projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Set the correct values for Identity Address Information
[linux-block.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
d22ef0bc 127static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 128 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
129 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 130{
131 u8 p1[16], p2[16];
132 int err;
133
134 memset(p1, 0, 16);
135
136 /* p1 = pres || preq || _rat || _iat */
137 swap56(pres, p1);
138 swap56(preq, p1 + 7);
139 p1[14] = _rat;
140 p1[15] = _iat;
141
142 memset(p2, 0, 16);
143
144 /* p2 = padding || ia || ra */
145 baswap((bdaddr_t *) (p2 + 4), ia);
146 baswap((bdaddr_t *) (p2 + 10), ra);
147
148 /* res = r XOR p1 */
149 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
150
151 /* res = e(k, res) */
152 err = smp_e(tfm, k, res);
153 if (err) {
154 BT_ERR("Encrypt data error");
155 return err;
156 }
157
158 /* res = res XOR p2 */
159 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
160
161 /* res = e(k, res) */
162 err = smp_e(tfm, k, res);
163 if (err)
164 BT_ERR("Encrypt data error");
165
166 return err;
167}
168
f1560463
MH		 169static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
170 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 171{
172 int err;
173
174 /* Just least significant octets from r1 and r2 are considered */
175 memcpy(_r, r1 + 8, 8);
176 memcpy(_r + 8, r2 + 8, 8);
177
178 err = smp_e(tfm, k, _r);
179 if (err)
180 BT_ERR("Encrypt data error");
181
182 return err;
183}
184
eb492e01 185static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 186 u16 dlen, void *data)
eb492e01
AB		 187{
188 struct sk_buff *skb;
189 struct l2cap_hdr *lh;
190 int len;
191
192 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
193
194 if (len > conn->mtu)
195 return NULL;
196
197 skb = bt_skb_alloc(len, GFP_ATOMIC);
198 if (!skb)
199 return NULL;
200
201 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
202 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 203 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 204
205 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
206
207 memcpy(skb_put(skb, dlen), data, dlen);
208
209 return skb;
210}
211
212static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
213{
214 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
215
216 BT_DBG("code 0x%2.2x", code);
217
218 if (!skb)
219 return;
220
73d80deb
LAD		 221 skb->priority = HCI_PRIO_MAX;
222 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 223
6c9d42a1 224 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 225 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 226}
227
2b64d153
BG		 228static __u8 authreq_to_seclevel(__u8 authreq)
229{
230 if (authreq & SMP_AUTH_MITM)
231 return BT_SECURITY_HIGH;
232 else
233 return BT_SECURITY_MEDIUM;
234}
235
236static __u8 seclevel_to_authreq(__u8 sec_level)
237{
238 switch (sec_level) {
239 case BT_SECURITY_HIGH:
240 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
241 case BT_SECURITY_MEDIUM:
242 return SMP_AUTH_BONDING;
243 default:
244 return SMP_AUTH_NONE;
245 }
246}
247
b8e66eac 248static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 249 struct smp_cmd_pairing *req,
250 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 251{
fd349c02
JH		 252 struct smp_chan *smp = conn->smp_chan;
253 struct hci_conn *hcon = conn->hcon;
254 struct hci_dev *hdev = hcon->hdev;
255 u8 local_dist = 0, remote_dist = 0;
54790f73 256
a8b2d5c2 257 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
fd349c02
JH		 258 local_dist = SMP_DIST_ENC_KEY;
259 remote_dist = SMP_DIST_ENC_KEY;
54790f73 260 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 261 } else {
262 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 263 }
264
fd349c02
JH		 265 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
266 remote_dist |= SMP_DIST_ID_KEY;
267
