projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Remove unnecessary early initialization of variable
[linux-block.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
b28b4943
JH		 34#define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
35#define SMP_DISALLOW_CMD(smp, code) clear_bit(code, &smp->allow_cmd)
36
17b02e62 37#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 38
065a13e2 39#define AUTH_REQ_MASK 0x07
88d3a8ac 40#define KEY_DIST_MASK 0x07
065a13e2 41
533e35d4
JH		 42enum {
43 SMP_FLAG_TK_VALID,
44 SMP_FLAG_CFM_PENDING,
45 SMP_FLAG_MITM_AUTH,
46 SMP_FLAG_COMPLETE,
47 SMP_FLAG_INITIATOR,
48};
4bc58f51
JH		 49
50struct smp_chan {
b68fda68
JH		 51 struct l2cap_conn *conn;
52 struct delayed_work security_timer;
b28b4943 53 unsigned long allow_cmd; /* Bitmask of allowed commands */
b68fda68 54
4bc58f51
JH		 55 u8 preq[7]; /* SMP Pairing Request */
56 u8 prsp[7]; /* SMP Pairing Response */
57 u8 prnd[16]; /* SMP Pairing Random (local) */
58 u8 rrnd[16]; /* SMP Pairing Random (remote) */
59 u8 pcnf[16]; /* SMP Pairing Confirm */
60 u8 tk[16]; /* SMP Temporary Key */
61 u8 enc_key_size;
62 u8 remote_key_dist;
63 bdaddr_t id_addr;
64 u8 id_addr_type;
65 u8 irk[16];
66 struct smp_csrk *csrk;
67 struct smp_csrk *slave_csrk;
68 struct smp_ltk *ltk;
69 struct smp_ltk *slave_ltk;
70 struct smp_irk *remote_irk;
4a74d658 71 unsigned long flags;
6a7bd103
JH		 72
73 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 74};
75
8a2936f4 76static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 77{
8a2936f4 78 size_t i;
d22ef0bc 79
8a2936f4
JH		 80 for (i = 0; i < len; i++)
81 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 82}
83
84static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
85{
86 struct blkcipher_desc desc;
87 struct scatterlist sg;
943a732a 88 uint8_t tmp[16], data[16];
201a5929 89 int err;
d22ef0bc
AB		 90
91 if (tfm == NULL) {
92 BT_ERR("tfm %p", tfm);
93 return -EINVAL;
94 }
95
96 desc.tfm = tfm;
97 desc.flags = 0;
98
943a732a 99 /* The most significant octet of key corresponds to k[0] */
8a2936f4 100 swap_buf(k, tmp, 16);
943a732a
JH		 101
102 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 103 if (err) {
104 BT_ERR("cipher setkey failed: %d", err);
105 return err;
106 }
107
943a732a 108 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 109 swap_buf(r, data, 16);
943a732a
JH		 110
111 sg_init_one(&sg, data, 16);
d22ef0bc 112
d22ef0bc
AB		 113 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
114 if (err)
115 BT_ERR("Encrypt data error %d", err);
116
943a732a 117 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 118 swap_buf(data, r, 16);
943a732a 119
d22ef0bc
AB		 120 return err;
121}
122
60478054
JH		 123static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
124{
943a732a 125 u8 _res[16];
60478054
JH		 126 int err;
127
128 /* r' = padding || r */
943a732a
JH		 129 memcpy(_res, r, 3);
130 memset(_res + 3, 0, 13);
60478054 131
943a732a 132 err = smp_e(tfm, irk, _res);
60478054
JH		 133 if (err) {
134 BT_ERR("Encrypt error");
135 return err;
136 }
137
138 /* The output of the random address function ah is:
139 * ah(h, r) = e(k, r') mod 2^24
140 * The output of the security function e is then truncated to 24 bits
141 * by taking the least significant 24 bits of the output of e as the
142 * result of ah.
143 */
943a732a 144 memcpy(res, _res, 3);
60478054
JH		 145
146 return 0;
147}
148
defce9e8 149bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 150{
defce9e8
JH		 151 struct l2cap_chan *chan = hdev->smp_data;
152 struct crypto_blkcipher *tfm;
60478054
JH		 153 u8 hash[3];
154 int err;
155
defce9e8
JH		 156 if (!chan || !chan->data)
157 return false;
158
159 tfm = chan->data;
160
60478054
JH		 161 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
162
163 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
164 if (err)
165 return false;
166
167 return !memcmp(bdaddr->b, hash, 3);
168}
169
defce9e8 170int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 171{
defce9e8
JH		 172 struct l2cap_chan *chan = hdev->smp_data;
173 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 174 int err;
175
defce9e8
JH		 176 if (!chan || !chan->data)
177 return -EOPNOTSUPP;
178
179 tfm = chan->data;
180
b1e2b3ae
JH		 181 get_random_bytes(&rpa->b[3], 3);
182
183 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
184 rpa->b[5] |= 0x40; /* Set second most significant bit */
185
186 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
187 if (err < 0)
188 return err;
189
190 BT_DBG("RPA %pMR", rpa);
191
192 return 0;
193}
194
ec70f36f
JH		 195static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
196 u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
197 u8 res[16])
d22ef0bc 198{
ec70f36f 199 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 200 u8 p1[16], p2[16];
201 int err;
202
ec70f36f
JH		 203 BT_DBG("%s", hdev->name);
204
d22ef0bc
AB		 205 memset(p1, 0, 16);
206
207 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 208 p1[0] = _iat;
209 p1[1] = _rat;
210 memcpy(p1 + 2, preq, 7);
211 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 212
213 /* p2 = padding || ia || ra */
943a732a
JH		 214 memcpy(p2, ra, 6);
215 memcpy(p2 + 6, ia, 6);
216 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 217
218 /* res = r XOR p1 */
219 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
220
221 /* res = e(k, res) */
ec70f36f 222 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 223 if (err) {
224 BT_ERR("Encrypt data error");
225 return err;
226 }
227
228 /* res = res XOR p2 */
229 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
230
231 /* res = e(k, res) */
ec70f36f 232 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 233 if (err)
234 BT_ERR("Encrypt data error");
235
236 return err;
237}
238
ec70f36f
JH		 239static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
240 u8 _r[16])
d22ef0bc 241{
ec70f36f 242 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 243 int err;
244
ec70f36f
JH		 245 BT_DBG("%s", hdev->name);
246
d22ef0bc 247 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 248 memcpy(_r, r2, 8);
249 memcpy(_r + 8, r1, 8);
d22ef0bc 250
ec70f36f 251 err = smp_e(smp->tfm_aes, k, _r);
d22ef0bc
AB		 252 if (err)
253 BT_ERR("Encrypt data error");
254
255 return err;
256}
257
5d88cc73 258static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 259{
5d88cc73 260 struct l2cap_chan *chan = conn->smp;
b68fda68 261 struct smp_chan *smp;
5d88cc73
JH		 262 struct kvec iv[2];
263 struct msghdr msg;
eb492e01 264
5d88cc73
JH		 265 if (!chan)
266 return;
eb492e01 267
