projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Update L2CAP timeout constants to use msecs_to_jiffies
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
23#include <net/bluetooth/bluetooth.h>
24#include <net/bluetooth/hci_core.h>
25#include <net/bluetooth/l2cap.h>
2b64d153 26#include <net/bluetooth/mgmt.h>
eb492e01 27#include <net/bluetooth/smp.h>
d22ef0bc 28#include <linux/crypto.h>
f70490e6 29#include <linux/scatterlist.h>
d22ef0bc
AB		 30#include <crypto/b128ops.h>
31
5d3de7df
VCG		 32#define SMP_TIMEOUT 30000 /* 30 seconds */
33
d22ef0bc
AB		 34static inline void swap128(u8 src[16], u8 dst[16])
35{
36 int i;
37 for (i = 0; i < 16; i++)
38 dst[15 - i] = src[i];
39}
40
41static inline void swap56(u8 src[7], u8 dst[7])
42{
43 int i;
44 for (i = 0; i < 7; i++)
45 dst[6 - i] = src[i];
46}
47
48static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
49{
50 struct blkcipher_desc desc;
51 struct scatterlist sg;
52 int err, iv_len;
53 unsigned char iv[128];
54
55 if (tfm == NULL) {
56 BT_ERR("tfm %p", tfm);
57 return -EINVAL;
58 }
59
60 desc.tfm = tfm;
61 desc.flags = 0;
62
63 err = crypto_blkcipher_setkey(tfm, k, 16);
64 if (err) {
65 BT_ERR("cipher setkey failed: %d", err);
66 return err;
67 }
68
69 sg_init_one(&sg, r, 16);
70
71 iv_len = crypto_blkcipher_ivsize(tfm);
72 if (iv_len) {
73 memset(&iv, 0xff, iv_len);
74 crypto_blkcipher_set_iv(tfm, iv, iv_len);
75 }
76
77 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
78 if (err)
79 BT_ERR("Encrypt data error %d", err);
80
81 return err;
82}
83
84static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
85 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
86 u8 _rat, bdaddr_t *ra, u8 res[16])
87{
88 u8 p1[16], p2[16];
89 int err;
90
91 memset(p1, 0, 16);
92
93 /* p1 = pres || preq || _rat || _iat */
94 swap56(pres, p1);
95 swap56(preq, p1 + 7);
96 p1[14] = _rat;
97 p1[15] = _iat;
98
99 memset(p2, 0, 16);
100
101 /* p2 = padding || ia || ra */
102 baswap((bdaddr_t *) (p2 + 4), ia);
103 baswap((bdaddr_t *) (p2 + 10), ra);
104
105 /* res = r XOR p1 */
106 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
107
108 /* res = e(k, res) */
109 err = smp_e(tfm, k, res);
110 if (err) {
111 BT_ERR("Encrypt data error");
112 return err;
113 }
114
115 /* res = res XOR p2 */
116 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
117
118 /* res = e(k, res) */
119 err = smp_e(tfm, k, res);
120 if (err)
121 BT_ERR("Encrypt data error");
122
123 return err;
124}
125
126static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16],
127 u8 r1[16], u8 r2[16], u8 _r[16])
128{
129 int err;
130
131 /* Just least significant octets from r1 and r2 are considered */
132 memcpy(_r, r1 + 8, 8);
133 memcpy(_r + 8, r2 + 8, 8);
134
135 err = smp_e(tfm, k, _r);
136 if (err)
137 BT_ERR("Encrypt data error");
138
139 return err;
140}
141
142static int smp_rand(u8 *buf)
143{
144 get_random_bytes(buf, 16);
145
146 return 0;
147}
eb492e01
AB		 148
149static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
150 u16 dlen, void *data)
151{
152 struct sk_buff *skb;
153 struct l2cap_hdr *lh;
154 int len;
155
156 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
157
158 if (len > conn->mtu)
159 return NULL;
160
161 skb = bt_skb_alloc(len, GFP_ATOMIC);
162 if (!skb)
163 return NULL;
164
165 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
166 lh->len = cpu_to_le16(sizeof(code) + dlen);
167 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
168
169 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
170
171 memcpy(skb_put(skb, dlen), data, dlen);
172
173 return skb;
174}
175
176static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
177{
178 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
179
180 BT_DBG("code 0x%2.2x", code);
181
182 if (!skb)
183 return;
184
73d80deb
LAD		 185 skb->priority = HCI_PRIO_MAX;
186 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 187
6c9d42a1
GP		 188 cancel_delayed_work_sync(&conn->security_timer);
189 schedule_delayed_work(&conn->security_timer,
e2dcd113 190 msecs_to_jiffies(SMP_TIMEOUT));
eb492e01
AB		 191}
192
2b64d153
BG		 193static __u8 authreq_to_seclevel(__u8 authreq)
194{
195 if (authreq & SMP_AUTH_MITM)
196 return BT_SECURITY_HIGH;
197 else
198 return BT_SECURITY_MEDIUM;
199}
200
