projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add SMP-internal timeout callback
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
533e35d4
JH		 38enum {
39 SMP_FLAG_TK_VALID,
40 SMP_FLAG_CFM_PENDING,
41 SMP_FLAG_MITM_AUTH,
42 SMP_FLAG_COMPLETE,
43 SMP_FLAG_INITIATOR,
44};
4bc58f51
JH		 45
46struct smp_chan {
b68fda68
JH		 47 struct l2cap_conn *conn;
48 struct delayed_work security_timer;
49
4bc58f51
JH		 50 u8 preq[7]; /* SMP Pairing Request */
51 u8 prsp[7]; /* SMP Pairing Response */
52 u8 prnd[16]; /* SMP Pairing Random (local) */
53 u8 rrnd[16]; /* SMP Pairing Random (remote) */
54 u8 pcnf[16]; /* SMP Pairing Confirm */
55 u8 tk[16]; /* SMP Temporary Key */
56 u8 enc_key_size;
57 u8 remote_key_dist;
58 bdaddr_t id_addr;
59 u8 id_addr_type;
60 u8 irk[16];
61 struct smp_csrk *csrk;
62 struct smp_csrk *slave_csrk;
63 struct smp_ltk *ltk;
64 struct smp_ltk *slave_ltk;
65 struct smp_irk *remote_irk;
4a74d658 66 unsigned long flags;
6a7bd103
JH		 67
68 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 69};
70
8a2936f4 71static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 72{
8a2936f4 73 size_t i;
d22ef0bc 74
8a2936f4
JH		 75 for (i = 0; i < len; i++)
76 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 77}
78
79static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
80{
81 struct blkcipher_desc desc;
82 struct scatterlist sg;
943a732a 83 uint8_t tmp[16], data[16];
201a5929 84 int err;
d22ef0bc
AB		 85
86 if (tfm == NULL) {
87 BT_ERR("tfm %p", tfm);
88 return -EINVAL;
89 }
90
91 desc.tfm = tfm;
92 desc.flags = 0;
93
943a732a 94 /* The most significant octet of key corresponds to k[0] */
8a2936f4 95 swap_buf(k, tmp, 16);
943a732a
JH		 96
97 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 98 if (err) {
99 BT_ERR("cipher setkey failed: %d", err);
100 return err;
101 }
102
943a732a 103 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 104 swap_buf(r, data, 16);
943a732a
JH		 105
106 sg_init_one(&sg, data, 16);
d22ef0bc 107
d22ef0bc
AB		 108 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
109 if (err)
110 BT_ERR("Encrypt data error %d", err);
111
943a732a 112 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 113 swap_buf(data, r, 16);
943a732a 114
d22ef0bc
AB		 115 return err;
116}
117
60478054
JH		 118static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
119{
943a732a 120 u8 _res[16];
60478054
JH		 121 int err;
122
123 /* r' = padding || r */
943a732a
JH		 124 memcpy(_res, r, 3);
125 memset(_res + 3, 0, 13);
60478054 126
943a732a 127 err = smp_e(tfm, irk, _res);
60478054
JH		 128 if (err) {
129 BT_ERR("Encrypt error");
130 return err;
131 }
132
133 /* The output of the random address function ah is:
134 * ah(h, r) = e(k, r') mod 2^24
135 * The output of the security function e is then truncated to 24 bits
136 * by taking the least significant 24 bits of the output of e as the
137 * result of ah.
138 */
943a732a 139 memcpy(res, _res, 3);
60478054
JH		 140
141 return 0;
142}
143
defce9e8 144bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 145{
defce9e8
JH		 146 struct l2cap_chan *chan = hdev->smp_data;
147 struct crypto_blkcipher *tfm;
60478054
JH		 148 u8 hash[3];
149 int err;
150
defce9e8
JH		 151 if (!chan || !chan->data)
152 return false;
153
154 tfm = chan->data;
155
60478054
JH		 156 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
157
158 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
159 if (err)
160 return false;
161
162 return !memcmp(bdaddr->b, hash, 3);
163}
164
defce9e8 165int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 166{
defce9e8
JH		 167 struct l2cap_chan *chan = hdev->smp_data;
168 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 169 int err;
170
defce9e8
JH		 171 if (!chan || !chan->data)
172 return -EOPNOTSUPP;
173
174 tfm = chan->data;
175
b1e2b3ae
JH		 176 get_random_bytes(&rpa->b[3], 3);
177
178 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
179 rpa->b[5] |= 0x40; /* Set second most significant bit */
180
181 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
182 if (err < 0)
183 return err;
184
185 BT_DBG("RPA %pMR", rpa);
186
187 return 0;
188}
189
ec70f36f
JH		 190static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
191 u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
192 u8 res[16])
d22ef0bc 193{
ec70f36f 194 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 195 u8 p1[16], p2[16];
196 int err;
197
ec70f36f
JH		 198 BT_DBG("%s", hdev->name);
199
d22ef0bc
AB		 200 memset(p1, 0, 16);
201
202 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 203 p1[0] = _iat;
204 p1[1] = _rat;
205 memcpy(p1 + 2, preq, 7);
206 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 207
208 /* p2 = padding || ia || ra */
943a732a
JH		 209 memcpy(p2, ra, 6);
210 memcpy(p2 + 6, ia, 6);
211 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 212
213 /* res = r XOR p1 */
214 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
215
216 /* res = e(k, res) */
ec70f36f 217 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 218 if (err) {
219 BT_ERR("Encrypt data error");
220 return err;
221 }
222
223 /* res = res XOR p2 */
224 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
225
226 /* res = e(k, res) */
ec70f36f 227 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 228 if (err)
229 BT_ERR("Encrypt data error");
230
231 return err;
232}
233
ec70f36f
JH		 234static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
235 u8 _r[16])
d22ef0bc 236{
ec70f36f 237 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 238 int err;
239
ec70f36f
JH		 240 BT_DBG("%s", hdev->name);
241
d22ef0bc 242 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 243 memcpy(_r, r2, 8);
244 memcpy(_r + 8, r1, 8);
d22ef0bc 245
ec70f36f 246 err = smp_e(smp->tfm_aes, k, _r);
d22ef0bc
AB		 247 if (err)
248 BT_ERR("Encrypt data error");
249
250 return err;
251}
252
5d88cc73 253static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 254{
5d88cc73 255 struct l2cap_chan *chan = conn->smp;
b68fda68 256 struct smp_chan *smp;
5d88cc73
JH		 257 struct kvec iv[2];
258 struct msghdr msg;
eb492e01 259
5d88cc73
JH		 260 if (!chan)
261 return;
eb492e01 262
5d88cc73 263 BT_DBG("code 0x%2.2x", code);
eb492e01 264
5d88cc73
JH		 265 iv[0].iov_base = &code;
266 iv[0].iov_len = 1;
eb492e01 267
5d88cc73
JH		 268 iv[1].iov_base = data;
269 iv[1].iov_len = len;
eb492e01 270
5d88cc73 271 memset(&msg, 0, sizeof(msg));
eb492e01 272
5d88cc73
JH		 273 msg.msg_iov = (struct iovec *) &iv;
274 msg.msg_iovlen = 2;
eb492e01 275
