2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
23 #include <linux/debugfs.h>
24 #include <linux/scatterlist.h>
25 #include <linux/crypto.h>
26 #include <crypto/algapi.h>
27 #include <crypto/b128ops.h>
28 #include <crypto/hash.h>
29 #include <crypto/kpp.h>
31 #include <net/bluetooth/bluetooth.h>
32 #include <net/bluetooth/hci_core.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
36 #include "ecdh_helper.h"
39 #define SMP_DEV(hdev) \
40 ((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data)
42 /* Low-level debug macros to be used for stuff that we don't want
43 * accidentially in dmesg, i.e. the values of the various crypto keys
44 * and the inputs & outputs of crypto functions.
47 #define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \
50 #define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \
54 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
56 /* Keys which are not distributed with Secure Connections */
57 #define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY);
59 #define SMP_TIMEOUT msecs_to_jiffies(30000)
61 #define AUTH_REQ_MASK(dev) (hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \
63 #define KEY_DIST_MASK 0x07
65 /* Maximum message length that can be passed to aes_cmac */
66 #define CMAC_MSG_MAX 80
78 SMP_FLAG_DHKEY_PENDING
,
85 /* Secure Connections OOB data */
94 struct crypto_cipher
*tfm_aes
;
95 struct crypto_shash
*tfm_cmac
;
96 struct crypto_kpp
*tfm_ecdh
;
100 struct l2cap_conn
*conn
;
101 struct delayed_work security_timer
;
102 unsigned long allow_cmd
; /* Bitmask of allowed commands */
104 u8 preq
[7]; /* SMP Pairing Request */
105 u8 prsp
[7]; /* SMP Pairing Response */
106 u8 prnd
[16]; /* SMP Pairing Random (local) */
107 u8 rrnd
[16]; /* SMP Pairing Random (remote) */
108 u8 pcnf
[16]; /* SMP Pairing Confirm */
109 u8 tk
[16]; /* SMP Temporary Key */
110 u8 rr
[16]; /* Remote OOB ra/rb value */
111 u8 lr
[16]; /* Local OOB ra/rb value */
117 struct smp_csrk
*csrk
;
118 struct smp_csrk
*slave_csrk
;
120 struct smp_ltk
*slave_ltk
;
121 struct smp_irk
*remote_irk
;
127 /* Secure Connections variables */
133 struct crypto_cipher
*tfm_aes
;
134 struct crypto_shash
*tfm_cmac
;
135 struct crypto_kpp
*tfm_ecdh
;
138 /* These debug key values are defined in the SMP section of the core
139 * specification. debug_pk is the public debug key and debug_sk the
142 static const u8 debug_pk
[64] = {
143 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
144 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
145 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
146 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20,
148 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74,
149 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
150 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63,
151 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc,
154 static const u8 debug_sk
[32] = {
155 0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58,
156 0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a,
157 0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74,
158 0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f,
161 static inline void swap_buf(const u8
*src
, u8
*dst
, size_t len
)
165 for (i
= 0; i
< len
; i
++)
166 dst
[len
- 1 - i
] = src
[i
];
169 /* The following functions map to the LE SC SMP crypto functions
170 * AES-CMAC, f4, f5, f6, g2 and h6.
173 static int aes_cmac(struct crypto_shash
*tfm
, const u8 k
[16], const u8
*m
,
174 size_t len
, u8 mac
[16])
176 uint8_t tmp
[16], mac_msb
[16], msg_msb
[CMAC_MSG_MAX
];
177 SHASH_DESC_ON_STACK(desc
, tfm
);
180 if (len
> CMAC_MSG_MAX
)
184 BT_ERR("tfm %p", tfm
);
191 /* Swap key and message from LSB to MSB */
192 swap_buf(k
, tmp
, 16);
193 swap_buf(m
, msg_msb
, len
);
195 SMP_DBG("msg (len %zu) %*phN", len
, (int) len
, m
);
196 SMP_DBG("key %16phN", k
);
198 err
= crypto_shash_setkey(tfm
, tmp
, 16);
200 BT_ERR("cipher setkey failed: %d", err
);
204 err
= crypto_shash_digest(desc
, msg_msb
, len
, mac_msb
);
205 shash_desc_zero(desc
);
207 BT_ERR("Hash computation error %d", err
);
211 swap_buf(mac_msb
, mac
, 16);
213 SMP_DBG("mac %16phN", mac
);
218 static int smp_f4(struct crypto_shash
*tfm_cmac
, const u8 u
[32],
219 const u8 v
[32], const u8 x
[16], u8 z
, u8 res
[16])
224 SMP_DBG("u %32phN", u
);
225 SMP_DBG("v %32phN", v
);
226 SMP_DBG("x %16phN z %02x", x
, z
);
229 memcpy(m
+ 1, v
, 32);
230 memcpy(m
+ 33, u
, 32);
232 err
= aes_cmac(tfm_cmac
, x
, m
, sizeof(m
), res
);
236 SMP_DBG("res %16phN", res
);
241 static int smp_f5(struct crypto_shash
*tfm_cmac
, const u8 w
[32],
242 const u8 n1
[16], const u8 n2
[16], const u8 a1
[7],
243 const u8 a2
[7], u8 mackey
[16], u8 ltk
[16])
245 /* The btle, salt and length "magic" values are as defined in
246 * the SMP section of the Bluetooth core specification. In ASCII
247 * the btle value ends up being 'btle'. The salt is just a
248 * random number whereas length is the value 256 in little
251 const u8 btle
[4] = { 0x65, 0x6c, 0x74, 0x62 };
252 const u8 salt
[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60,
253 0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c };
254 const u8 length
[2] = { 0x00, 0x01 };
258 SMP_DBG("w %32phN", w
);
259 SMP_DBG("n1 %16phN n2 %16phN", n1
, n2
);
260 SMP_DBG("a1 %7phN a2 %7phN", a1
, a2
);
262 err
= aes_cmac(tfm_cmac
, salt
, w
, 32, t
);
266 SMP_DBG("t %16phN", t
);
268 memcpy(m
, length
, 2);
269 memcpy(m
+ 2, a2
, 7);
270 memcpy(m
+ 9, a1
, 7);
271 memcpy(m
+ 16, n2
, 16);
272 memcpy(m
+ 32, n1
, 16);
273 memcpy(m
+ 48, btle
, 4);
275 m
[52] = 0; /* Counter */
277 err
= aes_cmac(tfm_cmac
, t
, m
, sizeof(m
), mackey
);
281 SMP_DBG("mackey %16phN", mackey
);
283 m
[52] = 1; /* Counter */
285 err
= aes_cmac(tfm_cmac
, t
, m
, sizeof(m
), ltk
);
289 SMP_DBG("ltk %16phN", ltk
);
294 static int smp_f6(struct crypto_shash
*tfm_cmac
, const u8 w
[16],
295 const u8 n1
[16], const u8 n2
[16], const u8 r
[16],
296 const u8 io_cap
[3], const u8 a1
[7], const u8 a2
[7],
302 SMP_DBG("w %16phN", w
);
303 SMP_DBG("n1 %16phN n2 %16phN", n1
, n2
);
304 SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r
, io_cap
, a1
, a2
);
307 memcpy(m
+ 7, a1
, 7);
308 memcpy(m
+ 14, io_cap
, 3);
309 memcpy(m
+ 17, r
, 16);
310 memcpy(m
+ 33, n2
, 16);
311 memcpy(m
+ 49, n1
, 16);
313 err
= aes_cmac(tfm_cmac
, w
, m
, sizeof(m
), res
);
317 SMP_DBG("res %16phN", res
);
322 static int smp_g2(struct crypto_shash
*tfm_cmac
, const u8 u
[32], const u8 v
[32],
323 const u8 x
[16], const u8 y
[16], u32
*val
)
328 SMP_DBG("u %32phN", u
);
329 SMP_DBG("v %32phN", v
);
330 SMP_DBG("x %16phN y %16phN", x
, y
);
333 memcpy(m
+ 16, v
, 32);
334 memcpy(m
+ 48, u
, 32);
336 err
= aes_cmac(tfm_cmac
, x
, m
, sizeof(m
), tmp
);
340 *val
= get_unaligned_le32(tmp
);
343 SMP_DBG("val %06u", *val
);
348 static int smp_h6(struct crypto_shash
*tfm_cmac
, const u8 w
[16],
349 const u8 key_id
[4], u8 res
[16])
353 SMP_DBG("w %16phN key_id %4phN", w
, key_id
);
355 err
= aes_cmac(tfm_cmac
, w
, key_id
, 4, res
);
359 SMP_DBG("res %16phN", res
);
364 static int smp_h7(struct crypto_shash
*tfm_cmac
, const u8 w
[16],
365 const u8 salt
[16], u8 res
[16])
369 SMP_DBG("w %16phN salt %16phN", w
, salt
);
371 err
= aes_cmac(tfm_cmac
, salt
, w
, 16, res
);
375 SMP_DBG("res %16phN", res
);
380 /* The following functions map to the legacy SMP crypto functions e, c1,
384 static int smp_e(struct crypto_cipher
*tfm
, const u8
*k
, u8
*r
)
386 uint8_t tmp
[16], data
[16];
389 SMP_DBG("k %16phN r %16phN", k
, r
);
392 BT_ERR("tfm %p", tfm
);
396 /* The most significant octet of key corresponds to k[0] */
397 swap_buf(k
, tmp
, 16);
399 err
= crypto_cipher_setkey(tfm
, tmp
, 16);
401 BT_ERR("cipher setkey failed: %d", err
);
405 /* Most significant octet of plaintextData corresponds to data[0] */
406 swap_buf(r
, data
, 16);
408 crypto_cipher_encrypt_one(tfm
, data
, data
);
410 /* Most significant octet of encryptedData corresponds to data[0] */
411 swap_buf(data
, r
, 16);
413 SMP_DBG("r %16phN", r
);
418 static int smp_c1(struct crypto_cipher
*tfm_aes
, const u8 k
[16],
419 const u8 r
[16], const u8 preq
[7], const u8 pres
[7], u8 _iat
,
420 const bdaddr_t
*ia
, u8 _rat
, const bdaddr_t
*ra
, u8 res
[16])
425 SMP_DBG("k %16phN r %16phN", k
, r
);
426 SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat
, ia
, _rat
, ra
);
427 SMP_DBG("preq %7phN pres %7phN", preq
, pres
);
431 /* p1 = pres || preq || _rat || _iat */
434 memcpy(p1
+ 2, preq
, 7);
435 memcpy(p1
+ 9, pres
, 7);
437 SMP_DBG("p1 %16phN", p1
);
440 u128_xor((u128
*) res
, (u128
*) r
, (u128
*) p1
);
442 /* res = e(k, res) */
443 err
= smp_e(tfm_aes
, k
, res
);
445 BT_ERR("Encrypt data error");
449 /* p2 = padding || ia || ra */
451 memcpy(p2
+ 6, ia
, 6);
452 memset(p2
+ 12, 0, 4);
454 SMP_DBG("p2 %16phN", p2
);
456 /* res = res XOR p2 */
457 u128_xor((u128
*) res
, (u128
*) res
, (u128
*) p2
);
459 /* res = e(k, res) */
460 err
= smp_e(tfm_aes
, k
, res
);
462 BT_ERR("Encrypt data error");
467 static int smp_s1(struct crypto_cipher
*tfm_aes
, const u8 k
[16],
468 const u8 r1
[16], const u8 r2
[16], u8 _r
[16])
472 /* Just least significant octets from r1 and r2 are considered */
474 memcpy(_r
+ 8, r1
, 8);
476 err
= smp_e(tfm_aes
, k
, _r
);
478 BT_ERR("Encrypt data error");
483 static int smp_ah(struct crypto_cipher
*tfm
, const u8 irk
[16],
484 const u8 r
[3], u8 res
[3])
489 /* r' = padding || r */
491 memset(_res
+ 3, 0, 13);
493 err
= smp_e(tfm
, irk
, _res
);
495 BT_ERR("Encrypt error");
499 /* The output of the random address function ah is:
500 * ah(k, r) = e(k, r') mod 2^24
501 * The output of the security function e is then truncated to 24 bits
502 * by taking the least significant 24 bits of the output of e as the
505 memcpy(res
, _res
, 3);
510 bool smp_irk_matches(struct hci_dev
*hdev
, const u8 irk
[16],
511 const bdaddr_t
*bdaddr
)
513 struct l2cap_chan
*chan
= hdev
->smp_data
;
518 if (!chan
|| !chan
->data
)
523 BT_DBG("RPA %pMR IRK %*phN", bdaddr
, 16, irk
);
525 err
= smp_ah(smp
->tfm_aes
, irk
, &bdaddr
->b
[3], hash
);
529 return !crypto_memneq(bdaddr
->b
, hash
, 3);
532 int smp_generate_rpa(struct hci_dev
*hdev
, const u8 irk
[16], bdaddr_t
*rpa
)
534 struct l2cap_chan
*chan
= hdev
->smp_data
;
538 if (!chan
|| !chan
->data
)
543 get_random_bytes(&rpa
->b
[3], 3);
545 rpa
->b
[5] &= 0x3f; /* Clear two most significant bits */
546 rpa
->b
[5] |= 0x40; /* Set second most significant bit */
548 err
= smp_ah(smp
->tfm_aes
, irk
, &rpa
->b
[3], rpa
->b
);
552 BT_DBG("RPA %pMR", rpa
);
557 int smp_generate_oob(struct hci_dev
*hdev
, u8 hash
[16], u8 rand
[16])
559 struct l2cap_chan
*chan
= hdev
->smp_data
;
563 if (!chan
|| !chan
->data
)
568 if (hci_dev_test_flag(hdev
, HCI_USE_DEBUG_KEYS
)) {
569 BT_DBG("Using debug keys");
570 err
= set_ecdh_privkey(smp
->tfm_ecdh
, debug_sk
);
573 memcpy(smp
->local_pk
, debug_pk
, 64);
574 smp
->debug_key
= true;
577 /* Generate key pair for Secure Connections */
578 err
= generate_ecdh_keys(smp
->tfm_ecdh
, smp
->local_pk
);
582 /* This is unlikely, but we need to check that
583 * we didn't accidentially generate a debug key.
