projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Remove useless smp_rand function
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
56 int err, iv_len;
57 unsigned char iv[128];
58
59 if (tfm == NULL) {
60 BT_ERR("tfm %p", tfm);
61 return -EINVAL;
62 }
63
64 desc.tfm = tfm;
65 desc.flags = 0;
66
67 err = crypto_blkcipher_setkey(tfm, k, 16);
68 if (err) {
69 BT_ERR("cipher setkey failed: %d", err);
70 return err;
71 }
72
73 sg_init_one(&sg, r, 16);
74
75 iv_len = crypto_blkcipher_ivsize(tfm);
76 if (iv_len) {
77 memset(&iv, 0xff, iv_len);
78 crypto_blkcipher_set_iv(tfm, iv, iv_len);
79 }
80
81 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
82 if (err)
83 BT_ERR("Encrypt data error %d", err);
84
85 return err;
86}
87
88static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 89 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
90 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 91{
92 u8 p1[16], p2[16];
93 int err;
94
95 memset(p1, 0, 16);
96
97 /* p1 = pres || preq || _rat || _iat */
98 swap56(pres, p1);
99 swap56(preq, p1 + 7);
100 p1[14] = _rat;
101 p1[15] = _iat;
102
103 memset(p2, 0, 16);
104
105 /* p2 = padding || ia || ra */
106 baswap((bdaddr_t *) (p2 + 4), ia);
107 baswap((bdaddr_t *) (p2 + 10), ra);
108
109 /* res = r XOR p1 */
110 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
111
112 /* res = e(k, res) */
113 err = smp_e(tfm, k, res);
114 if (err) {
115 BT_ERR("Encrypt data error");
116 return err;
117 }
118
119 /* res = res XOR p2 */
120 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
121
122 /* res = e(k, res) */
123 err = smp_e(tfm, k, res);
124 if (err)
125 BT_ERR("Encrypt data error");
126
127 return err;
128}
129
f1560463
MH		 130static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
131 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 132{
133 int err;
134
135 /* Just least significant octets from r1 and r2 are considered */
136 memcpy(_r, r1 + 8, 8);
137 memcpy(_r + 8, r2 + 8, 8);
138
139 err = smp_e(tfm, k, _r);
140 if (err)
141 BT_ERR("Encrypt data error");
142
143 return err;
144}
145
eb492e01 146static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 147 u16 dlen, void *data)
eb492e01
AB		 148{
149 struct sk_buff *skb;
150 struct l2cap_hdr *lh;
151 int len;
152
153 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
154
155 if (len > conn->mtu)
156 return NULL;
157
158 skb = bt_skb_alloc(len, GFP_ATOMIC);
159 if (!skb)
160 return NULL;
161
162 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
163 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 164 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 165
166 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
167
168 memcpy(skb_put(skb, dlen), data, dlen);
169
170 return skb;
171}
172
173static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
174{
175 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
176
177 BT_DBG("code 0x%2.2x", code);
178
179 if (!skb)
180 return;
181
73d80deb
LAD		 182 skb->priority = HCI_PRIO_MAX;
183 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 184
6c9d42a1 185 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 186 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 187}
188
2b64d153
BG		 189static __u8 authreq_to_seclevel(__u8 authreq)
190{
191 if (authreq & SMP_AUTH_MITM)
192 return BT_SECURITY_HIGH;
193 else
194 return BT_SECURITY_MEDIUM;
195}
196
197static __u8 seclevel_to_authreq(__u8 sec_level)
198{
199 switch (sec_level) {
200 case BT_SECURITY_HIGH:
201 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
202 case BT_SECURITY_MEDIUM:
203 return SMP_AUTH_BONDING;
204 default:
205 return SMP_AUTH_NONE;
206 }
207}
208
b8e66eac 209static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 210 struct smp_cmd_pairing *req,
211 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 212{
2b64d153 213 u8 dist_keys = 0;
54790f73 214
