;
54790f73
VCG		 298 return;
299 }
300
301 rsp->io_capability = conn->hcon->io_capability;
302 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
303 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 304 rsp->init_key_dist = req->init_key_dist & remote_dist;
305 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 306 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 307
308 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 309}
310
3158c50c
VCG		 311static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
312{
1c1def09
VCG		 313 struct smp_chan *smp = conn->smp_chan;
314
3158c50c 315 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 316 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 317 return SMP_ENC_KEY_SIZE;
318
f7aa611a 319 smp->enc_key_size = max_key_size;
3158c50c
VCG		 320
321 return 0;
322}
323
84794e11 324static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 325{
bab73cb6
JH		 326 struct hci_conn *hcon = conn->hcon;
327
84794e11 328 if (reason)
4f957a76 329 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 330 &reason);
4f957a76 331
ce39fb4e
MH		 332 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
333 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
334 HCI_ERROR_AUTH_FAILURE);
f1c09c07 335
61a0cfb0
AG		 336 cancel_delayed_work_sync(&conn->security_timer);
337
ce39fb4e 338 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 339 smp_chan_destroy(conn);
4f957a76
BG		 340}
341
2b64d153
BG		 342#define JUST_WORKS 0x00
343#define JUST_CFM 0x01
344#define REQ_PASSKEY 0x02
345#define CFM_PASSKEY 0x03
346#define REQ_OOB 0x04
347#define OVERLAP 0xFF
348
349static const u8 gen_method[5][5] = {
350 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
351 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
352 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
353 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
354 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
355};
356
357static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
358 u8 local_io, u8 remote_io)
359{
360 struct hci_conn *hcon = conn->hcon;
361 struct smp_chan *smp = conn->smp_chan;
362 u8 method;
363 u32 passkey = 0;
364 int ret = 0;
365
366 /* Initialize key for JUST WORKS */
367 memset(smp->tk, 0, sizeof(smp->tk));
368 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
369
370 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
371
372 /* If neither side wants MITM, use JUST WORKS */
373 /* If either side has unknown io_caps, use JUST WORKS */
374 /* Otherwise, look up method from the table */
375 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 376 local_io > SMP_IO_KEYBOARD_DISPLAY ||
377 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 378 method = JUST_WORKS;
379 else
b3ff53ff 380 method = gen_method[remote_io][local_io];
2b64d153
BG		 381
382 /* If not bonding, don't ask user to confirm a Zero TK */
383 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
384 method = JUST_WORKS;
385
386 /* If Just Works, Continue with Zero TK */
387 if (method == JUST_WORKS) {
388 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
389 return 0;
390 }
391
392 /* Not Just Works/Confirm results in MITM Authentication */
393 if (method != JUST_CFM)
394 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
395
396 /* If both devices have Keyoard-Display I/O, the master
397 * Confirms and the slave Enters the passkey.
398 */
399 if (method == OVERLAP) {
400 if (hcon->link_mode & HCI_LM_MASTER)
401 method = CFM_PASSKEY;
402 else
403 method = REQ_PASSKEY;
404 }
405
406 /* Generate random passkey. Not valid until confirmed. */
407 if (method == CFM_PASSKEY) {
408 u8 key[16];
409
410 memset(key, 0, sizeof(key));
411 get_random_bytes(&passkey, sizeof(passkey));
412 passkey %= 1000000;
413 put_unaligned_le32(passkey, key);
414 swap128(key, smp->tk);
415 BT_DBG("PassKey: %d", passkey);
416 }
417
418 hci_dev_lock(hcon->hdev);
419
420 if (method == REQ_PASSKEY)
ce39fb4e 421 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 422 hcon->type, hcon->dst_type);
2b64d153 423 else
ce39fb4e 424 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 425 hcon->type, hcon->dst_type,
2b64d153
BG		 426 cpu_to_le32(passkey), 0);
427
428 hci_dev_unlock(hcon->hdev);
429
430 return ret;
431}
432
8aab4757
VCG		 433static void confirm_work(struct work_struct *work)
434{
435 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
436 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 437 struct hci_dev *hdev = conn->hcon->hdev;
438 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 439 struct smp_cmd_pairing_confirm cp;
