projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add define for key distribution mask
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2 36#define AUTH_REQ_MASK 0x07
88d3a8ac 37#define KEY_DIST_MASK 0x07
065a13e2 38
533e35d4
JH		 39enum {
40 SMP_FLAG_TK_VALID,
41 SMP_FLAG_CFM_PENDING,
42 SMP_FLAG_MITM_AUTH,
43 SMP_FLAG_COMPLETE,
44 SMP_FLAG_INITIATOR,
45};
4bc58f51
JH		 46
47struct smp_chan {
b68fda68
JH		 48 struct l2cap_conn *conn;
49 struct delayed_work security_timer;
50
4bc58f51
JH		 51 u8 preq[7]; /* SMP Pairing Request */
52 u8 prsp[7]; /* SMP Pairing Response */
53 u8 prnd[16]; /* SMP Pairing Random (local) */
54 u8 rrnd[16]; /* SMP Pairing Random (remote) */
55 u8 pcnf[16]; /* SMP Pairing Confirm */
56 u8 tk[16]; /* SMP Temporary Key */
57 u8 enc_key_size;
58 u8 remote_key_dist;
59 bdaddr_t id_addr;
60 u8 id_addr_type;
61 u8 irk[16];
62 struct smp_csrk *csrk;
63 struct smp_csrk *slave_csrk;
64 struct smp_ltk *ltk;
65 struct smp_ltk *slave_ltk;
66 struct smp_irk *remote_irk;
4a74d658 67 unsigned long flags;
6a7bd103
JH		 68
69 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 70};
71
8a2936f4 72static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 73{
8a2936f4 74 size_t i;
d22ef0bc 75
8a2936f4
JH		 76 for (i = 0; i < len; i++)
77 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 78}
79
80static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
81{
82 struct blkcipher_desc desc;
83 struct scatterlist sg;
943a732a 84 uint8_t tmp[16], data[16];
201a5929 85 int err;
d22ef0bc
AB		 86
87 if (tfm == NULL) {
88 BT_ERR("tfm %p", tfm);
89 return -EINVAL;
90 }
91
92 desc.tfm = tfm;
93 desc.flags = 0;
94
943a732a 95 /* The most significant octet of key corresponds to k[0] */
8a2936f4 96 swap_buf(k, tmp, 16);
943a732a
JH		 97
98 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 99 if (err) {
100 BT_ERR("cipher setkey failed: %d", err);
101 return err;
102 }
103
943a732a 104 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 105 swap_buf(r, data, 16);
943a732a
JH		 106
107 sg_init_one(&sg, data, 16);
d22ef0bc 108
d22ef0bc
AB		 109 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
110 if (err)
111 BT_ERR("Encrypt data error %d", err);
112
943a732a 113 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 114 swap_buf(data, r, 16);
943a732a 115
d22ef0bc
AB		 116 return err;
117}
118
60478054
JH		 119static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
120{
943a732a 121 u8 _res[16];
60478054
JH		 122 int err;
123
124 /* r' = padding || r */
943a732a
JH		 125 memcpy(_res, r, 3);
126 memset(_res + 3, 0, 13);
60478054 127
943a732a 128 err = smp_e(tfm, irk, _res);
60478054
JH		 129 if (err) {
130 BT_ERR("Encrypt error");
131 return err;
132 }
133
134 /* The output of the random address function ah is:
135 * ah(h, r) = e(k, r') mod 2^24
136 * The output of the security function e is then truncated to 24 bits
137 * by taking the least significant 24 bits of the output of e as the
138 * result of ah.
139 */
943a732a 140 memcpy(res, _res, 3);
60478054
JH		 141
142 return 0;
143}
144
defce9e8 145bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 146{
defce9e8
JH		 147 struct l2cap_chan *chan = hdev->smp_data;
148 struct crypto_blkcipher *tfm;
60478054
JH		 149 u8 hash[3];
150 int err;
151
defce9e8
JH		 152 if (!chan || !chan->data)
153 return false;
154
155 tfm = chan->data;
156
60478054
JH		 157 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
158
159 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
160 if (err)
161 return false;
162
163 return !memcmp(bdaddr->b, hash, 3);
164}
165
defce9e8 166int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 167{
defce9e8
JH		 168 struct l2cap_chan *chan = hdev->smp_data;
169 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 170 int err;
171
defce9e8
JH		 172 if (!chan || !chan->data)
173 return -EOPNOTSUPP;
174
175 tfm = chan->data;
176
b1e2b3ae
JH		 177 get_random_bytes(&rpa->b[3], 3);
178
179 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
180 rpa->b[5] |= 0x40; /* Set second most significant bit */
181
182 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
183 if (err < 0)
184 return err;
185
186 BT_DBG("RPA %pMR", rpa);
187
188 return 0;
189}
190
ec70f36f
JH		 191static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
192 u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
193 u8 res[16])
d22ef0bc 194{
ec70f36f 195 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 196 u8 p1[16], p2[16];
197 int err;
198
ec70f36f
JH		 199 BT_DBG("%s", hdev->name);
200
d22ef0bc
AB		 201 memset(p1, 0, 16);
202
203 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 204 p1[0] = _iat;
205 p1[1] = _rat;
206 memcpy(p1 + 2, preq, 7);
207 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 208
209 /* p2 = padding || ia || ra */
943a732a
JH		 210 memcpy(p2, ra, 6);
211 memcpy(p2 + 6, ia, 6);
212 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 213
214 /* res = r XOR p1 */
215 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
216
217 /* res = e(k, res) */
ec70f36f 218 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 219 if (err) {
220 BT_ERR("Encrypt data error");
221 return err;
222 }
223
224 /* res = res XOR p2 */
225 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
226
227 /* res = e(k, res) */
ec70f36f 228 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 229 if (err)
230 BT_ERR("Encrypt data error");
231
232 return err;
233}
234
ec70f36f
JH		 235static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
236 u8 _r[16])
d22ef0bc 237{
ec70f36f 238 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 239 int err;
240
ec70f36f
JH		 241 BT_DBG("%s", hdev->name);
242
d22ef0bc 243 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 244 memcpy(_r, r2, 8);
245 memcpy(_r + 8, r1, 8);
d22ef0bc 246
ec70f36f 247 err = smp_e(smp->tfm_aes, k, _r);
d22ef0bc
AB		 248 if (err)
249 BT_ERR("Encrypt data error");
250
251 return err;
252}
253
5d88cc73 254static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 255{
5d88cc73 256 struct l2cap_chan *chan = conn->smp;
b68fda68 257 struct smp_chan *smp;
5d88cc73
JH		 258 struct kvec iv[2];
259 struct msghdr msg;
eb492e01 260
5d88cc73
JH		 261 if (!chan)
262 return;
eb492e01 263
5d88cc73 264 BT_DBG("code 0x%2.2x", code);
eb492e01 265
5d88cc73
JH		 266 iv[0].iov_base = &code;
267 iv[0].iov_len = 1;
eb492e01 268
5d88cc73
JH		 269 iv[1].iov_base = data;
