]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/bluetooth/smp.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Use __le64 type for LE random numbers
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
b1e2b3ae
JH		 127int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
128{
129 int err;
130
131 get_random_bytes(&rpa->b[3], 3);
132
133 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
134 rpa->b[5] |= 0x40; /* Set second most significant bit */
135
136 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
137 if (err < 0)
138 return err;
139
140 BT_DBG("RPA %pMR", rpa);
141
142 return 0;
143}
144
d22ef0bc 145static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 146 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
147 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 148{
149 u8 p1[16], p2[16];
150 int err;
151
152 memset(p1, 0, 16);
153
154 /* p1 = pres || preq || _rat || _iat */
155 swap56(pres, p1);
156 swap56(preq, p1 + 7);
157 p1[14] = _rat;
158 p1[15] = _iat;
159
160 memset(p2, 0, 16);
161
162 /* p2 = padding || ia || ra */
163 baswap((bdaddr_t *) (p2 + 4), ia);
164 baswap((bdaddr_t *) (p2 + 10), ra);
165
166 /* res = r XOR p1 */
167 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
168
169 /* res = e(k, res) */
170 err = smp_e(tfm, k, res);
171 if (err) {
172 BT_ERR("Encrypt data error");
173 return err;
174 }
175
176 /* res = res XOR p2 */
177 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
178
179 /* res = e(k, res) */
180 err = smp_e(tfm, k, res);
181 if (err)
182 BT_ERR("Encrypt data error");
183
184 return err;
185}
186
f1560463
MH		 187static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
188 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 189{
190 int err;
191
192 /* Just least significant octets from r1 and r2 are considered */
193 memcpy(_r, r1 + 8, 8);
194 memcpy(_r + 8, r2 + 8, 8);
195
196 err = smp_e(tfm, k, _r);
197 if (err)
198 BT_ERR("Encrypt data error");
199
200 return err;
201}
202
eb492e01 203static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 204 u16 dlen, void *data)
eb492e01
AB		 205{
206 struct sk_buff *skb;
207 struct l2cap_hdr *lh;
208 int len;
209
210 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
211
212 if (len > conn->mtu)
213 return NULL;
214
215 skb = bt_skb_alloc(len, GFP_ATOMIC);
216 if (!skb)
217 return NULL;
218
219 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
220 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 221 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 222
223 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
224
225 memcpy(skb_put(skb, dlen), data, dlen);
226
227 return skb;
228}
229
230static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
231{
232 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
233
234 BT_DBG("code 0x%2.2x", code);
235
236 if (!skb)
237 return;
238
73d80deb
LAD		 239 skb->priority = HCI_PRIO_MAX;
240 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 241
6c9d42a1 242 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 243 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 244}
245
2b64d153
BG		 246static __u8 authreq_to_seclevel(__u8 authreq)
247{
248 if (authreq & SMP_AUTH_MITM)
249 return BT_SECURITY_HIGH;
250 else
251 return BT_SECURITY_MEDIUM;
252}
253
254static __u8 seclevel_to_authreq(__u8 sec_level)
255{
256 switch (sec_level) {
257 case BT_SECURITY_HIGH:
258 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
259 case BT_SECURITY_MEDIUM:
260 return SMP_AUTH_BONDING;
261 default:
262 return SMP_AUTH_NONE;
263 }
264}
265
b8e66eac 266static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 267 struct smp_cmd_pairing *req,
268 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 269{
fd349c02
JH		 270 struct smp_chan *smp = conn->smp_chan;
271 struct hci_conn *hcon = conn->hcon;
272 struct hci_dev *hdev = hcon->hdev;
273 u8 local_dist = 0, remote_dist = 0;
54790f73 274
a8b2d5c2 275 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
fd349c02
JH		 276 local_dist = SMP_DIST_ENC_KEY;
277 remote_dist = SMP_DIST_ENC_KEY;
