projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Remove unused l2cap_conn_shutdown API
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
533e35d4
JH		 38enum {
39 SMP_FLAG_TK_VALID,
40 SMP_FLAG_CFM_PENDING,
41 SMP_FLAG_MITM_AUTH,
42 SMP_FLAG_COMPLETE,
43 SMP_FLAG_INITIATOR,
44};
4bc58f51
JH		 45
46struct smp_chan {
b68fda68
JH		 47 struct l2cap_conn *conn;
48 struct delayed_work security_timer;
86d1407c 49 struct work_struct distribute_work;
b68fda68 50
4bc58f51
JH		 51 u8 preq[7]; /* SMP Pairing Request */
52 u8 prsp[7]; /* SMP Pairing Response */
53 u8 prnd[16]; /* SMP Pairing Random (local) */
54 u8 rrnd[16]; /* SMP Pairing Random (remote) */
55 u8 pcnf[16]; /* SMP Pairing Confirm */
56 u8 tk[16]; /* SMP Temporary Key */
57 u8 enc_key_size;
58 u8 remote_key_dist;
59 bdaddr_t id_addr;
60 u8 id_addr_type;
61 u8 irk[16];
62 struct smp_csrk *csrk;
63 struct smp_csrk *slave_csrk;
64 struct smp_ltk *ltk;
65 struct smp_ltk *slave_ltk;
66 struct smp_irk *remote_irk;
4a74d658 67 unsigned long flags;
6a7bd103
JH		 68
69 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 70};
71
8a2936f4 72static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 73{
8a2936f4 74 size_t i;
d22ef0bc 75
8a2936f4
JH		 76 for (i = 0; i < len; i++)
77 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 78}
79
80static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
81{
82 struct blkcipher_desc desc;
83 struct scatterlist sg;
943a732a 84 uint8_t tmp[16], data[16];
201a5929 85 int err;
d22ef0bc
AB		 86
87 if (tfm == NULL) {
88 BT_ERR("tfm %p", tfm);
89 return -EINVAL;
90 }
91
92 desc.tfm = tfm;
93 desc.flags = 0;
94
943a732a 95 /* The most significant octet of key corresponds to k[0] */
8a2936f4 96 swap_buf(k, tmp, 16);
943a732a
JH		 97
98 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 99 if (err) {
100 BT_ERR("cipher setkey failed: %d", err);
101 return err;
102 }
103
943a732a 104 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 105 swap_buf(r, data, 16);
943a732a
JH		 106
107 sg_init_one(&sg, data, 16);
d22ef0bc 108
d22ef0bc
AB		 109 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
110 if (err)
111 BT_ERR("Encrypt data error %d", err);
112
943a732a 113 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 114 swap_buf(data, r, 16);
943a732a 115
d22ef0bc
AB		 116 return err;
117}
118
60478054
JH		 119static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
120{
943a732a 121 u8 _res[16];
60478054
JH		 122 int err;
123
124 /* r' = padding || r */
943a732a
JH		 125 memcpy(_res, r, 3);
126 memset(_res + 3, 0, 13);
60478054 127
943a732a 128 err = smp_e(tfm, irk, _res);
60478054
JH		 129 if (err) {
130 BT_ERR("Encrypt error");
131 return err;
132 }
133
134 /* The output of the random address function ah is:
135 * ah(h, r) = e(k, r') mod 2^24
136 * The output of the security function e is then truncated to 24 bits
137 * by taking the least significant 24 bits of the output of e as the
138 * result of ah.
139 */
943a732a 140 memcpy(res, _res, 3);
60478054
JH		 141
142 return 0;
143}
144
defce9e8 145bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 146{
defce9e8
JH		 147 struct l2cap_chan *chan = hdev->smp_data;
148 struct crypto_blkcipher *tfm;
60478054
JH		 149 u8 hash[3];
150 int err;
151
defce9e8
JH		 152 if (!chan || !chan->data)
153 return false;
154
155 tfm = chan->data;
156
60478054
JH		 157 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
158
159 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
160 if (err)
161 return false;
162
163 return !memcmp(bdaddr->b, hash, 3);
164}
165
defce9e8 166int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 167{
defce9e8
JH		 168 struct l2cap_chan *chan = hdev->smp_data;
169 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 170 int err;
171
defce9e8
JH		 172 if (!chan || !chan->data)
173 return -EOPNOTSUPP;
174
175 tfm = chan->data;
176
b1e2b3ae
JH		 177 get_random_bytes(&rpa->b[3], 3);
178
179 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
180 rpa->b[5] |= 0x40; /* Set second most significant bit */
181
182 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
183 if (err < 0)
184 return err;
185
186 BT_DBG("RPA %pMR", rpa);
187
188 return 0;
189}
190
ec70f36f
JH		 191static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
192 u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
193 u8 res[16])
d22ef0bc 194{
ec70f36f 195 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 196 u8 p1[16], p2[16];
197 int err;
198
ec70f36f
JH		 199 BT_DBG("%s", hdev->name);
200
d22ef0bc
AB		 201 memset(p1, 0, 16);
202
203 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 204 p1[0] = _iat;
205 p1[1] = _rat;
206 memcpy(p1 + 2, preq, 7);
207 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 208
209 /* p2 = padding || ia || ra */
943a732a
JH		 210 memcpy(p2, ra, 6);
211 memcpy(p2 + 6, ia, 6);
212 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 213
214 /* res = r XOR p1 */
215 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
216
217 /* res = e(k, res) */
ec70f36f 218 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 219 if (err) {
220 BT_ERR("Encrypt data error");
221 return err;
222 }
223
224 /* res = res XOR p2 */
225 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
226
227 /* res = e(k, res) */
ec70f36f 228 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 229 if (err)
230 BT_ERR("Encrypt data error");
231
232 return err;
233}
234
ec70f36f
JH		 235static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
236 u8 _r[16])
d22ef0bc 237{
ec70f36f 238 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 239 int err;
240
ec70f36f
JH		 241 BT_DBG("%s", hdev->name);
242
d22ef0bc 243 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 244 memcpy(_r, r2, 8);
245 memcpy(_r + 8, r1, 8);
d22ef0bc 246
ec70f36f 247 err = smp_e(smp->tfm_aes, k, _r);
d22ef0bc
AB		 248 if (err)
249 BT_ERR("Encrypt data error");
250
251 return err;
252}
253
5d88cc73 254static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 255{
5d88cc73 256 struct l2cap_chan *chan = conn->smp;
b68fda68 257 struct smp_chan *smp;
5d88cc73
JH		 258 struct kvec iv[2];
259 struct msghdr msg;
eb492e01 260
5d88cc73
JH		 261 if (!chan)
262 return;
eb492e01 263
5d88cc73 264 BT_DBG("code 0x%2.2x", code);
eb492e01 265
5d88cc73
JH		 266 iv[0].iov_base = &code;
267 iv[0].iov_len = 1;
eb492e01 268
5d88cc73
JH		 269 iv[1].iov_base = data;
270 iv[1].iov_len = len;
eb492e01 271
5d88cc73 272 memset(&msg, 0, sizeof(msg));
eb492e01 273
5d88cc73
JH		 274 msg.msg_iov = (struct iovec *) &iv;
275 msg.msg_iovlen = 2;
eb492e01 276
