projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix access to the STK generation methods matrix
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
23#include <net/bluetooth/bluetooth.h>
24#include <net/bluetooth/hci_core.h>
25#include <net/bluetooth/l2cap.h>
2b64d153 26#include <net/bluetooth/mgmt.h>
eb492e01 27#include <net/bluetooth/smp.h>
d22ef0bc 28#include <linux/crypto.h>
f70490e6 29#include <linux/scatterlist.h>
d22ef0bc
AB		 30#include <crypto/b128ops.h>
31
17b02e62 32#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 33
d22ef0bc
AB		 34static inline void swap128(u8 src[16], u8 dst[16])
35{
36 int i;
37 for (i = 0; i < 16; i++)
38 dst[15 - i] = src[i];
39}
40
41static inline void swap56(u8 src[7], u8 dst[7])
42{
43 int i;
44 for (i = 0; i < 7; i++)
45 dst[6 - i] = src[i];
46}
47
48static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
49{
50 struct blkcipher_desc desc;
51 struct scatterlist sg;
52 int err, iv_len;
53 unsigned char iv[128];
54
55 if (tfm == NULL) {
56 BT_ERR("tfm %p", tfm);
57 return -EINVAL;
58 }
59
60 desc.tfm = tfm;
61 desc.flags = 0;
62
63 err = crypto_blkcipher_setkey(tfm, k, 16);
64 if (err) {
65 BT_ERR("cipher setkey failed: %d", err);
66 return err;
67 }
68
69 sg_init_one(&sg, r, 16);
70
71 iv_len = crypto_blkcipher_ivsize(tfm);
72 if (iv_len) {
73 memset(&iv, 0xff, iv_len);
74 crypto_blkcipher_set_iv(tfm, iv, iv_len);
75 }
76
77 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
78 if (err)
79 BT_ERR("Encrypt data error %d", err);
80
81 return err;
82}
83
84static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
85 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
86 u8 _rat, bdaddr_t *ra, u8 res[16])
87{
88 u8 p1[16], p2[16];
89 int err;
90
91 memset(p1, 0, 16);
92
93 /* p1 = pres || preq || _rat || _iat */
94 swap56(pres, p1);
95 swap56(preq, p1 + 7);
96 p1[14] = _rat;
97 p1[15] = _iat;
98
99 memset(p2, 0, 16);
100
101 /* p2 = padding || ia || ra */
102 baswap((bdaddr_t *) (p2 + 4), ia);
103 baswap((bdaddr_t *) (p2 + 10), ra);
104
105 /* res = r XOR p1 */
106 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
107
108 /* res = e(k, res) */
109 err = smp_e(tfm, k, res);
110 if (err) {
111 BT_ERR("Encrypt data error");
112 return err;
113 }
114
115 /* res = res XOR p2 */
116 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
117
118 /* res = e(k, res) */
119 err = smp_e(tfm, k, res);
120 if (err)
121 BT_ERR("Encrypt data error");
122
123 return err;
124}
125
126static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16],
127 u8 r1[16], u8 r2[16], u8 _r[16])
128{
129 int err;
130
131 /* Just least significant octets from r1 and r2 are considered */
132 memcpy(_r, r1 + 8, 8);
133 memcpy(_r + 8, r2 + 8, 8);
134
135 err = smp_e(tfm, k, _r);
136 if (err)
137 BT_ERR("Encrypt data error");
138
139 return err;
140}
141
142static int smp_rand(u8 *buf)
143{
144 get_random_bytes(buf, 16);
145
146 return 0;
147}
eb492e01
AB		 148
149static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
150 u16 dlen, void *data)
151{
152 struct sk_buff *skb;
153 struct l2cap_hdr *lh;
154 int len;
155
156 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
157
158 if (len > conn->mtu)
159 return NULL;
160
161 skb = bt_skb_alloc(len, GFP_ATOMIC);
162 if (!skb)
163 return NULL;
164
165 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
166 lh->len = cpu_to_le16(sizeof(code) + dlen);
167 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
168
169 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
170
171 memcpy(skb_put(skb, dlen), data, dlen);
172
173 return skb;
174}
175
176static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
177{
178 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
179
180 BT_DBG("code 0x%2.2x", code);
181
182 if (!skb)
183 return;
184
73d80deb
LAD		 185 skb->priority = HCI_PRIO_MAX;
186 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 187
6c9d42a1 188 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 189 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 190}
191
2b64d153
BG		 192static __u8 authreq_to_seclevel(__u8 authreq)
193{
194 if (authreq & SMP_AUTH_MITM)
195 return BT_SECURITY_HIGH;
196 else
197 return BT_SECURITY_MEDIUM;
198}
199
200static __u8 seclevel_to_authreq(__u8 sec_level)