201static __u8 seclevel_to_authreq(__u8 sec_level)
202{
203 switch (sec_level) {
204 case BT_SECURITY_HIGH:
205 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
206 case BT_SECURITY_MEDIUM:
207 return SMP_AUTH_BONDING;
208 default:
209 return SMP_AUTH_NONE;
210 }
211}
212
b8e66eac 213static void build_pairing_cmd(struct l2cap_conn *conn,
54790f73
VCG		 214 struct smp_cmd_pairing *req,
215 struct smp_cmd_pairing *rsp,
216 __u8 authreq)
b8e66eac 217{
2b64d153 218 u8 dist_keys = 0;
54790f73 219
a8b2d5c2 220 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
ca10b5ee 221 dist_keys = SMP_DIST_ENC_KEY;
54790f73 222 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 223 } else {
224 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 225 }
226
227 if (rsp == NULL) {
228 req->io_capability = conn->hcon->io_capability;
229 req->oob_flag = SMP_OOB_NOT_PRESENT;
230 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 231 req->init_key_dist = 0;
54790f73
VCG		 232 req->resp_key_dist = dist_keys;
233 req->auth_req = authreq;
234 return;
235 }
236
237 rsp->io_capability = conn->hcon->io_capability;
238 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
239 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 240 rsp->init_key_dist = 0;
54790f73
VCG		 241 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
242 rsp->auth_req = authreq;
b8e66eac
VCG		 243}
244
3158c50c
VCG		 245static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
246{
1c1def09
VCG		 247 struct smp_chan *smp = conn->smp_chan;
248
3158c50c
VCG		 249 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
250 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
251 return SMP_ENC_KEY_SIZE;
252
f7aa611a 253 smp->enc_key_size = max_key_size;
3158c50c
VCG		 254
255 return 0;
256}
257
4f957a76
BG		 258static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
259{
bab73cb6
JH		 260 struct hci_conn *hcon = conn->hcon;
261
4f957a76
BG		 262 if (send)
263 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
264 &reason);
265
51a8efd7 266 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags);
bab73cb6
JH		 267 mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
268 hcon->dst_type, reason);
f1c09c07
VCG		 269
270 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
271 cancel_delayed_work_sync(&conn->security_timer);
272 smp_chan_destroy(conn);
273 }
4f957a76
BG		 274}
275
2b64d153
BG		 276#define JUST_WORKS 0x00
277#define JUST_CFM 0x01
278#define REQ_PASSKEY 0x02
279#define CFM_PASSKEY 0x03
280#define REQ_OOB 0x04
281#define OVERLAP 0xFF
282
283static const u8 gen_method[5][5] = {
284 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
285 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
286 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
287 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
288 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
289};
290
291static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
292 u8 local_io, u8 remote_io)
293{
294 struct hci_conn *hcon = conn->hcon;
295 struct smp_chan *smp = conn->smp_chan;
296 u8 method;
297 u32 passkey = 0;
298 int ret = 0;
299
300 /* Initialize key for JUST WORKS */
301 memset(smp->tk, 0, sizeof(smp->tk));
302 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
303
304 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
305
306 /* If neither side wants MITM, use JUST WORKS */
307 /* If either side has unknown io_caps, use JUST WORKS */
308 /* Otherwise, look up method from the table */
309 if (!(auth & SMP_AUTH_MITM) ||
310 local_io > SMP_IO_KEYBOARD_DISPLAY ||
311 remote_io > SMP_IO_KEYBOARD_DISPLAY)
312 method = JUST_WORKS;
313 else
314 method = gen_method[local_io][remote_io];
315
316 /* If not bonding, don't ask user to confirm a Zero TK */
317 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
318 method = JUST_WORKS;
319
320 /* If Just Works, Continue with Zero TK */
321 if (method == JUST_WORKS) {
322 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
323 return 0;
324 }
325
326 /* Not Just Works/Confirm results in MITM Authentication */
327 if (method != JUST_CFM)
328 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
329
330 /* If both devices have Keyoard-Display I/O, the master
331 * Confirms and the slave Enters the passkey.