270 iv[1].iov_len = len;
eb492e01 271
5d88cc73 272 memset(&msg, 0, sizeof(msg));
eb492e01 273
5d88cc73
JH		 274 msg.msg_iov = (struct iovec *) &iv;
275 msg.msg_iovlen = 2;
eb492e01 276
5d88cc73 277 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 278
b68fda68
JH		 279 if (!chan->data)
280 return;
281
282 smp = chan->data;
283
284 cancel_delayed_work_sync(&smp->security_timer);
1b0921d6 285 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 286}
287
2b64d153
BG		 288static __u8 authreq_to_seclevel(__u8 authreq)
289{
290 if (authreq & SMP_AUTH_MITM)
291 return BT_SECURITY_HIGH;
292 else
293 return BT_SECURITY_MEDIUM;
294}
295
296static __u8 seclevel_to_authreq(__u8 sec_level)
297{
298 switch (sec_level) {
299 case BT_SECURITY_HIGH:
300 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
301 case BT_SECURITY_MEDIUM:
302 return SMP_AUTH_BONDING;
303 default:
304 return SMP_AUTH_NONE;
305 }
306}
307
b8e66eac 308static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 309 struct smp_cmd_pairing *req,
310 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 311{
5d88cc73
JH		 312 struct l2cap_chan *chan = conn->smp;
313 struct smp_chan *smp = chan->data;
fd349c02
JH		 314 struct hci_conn *hcon = conn->hcon;
315 struct hci_dev *hdev = hcon->hdev;
316 u8 local_dist = 0, remote_dist = 0;
54790f73 317
b6ae8457 318 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 319 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
320 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 321 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 322 } else {
323 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 324 }
325
fd349c02
JH		 326 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
327 remote_dist |= SMP_DIST_ID_KEY;
328
863efaf2
JH		 329 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
330 local_dist |= SMP_DIST_ID_KEY;
331
54790f73
VCG		 332 if (rsp == NULL) {
333 req->io_capability = conn->hcon->io_capability;
334 req->oob_flag = SMP_OOB_NOT_PRESENT;
335 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 336 req->init_key_dist = local_dist;
337 req->resp_key_dist = remote_dist;
065a13e2 338 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 339
340 smp->remote_key_dist = remote_dist;
54790f73
VCG		 341 return;
342 }
343
344 rsp->io_capability = conn->hcon->io_capability;
345 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
346 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 347 rsp->init_key_dist = req->init_key_dist & remote_dist;
348 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 349 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 350
351 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 352}
353
3158c50c
VCG		 354static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
355{
5d88cc73
JH		 356 struct l2cap_chan *chan = conn->smp;
357 struct smp_chan *smp = chan->data;
1c1def09 358
3158c50c 359 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 360 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 361 return SMP_ENC_KEY_SIZE;
362
f7aa611a 363 smp->enc_key_size = max_key_size;
3158c50c
VCG		 364
365 return 0;
366}
367
6f48e260
JH		 368static void smp_chan_destroy(struct l2cap_conn *conn)
369{
370 struct l2cap_chan *chan = conn->smp;
371 struct smp_chan *smp = chan->data;
372 bool complete;
373
374 BUG_ON(!smp);
375
376 cancel_delayed_work_sync(&smp->security_timer);
6f48e260 377
6f48e260
JH		 378 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
379 mgmt_smp_complete(conn->hcon, complete);
380
381 kfree(smp->csrk);
382 kfree(smp->slave_csrk);
383
384 crypto_free_blkcipher(smp->tfm_aes);
385
386 /* If pairing failed clean up any keys we might have */
387 if (!complete) {
388 if (smp->ltk) {
389 list_del(&smp->ltk->list);
390 kfree(smp->ltk);
391 }
392
393 if (smp->slave_ltk) {
394 list_del(&smp->slave_ltk->list);
395 kfree(smp->slave_ltk);
396 }
397
398 if (smp->remote_irk) {
399 list_del(&smp->remote_irk->list);
400 kfree(smp->remote_irk);
401 }
402 }
403
404 chan->data = NULL;
405 kfree(smp);
406 hci_conn_drop(conn->hcon);
407}
408
84794e11 409static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 410{
bab73cb6 411 struct hci_conn *hcon = conn->hcon;
b68fda68 412 struct l2cap_chan *chan = conn->smp;
bab73cb6 413
84794e11 414 if (reason)
4f957a76 415 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 416 &reason);
4f957a76 417
ce39fb4e
MH		 418 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
419 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
420 HCI_ERROR_AUTH_FAILURE);
f1c09c07 421
fc75cc86 422 if (chan->data)
f1c09c07 423 smp_chan_destroy(conn);
4f957a76
BG		 424}
425
2b64d153
BG		 426#define JUST_WORKS 0x00
427#define JUST_CFM 0x01
428#define REQ_PASSKEY 0x02
429#define CFM_PASSKEY 0x03
430#define REQ_OOB 0x04
431#define OVERLAP 0xFF
432
433static const u8 gen_method[5][5] = {
434 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
435 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
436 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
437 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
438 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
439};
440
581370cc
JH		 441static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
442{
2bcd4003
JH		 443 /* If either side has unknown io_caps, use JUST_CFM (which gets
444 * converted later to JUST_WORKS if we're initiators.
445 */
581370cc
JH		 446 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
447 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 448 return JUST_CFM;
581370cc
JH		 449
450 return gen_method[remote_io][local_io];
451}
452
2b64d153
BG		 453static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
454 u8 local_io, u8 remote_io)
455{
456 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 457 struct l2cap_chan *chan = conn->smp;
458 struct smp_chan *smp = chan->data;
2b64d153
BG		 459 u8 method;
460 u32 passkey = 0;
461 int ret = 0;
462
463 /* Initialize key for JUST WORKS */
464 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 465 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 466
467 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
468
2bcd4003
JH		 469 /* If neither side wants MITM, either "just" confirm an incoming
470 * request or use just-works for outgoing ones. The JUST_CFM
471 * will be converted to JUST_WORKS if necessary later in this
472 * function. If either side has MITM look up the method from the
473 * table.