a8b2d5c2 215 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
ca10b5ee 216 dist_keys = SMP_DIST_ENC_KEY;
54790f73 217 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 218 } else {
219 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 220 }
221
222 if (rsp == NULL) {
223 req->io_capability = conn->hcon->io_capability;
224 req->oob_flag = SMP_OOB_NOT_PRESENT;
225 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 226 req->init_key_dist = 0;
54790f73 227 req->resp_key_dist = dist_keys;
065a13e2 228 req->auth_req = (authreq & AUTH_REQ_MASK);
54790f73
VCG		 229 return;
230 }
231
232 rsp->io_capability = conn->hcon->io_capability;
233 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
234 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 235 rsp->init_key_dist = 0;
54790f73 236 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
065a13e2 237 rsp->auth_req = (authreq & AUTH_REQ_MASK);
b8e66eac
VCG		 238}
239
3158c50c
VCG		 240static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
241{
1c1def09
VCG		 242 struct smp_chan *smp = conn->smp_chan;
243
3158c50c 244 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 245 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 246 return SMP_ENC_KEY_SIZE;
247
f7aa611a 248 smp->enc_key_size = max_key_size;
3158c50c
VCG		 249
250 return 0;
251}
252
84794e11 253static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 254{
bab73cb6
JH		 255 struct hci_conn *hcon = conn->hcon;
256
84794e11 257 if (reason)
4f957a76 258 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 259 &reason);
4f957a76 260
ce39fb4e
MH		 261 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
262 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
263 HCI_ERROR_AUTH_FAILURE);
f1c09c07 264
61a0cfb0
AG		 265 cancel_delayed_work_sync(&conn->security_timer);
266
ce39fb4e 267 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 268 smp_chan_destroy(conn);
4f957a76
BG		 269}
270
2b64d153
BG		 271#define JUST_WORKS 0x00
272#define JUST_CFM 0x01
273#define REQ_PASSKEY 0x02
274#define CFM_PASSKEY 0x03
275#define REQ_OOB 0x04
276#define OVERLAP 0xFF
277
278static const u8 gen_method[5][5] = {
279 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
280 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
281 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
282 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
283 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
284};
285
286static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
287 u8 local_io, u8 remote_io)
288{
289 struct hci_conn *hcon = conn->hcon;
290 struct smp_chan *smp = conn->smp_chan;
291 u8 method;
292 u32 passkey = 0;
293 int ret = 0;
294
295 /* Initialize key for JUST WORKS */
296 memset(smp->tk, 0, sizeof(smp->tk));
297 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
298
299 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
300
301 /* If neither side wants MITM, use JUST WORKS */
302 /* If either side has unknown io_caps, use JUST WORKS */
303 /* Otherwise, look up method from the table */
304 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 305 local_io > SMP_IO_KEYBOARD_DISPLAY ||
306 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 307 method = JUST_WORKS;
308 else
b3ff53ff 309 method = gen_method[remote_io][local_io];
2b64d153
BG		 310
311 /* If not bonding, don't ask user to confirm a Zero TK */
312 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
313 method = JUST_WORKS;
314
315 /* If Just Works, Continue with Zero TK */
316 if (method == JUST_WORKS) {
317 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
318 return 0;
319 }
320
321 /* Not Just Works/Confirm results in MITM Authentication */
322 if (method != JUST_CFM)
323 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
324
325 /* If both devices have Keyoard-Display I/O, the master
326 * Confirms and the slave Enters the passkey.