585 if (crypto_memneq(smp
->local_pk
, debug_pk
, 64))
588 smp
->debug_key
= false;
591 SMP_DBG("OOB Public Key X: %32phN", smp
->local_pk
);
592 SMP_DBG("OOB Public Key Y: %32phN", smp
->local_pk
+ 32);
594 get_random_bytes(smp
->local_rand
, 16);
596 err
= smp_f4(smp
->tfm_cmac
, smp
->local_pk
, smp
->local_pk
,
597 smp
->local_rand
, 0, hash
);
601 memcpy(rand
, smp
->local_rand
, 16);
603 smp
->local_oob
= true;
608 static void smp_send_cmd(struct l2cap_conn
*conn
, u8 code
, u16 len
, void *data
)
610 struct l2cap_chan
*chan
= conn
->smp
;
611 struct smp_chan
*smp
;
618 BT_DBG("code 0x%2.2x", code
);
620 iv
[0].iov_base
= &code
;
623 iv
[1].iov_base
= data
;
626 memset(&msg
, 0, sizeof(msg
));
628 iov_iter_kvec(&msg
.msg_iter
, WRITE
| ITER_KVEC
, iv
, 2, 1 + len
);
630 l2cap_chan_send(chan
, &msg
, 1 + len
);
637 cancel_delayed_work_sync(&smp
->security_timer
);
638 schedule_delayed_work(&smp
->security_timer
, SMP_TIMEOUT
);
641 static u8
authreq_to_seclevel(u8 authreq
)
643 if (authreq
& SMP_AUTH_MITM
) {
644 if (authreq
& SMP_AUTH_SC
)
645 return BT_SECURITY_FIPS
;
647 return BT_SECURITY_HIGH
;
649 return BT_SECURITY_MEDIUM
;
653 static __u8
seclevel_to_authreq(__u8 sec_level
)
656 case BT_SECURITY_FIPS
:
657 case BT_SECURITY_HIGH
:
658 return SMP_AUTH_MITM
| SMP_AUTH_BONDING
;
659 case BT_SECURITY_MEDIUM
:
660 return SMP_AUTH_BONDING
;
662 return SMP_AUTH_NONE
;
666 static void build_pairing_cmd(struct l2cap_conn
*conn
,
667 struct smp_cmd_pairing
*req
,
668 struct smp_cmd_pairing
*rsp
, __u8 authreq
)
670 struct l2cap_chan
*chan
= conn
->smp
;
671 struct smp_chan
*smp
= chan
->data
;
672 struct hci_conn
*hcon
= conn
->hcon
;
673 struct hci_dev
*hdev
= hcon
->hdev
;
674 u8 local_dist
= 0, remote_dist
= 0, oob_flag
= SMP_OOB_NOT_PRESENT
;
676 if (hci_dev_test_flag(hdev
, HCI_BONDABLE
)) {
677 local_dist
= SMP_DIST_ENC_KEY
| SMP_DIST_SIGN
;
678 remote_dist
= SMP_DIST_ENC_KEY
| SMP_DIST_SIGN
;
679 authreq
|= SMP_AUTH_BONDING
;
681 authreq
&= ~SMP_AUTH_BONDING
;
684 if (hci_dev_test_flag(hdev
, HCI_RPA_RESOLVING
))
685 remote_dist
|= SMP_DIST_ID_KEY
;
687 if (hci_dev_test_flag(hdev
, HCI_PRIVACY
))
688 local_dist
|= SMP_DIST_ID_KEY
;
690 if (hci_dev_test_flag(hdev
, HCI_SC_ENABLED
) &&
691 (authreq
& SMP_AUTH_SC
)) {
692 struct oob_data
*oob_data
;
695 if (hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
)) {
696 local_dist
|= SMP_DIST_LINK_KEY
;
697 remote_dist
|= SMP_DIST_LINK_KEY
;
700 if (hcon
->dst_type
== ADDR_LE_DEV_PUBLIC
)
701 bdaddr_type
= BDADDR_LE_PUBLIC
;
703 bdaddr_type
= BDADDR_LE_RANDOM
;
705 oob_data
= hci_find_remote_oob_data(hdev
, &hcon
->dst
,
707 if (oob_data
&& oob_data
->present
) {
708 set_bit(SMP_FLAG_REMOTE_OOB
, &smp
->flags
);
709 oob_flag
= SMP_OOB_PRESENT
;
710 memcpy(smp
->rr
, oob_data
->rand256
, 16);
711 memcpy(smp
->pcnf
, oob_data
->hash256
, 16);
712 SMP_DBG("OOB Remote Confirmation: %16phN", smp
->pcnf
);
713 SMP_DBG("OOB Remote Random: %16phN", smp
->rr
);
717 authreq
&= ~SMP_AUTH_SC
;
721 req
->io_capability
= conn
->hcon
->io_capability
;
722 req
->oob_flag
= oob_flag
;
723 req
->max_key_size
= SMP_DEV(hdev
)->max_key_size
;
724 req
->init_key_dist
= local_dist
;
725 req
->resp_key_dist
= remote_dist
;
726 req
->auth_req
= (authreq
& AUTH_REQ_MASK(hdev
));
728 smp
->remote_key_dist
= remote_dist
;
732 rsp
->io_capability
= conn
->hcon
->io_capability
;
733 rsp
->oob_flag
= oob_flag
;
734 rsp
->max_key_size
= SMP_DEV(hdev
)->max_key_size
;
735 rsp
->init_key_dist
= req
->init_key_dist
& remote_dist
;
736 rsp
->resp_key_dist
= req
->resp_key_dist
& local_dist
;
737 rsp
->auth_req
= (authreq
& AUTH_REQ_MASK(hdev
));
739 smp
->remote_key_dist
= rsp
->init_key_dist
;
742 static u8
check_enc_key_size(struct l2cap_conn
*conn
, __u8 max_key_size
)
744 struct l2cap_chan
*chan
= conn
->smp
;
745 struct hci_dev
*hdev
= conn
->hcon
->hdev
;
746 struct smp_chan
*smp
= chan
->data
;
748 if (max_key_size
> SMP_DEV(hdev
)->max_key_size
||
749 max_key_size
< SMP_MIN_ENC_KEY_SIZE
)
750 return SMP_ENC_KEY_SIZE
;
752 smp
->enc_key_size
= max_key_size
;
757 static void smp_chan_destroy(struct l2cap_conn
*conn
)
759 struct l2cap_chan
*chan
= conn
->smp
;
760 struct smp_chan
*smp
= chan
->data
;
761 struct hci_conn
*hcon
= conn
->hcon
;
766 cancel_delayed_work_sync(&smp
->security_timer
);
768 complete
= test_bit(SMP_FLAG_COMPLETE
, &smp
->flags
);
769 mgmt_smp_complete(hcon
, complete
);
772 kzfree(smp
->slave_csrk
);
773 kzfree(smp
->link_key
);
775 crypto_free_cipher(smp
->tfm_aes
);
776 crypto_free_shash(smp
->tfm_cmac
);
777 crypto_free_kpp(smp
->tfm_ecdh
);
779 /* Ensure that we don't leave any debug key around if debug key
780 * support hasn't been explicitly enabled.
782 if (smp
->ltk
&& smp
->ltk
->type
== SMP_LTK_P256_DEBUG
&&
783 !hci_dev_test_flag(hcon
->hdev
, HCI_KEEP_DEBUG_KEYS
)) {
784 list_del_rcu(&smp
->ltk
->list
);
785 kfree_rcu(smp
->ltk
, rcu
);
789 /* If pairing failed clean up any keys we might have */
792 list_del_rcu(&smp
->ltk
->list
);
793 kfree_rcu(smp
->ltk
, rcu
);
796 if (smp
->slave_ltk
) {
797 list_del_rcu(&smp
->slave_ltk
->list
);
798 kfree_rcu(smp
->slave_ltk
, rcu
);
801 if (smp
->remote_irk
) {
802 list_del_rcu(&smp
->remote_irk
->list
);
803 kfree_rcu(smp
->remote_irk
, rcu
);
812 static void smp_failure(struct l2cap_conn
*conn
, u8 reason
)
814 struct hci_conn
*hcon
= conn
->hcon
;
815 struct l2cap_chan
*chan
= conn
->smp
;
818 smp_send_cmd(conn
, SMP_CMD_PAIRING_FAIL
, sizeof(reason
),
821 mgmt_auth_failed(hcon
, HCI_ERROR_AUTH_FAILURE
);
824 smp_chan_destroy(conn
);
827 #define JUST_WORKS 0x00
828 #define JUST_CFM 0x01
829 #define REQ_PASSKEY 0x02
830 #define CFM_PASSKEY 0x03
832 #define DSP_PASSKEY 0x05
835 static const u8 gen_method
[5][5] = {
836 { JUST_WORKS
, JUST_CFM
, REQ_PASSKEY
, JUST_WORKS
, REQ_PASSKEY
},
837 { JUST_WORKS
, JUST_CFM
, REQ_PASSKEY
, JUST_WORKS
, REQ_PASSKEY
},
838 { CFM_PASSKEY
, CFM_PASSKEY
, REQ_PASSKEY
, JUST_WORKS
, CFM_PASSKEY
},
839 { JUST_WORKS
, JUST_CFM
, JUST_WORKS
, JUST_WORKS
, JUST_CFM
},
840 { CFM_PASSKEY
, CFM_PASSKEY
, REQ_PASSKEY
, JUST_WORKS
, OVERLAP
},
843 static const u8 sc_method
[5][5] = {
844 { JUST_WORKS
, JUST_CFM
, REQ_PASSKEY
, JUST_WORKS
, REQ_PASSKEY
},
845 { JUST_WORKS
, CFM_PASSKEY
, REQ_PASSKEY
, JUST_WORKS
, CFM_PASSKEY
},
846 { DSP_PASSKEY
, DSP_PASSKEY
, REQ_PASSKEY
, JUST_WORKS
, DSP_PASSKEY
},
847 { JUST_WORKS
, JUST_CFM
, JUST_WORKS
, JUST_WORKS
, JUST_CFM
},
848 { DSP_PASSKEY
, CFM_PASSKEY
, REQ_PASSKEY
, JUST_WORKS
, CFM_PASSKEY
},
851 static u8
get_auth_method(struct smp_chan
*smp
, u8 local_io
, u8 remote_io
)
853 /* If either side has unknown io_caps, use JUST_CFM (which gets
854 * converted later to JUST_WORKS if we're initiators.
856 if (local_io
> SMP_IO_KEYBOARD_DISPLAY
||
857 remote_io
> SMP_IO_KEYBOARD_DISPLAY
)
860 if (test_bit(SMP_FLAG_SC
, &smp
->flags
))
861 return sc_method
[remote_io
][local_io
];
863 return gen_method
[remote_io
][local_io
];
866 static int tk_request(struct l2cap_conn
*conn
, u8 remote_oob
, u8 auth
,
867 u8 local_io
, u8 remote_io
)
869 struct hci_conn
*hcon
= conn
->hcon
;
870 struct l2cap_chan
*chan
= conn
->smp
;
871 struct smp_chan
*smp
= chan
->data
;
875 /* Initialize key for JUST WORKS */
876 memset(smp
->tk
, 0, sizeof(smp
->tk
));
877 clear_bit(SMP_FLAG_TK_VALID
, &smp
->flags
);
879 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth
, local_io
, remote_io
);
881 /* If neither side wants MITM, either "just" confirm an incoming
882 * request or use just-works for outgoing ones. The JUST_CFM
883 * will be converted to JUST_WORKS if necessary later in this
884 * function. If either side has MITM look up the method from the
887 if (!(auth
& SMP_AUTH_MITM
))
888 smp
->method
= JUST_CFM
;
890 smp
->method
= get_auth_method(smp
, local_io
, remote_io
);
892 /* Don't confirm locally initiated pairing attempts */
893 if (smp
->method
== JUST_CFM
&& test_bit(SMP_FLAG_INITIATOR
,
895 smp
->method
= JUST_WORKS
;
897 /* Don't bother user space with no IO capabilities */
898 if (smp
->method
== JUST_CFM
&&
899 hcon
->io_capability
== HCI_IO_NO_INPUT_OUTPUT
)
900 smp
->method
= JUST_WORKS
;
902 /* If Just Works, Continue with Zero TK */
903 if (smp
->method
== JUST_WORKS
) {
904 set_bit(SMP_FLAG_TK_VALID
, &smp
->flags
);
908 /* If this function is used for SC -> legacy fallback we
909 * can only recover the just-works case.
911 if (test_bit(SMP_FLAG_SC
, &smp
->flags
))
914 /* Not Just Works/Confirm results in MITM Authentication */
915 if (smp
->method
!= JUST_CFM
) {
916 set_bit(SMP_FLAG_MITM_AUTH
, &smp
->flags
);
917 if (hcon
->pending_sec_level
< BT_SECURITY_HIGH
)
918 hcon
->pending_sec_level
= BT_SECURITY_HIGH
;
921 /* If both devices have Keyoard-Display I/O, the master
922 * Confirms and the slave Enters the passkey.
924 if (smp
->method
== OVERLAP
) {
925 if (hcon
->role
== HCI_ROLE_MASTER
)
926 smp
->method
= CFM_PASSKEY
;
928 smp
->method
= REQ_PASSKEY
;
931 /* Generate random passkey. */
932 if (smp
->method
== CFM_PASSKEY
) {
933 memset(smp
->tk
, 0, sizeof(smp
->tk
));
934 get_random_bytes(&passkey
, sizeof(passkey
));
936 put_unaligned_le32(passkey
, smp
->tk
);
937 BT_DBG("PassKey: %d", passkey
);
938 set_bit(SMP_FLAG_TK_VALID
, &smp
->flags
);
941 if (smp
->method
== REQ_PASSKEY
)
942 ret
= mgmt_user_passkey_request(hcon
->hdev
, &hcon
->dst
,
943 hcon
->type
, hcon
->dst_type
);
944 else if (smp
->method
== JUST_CFM
)
945 ret
= mgmt_user_confirm_request(hcon
->hdev
, &hcon
->dst
,
946 hcon
->type
, hcon
->dst_type
,
949 ret
= mgmt_user_passkey_notify(hcon
->hdev
, &hcon
->dst
,
950 hcon
->type
, hcon
->dst_type
,
956 static u8
smp_confirm(struct smp_chan
*smp
)
958 struct l2cap_conn
*conn
= smp
->conn
;
959 struct smp_cmd_pairing_confirm cp
;
962 BT_DBG("conn %p", conn
);
964 ret
= smp_c1(smp
->tfm_aes
, smp
->tk
, smp
->prnd
, smp
->preq
, smp
->prsp
,
965 conn
->hcon
->init_addr_type
, &conn
->hcon
->init_addr
,
966 conn
->hcon
->resp_addr_type
, &conn
->hcon
->resp_addr
,
969 return SMP_UNSPECIFIED
;
971 clear_bit(SMP_FLAG_CFM_PENDING
, &smp
->flags
);
973 smp_send_cmd(smp
->conn
, SMP_CMD_PAIRING_CONFIRM
, sizeof(cp
), &cp
);
976 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_CONFIRM
);
978 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RANDOM
);
983 static u8
smp_random(struct smp_chan
*smp
)
985 struct l2cap_conn
*conn
= smp
->conn
;
986 struct hci_conn
*hcon
= conn
->hcon
;
990 if (IS_ERR_OR_NULL(smp
->tfm_aes
))
991 return SMP_UNSPECIFIED
;
993 BT_DBG("conn %p %s", conn
, conn
->hcon
->out
? "master" : "slave");
995 ret
= smp_c1(smp
->tfm_aes
, smp
->tk
, smp
->rrnd
, smp
->preq
, smp
->prsp
,
996 hcon
->init_addr_type
, &hcon
->init_addr
,
997 hcon
->resp_addr_type
, &hcon
->resp_addr
, confirm
);
999 return SMP_UNSPECIFIED
;
1001 if (crypto_memneq(smp
->pcnf
, confirm
, sizeof(smp
->pcnf
))) {
1002 bt_dev_err(hcon
->hdev
, "pairing failed "
1003 "(confirmation values mismatch)");
1004 return SMP_CONFIRM_FAILED
;
1012 smp_s1(smp
->tfm_aes
, smp
->tk
, smp
->rrnd
, smp
->prnd
, stk
);
1014 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND
, &hcon
->flags
))
1015 return SMP_UNSPECIFIED
;
1017 hci_le_start_enc(hcon
, ediv
, rand
, stk
, smp
->enc_key_size
);
1018 hcon
->enc_key_size
= smp
->enc_key_size
;
1019 set_bit(HCI_CONN_STK_ENCRYPT
, &hcon
->flags
);
1025 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
, sizeof(smp
->prnd
),
1028 smp_s1(smp
->tfm_aes
, smp
->tk
, smp
->prnd
, smp
->rrnd
, stk
);
1030 if (hcon
->pending_sec_level
== BT_SECURITY_HIGH
)
1035 /* Even though there's no _SLAVE suffix this is the
1036 * slave STK we're adding for later lookup (the master
1037 * STK never needs to be stored).
1039 hci_add_ltk(hcon
->hdev
, &hcon
->dst
, hcon
->dst_type
,
1040 SMP_STK
, auth
, stk
, smp
->enc_key_size
, ediv
, rand
);
1046 static void smp_notify_keys(struct l2cap_conn
*conn
)
1048 struct l2cap_chan
*chan
= conn
->smp
;
1049 struct smp_chan
*smp
= chan
->data
;
1050 struct hci_conn
*hcon
= conn
->hcon
;
1051 struct hci_dev
*hdev
= hcon
->hdev
;
1052 struct smp_cmd_pairing
*req
= (void *) &smp
->preq
[1];
1053 struct smp_cmd_pairing
*rsp
= (void *) &smp
->prsp
[1];
1056 if (hcon
->type
== ACL_LINK
) {
1057 if (hcon
->key_type
== HCI_LK_DEBUG_COMBINATION
)
1060 persistent
= !test_bit(HCI_CONN_FLUSH_KEY
,
1063 /* The LTKs, IRKs and CSRKs should be persistent only if
1064 * both sides had the bonding bit set in their
1065 * authentication requests.