863efaf2
JH		 268 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
269 local_dist |= SMP_DIST_ID_KEY;
270
54790f73
VCG		 271 if (rsp == NULL) {
272 req->io_capability = conn->hcon->io_capability;
273 req->oob_flag = SMP_OOB_NOT_PRESENT;
274 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 275 req->init_key_dist = local_dist;
276 req->resp_key_dist = remote_dist;
065a13e2 277 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 278
279 smp->remote_key_dist = remote_dist;
54790f73
VCG		 280 return;
281 }
282
283 rsp->io_capability = conn->hcon->io_capability;
284 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
285 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 286 rsp->init_key_dist = req->init_key_dist & remote_dist;
287 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 288 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 289
290 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 291}
292
3158c50c
VCG		 293static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
294{
1c1def09
VCG		 295 struct smp_chan *smp = conn->smp_chan;
296
3158c50c 297 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 298 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 299 return SMP_ENC_KEY_SIZE;
300
f7aa611a 301 smp->enc_key_size = max_key_size;
3158c50c
VCG		 302
303 return 0;
304}
305
84794e11 306static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 307{
bab73cb6
JH		 308 struct hci_conn *hcon = conn->hcon;
309
84794e11 310 if (reason)
4f957a76 311 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 312 &reason);
4f957a76 313
ce39fb4e
MH		 314 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
315 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
316 HCI_ERROR_AUTH_FAILURE);
f1c09c07 317
61a0cfb0
AG		 318 cancel_delayed_work_sync(&conn->security_timer);
319
ce39fb4e 320 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 321 smp_chan_destroy(conn);
4f957a76
BG		 322}
323
2b64d153
BG		 324#define JUST_WORKS 0x00
325#define JUST_CFM 0x01
326#define REQ_PASSKEY 0x02
327#define CFM_PASSKEY 0x03
328#define REQ_OOB 0x04
329#define OVERLAP 0xFF
330
331static const u8 gen_method[5][5] = {
332 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
333 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
334 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
335 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
336 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
337};
338
339static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
340 u8 local_io, u8 remote_io)
341{
342 struct hci_conn *hcon = conn->hcon;
343 struct smp_chan *smp = conn->smp_chan;
344 u8 method;
345 u32 passkey = 0;
346 int ret = 0;
347
348 /* Initialize key for JUST WORKS */
349 memset(smp->tk, 0, sizeof(smp->tk));
350 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
351
352 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
353
354 /* If neither side wants MITM, use JUST WORKS */
355 /* If either side has unknown io_caps, use JUST WORKS */
356 /* Otherwise, look up method from the table */
357 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 358 local_io > SMP_IO_KEYBOARD_DISPLAY ||
359 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 360 method = JUST_WORKS;
361 else
b3ff53ff 362 method = gen_method[remote_io][local_io];
2b64d153
BG		 363
364 /* If not bonding, don't ask user to confirm a Zero TK */
365 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
366 method = JUST_WORKS;
367
368 /* If Just Works, Continue with Zero TK */
369 if (method == JUST_WORKS) {
370 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
371 return 0;
372 }
373
374 /* Not Just Works/Confirm results in MITM Authentication */
375 if (method != JUST_CFM)
376 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
377
378 /* If both devices have Keyoard-Display I/O, the master
379 * Confirms and the slave Enters the passkey.