54790f73 278 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 279 } else {
280 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 281 }
282
fd349c02
JH		 283 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
284 remote_dist |= SMP_DIST_ID_KEY;
285
863efaf2
JH		 286 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
287 local_dist |= SMP_DIST_ID_KEY;
288
54790f73
VCG		 289 if (rsp == NULL) {
290 req->io_capability = conn->hcon->io_capability;
291 req->oob_flag = SMP_OOB_NOT_PRESENT;
292 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 293 req->init_key_dist = local_dist;
294 req->resp_key_dist = remote_dist;
065a13e2 295 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 296
297 smp->remote_key_dist = remote_dist;
54790f73
VCG		 298 return;
299 }
300
301 rsp->io_capability = conn->hcon->io_capability;
302 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
303 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 304 rsp->init_key_dist = req->init_key_dist & remote_dist;
305 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 306 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 307
308 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 309}
310
3158c50c
VCG		 311static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
312{
1c1def09
VCG		 313 struct smp_chan *smp = conn->smp_chan;
314
3158c50c 315 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 316 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 317 return SMP_ENC_KEY_SIZE;
318
f7aa611a 319 smp->enc_key_size = max_key_size;
3158c50c
VCG		 320
321 return 0;
322}
323
84794e11 324static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 325{
bab73cb6
JH		 326 struct hci_conn *hcon = conn->hcon;
327
84794e11 328 if (reason)
4f957a76 329 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 330 &reason);
4f957a76 331
ce39fb4e
MH		 332 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
333 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
334 HCI_ERROR_AUTH_FAILURE);
f1c09c07 335
61a0cfb0
AG		 336 cancel_delayed_work_sync(&conn->security_timer);
337
ce39fb4e 338 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 339 smp_chan_destroy(conn);
4f957a76
BG		 340}
341
2b64d153
BG		 342#define JUST_WORKS 0x00
343#define JUST_CFM 0x01
344#define REQ_PASSKEY 0x02
345#define CFM_PASSKEY 0x03
346#define REQ_OOB 0x04
347#define OVERLAP 0xFF
348
349static const u8 gen_method[5][5] = {
350 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
351 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
352 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
353 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
354 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
355};
356
357static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
358 u8 local_io, u8 remote_io)
359{
360 struct hci_conn *hcon = conn->hcon;
361 struct smp_chan *smp = conn->smp_chan;
362 u8 method;
363 u32 passkey = 0;
364 int ret = 0;
365
366 /* Initialize key for JUST WORKS */
367 memset(smp->tk, 0, sizeof(smp->tk));
368 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
369
370 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
371
372 /* If neither side wants MITM, use JUST WORKS */
373 /* If either side has unknown io_caps, use JUST WORKS */
374 /* Otherwise, look up method from the table */
375 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 376 local_io > SMP_IO_KEYBOARD_DISPLAY ||
377 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 378 method = JUST_WORKS;
379 else
b3ff53ff 380 method = gen_method[remote_io][local_io];
2b64d153
BG		 381
382 /* If not bonding, don't ask user to confirm a Zero TK */
383 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
384 method = JUST_WORKS;
385
386 /* If Just Works, Continue with Zero TK */
387 if (method == JUST_WORKS) {
388 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
389 return 0;
390 }
391
392 /* Not Just Works/Confirm results in MITM Authentication */
393 if (method != JUST_CFM)
394 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
395
396 /* If both devices have Keyoard-Display I/O, the master
397 * Confirms and the slave Enters the passkey.