1067 persistent
= !!((req
->auth_req
& rsp
->auth_req
) &
1071 if (smp
->remote_irk
) {
1072 mgmt_new_irk(hdev
, smp
->remote_irk
, persistent
);
1074 /* Now that user space can be considered to know the
1075 * identity address track the connection based on it
1076 * from now on (assuming this is an LE link).
1078 if (hcon
->type
== LE_LINK
) {
1079 bacpy(&hcon
->dst
, &smp
->remote_irk
->bdaddr
);
1080 hcon
->dst_type
= smp
->remote_irk
->addr_type
;
1081 queue_work(hdev
->workqueue
, &conn
->id_addr_update_work
);
1086 smp
->csrk
->bdaddr_type
= hcon
->dst_type
;
1087 bacpy(&smp
->csrk
->bdaddr
, &hcon
->dst
);
1088 mgmt_new_csrk(hdev
, smp
->csrk
, persistent
);
1091 if (smp
->slave_csrk
) {
1092 smp
->slave_csrk
->bdaddr_type
= hcon
->dst_type
;
1093 bacpy(&smp
->slave_csrk
->bdaddr
, &hcon
->dst
);
1094 mgmt_new_csrk(hdev
, smp
->slave_csrk
, persistent
);
1098 smp
->ltk
->bdaddr_type
= hcon
->dst_type
;
1099 bacpy(&smp
->ltk
->bdaddr
, &hcon
->dst
);
1100 mgmt_new_ltk(hdev
, smp
->ltk
, persistent
);
1103 if (smp
->slave_ltk
) {
1104 smp
->slave_ltk
->bdaddr_type
= hcon
->dst_type
;
1105 bacpy(&smp
->slave_ltk
->bdaddr
, &hcon
->dst
);
1106 mgmt_new_ltk(hdev
, smp
->slave_ltk
, persistent
);
1109 if (smp
->link_key
) {
1110 struct link_key
*key
;
1113 if (test_bit(SMP_FLAG_DEBUG_KEY
, &smp
->flags
))
1114 type
= HCI_LK_DEBUG_COMBINATION
;
1115 else if (hcon
->sec_level
== BT_SECURITY_FIPS
)
1116 type
= HCI_LK_AUTH_COMBINATION_P256
;
1118 type
= HCI_LK_UNAUTH_COMBINATION_P256
;
1120 key
= hci_add_link_key(hdev
, smp
->conn
->hcon
, &hcon
->dst
,
1121 smp
->link_key
, type
, 0, &persistent
);
1123 mgmt_new_link_key(hdev
, key
, persistent
);
1125 /* Don't keep debug keys around if the relevant
1128 if (!hci_dev_test_flag(hdev
, HCI_KEEP_DEBUG_KEYS
) &&
1129 key
->type
== HCI_LK_DEBUG_COMBINATION
) {
1130 list_del_rcu(&key
->list
);
1131 kfree_rcu(key
, rcu
);
1137 static void sc_add_ltk(struct smp_chan
*smp
)
1139 struct hci_conn
*hcon
= smp
->conn
->hcon
;
1142 if (test_bit(SMP_FLAG_DEBUG_KEY
, &smp
->flags
))
1143 key_type
= SMP_LTK_P256_DEBUG
;
1145 key_type
= SMP_LTK_P256
;
1147 if (hcon
->pending_sec_level
== BT_SECURITY_FIPS
)
1152 smp
->ltk
= hci_add_ltk(hcon
->hdev
, &hcon
->dst
, hcon
->dst_type
,
1153 key_type
, auth
, smp
->tk
, smp
->enc_key_size
,
1157 static void sc_generate_link_key(struct smp_chan
*smp
)
1159 /* From core spec. Spells out in ASCII as 'lebr'. */
1160 const u8 lebr
[4] = { 0x72, 0x62, 0x65, 0x6c };
1162 smp
->link_key
= kzalloc(16, GFP_KERNEL
);
1166 if (test_bit(SMP_FLAG_CT2
, &smp
->flags
)) {
1167 /* SALT = 0x00000000000000000000000000000000746D7031 */
1168 const u8 salt
[16] = { 0x31, 0x70, 0x6d, 0x74 };
1170 if (smp_h7(smp
->tfm_cmac
, smp
->tk
, salt
, smp
->link_key
)) {
1171 kzfree(smp
->link_key
);
1172 smp
->link_key
= NULL
;
1176 /* From core spec. Spells out in ASCII as 'tmp1'. */
1177 const u8 tmp1
[4] = { 0x31, 0x70, 0x6d, 0x74 };
1179 if (smp_h6(smp
->tfm_cmac
, smp
->tk
, tmp1
, smp
->link_key
)) {
1180 kzfree(smp
->link_key
);
1181 smp
->link_key
= NULL
;
1186 if (smp_h6(smp
->tfm_cmac
, smp
->link_key
, lebr
, smp
->link_key
)) {
1187 kzfree(smp
->link_key
);
1188 smp
->link_key
= NULL
;
1193 static void smp_allow_key_dist(struct smp_chan
*smp
)
1195 /* Allow the first expected phase 3 PDU. The rest of the PDUs
1196 * will be allowed in each PDU handler to ensure we receive
1197 * them in the correct order.
1199 if (smp
->remote_key_dist
& SMP_DIST_ENC_KEY
)
1200 SMP_ALLOW_CMD(smp
, SMP_CMD_ENCRYPT_INFO
);
1201 else if (smp
->remote_key_dist
& SMP_DIST_ID_KEY
)
1202 SMP_ALLOW_CMD(smp
, SMP_CMD_IDENT_INFO
);
1203 else if (smp
->remote_key_dist
& SMP_DIST_SIGN
)
1204 SMP_ALLOW_CMD(smp
, SMP_CMD_SIGN_INFO
);
1207 static void sc_generate_ltk(struct smp_chan
*smp
)
1209 /* From core spec. Spells out in ASCII as 'brle'. */
1210 const u8 brle
[4] = { 0x65, 0x6c, 0x72, 0x62 };
1211 struct hci_conn
*hcon
= smp
->conn
->hcon
;
1212 struct hci_dev
*hdev
= hcon
->hdev
;
1213 struct link_key
*key
;
1215 key
= hci_find_link_key(hdev
, &hcon
->dst
);
1217 bt_dev_err(hdev
, "no Link Key found to generate LTK");
1221 if (key
->type
== HCI_LK_DEBUG_COMBINATION
)
1222 set_bit(SMP_FLAG_DEBUG_KEY
, &smp
->flags
);
1224 if (test_bit(SMP_FLAG_CT2
, &smp
->flags
)) {
1225 /* SALT = 0x00000000000000000000000000000000746D7032 */
1226 const u8 salt
[16] = { 0x32, 0x70, 0x6d, 0x74 };
1228 if (smp_h7(smp
->tfm_cmac
, key
->val
, salt
, smp
->tk
))
1231 /* From core spec. Spells out in ASCII as 'tmp2'. */
1232 const u8 tmp2
[4] = { 0x32, 0x70, 0x6d, 0x74 };
1234 if (smp_h6(smp
->tfm_cmac
, key
->val
, tmp2
, smp
->tk
))
1238 if (smp_h6(smp
->tfm_cmac
, smp
->tk
, brle
, smp
->tk
))
1244 static void smp_distribute_keys(struct smp_chan
*smp
)
1246 struct smp_cmd_pairing
*req
, *rsp
;
1247 struct l2cap_conn
*conn
= smp
->conn
;
1248 struct hci_conn
*hcon
= conn
->hcon
;
1249 struct hci_dev
*hdev
= hcon
->hdev
;
1252 BT_DBG("conn %p", conn
);
1254 rsp
= (void *) &smp
->prsp
[1];
1256 /* The responder sends its keys first */
1257 if (hcon
->out
&& (smp
->remote_key_dist
& KEY_DIST_MASK
)) {
1258 smp_allow_key_dist(smp
);
1262 req
= (void *) &smp
->preq
[1];
1265 keydist
= &rsp
->init_key_dist
;
1266 *keydist
&= req
->init_key_dist
;
1268 keydist
= &rsp
->resp_key_dist
;
1269 *keydist
&= req
->resp_key_dist
;
1272 if (test_bit(SMP_FLAG_SC
, &smp
->flags
)) {
1273 if (hcon
->type
== LE_LINK
&& (*keydist
& SMP_DIST_LINK_KEY
))
1274 sc_generate_link_key(smp
);
1275 if (hcon
->type
== ACL_LINK
&& (*keydist
& SMP_DIST_ENC_KEY
))
1276 sc_generate_ltk(smp
);
1278 /* Clear the keys which are generated but not distributed */
1279 *keydist
&= ~SMP_SC_NO_DIST
;
1282 BT_DBG("keydist 0x%x", *keydist
);
1284 if (*keydist
& SMP_DIST_ENC_KEY
) {
1285 struct smp_cmd_encrypt_info enc
;
1286 struct smp_cmd_master_ident ident
;
1287 struct smp_ltk
*ltk
;
1292 /* Make sure we generate only the significant amount of
1293 * bytes based on the encryption key size, and set the rest
1294 * of the value to zeroes.
1296 get_random_bytes(enc
.ltk
, smp
->enc_key_size
);
1297 memset(enc
.ltk
+ smp
->enc_key_size
, 0,
1298 sizeof(enc
.ltk
) - smp
->enc_key_size
);
1300 get_random_bytes(&ediv
, sizeof(ediv
));
1301 get_random_bytes(&rand
, sizeof(rand
));
1303 smp_send_cmd(conn
, SMP_CMD_ENCRYPT_INFO
, sizeof(enc
), &enc
);
1305 authenticated
= hcon
->sec_level
== BT_SECURITY_HIGH
;
1306 ltk
= hci_add_ltk(hdev
, &hcon
->dst
, hcon
->dst_type
,
1307 SMP_LTK_SLAVE
, authenticated
, enc
.ltk
,
1308 smp
->enc_key_size
, ediv
, rand
);
1309 smp
->slave_ltk
= ltk
;
1314 smp_send_cmd(conn
, SMP_CMD_MASTER_IDENT
, sizeof(ident
), &ident
);
1316 *keydist
&= ~SMP_DIST_ENC_KEY
;
1319 if (*keydist
& SMP_DIST_ID_KEY
) {
1320 struct smp_cmd_ident_addr_info addrinfo
;
1321 struct smp_cmd_ident_info idinfo
;
1323 memcpy(idinfo
.irk
, hdev
->irk
, sizeof(idinfo
.irk
));
1325 smp_send_cmd(conn
, SMP_CMD_IDENT_INFO
, sizeof(idinfo
), &idinfo
);
1327 /* The hci_conn contains the local identity address
1328 * after the connection has been established.
1330 * This is true even when the connection has been
1331 * established using a resolvable random address.
1333 bacpy(&addrinfo
.bdaddr
, &hcon
->src
);
1334 addrinfo
.addr_type
= hcon
->src_type
;
1336 smp_send_cmd(conn
, SMP_CMD_IDENT_ADDR_INFO
, sizeof(addrinfo
),
1339 *keydist
&= ~SMP_DIST_ID_KEY
;
1342 if (*keydist
& SMP_DIST_SIGN
) {
1343 struct smp_cmd_sign_info sign
;
1344 struct smp_csrk
*csrk
;
1346 /* Generate a new random key */
1347 get_random_bytes(sign
.csrk
, sizeof(sign
.csrk
));
1349 csrk
= kzalloc(sizeof(*csrk
), GFP_KERNEL
);
1351 if (hcon
->sec_level
> BT_SECURITY_MEDIUM
)
1352 csrk
->type
= MGMT_CSRK_LOCAL_AUTHENTICATED
;
1354 csrk
->type
= MGMT_CSRK_LOCAL_UNAUTHENTICATED
;
1355 memcpy(csrk
->val
, sign
.csrk
, sizeof(csrk
->val
));
1357 smp
->slave_csrk
= csrk
;
1359 smp_send_cmd(conn
, SMP_CMD_SIGN_INFO
, sizeof(sign
), &sign
);
1361 *keydist
&= ~SMP_DIST_SIGN
;
1364 /* If there are still keys to be received wait for them */
1365 if (smp
->remote_key_dist
& KEY_DIST_MASK
) {
1366 smp_allow_key_dist(smp
);
1370 set_bit(SMP_FLAG_COMPLETE
, &smp
->flags
);
1371 smp_notify_keys(conn
);
1373 smp_chan_destroy(conn
);
1376 static void smp_timeout(struct work_struct
*work
)
1378 struct smp_chan
*smp
= container_of(work
, struct smp_chan
,
1379 security_timer
.work
);
1380 struct l2cap_conn
*conn
= smp
->conn
;
1382 BT_DBG("conn %p", conn
);
1384 hci_disconnect(conn
->hcon
, HCI_ERROR_REMOTE_USER_TERM
);
1387 static struct smp_chan
*smp_chan_create(struct l2cap_conn
*conn
)
1389 struct l2cap_chan
*chan
= conn
->smp
;
1390 struct smp_chan
*smp
;
1392 smp
= kzalloc(sizeof(*smp
), GFP_ATOMIC
);
1396 smp
->tfm_aes
= crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC
);
1397 if (IS_ERR(smp
->tfm_aes
)) {
1398 BT_ERR("Unable to create AES crypto context");
1402 smp
->tfm_cmac
= crypto_alloc_shash("cmac(aes)", 0, 0);
1403 if (IS_ERR(smp
->tfm_cmac
)) {
1404 BT_ERR("Unable to create CMAC crypto context");
1408 smp
->tfm_ecdh
= crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL
, 0);
1409 if (IS_ERR(smp
->tfm_ecdh
)) {
1410 BT_ERR("Unable to create ECDH crypto context");
1417 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_FAIL
);
1419 INIT_DELAYED_WORK(&smp
->security_timer
, smp_timeout
);
1421 hci_conn_hold(conn
->hcon
);
1426 crypto_free_shash(smp
->tfm_cmac
);
1428 crypto_free_cipher(smp
->tfm_aes
);
1434 static int sc_mackey_and_ltk(struct smp_chan
*smp
, u8 mackey
[16], u8 ltk
[16])
1436 struct hci_conn
*hcon
= smp
->conn
->hcon
;
1437 u8
*na
, *nb
, a
[7], b
[7];
1447 memcpy(a
, &hcon
->init_addr
, 6);
1448 memcpy(b
, &hcon
->resp_addr
, 6);
1449 a
[6] = hcon
->init_addr_type
;
1450 b
[6] = hcon
->resp_addr_type
;
1452 return smp_f5(smp
->tfm_cmac
, smp
->dhkey
, na
, nb
, a
, b
, mackey
, ltk
);
1455 static void sc_dhkey_check(struct smp_chan
*smp
)
1457 struct hci_conn
*hcon
= smp
->conn
->hcon
;
1458 struct smp_cmd_dhkey_check check
;
1459 u8 a
[7], b
[7], *local_addr
, *remote_addr
;
1460 u8 io_cap
[3], r
[16];
1462 memcpy(a
, &hcon
->init_addr
, 6);
1463 memcpy(b
, &hcon
->resp_addr
, 6);
1464 a
[6] = hcon
->init_addr_type
;
1465 b
[6] = hcon
->resp_addr_type
;
1470 memcpy(io_cap
, &smp
->preq
[1], 3);
1474 memcpy(io_cap
, &smp
->prsp
[1], 3);
1477 memset(r
, 0, sizeof(r
));
1479 if (smp
->method
== REQ_PASSKEY
|| smp
->method
== DSP_PASSKEY
)
1480 put_unaligned_le32(hcon
->passkey_notify
, r
);
1482 if (smp
->method
== REQ_OOB
)
1483 memcpy(r
, smp
->rr
, 16);
1485 smp_f6(smp
->tfm_cmac
, smp
->mackey
, smp
->prnd
, smp
->rrnd
, r
, io_cap
,
1486 local_addr
, remote_addr
, check
.e
);
1488 smp_send_cmd(smp
->conn
, SMP_CMD_DHKEY_CHECK
, sizeof(check
), &check
);
1491 static u8
sc_passkey_send_confirm(struct smp_chan
*smp
)
1493 struct l2cap_conn
*conn
= smp
->conn
;
1494 struct hci_conn
*hcon
= conn
->hcon
;
1495 struct smp_cmd_pairing_confirm cfm
;
1498 r
= ((hcon
->passkey_notify
>> smp
->passkey_round
) & 0x01);
1501 get_random_bytes(smp
->prnd
, sizeof(smp
->prnd
));
1503 if (smp_f4(smp
->tfm_cmac
, smp
->local_pk
, smp
->remote_pk
, smp
->prnd
, r
,
1505 return SMP_UNSPECIFIED
;
1507 smp_send_cmd(conn
, SMP_CMD_PAIRING_CONFIRM
, sizeof(cfm
), &cfm
);
1512 static u8
sc_passkey_round(struct smp_chan
*smp
, u8 smp_op
)
1514 struct l2cap_conn
*conn
= smp
->conn
;
1515 struct hci_conn
*hcon
= conn
->hcon
;
1516 struct hci_dev
*hdev
= hcon
->hdev
;
1519 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */
1520 if (smp
->passkey_round
>= 20)
1524 case SMP_CMD_PAIRING_RANDOM
:
1525 r
= ((hcon
->passkey_notify
>> smp
->passkey_round
) & 0x01);
1528 if (smp_f4(smp
->tfm_cmac
, smp
->remote_pk
, smp
->local_pk
,
1530 return SMP_UNSPECIFIED
;
1532 if (crypto_memneq(smp
->pcnf
, cfm
, 16))
1533 return SMP_CONFIRM_FAILED
;
1535 smp
->passkey_round
++;
1537 if (smp
->passkey_round
== 20) {
1538 /* Generate MacKey and LTK */
1539 if (sc_mackey_and_ltk(smp
, smp
->mackey
, smp
->tk
))
1540 return SMP_UNSPECIFIED
;
1543 /* The round is only complete when the initiator
1544 * receives pairing random.
