projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix encryption key size handling for LTKs
[linux-block.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
300acfde 23#include <linux/debugfs.h>
8c520a59
GP		 24#include <linux/crypto.h>
25#include <linux/scatterlist.h>
26#include <crypto/b128ops.h>
27
eb492e01
AB		 28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30#include <net/bluetooth/l2cap.h>
2b64d153 31#include <net/bluetooth/mgmt.h>
ac4b7236 32
3b19146d 33#include "ecc.h"
ac4b7236 34#include "smp.h"
d22ef0bc 35
c7a3d57d
JH		 36/* Low-level debug macros to be used for stuff that we don't want
37 * accidentially in dmesg, i.e. the values of the various crypto keys
38 * and the inputs & outputs of crypto functions.
39 */
40#ifdef DEBUG
41#define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \
42 ##__VA_ARGS__)
43#else
44#define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \
45 ##__VA_ARGS__)
46#endif
47
b28b4943 48#define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
b28b4943 49
3b19146d
JH		 50/* Keys which are not distributed with Secure Connections */
51#define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY);
52
17b02e62 53#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 54
d7a5a11d 55#define AUTH_REQ_MASK(dev) (hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \
0edb14de
JH		 56 0x1f : 0x07)
57#define KEY_DIST_MASK 0x07
065a13e2 58
cbbbe3e2
JH		 59/* Maximum message length that can be passed to aes_cmac */
60#define CMAC_MSG_MAX 80
61
533e35d4
JH		 62enum {
63 SMP_FLAG_TK_VALID,
64 SMP_FLAG_CFM_PENDING,
65 SMP_FLAG_MITM_AUTH,
66 SMP_FLAG_COMPLETE,
67 SMP_FLAG_INITIATOR,
65668776 68 SMP_FLAG_SC,
d8f8edbe 69 SMP_FLAG_REMOTE_PK,
aeb7d461 70 SMP_FLAG_DEBUG_KEY,
38606f14 71 SMP_FLAG_WAIT_USER,
d3e54a87 72 SMP_FLAG_DHKEY_PENDING,
1a8bab4f
JH		 73 SMP_FLAG_REMOTE_OOB,
74 SMP_FLAG_LOCAL_OOB,
533e35d4 75};
4bc58f51 76
88a479d9 77struct smp_dev {
60a27d65
MH		 78 /* Secure Connections OOB data */
79 u8 local_pk[64];
80 u8 local_sk[32];
fb334fee 81 u8 local_rand[16];
60a27d65
MH		 82 bool debug_key;
83
88a479d9 84 struct crypto_blkcipher *tfm_aes;
6e2dc6d1 85 struct crypto_hash *tfm_cmac;
88a479d9
MH		 86};
87
4bc58f51 88struct smp_chan {
b68fda68
JH		 89 struct l2cap_conn *conn;
90 struct delayed_work security_timer;
b28b4943 91 unsigned long allow_cmd; /* Bitmask of allowed commands */
b68fda68 92
4bc58f51
JH		 93 u8 preq[7]; /* SMP Pairing Request */
94 u8 prsp[7]; /* SMP Pairing Response */
95 u8 prnd[16]; /* SMP Pairing Random (local) */
96 u8 rrnd[16]; /* SMP Pairing Random (remote) */
97 u8 pcnf[16]; /* SMP Pairing Confirm */
98 u8 tk[16]; /* SMP Temporary Key */
882fafad
JH		 99 u8 rr[16]; /* Remote OOB ra/rb value */
100 u8 lr[16]; /* Local OOB ra/rb value */
4bc58f51
JH		 101 u8 enc_key_size;
102 u8 remote_key_dist;
103 bdaddr_t id_addr;
104 u8 id_addr_type;
105 u8 irk[16];
106 struct smp_csrk *csrk;
107 struct smp_csrk *slave_csrk;
108 struct smp_ltk *ltk;
109 struct smp_ltk *slave_ltk;
110 struct smp_irk *remote_irk;
6a77083a 111 u8 *link_key;
4a74d658 112 unsigned long flags;
783e0574 113 u8 method;
38606f14 114 u8 passkey_round;
6a7bd103 115
3b19146d
JH		 116 /* Secure Connections variables */
117 u8 local_pk[64];
118 u8 local_sk[32];
d8f8edbe
JH		 119 u8 remote_pk[64];
120 u8 dhkey[32];
760b018b 121 u8 mackey[16];
3b19146d 122
6a7bd103 123 struct crypto_blkcipher *tfm_aes;
407cecf6 124 struct crypto_hash *tfm_cmac;
4bc58f51
JH		 125};
126
aeb7d461
JH		 127/* These debug key values are defined in the SMP section of the core
128 * specification. debug_pk is the public debug key and debug_sk the
129 * private debug key.
130 */
131static const u8 debug_pk[64] = {
132 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
133 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
134 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
135 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20,
136
137 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74,
138 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
139 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63,
140 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc,
141};
142
143static const u8 debug_sk[32] = {
144 0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58,
145 0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a,
146 0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74,
147 0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f,
148};
149
8a2936f4 150static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 151{
8a2936f4 152 size_t i;
d22ef0bc 153
8a2936f4
JH		 154 for (i = 0; i < len; i++)
155 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 156}
157
06edf8de
JH		 158/* The following functions map to the LE SC SMP crypto functions
159 * AES-CMAC, f4, f5, f6, g2 and h6.
160 */
161
cbbbe3e2
JH		 162static int aes_cmac(struct crypto_hash *tfm, const u8 k[16], const u8 *m,
163 size_t len, u8 mac[16])
164{
165 uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX];
166 struct hash_desc desc;
167 struct scatterlist sg;
168 int err;
169
170 if (len > CMAC_MSG_MAX)
171 return -EFBIG;
172
173 if (!tfm) {
174 BT_ERR("tfm %p", tfm);
175 return -EINVAL;
176 }
177
178 desc.tfm = tfm;
179 desc.flags = 0;
180
181 crypto_hash_init(&desc);
182
183 /* Swap key and message from LSB to MSB */
184 swap_buf(k, tmp, 16);
185 swap_buf(m, msg_msb, len);
186
c7a3d57d
JH		 187 SMP_DBG("msg (len %zu) %*phN", len, (int) len, m);
188 SMP_DBG("key %16phN", k);
cbbbe3e2
JH		 189
190 err = crypto_hash_setkey(tfm, tmp, 16);
191 if (err) {
192 BT_ERR("cipher setkey failed: %d", err);
193 return err;
194 }
195
196 sg_init_one(&sg, msg_msb, len);
197
198 err = crypto_hash_update(&desc, &sg, len);
199 if (err) {
200 BT_ERR("Hash update error %d", err);
201 return err;
202 }
203
204 err = crypto_hash_final(&desc, mac_msb);
205 if (err) {
206 BT_ERR("Hash final error %d", err);
207 return err;
208 }
209
210 swap_buf(mac_msb, mac, 16);
211
c7a3d57d 212 SMP_DBG("mac %16phN", mac);
cbbbe3e2
JH		 213
214 return 0;
215}
216
217static int smp_f4(struct crypto_hash *tfm_cmac, const u8 u[32], const u8 v[32],
218 const u8 x[16], u8 z, u8 res[16])
219{
220 u8 m[65];
221 int err;
222
c7a3d57d
JH		 223 SMP_DBG("u %32phN", u);
224 SMP_DBG("v %32phN", v);
225 SMP_DBG("x %16phN z %02x", x, z);
cbbbe3e2
JH		 226
227 m[0] = z;
228 memcpy(m + 1, v, 32);
229 memcpy(m + 33, u, 32);
230
231 err = aes_cmac(tfm_cmac, x, m, sizeof(m), res);
232 if (err)
233 return err;
234
c7a3d57d 235 SMP_DBG("res %16phN", res);
cbbbe3e2
JH		 236
237 return err;
238}
239
4da50de8
JH		 240static int smp_f5(struct crypto_hash *tfm_cmac, const u8 w[32],
241 const u8 n1[16], const u8 n2[16], const u8 a1[7],
242 const u8 a2[7], u8 mackey[16], u8 ltk[16])
760b018b
JH		 243{
244 /* The btle, salt and length "magic" values are as defined in
245 * the SMP section of the Bluetooth core specification. In ASCII
246 * the btle value ends up being 'btle'. The salt is just a
247 * random number whereas length is the value 256 in little
248 * endian format.
