projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Ignore IRKs with no Identity Address
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
b1e2b3ae
JH		 127int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
128{
129 int err;
130
131 get_random_bytes(&rpa->b[3], 3);
132
133 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
134 rpa->b[5] |= 0x40; /* Set second most significant bit */
135
136 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
137 if (err < 0)
138 return err;
139
140 BT_DBG("RPA %pMR", rpa);
141
142 return 0;
143}
144
d22ef0bc 145static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 146 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
147 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 148{
149 u8 p1[16], p2[16];
150 int err;
151
152 memset(p1, 0, 16);
153
154 /* p1 = pres || preq || _rat || _iat */
155 swap56(pres, p1);
156 swap56(preq, p1 + 7);
157 p1[14] = _rat;
158 p1[15] = _iat;
159
160 memset(p2, 0, 16);
161
162 /* p2 = padding || ia || ra */
163 baswap((bdaddr_t *) (p2 + 4), ia);
164 baswap((bdaddr_t *) (p2 + 10), ra);
165
166 /* res = r XOR p1 */
167 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
168
169 /* res = e(k, res) */
170 err = smp_e(tfm, k, res);
171 if (err) {
172 BT_ERR("Encrypt data error");
173 return err;
174 }
175
176 /* res = res XOR p2 */
177 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
178
179 /* res = e(k, res) */
180 err = smp_e(tfm, k, res);
181 if (err)
182 BT_ERR("Encrypt data error");
183
184 return err;
185}
186
f1560463
MH		 187static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
188 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 189{
190 int err;
191
192 /* Just least significant octets from r1 and r2 are considered */
193 memcpy(_r, r1 + 8, 8);
194 memcpy(_r + 8, r2 + 8, 8);
195
196 err = smp_e(tfm, k, _r);
197 if (err)
198 BT_ERR("Encrypt data error");
199
200 return err;
201}
202
eb492e01 203static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 204 u16 dlen, void *data)
eb492e01
AB		 205{
206 struct sk_buff *skb;
207 struct l2cap_hdr *lh;
208 int len;
209
210 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
211
212 if (len > conn->mtu)
213 return NULL;
214
215 skb = bt_skb_alloc(len, GFP_ATOMIC);
216 if (!skb)
217 return NULL;
218
219 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
220 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 221 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 222
223 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
224
225 memcpy(skb_put(skb, dlen), data, dlen);
226
227 return skb;
228}
229
230static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
231{
232 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
233
234 BT_DBG("code 0x%2.2x", code);
235
236 if (!skb)
237 return;
238
73d80deb
LAD		 239 skb->priority = HCI_PRIO_MAX;
240 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 241
6c9d42a1 242 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 243 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 244}
245
2b64d153
BG		 246static __u8 authreq_to_seclevel(__u8 authreq)
247{
248 if (authreq & SMP_AUTH_MITM)
249 return BT_SECURITY_HIGH;
250 else
251 return BT_SECURITY_MEDIUM;
252}
253
254static __u8 seclevel_to_authreq(__u8 sec_level)
255{
256 switch (sec_level) {
257 case BT_SECURITY_HIGH:
258 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
259 case BT_SECURITY_MEDIUM:
260 return SMP_AUTH_BONDING;
261 default:
262 return SMP_AUTH_NONE;
263 }
264}
265
b8e66eac 266static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 267 struct smp_cmd_pairing *req,
268 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 269{
fd349c02
JH		 270 struct smp_chan *smp = conn->smp_chan;
271 struct hci_conn *hcon = conn->hcon;
272 struct hci_dev *hdev = hcon->hdev;
273 u8 local_dist = 0, remote_dist = 0;
54790f73 274
a8b2d5c2 275 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
fd349c02
JH		 276 local_dist = SMP_DIST_ENC_KEY;
277 remote_dist = SMP_DIST_ENC_KEY;
54790f73 278 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 279 } else {
