projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix missing NULL check for smp_chan_create() return value
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
4bc58f51
JH		 38#define SMP_FLAG_TK_VALID 1
39#define SMP_FLAG_CFM_PENDING 2
40#define SMP_FLAG_MITM_AUTH 3
41#define SMP_FLAG_COMPLETE 4
42#define SMP_FLAG_INITIATOR 5
43
44struct smp_chan {
45 struct l2cap_conn *conn;
46 u8 preq[7]; /* SMP Pairing Request */
47 u8 prsp[7]; /* SMP Pairing Response */
48 u8 prnd[16]; /* SMP Pairing Random (local) */
49 u8 rrnd[16]; /* SMP Pairing Random (remote) */
50 u8 pcnf[16]; /* SMP Pairing Confirm */
51 u8 tk[16]; /* SMP Temporary Key */
52 u8 enc_key_size;
53 u8 remote_key_dist;
54 bdaddr_t id_addr;
55 u8 id_addr_type;
56 u8 irk[16];
57 struct smp_csrk *csrk;
58 struct smp_csrk *slave_csrk;
59 struct smp_ltk *ltk;
60 struct smp_ltk *slave_ltk;
61 struct smp_irk *remote_irk;
4a74d658 62 unsigned long flags;
4bc58f51
JH		 63};
64
66bed1a2 65static inline void swap128(const u8 src[16], u8 dst[16])
d22ef0bc
AB		 66{
67 int i;
68 for (i = 0; i < 16; i++)
69 dst[15 - i] = src[i];
70}
71
66bed1a2 72static inline void swap56(const u8 src[7], u8 dst[7])
d22ef0bc
AB		 73{
74 int i;
75 for (i = 0; i < 7; i++)
76 dst[6 - i] = src[i];
77}
78
79static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
80{
81 struct blkcipher_desc desc;
82 struct scatterlist sg;
943a732a 83 uint8_t tmp[16], data[16];
201a5929 84 int err;
d22ef0bc
AB		 85
86 if (tfm == NULL) {
87 BT_ERR("tfm %p", tfm);
88 return -EINVAL;
89 }
90
91 desc.tfm = tfm;
92 desc.flags = 0;
93
943a732a
JH		 94 /* The most significant octet of key corresponds to k[0] */
95 swap128(k, tmp);
96
97 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 98 if (err) {
99 BT_ERR("cipher setkey failed: %d", err);
100 return err;
101 }
102
943a732a
JH		 103 /* Most significant octet of plaintextData corresponds to data[0] */
104 swap128(r, data);
105
106 sg_init_one(&sg, data, 16);
d22ef0bc 107
d22ef0bc
AB		 108 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
109 if (err)
110 BT_ERR("Encrypt data error %d", err);
111
943a732a
JH		 112 /* Most significant octet of encryptedData corresponds to data[0] */
113 swap128(data, r);
114
d22ef0bc
AB		 115 return err;
116}
117
60478054
JH		 118static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
119{
943a732a 120 u8 _res[16];
60478054
JH		 121 int err;
122
123 /* r' = padding || r */
943a732a
JH		 124 memcpy(_res, r, 3);
125 memset(_res + 3, 0, 13);
60478054 126
943a732a 127 err = smp_e(tfm, irk, _res);
60478054
JH		 128 if (err) {
129 BT_ERR("Encrypt error");
130 return err;
131 }
132
133 /* The output of the random address function ah is:
134 * ah(h, r) = e(k, r') mod 2^24
135 * The output of the security function e is then truncated to 24 bits
136 * by taking the least significant 24 bits of the output of e as the
137 * result of ah.
138 */
943a732a 139 memcpy(res, _res, 3);
60478054
JH		 140
141 return 0;
142}
143
144bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
145 bdaddr_t *bdaddr)
146{
147 u8 hash[3];
148 int err;
149
150 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
151
152 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
153 if (err)
154 return false;
155
156 return !memcmp(bdaddr->b, hash, 3);
157}
158
b1e2b3ae
JH		 159int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
160{
161 int err;
162
163 get_random_bytes(&rpa->b[3], 3);
164
165 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
166 rpa->b[5] |= 0x40; /* Set second most significant bit */
167
168 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
169 if (err < 0)
170 return err;
171
172 BT_DBG("RPA %pMR", rpa);
173
174 return 0;
175}
176
d22ef0bc 177static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 178 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
179 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 180{
181 u8 p1[16], p2[16];
182 int err;
183
184 memset(p1, 0, 16);
185
186 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 187 p1[0] = _iat;
188 p1[1] = _rat;
189 memcpy(p1 + 2, preq, 7);
190 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 191
192 /* p2 = padding || ia || ra */
943a732a
JH		 193 memcpy(p2, ra, 6);
194 memcpy(p2 + 6, ia, 6);
195 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 196
197 /* res = r XOR p1 */
198 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
199
200 /* res = e(k, res) */
201 err = smp_e(tfm, k, res);
202 if (err) {
203 BT_ERR("Encrypt data error");
204 return err;
205 }
206
207 /* res = res XOR p2 */
208 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
209
210 /* res = e(k, res) */
211 err = smp_e(tfm, k, res);
212 if (err)
213 BT_ERR("Encrypt data error");
214
215 return err;
216}
217
f1560463
MH		 218static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
219 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 220{
221 int err;
222
223 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 224 memcpy(_r, r2, 8);
225 memcpy(_r + 8, r1, 8);
d22ef0bc
AB		 226
227 err = smp_e(tfm, k, _r);
228 if (err)
229 BT_ERR("Encrypt data error");
230
231 return err;
232}
233
eb492e01 234static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 235 u16 dlen, void *data)
eb492e01
AB		 236{
237 struct sk_buff *skb;
238 struct l2cap_hdr *lh;
239 int len;
240
241 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
242
243 if (len > conn->mtu)
244 return NULL;
245
246 skb = bt_skb_alloc(len, GFP_ATOMIC);
247 if (!skb)
248 return NULL;
249
250 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
251 lh->len = cpu_to_le16(sizeof(code) + dlen);
dcf4adbf 252 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 253
254 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
255
256 memcpy(skb_put(skb, dlen), data, dlen);
257
258 return skb;
259}
260
261static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
262{
