projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add timer to force power off
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
b1e2b3ae
JH		 127int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
128{
129 int err;
130
131 get_random_bytes(&rpa->b[3], 3);
132
133 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
134 rpa->b[5] |= 0x40; /* Set second most significant bit */
135
136 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
137 if (err < 0)
138 return err;
139
140 BT_DBG("RPA %pMR", rpa);
141
142 return 0;
143}
144
d22ef0bc 145static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 146 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
147 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 148{
149 u8 p1[16], p2[16];
150 int err;
151
152 memset(p1, 0, 16);
153
154 /* p1 = pres || preq || _rat || _iat */
155 swap56(pres, p1);
156 swap56(preq, p1 + 7);
157 p1[14] = _rat;
158 p1[15] = _iat;
159
160 memset(p2, 0, 16);
161
162 /* p2 = padding || ia || ra */
163 baswap((bdaddr_t *) (p2 + 4), ia);
164 baswap((bdaddr_t *) (p2 + 10), ra);
165
166 /* res = r XOR p1 */
167 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
168
169 /* res = e(k, res) */
170 err = smp_e(tfm, k, res);
171 if (err) {
172 BT_ERR("Encrypt data error");
173 return err;
174 }
175
176 /* res = res XOR p2 */
177 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
178
179 /* res = e(k, res) */
180 err = smp_e(tfm, k, res);
181 if (err)
182 BT_ERR("Encrypt data error");
183
184 return err;
185}
186
f1560463
MH		 187static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
188 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 189{
190 int err;
191
192 /* Just least significant octets from r1 and r2 are considered */
193 memcpy(_r, r1 + 8, 8);
194 memcpy(_r + 8, r2 + 8, 8);
195
196 err = smp_e(tfm, k, _r);
197 if (err)
198 BT_ERR("Encrypt data error");
199
200 return err;
201}
202
eb492e01 203static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 204 u16 dlen, void *data)
eb492e01
AB		 205{
206 struct sk_buff *skb;
207 struct l2cap_hdr *lh;
208 int len;
209
210 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
211
212 if (len > conn->mtu)
213 return NULL;
214
215 skb = bt_skb_alloc(len, GFP_ATOMIC);
216 if (!skb)
217 return NULL;
218
219 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
220 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 221 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 222
223 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
224
225 memcpy(skb_put(skb, dlen), data, dlen);
226
227 return skb;
228}
229
230static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
231{
232 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
233
234 BT_DBG("code 0x%2.2x", code);
235
236 if (!skb)
237 return;
238
73d80deb
LAD		 239 skb->priority = HCI_PRIO_MAX;
240 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 241
6c9d42a1 242 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 243 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 244}
245
2b64d153
BG		 246static __u8 authreq_to_seclevel(__u8 authreq)
247{
248 if (authreq & SMP_AUTH_MITM)
249 return BT_SECURITY_HIGH;
250 else
251 return BT_SECURITY_MEDIUM;
252}
253
254static __u8 seclevel_to_authreq(__u8 sec_level)
255{
256 switch (sec_level) {
257 case BT_SECURITY_HIGH:
258 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
259 case BT_SECURITY_MEDIUM:
260 return SMP_AUTH_BONDING;
261 default:
262 return SMP_AUTH_NONE;
263 }
264}
265
b8e66eac 266static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 267 struct smp_cmd_pairing *req,
268 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 269{
fd349c02
JH		 270 struct smp_chan *smp = conn->smp_chan;
271 struct hci_conn *hcon = conn->hcon;
272 struct hci_dev *hdev = hcon->hdev;
273 u8 local_dist = 0, remote_dist = 0;
54790f73 274
a8b2d5c2 275 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
fd349c02
JH		 276 local_dist = SMP_DIST_ENC_KEY;
277 remote_dist = SMP_DIST_ENC_KEY;
54790f73 278 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 279 } else {
