projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Track LE initiator and responder address information
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
b1e2b3ae
JH		 127int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
128{
129 int err;
130
131 get_random_bytes(&rpa->b[3], 3);
132
133 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
134 rpa->b[5] |= 0x40; /* Set second most significant bit */
135
136 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
137 if (err < 0)
138 return err;
139
140 BT_DBG("RPA %pMR", rpa);
141
142 return 0;
143}
144
d22ef0bc 145static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 146 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
147 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 148{
149 u8 p1[16], p2[16];
150 int err;
151
152 memset(p1, 0, 16);
153
154 /* p1 = pres || preq || _rat || _iat */
155 swap56(pres, p1);
156 swap56(preq, p1 + 7);
157 p1[14] = _rat;
158 p1[15] = _iat;
159
160 memset(p2, 0, 16);
161
162 /* p2 = padding || ia || ra */
163 baswap((bdaddr_t *) (p2 + 4), ia);
164 baswap((bdaddr_t *) (p2 + 10), ra);
165
166 /* res = r XOR p1 */
167 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
168
169 /* res = e(k, res) */
170 err = smp_e(tfm, k, res);
171 if (err) {
172 BT_ERR("Encrypt data error");
173 return err;
174 }
175
176 /* res = res XOR p2 */
177 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
178
179 /* res = e(k, res) */
180 err = smp_e(tfm, k, res);
181 if (err)
182 BT_ERR("Encrypt data error");
183
184 return err;
185}
186
f1560463
MH		 187static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
188 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 189{
190 int err;
191
192 /* Just least significant octets from r1 and r2 are considered */
193 memcpy(_r, r1 + 8, 8);
194 memcpy(_r + 8, r2 + 8, 8);
195
196 err = smp_e(tfm, k, _r);
197 if (err)
198 BT_ERR("Encrypt data error");
199
200 return err;
201}
202
eb492e01 203static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 204 u16 dlen, void *data)
eb492e01
AB		 205{
206 struct sk_buff *skb;
207 struct l2cap_hdr *lh;
208 int len;
209
210 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
211
212 if (len > conn->mtu)
213 return NULL;
214
215 skb = bt_skb_alloc(len, GFP_ATOMIC);
216 if (!skb)
217 return NULL;
218
219 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
220 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 221 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 222
223 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
224
225 memcpy(skb_put(skb, dlen), data, dlen);
226
227 return skb;
228}
229
230static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
231{
232 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
233
234 BT_DBG("code 0x%2.2x", code);
235
236 if (!skb)
237 return;
238
73d80deb
LAD		 239 skb->priority = HCI_PRIO_MAX;
240 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 241
6c9d42a1 242 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 243 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 244}
245
2b64d153
BG		 246static __u8 authreq_to_seclevel(__u8 authreq)
247{
248 if (authreq & SMP_AUTH_MITM)
249 return BT_SECURITY_HIGH;
250 else
251 return BT_SECURITY_MEDIUM;
252}
253
254static __u8 seclevel_to_authreq(__u8 sec_level)
255{
256 switch (sec_level) {
257 case BT_SECURITY_HIGH:
258 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
259 case BT_SECURITY_MEDIUM:
260 return SMP_AUTH_BONDING;
261 default:
262 return SMP_AUTH_NONE;
263 }
264}
265
b8e66eac 266static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 267 struct smp_cmd_pairing *req,
268 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 269{
fd349c02
JH		 270 struct smp_chan *smp = conn->smp_chan;
271 struct hci_conn *hcon = conn->hcon;
272 struct hci_dev *hdev = hcon->hdev;
273 u8 local_dist = 0, remote_dist = 0;
54790f73 274
a8b2d5c2 275 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
fd349c02
JH		 276 local_dist = SMP_DIST_ENC_KEY;
277 remote_dist = SMP_DIST_ENC_KEY;
54790f73 278 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 279 } else {