280 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 281 }
282
fd349c02
JH		 283 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
284 remote_dist |= SMP_DIST_ID_KEY;
285
863efaf2
JH		 286 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
287 local_dist |= SMP_DIST_ID_KEY;
288
54790f73
VCG		 289 if (rsp == NULL) {
290 req->io_capability = conn->hcon->io_capability;
291 req->oob_flag = SMP_OOB_NOT_PRESENT;
292 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 293 req->init_key_dist = local_dist;
294 req->resp_key_dist = remote_dist;
065a13e2 295 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 296
297 smp->remote_key_dist = remote_dist;
54790f73
VCG		 298 return;
299 }
300
301 rsp->io_capability = conn->hcon->io_capability;
302 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
303 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 304 rsp->init_key_dist = req->init_key_dist & remote_dist;
305 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 306 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 307
308 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 309}
310
3158c50c
VCG		 311static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
312{
1c1def09
VCG		 313 struct smp_chan *smp = conn->smp_chan;
314
3158c50c 315 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 316 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 317 return SMP_ENC_KEY_SIZE;
318
f7aa611a 319 smp->enc_key_size = max_key_size;
3158c50c
VCG		 320
321 return 0;
322}
323
84794e11 324static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 325{
bab73cb6
JH		 326 struct hci_conn *hcon = conn->hcon;
327
84794e11 328 if (reason)
4f957a76 329 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 330 &reason);
4f957a76 331
ce39fb4e
MH		 332 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
333 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
334 HCI_ERROR_AUTH_FAILURE);
f1c09c07 335
61a0cfb0
AG		 336 cancel_delayed_work_sync(&conn->security_timer);
337
ce39fb4e 338 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 339 smp_chan_destroy(conn);
4f957a76
BG		 340}
341
2b64d153
BG		 342#define JUST_WORKS 0x00
343#define JUST_CFM 0x01
344#define REQ_PASSKEY 0x02
345#define CFM_PASSKEY 0x03
346#define REQ_OOB 0x04
347#define OVERLAP 0xFF
348
349static const u8 gen_method[5][5] = {
350 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
351 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
352 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
353 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
354 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
355};
356
357static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
358 u8 local_io, u8 remote_io)
359{
360 struct hci_conn *hcon = conn->hcon;
361 struct smp_chan *smp = conn->smp_chan;
362 u8 method;
363 u32 passkey = 0;
364 int ret = 0;
365
366 /* Initialize key for JUST WORKS */
367 memset(smp->tk, 0, sizeof(smp->tk));
368 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
369
370 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
371
372 /* If neither side wants MITM, use JUST WORKS */
373 /* If either side has unknown io_caps, use JUST WORKS */
374 /* Otherwise, look up method from the table */
375 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 376 local_io > SMP_IO_KEYBOARD_DISPLAY ||
377 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 378 method = JUST_WORKS;
379 else
b3ff53ff 380 method = gen_method[remote_io][local_io];
2b64d153
BG		 381
382 /* If not bonding, don't ask user to confirm a Zero TK */
383 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
384 method = JUST_WORKS;
385
386 /* If Just Works, Continue with Zero TK */
387 if (method == JUST_WORKS) {
388 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
389 return 0;
390 }
391
392 /* Not Just Works/Confirm results in MITM Authentication */
393 if (method != JUST_CFM)
394 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
395
396 /* If both devices have Keyoard-Display I/O, the master
397 * Confirms and the slave Enters the passkey.
