projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: 6lowpan: Fix lockdep splats
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
b28b4943 34#define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
b28b4943 35
17b02e62 36#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 37
065a13e2 38#define AUTH_REQ_MASK 0x07
88d3a8ac 39#define KEY_DIST_MASK 0x07
065a13e2 40
533e35d4
JH		 41enum {
42 SMP_FLAG_TK_VALID,
43 SMP_FLAG_CFM_PENDING,
44 SMP_FLAG_MITM_AUTH,
45 SMP_FLAG_COMPLETE,
46 SMP_FLAG_INITIATOR,
47};
4bc58f51
JH		 48
49struct smp_chan {
b68fda68
JH		 50 struct l2cap_conn *conn;
51 struct delayed_work security_timer;
b28b4943 52 unsigned long allow_cmd; /* Bitmask of allowed commands */
b68fda68 53
4bc58f51
JH		 54 u8 preq[7]; /* SMP Pairing Request */
55 u8 prsp[7]; /* SMP Pairing Response */
56 u8 prnd[16]; /* SMP Pairing Random (local) */
57 u8 rrnd[16]; /* SMP Pairing Random (remote) */
58 u8 pcnf[16]; /* SMP Pairing Confirm */
59 u8 tk[16]; /* SMP Temporary Key */
60 u8 enc_key_size;
61 u8 remote_key_dist;
62 bdaddr_t id_addr;
63 u8 id_addr_type;
64 u8 irk[16];
65 struct smp_csrk *csrk;
66 struct smp_csrk *slave_csrk;
67 struct smp_ltk *ltk;
68 struct smp_ltk *slave_ltk;
69 struct smp_irk *remote_irk;
4a74d658 70 unsigned long flags;
6a7bd103
JH		 71
72 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 73};
74
8a2936f4 75static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 76{
8a2936f4 77 size_t i;
d22ef0bc 78
8a2936f4
JH		 79 for (i = 0; i < len; i++)
80 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 81}
82
83static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
84{
85 struct blkcipher_desc desc;
86 struct scatterlist sg;
943a732a 87 uint8_t tmp[16], data[16];
201a5929 88 int err;
d22ef0bc
AB		 89
90 if (tfm == NULL) {
91 BT_ERR("tfm %p", tfm);
92 return -EINVAL;
93 }
94
95 desc.tfm = tfm;
96 desc.flags = 0;
97
943a732a 98 /* The most significant octet of key corresponds to k[0] */
8a2936f4 99 swap_buf(k, tmp, 16);
943a732a
JH		 100
101 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 102 if (err) {
103 BT_ERR("cipher setkey failed: %d", err);
104 return err;
105 }
106
943a732a 107 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 108 swap_buf(r, data, 16);
943a732a
JH		 109
110 sg_init_one(&sg, data, 16);
d22ef0bc 111
d22ef0bc
AB		 112 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
113 if (err)
114 BT_ERR("Encrypt data error %d", err);
115
943a732a 116 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 117 swap_buf(data, r, 16);
943a732a 118
d22ef0bc
AB		 119 return err;
120}
121
60478054
JH		 122static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
123{
943a732a 124 u8 _res[16];
60478054
JH		 125 int err;
126
127 /* r' = padding || r */
943a732a
JH		 128 memcpy(_res, r, 3);
129 memset(_res + 3, 0, 13);
60478054 130
943a732a 131 err = smp_e(tfm, irk, _res);
60478054
JH		 132 if (err) {
133 BT_ERR("Encrypt error");
134 return err;
135 }
136
137 /* The output of the random address function ah is:
138 * ah(h, r) = e(k, r') mod 2^24
139 * The output of the security function e is then truncated to 24 bits
140 * by taking the least significant 24 bits of the output of e as the
141 * result of ah.
142 */
943a732a 143 memcpy(res, _res, 3);
60478054
JH		 144
145 return 0;
146}
147
defce9e8 148bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 149{
defce9e8
JH		 150 struct l2cap_chan *chan = hdev->smp_data;
151 struct crypto_blkcipher *tfm;
60478054
JH		 152 u8 hash[3];
153 int err;
154
defce9e8
JH		 155 if (!chan || !chan->data)
156 return false;
157
158 tfm = chan->data;
159
60478054
JH		 160 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
161
162 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
163 if (err)
164 return false;
165
166 return !memcmp(bdaddr->b, hash, 3);
167}
168
defce9e8 169int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 170{
defce9e8
JH		 171 struct l2cap_chan *chan = hdev->smp_data;
172 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 173 int err;
174
defce9e8
JH		 175 if (!chan || !chan->data)
176 return -EOPNOTSUPP;
177
178 tfm = chan->data;
179
b1e2b3ae
JH		 180 get_random_bytes(&rpa->b[3], 3);
181
182 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
183 rpa->b[5] |= 0x40; /* Set second most significant bit */
184
185 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
186 if (err < 0)
187 return err;
188
189 BT_DBG("RPA %pMR", rpa);
190
191 return 0;
192}
193
e491eaf3
JH		 194static int smp_c1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r[16],
195 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat,
196 bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 197{
198 u8 p1[16], p2[16];
199 int err;
200
201 memset(p1, 0, 16);
202
203 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 204 p1[0] = _iat;
205 p1[1] = _rat;
206 memcpy(p1 + 2, preq, 7);
207 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 208
209 /* p2 = padding || ia || ra */
943a732a
JH		 210 memcpy(p2, ra, 6);
211 memcpy(p2 + 6, ia, 6);
212 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 213
214 /* res = r XOR p1 */
215 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
216
217 /* res = e(k, res) */
e491eaf3 218 err = smp_e(tfm_aes, k, res);
d22ef0bc
AB		 219 if (err) {
220 BT_ERR("Encrypt data error");
221 return err;
222 }
223
224 /* res = res XOR p2 */
225 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
226
227 /* res = e(k, res) */
e491eaf3 228 err = smp_e(tfm_aes, k, res);
d22ef0bc
AB		 229 if (err)
230 BT_ERR("Encrypt data error");
231
232 return err;
233}
234
e491eaf3
JH		 235static int smp_s1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r1[16],
236 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 237{
238 int err;
239
240 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 241 memcpy(_r, r2, 8);
242 memcpy(_r + 8, r1, 8);
d22ef0bc 243
e491eaf3 244 err = smp_e(tfm_aes, k, _r);
d22ef0bc
AB		 245 if (err)
246 BT_ERR("Encrypt data error");
247
248 return err;
249}
250
5d88cc73 251static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 252{
5d88cc73 253 struct l2cap_chan *chan = conn->smp;
b68fda68 254 struct smp_chan *smp;
5d88cc73
JH		 255 struct kvec iv[2];
256 struct msghdr msg;
eb492e01 257
5d88cc73
JH		 258 if (!chan)
259 return;
eb492e01 260
5d88cc73 261 BT_DBG("code 0x%2.2x", code);
eb492e01 262
5d88cc73
JH		 263 iv[0].iov_base = &code;
264 iv[0].iov_len = 1;
eb492e01 265
5d88cc73
JH		 266 iv[1].iov_base = data;
267 iv[1].iov_len = len;
eb492e01 268
5d88cc73 269 memset(&msg, 0, sizeof(msg));
eb492e01 270
5d88cc73
JH		 271 msg.msg_iov = (struct iovec *) &iv;
272 msg.msg_iovlen = 2;
eb492e01 273
5d88cc73 274 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 275
b68fda68
JH		 276 if (!chan->data)
277 return;
278
279 smp = chan->data;
280
281 cancel_delayed_work_sync(&smp->security_timer);
1b0921d6 282 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 283}
284
2b64d153
BG		 285static __u8 authreq_to_seclevel(__u8 authreq)