280 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 281 }
282
fd349c02
JH		 283 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
284 remote_dist |= SMP_DIST_ID_KEY;
285
863efaf2
JH		 286 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
287 local_dist |= SMP_DIST_ID_KEY;
288
54790f73
VCG		 289 if (rsp == NULL) {
290 req->io_capability = conn->hcon->io_capability;
291 req->oob_flag = SMP_OOB_NOT_PRESENT;
292 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 293 req->init_key_dist = local_dist;
294 req->resp_key_dist = remote_dist;
065a13e2 295 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 296
297 smp->remote_key_dist = remote_dist;
54790f73
VCG		 298 return;
299 }
300
301 rsp->io_capability = conn->hcon->io_capability;
302 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
303 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 304 rsp->init_key_dist = req->init_key_dist & remote_dist;
305 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 306 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 307
308 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 309}
310
3158c50c
VCG		 311static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
312{
1c1def09
VCG		 313 struct smp_chan *smp = conn->smp_chan;
314
3158c50c 315 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 316 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 317 return SMP_ENC_KEY_SIZE;
318
f7aa611a 319 smp->enc_key_size = max_key_size;
3158c50c
VCG		 320
321 return 0;
322}
323
84794e11 324static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 325{
bab73cb6
JH		 326 struct hci_conn *hcon = conn->hcon;
327
84794e11 328 if (reason)
4f957a76 329 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 330 &reason);
4f957a76 331
ce39fb4e
MH		 332 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
333 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
334 HCI_ERROR_AUTH_FAILURE);
f1c09c07 335
61a0cfb0
AG		 336 cancel_delayed_work_sync(&conn->security_timer);
337
ce39fb4e 338 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 339 smp_chan_destroy(conn);
4f957a76
BG		 340}
341
2b64d153
BG		 342#define JUST_WORKS 0x00
343#define JUST_CFM 0x01
344#define REQ_PASSKEY 0x02
345#define CFM_PASSKEY 0x03
346#define REQ_OOB 0x04
347#define OVERLAP 0xFF
348
349static const u8 gen_method[5][5] = {
350 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
351 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
352 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
353 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
354 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
355};
356
357static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
358 u8 local_io, u8 remote_io)
359{
360 struct hci_conn *hcon = conn->hcon;
361 struct smp_chan *smp = conn->smp_chan;
362 u8 method;
363 u32 passkey = 0;
364 int ret = 0;
365
366 /* Initialize key for JUST WORKS */
367 memset(smp->tk, 0, sizeof(smp->tk));
368 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
369
370 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
371
372 /* If neither side wants MITM, use JUST WORKS */
373 /* If either side has unknown io_caps, use JUST WORKS */
374 /* Otherwise, look up method from the table */
375 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 376 local_io > SMP_IO_KEYBOARD_DISPLAY ||
377 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 378 method = JUST_WORKS;
379 else
b3ff53ff 380 method = gen_method[remote_io][local_io];
2b64d153
BG		 381
382 /* If not bonding, don't ask user to confirm a Zero TK */
383 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
384 method = JUST_WORKS;
385
386 /* If Just Works, Continue with Zero TK */
387 if (method == JUST_WORKS) {
388 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
389 return 0;
390 }
391
392 /* Not Just Works/Confirm results in MITM Authentication */
393 if (method != JUST_CFM)
394 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
395
396 /* If both devices have Keyoard-Display I/O, the master
397 * Confirms and the slave Enters the passkey.