398 */
399 if (method == OVERLAP) {
400 if (hcon->link_mode & HCI_LM_MASTER)
401 method = CFM_PASSKEY;
402 else
403 method = REQ_PASSKEY;
404 }
405
406 /* Generate random passkey. Not valid until confirmed. */
407 if (method == CFM_PASSKEY) {
408 u8 key[16];
409
410 memset(key, 0, sizeof(key));
411 get_random_bytes(&passkey, sizeof(passkey));
412 passkey %= 1000000;
413 put_unaligned_le32(passkey, key);
414 swap128(key, smp->tk);
415 BT_DBG("PassKey: %d", passkey);
416 }
417
418 hci_dev_lock(hcon->hdev);
419
420 if (method == REQ_PASSKEY)
ce39fb4e 421 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 422 hcon->type, hcon->dst_type);
2b64d153 423 else
ce39fb4e 424 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 425 hcon->type, hcon->dst_type,
2b64d153
BG		 426 cpu_to_le32(passkey), 0);
427
428 hci_dev_unlock(hcon->hdev);
429
430 return ret;
431}
432
8aab4757
VCG		 433static void confirm_work(struct work_struct *work)
434{
435 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
436 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 437 struct hci_dev *hdev = conn->hcon->hdev;
438 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 439 struct smp_cmd_pairing_confirm cp;
440 int ret;
441 u8 res[16], reason;
442
443 BT_DBG("conn %p", conn);
444
893ce8b1
JH		 445 /* Prevent mutual access to hdev->tfm_aes */
446 hci_dev_lock(hdev);
8aab4757
VCG		 447
448 if (conn->hcon->out)
c8462ca6
MH		 449 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
450 conn->hcon->src_type, &conn->hcon->src,
451 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 452 else
453 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 454 conn->hcon->dst_type, &conn->hcon->dst,
455 conn->hcon->src_type, &conn->hcon->src, res);
893ce8b1
JH		 456
457 hci_dev_unlock(hdev);
458
8aab4757
VCG		 459 if (ret) {
460 reason = SMP_UNSPECIFIED;
461 goto error;
462 }
463
2b64d153
BG		 464 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
465
8aab4757
VCG		 466 swap128(res, cp.confirm_val);
467 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
468
469 return;
470
471error:
84794e11 472 smp_failure(conn, reason);
8aab4757
VCG		 473}
474
475static void random_work(struct work_struct *work)
476{
477 struct smp_chan *smp = container_of(work, struct smp_chan, random);
478 struct l2cap_conn *conn = smp->conn;
479 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 480 struct hci_dev *hdev = hcon->hdev;
481 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 482 u8 reason, confirm[16], res[16], key[16];
483 int ret;
484
485 if (IS_ERR_OR_NULL(tfm)) {
486 reason = SMP_UNSPECIFIED;
487 goto error;
488 }
489
490 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
491
893ce8b1
JH		 492 /* Prevent mutual access to hdev->tfm_aes */
493 hci_dev_lock(hdev);
494
8aab4757 495 if (hcon->out)
c8462ca6
MH		 496 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
497 hcon->src_type, &hcon->src,
498 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 499 else
500 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 501 hcon->dst_type, &hcon->dst,
502 hcon->src_type, &hcon->src, res);
893ce8b1
JH		 503
504 hci_dev_unlock(hdev);
505
8aab4757
VCG		 506 if (ret) {
507 reason = SMP_UNSPECIFIED;
508 goto error;
509 }
510
511 swap128(res, confirm);
512
513 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
514 BT_ERR("Pairing failed (confirmation values mismatch)");
515 reason = SMP_CONFIRM_FAILED;
516 goto error;
517 }
518
519 if (hcon->out) {
520 u8 stk[16], rand[8];
521 __le16 ediv;
522
523 memset(rand, 0, sizeof(rand));
524 ediv = 0;
525
526 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
527 swap128(key, stk);
528
f7aa611a 529 memset(stk + smp->enc_key_size, 0,
04124681 530 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 531
51a8efd7 532 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 533 reason = SMP_UNSPECIFIED;
534 goto error;
535 }
536
537 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 538 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 539 } else {
540 u8 stk[16], r[16], rand[8];
541 __le16 ediv;
542
543 memset(rand, 0, sizeof(rand));
544 ediv = 0;
545
546 swap128(smp->prnd, r);
547 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
548
549 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
550 swap128(key, stk);
551
f7aa611a 552 memset(stk + smp->enc_key_size, 0,
f1560463 553 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 554
ce39fb4e 555 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 556 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 557 ediv, rand);
8aab4757
VCG		 558 }
559
560 return;