398 */
399 if (method == OVERLAP) {
400 if (hcon->link_mode & HCI_LM_MASTER)
401 method = CFM_PASSKEY;
402 else
403 method = REQ_PASSKEY;
404 }
405
406 /* Generate random passkey. Not valid until confirmed. */
407 if (method == CFM_PASSKEY) {
408 u8 key[16];
409
410 memset(key, 0, sizeof(key));
411 get_random_bytes(&passkey, sizeof(passkey));
412 passkey %= 1000000;
413 put_unaligned_le32(passkey, key);
414 swap128(key, smp->tk);
415 BT_DBG("PassKey: %d", passkey);
416 }
417
418 hci_dev_lock(hcon->hdev);
419
420 if (method == REQ_PASSKEY)
ce39fb4e 421 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 422 hcon->type, hcon->dst_type);
2b64d153 423 else
ce39fb4e 424 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 425 hcon->type, hcon->dst_type,
2b64d153
BG		 426 cpu_to_le32(passkey), 0);
427
428 hci_dev_unlock(hcon->hdev);
429
430 return ret;
431}
432
8aab4757
VCG		 433static void confirm_work(struct work_struct *work)
434{
435 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
436 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 437 struct hci_dev *hdev = conn->hcon->hdev;
438 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 439 struct smp_cmd_pairing_confirm cp;
440 int ret;
441 u8 res[16], reason;
442
443 BT_DBG("conn %p", conn);
444
893ce8b1
JH		 445 /* Prevent mutual access to hdev->tfm_aes */
446 hci_dev_lock(hdev);
8aab4757
VCG		 447
448 if (conn->hcon->out)
c8462ca6
MH		 449 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
450 conn->hcon->src_type, &conn->hcon->src,
451 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 452 else
453 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 454 conn->hcon->dst_type, &conn->hcon->dst,
455 conn->hcon->src_type, &conn->hcon->src, res);
893ce8b1
JH		 456
457 hci_dev_unlock(hdev);
458
8aab4757
VCG		 459 if (ret) {
460 reason = SMP_UNSPECIFIED;
461 goto error;
462 }
463
2b64d153
BG		 464 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
465
8aab4757
VCG		 466 swap128(res, cp.confirm_val);
467 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
468
469 return;
470
471error:
84794e11 472 smp_failure(conn, reason);
8aab4757
VCG		 473}
474
475static void random_work(struct work_struct *work)
476{
477 struct smp_chan *smp = container_of(work, struct smp_chan, random);
478 struct l2cap_conn *conn = smp->conn;
479 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 480 struct hci_dev *hdev = hcon->hdev;
481 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 482 u8 reason, confirm[16], res[16], key[16];
483 int ret;
484
485 if (IS_ERR_OR_NULL(tfm)) {
486 reason = SMP_UNSPECIFIED;
487 goto error;
488 }
489
490 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
491
893ce8b1
JH		 492 /* Prevent mutual access to hdev->tfm_aes */
493 hci_dev_lock(hdev);
494
8aab4757 495 if (hcon->out)
c8462ca6
MH		 496 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
497 hcon->src_type, &hcon->src,
498 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 499 else
500 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 501 hcon->dst_type, &hcon->dst,
502 hcon->src_type, &hcon->src, res);
893ce8b1
JH		 503
504 hci_dev_unlock(hdev);
505
8aab4757
VCG		 506 if (ret) {
507 reason = SMP_UNSPECIFIED;
508 goto error;
509 }
510
511 swap128(res, confirm);
512
513 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
514 BT_ERR("Pairing failed (confirmation values mismatch)");
515 reason = SMP_CONFIRM_FAILED;
516 goto error;
517 }
518
519 if (hcon->out) {
fe39c7b2
MH		 520 u8 stk[16];
521 __le64 rand = 0;
522 __le16 ediv = 0;
8aab4757
VCG		 523
524 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
525 swap128(key, stk);
526
f7aa611a 527 memset(stk + smp->enc_key_size, 0,
04124681 528 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 529
51a8efd7 530 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 531 reason = SMP_UNSPECIFIED;
532 goto error;
533 }
534
535 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 536 hcon->enc_key_size = smp->enc_key_size;
8aab4757 537 } else {
fe39c7b2
MH		 538 u8 stk[16], r[16];
539 __le64 rand = 0;
540 __le16 ediv = 0;
8aab4757
VCG		 541
542 swap128(smp->prnd, r);
543 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
544
545 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
546 swap128(key, stk);
547
f7aa611a 548 memset(stk + smp->enc_key_size, 0,
f1560463 549 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 550
ce39fb4e 551 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 552 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 553 ediv, rand);
8aab4757
VCG		 554 }
555
556 return;
557
558error:
84794e11 559 smp_failure(conn, reason);
8aab4757
VCG		 560}