440 int ret;
441 u8 res[16], reason;
442
443 BT_DBG("conn %p", conn);
444
893ce8b1
JH		 445 /* Prevent mutual access to hdev->tfm_aes */
446 hci_dev_lock(hdev);
8aab4757 447
b1cd5fd9
JH		 448 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
449 conn->hcon->init_addr_type, &conn->hcon->init_addr,
450 conn->hcon->resp_addr_type, &conn->hcon->resp_addr, res);
893ce8b1
JH		 451
452 hci_dev_unlock(hdev);
453
8aab4757
VCG		 454 if (ret) {
455 reason = SMP_UNSPECIFIED;
456 goto error;
457 }
458
2b64d153
BG		 459 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
460
8aab4757
VCG		 461 swap128(res, cp.confirm_val);
462 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
463
464 return;
465
466error:
84794e11 467 smp_failure(conn, reason);
8aab4757
VCG		 468}
469
470static void random_work(struct work_struct *work)
471{
472 struct smp_chan *smp = container_of(work, struct smp_chan, random);
473 struct l2cap_conn *conn = smp->conn;
474 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 475 struct hci_dev *hdev = hcon->hdev;
476 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 477 u8 reason, confirm[16], res[16], key[16];
478 int ret;
479
480 if (IS_ERR_OR_NULL(tfm)) {
481 reason = SMP_UNSPECIFIED;
482 goto error;
483 }
484
485 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
486
893ce8b1
JH		 487 /* Prevent mutual access to hdev->tfm_aes */
488 hci_dev_lock(hdev);
489
b1cd5fd9
JH		 490 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
491 hcon->init_addr_type, &hcon->init_addr,
492 hcon->resp_addr_type, &hcon->resp_addr, res);
893ce8b1
JH		 493
494 hci_dev_unlock(hdev);
495
8aab4757
VCG		 496 if (ret) {
497 reason = SMP_UNSPECIFIED;
498 goto error;
499 }
500
501 swap128(res, confirm);
502
503 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
504 BT_ERR("Pairing failed (confirmation values mismatch)");
505 reason = SMP_CONFIRM_FAILED;
506 goto error;
507 }
508
509 if (hcon->out) {
fe39c7b2
MH		 510 u8 stk[16];
511 __le64 rand = 0;
512 __le16 ediv = 0;
8aab4757
VCG		 513
514 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
515 swap128(key, stk);
516
f7aa611a 517 memset(stk + smp->enc_key_size, 0,
04124681 518 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 519
51a8efd7 520 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 521 reason = SMP_UNSPECIFIED;
522 goto error;
523 }
524
525 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 526 hcon->enc_key_size = smp->enc_key_size;
8aab4757 527 } else {
fe39c7b2
MH		 528 u8 stk[16], r[16];
529 __le64 rand = 0;
530 __le16 ediv = 0;
8aab4757
VCG		 531
532 swap128(smp->prnd, r);
533 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
534
535 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
536 swap128(key, stk);
537
f7aa611a 538 memset(stk + smp->enc_key_size, 0,
f1560463 539 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 540
ce39fb4e 541 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 542 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 543 ediv, rand);
8aab4757
VCG		 544 }
545
546 return;
547
548error:
84794e11 549 smp_failure(conn, reason);
8aab4757
VCG		 550}
551
e3098be4
JH		 552static void smp_reencrypt(struct work_struct *work)
553{
554 struct smp_chan *smp = container_of(work, struct smp_chan,
555 reencrypt.work);
556 struct l2cap_conn *conn = smp->conn;
557 struct hci_conn *hcon = conn->hcon;
558 struct smp_ltk *ltk = smp->ltk;
559
560 BT_DBG("");
561
562 hci_le_start_enc(hcon, ltk->ediv, ltk->rand, ltk->val);
563 hcon->enc_key_size = ltk->enc_size;
564}
565
8aab4757
VCG		 566static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
567{
568 struct smp_chan *smp;
569
f1560463 570 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 571 if (!smp)
572 return NULL;
573
574 INIT_WORK(&smp->confirm, confirm_work);
575 INIT_WORK(&smp->random, random_work);
e3098be4 576 INIT_DELAYED_WORK(&smp->reencrypt, smp_reencrypt);
8aab4757
VCG		 577
578 smp->conn = conn;
579 conn->smp_chan = smp;
2b64d153 580 conn->hcon->smp_conn = conn;
8aab4757
VCG		 581
582 hci_conn_hold(conn->hcon);
583
584 return smp;
585}
586
587void smp_chan_destroy(struct l2cap_conn *conn)
588{
c8eb9690 589 struct smp_chan *smp = conn->smp_chan;
f4a407be 590 bool complete;
c8eb9690 591
f1c09c07 592 BUG_ON(!smp);
c8eb9690 593
e3098be4
JH		 594 cancel_delayed_work_sync(&smp->reencrypt);
595
f4a407be
JH		 596 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
597 mgmt_smp_complete(conn->hcon, complete);
598
7ee4ea36
MH		 599 kfree(smp->csrk);
600 kfree(smp->slave_csrk);
601
759331d7