561
562error:
84794e11 563 smp_failure(conn, reason);
8aab4757
VCG		 564}
565
566static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
567{
568 struct smp_chan *smp;
569
f1560463 570 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 571 if (!smp)
572 return NULL;
573
574 INIT_WORK(&smp->confirm, confirm_work);
575 INIT_WORK(&smp->random, random_work);
576
577 smp->conn = conn;
578 conn->smp_chan = smp;
2b64d153 579 conn->hcon->smp_conn = conn;
8aab4757
VCG		 580
581 hci_conn_hold(conn->hcon);
582
583 return smp;
584}
585
586void smp_chan_destroy(struct l2cap_conn *conn)
587{
c8eb9690 588 struct smp_chan *smp = conn->smp_chan;
f4a407be 589 bool complete;
c8eb9690 590
f1c09c07 591 BUG_ON(!smp);
c8eb9690 592
f4a407be
JH		 593 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
594 mgmt_smp_complete(conn->hcon, complete);
595
c8eb9690
BG		 596 kfree(smp);
597 conn->smp_chan = NULL;
2b64d153 598 conn->hcon->smp_conn = NULL;
76a68ba0 599 hci_conn_drop(conn->hcon);
8aab4757
VCG		 600}
601
2b64d153
BG		 602int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
603{
604 struct l2cap_conn *conn = hcon->smp_conn;
605 struct smp_chan *smp;
606 u32 value;
607 u8 key[16];
608
609 BT_DBG("");
610
611 if (!conn)
612 return -ENOTCONN;
613
614 smp = conn->smp_chan;
615
616 switch (mgmt_op) {
617 case MGMT_OP_USER_PASSKEY_REPLY:
618 value = le32_to_cpu(passkey);
619 memset(key, 0, sizeof(key));
620 BT_DBG("PassKey: %d", value);
621 put_unaligned_le32(value, key);
622 swap128(key, smp->tk);
623 /* Fall Through */
624 case MGMT_OP_USER_CONFIRM_REPLY:
625 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
626 break;
627 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
628 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 629 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 630 return 0;
631 default:
84794e11 632 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 633 return -EOPNOTSUPP;
634 }
635
636 /* If it is our turn to send Pairing Confirm, do so now */
637 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
638 queue_work(hcon->hdev->workqueue, &smp->confirm);
639
640 return 0;
641}
642
da85e5e5 643static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 644{
3158c50c 645 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 646 struct smp_chan *smp;
3158c50c 647 u8 key_size;
2b64d153 648 u8 auth = SMP_AUTH_NONE;
8aab4757 649 int ret;
88ba43b6
AB		 650
651 BT_DBG("conn %p", conn);
652
c46b98be
JH		 653 if (skb->len < sizeof(*req))
654 return SMP_UNSPECIFIED;
655
2b64d153
BG		 656 if (conn->hcon->link_mode & HCI_LM_MASTER)
657 return SMP_CMD_NOTSUPP;
658
51a8efd7 659 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 660 smp = smp_chan_create(conn);
d08fd0e7
AE		 661 else
662 smp = conn->smp_chan;
8aab4757 663
d08fd0e7
AE		 664 if (!smp)
665 return SMP_UNSPECIFIED;
d26a2345 666
1c1def09
VCG		 667 smp->preq[0] = SMP_CMD_PAIRING_REQ;
668 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 669 skb_pull(skb, sizeof(*req));
88ba43b6 670
2b64d153
BG		 671 /* We didn't start the pairing, so match remote */
672 if (req->auth_req & SMP_AUTH_BONDING)
673 auth = req->auth_req;
da85e5e5 674
fdde0a26
IY		 675 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
676
2b64d153 677 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 678
679 key_size = min(req->max_key_size, rsp.max_key_size);
680 if (check_enc_key_size(conn, key_size))
681 return SMP_ENC_KEY_SIZE;
88ba43b6 682
e84a6b13 683 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 684
1c1def09
VCG		 685 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
686 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 687
3158c50c 688 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 689
2b64d153
BG		 690 /* Request setup of TK */
691 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
692 if (ret)
693 return SMP_UNSPECIFIED;
694
da85e5e5 695 return 0;
88ba43b6
AB		 696}
697
da85e5e5 698static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 699{
3158c50c 700 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 701 struct smp_chan *smp = conn->smp_chan;
8aab4757 702 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 703 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 704 int ret;
88ba43b6
AB		 705
706 BT_DBG("conn %p", conn);
707
c46b98be
JH		 708 if (skb->len < sizeof(*rsp))
709 return SMP_UNSPECIFIED;
710
2b64d153
BG		 711 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
712 return SMP_CMD_NOTSUPP;
713
3158c50c
VCG		 714 skb_pull(skb, sizeof(*rsp));
715
1c1def09 716 req = (void *) &smp->preq[1];
da85e5e5 717
3158c50c