286{
287 if (authreq & SMP_AUTH_MITM)
288 return BT_SECURITY_HIGH;
289 else
290 return BT_SECURITY_MEDIUM;
291}
292
293static __u8 seclevel_to_authreq(__u8 sec_level)
294{
295 switch (sec_level) {
296 case BT_SECURITY_HIGH:
297 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
298 case BT_SECURITY_MEDIUM:
299 return SMP_AUTH_BONDING;
300 default:
301 return SMP_AUTH_NONE;
302 }
303}
304
b8e66eac 305static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 306 struct smp_cmd_pairing *req,
307 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 308{
5d88cc73
JH		 309 struct l2cap_chan *chan = conn->smp;
310 struct smp_chan *smp = chan->data;
fd349c02
JH		 311 struct hci_conn *hcon = conn->hcon;
312 struct hci_dev *hdev = hcon->hdev;
313 u8 local_dist = 0, remote_dist = 0;
54790f73 314
b6ae8457 315 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 316 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
317 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 318 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 319 } else {
320 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 321 }
322
fd349c02
JH		 323 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
324 remote_dist |= SMP_DIST_ID_KEY;
325
863efaf2
JH		 326 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
327 local_dist |= SMP_DIST_ID_KEY;
328
54790f73
VCG		 329 if (rsp == NULL) {
330 req->io_capability = conn->hcon->io_capability;
331 req->oob_flag = SMP_OOB_NOT_PRESENT;
332 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 333 req->init_key_dist = local_dist;
334 req->resp_key_dist = remote_dist;
065a13e2 335 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 336
337 smp->remote_key_dist = remote_dist;
54790f73
VCG		 338 return;
339 }
340
341 rsp->io_capability = conn->hcon->io_capability;
342 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
343 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 344 rsp->init_key_dist = req->init_key_dist & remote_dist;
345 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 346 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 347
348 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 349}
350
3158c50c
VCG		 351static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
352{
5d88cc73
JH		 353 struct l2cap_chan *chan = conn->smp;
354 struct smp_chan *smp = chan->data;
1c1def09 355
3158c50c 356 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 357 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 358 return SMP_ENC_KEY_SIZE;
359
f7aa611a 360 smp->enc_key_size = max_key_size;
3158c50c
VCG		 361
362 return 0;
363}
364
6f48e260
JH		 365static void smp_chan_destroy(struct l2cap_conn *conn)
366{
367 struct l2cap_chan *chan = conn->smp;
368 struct smp_chan *smp = chan->data;
369 bool complete;
370
371 BUG_ON(!smp);
372
373 cancel_delayed_work_sync(&smp->security_timer);
6f48e260 374
6f48e260
JH		 375 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
376 mgmt_smp_complete(conn->hcon, complete);
377
378 kfree(smp->csrk);
379 kfree(smp->slave_csrk);
380
381 crypto_free_blkcipher(smp->tfm_aes);
382
383 /* If pairing failed clean up any keys we might have */
384 if (!complete) {
385 if (smp->ltk) {
386 list_del(&smp->ltk->list);
387 kfree(smp->ltk);
388 }
389
390 if (smp->slave_ltk) {
391 list_del(&smp->slave_ltk->list);
392 kfree(smp->slave_ltk);
393 }
394
395 if (smp->remote_irk) {
396 list_del(&smp->remote_irk->list);
397 kfree(smp->remote_irk);
398 }
399 }
400
401 chan->data = NULL;
402 kfree(smp);
403 hci_conn_drop(conn->hcon);
404}
405
84794e11 406static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 407{
bab73cb6 408 struct hci_conn *hcon = conn->hcon;
b68fda68 409 struct l2cap_chan *chan = conn->smp;
bab73cb6 410
84794e11 411 if (reason)
4f957a76 412 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 413 &reason);
4f957a76 414
ce39fb4e 415 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
e1e930f5 416 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
f1c09c07 417
fc75cc86 418 if (chan->data)
f1c09c07 419 smp_chan_destroy(conn);
4f957a76
BG		 420}
421
2b64d153
BG		 422#define JUST_WORKS 0x00
423#define JUST_CFM 0x01
424#define REQ_PASSKEY 0x02
425#define CFM_PASSKEY 0x03
426#define REQ_OOB 0x04
427#define OVERLAP 0xFF
428
429static const u8 gen_method[5][5] = {
430 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
431 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
432 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
433 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
434 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
435};
436
581370cc
JH		 437static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
438{
2bcd4003
JH		 439 /* If either side has unknown io_caps, use JUST_CFM (which gets
440 * converted later to JUST_WORKS if we're initiators.
441 */
581370cc
JH		 442 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
443 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 444 return JUST_CFM;
581370cc
JH		 445
446 return gen_method[remote_io][local_io];
447}
448
2b64d153
BG		 449static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
450 u8 local_io, u8 remote_io)
451{
452 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 453 struct l2cap_chan *chan = conn->smp;
454 struct smp_chan *smp = chan->data;
2b64d153
BG		 455 u8 method;
456 u32 passkey = 0;
457 int ret = 0;
458
459 /* Initialize key for JUST WORKS */
460 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 461 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 462
463 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
464
2bcd4003
JH		 465 /* If neither side wants MITM, either "just" confirm an incoming
466 * request or use just-works for outgoing ones. The JUST_CFM
467 * will be converted to JUST_WORKS if necessary later in this
468 * function. If either side has MITM look up the method from the
469 * table.
470 */
581370cc 471 if (!(auth & SMP_AUTH_MITM))
2bcd4003 472 method = JUST_CFM;
2b64d153 473 else
581370cc 474 method = get_auth_method(smp, local_io, remote_io);
2b64d153 475
a82505c7 476 /* Don't confirm locally initiated pairing attempts */
4a74d658 477 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 478 method = JUST_WORKS;
479
02f3e254
JH		 480 /* Don't bother user space with no IO capabilities */
481 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
482 method = JUST_WORKS;
483
2b64d153
BG		 484 /* If Just Works, Continue with Zero TK */
485 if (method == JUST_WORKS) {
4a74d658 486 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 487 return 0;
488 }
489
490 /* Not Just Works/Confirm results in MITM Authentication */
5eb596f5 491 if (method != JUST_CFM) {
4a74d658 492 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
5eb596f5
JH		 493 if (hcon->pending_sec_level < BT_SECURITY_HIGH)
494 hcon->pending_sec_level = BT_SECURITY_HIGH;
495 }
2b64d153
BG		 496
497 /* If both devices have Keyoard-Display I/O, the master
498 * Confirms and the slave Enters the passkey.