5d88cc73 277 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 278
b68fda68
JH		 279 if (!chan->data)
280 return;
281
282 smp = chan->data;
283
284 cancel_delayed_work_sync(&smp->security_timer);
285 if (test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
286 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 287}
288
2b64d153
BG		 289static __u8 authreq_to_seclevel(__u8 authreq)
290{
291 if (authreq & SMP_AUTH_MITM)
292 return BT_SECURITY_HIGH;
293 else
294 return BT_SECURITY_MEDIUM;
295}
296
297static __u8 seclevel_to_authreq(__u8 sec_level)
298{
299 switch (sec_level) {
300 case BT_SECURITY_HIGH:
301 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
302 case BT_SECURITY_MEDIUM:
303 return SMP_AUTH_BONDING;
304 default:
305 return SMP_AUTH_NONE;
306 }
307}
308
b8e66eac 309static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 310 struct smp_cmd_pairing *req,
311 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 312{
5d88cc73
JH		 313 struct l2cap_chan *chan = conn->smp;
314 struct smp_chan *smp = chan->data;
fd349c02
JH		 315 struct hci_conn *hcon = conn->hcon;
316 struct hci_dev *hdev = hcon->hdev;
317 u8 local_dist = 0, remote_dist = 0;
54790f73 318
b6ae8457 319 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 320 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
321 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 322 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 323 } else {
324 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 325 }
326
fd349c02
JH		 327 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
328 remote_dist |= SMP_DIST_ID_KEY;
329
863efaf2
JH		 330 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
331 local_dist |= SMP_DIST_ID_KEY;
332
54790f73
VCG		 333 if (rsp == NULL) {
334 req->io_capability = conn->hcon->io_capability;
335 req->oob_flag = SMP_OOB_NOT_PRESENT;
336 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 337 req->init_key_dist = local_dist;
338 req->resp_key_dist = remote_dist;
065a13e2 339 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 340
341 smp->remote_key_dist = remote_dist;
54790f73
VCG		 342 return;
343 }
344
345 rsp->io_capability = conn->hcon->io_capability;
346 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
347 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 348 rsp->init_key_dist = req->init_key_dist & remote_dist;
349 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 350 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 351
352 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 353}
354
3158c50c
VCG		 355static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
356{
5d88cc73
JH		 357 struct l2cap_chan *chan = conn->smp;
358 struct smp_chan *smp = chan->data;
1c1def09 359
3158c50c 360 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 361 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 362 return SMP_ENC_KEY_SIZE;
363
f7aa611a 364 smp->enc_key_size = max_key_size;
3158c50c
VCG		 365
366 return 0;
367}
368
6f48e260
JH		 369static void smp_chan_destroy(struct l2cap_conn *conn)
370{
371 struct l2cap_chan *chan = conn->smp;
372 struct smp_chan *smp = chan->data;
373 bool complete;
374
375 BUG_ON(!smp);
376
377 cancel_delayed_work_sync(&smp->security_timer);
378 /* In case the timeout freed the SMP context */
379 if (!chan->data)
380 return;
381
382 if (work_pending(&smp->distribute_work)) {
383 cancel_work_sync(&smp->distribute_work);
384 if (!chan->data)
385 return;
386 }
387
388 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
389 mgmt_smp_complete(conn->hcon, complete);
390
391 kfree(smp->csrk);
392 kfree(smp->slave_csrk);
393
394 crypto_free_blkcipher(smp->tfm_aes);
395
396 /* If pairing failed clean up any keys we might have */
397 if (!complete) {
398 if (smp->ltk) {
399 list_del(&smp->ltk->list);
400 kfree(smp->ltk);
401 }
402
403 if (smp->slave_ltk) {
404 list_del(&smp->slave_ltk->list);
405 kfree(smp->slave_ltk);
406 }
407
408 if (smp->remote_irk) {
409 list_del(&smp->remote_irk->list);
410 kfree(smp->remote_irk);
411 }
412 }
413
414 chan->data = NULL;
415 kfree(smp);
416 hci_conn_drop(conn->hcon);
417}
418
84794e11 419static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 420{
bab73cb6 421 struct hci_conn *hcon = conn->hcon;
b68fda68
JH		 422 struct l2cap_chan *chan = conn->smp;
423 struct smp_chan *smp;
bab73cb6 424
84794e11 425 if (reason)
4f957a76 426 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 427 &reason);
4f957a76 428
ce39fb4e
MH		 429 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
430 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
431 HCI_ERROR_AUTH_FAILURE);
f1c09c07 432
b68fda68
JH		 433 if (!chan->data)
434 return;
435
436 smp = chan->data;
437
ce39fb4e 438 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 439 smp_chan_destroy(conn);
4f957a76
BG		 440}
441
2b64d153
BG		 442#define JUST_WORKS 0x00
443#define JUST_CFM 0x01
444#define REQ_PASSKEY 0x02
445#define CFM_PASSKEY 0x03
446#define REQ_OOB 0x04
447#define OVERLAP 0xFF
448
449static const u8 gen_method[5][5] = {
450 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
451 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
452 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
453 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
454 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
455};
456
581370cc
JH		 457static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
458{
2bcd4003
JH		 459 /* If either side has unknown io_caps, use JUST_CFM (which gets
460 * converted later to JUST_WORKS if we're initiators.
461 */
581370cc
JH		 462 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
463 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 464 return JUST_CFM;
581370cc
JH		 465
466 return gen_method[remote_io][local_io];
467}
468
2b64d153
BG		 469static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
470 u8 local_io, u8 remote_io)
471{
472 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 473 struct l2cap_chan *chan = conn->smp;
474 struct smp_chan *smp = chan->data;
2b64d153
BG		 475 u8 method;
476 u32 passkey = 0;
477 int ret = 0;
478
479 /* Initialize key for JUST WORKS */
480 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 481 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 482
483 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
484
2bcd4003
JH		 485 /* If neither side wants MITM, either "just" confirm an incoming
486 * request or use just-works for outgoing ones. The JUST_CFM
487 * will be converted to JUST_WORKS if necessary later in this
488 * function. If either side has MITM look up the method from the
489 * table.