JH		 602 /* If pairing failed clean up any keys we might have */
603 if (!complete) {
604 if (smp->ltk) {
605 list_del(&smp->ltk->list);
606 kfree(smp->ltk);
607 }
608
609 if (smp->slave_ltk) {
610 list_del(&smp->slave_ltk->list);
611 kfree(smp->slave_ltk);
612 }
613
614 if (smp->remote_irk) {
615 list_del(&smp->remote_irk->list);
616 kfree(smp->remote_irk);
617 }
618 }
619
c8eb9690
BG		 620 kfree(smp);
621 conn->smp_chan = NULL;
2b64d153 622 conn->hcon->smp_conn = NULL;
76a68ba0 623 hci_conn_drop(conn->hcon);
8aab4757
VCG		 624}
625
2b64d153
BG		 626int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
627{
628 struct l2cap_conn *conn = hcon->smp_conn;
629 struct smp_chan *smp;
630 u32 value;
631 u8 key[16];
632
633 BT_DBG("");
634
635 if (!conn)
636 return -ENOTCONN;
637
638 smp = conn->smp_chan;
639
640 switch (mgmt_op) {
641 case MGMT_OP_USER_PASSKEY_REPLY:
642 value = le32_to_cpu(passkey);
643 memset(key, 0, sizeof(key));
644 BT_DBG("PassKey: %d", value);
645 put_unaligned_le32(value, key);
646 swap128(key, smp->tk);
647 /* Fall Through */
648 case MGMT_OP_USER_CONFIRM_REPLY:
649 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
650 break;
651 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
652 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 653 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 654 return 0;
655 default:
84794e11 656 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 657 return -EOPNOTSUPP;
658 }
659
660 /* If it is our turn to send Pairing Confirm, do so now */
661 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
662 queue_work(hcon->hdev->workqueue, &smp->confirm);
663
664 return 0;
665}
666
da85e5e5 667static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 668{
3158c50c 669 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 670 struct smp_chan *smp;
3158c50c 671 u8 key_size;
2b64d153 672 u8 auth = SMP_AUTH_NONE;
8aab4757 673 int ret;
88ba43b6
AB		 674
675 BT_DBG("conn %p", conn);
676
c46b98be
JH		 677 if (skb->len < sizeof(*req))
678 return SMP_UNSPECIFIED;
679
2b64d153
BG		 680 if (conn->hcon->link_mode & HCI_LM_MASTER)
681 return SMP_CMD_NOTSUPP;
682
51a8efd7 683 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 684 smp = smp_chan_create(conn);
d08fd0e7
AE		 685 else
686 smp = conn->smp_chan;
8aab4757 687
d08fd0e7
AE		 688 if (!smp)
689 return SMP_UNSPECIFIED;
d26a2345 690
1c1def09
VCG		 691 smp->preq[0] = SMP_CMD_PAIRING_REQ;
692 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 693 skb_pull(skb, sizeof(*req));
88ba43b6 694
2b64d153
BG		 695 /* We didn't start the pairing, so match remote */
696 if (req->auth_req & SMP_AUTH_BONDING)
697 auth = req->auth_req;
da85e5e5 698
fdde0a26
IY		 699 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
700
2b64d153 701 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 702
703 key_size = min(req->max_key_size, rsp.max_key_size);
704 if (check_enc_key_size(conn, key_size))
705 return SMP_ENC_KEY_SIZE;
88ba43b6 706
e84a6b13 707 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 708
1c1def09
VCG		 709 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
710 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 711
3158c50c 712 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 713
2b64d153
BG		 714 /* Request setup of TK */
715 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
716 if (ret)
717 return SMP_UNSPECIFIED;
718
da85e5e5 719 return 0;
88ba43b6
AB		 720}
721
da85e5e5 722static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 723{
3158c50c 724 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 725 struct smp_chan *smp = conn->smp_chan;
8aab4757 726 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 727 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 728 int ret;
88ba43b6
AB		 729
730 BT_DBG("conn %p", conn);
731
c46b98be
JH		 732 if (skb->len < sizeof(*rsp))
733 return SMP_UNSPECIFIED;
734
2b64d153
BG		 735 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
736 return SMP_CMD_NOTSUPP;
737
3158c50c
VCG		 738 skb_pull(skb, sizeof(*rsp));
739
1c1def09 740 req = (void *) &smp->preq[1];
da85e5e5 741
3158c50c
VCG		 742 key_size = min(req->max_key_size, rsp->max_key_size);
743 if (check_enc_key_size(conn, key_size))
744 return SMP_ENC_KEY_SIZE;
745
e84a6b13 746 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 747
8aab4757
VCG		 748 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
749 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 750
fdcc4bec
JH		 751 /* Update remote key distribution in case the remote cleared
752 * some bits that we had enabled in our request.