499 */
500 if (method == OVERLAP) {
40bef302 501 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 502 method = CFM_PASSKEY;
503 else
504 method = REQ_PASSKEY;
505 }
506
01ad34d2 507 /* Generate random passkey. */
2b64d153 508 if (method == CFM_PASSKEY) {
943a732a 509 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 510 get_random_bytes(&passkey, sizeof(passkey));
511 passkey %= 1000000;
943a732a 512 put_unaligned_le32(passkey, smp->tk);
2b64d153 513 BT_DBG("PassKey: %d", passkey);
4a74d658 514 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 515 }
516
517 hci_dev_lock(hcon->hdev);
518
519 if (method == REQ_PASSKEY)
ce39fb4e 520 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 521 hcon->type, hcon->dst_type);
4eb65e66
JH		 522 else if (method == JUST_CFM)
523 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
524 hcon->type, hcon->dst_type,
525 passkey, 1);
2b64d153 526 else
01ad34d2 527 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 528 hcon->type, hcon->dst_type,
39adbffe 529 passkey, 0);
2b64d153
BG		 530
531 hci_dev_unlock(hcon->hdev);
532
533 return ret;
534}
535
1cc61144 536static u8 smp_confirm(struct smp_chan *smp)
8aab4757 537{
8aab4757 538 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 539 struct smp_cmd_pairing_confirm cp;
540 int ret;
8aab4757
VCG		 541
542 BT_DBG("conn %p", conn);
543
e491eaf3 544 ret = smp_c1(smp->tfm_aes, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 545 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 546 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
547 cp.confirm_val);
1cc61144
JH		 548 if (ret)
549 return SMP_UNSPECIFIED;
8aab4757 550
4a74d658 551 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 552
8aab4757
VCG		 553 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
554
b28b4943
JH		 555 if (conn->hcon->out)
556 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
557 else
558 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
559
1cc61144 560 return 0;
8aab4757
VCG		 561}
562
861580a9 563static u8 smp_random(struct smp_chan *smp)
8aab4757 564{
8aab4757
VCG		 565 struct l2cap_conn *conn = smp->conn;
566 struct hci_conn *hcon = conn->hcon;
861580a9 567 u8 confirm[16];
8aab4757
VCG		 568 int ret;
569
ec70f36f 570 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 571 return SMP_UNSPECIFIED;
8aab4757
VCG		 572
573 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
574
e491eaf3 575 ret = smp_c1(smp->tfm_aes, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 576 hcon->init_addr_type, &hcon->init_addr,
943a732a 577 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 578 if (ret)
579 return SMP_UNSPECIFIED;
8aab4757 580
8aab4757
VCG		 581 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
582 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 583 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 584 }
585
586 if (hcon->out) {
fe39c7b2
MH		 587 u8 stk[16];
588 __le64 rand = 0;
589 __le16 ediv = 0;
8aab4757 590
e491eaf3 591 smp_s1(smp->tfm_aes, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 592
f7aa611a 593 memset(stk + smp->enc_key_size, 0,
04124681 594 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 595
861580a9
JH		 596 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
597 return SMP_UNSPECIFIED;
8aab4757
VCG		 598
599 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 600 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 601 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 602 } else {
fff3490f 603 u8 stk[16], auth;
fe39c7b2
MH		 604 __le64 rand = 0;
605 __le16 ediv = 0;
8aab4757 606
943a732a
JH		 607 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
608 smp->prnd);
8aab4757 609
e491eaf3 610 smp_s1(smp->tfm_aes, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 611
f7aa611a 612 memset(stk + smp->enc_key_size, 0,
f1560463 613 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 614
fff3490f
JH		 615 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
616 auth = 1;
617 else
618 auth = 0;
619
7d5843b7
JH		 620 /* Even though there's no _SLAVE suffix this is the
621 * slave STK we're adding for later lookup (the master
622 * STK never needs to be stored).
623 */
ce39fb4e 624 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 625 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 626 }
627
861580a9 628 return 0;
8aab4757
VCG		 629}
630
44f1a7ab
JH		 631static void smp_notify_keys(struct l2cap_conn *conn)
632{
633 struct l2cap_chan *chan = conn->smp;
634 struct smp_chan *smp = chan->data;
635 struct hci_conn *hcon = conn->hcon;
636 struct hci_dev *hdev = hcon->hdev;
637 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
638 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
639 bool persistent;
640
641 if (smp->remote_irk) {
642 mgmt_new_irk(hdev, smp->remote_irk);
643 /* Now that user space can be considered to know the
644 * identity address track the connection based on it
645 * from now on.
646 */
647 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
648 hcon->dst_type = smp->remote_irk->addr_type;
f3d82d0c 649 queue_work(hdev->workqueue, &conn->id_addr_update_work);
44f1a7ab
JH		 650
651 /* When receiving an indentity resolving key for
652 * a remote device that does not use a resolvable
653 * private address, just remove the key so that
654 * it is possible to use the controller white
655 * list for scanning.
656 *
657 * Userspace will have been told to not store
658 * this key at this point. So it is safe to
659 * just remove it.
660 */
661 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
662 list_del(&smp->remote_irk->list);
663 kfree(smp->remote_irk);
664 smp->remote_irk = NULL;
665 }
666 }
667
668 /* The LTKs and CSRKs should be persistent only if both sides
669 * had the bonding bit set in their authentication requests.
670 */
671 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
672
673 if (smp->csrk) {
674 smp->csrk->bdaddr_type = hcon->dst_type;
675 bacpy(&smp->csrk->bdaddr, &hcon->dst);
676 mgmt_new_csrk(hdev, smp->csrk, persistent);
677 }
678
679 if (smp->slave_csrk) {
680 smp->slave_csrk->bdaddr_type = hcon->dst_type;
681 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
682 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
683 }
684
685 if (smp->ltk) {
686 smp->ltk->bdaddr_type = hcon->dst_type;
687 bacpy(&smp->ltk->bdaddr, &hcon->dst);
688 mgmt_new_ltk(hdev, smp->ltk, persistent);
689 }
690
691 if (smp->slave_ltk) {
692 smp->slave_ltk->bdaddr_type = hcon->dst_type;
693 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
694 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
695 }
696}
697
b28b4943
JH		 698static void smp_allow_key_dist(struct smp_chan *smp)
699{
700 /* Allow the first expected phase 3 PDU. The rest of the PDUs
701 * will be allowed in each PDU handler to ensure we receive
702 * them in the correct order.