VCG		 718 key_size = min(req->max_key_size, rsp->max_key_size);
719 if (check_enc_key_size(conn, key_size))
720 return SMP_ENC_KEY_SIZE;
721
e84a6b13 722 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 723
8aab4757
VCG		 724 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
725 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 726
2b64d153 727 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 728 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 729 auth = SMP_AUTH_BONDING;
730
731 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
732
476585ec 733 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 734 if (ret)
735 return SMP_UNSPECIFIED;
736
737 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
738
739 /* Can't compose response until we have been confirmed */
740 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
741 return 0;
742
8aab4757 743 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 744
745 return 0;
88ba43b6
AB		 746}
747
da85e5e5 748static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 749{
1c1def09 750 struct smp_chan *smp = conn->smp_chan;
8aab4757 751 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 752
88ba43b6
AB		 753 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
754
c46b98be
JH		 755 if (skb->len < sizeof(smp->pcnf))
756 return SMP_UNSPECIFIED;
757
1c1def09
VCG		 758 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
759 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 760
7d24ddcc
AB		 761 if (conn->hcon->out) {
762 u8 random[16];
88ba43b6 763
1c1def09 764 swap128(smp->prnd, random);
88ba43b6 765 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 766 random);
2b64d153 767 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 768 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 769 } else {
770 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 771 }
da85e5e5
VCG		 772
773 return 0;
88ba43b6
AB		 774}
775
da85e5e5 776static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 777{
1c1def09 778 struct smp_chan *smp = conn->smp_chan;
8aab4757 779 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 780
8aab4757 781 BT_DBG("conn %p", conn);
3158c50c 782
c46b98be
JH		 783 if (skb->len < sizeof(smp->rrnd))
784 return SMP_UNSPECIFIED;
785
8aab4757
VCG		 786 swap128(skb->data, smp->rrnd);
787 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 788
8aab4757 789 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 790
791 return 0;
88ba43b6
AB		 792}
793
4dab7864 794static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 795{
c9839a11 796 struct smp_ltk *key;
988c5997
VCG		 797 struct hci_conn *hcon = conn->hcon;
798
98a0b845
JH		 799 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
800 hcon->out);
988c5997
VCG		 801 if (!key)
802 return 0;
803
4dab7864
JH		 804 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
805 return 0;
806
51a8efd7 807 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 808 return 1;
809
c9839a11
VCG		 810 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
811 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 812
813 return 1;
988c5997 814}
f1560463 815
da85e5e5 816static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 817{
818 struct smp_cmd_security_req *rp = (void *) skb->data;
819 struct smp_cmd_pairing cp;
f1cb9af5 820 struct hci_conn *hcon = conn->hcon;
8aab4757 821 struct smp_chan *smp;
88ba43b6
AB		 822
823 BT_DBG("conn %p", conn);
824
c46b98be
JH		 825 if (skb->len < sizeof(*rp))
826 return SMP_UNSPECIFIED;
827
86ca9eac
JH		 828 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
829 return SMP_CMD_NOTSUPP;
830
2b64d153 831 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 832
4dab7864 833 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 834 return 0;
835
51a8efd7 836 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 837 return 0;
f1cb9af5 838
8aab4757 839 smp = smp_chan_create(conn);
d26a2345 840
88ba43b6 841 skb_pull(skb, sizeof(*rp));
88ba43b6 842
da85e5e5 843 memset(&cp, 0, sizeof(cp));
54790f73 844 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 845
1c1def09
VCG		 846 smp->preq[0] = SMP_CMD_PAIRING_REQ;
847 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 848
88ba43b6 849 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 850
da85e5e5 851 return 0;
88ba43b6
AB		 852}
853
ad32a2f5
JH		 854bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
855{
856 if (sec_level == BT_SECURITY_LOW)
857 return true;
858
859 if (hcon->sec_level >= sec_level)
860 return true;
861
862 return false;
863}
864
cc110922 865int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 866{