201{
202 switch (sec_level) {
203 case BT_SECURITY_HIGH:
204 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
205 case BT_SECURITY_MEDIUM:
206 return SMP_AUTH_BONDING;
207 default:
208 return SMP_AUTH_NONE;
209 }
210}
211
b8e66eac 212static void build_pairing_cmd(struct l2cap_conn *conn,
54790f73
VCG		 213 struct smp_cmd_pairing *req,
214 struct smp_cmd_pairing *rsp,
215 __u8 authreq)
b8e66eac 216{
2b64d153 217 u8 dist_keys = 0;
54790f73 218
a8b2d5c2 219 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
ca10b5ee 220 dist_keys = SMP_DIST_ENC_KEY;
54790f73 221 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 222 } else {
223 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 224 }
225
226 if (rsp == NULL) {
227 req->io_capability = conn->hcon->io_capability;
228 req->oob_flag = SMP_OOB_NOT_PRESENT;
229 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 230 req->init_key_dist = 0;
54790f73
VCG		 231 req->resp_key_dist = dist_keys;
232 req->auth_req = authreq;
233 return;
234 }
235
236 rsp->io_capability = conn->hcon->io_capability;
237 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
238 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 239 rsp->init_key_dist = 0;
54790f73
VCG		 240 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
241 rsp->auth_req = authreq;
b8e66eac
VCG		 242}
243
3158c50c
VCG		 244static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
245{
1c1def09
VCG		 246 struct smp_chan *smp = conn->smp_chan;
247
3158c50c
VCG		 248 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
249 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
250 return SMP_ENC_KEY_SIZE;
251
f7aa611a 252 smp->enc_key_size = max_key_size;
3158c50c
VCG		 253
254 return 0;
255}
256
4f957a76
BG		 257static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
258{
bab73cb6
JH		 259 struct hci_conn *hcon = conn->hcon;
260
4f957a76
BG		 261 if (send)
262 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
263 &reason);
264
51a8efd7 265 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags);
bab73cb6 266 mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
04124681 267 hcon->dst_type, reason);
f1c09c07
VCG		 268
269 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
270 cancel_delayed_work_sync(&conn->security_timer);
271 smp_chan_destroy(conn);
272 }
4f957a76
BG		 273}
274
2b64d153
BG		 275#define JUST_WORKS 0x00
276#define JUST_CFM 0x01
277#define REQ_PASSKEY 0x02
278#define CFM_PASSKEY 0x03
279#define REQ_OOB 0x04
280#define OVERLAP 0xFF
281
282static const u8 gen_method[5][5] = {
283 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
284 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
285 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
286 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
287 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
288};
289
290static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
291 u8 local_io, u8 remote_io)
292{
293 struct hci_conn *hcon = conn->hcon;
294 struct smp_chan *smp = conn->smp_chan;
295 u8 method;
296 u32 passkey = 0;
297 int ret = 0;
298
299 /* Initialize key for JUST WORKS */
300 memset(smp->tk, 0, sizeof(smp->tk));
301 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
302
303 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
304
305 /* If neither side wants MITM, use JUST WORKS */
306 /* If either side has unknown io_caps, use JUST WORKS */
307 /* Otherwise, look up method from the table */
308 if (!(auth & SMP_AUTH_MITM) ||
309 local_io > SMP_IO_KEYBOARD_DISPLAY ||
310 remote_io > SMP_IO_KEYBOARD_DISPLAY)
311 method = JUST_WORKS;
312 else
b3ff53ff 313 method = gen_method[remote_io][local_io];
2b64d153
BG		 314
315 /* If not bonding, don't ask user to confirm a Zero TK */
316 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
317 method = JUST_WORKS;
318
319 /* If Just Works, Continue with Zero TK */
320 if (method == JUST_WORKS) {
321 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
322 return 0;
323 }
324
325 /* Not Just Works/Confirm results in MITM Authentication */
326 if (method != JUST_CFM)
327 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
328
329 /* If both devices have Keyoard-Display I/O, the master
330 * Confirms and the slave Enters the passkey.