5d88cc73 276 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 277
b68fda68
JH		 278 if (!chan->data)
279 return;
280
281 smp = chan->data;
282
283 cancel_delayed_work_sync(&smp->security_timer);
284 if (test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
285 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 286}
287
2b64d153
BG		 288static __u8 authreq_to_seclevel(__u8 authreq)
289{
290 if (authreq & SMP_AUTH_MITM)
291 return BT_SECURITY_HIGH;
292 else
293 return BT_SECURITY_MEDIUM;
294}
295
296static __u8 seclevel_to_authreq(__u8 sec_level)
297{
298 switch (sec_level) {
299 case BT_SECURITY_HIGH:
300 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
301 case BT_SECURITY_MEDIUM:
302 return SMP_AUTH_BONDING;
303 default:
304 return SMP_AUTH_NONE;
305 }
306}
307
b8e66eac 308static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 309 struct smp_cmd_pairing *req,
310 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 311{
5d88cc73
JH		 312 struct l2cap_chan *chan = conn->smp;
313 struct smp_chan *smp = chan->data;
fd349c02
JH		 314 struct hci_conn *hcon = conn->hcon;
315 struct hci_dev *hdev = hcon->hdev;
316 u8 local_dist = 0, remote_dist = 0;
54790f73 317
b6ae8457 318 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 319 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
320 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 321 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 322 } else {
323 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 324 }
325
fd349c02
JH		 326 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
327 remote_dist |= SMP_DIST_ID_KEY;
328
863efaf2
JH		 329 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
330 local_dist |= SMP_DIST_ID_KEY;
331
54790f73
VCG		 332 if (rsp == NULL) {
333 req->io_capability = conn->hcon->io_capability;
334 req->oob_flag = SMP_OOB_NOT_PRESENT;
335 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 336 req->init_key_dist = local_dist;
337 req->resp_key_dist = remote_dist;
065a13e2 338 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 339
340 smp->remote_key_dist = remote_dist;
54790f73
VCG		 341 return;
342 }
343
344 rsp->io_capability = conn->hcon->io_capability;
345 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
346 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 347 rsp->init_key_dist = req->init_key_dist & remote_dist;
348 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 349 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 350
351 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 352}
353
3158c50c
VCG		 354static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
355{
5d88cc73
JH		 356 struct l2cap_chan *chan = conn->smp;
357 struct smp_chan *smp = chan->data;
1c1def09 358
3158c50c 359 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 360 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 361 return SMP_ENC_KEY_SIZE;
362
f7aa611a 363 smp->enc_key_size = max_key_size;
3158c50c
VCG		 364
365 return 0;
366}
367
84794e11 368static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 369{
bab73cb6 370 struct hci_conn *hcon = conn->hcon;
b68fda68
JH		 371 struct l2cap_chan *chan = conn->smp;
372 struct smp_chan *smp;
bab73cb6 373
84794e11 374 if (reason)
4f957a76 375 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 376 &reason);
4f957a76 377
ce39fb4e
MH		 378 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
379 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
380 HCI_ERROR_AUTH_FAILURE);
f1c09c07 381
b68fda68
JH		 382 if (!chan->data)
383 return;
384
385 smp = chan->data;
386
387 cancel_delayed_work_sync(&smp->security_timer);
61a0cfb0 388
ce39fb4e 389 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 390 smp_chan_destroy(conn);
4f957a76
BG		 391}
392
2b64d153
BG		 393#define JUST_WORKS 0x00
394#define JUST_CFM 0x01
395#define REQ_PASSKEY 0x02
396#define CFM_PASSKEY 0x03
397#define REQ_OOB 0x04
398#define OVERLAP 0xFF
399
400static const u8 gen_method[5][5] = {
401 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
402 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
403 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
404 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
405 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
406};
407
581370cc
JH		 408static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
409{
2bcd4003
JH		 410 /* If either side has unknown io_caps, use JUST_CFM (which gets
411 * converted later to JUST_WORKS if we're initiators.
412 */
581370cc
JH		 413 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
414 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 415 return JUST_CFM;
581370cc
JH		 416
417 return gen_method[remote_io][local_io];
418}
419
2b64d153
BG		 420static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
421 u8 local_io, u8 remote_io)
422{
423 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 424 struct l2cap_chan *chan = conn->smp;
425 struct smp_chan *smp = chan->data;
2b64d153
BG		 426 u8 method;
427 u32 passkey = 0;
428 int ret = 0;
429
430 /* Initialize key for JUST WORKS */
431 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 432 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 433
434 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
435
2bcd4003
JH		 436 /* If neither side wants MITM, either "just" confirm an incoming
437 * request or use just-works for outgoing ones. The JUST_CFM
438 * will be converted to JUST_WORKS if necessary later in this
439 * function. If either side has MITM look up the method from the
440 * table.
441 */
581370cc 442 if (!(auth & SMP_AUTH_MITM))
2bcd4003 443 method = JUST_CFM;
2b64d153 444 else
581370cc 445 method = get_auth_method(smp, local_io, remote_io);
2b64d153 446
a82505c7 447 /* Don't confirm locally initiated pairing attempts */
4a74d658 448 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 449 method = JUST_WORKS;
450
02f3e254
JH		 451 /* Don't bother user space with no IO capabilities */
452 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
453 method = JUST_WORKS;
454
2b64d153
BG		 455 /* If Just Works, Continue with Zero TK */
456 if (method == JUST_WORKS) {
4a74d658 457 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 458 return 0;
459 }
460
461 /* Not Just Works/Confirm results in MITM Authentication */
462 if (method != JUST_CFM)
4a74d658 463 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 464
465 /* If both devices have Keyoard-Display I/O, the master
466 * Confirms and the slave Enters the passkey.