cc110922 867 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 868 struct smp_chan *smp = conn->smp_chan;
2b64d153 869 __u8 authreq;
eb492e01 870
3a0259bb
VCG		 871 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
872
757aee0f 873 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 874 return 1;
875
ad32a2f5 876 if (smp_sufficient_security(hcon, sec_level))
eb492e01 877 return 1;
f1cb9af5 878
988c5997 879 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 880 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 881 goto done;
d26a2345 882
51a8efd7 883 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 884 return 0;
885
8aab4757 886 smp = smp_chan_create(conn);
2b64d153
BG		 887 if (!smp)
888 return 1;
889
890 authreq = seclevel_to_authreq(sec_level);
d26a2345 891
d26a2345
VCG		 892 if (hcon->link_mode & HCI_LM_MASTER) {
893 struct smp_cmd_pairing cp;
f01ead31 894
2b64d153 895 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 896 smp->preq[0] = SMP_CMD_PAIRING_REQ;
897 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 898
eb492e01
AB		 899 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
900 } else {
901 struct smp_cmd_security_req cp;
2b64d153 902 cp.auth_req = authreq;
eb492e01
AB		 903 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
904 }
905
02bc7455 906done:
f1cb9af5 907 hcon->pending_sec_level = sec_level;
f1cb9af5 908
eb492e01
AB		 909 return 0;
910}
911
7034b911
VCG		 912static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
913{
16b90839 914 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 915 struct smp_chan *smp = conn->smp_chan;
16b90839 916
c46b98be
JH		 917 BT_DBG("conn %p", conn);
918
919 if (skb->len < sizeof(*rp))
920 return SMP_UNSPECIFIED;
921
6131ddc8
JH		 922 /* Ignore this PDU if it wasn't requested */
923 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
924 return 0;
925
16b90839
VCG		 926 skb_pull(skb, sizeof(*rp));
927
1c1def09 928 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 929
7034b911
VCG		 930 return 0;
931}
932
933static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
934{
16b90839 935 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 936 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 937 struct hci_dev *hdev = conn->hcon->hdev;
938 struct hci_conn *hcon = conn->hcon;
23d0e128 939 struct smp_ltk *ltk;
c9839a11 940 u8 authenticated;
16b90839 941
c46b98be
JH		 942 BT_DBG("conn %p", conn);
943
944 if (skb->len < sizeof(*rp))
945 return SMP_UNSPECIFIED;
946
6131ddc8
JH		 947 /* Ignore this PDU if it wasn't requested */
948 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
949 return 0;
950
16b90839 951 skb_pull(skb, sizeof(*rp));
7034b911 952
c9839a11 953 hci_dev_lock(hdev);
ce39fb4e 954 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 955 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 956 authenticated, smp->tk, smp->enc_key_size,
957 rp->ediv, rp->rand);
958 smp->ltk = ltk;
fd349c02
JH		 959 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
960 smp_distribute_keys(conn, 1);
c9839a11 961 hci_dev_unlock(hdev);
7034b911
VCG		 962
963 return 0;
964}
965
fd349c02
JH		 966static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
967{
968 struct smp_cmd_ident_info *info = (void *) skb->data;
969 struct smp_chan *smp = conn->smp_chan;
970
971 BT_DBG("");
972
973 if (skb->len < sizeof(*info))
974 return SMP_UNSPECIFIED;
975
6131ddc8
JH		 976 /* Ignore this PDU if it wasn't requested */
977 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
978 return 0;
979
fd349c02
JH		 980 skb_pull(skb, sizeof(*info));
981
982 memcpy(smp->irk, info->irk, 16);
983
984 return 0;
985}
986
987static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
988 struct sk_buff *skb)
989{
990 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
991 struct smp_chan *smp = conn->smp_chan;
992 struct hci_conn *hcon = conn->hcon;
993 bdaddr_t rpa;
994
995 BT_DBG("");
996
997 if (skb->len < sizeof(*info))
998 return SMP_UNSPECIFIED;
999
6131ddc8
JH		 1000 /* Ignore this PDU if it wasn't requested */
1001 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1002 return 0;
1003
fd349c02
JH		 1004 skb_pull(skb, sizeof(*info));
1005
a9a58f86
JH		 1006 /* Strictly speaking the Core Specification (4.1) allows sending
1007 * an empty address which would force us to rely on just the IRK
1008 * as "identity information". However, since such
1009 * implementations are not known of and in order to not over
1010 * complicate our implementation, simply pretend that we never
1011 * received an IRK for such a device.