331 */
332 if (method == OVERLAP) {
333 if (hcon->link_mode & HCI_LM_MASTER)
334 method = CFM_PASSKEY;
335 else
336 method = REQ_PASSKEY;
337 }
338
339 /* Generate random passkey. Not valid until confirmed. */
340 if (method == CFM_PASSKEY) {
341 u8 key[16];
342
343 memset(key, 0, sizeof(key));
344 get_random_bytes(&passkey, sizeof(passkey));
345 passkey %= 1000000;
346 put_unaligned_le32(passkey, key);
347 swap128(key, smp->tk);
348 BT_DBG("PassKey: %d", passkey);
349 }
350
351 hci_dev_lock(hcon->hdev);
352
353 if (method == REQ_PASSKEY)
272d90df
JH		 354 ret = mgmt_user_passkey_request(hcon->hdev, conn->dst,
355 hcon->type, hcon->dst_type);
2b64d153
BG		 356 else
357 ret = mgmt_user_confirm_request(hcon->hdev, conn->dst,
272d90df 358 hcon->type, hcon->dst_type,
2b64d153
BG		 359 cpu_to_le32(passkey), 0);
360
361 hci_dev_unlock(hcon->hdev);
362
363 return ret;
364}
365
8aab4757
VCG		 366static void confirm_work(struct work_struct *work)
367{
368 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
369 struct l2cap_conn *conn = smp->conn;
370 struct crypto_blkcipher *tfm;
371 struct smp_cmd_pairing_confirm cp;
372 int ret;
373 u8 res[16], reason;
374
375 BT_DBG("conn %p", conn);
376
377 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
378 if (IS_ERR(tfm)) {
379 reason = SMP_UNSPECIFIED;
380 goto error;
381 }
382
383 smp->tfm = tfm;
384
385 if (conn->hcon->out)
386 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 0,
04124681 387 conn->src, conn->hcon->dst_type, conn->dst, res);
8aab4757
VCG		 388 else
389 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
04124681
GP		 390 conn->hcon->dst_type, conn->dst, 0, conn->src,
391 res);
8aab4757
VCG		 392 if (ret) {
393 reason = SMP_UNSPECIFIED;
394 goto error;
395 }
396
2b64d153
BG		 397 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
398
8aab4757
VCG		 399 swap128(res, cp.confirm_val);
400 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
401
402 return;
403
404error:
4f957a76 405 smp_failure(conn, reason, 1);
8aab4757
VCG		 406}
407
408static void random_work(struct work_struct *work)
409{
410 struct smp_chan *smp = container_of(work, struct smp_chan, random);
411 struct l2cap_conn *conn = smp->conn;
412 struct hci_conn *hcon = conn->hcon;
413 struct crypto_blkcipher *tfm = smp->tfm;
414 u8 reason, confirm[16], res[16], key[16];
415 int ret;
416
417 if (IS_ERR_OR_NULL(tfm)) {
418 reason = SMP_UNSPECIFIED;
419 goto error;
420 }
421
422 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
423
424 if (hcon->out)
425 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 0,
04124681 426 conn->src, hcon->dst_type, conn->dst, res);
8aab4757
VCG		 427 else
428 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
04124681 429 hcon->dst_type, conn->dst, 0, conn->src, res);
8aab4757
VCG		 430 if (ret) {
431 reason = SMP_UNSPECIFIED;
432 goto error;
433 }
434
435 swap128(res, confirm);
436
437 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
438 BT_ERR("Pairing failed (confirmation values mismatch)");
439 reason = SMP_CONFIRM_FAILED;
440 goto error;
441 }
442
443 if (hcon->out) {
444 u8 stk[16], rand[8];
445 __le16 ediv;
446
447 memset(rand, 0, sizeof(rand));
448 ediv = 0;
449
450 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
451 swap128(key, stk);
452
f7aa611a 453 memset(stk + smp->enc_key_size, 0,
04124681 454 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 455
51a8efd7 456 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 457 reason = SMP_UNSPECIFIED;
458 goto error;
459 }
460
461 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 462 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 463 } else {
464 u8 stk[16], r[16], rand[8];
465 __le16 ediv;
466
467 memset(rand, 0, sizeof(rand));
468 ediv = 0;
469
470 swap128(smp->prnd, r);
471 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
472
473 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
474 swap128(key, stk);
475
f7aa611a