467 */
468 if (method == OVERLAP) {
40bef302 469 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 470 method = CFM_PASSKEY;
471 else
472 method = REQ_PASSKEY;
473 }
474
01ad34d2 475 /* Generate random passkey. */
2b64d153 476 if (method == CFM_PASSKEY) {
943a732a 477 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 478 get_random_bytes(&passkey, sizeof(passkey));
479 passkey %= 1000000;
943a732a 480 put_unaligned_le32(passkey, smp->tk);
2b64d153 481 BT_DBG("PassKey: %d", passkey);
4a74d658 482 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 483 }
484
485 hci_dev_lock(hcon->hdev);
486
487 if (method == REQ_PASSKEY)
ce39fb4e 488 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 489 hcon->type, hcon->dst_type);
4eb65e66
JH		 490 else if (method == JUST_CFM)
491 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
492 hcon->type, hcon->dst_type,
493 passkey, 1);
2b64d153 494 else
01ad34d2 495 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 496 hcon->type, hcon->dst_type,
39adbffe 497 passkey, 0);
2b64d153
BG		 498
499 hci_dev_unlock(hcon->hdev);
500
501 return ret;
502}
503
1cc61144 504static u8 smp_confirm(struct smp_chan *smp)
8aab4757 505{
8aab4757 506 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 507 struct smp_cmd_pairing_confirm cp;
508 int ret;
8aab4757
VCG		 509
510 BT_DBG("conn %p", conn);
511
ec70f36f 512 ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 513 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 514 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
515 cp.confirm_val);
1cc61144
JH		 516 if (ret)
517 return SMP_UNSPECIFIED;
8aab4757 518
4a74d658 519 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 520
8aab4757
VCG		 521 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
522
1cc61144 523 return 0;
8aab4757
VCG		 524}
525
861580a9 526static u8 smp_random(struct smp_chan *smp)
8aab4757 527{
8aab4757
VCG		 528 struct l2cap_conn *conn = smp->conn;
529 struct hci_conn *hcon = conn->hcon;
861580a9 530 u8 confirm[16];
8aab4757
VCG		 531 int ret;
532
ec70f36f 533 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 534 return SMP_UNSPECIFIED;
8aab4757
VCG		 535
536 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
537
ec70f36f 538 ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 539 hcon->init_addr_type, &hcon->init_addr,
943a732a 540 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 541 if (ret)
542 return SMP_UNSPECIFIED;
8aab4757 543
8aab4757
VCG		 544 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
545 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 546 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 547 }
548
549 if (hcon->out) {
fe39c7b2
MH		 550 u8 stk[16];
551 __le64 rand = 0;
552 __le16 ediv = 0;
8aab4757 553
ec70f36f 554 smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 555
f7aa611a 556 memset(stk + smp->enc_key_size, 0,
04124681 557 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 558
861580a9
JH		 559 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
560 return SMP_UNSPECIFIED;
8aab4757
VCG		 561
562 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 563 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 564 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 565 } else {
fff3490f 566 u8 stk[16], auth;
fe39c7b2
MH		 567 __le64 rand = 0;
568 __le16 ediv = 0;
8aab4757 569
943a732a
JH		 570 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
571 smp->prnd);
8aab4757 572
ec70f36f 573 smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 574
f7aa611a 575 memset(stk + smp->enc_key_size, 0,
f1560463 576 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 577
fff3490f
JH		 578 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
579 auth = 1;
580 else
581 auth = 0;
582
7d5843b7
JH		 583 /* Even though there's no _SLAVE suffix this is the
584 * slave STK we're adding for later lookup (the master
585 * STK never needs to be stored).
586 */
ce39fb4e 587 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 588 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 589 }
590
861580a9 591 return 0;
8aab4757
VCG		 592}
593
44f1a7ab
JH		 594static void smp_notify_keys(struct l2cap_conn *conn)
595{
596 struct l2cap_chan *chan = conn->smp;
597 struct smp_chan *smp = chan->data;
598 struct hci_conn *hcon = conn->hcon;
599 struct hci_dev *hdev = hcon->hdev;
600 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
601 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
602 bool persistent;
603
604 if (smp->remote_irk) {
605 mgmt_new_irk(hdev, smp->remote_irk);
606 /* Now that user space can be considered to know the
607 * identity address track the connection based on it
608 * from now on.
609 */
610 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
611 hcon->dst_type = smp->remote_irk->addr_type;
612 l2cap_conn_update_id_addr(hcon);
613
614 /* When receiving an indentity resolving key for
615 * a remote device that does not use a resolvable
616 * private address, just remove the key so that
617 * it is possible to use the controller white
618 * list for scanning.
619 *
620 * Userspace will have been told to not store
621 * this key at this point. So it is safe to
622 * just remove it.
623 */
624 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
625 list_del(&smp->remote_irk->list);
626 kfree(smp->remote_irk);
627 smp->remote_irk = NULL;
628 }
629 }
630
631 /* The LTKs and CSRKs should be persistent only if both sides
632 * had the bonding bit set in their authentication requests.
633 */
634 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
635
636 if (smp->csrk) {
637 smp->csrk->bdaddr_type = hcon->dst_type;
638 bacpy(&smp->csrk->bdaddr, &hcon->dst);
639 mgmt_new_csrk(hdev, smp->csrk, persistent);
640 }
641
642 if (smp->slave_csrk) {
643 smp->slave_csrk->bdaddr_type = hcon->dst_type;
644 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
645 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
646 }
647
648 if (smp->ltk) {
649 smp->ltk->bdaddr_type = hcon->dst_type;
650 bacpy(&smp->ltk->bdaddr, &hcon->dst);
651 mgmt_new_ltk(hdev, smp->ltk, persistent);
652 }
653
654 if (smp->slave_ltk) {
655 smp->slave_ltk->bdaddr_type = hcon->dst_type;
656 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
657 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
658 }
659}
660
661static int smp_distribute_keys(struct l2cap_conn *conn)
662{
663 struct smp_cmd_pairing *req, *rsp;
664 struct l2cap_chan *chan = conn->smp;
665 struct smp_chan *smp = chan->data;
666 struct hci_conn *hcon = conn->hcon;
667 struct hci_dev *hdev = hcon->hdev;
668 __u8 *keydist;
669
670 BT_DBG("conn %p", conn);
671
672 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
673 return 0;
674
675 rsp = (void *) &smp->prsp[1];
676
677 /* The responder sends its keys first */
678 if (hcon->out && (smp->remote_key_dist & 0x07))
679 return 0;
680
681 req = (void *) &smp->preq[1];
682
683 if (hcon->out) {
684 keydist = &rsp->init_key_dist;
685 *keydist &= req->init_key_dist;
686 } else {
687 keydist = &rsp->resp_key_dist;
688 *keydist &= req->resp_key_dist;
689 }
690
691 BT_DBG("keydist 0x%x", *keydist);
692
693 if (*keydist & SMP_DIST_ENC_KEY) {
694 struct smp_cmd_encrypt_info enc;
695 struct smp_cmd_master_ident ident;
696 struct smp_ltk *ltk;
697 u8 authenticated;
698 __le16 ediv;
699 __le64 rand;
700
701 get_random_bytes(enc.ltk, sizeof(enc.ltk));
702 get_random_bytes(&ediv, sizeof(ediv));
703 get_random_bytes(&rand, sizeof(rand));
704
705 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
706
707 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
708 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
709 SMP_LTK_SLAVE, authenticated, enc.ltk,
710 smp->enc_key_size, ediv, rand);
711 smp->slave_ltk = ltk;
712
713 ident.ediv = ediv;
714 ident.rand = rand;
715
716 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
717
718 *keydist &= ~SMP_DIST_ENC_KEY;
719 }
720
721 if (*keydist & SMP_DIST_ID_KEY) {
722 struct smp_cmd_ident_addr_info addrinfo;
723 struct smp_cmd_ident_info idinfo;
724
725 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
726
727 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
728
729 /* The hci_conn contains the local identity address
730 * after the connection has been established.