263 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
264
265 BT_DBG("code 0x%2.2x", code);
266
267 if (!skb)
268 return;
269
73d80deb
LAD		 270 skb->priority = HCI_PRIO_MAX;
271 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 272
6c9d42a1 273 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 274 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 275}
276
2b64d153
BG		 277static __u8 authreq_to_seclevel(__u8 authreq)
278{
279 if (authreq & SMP_AUTH_MITM)
280 return BT_SECURITY_HIGH;
281 else
282 return BT_SECURITY_MEDIUM;
283}
284
285static __u8 seclevel_to_authreq(__u8 sec_level)
286{
287 switch (sec_level) {
288 case BT_SECURITY_HIGH:
289 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
290 case BT_SECURITY_MEDIUM:
291 return SMP_AUTH_BONDING;
292 default:
293 return SMP_AUTH_NONE;
294 }
295}
296
b8e66eac 297static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 298 struct smp_cmd_pairing *req,
299 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 300{
fd349c02
JH		 301 struct smp_chan *smp = conn->smp_chan;
302 struct hci_conn *hcon = conn->hcon;
303 struct hci_dev *hdev = hcon->hdev;
304 u8 local_dist = 0, remote_dist = 0;
54790f73 305
a8b2d5c2 306 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 307 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
308 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 309 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 310 } else {
311 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 312 }
313
fd349c02
JH		 314 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
315 remote_dist |= SMP_DIST_ID_KEY;
316
863efaf2
JH		 317 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
318 local_dist |= SMP_DIST_ID_KEY;
319
54790f73
VCG		 320 if (rsp == NULL) {
321 req->io_capability = conn->hcon->io_capability;
322 req->oob_flag = SMP_OOB_NOT_PRESENT;
323 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 324 req->init_key_dist = local_dist;
325 req->resp_key_dist = remote_dist;
065a13e2 326 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 327
328 smp->remote_key_dist = remote_dist;
54790f73
VCG		 329 return;
330 }
331
332 rsp->io_capability = conn->hcon->io_capability;
333 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
334 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 335 rsp->init_key_dist = req->init_key_dist & remote_dist;
336 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 337 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 338
339 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 340}
341
3158c50c
VCG		 342static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
343{
1c1def09
VCG		 344 struct smp_chan *smp = conn->smp_chan;
345
3158c50c 346 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 347 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 348 return SMP_ENC_KEY_SIZE;
349
f7aa611a 350 smp->enc_key_size = max_key_size;
3158c50c
VCG		 351
352 return 0;
353}
354
84794e11 355static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 356{
bab73cb6
JH		 357 struct hci_conn *hcon = conn->hcon;
358
84794e11 359 if (reason)
4f957a76 360 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 361 &reason);
4f957a76 362
ce39fb4e
MH		 363 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
364 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
365 HCI_ERROR_AUTH_FAILURE);
f1c09c07 366
61a0cfb0
AG		 367 cancel_delayed_work_sync(&conn->security_timer);
368
ce39fb4e 369 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 370 smp_chan_destroy(conn);
4f957a76
BG		 371}
372
2b64d153
BG		 373#define JUST_WORKS 0x00
374#define JUST_CFM 0x01
375#define REQ_PASSKEY 0x02
376#define CFM_PASSKEY 0x03
377#define REQ_OOB 0x04
378#define OVERLAP 0xFF
379
380static const u8 gen_method[5][5] = {
381 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
382 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
383 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
384 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
385 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
386};
387
581370cc
JH		 388static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
389{
390 /* If either side has unknown io_caps, use JUST WORKS */
391 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
392 remote_io > SMP_IO_KEYBOARD_DISPLAY)
393 return JUST_WORKS;
394
395 return gen_method[remote_io][local_io];
396}
397
2b64d153
BG		 398static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
399 u8 local_io, u8 remote_io)
400{
401 struct hci_conn *hcon = conn->hcon;
402 struct smp_chan *smp = conn->smp_chan;
403 u8 method;
404 u32 passkey = 0;
405 int ret = 0;
406
407 /* Initialize key for JUST WORKS */
408 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 409 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 410
411 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
412
413 /* If neither side wants MITM, use JUST WORKS */
2b64d153 414 /* Otherwise, look up method from the table */
581370cc 415 if (!(auth & SMP_AUTH_MITM))
2b64d153
BG		 416 method = JUST_WORKS;
417 else
581370cc 418 method = get_auth_method(smp, local_io, remote_io);
2b64d153
BG		 419
420 /* If not bonding, don't ask user to confirm a Zero TK */
421 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
422 method = JUST_WORKS;
423
a82505c7 424 /* Don't confirm locally initiated pairing attempts */
4a74d658 425 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 426 method = JUST_WORKS;
427
2b64d153
BG		 428 /* If Just Works, Continue with Zero TK */
429 if (method == JUST_WORKS) {
4a74d658 430 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 431 return 0;
432 }
433
434 /* Not Just Works/Confirm results in MITM Authentication */
435 if (method != JUST_CFM)
4a74d658 436 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 437
438 /* If both devices have Keyoard-Display I/O, the master
439 * Confirms and the slave Enters the passkey.