753 */
754 smp->remote_key_dist &= rsp->resp_key_dist;
755
2b64d153 756 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 757 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 758 auth = SMP_AUTH_BONDING;
759
760 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
761
476585ec 762 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 763 if (ret)
764 return SMP_UNSPECIFIED;
765
766 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
767
768 /* Can't compose response until we have been confirmed */
769 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
770 return 0;
771
8aab4757 772 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 773
774 return 0;
88ba43b6
AB		 775}
776
da85e5e5 777static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 778{
1c1def09 779 struct smp_chan *smp = conn->smp_chan;
8aab4757 780 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 781
88ba43b6
AB		 782 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
783
c46b98be
JH		 784 if (skb->len < sizeof(smp->pcnf))
785 return SMP_UNSPECIFIED;
786
1c1def09
VCG		 787 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
788 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 789
7d24ddcc
AB		 790 if (conn->hcon->out) {
791 u8 random[16];
88ba43b6 792
1c1def09 793 swap128(smp->prnd, random);
88ba43b6 794 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 795 random);
2b64d153 796 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 797 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 798 } else {
799 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 800 }
da85e5e5
VCG		 801
802 return 0;
88ba43b6
AB		 803}
804
da85e5e5 805static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 806{
1c1def09 807 struct smp_chan *smp = conn->smp_chan;
8aab4757 808 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 809
8aab4757 810 BT_DBG("conn %p", conn);
3158c50c 811
c46b98be
JH		 812 if (skb->len < sizeof(smp->rrnd))
813 return SMP_UNSPECIFIED;
814
8aab4757
VCG		 815 swap128(skb->data, smp->rrnd);
816 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 817
8aab4757 818 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 819
820 return 0;
88ba43b6
AB		 821}
822
4dab7864 823static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 824{
c9839a11 825 struct smp_ltk *key;
988c5997
VCG		 826 struct hci_conn *hcon = conn->hcon;
827
98a0b845
JH		 828 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
829 hcon->out);
988c5997
VCG		 830 if (!key)
831 return 0;
832
4dab7864
JH		 833 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
834 return 0;
835
51a8efd7 836 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 837 return 1;
838
c9839a11
VCG		 839 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
840 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 841
842 return 1;
988c5997 843}
f1560463 844
da85e5e5 845static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 846{
847 struct smp_cmd_security_req *rp = (void *) skb->data;
848 struct smp_cmd_pairing cp;
f1cb9af5 849 struct hci_conn *hcon = conn->hcon;
8aab4757 850 struct smp_chan *smp;
88ba43b6
AB		 851
852 BT_DBG("conn %p", conn);
853
c46b98be
JH		 854 if (skb->len < sizeof(*rp))
855 return SMP_UNSPECIFIED;
856
86ca9eac
JH		 857 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
858 return SMP_CMD_NOTSUPP;
859
2b64d153 860 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 861
4dab7864 862 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 863 return 0;
864
51a8efd7 865 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 866 return 0;
f1cb9af5 867
8aab4757 868 smp = smp_chan_create(conn);
d26a2345 869
88ba43b6 870 skb_pull(skb, sizeof(*rp));
88ba43b6 871
da85e5e5 872 memset(&cp, 0, sizeof(cp));
54790f73 873 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 874
1c1def09
VCG		 875 smp->preq[0] = SMP_CMD_PAIRING_REQ;
876 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 877
88ba43b6 878 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 879
da85e5e5 880 return 0;
88ba43b6
AB		 881}
882
ad32a2f5
JH		 883bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
884{
885 if (sec_level == BT_SECURITY_LOW)
886 return true;
887
888 if (hcon->sec_level >= sec_level)
889 return true;
890
891 return false;
892}
893
cc110922 894int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 895{
cc110922 896 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 897 struct smp_chan *smp = conn->smp_chan;
2b64d153 898 __u8 authreq;
eb492e01 899
3a0259bb
VCG		 900 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
901
