projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Update smp_random to return a response code
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
4bc58f51
JH		 38#define SMP_FLAG_TK_VALID 1
39#define SMP_FLAG_CFM_PENDING 2
40#define SMP_FLAG_MITM_AUTH 3
41#define SMP_FLAG_COMPLETE 4
42#define SMP_FLAG_INITIATOR 5
43
44struct smp_chan {
45 struct l2cap_conn *conn;
46 u8 preq[7]; /* SMP Pairing Request */
47 u8 prsp[7]; /* SMP Pairing Response */
48 u8 prnd[16]; /* SMP Pairing Random (local) */
49 u8 rrnd[16]; /* SMP Pairing Random (remote) */
50 u8 pcnf[16]; /* SMP Pairing Confirm */
51 u8 tk[16]; /* SMP Temporary Key */
52 u8 enc_key_size;
53 u8 remote_key_dist;
54 bdaddr_t id_addr;
55 u8 id_addr_type;
56 u8 irk[16];
57 struct smp_csrk *csrk;
58 struct smp_csrk *slave_csrk;
59 struct smp_ltk *ltk;
60 struct smp_ltk *slave_ltk;
61 struct smp_irk *remote_irk;
4a74d658 62 unsigned long flags;
4bc58f51
JH		 63};
64
66bed1a2 65static inline void swap128(const u8 src[16], u8 dst[16])
d22ef0bc
AB		 66{
67 int i;
68 for (i = 0; i < 16; i++)
69 dst[15 - i] = src[i];
70}
71
66bed1a2 72static inline void swap56(const u8 src[7], u8 dst[7])
d22ef0bc
AB		 73{
74 int i;
75 for (i = 0; i < 7; i++)
76 dst[6 - i] = src[i];
77}
78
79static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
80{
81 struct blkcipher_desc desc;
82 struct scatterlist sg;
943a732a 83 uint8_t tmp[16], data[16];
201a5929 84 int err;
d22ef0bc
AB		 85
86 if (tfm == NULL) {
87 BT_ERR("tfm %p", tfm);
88 return -EINVAL;
89 }
90
91 desc.tfm = tfm;
92 desc.flags = 0;
93
943a732a
JH		 94 /* The most significant octet of key corresponds to k[0] */
95 swap128(k, tmp);
96
97 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 98 if (err) {
99 BT_ERR("cipher setkey failed: %d", err);
100 return err;
101 }
102
943a732a
JH		 103 /* Most significant octet of plaintextData corresponds to data[0] */
104 swap128(r, data);
105
106 sg_init_one(&sg, data, 16);
d22ef0bc 107
d22ef0bc
AB		 108 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
109 if (err)
110 BT_ERR("Encrypt data error %d", err);
111
943a732a
JH		 112 /* Most significant octet of encryptedData corresponds to data[0] */
113 swap128(data, r);
114
d22ef0bc
AB		 115 return err;
116}
117
60478054
JH		 118static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
119{
943a732a 120 u8 _res[16];
60478054
JH		 121 int err;
122
123 /* r' = padding || r */
943a732a
JH		 124 memcpy(_res, r, 3);
125 memset(_res + 3, 0, 13);
60478054 126
943a732a 127 err = smp_e(tfm, irk, _res);
60478054
JH		 128 if (err) {
129 BT_ERR("Encrypt error");
130 return err;
131 }
132
133 /* The output of the random address function ah is:
134 * ah(h, r) = e(k, r') mod 2^24
135 * The output of the security function e is then truncated to 24 bits
136 * by taking the least significant 24 bits of the output of e as the
137 * result of ah.