VCG		 476 memset(stk + smp->enc_key_size, 0,
477 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 478
c9839a11 479 hci_add_ltk(hcon->hdev, conn->dst, hcon->dst_type,
04124681
GP		 480 HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
481 ediv, rand);
8aab4757
VCG		 482 }
483
484 return;
485
486error:
4f957a76 487 smp_failure(conn, reason, 1);
8aab4757
VCG		 488}
489
490static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
491{
492 struct smp_chan *smp;
493
494 smp = kzalloc(sizeof(struct smp_chan), GFP_ATOMIC);
495 if (!smp)
496 return NULL;
497
498 INIT_WORK(&smp->confirm, confirm_work);
499 INIT_WORK(&smp->random, random_work);
500
501 smp->conn = conn;
502 conn->smp_chan = smp;
2b64d153 503 conn->hcon->smp_conn = conn;
8aab4757
VCG		 504
505 hci_conn_hold(conn->hcon);
506
507 return smp;
508}
509
510void smp_chan_destroy(struct l2cap_conn *conn)
511{
c8eb9690
BG		 512 struct smp_chan *smp = conn->smp_chan;
513
f1c09c07 514 BUG_ON(!smp);
c8eb9690
BG		 515
516 if (smp->tfm)
517 crypto_free_blkcipher(smp->tfm);
518
519 kfree(smp);
520 conn->smp_chan = NULL;
2b64d153 521 conn->hcon->smp_conn = NULL;
8aab4757
VCG		 522 hci_conn_put(conn->hcon);
523}
524
2b64d153
BG		 525int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
526{
527 struct l2cap_conn *conn = hcon->smp_conn;
528 struct smp_chan *smp;
529 u32 value;
530 u8 key[16];
531
532 BT_DBG("");
533
534 if (!conn)
535 return -ENOTCONN;
536
537 smp = conn->smp_chan;
538
539 switch (mgmt_op) {
540 case MGMT_OP_USER_PASSKEY_REPLY:
541 value = le32_to_cpu(passkey);
542 memset(key, 0, sizeof(key));
543 BT_DBG("PassKey: %d", value);
544 put_unaligned_le32(value, key);
545 swap128(key, smp->tk);
546 /* Fall Through */
547 case MGMT_OP_USER_CONFIRM_REPLY:
548 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
549 break;
550 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
551 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
552 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
553 return 0;
554 default:
555 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
556 return -EOPNOTSUPP;
557 }
558
559 /* If it is our turn to send Pairing Confirm, do so now */
560 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
561 queue_work(hcon->hdev->workqueue, &smp->confirm);
562
563 return 0;
564}
565
da85e5e5 566static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 567{
3158c50c 568 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 569 struct smp_chan *smp;
3158c50c 570 u8 key_size;
2b64d153 571 u8 auth = SMP_AUTH_NONE;
8aab4757 572 int ret;
88ba43b6
AB		 573
574 BT_DBG("conn %p", conn);
575
2b64d153
BG		 576 if (conn->hcon->link_mode & HCI_LM_MASTER)
577 return SMP_CMD_NOTSUPP;
578
51a8efd7 579 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757
VCG		 580 smp = smp_chan_create(conn);
581
582 smp = conn->smp_chan;
d26a2345 583
1c1def09
VCG		 584 smp->preq[0] = SMP_CMD_PAIRING_REQ;
585 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 586 skb_pull(skb, sizeof(*req));
88ba43b6 587
2b64d153
BG		 588 /* We didn't start the pairing, so match remote */
589 if (req->auth_req & SMP_AUTH_BONDING)
590 auth = req->auth_req;
da85e5e5 591
2b64d153 592 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 593
594 key_size = min(req->max_key_size, rsp.max_key_size);
595 if (check_enc_key_size(conn, key_size))
596 return SMP_ENC_KEY_SIZE;
88ba43b6 597
8aab4757
VCG		 598 ret = smp_rand(smp->prnd);
599 if (ret)
600 return SMP_UNSPECIFIED;
601
1c1def09
VCG		 602 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
603 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 604
3158c50c 605 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 606
2b64d153
BG		 607 /* Request setup of TK */
608 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
609 if (ret)
610 return SMP_UNSPECIFIED;
611
da85e5e5 612 return 0;
88ba43b6
AB		 613}
614
da85e5e5 615static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 616{