280 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 281 }
282
fd349c02
JH		 283 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
284 remote_dist |= SMP_DIST_ID_KEY;
285
863efaf2
JH		 286 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
287 local_dist |= SMP_DIST_ID_KEY;
288
54790f73
VCG		 289 if (rsp == NULL) {
290 req->io_capability = conn->hcon->io_capability;
291 req->oob_flag = SMP_OOB_NOT_PRESENT;
292 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 293 req->init_key_dist = local_dist;
294 req->resp_key_dist = remote_dist;
065a13e2 295 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 296
297 smp->remote_key_dist = remote_dist;
54790f73
VCG		 298 return;
299 }
300
301 rsp->io_capability = conn->hcon->io_capability;
302 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
303 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 304 rsp->init_key_dist = req->init_key_dist & remote_dist;
305 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 306 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 307
308 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 309}
310
3158c50c
VCG		 311static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
312{
1c1def09
VCG		 313 struct smp_chan *smp = conn->smp_chan;
314
3158c50c 315 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 316 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 317 return SMP_ENC_KEY_SIZE;
318
f7aa611a 319 smp->enc_key_size = max_key_size;
3158c50c
VCG		 320
321 return 0;
322}
323
84794e11 324static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 325{
bab73cb6
JH		 326 struct hci_conn *hcon = conn->hcon;
327
84794e11 328 if (reason)
4f957a76 329 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 330 &reason);
4f957a76 331
ce39fb4e
MH		 332 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
333 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
334 HCI_ERROR_AUTH_FAILURE);
f1c09c07 335
61a0cfb0
AG		 336 cancel_delayed_work_sync(&conn->security_timer);
337
ce39fb4e 338 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 339 smp_chan_destroy(conn);
4f957a76
BG		 340}
341
2b64d153
BG		 342#define JUST_WORKS 0x00
343#define JUST_CFM 0x01
344#define REQ_PASSKEY 0x02
345#define CFM_PASSKEY 0x03
346#define REQ_OOB 0x04
347#define OVERLAP 0xFF
348
349static const u8 gen_method[5][5] = {
350 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
351 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
352 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
353 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
354 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
355};
356
357static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
358 u8 local_io, u8 remote_io)
359{
360 struct hci_conn *hcon = conn->hcon;
361 struct smp_chan *smp = conn->smp_chan;
362 u8 method;
363 u32 passkey = 0;
364 int ret = 0;
365
366 /* Initialize key for JUST WORKS */
367 memset(smp->tk, 0, sizeof(smp->tk));
368 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
369
370 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
371
372 /* If neither side wants MITM, use JUST WORKS */
373 /* If either side has unknown io_caps, use JUST WORKS */
374 /* Otherwise, look up method from the table */
375 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 376 local_io > SMP_IO_KEYBOARD_DISPLAY ||
377 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 378 method = JUST_WORKS;
379 else
b3ff53ff 380 method = gen_method[remote_io][local_io];
2b64d153
BG		 381
382 /* If not bonding, don't ask user to confirm a Zero TK */
383 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
384 method = JUST_WORKS;
385
386 /* If Just Works, Continue with Zero TK */
387 if (method == JUST_WORKS) {
388 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
389 return 0;
390 }
391
392 /* Not Just Works/Confirm results in MITM Authentication */
393 if (method != JUST_CFM)
394 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
395
396 /* If both devices have Keyoard-Display I/O, the master
397 * Confirms and the slave Enters the passkey.