138 */
943a732a 139 memcpy(res, _res, 3);
60478054
JH		 140
141 return 0;
142}
143
144bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
145 bdaddr_t *bdaddr)
146{
147 u8 hash[3];
148 int err;
149
150 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
151
152 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
153 if (err)
154 return false;
155
156 return !memcmp(bdaddr->b, hash, 3);
157}
158
b1e2b3ae
JH		 159int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
160{
161 int err;
162
163 get_random_bytes(&rpa->b[3], 3);
164
165 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
166 rpa->b[5] |= 0x40; /* Set second most significant bit */
167
168 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
169 if (err < 0)
170 return err;
171
172 BT_DBG("RPA %pMR", rpa);
173
174 return 0;
175}
176
d22ef0bc 177static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 178 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
179 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 180{
181 u8 p1[16], p2[16];
182 int err;
183
184 memset(p1, 0, 16);
185
186 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 187 p1[0] = _iat;
188 p1[1] = _rat;
189 memcpy(p1 + 2, preq, 7);
190 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 191
192 /* p2 = padding || ia || ra */
943a732a
JH		 193 memcpy(p2, ra, 6);
194 memcpy(p2 + 6, ia, 6);
195 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 196
197 /* res = r XOR p1 */
198 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
199
200 /* res = e(k, res) */
201 err = smp_e(tfm, k, res);
202 if (err) {
203 BT_ERR("Encrypt data error");
204 return err;
205 }
206
207 /* res = res XOR p2 */
208 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
209
210 /* res = e(k, res) */
211 err = smp_e(tfm, k, res);
212 if (err)
213 BT_ERR("Encrypt data error");
214
215 return err;
216}
217
f1560463
MH		 218static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
219 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 220{
221 int err;
222
223 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 224 memcpy(_r, r2, 8);
225 memcpy(_r + 8, r1, 8);
d22ef0bc
AB		 226
227 err = smp_e(tfm, k, _r);
228 if (err)
229 BT_ERR("Encrypt data error");
230
231 return err;
232}
233
eb492e01 234static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 235 u16 dlen, void *data)
eb492e01
AB		 236{
237 struct sk_buff *skb;
238 struct l2cap_hdr *lh;
239 int len;
240
241 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
242
243 if (len > conn->mtu)
244 return NULL;
245
246 skb = bt_skb_alloc(len, GFP_ATOMIC);
247 if (!skb)
248 return NULL;
249
250 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
251 lh->len = cpu_to_le16(sizeof(code) + dlen);
dcf4adbf 252 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 253
254 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
255
256 memcpy(skb_put(skb, dlen), data, dlen);
257
258 return skb;
259}
260
261static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
262{
263 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
264
265 BT_DBG("code 0x%2.2x", code);
266
267 if (!skb)
268 return;
269
73d80deb
LAD		 270 skb->priority = HCI_PRIO_MAX;
271 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 272
6c9d42a1 273 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 274 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 275}
276
2b64d153
BG		 277static __u8 authreq_to_seclevel(__u8 authreq)
278{
279 if (authreq & SMP_AUTH_MITM)
280 return BT_SECURITY_HIGH;
281 else
282 return BT_SECURITY_MEDIUM;
283}
284
285static __u8 seclevel_to_authreq(__u8 sec_level)
286{
287 switch (sec_level) {
288 case BT_SECURITY_HIGH:
289 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
290 case BT_SECURITY_MEDIUM:
291 return SMP_AUTH_BONDING;
292 default:
293 return SMP_AUTH_NONE;
294 }
295}
296
b8e66eac 297static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 298 struct smp_cmd_pairing *req,
299 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 300{
fd349c02
JH		 301 struct smp_chan *smp = conn->smp_chan;
302 struct hci_conn *hcon = conn->hcon;
303 struct hci_dev *hdev = hcon->hdev;
304 u8 local_dist = 0, remote_dist = 0;
54790f73 305
a8b2d5c2 306 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 307 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
308 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 309 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 310 } else {
311 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 312 }
313
fd349c02
JH		 314 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
315 remote_dist |= SMP_DIST_ID_KEY;
316
863efaf2
JH		 317 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
318 local_dist |= SMP_DIST_ID_KEY;
319
54790f73
VCG		 320 if (rsp == NULL) {
321 req->io_capability = conn->hcon->io_capability;
322 req->oob_flag = SMP_OOB_NOT_PRESENT;
323 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 324 req->init_key_dist = local_dist;
325 req->resp_key_dist = remote_dist;
065a13e2 326 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 327
328 smp->remote_key_dist = remote_dist;
54790f73
VCG		 329 return;
330 }
331
332 rsp->io_capability = conn->hcon->io_capability;
333 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
334 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 335 rsp->init_key_dist = req->init_key_dist & remote_dist;
336 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 337 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 338
339 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 340}
341
3158c50c
VCG		 342static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
343{
1c1def09
VCG		 344 struct smp_chan *smp = conn->smp_chan;
345
3158c50c 346 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 347 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 348 return SMP_ENC_KEY_SIZE;
349
f7aa611a 350 smp->enc_key_size = max_key_size;
3158c50c
VCG		 351
352 return 0;
353}
354
84794e11 355static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 356{
bab73cb6
JH		 357 struct hci_conn *hcon = conn->hcon;
358
84794e11 359 if (reason)
4f957a76 360 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 361 &reason);
4f957a76 362
ce39fb4e
MH		 363 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
364 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
365 HCI_ERROR_AUTH_FAILURE);
f1c09c07 366
61a0cfb0
AG		 367 cancel_delayed_work_sync(&conn->security_timer);
368
ce39fb4e 369 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 370 smp_chan_destroy(conn);
4f957a76
BG		 371}
372
2b64d153
BG		 373#define JUST_WORKS 0x00
374#define JUST_CFM 0x01
375#define REQ_PASSKEY 0x02
376#define CFM_PASSKEY 0x03
377#define REQ_OOB 0x04
378#define OVERLAP 0xFF
379
380static const u8 gen_method[5][5] = {
381 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
382 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
383 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
384 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
385 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
386};
387
388static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
389 u8 local_io, u8 remote_io)
390{
391 struct hci_conn *hcon = conn->hcon;
392 struct smp_chan *smp = conn->smp_chan;
393 u8 method;
394 u32 passkey = 0;
395 int ret = 0;
396
397 /* Initialize key for JUST WORKS */
398 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 399 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 400
401 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
402
403 /* If neither side wants MITM, use JUST WORKS */
404 /* If either side has unknown io_caps, use JUST WORKS */
405 /* Otherwise, look up method from the table */
406 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 407 local_io > SMP_IO_KEYBOARD_DISPLAY ||
408 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 409 method = JUST_WORKS;
410 else
b3ff53ff 411 method = gen_method[remote_io][local_io];
2b64d153
BG		 412
413 /* If not bonding, don't ask user to confirm a Zero TK */
414 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
415 method = JUST_WORKS;
416
a82505c7 417 /* Don't confirm locally initiated pairing attempts */
4a74d658 418 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 419 method = JUST_WORKS;
420
2b64d153
BG		 421 /* If Just Works, Continue with Zero TK */
422 if (method == JUST_WORKS) {
4a74d658 423 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 424 return 0;
425 }
426
427 /* Not Just Works/Confirm results in MITM Authentication */
428 if (method != JUST_CFM)
4a74d658 429 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 430
431 /* If both devices have Keyoard-Display I/O, the master
432 * Confirms and the slave Enters the passkey.