1012 */
1013 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1014 BT_ERR("Ignoring IRK with no identity address");
1015 smp_distribute_keys(conn, 1);
1016 return 0;
1017 }
1018
fd349c02
JH		 1019 bacpy(&smp->id_addr, &info->bdaddr);
1020 smp->id_addr_type = info->addr_type;
1021
1022 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1023 bacpy(&rpa, &hcon->dst);
1024 else
1025 bacpy(&rpa, BDADDR_ANY);
1026
23d0e128
JH		 1027 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1028 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1029
68d6f6de
JH		 1030 /* Track the connection based on the Identity Address from now on */
1031 bacpy(&hcon->dst, &smp->id_addr);
1032 hcon->dst_type = smp->id_addr_type;
1033
387a33e3
JH		 1034 l2cap_conn_update_id_addr(hcon);
1035
fd349c02
JH		 1036 smp_distribute_keys(conn, 1);
1037
1038 return 0;
1039}
1040
eb492e01
AB		 1041int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1042{
7b9899db 1043 struct hci_conn *hcon = conn->hcon;
92381f5c 1044 __u8 code, reason;
eb492e01
AB		 1045 int err = 0;
1046
7b9899db
MH		 1047 if (hcon->type != LE_LINK) {
1048 kfree_skb(skb);
3432711f 1049 return 0;
7b9899db
MH		 1050 }
1051
92381f5c
MH		 1052 if (skb->len < 1) {
1053 kfree_skb(skb);
1054 return -EILSEQ;
1055 }
1056
06ae3314 1057 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1058 err = -ENOTSUPP;
1059 reason = SMP_PAIRING_NOTSUPP;
1060 goto done;
1061 }
1062
92381f5c 1063 code = skb->data[0];
eb492e01
AB		 1064 skb_pull(skb, sizeof(code));
1065
8cf9fa12
JH		 1066 /*
1067 * The SMP context must be initialized for all other PDUs except
1068 * pairing and security requests. If we get any other PDU when
1069 * not initialized simply disconnect (done if this function
1070 * returns an error).
1071 */
1072 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1073 !conn->smp_chan) {
1074 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1075 kfree_skb(skb);
1076 return -ENOTSUPP;
1077 }
1078
eb492e01
AB		 1079 switch (code) {
1080 case SMP_CMD_PAIRING_REQ:
da85e5e5 1081 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1082 break;
1083
1084 case SMP_CMD_PAIRING_FAIL:
84794e11 1085 smp_failure(conn, 0);
da85e5e5
VCG		 1086 reason = 0;
1087 err = -EPERM;
eb492e01
AB		 1088 break;
1089
1090 case SMP_CMD_PAIRING_RSP:
da85e5e5 1091 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1092 break;
1093
1094 case SMP_CMD_SECURITY_REQ:
da85e5e5 1095 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1096 break;
1097
eb492e01 1098 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1099 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1100 break;
1101
eb492e01 1102 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1103 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1104 break;
1105
eb492e01 1106 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1107 reason = smp_cmd_encrypt_info(conn, skb);
1108 break;
1109
eb492e01 1110 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1111 reason = smp_cmd_master_ident(conn, skb);
1112 break;
1113
eb492e01 1114 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1115 reason = smp_cmd_ident_info(conn, skb);
1116 break;
1117
eb492e01 1118 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1119 reason = smp_cmd_ident_addr_info(conn, skb);
1120 break;
1121
eb492e01 1122 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 1123 /* Just ignored */
1124 reason = 0;
1125 break;
1126
eb492e01
AB		 1127 default:
1128 BT_DBG("Unknown command code 0x%2.2x", code);
1129
1130 reason = SMP_CMD_NOTSUPP;
eb492e01 1131 err = -EOPNOTSUPP;
3a0259bb 1132 goto done;
eb492e01
AB		 1133 }
1134
3a0259bb
VCG		 1135done:
1136 if (reason)
84794e11 1137 smp_failure(conn, reason);
3a0259bb 1138
eb492e01
AB		 1139 kfree_skb(skb);
1140 return err;
1141}
7034b911 1142
35d70271
JH		 1143static void smp_notify_keys(struct l2cap_conn *conn)
1144{
1145 struct smp_chan *smp = conn->smp_chan;
1146 struct hci_conn *hcon = conn->hcon;