398 */
399 if (method == OVERLAP) {
400 if (hcon->link_mode & HCI_LM_MASTER)
401 method = CFM_PASSKEY;
402 else
403 method = REQ_PASSKEY;
404 }
405
406 /* Generate random passkey. Not valid until confirmed. */
407 if (method == CFM_PASSKEY) {
408 u8 key[16];
409
410 memset(key, 0, sizeof(key));
411 get_random_bytes(&passkey, sizeof(passkey));
412 passkey %= 1000000;
413 put_unaligned_le32(passkey, key);
414 swap128(key, smp->tk);
415 BT_DBG("PassKey: %d", passkey);
416 }
417
418 hci_dev_lock(hcon->hdev);
419
420 if (method == REQ_PASSKEY)
ce39fb4e 421 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 422 hcon->type, hcon->dst_type);
2b64d153 423 else
ce39fb4e 424 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 425 hcon->type, hcon->dst_type,
2b64d153
BG		 426 cpu_to_le32(passkey), 0);
427
428 hci_dev_unlock(hcon->hdev);
429
430 return ret;
431}
432
8aab4757
VCG		 433static void confirm_work(struct work_struct *work)
434{
435 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
436 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 437 struct hci_dev *hdev = conn->hcon->hdev;
438 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 439 struct smp_cmd_pairing_confirm cp;
440 int ret;
441 u8 res[16], reason;
442
443 BT_DBG("conn %p", conn);
444
893ce8b1
JH		 445 /* Prevent mutual access to hdev->tfm_aes */
446 hci_dev_lock(hdev);
8aab4757
VCG		 447
448 if (conn->hcon->out)
c8462ca6
MH		 449 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
450 conn->hcon->src_type, &conn->hcon->src,
451 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 452 else
453 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 454 conn->hcon->dst_type, &conn->hcon->dst,
455 conn->hcon->src_type, &conn->hcon->src, res);
893ce8b1
JH		 456
457 hci_dev_unlock(hdev);
458
8aab4757
VCG		 459 if (ret) {
460 reason = SMP_UNSPECIFIED;
461 goto error;
462 }
463
2b64d153
BG		 464 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
465
8aab4757
VCG		 466 swap128(res, cp.confirm_val);
467 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
468
469 return;
470
471error:
84794e11 472 smp_failure(conn, reason);
8aab4757
VCG		 473}
474
475static void random_work(struct work_struct *work)
476{
477 struct smp_chan *smp = container_of(work, struct smp_chan, random);
478 struct l2cap_conn *conn = smp->conn;
479 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 480 struct hci_dev *hdev = hcon->hdev;
481 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 482 u8 reason, confirm[16], res[16], key[16];
483 int ret;
484
485 if (IS_ERR_OR_NULL(tfm)) {
486 reason = SMP_UNSPECIFIED;
487 goto error;
488 }
489
490 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
491
893ce8b1
JH		 492 /* Prevent mutual access to hdev->tfm_aes */
493 hci_dev_lock(hdev);
494
8aab4757 495 if (hcon->out)
c8462ca6
MH		 496 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
497 hcon->src_type, &hcon->src,
498 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 499 else
500 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 501 hcon->dst_type, &hcon->dst,
502 hcon->src_type, &hcon->src, res);
893ce8b1
JH		 503
504 hci_dev_unlock(hdev);
505
8aab4757
VCG		 506 if (ret) {
507 reason = SMP_UNSPECIFIED;
508 goto error;
509 }
510
511 swap128(res, confirm);
512
513 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
514 BT_ERR("Pairing failed (confirmation values mismatch)");
515 reason = SMP_CONFIRM_FAILED;
516 goto error;
517 }
518
519 if (hcon->out) {
520 u8 stk[16], rand[8];
521 __le16 ediv;
522
523 memset(rand, 0, sizeof(rand));
524 ediv = 0;
525
526 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
527 swap128(key, stk);
528
f7aa611a 529 memset(stk + smp->enc_key_size, 0,
04124681 530 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 531
51a8efd7 532 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 533 reason = SMP_UNSPECIFIED;
534 goto error;
535 }
536
537 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 538 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 539 } else {
540 u8 stk[16], r[16], rand[8];
541 __le16 ediv;
542
543 memset(rand, 0, sizeof(rand));
544 ediv = 0;
545
546 swap128(smp->prnd, r);
547 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
548
549 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
550 swap128(key, stk);
551
f7aa611a 552 memset(stk + smp->enc_key_size, 0,
f1560463 553 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 554
ce39fb4e 555 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 556 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 557 ediv, rand);
8aab4757
VCG		 558 }
559
560 return;
561
562error:
84794e11 563 smp_failure(conn, reason);