433 */
434 if (method == OVERLAP) {
435 if (hcon->link_mode & HCI_LM_MASTER)
436 method = CFM_PASSKEY;
437 else
438 method = REQ_PASSKEY;
439 }
440
01ad34d2 441 /* Generate random passkey. */
2b64d153 442 if (method == CFM_PASSKEY) {
943a732a 443 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 444 get_random_bytes(&passkey, sizeof(passkey));
445 passkey %= 1000000;
943a732a 446 put_unaligned_le32(passkey, smp->tk);
2b64d153 447 BT_DBG("PassKey: %d", passkey);
4a74d658 448 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 449 }
450
451 hci_dev_lock(hcon->hdev);
452
453 if (method == REQ_PASSKEY)
ce39fb4e 454 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 455 hcon->type, hcon->dst_type);
4eb65e66
JH		 456 else if (method == JUST_CFM)
457 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
458 hcon->type, hcon->dst_type,
459 passkey, 1);
2b64d153 460 else
01ad34d2 461 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 462 hcon->type, hcon->dst_type,
39adbffe 463 passkey, 0);
2b64d153
BG		 464
465 hci_dev_unlock(hcon->hdev);
466
467 return ret;
468}
469
9dd4dd27 470static void smp_confirm(struct smp_chan *smp)
8aab4757 471{
8aab4757 472 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 473 struct hci_dev *hdev = conn->hcon->hdev;
474 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 475 struct smp_cmd_pairing_confirm cp;
476 int ret;
943a732a 477 u8 reason;
8aab4757
VCG		 478
479 BT_DBG("conn %p", conn);
480
893ce8b1
JH		 481 /* Prevent mutual access to hdev->tfm_aes */
482 hci_dev_lock(hdev);
8aab4757 483
b1cd5fd9
JH		 484 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
485 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 486 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
487 cp.confirm_val);
893ce8b1
JH		 488
489 hci_dev_unlock(hdev);
490
8aab4757
VCG		 491 if (ret) {
492 reason = SMP_UNSPECIFIED;
493 goto error;
494 }
495
4a74d658 496 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 497
8aab4757
VCG		 498 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
499
500 return;
501
502error:
84794e11 503 smp_failure(conn, reason);
8aab4757
VCG		 504}
505
861580a9 506static u8 smp_random(struct smp_chan *smp)
8aab4757 507{
8aab4757
VCG		 508 struct l2cap_conn *conn = smp->conn;
509 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 510 struct hci_dev *hdev = hcon->hdev;
511 struct crypto_blkcipher *tfm = hdev->tfm_aes;
861580a9 512 u8 confirm[16];
8aab4757
VCG		 513 int ret;
514
861580a9
JH		 515 if (IS_ERR_OR_NULL(tfm))
516 return SMP_UNSPECIFIED;
8aab4757
VCG		 517
518 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
519
893ce8b1
JH		 520 /* Prevent mutual access to hdev->tfm_aes */
521 hci_dev_lock(hdev);
522
b1cd5fd9
JH		 523 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
524 hcon->init_addr_type, &hcon->init_addr,
943a732a 525 hcon->resp_addr_type, &hcon->resp_addr, confirm);
893ce8b1
JH		 526
527 hci_dev_unlock(hdev);
528
861580a9
JH		 529 if (ret)
530 return SMP_UNSPECIFIED;
8aab4757 531
8aab4757
VCG		 532 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
533 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 534 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 535 }
536
537 if (hcon->out) {
fe39c7b2
MH		 538 u8 stk[16];
539 __le64 rand = 0;
540 __le16 ediv = 0;
8aab4757 541
943a732a 542 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 543
f7aa611a 544 memset(stk + smp->enc_key_size, 0,
04124681 545 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 546
861580a9
JH		 547 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
548 return SMP_UNSPECIFIED;
8aab4757
VCG		 549
550 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 551 hcon->enc_key_size = smp->enc_key_size;
8aab4757 552 } else {
943a732a 553 u8 stk[16];
fe39c7b2
MH		 554 __le64 rand = 0;
555 __le16 ediv = 0;
8aab4757 556
943a732a
JH		 557 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
558 smp->prnd);
8aab4757 559
943a732a 560 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 561
f7aa611a 562 memset(stk + smp->enc_key_size, 0,
f1560463 563 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 564
ce39fb4e 565 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 566 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 567 ediv, rand);
8aab4757
VCG		 568 }
569
861580a9 570 return 0;
8aab4757
VCG		 571}
572
573static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
574{
575 struct smp_chan *smp;
576
f1560463 577 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 578 if (!smp)
579 return NULL;
580
8aab4757
VCG		 581 smp->conn = conn;
582 conn->smp_chan = smp;
2b64d153 583 conn->hcon->smp_conn = conn;
8aab4757
VCG		 584
585 hci_conn_hold(conn->hcon);
586
587 return smp;
588}
589
590void smp_chan_destroy(struct l2cap_conn *conn)
591{
c8eb9690 592 struct smp_chan *smp = conn->smp_chan;
f4a407be 593 bool complete;
c8eb9690 594