398 */
399 if (method == OVERLAP) {
400 if (hcon->link_mode & HCI_LM_MASTER)
401 method = CFM_PASSKEY;
402 else
403 method = REQ_PASSKEY;
404 }
405
406 /* Generate random passkey. Not valid until confirmed. */
407 if (method == CFM_PASSKEY) {
408 u8 key[16];
409
410 memset(key, 0, sizeof(key));
411 get_random_bytes(&passkey, sizeof(passkey));
412 passkey %= 1000000;
413 put_unaligned_le32(passkey, key);
414 swap128(key, smp->tk);
415 BT_DBG("PassKey: %d", passkey);
416 }
417
418 hci_dev_lock(hcon->hdev);
419
420 if (method == REQ_PASSKEY)
ce39fb4e 421 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 422 hcon->type, hcon->dst_type);
2b64d153 423 else
ce39fb4e 424 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 425 hcon->type, hcon->dst_type,
2b64d153
BG		 426 cpu_to_le32(passkey), 0);
427
428 hci_dev_unlock(hcon->hdev);
429
430 return ret;
431}
432
8aab4757
VCG		 433static void confirm_work(struct work_struct *work)
434{
435 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
436 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 437 struct hci_dev *hdev = conn->hcon->hdev;
438 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 439 struct smp_cmd_pairing_confirm cp;
440 int ret;
441 u8 res[16], reason;
442
443 BT_DBG("conn %p", conn);
444
893ce8b1
JH		 445 /* Prevent mutual access to hdev->tfm_aes */
446 hci_dev_lock(hdev);
8aab4757
VCG		 447
448 if (conn->hcon->out)
c8462ca6
MH		 449 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
450 conn->hcon->src_type, &conn->hcon->src,
451 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 452 else
453 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 454 conn->hcon->dst_type, &conn->hcon->dst,
455 conn->hcon->src_type, &conn->hcon->src, res);
893ce8b1
JH		 456
457 hci_dev_unlock(hdev);
458
8aab4757
VCG		 459 if (ret) {
460 reason = SMP_UNSPECIFIED;
461 goto error;
462 }
463
2b64d153
BG		 464 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
465
8aab4757
VCG		 466 swap128(res, cp.confirm_val);
467 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
468
469 return;
470
471error:
84794e11 472 smp_failure(conn, reason);
8aab4757
VCG		 473}
474
475static void random_work(struct work_struct *work)
476{
477 struct smp_chan *smp = container_of(work, struct smp_chan, random);
478 struct l2cap_conn *conn = smp->conn;
479 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 480 struct hci_dev *hdev = hcon->hdev;
481 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 482 u8 reason, confirm[16], res[16], key[16];
483 int ret;
484
485 if (IS_ERR_OR_NULL(tfm)) {
486 reason = SMP_UNSPECIFIED;
487 goto error;
488 }
489
490 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
491
893ce8b1
JH		 492 /* Prevent mutual access to hdev->tfm_aes */
493 hci_dev_lock(hdev);
494
8aab4757 495 if (hcon->out)
c8462ca6
MH		 496 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
497 hcon->src_type, &hcon->src,
498 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 499 else
500 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 501 hcon->dst_type, &hcon->dst,
502 hcon->src_type, &hcon->src, res);
893ce8b1
JH		 503
504 hci_dev_unlock(hdev);
505
8aab4757
VCG		 506 if (ret) {
507 reason = SMP_UNSPECIFIED;
508 goto error;
509 }
510
511 swap128(res, confirm);
512
513 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
514 BT_ERR("Pairing failed (confirmation values mismatch)");
515 reason = SMP_CONFIRM_FAILED;
516 goto error;
517 }
518
519 if (hcon->out) {
fe39c7b2
MH		 520 u8 stk[16];
521 __le64 rand = 0;
522 __le16 ediv = 0;
8aab4757
VCG		 523
524 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
525 swap128(key, stk);
526
f7aa611a 527 memset(stk + smp->enc_key_size, 0,
04124681 528 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 529
51a8efd7 530 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 531 reason = SMP_UNSPECIFIED;
532 goto error;
533 }
534
535 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 536 hcon->enc_key_size = smp->enc_key_size;
8aab4757 537 } else {
fe39c7b2
MH		 538 u8 stk[16], r[16];
539 __le64 rand = 0;
540 __le16 ediv = 0;
8aab4757
VCG		 541
542 swap128(smp->prnd, r);
543 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
544
545 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
546 swap128(key, stk);
547
f7aa611a 548 memset(stk + smp->enc_key_size, 0,
f1560463 549 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 550
ce39fb4e 551 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 552 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 553 ediv, rand);
8aab4757
VCG		 554 }
555
556 return;
557
558error:
84794e11 559 smp_failure(conn, reason);
8aab4757
VCG		 560}
561
562static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
563{
564 struct smp_chan *smp;