474 */
581370cc 475 if (!(auth & SMP_AUTH_MITM))
2bcd4003 476 method = JUST_CFM;
2b64d153 477 else
581370cc 478 method = get_auth_method(smp, local_io, remote_io);
2b64d153 479
a82505c7 480 /* Don't confirm locally initiated pairing attempts */
4a74d658 481 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 482 method = JUST_WORKS;
483
02f3e254
JH		 484 /* Don't bother user space with no IO capabilities */
485 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
486 method = JUST_WORKS;
487
2b64d153
BG		 488 /* If Just Works, Continue with Zero TK */
489 if (method == JUST_WORKS) {
4a74d658 490 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 491 return 0;
492 }
493
494 /* Not Just Works/Confirm results in MITM Authentication */
495 if (method != JUST_CFM)
4a74d658 496 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 497
498 /* If both devices have Keyoard-Display I/O, the master
499 * Confirms and the slave Enters the passkey.
500 */
501 if (method == OVERLAP) {
40bef302 502 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 503 method = CFM_PASSKEY;
504 else
505 method = REQ_PASSKEY;
506 }
507
01ad34d2 508 /* Generate random passkey. */
2b64d153 509 if (method == CFM_PASSKEY) {
943a732a 510 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 511 get_random_bytes(&passkey, sizeof(passkey));
512 passkey %= 1000000;
943a732a 513 put_unaligned_le32(passkey, smp->tk);
2b64d153 514 BT_DBG("PassKey: %d", passkey);
4a74d658 515 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 516 }
517
518 hci_dev_lock(hcon->hdev);
519
520 if (method == REQ_PASSKEY)
ce39fb4e 521 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 522 hcon->type, hcon->dst_type);
4eb65e66
JH		 523 else if (method == JUST_CFM)
524 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
525 hcon->type, hcon->dst_type,
526 passkey, 1);
2b64d153 527 else
01ad34d2 528 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 529 hcon->type, hcon->dst_type,
39adbffe 530 passkey, 0);
2b64d153
BG		 531
532 hci_dev_unlock(hcon->hdev);
533
534 return ret;
535}
536
1cc61144 537static u8 smp_confirm(struct smp_chan *smp)
8aab4757 538{
8aab4757 539 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 540 struct smp_cmd_pairing_confirm cp;
541 int ret;
8aab4757
VCG		 542
543 BT_DBG("conn %p", conn);
544
ec70f36f 545 ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 546 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 547 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
548 cp.confirm_val);
1cc61144
JH		 549 if (ret)
550 return SMP_UNSPECIFIED;
8aab4757 551
4a74d658 552 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 553
8aab4757
VCG		 554 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
555
1cc61144 556 return 0;
8aab4757
VCG		 557}
558
861580a9 559static u8 smp_random(struct smp_chan *smp)
8aab4757 560{
8aab4757
VCG		 561 struct l2cap_conn *conn = smp->conn;
562 struct hci_conn *hcon = conn->hcon;
861580a9 563 u8 confirm[16];
8aab4757
VCG		 564 int ret;
565
ec70f36f 566 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 567 return SMP_UNSPECIFIED;
8aab4757
VCG		 568
569 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
570
ec70f36f 571 ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 572 hcon->init_addr_type, &hcon->init_addr,
943a732a 573 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 574 if (ret)
575 return SMP_UNSPECIFIED;
8aab4757 576
8aab4757
VCG		 577 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
578 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 579 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 580 }
581
582 if (hcon->out) {
fe39c7b2
MH		 583 u8 stk[16];
584 __le64 rand = 0;
585 __le16 ediv = 0;
8aab4757 586
ec70f36f 587 smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 588
f7aa611a 589 memset(stk + smp->enc_key_size, 0,
04124681 590 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 591
861580a9
JH		 592 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
593 return SMP_UNSPECIFIED;
8aab4757
VCG		 594
595 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 596 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 597 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 598 } else {
fff3490f 599 u8 stk[16], auth;
fe39c7b2
MH		 600 __le64 rand = 0;
601 __le16 ediv = 0;
8aab4757 602
943a732a
JH		 603 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
604 smp->prnd);
8aab4757 605
ec70f36f 606 smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 607
f7aa611a 608 memset(stk + smp->enc_key_size, 0,
f1560463 609 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 610
fff3490f
JH		 611 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
612 auth = 1;
613 else
614 auth = 0;
615
7d5843b7
JH		 616 /* Even though there's no _SLAVE suffix this is the
617 * slave STK we're adding for later lookup (the master
618 * STK never needs to be stored).
619 */
ce39fb4e 620 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 621 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 622 }
623
861580a9 624 return 0;
8aab4757
VCG		 625}
626
44f1a7ab
JH		 627static void smp_notify_keys(struct l2cap_conn *conn)
628{
629 struct l2cap_chan *chan = conn->smp;
630 struct smp_chan *smp = chan->data;
631 struct hci_conn *hcon = conn->hcon;
632 struct hci_dev *hdev = hcon->hdev;
633 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
634 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
635 bool persistent;
636
637 if (smp->remote_irk) {
638 mgmt_new_irk(hdev, smp->remote_irk);
639 /* Now that user space can be considered to know the
640 * identity address track the connection based on it
641 * from now on.
642 */
643 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
644 hcon->dst_type = smp->remote_irk->addr_type;
f3d82d0c 645 queue_work(hdev->workqueue, &conn->id_addr_update_work);
44f1a7ab
JH		 646
647 /* When receiving an indentity resolving key for
648 * a remote device that does not use a resolvable
649 * private address, just remove the key so that
650 * it is possible to use the controller white
651 * list for scanning.
652 *
653 * Userspace will have been told to not store
654 * this key at this point. So it is safe to
655 * just remove it.
656 */
657 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
658 list_del(&smp->remote_irk->list);
659 kfree(smp->remote_irk);
660 smp->remote_irk = NULL;
661 }
662 }
663
664 /* The LTKs and CSRKs should be persistent only if both sides
665 * had the bonding bit set in their authentication requests.