8aab4757
VCG		 564}
565
566static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
567{
568 struct smp_chan *smp;
569
f1560463 570 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 571 if (!smp)
572 return NULL;
573
574 INIT_WORK(&smp->confirm, confirm_work);
575 INIT_WORK(&smp->random, random_work);
576
577 smp->conn = conn;
578 conn->smp_chan = smp;
2b64d153 579 conn->hcon->smp_conn = conn;
8aab4757
VCG		 580
581 hci_conn_hold(conn->hcon);
582
583 return smp;
584}
585
586void smp_chan_destroy(struct l2cap_conn *conn)
587{
c8eb9690 588 struct smp_chan *smp = conn->smp_chan;
f4a407be 589 bool complete;
c8eb9690 590
f1c09c07 591 BUG_ON(!smp);
c8eb9690 592
f4a407be
JH		 593 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
594 mgmt_smp_complete(conn->hcon, complete);
595
c8eb9690
BG		 596 kfree(smp);
597 conn->smp_chan = NULL;
2b64d153 598 conn->hcon->smp_conn = NULL;
76a68ba0 599 hci_conn_drop(conn->hcon);
8aab4757
VCG		 600}
601
2b64d153
BG		 602int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
603{
604 struct l2cap_conn *conn = hcon->smp_conn;
605 struct smp_chan *smp;
606 u32 value;
607 u8 key[16];
608
609 BT_DBG("");
610
611 if (!conn)
612 return -ENOTCONN;
613
614 smp = conn->smp_chan;
615
616 switch (mgmt_op) {
617 case MGMT_OP_USER_PASSKEY_REPLY:
618 value = le32_to_cpu(passkey);
619 memset(key, 0, sizeof(key));
620 BT_DBG("PassKey: %d", value);
621 put_unaligned_le32(value, key);
622 swap128(key, smp->tk);
623 /* Fall Through */
624 case MGMT_OP_USER_CONFIRM_REPLY:
625 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
626 break;
627 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
628 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 629 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 630 return 0;
631 default:
84794e11 632 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 633 return -EOPNOTSUPP;
634 }
635
636 /* If it is our turn to send Pairing Confirm, do so now */
637 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
638 queue_work(hcon->hdev->workqueue, &smp->confirm);
639
640 return 0;
641}
642
da85e5e5 643static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 644{
3158c50c 645 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 646 struct smp_chan *smp;
3158c50c 647 u8 key_size;
2b64d153 648 u8 auth = SMP_AUTH_NONE;
8aab4757 649 int ret;
88ba43b6
AB		 650
651 BT_DBG("conn %p", conn);
652
c46b98be
JH		 653 if (skb->len < sizeof(*req))
654 return SMP_UNSPECIFIED;
655
2b64d153
BG		 656 if (conn->hcon->link_mode & HCI_LM_MASTER)
657 return SMP_CMD_NOTSUPP;
658
51a8efd7 659 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 660 smp = smp_chan_create(conn);
d08fd0e7
AE		 661 else
662 smp = conn->smp_chan;
8aab4757 663
d08fd0e7
AE		 664 if (!smp)
665 return SMP_UNSPECIFIED;
d26a2345 666
1c1def09
VCG		 667 smp->preq[0] = SMP_CMD_PAIRING_REQ;
668 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 669 skb_pull(skb, sizeof(*req));
88ba43b6 670
2b64d153
BG		 671 /* We didn't start the pairing, so match remote */
672 if (req->auth_req & SMP_AUTH_BONDING)
673 auth = req->auth_req;
da85e5e5 674
fdde0a26
IY		 675 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
676
2b64d153 677 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 678
679 key_size = min(req->max_key_size, rsp.max_key_size);
680 if (check_enc_key_size(conn, key_size))
681 return SMP_ENC_KEY_SIZE;
88ba43b6 682
e84a6b13 683 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 684
1c1def09
VCG		 685 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
686 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 687
3158c50c 688 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 689
2b64d153
BG		 690 /* Request setup of TK */
691 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
692 if (ret)
693 return SMP_UNSPECIFIED;
694
da85e5e5 695 return 0;
88ba43b6
AB		 696}
697
da85e5e5 698static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 699{
3158c50c 700 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 701 struct smp_chan *smp = conn->smp_chan;
8aab4757 702 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 703 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 704 int ret;
88ba43b6
AB		 705
706 BT_DBG("conn %p", conn);
707
c46b98be
JH		 708 if (skb->len < sizeof(*rsp))
709 return SMP_UNSPECIFIED;
710
2b64d153
BG		 711 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
712 return SMP_CMD_NOTSUPP;
713
3158c50c
VCG		 714 skb_pull(skb, sizeof(*rsp));
715
1c1def09 716 req = (void *) &smp->preq[1];
da85e5e5 717
3158c50c
VCG		 718 key_size = min(req->max_key_size, rsp->max_key_size);
719 if (check_enc_key_size(conn, key_size))