332 */
333 if (method == OVERLAP) {
334 if (hcon->link_mode & HCI_LM_MASTER)
335 method = CFM_PASSKEY;
336 else
337 method = REQ_PASSKEY;
338 }
339
340 /* Generate random passkey. Not valid until confirmed. */
341 if (method == CFM_PASSKEY) {
342 u8 key[16];
343
344 memset(key, 0, sizeof(key));
345 get_random_bytes(&passkey, sizeof(passkey));
346 passkey %= 1000000;
347 put_unaligned_le32(passkey, key);
348 swap128(key, smp->tk);
349 BT_DBG("PassKey: %d", passkey);
350 }
351
352 hci_dev_lock(hcon->hdev);
353
354 if (method == REQ_PASSKEY)
272d90df
JH		 355 ret = mgmt_user_passkey_request(hcon->hdev, conn->dst,
356 hcon->type, hcon->dst_type);
2b64d153
BG		 357 else
358 ret = mgmt_user_confirm_request(hcon->hdev, conn->dst,
272d90df 359 hcon->type, hcon->dst_type,
2b64d153
BG		 360 cpu_to_le32(passkey), 0);
361
362 hci_dev_unlock(hcon->hdev);
363
364 return ret;
365}
366
8aab4757
VCG		 367static void confirm_work(struct work_struct *work)
368{
369 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
370 struct l2cap_conn *conn = smp->conn;
371 struct crypto_blkcipher *tfm;
372 struct smp_cmd_pairing_confirm cp;
373 int ret;
374 u8 res[16], reason;
375
376 BT_DBG("conn %p", conn);
377
378 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
379 if (IS_ERR(tfm)) {
380 reason = SMP_UNSPECIFIED;
381 goto error;
382 }
383
384 smp->tfm = tfm;
385
386 if (conn->hcon->out)
387 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 0,
388 conn->src, conn->hcon->dst_type, conn->dst,
389 res);
390 else
391 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
392 conn->hcon->dst_type, conn->dst, 0, conn->src,
393 res);
394 if (ret) {
395 reason = SMP_UNSPECIFIED;
396 goto error;
397 }
398
2b64d153
BG		 399 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
400
8aab4757
VCG		 401 swap128(res, cp.confirm_val);
402 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
403
404 return;
405
406error:
4f957a76 407 smp_failure(conn, reason, 1);
8aab4757
VCG		 408}
409
410static void random_work(struct work_struct *work)
411{
412 struct smp_chan *smp = container_of(work, struct smp_chan, random);
413 struct l2cap_conn *conn = smp->conn;
414 struct hci_conn *hcon = conn->hcon;
415 struct crypto_blkcipher *tfm = smp->tfm;
416 u8 reason, confirm[16], res[16], key[16];
417 int ret;
418
419 if (IS_ERR_OR_NULL(tfm)) {
420 reason = SMP_UNSPECIFIED;
421 goto error;
422 }
423
424 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
425
426 if (hcon->out)
427 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 0,
428 conn->src, hcon->dst_type, conn->dst,
429 res);
430 else
431 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
432 hcon->dst_type, conn->dst, 0, conn->src,
433 res);
434 if (ret) {
435 reason = SMP_UNSPECIFIED;
436 goto error;
437 }
438
439 swap128(res, confirm);
440
441 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
442 BT_ERR("Pairing failed (confirmation values mismatch)");
443 reason = SMP_CONFIRM_FAILED;
444 goto error;
445 }
446
447 if (hcon->out) {
448 u8 stk[16], rand[8];
449 __le16 ediv;
450
451 memset(rand, 0, sizeof(rand));
452 ediv = 0;
453
454 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
455 swap128(key, stk);
456
f7aa611a
VCG		 457 memset(stk + smp->enc_key_size, 0,
458 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 459
51a8efd7 460 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 461 reason = SMP_UNSPECIFIED;
462 goto error;
463 }
464
465 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 466 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 467 } else {
468 u8 stk[16], r[16], rand[8];
469 __le16 ediv;
470
471 memset(rand, 0, sizeof(rand));
472 ediv = 0;
473
474 swap128(smp->prnd, r);
475 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
476
477 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
478 swap128(key, stk);
479
f7aa611a
VCG		 480 memset(stk + smp->enc_key_size, 0,