666 */
667 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
668
669 if (smp->csrk) {
670 smp->csrk->bdaddr_type = hcon->dst_type;
671 bacpy(&smp->csrk->bdaddr, &hcon->dst);
672 mgmt_new_csrk(hdev, smp->csrk, persistent);
673 }
674
675 if (smp->slave_csrk) {
676 smp->slave_csrk->bdaddr_type = hcon->dst_type;
677 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
678 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
679 }
680
681 if (smp->ltk) {
682 smp->ltk->bdaddr_type = hcon->dst_type;
683 bacpy(&smp->ltk->bdaddr, &hcon->dst);
684 mgmt_new_ltk(hdev, smp->ltk, persistent);
685 }
686
687 if (smp->slave_ltk) {
688 smp->slave_ltk->bdaddr_type = hcon->dst_type;
689 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
690 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
691 }
692}
693
d6268e86 694static void smp_distribute_keys(struct smp_chan *smp)
44f1a7ab
JH		 695{
696 struct smp_cmd_pairing *req, *rsp;
86d1407c 697 struct l2cap_conn *conn = smp->conn;
44f1a7ab
JH		 698 struct hci_conn *hcon = conn->hcon;
699 struct hci_dev *hdev = hcon->hdev;
700 __u8 *keydist;
701
702 BT_DBG("conn %p", conn);
703
44f1a7ab
JH		 704 rsp = (void *) &smp->prsp[1];
705
706 /* The responder sends its keys first */
88d3a8ac 707 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK))
86d1407c 708 return;
44f1a7ab
JH		 709
710 req = (void *) &smp->preq[1];
711
712 if (hcon->out) {
713 keydist = &rsp->init_key_dist;
714 *keydist &= req->init_key_dist;
715 } else {
716 keydist = &rsp->resp_key_dist;
717 *keydist &= req->resp_key_dist;
718 }
719
720 BT_DBG("keydist 0x%x", *keydist);
721
722 if (*keydist & SMP_DIST_ENC_KEY) {
723 struct smp_cmd_encrypt_info enc;
724 struct smp_cmd_master_ident ident;
725 struct smp_ltk *ltk;
726 u8 authenticated;
727 __le16 ediv;
728 __le64 rand;
729
730 get_random_bytes(enc.ltk, sizeof(enc.ltk));
731 get_random_bytes(&ediv, sizeof(ediv));
732 get_random_bytes(&rand, sizeof(rand));
733
734 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
735
736 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
737 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
738 SMP_LTK_SLAVE, authenticated, enc.ltk,
739 smp->enc_key_size, ediv, rand);
740 smp->slave_ltk = ltk;
741
742 ident.ediv = ediv;
743 ident.rand = rand;
744
745 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
746
747 *keydist &= ~SMP_DIST_ENC_KEY;
748 }
749
750 if (*keydist & SMP_DIST_ID_KEY) {
751 struct smp_cmd_ident_addr_info addrinfo;
752 struct smp_cmd_ident_info idinfo;
753
754 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
755
756 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
757
758 /* The hci_conn contains the local identity address
759 * after the connection has been established.
760 *
761 * This is true even when the connection has been
762 * established using a resolvable random address.
763 */
764 bacpy(&addrinfo.bdaddr, &hcon->src);
765 addrinfo.addr_type = hcon->src_type;
766
767 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
768 &addrinfo);
769
770 *keydist &= ~SMP_DIST_ID_KEY;
771 }
772
773 if (*keydist & SMP_DIST_SIGN) {
774 struct smp_cmd_sign_info sign;
775 struct smp_csrk *csrk;
776
777 /* Generate a new random key */
778 get_random_bytes(sign.csrk, sizeof(sign.csrk));
779
780 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
781 if (csrk) {
782 csrk->master = 0x00;
783 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
784 }
785 smp->slave_csrk = csrk;
786
787 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
788
789 *keydist &= ~SMP_DIST_SIGN;
790 }
791
792 /* If there are still keys to be received wait for them */
88d3a8ac 793 if (smp->remote_key_dist & KEY_DIST_MASK)
86d1407c 794 return;
44f1a7ab 795
44f1a7ab
JH		 796 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
797 smp_notify_keys(conn);
798
799 smp_chan_destroy(conn);
44f1a7ab
JH		 800}
801
b68fda68
JH		 802static void smp_timeout(struct work_struct *work)
803{
804 struct smp_chan *smp = container_of(work, struct smp_chan,
805 security_timer.work);
806 struct l2cap_conn *conn = smp->conn;
807
808 BT_DBG("conn %p", conn);
809
1e91c29e 810 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
b68fda68
JH		 811}
812
8aab4757
VCG		 813static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
814{
5d88cc73 815 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 816 struct smp_chan *smp;
817
f1560463 818 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
fc75cc86 819 if (!smp)
8aab4757
VCG		 820 return NULL;
821
6a7bd103
JH		 822 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
823 if (IS_ERR(smp->tfm_aes)) {
824 BT_ERR("Unable to create ECB crypto context");
825 kfree(smp);
826 return NULL;
827 }
828
8aab4757 829 smp->conn = conn;
5d88cc73 830 chan->data = smp;
8aab4757 831
b68fda68
JH		 832 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
833
8aab4757
VCG		 834 hci_conn_hold(conn->hcon);
835
836 return smp;
837}
838
2b64d153
BG		 839int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
840{
b10e8017 841 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 842 struct l2cap_chan *chan;
2b64d153
BG		 843 struct smp_chan *smp;
844 u32 value;
fc75cc86 845 int err;
2b64d153
BG		 846
847 BT_DBG("");
848
fc75cc86 849 if (!conn)
2b64d153
BG		 850 return -ENOTCONN;
851
5d88cc73
JH		 852 chan = conn->smp;
853 if (!chan)
854 return -ENOTCONN;
855
fc75cc86
JH		 856 l2cap_chan_lock(chan);
857 if (!chan->data) {
858 err = -ENOTCONN;
859 goto unlock;
860 }
861
5d88cc73 862 smp = chan->data;
2b64d153
BG		 863
864 switch (mgmt_op) {
865 case MGMT_OP_USER_PASSKEY_REPLY:
866 value = le32_to_cpu(passkey);
943a732a 867 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 868 BT_DBG("PassKey: %d", value);
943a732a 869 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 870 /* Fall Through */
871 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 872 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 873 break;
874 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
875 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 876 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 877 err = 0;
878 goto unlock;
2b64d153 879 default:
84794e11 880 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 881 err = -EOPNOTSUPP;
882 goto unlock;
2b64d153
BG		 883 }
884
fc75cc86
JH		 885 err = 0;
886
2b64d153 887 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 888 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
889 u8 rsp = smp_confirm(smp);
890 if (rsp)
891 smp_failure(conn, rsp);
892 }
2b64d153 893
fc75cc86
JH		 894unlock:
895 l2cap_chan_unlock(chan);
896 return err;
2b64d153
BG		 897}
898
da85e5e5 899static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 900{
3158c50c 901 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
fc75cc86 902 struct l2cap_chan *chan = conn->smp;
b3c6410b 903 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 904 struct smp_chan *smp;
c7262e71 905 u8 key_size, auth, sec_level;