703 */
704 if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
705 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
706 else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
707 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
708 else if (smp->remote_key_dist & SMP_DIST_SIGN)
709 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
710}
711
d6268e86 712static void smp_distribute_keys(struct smp_chan *smp)
44f1a7ab
JH		 713{
714 struct smp_cmd_pairing *req, *rsp;
86d1407c 715 struct l2cap_conn *conn = smp->conn;
44f1a7ab
JH		 716 struct hci_conn *hcon = conn->hcon;
717 struct hci_dev *hdev = hcon->hdev;
718 __u8 *keydist;
719
720 BT_DBG("conn %p", conn);
721
44f1a7ab
JH		 722 rsp = (void *) &smp->prsp[1];
723
724 /* The responder sends its keys first */
b28b4943
JH		 725 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
726 smp_allow_key_dist(smp);
86d1407c 727 return;
b28b4943 728 }
44f1a7ab
JH		 729
730 req = (void *) &smp->preq[1];
731
732 if (hcon->out) {
733 keydist = &rsp->init_key_dist;
734 *keydist &= req->init_key_dist;
735 } else {
736 keydist = &rsp->resp_key_dist;
737 *keydist &= req->resp_key_dist;
738 }
739
740 BT_DBG("keydist 0x%x", *keydist);
741
742 if (*keydist & SMP_DIST_ENC_KEY) {
743 struct smp_cmd_encrypt_info enc;
744 struct smp_cmd_master_ident ident;
745 struct smp_ltk *ltk;
746 u8 authenticated;
747 __le16 ediv;
748 __le64 rand;
749
750 get_random_bytes(enc.ltk, sizeof(enc.ltk));
751 get_random_bytes(&ediv, sizeof(ediv));
752 get_random_bytes(&rand, sizeof(rand));
753
754 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
755
756 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
757 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
758 SMP_LTK_SLAVE, authenticated, enc.ltk,
759 smp->enc_key_size, ediv, rand);
760 smp->slave_ltk = ltk;
761
762 ident.ediv = ediv;
763 ident.rand = rand;
764
765 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
766
767 *keydist &= ~SMP_DIST_ENC_KEY;
768 }
769
770 if (*keydist & SMP_DIST_ID_KEY) {
771 struct smp_cmd_ident_addr_info addrinfo;
772 struct smp_cmd_ident_info idinfo;
773
774 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
775
776 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
777
778 /* The hci_conn contains the local identity address
779 * after the connection has been established.
780 *
781 * This is true even when the connection has been
782 * established using a resolvable random address.
783 */
784 bacpy(&addrinfo.bdaddr, &hcon->src);
785 addrinfo.addr_type = hcon->src_type;
786
787 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
788 &addrinfo);
789
790 *keydist &= ~SMP_DIST_ID_KEY;
791 }
792
793 if (*keydist & SMP_DIST_SIGN) {
794 struct smp_cmd_sign_info sign;
795 struct smp_csrk *csrk;
796
797 /* Generate a new random key */
798 get_random_bytes(sign.csrk, sizeof(sign.csrk));
799
800 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
801 if (csrk) {
802 csrk->master = 0x00;
803 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
804 }
805 smp->slave_csrk = csrk;
806
807 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
808
809 *keydist &= ~SMP_DIST_SIGN;
810 }
811
812 /* If there are still keys to be received wait for them */
b28b4943
JH		 813 if (smp->remote_key_dist & KEY_DIST_MASK) {
814 smp_allow_key_dist(smp);
86d1407c 815 return;
b28b4943 816 }
44f1a7ab 817
44f1a7ab
JH		 818 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
819 smp_notify_keys(conn);
820
821 smp_chan_destroy(conn);
44f1a7ab
JH		 822}
823
b68fda68
JH		 824static void smp_timeout(struct work_struct *work)
825{
826 struct smp_chan *smp = container_of(work, struct smp_chan,
827 security_timer.work);
828 struct l2cap_conn *conn = smp->conn;
829
830 BT_DBG("conn %p", conn);
831
1e91c29e 832 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
b68fda68
JH		 833}
834
8aab4757
VCG		 835static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
836{
5d88cc73 837 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 838 struct smp_chan *smp;
839
f1560463 840 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
fc75cc86 841 if (!smp)
8aab4757
VCG		 842 return NULL;
843
6a7bd103
JH		 844 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
845 if (IS_ERR(smp->tfm_aes)) {
846 BT_ERR("Unable to create ECB crypto context");
847 kfree(smp);
848 return NULL;
849 }
850
8aab4757 851 smp->conn = conn;
5d88cc73 852 chan->data = smp;
8aab4757 853
b28b4943
JH		 854 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
855
b68fda68
JH		 856 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
857
8aab4757
VCG		 858 hci_conn_hold(conn->hcon);
859
860 return smp;
861}
862
2b64d153
BG		 863int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
864{
b10e8017 865 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 866 struct l2cap_chan *chan;
2b64d153
BG		 867 struct smp_chan *smp;
868 u32 value;
fc75cc86 869 int err;
2b64d153
BG		 870
871 BT_DBG("");
872
fc75cc86 873 if (!conn)
2b64d153
BG		 874 return -ENOTCONN;
875
5d88cc73
JH		 876 chan = conn->smp;
877 if (!chan)
878 return -ENOTCONN;
879
fc75cc86
JH		 880 l2cap_chan_lock(chan);
881 if (!chan->data) {
882 err = -ENOTCONN;
883 goto unlock;
884 }
885
5d88cc73 886 smp = chan->data;
2b64d153
BG		 887
888 switch (mgmt_op) {
889 case MGMT_OP_USER_PASSKEY_REPLY:
890 value = le32_to_cpu(passkey);
943a732a 891 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 892 BT_DBG("PassKey: %d", value);
943a732a 893 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 894 /* Fall Through */
895 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 896 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 897 break;
898 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
899 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 900 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 901 err = 0;
902 goto unlock;
2b64d153 903 default:
84794e11 904 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 905 err = -EOPNOTSUPP;
906 goto unlock;
2b64d153
BG		 907 }
908
fc75cc86
JH		 909 err = 0;
910
2b64d153 911 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 912 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
913 u8 rsp = smp_confirm(smp);
914 if (rsp)
915 smp_failure(conn, rsp);
916 }
2b64d153 917
fc75cc86
JH		 918unlock:
919 l2cap_chan_unlock(chan);
920 return err;
2b64d153
BG		 921}
922
da85e5e5 923static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 924{
3158c50c 925 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
fc75cc86 926 struct l2cap_chan *chan = conn->smp;
b3c6410b 927 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 928 struct smp_chan *smp;
c7262e71 929 u8 key_size, auth, sec_level;
8aab4757 930 int ret;
88ba43b6
AB		 931
932 BT_DBG("conn %p", conn);
933
c46b98be 934 if (skb->len < sizeof(*req))
38e4a915 935 return SMP_INVALID_PARAMS;
c46b98be 936