440 */
441 if (method == OVERLAP) {
442 if (hcon->link_mode & HCI_LM_MASTER)
443 method = CFM_PASSKEY;
444 else
445 method = REQ_PASSKEY;
446 }
447
01ad34d2 448 /* Generate random passkey. */
2b64d153 449 if (method == CFM_PASSKEY) {
943a732a 450 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 451 get_random_bytes(&passkey, sizeof(passkey));
452 passkey %= 1000000;
943a732a 453 put_unaligned_le32(passkey, smp->tk);
2b64d153 454 BT_DBG("PassKey: %d", passkey);
4a74d658 455 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 456 }
457
458 hci_dev_lock(hcon->hdev);
459
460 if (method == REQ_PASSKEY)
ce39fb4e 461 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 462 hcon->type, hcon->dst_type);
4eb65e66
JH		 463 else if (method == JUST_CFM)
464 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
465 hcon->type, hcon->dst_type,
466 passkey, 1);
2b64d153 467 else
01ad34d2 468 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 469 hcon->type, hcon->dst_type,
39adbffe 470 passkey, 0);
2b64d153
BG		 471
472 hci_dev_unlock(hcon->hdev);
473
474 return ret;
475}
476
1cc61144 477static u8 smp_confirm(struct smp_chan *smp)
8aab4757 478{
8aab4757 479 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 480 struct hci_dev *hdev = conn->hcon->hdev;
481 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 482 struct smp_cmd_pairing_confirm cp;
483 int ret;
8aab4757
VCG		 484
485 BT_DBG("conn %p", conn);
486
893ce8b1
JH		 487 /* Prevent mutual access to hdev->tfm_aes */
488 hci_dev_lock(hdev);
8aab4757 489
b1cd5fd9
JH		 490 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
491 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 492 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
493 cp.confirm_val);
893ce8b1
JH		 494
495 hci_dev_unlock(hdev);
496
1cc61144
JH		 497 if (ret)
498 return SMP_UNSPECIFIED;
8aab4757 499
4a74d658 500 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 501
8aab4757
VCG		 502 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
503
1cc61144 504 return 0;
8aab4757
VCG		 505}
506
861580a9 507static u8 smp_random(struct smp_chan *smp)
8aab4757 508{
8aab4757
VCG		 509 struct l2cap_conn *conn = smp->conn;
510 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 511 struct hci_dev *hdev = hcon->hdev;
512 struct crypto_blkcipher *tfm = hdev->tfm_aes;
861580a9 513 u8 confirm[16];
8aab4757
VCG		 514 int ret;
515
861580a9
JH		 516 if (IS_ERR_OR_NULL(tfm))
517 return SMP_UNSPECIFIED;
8aab4757
VCG		 518
519 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
520
893ce8b1
JH		 521 /* Prevent mutual access to hdev->tfm_aes */
522 hci_dev_lock(hdev);
523
b1cd5fd9
JH		 524 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
525 hcon->init_addr_type, &hcon->init_addr,
943a732a 526 hcon->resp_addr_type, &hcon->resp_addr, confirm);
893ce8b1
JH		 527
528 hci_dev_unlock(hdev);
529
861580a9
JH		 530 if (ret)
531 return SMP_UNSPECIFIED;
8aab4757 532
8aab4757
VCG		 533 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
534 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 535 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 536 }
537
538 if (hcon->out) {
fe39c7b2
MH		 539 u8 stk[16];
540 __le64 rand = 0;
541 __le16 ediv = 0;
8aab4757 542
943a732a 543 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 544
f7aa611a 545 memset(stk + smp->enc_key_size, 0,
04124681 546 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 547
861580a9
JH		 548 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
549 return SMP_UNSPECIFIED;
8aab4757
VCG		 550
551 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 552 hcon->enc_key_size = smp->enc_key_size;
8aab4757 553 } else {
fff3490f 554 u8 stk[16], auth;
fe39c7b2
MH		 555 __le64 rand = 0;
556 __le16 ediv = 0;
8aab4757 557
943a732a
JH		 558 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
559 smp->prnd);
8aab4757 560
943a732a 561 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 562
f7aa611a 563 memset(stk + smp->enc_key_size, 0,
f1560463 564 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 565
fff3490f
JH		 566 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
567 auth = 1;
568 else
569 auth = 0;
570
ce39fb4e 571 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
fff3490f 572 HCI_SMP_STK_SLAVE, auth, stk, smp->enc_key_size,
04124681 573 ediv, rand);
8aab4757
VCG		 574 }
575
861580a9 576 return 0;
8aab4757
VCG		 577}
578
579static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
580{
581 struct smp_chan *smp;
582
f1560463 583 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 584 if (!smp)
585 return NULL;
586
8aab4757
VCG		 587 smp->conn = conn;
588 conn->smp_chan = smp;
2b64d153 589 conn->hcon->smp_conn = conn;
8aab4757
VCG		 590
591 hci_conn_hold(conn->hcon);
592
593 return smp;
594}
595
596void smp_chan_destroy(struct l2cap_conn *conn)
597{
c8eb9690 598 struct smp_chan *smp = conn->smp_chan;
f4a407be 599 bool complete;
c8eb9690 600
f1c09c07 601 BUG_ON(!smp);
c8eb9690 602
4a74d658 603 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
f4a407be
JH		 604 mgmt_smp_complete(conn->hcon, complete);
605
7ee4ea36
MH		 606 kfree(smp->csrk);
607 kfree(smp->slave_csrk);
608
759331d7
JH		 609 /* If pairing failed clean up any keys we might have */
610 if (!complete) {
611 if (smp->ltk) {
612 list_del(&smp->ltk->list);