f1c09c07 595 BUG_ON(!smp);
c8eb9690 596
4a74d658 597 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
f4a407be
JH		 598 mgmt_smp_complete(conn->hcon, complete);
599
7ee4ea36
MH		 600 kfree(smp->csrk);
601 kfree(smp->slave_csrk);
602
759331d7
JH		 603 /* If pairing failed clean up any keys we might have */
604 if (!complete) {
605 if (smp->ltk) {
606 list_del(&smp->ltk->list);
607 kfree(smp->ltk);
608 }
609
610 if (smp->slave_ltk) {
611 list_del(&smp->slave_ltk->list);
612 kfree(smp->slave_ltk);
613 }
614
615 if (smp->remote_irk) {
616 list_del(&smp->remote_irk->list);
617 kfree(smp->remote_irk);
618 }
619 }
620
c8eb9690
BG		 621 kfree(smp);
622 conn->smp_chan = NULL;
2b64d153 623 conn->hcon->smp_conn = NULL;
76a68ba0 624 hci_conn_drop(conn->hcon);
8aab4757
VCG		 625}
626
2b64d153
BG		 627int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
628{
629 struct l2cap_conn *conn = hcon->smp_conn;
630 struct smp_chan *smp;
631 u32 value;
2b64d153
BG		 632
633 BT_DBG("");
634
635 if (!conn)
636 return -ENOTCONN;
637
638 smp = conn->smp_chan;
639
640 switch (mgmt_op) {
641 case MGMT_OP_USER_PASSKEY_REPLY:
642 value = le32_to_cpu(passkey);
943a732a 643 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 644 BT_DBG("PassKey: %d", value);
943a732a 645 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 646 /* Fall Through */
647 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 648 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 649 break;
650 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
651 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 652 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 653 return 0;
654 default:
84794e11 655 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 656 return -EOPNOTSUPP;
657 }
658
659 /* If it is our turn to send Pairing Confirm, do so now */
4a74d658 660 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags))
9dd4dd27 661 smp_confirm(smp);
2b64d153
BG		 662
663 return 0;
664}
665
da85e5e5 666static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 667{
3158c50c 668 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 669 struct smp_chan *smp;
1ef35827 670 u8 key_size, auth;
8aab4757 671 int ret;
88ba43b6
AB		 672
673 BT_DBG("conn %p", conn);
674
c46b98be 675 if (skb->len < sizeof(*req))
38e4a915 676 return SMP_INVALID_PARAMS;
c46b98be 677
2b64d153
BG		 678 if (conn->hcon->link_mode & HCI_LM_MASTER)
679 return SMP_CMD_NOTSUPP;
680
51a8efd7 681 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 682 smp = smp_chan_create(conn);
d08fd0e7
AE		 683 else
684 smp = conn->smp_chan;
8aab4757 685
d08fd0e7
AE		 686 if (!smp)
687 return SMP_UNSPECIFIED;
d26a2345 688
1c1def09
VCG		 689 smp->preq[0] = SMP_CMD_PAIRING_REQ;
690 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 691 skb_pull(skb, sizeof(*req));
88ba43b6 692
2b64d153 693 /* We didn't start the pairing, so match remote */
1ef35827 694 auth = req->auth_req;
da85e5e5 695
fdde0a26
IY		 696 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
697
2b64d153 698 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 699
700 key_size = min(req->max_key_size, rsp.max_key_size);
701 if (check_enc_key_size(conn, key_size))
702 return SMP_ENC_KEY_SIZE;
88ba43b6 703
e84a6b13 704 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 705
1c1def09
VCG		 706 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
707 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 708
3158c50c 709 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 710
2b64d153
BG		 711 /* Request setup of TK */
712 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
713 if (ret)
714 return SMP_UNSPECIFIED;
715
4a74d658 716 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 717
da85e5e5 718 return 0;
88ba43b6
AB		 719}
720
da85e5e5 721static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 722{
3158c50c 723 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 724 struct smp_chan *smp = conn->smp_chan;
2b64d153 725 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 726 int ret;
88ba43b6
AB		 727
728 BT_DBG("conn %p", conn);
729
c46b98be 730 if (skb->len < sizeof(*rsp))
38e4a915 731 return SMP_INVALID_PARAMS;
c46b98be 732
2b64d153
BG		 733 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
734 return SMP_CMD_NOTSUPP;
735
3158c50c
VCG		 736 skb_pull(skb, sizeof(*rsp));
737
1c1def09 738 req = (void *) &smp->preq[1];
da85e5e5 739
3158c50c
VCG		 740 key_size = min(req->max_key_size, rsp->max_key_size);
741 if (check_enc_key_size(conn, key_size))
742 return SMP_ENC_KEY_SIZE;
743
e84a6b13 744 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 745
8aab4757
VCG		 746 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
747 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 748
fdcc4bec
JH		 749 /* Update remote key distribution in case the remote cleared
750 * some bits that we had enabled in our request.