327 */
328 if (method == OVERLAP) {
329 if (hcon->link_mode & HCI_LM_MASTER)
330 method = CFM_PASSKEY;
331 else
332 method = REQ_PASSKEY;
333 }
334
335 /* Generate random passkey. Not valid until confirmed. */
336 if (method == CFM_PASSKEY) {
337 u8 key[16];
338
339 memset(key, 0, sizeof(key));
340 get_random_bytes(&passkey, sizeof(passkey));
341 passkey %= 1000000;
342 put_unaligned_le32(passkey, key);
343 swap128(key, smp->tk);
344 BT_DBG("PassKey: %d", passkey);
345 }
346
347 hci_dev_lock(hcon->hdev);
348
349 if (method == REQ_PASSKEY)
ce39fb4e 350 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 351 hcon->type, hcon->dst_type);
2b64d153 352 else
ce39fb4e 353 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 354 hcon->type, hcon->dst_type,
2b64d153
BG		 355 cpu_to_le32(passkey), 0);
356
357 hci_dev_unlock(hcon->hdev);
358
359 return ret;
360}
361
8aab4757
VCG		 362static void confirm_work(struct work_struct *work)
363{
364 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
365 struct l2cap_conn *conn = smp->conn;
366 struct crypto_blkcipher *tfm;
367 struct smp_cmd_pairing_confirm cp;
368 int ret;
369 u8 res[16], reason;
370
371 BT_DBG("conn %p", conn);
372
373 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
374 if (IS_ERR(tfm)) {
375 reason = SMP_UNSPECIFIED;
376 goto error;
377 }
378
379 smp->tfm = tfm;
380
381 if (conn->hcon->out)
c8462ca6
MH		 382 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
383 conn->hcon->src_type, &conn->hcon->src,
384 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 385 else
386 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 387 conn->hcon->dst_type, &conn->hcon->dst,
388 conn->hcon->src_type, &conn->hcon->src, res);
8aab4757
VCG		 389 if (ret) {
390 reason = SMP_UNSPECIFIED;
391 goto error;
392 }
393
2b64d153
BG		 394 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
395
8aab4757
VCG		 396 swap128(res, cp.confirm_val);
397 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
398
399 return;
400
401error:
84794e11 402 smp_failure(conn, reason);
8aab4757
VCG		 403}
404
405static void random_work(struct work_struct *work)
406{
407 struct smp_chan *smp = container_of(work, struct smp_chan, random);
408 struct l2cap_conn *conn = smp->conn;
409 struct hci_conn *hcon = conn->hcon;
410 struct crypto_blkcipher *tfm = smp->tfm;
411 u8 reason, confirm[16], res[16], key[16];
412 int ret;
413
414 if (IS_ERR_OR_NULL(tfm)) {
415 reason = SMP_UNSPECIFIED;
416 goto error;
417 }
418
419 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
420
421 if (hcon->out)
c8462ca6
MH		 422 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
423 hcon->src_type, &hcon->src,
424 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 425 else
426 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 427 hcon->dst_type, &hcon->dst,
428 hcon->src_type, &hcon->src, res);
8aab4757
VCG		 429 if (ret) {
430 reason = SMP_UNSPECIFIED;
431 goto error;
432 }
433
434 swap128(res, confirm);
435
436 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
437 BT_ERR("Pairing failed (confirmation values mismatch)");
438 reason = SMP_CONFIRM_FAILED;
439 goto error;
440 }
441
442 if (hcon->out) {
443 u8 stk[16], rand[8];
444 __le16 ediv;
445
446 memset(rand, 0, sizeof(rand));
447 ediv = 0;
448
449 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
450 swap128(key, stk);
451
f7aa611a 452 memset(stk + smp->enc_key_size, 0,
04124681 453 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 454
51a8efd7 455 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 456 reason = SMP_UNSPECIFIED;
457 goto error;
458 }
459
460 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 461 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 462 } else {
463 u8 stk[16], r[16], rand[8];
464 __le16 ediv;
465
466 memset(rand, 0, sizeof(rand));
467 ediv = 0;
468
469 swap128(smp->prnd, r);
470 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
471
472 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
473 swap128(key, stk);
474
f7aa611a 475 memset(stk + smp->enc_key_size, 0,