1547 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
,
1548 sizeof(smp
->prnd
), smp
->prnd
);
1549 if (smp
->passkey_round
== 20)
1550 SMP_ALLOW_CMD(smp
, SMP_CMD_DHKEY_CHECK
);
1552 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_CONFIRM
);
1556 /* Start the next round */
1557 if (smp
->passkey_round
!= 20)
1558 return sc_passkey_round(smp
, 0);
1560 /* Passkey rounds are complete - start DHKey Check */
1561 sc_dhkey_check(smp
);
1562 SMP_ALLOW_CMD(smp
, SMP_CMD_DHKEY_CHECK
);
1566 case SMP_CMD_PAIRING_CONFIRM
:
1567 if (test_bit(SMP_FLAG_WAIT_USER
, &smp
->flags
)) {
1568 set_bit(SMP_FLAG_CFM_PENDING
, &smp
->flags
);
1572 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RANDOM
);
1575 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
,
1576 sizeof(smp
->prnd
), smp
->prnd
);
1580 return sc_passkey_send_confirm(smp
);
1582 case SMP_CMD_PUBLIC_KEY
:
1584 /* Initiating device starts the round */
1588 BT_DBG("%s Starting passkey round %u", hdev
->name
,
1589 smp
->passkey_round
+ 1);
1591 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_CONFIRM
);
1593 return sc_passkey_send_confirm(smp
);
1599 static int sc_user_reply(struct smp_chan
*smp
, u16 mgmt_op
, __le32 passkey
)
1601 struct l2cap_conn
*conn
= smp
->conn
;
1602 struct hci_conn
*hcon
= conn
->hcon
;
1605 clear_bit(SMP_FLAG_WAIT_USER
, &smp
->flags
);
1608 case MGMT_OP_USER_PASSKEY_NEG_REPLY
:
1609 smp_failure(smp
->conn
, SMP_PASSKEY_ENTRY_FAILED
);
1611 case MGMT_OP_USER_CONFIRM_NEG_REPLY
:
1612 smp_failure(smp
->conn
, SMP_NUMERIC_COMP_FAILED
);
1614 case MGMT_OP_USER_PASSKEY_REPLY
:
1615 hcon
->passkey_notify
= le32_to_cpu(passkey
);
1616 smp
->passkey_round
= 0;
1618 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING
, &smp
->flags
))
1619 smp_op
= SMP_CMD_PAIRING_CONFIRM
;
1623 if (sc_passkey_round(smp
, smp_op
))
1629 /* Initiator sends DHKey check first */
1631 sc_dhkey_check(smp
);
1632 SMP_ALLOW_CMD(smp
, SMP_CMD_DHKEY_CHECK
);
1633 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING
, &smp
->flags
)) {
1634 sc_dhkey_check(smp
);
1641 int smp_user_confirm_reply(struct hci_conn
*hcon
, u16 mgmt_op
, __le32 passkey
)
1643 struct l2cap_conn
*conn
= hcon
->l2cap_data
;
1644 struct l2cap_chan
*chan
;
1645 struct smp_chan
*smp
;
1658 l2cap_chan_lock(chan
);
1666 if (test_bit(SMP_FLAG_SC
, &smp
->flags
)) {
1667 err
= sc_user_reply(smp
, mgmt_op
, passkey
);
1672 case MGMT_OP_USER_PASSKEY_REPLY
:
1673 value
= le32_to_cpu(passkey
);
1674 memset(smp
->tk
, 0, sizeof(smp
->tk
));
1675 BT_DBG("PassKey: %d", value
);
1676 put_unaligned_le32(value
, smp
->tk
);
1678 case MGMT_OP_USER_CONFIRM_REPLY
:
1679 set_bit(SMP_FLAG_TK_VALID
, &smp
->flags
);
1681 case MGMT_OP_USER_PASSKEY_NEG_REPLY
:
1682 case MGMT_OP_USER_CONFIRM_NEG_REPLY
:
1683 smp_failure(conn
, SMP_PASSKEY_ENTRY_FAILED
);
1687 smp_failure(conn
, SMP_PASSKEY_ENTRY_FAILED
);
1694 /* If it is our turn to send Pairing Confirm, do so now */
1695 if (test_bit(SMP_FLAG_CFM_PENDING
, &smp
->flags
)) {
1696 u8 rsp
= smp_confirm(smp
);
1698 smp_failure(conn
, rsp
);
1702 l2cap_chan_unlock(chan
);
1706 static void build_bredr_pairing_cmd(struct smp_chan
*smp
,
1707 struct smp_cmd_pairing
*req
,
1708 struct smp_cmd_pairing
*rsp
)
1710 struct l2cap_conn
*conn
= smp
->conn
;
1711 struct hci_dev
*hdev
= conn
->hcon
->hdev
;
1712 u8 local_dist
= 0, remote_dist
= 0;
1714 if (hci_dev_test_flag(hdev
, HCI_BONDABLE
)) {
1715 local_dist
= SMP_DIST_ENC_KEY
| SMP_DIST_SIGN
;
1716 remote_dist
= SMP_DIST_ENC_KEY
| SMP_DIST_SIGN
;
1719 if (hci_dev_test_flag(hdev
, HCI_RPA_RESOLVING
))
1720 remote_dist
|= SMP_DIST_ID_KEY
;
1722 if (hci_dev_test_flag(hdev
, HCI_PRIVACY
))
1723 local_dist
|= SMP_DIST_ID_KEY
;
1726 memset(req
, 0, sizeof(*req
));
1728 req
->auth_req
= SMP_AUTH_CT2
;
1729 req
->init_key_dist
= local_dist
;
1730 req
->resp_key_dist
= remote_dist
;
1731 req
->max_key_size
= conn
->hcon
->enc_key_size
;
1733 smp
->remote_key_dist
= remote_dist
;
1738 memset(rsp
, 0, sizeof(*rsp
));
1740 rsp
->auth_req
= SMP_AUTH_CT2
;
1741 rsp
->max_key_size
= conn
->hcon
->enc_key_size
;
1742 rsp
->init_key_dist
= req
->init_key_dist
& remote_dist
;
1743 rsp
->resp_key_dist
= req
->resp_key_dist
& local_dist
;
1745 smp
->remote_key_dist
= rsp
->init_key_dist
;
1748 static u8
smp_cmd_pairing_req(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
1750 struct smp_cmd_pairing rsp
, *req
= (void *) skb
->data
;
1751 struct l2cap_chan
*chan
= conn
->smp
;
1752 struct hci_dev
*hdev
= conn
->hcon
->hdev
;
1753 struct smp_chan
*smp
;
1754 u8 key_size
, auth
, sec_level
;
1757 BT_DBG("conn %p", conn
);
1759 if (skb
->len
< sizeof(*req
))
1760 return SMP_INVALID_PARAMS
;
1762 if (conn
->hcon
->role
!= HCI_ROLE_SLAVE
)
1763 return SMP_CMD_NOTSUPP
;
1766 smp
= smp_chan_create(conn
);
1771 return SMP_UNSPECIFIED
;
1773 /* We didn't start the pairing, so match remote */
1774 auth
= req
->auth_req
& AUTH_REQ_MASK(hdev
);
1776 if (!hci_dev_test_flag(hdev
, HCI_BONDABLE
) &&
1777 (auth
& SMP_AUTH_BONDING
))
1778 return SMP_PAIRING_NOTSUPP
;
1780 if (hci_dev_test_flag(hdev
, HCI_SC_ONLY
) && !(auth
& SMP_AUTH_SC
))
1781 return SMP_AUTH_REQUIREMENTS
;
1783 smp
->preq
[0] = SMP_CMD_PAIRING_REQ
;
1784 memcpy(&smp
->preq
[1], req
, sizeof(*req
));
1785 skb_pull(skb
, sizeof(*req
));
1787 /* If the remote side's OOB flag is set it means it has
1788 * successfully received our local OOB data - therefore set the
1789 * flag to indicate that local OOB is in use.
1791 if (req
->oob_flag
== SMP_OOB_PRESENT
&& SMP_DEV(hdev
)->local_oob
)
1792 set_bit(SMP_FLAG_LOCAL_OOB
, &smp
->flags
);
1794 /* SMP over BR/EDR requires special treatment */
1795 if (conn
->hcon
->type
== ACL_LINK
) {
1796 /* We must have a BR/EDR SC link */
1797 if (!test_bit(HCI_CONN_AES_CCM
, &conn
->hcon
->flags
) &&
1798 !hci_dev_test_flag(hdev
, HCI_FORCE_BREDR_SMP
))
1799 return SMP_CROSS_TRANSP_NOT_ALLOWED
;
1801 set_bit(SMP_FLAG_SC
, &smp
->flags
);
1803 build_bredr_pairing_cmd(smp
, req
, &rsp
);
1805 if (req
->auth_req
& SMP_AUTH_CT2
)
1806 set_bit(SMP_FLAG_CT2
, &smp
->flags
);
1808 key_size
= min(req
->max_key_size
, rsp
.max_key_size
);
1809 if (check_enc_key_size(conn
, key_size
))
1810 return SMP_ENC_KEY_SIZE
;
1812 /* Clear bits which are generated but not distributed */
1813 smp
->remote_key_dist
&= ~SMP_SC_NO_DIST
;
1815 smp
->prsp
[0] = SMP_CMD_PAIRING_RSP
;
1816 memcpy(&smp
->prsp
[1], &rsp
, sizeof(rsp
));
1817 smp_send_cmd(conn
, SMP_CMD_PAIRING_RSP
, sizeof(rsp
), &rsp
);
1819 smp_distribute_keys(smp
);
1823 build_pairing_cmd(conn
, req
, &rsp
, auth
);
1825 if (rsp
.auth_req
& SMP_AUTH_SC
) {
1826 set_bit(SMP_FLAG_SC
, &smp
->flags
);
1828 if (rsp
.auth_req
& SMP_AUTH_CT2
)
1829 set_bit(SMP_FLAG_CT2
, &smp
->flags
);
1832 if (conn
->hcon
->io_capability
== HCI_IO_NO_INPUT_OUTPUT
)
1833 sec_level
= BT_SECURITY_MEDIUM
;
1835 sec_level
= authreq_to_seclevel(auth
);
1837 if (sec_level
> conn
->hcon
->pending_sec_level
)
1838 conn
->hcon
->pending_sec_level
= sec_level
;
1840 /* If we need MITM check that it can be achieved */
1841 if (conn
->hcon
->pending_sec_level
>= BT_SECURITY_HIGH
) {
1844 method
= get_auth_method(smp
, conn
->hcon
->io_capability
,
1845 req
->io_capability
);
1846 if (method
== JUST_WORKS
|| method
== JUST_CFM
)
1847 return SMP_AUTH_REQUIREMENTS
;
1850 key_size
= min(req
->max_key_size
, rsp
.max_key_size
);
1851 if (check_enc_key_size(conn
, key_size
))
1852 return SMP_ENC_KEY_SIZE
;
1854 get_random_bytes(smp
->prnd
, sizeof(smp
->prnd
));
1856 smp
->prsp
[0] = SMP_CMD_PAIRING_RSP
;
1857 memcpy(&smp
->prsp
[1], &rsp
, sizeof(rsp
));
1859 smp_send_cmd(conn
, SMP_CMD_PAIRING_RSP
, sizeof(rsp
), &rsp
);
1861 clear_bit(SMP_FLAG_INITIATOR
, &smp
->flags
);
1863 /* Strictly speaking we shouldn't allow Pairing Confirm for the
1864 * SC case, however some implementations incorrectly copy RFU auth
1865 * req bits from our security request, which may create a false
1866 * positive SC enablement.
1868 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_CONFIRM
);
1870 if (test_bit(SMP_FLAG_SC
, &smp
->flags
)) {
1871 SMP_ALLOW_CMD(smp
, SMP_CMD_PUBLIC_KEY
);
1872 /* Clear bits which are generated but not distributed */
1873 smp
->remote_key_dist
&= ~SMP_SC_NO_DIST
;
1874 /* Wait for Public Key from Initiating Device */
1878 /* Request setup of TK */
1879 ret
= tk_request(conn
, 0, auth
, rsp
.io_capability
, req
->io_capability
);
1881 return SMP_UNSPECIFIED
;
1886 static u8
sc_send_public_key(struct smp_chan
*smp
)
1888 struct hci_dev
*hdev
= smp
->conn
->hcon
->hdev
;
1892 if (test_bit(SMP_FLAG_LOCAL_OOB
, &smp
->flags
)) {
1893 struct l2cap_chan
*chan
= hdev
->smp_data
;
1894 struct smp_dev
*smp_dev
;
1896 if (!chan
|| !chan
->data
)
1897 return SMP_UNSPECIFIED
;
1899 smp_dev
= chan
->data
;
1901 memcpy(smp
->local_pk
, smp_dev
->local_pk
, 64);
1902 memcpy(smp
->lr
, smp_dev
->local_rand
, 16);
1904 if (smp_dev
->debug_key
)
1905 set_bit(SMP_FLAG_DEBUG_KEY
, &smp
->flags
);
1910 if (hci_dev_test_flag(hdev
, HCI_USE_DEBUG_KEYS
)) {
1911 BT_DBG("Using debug keys");
1912 if (set_ecdh_privkey(smp
->tfm_ecdh
, debug_sk
))
1913 return SMP_UNSPECIFIED
;
1914 memcpy(smp
->local_pk
, debug_pk
, 64);
1915 set_bit(SMP_FLAG_DEBUG_KEY
, &smp
->flags
);
1918 /* Generate key pair for Secure Connections */
1919 if (generate_ecdh_keys(smp
->tfm_ecdh
, smp
->local_pk
))
1920 return SMP_UNSPECIFIED
;
1922 /* This is unlikely, but we need to check that
1923 * we didn't accidentially generate a debug key.