565
f1560463 566 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 567 if (!smp)
568 return NULL;
569
570 INIT_WORK(&smp->confirm, confirm_work);
571 INIT_WORK(&smp->random, random_work);
572
573 smp->conn = conn;
574 conn->smp_chan = smp;
2b64d153 575 conn->hcon->smp_conn = conn;
8aab4757
VCG		 576
577 hci_conn_hold(conn->hcon);
578
579 return smp;
580}
581
582void smp_chan_destroy(struct l2cap_conn *conn)
583{
c8eb9690 584 struct smp_chan *smp = conn->smp_chan;
f4a407be 585 bool complete;
c8eb9690 586
f1c09c07 587 BUG_ON(!smp);
c8eb9690 588
f4a407be
JH		 589 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
590 mgmt_smp_complete(conn->hcon, complete);
591
759331d7
JH		 592 /* If pairing failed clean up any keys we might have */
593 if (!complete) {
594 if (smp->ltk) {
595 list_del(&smp->ltk->list);
596 kfree(smp->ltk);
597 }
598
599 if (smp->slave_ltk) {
600 list_del(&smp->slave_ltk->list);
601 kfree(smp->slave_ltk);
602 }
603
604 if (smp->remote_irk) {
605 list_del(&smp->remote_irk->list);
606 kfree(smp->remote_irk);
607 }
608 }
609
c8eb9690
BG		 610 kfree(smp);
611 conn->smp_chan = NULL;
2b64d153 612 conn->hcon->smp_conn = NULL;
76a68ba0 613 hci_conn_drop(conn->hcon);
8aab4757
VCG		 614}
615
2b64d153
BG		 616int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
617{
618 struct l2cap_conn *conn = hcon->smp_conn;
619 struct smp_chan *smp;
620 u32 value;
621 u8 key[16];
622
623 BT_DBG("");
624
625 if (!conn)
626 return -ENOTCONN;
627
628 smp = conn->smp_chan;
629
630 switch (mgmt_op) {
631 case MGMT_OP_USER_PASSKEY_REPLY:
632 value = le32_to_cpu(passkey);
633 memset(key, 0, sizeof(key));
634 BT_DBG("PassKey: %d", value);
635 put_unaligned_le32(value, key);
636 swap128(key, smp->tk);
637 /* Fall Through */
638 case MGMT_OP_USER_CONFIRM_REPLY:
639 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
640 break;
641 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
642 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 643 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 644 return 0;
645 default:
84794e11 646 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 647 return -EOPNOTSUPP;
648 }
649
650 /* If it is our turn to send Pairing Confirm, do so now */
651 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
652 queue_work(hcon->hdev->workqueue, &smp->confirm);
653
654 return 0;
655}
656
da85e5e5 657static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 658{
3158c50c 659 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 660 struct smp_chan *smp;
3158c50c 661 u8 key_size;
2b64d153 662 u8 auth = SMP_AUTH_NONE;
8aab4757 663 int ret;
88ba43b6
AB		 664
665 BT_DBG("conn %p", conn);
666
c46b98be
JH		 667 if (skb->len < sizeof(*req))
668 return SMP_UNSPECIFIED;
669
2b64d153
BG		 670 if (conn->hcon->link_mode & HCI_LM_MASTER)
671 return SMP_CMD_NOTSUPP;
672
51a8efd7 673 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 674 smp = smp_chan_create(conn);
d08fd0e7
AE		 675 else
676 smp = conn->smp_chan;
8aab4757 677
d08fd0e7
AE		 678 if (!smp)
679 return SMP_UNSPECIFIED;
d26a2345 680
1c1def09
VCG		 681 smp->preq[0] = SMP_CMD_PAIRING_REQ;
682 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 683 skb_pull(skb, sizeof(*req));
88ba43b6 684
2b64d153
BG		 685 /* We didn't start the pairing, so match remote */
686 if (req->auth_req & SMP_AUTH_BONDING)
687 auth = req->auth_req;
da85e5e5 688
fdde0a26
IY		 689 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
690
2b64d153 691 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 692
693 key_size = min(req->max_key_size, rsp.max_key_size);
694 if (check_enc_key_size(conn, key_size))
695 return SMP_ENC_KEY_SIZE;
88ba43b6 696
e84a6b13 697 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 698
1c1def09
VCG		 699 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
700 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 701
3158c50c 702 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 703
2b64d153
BG		 704 /* Request setup of TK */
705 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
706 if (ret)
707 return SMP_UNSPECIFIED;
708
da85e5e5 709 return 0;
88ba43b6
AB		 710}
711
da85e5e5 712static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 713{
3158c50c 714 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 715 struct smp_chan *smp = conn->smp_chan;
8aab4757 716 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 717 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 718 int ret;
88ba43b6
AB		 719
720 BT_DBG("conn %p", conn);
721
c46b98be
JH		 722 if (skb->len < sizeof(*rsp))
723 return SMP_UNSPECIFIED;
724
2b64d153
BG		 725 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
726 return SMP_CMD_NOTSUPP;
727
3158c50c
VCG		 728 skb_pull(skb, sizeof(*rsp));
729