751 */
752 smp->remote_key_dist &= rsp->resp_key_dist;
753
2b64d153 754 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 755 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 756 auth = SMP_AUTH_BONDING;
757
758 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
759
476585ec 760 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 761 if (ret)
762 return SMP_UNSPECIFIED;
763
4a74d658 764 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 765
766 /* Can't compose response until we have been confirmed */
4a74d658 767 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
9dd4dd27 768 smp_confirm(smp);
da85e5e5
VCG		 769
770 return 0;
88ba43b6
AB		 771}
772
da85e5e5 773static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 774{
1c1def09 775 struct smp_chan *smp = conn->smp_chan;
7d24ddcc 776
88ba43b6
AB		 777 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
778
c46b98be 779 if (skb->len < sizeof(smp->pcnf))
38e4a915 780 return SMP_INVALID_PARAMS;
c46b98be 781
1c1def09
VCG		 782 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
783 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 784
943a732a
JH		 785 if (conn->hcon->out)
786 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
787 smp->prnd);
4a74d658 788 else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
9dd4dd27 789 smp_confirm(smp);
943a732a 790 else
4a74d658 791 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 792
793 return 0;
88ba43b6
AB		 794}
795
da85e5e5 796static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 797{
1c1def09 798 struct smp_chan *smp = conn->smp_chan;
7d24ddcc 799
8aab4757 800 BT_DBG("conn %p", conn);
3158c50c 801
c46b98be 802 if (skb->len < sizeof(smp->rrnd))
38e4a915 803 return SMP_INVALID_PARAMS;
c46b98be 804
943a732a 805 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 806 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 807
861580a9 808 return smp_random(smp);
88ba43b6
AB		 809}
810
4dab7864 811static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 812{
c9839a11 813 struct smp_ltk *key;
988c5997
VCG		 814 struct hci_conn *hcon = conn->hcon;
815
98a0b845
JH		 816 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
817 hcon->out);
988c5997
VCG		 818 if (!key)
819 return 0;
820
4dab7864
JH		 821 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
822 return 0;
823
51a8efd7 824 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 825 return 1;
826
c9839a11
VCG		 827 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
828 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 829
830 return 1;
988c5997 831}
f1560463 832
da85e5e5 833static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 834{
835 struct smp_cmd_security_req *rp = (void *) skb->data;
836 struct smp_cmd_pairing cp;
f1cb9af5 837 struct hci_conn *hcon = conn->hcon;
8aab4757 838 struct smp_chan *smp;
88ba43b6
AB		 839
840 BT_DBG("conn %p", conn);
841
c46b98be 842 if (skb->len < sizeof(*rp))
38e4a915 843 return SMP_INVALID_PARAMS;
c46b98be 844
86ca9eac
JH		 845 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
846 return SMP_CMD_NOTSUPP;
847
2b64d153 848 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 849
4dab7864 850 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 851 return 0;
852
51a8efd7 853 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 854 return 0;
f1cb9af5 855
8aab4757 856 smp = smp_chan_create(conn);
d26a2345 857
88ba43b6 858 skb_pull(skb, sizeof(*rp));
88ba43b6 859
da85e5e5 860 memset(&cp, 0, sizeof(cp));
54790f73 861 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 862
1c1def09
VCG		 863 smp->preq[0] = SMP_CMD_PAIRING_REQ;
864 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 865
88ba43b6 866 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 867
4a74d658 868 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 869
da85e5e5 870 return 0;
88ba43b6
AB		 871}
872
ad32a2f5
JH		 873bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
874{
875 if (sec_level == BT_SECURITY_LOW)
876 return true;
877
878 if (hcon->sec_level >= sec_level)
879 return true;
880
881 return false;
882}
883
cc110922 884int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 885{
cc110922 886 struct l2cap_conn *conn = hcon->l2cap_data;
0a66cf20 887 struct smp_chan *smp;
2b64d153 888 __u8 authreq;
eb492e01 889
3a0259bb
VCG		 890 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
891
0a66cf20
JH		 892 /* This may be NULL if there's an unexpected disconnection */
893 if (!conn)
894 return 1;
895
757aee0f 896 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 897 return 1;
898
ad32a2f5 899 if (smp_sufficient_security(hcon, sec_level))
eb492e01 900 return 1;
f1cb9af5 901
988c5997 902 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 903 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 904 goto done;
d26a2345 905
51a8efd7 906 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 907 return 0;
908
8aab4757 909 smp = smp_chan_create(conn);
2b64d153
BG		 910 if (!smp)
911 return 1;
912
913 authreq = seclevel_to_authreq(sec_level);
d26a2345 914
2e233644
JH		 915 /* hcon->auth_type is set by pair_device in mgmt.c. If the MITM
916 * flag is set we should also set it for the SMP request.