490 */
581370cc 491 if (!(auth & SMP_AUTH_MITM))
2bcd4003 492 method = JUST_CFM;
2b64d153 493 else
581370cc 494 method = get_auth_method(smp, local_io, remote_io);
2b64d153 495
a82505c7 496 /* Don't confirm locally initiated pairing attempts */
4a74d658 497 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 498 method = JUST_WORKS;
499
02f3e254
JH		 500 /* Don't bother user space with no IO capabilities */
501 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
502 method = JUST_WORKS;
503
2b64d153
BG		 504 /* If Just Works, Continue with Zero TK */
505 if (method == JUST_WORKS) {
4a74d658 506 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 507 return 0;
508 }
509
510 /* Not Just Works/Confirm results in MITM Authentication */
511 if (method != JUST_CFM)
4a74d658 512 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 513
514 /* If both devices have Keyoard-Display I/O, the master
515 * Confirms and the slave Enters the passkey.
516 */
517 if (method == OVERLAP) {
40bef302 518 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 519 method = CFM_PASSKEY;
520 else
521 method = REQ_PASSKEY;
522 }
523
01ad34d2 524 /* Generate random passkey. */
2b64d153 525 if (method == CFM_PASSKEY) {
943a732a 526 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 527 get_random_bytes(&passkey, sizeof(passkey));
528 passkey %= 1000000;
943a732a 529 put_unaligned_le32(passkey, smp->tk);
2b64d153 530 BT_DBG("PassKey: %d", passkey);
4a74d658 531 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 532 }
533
534 hci_dev_lock(hcon->hdev);
535
536 if (method == REQ_PASSKEY)
ce39fb4e 537 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 538 hcon->type, hcon->dst_type);
4eb65e66
JH		 539 else if (method == JUST_CFM)
540 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
541 hcon->type, hcon->dst_type,
542 passkey, 1);
2b64d153 543 else
01ad34d2 544 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 545 hcon->type, hcon->dst_type,
39adbffe 546 passkey, 0);
2b64d153
BG		 547
548 hci_dev_unlock(hcon->hdev);
549
550 return ret;
551}
552
1cc61144 553static u8 smp_confirm(struct smp_chan *smp)
8aab4757 554{
8aab4757 555 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 556 struct smp_cmd_pairing_confirm cp;
557 int ret;
8aab4757
VCG		 558
559 BT_DBG("conn %p", conn);
560
ec70f36f 561 ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 562 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 563 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
564 cp.confirm_val);
1cc61144
JH		 565 if (ret)
566 return SMP_UNSPECIFIED;
8aab4757 567
4a74d658 568 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 569
8aab4757
VCG		 570 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
571
1cc61144 572 return 0;
8aab4757
VCG		 573}
574
861580a9 575static u8 smp_random(struct smp_chan *smp)
8aab4757 576{
8aab4757
VCG		 577 struct l2cap_conn *conn = smp->conn;
578 struct hci_conn *hcon = conn->hcon;
861580a9 579 u8 confirm[16];
8aab4757
VCG		 580 int ret;
581
ec70f36f 582 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 583 return SMP_UNSPECIFIED;
8aab4757
VCG		 584
585 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
586
ec70f36f 587 ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 588 hcon->init_addr_type, &hcon->init_addr,
943a732a 589 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 590 if (ret)
591 return SMP_UNSPECIFIED;
8aab4757 592
8aab4757
VCG		 593 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
594 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 595 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 596 }
597
598 if (hcon->out) {
fe39c7b2
MH		 599 u8 stk[16];
600 __le64 rand = 0;
601 __le16 ediv = 0;
8aab4757 602
ec70f36f 603 smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 604
f7aa611a 605 memset(stk + smp->enc_key_size, 0,
04124681 606 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 607
861580a9
JH		 608 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
609 return SMP_UNSPECIFIED;
8aab4757
VCG		 610
611 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 612 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 613 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 614 } else {
fff3490f 615 u8 stk[16], auth;
fe39c7b2
MH		 616 __le64 rand = 0;
617 __le16 ediv = 0;
8aab4757 618
943a732a
JH		 619 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
620 smp->prnd);
8aab4757 621
ec70f36f 622 smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 623
f7aa611a 624 memset(stk + smp->enc_key_size, 0,
f1560463 625 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 626
fff3490f
JH		 627 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
628 auth = 1;
629 else
630 auth = 0;
631
7d5843b7
JH		 632 /* Even though there's no _SLAVE suffix this is the
633 * slave STK we're adding for later lookup (the master
634 * STK never needs to be stored).
635 */
ce39fb4e 636 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 637 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 638 }
639
861580a9 640 return 0;
8aab4757
VCG		 641}
642
44f1a7ab
JH		 643static void smp_notify_keys(struct l2cap_conn *conn)
644{
645 struct l2cap_chan *chan = conn->smp;
646 struct smp_chan *smp = chan->data;
647 struct hci_conn *hcon = conn->hcon;
648 struct hci_dev *hdev = hcon->hdev;
649 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
650 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
651 bool persistent;
652
653 if (smp->remote_irk) {
654 mgmt_new_irk(hdev, smp->remote_irk);
655 /* Now that user space can be considered to know the
656 * identity address track the connection based on it
657 * from now on.
658 */
659 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
660 hcon->dst_type = smp->remote_irk->addr_type;
661 l2cap_conn_update_id_addr(hcon);
662
663 /* When receiving an indentity resolving key for
664 * a remote device that does not use a resolvable
665 * private address, just remove the key so that
666 * it is possible to use the controller white
667 * list for scanning.
668 *
669 * Userspace will have been told to not store
670 * this key at this point. So it is safe to
671 * just remove it.
672 */
673 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
674 list_del(&smp->remote_irk->list);
675 kfree(smp->remote_irk);
676 smp->remote_irk = NULL;
677 }
678 }
679
680 /* The LTKs and CSRKs should be persistent only if both sides
681 * had the bonding bit set in their authentication requests.