380 */
381 if (method == OVERLAP) {
382 if (hcon->link_mode & HCI_LM_MASTER)
383 method = CFM_PASSKEY;
384 else
385 method = REQ_PASSKEY;
386 }
387
388 /* Generate random passkey. Not valid until confirmed. */
389 if (method == CFM_PASSKEY) {
390 u8 key[16];
391
392 memset(key, 0, sizeof(key));
393 get_random_bytes(&passkey, sizeof(passkey));
394 passkey %= 1000000;
395 put_unaligned_le32(passkey, key);
396 swap128(key, smp->tk);
397 BT_DBG("PassKey: %d", passkey);
398 }
399
400 hci_dev_lock(hcon->hdev);
401
402 if (method == REQ_PASSKEY)
ce39fb4e 403 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 404 hcon->type, hcon->dst_type);
2b64d153 405 else
ce39fb4e 406 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 407 hcon->type, hcon->dst_type,
2b64d153
BG		 408 cpu_to_le32(passkey), 0);
409
410 hci_dev_unlock(hcon->hdev);
411
412 return ret;
413}
414
8aab4757
VCG		 415static void confirm_work(struct work_struct *work)
416{
417 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
418 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 419 struct hci_dev *hdev = conn->hcon->hdev;
420 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 421 struct smp_cmd_pairing_confirm cp;
422 int ret;
423 u8 res[16], reason;
424
425 BT_DBG("conn %p", conn);
426
893ce8b1
JH		 427 /* Prevent mutual access to hdev->tfm_aes */
428 hci_dev_lock(hdev);
8aab4757
VCG		 429
430 if (conn->hcon->out)
c8462ca6
MH		 431 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
432 conn->hcon->src_type, &conn->hcon->src,
433 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 434 else
435 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 436 conn->hcon->dst_type, &conn->hcon->dst,
437 conn->hcon->src_type, &conn->hcon->src, res);
893ce8b1
JH		 438
439 hci_dev_unlock(hdev);
440
8aab4757
VCG		 441 if (ret) {
442 reason = SMP_UNSPECIFIED;
443 goto error;
444 }
445
2b64d153
BG		 446 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
447
8aab4757
VCG		 448 swap128(res, cp.confirm_val);
449 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
450
451 return;
452
453error:
84794e11 454 smp_failure(conn, reason);
8aab4757
VCG		 455}
456
457static void random_work(struct work_struct *work)
458{
459 struct smp_chan *smp = container_of(work, struct smp_chan, random);
460 struct l2cap_conn *conn = smp->conn;
461 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 462 struct hci_dev *hdev = hcon->hdev;
463 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 464 u8 reason, confirm[16], res[16], key[16];
465 int ret;
466
467 if (IS_ERR_OR_NULL(tfm)) {
468 reason = SMP_UNSPECIFIED;
469 goto error;
470 }
471
472 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
473
893ce8b1
JH		 474 /* Prevent mutual access to hdev->tfm_aes */
475 hci_dev_lock(hdev);
476
8aab4757 477 if (hcon->out)
c8462ca6
MH		 478 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
479 hcon->src_type, &hcon->src,
480 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 481 else
482 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 483 hcon->dst_type, &hcon->dst,
484 hcon->src_type, &hcon->src, res);
893ce8b1
JH		 485
486 hci_dev_unlock(hdev);
487
8aab4757
VCG		 488 if (ret) {
489 reason = SMP_UNSPECIFIED;
490 goto error;
491 }
492
493 swap128(res, confirm);
494
495 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
496 BT_ERR("Pairing failed (confirmation values mismatch)");
497 reason = SMP_CONFIRM_FAILED;
498 goto error;
499 }
500
501 if (hcon->out) {
502 u8 stk[16], rand[8];
503 __le16 ediv;
504
505 memset(rand, 0, sizeof(rand));
506 ediv = 0;
507
508 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
509 swap128(key, stk);
510
f7aa611a 511 memset(stk + smp->enc_key_size, 0,
04124681 512 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 513
51a8efd7 514 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 515 reason = SMP_UNSPECIFIED;
516 goto error;
517 }
518
519 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 520 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 521 } else {
522 u8 stk[16], r[16], rand[8];
523 __le16 ediv;
524
525 memset(rand, 0, sizeof(rand));
526 ediv = 0;
527
528 swap128(smp->prnd, r);
529 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
530
531 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