561
562static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
563{
564 struct smp_chan *smp;
565
f1560463 566 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 567 if (!smp)
568 return NULL;
569
570 INIT_WORK(&smp->confirm, confirm_work);
571 INIT_WORK(&smp->random, random_work);
572
573 smp->conn = conn;
574 conn->smp_chan = smp;
2b64d153 575 conn->hcon->smp_conn = conn;
8aab4757
VCG		 576
577 hci_conn_hold(conn->hcon);
578
579 return smp;
580}
581
582void smp_chan_destroy(struct l2cap_conn *conn)
583{
c8eb9690 584 struct smp_chan *smp = conn->smp_chan;
f4a407be 585 bool complete;
c8eb9690 586
f1c09c07 587 BUG_ON(!smp);
c8eb9690 588
f4a407be
JH		 589 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
590 mgmt_smp_complete(conn->hcon, complete);
591
c8eb9690
BG		 592 kfree(smp);
593 conn->smp_chan = NULL;
2b64d153 594 conn->hcon->smp_conn = NULL;
76a68ba0 595 hci_conn_drop(conn->hcon);
8aab4757
VCG		 596}
597
2b64d153
BG		 598int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
599{
600 struct l2cap_conn *conn = hcon->smp_conn;
601 struct smp_chan *smp;
602 u32 value;
603 u8 key[16];
604
605 BT_DBG("");
606
607 if (!conn)
608 return -ENOTCONN;
609
610 smp = conn->smp_chan;
611
612 switch (mgmt_op) {
613 case MGMT_OP_USER_PASSKEY_REPLY:
614 value = le32_to_cpu(passkey);
615 memset(key, 0, sizeof(key));
616 BT_DBG("PassKey: %d", value);
617 put_unaligned_le32(value, key);
618 swap128(key, smp->tk);
619 /* Fall Through */
620 case MGMT_OP_USER_CONFIRM_REPLY:
621 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
622 break;
623 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
624 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 625 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 626 return 0;
627 default:
84794e11 628 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 629 return -EOPNOTSUPP;
630 }
631
632 /* If it is our turn to send Pairing Confirm, do so now */
633 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
634 queue_work(hcon->hdev->workqueue, &smp->confirm);
635
636 return 0;
637}
638
da85e5e5 639static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 640{
3158c50c 641 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 642 struct smp_chan *smp;
3158c50c 643 u8 key_size;
2b64d153 644 u8 auth = SMP_AUTH_NONE;
8aab4757 645 int ret;
88ba43b6
AB		 646
647 BT_DBG("conn %p", conn);
648
c46b98be
JH		 649 if (skb->len < sizeof(*req))
650 return SMP_UNSPECIFIED;
651
2b64d153
BG		 652 if (conn->hcon->link_mode & HCI_LM_MASTER)
653 return SMP_CMD_NOTSUPP;
654
51a8efd7 655 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 656 smp = smp_chan_create(conn);
d08fd0e7
AE		 657 else
658 smp = conn->smp_chan;
8aab4757 659
d08fd0e7
AE		 660 if (!smp)
661 return SMP_UNSPECIFIED;
d26a2345 662
1c1def09
VCG		 663 smp->preq[0] = SMP_CMD_PAIRING_REQ;
664 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 665 skb_pull(skb, sizeof(*req));
88ba43b6 666
2b64d153
BG		 667 /* We didn't start the pairing, so match remote */
668 if (req->auth_req & SMP_AUTH_BONDING)
669 auth = req->auth_req;
da85e5e5 670
fdde0a26
IY		 671 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
672
2b64d153 673 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 674
675 key_size = min(req->max_key_size, rsp.max_key_size);
676 if (check_enc_key_size(conn, key_size))
677 return SMP_ENC_KEY_SIZE;
88ba43b6 678
e84a6b13 679 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 680
1c1def09
VCG		 681 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
682 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 683
3158c50c 684 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 685
2b64d153
BG		 686 /* Request setup of TK */
687 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
688 if (ret)
689 return SMP_UNSPECIFIED;
690
da85e5e5 691 return 0;
88ba43b6
AB		 692}
693
da85e5e5 694static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 695{
3158c50c 696 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 697 struct smp_chan *smp = conn->smp_chan;
8aab4757 698 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 699 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 700 int ret;
88ba43b6
AB		 701
702 BT_DBG("conn %p", conn);
703
c46b98be
JH		 704 if (skb->len < sizeof(*rsp))
705 return SMP_UNSPECIFIED;
706
2b64d153
BG		 707 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
708 return SMP_CMD_NOTSUPP;
709
3158c50c
VCG		 710 skb_pull(skb, sizeof(*rsp));
711
1c1def09 712 req = (void *) &smp->preq[1];
da85e5e5 713
3158c50c
VCG		 714 key_size = min(req->max_key_size, rsp->max_key_size);
715 if (check_enc_key_size(conn, key_size))
716 return SMP_ENC_KEY_SIZE;