682 */
683 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
684
685 if (smp->csrk) {
686 smp->csrk->bdaddr_type = hcon->dst_type;
687 bacpy(&smp->csrk->bdaddr, &hcon->dst);
688 mgmt_new_csrk(hdev, smp->csrk, persistent);
689 }
690
691 if (smp->slave_csrk) {
692 smp->slave_csrk->bdaddr_type = hcon->dst_type;
693 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
694 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
695 }
696
697 if (smp->ltk) {
698 smp->ltk->bdaddr_type = hcon->dst_type;
699 bacpy(&smp->ltk->bdaddr, &hcon->dst);
700 mgmt_new_ltk(hdev, smp->ltk, persistent);
701 }
702
703 if (smp->slave_ltk) {
704 smp->slave_ltk->bdaddr_type = hcon->dst_type;
705 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
706 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
707 }
708}
709
86d1407c 710static void smp_distribute_keys(struct work_struct *work)
44f1a7ab 711{
86d1407c
JH		 712 struct smp_chan *smp = container_of(work, struct smp_chan,
713 distribute_work);
44f1a7ab 714 struct smp_cmd_pairing *req, *rsp;
86d1407c 715 struct l2cap_conn *conn = smp->conn;
44f1a7ab
JH		 716 struct hci_conn *hcon = conn->hcon;
717 struct hci_dev *hdev = hcon->hdev;
718 __u8 *keydist;
719
720 BT_DBG("conn %p", conn);
721
722 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
86d1407c 723 return;
44f1a7ab
JH		 724
725 rsp = (void *) &smp->prsp[1];
726
727 /* The responder sends its keys first */
728 if (hcon->out && (smp->remote_key_dist & 0x07))
86d1407c 729 return;
44f1a7ab
JH		 730
731 req = (void *) &smp->preq[1];
732
733 if (hcon->out) {
734 keydist = &rsp->init_key_dist;
735 *keydist &= req->init_key_dist;
736 } else {
737 keydist = &rsp->resp_key_dist;
738 *keydist &= req->resp_key_dist;
739 }
740
741 BT_DBG("keydist 0x%x", *keydist);
742
743 if (*keydist & SMP_DIST_ENC_KEY) {
744 struct smp_cmd_encrypt_info enc;
745 struct smp_cmd_master_ident ident;
746 struct smp_ltk *ltk;
747 u8 authenticated;
748 __le16 ediv;
749 __le64 rand;
750
751 get_random_bytes(enc.ltk, sizeof(enc.ltk));
752 get_random_bytes(&ediv, sizeof(ediv));
753 get_random_bytes(&rand, sizeof(rand));
754
755 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
756
757 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
758 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
759 SMP_LTK_SLAVE, authenticated, enc.ltk,
760 smp->enc_key_size, ediv, rand);
761 smp->slave_ltk = ltk;
762
763 ident.ediv = ediv;
764 ident.rand = rand;
765
766 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
767
768 *keydist &= ~SMP_DIST_ENC_KEY;
769 }
770
771 if (*keydist & SMP_DIST_ID_KEY) {
772 struct smp_cmd_ident_addr_info addrinfo;
773 struct smp_cmd_ident_info idinfo;
774
775 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
776
777 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
778
779 /* The hci_conn contains the local identity address
780 * after the connection has been established.
781 *
782 * This is true even when the connection has been
783 * established using a resolvable random address.
784 */
785 bacpy(&addrinfo.bdaddr, &hcon->src);
786 addrinfo.addr_type = hcon->src_type;
787
788 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
789 &addrinfo);
790
791 *keydist &= ~SMP_DIST_ID_KEY;
792 }
793
794 if (*keydist & SMP_DIST_SIGN) {
795 struct smp_cmd_sign_info sign;
796 struct smp_csrk *csrk;
797
798 /* Generate a new random key */
799 get_random_bytes(sign.csrk, sizeof(sign.csrk));
800
801 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
802 if (csrk) {
803 csrk->master = 0x00;
804 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
805 }
806 smp->slave_csrk = csrk;
807
808 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
809
810 *keydist &= ~SMP_DIST_SIGN;
811 }
812
813 /* If there are still keys to be received wait for them */
814 if ((smp->remote_key_dist & 0x07))
86d1407c 815 return;
44f1a7ab
JH		 816
817 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
44f1a7ab
JH		 818 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
819 smp_notify_keys(conn);
820
821 smp_chan_destroy(conn);
44f1a7ab
JH		 822}
823
b68fda68
JH		 824static void smp_timeout(struct work_struct *work)
825{
826 struct smp_chan *smp = container_of(work, struct smp_chan,
827 security_timer.work);
828 struct l2cap_conn *conn = smp->conn;
829
830 BT_DBG("conn %p", conn);
831
1e91c29e 832 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
b68fda68
JH		 833}
834
8aab4757
VCG		 835static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
836{
5d88cc73 837 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 838 struct smp_chan *smp;
839
f1560463 840 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
616d55be
JH		 841 if (!smp) {
842 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
8aab4757 843 return NULL;
616d55be 844 }
8aab4757 845
6a7bd103
JH		 846 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
847 if (IS_ERR(smp->tfm_aes)) {
848 BT_ERR("Unable to create ECB crypto context");
849 kfree(smp);
616d55be 850 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6a7bd103
JH		 851 return NULL;
852 }
853
8aab4757 854 smp->conn = conn;
5d88cc73 855 chan->data = smp;
8aab4757 856
86d1407c 857 INIT_WORK(&smp->distribute_work, smp_distribute_keys);
b68fda68
JH		 858 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
859
8aab4757
VCG		 860 hci_conn_hold(conn->hcon);
861
862 return smp;
863}
864
2b64d153
BG		 865int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
866{
b10e8017 867 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 868 struct l2cap_chan *chan;
2b64d153
BG		 869 struct smp_chan *smp;
870 u32 value;
2b64d153
BG		 871
872 BT_DBG("");
873
642ac774 874 if (!conn || !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
2b64d153
BG		 875 return -ENOTCONN;
876
5d88cc73
JH		 877 chan = conn->smp;
878 if (!chan)
879 return -ENOTCONN;
880
881 smp = chan->data;
2b64d153
BG		 882
883 switch (mgmt_op) {
884 case MGMT_OP_USER_PASSKEY_REPLY:
885 value = le32_to_cpu(passkey);
943a732a 886 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 887 BT_DBG("PassKey: %d", value);
943a732a 888 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 889 /* Fall Through */
890 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 891 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 892 break;
893 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
894 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 895 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 896 return 0;
897 default:
84794e11 898 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 899 return -EOPNOTSUPP;
900 }
901
902 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 903 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
904 u8 rsp = smp_confirm(smp);
905 if (rsp)
906 smp_failure(conn, rsp);
907 }
2b64d153
BG		 908
909 return 0;
910}
911
da85e5e5 912static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 913{
3158c50c 914 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
b3c6410b 915 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 916 struct smp_chan *smp;