249 */
250 const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 };
251 const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60,
252 0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c };
253 const u8 length[2] = { 0x00, 0x01 };
254 u8 m[53], t[16];
255 int err;
256
c7a3d57d
JH		 257 SMP_DBG("w %32phN", w);
258 SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
259 SMP_DBG("a1 %7phN a2 %7phN", a1, a2);
760b018b
JH		 260
261 err = aes_cmac(tfm_cmac, salt, w, 32, t);
262 if (err)
263 return err;
264
c7a3d57d 265 SMP_DBG("t %16phN", t);
760b018b
JH		 266
267 memcpy(m, length, 2);
268 memcpy(m + 2, a2, 7);
269 memcpy(m + 9, a1, 7);
270 memcpy(m + 16, n2, 16);
271 memcpy(m + 32, n1, 16);
272 memcpy(m + 48, btle, 4);
273
274 m[52] = 0; /* Counter */
275
276 err = aes_cmac(tfm_cmac, t, m, sizeof(m), mackey);
277 if (err)
278 return err;
279
c7a3d57d 280 SMP_DBG("mackey %16phN", mackey);
760b018b
JH		 281
282 m[52] = 1; /* Counter */
283
284 err = aes_cmac(tfm_cmac, t, m, sizeof(m), ltk);
285 if (err)
286 return err;
287
c7a3d57d 288 SMP_DBG("ltk %16phN", ltk);
760b018b
JH		 289
290 return 0;
291}
292
293static int smp_f6(struct crypto_hash *tfm_cmac, const u8 w[16],
4da50de8 294 const u8 n1[16], const u8 n2[16], const u8 r[16],
760b018b
JH		 295 const u8 io_cap[3], const u8 a1[7], const u8 a2[7],
296 u8 res[16])
297{
298 u8 m[65];
299 int err;
300
c7a3d57d
JH		 301 SMP_DBG("w %16phN", w);
302 SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
303 SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2);
760b018b
JH		 304
305 memcpy(m, a2, 7);
306 memcpy(m + 7, a1, 7);
307 memcpy(m + 14, io_cap, 3);
308 memcpy(m + 17, r, 16);
309 memcpy(m + 33, n2, 16);
310 memcpy(m + 49, n1, 16);
311
312 err = aes_cmac(tfm_cmac, w, m, sizeof(m), res);
313 if (err)
314 return err;
315
203de21b 316 SMP_DBG("res %16phN", res);
760b018b
JH		 317
318 return err;
319}
320
191dc7fe
JH		 321static int smp_g2(struct crypto_hash *tfm_cmac, const u8 u[32], const u8 v[32],
322 const u8 x[16], const u8 y[16], u32 *val)
323{
324 u8 m[80], tmp[16];
325 int err;
326
c7a3d57d
JH		 327 SMP_DBG("u %32phN", u);
328 SMP_DBG("v %32phN", v);
329 SMP_DBG("x %16phN y %16phN", x, y);
191dc7fe
JH		 330
331 memcpy(m, y, 16);
332 memcpy(m + 16, v, 32);
333 memcpy(m + 48, u, 32);
334
335 err = aes_cmac(tfm_cmac, x, m, sizeof(m), tmp);
336 if (err)
337 return err;
338
339 *val = get_unaligned_le32(tmp);
340 *val %= 1000000;
341
c7a3d57d 342 SMP_DBG("val %06u", *val);
191dc7fe
JH		 343
344 return 0;
345}
346
06edf8de
JH		 347static int smp_h6(struct crypto_hash *tfm_cmac, const u8 w[16],
348 const u8 key_id[4], u8 res[16])
349{
350 int err;
351
352 SMP_DBG("w %16phN key_id %4phN", w, key_id);
353
354 err = aes_cmac(tfm_cmac, w, key_id, 4, res);
355 if (err)
356 return err;
357
358 SMP_DBG("res %16phN", res);
359
360 return err;
361}
362
363/* The following functions map to the legacy SMP crypto functions e, c1,
364 * s1 and ah.
365 */
366
d22ef0bc
AB		 367static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
368{
369 struct blkcipher_desc desc;
370 struct scatterlist sg;
943a732a 371 uint8_t tmp[16], data[16];
201a5929 372 int err;
d22ef0bc 373
011c391a
JH		 374 SMP_DBG("k %16phN r %16phN", k, r);
375
7f376cd6 376 if (!tfm) {
d22ef0bc
AB		 377 BT_ERR("tfm %p", tfm);
378 return -EINVAL;
379 }
380
381 desc.tfm = tfm;
382 desc.flags = 0;
383
943a732a 384 /* The most significant octet of key corresponds to k[0] */
8a2936f4 385 swap_buf(k, tmp, 16);
943a732a
JH		 386
387 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 388 if (err) {
389 BT_ERR("cipher setkey failed: %d", err);
390 return err;
391 }
392
943a732a 393 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 394 swap_buf(r, data, 16);
943a732a
JH		 395
396 sg_init_one(&sg, data, 16);
d22ef0bc 397
d22ef0bc
AB		 398 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
399 if (err)
400 BT_ERR("Encrypt data error %d", err);
401
943a732a 402 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 403 swap_buf(data, r, 16);
943a732a 404
011c391a
JH		 405 SMP_DBG("r %16phN", r);
406
d22ef0bc
AB		 407 return err;
408}
409
06edf8de
JH		 410static int smp_c1(struct crypto_blkcipher *tfm_aes, const u8 k[16],
411 const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat,
412 const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16])
6a77083a 413{
06edf8de 414 u8 p1[16], p2[16];
6a77083a
JH		 415 int err;
416
011c391a
JH		 417 SMP_DBG("k %16phN r %16phN", k, r);
418 SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra);
419 SMP_DBG("preq %7phN pres %7phN", preq, pres);
420
06edf8de 421 memset(p1, 0, 16);
6a77083a 422
06edf8de
JH		 423 /* p1 = pres || preq || _rat || _iat */
424 p1[0] = _iat;
425 p1[1] = _rat;
426 memcpy(p1 + 2, preq, 7);
427 memcpy(p1 + 9, pres, 7);
428
011c391a 429 SMP_DBG("p1 %16phN", p1);
06edf8de
JH		 430
431 /* res = r XOR p1 */
432 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
433
434 /* res = e(k, res) */
435 err = smp_e(tfm_aes, k, res);
436 if (err) {
437 BT_ERR("Encrypt data error");
6a77083a 438 return err;
06edf8de 439 }
6a77083a 440
011c391a
JH		 441 /* p2 = padding || ia || ra */
442 memcpy(p2, ra, 6);
443 memcpy(p2 + 6, ia, 6);
444 memset(p2 + 12, 0, 4);
445
446 SMP_DBG("p2 %16phN", p2);
447
06edf8de
JH		 448 /* res = res XOR p2 */
449 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
450
451 /* res = e(k, res) */
452 err = smp_e(tfm_aes, k, res);
453 if (err)
454 BT_ERR("Encrypt data error");
455
456 return err;
457}
458
459static int smp_s1(struct crypto_blkcipher *tfm_aes, const u8 k[16],
460 const u8 r1[16], const u8 r2[16], u8 _r[16])
461{
462 int err;
463
464 /* Just least significant octets from r1 and r2 are considered */
465 memcpy(_r, r2, 8);
466 memcpy(_r + 8, r1, 8);
467
468 err = smp_e(tfm_aes, k, _r);
469 if (err)
470 BT_ERR("Encrypt data error");
6a77083a
JH		 471
472 return err;
473}
474
cd082797
JH		 475static int smp_ah(struct crypto_blkcipher *tfm, const u8 irk[16],
476 const u8 r[3], u8 res[3])
60478054 477{
943a732a 478 u8 _res[16];
60478054
JH		 479 int err;
480
481 /* r' = padding || r */
943a732a
JH		 482 memcpy(_res, r, 3);
483 memset(_res + 3, 0, 13);
60478054 484
943a732a 485 err = smp_e(tfm, irk, _res);
60478054
JH		 486 if (err) {
487 BT_ERR("Encrypt error");
488 return err;
489 }
490
491 /* The output of the random address function ah is:
492 * ah(h, r) = e(k, r') mod 2^24
493 * The output of the security function e is then truncated to 24 bits
494 * by taking the least significant 24 bits of the output of e as the
495 * result of ah.
496 */
943a732a 497 memcpy(res, _res, 3);
60478054
JH		 498
499 return 0;
500}
501
cd082797
JH		 502bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16],
503 const bdaddr_t *bdaddr)
60478054 504{
defce9e8 505 struct l2cap_chan *chan = hdev->smp_data;
88a479d9 506 struct smp_dev *smp;
60478054
JH		 507 u8 hash[3];
508 int err;
509
defce9e8
JH		 510 if (!chan || !chan->data)
511 return false;
512
88a479d9 513 smp = chan->data;
defce9e8 514
60478054
JH		 515 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
516
88a479d9 517 err = smp_ah(smp->tfm_aes, irk, &bdaddr->b[3], hash);
60478054
JH		 518 if (err)
519 return false;
520
521 return !memcmp(bdaddr->b, hash, 3);
522}
523
cd082797 524int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 525{
defce9e8 526 struct l2cap_chan *chan = hdev->smp_data;
88a479d9 527 struct smp_dev *smp;
b1e2b3ae
JH		 528 int err;
529
defce9e8
JH		 530 if (!chan || !chan->data)
531 return -EOPNOTSUPP;
532
88a479d9 533 smp = chan->data;
defce9e8 534
b1e2b3ae
JH		 535 get_random_bytes(&rpa->b[3], 3);
536
537 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
538 rpa->b[5] |= 0x40; /* Set second most significant bit */
539
88a479d9 540 err = smp_ah(smp->tfm_aes, irk, &rpa->b[3], rpa->b);
b1e2b3ae
JH		 541 if (err < 0)
542 return err;
543
544 BT_DBG("RPA %pMR", rpa);
545
546 return 0;
547}
548
60a27d65
MH		 549int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
550{
551 struct l2cap_chan *chan = hdev->smp_data;
552 struct smp_dev *smp;
553 int err;
554
555 if (!chan || !chan->data)
556 return -EOPNOTSUPP;
557
558 smp = chan->data;
559
560 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
561 BT_DBG("Using debug keys");
562 memcpy(smp->local_pk, debug_pk, 64);
563 memcpy(smp->local_sk, debug_sk, 32);
564 smp->debug_key = true;
565 } else {
566 while (true) {
567 /* Generate local key pair for Secure Connections */
568 if (!ecc_make_key(smp->local_pk, smp->local_sk))
569 return -EIO;
570
571 /* This is unlikely, but we need to check that
572 * we didn't accidentially generate a debug key.