532 swap128(key, stk);
533
f7aa611a 534 memset(stk + smp->enc_key_size, 0,
f1560463 535 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 536
ce39fb4e 537 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 538 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 539 ediv, rand);
8aab4757
VCG		 540 }
541
542 return;
543
544error:
84794e11 545 smp_failure(conn, reason);
8aab4757
VCG		 546}
547
548static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
549{
550 struct smp_chan *smp;
551
f1560463 552 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 553 if (!smp)
554 return NULL;
555
556 INIT_WORK(&smp->confirm, confirm_work);
557 INIT_WORK(&smp->random, random_work);
558
559 smp->conn = conn;
560 conn->smp_chan = smp;
2b64d153 561 conn->hcon->smp_conn = conn;
8aab4757
VCG		 562
563 hci_conn_hold(conn->hcon);
564
565 return smp;
566}
567
568void smp_chan_destroy(struct l2cap_conn *conn)
569{
c8eb9690 570 struct smp_chan *smp = conn->smp_chan;
f4a407be 571 bool complete;
c8eb9690 572
f1c09c07 573 BUG_ON(!smp);
c8eb9690 574
f4a407be
JH		 575 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
576 mgmt_smp_complete(conn->hcon, complete);
577
c8eb9690
BG		 578 kfree(smp);
579 conn->smp_chan = NULL;
2b64d153 580 conn->hcon->smp_conn = NULL;
76a68ba0 581 hci_conn_drop(conn->hcon);
8aab4757
VCG		 582}
583
2b64d153
BG		 584int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
585{
586 struct l2cap_conn *conn = hcon->smp_conn;
587 struct smp_chan *smp;
588 u32 value;
589 u8 key[16];
590
591 BT_DBG("");
592
593 if (!conn)
594 return -ENOTCONN;
595
596 smp = conn->smp_chan;
597
598 switch (mgmt_op) {
599 case MGMT_OP_USER_PASSKEY_REPLY:
600 value = le32_to_cpu(passkey);
601 memset(key, 0, sizeof(key));
602 BT_DBG("PassKey: %d", value);
603 put_unaligned_le32(value, key);
604 swap128(key, smp->tk);
605 /* Fall Through */
606 case MGMT_OP_USER_CONFIRM_REPLY:
607 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
608 break;
609 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
610 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 611 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 612 return 0;
613 default:
84794e11 614 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 615 return -EOPNOTSUPP;
616 }
617
618 /* If it is our turn to send Pairing Confirm, do so now */
619 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
620 queue_work(hcon->hdev->workqueue, &smp->confirm);
621
622 return 0;
623}
624
da85e5e5 625static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 626{
3158c50c 627 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 628 struct smp_chan *smp;
3158c50c 629 u8 key_size;
2b64d153 630 u8 auth = SMP_AUTH_NONE;
8aab4757 631 int ret;
88ba43b6
AB		 632
633 BT_DBG("conn %p", conn);
634
c46b98be
JH		 635 if (skb->len < sizeof(*req))
636 return SMP_UNSPECIFIED;
637
2b64d153
BG		 638 if (conn->hcon->link_mode & HCI_LM_MASTER)
639 return SMP_CMD_NOTSUPP;
640
51a8efd7 641 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 642 smp = smp_chan_create(conn);
d08fd0e7
AE		 643 else
644 smp = conn->smp_chan;
8aab4757 645
d08fd0e7
AE		 646 if (!smp)
647 return SMP_UNSPECIFIED;
d26a2345 648
1c1def09
VCG		 649 smp->preq[0] = SMP_CMD_PAIRING_REQ;
650 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 651 skb_pull(skb, sizeof(*req));
88ba43b6 652
2b64d153
BG		 653 /* We didn't start the pairing, so match remote */
654 if (req->auth_req & SMP_AUTH_BONDING)
655 auth = req->auth_req;
da85e5e5 656
fdde0a26
IY		 657 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
658
2b64d153 659 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 660
661 key_size = min(req->max_key_size, rsp.max_key_size);
662 if (check_enc_key_size(conn, key_size))
663 return SMP_ENC_KEY_SIZE;
88ba43b6 664
e84a6b13 665 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 666
1c1def09
VCG		 667 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
668 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 669
3158c50c 670 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 671
2b64d153
BG		 672 /* Request setup of TK */
673 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
674 if (ret)
675 return SMP_UNSPECIFIED;
676
da85e5e5 677 return 0;
88ba43b6
AB		 678}
679
da85e5e5 680static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 681{