720 return SMP_ENC_KEY_SIZE;
721
e84a6b13 722 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 723
8aab4757
VCG		 724 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
725 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 726
2b64d153 727 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 728 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 729 auth = SMP_AUTH_BONDING;
730
731 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
732
476585ec 733 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 734 if (ret)
735 return SMP_UNSPECIFIED;
736
737 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
738
739 /* Can't compose response until we have been confirmed */
740 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
741 return 0;
742
8aab4757 743 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 744
745 return 0;
88ba43b6
AB		 746}
747
da85e5e5 748static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 749{
1c1def09 750 struct smp_chan *smp = conn->smp_chan;
8aab4757 751 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 752
88ba43b6
AB		 753 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
754
c46b98be
JH		 755 if (skb->len < sizeof(smp->pcnf))
756 return SMP_UNSPECIFIED;
757
1c1def09
VCG		 758 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
759 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 760
7d24ddcc
AB		 761 if (conn->hcon->out) {
762 u8 random[16];
88ba43b6 763
1c1def09 764 swap128(smp->prnd, random);
88ba43b6 765 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 766 random);
2b64d153 767 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 768 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 769 } else {
770 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 771 }
da85e5e5
VCG		 772
773 return 0;
88ba43b6
AB		 774}
775
da85e5e5 776static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 777{
1c1def09 778 struct smp_chan *smp = conn->smp_chan;
8aab4757 779 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 780
8aab4757 781 BT_DBG("conn %p", conn);
3158c50c 782
c46b98be
JH		 783 if (skb->len < sizeof(smp->rrnd))
784 return SMP_UNSPECIFIED;
785
8aab4757
VCG		 786 swap128(skb->data, smp->rrnd);
787 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 788
8aab4757 789 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 790
791 return 0;
88ba43b6
AB		 792}
793
4dab7864 794static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 795{
c9839a11 796 struct smp_ltk *key;
988c5997
VCG		 797 struct hci_conn *hcon = conn->hcon;
798
98a0b845
JH		 799 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
800 hcon->out);
988c5997
VCG		 801 if (!key)
802 return 0;
803
4dab7864
JH		 804 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
805 return 0;
806
51a8efd7 807 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 808 return 1;
809
c9839a11
VCG		 810 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
811 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 812
813 return 1;
988c5997 814}
f1560463 815
da85e5e5 816static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 817{
818 struct smp_cmd_security_req *rp = (void *) skb->data;
819 struct smp_cmd_pairing cp;
f1cb9af5 820 struct hci_conn *hcon = conn->hcon;
8aab4757 821 struct smp_chan *smp;
88ba43b6
AB		 822
823 BT_DBG("conn %p", conn);
824
c46b98be
JH		 825 if (skb->len < sizeof(*rp))
826 return SMP_UNSPECIFIED;
827
86ca9eac
JH		 828 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
829 return SMP_CMD_NOTSUPP;
830
2b64d153 831 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 832
4dab7864 833 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 834 return 0;
835
51a8efd7 836 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 837 return 0;
f1cb9af5 838
8aab4757 839 smp = smp_chan_create(conn);
d26a2345 840
88ba43b6 841 skb_pull(skb, sizeof(*rp));
88ba43b6 842
da85e5e5 843 memset(&cp, 0, sizeof(cp));
54790f73 844 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 845
1c1def09
VCG		 846 smp->preq[0] = SMP_CMD_PAIRING_REQ;
847 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 848
88ba43b6 849 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 850
da85e5e5 851 return 0;
88ba43b6
AB		 852}
853
ad32a2f5
JH		 854bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
855{
856 if (sec_level == BT_SECURITY_LOW)
857 return true;
858
859 if (hcon->sec_level >= sec_level)
860 return true;
861
862 return false;
863}
864
cc110922 865int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 866{
cc110922 867 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 868 struct smp_chan *smp = conn->smp_chan;
2b64d153 869 __u8 authreq;
eb492e01 870