757aee0f 902 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 903 return 1;
904
ad32a2f5 905 if (smp_sufficient_security(hcon, sec_level))
eb492e01 906 return 1;
f1cb9af5 907
988c5997 908 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 909 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 910 goto done;
d26a2345 911
51a8efd7 912 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 913 return 0;
914
8aab4757 915 smp = smp_chan_create(conn);
2b64d153
BG		 916 if (!smp)
917 return 1;
918
919 authreq = seclevel_to_authreq(sec_level);
d26a2345 920
d26a2345
VCG		 921 if (hcon->link_mode & HCI_LM_MASTER) {
922 struct smp_cmd_pairing cp;
f01ead31 923
2b64d153 924 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 925 smp->preq[0] = SMP_CMD_PAIRING_REQ;
926 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 927
eb492e01
AB		 928 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
929 } else {
930 struct smp_cmd_security_req cp;
2b64d153 931 cp.auth_req = authreq;
eb492e01
AB		 932 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
933 }
934
02bc7455 935done:
f1cb9af5 936 hcon->pending_sec_level = sec_level;
f1cb9af5 937
eb492e01
AB		 938 return 0;
939}
940
7034b911
VCG		 941static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
942{
16b90839 943 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 944 struct smp_chan *smp = conn->smp_chan;
16b90839 945
c46b98be
JH		 946 BT_DBG("conn %p", conn);
947
948 if (skb->len < sizeof(*rp))
949 return SMP_UNSPECIFIED;
950
6131ddc8
JH		 951 /* Ignore this PDU if it wasn't requested */
952 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
953 return 0;
954
16b90839
VCG		 955 skb_pull(skb, sizeof(*rp));
956
1c1def09 957 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 958
7034b911
VCG		 959 return 0;
960}
961
962static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
963{
16b90839 964 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 965 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 966 struct hci_dev *hdev = conn->hcon->hdev;
967 struct hci_conn *hcon = conn->hcon;
23d0e128 968 struct smp_ltk *ltk;
c9839a11 969 u8 authenticated;
16b90839 970
c46b98be
JH		 971 BT_DBG("conn %p", conn);
972
973 if (skb->len < sizeof(*rp))
974 return SMP_UNSPECIFIED;
975
6131ddc8
JH		 976 /* Ignore this PDU if it wasn't requested */
977 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
978 return 0;
979
9747a9f3
JH		 980 /* Mark the information as received */
981 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
982
16b90839 983 skb_pull(skb, sizeof(*rp));
7034b911 984
c9839a11 985 hci_dev_lock(hdev);
ce39fb4e 986 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 987 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 988 authenticated, smp->tk, smp->enc_key_size,
989 rp->ediv, rp->rand);
990 smp->ltk = ltk;
fd349c02 991 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 992 smp_distribute_keys(conn);
c9839a11 993 hci_dev_unlock(hdev);
7034b911
VCG		 994
995 return 0;
996}
997
fd349c02
JH		 998static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
999{
1000 struct smp_cmd_ident_info *info = (void *) skb->data;
1001 struct smp_chan *smp = conn->smp_chan;
1002
1003 BT_DBG("");
1004
1005 if (skb->len < sizeof(*info))
1006 return SMP_UNSPECIFIED;
1007
6131ddc8
JH		 1008 /* Ignore this PDU if it wasn't requested */
1009 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1010 return 0;
1011
fd349c02
JH		 1012 skb_pull(skb, sizeof(*info));
1013
1014 memcpy(smp->irk, info->irk, 16);
1015
1016 return 0;
1017}
1018
1019static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1020 struct sk_buff *skb)
1021{
1022 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
1023 struct smp_chan *smp = conn->smp_chan;
1024 struct hci_conn *hcon = conn->hcon;
1025 bdaddr_t rpa;
1026
1027 BT_DBG("");
1028
1029 if (skb->len < sizeof(*info))
1030 return SMP_UNSPECIFIED;
1031
6131ddc8
JH		 1032 /* Ignore this PDU if it wasn't requested */
1033 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1034 return 0;
1035
9747a9f3
JH		 1036 /* Mark the information as received */
1037 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1038
fd349c02
JH		 1039 skb_pull(skb, sizeof(*info));
1040
a9a58f86
JH		 1041 /* Strictly speaking the Core Specification (4.1) allows sending
1042 * an empty address which would force us to rely on just the IRK
1043 * as "identity information". However, since such
1044 * implementations are not known of and in order to not over
1045 * complicate our implementation, simply pretend that we never
1046 * received an IRK for such a device.