1c1def09 730 req = (void *) &smp->preq[1];
da85e5e5 731
3158c50c
VCG		 732 key_size = min(req->max_key_size, rsp->max_key_size);
733 if (check_enc_key_size(conn, key_size))
734 return SMP_ENC_KEY_SIZE;
735
e84a6b13 736 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 737
8aab4757
VCG		 738 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
739 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 740
2b64d153 741 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 742 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 743 auth = SMP_AUTH_BONDING;
744
745 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
746
476585ec 747 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 748 if (ret)
749 return SMP_UNSPECIFIED;
750
751 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
752
753 /* Can't compose response until we have been confirmed */
754 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
755 return 0;
756
8aab4757 757 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 758
759 return 0;
88ba43b6
AB		 760}
761
da85e5e5 762static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 763{
1c1def09 764 struct smp_chan *smp = conn->smp_chan;
8aab4757 765 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 766
88ba43b6
AB		 767 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
768
c46b98be
JH		 769 if (skb->len < sizeof(smp->pcnf))
770 return SMP_UNSPECIFIED;
771
1c1def09
VCG		 772 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
773 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 774
7d24ddcc
AB		 775 if (conn->hcon->out) {
776 u8 random[16];
88ba43b6 777
1c1def09 778 swap128(smp->prnd, random);
88ba43b6 779 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 780 random);
2b64d153 781 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 782 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 783 } else {
784 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 785 }
da85e5e5
VCG		 786
787 return 0;
88ba43b6
AB		 788}
789
da85e5e5 790static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 791{
1c1def09 792 struct smp_chan *smp = conn->smp_chan;
8aab4757 793 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 794
8aab4757 795 BT_DBG("conn %p", conn);
3158c50c 796
c46b98be
JH		 797 if (skb->len < sizeof(smp->rrnd))
798 return SMP_UNSPECIFIED;
799
8aab4757
VCG		 800 swap128(skb->data, smp->rrnd);
801 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 802
8aab4757 803 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 804
805 return 0;
88ba43b6
AB		 806}
807
4dab7864 808static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 809{
c9839a11 810 struct smp_ltk *key;
988c5997
VCG		 811 struct hci_conn *hcon = conn->hcon;
812
98a0b845
JH		 813 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
814 hcon->out);
988c5997
VCG		 815 if (!key)
816 return 0;
817
4dab7864
JH		 818 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
819 return 0;
820
51a8efd7 821 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 822 return 1;
823
c9839a11
VCG		 824 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
825 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 826
827 return 1;
988c5997 828}
f1560463 829
da85e5e5 830static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 831{
832 struct smp_cmd_security_req *rp = (void *) skb->data;
833 struct smp_cmd_pairing cp;
f1cb9af5 834 struct hci_conn *hcon = conn->hcon;
8aab4757 835 struct smp_chan *smp;
88ba43b6
AB		 836
837 BT_DBG("conn %p", conn);
838
c46b98be
JH		 839 if (skb->len < sizeof(*rp))
840 return SMP_UNSPECIFIED;
841
86ca9eac
JH		 842 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
843 return SMP_CMD_NOTSUPP;
844
2b64d153 845 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 846
4dab7864 847 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 848 return 0;
849
51a8efd7 850 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 851 return 0;
f1cb9af5 852
8aab4757 853 smp = smp_chan_create(conn);
d26a2345 854
88ba43b6 855 skb_pull(skb, sizeof(*rp));
88ba43b6 856
da85e5e5 857 memset(&cp, 0, sizeof(cp));
54790f73 858 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 859
1c1def09
VCG		 860 smp->preq[0] = SMP_CMD_PAIRING_REQ;
861 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 862
88ba43b6 863 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 864
da85e5e5 865 return 0;
88ba43b6
AB		 866}
867
ad32a2f5
JH		 868bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
869{
870 if (sec_level == BT_SECURITY_LOW)
871 return true;
872
873 if (hcon->sec_level >= sec_level)
874 return true;
875
876 return false;
877}
878
cc110922 879int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 880{
cc110922 881 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 882 struct smp_chan *smp = conn->smp_chan;