40bef302 937 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 938 return SMP_CMD_NOTSUPP;
939
fc75cc86 940 if (!chan->data)
8aab4757 941 smp = smp_chan_create(conn);
fc75cc86 942 else
5d88cc73 943 smp = chan->data;
8aab4757 944
d08fd0e7
AE		 945 if (!smp)
946 return SMP_UNSPECIFIED;
d26a2345 947
c05b9339
JH		 948 /* We didn't start the pairing, so match remote */
949 auth = req->auth_req & AUTH_REQ_MASK;
950
b6ae8457 951 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
c05b9339 952 (auth & SMP_AUTH_BONDING))
b3c6410b
JH		 953 return SMP_PAIRING_NOTSUPP;
954
1c1def09
VCG		 955 smp->preq[0] = SMP_CMD_PAIRING_REQ;
956 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 957 skb_pull(skb, sizeof(*req));
88ba43b6 958
5be5e275 959 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1afc2a1a
JH		 960 sec_level = BT_SECURITY_MEDIUM;
961 else
962 sec_level = authreq_to_seclevel(auth);
963
c7262e71
JH		 964 if (sec_level > conn->hcon->pending_sec_level)
965 conn->hcon->pending_sec_level = sec_level;
fdde0a26 966
2ed8f65c
JH		 967 /* If we need MITM check that it can be acheived */
968 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
969 u8 method;
970
971 method = get_auth_method(smp, conn->hcon->io_capability,
972 req->io_capability);
973 if (method == JUST_WORKS || method == JUST_CFM)
974 return SMP_AUTH_REQUIREMENTS;
975 }
976
2b64d153 977 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 978
979 key_size = min(req->max_key_size, rsp.max_key_size);
980 if (check_enc_key_size(conn, key_size))
981 return SMP_ENC_KEY_SIZE;
88ba43b6 982
e84a6b13 983 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 984
1c1def09
VCG		 985 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
986 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 987
3158c50c 988 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
b28b4943 989 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
da85e5e5 990
2b64d153
BG		 991 /* Request setup of TK */
992 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
993 if (ret)
994 return SMP_UNSPECIFIED;
995
da85e5e5 996 return 0;
88ba43b6
AB		 997}
998
da85e5e5 999static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1000{
3158c50c 1001 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 1002 struct l2cap_chan *chan = conn->smp;
1003 struct smp_chan *smp = chan->data;
3a7dbfb8 1004 u8 key_size, auth;
7d24ddcc 1005 int ret;
88ba43b6
AB		 1006
1007 BT_DBG("conn %p", conn);
1008
c46b98be 1009 if (skb->len < sizeof(*rsp))
38e4a915 1010 return SMP_INVALID_PARAMS;
c46b98be 1011
40bef302 1012 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 1013 return SMP_CMD_NOTSUPP;
1014
3158c50c
VCG		 1015 skb_pull(skb, sizeof(*rsp));
1016
1c1def09 1017 req = (void *) &smp->preq[1];
da85e5e5 1018
3158c50c
VCG		 1019 key_size = min(req->max_key_size, rsp->max_key_size);
1020 if (check_enc_key_size(conn, key_size))
1021 return SMP_ENC_KEY_SIZE;
1022
c05b9339
JH		 1023 auth = rsp->auth_req & AUTH_REQ_MASK;
1024
2ed8f65c
JH		 1025 /* If we need MITM check that it can be acheived */
1026 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1027 u8 method;
1028
1029 method = get_auth_method(smp, req->io_capability,
1030 rsp->io_capability);
1031 if (method == JUST_WORKS || method == JUST_CFM)
1032 return SMP_AUTH_REQUIREMENTS;
1033 }
1034
e84a6b13 1035 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1036
8aab4757
VCG		 1037 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1038 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1039
fdcc4bec
JH		 1040 /* Update remote key distribution in case the remote cleared
1041 * some bits that we had enabled in our request.
1042 */
1043 smp->remote_key_dist &= rsp->resp_key_dist;
1044
c05b9339 1045 auth |= req->auth_req;
2b64d153 1046
476585ec 1047 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1048 if (ret)
1049 return SMP_UNSPECIFIED;
1050
4a74d658 1051 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1052
1053 /* Can't compose response until we have been confirmed */
4a74d658 1054 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1055 return smp_confirm(smp);
da85e5e5
VCG		 1056
1057 return 0;
88ba43b6
AB		 1058}
1059
da85e5e5 1060static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1061{
5d88cc73
JH		 1062 struct l2cap_chan *chan = conn->smp;
1063 struct smp_chan *smp = chan->data;
7d24ddcc 1064
88ba43b6
AB		 1065 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1066
c46b98be 1067 if (skb->len < sizeof(smp->pcnf))
38e4a915 1068 return SMP_INVALID_PARAMS;
c46b98be 1069
1c1def09
VCG		 1070 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1071 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1072
b28b4943 1073 if (conn->hcon->out) {
943a732a
JH		 1074 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1075 smp->prnd);
b28b4943
JH		 1076 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1077 return 0;
1078 }
1079
1080 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1081 return smp_confirm(smp);
943a732a 1082 else
4a74d658 1083 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1084
1085 return 0;
88ba43b6
AB		 1086}
1087
da85e5e5 1088static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1089{
5d88cc73
JH		 1090 struct l2cap_chan *chan = conn->smp;
1091 struct smp_chan *smp = chan->data;
7d24ddcc 1092
8aab4757 1093 BT_DBG("conn %p", conn);
3158c50c 1094
c46b98be 1095 if (skb->len < sizeof(smp->rrnd))
38e4a915 1096 return SMP_INVALID_PARAMS;
c46b98be 1097
943a732a 1098 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1099 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1100
861580a9 1101 return smp_random(smp);
88ba43b6
AB		 1102}
1103
f81cd823 1104static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1105{
c9839a11 1106 struct smp_ltk *key;
988c5997
VCG		 1107 struct hci_conn *hcon = conn->hcon;
1108
98a0b845 1109 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1110 hcon->role);
988c5997 1111 if (!key)
f81cd823 1112 return false;
988c5997 1113
a6f7833c 1114 if (smp_ltk_sec_level(key) < sec_level)
f81cd823 1115 return false;
4dab7864 1116
51a8efd7 1117 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1118 return true;
988c5997 1119
c9839a11
VCG		 1120 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1121 hcon->enc_key_size = key->enc_size;
988c5997 1122
fe59a05f
JH		 1123 /* We never store STKs for master role, so clear this flag */
1124 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1125
f81cd823 1126 return true;
988c5997 1127}
f1560463 1128
854f4727
JH		 1129bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
1130{
1131 if (sec_level == BT_SECURITY_LOW)
1132 return true;
1133
9ab65d60
JH		 1134 /* If we're encrypted with an STK always claim insufficient
1135 * security. This way we allow the connection to be re-encrypted
1136 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 1137 * security. Only exception is if we don't have an LTK (e.g.