c7262e71 917 u8 key_size, auth, sec_level;
8aab4757 918 int ret;
88ba43b6
AB		 919
920 BT_DBG("conn %p", conn);
921
c46b98be 922 if (skb->len < sizeof(*req))
38e4a915 923 return SMP_INVALID_PARAMS;
c46b98be 924
40bef302 925 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 926 return SMP_CMD_NOTSUPP;
927
5d88cc73 928 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
8aab4757 929 smp = smp_chan_create(conn);
5d88cc73
JH		 930 } else {
931 struct l2cap_chan *chan = conn->smp;
932 smp = chan->data;
933 }
8aab4757 934
d08fd0e7
AE		 935 if (!smp)
936 return SMP_UNSPECIFIED;
d26a2345 937
b6ae8457 938 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
b3c6410b
JH		 939 (req->auth_req & SMP_AUTH_BONDING))
940 return SMP_PAIRING_NOTSUPP;
941
1c1def09
VCG		 942 smp->preq[0] = SMP_CMD_PAIRING_REQ;
943 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 944 skb_pull(skb, sizeof(*req));
88ba43b6 945
2b64d153 946 /* We didn't start the pairing, so match remote */
1ef35827 947 auth = req->auth_req;
da85e5e5 948
c7262e71
JH		 949 sec_level = authreq_to_seclevel(auth);
950 if (sec_level > conn->hcon->pending_sec_level)
951 conn->hcon->pending_sec_level = sec_level;
fdde0a26 952
2ed8f65c
JH		 953 /* If we need MITM check that it can be acheived */
954 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
955 u8 method;
956
957 method = get_auth_method(smp, conn->hcon->io_capability,
958 req->io_capability);
959 if (method == JUST_WORKS || method == JUST_CFM)
960 return SMP_AUTH_REQUIREMENTS;
961 }
962
2b64d153 963 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 964
965 key_size = min(req->max_key_size, rsp.max_key_size);
966 if (check_enc_key_size(conn, key_size))
967 return SMP_ENC_KEY_SIZE;
88ba43b6 968
e84a6b13 969 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 970
1c1def09
VCG		 971 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
972 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 973
3158c50c 974 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 975
2b64d153
BG		 976 /* Request setup of TK */
977 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
978 if (ret)
979 return SMP_UNSPECIFIED;
980
da85e5e5 981 return 0;
88ba43b6
AB		 982}
983
da85e5e5 984static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 985{
3158c50c 986 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 987 struct l2cap_chan *chan = conn->smp;
988 struct smp_chan *smp = chan->data;
2b64d153 989 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 990 int ret;
88ba43b6
AB		 991
992 BT_DBG("conn %p", conn);
993
c46b98be 994 if (skb->len < sizeof(*rsp))
38e4a915 995 return SMP_INVALID_PARAMS;
c46b98be 996
40bef302 997 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 998 return SMP_CMD_NOTSUPP;
999
3158c50c
VCG		 1000 skb_pull(skb, sizeof(*rsp));
1001
1c1def09 1002 req = (void *) &smp->preq[1];
da85e5e5 1003
3158c50c
VCG		 1004 key_size = min(req->max_key_size, rsp->max_key_size);
1005 if (check_enc_key_size(conn, key_size))
1006 return SMP_ENC_KEY_SIZE;
1007
2ed8f65c
JH		 1008 /* If we need MITM check that it can be acheived */
1009 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1010 u8 method;
1011
1012 method = get_auth_method(smp, req->io_capability,
1013 rsp->io_capability);
1014 if (method == JUST_WORKS || method == JUST_CFM)
1015 return SMP_AUTH_REQUIREMENTS;
1016 }
1017
e84a6b13 1018 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1019
8aab4757
VCG		 1020 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1021 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1022
fdcc4bec
JH		 1023 /* Update remote key distribution in case the remote cleared
1024 * some bits that we had enabled in our request.
1025 */
1026 smp->remote_key_dist &= rsp->resp_key_dist;
1027
2b64d153 1028 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 1029 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 1030 auth = SMP_AUTH_BONDING;
1031
1032 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
1033
476585ec 1034 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1035 if (ret)
1036 return SMP_UNSPECIFIED;
1037
4a74d658 1038 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1039
1040 /* Can't compose response until we have been confirmed */
4a74d658 1041 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1042 return smp_confirm(smp);
da85e5e5
VCG		 1043
1044 return 0;
88ba43b6
AB		 1045}
1046
da85e5e5 1047static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1048{
5d88cc73
JH		 1049 struct l2cap_chan *chan = conn->smp;
1050 struct smp_chan *smp = chan->data;
7d24ddcc 1051
88ba43b6
AB		 1052 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1053
c46b98be 1054 if (skb->len < sizeof(smp->pcnf))
38e4a915 1055 return SMP_INVALID_PARAMS;
c46b98be 1056
1c1def09
VCG		 1057 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1058 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1059
943a732a
JH		 1060 if (conn->hcon->out)
1061 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1062 smp->prnd);
4a74d658 1063 else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1064 return smp_confirm(smp);
943a732a 1065 else
4a74d658 1066 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1067
1068 return 0;
88ba43b6
AB		 1069}
1070
da85e5e5 1071static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1072{
5d88cc73
JH		 1073 struct l2cap_chan *chan = conn->smp;
1074 struct smp_chan *smp = chan->data;
7d24ddcc 1075
8aab4757 1076 BT_DBG("conn %p", conn);
3158c50c 1077
c46b98be 1078 if (skb->len < sizeof(smp->rrnd))
38e4a915 1079 return SMP_INVALID_PARAMS;
c46b98be 1080
943a732a 1081 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1082 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1083
861580a9 1084 return smp_random(smp);
88ba43b6
AB		 1085}
1086
f81cd823 1087static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1088{
c9839a11 1089 struct smp_ltk *key;
988c5997
VCG		 1090 struct hci_conn *hcon = conn->hcon;
1091
98a0b845 1092 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1093 hcon->role);
988c5997 1094 if (!key)
f81cd823 1095 return false;
988c5997 1096
4dab7864 1097 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
f81cd823 1098 return false;
4dab7864 1099
51a8efd7 1100 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1101 return true;
988c5997 1102
c9839a11
VCG		 1103 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1104 hcon->enc_key_size = key->enc_size;
988c5997 1105
fe59a05f
JH		 1106 /* We never store STKs for master role, so clear this flag */
1107 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1108
f81cd823 1109 return true;
988c5997 1110}
f1560463 1111
854f4727
JH		 1112bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
1113{
1114 if (sec_level == BT_SECURITY_LOW)
1115 return true;
1116
9ab65d60
JH		 1117 /* If we're encrypted with an STK always claim insufficient
1118 * security. This way we allow the connection to be re-encrypted
1119 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 1120 * security. Only exception is if we don't have an LTK (e.g.