5d88cc73 268 BT_DBG("code 0x%2.2x", code);
eb492e01 269
5d88cc73
JH		 270 iv[0].iov_base = &code;
271 iv[0].iov_len = 1;
eb492e01 272
5d88cc73
JH		 273 iv[1].iov_base = data;
274 iv[1].iov_len = len;
eb492e01 275
5d88cc73 276 memset(&msg, 0, sizeof(msg));
eb492e01 277
5d88cc73
JH		 278 msg.msg_iov = (struct iovec *) &iv;
279 msg.msg_iovlen = 2;
eb492e01 280
5d88cc73 281 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 282
b68fda68
JH		 283 if (!chan->data)
284 return;
285
286 smp = chan->data;
287
288 cancel_delayed_work_sync(&smp->security_timer);
1b0921d6 289 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 290}
291
2b64d153
BG		 292static __u8 authreq_to_seclevel(__u8 authreq)
293{
294 if (authreq & SMP_AUTH_MITM)
295 return BT_SECURITY_HIGH;
296 else
297 return BT_SECURITY_MEDIUM;
298}
299
300static __u8 seclevel_to_authreq(__u8 sec_level)
301{
302 switch (sec_level) {
303 case BT_SECURITY_HIGH:
304 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
305 case BT_SECURITY_MEDIUM:
306 return SMP_AUTH_BONDING;
307 default:
308 return SMP_AUTH_NONE;
309 }
310}
311
b8e66eac 312static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 313 struct smp_cmd_pairing *req,
314 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 315{
5d88cc73
JH		 316 struct l2cap_chan *chan = conn->smp;
317 struct smp_chan *smp = chan->data;
fd349c02
JH		 318 struct hci_conn *hcon = conn->hcon;
319 struct hci_dev *hdev = hcon->hdev;
320 u8 local_dist = 0, remote_dist = 0;
54790f73 321
b6ae8457 322 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 323 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
324 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 325 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 326 } else {
327 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 328 }
329
fd349c02
JH		 330 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
331 remote_dist |= SMP_DIST_ID_KEY;
332
863efaf2
JH		 333 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
334 local_dist |= SMP_DIST_ID_KEY;
335
54790f73
VCG		 336 if (rsp == NULL) {
337 req->io_capability = conn->hcon->io_capability;
338 req->oob_flag = SMP_OOB_NOT_PRESENT;
339 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 340 req->init_key_dist = local_dist;
341 req->resp_key_dist = remote_dist;
065a13e2 342 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 343
344 smp->remote_key_dist = remote_dist;
54790f73
VCG		 345 return;
346 }
347
348 rsp->io_capability = conn->hcon->io_capability;
349 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
350 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 351 rsp->init_key_dist = req->init_key_dist & remote_dist;
352 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 353 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 354
355 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 356}
357
3158c50c
VCG		 358static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
359{
5d88cc73
JH		 360 struct l2cap_chan *chan = conn->smp;
361 struct smp_chan *smp = chan->data;
1c1def09 362
3158c50c 363 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 364 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 365 return SMP_ENC_KEY_SIZE;
366
f7aa611a 367 smp->enc_key_size = max_key_size;
3158c50c
VCG		 368
369 return 0;
370}
371
6f48e260
JH		 372static void smp_chan_destroy(struct l2cap_conn *conn)
373{
374 struct l2cap_chan *chan = conn->smp;
375 struct smp_chan *smp = chan->data;
376 bool complete;
377
378 BUG_ON(!smp);
379
380 cancel_delayed_work_sync(&smp->security_timer);
6f48e260 381
6f48e260
JH		 382 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
383 mgmt_smp_complete(conn->hcon, complete);
384
385 kfree(smp->csrk);
386 kfree(smp->slave_csrk);
387
388 crypto_free_blkcipher(smp->tfm_aes);
389
390 /* If pairing failed clean up any keys we might have */
391 if (!complete) {
392 if (smp->ltk) {
393 list_del(&smp->ltk->list);
394 kfree(smp->ltk);
395 }
396
397 if (smp->slave_ltk) {
398 list_del(&smp->slave_ltk->list);
399 kfree(smp->slave_ltk);
400 }
401
402 if (smp->remote_irk) {
403 list_del(&smp->remote_irk->list);
404 kfree(smp->remote_irk);
405 }
406 }
407
408 chan->data = NULL;
409 kfree(smp);
410 hci_conn_drop(conn->hcon);
411}
412
84794e11 413static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 414{
bab73cb6 415 struct hci_conn *hcon = conn->hcon;
b68fda68 416 struct l2cap_chan *chan = conn->smp;
bab73cb6 417
84794e11 418 if (reason)
4f957a76 419 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 420 &reason);
4f957a76 421
ce39fb4e 422 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
e1e930f5 423 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
f1c09c07 424
fc75cc86 425 if (chan->data)
f1c09c07 426 smp_chan_destroy(conn);
4f957a76
BG		 427}
428
2b64d153
BG		 429#define JUST_WORKS 0x00
430#define JUST_CFM 0x01
431#define REQ_PASSKEY 0x02
432#define CFM_PASSKEY 0x03
433#define REQ_OOB 0x04
434#define OVERLAP 0xFF
435
436static const u8 gen_method[5][5] = {
437 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
438 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
439 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
440 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
441 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
442};
443
581370cc
JH		 444static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
445{
2bcd4003
JH		 446 /* If either side has unknown io_caps, use JUST_CFM (which gets
447 * converted later to JUST_WORKS if we're initiators.
448 */
581370cc
JH		 449 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
450 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 451 return JUST_CFM;
581370cc
JH		 452
453 return gen_method[remote_io][local_io];
454}
455
2b64d153
BG		 456static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
457 u8 local_io, u8 remote_io)
458{
459 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 460 struct l2cap_chan *chan = conn->smp;
461 struct smp_chan *smp = chan->data;
2b64d153
BG		 462 u8 method;
463 u32 passkey = 0;
464 int ret = 0;
465
466 /* Initialize key for JUST WORKS */
467 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 468 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 469
470 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
471
2bcd4003
JH		 472 /* If neither side wants MITM, either "just" confirm an incoming
473 * request or use just-works for outgoing ones. The JUST_CFM
474 * will be converted to JUST_WORKS if necessary later in this
475 * function. If either side has MITM look up the method from the
476 * table.