917 */
918 if ((hcon->auth_type & 0x01))
919 authreq |= SMP_AUTH_MITM;
920
d26a2345
VCG		 921 if (hcon->link_mode & HCI_LM_MASTER) {
922 struct smp_cmd_pairing cp;
f01ead31 923
2b64d153 924 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 925 smp->preq[0] = SMP_CMD_PAIRING_REQ;
926 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 927
eb492e01
AB		 928 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
929 } else {
930 struct smp_cmd_security_req cp;
2b64d153 931 cp.auth_req = authreq;
eb492e01
AB		 932 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
933 }
934
4a74d658 935 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 936
61b3b2b6 937done:
f1cb9af5 938 hcon->pending_sec_level = sec_level;
f1cb9af5 939
eb492e01
AB		 940 return 0;
941}
942
7034b911
VCG		 943static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
944{
16b90839 945 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 946 struct smp_chan *smp = conn->smp_chan;
16b90839 947
c46b98be
JH		 948 BT_DBG("conn %p", conn);
949
950 if (skb->len < sizeof(*rp))
38e4a915 951 return SMP_INVALID_PARAMS;
c46b98be 952
6131ddc8
JH		 953 /* Ignore this PDU if it wasn't requested */
954 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
955 return 0;
956
16b90839
VCG		 957 skb_pull(skb, sizeof(*rp));
958
1c1def09 959 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 960
7034b911
VCG		 961 return 0;
962}
963
964static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
965{
16b90839 966 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 967 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 968 struct hci_dev *hdev = conn->hcon->hdev;
969 struct hci_conn *hcon = conn->hcon;
23d0e128 970 struct smp_ltk *ltk;
c9839a11 971 u8 authenticated;
16b90839 972
c46b98be
JH		 973 BT_DBG("conn %p", conn);
974
975 if (skb->len < sizeof(*rp))
38e4a915 976 return SMP_INVALID_PARAMS;
c46b98be 977
6131ddc8
JH		 978 /* Ignore this PDU if it wasn't requested */
979 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
980 return 0;
981
9747a9f3
JH		 982 /* Mark the information as received */
983 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
984
16b90839 985 skb_pull(skb, sizeof(*rp));
7034b911 986
c9839a11 987 hci_dev_lock(hdev);
ce39fb4e 988 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 989 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 990 authenticated, smp->tk, smp->enc_key_size,
991 rp->ediv, rp->rand);
992 smp->ltk = ltk;
fd349c02 993 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 994 smp_distribute_keys(conn);
c9839a11 995 hci_dev_unlock(hdev);
7034b911
VCG		 996
997 return 0;
998}
999
fd349c02
JH		 1000static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1001{
1002 struct smp_cmd_ident_info *info = (void *) skb->data;
1003 struct smp_chan *smp = conn->smp_chan;
1004
1005 BT_DBG("");
1006
1007 if (skb->len < sizeof(*info))
38e4a915 1008 return SMP_INVALID_PARAMS;
fd349c02 1009
6131ddc8
JH		 1010 /* Ignore this PDU if it wasn't requested */
1011 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1012 return 0;
1013
fd349c02
JH		 1014 skb_pull(skb, sizeof(*info));
1015
1016 memcpy(smp->irk, info->irk, 16);
1017
1018 return 0;
1019}
1020
1021static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1022 struct sk_buff *skb)
1023{
1024 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
1025 struct smp_chan *smp = conn->smp_chan;
1026 struct hci_conn *hcon = conn->hcon;
1027 bdaddr_t rpa;
1028
1029 BT_DBG("");
1030
1031 if (skb->len < sizeof(*info))
38e4a915 1032 return SMP_INVALID_PARAMS;
fd349c02 1033
6131ddc8
JH		 1034 /* Ignore this PDU if it wasn't requested */
1035 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1036 return 0;
1037
9747a9f3
JH		 1038 /* Mark the information as received */
1039 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1040
fd349c02
JH		 1041 skb_pull(skb, sizeof(*info));
1042
a9a58f86
JH		 1043 /* Strictly speaking the Core Specification (4.1) allows sending
1044 * an empty address which would force us to rely on just the IRK
1045 * as "identity information". However, since such
1046 * implementations are not known of and in order to not over
1047 * complicate our implementation, simply pretend that we never
1048 * received an IRK for such a device.