1925 if (crypto_memneq(smp
->local_pk
, debug_pk
, 64))
1931 SMP_DBG("Local Public Key X: %32phN", smp
->local_pk
);
1932 SMP_DBG("Local Public Key Y: %32phN", smp
->local_pk
+ 32);
1934 smp_send_cmd(smp
->conn
, SMP_CMD_PUBLIC_KEY
, 64, smp
->local_pk
);
1939 static u8
smp_cmd_pairing_rsp(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
1941 struct smp_cmd_pairing
*req
, *rsp
= (void *) skb
->data
;
1942 struct l2cap_chan
*chan
= conn
->smp
;
1943 struct smp_chan
*smp
= chan
->data
;
1944 struct hci_dev
*hdev
= conn
->hcon
->hdev
;
1948 BT_DBG("conn %p", conn
);
1950 if (skb
->len
< sizeof(*rsp
))
1951 return SMP_INVALID_PARAMS
;
1953 if (conn
->hcon
->role
!= HCI_ROLE_MASTER
)
1954 return SMP_CMD_NOTSUPP
;
1956 skb_pull(skb
, sizeof(*rsp
));
1958 req
= (void *) &smp
->preq
[1];
1960 key_size
= min(req
->max_key_size
, rsp
->max_key_size
);
1961 if (check_enc_key_size(conn
, key_size
))
1962 return SMP_ENC_KEY_SIZE
;
1964 auth
= rsp
->auth_req
& AUTH_REQ_MASK(hdev
);
1966 if (hci_dev_test_flag(hdev
, HCI_SC_ONLY
) && !(auth
& SMP_AUTH_SC
))
1967 return SMP_AUTH_REQUIREMENTS
;
1969 /* If the remote side's OOB flag is set it means it has
1970 * successfully received our local OOB data - therefore set the
1971 * flag to indicate that local OOB is in use.
1973 if (rsp
->oob_flag
== SMP_OOB_PRESENT
&& SMP_DEV(hdev
)->local_oob
)
1974 set_bit(SMP_FLAG_LOCAL_OOB
, &smp
->flags
);
1976 smp
->prsp
[0] = SMP_CMD_PAIRING_RSP
;
1977 memcpy(&smp
->prsp
[1], rsp
, sizeof(*rsp
));
1979 /* Update remote key distribution in case the remote cleared
1980 * some bits that we had enabled in our request.
1982 smp
->remote_key_dist
&= rsp
->resp_key_dist
;
1984 if ((req
->auth_req
& SMP_AUTH_CT2
) && (auth
& SMP_AUTH_CT2
))
1985 set_bit(SMP_FLAG_CT2
, &smp
->flags
);
1987 /* For BR/EDR this means we're done and can start phase 3 */
1988 if (conn
->hcon
->type
== ACL_LINK
) {
1989 /* Clear bits which are generated but not distributed */
1990 smp
->remote_key_dist
&= ~SMP_SC_NO_DIST
;
1991 smp_distribute_keys(smp
);
1995 if ((req
->auth_req
& SMP_AUTH_SC
) && (auth
& SMP_AUTH_SC
))
1996 set_bit(SMP_FLAG_SC
, &smp
->flags
);
1997 else if (conn
->hcon
->pending_sec_level
> BT_SECURITY_HIGH
)
1998 conn
->hcon
->pending_sec_level
= BT_SECURITY_HIGH
;
2000 /* If we need MITM check that it can be achieved */
2001 if (conn
->hcon
->pending_sec_level
>= BT_SECURITY_HIGH
) {
2004 method
= get_auth_method(smp
, req
->io_capability
,
2005 rsp
->io_capability
);
2006 if (method
== JUST_WORKS
|| method
== JUST_CFM
)
2007 return SMP_AUTH_REQUIREMENTS
;
2010 get_random_bytes(smp
->prnd
, sizeof(smp
->prnd
));
2012 /* Update remote key distribution in case the remote cleared
2013 * some bits that we had enabled in our request.
2015 smp
->remote_key_dist
&= rsp
->resp_key_dist
;
2017 if (test_bit(SMP_FLAG_SC
, &smp
->flags
)) {
2018 /* Clear bits which are generated but not distributed */
2019 smp
->remote_key_dist
&= ~SMP_SC_NO_DIST
;
2020 SMP_ALLOW_CMD(smp
, SMP_CMD_PUBLIC_KEY
);
2021 return sc_send_public_key(smp
);
2024 auth
|= req
->auth_req
;
2026 ret
= tk_request(conn
, 0, auth
, req
->io_capability
, rsp
->io_capability
);
2028 return SMP_UNSPECIFIED
;
2030 set_bit(SMP_FLAG_CFM_PENDING
, &smp
->flags
);
2032 /* Can't compose response until we have been confirmed */
2033 if (test_bit(SMP_FLAG_TK_VALID
, &smp
->flags
))
2034 return smp_confirm(smp
);
2039 static u8
sc_check_confirm(struct smp_chan
*smp
)
2041 struct l2cap_conn
*conn
= smp
->conn
;
2045 if (smp
->method
== REQ_PASSKEY
|| smp
->method
== DSP_PASSKEY
)
2046 return sc_passkey_round(smp
, SMP_CMD_PAIRING_CONFIRM
);
2048 if (conn
->hcon
->out
) {
2049 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
, sizeof(smp
->prnd
),
2051 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RANDOM
);
2057 /* Work-around for some implementations that incorrectly copy RFU bits
2058 * from our security request and thereby create the impression that
2059 * we're doing SC when in fact the remote doesn't support it.
2061 static int fixup_sc_false_positive(struct smp_chan
*smp
)
2063 struct l2cap_conn
*conn
= smp
->conn
;
2064 struct hci_conn
*hcon
= conn
->hcon
;
2065 struct hci_dev
*hdev
= hcon
->hdev
;
2066 struct smp_cmd_pairing
*req
, *rsp
;
2069 /* The issue is only observed when we're in slave role */
2071 return SMP_UNSPECIFIED
;
2073 if (hci_dev_test_flag(hdev
, HCI_SC_ONLY
)) {
2074 bt_dev_err(hdev
, "refusing legacy fallback in SC-only mode");
2075 return SMP_UNSPECIFIED
;
2078 bt_dev_err(hdev
, "trying to fall back to legacy SMP");
2080 req
= (void *) &smp
->preq
[1];
2081 rsp
= (void *) &smp
->prsp
[1];
2083 /* Rebuild key dist flags which may have been cleared for SC */
2084 smp
->remote_key_dist
= (req
->init_key_dist
& rsp
->resp_key_dist
);
2086 auth
= req
->auth_req
& AUTH_REQ_MASK(hdev
);
2088 if (tk_request(conn
, 0, auth
, rsp
->io_capability
, req
->io_capability
)) {
2089 bt_dev_err(hdev
, "failed to fall back to legacy SMP");
2090 return SMP_UNSPECIFIED
;
2093 clear_bit(SMP_FLAG_SC
, &smp
->flags
);
2098 static u8
smp_cmd_pairing_confirm(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2100 struct l2cap_chan
*chan
= conn
->smp
;
2101 struct smp_chan
*smp
= chan
->data
;
2103 BT_DBG("conn %p %s", conn
, conn
->hcon
->out
? "master" : "slave");
2105 if (skb
->len
< sizeof(smp
->pcnf
))
2106 return SMP_INVALID_PARAMS
;
2108 memcpy(smp
->pcnf
, skb
->data
, sizeof(smp
->pcnf
));
2109 skb_pull(skb
, sizeof(smp
->pcnf
));
2111 if (test_bit(SMP_FLAG_SC
, &smp
->flags
)) {
2114 /* Public Key exchange must happen before any other steps */
2115 if (test_bit(SMP_FLAG_REMOTE_PK
, &smp
->flags
))
2116 return sc_check_confirm(smp
);
2118 BT_ERR("Unexpected SMP Pairing Confirm");
2120 ret
= fixup_sc_false_positive(smp
);
2125 if (conn
->hcon
->out
) {
2126 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
, sizeof(smp
->prnd
),
2128 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RANDOM
);
2132 if (test_bit(SMP_FLAG_TK_VALID
, &smp
->flags
))
2133 return smp_confirm(smp
);
2135 set_bit(SMP_FLAG_CFM_PENDING
, &smp
->flags
);
2140 static u8
smp_cmd_pairing_random(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2142 struct l2cap_chan
*chan
= conn
->smp
;
2143 struct smp_chan
*smp
= chan
->data
;
2144 struct hci_conn
*hcon
= conn
->hcon
;
2145 u8
*pkax
, *pkbx
, *na
, *nb
;
2149 BT_DBG("conn %p", conn
);
2151 if (skb
->len
< sizeof(smp
->rrnd
))
2152 return SMP_INVALID_PARAMS
;
2154 memcpy(smp
->rrnd
, skb
->data
, sizeof(smp
->rrnd
));
2155 skb_pull(skb
, sizeof(smp
->rrnd
));
2157 if (!test_bit(SMP_FLAG_SC
, &smp
->flags
))
2158 return smp_random(smp
);
2161 pkax
= smp
->local_pk
;
2162 pkbx
= smp
->remote_pk
;
2166 pkax
= smp
->remote_pk
;
2167 pkbx
= smp
->local_pk
;
2172 if (smp
->method
== REQ_OOB
) {
2174 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
,
2175 sizeof(smp
->prnd
), smp
->prnd
);
2176 SMP_ALLOW_CMD(smp
, SMP_CMD_DHKEY_CHECK
);
2177 goto mackey_and_ltk
;
2180 /* Passkey entry has special treatment */
2181 if (smp
->method
== REQ_PASSKEY
|| smp
->method
== DSP_PASSKEY
)
2182 return sc_passkey_round(smp
, SMP_CMD_PAIRING_RANDOM
);
2187 err
= smp_f4(smp
->tfm_cmac
, smp
->remote_pk
, smp
->local_pk
,
2190 return SMP_UNSPECIFIED
;
2192 if (crypto_memneq(smp
->pcnf
, cfm
, 16))
2193 return SMP_CONFIRM_FAILED
;
2195 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
, sizeof(smp
->prnd
),
2197 SMP_ALLOW_CMD(smp
, SMP_CMD_DHKEY_CHECK
);
2201 /* Generate MacKey and LTK */
2202 err
= sc_mackey_and_ltk(smp
, smp
->mackey
, smp
->tk
);
2204 return SMP_UNSPECIFIED
;
2206 if (smp
->method
== JUST_WORKS
|| smp
->method
== REQ_OOB
) {
2208 sc_dhkey_check(smp
);
2209 SMP_ALLOW_CMD(smp
, SMP_CMD_DHKEY_CHECK
);
2214 err
= smp_g2(smp
->tfm_cmac
, pkax
, pkbx
, na
, nb
, &passkey
);
2216 return SMP_UNSPECIFIED
;
2218 err
= mgmt_user_confirm_request(hcon
->hdev
, &hcon
->dst
, hcon
->type
,
2219 hcon
->dst_type
, passkey
, 0);
2221 return SMP_UNSPECIFIED
;
2223 set_bit(SMP_FLAG_WAIT_USER
, &smp
->flags
);
2228 static bool smp_ltk_encrypt(struct l2cap_conn
*conn
, u8 sec_level
)
2230 struct smp_ltk
*key
;
2231 struct hci_conn
*hcon
= conn
->hcon
;
2233 key
= hci_find_ltk(hcon
->hdev
, &hcon
->dst
, hcon
->dst_type
, hcon
->role
);
2237 if (smp_ltk_sec_level(key
) < sec_level
)
2240 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND
, &hcon
->flags
))
2243 hci_le_start_enc(hcon
, key
->ediv
, key
->rand
, key
->val
, key
->enc_size
);
2244 hcon
->enc_key_size
= key
->enc_size
;
2246 /* We never store STKs for master role, so clear this flag */
2247 clear_bit(HCI_CONN_STK_ENCRYPT
, &hcon
->flags
);
2252 bool smp_sufficient_security(struct hci_conn
*hcon
, u8 sec_level
,
2253 enum smp_key_pref key_pref
)
2255 if (sec_level
== BT_SECURITY_LOW
)
2258 /* If we're encrypted with an STK but the caller prefers using
2259 * LTK claim insufficient security. This way we allow the
2260 * connection to be re-encrypted with an LTK, even if the LTK
2261 * provides the same level of security. Only exception is if we
2262 * don't have an LTK (e.g. because of key distribution bits).