1138 * because of key distribution bits).
9ab65d60 1139 */
b2d5e254
JH		 1140 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
1141 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1142 hcon->role))
9ab65d60
JH		 1143 return false;
1144
854f4727
JH		 1145 if (hcon->sec_level >= sec_level)
1146 return true;
1147
1148 return false;
1149}
1150
da85e5e5 1151static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1152{
1153 struct smp_cmd_security_req *rp = (void *) skb->data;
1154 struct smp_cmd_pairing cp;
f1cb9af5 1155 struct hci_conn *hcon = conn->hcon;
8aab4757 1156 struct smp_chan *smp;
c05b9339 1157 u8 sec_level, auth;
88ba43b6
AB		 1158
1159 BT_DBG("conn %p", conn);
1160
c46b98be 1161 if (skb->len < sizeof(*rp))
38e4a915 1162 return SMP_INVALID_PARAMS;
c46b98be 1163
40bef302 1164 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1165 return SMP_CMD_NOTSUPP;
1166
c05b9339
JH		 1167 auth = rp->auth_req & AUTH_REQ_MASK;
1168
5be5e275 1169 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1afc2a1a
JH		 1170 sec_level = BT_SECURITY_MEDIUM;
1171 else
1172 sec_level = authreq_to_seclevel(auth);
1173
854f4727
JH		 1174 if (smp_sufficient_security(hcon, sec_level))
1175 return 0;
1176
c7262e71
JH		 1177 if (sec_level > hcon->pending_sec_level)
1178 hcon->pending_sec_level = sec_level;
feb45eb5 1179
4dab7864 1180 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1181 return 0;
1182
8aab4757 1183 smp = smp_chan_create(conn);
c29d2444
JH		 1184 if (!smp)
1185 return SMP_UNSPECIFIED;
d26a2345 1186
b6ae8457 1187 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
c05b9339 1188 (auth & SMP_AUTH_BONDING))
616d55be
JH		 1189 return SMP_PAIRING_NOTSUPP;
1190
88ba43b6 1191 skb_pull(skb, sizeof(*rp));
88ba43b6 1192
da85e5e5 1193 memset(&cp, 0, sizeof(cp));
c05b9339 1194 build_pairing_cmd(conn, &cp, NULL, auth);
88ba43b6 1195
1c1def09
VCG		 1196 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1197 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1198
88ba43b6 1199 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1200 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
f1cb9af5 1201
da85e5e5 1202 return 0;
88ba43b6
AB		 1203}
1204
cc110922 1205int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1206{
cc110922 1207 struct l2cap_conn *conn = hcon->l2cap_data;
c68b7f12 1208 struct l2cap_chan *chan;
0a66cf20 1209 struct smp_chan *smp;
2b64d153 1210 __u8 authreq;
fc75cc86 1211 int ret;
eb492e01 1212
3a0259bb
VCG		 1213 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1214
0a66cf20
JH		 1215 /* This may be NULL if there's an unexpected disconnection */
1216 if (!conn)
1217 return 1;
1218
c68b7f12
JH		 1219 chan = conn->smp;
1220
757aee0f 1221 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1222 return 1;
1223
ad32a2f5 1224 if (smp_sufficient_security(hcon, sec_level))
eb492e01 1225 return 1;
f1cb9af5 1226
c7262e71
JH		 1227 if (sec_level > hcon->pending_sec_level)
1228 hcon->pending_sec_level = sec_level;
1229
40bef302 1230 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1231 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1232 return 0;
d26a2345 1233
fc75cc86
JH		 1234 l2cap_chan_lock(chan);
1235
1236 /* If SMP is already in progress ignore this request */
1237 if (chan->data) {
1238 ret = 0;
1239 goto unlock;
1240 }
d26a2345 1241
8aab4757 1242 smp = smp_chan_create(conn);
fc75cc86
JH		 1243 if (!smp) {
1244 ret = 1;
1245 goto unlock;
1246 }
2b64d153
BG		 1247
1248 authreq = seclevel_to_authreq(sec_level);
d26a2345 1249
79897d20
JH		 1250 /* Require MITM if IO Capability allows or the security level
1251 * requires it.
2e233644 1252 */
79897d20 1253 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1254 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1255 authreq |= SMP_AUTH_MITM;
1256
40bef302 1257 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1258 struct smp_cmd_pairing cp;
f01ead31 1259
2b64d153 1260 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1261 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1262 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1263
eb492e01 1264 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1265 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
eb492e01
AB		 1266 } else {
1267 struct smp_cmd_security_req cp;
2b64d153 1268 cp.auth_req = authreq;
eb492e01 1269 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
b28b4943 1270 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
eb492e01
AB		 1271 }
1272
4a74d658 1273 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
fc75cc86 1274 ret = 0;
edca792c 1275
fc75cc86
JH		 1276unlock:
1277 l2cap_chan_unlock(chan);
1278 return ret;
eb492e01
AB		 1279}
1280
7034b911
VCG		 1281static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1282{
16b90839 1283 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1284 struct l2cap_chan *chan = conn->smp;
1285 struct smp_chan *smp = chan->data;
16b90839 1286
c46b98be
JH		 1287 BT_DBG("conn %p", conn);
1288
1289 if (skb->len < sizeof(*rp))
38e4a915 1290 return SMP_INVALID_PARAMS;
c46b98be 1291
b28b4943 1292 SMP_ALLOW_CMD(smp, SMP_CMD_MASTER_IDENT);
6131ddc8 1293
16b90839
VCG		 1294 skb_pull(skb, sizeof(*rp));
1295
1c1def09 1296 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1297
7034b911
VCG		 1298 return 0;
1299}
1300
1301static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1302{
16b90839 1303 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1304 struct l2cap_chan *chan = conn->smp;
1305 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1306 struct hci_dev *hdev = conn->hcon->hdev;
1307 struct hci_conn *hcon = conn->hcon;
23d0e128 1308 struct smp_ltk *ltk;
c9839a11 1309 u8 authenticated;
16b90839 1310
c46b98be
JH		 1311 BT_DBG("conn %p", conn);
1312
1313 if (skb->len < sizeof(*rp))
38e4a915 1314 return SMP_INVALID_PARAMS;
c46b98be 1315
9747a9f3
JH		 1316 /* Mark the information as received */
1317 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1318
b28b4943
JH		 1319 if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1320 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
196332f5
JH		 1321 else if (smp->remote_key_dist & SMP_DIST_SIGN)
1322 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
b28b4943 1323
16b90839 1324 skb_pull(skb, sizeof(*rp));
7034b911 1325
c9839a11 1326 hci_dev_lock(hdev);
ce39fb4e 1327 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1328 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1329 authenticated, smp->tk, smp->enc_key_size,
1330 rp->ediv, rp->rand);
1331 smp->ltk = ltk;
c6e81e9a 1332 if (!(smp->remote_key_dist & KEY_DIST_MASK))
d6268e86 1333 smp_distribute_keys(smp);
c9839a11 1334 hci_dev_unlock(hdev);
7034b911
VCG		 1335
1336 return 0;
1337}
1338
fd349c02
JH		 1339static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1340{
1341 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1342 struct l2cap_chan *chan = conn->smp;
1343 struct smp_chan *smp = chan->data;
fd349c02
JH		 1344
1345 BT_DBG("");
1346
1347 if (skb->len < sizeof(*info))
38e4a915 1348 return SMP_INVALID_PARAMS;
fd349c02 1349
b28b4943 1350 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
6131ddc8 1351
fd349c02
JH		 1352 skb_pull(skb, sizeof(*info));
1353
1354 memcpy(smp->irk, info->irk, 16);
1355
1356 return 0;
1357}
1358
1359static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1360 struct sk_buff *skb)
1361{
1362 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1363 struct l2cap_chan *chan = conn->smp;
1364 struct smp_chan *smp = chan->data;
fd349c02
JH		 1365 struct hci_conn *hcon = conn->hcon;
1366 bdaddr_t rpa;
1367
1368 BT_DBG("");
1369
1370 if (skb->len < sizeof(*info))
38e4a915 1371 return SMP_INVALID_PARAMS;
fd349c02 1372
9747a9f3
JH		 1373 /* Mark the information as received */
1374 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1375
b28b4943
JH		 1376 if (smp->remote_key_dist & SMP_DIST_SIGN)
1377 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1378
fd349c02
JH		 1379 skb_pull(skb, sizeof(*info));
1380
31dd624e
JH		 1381 hci_dev_lock(hcon->hdev);
1382
a9a58f86
JH		 1383 /* Strictly speaking the Core Specification (4.1) allows sending
1384 * an empty address which would force us to rely on just the IRK
1385 * as "identity information". However, since such
1386 * implementations are not known of and in order to not over
1387 * complicate our implementation, simply pretend that we never
1388 * received an IRK for such a device.