613 kfree(smp->ltk);
614 }
615
616 if (smp->slave_ltk) {
617 list_del(&smp->slave_ltk->list);
618 kfree(smp->slave_ltk);
619 }
620
621 if (smp->remote_irk) {
622 list_del(&smp->remote_irk->list);
623 kfree(smp->remote_irk);
624 }
625 }
626
c8eb9690
BG		 627 kfree(smp);
628 conn->smp_chan = NULL;
2b64d153 629 conn->hcon->smp_conn = NULL;
76a68ba0 630 hci_conn_drop(conn->hcon);
8aab4757
VCG		 631}
632
2b64d153
BG		 633int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
634{
635 struct l2cap_conn *conn = hcon->smp_conn;
636 struct smp_chan *smp;
637 u32 value;
2b64d153
BG		 638
639 BT_DBG("");
640
641 if (!conn)
642 return -ENOTCONN;
643
644 smp = conn->smp_chan;
645
646 switch (mgmt_op) {
647 case MGMT_OP_USER_PASSKEY_REPLY:
648 value = le32_to_cpu(passkey);
943a732a 649 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 650 BT_DBG("PassKey: %d", value);
943a732a 651 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 652 /* Fall Through */
653 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 654 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 655 break;
656 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
657 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 658 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 659 return 0;
660 default:
84794e11 661 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 662 return -EOPNOTSUPP;
663 }
664
665 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 666 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
667 u8 rsp = smp_confirm(smp);
668 if (rsp)
669 smp_failure(conn, rsp);
670 }
2b64d153
BG		 671
672 return 0;
673}
674
da85e5e5 675static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 676{
3158c50c 677 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 678 struct smp_chan *smp;
c7262e71 679 u8 key_size, auth, sec_level;
8aab4757 680 int ret;
88ba43b6
AB		 681
682 BT_DBG("conn %p", conn);
683
c46b98be 684 if (skb->len < sizeof(*req))
38e4a915 685 return SMP_INVALID_PARAMS;
c46b98be 686
2b64d153
BG		 687 if (conn->hcon->link_mode & HCI_LM_MASTER)
688 return SMP_CMD_NOTSUPP;
689
51a8efd7 690 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 691 smp = smp_chan_create(conn);
d08fd0e7
AE		 692 else
693 smp = conn->smp_chan;
8aab4757 694
d08fd0e7
AE		 695 if (!smp)
696 return SMP_UNSPECIFIED;
d26a2345 697
1c1def09
VCG		 698 smp->preq[0] = SMP_CMD_PAIRING_REQ;
699 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 700 skb_pull(skb, sizeof(*req));
88ba43b6 701
2b64d153 702 /* We didn't start the pairing, so match remote */
1ef35827 703 auth = req->auth_req;
da85e5e5 704
c7262e71
JH		 705 sec_level = authreq_to_seclevel(auth);
706 if (sec_level > conn->hcon->pending_sec_level)
707 conn->hcon->pending_sec_level = sec_level;
fdde0a26 708
2ed8f65c
JH		 709 /* If we need MITM check that it can be acheived */
710 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
711 u8 method;
712
713 method = get_auth_method(smp, conn->hcon->io_capability,
714 req->io_capability);
715 if (method == JUST_WORKS || method == JUST_CFM)
716 return SMP_AUTH_REQUIREMENTS;
717 }
718
2b64d153 719 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 720
721 key_size = min(req->max_key_size, rsp.max_key_size);
722 if (check_enc_key_size(conn, key_size))
723 return SMP_ENC_KEY_SIZE;
88ba43b6 724
e84a6b13 725 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 726
1c1def09
VCG		 727 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
728 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 729
3158c50c 730 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 731
2b64d153
BG		 732 /* Request setup of TK */
733 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
734 if (ret)
735 return SMP_UNSPECIFIED;
736
4a74d658 737 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 738
da85e5e5 739 return 0;
88ba43b6
AB		 740}
741
da85e5e5 742static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 743{
3158c50c 744 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 745 struct smp_chan *smp = conn->smp_chan;
2b64d153 746 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 747 int ret;
88ba43b6
AB		 748
749 BT_DBG("conn %p", conn);
750
c46b98be 751 if (skb->len < sizeof(*rsp))
38e4a915 752 return SMP_INVALID_PARAMS;
c46b98be 753
2b64d153
BG		 754 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
755 return SMP_CMD_NOTSUPP;
756
3158c50c
VCG		 757 skb_pull(skb, sizeof(*rsp));
758
1c1def09 759 req = (void *) &smp->preq[1];
da85e5e5 760
3158c50c
VCG		 761 key_size = min(req->max_key_size, rsp->max_key_size);
762 if (check_enc_key_size(conn, key_size))
763 return SMP_ENC_KEY_SIZE;
764
2ed8f65c
JH		 765 /* If we need MITM check that it can be acheived */
766 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
767 u8 method;
768
769 method = get_auth_method(smp, req->io_capability,
770 rsp->io_capability);
771 if (method == JUST_WORKS || method == JUST_CFM)
772 return SMP_AUTH_REQUIREMENTS;
773 }
774
e84a6b13 775 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 776
8aab4757
VCG		 777 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
778 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 779
fdcc4bec
JH		 780 /* Update remote key distribution in case the remote cleared
781 * some bits that we had enabled in our request.