573 */
574 if (memcmp(smp->local_sk, debug_sk, 32))
575 break;
576 }
577 smp->debug_key = false;
578 }
579
580 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk);
581 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32);
582 SMP_DBG("OOB Private Key: %32phN", smp->local_sk);
583
fb334fee 584 get_random_bytes(smp->local_rand, 16);
60a27d65
MH		 585
586 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk,
fb334fee 587 smp->local_rand, 0, hash);
60a27d65
MH		 588 if (err < 0)
589 return err;
590
fb334fee 591 memcpy(rand, smp->local_rand, 16);
60a27d65
MH		 592
593 return 0;
594}
595
5d88cc73 596static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 597{
5d88cc73 598 struct l2cap_chan *chan = conn->smp;
b68fda68 599 struct smp_chan *smp;
5d88cc73
JH		 600 struct kvec iv[2];
601 struct msghdr msg;
eb492e01 602
5d88cc73
JH		 603 if (!chan)
604 return;
eb492e01 605
5d88cc73 606 BT_DBG("code 0x%2.2x", code);
eb492e01 607
5d88cc73
JH		 608 iv[0].iov_base = &code;
609 iv[0].iov_len = 1;
eb492e01 610
5d88cc73
JH		 611 iv[1].iov_base = data;
612 iv[1].iov_len = len;
eb492e01 613
5d88cc73 614 memset(&msg, 0, sizeof(msg));
eb492e01 615
17836394 616 iov_iter_kvec(&msg.msg_iter, WRITE | ITER_KVEC, iv, 2, 1 + len);
eb492e01 617
5d88cc73 618 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 619
b68fda68
JH		 620 if (!chan->data)
621 return;
622
623 smp = chan->data;
624
625 cancel_delayed_work_sync(&smp->security_timer);
1b0921d6 626 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 627}
628
d2eb9e10 629static u8 authreq_to_seclevel(u8 authreq)
2b64d153 630{
d2eb9e10
JH		 631 if (authreq & SMP_AUTH_MITM) {
632 if (authreq & SMP_AUTH_SC)
633 return BT_SECURITY_FIPS;
634 else
635 return BT_SECURITY_HIGH;
636 } else {
2b64d153 637 return BT_SECURITY_MEDIUM;
d2eb9e10 638 }
2b64d153
BG		 639}
640
641static __u8 seclevel_to_authreq(__u8 sec_level)
642{
643 switch (sec_level) {
d2eb9e10 644 case BT_SECURITY_FIPS:
2b64d153
BG		 645 case BT_SECURITY_HIGH:
646 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
647 case BT_SECURITY_MEDIUM:
648 return SMP_AUTH_BONDING;
649 default:
650 return SMP_AUTH_NONE;
651 }
652}
653
b8e66eac 654static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 655 struct smp_cmd_pairing *req,
656 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 657{
5d88cc73
JH		 658 struct l2cap_chan *chan = conn->smp;
659 struct smp_chan *smp = chan->data;
fd349c02
JH		 660 struct hci_conn *hcon = conn->hcon;
661 struct hci_dev *hdev = hcon->hdev;
02b05bd8 662 u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT;
54790f73 663
d7a5a11d 664 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
7ee4ea36
MH		 665 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
666 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 667 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 668 } else {
669 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 670 }
671
d7a5a11d 672 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
fd349c02
JH		 673 remote_dist |= SMP_DIST_ID_KEY;
674
d7a5a11d 675 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
863efaf2
JH		 676 local_dist |= SMP_DIST_ID_KEY;
677
d7a5a11d 678 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
02b05bd8
JH		 679 (authreq & SMP_AUTH_SC)) {
680 struct oob_data *oob_data;
681 u8 bdaddr_type;
682
d7a5a11d 683 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
df8e1a4c
JH		 684 local_dist |= SMP_DIST_LINK_KEY;
685 remote_dist |= SMP_DIST_LINK_KEY;
686 }
02b05bd8
JH		 687
688 if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
689 bdaddr_type = BDADDR_LE_PUBLIC;
690 else
691 bdaddr_type = BDADDR_LE_RANDOM;
692
693 oob_data = hci_find_remote_oob_data(hdev, &hcon->dst,
694 bdaddr_type);
4775a4ea 695 if (oob_data && oob_data->present) {
1a8bab4f 696 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags);
02b05bd8 697 oob_flag = SMP_OOB_PRESENT;
a29b0733 698 memcpy(smp->rr, oob_data->rand256, 16);
02b05bd8 699 memcpy(smp->pcnf, oob_data->hash256, 16);
bc07cd69
MH		 700 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf);
701 SMP_DBG("OOB Remote Random: %16phN", smp->rr);
02b05bd8
JH		 702 }
703
df8e1a4c
JH		 704 } else {
705 authreq &= ~SMP_AUTH_SC;
706 }
707
54790f73
VCG		 708 if (rsp == NULL) {
709 req->io_capability = conn->hcon->io_capability;
02b05bd8 710 req->oob_flag = oob_flag;
54790f73 711 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 712 req->init_key_dist = local_dist;
713 req->resp_key_dist = remote_dist;
0edb14de 714 req->auth_req = (authreq & AUTH_REQ_MASK(hdev));
fd349c02
JH		 715
716 smp->remote_key_dist = remote_dist;
54790f73
VCG		 717 return;
718 }
719
720 rsp->io_capability = conn->hcon->io_capability;
02b05bd8 721 rsp->oob_flag = oob_flag;
54790f73 722 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 723 rsp->init_key_dist = req->init_key_dist & remote_dist;
724 rsp->resp_key_dist = req->resp_key_dist & local_dist;
0edb14de 725 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev));
fd349c02
JH		 726
727 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 728}
729
3158c50c
VCG		 730static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
731{
5d88cc73
JH		 732 struct l2cap_chan *chan = conn->smp;
733 struct smp_chan *smp = chan->data;
1c1def09 734
3158c50c 735 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 736 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 737 return SMP_ENC_KEY_SIZE;
738
f7aa611a 739 smp->enc_key_size = max_key_size;
3158c50c
VCG		 740
741 return 0;
742}
743
6f48e260
JH		 744static void smp_chan_destroy(struct l2cap_conn *conn)
745{
746 struct l2cap_chan *chan = conn->smp;
747 struct smp_chan *smp = chan->data;
923e2414 748 struct hci_conn *hcon = conn->hcon;
6f48e260
JH		 749 bool complete;
750
751 BUG_ON(!smp);
752
753 cancel_delayed_work_sync(&smp->security_timer);
6f48e260 754
6f48e260 755 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
923e2414 756 mgmt_smp_complete(hcon, complete);
6f48e260 757
276812ec
MH		 758 kzfree(smp->csrk);
759 kzfree(smp->slave_csrk);
760 kzfree(smp->link_key);
6f48e260
JH		 761
762 crypto_free_blkcipher(smp->tfm_aes);
407cecf6 763 crypto_free_hash(smp->tfm_cmac);
6f48e260 764
923e2414
JH		 765 /* Ensure that we don't leave any debug key around if debug key
766 * support hasn't been explicitly enabled.
767 */
768 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG &&
d7a5a11d 769 !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) {
923e2414
JH		 770 list_del_rcu(&smp->ltk->list);
771 kfree_rcu(smp->ltk, rcu);
772 smp->ltk = NULL;
773 }
774
6f48e260
JH		 775 /* If pairing failed clean up any keys we might have */
776 if (!complete) {
777 if (smp->ltk) {
970d0f1b
JH		 778 list_del_rcu(&smp->ltk->list);
779 kfree_rcu(smp->ltk, rcu);
6f48e260
JH		 780 }
781
782 if (smp->slave_ltk) {
970d0f1b
JH		 783 list_del_rcu(&smp->slave_ltk->list);
784 kfree_rcu(smp->slave_ltk, rcu);
6f48e260
JH		 785 }
786
787 if (smp->remote_irk) {
adae20cb
JH		 788 list_del_rcu(&smp->remote_irk->list);
789 kfree_rcu(smp->remote_irk, rcu);
6f48e260
JH		 790 }
791 }
792
793 chan->data = NULL;
276812ec 794 kzfree(smp);
923e2414 795 hci_conn_drop(hcon);
6f48e260
JH		 796}
797
84794e11 798static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 799{
bab73cb6 800 struct hci_conn *hcon = conn->hcon;
b68fda68 801 struct l2cap_chan *chan = conn->smp;
bab73cb6 802
84794e11 803 if (reason)
4f957a76 804 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 805 &reason);
4f957a76 806
ce39fb4e 807 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
e1e930f5 808 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
f1c09c07 809
fc75cc86 810 if (chan->data)
f1c09c07 811 smp_chan_destroy(conn);
4f957a76
BG		 812}
813
2b64d153
BG		 814#define JUST_WORKS 0x00
815#define JUST_CFM 0x01
816#define REQ_PASSKEY 0x02
817#define CFM_PASSKEY 0x03
818#define REQ_OOB 0x04
5e3d3d9b 819#define DSP_PASSKEY 0x05
2b64d153
BG		 820#define OVERLAP 0xFF
821
822static const u8 gen_method[5][5] = {
823 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
824 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
825 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
826 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
827 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
828};
829
5e3d3d9b
JH		 830static const u8 sc_method[5][5] = {
831 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
832 { JUST_WORKS, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
833 { DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY },
834 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
835 { DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
836};
837
581370cc
JH		 838static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
839{
2bcd4003
JH		 840 /* If either side has unknown io_caps, use JUST_CFM (which gets
841 * converted later to JUST_WORKS if we're initiators.