f1560463 476 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 477
ce39fb4e 478 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
04124681
GP		 479 HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
480 ediv, rand);
8aab4757
VCG		 481 }
482
483 return;
484
485error:
84794e11 486 smp_failure(conn, reason);
8aab4757
VCG		 487}
488
489static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
490{
491 struct smp_chan *smp;
492
f1560463 493 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 494 if (!smp)
495 return NULL;
496
497 INIT_WORK(&smp->confirm, confirm_work);
498 INIT_WORK(&smp->random, random_work);
499
500 smp->conn = conn;
501 conn->smp_chan = smp;
2b64d153 502 conn->hcon->smp_conn = conn;
8aab4757
VCG		 503
504 hci_conn_hold(conn->hcon);
505
506 return smp;
507}
508
509void smp_chan_destroy(struct l2cap_conn *conn)
510{
c8eb9690
BG		 511 struct smp_chan *smp = conn->smp_chan;
512
f1c09c07 513 BUG_ON(!smp);
c8eb9690
BG		 514
515 if (smp->tfm)
516 crypto_free_blkcipher(smp->tfm);
517
518 kfree(smp);
519 conn->smp_chan = NULL;
2b64d153 520 conn->hcon->smp_conn = NULL;
76a68ba0 521 hci_conn_drop(conn->hcon);
8aab4757
VCG		 522}
523
2b64d153
BG		 524int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
525{
526 struct l2cap_conn *conn = hcon->smp_conn;
527 struct smp_chan *smp;
528 u32 value;
529 u8 key[16];
530
531 BT_DBG("");
532
533 if (!conn)
534 return -ENOTCONN;
535
536 smp = conn->smp_chan;
537
538 switch (mgmt_op) {
539 case MGMT_OP_USER_PASSKEY_REPLY:
540 value = le32_to_cpu(passkey);
541 memset(key, 0, sizeof(key));
542 BT_DBG("PassKey: %d", value);
543 put_unaligned_le32(value, key);
544 swap128(key, smp->tk);
545 /* Fall Through */
546 case MGMT_OP_USER_CONFIRM_REPLY:
547 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
548 break;
549 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
550 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 551 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 552 return 0;
553 default:
84794e11 554 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 555 return -EOPNOTSUPP;
556 }
557
558 /* If it is our turn to send Pairing Confirm, do so now */
559 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
560 queue_work(hcon->hdev->workqueue, &smp->confirm);
561
562 return 0;
563}
564
da85e5e5 565static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 566{
3158c50c 567 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 568 struct smp_chan *smp;
3158c50c 569 u8 key_size;
2b64d153 570 u8 auth = SMP_AUTH_NONE;
8aab4757 571 int ret;
88ba43b6
AB		 572
573 BT_DBG("conn %p", conn);
574
2b64d153
BG		 575 if (conn->hcon->link_mode & HCI_LM_MASTER)
576 return SMP_CMD_NOTSUPP;
577
51a8efd7 578 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 579 smp = smp_chan_create(conn);
d08fd0e7
AE		 580 else
581 smp = conn->smp_chan;
8aab4757 582
d08fd0e7
AE		 583 if (!smp)
584 return SMP_UNSPECIFIED;
d26a2345 585
1c1def09
VCG		 586 smp->preq[0] = SMP_CMD_PAIRING_REQ;
587 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 588 skb_pull(skb, sizeof(*req));
88ba43b6 589
2b64d153
BG		 590 /* We didn't start the pairing, so match remote */
591 if (req->auth_req & SMP_AUTH_BONDING)
592 auth = req->auth_req;
da85e5e5 593
fdde0a26
IY		 594 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
595
2b64d153 596 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 597
598 key_size = min(req->max_key_size, rsp.max_key_size);
599 if (check_enc_key_size(conn, key_size))
600 return SMP_ENC_KEY_SIZE;
88ba43b6 601
e84a6b13 602 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 603
1c1def09
VCG		 604 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
605 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 606
3158c50c 607 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 608
2b64d153
BG		 609 /* Request setup of TK */
610 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
611 if (ret)
612 return SMP_UNSPECIFIED;
613
da85e5e5 614 return 0;
88ba43b6
AB		 615}
616
da85e5e5 617static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 618{