481 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 482
c9839a11
VCG		 483 hci_add_ltk(hcon->hdev, conn->dst, hcon->dst_type,
484 HCI_SMP_STK_SLAVE, 0, 0, stk,
485 smp->enc_key_size, ediv, rand);
8aab4757
VCG		 486 }
487
488 return;
489
490error:
4f957a76 491 smp_failure(conn, reason, 1);
8aab4757
VCG		 492}
493
494static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
495{
496 struct smp_chan *smp;
497
498 smp = kzalloc(sizeof(struct smp_chan), GFP_ATOMIC);
499 if (!smp)
500 return NULL;
501
502 INIT_WORK(&smp->confirm, confirm_work);
503 INIT_WORK(&smp->random, random_work);
504
505 smp->conn = conn;
506 conn->smp_chan = smp;
2b64d153 507 conn->hcon->smp_conn = conn;
8aab4757
VCG		 508
509 hci_conn_hold(conn->hcon);
510
511 return smp;
512}
513
514void smp_chan_destroy(struct l2cap_conn *conn)
515{
c8eb9690
BG		 516 struct smp_chan *smp = conn->smp_chan;
517
f1c09c07 518 BUG_ON(!smp);
c8eb9690
BG		 519
520 if (smp->tfm)
521 crypto_free_blkcipher(smp->tfm);
522
523 kfree(smp);
524 conn->smp_chan = NULL;
2b64d153 525 conn->hcon->smp_conn = NULL;
8aab4757
VCG		 526 hci_conn_put(conn->hcon);
527}
528
2b64d153
BG		 529int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
530{
531 struct l2cap_conn *conn = hcon->smp_conn;
532 struct smp_chan *smp;
533 u32 value;
534 u8 key[16];
535
536 BT_DBG("");
537
538 if (!conn)
539 return -ENOTCONN;
540
541 smp = conn->smp_chan;
542
543 switch (mgmt_op) {
544 case MGMT_OP_USER_PASSKEY_REPLY:
545 value = le32_to_cpu(passkey);
546 memset(key, 0, sizeof(key));
547 BT_DBG("PassKey: %d", value);
548 put_unaligned_le32(value, key);
549 swap128(key, smp->tk);
550 /* Fall Through */
551 case MGMT_OP_USER_CONFIRM_REPLY:
552 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
553 break;
554 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
555 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
556 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
557 return 0;
558 default:
559 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
560 return -EOPNOTSUPP;
561 }
562
563 /* If it is our turn to send Pairing Confirm, do so now */
564 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
565 queue_work(hcon->hdev->workqueue, &smp->confirm);
566
567 return 0;
568}
569
da85e5e5 570static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 571{
3158c50c 572 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 573 struct smp_chan *smp;
3158c50c 574 u8 key_size;
2b64d153 575 u8 auth = SMP_AUTH_NONE;
8aab4757 576 int ret;
88ba43b6
AB		 577
578 BT_DBG("conn %p", conn);
579
2b64d153
BG		 580 if (conn->hcon->link_mode & HCI_LM_MASTER)
581 return SMP_CMD_NOTSUPP;
582
51a8efd7 583 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757
VCG		 584 smp = smp_chan_create(conn);
585
586 smp = conn->smp_chan;
d26a2345 587
1c1def09
VCG		 588 smp->preq[0] = SMP_CMD_PAIRING_REQ;
589 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 590 skb_pull(skb, sizeof(*req));
88ba43b6 591
2b64d153
BG		 592 /* We didn't start the pairing, so match remote */
593 if (req->auth_req & SMP_AUTH_BONDING)
594 auth = req->auth_req;
da85e5e5 595
2b64d153 596 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 597
598 key_size = min(req->max_key_size, rsp.max_key_size);
599 if (check_enc_key_size(conn, key_size))
600 return SMP_ENC_KEY_SIZE;
88ba43b6 601
8aab4757
VCG		 602 ret = smp_rand(smp->prnd);
603 if (ret)
604 return SMP_UNSPECIFIED;
605
1c1def09
VCG		 606 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
607 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 608
3158c50c 609 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 610
2b64d153
BG		 611 /* Request setup of TK */
612 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
613 if (ret)
614 return SMP_UNSPECIFIED;
615
da85e5e5 616 return 0;
88ba43b6
AB		 617}
618
da85e5e5 619static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 620{