782 */
783 smp->remote_key_dist &= rsp->resp_key_dist;
784
2b64d153 785 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 786 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 787 auth = SMP_AUTH_BONDING;
788
789 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
790
476585ec 791 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 792 if (ret)
793 return SMP_UNSPECIFIED;
794
4a74d658 795 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 796
797 /* Can't compose response until we have been confirmed */
4a74d658 798 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 799 return smp_confirm(smp);
da85e5e5
VCG		 800
801 return 0;
88ba43b6
AB		 802}
803
da85e5e5 804static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 805{
1c1def09 806 struct smp_chan *smp = conn->smp_chan;
7d24ddcc 807
88ba43b6
AB		 808 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
809
c46b98be 810 if (skb->len < sizeof(smp->pcnf))
38e4a915 811 return SMP_INVALID_PARAMS;
c46b98be 812
1c1def09
VCG		 813 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
814 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 815
943a732a
JH		 816 if (conn->hcon->out)
817 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
818 smp->prnd);
4a74d658 819 else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 820 return smp_confirm(smp);
943a732a 821 else
4a74d658 822 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 823
824 return 0;
88ba43b6
AB		 825}
826
da85e5e5 827static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 828{
1c1def09 829 struct smp_chan *smp = conn->smp_chan;
7d24ddcc 830
8aab4757 831 BT_DBG("conn %p", conn);
3158c50c 832
c46b98be 833 if (skb->len < sizeof(smp->rrnd))
38e4a915 834 return SMP_INVALID_PARAMS;
c46b98be 835
943a732a 836 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 837 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 838
861580a9 839 return smp_random(smp);
88ba43b6
AB		 840}
841
4dab7864 842static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 843{
c9839a11 844 struct smp_ltk *key;
988c5997
VCG		 845 struct hci_conn *hcon = conn->hcon;
846
98a0b845
JH		 847 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
848 hcon->out);
988c5997
VCG		 849 if (!key)
850 return 0;
851
4dab7864
JH		 852 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
853 return 0;
854
51a8efd7 855 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 856 return 1;
857
c9839a11
VCG		 858 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
859 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 860
861 return 1;
988c5997 862}
f1560463 863
da85e5e5 864static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 865{
866 struct smp_cmd_security_req *rp = (void *) skb->data;
867 struct smp_cmd_pairing cp;
f1cb9af5 868 struct hci_conn *hcon = conn->hcon;
8aab4757 869 struct smp_chan *smp;
c7262e71 870 u8 sec_level;
88ba43b6
AB		 871
872 BT_DBG("conn %p", conn);
873
c46b98be 874 if (skb->len < sizeof(*rp))
38e4a915 875 return SMP_INVALID_PARAMS;
c46b98be 876
86ca9eac
JH		 877 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
878 return SMP_CMD_NOTSUPP;
879
c7262e71
JH		 880 sec_level = authreq_to_seclevel(rp->auth_req);
881 if (sec_level > hcon->pending_sec_level)
882 hcon->pending_sec_level = sec_level;
feb45eb5 883
4dab7864 884 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 885 return 0;
886
51a8efd7 887 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 888 return 0;
f1cb9af5 889
8aab4757 890 smp = smp_chan_create(conn);
c29d2444
JH		 891 if (!smp)
892 return SMP_UNSPECIFIED;
d26a2345 893
88ba43b6 894 skb_pull(skb, sizeof(*rp));
88ba43b6 895
da85e5e5 896 memset(&cp, 0, sizeof(cp));
54790f73 897 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 898
1c1def09
VCG		 899 smp->preq[0] = SMP_CMD_PAIRING_REQ;
900 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 901
88ba43b6 902 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 903
4a74d658 904 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 905
da85e5e5 906 return 0;
88ba43b6
AB		 907}
908
ad32a2f5
JH		 909bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
910{
911 if (sec_level == BT_SECURITY_LOW)
912 return true;
913
914 if (hcon->sec_level >= sec_level)
915 return true;
916
917 return false;
918}
919
cc110922 920int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 921{
cc110922 922 struct l2cap_conn *conn = hcon->l2cap_data;
0a66cf20 923 struct smp_chan *smp;
2b64d153 924 __u8 authreq;
eb492e01 925
3a0259bb
VCG		 926 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
927
0a66cf20
JH		 928 /* This may be NULL if there's an unexpected disconnection */
929 if (!conn)
930 return 1;
931
757aee0f 932 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 933 return 1;
934
ad32a2f5 935 if (smp_sufficient_security(hcon, sec_level))
eb492e01 936 return 1;
f1cb9af5 937
c7262e71
JH		 938 if (sec_level > hcon->pending_sec_level)
939 hcon->pending_sec_level = sec_level;
940
988c5997 941 if (hcon->link_mode & HCI_LM_MASTER)
c7262e71
JH		 942 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
943 return 0;
d26a2345 944
51a8efd7 945 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 946 return 0;
947
8aab4757 948 smp = smp_chan_create(conn);
2b64d153
BG		 949 if (!smp)
950 return 1;
951
952 authreq = seclevel_to_authreq(sec_level);
d26a2345 953
79897d20
JH		 954 /* Require MITM if IO Capability allows or the security level
955 * requires it.