717
e84a6b13 718 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 719
8aab4757
VCG		 720 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
721 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 722
2b64d153 723 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 724 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 725 auth = SMP_AUTH_BONDING;
726
727 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
728
476585ec 729 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 730 if (ret)
731 return SMP_UNSPECIFIED;
732
733 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
734
735 /* Can't compose response until we have been confirmed */
736 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
737 return 0;
738
8aab4757 739 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 740
741 return 0;
88ba43b6
AB		 742}
743
da85e5e5 744static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 745{
1c1def09 746 struct smp_chan *smp = conn->smp_chan;
8aab4757 747 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 748
88ba43b6
AB		 749 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
750
c46b98be
JH		 751 if (skb->len < sizeof(smp->pcnf))
752 return SMP_UNSPECIFIED;
753
1c1def09
VCG		 754 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
755 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 756
7d24ddcc
AB		 757 if (conn->hcon->out) {
758 u8 random[16];
88ba43b6 759
1c1def09 760 swap128(smp->prnd, random);
88ba43b6 761 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 762 random);
2b64d153 763 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 764 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 765 } else {
766 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 767 }
da85e5e5
VCG		 768
769 return 0;
88ba43b6
AB		 770}
771
da85e5e5 772static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 773{
1c1def09 774 struct smp_chan *smp = conn->smp_chan;
8aab4757 775 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 776
8aab4757 777 BT_DBG("conn %p", conn);
3158c50c 778
c46b98be
JH		 779 if (skb->len < sizeof(smp->rrnd))
780 return SMP_UNSPECIFIED;
781
8aab4757
VCG		 782 swap128(skb->data, smp->rrnd);
783 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 784
8aab4757 785 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 786
787 return 0;
88ba43b6
AB		 788}
789
4dab7864 790static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 791{
c9839a11 792 struct smp_ltk *key;
988c5997
VCG		 793 struct hci_conn *hcon = conn->hcon;
794
98a0b845
JH		 795 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
796 hcon->out);
988c5997
VCG		 797 if (!key)
798 return 0;
799
4dab7864
JH		 800 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
801 return 0;
802
51a8efd7 803 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 804 return 1;
805
c9839a11
VCG		 806 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
807 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 808
809 return 1;
988c5997 810}
f1560463 811
da85e5e5 812static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 813{
814 struct smp_cmd_security_req *rp = (void *) skb->data;
815 struct smp_cmd_pairing cp;
f1cb9af5 816 struct hci_conn *hcon = conn->hcon;
8aab4757 817 struct smp_chan *smp;
88ba43b6
AB		 818
819 BT_DBG("conn %p", conn);
820
c46b98be
JH		 821 if (skb->len < sizeof(*rp))
822 return SMP_UNSPECIFIED;
823
86ca9eac
JH		 824 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
825 return SMP_CMD_NOTSUPP;
826
2b64d153 827 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 828
4dab7864 829 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 830 return 0;
831
51a8efd7 832 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 833 return 0;
f1cb9af5 834
8aab4757 835 smp = smp_chan_create(conn);
d26a2345 836
88ba43b6 837 skb_pull(skb, sizeof(*rp));
88ba43b6 838
da85e5e5 839 memset(&cp, 0, sizeof(cp));
54790f73 840 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 841
1c1def09
VCG		 842 smp->preq[0] = SMP_CMD_PAIRING_REQ;
843 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 844
88ba43b6 845 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 846
da85e5e5 847 return 0;
88ba43b6
AB		 848}
849
ad32a2f5
JH		 850bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
851{
852 if (sec_level == BT_SECURITY_LOW)
853 return true;
854
855 if (hcon->sec_level >= sec_level)
856 return true;
857
858 return false;
859}
860
cc110922 861int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 862{
cc110922 863 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 864 struct smp_chan *smp = conn->smp_chan;
2b64d153 865 __u8 authreq;
eb492e01 866