477 */
581370cc 478 if (!(auth & SMP_AUTH_MITM))
2bcd4003 479 method = JUST_CFM;
2b64d153 480 else
581370cc 481 method = get_auth_method(smp, local_io, remote_io);
2b64d153 482
a82505c7 483 /* Don't confirm locally initiated pairing attempts */
4a74d658 484 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 485 method = JUST_WORKS;
486
02f3e254
JH		 487 /* Don't bother user space with no IO capabilities */
488 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
489 method = JUST_WORKS;
490
2b64d153
BG		 491 /* If Just Works, Continue with Zero TK */
492 if (method == JUST_WORKS) {
4a74d658 493 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 494 return 0;
495 }
496
497 /* Not Just Works/Confirm results in MITM Authentication */
498 if (method != JUST_CFM)
4a74d658 499 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 500
501 /* If both devices have Keyoard-Display I/O, the master
502 * Confirms and the slave Enters the passkey.
503 */
504 if (method == OVERLAP) {
40bef302 505 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 506 method = CFM_PASSKEY;
507 else
508 method = REQ_PASSKEY;
509 }
510
01ad34d2 511 /* Generate random passkey. */
2b64d153 512 if (method == CFM_PASSKEY) {
943a732a 513 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 514 get_random_bytes(&passkey, sizeof(passkey));
515 passkey %= 1000000;
943a732a 516 put_unaligned_le32(passkey, smp->tk);
2b64d153 517 BT_DBG("PassKey: %d", passkey);
4a74d658 518 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 519 }
520
521 hci_dev_lock(hcon->hdev);
522
523 if (method == REQ_PASSKEY)
ce39fb4e 524 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 525 hcon->type, hcon->dst_type);
4eb65e66
JH		 526 else if (method == JUST_CFM)
527 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
528 hcon->type, hcon->dst_type,
529 passkey, 1);
2b64d153 530 else
01ad34d2 531 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 532 hcon->type, hcon->dst_type,
39adbffe 533 passkey, 0);
2b64d153
BG		 534
535 hci_dev_unlock(hcon->hdev);
536
537 return ret;
538}
539
1cc61144 540static u8 smp_confirm(struct smp_chan *smp)
8aab4757 541{
8aab4757 542 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 543 struct smp_cmd_pairing_confirm cp;
544 int ret;
8aab4757
VCG		 545
546 BT_DBG("conn %p", conn);
547
ec70f36f 548 ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 549 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 550 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
551 cp.confirm_val);
1cc61144
JH		 552 if (ret)
553 return SMP_UNSPECIFIED;
8aab4757 554
4a74d658 555 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 556
8aab4757
VCG		 557 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
558
b28b4943
JH		 559 if (conn->hcon->out)
560 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
561 else
562 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
563
1cc61144 564 return 0;
8aab4757
VCG		 565}
566
861580a9 567static u8 smp_random(struct smp_chan *smp)
8aab4757 568{
8aab4757
VCG		 569 struct l2cap_conn *conn = smp->conn;
570 struct hci_conn *hcon = conn->hcon;
861580a9 571 u8 confirm[16];
8aab4757
VCG		 572 int ret;
573
ec70f36f 574 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 575 return SMP_UNSPECIFIED;
8aab4757
VCG		 576
577 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
578
ec70f36f 579 ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 580 hcon->init_addr_type, &hcon->init_addr,
943a732a 581 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 582 if (ret)
583 return SMP_UNSPECIFIED;
8aab4757 584
8aab4757
VCG		 585 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
586 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 587 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 588 }
589
590 if (hcon->out) {
fe39c7b2
MH		 591 u8 stk[16];
592 __le64 rand = 0;
593 __le16 ediv = 0;
8aab4757 594
ec70f36f 595 smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 596
f7aa611a 597 memset(stk + smp->enc_key_size, 0,
04124681 598 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 599
861580a9
JH		 600 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
601 return SMP_UNSPECIFIED;
8aab4757
VCG		 602
603 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 604 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 605 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 606 } else {
fff3490f 607 u8 stk[16], auth;
fe39c7b2
MH		 608 __le64 rand = 0;
609 __le16 ediv = 0;
8aab4757 610
943a732a
JH		 611 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
612 smp->prnd);
8aab4757 613
ec70f36f 614 smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 615
f7aa611a 616 memset(stk + smp->enc_key_size, 0,
f1560463 617 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 618
fff3490f
JH		 619 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
620 auth = 1;
621 else
622 auth = 0;
623
7d5843b7
JH		 624 /* Even though there's no _SLAVE suffix this is the
625 * slave STK we're adding for later lookup (the master
626 * STK never needs to be stored).
627 */
ce39fb4e 628 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 629 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 630 }
631
861580a9 632 return 0;
8aab4757
VCG		 633}
634
44f1a7ab
JH		 635static void smp_notify_keys(struct l2cap_conn *conn)
636{
637 struct l2cap_chan *chan = conn->smp;
638 struct smp_chan *smp = chan->data;
639 struct hci_conn *hcon = conn->hcon;
640 struct hci_dev *hdev = hcon->hdev;
641 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
642 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
643 bool persistent;
644
645 if (smp->remote_irk) {
646 mgmt_new_irk(hdev, smp->remote_irk);
647 /* Now that user space can be considered to know the
648 * identity address track the connection based on it
649 * from now on.
650 */
651 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
652 hcon->dst_type = smp->remote_irk->addr_type;
f3d82d0c 653 queue_work(hdev->workqueue, &conn->id_addr_update_work);
44f1a7ab
JH		 654
655 /* When receiving an indentity resolving key for
656 * a remote device that does not use a resolvable
657 * private address, just remove the key so that
658 * it is possible to use the controller white
659 * list for scanning.
660 *
661 * Userspace will have been told to not store
662 * this key at this point. So it is safe to
663 * just remove it.
664 */
665 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
666 list_del(&smp->remote_irk->list);
667 kfree(smp->remote_irk);
668 smp->remote_irk = NULL;
669 }
670 }
671
672 /* The LTKs and CSRKs should be persistent only if both sides
673 * had the bonding bit set in their authentication requests.
674 */
675 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
676
677 if (smp->csrk) {
678 smp->csrk->bdaddr_type = hcon->dst_type;
679 bacpy(&smp->csrk->bdaddr, &hcon->dst);
680 mgmt_new_csrk(hdev, smp->csrk, persistent);
681 }
682
683 if (smp->slave_csrk) {
684 smp->slave_csrk->bdaddr_type = hcon->dst_type;
685 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
686 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
687 }
688
689 if (smp->ltk) {
690 smp->ltk->bdaddr_type = hcon->dst_type;
691 bacpy(&smp->ltk->bdaddr, &hcon->dst);
692 mgmt_new_ltk(hdev, smp->ltk, persistent);
693 }
694
695 if (smp->slave_ltk) {
696 smp->slave_ltk->bdaddr_type = hcon->dst_type;
697 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
698 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
699 }
700}
701
b28b4943
JH		 702static void smp_allow_key_dist(struct smp_chan *smp)
703{
704 /* Allow the first expected phase 3 PDU. The rest of the PDUs
705 * will be allowed in each PDU handler to ensure we receive
706 * them in the correct order.