2b64d153 883 __u8 authreq;
eb492e01 884
3a0259bb
VCG		 885 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
886
757aee0f 887 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 888 return 1;
889
ad32a2f5 890 if (smp_sufficient_security(hcon, sec_level))
eb492e01 891 return 1;
f1cb9af5 892
988c5997 893 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 894 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 895 goto done;
d26a2345 896
51a8efd7 897 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 898 return 0;
899
8aab4757 900 smp = smp_chan_create(conn);
2b64d153
BG		 901 if (!smp)
902 return 1;
903
904 authreq = seclevel_to_authreq(sec_level);
d26a2345 905
d26a2345
VCG		 906 if (hcon->link_mode & HCI_LM_MASTER) {
907 struct smp_cmd_pairing cp;
f01ead31 908
2b64d153 909 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 910 smp->preq[0] = SMP_CMD_PAIRING_REQ;
911 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 912
eb492e01
AB		 913 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
914 } else {
915 struct smp_cmd_security_req cp;
2b64d153 916 cp.auth_req = authreq;
eb492e01
AB		 917 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
918 }
919
02bc7455 920done:
f1cb9af5 921 hcon->pending_sec_level = sec_level;
f1cb9af5 922
eb492e01
AB		 923 return 0;
924}
925
7034b911
VCG		 926static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
927{
16b90839 928 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 929 struct smp_chan *smp = conn->smp_chan;
16b90839 930
c46b98be
JH		 931 BT_DBG("conn %p", conn);
932
933 if (skb->len < sizeof(*rp))
934 return SMP_UNSPECIFIED;
935
6131ddc8
JH		 936 /* Ignore this PDU if it wasn't requested */
937 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
938 return 0;
939
16b90839
VCG		 940 skb_pull(skb, sizeof(*rp));
941
1c1def09 942 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 943
7034b911
VCG		 944 return 0;
945}
946
947static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
948{
16b90839 949 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 950 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 951 struct hci_dev *hdev = conn->hcon->hdev;
952 struct hci_conn *hcon = conn->hcon;
23d0e128 953 struct smp_ltk *ltk;
c9839a11 954 u8 authenticated;
16b90839 955
c46b98be
JH		 956 BT_DBG("conn %p", conn);
957
958 if (skb->len < sizeof(*rp))
959 return SMP_UNSPECIFIED;
960
6131ddc8
JH		 961 /* Ignore this PDU if it wasn't requested */
962 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
963 return 0;
964
9747a9f3
JH		 965 /* Mark the information as received */
966 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
967
16b90839 968 skb_pull(skb, sizeof(*rp));
7034b911 969
c9839a11 970 hci_dev_lock(hdev);
ce39fb4e 971 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 972 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 973 authenticated, smp->tk, smp->enc_key_size,
974 rp->ediv, rp->rand);
975 smp->ltk = ltk;
fd349c02 976 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 977 smp_distribute_keys(conn);
c9839a11 978 hci_dev_unlock(hdev);
7034b911
VCG		 979
980 return 0;
981}
982
fd349c02
JH		 983static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
984{
985 struct smp_cmd_ident_info *info = (void *) skb->data;
986 struct smp_chan *smp = conn->smp_chan;
987
988 BT_DBG("");
989
990 if (skb->len < sizeof(*info))
991 return SMP_UNSPECIFIED;
992
6131ddc8
JH		 993 /* Ignore this PDU if it wasn't requested */
994 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
995 return 0;
996
fd349c02
JH		 997 skb_pull(skb, sizeof(*info));
998
999 memcpy(smp->irk, info->irk, 16);
1000
1001 return 0;
1002}
1003
1004static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1005 struct sk_buff *skb)
1006{
1007 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
1008 struct smp_chan *smp = conn->smp_chan;
1009 struct hci_conn *hcon = conn->hcon;
1010 bdaddr_t rpa;
1011
1012 BT_DBG("");
1013
1014 if (skb->len < sizeof(*info))
1015 return SMP_UNSPECIFIED;
1016
6131ddc8
JH		 1017 /* Ignore this PDU if it wasn't requested */
1018 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1019 return 0;
1020
9747a9f3
JH		 1021 /* Mark the information as received */
1022 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1023
fd349c02
JH		 1024 skb_pull(skb, sizeof(*info));
1025
a9a58f86
JH		 1026 /* Strictly speaking the Core Specification (4.1) allows sending
1027 * an empty address which would force us to rely on just the IRK
1028 * as "identity information". However, since such
1029 * implementations are not known of and in order to not over
1030 * complicate our implementation, simply pretend that we never
1031 * received an IRK for such a device.