8aab4757 906 int ret;
88ba43b6
AB		 907
908 BT_DBG("conn %p", conn);
909
c46b98be 910 if (skb->len < sizeof(*req))
38e4a915 911 return SMP_INVALID_PARAMS;
c46b98be 912
40bef302 913 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 914 return SMP_CMD_NOTSUPP;
915
fc75cc86 916 if (!chan->data)
8aab4757 917 smp = smp_chan_create(conn);
fc75cc86 918 else
5d88cc73 919 smp = chan->data;
8aab4757 920
d08fd0e7
AE		 921 if (!smp)
922 return SMP_UNSPECIFIED;
d26a2345 923
b6ae8457 924 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
b3c6410b
JH		 925 (req->auth_req & SMP_AUTH_BONDING))
926 return SMP_PAIRING_NOTSUPP;
927
1c1def09
VCG		 928 smp->preq[0] = SMP_CMD_PAIRING_REQ;
929 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 930 skb_pull(skb, sizeof(*req));
88ba43b6 931
2b64d153 932 /* We didn't start the pairing, so match remote */
1ef35827 933 auth = req->auth_req;
da85e5e5 934
c7262e71
JH		 935 sec_level = authreq_to_seclevel(auth);
936 if (sec_level > conn->hcon->pending_sec_level)
937 conn->hcon->pending_sec_level = sec_level;
fdde0a26 938
2ed8f65c
JH		 939 /* If we need MITM check that it can be acheived */
940 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
941 u8 method;
942
943 method = get_auth_method(smp, conn->hcon->io_capability,
944 req->io_capability);
945 if (method == JUST_WORKS || method == JUST_CFM)
946 return SMP_AUTH_REQUIREMENTS;
947 }
948
2b64d153 949 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 950
951 key_size = min(req->max_key_size, rsp.max_key_size);
952 if (check_enc_key_size(conn, key_size))
953 return SMP_ENC_KEY_SIZE;
88ba43b6 954
e84a6b13 955 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 956
1c1def09
VCG		 957 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
958 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 959
3158c50c 960 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 961
2b64d153
BG		 962 /* Request setup of TK */
963 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
964 if (ret)
965 return SMP_UNSPECIFIED;
966
da85e5e5 967 return 0;
88ba43b6
AB		 968}
969
da85e5e5 970static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 971{
3158c50c 972 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 973 struct l2cap_chan *chan = conn->smp;
974 struct smp_chan *smp = chan->data;
2b64d153 975 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 976 int ret;
88ba43b6
AB		 977
978 BT_DBG("conn %p", conn);
979
c46b98be 980 if (skb->len < sizeof(*rsp))
38e4a915 981 return SMP_INVALID_PARAMS;
c46b98be 982
40bef302 983 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 984 return SMP_CMD_NOTSUPP;
985
3158c50c
VCG		 986 skb_pull(skb, sizeof(*rsp));
987
1c1def09 988 req = (void *) &smp->preq[1];
da85e5e5 989
3158c50c
VCG		 990 key_size = min(req->max_key_size, rsp->max_key_size);
991 if (check_enc_key_size(conn, key_size))
992 return SMP_ENC_KEY_SIZE;
993
2ed8f65c
JH		 994 /* If we need MITM check that it can be acheived */
995 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
996 u8 method;
997
998 method = get_auth_method(smp, req->io_capability,
999 rsp->io_capability);
1000 if (method == JUST_WORKS || method == JUST_CFM)
1001 return SMP_AUTH_REQUIREMENTS;
1002 }
1003
e84a6b13 1004 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1005
8aab4757
VCG		 1006 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1007 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1008
fdcc4bec
JH		 1009 /* Update remote key distribution in case the remote cleared
1010 * some bits that we had enabled in our request.
1011 */
1012 smp->remote_key_dist &= rsp->resp_key_dist;
1013
2b64d153 1014 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 1015 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 1016 auth = SMP_AUTH_BONDING;
1017
1018 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
1019
476585ec 1020 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1021 if (ret)
1022 return SMP_UNSPECIFIED;
1023
4a74d658 1024 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1025
1026 /* Can't compose response until we have been confirmed */
4a74d658 1027 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1028 return smp_confirm(smp);
da85e5e5
VCG		 1029
1030 return 0;
88ba43b6
AB		 1031}
1032
da85e5e5 1033static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1034{
5d88cc73
JH		 1035 struct l2cap_chan *chan = conn->smp;
1036 struct smp_chan *smp = chan->data;
7d24ddcc 1037
88ba43b6
AB		 1038 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1039
c46b98be 1040 if (skb->len < sizeof(smp->pcnf))
38e4a915 1041 return SMP_INVALID_PARAMS;
c46b98be 1042
1c1def09
VCG		 1043 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1044 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1045
943a732a
JH		 1046 if (conn->hcon->out)
1047 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1048 smp->prnd);
4a74d658 1049 else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1050 return smp_confirm(smp);
943a732a 1051 else
4a74d658 1052 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1053
1054 return 0;
88ba43b6
AB		 1055}
1056
da85e5e5 1057static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1058{
5d88cc73
JH		 1059 struct l2cap_chan *chan = conn->smp;
1060 struct smp_chan *smp = chan->data;
7d24ddcc 1061
8aab4757 1062 BT_DBG("conn %p", conn);
3158c50c 1063
c46b98be 1064 if (skb->len < sizeof(smp->rrnd))
38e4a915 1065 return SMP_INVALID_PARAMS;
c46b98be 1066
943a732a 1067 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1068 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1069
861580a9 1070 return smp_random(smp);
88ba43b6
AB		 1071}
1072
f81cd823 1073static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1074{
c9839a11 1075 struct smp_ltk *key;
988c5997
VCG		 1076 struct hci_conn *hcon = conn->hcon;
1077
98a0b845 1078 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1079 hcon->role);
988c5997 1080 if (!key)
f81cd823 1081 return false;
988c5997 1082
4dab7864 1083 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
f81cd823 1084 return false;
4dab7864 1085
51a8efd7 1086 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1087 return true;
988c5997 1088
c9839a11
VCG		 1089 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1090 hcon->enc_key_size = key->enc_size;
988c5997 1091
fe59a05f
JH		 1092 /* We never store STKs for master role, so clear this flag */
1093 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1094
f81cd823 1095 return true;
988c5997 1096}
f1560463 1097
854f4727
JH		 1098bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
1099{
1100 if (sec_level == BT_SECURITY_LOW)
1101 return true;
1102
9ab65d60
JH		 1103 /* If we're encrypted with an STK always claim insufficient
1104 * security. This way we allow the connection to be re-encrypted
1105 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 1106 * security. Only exception is if we don't have an LTK (e.g.
1107 * because of key distribution bits).