3158c50c 682 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 683 struct smp_chan *smp = conn->smp_chan;
8aab4757 684 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 685 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 686 int ret;
88ba43b6
AB		 687
688 BT_DBG("conn %p", conn);
689
c46b98be
JH		 690 if (skb->len < sizeof(*rsp))
691 return SMP_UNSPECIFIED;
692
2b64d153
BG		 693 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
694 return SMP_CMD_NOTSUPP;
695
3158c50c
VCG		 696 skb_pull(skb, sizeof(*rsp));
697
1c1def09 698 req = (void *) &smp->preq[1];
da85e5e5 699
3158c50c
VCG		 700 key_size = min(req->max_key_size, rsp->max_key_size);
701 if (check_enc_key_size(conn, key_size))
702 return SMP_ENC_KEY_SIZE;
703
e84a6b13 704 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 705
8aab4757
VCG		 706 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
707 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 708
2b64d153 709 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 710 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 711 auth = SMP_AUTH_BONDING;
712
713 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
714
476585ec 715 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 716 if (ret)
717 return SMP_UNSPECIFIED;
718
719 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
720
721 /* Can't compose response until we have been confirmed */
722 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
723 return 0;
724
8aab4757 725 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 726
727 return 0;
88ba43b6
AB		 728}
729
da85e5e5 730static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 731{
1c1def09 732 struct smp_chan *smp = conn->smp_chan;
8aab4757 733 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 734
88ba43b6
AB		 735 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
736
c46b98be
JH		 737 if (skb->len < sizeof(smp->pcnf))
738 return SMP_UNSPECIFIED;
739
1c1def09
VCG		 740 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
741 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 742
7d24ddcc
AB		 743 if (conn->hcon->out) {
744 u8 random[16];
88ba43b6 745
1c1def09 746 swap128(smp->prnd, random);
88ba43b6 747 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 748 random);
2b64d153 749 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 750 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 751 } else {
752 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 753 }
da85e5e5
VCG		 754
755 return 0;
88ba43b6
AB		 756}
757
da85e5e5 758static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 759{
1c1def09 760 struct smp_chan *smp = conn->smp_chan;
8aab4757 761 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 762
8aab4757 763 BT_DBG("conn %p", conn);
3158c50c 764
c46b98be
JH		 765 if (skb->len < sizeof(smp->rrnd))
766 return SMP_UNSPECIFIED;
767
8aab4757
VCG		 768 swap128(skb->data, smp->rrnd);
769 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 770
8aab4757 771 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 772
773 return 0;
88ba43b6
AB		 774}
775
4dab7864 776static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 777{
c9839a11 778 struct smp_ltk *key;
988c5997
VCG		 779 struct hci_conn *hcon = conn->hcon;
780
98a0b845
JH		 781 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
782 hcon->out);
988c5997
VCG		 783 if (!key)
784 return 0;
785
4dab7864
JH		 786 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
787 return 0;
788
51a8efd7 789 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 790 return 1;
791
c9839a11
VCG		 792 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
793 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 794
795 return 1;
988c5997 796}
f1560463 797
da85e5e5 798static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 799{
800 struct smp_cmd_security_req *rp = (void *) skb->data;
801 struct smp_cmd_pairing cp;
f1cb9af5 802 struct hci_conn *hcon = conn->hcon;
8aab4757 803 struct smp_chan *smp;
88ba43b6
AB		 804
805 BT_DBG("conn %p", conn);
806
c46b98be
JH		 807 if (skb->len < sizeof(*rp))
808 return SMP_UNSPECIFIED;
809
86ca9eac
JH		 810 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
811 return SMP_CMD_NOTSUPP;
812