3158c50c 619 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 620 struct smp_chan *smp = conn->smp_chan;
8aab4757 621 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 622 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 623 int ret;
88ba43b6
AB		 624
625 BT_DBG("conn %p", conn);
626
2b64d153
BG		 627 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
628 return SMP_CMD_NOTSUPP;
629
3158c50c
VCG		 630 skb_pull(skb, sizeof(*rsp));
631
1c1def09 632 req = (void *) &smp->preq[1];
da85e5e5 633
3158c50c
VCG		 634 key_size = min(req->max_key_size, rsp->max_key_size);
635 if (check_enc_key_size(conn, key_size))
636 return SMP_ENC_KEY_SIZE;
637
e84a6b13 638 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 639
8aab4757
VCG		 640 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
641 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 642
2b64d153 643 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 644 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 645 auth = SMP_AUTH_BONDING;
646
647 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
648
476585ec 649 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 650 if (ret)
651 return SMP_UNSPECIFIED;
652
653 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
654
655 /* Can't compose response until we have been confirmed */
656 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
657 return 0;
658
8aab4757 659 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 660
661 return 0;
88ba43b6
AB		 662}
663
da85e5e5 664static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 665{
1c1def09 666 struct smp_chan *smp = conn->smp_chan;
8aab4757 667 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 668
88ba43b6
AB		 669 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
670
1c1def09
VCG		 671 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
672 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 673
7d24ddcc
AB		 674 if (conn->hcon->out) {
675 u8 random[16];
88ba43b6 676
1c1def09 677 swap128(smp->prnd, random);
88ba43b6 678 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 679 random);
2b64d153 680 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 681 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 682 } else {
683 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 684 }
da85e5e5
VCG		 685
686 return 0;
88ba43b6
AB		 687}
688
da85e5e5 689static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 690{
1c1def09 691 struct smp_chan *smp = conn->smp_chan;
8aab4757 692 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 693
8aab4757 694 BT_DBG("conn %p", conn);
3158c50c 695
8aab4757
VCG		 696 swap128(skb->data, smp->rrnd);
697 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 698
8aab4757 699 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 700
701 return 0;
88ba43b6
AB		 702}
703
4dab7864 704static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 705{
c9839a11 706 struct smp_ltk *key;
988c5997
VCG		 707 struct hci_conn *hcon = conn->hcon;
708
ce39fb4e 709 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type);
988c5997
VCG		 710 if (!key)
711 return 0;
712
4dab7864
JH		 713 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
714 return 0;
715
51a8efd7 716 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 717 return 1;
718
c9839a11
VCG		 719 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
720 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 721
722 return 1;
988c5997 723}
f1560463 724
da85e5e5 725static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 726{
727 struct smp_cmd_security_req *rp = (void *) skb->data;
728 struct smp_cmd_pairing cp;
f1cb9af5 729 struct hci_conn *hcon = conn->hcon;
8aab4757 730 struct smp_chan *smp;
88ba43b6
AB		 731
732 BT_DBG("conn %p", conn);
733
86ca9eac
JH		 734 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
735 return SMP_CMD_NOTSUPP;
736
2b64d153 737 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 738
4dab7864 739 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 740 return 0;
741