731 *
732 * This is true even when the connection has been
733 * established using a resolvable random address.
734 */
735 bacpy(&addrinfo.bdaddr, &hcon->src);
736 addrinfo.addr_type = hcon->src_type;
737
738 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
739 &addrinfo);
740
741 *keydist &= ~SMP_DIST_ID_KEY;
742 }
743
744 if (*keydist & SMP_DIST_SIGN) {
745 struct smp_cmd_sign_info sign;
746 struct smp_csrk *csrk;
747
748 /* Generate a new random key */
749 get_random_bytes(sign.csrk, sizeof(sign.csrk));
750
751 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
752 if (csrk) {
753 csrk->master = 0x00;
754 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
755 }
756 smp->slave_csrk = csrk;
757
758 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
759
760 *keydist &= ~SMP_DIST_SIGN;
761 }
762
763 /* If there are still keys to be received wait for them */
764 if ((smp->remote_key_dist & 0x07))
765 return 0;
766
767 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
b68fda68 768 cancel_delayed_work_sync(&smp->security_timer);
44f1a7ab
JH		 769 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
770 smp_notify_keys(conn);
771
772 smp_chan_destroy(conn);
773
774 return 0;
775}
776
b68fda68
JH		 777static void smp_timeout(struct work_struct *work)
778{
779 struct smp_chan *smp = container_of(work, struct smp_chan,
780 security_timer.work);
781 struct l2cap_conn *conn = smp->conn;
782
783 BT_DBG("conn %p", conn);
784
785 l2cap_conn_shutdown(conn, ETIMEDOUT);
786}
787
8aab4757
VCG		 788static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
789{
5d88cc73 790 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 791 struct smp_chan *smp;
792
f1560463 793 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
616d55be
JH		 794 if (!smp) {
795 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
8aab4757 796 return NULL;
616d55be 797 }
8aab4757 798
6a7bd103
JH		 799 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
800 if (IS_ERR(smp->tfm_aes)) {
801 BT_ERR("Unable to create ECB crypto context");
802 kfree(smp);
616d55be 803 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6a7bd103
JH		 804 return NULL;
805 }
806
8aab4757 807 smp->conn = conn;
5d88cc73 808 chan->data = smp;
8aab4757 809
b68fda68
JH		 810 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
811
8aab4757
VCG		 812 hci_conn_hold(conn->hcon);
813
814 return smp;
815}
816
817void smp_chan_destroy(struct l2cap_conn *conn)
818{
5d88cc73
JH		 819 struct l2cap_chan *chan = conn->smp;
820 struct smp_chan *smp = chan->data;
f4a407be 821 bool complete;
c8eb9690 822
f1c09c07 823 BUG_ON(!smp);
c8eb9690 824
4a74d658 825 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
f4a407be
JH		 826 mgmt_smp_complete(conn->hcon, complete);
827
7ee4ea36
MH		 828 kfree(smp->csrk);
829 kfree(smp->slave_csrk);
830
6a7bd103
JH		 831 crypto_free_blkcipher(smp->tfm_aes);
832
759331d7
JH		 833 /* If pairing failed clean up any keys we might have */
834 if (!complete) {
835 if (smp->ltk) {
836 list_del(&smp->ltk->list);
837 kfree(smp->ltk);
838 }
839
840 if (smp->slave_ltk) {
841 list_del(&smp->slave_ltk->list);
842 kfree(smp->slave_ltk);
843 }
844
845 if (smp->remote_irk) {
846 list_del(&smp->remote_irk->list);
847 kfree(smp->remote_irk);
848 }
849 }
850
5d88cc73 851 chan->data = NULL;
c8eb9690 852 kfree(smp);
76a68ba0 853 hci_conn_drop(conn->hcon);
8aab4757
VCG		 854}
855
2b64d153
BG		 856int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
857{
b10e8017 858 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 859 struct l2cap_chan *chan;
2b64d153
BG		 860 struct smp_chan *smp;
861 u32 value;
2b64d153
BG		 862
863 BT_DBG("");
864
642ac774 865 if (!conn || !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
2b64d153
BG		 866 return -ENOTCONN;
867
5d88cc73
JH		 868 chan = conn->smp;
869 if (!chan)
870 return -ENOTCONN;
871
872 smp = chan->data;
2b64d153
BG		 873
874 switch (mgmt_op) {
875 case MGMT_OP_USER_PASSKEY_REPLY:
876 value = le32_to_cpu(passkey);
943a732a 877 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 878 BT_DBG("PassKey: %d", value);
943a732a 879 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 880 /* Fall Through */
881 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 882 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 883 break;
884 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
885 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 886 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 887 return 0;
888 default:
84794e11 889 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 890 return -EOPNOTSUPP;
891 }
892
893 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 894 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
895 u8 rsp = smp_confirm(smp);
896 if (rsp)
897 smp_failure(conn, rsp);
898 }
2b64d153
BG		 899
900 return 0;
901}
902
da85e5e5 903static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 904{
3158c50c 905 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
b3c6410b 906 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 907 struct smp_chan *smp;
c7262e71 908 u8 key_size, auth, sec_level;
8aab4757 909 int ret;
88ba43b6
AB		 910
911 BT_DBG("conn %p", conn);
912
c46b98be 913 if (skb->len < sizeof(*req))
38e4a915 914 return SMP_INVALID_PARAMS;
c46b98be 915
40bef302 916 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 917 return SMP_CMD_NOTSUPP;
918
5d88cc73 919 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
8aab4757 920 smp = smp_chan_create(conn);
5d88cc73
JH		 921 } else {
922 struct l2cap_chan *chan = conn->smp;
923 smp = chan->data;
924 }
8aab4757 925
d08fd0e7
AE		 926 if (!smp)
927 return SMP_UNSPECIFIED;
d26a2345 928
b6ae8457 929 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
b3c6410b
JH		 930 (req->auth_req & SMP_AUTH_BONDING))
931 return SMP_PAIRING_NOTSUPP;
932
1c1def09
VCG		 933 smp->preq[0] = SMP_CMD_PAIRING_REQ;
934 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 935 skb_pull(skb, sizeof(*req));
88ba43b6 936
2b64d153 937 /* We didn't start the pairing, so match remote */