2e233644 956 */
79897d20 957 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 958 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 959 authreq |= SMP_AUTH_MITM;
960
d26a2345
VCG		 961 if (hcon->link_mode & HCI_LM_MASTER) {
962 struct smp_cmd_pairing cp;
f01ead31 963
2b64d153 964 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 965 smp->preq[0] = SMP_CMD_PAIRING_REQ;
966 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 967
eb492e01
AB		 968 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
969 } else {
970 struct smp_cmd_security_req cp;
2b64d153 971 cp.auth_req = authreq;
eb492e01
AB		 972 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
973 }
974
4a74d658 975 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 976
eb492e01
AB		 977 return 0;
978}
979
7034b911
VCG		 980static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
981{
16b90839 982 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 983 struct smp_chan *smp = conn->smp_chan;
16b90839 984
c46b98be
JH		 985 BT_DBG("conn %p", conn);
986
987 if (skb->len < sizeof(*rp))
38e4a915 988 return SMP_INVALID_PARAMS;
c46b98be 989
6131ddc8
JH		 990 /* Ignore this PDU if it wasn't requested */
991 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
992 return 0;
993
16b90839
VCG		 994 skb_pull(skb, sizeof(*rp));
995
1c1def09 996 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 997
7034b911
VCG		 998 return 0;
999}
1000
1001static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1002{
16b90839 1003 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 1004 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 1005 struct hci_dev *hdev = conn->hcon->hdev;
1006 struct hci_conn *hcon = conn->hcon;
23d0e128 1007 struct smp_ltk *ltk;
c9839a11 1008 u8 authenticated;
16b90839 1009
c46b98be
JH		 1010 BT_DBG("conn %p", conn);
1011
1012 if (skb->len < sizeof(*rp))
38e4a915 1013 return SMP_INVALID_PARAMS;
c46b98be 1014
6131ddc8
JH		 1015 /* Ignore this PDU if it wasn't requested */
1016 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1017 return 0;
1018
9747a9f3
JH		 1019 /* Mark the information as received */
1020 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1021
16b90839 1022 skb_pull(skb, sizeof(*rp));
7034b911 1023
c9839a11 1024 hci_dev_lock(hdev);
ce39fb4e 1025 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 1026 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 1027 authenticated, smp->tk, smp->enc_key_size,
1028 rp->ediv, rp->rand);
1029 smp->ltk = ltk;
fd349c02 1030 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 1031 smp_distribute_keys(conn);
c9839a11 1032 hci_dev_unlock(hdev);
7034b911
VCG		 1033
1034 return 0;
1035}
1036
fd349c02
JH		 1037static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1038{
1039 struct smp_cmd_ident_info *info = (void *) skb->data;
1040 struct smp_chan *smp = conn->smp_chan;
1041
1042 BT_DBG("");
1043
1044 if (skb->len < sizeof(*info))
38e4a915 1045 return SMP_INVALID_PARAMS;
fd349c02 1046
6131ddc8
JH		 1047 /* Ignore this PDU if it wasn't requested */
1048 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1049 return 0;
1050
fd349c02
JH		 1051 skb_pull(skb, sizeof(*info));
1052
1053 memcpy(smp->irk, info->irk, 16);
1054
1055 return 0;
1056}
1057
1058static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1059 struct sk_buff *skb)
1060{
1061 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
1062 struct smp_chan *smp = conn->smp_chan;
1063 struct hci_conn *hcon = conn->hcon;
1064 bdaddr_t rpa;
1065
1066 BT_DBG("");
1067
1068 if (skb->len < sizeof(*info))
38e4a915 1069 return SMP_INVALID_PARAMS;
fd349c02 1070
6131ddc8
JH		 1071 /* Ignore this PDU if it wasn't requested */
1072 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1073 return 0;
1074
9747a9f3
JH		 1075 /* Mark the information as received */
1076 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1077
fd349c02
JH		 1078 skb_pull(skb, sizeof(*info));
1079
a9a58f86
JH		 1080 /* Strictly speaking the Core Specification (4.1) allows sending
1081 * an empty address which would force us to rely on just the IRK
1082 * as "identity information". However, since such
1083 * implementations are not known of and in order to not over
1084 * complicate our implementation, simply pretend that we never
1085 * received an IRK for such a device.