3a0259bb
VCG		 871 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
872
757aee0f 873 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 874 return 1;
875
ad32a2f5 876 if (smp_sufficient_security(hcon, sec_level))
eb492e01 877 return 1;
f1cb9af5 878
988c5997 879 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 880 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 881 goto done;
d26a2345 882
51a8efd7 883 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 884 return 0;
885
8aab4757 886 smp = smp_chan_create(conn);
2b64d153
BG		 887 if (!smp)
888 return 1;
889
890 authreq = seclevel_to_authreq(sec_level);
d26a2345 891
d26a2345
VCG		 892 if (hcon->link_mode & HCI_LM_MASTER) {
893 struct smp_cmd_pairing cp;
f01ead31 894
2b64d153 895 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 896 smp->preq[0] = SMP_CMD_PAIRING_REQ;
897 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 898
eb492e01
AB		 899 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
900 } else {
901 struct smp_cmd_security_req cp;
2b64d153 902 cp.auth_req = authreq;
eb492e01
AB		 903 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
904 }
905
02bc7455 906done:
f1cb9af5 907 hcon->pending_sec_level = sec_level;
f1cb9af5 908
eb492e01
AB		 909 return 0;
910}
911
7034b911
VCG		 912static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
913{
16b90839 914 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 915 struct smp_chan *smp = conn->smp_chan;
16b90839 916
c46b98be
JH		 917 BT_DBG("conn %p", conn);
918
919 if (skb->len < sizeof(*rp))
920 return SMP_UNSPECIFIED;
921
6131ddc8
JH		 922 /* Ignore this PDU if it wasn't requested */
923 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
924 return 0;
925
16b90839
VCG		 926 skb_pull(skb, sizeof(*rp));
927
1c1def09 928 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 929
7034b911
VCG		 930 return 0;
931}
932
933static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
934{
16b90839 935 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 936 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 937 struct hci_dev *hdev = conn->hcon->hdev;
938 struct hci_conn *hcon = conn->hcon;
23d0e128 939 struct smp_ltk *ltk;
c9839a11 940 u8 authenticated;
16b90839 941
c46b98be
JH		 942 BT_DBG("conn %p", conn);
943
944 if (skb->len < sizeof(*rp))
945 return SMP_UNSPECIFIED;
946
6131ddc8
JH		 947 /* Ignore this PDU if it wasn't requested */
948 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
949 return 0;
950
9747a9f3
JH		 951 /* Mark the information as received */
952 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
953
16b90839 954 skb_pull(skb, sizeof(*rp));
7034b911 955
c9839a11 956 hci_dev_lock(hdev);
ce39fb4e 957 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 958 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 959 authenticated, smp->tk, smp->enc_key_size,
960 rp->ediv, rp->rand);
961 smp->ltk = ltk;
fd349c02 962 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 963 smp_distribute_keys(conn);
c9839a11 964 hci_dev_unlock(hdev);
7034b911
VCG		 965
966 return 0;
967}
968
fd349c02
JH		 969static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
970{
971 struct smp_cmd_ident_info *info = (void *) skb->data;
972 struct smp_chan *smp = conn->smp_chan;
973
974 BT_DBG("");
975
976 if (skb->len < sizeof(*info))
977 return SMP_UNSPECIFIED;
978
6131ddc8
JH		 979 /* Ignore this PDU if it wasn't requested */
980 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
981 return 0;
982
fd349c02
JH		 983 skb_pull(skb, sizeof(*info));
984
985 memcpy(smp->irk, info->irk, 16);
986
987 return 0;
988}
989
990static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
991 struct sk_buff *skb)
992{
993 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
994 struct smp_chan *smp = conn->smp_chan;
995 struct hci_conn *hcon = conn->hcon;
996 bdaddr_t rpa;
997
998 BT_DBG("");
999
1000 if (skb->len < sizeof(*info))
1001 return SMP_UNSPECIFIED;
1002
6131ddc8
JH		 1003 /* Ignore this PDU if it wasn't requested */
1004 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1005 return 0;
1006
9747a9f3
JH		 1007 /* Mark the information as received */
1008 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1009
fd349c02
JH		 1010 skb_pull(skb, sizeof(*info));
1011
a9a58f86
JH		 1012 /* Strictly speaking the Core Specification (4.1) allows sending
1013 * an empty address which would force us to rely on just the IRK
1014 * as "identity information". However, since such
1015 * implementations are not known of and in order to not over
1016 * complicate our implementation, simply pretend that we never
1017 * received an IRK for such a device.