1ef35827 938 auth = req->auth_req;
da85e5e5 939
c7262e71
JH		 940 sec_level = authreq_to_seclevel(auth);
941 if (sec_level > conn->hcon->pending_sec_level)
942 conn->hcon->pending_sec_level = sec_level;
fdde0a26 943
2ed8f65c
JH		 944 /* If we need MITM check that it can be acheived */
945 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
946 u8 method;
947
948 method = get_auth_method(smp, conn->hcon->io_capability,
949 req->io_capability);
950 if (method == JUST_WORKS || method == JUST_CFM)
951 return SMP_AUTH_REQUIREMENTS;
952 }
953
2b64d153 954 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 955
956 key_size = min(req->max_key_size, rsp.max_key_size);
957 if (check_enc_key_size(conn, key_size))
958 return SMP_ENC_KEY_SIZE;
88ba43b6 959
e84a6b13 960 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 961
1c1def09
VCG		 962 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
963 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 964
3158c50c 965 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 966
2b64d153
BG		 967 /* Request setup of TK */
968 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
969 if (ret)
970 return SMP_UNSPECIFIED;
971
da85e5e5 972 return 0;
88ba43b6
AB		 973}
974
da85e5e5 975static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 976{
3158c50c 977 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 978 struct l2cap_chan *chan = conn->smp;
979 struct smp_chan *smp = chan->data;
2b64d153 980 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 981 int ret;
88ba43b6
AB		 982
983 BT_DBG("conn %p", conn);
984
c46b98be 985 if (skb->len < sizeof(*rsp))
38e4a915 986 return SMP_INVALID_PARAMS;
c46b98be 987
40bef302 988 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 989 return SMP_CMD_NOTSUPP;
990
3158c50c
VCG		 991 skb_pull(skb, sizeof(*rsp));
992
1c1def09 993 req = (void *) &smp->preq[1];
da85e5e5 994
3158c50c
VCG		 995 key_size = min(req->max_key_size, rsp->max_key_size);
996 if (check_enc_key_size(conn, key_size))
997 return SMP_ENC_KEY_SIZE;
998
2ed8f65c
JH		 999 /* If we need MITM check that it can be acheived */
1000 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1001 u8 method;
1002
1003 method = get_auth_method(smp, req->io_capability,
1004 rsp->io_capability);
1005 if (method == JUST_WORKS || method == JUST_CFM)
1006 return SMP_AUTH_REQUIREMENTS;
1007 }
1008
e84a6b13 1009 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1010
8aab4757
VCG		 1011 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1012 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1013
fdcc4bec
JH		 1014 /* Update remote key distribution in case the remote cleared
1015 * some bits that we had enabled in our request.
1016 */
1017 smp->remote_key_dist &= rsp->resp_key_dist;
1018
2b64d153 1019 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 1020 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 1021 auth = SMP_AUTH_BONDING;
1022
1023 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
1024
476585ec 1025 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1026 if (ret)
1027 return SMP_UNSPECIFIED;
1028
4a74d658 1029 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1030
1031 /* Can't compose response until we have been confirmed */
4a74d658 1032 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1033 return smp_confirm(smp);
da85e5e5
VCG		 1034
1035 return 0;
88ba43b6
AB		 1036}
1037
da85e5e5 1038static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1039{
5d88cc73
JH		 1040 struct l2cap_chan *chan = conn->smp;
1041 struct smp_chan *smp = chan->data;
7d24ddcc 1042
88ba43b6
AB		 1043 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1044
c46b98be 1045 if (skb->len < sizeof(smp->pcnf))
38e4a915 1046 return SMP_INVALID_PARAMS;
c46b98be 1047
1c1def09
VCG		 1048 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1049 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1050
943a732a
JH		 1051 if (conn->hcon->out)
1052 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1053 smp->prnd);
4a74d658 1054 else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1055 return smp_confirm(smp);
943a732a 1056 else
4a74d658 1057 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1058
1059 return 0;
88ba43b6
AB		 1060}
1061
da85e5e5 1062static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1063{
5d88cc73
JH		 1064 struct l2cap_chan *chan = conn->smp;
1065 struct smp_chan *smp = chan->data;
7d24ddcc 1066
8aab4757 1067 BT_DBG("conn %p", conn);
3158c50c 1068
c46b98be 1069 if (skb->len < sizeof(smp->rrnd))
38e4a915 1070 return SMP_INVALID_PARAMS;
c46b98be 1071
943a732a 1072 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1073 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1074
861580a9 1075 return smp_random(smp);
88ba43b6
AB		 1076}
1077
f81cd823 1078static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1079{
c9839a11 1080 struct smp_ltk *key;
988c5997
VCG		 1081 struct hci_conn *hcon = conn->hcon;
1082
98a0b845 1083 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1084 hcon->role);
988c5997 1085 if (!key)
f81cd823 1086 return false;
988c5997 1087
4dab7864 1088 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
f81cd823 1089 return false;
4dab7864 1090
51a8efd7 1091 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1092 return true;
988c5997 1093
c9839a11
VCG		 1094 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1095 hcon->enc_key_size = key->enc_size;
988c5997 1096
fe59a05f
JH		 1097 /* We never store STKs for master role, so clear this flag */
1098 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1099
f81cd823 1100 return true;
988c5997 1101}
f1560463 1102
854f4727
JH		 1103bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
1104{
1105 if (sec_level == BT_SECURITY_LOW)
1106 return true;
1107
9ab65d60
JH		 1108 /* If we're encrypted with an STK always claim insufficient
1109 * security. This way we allow the connection to be re-encrypted
1110 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 1111 * security. Only exception is if we don't have an LTK (e.g.