1086 */
1087 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1088 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1089 smp_distribute_keys(conn);
a9a58f86
JH		 1090 return 0;
1091 }
1092
fd349c02
JH		 1093 bacpy(&smp->id_addr, &info->bdaddr);
1094 smp->id_addr_type = info->addr_type;
1095
1096 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1097 bacpy(&rpa, &hcon->dst);
1098 else
1099 bacpy(&rpa, BDADDR_ANY);
1100
23d0e128
JH		 1101 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1102 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1103
4bd6d38e 1104 smp_distribute_keys(conn);
fd349c02
JH		 1105
1106 return 0;
1107}
1108
7ee4ea36
MH		 1109static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1110{
1111 struct smp_cmd_sign_info *rp = (void *) skb->data;
1112 struct smp_chan *smp = conn->smp_chan;
1113 struct hci_dev *hdev = conn->hcon->hdev;
1114 struct smp_csrk *csrk;
1115
1116 BT_DBG("conn %p", conn);
1117
1118 if (skb->len < sizeof(*rp))
38e4a915 1119 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1120
1121 /* Ignore this PDU if it wasn't requested */
1122 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1123 return 0;
1124
1125 /* Mark the information as received */
1126 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1127
1128 skb_pull(skb, sizeof(*rp));
1129
1130 hci_dev_lock(hdev);
1131 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1132 if (csrk) {
1133 csrk->master = 0x01;
1134 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1135 }
1136 smp->csrk = csrk;
1137 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1138 smp_distribute_keys(conn);
1139 hci_dev_unlock(hdev);
1140
1141 return 0;
1142}
1143
eb492e01
AB		 1144int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1145{
7b9899db 1146 struct hci_conn *hcon = conn->hcon;
92381f5c 1147 __u8 code, reason;
eb492e01
AB		 1148 int err = 0;
1149
7b9899db
MH		 1150 if (hcon->type != LE_LINK) {
1151 kfree_skb(skb);
3432711f 1152 return 0;
7b9899db
MH		 1153 }
1154
92381f5c
MH		 1155 if (skb->len < 1) {
1156 kfree_skb(skb);
1157 return -EILSEQ;
1158 }
1159
06ae3314 1160 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1161 err = -ENOTSUPP;
1162 reason = SMP_PAIRING_NOTSUPP;
1163 goto done;
1164 }
1165
92381f5c 1166 code = skb->data[0];
eb492e01
AB		 1167 skb_pull(skb, sizeof(code));
1168
8cf9fa12
JH		 1169 /*
1170 * The SMP context must be initialized for all other PDUs except
1171 * pairing and security requests. If we get any other PDU when
1172 * not initialized simply disconnect (done if this function
1173 * returns an error).
1174 */
1175 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1176 !conn->smp_chan) {
1177 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1178 kfree_skb(skb);
1179 return -ENOTSUPP;
1180 }
1181
eb492e01
AB		 1182 switch (code) {
1183 case SMP_CMD_PAIRING_REQ:
da85e5e5 1184 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1185 break;
1186
1187 case SMP_CMD_PAIRING_FAIL:
84794e11 1188 smp_failure(conn, 0);
da85e5e5
VCG		 1189 reason = 0;
1190 err = -EPERM;
eb492e01
AB		 1191 break;
1192
1193 case SMP_CMD_PAIRING_RSP:
da85e5e5 1194 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1195 break;
1196
1197 case SMP_CMD_SECURITY_REQ:
da85e5e5 1198 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1199 break;
1200
eb492e01 1201 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1202 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1203 break;
1204
eb492e01 1205 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1206 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1207 break;
1208
eb492e01 1209 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1210 reason = smp_cmd_encrypt_info(conn, skb);
1211 break;
1212
eb492e01 1213 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1214 reason = smp_cmd_master_ident(conn, skb);
1215 break;
1216
eb492e01 1217 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1218 reason = smp_cmd_ident_info(conn, skb);
1219 break;
1220
eb492e01 1221 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1222 reason = smp_cmd_ident_addr_info(conn, skb);
1223 break;
1224
eb492e01 1225 case SMP_CMD_SIGN_INFO:
7ee4ea36 1226 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1227 break;
1228
eb492e01
AB		 1229 default:
1230 BT_DBG("Unknown command code 0x%2.2x", code);
1231
1232 reason = SMP_CMD_NOTSUPP;
eb492e01 1233 err = -EOPNOTSUPP;
3a0259bb 1234 goto done;
eb492e01
AB		 1235 }
1236
3a0259bb
VCG		 1237done:
1238 if (reason)
84794e11 1239 smp_failure(conn, reason);
3a0259bb 1240
eb492e01
AB		 1241 kfree_skb(skb);
1242 return err;
1243}
7034b911 1244
35d70271
JH		 1245static void smp_notify_keys(struct l2cap_conn *conn)
1246{
1247 struct smp_chan *smp = conn->smp_chan;
1248 struct hci_conn *hcon = conn->hcon;
1249 struct hci_dev *hdev = hcon->hdev;
53ac6ab6
MH		 1250 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1251 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1252 bool persistent;
35d70271 1253
61b1a7fb 1254 if (smp->remote_irk) {
95fbac8a 1255 mgmt_new_irk(hdev, smp->remote_irk);
61b1a7fb
JH		 1256 /* Now that user space can be considered to know the
1257 * identity address track the connection based on it
1258 * from now on.