1389 */
1390 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1391 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1392 goto distribute;
a9a58f86
JH		 1393 }
1394
fd349c02
JH		 1395 bacpy(&smp->id_addr, &info->bdaddr);
1396 smp->id_addr_type = info->addr_type;
1397
1398 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1399 bacpy(&rpa, &hcon->dst);
1400 else
1401 bacpy(&rpa, BDADDR_ANY);
1402
23d0e128
JH		 1403 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1404 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1405
31dd624e 1406distribute:
c6e81e9a
JH		 1407 if (!(smp->remote_key_dist & KEY_DIST_MASK))
1408 smp_distribute_keys(smp);
fd349c02 1409
31dd624e
JH		 1410 hci_dev_unlock(hcon->hdev);
1411
fd349c02
JH		 1412 return 0;
1413}
1414
7ee4ea36
MH		 1415static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1416{
1417 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1418 struct l2cap_chan *chan = conn->smp;
1419 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1420 struct hci_dev *hdev = conn->hcon->hdev;
1421 struct smp_csrk *csrk;
1422
1423 BT_DBG("conn %p", conn);
1424
1425 if (skb->len < sizeof(*rp))
38e4a915 1426 return SMP_INVALID_PARAMS;
7ee4ea36 1427
7ee4ea36
MH		 1428 /* Mark the information as received */
1429 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1430
1431 skb_pull(skb, sizeof(*rp));
1432
1433 hci_dev_lock(hdev);
1434 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1435 if (csrk) {
1436 csrk->master = 0x01;
1437 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1438 }
1439 smp->csrk = csrk;
d6268e86 1440 smp_distribute_keys(smp);
7ee4ea36
MH		 1441 hci_dev_unlock(hdev);
1442
1443 return 0;
1444}
1445
4befb867 1446static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1447{
5d88cc73 1448 struct l2cap_conn *conn = chan->conn;
7b9899db 1449 struct hci_conn *hcon = conn->hcon;
b28b4943 1450 struct smp_chan *smp;
92381f5c 1451 __u8 code, reason;
eb492e01
AB		 1452 int err = 0;
1453
7b9899db
MH		 1454 if (hcon->type != LE_LINK) {
1455 kfree_skb(skb);
3432711f 1456 return 0;
7b9899db
MH		 1457 }
1458
8ae9b984 1459 if (skb->len < 1)
92381f5c 1460 return -EILSEQ;
92381f5c 1461
06ae3314 1462 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1463 reason = SMP_PAIRING_NOTSUPP;
1464 goto done;
1465 }
1466
92381f5c 1467 code = skb->data[0];
eb492e01
AB		 1468 skb_pull(skb, sizeof(code));
1469
b28b4943
JH		 1470 smp = chan->data;
1471
1472 if (code > SMP_CMD_MAX)
1473 goto drop;
1474
24bd0bd9 1475 if (smp && !test_and_clear_bit(code, &smp->allow_cmd))
b28b4943
JH		 1476 goto drop;
1477
1478 /* If we don't have a context the only allowed commands are
1479 * pairing request and security request.