842 */
581370cc
JH		 843 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
844 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 845 return JUST_CFM;
581370cc 846
5e3d3d9b
JH		 847 if (test_bit(SMP_FLAG_SC, &smp->flags))
848 return sc_method[remote_io][local_io];
849
581370cc
JH		 850 return gen_method[remote_io][local_io];
851}
852
2b64d153
BG		 853static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
854 u8 local_io, u8 remote_io)
855{
856 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 857 struct l2cap_chan *chan = conn->smp;
858 struct smp_chan *smp = chan->data;
2b64d153
BG		 859 u32 passkey = 0;
860 int ret = 0;
861
862 /* Initialize key for JUST WORKS */
863 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 864 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 865
866 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
867
2bcd4003
JH		 868 /* If neither side wants MITM, either "just" confirm an incoming
869 * request or use just-works for outgoing ones. The JUST_CFM
870 * will be converted to JUST_WORKS if necessary later in this
871 * function. If either side has MITM look up the method from the
872 * table.
873 */
581370cc 874 if (!(auth & SMP_AUTH_MITM))
783e0574 875 smp->method = JUST_CFM;
2b64d153 876 else
783e0574 877 smp->method = get_auth_method(smp, local_io, remote_io);
2b64d153 878
a82505c7 879 /* Don't confirm locally initiated pairing attempts */
783e0574
JH		 880 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
881 &smp->flags))
882 smp->method = JUST_WORKS;
a82505c7 883
02f3e254 884 /* Don't bother user space with no IO capabilities */
783e0574
JH		 885 if (smp->method == JUST_CFM &&
886 hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
887 smp->method = JUST_WORKS;
02f3e254 888
2b64d153 889 /* If Just Works, Continue with Zero TK */
783e0574 890 if (smp->method == JUST_WORKS) {
4a74d658 891 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 892 return 0;
893 }
894
19c5ce9c
JH		 895 /* If this function is used for SC -> legacy fallback we
896 * can only recover the just-works case.
897 */
898 if (test_bit(SMP_FLAG_SC, &smp->flags))
899 return -EINVAL;
900
2b64d153 901 /* Not Just Works/Confirm results in MITM Authentication */
783e0574 902 if (smp->method != JUST_CFM) {
4a74d658 903 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
5eb596f5
JH		 904 if (hcon->pending_sec_level < BT_SECURITY_HIGH)
905 hcon->pending_sec_level = BT_SECURITY_HIGH;
906 }
2b64d153
BG		 907
908 /* If both devices have Keyoard-Display I/O, the master
909 * Confirms and the slave Enters the passkey.
910 */
783e0574 911 if (smp->method == OVERLAP) {
40bef302 912 if (hcon->role == HCI_ROLE_MASTER)
783e0574 913 smp->method = CFM_PASSKEY;
2b64d153 914 else
783e0574 915 smp->method = REQ_PASSKEY;
2b64d153
BG		 916 }
917
01ad34d2 918 /* Generate random passkey. */
783e0574 919 if (smp->method == CFM_PASSKEY) {
943a732a 920 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 921 get_random_bytes(&passkey, sizeof(passkey));
922 passkey %= 1000000;
943a732a 923 put_unaligned_le32(passkey, smp->tk);
2b64d153 924 BT_DBG("PassKey: %d", passkey);
4a74d658 925 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 926 }
927
783e0574 928 if (smp->method == REQ_PASSKEY)
ce39fb4e 929 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 930 hcon->type, hcon->dst_type);
783e0574 931 else if (smp->method == JUST_CFM)
4eb65e66
JH		 932 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
933 hcon->type, hcon->dst_type,
934 passkey, 1);
2b64d153 935 else
01ad34d2 936 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 937 hcon->type, hcon->dst_type,
39adbffe 938 passkey, 0);
2b64d153 939
2b64d153
BG		 940 return ret;
941}
942
1cc61144 943static u8 smp_confirm(struct smp_chan *smp)
8aab4757 944{
8aab4757 945 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 946 struct smp_cmd_pairing_confirm cp;
947 int ret;
8aab4757
VCG		 948
949 BT_DBG("conn %p", conn);
950
e491eaf3 951 ret = smp_c1(smp->tfm_aes, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 952 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 953 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
954 cp.confirm_val);
1cc61144
JH		 955 if (ret)
956 return SMP_UNSPECIFIED;
8aab4757 957
4a74d658 958 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 959
8aab4757
VCG		 960 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
961
b28b4943
JH		 962 if (conn->hcon->out)
963 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
964 else
965 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
966
1cc61144 967 return 0;
8aab4757
VCG		 968}
969
861580a9 970static u8 smp_random(struct smp_chan *smp)
8aab4757 971{
8aab4757
VCG		 972 struct l2cap_conn *conn = smp->conn;
973 struct hci_conn *hcon = conn->hcon;
861580a9 974 u8 confirm[16];
8aab4757
VCG		 975 int ret;
976
ec70f36f 977 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 978 return SMP_UNSPECIFIED;
8aab4757
VCG		 979
980 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
981
e491eaf3 982 ret = smp_c1(smp->tfm_aes, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 983 hcon->init_addr_type, &hcon->init_addr,
943a732a 984 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 985 if (ret)
986 return SMP_UNSPECIFIED;
8aab4757 987
8aab4757
VCG		 988 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
989 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 990 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 991 }
992
993 if (hcon->out) {
fe39c7b2
MH		 994 u8 stk[16];
995 __le64 rand = 0;
996 __le16 ediv = 0;
8aab4757 997
e491eaf3 998 smp_s1(smp->tfm_aes, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 999
861580a9
JH		 1000 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
1001 return SMP_UNSPECIFIED;
8aab4757 1002
8b76ce34 1003 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size);
f7aa611a 1004 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 1005 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 1006 } else {
fff3490f 1007 u8 stk[16], auth;
fe39c7b2
MH		 1008 __le64 rand = 0;
1009 __le16 ediv = 0;
8aab4757 1010
943a732a
JH		 1011 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1012 smp->prnd);
8aab4757 1013
e491eaf3 1014 smp_s1(smp->tfm_aes, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 1015
fff3490f
JH		 1016 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
1017 auth = 1;
1018 else
1019 auth = 0;
1020
7d5843b7
JH		 1021 /* Even though there's no _SLAVE suffix this is the
1022 * slave STK we're adding for later lookup (the master
1023 * STK never needs to be stored).
1024 */
ce39fb4e 1025 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 1026 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 1027 }
1028
861580a9 1029 return 0;
8aab4757
VCG		 1030}
1031
44f1a7ab
JH		 1032static void smp_notify_keys(struct l2cap_conn *conn)
1033{
1034 struct l2cap_chan *chan = conn->smp;
1035 struct smp_chan *smp = chan->data;
1036 struct hci_conn *hcon = conn->hcon;
1037 struct hci_dev *hdev = hcon->hdev;
1038 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1039 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1040 bool persistent;
1041
1042 if (smp->remote_irk) {
1043 mgmt_new_irk(hdev, smp->remote_irk);
1044 /* Now that user space can be considered to know the
1045 * identity address track the connection based on it
b5ae344d 1046 * from now on (assuming this is an LE link).
44f1a7ab 1047 */
b5ae344d
JH		 1048 if (hcon->type == LE_LINK) {
1049 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1050 hcon->dst_type = smp->remote_irk->addr_type;
1051 queue_work(hdev->workqueue, &conn->id_addr_update_work);
1052 }
44f1a7ab
JH		 1053
1054 /* When receiving an indentity resolving key for
1055 * a remote device that does not use a resolvable
1056 * private address, just remove the key so that
1057 * it is possible to use the controller white
1058 * list for scanning.
1059 *
1060 * Userspace will have been told to not store
1061 * this key at this point. So it is safe to
1062 * just remove it.
1063 */
1064 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
adae20cb
JH		 1065 list_del_rcu(&smp->remote_irk->list);
1066 kfree_rcu(smp->remote_irk, rcu);
44f1a7ab
JH		 1067 smp->remote_irk = NULL;
1068 }
1069 }
1070
b5ae344d
JH		 1071 if (hcon->type == ACL_LINK) {
1072 if (hcon->key_type == HCI_LK_DEBUG_COMBINATION)
1073 persistent = false;
1074 else
1075 persistent = !test_bit(HCI_CONN_FLUSH_KEY,
1076 &hcon->flags);
1077 } else {
1078 /* The LTKs and CSRKs should be persistent only if both sides
1079 * had the bonding bit set in their authentication requests.