1121 * because of key distribution bits).
9ab65d60 1122 */
b2d5e254
JH		 1123 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
1124 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1125 hcon->role))
9ab65d60
JH		 1126 return false;
1127
854f4727
JH		 1128 if (hcon->sec_level >= sec_level)
1129 return true;
1130
1131 return false;
1132}
1133
da85e5e5 1134static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1135{
1136 struct smp_cmd_security_req *rp = (void *) skb->data;
1137 struct smp_cmd_pairing cp;
f1cb9af5 1138 struct hci_conn *hcon = conn->hcon;
8aab4757 1139 struct smp_chan *smp;
c7262e71 1140 u8 sec_level;
88ba43b6
AB		 1141
1142 BT_DBG("conn %p", conn);
1143
c46b98be 1144 if (skb->len < sizeof(*rp))
38e4a915 1145 return SMP_INVALID_PARAMS;
c46b98be 1146
40bef302 1147 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1148 return SMP_CMD_NOTSUPP;
1149
c7262e71 1150 sec_level = authreq_to_seclevel(rp->auth_req);
854f4727
JH		 1151 if (smp_sufficient_security(hcon, sec_level))
1152 return 0;
1153
c7262e71
JH		 1154 if (sec_level > hcon->pending_sec_level)
1155 hcon->pending_sec_level = sec_level;
feb45eb5 1156
4dab7864 1157 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1158 return 0;
1159
51a8efd7 1160 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 1161 return 0;
f1cb9af5 1162
8aab4757 1163 smp = smp_chan_create(conn);
c29d2444
JH		 1164 if (!smp)
1165 return SMP_UNSPECIFIED;
d26a2345 1166
b6ae8457 1167 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
616d55be
JH		 1168 (rp->auth_req & SMP_AUTH_BONDING))
1169 return SMP_PAIRING_NOTSUPP;
1170
88ba43b6 1171 skb_pull(skb, sizeof(*rp));
88ba43b6 1172
da85e5e5 1173 memset(&cp, 0, sizeof(cp));
54790f73 1174 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 1175
1c1def09
VCG		 1176 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1177 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1178
88ba43b6 1179 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 1180
da85e5e5 1181 return 0;
88ba43b6
AB		 1182}
1183
cc110922 1184int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1185{
cc110922 1186 struct l2cap_conn *conn = hcon->l2cap_data;
0a66cf20 1187 struct smp_chan *smp;
2b64d153 1188 __u8 authreq;
eb492e01 1189
3a0259bb
VCG		 1190 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1191
0a66cf20
JH		 1192 /* This may be NULL if there's an unexpected disconnection */
1193 if (!conn)
1194 return 1;
1195
757aee0f 1196 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1197 return 1;
1198
ad32a2f5 1199 if (smp_sufficient_security(hcon, sec_level))
eb492e01 1200 return 1;
f1cb9af5 1201
c7262e71
JH		 1202 if (sec_level > hcon->pending_sec_level)
1203 hcon->pending_sec_level = sec_level;
1204
40bef302 1205 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1206 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1207 return 0;
d26a2345 1208
51a8efd7 1209 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1210 return 0;
1211
8aab4757 1212 smp = smp_chan_create(conn);
2b64d153
BG		 1213 if (!smp)
1214 return 1;
1215
1216 authreq = seclevel_to_authreq(sec_level);
d26a2345 1217
79897d20
JH		 1218 /* Require MITM if IO Capability allows or the security level
1219 * requires it.
2e233644 1220 */
79897d20 1221 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1222 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1223 authreq |= SMP_AUTH_MITM;
1224
40bef302 1225 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1226 struct smp_cmd_pairing cp;
f01ead31 1227
2b64d153 1228 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1229 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1230 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1231
eb492e01
AB		 1232 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
1233 } else {
1234 struct smp_cmd_security_req cp;
2b64d153 1235 cp.auth_req = authreq;
eb492e01
AB		 1236 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
1237 }
1238
4a74d658 1239 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 1240
eb492e01
AB		 1241 return 0;
1242}
1243
7034b911
VCG		 1244static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1245{
16b90839 1246 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1247 struct l2cap_chan *chan = conn->smp;
1248 struct smp_chan *smp = chan->data;
16b90839 1249
c46b98be
JH		 1250 BT_DBG("conn %p", conn);
1251
1252 if (skb->len < sizeof(*rp))
38e4a915 1253 return SMP_INVALID_PARAMS;
c46b98be 1254
6131ddc8
JH		 1255 /* Ignore this PDU if it wasn't requested */
1256 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1257 return 0;
1258
16b90839
VCG		 1259 skb_pull(skb, sizeof(*rp));
1260
1c1def09 1261 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1262
7034b911
VCG		 1263 return 0;
1264}
1265
1266static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1267{
16b90839 1268 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1269 struct l2cap_chan *chan = conn->smp;
1270 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1271 struct hci_dev *hdev = conn->hcon->hdev;
1272 struct hci_conn *hcon = conn->hcon;
23d0e128 1273 struct smp_ltk *ltk;
c9839a11 1274 u8 authenticated;
16b90839 1275
c46b98be
JH		 1276 BT_DBG("conn %p", conn);
1277
1278 if (skb->len < sizeof(*rp))
38e4a915 1279 return SMP_INVALID_PARAMS;
c46b98be 1280
6131ddc8
JH		 1281 /* Ignore this PDU if it wasn't requested */
1282 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1283 return 0;
1284
9747a9f3
JH		 1285 /* Mark the information as received */
1286 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1287
16b90839 1288 skb_pull(skb, sizeof(*rp));
7034b911 1289
c9839a11 1290 hci_dev_lock(hdev);
ce39fb4e 1291 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1292 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1293 authenticated, smp->tk, smp->enc_key_size,
1294 rp->ediv, rp->rand);
1295 smp->ltk = ltk;
fd349c02 1296 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
86d1407c 1297 queue_work(hdev->workqueue, &smp->distribute_work);
c9839a11 1298 hci_dev_unlock(hdev);
7034b911
VCG		 1299
1300 return 0;
1301}
1302
fd349c02
JH		 1303static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1304{
1305 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1306 struct l2cap_chan *chan = conn->smp;
1307 struct smp_chan *smp = chan->data;
fd349c02
JH		 1308
1309 BT_DBG("");
1310
1311 if (skb->len < sizeof(*info))
38e4a915 1312 return SMP_INVALID_PARAMS;
fd349c02 1313
6131ddc8
JH		 1314 /* Ignore this PDU if it wasn't requested */
1315 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1316 return 0;
1317
fd349c02
JH		 1318 skb_pull(skb, sizeof(*info));
1319
1320 memcpy(smp->irk, info->irk, 16);
1321
1322 return 0;
1323}
1324
1325static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1326 struct sk_buff *skb)
1327{
1328 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1329 struct l2cap_chan *chan = conn->smp;
1330 struct smp_chan *smp = chan->data;
fd349c02 1331 struct hci_conn *hcon = conn->hcon;
86d1407c 1332 struct hci_dev *hdev = hcon->hdev;
fd349c02
JH		 1333 bdaddr_t rpa;
1334
1335 BT_DBG("");
1336
1337 if (skb->len < sizeof(*info))
38e4a915 1338 return SMP_INVALID_PARAMS;
fd349c02 1339
6131ddc8
JH		 1340 /* Ignore this PDU if it wasn't requested */
1341 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1342 return 0;
1343
9747a9f3
JH		 1344 /* Mark the information as received */
1345 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1346
fd349c02
JH		 1347 skb_pull(skb, sizeof(*info));
1348
31dd624e
JH		 1349 hci_dev_lock(hcon->hdev);
1350
a9a58f86
JH		 1351 /* Strictly speaking the Core Specification (4.1) allows sending
1352 * an empty address which would force us to rely on just the IRK
1353 * as "identity information". However, since such
1354 * implementations are not known of and in order to not over
1355 * complicate our implementation, simply pretend that we never
1356 * received an IRK for such a device.