9ab65d60 1108 */
b2d5e254
JH		 1109 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
1110 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1111 hcon->role))
9ab65d60
JH		 1112 return false;
1113
854f4727
JH		 1114 if (hcon->sec_level >= sec_level)
1115 return true;
1116
1117 return false;
1118}
1119
da85e5e5 1120static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1121{
1122 struct smp_cmd_security_req *rp = (void *) skb->data;
1123 struct smp_cmd_pairing cp;
f1cb9af5 1124 struct hci_conn *hcon = conn->hcon;
fc75cc86 1125 struct l2cap_chan *chan = conn->smp;
8aab4757 1126 struct smp_chan *smp;
c7262e71 1127 u8 sec_level;
88ba43b6
AB		 1128
1129 BT_DBG("conn %p", conn);
1130
c46b98be 1131 if (skb->len < sizeof(*rp))
38e4a915 1132 return SMP_INVALID_PARAMS;
c46b98be 1133
40bef302 1134 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1135 return SMP_CMD_NOTSUPP;
1136
c7262e71 1137 sec_level = authreq_to_seclevel(rp->auth_req);
854f4727
JH		 1138 if (smp_sufficient_security(hcon, sec_level))
1139 return 0;
1140
c7262e71
JH		 1141 if (sec_level > hcon->pending_sec_level)
1142 hcon->pending_sec_level = sec_level;
feb45eb5 1143
4dab7864 1144 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1145 return 0;
1146
fc75cc86
JH		 1147 /* If SMP is already in progress ignore this request */
1148 if (chan->data)
da85e5e5 1149 return 0;
f1cb9af5 1150
8aab4757 1151 smp = smp_chan_create(conn);
c29d2444
JH		 1152 if (!smp)
1153 return SMP_UNSPECIFIED;
d26a2345 1154
b6ae8457 1155 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
616d55be
JH		 1156 (rp->auth_req & SMP_AUTH_BONDING))
1157 return SMP_PAIRING_NOTSUPP;
1158
88ba43b6 1159 skb_pull(skb, sizeof(*rp));
88ba43b6 1160
da85e5e5 1161 memset(&cp, 0, sizeof(cp));
54790f73 1162 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 1163
1c1def09
VCG		 1164 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1165 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1166
88ba43b6 1167 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 1168
da85e5e5 1169 return 0;
88ba43b6
AB		 1170}
1171
cc110922 1172int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1173{
cc110922 1174 struct l2cap_conn *conn = hcon->l2cap_data;
fc75cc86 1175 struct l2cap_chan *chan = conn->smp;
0a66cf20 1176 struct smp_chan *smp;
2b64d153 1177 __u8 authreq;
fc75cc86 1178 int ret;
eb492e01 1179
3a0259bb
VCG		 1180 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1181
0a66cf20
JH		 1182 /* This may be NULL if there's an unexpected disconnection */
1183 if (!conn)
1184 return 1;
1185
757aee0f 1186 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1187 return 1;
1188
ad32a2f5 1189 if (smp_sufficient_security(hcon, sec_level))
eb492e01 1190 return 1;
f1cb9af5 1191
c7262e71
JH		 1192 if (sec_level > hcon->pending_sec_level)
1193 hcon->pending_sec_level = sec_level;
1194
40bef302 1195 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1196 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1197 return 0;
d26a2345 1198
fc75cc86
JH		 1199 l2cap_chan_lock(chan);
1200
1201 /* If SMP is already in progress ignore this request */
1202 if (chan->data) {
1203 ret = 0;
1204 goto unlock;
1205 }
d26a2345 1206
8aab4757 1207 smp = smp_chan_create(conn);
fc75cc86
JH		 1208 if (!smp) {
1209 ret = 1;
1210 goto unlock;
1211 }
2b64d153
BG		 1212
1213 authreq = seclevel_to_authreq(sec_level);
d26a2345 1214
79897d20
JH		 1215 /* Require MITM if IO Capability allows or the security level
1216 * requires it.
2e233644 1217 */
79897d20 1218 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1219 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1220 authreq |= SMP_AUTH_MITM;
1221
40bef302 1222 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1223 struct smp_cmd_pairing cp;
f01ead31 1224
2b64d153 1225 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1226 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1227 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1228
eb492e01
AB		 1229 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
1230 } else {
1231 struct smp_cmd_security_req cp;
2b64d153 1232 cp.auth_req = authreq;
eb492e01
AB		 1233 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
1234 }
1235
4a74d658 1236 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
fc75cc86 1237 ret = 0;
edca792c 1238
fc75cc86
JH		 1239unlock:
1240 l2cap_chan_unlock(chan);
1241 return ret;
eb492e01
AB		 1242}
1243
7034b911
VCG		 1244static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1245{
16b90839 1246 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1247 struct l2cap_chan *chan = conn->smp;
1248 struct smp_chan *smp = chan->data;
16b90839 1249
c46b98be
JH		 1250 BT_DBG("conn %p", conn);
1251
1252 if (skb->len < sizeof(*rp))
38e4a915 1253 return SMP_INVALID_PARAMS;
c46b98be 1254
6131ddc8
JH		 1255 /* Ignore this PDU if it wasn't requested */
1256 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1257 return 0;
1258
16b90839
VCG		 1259 skb_pull(skb, sizeof(*rp));
1260
1c1def09 1261 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1262
7034b911
VCG		 1263 return 0;
1264}
1265
1266static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1267{
16b90839 1268 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1269 struct l2cap_chan *chan = conn->smp;
1270 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1271 struct hci_dev *hdev = conn->hcon->hdev;
1272 struct hci_conn *hcon = conn->hcon;
23d0e128 1273 struct smp_ltk *ltk;
c9839a11 1274 u8 authenticated;
16b90839 1275
c46b98be
JH		 1276 BT_DBG("conn %p", conn);
1277
1278 if (skb->len < sizeof(*rp))
38e4a915 1279 return SMP_INVALID_PARAMS;
c46b98be 1280
6131ddc8
JH		 1281 /* Ignore this PDU if it wasn't requested */
1282 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1283 return 0;
1284
9747a9f3
JH		 1285 /* Mark the information as received */
1286 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1287
16b90839 1288 skb_pull(skb, sizeof(*rp));
7034b911 1289
c9839a11 1290 hci_dev_lock(hdev);
ce39fb4e 1291 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1292 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1293 authenticated, smp->tk, smp->enc_key_size,
1294 rp->ediv, rp->rand);
1295 smp->ltk = ltk;
fd349c02 1296 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
d6268e86 1297 smp_distribute_keys(smp);
c9839a11 1298 hci_dev_unlock(hdev);
7034b911
VCG		 1299
1300 return 0;
1301}
1302
fd349c02
JH		 1303static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1304{
1305 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1306 struct l2cap_chan *chan = conn->smp;
1307 struct smp_chan *smp = chan->data;
fd349c02
JH		 1308
1309 BT_DBG("");
1310
1311 if (skb->len < sizeof(*info))
38e4a915 1312 return SMP_INVALID_PARAMS;
fd349c02 1313
6131ddc8
JH		 1314 /* Ignore this PDU if it wasn't requested */
1315 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1316 return 0;
1317
fd349c02
JH		 1318 skb_pull(skb, sizeof(*info));
1319
1320 memcpy(smp->irk, info->irk, 16);
1321
1322 return 0;
1323}
1324
1325static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1326 struct sk_buff *skb)
1327{
1328 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1329 struct l2cap_chan *chan = conn->smp;
1330 struct smp_chan *smp = chan->data;
fd349c02
JH		 1331 struct hci_conn *hcon = conn->hcon;
1332 bdaddr_t rpa;
1333
1334 BT_DBG("");
1335
1336 if (skb->len < sizeof(*info))
38e4a915 1337 return SMP_INVALID_PARAMS;
fd349c02 1338
6131ddc8
JH		 1339 /* Ignore this PDU if it wasn't requested */
1340 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1341 return 0;
1342
9747a9f3
JH		 1343 /* Mark the information as received */
1344 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1345
fd349c02
JH		 1346 skb_pull(skb, sizeof(*info));
1347
31dd624e
JH		 1348 hci_dev_lock(hcon->hdev);
1349
a9a58f86
JH		 1350 /* Strictly speaking the Core Specification (4.1) allows sending
1351 * an empty address which would force us to rely on just the IRK
1352 * as "identity information". However, since such
1353 * implementations are not known of and in order to not over
1354 * complicate our implementation, simply pretend that we never
1355 * received an IRK for such a device.