1080 */
1081 persistent = !!((req->auth_req & rsp->auth_req) &
1082 SMP_AUTH_BONDING);
1083 }
1084
44f1a7ab
JH		 1085
1086 if (smp->csrk) {
1087 smp->csrk->bdaddr_type = hcon->dst_type;
1088 bacpy(&smp->csrk->bdaddr, &hcon->dst);
1089 mgmt_new_csrk(hdev, smp->csrk, persistent);
1090 }
1091
1092 if (smp->slave_csrk) {
1093 smp->slave_csrk->bdaddr_type = hcon->dst_type;
1094 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
1095 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
1096 }
1097
1098 if (smp->ltk) {
1099 smp->ltk->bdaddr_type = hcon->dst_type;
1100 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1101 mgmt_new_ltk(hdev, smp->ltk, persistent);
1102 }
1103
1104 if (smp->slave_ltk) {
1105 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1106 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1107 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
1108 }
6a77083a
JH		 1109
1110 if (smp->link_key) {
e3befab9
JH		 1111 struct link_key *key;
1112 u8 type;
1113
1114 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1115 type = HCI_LK_DEBUG_COMBINATION;
1116 else if (hcon->sec_level == BT_SECURITY_FIPS)
1117 type = HCI_LK_AUTH_COMBINATION_P256;
1118 else
1119 type = HCI_LK_UNAUTH_COMBINATION_P256;
1120
1121 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst,
1122 smp->link_key, type, 0, &persistent);
1123 if (key) {
1124 mgmt_new_link_key(hdev, key, persistent);
1125
1126 /* Don't keep debug keys around if the relevant
1127 * flag is not set.
1128 */
d7a5a11d 1129 if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) &&
e3befab9
JH		 1130 key->type == HCI_LK_DEBUG_COMBINATION) {
1131 list_del_rcu(&key->list);
1132 kfree_rcu(key, rcu);
1133 }
1134 }
6a77083a
JH		 1135 }
1136}
1137
d3e54a87
JH		 1138static void sc_add_ltk(struct smp_chan *smp)
1139{
1140 struct hci_conn *hcon = smp->conn->hcon;
1141 u8 key_type, auth;
1142
1143 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1144 key_type = SMP_LTK_P256_DEBUG;
1145 else
1146 key_type = SMP_LTK_P256;
1147
1148 if (hcon->pending_sec_level == BT_SECURITY_FIPS)
1149 auth = 1;
1150 else
1151 auth = 0;
1152
d3e54a87
JH		 1153 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1154 key_type, auth, smp->tk, smp->enc_key_size,
1155 0, 0);
1156}
1157
6a77083a
JH		 1158static void sc_generate_link_key(struct smp_chan *smp)
1159{
1160 /* These constants are as specified in the core specification.
1161 * In ASCII they spell out to 'tmp1' and 'lebr'.
1162 */
1163 const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 };
1164 const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c };
1165
1166 smp->link_key = kzalloc(16, GFP_KERNEL);
1167 if (!smp->link_key)
1168 return;
1169
1170 if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) {
276812ec 1171 kzfree(smp->link_key);
6a77083a
JH		 1172 smp->link_key = NULL;
1173 return;
1174 }
1175
1176 if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) {
276812ec 1177 kzfree(smp->link_key);
6a77083a
JH		 1178 smp->link_key = NULL;
1179 return;
1180 }
44f1a7ab
JH		 1181}
1182
b28b4943
JH		 1183static void smp_allow_key_dist(struct smp_chan *smp)
1184{
1185 /* Allow the first expected phase 3 PDU. The rest of the PDUs
1186 * will be allowed in each PDU handler to ensure we receive
1187 * them in the correct order.
1188 */
1189 if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
1190 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
1191 else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1192 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
1193 else if (smp->remote_key_dist & SMP_DIST_SIGN)
1194 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1195}
1196
b5ae344d
JH		 1197static void sc_generate_ltk(struct smp_chan *smp)
1198{
1199 /* These constants are as specified in the core specification.
1200 * In ASCII they spell out to 'tmp2' and 'brle'.
1201 */
1202 const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 };
1203 const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 };
1204 struct hci_conn *hcon = smp->conn->hcon;
1205 struct hci_dev *hdev = hcon->hdev;
1206 struct link_key *key;
1207
1208 key = hci_find_link_key(hdev, &hcon->dst);
1209 if (!key) {
1210 BT_ERR("%s No Link Key found to generate LTK", hdev->name);
1211 return;
1212 }
1213
1214 if (key->type == HCI_LK_DEBUG_COMBINATION)
1215 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1216
1217 if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk))
1218 return;
1219
1220 if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk))
1221 return;
1222
1223 sc_add_ltk(smp);
1224}
1225
d6268e86 1226static void smp_distribute_keys(struct smp_chan *smp)
44f1a7ab
JH		 1227{
1228 struct smp_cmd_pairing *req, *rsp;
86d1407c 1229 struct l2cap_conn *conn = smp->conn;
44f1a7ab
JH		 1230 struct hci_conn *hcon = conn->hcon;
1231 struct hci_dev *hdev = hcon->hdev;
1232 __u8 *keydist;
1233
1234 BT_DBG("conn %p", conn);
1235
44f1a7ab
JH		 1236 rsp = (void *) &smp->prsp[1];
1237
1238 /* The responder sends its keys first */
b28b4943
JH		 1239 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
1240 smp_allow_key_dist(smp);
86d1407c 1241 return;
b28b4943 1242 }
44f1a7ab
JH		 1243
1244 req = (void *) &smp->preq[1];
1245
1246 if (hcon->out) {
1247 keydist = &rsp->init_key_dist;
1248 *keydist &= req->init_key_dist;
1249 } else {
1250 keydist = &rsp->resp_key_dist;
1251 *keydist &= req->resp_key_dist;
1252 }
1253
6a77083a 1254 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
b5ae344d 1255 if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY))
6a77083a 1256 sc_generate_link_key(smp);
b5ae344d
JH		 1257 if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY))
1258 sc_generate_ltk(smp);
6a77083a
JH		 1259
1260 /* Clear the keys which are generated but not distributed */
1261 *keydist &= ~SMP_SC_NO_DIST;
1262 }
1263
44f1a7ab
JH		 1264 BT_DBG("keydist 0x%x", *keydist);
1265
1266 if (*keydist & SMP_DIST_ENC_KEY) {
1267 struct smp_cmd_encrypt_info enc;
1268 struct smp_cmd_master_ident ident;
1269 struct smp_ltk *ltk;
1270 u8 authenticated;
1271 __le16 ediv;
1272 __le64 rand;
1273
1274 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1275 get_random_bytes(&ediv, sizeof(ediv));
1276 get_random_bytes(&rand, sizeof(rand));
1277
1278 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1279
1280 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
1281 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
1282 SMP_LTK_SLAVE, authenticated, enc.ltk,
1283 smp->enc_key_size, ediv, rand);
1284 smp->slave_ltk = ltk;
1285
1286 ident.ediv = ediv;
1287 ident.rand = rand;
1288
1289 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1290
1291 *keydist &= ~SMP_DIST_ENC_KEY;
1292 }
1293
1294 if (*keydist & SMP_DIST_ID_KEY) {
1295 struct smp_cmd_ident_addr_info addrinfo;
1296 struct smp_cmd_ident_info idinfo;
1297
1298 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
1299
1300 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1301
1302 /* The hci_conn contains the local identity address
1303 * after the connection has been established.
1304 *
1305 * This is true even when the connection has been
1306 * established using a resolvable random address.