1032 */
1033 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1034 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1035 smp_distribute_keys(conn);
a9a58f86
JH		 1036 return 0;
1037 }
1038
fd349c02
JH		 1039 bacpy(&smp->id_addr, &info->bdaddr);
1040 smp->id_addr_type = info->addr_type;
1041
1042 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1043 bacpy(&rpa, &hcon->dst);
1044 else
1045 bacpy(&rpa, BDADDR_ANY);
1046
23d0e128
JH		 1047 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1048 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1049
68d6f6de
JH		 1050 /* Track the connection based on the Identity Address from now on */
1051 bacpy(&hcon->dst, &smp->id_addr);
1052 hcon->dst_type = smp->id_addr_type;
1053
387a33e3
JH		 1054 l2cap_conn_update_id_addr(hcon);
1055
4bd6d38e 1056 smp_distribute_keys(conn);
fd349c02
JH		 1057
1058 return 0;
1059}
1060
eb492e01
AB		 1061int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1062{
7b9899db 1063 struct hci_conn *hcon = conn->hcon;
92381f5c 1064 __u8 code, reason;
eb492e01
AB		 1065 int err = 0;
1066
7b9899db
MH		 1067 if (hcon->type != LE_LINK) {
1068 kfree_skb(skb);
3432711f 1069 return 0;
7b9899db
MH		 1070 }
1071
92381f5c
MH		 1072 if (skb->len < 1) {
1073 kfree_skb(skb);
1074 return -EILSEQ;
1075 }
1076
06ae3314 1077 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1078 err = -ENOTSUPP;
1079 reason = SMP_PAIRING_NOTSUPP;
1080 goto done;
1081 }
1082
92381f5c 1083 code = skb->data[0];
eb492e01
AB		 1084 skb_pull(skb, sizeof(code));
1085
8cf9fa12
JH		 1086 /*
1087 * The SMP context must be initialized for all other PDUs except
1088 * pairing and security requests. If we get any other PDU when
1089 * not initialized simply disconnect (done if this function
1090 * returns an error).
1091 */
1092 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1093 !conn->smp_chan) {
1094 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1095 kfree_skb(skb);
1096 return -ENOTSUPP;
1097 }
1098
eb492e01
AB		 1099 switch (code) {
1100 case SMP_CMD_PAIRING_REQ:
da85e5e5 1101 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1102 break;
1103
1104 case SMP_CMD_PAIRING_FAIL:
84794e11 1105 smp_failure(conn, 0);
da85e5e5
VCG		 1106 reason = 0;
1107 err = -EPERM;
eb492e01
AB		 1108 break;
1109
1110 case SMP_CMD_PAIRING_RSP:
da85e5e5 1111 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1112 break;
1113
1114 case SMP_CMD_SECURITY_REQ:
da85e5e5 1115 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1116 break;
1117
eb492e01 1118 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1119 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1120 break;
1121
eb492e01 1122 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1123 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1124 break;
1125
eb492e01 1126 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1127 reason = smp_cmd_encrypt_info(conn, skb);
1128 break;
1129
eb492e01 1130 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1131 reason = smp_cmd_master_ident(conn, skb);
1132 break;
1133
eb492e01 1134 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1135 reason = smp_cmd_ident_info(conn, skb);
1136 break;
1137
eb492e01 1138 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1139 reason = smp_cmd_ident_addr_info(conn, skb);
1140 break;
1141
eb492e01 1142 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 1143 /* Just ignored */
1144 reason = 0;
1145 break;
1146
eb492e01
AB		 1147 default:
1148 BT_DBG("Unknown command code 0x%2.2x", code);
1149
1150 reason = SMP_CMD_NOTSUPP;
eb492e01 1151 err = -EOPNOTSUPP;
3a0259bb 1152 goto done;
eb492e01
AB		 1153 }
1154
3a0259bb
VCG		 1155done:
1156 if (reason)
84794e11 1157 smp_failure(conn, reason);
3a0259bb 1158
eb492e01
AB		 1159 kfree_skb(skb);
1160 return err;
1161}
7034b911 1162
35d70271
JH		 1163static void smp_notify_keys(struct l2cap_conn *conn)
1164{
1165 struct smp_chan *smp = conn->smp_chan;
1166 struct hci_conn *hcon = conn->hcon;
1167 struct hci_dev *hdev = hcon->hdev;