3a0259bb
VCG		 867 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
868
757aee0f 869 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 870 return 1;
871
ad32a2f5 872 if (smp_sufficient_security(hcon, sec_level))
eb492e01 873 return 1;
f1cb9af5 874
988c5997 875 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 876 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 877 goto done;
d26a2345 878
51a8efd7 879 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 880 return 0;
881
8aab4757 882 smp = smp_chan_create(conn);
2b64d153
BG		 883 if (!smp)
884 return 1;
885
886 authreq = seclevel_to_authreq(sec_level);
d26a2345 887
d26a2345
VCG		 888 if (hcon->link_mode & HCI_LM_MASTER) {
889 struct smp_cmd_pairing cp;
f01ead31 890
2b64d153 891 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 892 smp->preq[0] = SMP_CMD_PAIRING_REQ;
893 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 894
eb492e01
AB		 895 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
896 } else {
897 struct smp_cmd_security_req cp;
2b64d153 898 cp.auth_req = authreq;
eb492e01
AB		 899 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
900 }
901
02bc7455 902done:
f1cb9af5 903 hcon->pending_sec_level = sec_level;
f1cb9af5 904
eb492e01
AB		 905 return 0;
906}
907
7034b911
VCG		 908static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
909{
16b90839 910 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 911 struct smp_chan *smp = conn->smp_chan;
16b90839 912
c46b98be
JH		 913 BT_DBG("conn %p", conn);
914
915 if (skb->len < sizeof(*rp))
916 return SMP_UNSPECIFIED;
917
6131ddc8
JH		 918 /* Ignore this PDU if it wasn't requested */
919 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
920 return 0;
921
16b90839
VCG		 922 skb_pull(skb, sizeof(*rp));
923
1c1def09 924 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 925
7034b911
VCG		 926 return 0;
927}
928
929static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
930{
16b90839 931 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 932 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 933 struct hci_dev *hdev = conn->hcon->hdev;
934 struct hci_conn *hcon = conn->hcon;
23d0e128 935 struct smp_ltk *ltk;
c9839a11 936 u8 authenticated;
16b90839 937
c46b98be
JH		 938 BT_DBG("conn %p", conn);
939
940 if (skb->len < sizeof(*rp))
941 return SMP_UNSPECIFIED;
942
6131ddc8
JH		 943 /* Ignore this PDU if it wasn't requested */
944 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
945 return 0;
946
9747a9f3
JH		 947 /* Mark the information as received */
948 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
949
16b90839 950 skb_pull(skb, sizeof(*rp));
7034b911 951
c9839a11 952 hci_dev_lock(hdev);
ce39fb4e 953 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 954 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 955 authenticated, smp->tk, smp->enc_key_size,
956 rp->ediv, rp->rand);
957 smp->ltk = ltk;
fd349c02 958 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 959 smp_distribute_keys(conn);
c9839a11 960 hci_dev_unlock(hdev);
7034b911
VCG		 961
962 return 0;
963}
964
fd349c02
JH		 965static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
966{
967 struct smp_cmd_ident_info *info = (void *) skb->data;
968 struct smp_chan *smp = conn->smp_chan;
969
970 BT_DBG("");
971
972 if (skb->len < sizeof(*info))
973 return SMP_UNSPECIFIED;
974
6131ddc8
JH		 975 /* Ignore this PDU if it wasn't requested */
976 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
977 return 0;
978
fd349c02
JH		 979 skb_pull(skb, sizeof(*info));
980
981 memcpy(smp->irk, info->irk, 16);
982
983 return 0;
984}
985
986static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
987 struct sk_buff *skb)
988{
989 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
990 struct smp_chan *smp = conn->smp_chan;
991 struct hci_conn *hcon = conn->hcon;
992 bdaddr_t rpa;
993
994 BT_DBG("");
995
996 if (skb->len < sizeof(*info))
997 return SMP_UNSPECIFIED;
998
6131ddc8
JH		 999 /* Ignore this PDU if it wasn't requested */
1000 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1001 return 0;
1002
9747a9f3
JH		 1003 /* Mark the information as received */
1004 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1005
fd349c02
JH		 1006 skb_pull(skb, sizeof(*info));
1007
a9a58f86
JH		 1008 /* Strictly speaking the Core Specification (4.1) allows sending
1009 * an empty address which would force us to rely on just the IRK
1010 * as "identity information". However, since such
1011 * implementations are not known of and in order to not over
1012 * complicate our implementation, simply pretend that we never
1013 * received an IRK for such a device.