1307 */
1308 bacpy(&addrinfo.bdaddr, &hcon->src);
1309 addrinfo.addr_type = hcon->src_type;
1310
1311 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
1312 &addrinfo);
1313
1314 *keydist &= ~SMP_DIST_ID_KEY;
1315 }
1316
1317 if (*keydist & SMP_DIST_SIGN) {
1318 struct smp_cmd_sign_info sign;
1319 struct smp_csrk *csrk;
1320
1321 /* Generate a new random key */
1322 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1323
1324 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1325 if (csrk) {
4cd3928a
JH		 1326 if (hcon->sec_level > BT_SECURITY_MEDIUM)
1327 csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED;
1328 else
1329 csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED;
44f1a7ab
JH		 1330 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1331 }
1332 smp->slave_csrk = csrk;
1333
1334 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1335
1336 *keydist &= ~SMP_DIST_SIGN;
1337 }
1338
1339 /* If there are still keys to be received wait for them */
b28b4943
JH		 1340 if (smp->remote_key_dist & KEY_DIST_MASK) {
1341 smp_allow_key_dist(smp);
86d1407c 1342 return;
b28b4943 1343 }
44f1a7ab 1344
44f1a7ab
JH		 1345 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1346 smp_notify_keys(conn);
1347
1348 smp_chan_destroy(conn);
44f1a7ab
JH		 1349}
1350
b68fda68
JH		 1351static void smp_timeout(struct work_struct *work)
1352{
1353 struct smp_chan *smp = container_of(work, struct smp_chan,
1354 security_timer.work);
1355 struct l2cap_conn *conn = smp->conn;
1356
1357 BT_DBG("conn %p", conn);
1358
1e91c29e 1359 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
b68fda68
JH		 1360}
1361
8aab4757
VCG		 1362static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
1363{
5d88cc73 1364 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 1365 struct smp_chan *smp;
1366
f1560463 1367 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
fc75cc86 1368 if (!smp)
8aab4757
VCG		 1369 return NULL;
1370
6a7bd103
JH		 1371 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1372 if (IS_ERR(smp->tfm_aes)) {
1373 BT_ERR("Unable to create ECB crypto context");
276812ec 1374 kzfree(smp);
6a7bd103
JH		 1375 return NULL;
1376 }
1377
407cecf6
JH		 1378 smp->tfm_cmac = crypto_alloc_hash("cmac(aes)", 0, CRYPTO_ALG_ASYNC);
1379 if (IS_ERR(smp->tfm_cmac)) {
1380 BT_ERR("Unable to create CMAC crypto context");
1381 crypto_free_blkcipher(smp->tfm_aes);
276812ec 1382 kzfree(smp);
407cecf6
JH		 1383 return NULL;
1384 }
1385
8aab4757 1386 smp->conn = conn;
5d88cc73 1387 chan->data = smp;
8aab4757 1388
b28b4943
JH		 1389 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
1390
b68fda68
JH		 1391 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
1392
8aab4757
VCG		 1393 hci_conn_hold(conn->hcon);
1394
1395 return smp;
1396}
1397
760b018b
JH		 1398static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16])
1399{
1400 struct hci_conn *hcon = smp->conn->hcon;
1401 u8 *na, *nb, a[7], b[7];
1402
1403 if (hcon->out) {
1404 na = smp->prnd;
1405 nb = smp->rrnd;
1406 } else {
1407 na = smp->rrnd;
1408 nb = smp->prnd;
1409 }
1410
1411 memcpy(a, &hcon->init_addr, 6);
1412 memcpy(b, &hcon->resp_addr, 6);
1413 a[6] = hcon->init_addr_type;
1414 b[6] = hcon->resp_addr_type;
1415
1416 return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk);
1417}
1418
38606f14 1419static void sc_dhkey_check(struct smp_chan *smp)
760b018b
JH		 1420{
1421 struct hci_conn *hcon = smp->conn->hcon;
1422 struct smp_cmd_dhkey_check check;
1423 u8 a[7], b[7], *local_addr, *remote_addr;
1424 u8 io_cap[3], r[16];
1425
760b018b
JH		 1426 memcpy(a, &hcon->init_addr, 6);
1427 memcpy(b, &hcon->resp_addr, 6);
1428 a[6] = hcon->init_addr_type;
1429 b[6] = hcon->resp_addr_type;
1430
1431 if (hcon->out) {
1432 local_addr = a;
1433 remote_addr = b;
1434 memcpy(io_cap, &smp->preq[1], 3);
1435 } else {
1436 local_addr = b;
1437 remote_addr = a;
1438 memcpy(io_cap, &smp->prsp[1], 3);
1439 }
1440
dddd3059
JH		 1441 memset(r, 0, sizeof(r));
1442
1443 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
38606f14 1444 put_unaligned_le32(hcon->passkey_notify, r);
760b018b 1445
a29b0733
JH		 1446 if (smp->method == REQ_OOB)
1447 memcpy(r, smp->rr, 16);
1448
760b018b
JH		 1449 smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
1450 local_addr, remote_addr, check.e);
1451
1452 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check);
dddd3059
JH		 1453}
1454
38606f14
JH		 1455static u8 sc_passkey_send_confirm(struct smp_chan *smp)
1456{
1457 struct l2cap_conn *conn = smp->conn;
1458 struct hci_conn *hcon = conn->hcon;
1459 struct smp_cmd_pairing_confirm cfm;
1460 u8 r;
1461
1462 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1463 r |= 0x80;
1464
1465 get_random_bytes(smp->prnd, sizeof(smp->prnd));
1466
1467 if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r,
1468 cfm.confirm_val))
1469 return SMP_UNSPECIFIED;
1470
1471 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
1472
1473 return 0;
1474}
1475
1476static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op)
1477{
1478 struct l2cap_conn *conn = smp->conn;
1479 struct hci_conn *hcon = conn->hcon;
1480 struct hci_dev *hdev = hcon->hdev;
1481 u8 cfm[16], r;
1482
1483 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */
1484 if (smp->passkey_round >= 20)
1485 return 0;
1486
1487 switch (smp_op) {
1488 case SMP_CMD_PAIRING_RANDOM:
1489 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1490 r |= 0x80;
1491
1492 if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
1493 smp->rrnd, r, cfm))
1494 return SMP_UNSPECIFIED;
1495
1496 if (memcmp(smp->pcnf, cfm, 16))
1497 return SMP_CONFIRM_FAILED;
1498
1499 smp->passkey_round++;
1500
1501 if (smp->passkey_round == 20) {
1502 /* Generate MacKey and LTK */
1503 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk))
1504 return SMP_UNSPECIFIED;
1505 }
1506
1507 /* The round is only complete when the initiator
1508 * receives pairing random.
1509 */
1510 if (!hcon->out) {
1511 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1512 sizeof(smp->prnd), smp->prnd);
d3e54a87 1513 if (smp->passkey_round == 20)
38606f14 1514 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
d3e54a87 1515 else
38606f14 1516 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
38606f14
JH		 1517 return 0;
1518 }
1519
1520 /* Start the next round */
1521 if (smp->passkey_round != 20)
1522 return sc_passkey_round(smp, 0);
1523
1524 /* Passkey rounds are complete - start DHKey Check */
1525 sc_dhkey_check(smp);
1526 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1527
1528 break;
1529
1530 case SMP_CMD_PAIRING_CONFIRM:
1531 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
1532 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
1533 return 0;
1534 }
1535
1536 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1537
1538 if (hcon->out) {
1539 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1540 sizeof(smp->prnd), smp->prnd);
1541 return 0;
1542 }
1543
1544 return sc_passkey_send_confirm(smp);
1545
1546 case SMP_CMD_PUBLIC_KEY:
1547 default:
1548 /* Initiating device starts the round */
1549 if (!hcon->out)
1550 return 0;
1551
1552 BT_DBG("%s Starting passkey round %u", hdev->name,
1553 smp->passkey_round + 1);
1554
1555 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1556
1557 return sc_passkey_send_confirm(smp);
1558 }
1559
1560 return 0;
1561}
1562
dddd3059
JH		 1563static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey)
1564{
38606f14
JH		 1565 struct l2cap_conn *conn = smp->conn;
1566 struct hci_conn *hcon = conn->hcon;
1567 u8 smp_op;
1568
1569 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags);
1570
dddd3059
JH		 1571 switch (mgmt_op) {
1572 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1573 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED);
1574 return 0;
1575 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1576 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED);
1577 return 0;
38606f14
JH		 1578 case MGMT_OP_USER_PASSKEY_REPLY:
1579 hcon->passkey_notify = le32_to_cpu(passkey);
1580 smp->passkey_round = 0;
1581
1582 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags))
1583 smp_op = SMP_CMD_PAIRING_CONFIRM;
1584 else
1585 smp_op = 0;
1586
1587 if (sc_passkey_round(smp, smp_op))
1588 return -EIO;
1589
1590 return 0;
dddd3059
JH		 1591 }
1592
d3e54a87
JH		 1593 /* Initiator sends DHKey check first */
1594 if (hcon->out) {
1595 sc_dhkey_check(smp);
1596 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1597 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) {
1598 sc_dhkey_check(smp);
1599 sc_add_ltk(smp);
1600 }
760b018b
JH		 1601
1602 return 0;
1603}
1604
2b64d153
BG		 1605int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
1606{
b10e8017 1607 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 1608 struct l2cap_chan *chan;
2b64d153
BG		 1609 struct smp_chan *smp;
1610 u32 value;
fc75cc86 1611 int err;
2b64d153
BG		 1612
1613 BT_DBG("");
1614
fc75cc86 1615 if (!conn)
2b64d153
BG		 1616 return -ENOTCONN;
1617
5d88cc73
JH		 1618 chan = conn->smp;
1619 if (!chan)
1620 return -ENOTCONN;
1621
fc75cc86
JH		 1622 l2cap_chan_lock(chan);
1623 if (!chan->data) {
1624 err = -ENOTCONN;
1625 goto unlock;
1626 }
1627
5d88cc73 1628 smp = chan->data;
2b64d153 1629
760b018b
JH		 1630 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1631 err = sc_user_reply(smp, mgmt_op, passkey);
1632 goto unlock;
1633 }
1634
2b64d153
BG		 1635 switch (mgmt_op) {
1636 case MGMT_OP_USER_PASSKEY_REPLY:
1637 value = le32_to_cpu(passkey);
943a732a 1638 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 1639 BT_DBG("PassKey: %d", value);
943a732a 1640 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 1641 /* Fall Through */
1642 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 1643 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 1644 break;