1147 struct hci_dev *hdev = hcon->hdev;
1148
95fbac8a
JH		 1149 if (smp->remote_irk)
1150 mgmt_new_irk(hdev, smp->remote_irk);
1151
35d70271
JH		 1152 if (smp->ltk) {
1153 smp->ltk->bdaddr_type = hcon->dst_type;
1154 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1155 mgmt_new_ltk(hdev, smp->ltk);
1156 }
1157
1158 if (smp->slave_ltk) {
1159 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1160 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1161 mgmt_new_ltk(hdev, smp->slave_ltk);
1162 }
1163}
1164
7034b911
VCG		 1165int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
1166{
1167 struct smp_cmd_pairing *req, *rsp;
1c1def09 1168 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1169 struct hci_conn *hcon = conn->hcon;
1170 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1171 __u8 *keydist;
1172
1173 BT_DBG("conn %p force %d", conn, force);
1174
524237cb 1175 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1176 return 0;
1177
1c1def09 1178 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1179
1180 /* The responder sends its keys first */
524237cb 1181 if (!force && hcon->out && (rsp->resp_key_dist & 0x07))
7034b911
VCG		 1182 return 0;
1183
1c1def09 1184 req = (void *) &smp->preq[1];
7034b911 1185
524237cb 1186 if (hcon->out) {
7034b911
VCG		 1187 keydist = &rsp->init_key_dist;
1188 *keydist &= req->init_key_dist;
1189 } else {
1190 keydist = &rsp->resp_key_dist;
1191 *keydist &= req->resp_key_dist;
1192 }
1193
7034b911
VCG		 1194 BT_DBG("keydist 0x%x", *keydist);
1195
1196 if (*keydist & SMP_DIST_ENC_KEY) {
1197 struct smp_cmd_encrypt_info enc;
1198 struct smp_cmd_master_ident ident;
23d0e128 1199 struct smp_ltk *ltk;
c9839a11 1200 u8 authenticated;
7034b911
VCG		 1201 __le16 ediv;
1202
1203 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1204 get_random_bytes(&ediv, sizeof(ediv));
1205 get_random_bytes(ident.rand, sizeof(ident.rand));
1206
1207 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1208
c9839a11 1209 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1210 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271
JH		 1211 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
1212 smp->enc_key_size, ediv, ident.rand);
23d0e128 1213 smp->slave_ltk = ltk;
16b90839 1214
58115373 1215 ident.ediv = ediv;
7034b911
VCG		 1216
1217 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1218
1219 *keydist &= ~SMP_DIST_ENC_KEY;
1220 }
1221
1222 if (*keydist & SMP_DIST_ID_KEY) {
1223 struct smp_cmd_ident_addr_info addrinfo;
1224 struct smp_cmd_ident_info idinfo;
1225
863efaf2 1226 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1227
1228 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1229
82d4b359
JH		 1230 /* The hci_conn contains the local identity address
1231 * after the connection has been established.
1232 *
1233 * This is true even when the connection has been
1234 * established using a resolvable random address.
1235 */
524237cb 1236 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1237 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1238
1239 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1240 &addrinfo);
7034b911
VCG		 1241
1242 *keydist &= ~SMP_DIST_ID_KEY;
1243 }
1244
1245 if (*keydist & SMP_DIST_SIGN) {
1246 struct smp_cmd_sign_info sign;
1247
1248 /* Send a dummy key */
1249 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1250
1251 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1252
1253 *keydist &= ~SMP_DIST_SIGN;
1254 }
1255
524237cb
JH		 1256 if (hcon->out || force || !(rsp->init_key_dist & 0x07)) {
1257 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
6c9d42a1 1258 cancel_delayed_work_sync(&conn->security_timer);
f4a407be 1259 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
35d70271 1260 smp_notify_keys(conn);
8aab4757 1261 smp_chan_destroy(conn);
d26a2345
VCG		 1262 }
1263
7034b911
VCG		 1264 return 0;
1265}
Linux kernel - Deliverables
This page took 0.242172 seconds and 5 git commands to generate.