1112 * because of key distribution bits).
9ab65d60 1113 */
b2d5e254
JH		 1114 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
1115 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1116 hcon->role))
9ab65d60
JH		 1117 return false;
1118
854f4727
JH		 1119 if (hcon->sec_level >= sec_level)
1120 return true;
1121
1122 return false;
1123}
1124
da85e5e5 1125static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1126{
1127 struct smp_cmd_security_req *rp = (void *) skb->data;
1128 struct smp_cmd_pairing cp;
f1cb9af5 1129 struct hci_conn *hcon = conn->hcon;
8aab4757 1130 struct smp_chan *smp;
c7262e71 1131 u8 sec_level;
88ba43b6
AB		 1132
1133 BT_DBG("conn %p", conn);
1134
c46b98be 1135 if (skb->len < sizeof(*rp))
38e4a915 1136 return SMP_INVALID_PARAMS;
c46b98be 1137
40bef302 1138 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1139 return SMP_CMD_NOTSUPP;
1140
c7262e71 1141 sec_level = authreq_to_seclevel(rp->auth_req);
854f4727
JH		 1142 if (smp_sufficient_security(hcon, sec_level))
1143 return 0;
1144
c7262e71
JH		 1145 if (sec_level > hcon->pending_sec_level)
1146 hcon->pending_sec_level = sec_level;
feb45eb5 1147
4dab7864 1148 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1149 return 0;
1150
51a8efd7 1151 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 1152 return 0;
f1cb9af5 1153
8aab4757 1154 smp = smp_chan_create(conn);
c29d2444
JH		 1155 if (!smp)
1156 return SMP_UNSPECIFIED;
d26a2345 1157
b6ae8457 1158 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
616d55be
JH		 1159 (rp->auth_req & SMP_AUTH_BONDING))
1160 return SMP_PAIRING_NOTSUPP;
1161
88ba43b6 1162 skb_pull(skb, sizeof(*rp));
88ba43b6 1163
da85e5e5 1164 memset(&cp, 0, sizeof(cp));
54790f73 1165 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 1166
1c1def09
VCG		 1167 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1168 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1169
88ba43b6 1170 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 1171
da85e5e5 1172 return 0;
88ba43b6
AB		 1173}
1174
cc110922 1175int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1176{
cc110922 1177 struct l2cap_conn *conn = hcon->l2cap_data;
0a66cf20 1178 struct smp_chan *smp;
2b64d153 1179 __u8 authreq;
eb492e01 1180
3a0259bb
VCG		 1181 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1182
0a66cf20
JH		 1183 /* This may be NULL if there's an unexpected disconnection */
1184 if (!conn)
1185 return 1;
1186
757aee0f 1187 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1188 return 1;
1189
ad32a2f5 1190 if (smp_sufficient_security(hcon, sec_level))
eb492e01 1191 return 1;
f1cb9af5 1192
c7262e71
JH		 1193 if (sec_level > hcon->pending_sec_level)
1194 hcon->pending_sec_level = sec_level;
1195
40bef302 1196 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1197 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1198 return 0;
d26a2345 1199
51a8efd7 1200 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1201 return 0;
1202
8aab4757 1203 smp = smp_chan_create(conn);
2b64d153
BG		 1204 if (!smp)
1205 return 1;
1206
1207 authreq = seclevel_to_authreq(sec_level);
d26a2345 1208
79897d20
JH		 1209 /* Require MITM if IO Capability allows or the security level
1210 * requires it.
2e233644 1211 */
79897d20 1212 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1213 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1214 authreq |= SMP_AUTH_MITM;
1215
40bef302 1216 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1217 struct smp_cmd_pairing cp;
f01ead31 1218
2b64d153 1219 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1220 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1221 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1222
eb492e01
AB		 1223 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
1224 } else {
1225 struct smp_cmd_security_req cp;
2b64d153 1226 cp.auth_req = authreq;
eb492e01
AB		 1227 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
1228 }
1229
4a74d658 1230 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 1231
eb492e01
AB		 1232 return 0;
1233}
1234
7034b911
VCG		 1235static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1236{
16b90839 1237 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1238 struct l2cap_chan *chan = conn->smp;
1239 struct smp_chan *smp = chan->data;
16b90839 1240
c46b98be
JH		 1241 BT_DBG("conn %p", conn);
1242
1243 if (skb->len < sizeof(*rp))
38e4a915 1244 return SMP_INVALID_PARAMS;
c46b98be 1245
6131ddc8
JH		 1246 /* Ignore this PDU if it wasn't requested */
1247 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1248 return 0;
1249
16b90839
VCG		 1250 skb_pull(skb, sizeof(*rp));
1251
1c1def09 1252 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1253
7034b911
VCG		 1254 return 0;
1255}
1256
1257static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1258{
16b90839 1259 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1260 struct l2cap_chan *chan = conn->smp;
1261 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1262 struct hci_dev *hdev = conn->hcon->hdev;
1263 struct hci_conn *hcon = conn->hcon;
23d0e128 1264 struct smp_ltk *ltk;
c9839a11 1265 u8 authenticated;
16b90839 1266
c46b98be
JH		 1267 BT_DBG("conn %p", conn);
1268
1269 if (skb->len < sizeof(*rp))
38e4a915 1270 return SMP_INVALID_PARAMS;
c46b98be 1271
6131ddc8
JH		 1272 /* Ignore this PDU if it wasn't requested */
1273 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1274 return 0;
1275
9747a9f3
JH		 1276 /* Mark the information as received */
1277 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1278
16b90839 1279 skb_pull(skb, sizeof(*rp));
7034b911 1280
c9839a11 1281 hci_dev_lock(hdev);
ce39fb4e 1282 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1283 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1284 authenticated, smp->tk, smp->enc_key_size,
1285 rp->ediv, rp->rand);
1286 smp->ltk = ltk;
fd349c02 1287 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 1288 smp_distribute_keys(conn);
c9839a11 1289 hci_dev_unlock(hdev);
7034b911
VCG		 1290
1291 return 0;
1292}
1293
fd349c02
JH		 1294static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1295{
1296 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1297 struct l2cap_chan *chan = conn->smp;
1298 struct smp_chan *smp = chan->data;
fd349c02
JH		 1299
1300 BT_DBG("");
1301
1302 if (skb->len < sizeof(*info))
38e4a915 1303 return SMP_INVALID_PARAMS;
fd349c02 1304
6131ddc8
JH		 1305 /* Ignore this PDU if it wasn't requested */
1306 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1307 return 0;
1308
fd349c02
JH		 1309 skb_pull(skb, sizeof(*info));
1310
1311 memcpy(smp->irk, info->irk, 16);
1312
1313 return 0;
1314}
1315
1316static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1317 struct sk_buff *skb)
1318{
1319 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1320 struct l2cap_chan *chan = conn->smp;
1321 struct smp_chan *smp = chan->data;
fd349c02
JH		 1322 struct hci_conn *hcon = conn->hcon;
1323 bdaddr_t rpa;
1324
1325 BT_DBG("");
1326
1327 if (skb->len < sizeof(*info))
38e4a915 1328 return SMP_INVALID_PARAMS;
fd349c02 1329
6131ddc8
JH		 1330 /* Ignore this PDU if it wasn't requested */
1331 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1332 return 0;
1333
9747a9f3
JH		 1334 /* Mark the information as received */
1335 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1336
fd349c02
JH		 1337 skb_pull(skb, sizeof(*info));
1338
31dd624e
JH		 1339 hci_dev_lock(hcon->hdev);
1340
a9a58f86
JH		 1341 /* Strictly speaking the Core Specification (4.1) allows sending
1342 * an empty address which would force us to rely on just the IRK
1343 * as "identity information". However, since such
1344 * implementations are not known of and in order to not over
1345 * complicate our implementation, simply pretend that we never
1346 * received an IRK for such a device.