51a8efd7 742 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 743 return 0;
f1cb9af5 744
8aab4757 745 smp = smp_chan_create(conn);
d26a2345 746
88ba43b6 747 skb_pull(skb, sizeof(*rp));
88ba43b6 748
da85e5e5 749 memset(&cp, 0, sizeof(cp));
54790f73 750 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 751
1c1def09
VCG		 752 smp->preq[0] = SMP_CMD_PAIRING_REQ;
753 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 754
88ba43b6 755 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 756
da85e5e5 757 return 0;
88ba43b6
AB		 758}
759
cc110922 760int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 761{
cc110922 762 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 763 struct smp_chan *smp = conn->smp_chan;
2b64d153 764 __u8 authreq;
eb492e01 765
3a0259bb
VCG		 766 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
767
757aee0f 768 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 769 return 1;
770
f1cb9af5
VCG		 771 if (sec_level == BT_SECURITY_LOW)
772 return 1;
eb492e01 773
f1cb9af5 774 if (hcon->sec_level >= sec_level)
eb492e01 775 return 1;
f1cb9af5 776
988c5997 777 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 778 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 779 goto done;
d26a2345 780
51a8efd7 781 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 782 return 0;
783
8aab4757 784 smp = smp_chan_create(conn);
2b64d153
BG		 785 if (!smp)
786 return 1;
787
788 authreq = seclevel_to_authreq(sec_level);
d26a2345 789
d26a2345
VCG		 790 if (hcon->link_mode & HCI_LM_MASTER) {
791 struct smp_cmd_pairing cp;
f01ead31 792
2b64d153 793 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 794 smp->preq[0] = SMP_CMD_PAIRING_REQ;
795 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 796
eb492e01
AB		 797 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
798 } else {
799 struct smp_cmd_security_req cp;
2b64d153 800 cp.auth_req = authreq;
eb492e01
AB		 801 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
802 }
803
02bc7455 804done:
f1cb9af5 805 hcon->pending_sec_level = sec_level;
f1cb9af5 806
eb492e01
AB		 807 return 0;
808}
809
7034b911
VCG		 810static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
811{
16b90839 812 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 813 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 814
815 skb_pull(skb, sizeof(*rp));
816
1c1def09 817 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 818
7034b911
VCG		 819 return 0;
820}
821
822static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
823{
16b90839 824 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 825 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 826 struct hci_dev *hdev = conn->hcon->hdev;
827 struct hci_conn *hcon = conn->hcon;
828 u8 authenticated;
16b90839
VCG		 829
830 skb_pull(skb, sizeof(*rp));
7034b911 831
c9839a11 832 hci_dev_lock(hdev);
ce39fb4e
MH		 833 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
834 hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK, 1,
835 authenticated, smp->tk, smp->enc_key_size,
04124681 836 rp->ediv, rp->rand);
7034b911 837 smp_distribute_keys(conn, 1);
c9839a11 838 hci_dev_unlock(hdev);
7034b911
VCG		 839
840 return 0;
841}
842
eb492e01
AB		 843int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
844{
7b9899db 845 struct hci_conn *hcon = conn->hcon;
92381f5c 846 __u8 code, reason;
eb492e01
AB		 847 int err = 0;
848
7b9899db
MH		 849 if (hcon->type != LE_LINK) {
850 kfree_skb(skb);
3432711f 851 return 0;
7b9899db
MH		 852 }
853
92381f5c
MH		 854 if (skb->len < 1) {
855 kfree_skb(skb);
856 return -EILSEQ;
857 }
858
06ae3314 859 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 860 err = -ENOTSUPP;
861 reason = SMP_PAIRING_NOTSUPP;
862 goto done;
863 }
864
92381f5c 865 code = skb->data[0];
eb492e01
AB		 866 skb_pull(skb, sizeof(code));
867
8cf9fa12
JH		 868 /*
869 * The SMP context must be initialized for all other PDUs except
870 * pairing and security requests. If we get any other PDU when
871 * not initialized simply disconnect (done if this function
872 * returns an error).