2264 if (key_pref
== SMP_USE_LTK
&&
2265 test_bit(HCI_CONN_STK_ENCRYPT
, &hcon
->flags
) &&
2266 hci_find_ltk(hcon
->hdev
, &hcon
->dst
, hcon
->dst_type
, hcon
->role
))
2269 if (hcon
->sec_level
>= sec_level
)
2275 static u8
smp_cmd_security_req(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2277 struct smp_cmd_security_req
*rp
= (void *) skb
->data
;
2278 struct smp_cmd_pairing cp
;
2279 struct hci_conn
*hcon
= conn
->hcon
;
2280 struct hci_dev
*hdev
= hcon
->hdev
;
2281 struct smp_chan
*smp
;
2284 BT_DBG("conn %p", conn
);
2286 if (skb
->len
< sizeof(*rp
))
2287 return SMP_INVALID_PARAMS
;
2289 if (hcon
->role
!= HCI_ROLE_MASTER
)
2290 return SMP_CMD_NOTSUPP
;
2292 auth
= rp
->auth_req
& AUTH_REQ_MASK(hdev
);
2294 if (hci_dev_test_flag(hdev
, HCI_SC_ONLY
) && !(auth
& SMP_AUTH_SC
))
2295 return SMP_AUTH_REQUIREMENTS
;
2297 if (hcon
->io_capability
== HCI_IO_NO_INPUT_OUTPUT
)
2298 sec_level
= BT_SECURITY_MEDIUM
;
2300 sec_level
= authreq_to_seclevel(auth
);
2302 if (smp_sufficient_security(hcon
, sec_level
, SMP_USE_LTK
)) {
2303 /* If link is already encrypted with sufficient security we
2304 * still need refresh encryption as per Core Spec 5.0 Vol 3,
2307 smp_ltk_encrypt(conn
, hcon
->sec_level
);
2311 if (sec_level
> hcon
->pending_sec_level
)
2312 hcon
->pending_sec_level
= sec_level
;
2314 if (smp_ltk_encrypt(conn
, hcon
->pending_sec_level
))
2317 smp
= smp_chan_create(conn
);
2319 return SMP_UNSPECIFIED
;
2321 if (!hci_dev_test_flag(hdev
, HCI_BONDABLE
) &&
2322 (auth
& SMP_AUTH_BONDING
))
2323 return SMP_PAIRING_NOTSUPP
;
2325 skb_pull(skb
, sizeof(*rp
));
2327 memset(&cp
, 0, sizeof(cp
));
2328 build_pairing_cmd(conn
, &cp
, NULL
, auth
);
2330 smp
->preq
[0] = SMP_CMD_PAIRING_REQ
;
2331 memcpy(&smp
->preq
[1], &cp
, sizeof(cp
));
2333 smp_send_cmd(conn
, SMP_CMD_PAIRING_REQ
, sizeof(cp
), &cp
);
2334 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RSP
);
2339 int smp_conn_security(struct hci_conn
*hcon
, __u8 sec_level
)
2341 struct l2cap_conn
*conn
= hcon
->l2cap_data
;
2342 struct l2cap_chan
*chan
;
2343 struct smp_chan
*smp
;
2347 BT_DBG("conn %p hcon %p level 0x%2.2x", conn
, hcon
, sec_level
);
2349 /* This may be NULL if there's an unexpected disconnection */
2353 if (!hci_dev_test_flag(hcon
->hdev
, HCI_LE_ENABLED
))
2356 if (smp_sufficient_security(hcon
, sec_level
, SMP_USE_LTK
))
2359 if (sec_level
> hcon
->pending_sec_level
)
2360 hcon
->pending_sec_level
= sec_level
;
2362 if (hcon
->role
== HCI_ROLE_MASTER
)
2363 if (smp_ltk_encrypt(conn
, hcon
->pending_sec_level
))
2368 bt_dev_err(hcon
->hdev
, "security requested but not available");
2372 l2cap_chan_lock(chan
);
2374 /* If SMP is already in progress ignore this request */
2380 smp
= smp_chan_create(conn
);
2386 authreq
= seclevel_to_authreq(sec_level
);
2388 if (hci_dev_test_flag(hcon
->hdev
, HCI_SC_ENABLED
)) {
2389 authreq
|= SMP_AUTH_SC
;
2390 if (hci_dev_test_flag(hcon
->hdev
, HCI_SSP_ENABLED
))
2391 authreq
|= SMP_AUTH_CT2
;
2394 /* Require MITM if IO Capability allows or the security level
2397 if (hcon
->io_capability
!= HCI_IO_NO_INPUT_OUTPUT
||
2398 hcon
->pending_sec_level
> BT_SECURITY_MEDIUM
)
2399 authreq
|= SMP_AUTH_MITM
;
2401 if (hcon
->role
== HCI_ROLE_MASTER
) {
2402 struct smp_cmd_pairing cp
;
2404 build_pairing_cmd(conn
, &cp
, NULL
, authreq
);
2405 smp
->preq
[0] = SMP_CMD_PAIRING_REQ
;
2406 memcpy(&smp
->preq
[1], &cp
, sizeof(cp
));
2408 smp_send_cmd(conn
, SMP_CMD_PAIRING_REQ
, sizeof(cp
), &cp
);
2409 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RSP
);
2411 struct smp_cmd_security_req cp
;
2412 cp
.auth_req
= authreq
;
2413 smp_send_cmd(conn
, SMP_CMD_SECURITY_REQ
, sizeof(cp
), &cp
);
2414 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_REQ
);
2417 set_bit(SMP_FLAG_INITIATOR
, &smp
->flags
);
2421 l2cap_chan_unlock(chan
);
2425 int smp_cancel_and_remove_pairing(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
2428 struct hci_conn
*hcon
;
2429 struct l2cap_conn
*conn
;
2430 struct l2cap_chan
*chan
;
2431 struct smp_chan
*smp
;
2434 err
= hci_remove_ltk(hdev
, bdaddr
, addr_type
);
2435 hci_remove_irk(hdev
, bdaddr
, addr_type
);
2437 hcon
= hci_conn_hash_lookup_le(hdev
, bdaddr
, addr_type
);
2441 conn
= hcon
->l2cap_data
;
2449 l2cap_chan_lock(chan
);
2453 /* Set keys to NULL to make sure smp_failure() does not try to
2454 * remove and free already invalidated rcu list entries. */
2456 smp
->slave_ltk
= NULL
;
2457 smp
->remote_irk
= NULL
;
2459 if (test_bit(SMP_FLAG_COMPLETE
, &smp
->flags
))
2460 smp_failure(conn
, 0);
2462 smp_failure(conn
, SMP_UNSPECIFIED
);
2466 l2cap_chan_unlock(chan
);
2472 static int smp_cmd_encrypt_info(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2474 struct smp_cmd_encrypt_info
*rp
= (void *) skb
->data
;
2475 struct l2cap_chan
*chan
= conn
->smp
;
2476 struct smp_chan
*smp
= chan
->data
;
2478 BT_DBG("conn %p", conn
);
2480 if (skb
->len
< sizeof(*rp
))
2481 return SMP_INVALID_PARAMS
;
2483 SMP_ALLOW_CMD(smp
, SMP_CMD_MASTER_IDENT
);
2485 skb_pull(skb
, sizeof(*rp
));
2487 memcpy(smp
->tk
, rp
->ltk
, sizeof(smp
->tk
));
2492 static int smp_cmd_master_ident(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2494 struct smp_cmd_master_ident
*rp
= (void *) skb
->data
;
2495 struct l2cap_chan
*chan
= conn
->smp
;
2496 struct smp_chan
*smp
= chan
->data
;
2497 struct hci_dev
*hdev
= conn
->hcon
->hdev
;
2498 struct hci_conn
*hcon
= conn
->hcon
;
2499 struct smp_ltk
*ltk
;
2502 BT_DBG("conn %p", conn
);
2504 if (skb
->len
< sizeof(*rp
))
2505 return SMP_INVALID_PARAMS
;
2507 /* Mark the information as received */
2508 smp
->remote_key_dist
&= ~SMP_DIST_ENC_KEY
;
2510 if (smp
->remote_key_dist
& SMP_DIST_ID_KEY
)
2511 SMP_ALLOW_CMD(smp
, SMP_CMD_IDENT_INFO
);
2512 else if (smp
->remote_key_dist
& SMP_DIST_SIGN
)
2513 SMP_ALLOW_CMD(smp
, SMP_CMD_SIGN_INFO
);
2515 skb_pull(skb
, sizeof(*rp
));
2517 authenticated
= (hcon
->sec_level
== BT_SECURITY_HIGH
);
2518 ltk
= hci_add_ltk(hdev
, &hcon
->dst
, hcon
->dst_type
, SMP_LTK
,
2519 authenticated
, smp
->tk
, smp
->enc_key_size
,
2520 rp
->ediv
, rp
->rand
);
2522 if (!(smp
->remote_key_dist
& KEY_DIST_MASK
))
2523 smp_distribute_keys(smp
);
2528 static int smp_cmd_ident_info(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2530 struct smp_cmd_ident_info
*info
= (void *) skb
->data
;
2531 struct l2cap_chan
*chan
= conn
->smp
;
2532 struct smp_chan
*smp
= chan
->data
;
2536 if (skb
->len
< sizeof(*info
))
2537 return SMP_INVALID_PARAMS
;
2539 SMP_ALLOW_CMD(smp
, SMP_CMD_IDENT_ADDR_INFO
);
2541 skb_pull(skb
, sizeof(*info
));
2543 memcpy(smp
->irk
, info
->irk
, 16);
2548 static int smp_cmd_ident_addr_info(struct l2cap_conn
*conn
,
2549 struct sk_buff
*skb
)
2551 struct smp_cmd_ident_addr_info
*info
= (void *) skb
->data
;
2552 struct l2cap_chan
*chan
= conn
->smp
;
2553 struct smp_chan
*smp
= chan
->data
;
2554 struct hci_conn
*hcon
= conn
->hcon
;
2559 if (skb
->len
< sizeof(*info
))
2560 return SMP_INVALID_PARAMS
;
2562 /* Mark the information as received */
2563 smp
->remote_key_dist
&= ~SMP_DIST_ID_KEY
;
2565 if (smp
->remote_key_dist
& SMP_DIST_SIGN
)
2566 SMP_ALLOW_CMD(smp
, SMP_CMD_SIGN_INFO
);
2568 skb_pull(skb
, sizeof(*info
));
2570 /* Strictly speaking the Core Specification (4.1) allows sending
2571 * an empty address which would force us to rely on just the IRK
2572 * as "identity information". However, since such
2573 * implementations are not known of and in order to not over
2574 * complicate our implementation, simply pretend that we never
2575 * received an IRK for such a device.
2577 * The Identity Address must also be a Static Random or Public
2578 * Address, which hci_is_identity_address() checks for.
2580 if (!bacmp(&info
->bdaddr
, BDADDR_ANY
) ||
2581 !hci_is_identity_address(&info
->bdaddr
, info
->addr_type
)) {
2582 bt_dev_err(hcon
->hdev
, "ignoring IRK with no identity address");
2586 bacpy(&smp
->id_addr
, &info
->bdaddr
);
2587 smp
->id_addr_type
= info
->addr_type
;
2589 if (hci_bdaddr_is_rpa(&hcon
->dst
, hcon
->dst_type
))
2590 bacpy(&rpa
, &hcon
->dst
);
2592 bacpy(&rpa
, BDADDR_ANY
);
2594 smp
->remote_irk
= hci_add_irk(conn
->hcon
->hdev
, &smp
->id_addr
,
2595 smp
->id_addr_type
, smp
->irk
, &rpa
);
2598 if (!(smp
->remote_key_dist
& KEY_DIST_MASK
))
2599 smp_distribute_keys(smp
);
2604 static int smp_cmd_sign_info(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2606 struct smp_cmd_sign_info
*rp
= (void *) skb
->data
;
2607 struct l2cap_chan
*chan
= conn
->smp
;
2608 struct smp_chan
*smp
= chan
->data
;
2609 struct smp_csrk
*csrk
;
2611 BT_DBG("conn %p", conn
);
2613 if (skb
->len
< sizeof(*rp
))
2614 return SMP_INVALID_PARAMS
;
2616 /* Mark the information as received */
2617 smp
->remote_key_dist
&= ~SMP_DIST_SIGN
;
2619 skb_pull(skb
, sizeof(*rp
));
2621 csrk
= kzalloc(sizeof(*csrk
), GFP_KERNEL
);
2623 if (conn
->hcon
->sec_level
> BT_SECURITY_MEDIUM
)
2624 csrk
->type
= MGMT_CSRK_REMOTE_AUTHENTICATED
;
2626 csrk
->type
= MGMT_CSRK_REMOTE_UNAUTHENTICATED
;
2627 memcpy(csrk
->val
, rp
->csrk
, sizeof(csrk
->val
));
2630 smp_distribute_keys(smp
);
2635 static u8
sc_select_method(struct smp_chan
*smp
)
2637 struct l2cap_conn
*conn
= smp
->conn
;
2638 struct hci_conn
*hcon
= conn
->hcon
;
2639 struct smp_cmd_pairing
*local
, *remote
;
2640 u8 local_mitm
, remote_mitm
, local_io
, remote_io
, method
;
2642 if (test_bit(SMP_FLAG_REMOTE_OOB
, &smp
->flags
) ||
2643 test_bit(SMP_FLAG_LOCAL_OOB
, &smp
->flags
))
2646 /* The preq/prsp contain the raw Pairing Request/Response PDUs
2647 * which are needed as inputs to some crypto functions. To get
2648 * the "struct smp_cmd_pairing" from them we need to skip the
2649 * first byte which contains the opcode.
2652 local
= (void *) &smp
->preq
[1];
2653 remote
= (void *) &smp
->prsp
[1];
2655 local
= (void *) &smp
->prsp
[1];
2656 remote
= (void *) &smp
->preq
[1];
2659 local_io
= local
->io_capability
;
2660 remote_io
= remote
->io_capability
;
2662 local_mitm
= (local
->auth_req
& SMP_AUTH_MITM
);
2663 remote_mitm
= (remote
->auth_req
& SMP_AUTH_MITM
);
2665 /* If either side wants MITM, look up the method from the table,
2666 * otherwise use JUST WORKS.
2668 if (local_mitm
|| remote_mitm
)
2669 method
= get_auth_method(smp
, local_io
, remote_io
);
2671 method
= JUST_WORKS
;
2673 /* Don't confirm locally initiated pairing attempts */
2674 if (method
== JUST_CFM
&& test_bit(SMP_FLAG_INITIATOR
, &smp
->flags
))
2675 method
= JUST_WORKS
;
2680 static int smp_cmd_public_key(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2682 struct smp_cmd_public_key
*key
= (void *) skb
->data
;
2683 struct hci_conn
*hcon
= conn
->hcon
;
2684 struct l2cap_chan
*chan
= conn
->smp
;
2685 struct smp_chan
*smp
= chan
->data
;
2686 struct hci_dev
*hdev
= hcon
->hdev
;
2687 struct crypto_kpp
*tfm_ecdh
;
2688 struct smp_cmd_pairing_confirm cfm
;
2691 BT_DBG("conn %p", conn
);
2693 if (skb
->len
< sizeof(*key
))
2694 return SMP_INVALID_PARAMS
;
2696 memcpy(smp
->remote_pk
, key
, 64);
2698 if (test_bit(SMP_FLAG_REMOTE_OOB
, &smp
->flags
)) {
2699 err
= smp_f4(smp
->tfm_cmac
, smp
->remote_pk
, smp
->remote_pk
,
2700 smp
->rr
, 0, cfm
.confirm_val
);
2702 return SMP_UNSPECIFIED
;
2704 if (crypto_memneq(cfm
.confirm_val
, smp
->pcnf
, 16))
2705 return SMP_CONFIRM_FAILED
;
2708 /* Non-initiating device sends its public key after receiving
2709 * the key from the initiating device.
2712 err
= sc_send_public_key(smp
);
2717 SMP_DBG("Remote Public Key X: %32phN", smp
->remote_pk
);
2718 SMP_DBG("Remote Public Key Y: %32phN", smp
->remote_pk
+ 32);
2720 /* Compute the shared secret on the same crypto tfm on which the private
2721 * key was set/generated.
2723 if (test_bit(SMP_FLAG_LOCAL_OOB
, &smp
->flags
)) {
2724 struct l2cap_chan
*hchan
= hdev
->smp_data
;
2725 struct smp_dev
*smp_dev
;
2727 if (!hchan
|| !hchan
->data
)
2728 return SMP_UNSPECIFIED
;
2730 smp_dev
= hchan
->data
;
2732 tfm_ecdh
= smp_dev
->tfm_ecdh
;
2734 tfm_ecdh
= smp
->tfm_ecdh
;
2737 if (compute_ecdh_secret(tfm_ecdh
, smp
->remote_pk
, smp
->dhkey
))
2738 return SMP_UNSPECIFIED
;
2740 SMP_DBG("DHKey %32phN", smp
->dhkey
);
2742 set_bit(SMP_FLAG_REMOTE_PK
, &smp
->flags
);
2744 smp
->method
= sc_select_method(smp
);
2746 BT_DBG("%s selected method 0x%02x", hdev
->name
, smp
->method
);
2748 /* JUST_WORKS and JUST_CFM result in an unauthenticated key */
2749 if (smp
->method
== JUST_WORKS
|| smp
->method
== JUST_CFM
)
2750 hcon
->pending_sec_level
= BT_SECURITY_MEDIUM
;
2752 hcon
->pending_sec_level
= BT_SECURITY_FIPS
;
2754 if (!crypto_memneq(debug_pk
, smp
->remote_pk
, 64))
2755 set_bit(SMP_FLAG_DEBUG_KEY
, &smp
->flags
);
2757 if (smp
->method
== DSP_PASSKEY
) {
2758 get_random_bytes(&hcon
->passkey_notify
,
2759 sizeof(hcon
->passkey_notify
));
2760 hcon
->passkey_notify
%= 1000000;
2761 hcon
->passkey_entered
= 0;
2762 smp
->passkey_round
= 0;
2763 if (mgmt_user_passkey_notify(hdev
, &hcon
->dst
, hcon
->type
,
2765 hcon
->passkey_notify
,
2766 hcon
->passkey_entered
))
2767 return SMP_UNSPECIFIED
;
2768 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_CONFIRM
);
2769 return sc_passkey_round(smp
, SMP_CMD_PUBLIC_KEY
);
2772 if (smp
->method
== REQ_OOB
) {
2774 smp_send_cmd(conn
, SMP_CMD_PAIRING_RANDOM
,
2775 sizeof(smp
->prnd
), smp
->prnd
);
2777 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RANDOM
);
2783 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_CONFIRM
);
2785 if (smp
->method
== REQ_PASSKEY
) {
2786 if (mgmt_user_passkey_request(hdev
, &hcon
->dst
, hcon
->type
,
2788 return SMP_UNSPECIFIED
;
2789 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_CONFIRM
);
2790 set_bit(SMP_FLAG_WAIT_USER
, &smp
->flags
);
2794 /* The Initiating device waits for the non-initiating device to
2795 * send the confirm value.