1347 */
1348 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1349 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1350 goto distribute;
a9a58f86
JH		 1351 }
1352
fd349c02
JH		 1353 bacpy(&smp->id_addr, &info->bdaddr);
1354 smp->id_addr_type = info->addr_type;
1355
1356 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1357 bacpy(&rpa, &hcon->dst);
1358 else
1359 bacpy(&rpa, BDADDR_ANY);
1360
23d0e128
JH		 1361 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1362 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1363
31dd624e 1364distribute:
4bd6d38e 1365 smp_distribute_keys(conn);
fd349c02 1366
31dd624e
JH		 1367 hci_dev_unlock(hcon->hdev);
1368
fd349c02
JH		 1369 return 0;
1370}
1371
7ee4ea36
MH		 1372static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1373{
1374 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1375 struct l2cap_chan *chan = conn->smp;
1376 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1377 struct hci_dev *hdev = conn->hcon->hdev;
1378 struct smp_csrk *csrk;
1379
1380 BT_DBG("conn %p", conn);
1381
1382 if (skb->len < sizeof(*rp))
38e4a915 1383 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1384
1385 /* Ignore this PDU if it wasn't requested */
1386 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1387 return 0;
1388
1389 /* Mark the information as received */
1390 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1391
1392 skb_pull(skb, sizeof(*rp));
1393
1394 hci_dev_lock(hdev);
1395 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1396 if (csrk) {
1397 csrk->master = 0x01;
1398 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1399 }
1400 smp->csrk = csrk;
5fcb9347 1401 smp_distribute_keys(conn);
7ee4ea36
MH		 1402 hci_dev_unlock(hdev);
1403
1404 return 0;
1405}
1406
4befb867 1407static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1408{
5d88cc73 1409 struct l2cap_conn *conn = chan->conn;
7b9899db 1410 struct hci_conn *hcon = conn->hcon;
92381f5c 1411 __u8 code, reason;
eb492e01
AB		 1412 int err = 0;
1413
7b9899db
MH		 1414 if (hcon->type != LE_LINK) {
1415 kfree_skb(skb);
3432711f 1416 return 0;
7b9899db
MH		 1417 }
1418
8ae9b984 1419 if (skb->len < 1)
92381f5c 1420 return -EILSEQ;
92381f5c 1421
06ae3314 1422 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
beb19e4c 1423 err = -EOPNOTSUPP;
2e65c9d2
AG		 1424 reason = SMP_PAIRING_NOTSUPP;
1425 goto done;
1426 }
1427
92381f5c 1428 code = skb->data[0];
eb492e01
AB		 1429 skb_pull(skb, sizeof(code));
1430
8cf9fa12
JH		 1431 /*
1432 * The SMP context must be initialized for all other PDUs except
1433 * pairing and security requests. If we get any other PDU when
1434 * not initialized simply disconnect (done if this function
1435 * returns an error).
1436 */
1437 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
d3368605 1438 !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
8cf9fa12 1439 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
8ae9b984
JH		 1440 reason = SMP_CMD_NOTSUPP;
1441 err = -EOPNOTSUPP;
1442 goto done;
8cf9fa12
JH		 1443 }
1444
eb492e01
AB		 1445 switch (code) {
1446 case SMP_CMD_PAIRING_REQ:
da85e5e5 1447 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1448 break;
1449
1450 case SMP_CMD_PAIRING_FAIL:
84794e11 1451 smp_failure(conn, 0);
da85e5e5
VCG		 1452 reason = 0;
1453 err = -EPERM;
eb492e01
AB		 1454 break;
1455
1456 case SMP_CMD_PAIRING_RSP:
da85e5e5 1457 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1458 break;
1459
1460 case SMP_CMD_SECURITY_REQ:
da85e5e5 1461 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1462 break;
1463
eb492e01 1464 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1465 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1466 break;
1467
eb492e01 1468 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1469 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1470 break;
1471
eb492e01 1472 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1473 reason = smp_cmd_encrypt_info(conn, skb);
1474 break;
1475
eb492e01 1476 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1477 reason = smp_cmd_master_ident(conn, skb);
1478 break;
1479
eb492e01 1480 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1481 reason = smp_cmd_ident_info(conn, skb);
1482 break;
1483
eb492e01 1484 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1485 reason = smp_cmd_ident_addr_info(conn, skb);
1486 break;
1487
eb492e01 1488 case SMP_CMD_SIGN_INFO:
7ee4ea36 1489 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1490 break;
1491
eb492e01
AB		 1492 default:
1493 BT_DBG("Unknown command code 0x%2.2x", code);
1494
1495 reason = SMP_CMD_NOTSUPP;
eb492e01 1496 err = -EOPNOTSUPP;
3a0259bb 1497 goto done;
eb492e01
AB		 1498 }
1499
3a0259bb
VCG		 1500done:
1501 if (reason)
84794e11 1502 smp_failure(conn, reason);
8ae9b984
JH		 1503 if (!err)
1504 kfree_skb(skb);
eb492e01
AB		 1505 return err;
1506}
7034b911 1507
70db83c4
JH		 1508static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1509{
1510 struct l2cap_conn *conn = chan->conn;
b68fda68 1511 struct smp_chan *smp = chan->data;
70db83c4
JH		 1512
1513 BT_DBG("chan %p", chan);
1514
5d88cc73 1515 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
b68fda68 1516 cancel_delayed_work_sync(&smp->security_timer);