707 */
708 if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
709 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
710 else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
711 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
712 else if (smp->remote_key_dist & SMP_DIST_SIGN)
713 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
714}
715
d6268e86 716static void smp_distribute_keys(struct smp_chan *smp)
44f1a7ab
JH		 717{
718 struct smp_cmd_pairing *req, *rsp;
86d1407c 719 struct l2cap_conn *conn = smp->conn;
44f1a7ab
JH		 720 struct hci_conn *hcon = conn->hcon;
721 struct hci_dev *hdev = hcon->hdev;
722 __u8 *keydist;
723
724 BT_DBG("conn %p", conn);
725
44f1a7ab
JH		 726 rsp = (void *) &smp->prsp[1];
727
728 /* The responder sends its keys first */
b28b4943
JH		 729 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
730 smp_allow_key_dist(smp);
86d1407c 731 return;
b28b4943 732 }
44f1a7ab
JH		 733
734 req = (void *) &smp->preq[1];
735
736 if (hcon->out) {
737 keydist = &rsp->init_key_dist;
738 *keydist &= req->init_key_dist;
739 } else {
740 keydist = &rsp->resp_key_dist;
741 *keydist &= req->resp_key_dist;
742 }
743
744 BT_DBG("keydist 0x%x", *keydist);
745
746 if (*keydist & SMP_DIST_ENC_KEY) {
747 struct smp_cmd_encrypt_info enc;
748 struct smp_cmd_master_ident ident;
749 struct smp_ltk *ltk;
750 u8 authenticated;
751 __le16 ediv;
752 __le64 rand;
753
754 get_random_bytes(enc.ltk, sizeof(enc.ltk));
755 get_random_bytes(&ediv, sizeof(ediv));
756 get_random_bytes(&rand, sizeof(rand));
757
758 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
759
760 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
761 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
762 SMP_LTK_SLAVE, authenticated, enc.ltk,
763 smp->enc_key_size, ediv, rand);
764 smp->slave_ltk = ltk;
765
766 ident.ediv = ediv;
767 ident.rand = rand;
768
769 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
770
771 *keydist &= ~SMP_DIST_ENC_KEY;
772 }
773
774 if (*keydist & SMP_DIST_ID_KEY) {
775 struct smp_cmd_ident_addr_info addrinfo;
776 struct smp_cmd_ident_info idinfo;
777
778 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
779
780 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
781
782 /* The hci_conn contains the local identity address
783 * after the connection has been established.
784 *
785 * This is true even when the connection has been
786 * established using a resolvable random address.
787 */
788 bacpy(&addrinfo.bdaddr, &hcon->src);
789 addrinfo.addr_type = hcon->src_type;
790
791 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
792 &addrinfo);
793
794 *keydist &= ~SMP_DIST_ID_KEY;
795 }
796
797 if (*keydist & SMP_DIST_SIGN) {
798 struct smp_cmd_sign_info sign;
799 struct smp_csrk *csrk;
800
801 /* Generate a new random key */
802 get_random_bytes(sign.csrk, sizeof(sign.csrk));
803
804 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
805 if (csrk) {
806 csrk->master = 0x00;
807 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
808 }
809 smp->slave_csrk = csrk;
810
811 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
812
813 *keydist &= ~SMP_DIST_SIGN;
814 }
815
816 /* If there are still keys to be received wait for them */
b28b4943
JH		 817 if (smp->remote_key_dist & KEY_DIST_MASK) {
818 smp_allow_key_dist(smp);
86d1407c 819 return;
b28b4943 820 }
44f1a7ab 821
44f1a7ab
JH		 822 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
823 smp_notify_keys(conn);
824
825 smp_chan_destroy(conn);
44f1a7ab
JH		 826}
827
b68fda68
JH		 828static void smp_timeout(struct work_struct *work)
829{
830 struct smp_chan *smp = container_of(work, struct smp_chan,
831 security_timer.work);
832 struct l2cap_conn *conn = smp->conn;
833
834 BT_DBG("conn %p", conn);
835
1e91c29e 836 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
b68fda68
JH		 837}
838
8aab4757
VCG		 839static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
840{
5d88cc73 841 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 842 struct smp_chan *smp;
843
f1560463 844 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
fc75cc86 845 if (!smp)
8aab4757
VCG		 846 return NULL;
847
6a7bd103
JH		 848 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
849 if (IS_ERR(smp->tfm_aes)) {
850 BT_ERR("Unable to create ECB crypto context");
851 kfree(smp);
852 return NULL;
853 }
854
8aab4757 855 smp->conn = conn;
5d88cc73 856 chan->data = smp;
8aab4757 857
b28b4943
JH		 858 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
859
b68fda68
JH		 860 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
861
8aab4757
VCG		 862 hci_conn_hold(conn->hcon);
863
864 return smp;
865}
866
2b64d153
BG		 867int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
868{
b10e8017 869 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 870 struct l2cap_chan *chan;
2b64d153
BG		 871 struct smp_chan *smp;
872 u32 value;
fc75cc86 873 int err;
2b64d153
BG		 874
875 BT_DBG("");
876
fc75cc86 877 if (!conn)
2b64d153
BG		 878 return -ENOTCONN;
879
5d88cc73
JH		 880 chan = conn->smp;
881 if (!chan)
882 return -ENOTCONN;
883
fc75cc86
JH		 884 l2cap_chan_lock(chan);
885 if (!chan->data) {
886 err = -ENOTCONN;
887 goto unlock;
888 }
889
5d88cc73 890 smp = chan->data;
2b64d153
BG		 891
892 switch (mgmt_op) {
893 case MGMT_OP_USER_PASSKEY_REPLY:
894 value = le32_to_cpu(passkey);
943a732a 895 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 896 BT_DBG("PassKey: %d", value);
943a732a 897 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 898 /* Fall Through */
899 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 900 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 901 break;
902 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
903 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 904 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 905 err = 0;
906 goto unlock;
2b64d153 907 default:
84794e11 908 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 909 err = -EOPNOTSUPP;
910 goto unlock;
2b64d153
BG		 911 }
912
fc75cc86
JH		 913 err = 0;
914
2b64d153 915 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 916 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
917 u8 rsp = smp_confirm(smp);
918 if (rsp)
919 smp_failure(conn, rsp);
920 }
2b64d153 921
fc75cc86
JH		 922unlock:
923 l2cap_chan_unlock(chan);
924 return err;
2b64d153
BG		 925}
926
da85e5e5 927static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 928{
3158c50c 929 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
fc75cc86 930 struct l2cap_chan *chan = conn->smp;
b3c6410b 931 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 932 struct smp_chan *smp;
c7262e71 933 u8 key_size, auth, sec_level;
8aab4757 934 int ret;
88ba43b6
AB		 935
936 BT_DBG("conn %p", conn);
937
c46b98be 938 if (skb->len < sizeof(*req))
38e4a915 939 return SMP_INVALID_PARAMS;
c46b98be 940
40bef302 941 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 942 return SMP_CMD_NOTSUPP;
943