3158c50c 617 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 618 struct smp_chan *smp = conn->smp_chan;
8aab4757 619 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 620 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 621 int ret;
88ba43b6
AB		 622
623 BT_DBG("conn %p", conn);
624
2b64d153
BG		 625 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
626 return SMP_CMD_NOTSUPP;
627
3158c50c
VCG		 628 skb_pull(skb, sizeof(*rsp));
629
1c1def09 630 req = (void *) &smp->preq[1];
da85e5e5 631
3158c50c
VCG		 632 key_size = min(req->max_key_size, rsp->max_key_size);
633 if (check_enc_key_size(conn, key_size))
634 return SMP_ENC_KEY_SIZE;
635
1c1def09 636 ret = smp_rand(smp->prnd);
7d24ddcc 637 if (ret)
da85e5e5 638 return SMP_UNSPECIFIED;
7d24ddcc 639
8aab4757
VCG		 640 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
641 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 642
2b64d153
BG		 643 if ((req->auth_req & SMP_AUTH_BONDING) &&
644 (rsp->auth_req & SMP_AUTH_BONDING))
645 auth = SMP_AUTH_BONDING;
646
647 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
648
649 ret = tk_request(conn, 0, auth, rsp->io_capability, req->io_capability);
650 if (ret)
651 return SMP_UNSPECIFIED;
652
653 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
654
655 /* Can't compose response until we have been confirmed */
656 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
657 return 0;
658
8aab4757 659 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 660
661 return 0;
88ba43b6
AB		 662}
663
da85e5e5 664static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 665{
1c1def09 666 struct smp_chan *smp = conn->smp_chan;
8aab4757 667 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 668
88ba43b6
AB		 669 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
670
1c1def09
VCG		 671 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
672 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 673
7d24ddcc
AB		 674 if (conn->hcon->out) {
675 u8 random[16];
88ba43b6 676
1c1def09 677 swap128(smp->prnd, random);
88ba43b6 678 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
7d24ddcc 679 random);
2b64d153 680 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 681 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 682 } else {
683 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 684 }
da85e5e5
VCG		 685
686 return 0;
88ba43b6
AB		 687}
688
da85e5e5 689static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 690{
1c1def09 691 struct smp_chan *smp = conn->smp_chan;
8aab4757 692 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 693
8aab4757 694 BT_DBG("conn %p", conn);
3158c50c 695
8aab4757
VCG		 696 swap128(skb->data, smp->rrnd);
697 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 698
8aab4757 699 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 700
701 return 0;
88ba43b6
AB		 702}
703
988c5997
VCG		 704static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
705{
c9839a11 706 struct smp_ltk *key;
988c5997
VCG		 707 struct hci_conn *hcon = conn->hcon;
708
c9839a11 709 key = hci_find_ltk_by_addr(hcon->hdev, conn->dst, hcon->dst_type);
988c5997
VCG		 710 if (!key)
711 return 0;
712
51a8efd7 713 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 714 return 1;
715
c9839a11
VCG		 716 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
717 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 718
719 return 1;
720
721}
da85e5e5 722static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 723{
724 struct smp_cmd_security_req *rp = (void *) skb->data;
725 struct smp_cmd_pairing cp;
f1cb9af5 726 struct hci_conn *hcon = conn->hcon;
8aab4757 727 struct smp_chan *smp;
88ba43b6
AB		 728
729 BT_DBG("conn %p", conn);
730
2b64d153 731 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 732
988c5997
VCG		 733 if (smp_ltk_encrypt(conn))
734 return 0;
735
51a8efd7 736 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 737 return 0;