1049 */
1050 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1051 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1052 smp_distribute_keys(conn);
a9a58f86
JH		 1053 return 0;
1054 }
1055
fd349c02
JH		 1056 bacpy(&smp->id_addr, &info->bdaddr);
1057 smp->id_addr_type = info->addr_type;
1058
1059 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1060 bacpy(&rpa, &hcon->dst);
1061 else
1062 bacpy(&rpa, BDADDR_ANY);
1063
23d0e128
JH		 1064 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1065 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1066
4bd6d38e 1067 smp_distribute_keys(conn);
fd349c02
JH		 1068
1069 return 0;
1070}
1071
7ee4ea36
MH		 1072static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1073{
1074 struct smp_cmd_sign_info *rp = (void *) skb->data;
1075 struct smp_chan *smp = conn->smp_chan;
1076 struct hci_dev *hdev = conn->hcon->hdev;
1077 struct smp_csrk *csrk;
1078
1079 BT_DBG("conn %p", conn);
1080
1081 if (skb->len < sizeof(*rp))
38e4a915 1082 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1083
1084 /* Ignore this PDU if it wasn't requested */
1085 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1086 return 0;
1087
1088 /* Mark the information as received */
1089 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1090
1091 skb_pull(skb, sizeof(*rp));
1092
1093 hci_dev_lock(hdev);
1094 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1095 if (csrk) {
1096 csrk->master = 0x01;
1097 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1098 }
1099 smp->csrk = csrk;
1100 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1101 smp_distribute_keys(conn);
1102 hci_dev_unlock(hdev);
1103
1104 return 0;
1105}
1106
eb492e01
AB		 1107int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1108{
7b9899db 1109 struct hci_conn *hcon = conn->hcon;
92381f5c 1110 __u8 code, reason;
eb492e01
AB		 1111 int err = 0;
1112
7b9899db
MH		 1113 if (hcon->type != LE_LINK) {
1114 kfree_skb(skb);
3432711f 1115 return 0;
7b9899db
MH		 1116 }
1117
92381f5c
MH		 1118 if (skb->len < 1) {
1119 kfree_skb(skb);
1120 return -EILSEQ;
1121 }
1122
06ae3314 1123 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1124 err = -ENOTSUPP;
1125 reason = SMP_PAIRING_NOTSUPP;
1126 goto done;
1127 }
1128
92381f5c 1129 code = skb->data[0];
eb492e01
AB		 1130 skb_pull(skb, sizeof(code));
1131
8cf9fa12
JH		 1132 /*
1133 * The SMP context must be initialized for all other PDUs except
1134 * pairing and security requests. If we get any other PDU when
1135 * not initialized simply disconnect (done if this function
1136 * returns an error).
1137 */
1138 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1139 !conn->smp_chan) {
1140 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1141 kfree_skb(skb);
1142 return -ENOTSUPP;
1143 }
1144
eb492e01
AB		 1145 switch (code) {
1146 case SMP_CMD_PAIRING_REQ:
da85e5e5 1147 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1148 break;
1149
1150 case SMP_CMD_PAIRING_FAIL:
84794e11 1151 smp_failure(conn, 0);
da85e5e5
VCG		 1152 reason = 0;
1153 err = -EPERM;
eb492e01
AB		 1154 break;
1155
1156 case SMP_CMD_PAIRING_RSP:
da85e5e5 1157 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1158 break;
1159
1160 case SMP_CMD_SECURITY_REQ:
da85e5e5 1161 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1162 break;
1163
eb492e01 1164 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1165 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1166 break;
1167
eb492e01 1168 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1169 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1170 break;
1171
eb492e01 1172 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1173 reason = smp_cmd_encrypt_info(conn, skb);
1174 break;
1175
eb492e01 1176 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1177 reason = smp_cmd_master_ident(conn, skb);
1178 break;
1179
eb492e01 1180 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1181 reason = smp_cmd_ident_info(conn, skb);
1182 break;
1183
eb492e01 1184 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1185 reason = smp_cmd_ident_addr_info(conn, skb);
1186 break;
1187
eb492e01 1188 case SMP_CMD_SIGN_INFO:
7ee4ea36 1189 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1190 break;
1191
eb492e01
AB		 1192 default:
1193 BT_DBG("Unknown command code 0x%2.2x", code);
1194
1195 reason = SMP_CMD_NOTSUPP;
eb492e01 1196 err = -EOPNOTSUPP;
3a0259bb 1197 goto done;
eb492e01
AB		 1198 }
1199
3a0259bb
VCG		 1200done:
1201 if (reason)
84794e11 1202 smp_failure(conn, reason);
3a0259bb 1203
eb492e01
AB		 1204 kfree_skb(skb);
1205 return err;
1206}
7034b911 1207
35d70271
JH		 1208static void smp_notify_keys(struct l2cap_conn *conn)
1209{
1210 struct smp_chan *smp = conn->smp_chan;
1211 struct hci_conn *hcon = conn->hcon;
1212 struct hci_dev *hdev = hcon->hdev;
53ac6ab6
MH		 1213 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1214 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1215 bool persistent;
35d70271 1216
61b1a7fb 1217 if (smp->remote_irk) {
95fbac8a 1218 mgmt_new_irk(hdev, smp->remote_irk);
61b1a7fb
JH		 1219 /* Now that user space can be considered to know the
1220 * identity address track the connection based on it
1221 * from now on.