5d88cc73
JH		 1517 smp_chan_destroy(conn);
1518 }
1519
70db83c4
JH		 1520 conn->smp = NULL;
1521 l2cap_chan_put(chan);
1522}
1523
44f1a7ab
JH		 1524static void smp_resume_cb(struct l2cap_chan *chan)
1525{
b68fda68 1526 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1527 struct l2cap_conn *conn = chan->conn;
1528 struct hci_conn *hcon = conn->hcon;
1529
1530 BT_DBG("chan %p", chan);
1531
1532 if (test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1533 smp_distribute_keys(conn);
b68fda68
JH		 1534
1535 if (smp)
1536 cancel_delayed_work(&smp->security_timer);
44f1a7ab
JH		 1537}
1538
70db83c4
JH		 1539static void smp_ready_cb(struct l2cap_chan *chan)
1540{
1541 struct l2cap_conn *conn = chan->conn;
1542
1543 BT_DBG("chan %p", chan);
1544
1545 conn->smp = chan;
1546 l2cap_chan_hold(chan);
1547}
1548
4befb867
JH		 1549static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1550{
1551 int err;
1552
1553 BT_DBG("chan %p", chan);
1554
1555 err = smp_sig_channel(chan, skb);
1556 if (err) {
b68fda68 1557 struct smp_chan *smp = chan->data;
4befb867 1558
b68fda68
JH		 1559 if (smp)
1560 cancel_delayed_work_sync(&smp->security_timer);
4befb867
JH		 1561
1562 l2cap_conn_shutdown(chan->conn, -err);
1563 }
1564
1565 return err;
1566}
1567
70db83c4
JH		 1568static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1569 unsigned long hdr_len,
1570 unsigned long len, int nb)
1571{
1572 struct sk_buff *skb;
1573
1574 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1575 if (!skb)
1576 return ERR_PTR(-ENOMEM);
1577
1578 skb->priority = HCI_PRIO_MAX;
1579 bt_cb(skb)->chan = chan;
1580
1581 return skb;
1582}
1583
1584static const struct l2cap_ops smp_chan_ops = {
1585 .name = "Security Manager",
1586 .ready = smp_ready_cb,
5d88cc73 1587 .recv = smp_recv_cb,
70db83c4
JH		 1588 .alloc_skb = smp_alloc_skb_cb,
1589 .teardown = smp_teardown_cb,
44f1a7ab 1590 .resume = smp_resume_cb,
70db83c4
JH		 1591
1592 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1593 .state_change = l2cap_chan_no_state_change,
1594 .close = l2cap_chan_no_close,
1595 .defer = l2cap_chan_no_defer,
1596 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1597 .set_shutdown = l2cap_chan_no_set_shutdown,
1598 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1599 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1600};
1601
1602static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1603{
1604 struct l2cap_chan *chan;
1605
1606 BT_DBG("pchan %p", pchan);
1607
1608 chan = l2cap_chan_create();
1609 if (!chan)
1610 return NULL;
1611
1612 chan->chan_type = pchan->chan_type;
1613 chan->ops = &smp_chan_ops;
1614 chan->scid = pchan->scid;
1615 chan->dcid = chan->scid;
1616 chan->imtu = pchan->imtu;
1617 chan->omtu = pchan->omtu;
1618 chan->mode = pchan->mode;
1619
1620 BT_DBG("created chan %p", chan);
1621
1622 return chan;
1623}
1624
1625static const struct l2cap_ops smp_root_chan_ops = {
1626 .name = "Security Manager Root",
1627 .new_connection = smp_new_conn_cb,
1628
1629 /* None of these are implemented for the root channel */
1630 .close = l2cap_chan_no_close,
1631 .alloc_skb = l2cap_chan_no_alloc_skb,
1632 .recv = l2cap_chan_no_recv,
1633 .state_change = l2cap_chan_no_state_change,
1634 .teardown = l2cap_chan_no_teardown,
1635 .ready = l2cap_chan_no_ready,
1636 .defer = l2cap_chan_no_defer,
1637 .suspend = l2cap_chan_no_suspend,
1638 .resume = l2cap_chan_no_resume,
1639 .set_shutdown = l2cap_chan_no_set_shutdown,
1640 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1641 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1642};
1643
711eafe3
JH		 1644int smp_register(struct hci_dev *hdev)
1645{
70db83c4 1646 struct l2cap_chan *chan;
defce9e8 1647 struct crypto_blkcipher *tfm_aes;
70db83c4 1648
711eafe3
JH		 1649 BT_DBG("%s", hdev->name);
1650
defce9e8
JH		 1651 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1652 if (IS_ERR(tfm_aes)) {
1653 int err = PTR_ERR(tfm_aes);
711eafe3 1654 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1655 return err;
1656 }
1657
70db83c4
JH		 1658 chan = l2cap_chan_create();
1659 if (!chan) {
defce9e8 1660 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1661 return -ENOMEM;
1662 }
1663
defce9e8
JH		 1664 chan->data = tfm_aes;
1665
5d88cc73 1666 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1667
1668 l2cap_chan_set_defaults(chan);
1669
1670 bacpy(&chan->src, &hdev->bdaddr);
1671 chan->src_type = BDADDR_LE_PUBLIC;
1672 chan->state = BT_LISTEN;
1673 chan->mode = L2CAP_MODE_BASIC;
1674 chan->imtu = L2CAP_DEFAULT_MTU;
1675 chan->ops = &smp_root_chan_ops;
1676
1677 hdev->smp_data = chan;
1678
711eafe3
JH		 1679 return 0;
1680}
1681
1682void smp_unregister(struct hci_dev *hdev)
1683{
70db83c4 1684 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1685 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1686
1687 if (!chan)
1688 return;
1689
1690 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1691
defce9e8
JH		 1692 tfm_aes = chan->data;
1693 if (tfm_aes) {
1694 chan->data = NULL;
1695 crypto_free_blkcipher(tfm_aes);
711eafe3 1696 }
70db83c4
JH		 1697
1698 hdev->smp_data = NULL;
1699 l2cap_chan_put(chan);
711eafe3 1700}
Linux kernel - Deliverables
This page took 0.283839 seconds and 5 git commands to generate.