2b64d153 813 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 814
4dab7864 815 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 816 return 0;
817
51a8efd7 818 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 819 return 0;
f1cb9af5 820
8aab4757 821 smp = smp_chan_create(conn);
d26a2345 822
88ba43b6 823 skb_pull(skb, sizeof(*rp));
88ba43b6 824
da85e5e5 825 memset(&cp, 0, sizeof(cp));
54790f73 826 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 827
1c1def09
VCG		 828 smp->preq[0] = SMP_CMD_PAIRING_REQ;
829 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 830
88ba43b6 831 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 832
da85e5e5 833 return 0;
88ba43b6
AB		 834}
835
ad32a2f5
JH		 836bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
837{
838 if (sec_level == BT_SECURITY_LOW)
839 return true;
840
841 if (hcon->sec_level >= sec_level)
842 return true;
843
844 return false;
845}
846
cc110922 847int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 848{
cc110922 849 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 850 struct smp_chan *smp = conn->smp_chan;
2b64d153 851 __u8 authreq;
eb492e01 852
3a0259bb
VCG		 853 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
854
757aee0f 855 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 856 return 1;
857
ad32a2f5 858 if (smp_sufficient_security(hcon, sec_level))
eb492e01 859 return 1;
f1cb9af5 860
988c5997 861 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 862 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 863 goto done;
d26a2345 864
51a8efd7 865 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 866 return 0;
867
8aab4757 868 smp = smp_chan_create(conn);
2b64d153
BG		 869 if (!smp)
870 return 1;
871
872 authreq = seclevel_to_authreq(sec_level);
d26a2345 873
d26a2345
VCG		 874 if (hcon->link_mode & HCI_LM_MASTER) {
875 struct smp_cmd_pairing cp;
f01ead31 876
2b64d153 877 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 878 smp->preq[0] = SMP_CMD_PAIRING_REQ;
879 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 880
eb492e01
AB		 881 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
882 } else {
883 struct smp_cmd_security_req cp;
2b64d153 884 cp.auth_req = authreq;
eb492e01
AB		 885 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
886 }
887
02bc7455 888done:
f1cb9af5 889 hcon->pending_sec_level = sec_level;
f1cb9af5 890
eb492e01
AB		 891 return 0;
892}
893
7034b911
VCG		 894static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
895{
16b90839 896 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 897 struct smp_chan *smp = conn->smp_chan;
16b90839 898
c46b98be
JH		 899 BT_DBG("conn %p", conn);
900
901 if (skb->len < sizeof(*rp))
902 return SMP_UNSPECIFIED;
903
6131ddc8
JH		 904 /* Ignore this PDU if it wasn't requested */
905 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
906 return 0;
907
16b90839
VCG		 908 skb_pull(skb, sizeof(*rp));
909
1c1def09 910 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 911
7034b911
VCG		 912 return 0;
913}
914
915static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
916{
16b90839 917 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 918 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 919 struct hci_dev *hdev = conn->hcon->hdev;
920 struct hci_conn *hcon = conn->hcon;
23d0e128 921 struct smp_ltk *ltk;
c9839a11 922 u8 authenticated;
16b90839 923
c46b98be
JH		 924 BT_DBG("conn %p", conn);
925
926 if (skb->len < sizeof(*rp))
927 return SMP_UNSPECIFIED;
928
6131ddc8
JH		 929 /* Ignore this PDU if it wasn't requested */
930 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
931 return 0;
932
16b90839 933 skb_pull(skb, sizeof(*rp));
7034b911 934
c9839a11 935 hci_dev_lock(hdev);
ce39fb4e 936 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 937 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 938 authenticated, smp->tk, smp->enc_key_size,
939 rp->ediv, rp->rand);
940 smp->ltk = ltk;
fd349c02
JH		 941 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
942 smp_distribute_keys(conn, 1);
c9839a11 943 hci_dev_unlock(hdev);
7034b911
VCG		 944
945 return 0;
946}
947
fd349c02
JH		 948static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
949{
950 struct smp_cmd_ident_info *info = (void *) skb->data;
951 struct smp_chan *smp = conn->smp_chan;