1014 */
1015 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1016 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1017 smp_distribute_keys(conn);
a9a58f86
JH		 1018 return 0;
1019 }
1020
fd349c02
JH		 1021 bacpy(&smp->id_addr, &info->bdaddr);
1022 smp->id_addr_type = info->addr_type;
1023
1024 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1025 bacpy(&rpa, &hcon->dst);
1026 else
1027 bacpy(&rpa, BDADDR_ANY);
1028
23d0e128
JH		 1029 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1030 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1031
68d6f6de
JH		 1032 /* Track the connection based on the Identity Address from now on */
1033 bacpy(&hcon->dst, &smp->id_addr);
1034 hcon->dst_type = smp->id_addr_type;
1035
387a33e3
JH		 1036 l2cap_conn_update_id_addr(hcon);
1037
4bd6d38e 1038 smp_distribute_keys(conn);
fd349c02
JH		 1039
1040 return 0;
1041}
1042
eb492e01
AB		 1043int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1044{
7b9899db 1045 struct hci_conn *hcon = conn->hcon;
92381f5c 1046 __u8 code, reason;
eb492e01
AB		 1047 int err = 0;
1048
7b9899db
MH		 1049 if (hcon->type != LE_LINK) {
1050 kfree_skb(skb);
3432711f 1051 return 0;
7b9899db
MH		 1052 }
1053
92381f5c
MH		 1054 if (skb->len < 1) {
1055 kfree_skb(skb);
1056 return -EILSEQ;
1057 }
1058
06ae3314 1059 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1060 err = -ENOTSUPP;
1061 reason = SMP_PAIRING_NOTSUPP;
1062 goto done;
1063 }
1064
92381f5c 1065 code = skb->data[0];
eb492e01
AB		 1066 skb_pull(skb, sizeof(code));
1067
8cf9fa12
JH		 1068 /*
1069 * The SMP context must be initialized for all other PDUs except
1070 * pairing and security requests. If we get any other PDU when
1071 * not initialized simply disconnect (done if this function
1072 * returns an error).
1073 */
1074 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1075 !conn->smp_chan) {
1076 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1077 kfree_skb(skb);
1078 return -ENOTSUPP;
1079 }
1080
eb492e01
AB		 1081 switch (code) {
1082 case SMP_CMD_PAIRING_REQ:
da85e5e5 1083 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1084 break;
1085
1086 case SMP_CMD_PAIRING_FAIL:
84794e11 1087 smp_failure(conn, 0);
da85e5e5
VCG		 1088 reason = 0;
1089 err = -EPERM;
eb492e01
AB		 1090 break;
1091
1092 case SMP_CMD_PAIRING_RSP:
da85e5e5 1093 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1094 break;
1095
1096 case SMP_CMD_SECURITY_REQ:
da85e5e5 1097 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1098 break;
1099
eb492e01 1100 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1101 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1102 break;
1103
eb492e01 1104 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1105 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1106 break;
1107
eb492e01 1108 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1109 reason = smp_cmd_encrypt_info(conn, skb);
1110 break;
1111
eb492e01 1112 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1113 reason = smp_cmd_master_ident(conn, skb);
1114 break;
1115
eb492e01 1116 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1117 reason = smp_cmd_ident_info(conn, skb);
1118 break;
1119
eb492e01 1120 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1121 reason = smp_cmd_ident_addr_info(conn, skb);
1122 break;
1123
eb492e01 1124 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 1125 /* Just ignored */
1126 reason = 0;
1127 break;
1128
eb492e01
AB		 1129 default:
1130 BT_DBG("Unknown command code 0x%2.2x", code);
1131
1132 reason = SMP_CMD_NOTSUPP;
eb492e01 1133 err = -EOPNOTSUPP;
3a0259bb 1134 goto done;
eb492e01
AB		 1135 }
1136
3a0259bb
VCG		 1137done:
1138 if (reason)
84794e11 1139 smp_failure(conn, reason);
3a0259bb 1140
eb492e01
AB		 1141 kfree_skb(skb);
1142 return err;
1143}
7034b911 1144
35d70271
JH		 1145static void smp_notify_keys(struct l2cap_conn *conn)
1146{
1147 struct smp_chan *smp = conn->smp_chan;
1148 struct hci_conn *hcon = conn->hcon;