1168
95fbac8a
JH		 1169 if (smp->remote_irk)
1170 mgmt_new_irk(hdev, smp->remote_irk);
1171
35d70271
JH		 1172 if (smp->ltk) {
1173 smp->ltk->bdaddr_type = hcon->dst_type;
1174 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1175 mgmt_new_ltk(hdev, smp->ltk);
1176 }
1177
1178 if (smp->slave_ltk) {
1179 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1180 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1181 mgmt_new_ltk(hdev, smp->slave_ltk);
1182 }
1183}
1184
4bd6d38e 1185int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1186{
1187 struct smp_cmd_pairing *req, *rsp;
1c1def09 1188 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1189 struct hci_conn *hcon = conn->hcon;
1190 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1191 __u8 *keydist;
1192
4bd6d38e 1193 BT_DBG("conn %p", conn);
7034b911 1194
524237cb 1195 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1196 return 0;
1197
1c1def09 1198 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1199
1200 /* The responder sends its keys first */
efabba37 1201 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1202 return 0;
1203
1c1def09 1204 req = (void *) &smp->preq[1];
7034b911 1205
524237cb 1206 if (hcon->out) {
7034b911
VCG		 1207 keydist = &rsp->init_key_dist;
1208 *keydist &= req->init_key_dist;
1209 } else {
1210 keydist = &rsp->resp_key_dist;
1211 *keydist &= req->resp_key_dist;
1212 }
1213
7034b911
VCG		 1214 BT_DBG("keydist 0x%x", *keydist);
1215
1216 if (*keydist & SMP_DIST_ENC_KEY) {
1217 struct smp_cmd_encrypt_info enc;
1218 struct smp_cmd_master_ident ident;
23d0e128 1219 struct smp_ltk *ltk;
c9839a11 1220 u8 authenticated;
7034b911 1221 __le16 ediv;
fe39c7b2 1222 __le64 rand;
7034b911
VCG		 1223
1224 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1225 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1226 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1227
1228 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1229
c9839a11 1230 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1231 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271 1232 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1233 smp->enc_key_size, ediv, rand);
23d0e128 1234 smp->slave_ltk = ltk;
16b90839 1235
58115373 1236 ident.ediv = ediv;
fe39c7b2 1237 ident.rand = rand;
7034b911
VCG		 1238
1239 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1240
1241 *keydist &= ~SMP_DIST_ENC_KEY;
1242 }
1243
1244 if (*keydist & SMP_DIST_ID_KEY) {
1245 struct smp_cmd_ident_addr_info addrinfo;
1246 struct smp_cmd_ident_info idinfo;
1247
863efaf2 1248 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1249
1250 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1251
82d4b359
JH		 1252 /* The hci_conn contains the local identity address
1253 * after the connection has been established.
1254 *
1255 * This is true even when the connection has been
1256 * established using a resolvable random address.
1257 */
524237cb 1258 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1259 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1260
1261 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1262 &addrinfo);
7034b911
VCG		 1263
1264 *keydist &= ~SMP_DIST_ID_KEY;
1265 }
1266
1267 if (*keydist & SMP_DIST_SIGN) {
1268 struct smp_cmd_sign_info sign;
1269
1270 /* Send a dummy key */
1271 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1272
1273 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1274
1275 *keydist &= ~SMP_DIST_SIGN;
1276 }
1277
efabba37
JH		 1278 /* If there are still keys to be received wait for them */
1279 if ((smp->remote_key_dist & 0x07))
1280 return 0;
1281
1282 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1283 cancel_delayed_work_sync(&conn->security_timer);
1284 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
1285 smp_notify_keys(conn);
1286
1287 smp_chan_destroy(conn);
d26a2345 1288
7034b911
VCG		 1289 return 0;
1290}
Linux kernel - Deliverables
This page took 0.226839 seconds and 5 git commands to generate.