952
953 BT_DBG("");
954
955 if (skb->len < sizeof(*info))
956 return SMP_UNSPECIFIED;
957
6131ddc8
JH		 958 /* Ignore this PDU if it wasn't requested */
959 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
960 return 0;
961
fd349c02
JH		 962 skb_pull(skb, sizeof(*info));
963
964 memcpy(smp->irk, info->irk, 16);
965
966 return 0;
967}
968
969static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
970 struct sk_buff *skb)
971{
972 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
973 struct smp_chan *smp = conn->smp_chan;
974 struct hci_conn *hcon = conn->hcon;
975 bdaddr_t rpa;
976
977 BT_DBG("");
978
979 if (skb->len < sizeof(*info))
980 return SMP_UNSPECIFIED;
981
6131ddc8
JH		 982 /* Ignore this PDU if it wasn't requested */
983 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
984 return 0;
985
fd349c02
JH		 986 skb_pull(skb, sizeof(*info));
987
988 bacpy(&smp->id_addr, &info->bdaddr);
989 smp->id_addr_type = info->addr_type;
990
991 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
992 bacpy(&rpa, &hcon->dst);
993 else
994 bacpy(&rpa, BDADDR_ANY);
995
23d0e128
JH		 996 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
997 smp->id_addr_type, smp->irk, &rpa);
fd349c02 998
68d6f6de
JH		 999 /* Track the connection based on the Identity Address from now on */
1000 bacpy(&hcon->dst, &smp->id_addr);
1001 hcon->dst_type = smp->id_addr_type;
1002
387a33e3
JH		 1003 l2cap_conn_update_id_addr(hcon);
1004
fd349c02
JH		 1005 smp_distribute_keys(conn, 1);
1006
1007 return 0;
1008}
1009
eb492e01
AB		 1010int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1011{
7b9899db 1012 struct hci_conn *hcon = conn->hcon;
92381f5c 1013 __u8 code, reason;
eb492e01
AB		 1014 int err = 0;
1015
7b9899db
MH		 1016 if (hcon->type != LE_LINK) {
1017 kfree_skb(skb);
3432711f 1018 return 0;
7b9899db
MH		 1019 }
1020
92381f5c
MH		 1021 if (skb->len < 1) {
1022 kfree_skb(skb);
1023 return -EILSEQ;
1024 }
1025
06ae3314 1026 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1027 err = -ENOTSUPP;
1028 reason = SMP_PAIRING_NOTSUPP;
1029 goto done;
1030 }
1031
92381f5c 1032 code = skb->data[0];
eb492e01
AB		 1033 skb_pull(skb, sizeof(code));
1034
8cf9fa12
JH		 1035 /*
1036 * The SMP context must be initialized for all other PDUs except
1037 * pairing and security requests. If we get any other PDU when
1038 * not initialized simply disconnect (done if this function
1039 * returns an error).
1040 */
1041 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1042 !conn->smp_chan) {
1043 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1044 kfree_skb(skb);
1045 return -ENOTSUPP;
1046 }
1047
eb492e01
AB		 1048 switch (code) {
1049 case SMP_CMD_PAIRING_REQ:
da85e5e5 1050 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1051 break;
1052
1053 case SMP_CMD_PAIRING_FAIL:
84794e11 1054 smp_failure(conn, 0);
da85e5e5
VCG		 1055 reason = 0;
1056 err = -EPERM;
eb492e01
AB		 1057 break;
1058
1059 case SMP_CMD_PAIRING_RSP:
da85e5e5 1060 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1061 break;
1062
1063 case SMP_CMD_SECURITY_REQ:
da85e5e5 1064 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1065 break;
1066
eb492e01 1067 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1068 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1069 break;
1070
eb492e01 1071 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1072 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1073 break;
1074
eb492e01 1075 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1076 reason = smp_cmd_encrypt_info(conn, skb);
1077 break;
1078
eb492e01 1079 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1080 reason = smp_cmd_master_ident(conn, skb);
1081 break;
1082
eb492e01 1083 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1084 reason = smp_cmd_ident_info(conn, skb);
1085 break;
1086
eb492e01 1087 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1088 reason = smp_cmd_ident_addr_info(conn, skb);
1089 break;
1090
eb492e01 1091 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 1092 /* Just ignored */
1093 reason = 0;
1094 break;
1095
eb492e01
AB		 1096 default:
1097 BT_DBG("Unknown command code 0x%2.2x", code);
1098
1099 reason = SMP_CMD_NOTSUPP;
eb492e01 1100 err = -EOPNOTSUPP;
3a0259bb 1101 goto done;