f1cb9af5 738
8aab4757 739 smp = smp_chan_create(conn);
d26a2345 740
88ba43b6 741 skb_pull(skb, sizeof(*rp));
88ba43b6 742
da85e5e5 743 memset(&cp, 0, sizeof(cp));
54790f73 744 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 745
1c1def09
VCG		 746 smp->preq[0] = SMP_CMD_PAIRING_REQ;
747 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 748
88ba43b6 749 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 750
da85e5e5 751 return 0;
88ba43b6
AB		 752}
753
eb492e01
AB		 754int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
755{
3a0259bb 756 struct hci_conn *hcon = conn->hcon;
1c1def09 757 struct smp_chan *smp = conn->smp_chan;
2b64d153 758 __u8 authreq;
eb492e01 759
3a0259bb
VCG		 760 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
761
2e65c9d2
AG		 762 if (!lmp_host_le_capable(hcon->hdev))
763 return 1;
764
f1cb9af5
VCG		 765 if (sec_level == BT_SECURITY_LOW)
766 return 1;
eb492e01 767
f1cb9af5 768 if (hcon->sec_level >= sec_level)
eb492e01 769 return 1;
f1cb9af5 770
988c5997
VCG		 771 if (hcon->link_mode & HCI_LM_MASTER)
772 if (smp_ltk_encrypt(conn))
02bc7455 773 goto done;
d26a2345 774
51a8efd7 775 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 776 return 0;
777
8aab4757 778 smp = smp_chan_create(conn);
2b64d153
BG		 779 if (!smp)
780 return 1;
781
782 authreq = seclevel_to_authreq(sec_level);
d26a2345 783
d26a2345
VCG		 784 if (hcon->link_mode & HCI_LM_MASTER) {
785 struct smp_cmd_pairing cp;
f01ead31 786
2b64d153 787 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 788 smp->preq[0] = SMP_CMD_PAIRING_REQ;
789 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 790
eb492e01
AB		 791 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
792 } else {
793 struct smp_cmd_security_req cp;
2b64d153 794 cp.auth_req = authreq;
eb492e01
AB		 795 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
796 }
797
02bc7455 798done:
f1cb9af5 799 hcon->pending_sec_level = sec_level;
f1cb9af5 800
eb492e01
AB		 801 return 0;
802}
803
7034b911
VCG		 804static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
805{
16b90839 806 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 807 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 808
809 skb_pull(skb, sizeof(*rp));
810
1c1def09 811 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 812
7034b911
VCG		 813 return 0;
814}
815
816static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
817{
16b90839 818 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 819 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 820 struct hci_dev *hdev = conn->hcon->hdev;
821 struct hci_conn *hcon = conn->hcon;
822 u8 authenticated;
16b90839
VCG		 823
824 skb_pull(skb, sizeof(*rp));
7034b911 825
c9839a11
VCG		 826 hci_dev_lock(hdev);
827 authenticated = (conn->hcon->sec_level == BT_SECURITY_HIGH);
828 hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
04124681
GP		 829 HCI_SMP_LTK, 1, authenticated, smp->tk, smp->enc_key_size,
830 rp->ediv, rp->rand);
7034b911 831 smp_distribute_keys(conn, 1);
c9839a11 832 hci_dev_unlock(hdev);
7034b911
VCG		 833
834 return 0;
835}
836
eb492e01
AB		 837int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
838{
839 __u8 code = skb->data[0];
840 __u8 reason;
841 int err = 0;
842
2e65c9d2
AG		 843 if (!lmp_host_le_capable(conn->hcon->hdev)) {
844 err = -ENOTSUPP;
845 reason = SMP_PAIRING_NOTSUPP;
846 goto done;
847 }
848
eb492e01
AB		 849 skb_pull(skb, sizeof(code));
850
851 switch (code) {
852 case SMP_CMD_PAIRING_REQ:
da85e5e5 853 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 854 break;
855
856 case SMP_CMD_PAIRING_FAIL:
4f957a76 857 smp_failure(conn, skb->data[0], 0);
da85e5e5
VCG		 858 reason = 0;
859 err = -EPERM;
eb492e01
AB		 860 break;
861
862 case SMP_CMD_PAIRING_RSP:
da85e5e5 863 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 864 break;
865
866 case SMP_CMD_SECURITY_REQ:
da85e5e5 867 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 868 break;