1357 */
1358 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1359 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1360 goto distribute;
a9a58f86
JH		 1361 }
1362
fd349c02
JH		 1363 bacpy(&smp->id_addr, &info->bdaddr);
1364 smp->id_addr_type = info->addr_type;
1365
1366 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1367 bacpy(&rpa, &hcon->dst);
1368 else
1369 bacpy(&rpa, BDADDR_ANY);
1370
23d0e128
JH		 1371 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1372 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1373
31dd624e 1374distribute:
86d1407c 1375 queue_work(hdev->workqueue, &smp->distribute_work);
fd349c02 1376
31dd624e
JH		 1377 hci_dev_unlock(hcon->hdev);
1378
fd349c02
JH		 1379 return 0;
1380}
1381
7ee4ea36
MH		 1382static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1383{
1384 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1385 struct l2cap_chan *chan = conn->smp;
1386 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1387 struct hci_dev *hdev = conn->hcon->hdev;
1388 struct smp_csrk *csrk;
1389
1390 BT_DBG("conn %p", conn);
1391
1392 if (skb->len < sizeof(*rp))
38e4a915 1393 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1394
1395 /* Ignore this PDU if it wasn't requested */
1396 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1397 return 0;
1398
1399 /* Mark the information as received */
1400 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1401
1402 skb_pull(skb, sizeof(*rp));
1403
1404 hci_dev_lock(hdev);
1405 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1406 if (csrk) {
1407 csrk->master = 0x01;
1408 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1409 }
1410 smp->csrk = csrk;
86d1407c 1411 queue_work(hdev->workqueue, &smp->distribute_work);
7ee4ea36
MH		 1412 hci_dev_unlock(hdev);
1413
1414 return 0;
1415}
1416
4befb867 1417static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1418{
5d88cc73 1419 struct l2cap_conn *conn = chan->conn;
7b9899db 1420 struct hci_conn *hcon = conn->hcon;
92381f5c 1421 __u8 code, reason;
eb492e01
AB		 1422 int err = 0;
1423
7b9899db
MH		 1424 if (hcon->type != LE_LINK) {
1425 kfree_skb(skb);
3432711f 1426 return 0;
7b9899db
MH		 1427 }
1428
8ae9b984 1429 if (skb->len < 1)
92381f5c 1430 return -EILSEQ;
92381f5c 1431
06ae3314 1432 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
beb19e4c 1433 err = -EOPNOTSUPP;
2e65c9d2
AG		 1434 reason = SMP_PAIRING_NOTSUPP;
1435 goto done;
1436 }
1437
92381f5c 1438 code = skb->data[0];
eb492e01
AB		 1439 skb_pull(skb, sizeof(code));
1440
8cf9fa12
JH		 1441 /*
1442 * The SMP context must be initialized for all other PDUs except
1443 * pairing and security requests. If we get any other PDU when
1444 * not initialized simply disconnect (done if this function
1445 * returns an error).
1446 */
1447 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
d3368605 1448 !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
8cf9fa12 1449 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
8ae9b984
JH		 1450 reason = SMP_CMD_NOTSUPP;
1451 err = -EOPNOTSUPP;
1452 goto done;
8cf9fa12
JH		 1453 }
1454
eb492e01
AB		 1455 switch (code) {
1456 case SMP_CMD_PAIRING_REQ:
da85e5e5 1457 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1458 break;
1459
1460 case SMP_CMD_PAIRING_FAIL:
84794e11 1461 smp_failure(conn, 0);
da85e5e5
VCG		 1462 reason = 0;
1463 err = -EPERM;
eb492e01
AB		 1464 break;
1465
1466 case SMP_CMD_PAIRING_RSP:
da85e5e5 1467 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1468 break;
1469
1470 case SMP_CMD_SECURITY_REQ:
da85e5e5 1471 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1472 break;
1473
eb492e01 1474 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1475 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1476 break;
1477
eb492e01 1478 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1479 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1480 break;
1481
eb492e01 1482 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1483 reason = smp_cmd_encrypt_info(conn, skb);
1484 break;
1485
eb492e01 1486 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1487 reason = smp_cmd_master_ident(conn, skb);
1488 break;
1489
eb492e01 1490 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1491 reason = smp_cmd_ident_info(conn, skb);
1492 break;
1493
eb492e01 1494 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1495 reason = smp_cmd_ident_addr_info(conn, skb);
1496 break;
1497
eb492e01 1498 case SMP_CMD_SIGN_INFO:
7ee4ea36 1499 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1500 break;
1501
eb492e01
AB		 1502 default:
1503 BT_DBG("Unknown command code 0x%2.2x", code);
1504
1505 reason = SMP_CMD_NOTSUPP;
eb492e01 1506 err = -EOPNOTSUPP;
3a0259bb 1507 goto done;
eb492e01
AB		 1508 }
1509
3a0259bb
VCG		 1510done:
1511 if (reason)
84794e11 1512 smp_failure(conn, reason);
8ae9b984
JH		 1513 if (!err)
1514 kfree_skb(skb);
eb492e01
AB		 1515 return err;
1516}
7034b911 1517
70db83c4
JH		 1518static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1519{
1520 struct l2cap_conn *conn = chan->conn;
1521
1522 BT_DBG("chan %p", chan);
1523
109ec230 1524 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
5d88cc73 1525 smp_chan_destroy(conn);
5d88cc73 1526
70db83c4
JH		 1527 conn->smp = NULL;
1528 l2cap_chan_put(chan);