1149 struct hci_dev *hdev = hcon->hdev;
1150
95fbac8a
JH		 1151 if (smp->remote_irk)
1152 mgmt_new_irk(hdev, smp->remote_irk);
1153
35d70271
JH		 1154 if (smp->ltk) {
1155 smp->ltk->bdaddr_type = hcon->dst_type;
1156 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1157 mgmt_new_ltk(hdev, smp->ltk);
1158 }
1159
1160 if (smp->slave_ltk) {
1161 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1162 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1163 mgmt_new_ltk(hdev, smp->slave_ltk);
1164 }
1165}
1166
4bd6d38e 1167int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1168{
1169 struct smp_cmd_pairing *req, *rsp;
1c1def09 1170 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1171 struct hci_conn *hcon = conn->hcon;
1172 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1173 __u8 *keydist;
1174
4bd6d38e 1175 BT_DBG("conn %p", conn);
7034b911 1176
524237cb 1177 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1178 return 0;
1179
1c1def09 1180 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1181
1182 /* The responder sends its keys first */
efabba37 1183 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1184 return 0;
1185
1c1def09 1186 req = (void *) &smp->preq[1];
7034b911 1187
524237cb 1188 if (hcon->out) {
7034b911
VCG		 1189 keydist = &rsp->init_key_dist;
1190 *keydist &= req->init_key_dist;
1191 } else {
1192 keydist = &rsp->resp_key_dist;
1193 *keydist &= req->resp_key_dist;
1194 }
1195
7034b911
VCG		 1196 BT_DBG("keydist 0x%x", *keydist);
1197
1198 if (*keydist & SMP_DIST_ENC_KEY) {
1199 struct smp_cmd_encrypt_info enc;
1200 struct smp_cmd_master_ident ident;
23d0e128 1201 struct smp_ltk *ltk;
c9839a11 1202 u8 authenticated;
7034b911 1203 __le16 ediv;
fe39c7b2 1204 __le64 rand;
7034b911
VCG		 1205
1206 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1207 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1208 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1209
1210 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1211
c9839a11 1212 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1213 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271 1214 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1215 smp->enc_key_size, ediv, rand);
23d0e128 1216 smp->slave_ltk = ltk;
16b90839 1217
58115373 1218 ident.ediv = ediv;
fe39c7b2 1219 ident.rand = rand;
7034b911
VCG		 1220
1221 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1222
1223 *keydist &= ~SMP_DIST_ENC_KEY;
1224 }
1225
1226 if (*keydist & SMP_DIST_ID_KEY) {
1227 struct smp_cmd_ident_addr_info addrinfo;
1228 struct smp_cmd_ident_info idinfo;
1229
863efaf2 1230 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1231
1232 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1233
82d4b359
JH		 1234 /* The hci_conn contains the local identity address
1235 * after the connection has been established.
1236 *
1237 * This is true even when the connection has been
1238 * established using a resolvable random address.
1239 */
524237cb 1240 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1241 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1242
1243 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1244 &addrinfo);
7034b911
VCG		 1245
1246 *keydist &= ~SMP_DIST_ID_KEY;
1247 }
1248
1249 if (*keydist & SMP_DIST_SIGN) {
1250 struct smp_cmd_sign_info sign;
1251
1252 /* Send a dummy key */
1253 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1254
1255 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1256
1257 *keydist &= ~SMP_DIST_SIGN;
1258 }
1259
efabba37
JH		 1260 /* If there are still keys to be received wait for them */
1261 if ((smp->remote_key_dist & 0x07))
1262 return 0;
1263
1264 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1265 cancel_delayed_work_sync(&conn->security_timer);
1266 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
1267 smp_notify_keys(conn);
1268
1269 smp_chan_destroy(conn);
d26a2345 1270
7034b911
VCG		 1271 return 0;
1272}
ubuntu-bionic-kernel mirror