fc75cc86 944 if (!chan->data)
8aab4757 945 smp = smp_chan_create(conn);
fc75cc86 946 else
5d88cc73 947 smp = chan->data;
8aab4757 948
d08fd0e7
AE		 949 if (!smp)
950 return SMP_UNSPECIFIED;
d26a2345 951
b6ae8457 952 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
b3c6410b
JH		 953 (req->auth_req & SMP_AUTH_BONDING))
954 return SMP_PAIRING_NOTSUPP;
955
b28b4943
JH		 956 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
957
1c1def09
VCG		 958 smp->preq[0] = SMP_CMD_PAIRING_REQ;
959 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 960 skb_pull(skb, sizeof(*req));
88ba43b6 961
2b64d153 962 /* We didn't start the pairing, so match remote */
1ef35827 963 auth = req->auth_req;
da85e5e5 964
c7262e71
JH		 965 sec_level = authreq_to_seclevel(auth);
966 if (sec_level > conn->hcon->pending_sec_level)
967 conn->hcon->pending_sec_level = sec_level;
fdde0a26 968
2ed8f65c
JH		 969 /* If we need MITM check that it can be acheived */
970 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
971 u8 method;
972
973 method = get_auth_method(smp, conn->hcon->io_capability,
974 req->io_capability);
975 if (method == JUST_WORKS || method == JUST_CFM)
976 return SMP_AUTH_REQUIREMENTS;
977 }
978
2b64d153 979 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 980
981 key_size = min(req->max_key_size, rsp.max_key_size);
982 if (check_enc_key_size(conn, key_size))
983 return SMP_ENC_KEY_SIZE;
88ba43b6 984
e84a6b13 985 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 986
1c1def09
VCG		 987 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
988 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 989
3158c50c 990 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
b28b4943 991 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
da85e5e5 992
2b64d153
BG		 993 /* Request setup of TK */
994 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
995 if (ret)
996 return SMP_UNSPECIFIED;
997
da85e5e5 998 return 0;
88ba43b6
AB		 999}
1000
da85e5e5 1001static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1002{
3158c50c 1003 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 1004 struct l2cap_chan *chan = conn->smp;
1005 struct smp_chan *smp = chan->data;
3a7dbfb8 1006 u8 key_size, auth;
7d24ddcc 1007 int ret;
88ba43b6
AB		 1008
1009 BT_DBG("conn %p", conn);
1010
c46b98be 1011 if (skb->len < sizeof(*rsp))
38e4a915 1012 return SMP_INVALID_PARAMS;
c46b98be 1013
40bef302 1014 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 1015 return SMP_CMD_NOTSUPP;
1016
b28b4943
JH		 1017 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
1018
3158c50c
VCG		 1019 skb_pull(skb, sizeof(*rsp));
1020
1c1def09 1021 req = (void *) &smp->preq[1];
da85e5e5 1022
3158c50c
VCG		 1023 key_size = min(req->max_key_size, rsp->max_key_size);
1024 if (check_enc_key_size(conn, key_size))
1025 return SMP_ENC_KEY_SIZE;
1026
2ed8f65c
JH		 1027 /* If we need MITM check that it can be acheived */
1028 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1029 u8 method;
1030
1031 method = get_auth_method(smp, req->io_capability,
1032 rsp->io_capability);
1033 if (method == JUST_WORKS || method == JUST_CFM)
1034 return SMP_AUTH_REQUIREMENTS;
1035 }
1036
e84a6b13 1037 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1038
8aab4757
VCG		 1039 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1040 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1041
fdcc4bec
JH		 1042 /* Update remote key distribution in case the remote cleared
1043 * some bits that we had enabled in our request.
1044 */
1045 smp->remote_key_dist &= rsp->resp_key_dist;
1046
3a7dbfb8 1047 auth = (req->auth_req | rsp->auth_req);
2b64d153 1048
476585ec 1049 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1050 if (ret)
1051 return SMP_UNSPECIFIED;
1052
4a74d658 1053 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1054
1055 /* Can't compose response until we have been confirmed */
4a74d658 1056 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1057 return smp_confirm(smp);
da85e5e5
VCG		 1058
1059 return 0;
88ba43b6
AB		 1060}
1061
da85e5e5 1062static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1063{
5d88cc73
JH		 1064 struct l2cap_chan *chan = conn->smp;
1065 struct smp_chan *smp = chan->data;
7d24ddcc 1066
88ba43b6
AB		 1067 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1068
c46b98be 1069 if (skb->len < sizeof(smp->pcnf))
38e4a915 1070 return SMP_INVALID_PARAMS;
c46b98be 1071
b28b4943
JH		 1072 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1073
1c1def09
VCG		 1074 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1075 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1076
b28b4943 1077 if (conn->hcon->out) {
943a732a
JH		 1078 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1079 smp->prnd);
b28b4943
JH		 1080 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1081 return 0;
1082 }
1083
1084 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1085 return smp_confirm(smp);
943a732a 1086 else
4a74d658 1087 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1088
1089 return 0;
88ba43b6
AB		 1090}
1091
da85e5e5 1092static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1093{
5d88cc73
JH		 1094 struct l2cap_chan *chan = conn->smp;
1095 struct smp_chan *smp = chan->data;
7d24ddcc 1096
8aab4757 1097 BT_DBG("conn %p", conn);
3158c50c 1098
c46b98be 1099 if (skb->len < sizeof(smp->rrnd))
38e4a915 1100 return SMP_INVALID_PARAMS;
c46b98be 1101
b28b4943
JH		 1102 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1103
943a732a 1104 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1105 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1106
861580a9 1107 return smp_random(smp);
88ba43b6
AB		 1108}
1109
f81cd823 1110static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1111{
c9839a11 1112 struct smp_ltk *key;
988c5997
VCG		 1113 struct hci_conn *hcon = conn->hcon;
1114
98a0b845 1115 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1116 hcon->role);
988c5997 1117 if (!key)
f81cd823 1118 return false;
988c5997 1119
4dab7864 1120 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
f81cd823 1121 return false;
4dab7864 1122
51a8efd7 1123 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1124 return true;
988c5997 1125
c9839a11
VCG		 1126 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1127 hcon->enc_key_size = key->enc_size;
988c5997 1128
fe59a05f
JH		 1129 /* We never store STKs for master role, so clear this flag */
1130 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1131
f81cd823 1132 return true;
988c5997 1133}
f1560463 1134
854f4727
JH		 1135bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
1136{
1137 if (sec_level == BT_SECURITY_LOW)
1138 return true;
1139
9ab65d60
JH		 1140 /* If we're encrypted with an STK always claim insufficient
1141 * security. This way we allow the connection to be re-encrypted
1142 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 1143 * security. Only exception is if we don't have an LTK (e.g.