3158c50c 621 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 622 struct smp_chan *smp = conn->smp_chan;
8aab4757 623 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 624 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 625 int ret;
88ba43b6
AB		 626
627 BT_DBG("conn %p", conn);
628
2b64d153
BG		 629 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
630 return SMP_CMD_NOTSUPP;
631
3158c50c
VCG		 632 skb_pull(skb, sizeof(*rsp));
633
1c1def09 634 req = (void *) &smp->preq[1];
da85e5e5 635
3158c50c
VCG		 636 key_size = min(req->max_key_size, rsp->max_key_size);
637 if (check_enc_key_size(conn, key_size))
638 return SMP_ENC_KEY_SIZE;
639
1c1def09 640 ret = smp_rand(smp->prnd);
7d24ddcc 641 if (ret)
da85e5e5 642 return SMP_UNSPECIFIED;
7d24ddcc 643
8aab4757
VCG		 644 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
645 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 646
2b64d153
BG		 647 if ((req->auth_req & SMP_AUTH_BONDING) &&
648 (rsp->auth_req & SMP_AUTH_BONDING))
649 auth = SMP_AUTH_BONDING;
650
651 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
652
653 ret = tk_request(conn, 0, auth, rsp->io_capability, req->io_capability);
654 if (ret)
655 return SMP_UNSPECIFIED;
656
657 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
658
659 /* Can't compose response until we have been confirmed */
660 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
661 return 0;
662
8aab4757 663 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 664
665 return 0;
88ba43b6
AB		 666}
667
da85e5e5 668static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 669{
1c1def09 670 struct smp_chan *smp = conn->smp_chan;
8aab4757 671 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 672
88ba43b6
AB		 673 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
674
1c1def09
VCG		 675 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
676 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 677
7d24ddcc
AB		 678 if (conn->hcon->out) {
679 u8 random[16];
88ba43b6 680
1c1def09 681 swap128(smp->prnd, random);
88ba43b6 682 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
7d24ddcc 683 random);
2b64d153 684 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 685 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 686 } else {
687 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 688 }
da85e5e5
VCG		 689
690 return 0;
88ba43b6
AB		 691}
692
da85e5e5 693static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 694{
1c1def09 695 struct smp_chan *smp = conn->smp_chan;
8aab4757 696 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 697
8aab4757 698 BT_DBG("conn %p", conn);
3158c50c 699
8aab4757
VCG		 700 swap128(skb->data, smp->rrnd);
701 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 702
8aab4757 703 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 704
705 return 0;
88ba43b6
AB		 706}
707
988c5997
VCG		 708static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
709{
c9839a11 710 struct smp_ltk *key;
988c5997
VCG		 711 struct hci_conn *hcon = conn->hcon;
712
c9839a11 713 key = hci_find_ltk_by_addr(hcon->hdev, conn->dst, hcon->dst_type);
988c5997
VCG		 714 if (!key)
715 return 0;
716
51a8efd7 717 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 718 return 1;
719
c9839a11
VCG		 720 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
721 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 722
723 return 1;
724
725}
da85e5e5 726static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 727{
728 struct smp_cmd_security_req *rp = (void *) skb->data;
729 struct smp_cmd_pairing cp;
f1cb9af5 730 struct hci_conn *hcon = conn->hcon;
8aab4757 731 struct smp_chan *smp;
88ba43b6
AB		 732
733 BT_DBG("conn %p", conn);
734
2b64d153 735 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 736
988c5997
VCG		 737 if (smp_ltk_encrypt(conn))
738 return 0;
739
51a8efd7 740 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 741 return 0;
f1cb9af5 742