1018 */
1019 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1020 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1021 smp_distribute_keys(conn);
a9a58f86
JH		 1022 return 0;
1023 }
1024
fd349c02
JH		 1025 bacpy(&smp->id_addr, &info->bdaddr);
1026 smp->id_addr_type = info->addr_type;
1027
1028 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1029 bacpy(&rpa, &hcon->dst);
1030 else
1031 bacpy(&rpa, BDADDR_ANY);
1032
23d0e128
JH		 1033 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1034 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1035
68d6f6de
JH		 1036 /* Track the connection based on the Identity Address from now on */
1037 bacpy(&hcon->dst, &smp->id_addr);
1038 hcon->dst_type = smp->id_addr_type;
1039
387a33e3
JH		 1040 l2cap_conn_update_id_addr(hcon);
1041
4bd6d38e 1042 smp_distribute_keys(conn);
fd349c02
JH		 1043
1044 return 0;
1045}
1046
eb492e01
AB		 1047int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1048{
7b9899db 1049 struct hci_conn *hcon = conn->hcon;
92381f5c 1050 __u8 code, reason;
eb492e01
AB		 1051 int err = 0;
1052
7b9899db
MH		 1053 if (hcon->type != LE_LINK) {
1054 kfree_skb(skb);
3432711f 1055 return 0;
7b9899db
MH		 1056 }
1057
92381f5c
MH		 1058 if (skb->len < 1) {
1059 kfree_skb(skb);
1060 return -EILSEQ;
1061 }
1062
06ae3314 1063 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1064 err = -ENOTSUPP;
1065 reason = SMP_PAIRING_NOTSUPP;
1066 goto done;
1067 }
1068
92381f5c 1069 code = skb->data[0];
eb492e01
AB		 1070 skb_pull(skb, sizeof(code));
1071
8cf9fa12
JH		 1072 /*
1073 * The SMP context must be initialized for all other PDUs except
1074 * pairing and security requests. If we get any other PDU when
1075 * not initialized simply disconnect (done if this function
1076 * returns an error).
1077 */
1078 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1079 !conn->smp_chan) {
1080 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1081 kfree_skb(skb);
1082 return -ENOTSUPP;
1083 }
1084
eb492e01
AB		 1085 switch (code) {
1086 case SMP_CMD_PAIRING_REQ:
da85e5e5 1087 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1088 break;
1089
1090 case SMP_CMD_PAIRING_FAIL:
84794e11 1091 smp_failure(conn, 0);
da85e5e5
VCG		 1092 reason = 0;
1093 err = -EPERM;
eb492e01
AB		 1094 break;
1095
1096 case SMP_CMD_PAIRING_RSP:
da85e5e5 1097 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1098 break;
1099
1100 case SMP_CMD_SECURITY_REQ:
da85e5e5 1101 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1102 break;
1103
eb492e01 1104 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1105 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1106 break;
1107
eb492e01 1108 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1109 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1110 break;
1111
eb492e01 1112 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1113 reason = smp_cmd_encrypt_info(conn, skb);
1114 break;
1115
eb492e01 1116 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1117 reason = smp_cmd_master_ident(conn, skb);
1118 break;
1119
eb492e01 1120 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1121 reason = smp_cmd_ident_info(conn, skb);
1122 break;
1123
eb492e01 1124 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1125 reason = smp_cmd_ident_addr_info(conn, skb);
1126 break;
1127
eb492e01 1128 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 1129 /* Just ignored */
1130 reason = 0;
1131 break;
1132
eb492e01
AB		 1133 default:
1134 BT_DBG("Unknown command code 0x%2.2x", code);
1135
1136 reason = SMP_CMD_NOTSUPP;
eb492e01 1137 err = -EOPNOTSUPP;
3a0259bb 1138 goto done;
eb492e01
AB		 1139 }
1140
3a0259bb
VCG		 1141done:
1142 if (reason)
84794e11 1143 smp_failure(conn, reason);
3a0259bb 1144
eb492e01
AB		 1145 kfree_skb(skb);
1146 return err;
1147}
7034b911 1148
35d70271
JH		 1149static void smp_notify_keys(struct l2cap_conn *conn)
1150{
1151 struct smp_chan *smp = conn->smp_chan;
1152 struct hci_conn *hcon = conn->hcon;