1144 * because of key distribution bits).
9ab65d60 1145 */
b2d5e254
JH		 1146 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
1147 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1148 hcon->role))
9ab65d60
JH		 1149 return false;
1150
854f4727
JH		 1151 if (hcon->sec_level >= sec_level)
1152 return true;
1153
1154 return false;
1155}
1156
da85e5e5 1157static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1158{
1159 struct smp_cmd_security_req *rp = (void *) skb->data;
1160 struct smp_cmd_pairing cp;
f1cb9af5 1161 struct hci_conn *hcon = conn->hcon;
8aab4757 1162 struct smp_chan *smp;
c7262e71 1163 u8 sec_level;
88ba43b6
AB		 1164
1165 BT_DBG("conn %p", conn);
1166
c46b98be 1167 if (skb->len < sizeof(*rp))
38e4a915 1168 return SMP_INVALID_PARAMS;
c46b98be 1169
40bef302 1170 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1171 return SMP_CMD_NOTSUPP;
1172
c7262e71 1173 sec_level = authreq_to_seclevel(rp->auth_req);
854f4727
JH		 1174 if (smp_sufficient_security(hcon, sec_level))
1175 return 0;
1176
c7262e71
JH		 1177 if (sec_level > hcon->pending_sec_level)
1178 hcon->pending_sec_level = sec_level;
feb45eb5 1179
4dab7864 1180 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1181 return 0;
1182
8aab4757 1183 smp = smp_chan_create(conn);
c29d2444
JH		 1184 if (!smp)
1185 return SMP_UNSPECIFIED;
d26a2345 1186
b6ae8457 1187 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
616d55be
JH		 1188 (rp->auth_req & SMP_AUTH_BONDING))
1189 return SMP_PAIRING_NOTSUPP;
1190
88ba43b6 1191 skb_pull(skb, sizeof(*rp));
88ba43b6 1192
da85e5e5 1193 memset(&cp, 0, sizeof(cp));
54790f73 1194 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 1195
1c1def09
VCG		 1196 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1197 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1198
88ba43b6 1199 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1200 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
f1cb9af5 1201
da85e5e5 1202 return 0;
88ba43b6
AB		 1203}
1204
cc110922 1205int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1206{
cc110922 1207 struct l2cap_conn *conn = hcon->l2cap_data;
c68b7f12 1208 struct l2cap_chan *chan;
0a66cf20 1209 struct smp_chan *smp;
2b64d153 1210 __u8 authreq;
fc75cc86 1211 int ret;
eb492e01 1212
3a0259bb
VCG		 1213 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1214
0a66cf20
JH		 1215 /* This may be NULL if there's an unexpected disconnection */
1216 if (!conn)
1217 return 1;
1218
c68b7f12
JH		 1219 chan = conn->smp;
1220
757aee0f 1221 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1222 return 1;
1223
ad32a2f5 1224 if (smp_sufficient_security(hcon, sec_level))
eb492e01 1225 return 1;
f1cb9af5 1226
c7262e71
JH		 1227 if (sec_level > hcon->pending_sec_level)
1228 hcon->pending_sec_level = sec_level;
1229
40bef302 1230 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1231 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1232 return 0;
d26a2345 1233
fc75cc86
JH		 1234 l2cap_chan_lock(chan);
1235
1236 /* If SMP is already in progress ignore this request */
1237 if (chan->data) {
1238 ret = 0;
1239 goto unlock;
1240 }
d26a2345 1241
8aab4757 1242 smp = smp_chan_create(conn);
fc75cc86
JH		 1243 if (!smp) {
1244 ret = 1;
1245 goto unlock;
1246 }
2b64d153
BG		 1247
1248 authreq = seclevel_to_authreq(sec_level);
d26a2345 1249
79897d20
JH		 1250 /* Require MITM if IO Capability allows or the security level
1251 * requires it.
2e233644 1252 */
79897d20 1253 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1254 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1255 authreq |= SMP_AUTH_MITM;
1256
40bef302 1257 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1258 struct smp_cmd_pairing cp;
f01ead31 1259
2b64d153 1260 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1261 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1262 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1263
eb492e01 1264 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1265 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
eb492e01
AB		 1266 } else {
1267 struct smp_cmd_security_req cp;
2b64d153 1268 cp.auth_req = authreq;
eb492e01 1269 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
b28b4943 1270 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
eb492e01
AB		 1271 }
1272
4a74d658 1273 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
fc75cc86 1274 ret = 0;
edca792c 1275
fc75cc86
JH		 1276unlock:
1277 l2cap_chan_unlock(chan);
1278 return ret;
eb492e01
AB		 1279}
1280
7034b911
VCG		 1281static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1282{
16b90839 1283 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1284 struct l2cap_chan *chan = conn->smp;
1285 struct smp_chan *smp = chan->data;
16b90839 1286
c46b98be
JH		 1287 BT_DBG("conn %p", conn);
1288
1289 if (skb->len < sizeof(*rp))
38e4a915 1290 return SMP_INVALID_PARAMS;
c46b98be 1291
b28b4943
JH		 1292 SMP_DISALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
1293 SMP_ALLOW_CMD(smp, SMP_CMD_MASTER_IDENT);
6131ddc8 1294
16b90839
VCG		 1295 skb_pull(skb, sizeof(*rp));
1296
1c1def09 1297 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1298
7034b911
VCG		 1299 return 0;
1300}
1301
1302static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1303{
16b90839 1304 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1305 struct l2cap_chan *chan = conn->smp;
1306 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1307 struct hci_dev *hdev = conn->hcon->hdev;
1308 struct hci_conn *hcon = conn->hcon;
23d0e128 1309 struct smp_ltk *ltk;
c9839a11 1310 u8 authenticated;
16b90839 1311
c46b98be
JH		 1312 BT_DBG("conn %p", conn);
1313
1314 if (skb->len < sizeof(*rp))
38e4a915 1315 return SMP_INVALID_PARAMS;
c46b98be 1316
9747a9f3
JH		 1317 /* Mark the information as received */
1318 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1319
b28b4943
JH		 1320 SMP_DISALLOW_CMD(smp, SMP_CMD_MASTER_IDENT);
1321 if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1322 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
196332f5
JH		 1323 else if (smp->remote_key_dist & SMP_DIST_SIGN)
1324 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
b28b4943 1325
16b90839 1326 skb_pull(skb, sizeof(*rp));
7034b911 1327
c9839a11 1328 hci_dev_lock(hdev);
ce39fb4e 1329 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1330 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1331 authenticated, smp->tk, smp->enc_key_size,
1332 rp->ediv, rp->rand);
1333 smp->ltk = ltk;
c6e81e9a 1334 if (!(smp->remote_key_dist & KEY_DIST_MASK))
d6268e86 1335 smp_distribute_keys(smp);
c9839a11 1336 hci_dev_unlock(hdev);
7034b911
VCG		 1337
1338 return 0;
1339}
1340
fd349c02
JH		 1341static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1342{
1343 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1344 struct l2cap_chan *chan = conn->smp;
1345 struct smp_chan *smp = chan->data;
fd349c02
JH		 1346
1347 BT_DBG("");
1348
1349 if (skb->len < sizeof(*info))
38e4a915 1350 return SMP_INVALID_PARAMS;
fd349c02 1351
b28b4943
JH		 1352 SMP_DISALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
1353 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
6131ddc8 1354
fd349c02
JH		 1355 skb_pull(skb, sizeof(*info));
1356
1357 memcpy(smp->irk, info->irk, 16);
1358
1359 return 0;
1360}
1361
1362static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1363 struct sk_buff *skb)
1364{
1365 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1366 struct l2cap_chan *chan = conn->smp;
1367 struct smp_chan *smp = chan->data;
fd349c02
JH		 1368 struct hci_conn *hcon = conn->hcon;
1369 bdaddr_t rpa;
1370
1371 BT_DBG("");
1372
1373 if (skb->len < sizeof(*info))
38e4a915 1374 return SMP_INVALID_PARAMS;
fd349c02 1375
9747a9f3
JH		 1376 /* Mark the information as received */
1377 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1378
b28b4943
JH		 1379 SMP_DISALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
1380 if (smp->remote_key_dist & SMP_DIST_SIGN)
1381 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1382
fd349c02
JH		 1383 skb_pull(skb, sizeof(*info));
1384
31dd624e
JH		 1385 hci_dev_lock(hcon->hdev);
1386
a9a58f86
JH		 1387 /* Strictly speaking the Core Specification (4.1) allows sending
1388 * an empty address which would force us to rely on just the IRK
1389 * as "identity information". However, since such
1390 * implementations are not known of and in order to not over
1391 * complicate our implementation, simply pretend that we never
1392 * received an IRK for such a device.