1047 */
1048 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1049 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1050 smp_distribute_keys(conn);
a9a58f86
JH		 1051 return 0;
1052 }
1053
fd349c02
JH		 1054 bacpy(&smp->id_addr, &info->bdaddr);
1055 smp->id_addr_type = info->addr_type;
1056
1057 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1058 bacpy(&rpa, &hcon->dst);
1059 else
1060 bacpy(&rpa, BDADDR_ANY);
1061
23d0e128
JH		 1062 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1063 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1064
68d6f6de
JH		 1065 /* Track the connection based on the Identity Address from now on */
1066 bacpy(&hcon->dst, &smp->id_addr);
1067 hcon->dst_type = smp->id_addr_type;
1068
387a33e3
JH		 1069 l2cap_conn_update_id_addr(hcon);
1070
4bd6d38e 1071 smp_distribute_keys(conn);
fd349c02
JH		 1072
1073 return 0;
1074}
1075
7ee4ea36
MH		 1076static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1077{
1078 struct smp_cmd_sign_info *rp = (void *) skb->data;
1079 struct smp_chan *smp = conn->smp_chan;
1080 struct hci_dev *hdev = conn->hcon->hdev;
1081 struct smp_csrk *csrk;
1082
1083 BT_DBG("conn %p", conn);
1084
1085 if (skb->len < sizeof(*rp))
1086 return SMP_UNSPECIFIED;
1087
1088 /* Ignore this PDU if it wasn't requested */
1089 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1090 return 0;
1091
1092 /* Mark the information as received */
1093 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1094
1095 skb_pull(skb, sizeof(*rp));
1096
1097 hci_dev_lock(hdev);
1098 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1099 if (csrk) {
1100 csrk->master = 0x01;
1101 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1102 }
1103 smp->csrk = csrk;
1104 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1105 smp_distribute_keys(conn);
1106 hci_dev_unlock(hdev);
1107
1108 return 0;
1109}
1110
eb492e01
AB		 1111int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1112{
7b9899db 1113 struct hci_conn *hcon = conn->hcon;
92381f5c 1114 __u8 code, reason;
eb492e01
AB		 1115 int err = 0;
1116
7b9899db
MH		 1117 if (hcon->type != LE_LINK) {
1118 kfree_skb(skb);
3432711f 1119 return 0;
7b9899db
MH		 1120 }
1121
92381f5c
MH		 1122 if (skb->len < 1) {
1123 kfree_skb(skb);
1124 return -EILSEQ;
1125 }
1126
06ae3314 1127 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1128 err = -ENOTSUPP;
1129 reason = SMP_PAIRING_NOTSUPP;
1130 goto done;
1131 }
1132
92381f5c 1133 code = skb->data[0];
eb492e01
AB		 1134 skb_pull(skb, sizeof(code));
1135
8cf9fa12
JH		 1136 /*
1137 * The SMP context must be initialized for all other PDUs except
1138 * pairing and security requests. If we get any other PDU when
1139 * not initialized simply disconnect (done if this function
1140 * returns an error).