8aab4757 743 smp = smp_chan_create(conn);
d26a2345 744
88ba43b6 745 skb_pull(skb, sizeof(*rp));
88ba43b6 746
da85e5e5 747 memset(&cp, 0, sizeof(cp));
54790f73 748 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 749
1c1def09
VCG		 750 smp->preq[0] = SMP_CMD_PAIRING_REQ;
751 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 752
88ba43b6 753 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 754
da85e5e5 755 return 0;
88ba43b6
AB		 756}
757
eb492e01
AB		 758int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
759{
3a0259bb 760 struct hci_conn *hcon = conn->hcon;
1c1def09 761 struct smp_chan *smp = conn->smp_chan;
2b64d153 762 __u8 authreq;
eb492e01 763
3a0259bb
VCG		 764 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
765
2e65c9d2
AG		 766 if (!lmp_host_le_capable(hcon->hdev))
767 return 1;
768
f1cb9af5
VCG		 769 if (sec_level == BT_SECURITY_LOW)
770 return 1;
eb492e01 771
f1cb9af5 772 if (hcon->sec_level >= sec_level)
eb492e01 773 return 1;
f1cb9af5 774
988c5997
VCG		 775 if (hcon->link_mode & HCI_LM_MASTER)
776 if (smp_ltk_encrypt(conn))
02bc7455 777 goto done;
d26a2345 778
51a8efd7 779 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 780 return 0;
781
8aab4757 782 smp = smp_chan_create(conn);
2b64d153
BG		 783 if (!smp)
784 return 1;
785
786 authreq = seclevel_to_authreq(sec_level);
d26a2345 787
d26a2345
VCG		 788 if (hcon->link_mode & HCI_LM_MASTER) {
789 struct smp_cmd_pairing cp;
f01ead31 790
2b64d153 791 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 792 smp->preq[0] = SMP_CMD_PAIRING_REQ;
793 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 794
eb492e01
AB		 795 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
796 } else {
797 struct smp_cmd_security_req cp;
2b64d153 798 cp.auth_req = authreq;
eb492e01
AB		 799 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
800 }
801
02bc7455 802done:
f1cb9af5 803 hcon->pending_sec_level = sec_level;
f1cb9af5 804
eb492e01
AB		 805 return 0;
806}
807
7034b911
VCG		 808static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
809{
16b90839 810 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 811 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 812
813 skb_pull(skb, sizeof(*rp));
814
1c1def09 815 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 816
7034b911
VCG		 817 return 0;
818}
819
820static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
821{
16b90839 822 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 823 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 824 struct hci_dev *hdev = conn->hcon->hdev;
825 struct hci_conn *hcon = conn->hcon;
826 u8 authenticated;
16b90839
VCG		 827
828 skb_pull(skb, sizeof(*rp));
7034b911 829
c9839a11
VCG		 830 hci_dev_lock(hdev);
831 authenticated = (conn->hcon->sec_level == BT_SECURITY_HIGH);
832 hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
833 HCI_SMP_LTK, 1, authenticated, smp->tk,
834 smp->enc_key_size, rp->ediv, rp->rand);
7034b911 835 smp_distribute_keys(conn, 1);
c9839a11 836 hci_dev_unlock(hdev);
7034b911
VCG		 837
838 return 0;
839}
840
eb492e01
AB		 841int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
842{
843 __u8 code = skb->data[0];
844 __u8 reason;
845 int err = 0;
846
2e65c9d2
AG		 847 if (!lmp_host_le_capable(conn->hcon->hdev)) {
848 err = -ENOTSUPP;
849 reason = SMP_PAIRING_NOTSUPP;
850 goto done;
851 }
852
eb492e01
AB		 853 skb_pull(skb, sizeof(code));
854
855 switch (code) {
856 case SMP_CMD_PAIRING_REQ:
da85e5e5 857 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 858 break;
859
860 case SMP_CMD_PAIRING_FAIL:
4f957a76 861 smp_failure(conn, skb->data[0], 0);
da85e5e5
VCG		 862 reason = 0;
863 err = -EPERM;
eb492e01
AB		 864 break;
865
866 case SMP_CMD_PAIRING_RSP:
da85e5e5 867 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 868 break;
869
870 case SMP_CMD_SECURITY_REQ:
da85e5e5 871 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 872 break;