1393 */
1394 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1395 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1396 goto distribute;
a9a58f86
JH		 1397 }
1398
fd349c02
JH		 1399 bacpy(&smp->id_addr, &info->bdaddr);
1400 smp->id_addr_type = info->addr_type;
1401
1402 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1403 bacpy(&rpa, &hcon->dst);
1404 else
1405 bacpy(&rpa, BDADDR_ANY);
1406
23d0e128
JH		 1407 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1408 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1409
31dd624e 1410distribute:
c6e81e9a
JH		 1411 if (!(smp->remote_key_dist & KEY_DIST_MASK))
1412 smp_distribute_keys(smp);
fd349c02 1413
31dd624e
JH		 1414 hci_dev_unlock(hcon->hdev);
1415
fd349c02
JH		 1416 return 0;
1417}
1418
7ee4ea36
MH		 1419static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1420{
1421 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1422 struct l2cap_chan *chan = conn->smp;
1423 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1424 struct hci_dev *hdev = conn->hcon->hdev;
1425 struct smp_csrk *csrk;
1426
1427 BT_DBG("conn %p", conn);
1428
1429 if (skb->len < sizeof(*rp))
38e4a915 1430 return SMP_INVALID_PARAMS;
7ee4ea36 1431
7ee4ea36
MH		 1432 /* Mark the information as received */
1433 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1434
b28b4943
JH		 1435 SMP_DISALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1436
7ee4ea36
MH		 1437 skb_pull(skb, sizeof(*rp));
1438
1439 hci_dev_lock(hdev);
1440 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1441 if (csrk) {
1442 csrk->master = 0x01;
1443 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1444 }
1445 smp->csrk = csrk;
d6268e86 1446 smp_distribute_keys(smp);
7ee4ea36
MH		 1447 hci_dev_unlock(hdev);
1448
1449 return 0;
1450}
1451
4befb867 1452static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1453{
5d88cc73 1454 struct l2cap_conn *conn = chan->conn;
7b9899db 1455 struct hci_conn *hcon = conn->hcon;
b28b4943 1456 struct smp_chan *smp;
92381f5c 1457 __u8 code, reason;
eb492e01
AB		 1458 int err = 0;
1459
7b9899db
MH		 1460 if (hcon->type != LE_LINK) {
1461 kfree_skb(skb);
3432711f 1462 return 0;
7b9899db
MH		 1463 }
1464
8ae9b984 1465 if (skb->len < 1)
92381f5c 1466 return -EILSEQ;
92381f5c 1467
06ae3314 1468 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1469 reason = SMP_PAIRING_NOTSUPP;
1470 goto done;
1471 }
1472
92381f5c 1473 code = skb->data[0];
eb492e01
AB		 1474 skb_pull(skb, sizeof(code));
1475
b28b4943
JH		 1476 smp = chan->data;
1477
1478 if (code > SMP_CMD_MAX)
1479 goto drop;
1480
1481 if (smp && !test_bit(code, &smp->allow_cmd))
1482 goto drop;
1483
1484 /* If we don't have a context the only allowed commands are
1485 * pairing request and security request.