1356 */
1357 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1358 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1359 goto distribute;
a9a58f86
JH		 1360 }
1361
fd349c02
JH		 1362 bacpy(&smp->id_addr, &info->bdaddr);
1363 smp->id_addr_type = info->addr_type;
1364
1365 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1366 bacpy(&rpa, &hcon->dst);
1367 else
1368 bacpy(&rpa, BDADDR_ANY);
1369
23d0e128
JH		 1370 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1371 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1372
31dd624e 1373distribute:
d6268e86 1374 smp_distribute_keys(smp);
fd349c02 1375
31dd624e
JH		 1376 hci_dev_unlock(hcon->hdev);
1377
fd349c02
JH		 1378 return 0;
1379}
1380
7ee4ea36
MH		 1381static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1382{
1383 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1384 struct l2cap_chan *chan = conn->smp;
1385 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1386 struct hci_dev *hdev = conn->hcon->hdev;
1387 struct smp_csrk *csrk;
1388
1389 BT_DBG("conn %p", conn);
1390
1391 if (skb->len < sizeof(*rp))
38e4a915 1392 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1393
1394 /* Ignore this PDU if it wasn't requested */
1395 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1396 return 0;
1397
1398 /* Mark the information as received */
1399 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1400
1401 skb_pull(skb, sizeof(*rp));
1402
1403 hci_dev_lock(hdev);
1404 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1405 if (csrk) {
1406 csrk->master = 0x01;
1407 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1408 }
1409 smp->csrk = csrk;
d6268e86 1410 smp_distribute_keys(smp);
7ee4ea36
MH		 1411 hci_dev_unlock(hdev);
1412
1413 return 0;
1414}
1415
4befb867 1416static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1417{
5d88cc73 1418 struct l2cap_conn *conn = chan->conn;
7b9899db 1419 struct hci_conn *hcon = conn->hcon;
92381f5c 1420 __u8 code, reason;
eb492e01
AB		 1421 int err = 0;
1422
7b9899db
MH		 1423 if (hcon->type != LE_LINK) {
1424 kfree_skb(skb);
3432711f 1425 return 0;
7b9899db
MH		 1426 }
1427
8ae9b984 1428 if (skb->len < 1)
92381f5c 1429 return -EILSEQ;
92381f5c 1430
06ae3314 1431 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1432 reason = SMP_PAIRING_NOTSUPP;
1433 goto done;
1434 }
1435
92381f5c 1436 code = skb->data[0];
eb492e01
AB		 1437 skb_pull(skb, sizeof(code));
1438
8cf9fa12
JH		 1439 /*
1440 * The SMP context must be initialized for all other PDUs except
1441 * pairing and security requests. If we get any other PDU when
1442 * not initialized simply disconnect (done if this function
1443 * returns an error).