1141 */
1142 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1143 !conn->smp_chan) {
1144 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1145 kfree_skb(skb);
1146 return -ENOTSUPP;
1147 }
1148
eb492e01
AB		 1149 switch (code) {
1150 case SMP_CMD_PAIRING_REQ:
da85e5e5 1151 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1152 break;
1153
1154 case SMP_CMD_PAIRING_FAIL:
84794e11 1155 smp_failure(conn, 0);
da85e5e5
VCG		 1156 reason = 0;
1157 err = -EPERM;
eb492e01
AB		 1158 break;
1159
1160 case SMP_CMD_PAIRING_RSP:
da85e5e5 1161 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1162 break;
1163
1164 case SMP_CMD_SECURITY_REQ:
da85e5e5 1165 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1166 break;
1167
eb492e01 1168 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1169 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1170 break;
1171
eb492e01 1172 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1173 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1174 break;
1175
eb492e01 1176 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1177 reason = smp_cmd_encrypt_info(conn, skb);
1178 break;
1179
eb492e01 1180 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1181 reason = smp_cmd_master_ident(conn, skb);
1182 break;
1183
eb492e01 1184 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1185 reason = smp_cmd_ident_info(conn, skb);
1186 break;
1187
eb492e01 1188 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1189 reason = smp_cmd_ident_addr_info(conn, skb);
1190 break;
1191
eb492e01 1192 case SMP_CMD_SIGN_INFO:
7ee4ea36 1193 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1194 break;
1195
eb492e01
AB		 1196 default:
1197 BT_DBG("Unknown command code 0x%2.2x", code);
1198
1199 reason = SMP_CMD_NOTSUPP;
eb492e01 1200 err = -EOPNOTSUPP;
3a0259bb 1201 goto done;
eb492e01
AB		 1202 }
1203
3a0259bb
VCG		 1204done:
1205 if (reason)
84794e11 1206 smp_failure(conn, reason);
3a0259bb 1207
eb492e01
AB		 1208 kfree_skb(skb);
1209 return err;
1210}
7034b911 1211
35d70271
JH		 1212static void smp_notify_keys(struct l2cap_conn *conn)
1213{
1214 struct smp_chan *smp = conn->smp_chan;
1215 struct hci_conn *hcon = conn->hcon;
1216 struct hci_dev *hdev = hcon->hdev;
53ac6ab6
MH		 1217 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1218 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1219 bool persistent;
35d70271 1220
95fbac8a
JH		 1221 if (smp->remote_irk)
1222 mgmt_new_irk(hdev, smp->remote_irk);
1223
53ac6ab6
MH		 1224 /* The LTKs and CSRKs should be persistent only if both sides
1225 * had the bonding bit set in their authentication requests.
1226 */
1227 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
1228
7ee4ea36
MH		 1229 if (smp->csrk) {
1230 smp->csrk->bdaddr_type = hcon->dst_type;
1231 bacpy(&smp->csrk->bdaddr, &hcon->dst);
53ac6ab6 1232 mgmt_new_csrk(hdev, smp->csrk, persistent);
7ee4ea36
MH		 1233 }
1234
1235 if (smp->slave_csrk) {
1236 smp->slave_csrk->bdaddr_type = hcon->dst_type;
1237 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
53ac6ab6 1238 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
7ee4ea36
MH		 1239 }
1240
35d70271
JH		 1241 if (smp->ltk) {
1242 smp->ltk->bdaddr_type = hcon->dst_type;
1243 bacpy(&smp->ltk->bdaddr, &hcon->dst);
53ac6ab6 1244 mgmt_new_ltk(hdev, smp->ltk, persistent);
35d70271
JH		 1245 }
1246
1247 if (smp->slave_ltk) {
1248 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1249 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
53ac6ab6 1250 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
35d70271
JH		 1251 }
1252}
1253
4bd6d38e 1254int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1255{
1256 struct smp_cmd_pairing *req, *rsp;
1c1def09 1257 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1258 struct hci_conn *hcon = conn->hcon;
1259 struct hci_dev *hdev = hcon->hdev;
38ccdc93 1260 bool ltk_encrypt;
7034b911
VCG		 1261 __u8 *keydist;
1262
4bd6d38e 1263 BT_DBG("conn %p", conn);
7034b911 1264
524237cb 1265 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1266 return 0;
1267
1c1def09 1268 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1269