1645 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1646 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 1647 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 1648 err = 0;
1649 goto unlock;
2b64d153 1650 default:
84794e11 1651 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 1652 err = -EOPNOTSUPP;
1653 goto unlock;
2b64d153
BG		 1654 }
1655
fc75cc86
JH		 1656 err = 0;
1657
2b64d153 1658 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 1659 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
1660 u8 rsp = smp_confirm(smp);
1661 if (rsp)
1662 smp_failure(conn, rsp);
1663 }
2b64d153 1664
fc75cc86
JH		 1665unlock:
1666 l2cap_chan_unlock(chan);
1667 return err;
2b64d153
BG		 1668}
1669
b5ae344d
JH		 1670static void build_bredr_pairing_cmd(struct smp_chan *smp,
1671 struct smp_cmd_pairing *req,
1672 struct smp_cmd_pairing *rsp)
1673{
1674 struct l2cap_conn *conn = smp->conn;
1675 struct hci_dev *hdev = conn->hcon->hdev;
1676 u8 local_dist = 0, remote_dist = 0;
1677
d7a5a11d 1678 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
b5ae344d
JH		 1679 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1680 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1681 }
1682
d7a5a11d 1683 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
b5ae344d
JH		 1684 remote_dist |= SMP_DIST_ID_KEY;
1685
d7a5a11d 1686 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
b5ae344d
JH		 1687 local_dist |= SMP_DIST_ID_KEY;
1688
1689 if (!rsp) {
1690 memset(req, 0, sizeof(*req));
1691
1692 req->init_key_dist = local_dist;
1693 req->resp_key_dist = remote_dist;
1694 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
1695
1696 smp->remote_key_dist = remote_dist;
1697
1698 return;
1699 }
1700
1701 memset(rsp, 0, sizeof(*rsp));
1702
1703 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
1704 rsp->init_key_dist = req->init_key_dist & remote_dist;
1705 rsp->resp_key_dist = req->resp_key_dist & local_dist;
1706
1707 smp->remote_key_dist = rsp->init_key_dist;
1708}
1709
da85e5e5 1710static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1711{
3158c50c 1712 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
fc75cc86 1713 struct l2cap_chan *chan = conn->smp;
b3c6410b 1714 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 1715 struct smp_chan *smp;
c7262e71 1716 u8 key_size, auth, sec_level;
8aab4757 1717 int ret;
88ba43b6
AB		 1718
1719 BT_DBG("conn %p", conn);
1720
c46b98be 1721 if (skb->len < sizeof(*req))
38e4a915 1722 return SMP_INVALID_PARAMS;
c46b98be 1723
40bef302 1724 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 1725 return SMP_CMD_NOTSUPP;
1726
fc75cc86 1727 if (!chan->data)
8aab4757 1728 smp = smp_chan_create(conn);
fc75cc86 1729 else
5d88cc73 1730 smp = chan->data;
8aab4757 1731
d08fd0e7
AE		 1732 if (!smp)
1733 return SMP_UNSPECIFIED;
d26a2345 1734
c05b9339 1735 /* We didn't start the pairing, so match remote */
0edb14de 1736 auth = req->auth_req & AUTH_REQ_MASK(hdev);
c05b9339 1737
d7a5a11d 1738 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
c05b9339 1739 (auth & SMP_AUTH_BONDING))
b3c6410b
JH		 1740 return SMP_PAIRING_NOTSUPP;
1741
d7a5a11d 1742 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
903b71c7
JH		 1743 return SMP_AUTH_REQUIREMENTS;
1744
1c1def09
VCG		 1745 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1746 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 1747 skb_pull(skb, sizeof(*req));
88ba43b6 1748
cb06d366
JH		 1749 /* If the remote side's OOB flag is set it means it has
1750 * successfully received our local OOB data - therefore set the
1751 * flag to indicate that local OOB is in use.
1752 */
58428563
JH		 1753 if (req->oob_flag == SMP_OOB_PRESENT)
1754 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1755
b5ae344d
JH		 1756 /* SMP over BR/EDR requires special treatment */
1757 if (conn->hcon->type == ACL_LINK) {
1758 /* We must have a BR/EDR SC link */
08f63cc5 1759 if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) &&
b7cb93e5 1760 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
b5ae344d
JH		 1761 return SMP_CROSS_TRANSP_NOT_ALLOWED;
1762
1763 set_bit(SMP_FLAG_SC, &smp->flags);
1764
1765 build_bredr_pairing_cmd(smp, req, &rsp);
1766
1767 key_size = min(req->max_key_size, rsp.max_key_size);
1768 if (check_enc_key_size(conn, key_size))
1769 return SMP_ENC_KEY_SIZE;
1770
1771 /* Clear bits which are generated but not distributed */
1772 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1773
1774 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1775 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1776 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1777
1778 smp_distribute_keys(smp);
1779 return 0;
1780 }
1781
5e3d3d9b
JH		 1782 build_pairing_cmd(conn, req, &rsp, auth);
1783
1784 if (rsp.auth_req & SMP_AUTH_SC)
1785 set_bit(SMP_FLAG_SC, &smp->flags);
1786
5be5e275 1787 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1afc2a1a
JH		 1788 sec_level = BT_SECURITY_MEDIUM;
1789 else
1790 sec_level = authreq_to_seclevel(auth);
1791
c7262e71
JH		 1792 if (sec_level > conn->hcon->pending_sec_level)
1793 conn->hcon->pending_sec_level = sec_level;
fdde0a26 1794
49c922bb 1795 /* If we need MITM check that it can be achieved */
2ed8f65c
JH		 1796 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1797 u8 method;
1798
1799 method = get_auth_method(smp, conn->hcon->io_capability,
1800 req->io_capability);
1801 if (method == JUST_WORKS || method == JUST_CFM)
1802 return SMP_AUTH_REQUIREMENTS;
1803 }
1804
3158c50c
VCG		 1805 key_size = min(req->max_key_size, rsp.max_key_size);
1806 if (check_enc_key_size(conn, key_size))
1807 return SMP_ENC_KEY_SIZE;
88ba43b6 1808
e84a6b13 1809 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 1810
1c1def09
VCG		 1811 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1812 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 1813
3158c50c 1814 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
3b19146d
JH		 1815
1816 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
1817
19c5ce9c
JH		 1818 /* Strictly speaking we shouldn't allow Pairing Confirm for the
1819 * SC case, however some implementations incorrectly copy RFU auth
1820 * req bits from our security request, which may create a false
1821 * positive SC enablement.
1822 */
1823 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1824
3b19146d
JH		 1825 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1826 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
1827 /* Clear bits which are generated but not distributed */
1828 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1829 /* Wait for Public Key from Initiating Device */
1830 return 0;
3b19146d 1831 }
da85e5e5 1832
2b64d153
BG		 1833 /* Request setup of TK */
1834 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
1835 if (ret)
1836 return SMP_UNSPECIFIED;
1837
da85e5e5 1838 return 0;
88ba43b6
AB		 1839}
1840
3b19146d
JH		 1841static u8 sc_send_public_key(struct smp_chan *smp)
1842{
70157ef5
JH		 1843 struct hci_dev *hdev = smp->conn->hcon->hdev;
1844
3b19146d
JH		 1845 BT_DBG("");
1846
1a8bab4f 1847 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
33d0c030
MH		 1848 struct l2cap_chan *chan = hdev->smp_data;
1849 struct smp_dev *smp_dev;
1850
1851 if (!chan || !chan->data)
1852 return SMP_UNSPECIFIED;
1853
1854 smp_dev = chan->data;
1855
1856 memcpy(smp->local_pk, smp_dev->local_pk, 64);
1857 memcpy(smp->local_sk, smp_dev->local_sk, 32);
fb334fee 1858 memcpy(smp->lr, smp_dev->local_rand, 16);
33d0c030
MH		 1859
1860 if (smp_dev->debug_key)
1861 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1862
1863 goto done;
1864 }
1865
d7a5a11d 1866 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
70157ef5
JH		 1867 BT_DBG("Using debug keys");
1868 memcpy(smp->local_pk, debug_pk, 64);
1869 memcpy(smp->local_sk, debug_sk, 32);
1870 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1871 } else {
1872 while (true) {
1873 /* Generate local key pair for Secure Connections */
1874 if (!ecc_make_key(smp->local_pk, smp->local_sk))
1875 return SMP_UNSPECIFIED;
6c0dcc50 1876
70157ef5
JH		 1877 /* This is unlikely, but we need to check that
1878 * we didn't accidentially generate a debug key.
1879 */
1880 if (memcmp(smp->local_sk, debug_sk, 32))
1881 break;
1882 }
6c0dcc50 1883 }
3b19146d 1884
33d0c030 1885done:
c7a3d57d 1886 SMP_DBG("Local Public Key X: %32phN", smp->local_pk);
8e4e2ee5 1887 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32);
c7a3d57d 1888 SMP_DBG("Local Private Key: %32phN", smp->local_sk);
3b19146d
JH		 1889
1890 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk);
1891
1892 return 0;
1893}
1894
da85e5e5 1895static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1896{
3158c50c 1897 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 1898 struct l2cap_chan *chan = conn->smp;
1899 struct smp_chan *smp = chan->data;
0edb14de 1900 struct hci_dev *hdev = conn->hcon->hdev;
3a7dbfb8 1901 u8 key_size, auth;
7d24ddcc 1902 int ret;
88ba43b6
AB		 1903
1904 BT_DBG("conn %p", conn);
1905
c46b98be 1906 if (skb->len < sizeof(*rsp))
38e4a915 1907 return SMP_INVALID_PARAMS;
c46b98be 1908
40bef302 1909 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 1910 return SMP_CMD_NOTSUPP;
1911
3158c50c
VCG		 1912 skb_pull(skb, sizeof(*rsp));
1913
1c1def09 1914 req = (void *) &smp->preq[1];
da85e5e5 1915
3158c50c
VCG		 1916 key_size = min(req->max_key_size, rsp->max_key_size);
1917 if (check_enc_key_size(conn, key_size))
1918 return SMP_ENC_KEY_SIZE;
1919
0edb14de 1920 auth = rsp->auth_req & AUTH_REQ_MASK(hdev);
c05b9339 1921
d7a5a11d 1922 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
903b71c7
JH		 1923 return SMP_AUTH_REQUIREMENTS;
1924
cb06d366
JH		 1925 /* If the remote side's OOB flag is set it means it has
1926 * successfully received our local OOB data - therefore set the
1927 * flag to indicate that local OOB is in use.