8cf9fa12 1480 */
b28b4943
JH		 1481 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
1482 goto drop;
8cf9fa12 1483
eb492e01
AB		 1484 switch (code) {
1485 case SMP_CMD_PAIRING_REQ:
da85e5e5 1486 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1487 break;
1488
1489 case SMP_CMD_PAIRING_FAIL:
84794e11 1490 smp_failure(conn, 0);
da85e5e5 1491 err = -EPERM;
eb492e01
AB		 1492 break;
1493
1494 case SMP_CMD_PAIRING_RSP:
da85e5e5 1495 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1496 break;
1497
1498 case SMP_CMD_SECURITY_REQ:
da85e5e5 1499 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1500 break;
1501
eb492e01 1502 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1503 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1504 break;
1505
eb492e01 1506 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1507 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1508 break;
1509
eb492e01 1510 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1511 reason = smp_cmd_encrypt_info(conn, skb);
1512 break;
1513
eb492e01 1514 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1515 reason = smp_cmd_master_ident(conn, skb);
1516 break;
1517
eb492e01 1518 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1519 reason = smp_cmd_ident_info(conn, skb);
1520 break;
1521
eb492e01 1522 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1523 reason = smp_cmd_ident_addr_info(conn, skb);
1524 break;
1525
eb492e01 1526 case SMP_CMD_SIGN_INFO:
7ee4ea36 1527 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1528 break;
1529
eb492e01
AB		 1530 default:
1531 BT_DBG("Unknown command code 0x%2.2x", code);
eb492e01 1532 reason = SMP_CMD_NOTSUPP;
3a0259bb 1533 goto done;
eb492e01
AB		 1534 }
1535
3a0259bb 1536done:
9b7b18ef
JH		 1537 if (!err) {
1538 if (reason)
1539 smp_failure(conn, reason);
8ae9b984 1540 kfree_skb(skb);
9b7b18ef
JH		 1541 }
1542
eb492e01 1543 return err;
b28b4943
JH		 1544
1545drop:
1546 BT_ERR("%s unexpected SMP command 0x%02x from %pMR", hcon->hdev->name,
1547 code, &hcon->dst);
1548 kfree_skb(skb);
1549 return 0;
eb492e01 1550}
7034b911 1551
70db83c4
JH		 1552static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1553{
1554 struct l2cap_conn *conn = chan->conn;
1555
1556 BT_DBG("chan %p", chan);
1557
fc75cc86 1558 if (chan->data)
5d88cc73 1559 smp_chan_destroy(conn);
5d88cc73 1560
70db83c4
JH		 1561 conn->smp = NULL;
1562 l2cap_chan_put(chan);
1563}
1564
44f1a7ab
JH		 1565static void smp_resume_cb(struct l2cap_chan *chan)
1566{
b68fda68 1567 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1568 struct l2cap_conn *conn = chan->conn;
1569 struct hci_conn *hcon = conn->hcon;
1570
1571 BT_DBG("chan %p", chan);
1572
86d1407c
JH		 1573 if (!smp)
1574 return;
b68fda68 1575
84bc0db5
JH		 1576 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1577 return;
1578
86d1407c
JH		 1579 cancel_delayed_work(&smp->security_timer);
1580
d6268e86 1581 smp_distribute_keys(smp);
44f1a7ab
JH		 1582}
1583
70db83c4
JH		 1584static void smp_ready_cb(struct l2cap_chan *chan)
1585{
1586 struct l2cap_conn *conn = chan->conn;
1587
1588 BT_DBG("chan %p", chan);
1589
1590 conn->smp = chan;
1591 l2cap_chan_hold(chan);
1592}
1593
4befb867
JH		 1594static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1595{
1596 int err;
1597
1598 BT_DBG("chan %p", chan);
1599
1600 err = smp_sig_channel(chan, skb);
1601 if (err) {
b68fda68 1602 struct smp_chan *smp = chan->data;
4befb867 1603
b68fda68
JH		 1604 if (smp)
1605 cancel_delayed_work_sync(&smp->security_timer);
4befb867 1606
1e91c29e 1607 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
4befb867
JH		 1608 }
1609
1610 return err;
1611}
1612
70db83c4
JH		 1613static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1614 unsigned long hdr_len,
1615 unsigned long len, int nb)
1616{
1617 struct sk_buff *skb;
1618
1619 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1620 if (!skb)
1621 return ERR_PTR(-ENOMEM);
1622
1623 skb->priority = HCI_PRIO_MAX;
1624 bt_cb(skb)->chan = chan;
1625
1626 return skb;
1627}
1628
1629static const struct l2cap_ops smp_chan_ops = {
1630 .name = "Security Manager",
1631 .ready = smp_ready_cb,
5d88cc73 1632 .recv = smp_recv_cb,
70db83c4
JH		 1633 .alloc_skb = smp_alloc_skb_cb,
1634 .teardown = smp_teardown_cb,
44f1a7ab 1635 .resume = smp_resume_cb,
70db83c4
JH		 1636
1637 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1638 .state_change = l2cap_chan_no_state_change,
1639 .close = l2cap_chan_no_close,
1640 .defer = l2cap_chan_no_defer,
1641 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1642 .set_shutdown = l2cap_chan_no_set_shutdown,
1643 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1644 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1645};
1646
1647static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1648{
1649 struct l2cap_chan *chan;
1650
1651 BT_DBG("pchan %p", pchan);
1652
1653 chan = l2cap_chan_create();
1654 if (!chan)
1655 return NULL;
1656
1657 chan->chan_type = pchan->chan_type;
1658 chan->ops = &smp_chan_ops;
1659 chan->scid = pchan->scid;
1660 chan->dcid = chan->scid;
1661 chan->imtu = pchan->imtu;
1662 chan->omtu = pchan->omtu;
1663 chan->mode = pchan->mode;
1664
1665 BT_DBG("created chan %p", chan);
1666
1667 return chan;
1668}
1669
1670static const struct l2cap_ops smp_root_chan_ops = {
1671 .name = "Security Manager Root",
1672 .new_connection = smp_new_conn_cb,
1673
1674 /* None of these are implemented for the root channel */
1675 .close = l2cap_chan_no_close,
1676 .alloc_skb = l2cap_chan_no_alloc_skb,
1677 .recv = l2cap_chan_no_recv,
1678 .state_change = l2cap_chan_no_state_change,
1679 .teardown = l2cap_chan_no_teardown,
1680 .ready = l2cap_chan_no_ready,
1681 .defer = l2cap_chan_no_defer,
1682 .suspend = l2cap_chan_no_suspend,
1683 .resume = l2cap_chan_no_resume,
1684 .set_shutdown = l2cap_chan_no_set_shutdown,
1685 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1686 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1687};
1688
711eafe3
JH		 1689int smp_register(struct hci_dev *hdev)
1690{
70db83c4 1691 struct l2cap_chan *chan;
defce9e8 1692 struct crypto_blkcipher *tfm_aes;
70db83c4 1693
711eafe3
JH		 1694 BT_DBG("%s", hdev->name);
1695
defce9e8
JH		 1696 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1697 if (IS_ERR(tfm_aes)) {
1698 int err = PTR_ERR(tfm_aes);
711eafe3 1699 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1700 return err;
1701 }
1702
70db83c4
JH		 1703 chan = l2cap_chan_create();
1704 if (!chan) {
defce9e8 1705 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1706 return -ENOMEM;
1707 }
1708
defce9e8
JH		 1709 chan->data = tfm_aes;
1710
5d88cc73 1711 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1712
1713 l2cap_chan_set_defaults(chan);
1714
1715 bacpy(&chan->src, &hdev->bdaddr);
1716 chan->src_type = BDADDR_LE_PUBLIC;
1717 chan->state = BT_LISTEN;
1718 chan->mode = L2CAP_MODE_BASIC;
1719 chan->imtu = L2CAP_DEFAULT_MTU;
1720 chan->ops = &smp_root_chan_ops;
1721
1722 hdev->smp_data = chan;
1723
711eafe3
JH		 1724 return 0;
1725}
1726
1727void smp_unregister(struct hci_dev *hdev)
1728{
70db83c4 1729 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1730 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1731
1732 if (!chan)
1733 return;
1734
1735 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1736
defce9e8
JH		 1737 tfm_aes = chan->data;
1738 if (tfm_aes) {
1739 chan->data = NULL;
1740 crypto_free_blkcipher(tfm_aes);
711eafe3 1741 }
70db83c4
JH		 1742
1743 hdev->smp_data = NULL;
1744 l2cap_chan_put(chan);
711eafe3 1745}
Linux kernel - Deliverables
This page took 0.563151 seconds and 5 git commands to generate.