1270 /* The responder sends its keys first */
efabba37 1271 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1272 return 0;
1273
1c1def09 1274 req = (void *) &smp->preq[1];
7034b911 1275
524237cb 1276 if (hcon->out) {
7034b911
VCG		 1277 keydist = &rsp->init_key_dist;
1278 *keydist &= req->init_key_dist;
1279 } else {
1280 keydist = &rsp->resp_key_dist;
1281 *keydist &= req->resp_key_dist;
1282 }
1283
7034b911
VCG		 1284 BT_DBG("keydist 0x%x", *keydist);
1285
1286 if (*keydist & SMP_DIST_ENC_KEY) {
1287 struct smp_cmd_encrypt_info enc;
1288 struct smp_cmd_master_ident ident;
23d0e128 1289 struct smp_ltk *ltk;
c9839a11 1290 u8 authenticated;
7034b911 1291 __le16 ediv;
fe39c7b2 1292 __le64 rand;
7034b911
VCG		 1293
1294 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1295 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1296 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1297
1298 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1299
c9839a11 1300 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1301 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271 1302 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1303 smp->enc_key_size, ediv, rand);
23d0e128 1304 smp->slave_ltk = ltk;
16b90839 1305
58115373 1306 ident.ediv = ediv;
fe39c7b2 1307 ident.rand = rand;
7034b911
VCG		 1308
1309 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1310
1311 *keydist &= ~SMP_DIST_ENC_KEY;
1312 }
1313
1314 if (*keydist & SMP_DIST_ID_KEY) {
1315 struct smp_cmd_ident_addr_info addrinfo;
1316 struct smp_cmd_ident_info idinfo;
1317
863efaf2 1318 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1319
1320 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1321
82d4b359
JH		 1322 /* The hci_conn contains the local identity address
1323 * after the connection has been established.
1324 *
1325 * This is true even when the connection has been
1326 * established using a resolvable random address.
1327 */
524237cb 1328 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1329 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1330
1331 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1332 &addrinfo);
7034b911
VCG		 1333
1334 *keydist &= ~SMP_DIST_ID_KEY;
1335 }
1336
1337 if (*keydist & SMP_DIST_SIGN) {
1338 struct smp_cmd_sign_info sign;
7ee4ea36 1339 struct smp_csrk *csrk;
7034b911 1340
7ee4ea36 1341 /* Generate a new random key */
7034b911
VCG		 1342 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1343
7ee4ea36
MH		 1344 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1345 if (csrk) {
1346 csrk->master = 0x00;
1347 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1348 }
1349 smp->slave_csrk = csrk;
1350
7034b911
VCG		 1351 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1352
1353 *keydist &= ~SMP_DIST_SIGN;
1354 }
1355
efabba37
JH		 1356 /* If there are still keys to be received wait for them */
1357 if ((smp->remote_key_dist & 0x07))
1358 return 0;
1359
38ccdc93
JH		 1360 /* Check if we should try to re-encrypt the link with the LTK.
1361 * SMP_FLAG_LTK_ENCRYPT flag is used to track whether we've
1362 * already tried this (in which case we shouldn't try again).
1363 *
1364 * The request will trigger an encryption key refresh event
1365 * which will cause a call to auth_cfm and eventually lead to
1366 * l2cap_core.c calling this smp_distribute_keys function again
1367 * and thereby completing the process.
1368 */
1369 if (smp->ltk)
1370 ltk_encrypt = !test_and_set_bit(SMP_FLAG_LTK_ENCRYPT,
1371 &smp->smp_flags);
1372 else
1373 ltk_encrypt = false;
efabba37 1374
38ccdc93
JH		 1375 /* Re-encrypt the link with LTK if possible */
1376 if (ltk_encrypt && hcon->out) {
e3098be4
JH		 1377 queue_delayed_work(hdev->req_workqueue, &smp->reencrypt,
1378 SMP_REENCRYPT_TIMEOUT);
38ccdc93
JH		 1379 } else {
1380 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1381 cancel_delayed_work_sync(&conn->security_timer);
1382 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
1383 smp_notify_keys(conn);
1384 smp_chan_destroy(conn);
1385 }
d26a2345 1386
7034b911
VCG		 1387 return 0;
1388}
Linux kernel - Deliverables
This page took 0.281485 seconds and 5 git commands to generate.