1259 */
1260 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1261 hcon->dst_type = smp->remote_irk->addr_type;
1262 l2cap_conn_update_id_addr(hcon);
1263 }
95fbac8a 1264
53ac6ab6
MH		 1265 /* The LTKs and CSRKs should be persistent only if both sides
1266 * had the bonding bit set in their authentication requests.
1267 */
1268 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
1269
7ee4ea36
MH		 1270 if (smp->csrk) {
1271 smp->csrk->bdaddr_type = hcon->dst_type;
1272 bacpy(&smp->csrk->bdaddr, &hcon->dst);
53ac6ab6 1273 mgmt_new_csrk(hdev, smp->csrk, persistent);
7ee4ea36
MH		 1274 }
1275
1276 if (smp->slave_csrk) {
1277 smp->slave_csrk->bdaddr_type = hcon->dst_type;
1278 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
53ac6ab6 1279 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
7ee4ea36
MH		 1280 }
1281
35d70271
JH		 1282 if (smp->ltk) {
1283 smp->ltk->bdaddr_type = hcon->dst_type;
1284 bacpy(&smp->ltk->bdaddr, &hcon->dst);
53ac6ab6 1285 mgmt_new_ltk(hdev, smp->ltk, persistent);
35d70271
JH		 1286 }
1287
1288 if (smp->slave_ltk) {
1289 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1290 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
53ac6ab6 1291 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
35d70271
JH		 1292 }
1293}
1294
4bd6d38e 1295int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1296{
1297 struct smp_cmd_pairing *req, *rsp;
1c1def09 1298 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1299 struct hci_conn *hcon = conn->hcon;
1300 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1301 __u8 *keydist;
1302
4bd6d38e 1303 BT_DBG("conn %p", conn);
7034b911 1304
524237cb 1305 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1306 return 0;
1307
1c1def09 1308 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1309
1310 /* The responder sends its keys first */
efabba37 1311 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1312 return 0;
1313
1c1def09 1314 req = (void *) &smp->preq[1];
7034b911 1315
524237cb 1316 if (hcon->out) {
7034b911
VCG		 1317 keydist = &rsp->init_key_dist;
1318 *keydist &= req->init_key_dist;
1319 } else {
1320 keydist = &rsp->resp_key_dist;
1321 *keydist &= req->resp_key_dist;
1322 }
1323
7034b911
VCG		 1324 BT_DBG("keydist 0x%x", *keydist);
1325
1326 if (*keydist & SMP_DIST_ENC_KEY) {
1327 struct smp_cmd_encrypt_info enc;
1328 struct smp_cmd_master_ident ident;
23d0e128 1329 struct smp_ltk *ltk;
c9839a11 1330 u8 authenticated;
7034b911 1331 __le16 ediv;
fe39c7b2 1332 __le64 rand;
7034b911
VCG		 1333
1334 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1335 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1336 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1337
1338 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1339
c9839a11 1340 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1341 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271 1342 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1343 smp->enc_key_size, ediv, rand);
23d0e128 1344 smp->slave_ltk = ltk;
16b90839 1345
58115373 1346 ident.ediv = ediv;
fe39c7b2 1347 ident.rand = rand;
7034b911
VCG		 1348
1349 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1350
1351 *keydist &= ~SMP_DIST_ENC_KEY;
1352 }
1353
1354 if (*keydist & SMP_DIST_ID_KEY) {
1355 struct smp_cmd_ident_addr_info addrinfo;
1356 struct smp_cmd_ident_info idinfo;
1357
863efaf2 1358 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1359
1360 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1361
82d4b359
JH		 1362 /* The hci_conn contains the local identity address
1363 * after the connection has been established.
1364 *
1365 * This is true even when the connection has been
1366 * established using a resolvable random address.
1367 */
524237cb 1368 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1369 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1370
1371 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1372 &addrinfo);
7034b911
VCG		 1373
1374 *keydist &= ~SMP_DIST_ID_KEY;
1375 }
1376
1377 if (*keydist & SMP_DIST_SIGN) {
1378 struct smp_cmd_sign_info sign;
7ee4ea36 1379 struct smp_csrk *csrk;
7034b911 1380
7ee4ea36 1381 /* Generate a new random key */
7034b911
VCG		 1382 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1383
7ee4ea36
MH		 1384 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1385 if (csrk) {
1386 csrk->master = 0x00;
1387 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1388 }
1389 smp->slave_csrk = csrk;
1390
7034b911
VCG		 1391 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1392
1393 *keydist &= ~SMP_DIST_SIGN;
1394 }
1395
efabba37
JH		 1396 /* If there are still keys to be received wait for them */
1397 if ((smp->remote_key_dist & 0x07))
1398 return 0;
1399
1d98bf4f
JH		 1400 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1401 cancel_delayed_work_sync(&conn->security_timer);
4a74d658 1402 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1d98bf4f 1403 smp_notify_keys(conn);
efabba37 1404
1d98bf4f 1405 smp_chan_destroy(conn);
d26a2345 1406
7034b911
VCG		 1407 return 0;
1408}
Linux kernel - Deliverables
This page took 0.345647 seconds and 5 git commands to generate.