8cf9fa12 1486 */
b28b4943
JH		 1487 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
1488 goto drop;
8cf9fa12 1489
eb492e01
AB		 1490 switch (code) {
1491 case SMP_CMD_PAIRING_REQ:
da85e5e5 1492 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1493 break;
1494
1495 case SMP_CMD_PAIRING_FAIL:
84794e11 1496 smp_failure(conn, 0);
da85e5e5 1497 err = -EPERM;
eb492e01
AB		 1498 break;
1499
1500 case SMP_CMD_PAIRING_RSP:
da85e5e5 1501 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1502 break;
1503
1504 case SMP_CMD_SECURITY_REQ:
da85e5e5 1505 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1506 break;
1507
eb492e01 1508 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1509 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1510 break;
1511
eb492e01 1512 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1513 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1514 break;
1515
eb492e01 1516 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1517 reason = smp_cmd_encrypt_info(conn, skb);
1518 break;
1519
eb492e01 1520 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1521 reason = smp_cmd_master_ident(conn, skb);
1522 break;
1523
eb492e01 1524 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1525 reason = smp_cmd_ident_info(conn, skb);
1526 break;
1527
eb492e01 1528 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1529 reason = smp_cmd_ident_addr_info(conn, skb);
1530 break;
1531
eb492e01 1532 case SMP_CMD_SIGN_INFO:
7ee4ea36 1533 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1534 break;
1535
eb492e01
AB		 1536 default:
1537 BT_DBG("Unknown command code 0x%2.2x", code);
eb492e01 1538 reason = SMP_CMD_NOTSUPP;
3a0259bb 1539 goto done;
eb492e01
AB		 1540 }
1541
3a0259bb 1542done:
9b7b18ef
JH		 1543 if (!err) {
1544 if (reason)
1545 smp_failure(conn, reason);
8ae9b984 1546 kfree_skb(skb);
9b7b18ef
JH		 1547 }
1548
eb492e01 1549 return err;
b28b4943
JH		 1550
1551drop:
1552 BT_ERR("%s unexpected SMP command 0x%02x from %pMR", hcon->hdev->name,
1553 code, &hcon->dst);
1554 kfree_skb(skb);
1555 return 0;
eb492e01 1556}
7034b911 1557
70db83c4
JH		 1558static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1559{
1560 struct l2cap_conn *conn = chan->conn;
1561
1562 BT_DBG("chan %p", chan);
1563
fc75cc86 1564 if (chan->data)
5d88cc73 1565 smp_chan_destroy(conn);
5d88cc73 1566
70db83c4
JH		 1567 conn->smp = NULL;
1568 l2cap_chan_put(chan);
1569}
1570
44f1a7ab
JH		 1571static void smp_resume_cb(struct l2cap_chan *chan)
1572{
b68fda68 1573 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1574 struct l2cap_conn *conn = chan->conn;
1575 struct hci_conn *hcon = conn->hcon;
1576
1577 BT_DBG("chan %p", chan);
1578
86d1407c
JH		 1579 if (!smp)
1580 return;
b68fda68 1581
84bc0db5
JH		 1582 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1583 return;
1584
86d1407c
JH		 1585 cancel_delayed_work(&smp->security_timer);
1586
d6268e86 1587 smp_distribute_keys(smp);
44f1a7ab
JH		 1588}
1589
70db83c4
JH		 1590static void smp_ready_cb(struct l2cap_chan *chan)
1591{
1592 struct l2cap_conn *conn = chan->conn;
1593
1594 BT_DBG("chan %p", chan);
1595
1596 conn->smp = chan;
1597 l2cap_chan_hold(chan);
1598}
1599
4befb867
JH		 1600static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1601{
1602 int err;
1603
1604 BT_DBG("chan %p", chan);
1605
1606 err = smp_sig_channel(chan, skb);
1607 if (err) {
b68fda68 1608 struct smp_chan *smp = chan->data;
4befb867 1609
b68fda68
JH		 1610 if (smp)
1611 cancel_delayed_work_sync(&smp->security_timer);
4befb867 1612
1e91c29e 1613 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
4befb867
JH		 1614 }
1615
1616 return err;
1617}
1618
70db83c4
JH		 1619static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1620 unsigned long hdr_len,
1621 unsigned long len, int nb)
1622{
1623 struct sk_buff *skb;
1624
1625 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1626 if (!skb)
1627 return ERR_PTR(-ENOMEM);
1628
1629 skb->priority = HCI_PRIO_MAX;
1630 bt_cb(skb)->chan = chan;
1631
1632 return skb;
1633}
1634
1635static const struct l2cap_ops smp_chan_ops = {
1636 .name = "Security Manager",
1637 .ready = smp_ready_cb,
5d88cc73 1638 .recv = smp_recv_cb,
70db83c4
JH		 1639 .alloc_skb = smp_alloc_skb_cb,
1640 .teardown = smp_teardown_cb,
44f1a7ab 1641 .resume = smp_resume_cb,
70db83c4
JH		 1642
1643 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1644 .state_change = l2cap_chan_no_state_change,
1645 .close = l2cap_chan_no_close,
1646 .defer = l2cap_chan_no_defer,
1647 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1648 .set_shutdown = l2cap_chan_no_set_shutdown,
1649 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1650 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1651};
1652
1653static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1654{
1655 struct l2cap_chan *chan;
1656
1657 BT_DBG("pchan %p", pchan);
1658
1659 chan = l2cap_chan_create();
1660 if (!chan)
1661 return NULL;
1662
1663 chan->chan_type = pchan->chan_type;
1664 chan->ops = &smp_chan_ops;
1665 chan->scid = pchan->scid;
1666 chan->dcid = chan->scid;
1667 chan->imtu = pchan->imtu;
1668 chan->omtu = pchan->omtu;
1669 chan->mode = pchan->mode;
1670
1671 BT_DBG("created chan %p", chan);
1672
1673 return chan;
1674}
1675
1676static const struct l2cap_ops smp_root_chan_ops = {
1677 .name = "Security Manager Root",
1678 .new_connection = smp_new_conn_cb,
1679
1680 /* None of these are implemented for the root channel */
1681 .close = l2cap_chan_no_close,
1682 .alloc_skb = l2cap_chan_no_alloc_skb,
1683 .recv = l2cap_chan_no_recv,
1684 .state_change = l2cap_chan_no_state_change,
1685 .teardown = l2cap_chan_no_teardown,
1686 .ready = l2cap_chan_no_ready,
1687 .defer = l2cap_chan_no_defer,
1688 .suspend = l2cap_chan_no_suspend,
1689 .resume = l2cap_chan_no_resume,
1690 .set_shutdown = l2cap_chan_no_set_shutdown,
1691 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1692 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1693};
1694
711eafe3
JH		 1695int smp_register(struct hci_dev *hdev)
1696{
70db83c4 1697 struct l2cap_chan *chan;
defce9e8 1698 struct crypto_blkcipher *tfm_aes;
70db83c4 1699
711eafe3
JH		 1700 BT_DBG("%s", hdev->name);
1701
defce9e8
JH		 1702 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1703 if (IS_ERR(tfm_aes)) {
1704 int err = PTR_ERR(tfm_aes);
711eafe3 1705 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1706 return err;
1707 }
1708
70db83c4
JH		 1709 chan = l2cap_chan_create();
1710 if (!chan) {
defce9e8 1711 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1712 return -ENOMEM;
1713 }
1714
defce9e8
JH		 1715 chan->data = tfm_aes;
1716
5d88cc73 1717 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1718
1719 l2cap_chan_set_defaults(chan);
1720
1721 bacpy(&chan->src, &hdev->bdaddr);
1722 chan->src_type = BDADDR_LE_PUBLIC;
1723 chan->state = BT_LISTEN;
1724 chan->mode = L2CAP_MODE_BASIC;
1725 chan->imtu = L2CAP_DEFAULT_MTU;
1726 chan->ops = &smp_root_chan_ops;
1727
1728 hdev->smp_data = chan;
1729
711eafe3
JH		 1730 return 0;
1731}
1732
1733void smp_unregister(struct hci_dev *hdev)
1734{
70db83c4 1735 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1736 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1737
1738 if (!chan)
1739 return;
1740
1741 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1742
defce9e8
JH		 1743 tfm_aes = chan->data;
1744 if (tfm_aes) {
1745 chan->data = NULL;
1746 crypto_free_blkcipher(tfm_aes);
711eafe3 1747 }
70db83c4
JH		 1748
1749 hdev->smp_data = NULL;
1750 l2cap_chan_put(chan);
711eafe3 1751}
Linux 6.x block layer and io_uring tree(s)