873 */
874 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
875 !conn->smp_chan) {
876 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
877 kfree_skb(skb);
878 return -ENOTSUPP;
879 }
880
eb492e01
AB		 881 switch (code) {
882 case SMP_CMD_PAIRING_REQ:
da85e5e5 883 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 884 break;
885
886 case SMP_CMD_PAIRING_FAIL:
84794e11 887 smp_failure(conn, 0);
da85e5e5
VCG		 888 reason = 0;
889 err = -EPERM;
eb492e01
AB		 890 break;
891
892 case SMP_CMD_PAIRING_RSP:
da85e5e5 893 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 894 break;
895
896 case SMP_CMD_SECURITY_REQ:
da85e5e5 897 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 898 break;
899
eb492e01 900 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 901 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 902 break;
903
eb492e01 904 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 905 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 906 break;
907
eb492e01 908 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 909 reason = smp_cmd_encrypt_info(conn, skb);
910 break;
911
eb492e01 912 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 913 reason = smp_cmd_master_ident(conn, skb);
914 break;
915
eb492e01
AB		 916 case SMP_CMD_IDENT_INFO:
917 case SMP_CMD_IDENT_ADDR_INFO:
918 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 919 /* Just ignored */
920 reason = 0;
921 break;
922
eb492e01
AB		 923 default:
924 BT_DBG("Unknown command code 0x%2.2x", code);
925
926 reason = SMP_CMD_NOTSUPP;
eb492e01 927 err = -EOPNOTSUPP;
3a0259bb 928 goto done;
eb492e01
AB		 929 }
930
3a0259bb
VCG		 931done:
932 if (reason)
84794e11 933 smp_failure(conn, reason);
3a0259bb 934
eb492e01
AB		 935 kfree_skb(skb);
936 return err;
937}
7034b911
VCG		 938
939int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
940{
941 struct smp_cmd_pairing *req, *rsp;
1c1def09 942 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 943 __u8 *keydist;
944
945 BT_DBG("conn %p force %d", conn, force);
946
51a8efd7 947 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
d26a2345
VCG		 948 return 0;
949
1c1def09 950 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 951
952 /* The responder sends its keys first */
953 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
954 return 0;
955
1c1def09 956 req = (void *) &smp->preq[1];
7034b911
VCG		 957
958 if (conn->hcon->out) {
959 keydist = &rsp->init_key_dist;
960 *keydist &= req->init_key_dist;
961 } else {
962 keydist = &rsp->resp_key_dist;
963 *keydist &= req->resp_key_dist;
964 }
965
966
967 BT_DBG("keydist 0x%x", *keydist);
968
969 if (*keydist & SMP_DIST_ENC_KEY) {
970 struct smp_cmd_encrypt_info enc;
971 struct smp_cmd_master_ident ident;
c9839a11
VCG		 972 struct hci_conn *hcon = conn->hcon;
973 u8 authenticated;
7034b911
VCG		 974 __le16 ediv;
975
976 get_random_bytes(enc.ltk, sizeof(enc.ltk));
977 get_random_bytes(&ediv, sizeof(ediv));
978 get_random_bytes(ident.rand, sizeof(ident.rand));
979
980 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
981
c9839a11 982 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
ce39fb4e 983 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
04124681
GP		 984 HCI_SMP_LTK_SLAVE, 1, authenticated,
985 enc.ltk, smp->enc_key_size, ediv, ident.rand);
16b90839 986
58115373 987 ident.ediv = ediv;
7034b911
VCG		 988
989 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
990
991 *keydist &= ~SMP_DIST_ENC_KEY;
992 }
993
994 if (*keydist & SMP_DIST_ID_KEY) {
995 struct smp_cmd_ident_addr_info addrinfo;
996 struct smp_cmd_ident_info idinfo;
997
998 /* Send a dummy key */
999 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
1000
1001 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1002
1003 /* Just public address */
1004 memset(&addrinfo, 0, sizeof(addrinfo));
2b36a562 1005 bacpy(&addrinfo.bdaddr, &conn->hcon->src);
7034b911
VCG		 1006
1007 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1008 &addrinfo);
7034b911
VCG		 1009
1010 *keydist &= ~SMP_DIST_ID_KEY;
1011 }
1012
1013 if (*keydist & SMP_DIST_SIGN) {
1014 struct smp_cmd_sign_info sign;
1015
1016 /* Send a dummy key */
1017 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1018
1019 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1020
1021 *keydist &= ~SMP_DIST_SIGN;
1022 }
1023
d26a2345 1024 if (conn->hcon->out || force) {
51a8efd7 1025 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6c9d42a1 1026 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1027 smp_chan_destroy(conn);
d26a2345
VCG		 1028 }
1029
7034b911
VCG		 1030 return 0;
1031}
Linux kernel - Deliverables
This page took 0.401461 seconds and 5 git commands to generate.