869
eb492e01 870 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 871 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 872 break;
873
eb492e01 874 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 875 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 876 break;
877
eb492e01 878 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 879 reason = smp_cmd_encrypt_info(conn, skb);
880 break;
881
eb492e01 882 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 883 reason = smp_cmd_master_ident(conn, skb);
884 break;
885
eb492e01
AB		 886 case SMP_CMD_IDENT_INFO:
887 case SMP_CMD_IDENT_ADDR_INFO:
888 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 889 /* Just ignored */
890 reason = 0;
891 break;
892
eb492e01
AB		 893 default:
894 BT_DBG("Unknown command code 0x%2.2x", code);
895
896 reason = SMP_CMD_NOTSUPP;
eb492e01 897 err = -EOPNOTSUPP;
3a0259bb 898 goto done;
eb492e01
AB		 899 }
900
3a0259bb
VCG		 901done:
902 if (reason)
4f957a76 903 smp_failure(conn, reason, 1);
3a0259bb 904
eb492e01
AB		 905 kfree_skb(skb);
906 return err;
907}
7034b911
VCG		 908
909int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
910{
911 struct smp_cmd_pairing *req, *rsp;
1c1def09 912 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 913 __u8 *keydist;
914
915 BT_DBG("conn %p force %d", conn, force);
916
51a8efd7 917 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
d26a2345
VCG		 918 return 0;
919
1c1def09 920 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 921
922 /* The responder sends its keys first */
923 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
924 return 0;
925
1c1def09 926 req = (void *) &smp->preq[1];
7034b911
VCG		 927
928 if (conn->hcon->out) {
929 keydist = &rsp->init_key_dist;
930 *keydist &= req->init_key_dist;
931 } else {
932 keydist = &rsp->resp_key_dist;
933 *keydist &= req->resp_key_dist;
934 }
935
936
937 BT_DBG("keydist 0x%x", *keydist);
938
939 if (*keydist & SMP_DIST_ENC_KEY) {
940 struct smp_cmd_encrypt_info enc;
941 struct smp_cmd_master_ident ident;
c9839a11
VCG		 942 struct hci_conn *hcon = conn->hcon;
943 u8 authenticated;
7034b911
VCG		 944 __le16 ediv;
945
946 get_random_bytes(enc.ltk, sizeof(enc.ltk));
947 get_random_bytes(&ediv, sizeof(ediv));
948 get_random_bytes(ident.rand, sizeof(ident.rand));
949
950 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
951
c9839a11
VCG		 952 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
953 hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
04124681
GP		 954 HCI_SMP_LTK_SLAVE, 1, authenticated,
955 enc.ltk, smp->enc_key_size, ediv, ident.rand);
16b90839 956
7034b911
VCG		 957 ident.ediv = cpu_to_le16(ediv);
958
959 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
960
961 *keydist &= ~SMP_DIST_ENC_KEY;
962 }
963
964 if (*keydist & SMP_DIST_ID_KEY) {
965 struct smp_cmd_ident_addr_info addrinfo;
966 struct smp_cmd_ident_info idinfo;
967
968 /* Send a dummy key */
969 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
970
971 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
972
973 /* Just public address */
974 memset(&addrinfo, 0, sizeof(addrinfo));
975 bacpy(&addrinfo.bdaddr, conn->src);
976
977 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
978 &addrinfo);
979
980 *keydist &= ~SMP_DIST_ID_KEY;
981 }
982
983 if (*keydist & SMP_DIST_SIGN) {
984 struct smp_cmd_sign_info sign;
985
986 /* Send a dummy key */
987 get_random_bytes(sign.csrk, sizeof(sign.csrk));
988
989 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
990
991 *keydist &= ~SMP_DIST_SIGN;
992 }
993
d26a2345 994 if (conn->hcon->out || force) {
51a8efd7 995 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6c9d42a1 996 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 997 smp_chan_destroy(conn);
d26a2345
VCG		 998 }
999
7034b911
VCG		 1000 return 0;
1001}
Linux kernel - Deliverables
This page took 0.214485 seconds and 5 git commands to generate.