1529}
1530
44f1a7ab
JH		 1531static void smp_resume_cb(struct l2cap_chan *chan)
1532{
b68fda68 1533 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1534 struct l2cap_conn *conn = chan->conn;
1535 struct hci_conn *hcon = conn->hcon;
86d1407c 1536 struct hci_dev *hdev = hcon->hdev;
44f1a7ab
JH		 1537
1538 BT_DBG("chan %p", chan);
1539
86d1407c
JH		 1540 if (!smp)
1541 return;
b68fda68 1542
86d1407c
JH		 1543 cancel_delayed_work(&smp->security_timer);
1544
1545 if (test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1546 queue_work(hdev->workqueue, &smp->distribute_work);
44f1a7ab
JH		 1547}
1548
70db83c4
JH		 1549static void smp_ready_cb(struct l2cap_chan *chan)
1550{
1551 struct l2cap_conn *conn = chan->conn;
1552
1553 BT_DBG("chan %p", chan);
1554
1555 conn->smp = chan;
1556 l2cap_chan_hold(chan);
1557}
1558
4befb867
JH		 1559static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1560{
1561 int err;
1562
1563 BT_DBG("chan %p", chan);
1564
1565 err = smp_sig_channel(chan, skb);
1566 if (err) {
b68fda68 1567 struct smp_chan *smp = chan->data;
4befb867 1568
b68fda68
JH		 1569 if (smp)
1570 cancel_delayed_work_sync(&smp->security_timer);
4befb867 1571
1e91c29e 1572 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
4befb867
JH		 1573 }
1574
1575 return err;
1576}
1577
70db83c4
JH		 1578static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1579 unsigned long hdr_len,
1580 unsigned long len, int nb)
1581{
1582 struct sk_buff *skb;
1583
1584 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1585 if (!skb)
1586 return ERR_PTR(-ENOMEM);
1587
1588 skb->priority = HCI_PRIO_MAX;
1589 bt_cb(skb)->chan = chan;
1590
1591 return skb;
1592}
1593
1594static const struct l2cap_ops smp_chan_ops = {
1595 .name = "Security Manager",
1596 .ready = smp_ready_cb,
5d88cc73 1597 .recv = smp_recv_cb,
70db83c4
JH		 1598 .alloc_skb = smp_alloc_skb_cb,
1599 .teardown = smp_teardown_cb,
44f1a7ab 1600 .resume = smp_resume_cb,
70db83c4
JH		 1601
1602 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1603 .state_change = l2cap_chan_no_state_change,
1604 .close = l2cap_chan_no_close,
1605 .defer = l2cap_chan_no_defer,
1606 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1607 .set_shutdown = l2cap_chan_no_set_shutdown,
1608 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1609 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1610};
1611
1612static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1613{
1614 struct l2cap_chan *chan;
1615
1616 BT_DBG("pchan %p", pchan);
1617
1618 chan = l2cap_chan_create();
1619 if (!chan)
1620 return NULL;
1621
1622 chan->chan_type = pchan->chan_type;
1623 chan->ops = &smp_chan_ops;
1624 chan->scid = pchan->scid;
1625 chan->dcid = chan->scid;
1626 chan->imtu = pchan->imtu;
1627 chan->omtu = pchan->omtu;
1628 chan->mode = pchan->mode;
1629
1630 BT_DBG("created chan %p", chan);
1631
1632 return chan;
1633}
1634
1635static const struct l2cap_ops smp_root_chan_ops = {
1636 .name = "Security Manager Root",
1637 .new_connection = smp_new_conn_cb,
1638
1639 /* None of these are implemented for the root channel */
1640 .close = l2cap_chan_no_close,
1641 .alloc_skb = l2cap_chan_no_alloc_skb,
1642 .recv = l2cap_chan_no_recv,
1643 .state_change = l2cap_chan_no_state_change,
1644 .teardown = l2cap_chan_no_teardown,
1645 .ready = l2cap_chan_no_ready,
1646 .defer = l2cap_chan_no_defer,
1647 .suspend = l2cap_chan_no_suspend,
1648 .resume = l2cap_chan_no_resume,
1649 .set_shutdown = l2cap_chan_no_set_shutdown,
1650 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1651 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1652};
1653
711eafe3
JH		 1654int smp_register(struct hci_dev *hdev)
1655{
70db83c4 1656 struct l2cap_chan *chan;
defce9e8 1657 struct crypto_blkcipher *tfm_aes;
70db83c4 1658
711eafe3
JH		 1659 BT_DBG("%s", hdev->name);
1660
defce9e8
JH		 1661 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1662 if (IS_ERR(tfm_aes)) {
1663 int err = PTR_ERR(tfm_aes);
711eafe3 1664 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1665 return err;
1666 }
1667
70db83c4
JH		 1668 chan = l2cap_chan_create();
1669 if (!chan) {
defce9e8 1670 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1671 return -ENOMEM;
1672 }
1673
defce9e8
JH		 1674 chan->data = tfm_aes;
1675
5d88cc73 1676 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1677
1678 l2cap_chan_set_defaults(chan);
1679
1680 bacpy(&chan->src, &hdev->bdaddr);
1681 chan->src_type = BDADDR_LE_PUBLIC;
1682 chan->state = BT_LISTEN;
1683 chan->mode = L2CAP_MODE_BASIC;
1684 chan->imtu = L2CAP_DEFAULT_MTU;
1685 chan->ops = &smp_root_chan_ops;
1686
1687 hdev->smp_data = chan;
1688
711eafe3
JH		 1689 return 0;
1690}
1691
1692void smp_unregister(struct hci_dev *hdev)
1693{
70db83c4 1694 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1695 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1696
1697 if (!chan)
1698 return;
1699
1700 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1701
defce9e8
JH		 1702 tfm_aes = chan->data;
1703 if (tfm_aes) {
1704 chan->data = NULL;
1705 crypto_free_blkcipher(tfm_aes);
711eafe3 1706 }
70db83c4
JH		 1707
1708 hdev->smp_data = NULL;
1709 l2cap_chan_put(chan);
711eafe3 1710}
Linux kernel - Deliverables
This page took 0.278034 seconds and 5 git commands to generate.