1222 */
1223 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1224 hcon->dst_type = smp->remote_irk->addr_type;
1225 l2cap_conn_update_id_addr(hcon);
1226 }
95fbac8a 1227
53ac6ab6
MH		 1228 /* The LTKs and CSRKs should be persistent only if both sides
1229 * had the bonding bit set in their authentication requests.
1230 */
1231 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
1232
7ee4ea36
MH		 1233 if (smp->csrk) {
1234 smp->csrk->bdaddr_type = hcon->dst_type;
1235 bacpy(&smp->csrk->bdaddr, &hcon->dst);
53ac6ab6 1236 mgmt_new_csrk(hdev, smp->csrk, persistent);
7ee4ea36
MH		 1237 }
1238
1239 if (smp->slave_csrk) {
1240 smp->slave_csrk->bdaddr_type = hcon->dst_type;
1241 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
53ac6ab6 1242 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
7ee4ea36
MH		 1243 }
1244
35d70271
JH		 1245 if (smp->ltk) {
1246 smp->ltk->bdaddr_type = hcon->dst_type;
1247 bacpy(&smp->ltk->bdaddr, &hcon->dst);
53ac6ab6 1248 mgmt_new_ltk(hdev, smp->ltk, persistent);
35d70271
JH		 1249 }
1250
1251 if (smp->slave_ltk) {
1252 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1253 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
53ac6ab6 1254 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
35d70271
JH		 1255 }
1256}
1257
4bd6d38e 1258int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1259{
1260 struct smp_cmd_pairing *req, *rsp;
1c1def09 1261 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1262 struct hci_conn *hcon = conn->hcon;
1263 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1264 __u8 *keydist;
1265
4bd6d38e 1266 BT_DBG("conn %p", conn);
7034b911 1267
524237cb 1268 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1269 return 0;
1270
1c1def09 1271 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1272
1273 /* The responder sends its keys first */
efabba37 1274 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1275 return 0;
1276
1c1def09 1277 req = (void *) &smp->preq[1];
7034b911 1278
524237cb 1279 if (hcon->out) {
7034b911
VCG		 1280 keydist = &rsp->init_key_dist;
1281 *keydist &= req->init_key_dist;
1282 } else {
1283 keydist = &rsp->resp_key_dist;
1284 *keydist &= req->resp_key_dist;
1285 }
1286
7034b911
VCG		 1287 BT_DBG("keydist 0x%x", *keydist);
1288
1289 if (*keydist & SMP_DIST_ENC_KEY) {
1290 struct smp_cmd_encrypt_info enc;
1291 struct smp_cmd_master_ident ident;
23d0e128 1292 struct smp_ltk *ltk;
c9839a11 1293 u8 authenticated;
7034b911 1294 __le16 ediv;
fe39c7b2 1295 __le64 rand;
7034b911
VCG		 1296
1297 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1298 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1299 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1300
1301 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1302
c9839a11 1303 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1304 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271 1305 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1306 smp->enc_key_size, ediv, rand);
23d0e128 1307 smp->slave_ltk = ltk;
16b90839 1308
58115373 1309 ident.ediv = ediv;
fe39c7b2 1310 ident.rand = rand;
7034b911
VCG		 1311
1312 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1313
1314 *keydist &= ~SMP_DIST_ENC_KEY;
1315 }
1316
1317 if (*keydist & SMP_DIST_ID_KEY) {
1318 struct smp_cmd_ident_addr_info addrinfo;
1319 struct smp_cmd_ident_info idinfo;
1320
863efaf2 1321 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1322
1323 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1324
82d4b359
JH		 1325 /* The hci_conn contains the local identity address
1326 * after the connection has been established.
1327 *
1328 * This is true even when the connection has been
1329 * established using a resolvable random address.
1330 */
524237cb 1331 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1332 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1333
1334 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1335 &addrinfo);
7034b911
VCG		 1336
1337 *keydist &= ~SMP_DIST_ID_KEY;
1338 }
1339
1340 if (*keydist & SMP_DIST_SIGN) {
1341 struct smp_cmd_sign_info sign;
7ee4ea36 1342 struct smp_csrk *csrk;
7034b911 1343
7ee4ea36 1344 /* Generate a new random key */
7034b911
VCG		 1345 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1346
7ee4ea36
MH		 1347 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1348 if (csrk) {
1349 csrk->master = 0x00;
1350 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1351 }
1352 smp->slave_csrk = csrk;
1353
7034b911
VCG		 1354 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1355
1356 *keydist &= ~SMP_DIST_SIGN;
1357 }
1358
efabba37
JH		 1359 /* If there are still keys to be received wait for them */
1360 if ((smp->remote_key_dist & 0x07))
1361 return 0;
1362
1d98bf4f
JH		 1363 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1364 cancel_delayed_work_sync(&conn->security_timer);
4a74d658 1365 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1d98bf4f 1366 smp_notify_keys(conn);
efabba37 1367
1d98bf4f 1368 smp_chan_destroy(conn);
d26a2345 1369
7034b911
VCG		 1370 return 0;
1371}
Linux kernel - Deliverables
This page took 0.408372 seconds and 5 git commands to generate.