1444 */
1445 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
fc75cc86 1446 !chan->data) {
8cf9fa12 1447 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
8ae9b984
JH		 1448 err = -EOPNOTSUPP;
1449 goto done;
8cf9fa12
JH		 1450 }
1451
eb492e01
AB		 1452 switch (code) {
1453 case SMP_CMD_PAIRING_REQ:
da85e5e5 1454 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1455 break;
1456
1457 case SMP_CMD_PAIRING_FAIL:
84794e11 1458 smp_failure(conn, 0);
da85e5e5 1459 err = -EPERM;
eb492e01
AB		 1460 break;
1461
1462 case SMP_CMD_PAIRING_RSP:
da85e5e5 1463 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1464 break;
1465
1466 case SMP_CMD_SECURITY_REQ:
da85e5e5 1467 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1468 break;
1469
eb492e01 1470 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1471 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1472 break;
1473
eb492e01 1474 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1475 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1476 break;
1477
eb492e01 1478 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1479 reason = smp_cmd_encrypt_info(conn, skb);
1480 break;
1481
eb492e01 1482 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1483 reason = smp_cmd_master_ident(conn, skb);
1484 break;
1485
eb492e01 1486 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1487 reason = smp_cmd_ident_info(conn, skb);
1488 break;
1489
eb492e01 1490 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1491 reason = smp_cmd_ident_addr_info(conn, skb);
1492 break;
1493
eb492e01 1494 case SMP_CMD_SIGN_INFO:
7ee4ea36 1495 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1496 break;
1497
eb492e01
AB		 1498 default:
1499 BT_DBG("Unknown command code 0x%2.2x", code);
eb492e01 1500 reason = SMP_CMD_NOTSUPP;
3a0259bb 1501 goto done;
eb492e01
AB		 1502 }
1503
3a0259bb 1504done:
9b7b18ef
JH		 1505 if (!err) {
1506 if (reason)
1507 smp_failure(conn, reason);
8ae9b984 1508 kfree_skb(skb);
9b7b18ef
JH		 1509 }
1510
eb492e01
AB		 1511 return err;
1512}
7034b911 1513
70db83c4
JH		 1514static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1515{
1516 struct l2cap_conn *conn = chan->conn;
1517
1518 BT_DBG("chan %p", chan);
1519
fc75cc86 1520 if (chan->data)
5d88cc73 1521 smp_chan_destroy(conn);
5d88cc73 1522
70db83c4
JH		 1523 conn->smp = NULL;
1524 l2cap_chan_put(chan);
1525}
1526
44f1a7ab
JH		 1527static void smp_resume_cb(struct l2cap_chan *chan)
1528{
b68fda68 1529 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1530 struct l2cap_conn *conn = chan->conn;
1531 struct hci_conn *hcon = conn->hcon;
1532
1533 BT_DBG("chan %p", chan);
1534
86d1407c
JH		 1535 if (!smp)
1536 return;
b68fda68 1537
84bc0db5
JH		 1538 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1539 return;
1540
86d1407c
JH		 1541 cancel_delayed_work(&smp->security_timer);
1542
d6268e86 1543 smp_distribute_keys(smp);
44f1a7ab
JH		 1544}
1545
70db83c4
JH		 1546static void smp_ready_cb(struct l2cap_chan *chan)
1547{
1548 struct l2cap_conn *conn = chan->conn;
1549
1550 BT_DBG("chan %p", chan);
1551
1552 conn->smp = chan;
1553 l2cap_chan_hold(chan);
1554}
1555
4befb867
JH		 1556static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1557{
1558 int err;
1559
1560 BT_DBG("chan %p", chan);
1561
1562 err = smp_sig_channel(chan, skb);
1563 if (err) {
b68fda68 1564 struct smp_chan *smp = chan->data;
4befb867 1565
b68fda68
JH		 1566 if (smp)
1567 cancel_delayed_work_sync(&smp->security_timer);
4befb867 1568
1e91c29e 1569 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
4befb867
JH		 1570 }
1571
1572 return err;
1573}
1574
70db83c4
JH		 1575static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1576 unsigned long hdr_len,
1577 unsigned long len, int nb)
1578{
1579 struct sk_buff *skb;
1580
1581 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1582 if (!skb)
1583 return ERR_PTR(-ENOMEM);
1584
1585 skb->priority = HCI_PRIO_MAX;
1586 bt_cb(skb)->chan = chan;
1587
1588 return skb;
1589}
1590
1591static const struct l2cap_ops smp_chan_ops = {
1592 .name = "Security Manager",
1593 .ready = smp_ready_cb,
5d88cc73 1594 .recv = smp_recv_cb,
70db83c4
JH		 1595 .alloc_skb = smp_alloc_skb_cb,
1596 .teardown = smp_teardown_cb,
44f1a7ab 1597 .resume = smp_resume_cb,
70db83c4
JH		 1598
1599 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1600 .state_change = l2cap_chan_no_state_change,
1601 .close = l2cap_chan_no_close,
1602 .defer = l2cap_chan_no_defer,
1603 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1604 .set_shutdown = l2cap_chan_no_set_shutdown,
1605 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1606 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1607};
1608
1609static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1610{
1611 struct l2cap_chan *chan;
1612
1613 BT_DBG("pchan %p", pchan);
1614
1615 chan = l2cap_chan_create();
1616 if (!chan)
1617 return NULL;
1618
1619 chan->chan_type = pchan->chan_type;
1620 chan->ops = &smp_chan_ops;
1621 chan->scid = pchan->scid;
1622 chan->dcid = chan->scid;
1623 chan->imtu = pchan->imtu;
1624 chan->omtu = pchan->omtu;
1625 chan->mode = pchan->mode;
1626
1627 BT_DBG("created chan %p", chan);
1628
1629 return chan;
1630}
1631
1632static const struct l2cap_ops smp_root_chan_ops = {
1633 .name = "Security Manager Root",
1634 .new_connection = smp_new_conn_cb,
1635
1636 /* None of these are implemented for the root channel */
1637 .close = l2cap_chan_no_close,
1638 .alloc_skb = l2cap_chan_no_alloc_skb,
1639 .recv = l2cap_chan_no_recv,
1640 .state_change = l2cap_chan_no_state_change,
1641 .teardown = l2cap_chan_no_teardown,
1642 .ready = l2cap_chan_no_ready,
1643 .defer = l2cap_chan_no_defer,
1644 .suspend = l2cap_chan_no_suspend,
1645 .resume = l2cap_chan_no_resume,
1646 .set_shutdown = l2cap_chan_no_set_shutdown,
1647 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1648 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1649};
1650
711eafe3
JH		 1651int smp_register(struct hci_dev *hdev)
1652{
70db83c4 1653 struct l2cap_chan *chan;
defce9e8 1654 struct crypto_blkcipher *tfm_aes;
70db83c4 1655
711eafe3
JH		 1656 BT_DBG("%s", hdev->name);
1657
defce9e8
JH		 1658 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1659 if (IS_ERR(tfm_aes)) {
1660 int err = PTR_ERR(tfm_aes);
711eafe3 1661 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1662 return err;
1663 }
1664
70db83c4
JH		 1665 chan = l2cap_chan_create();
1666 if (!chan) {
defce9e8 1667 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1668 return -ENOMEM;
1669 }
1670
defce9e8
JH		 1671 chan->data = tfm_aes;
1672
5d88cc73 1673 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1674
1675 l2cap_chan_set_defaults(chan);
1676
1677 bacpy(&chan->src, &hdev->bdaddr);
1678 chan->src_type = BDADDR_LE_PUBLIC;
1679 chan->state = BT_LISTEN;
1680 chan->mode = L2CAP_MODE_BASIC;
1681 chan->imtu = L2CAP_DEFAULT_MTU;
1682 chan->ops = &smp_root_chan_ops;
1683
1684 hdev->smp_data = chan;
1685
711eafe3
JH		 1686 return 0;
1687}
1688
1689void smp_unregister(struct hci_dev *hdev)
1690{
70db83c4 1691 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1692 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1693
1694 if (!chan)
1695 return;
1696
1697 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1698
defce9e8
JH		 1699 tfm_aes = chan->data;
1700 if (tfm_aes) {
1701 chan->data = NULL;
1702 crypto_free_blkcipher(tfm_aes);
711eafe3 1703 }
70db83c4
JH		 1704
1705 hdev->smp_data = NULL;
1706 l2cap_chan_put(chan);
711eafe3 1707}
Linux kernel - Deliverables
This page took 0.454341 seconds and 5 git commands to generate.