873
eb492e01 874 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 875 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 876 break;
877
eb492e01 878 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 879 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 880 break;
881
eb492e01 882 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 883 reason = smp_cmd_encrypt_info(conn, skb);
884 break;
885
eb492e01 886 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 887 reason = smp_cmd_master_ident(conn, skb);
888 break;
889
eb492e01
AB		 890 case SMP_CMD_IDENT_INFO:
891 case SMP_CMD_IDENT_ADDR_INFO:
892 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 893 /* Just ignored */
894 reason = 0;
895 break;
896
eb492e01
AB		 897 default:
898 BT_DBG("Unknown command code 0x%2.2x", code);
899
900 reason = SMP_CMD_NOTSUPP;
eb492e01 901 err = -EOPNOTSUPP;
3a0259bb 902 goto done;
eb492e01
AB		 903 }
904
3a0259bb
VCG		 905done:
906 if (reason)
4f957a76 907 smp_failure(conn, reason, 1);
3a0259bb 908
eb492e01
AB		 909 kfree_skb(skb);
910 return err;
911}
7034b911
VCG		 912
913int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
914{
915 struct smp_cmd_pairing *req, *rsp;
1c1def09 916 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 917 __u8 *keydist;
918
919 BT_DBG("conn %p force %d", conn, force);
920
51a8efd7 921 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
d26a2345
VCG		 922 return 0;
923
1c1def09 924 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 925
926 /* The responder sends its keys first */
927 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
928 return 0;
929
1c1def09 930 req = (void *) &smp->preq[1];
7034b911
VCG		 931
932 if (conn->hcon->out) {
933 keydist = &rsp->init_key_dist;
934 *keydist &= req->init_key_dist;
935 } else {
936 keydist = &rsp->resp_key_dist;
937 *keydist &= req->resp_key_dist;
938 }
939
940
941 BT_DBG("keydist 0x%x", *keydist);
942
943 if (*keydist & SMP_DIST_ENC_KEY) {
944 struct smp_cmd_encrypt_info enc;
945 struct smp_cmd_master_ident ident;
c9839a11
VCG		 946 struct hci_conn *hcon = conn->hcon;
947 u8 authenticated;
7034b911
VCG		 948 __le16 ediv;
949
950 get_random_bytes(enc.ltk, sizeof(enc.ltk));
951 get_random_bytes(&ediv, sizeof(ediv));
952 get_random_bytes(ident.rand, sizeof(ident.rand));
953
954 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
955
c9839a11
VCG		 956 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
957 hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
958 HCI_SMP_LTK_SLAVE, 1, authenticated,
959 enc.ltk, smp->enc_key_size,
960 ediv, ident.rand);
16b90839 961
7034b911
VCG		 962 ident.ediv = cpu_to_le16(ediv);
963
964 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
965
966 *keydist &= ~SMP_DIST_ENC_KEY;
967 }
968
969 if (*keydist & SMP_DIST_ID_KEY) {
970 struct smp_cmd_ident_addr_info addrinfo;
971 struct smp_cmd_ident_info idinfo;
972
973 /* Send a dummy key */
974 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
975
976 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
977
978 /* Just public address */
979 memset(&addrinfo, 0, sizeof(addrinfo));
980 bacpy(&addrinfo.bdaddr, conn->src);
981
982 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
983 &addrinfo);
984
985 *keydist &= ~SMP_DIST_ID_KEY;
986 }
987
988 if (*keydist & SMP_DIST_SIGN) {
989 struct smp_cmd_sign_info sign;
990
991 /* Send a dummy key */
992 get_random_bytes(sign.csrk, sizeof(sign.csrk));
993
994 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
995
996 *keydist &= ~SMP_DIST_SIGN;
997 }
998
d26a2345 999 if (conn->hcon->out || force) {
51a8efd7 1000 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6c9d42a1 1001 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1002 smp_chan_destroy(conn);
d26a2345
VCG		 1003 }
1004
7034b911
VCG		 1005 return 0;
1006}
Linux kernel - Deliverables
This page took 0.172702 seconds and 5 git commands to generate.