1153 struct hci_dev *hdev = hcon->hdev;
1154
95fbac8a
JH		 1155 if (smp->remote_irk)
1156 mgmt_new_irk(hdev, smp->remote_irk);
1157
35d70271
JH		 1158 if (smp->ltk) {
1159 smp->ltk->bdaddr_type = hcon->dst_type;
1160 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1161 mgmt_new_ltk(hdev, smp->ltk);
1162 }
1163
1164 if (smp->slave_ltk) {
1165 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1166 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1167 mgmt_new_ltk(hdev, smp->slave_ltk);
1168 }
1169}
1170
4bd6d38e 1171int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1172{
1173 struct smp_cmd_pairing *req, *rsp;
1c1def09 1174 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1175 struct hci_conn *hcon = conn->hcon;
1176 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1177 __u8 *keydist;
1178
4bd6d38e 1179 BT_DBG("conn %p", conn);
7034b911 1180
524237cb 1181 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1182 return 0;
1183
1c1def09 1184 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1185
1186 /* The responder sends its keys first */
efabba37 1187 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1188 return 0;
1189
1c1def09 1190 req = (void *) &smp->preq[1];
7034b911 1191
524237cb 1192 if (hcon->out) {
7034b911
VCG		 1193 keydist = &rsp->init_key_dist;
1194 *keydist &= req->init_key_dist;
1195 } else {
1196 keydist = &rsp->resp_key_dist;
1197 *keydist &= req->resp_key_dist;
1198 }
1199
7034b911
VCG		 1200 BT_DBG("keydist 0x%x", *keydist);
1201
1202 if (*keydist & SMP_DIST_ENC_KEY) {
1203 struct smp_cmd_encrypt_info enc;
1204 struct smp_cmd_master_ident ident;
23d0e128 1205 struct smp_ltk *ltk;
c9839a11 1206 u8 authenticated;
7034b911
VCG		 1207 __le16 ediv;
1208
1209 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1210 get_random_bytes(&ediv, sizeof(ediv));
1211 get_random_bytes(ident.rand, sizeof(ident.rand));
1212
1213 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1214
c9839a11 1215 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1216 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271
JH		 1217 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
1218 smp->enc_key_size, ediv, ident.rand);
23d0e128 1219 smp->slave_ltk = ltk;
16b90839 1220
58115373 1221 ident.ediv = ediv;
7034b911
VCG		 1222
1223 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1224
1225 *keydist &= ~SMP_DIST_ENC_KEY;
1226 }
1227
1228 if (*keydist & SMP_DIST_ID_KEY) {
1229 struct smp_cmd_ident_addr_info addrinfo;
1230 struct smp_cmd_ident_info idinfo;
1231
863efaf2 1232 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1233
1234 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1235
82d4b359
JH		 1236 /* The hci_conn contains the local identity address
1237 * after the connection has been established.
1238 *
1239 * This is true even when the connection has been
1240 * established using a resolvable random address.
1241 */
524237cb 1242 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1243 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1244
1245 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1246 &addrinfo);
7034b911
VCG		 1247
1248 *keydist &= ~SMP_DIST_ID_KEY;
1249 }
1250
1251 if (*keydist & SMP_DIST_SIGN) {
1252 struct smp_cmd_sign_info sign;
1253
1254 /* Send a dummy key */
1255 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1256
1257 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1258
1259 *keydist &= ~SMP_DIST_SIGN;
1260 }
1261
efabba37
JH		 1262 /* If there are still keys to be received wait for them */
1263 if ((smp->remote_key_dist & 0x07))
1264 return 0;
1265
1266 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1267 cancel_delayed_work_sync(&conn->security_timer);
1268 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
1269 smp_notify_keys(conn);
1270
1271 smp_chan_destroy(conn);
d26a2345 1272
7034b911
VCG		 1273 return 0;
1274}
Linux kernel - Deliverables
This page took 0.294344 seconds and 5 git commands to generate.