2797 if (conn
->hcon
->out
)
2800 err
= smp_f4(smp
->tfm_cmac
, smp
->local_pk
, smp
->remote_pk
, smp
->prnd
,
2801 0, cfm
.confirm_val
);
2803 return SMP_UNSPECIFIED
;
2805 smp_send_cmd(conn
, SMP_CMD_PAIRING_CONFIRM
, sizeof(cfm
), &cfm
);
2806 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RANDOM
);
2811 static int smp_cmd_dhkey_check(struct l2cap_conn
*conn
, struct sk_buff
*skb
)
2813 struct smp_cmd_dhkey_check
*check
= (void *) skb
->data
;
2814 struct l2cap_chan
*chan
= conn
->smp
;
2815 struct hci_conn
*hcon
= conn
->hcon
;
2816 struct smp_chan
*smp
= chan
->data
;
2817 u8 a
[7], b
[7], *local_addr
, *remote_addr
;
2818 u8 io_cap
[3], r
[16], e
[16];
2821 BT_DBG("conn %p", conn
);
2823 if (skb
->len
< sizeof(*check
))
2824 return SMP_INVALID_PARAMS
;
2826 memcpy(a
, &hcon
->init_addr
, 6);
2827 memcpy(b
, &hcon
->resp_addr
, 6);
2828 a
[6] = hcon
->init_addr_type
;
2829 b
[6] = hcon
->resp_addr_type
;
2834 memcpy(io_cap
, &smp
->prsp
[1], 3);
2838 memcpy(io_cap
, &smp
->preq
[1], 3);
2841 memset(r
, 0, sizeof(r
));
2843 if (smp
->method
== REQ_PASSKEY
|| smp
->method
== DSP_PASSKEY
)
2844 put_unaligned_le32(hcon
->passkey_notify
, r
);
2845 else if (smp
->method
== REQ_OOB
)
2846 memcpy(r
, smp
->lr
, 16);
2848 err
= smp_f6(smp
->tfm_cmac
, smp
->mackey
, smp
->rrnd
, smp
->prnd
, r
,
2849 io_cap
, remote_addr
, local_addr
, e
);
2851 return SMP_UNSPECIFIED
;
2853 if (crypto_memneq(check
->e
, e
, 16))
2854 return SMP_DHKEY_CHECK_FAILED
;
2857 if (test_bit(SMP_FLAG_WAIT_USER
, &smp
->flags
)) {
2858 set_bit(SMP_FLAG_DHKEY_PENDING
, &smp
->flags
);
2862 /* Slave sends DHKey check as response to master */
2863 sc_dhkey_check(smp
);
2869 hci_le_start_enc(hcon
, 0, 0, smp
->tk
, smp
->enc_key_size
);
2870 hcon
->enc_key_size
= smp
->enc_key_size
;
2876 static int smp_cmd_keypress_notify(struct l2cap_conn
*conn
,
2877 struct sk_buff
*skb
)
2879 struct smp_cmd_keypress_notify
*kp
= (void *) skb
->data
;
2881 BT_DBG("value 0x%02x", kp
->value
);
2886 static int smp_sig_channel(struct l2cap_chan
*chan
, struct sk_buff
*skb
)
2888 struct l2cap_conn
*conn
= chan
->conn
;
2889 struct hci_conn
*hcon
= conn
->hcon
;
2890 struct smp_chan
*smp
;
2897 if (!hci_dev_test_flag(hcon
->hdev
, HCI_LE_ENABLED
)) {
2898 reason
= SMP_PAIRING_NOTSUPP
;
2902 code
= skb
->data
[0];
2903 skb_pull(skb
, sizeof(code
));
2907 if (code
> SMP_CMD_MAX
)
2910 if (smp
&& !test_and_clear_bit(code
, &smp
->allow_cmd
))
2913 /* If we don't have a context the only allowed commands are
2914 * pairing request and security request.
2916 if (!smp
&& code
!= SMP_CMD_PAIRING_REQ
&& code
!= SMP_CMD_SECURITY_REQ
)
2920 case SMP_CMD_PAIRING_REQ
:
2921 reason
= smp_cmd_pairing_req(conn
, skb
);
2924 case SMP_CMD_PAIRING_FAIL
:
2925 smp_failure(conn
, 0);
2929 case SMP_CMD_PAIRING_RSP
:
2930 reason
= smp_cmd_pairing_rsp(conn
, skb
);
2933 case SMP_CMD_SECURITY_REQ
:
2934 reason
= smp_cmd_security_req(conn
, skb
);
2937 case SMP_CMD_PAIRING_CONFIRM
:
2938 reason
= smp_cmd_pairing_confirm(conn
, skb
);
2941 case SMP_CMD_PAIRING_RANDOM
:
2942 reason
= smp_cmd_pairing_random(conn
, skb
);
2945 case SMP_CMD_ENCRYPT_INFO
:
2946 reason
= smp_cmd_encrypt_info(conn
, skb
);
2949 case SMP_CMD_MASTER_IDENT
:
2950 reason
= smp_cmd_master_ident(conn
, skb
);
2953 case SMP_CMD_IDENT_INFO
:
2954 reason
= smp_cmd_ident_info(conn
, skb
);
2957 case SMP_CMD_IDENT_ADDR_INFO
:
2958 reason
= smp_cmd_ident_addr_info(conn
, skb
);
2961 case SMP_CMD_SIGN_INFO
:
2962 reason
= smp_cmd_sign_info(conn
, skb
);
2965 case SMP_CMD_PUBLIC_KEY
:
2966 reason
= smp_cmd_public_key(conn
, skb
);
2969 case SMP_CMD_DHKEY_CHECK
:
2970 reason
= smp_cmd_dhkey_check(conn
, skb
);
2973 case SMP_CMD_KEYPRESS_NOTIFY
:
2974 reason
= smp_cmd_keypress_notify(conn
, skb
);
2978 BT_DBG("Unknown command code 0x%2.2x", code
);
2979 reason
= SMP_CMD_NOTSUPP
;
2986 smp_failure(conn
, reason
);
2993 bt_dev_err(hcon
->hdev
, "unexpected SMP command 0x%02x from %pMR",
2999 static void smp_teardown_cb(struct l2cap_chan
*chan
, int err
)
3001 struct l2cap_conn
*conn
= chan
->conn
;
3003 BT_DBG("chan %p", chan
);
3006 smp_chan_destroy(conn
);
3009 l2cap_chan_put(chan
);
3012 static void bredr_pairing(struct l2cap_chan
*chan
)
3014 struct l2cap_conn
*conn
= chan
->conn
;
3015 struct hci_conn
*hcon
= conn
->hcon
;
3016 struct hci_dev
*hdev
= hcon
->hdev
;
3017 struct smp_cmd_pairing req
;
3018 struct smp_chan
*smp
;
3020 BT_DBG("chan %p", chan
);
3022 /* Only new pairings are interesting */
3023 if (!test_bit(HCI_CONN_NEW_LINK_KEY
, &hcon
->flags
))
3026 /* Don't bother if we're not encrypted */
3027 if (!test_bit(HCI_CONN_ENCRYPT
, &hcon
->flags
))
3030 /* Only master may initiate SMP over BR/EDR */
3031 if (hcon
->role
!= HCI_ROLE_MASTER
)
3034 /* Secure Connections support must be enabled */
3035 if (!hci_dev_test_flag(hdev
, HCI_SC_ENABLED
))
3038 /* BR/EDR must use Secure Connections for SMP */
3039 if (!test_bit(HCI_CONN_AES_CCM
, &hcon
->flags
) &&
3040 !hci_dev_test_flag(hdev
, HCI_FORCE_BREDR_SMP
))
3043 /* If our LE support is not enabled don't do anything */
3044 if (!hci_dev_test_flag(hdev
, HCI_LE_ENABLED
))
3047 /* Don't bother if remote LE support is not enabled */
3048 if (!lmp_host_le_capable(hcon
))
3051 /* Remote must support SMP fixed chan for BR/EDR */
3052 if (!(conn
->remote_fixed_chan
& L2CAP_FC_SMP_BREDR
))
3055 /* Don't bother if SMP is already ongoing */
3059 smp
= smp_chan_create(conn
);
3061 bt_dev_err(hdev
, "unable to create SMP context for BR/EDR");
3065 set_bit(SMP_FLAG_SC
, &smp
->flags
);
3067 BT_DBG("%s starting SMP over BR/EDR", hdev
->name
);
3069 /* Prepare and send the BR/EDR SMP Pairing Request */
3070 build_bredr_pairing_cmd(smp
, &req
, NULL
);
3072 smp
->preq
[0] = SMP_CMD_PAIRING_REQ
;
3073 memcpy(&smp
->preq
[1], &req
, sizeof(req
));
3075 smp_send_cmd(conn
, SMP_CMD_PAIRING_REQ
, sizeof(req
), &req
);
3076 SMP_ALLOW_CMD(smp
, SMP_CMD_PAIRING_RSP
);
3079 static void smp_resume_cb(struct l2cap_chan
*chan
)
3081 struct smp_chan
*smp
= chan
->data
;
3082 struct l2cap_conn
*conn
= chan
->conn
;
3083 struct hci_conn
*hcon
= conn
->hcon
;
3085 BT_DBG("chan %p", chan
);
3087 if (hcon
->type
== ACL_LINK
) {
3088 bredr_pairing(chan
);
3095 if (!test_bit(HCI_CONN_ENCRYPT
, &hcon
->flags
))
3098 cancel_delayed_work(&smp
->security_timer
);
3100 smp_distribute_keys(smp
);
3103 static void smp_ready_cb(struct l2cap_chan
*chan
)
3105 struct l2cap_conn
*conn
= chan
->conn
;
3106 struct hci_conn
*hcon
= conn
->hcon
;
3108 BT_DBG("chan %p", chan
);
3110 /* No need to call l2cap_chan_hold() here since we already own
3111 * the reference taken in smp_new_conn_cb(). This is just the
3112 * first time that we tie it to a specific pointer. The code in
3113 * l2cap_core.c ensures that there's no risk this function wont
3114 * get called if smp_new_conn_cb was previously called.
3118 if (hcon
->type
== ACL_LINK
&& test_bit(HCI_CONN_ENCRYPT
, &hcon
->flags
))
3119 bredr_pairing(chan
);
3122 static int smp_recv_cb(struct l2cap_chan
*chan
, struct sk_buff
*skb
)
3126 BT_DBG("chan %p", chan
);
3128 err
= smp_sig_channel(chan
, skb
);
3130 struct smp_chan
*smp
= chan
->data
;
3133 cancel_delayed_work_sync(&smp
->security_timer
);
3135 hci_disconnect(chan
->conn
->hcon
, HCI_ERROR_AUTH_FAILURE
);
3141 static struct sk_buff
*smp_alloc_skb_cb(struct l2cap_chan
*chan
,
3142 unsigned long hdr_len
,
3143 unsigned long len
, int nb
)
3145 struct sk_buff
*skb
;
3147 skb
= bt_skb_alloc(hdr_len
+ len
, GFP_KERNEL
);
3149 return ERR_PTR(-ENOMEM
);
3151 skb
->priority
= HCI_PRIO_MAX
;
3152 bt_cb(skb
)->l2cap
.chan
= chan
;
3157 static const struct l2cap_ops smp_chan_ops
= {
3158 .name
= "Security Manager",
3159 .ready
= smp_ready_cb
,
3160 .recv
= smp_recv_cb
,
3161 .alloc_skb
= smp_alloc_skb_cb
,
3162 .teardown
= smp_teardown_cb
,
3163 .resume
= smp_resume_cb
,
3165 .new_connection
= l2cap_chan_no_new_connection
,
3166 .state_change
= l2cap_chan_no_state_change
,
3167 .close
= l2cap_chan_no_close
,
3168 .defer
= l2cap_chan_no_defer
,
3169 .suspend
= l2cap_chan_no_suspend
,
3170 .set_shutdown
= l2cap_chan_no_set_shutdown
,
3171 .get_sndtimeo
= l2cap_chan_no_get_sndtimeo
,
3174 static inline struct l2cap_chan
*smp_new_conn_cb(struct l2cap_chan
*pchan
)
3176 struct l2cap_chan
*chan
;
3178 BT_DBG("pchan %p", pchan
);
3180 chan
= l2cap_chan_create();
3184 chan
->chan_type
= pchan
->chan_type
;
3185 chan
->ops
= &smp_chan_ops
;
3186 chan
->scid
= pchan
->scid
;
3187 chan
->dcid
= chan
->scid
;
3188 chan
->imtu
= pchan
->imtu
;
3189 chan
->omtu
= pchan
->omtu
;
3190 chan
->mode
= pchan
->mode
;
3192 /* Other L2CAP channels may request SMP routines in order to
3193 * change the security level. This means that the SMP channel
3194 * lock must be considered in its own category to avoid lockdep
3197 atomic_set(&chan
->nesting
, L2CAP_NESTING_SMP
);
3199 BT_DBG("created chan %p", chan
);
3204 static const struct l2cap_ops smp_root_chan_ops
= {
3205 .name
= "Security Manager Root",
3206 .new_connection
= smp_new_conn_cb
,
3208 /* None of these are implemented for the root channel */
3209 .close
= l2cap_chan_no_close
,
3210 .alloc_skb
= l2cap_chan_no_alloc_skb
,
3211 .recv
= l2cap_chan_no_recv
,
3212 .state_change
= l2cap_chan_no_state_change
,
3213 .teardown
= l2cap_chan_no_teardown
,
3214 .ready
= l2cap_chan_no_ready
,
3215 .defer
= l2cap_chan_no_defer
,
3216 .suspend
= l2cap_chan_no_suspend
,
3217 .resume
= l2cap_chan_no_resume
,
3218 .set_shutdown
= l2cap_chan_no_set_shutdown
,
3219 .get_sndtimeo
= l2cap_chan_no_get_sndtimeo
,
3222 static struct l2cap_chan
*smp_add_cid(struct hci_dev
*hdev
, u16 cid
)
3224 struct l2cap_chan
*chan
;
3225 struct smp_dev
*smp
;
3226 struct crypto_cipher
*tfm_aes
;
3227 struct crypto_shash
*tfm_cmac
;
3228 struct crypto_kpp
*tfm_ecdh
;
3230 if (cid
== L2CAP_CID_SMP_BREDR
) {
3235 smp
= kzalloc(sizeof(*smp
), GFP_KERNEL
);
3237 return ERR_PTR(-ENOMEM
);
3239 tfm_aes
= crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC
);
3240 if (IS_ERR(tfm_aes
)) {
3241 BT_ERR("Unable to create AES crypto context");
3243 return ERR_CAST(tfm_aes
);
3246 tfm_cmac
= crypto_alloc_shash("cmac(aes)", 0, 0);
3247 if (IS_ERR(tfm_cmac
)) {
3248 BT_ERR("Unable to create CMAC crypto context");
3249 crypto_free_cipher(tfm_aes
);
3251 return ERR_CAST(tfm_cmac
);
3254 tfm_ecdh
= crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL
, 0);
3255 if (IS_ERR(tfm_ecdh
)) {
3256 BT_ERR("Unable to create ECDH crypto context");
3257 crypto_free_shash(tfm_cmac
);
3258 crypto_free_cipher(tfm_aes
);
3260 return ERR_CAST(tfm_ecdh
);
3263 smp
->local_oob
= false;
3264 smp
->tfm_aes
= tfm_aes
;
3265 smp
->tfm_cmac
= tfm_cmac
;
3266 smp
->tfm_ecdh
= tfm_ecdh
;
3267 smp
->min_key_size
= SMP_MIN_ENC_KEY_SIZE
;
3268 smp
->max_key_size
= SMP_MAX_ENC_KEY_SIZE
;
3271 chan
= l2cap_chan_create();
3274 crypto_free_cipher(smp
->tfm_aes
);
3275 crypto_free_shash(smp
->tfm_cmac
);
3276 crypto_free_kpp(smp
->tfm_ecdh
);
3279 return ERR_PTR(-ENOMEM
);
3284 l2cap_add_scid(chan
, cid
);
3286 l2cap_chan_set_defaults(chan
);
3288 if (cid
== L2CAP_CID_SMP
) {
3291 hci_copy_identity_address(hdev
, &chan
->src
, &bdaddr_type
);
3293 if (bdaddr_type
== ADDR_LE_DEV_PUBLIC
)
3294 chan
->src_type
= BDADDR_LE_PUBLIC
;
3296 chan
->src_type
= BDADDR_LE_RANDOM
;
3298 bacpy(&chan
->src
, &hdev
->bdaddr
);
3299 chan
->src_type
= BDADDR_BREDR
;
3302 chan
->state
= BT_LISTEN
;
3303 chan
->mode
= L2CAP_MODE_BASIC
;
3304 chan
->imtu
= L2CAP_DEFAULT_MTU
;
3305 chan
->ops
= &smp_root_chan_ops
;
3307 /* Set correct nesting level for a parent/listening channel */
3308 atomic_set(&chan
->nesting
, L2CAP_NESTING_PARENT
);
3313 static void smp_del_chan(struct l2cap_chan
*chan
)
3315 struct smp_dev
*smp
;
3317 BT_DBG("chan %p", chan
);
3322 crypto_free_cipher(smp
->tfm_aes
);
3323 crypto_free_shash(smp
->tfm_cmac
);
3324 crypto_free_kpp(smp
->tfm_ecdh
);
3328 l2cap_chan_put(chan
);
3331 static ssize_t
force_bredr_smp_read(struct file
*file
,
3332 char __user
*user_buf
,
3333 size_t count
, loff_t
*ppos
)
3335 struct hci_dev
*hdev
= file
->private_data
;
3338 buf
[0] = hci_dev_test_flag(hdev
, HCI_FORCE_BREDR_SMP
) ? 'Y': 'N';
3341 return simple_read_from_buffer(user_buf
, count
, ppos
, buf
, 2);
3344 static ssize_t
force_bredr_smp_write(struct file
*file
,
3345 const char __user
*user_buf
,
3346 size_t count
, loff_t
*ppos
)
3348 struct hci_dev
*hdev
= file
->private_data
;
3350 size_t buf_size
= min(count
, (sizeof(buf
)-1));
3353 if (copy_from_user(buf
, user_buf
, buf_size
))
3356 buf
[buf_size
] = '\0';
3357 if (strtobool(buf
, &enable
))
3360 if (enable
== hci_dev_test_flag(hdev
, HCI_FORCE_BREDR_SMP
))
3364 struct l2cap_chan
*chan
;
3366 chan
= smp_add_cid(hdev
, L2CAP_CID_SMP_BREDR
);
3368 return PTR_ERR(chan
);
3370 hdev
->smp_bredr_data
= chan
;
3372 struct l2cap_chan
*chan
;
3374 chan
= hdev
->smp_bredr_data
;
3375 hdev
->smp_bredr_data
= NULL
;
3379 hci_dev_change_flag(hdev
, HCI_FORCE_BREDR_SMP
);
3384 static const struct file_operations force_bredr_smp_fops
= {
3385 .open
= simple_open
,
3386 .read
= force_bredr_smp_read
,
3387 .write
= force_bredr_smp_write
,
3388 .llseek
= default_llseek
,
3391 static ssize_t