eb492e01
AB		 1102 }
1103
3a0259bb
VCG		 1104done:
1105 if (reason)
84794e11 1106 smp_failure(conn, reason);
3a0259bb 1107
eb492e01
AB		 1108 kfree_skb(skb);
1109 return err;
1110}
7034b911 1111
35d70271
JH		 1112static void smp_notify_keys(struct l2cap_conn *conn)
1113{
1114 struct smp_chan *smp = conn->smp_chan;
1115 struct hci_conn *hcon = conn->hcon;
1116 struct hci_dev *hdev = hcon->hdev;
1117
95fbac8a
JH		 1118 if (smp->remote_irk)
1119 mgmt_new_irk(hdev, smp->remote_irk);
1120
35d70271
JH		 1121 if (smp->ltk) {
1122 smp->ltk->bdaddr_type = hcon->dst_type;
1123 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1124 mgmt_new_ltk(hdev, smp->ltk);
1125 }
1126
1127 if (smp->slave_ltk) {
1128 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1129 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1130 mgmt_new_ltk(hdev, smp->slave_ltk);
1131 }
1132}
1133
7034b911
VCG		 1134int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
1135{
1136 struct smp_cmd_pairing *req, *rsp;
1c1def09 1137 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1138 struct hci_conn *hcon = conn->hcon;
1139 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1140 __u8 *keydist;
1141
1142 BT_DBG("conn %p force %d", conn, force);
1143
524237cb 1144 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1145 return 0;
1146
1c1def09 1147 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1148
1149 /* The responder sends its keys first */
524237cb 1150 if (!force && hcon->out && (rsp->resp_key_dist & 0x07))
7034b911
VCG		 1151 return 0;
1152
1c1def09 1153 req = (void *) &smp->preq[1];
7034b911 1154
524237cb 1155 if (hcon->out) {
7034b911
VCG		 1156 keydist = &rsp->init_key_dist;
1157 *keydist &= req->init_key_dist;
1158 } else {
1159 keydist = &rsp->resp_key_dist;
1160 *keydist &= req->resp_key_dist;
1161 }
1162
7034b911
VCG		 1163 BT_DBG("keydist 0x%x", *keydist);
1164
1165 if (*keydist & SMP_DIST_ENC_KEY) {
1166 struct smp_cmd_encrypt_info enc;
1167 struct smp_cmd_master_ident ident;
23d0e128 1168 struct smp_ltk *ltk;
c9839a11 1169 u8 authenticated;
7034b911
VCG		 1170 __le16 ediv;
1171
1172 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1173 get_random_bytes(&ediv, sizeof(ediv));
1174 get_random_bytes(ident.rand, sizeof(ident.rand));
1175
1176 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1177
c9839a11 1178 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1179 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271
JH		 1180 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
1181 smp->enc_key_size, ediv, ident.rand);
23d0e128 1182 smp->slave_ltk = ltk;
16b90839 1183
58115373 1184 ident.ediv = ediv;
7034b911
VCG		 1185
1186 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1187
1188 *keydist &= ~SMP_DIST_ENC_KEY;
1189 }
1190
1191 if (*keydist & SMP_DIST_ID_KEY) {
1192 struct smp_cmd_ident_addr_info addrinfo;
1193 struct smp_cmd_ident_info idinfo;
1194
863efaf2 1195 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1196
1197 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1198
82d4b359
JH		 1199 /* The hci_conn contains the local identity address
1200 * after the connection has been established.
1201 *
1202 * This is true even when the connection has been
1203 * established using a resolvable random address.
1204 */
524237cb 1205 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1206 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1207
1208 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1209 &addrinfo);
7034b911
VCG		 1210
1211 *keydist &= ~SMP_DIST_ID_KEY;
1212 }
1213
1214 if (*keydist & SMP_DIST_SIGN) {
1215 struct smp_cmd_sign_info sign;
1216
1217 /* Send a dummy key */
1218 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1219
1220 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1221
1222 *keydist &= ~SMP_DIST_SIGN;
1223 }
1224
524237cb
JH		 1225 if (hcon->out || force || !(rsp->init_key_dist & 0x07)) {
1226 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
6c9d42a1 1227 cancel_delayed_work_sync(&conn->security_timer);
f4a407be 1228 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
35d70271 1229 smp_notify_keys(conn);
8aab4757 1230 smp_chan_destroy(conn);
d26a2345
VCG		 1231 }
1232
7034b911
VCG		 1233 return 0;
1234}
Linux 6.x block layer and io_uring tree(s)