le_min_key_size_read(struct file
*file
,
3392 char __user
*user_buf
,
3393 size_t count
, loff_t
*ppos
)
3395 struct hci_dev
*hdev
= file
->private_data
;
3398 snprintf(buf
, sizeof(buf
), "%2u\n", SMP_DEV(hdev
)->min_key_size
);
3400 return simple_read_from_buffer(user_buf
, count
, ppos
, buf
, strlen(buf
));
3403 static ssize_t
le_min_key_size_write(struct file
*file
,
3404 const char __user
*user_buf
,
3405 size_t count
, loff_t
*ppos
)
3407 struct hci_dev
*hdev
= file
->private_data
;
3409 size_t buf_size
= min(count
, (sizeof(buf
) - 1));
3412 if (copy_from_user(buf
, user_buf
, buf_size
))
3415 buf
[buf_size
] = '\0';
3417 sscanf(buf
, "%hhu", &key_size
);
3419 if (key_size
> SMP_DEV(hdev
)->max_key_size
||
3420 key_size
< SMP_MIN_ENC_KEY_SIZE
)
3423 SMP_DEV(hdev
)->min_key_size
= key_size
;
3428 static const struct file_operations le_min_key_size_fops
= {
3429 .open
= simple_open
,
3430 .read
= le_min_key_size_read
,
3431 .write
= le_min_key_size_write
,
3432 .llseek
= default_llseek
,
3435 static ssize_t
le_max_key_size_read(struct file
*file
,
3436 char __user
*user_buf
,
3437 size_t count
, loff_t
*ppos
)
3439 struct hci_dev
*hdev
= file
->private_data
;
3442 snprintf(buf
, sizeof(buf
), "%2u\n", SMP_DEV(hdev
)->max_key_size
);
3444 return simple_read_from_buffer(user_buf
, count
, ppos
, buf
, strlen(buf
));
3447 static ssize_t
le_max_key_size_write(struct file
*file
,
3448 const char __user
*user_buf
,
3449 size_t count
, loff_t
*ppos
)
3451 struct hci_dev
*hdev
= file
->private_data
;
3453 size_t buf_size
= min(count
, (sizeof(buf
) - 1));
3456 if (copy_from_user(buf
, user_buf
, buf_size
))
3459 buf
[buf_size
] = '\0';
3461 sscanf(buf
, "%hhu", &key_size
);
3463 if (key_size
> SMP_MAX_ENC_KEY_SIZE
||
3464 key_size
< SMP_DEV(hdev
)->min_key_size
)
3467 SMP_DEV(hdev
)->max_key_size
= key_size
;
3472 static const struct file_operations le_max_key_size_fops
= {
3473 .open
= simple_open
,
3474 .read
= le_max_key_size_read
,
3475 .write
= le_max_key_size_write
,
3476 .llseek
= default_llseek
,
3479 int smp_register(struct hci_dev
*hdev
)
3481 struct l2cap_chan
*chan
;
3483 BT_DBG("%s", hdev
->name
);
3485 /* If the controller does not support Low Energy operation, then
3486 * there is also no need to register any SMP channel.
3488 if (!lmp_le_capable(hdev
))
3491 if (WARN_ON(hdev
->smp_data
)) {
3492 chan
= hdev
->smp_data
;
3493 hdev
->smp_data
= NULL
;
3497 chan
= smp_add_cid(hdev
, L2CAP_CID_SMP
);
3499 return PTR_ERR(chan
);
3501 hdev
->smp_data
= chan
;
3503 debugfs_create_file("le_min_key_size", 0644, hdev
->debugfs
, hdev
,
3504 &le_min_key_size_fops
);
3505 debugfs_create_file("le_max_key_size", 0644, hdev
->debugfs
, hdev
,
3506 &le_max_key_size_fops
);
3508 /* If the controller does not support BR/EDR Secure Connections
3509 * feature, then the BR/EDR SMP channel shall not be present.
3511 * To test this with Bluetooth 4.0 controllers, create a debugfs
3512 * switch that allows forcing BR/EDR SMP support and accepting
3513 * cross-transport pairing on non-AES encrypted connections.
3515 if (!lmp_sc_capable(hdev
)) {
3516 debugfs_create_file("force_bredr_smp", 0644, hdev
->debugfs
,
3517 hdev
, &force_bredr_smp_fops
);
3519 /* Flag can be already set here (due to power toggle) */
3520 if (!hci_dev_test_flag(hdev
, HCI_FORCE_BREDR_SMP
))
3524 if (WARN_ON(hdev
->smp_bredr_data
)) {
3525 chan
= hdev
->smp_bredr_data
;
3526 hdev
->smp_bredr_data
= NULL
;
3530 chan
= smp_add_cid(hdev
, L2CAP_CID_SMP_BREDR
);
3532 int err
= PTR_ERR(chan
);
3533 chan
= hdev
->smp_data
;
3534 hdev
->smp_data
= NULL
;
3539 hdev
->smp_bredr_data
= chan
;
3544 void smp_unregister(struct hci_dev
*hdev
)
3546 struct l2cap_chan
*chan
;
3548 if (hdev
->smp_bredr_data
) {
3549 chan
= hdev
->smp_bredr_data
;
3550 hdev
->smp_bredr_data
= NULL
;
3554 if (hdev
->smp_data
) {
3555 chan
= hdev
->smp_data
;
3556 hdev
->smp_data
= NULL
;
3561 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP)
3563 static int __init
test_debug_key(struct crypto_kpp
*tfm_ecdh
)
3568 err
= set_ecdh_privkey(tfm_ecdh
, debug_sk
);
3572 err
= generate_ecdh_public_key(tfm_ecdh
, pk
);
3576 if (crypto_memneq(pk
, debug_pk
, 64))
3582 static int __init
test_ah(struct crypto_cipher
*tfm_aes
)
3584 const u8 irk
[16] = {
3585 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3586 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3587 const u8 r
[3] = { 0x94, 0x81, 0x70 };
3588 const u8 exp
[3] = { 0xaa, 0xfb, 0x0d };
3592 err
= smp_ah(tfm_aes
, irk
, r
, res
);
3596 if (crypto_memneq(res
, exp
, 3))
3602 static int __init
test_c1(struct crypto_cipher
*tfm_aes
)
3605 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3606 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3608 0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63,
3609 0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 };
3610 const u8 preq
[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 };
3611 const u8 pres
[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 };
3612 const u8 _iat
= 0x01;
3613 const u8 _rat
= 0x00;
3614 const bdaddr_t ra
= { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } };
3615 const bdaddr_t ia
= { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } };
3616 const u8 exp
[16] = {
3617 0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2,
3618 0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e };
3622 err
= smp_c1(tfm_aes
, k
, r
, preq
, pres
, _iat
, &ia
, _rat
, &ra
, res
);
3626 if (crypto_memneq(res
, exp
, 16))
3632 static int __init
test_s1(struct crypto_cipher
*tfm_aes
)
3635 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3636 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3638 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 };
3640 0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 };
3641 const u8 exp
[16] = {
3642 0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b,
3643 0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a };
3647 err
= smp_s1(tfm_aes
, k
, r1
, r2
, res
);
3651 if (crypto_memneq(res
, exp
, 16))
3657 static int __init
test_f4(struct crypto_shash
*tfm_cmac
)
3660 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3661 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3662 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3663 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3665 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3666 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3667 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3668 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3670 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3671 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3673 const u8 exp
[16] = {
3674 0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1,
3675 0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 };
3679 err
= smp_f4(tfm_cmac
, u
, v
, x
, z
, res
);
3683 if (crypto_memneq(res
, exp
, 16))
3689 static int __init
test_f5(struct crypto_shash
*tfm_cmac
)
3692 0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86,
3693 0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99,
3694 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3695 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3697 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3698 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3700 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3701 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3702 const u8 a1
[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3703 const u8 a2
[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3704 const u8 exp_ltk
[16] = {
3705 0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98,
3706 0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 };
3707 const u8 exp_mackey
[16] = {
3708 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3709 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3710 u8 mackey
[16], ltk
[16];
3713 err
= smp_f5(tfm_cmac
, w
, n1
, n2
, a1
, a2
, mackey
, ltk
);
3717 if (crypto_memneq(mackey
, exp_mackey
, 16))
3720 if (crypto_memneq(ltk
, exp_ltk
, 16))
3726 static int __init
test_f6(struct crypto_shash
*tfm_cmac
)
3729 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3730 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3732 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3733 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3735 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3736 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3738 0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08,
3739 0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 };
3740 const u8 io_cap
[3] = { 0x02, 0x01, 0x01 };
3741 const u8 a1
[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3742 const u8 a2
[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3743 const u8 exp
[16] = {
3744 0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2,
3745 0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 };
3749 err
= smp_f6(tfm_cmac
, w
, n1
, n2
, r
, io_cap
, a1
, a2
, res
);
3753 if (crypto_memneq(res
, exp
, 16))
3759 static int __init
test_g2(struct crypto_shash
*tfm_cmac
)
3762 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3763 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3764 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3765 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3767 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3768 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3769 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3770 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3772 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3773 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3775 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3776 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3777 const u32 exp_val
= 0x2f9ed5ba % 1000000;
3781 err
= smp_g2(tfm_cmac
, u
, v
, x
, y
, &val
);
3791 static int __init
test_h6(struct crypto_shash
*tfm_cmac
)
3794 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3795 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3796 const u8 key_id
[4] = { 0x72, 0x62, 0x65, 0x6c };
3797 const u8 exp
[16] = {
3798 0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8,
3799 0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d };
3803 err
= smp_h6(tfm_cmac
, w
, key_id
, res
);
3807 if (crypto_memneq(res
, exp
, 16))
3813 static char test_smp_buffer
[32];
3815 static ssize_t
test_smp_read(struct file
*file
, char __user
*user_buf
,
3816 size_t count
, loff_t
*ppos
)
3818 return simple_read_from_buffer(user_buf
, count
, ppos
, test_smp_buffer
,
3819 strlen(test_smp_buffer
));
3822 static const struct file_operations test_smp_fops
= {
3823 .open
= simple_open
,
3824 .read
= test_smp_read
,
3825 .llseek
= default_llseek
,
3828 static int __init
run_selftests(struct crypto_cipher
*tfm_aes
,
3829 struct crypto_shash
*tfm_cmac
,
3830 struct crypto_kpp
*tfm_ecdh
)
3832 ktime_t calltime
, delta
, rettime
;
3833 unsigned long long duration
;
3836 calltime
= ktime_get();
3838 err
= test_debug_key(tfm_ecdh
);
3840 BT_ERR("debug_key test failed");
3844 err
= test_ah(tfm_aes
);
3846 BT_ERR("smp_ah test failed");
3850 err
= test_c1(tfm_aes
);
3852 BT_ERR("smp_c1 test failed");
3856 err
= test_s1(tfm_aes
);
3858 BT_ERR("smp_s1 test failed");
3862 err
= test_f4(tfm_cmac
);
3864 BT_ERR("smp_f4 test failed");
3868 err
= test_f5(tfm_cmac
);
3870 BT_ERR("smp_f5 test failed");
3874 err
= test_f6(tfm_cmac
);
3876 BT_ERR("smp_f6 test failed");
3880 err
= test_g2(tfm_cmac
);
3882 BT_ERR("smp_g2 test failed");
3886 err
= test_h6(tfm_cmac
);
3888 BT_ERR("smp_h6 test failed");
3892 rettime
= ktime_get();
3893 delta
= ktime_sub(rettime
, calltime
);
3894 duration
= (unsigned long long) ktime_to_ns(delta
) >> 10;
3896 BT_INFO("SMP test passed in %llu usecs", duration
);
3900 snprintf(test_smp_buffer
, sizeof(test_smp_buffer
),
3901 "PASS (%llu usecs)\n", duration
);
3903 snprintf(test_smp_buffer
, sizeof(test_smp_buffer
), "FAIL\n");
3905 debugfs_create_file("selftest_smp", 0444, bt_debugfs
, NULL
,
3911 int __init
bt_selftest_smp(void)
3913 struct crypto_cipher
*tfm_aes
;
3914 struct crypto_shash
*tfm_cmac
;
3915 struct crypto_kpp
*tfm_ecdh
;
3918 tfm_aes
= crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC
);
3919 if (IS_ERR(tfm_aes
)) {
3920 BT_ERR("Unable to create AES crypto context");
3921 return PTR_ERR(tfm_aes
);
3924 tfm_cmac
= crypto_alloc_shash("cmac(aes)", 0, CRYPTO_ALG_ASYNC
);
3925 if (IS_ERR(tfm_cmac
)) {
3926 BT_ERR("Unable to create CMAC crypto context");
3927 crypto_free_cipher(tfm_aes
);
3928 return PTR_ERR(tfm_cmac
);
3931 tfm_ecdh
= crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL
, 0);
3932 if (IS_ERR(tfm_ecdh
)) {
3933 BT_ERR("Unable to create ECDH crypto context");
3934 crypto_free_shash(tfm_cmac
);
3935 crypto_free_cipher(tfm_aes
);
3936 return PTR_ERR(tfm_ecdh
);
3939 err
= run_selftests(tfm_aes
, tfm_cmac
, tfm_ecdh
);
3941 crypto_free_shash(tfm_cmac
);
3942 crypto_free_cipher(tfm_aes
);
3943 crypto_free_kpp(tfm_ecdh
);