1928 */
58428563
JH		 1929 if (rsp->oob_flag == SMP_OOB_PRESENT)
1930 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1931
b5ae344d
JH		 1932 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1933 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
1934
1935 /* Update remote key distribution in case the remote cleared
1936 * some bits that we had enabled in our request.
1937 */
1938 smp->remote_key_dist &= rsp->resp_key_dist;
1939
1940 /* For BR/EDR this means we're done and can start phase 3 */
1941 if (conn->hcon->type == ACL_LINK) {
1942 /* Clear bits which are generated but not distributed */
1943 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1944 smp_distribute_keys(smp);
1945 return 0;
1946 }
1947
65668776
JH		 1948 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC))
1949 set_bit(SMP_FLAG_SC, &smp->flags);
d2eb9e10
JH		 1950 else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH)
1951 conn->hcon->pending_sec_level = BT_SECURITY_HIGH;
65668776 1952
49c922bb 1953 /* If we need MITM check that it can be achieved */
2ed8f65c
JH		 1954 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1955 u8 method;
1956
1957 method = get_auth_method(smp, req->io_capability,
1958 rsp->io_capability);
1959 if (method == JUST_WORKS || method == JUST_CFM)
1960 return SMP_AUTH_REQUIREMENTS;
1961 }
1962
e84a6b13 1963 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1964
fdcc4bec
JH		 1965 /* Update remote key distribution in case the remote cleared
1966 * some bits that we had enabled in our request.
1967 */
1968 smp->remote_key_dist &= rsp->resp_key_dist;
1969
3b19146d
JH		 1970 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1971 /* Clear bits which are generated but not distributed */
1972 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1973 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
1974 return sc_send_public_key(smp);
1975 }
1976
c05b9339 1977 auth |= req->auth_req;
2b64d153 1978
476585ec 1979 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1980 if (ret)
1981 return SMP_UNSPECIFIED;
1982
4a74d658 1983 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1984
1985 /* Can't compose response until we have been confirmed */
4a74d658 1986 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1987 return smp_confirm(smp);
da85e5e5
VCG		 1988
1989 return 0;
88ba43b6
AB		 1990}
1991
dcee2b32
JH		 1992static u8 sc_check_confirm(struct smp_chan *smp)
1993{
1994 struct l2cap_conn *conn = smp->conn;
1995
1996 BT_DBG("");
1997
38606f14
JH		 1998 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
1999 return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM);
2000
dcee2b32
JH		 2001 if (conn->hcon->out) {
2002 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2003 smp->prnd);
2004 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2005 }
2006
2007 return 0;
2008}
2009
19c5ce9c
JH		 2010/* Work-around for some implementations that incorrectly copy RFU bits
2011 * from our security request and thereby create the impression that
2012 * we're doing SC when in fact the remote doesn't support it.
2013 */
2014static int fixup_sc_false_positive(struct smp_chan *smp)
2015{
2016 struct l2cap_conn *conn = smp->conn;
2017 struct hci_conn *hcon = conn->hcon;
2018 struct hci_dev *hdev = hcon->hdev;
2019 struct smp_cmd_pairing *req, *rsp;
2020 u8 auth;
2021
2022 /* The issue is only observed when we're in slave role */
2023 if (hcon->out)
2024 return SMP_UNSPECIFIED;
2025
2026 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
2027 BT_ERR("Refusing SMP SC -> legacy fallback in SC-only mode");
2028 return SMP_UNSPECIFIED;
2029 }
2030
2031 BT_ERR("Trying to fall back to legacy SMP");
2032
2033 req = (void *) &smp->preq[1];
2034 rsp = (void *) &smp->prsp[1];
2035
2036 /* Rebuild key dist flags which may have been cleared for SC */
2037 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist);
2038
2039 auth = req->auth_req & AUTH_REQ_MASK(hdev);
2040
2041 if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) {
2042 BT_ERR("Failed to fall back to legacy SMP");
2043 return SMP_UNSPECIFIED;
2044 }
2045
2046 clear_bit(SMP_FLAG_SC, &smp->flags);
2047
2048 return 0;
2049}
2050
da85e5e5 2051static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 2052{
5d88cc73
JH		 2053 struct l2cap_chan *chan = conn->smp;
2054 struct smp_chan *smp = chan->data;
7d24ddcc 2055
88ba43b6
AB		 2056 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
2057
c46b98be 2058 if (skb->len < sizeof(smp->pcnf))
38e4a915 2059 return SMP_INVALID_PARAMS;
c46b98be 2060
1c1def09
VCG		 2061 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
2062 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 2063
19c5ce9c
JH		 2064 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2065 int ret;
2066
2067 /* Public Key exchange must happen before any other steps */
2068 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags))
2069 return sc_check_confirm(smp);
2070
2071 BT_ERR("Unexpected SMP Pairing Confirm");
2072
2073 ret = fixup_sc_false_positive(smp);
2074 if (ret)
2075 return ret;
2076 }
dcee2b32 2077
b28b4943 2078 if (conn->hcon->out) {
943a732a
JH		 2079 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2080 smp->prnd);
b28b4943
JH		 2081 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2082 return 0;
2083 }
2084
2085 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 2086 return smp_confirm(smp);
983f9814
MH		 2087
2088 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 2089
2090 return 0;
88ba43b6
AB		 2091}
2092
da85e5e5 2093static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 2094{
5d88cc73
JH		 2095 struct l2cap_chan *chan = conn->smp;
2096 struct smp_chan *smp = chan->data;
191dc7fe
JH		 2097 struct hci_conn *hcon = conn->hcon;
2098 u8 *pkax, *pkbx, *na, *nb;
2099 u32 passkey;
2100 int err;
7d24ddcc 2101
8aab4757 2102 BT_DBG("conn %p", conn);
3158c50c 2103
c46b98be 2104 if (skb->len < sizeof(smp->rrnd))
38e4a915 2105 return SMP_INVALID_PARAMS;
c46b98be 2106
943a732a 2107 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 2108 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 2109
191dc7fe
JH		 2110 if (!test_bit(SMP_FLAG_SC, &smp->flags))
2111 return smp_random(smp);
2112
580039e8
JH		 2113 if (hcon->out) {
2114 pkax = smp->local_pk;
2115 pkbx = smp->remote_pk;
2116 na = smp->prnd;
2117 nb = smp->rrnd;
2118 } else {
2119 pkax = smp->remote_pk;
2120 pkbx = smp->local_pk;
2121 na = smp->rrnd;
2122 nb = smp->prnd;
2123 }
2124
a29b0733
JH		 2125 if (smp->method == REQ_OOB) {
2126 if (!hcon->out)
2127 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2128 sizeof(smp->prnd), smp->prnd);
2129 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2130 goto mackey_and_ltk;
2131 }
2132
38606f14
JH		 2133 /* Passkey entry has special treatment */
2134 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2135 return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM);
2136
191dc7fe
JH		 2137 if (hcon->out) {
2138 u8 cfm[16];
2139
2140 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
2141 smp->rrnd, 0, cfm);
2142 if (err)
2143 return SMP_UNSPECIFIED;
2144
2145 if (memcmp(smp->pcnf, cfm, 16))
2146 return SMP_CONFIRM_FAILED;
191dc7fe
JH		 2147 } else {
2148 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2149 smp->prnd);
2150 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
191dc7fe
JH		 2151 }
2152
a29b0733 2153mackey_and_ltk:
760b018b
JH		 2154 /* Generate MacKey and LTK */
2155 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk);
2156 if (err)
2157 return SMP_UNSPECIFIED;
2158
a29b0733 2159 if (smp->method == JUST_WORKS || smp->method == REQ_OOB) {
dddd3059 2160 if (hcon->out) {
38606f14 2161 sc_dhkey_check(smp);
dddd3059
JH		 2162 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2163 }
2164 return 0;
2165 }
2166
38606f14
JH		 2167 err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey);
2168 if (err)
2169 return SMP_UNSPECIFIED;
2170
2171 err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
2172 hcon->dst_type, passkey, 0);
191dc7fe
JH		 2173 if (err)
2174 return SMP_UNSPECIFIED;
2175
38606f14
JH		 2176 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2177
191dc7fe 2178 return 0;
88ba43b6
AB		 2179}
2180
f81cd823 2181static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 2182{
c9839a11 2183 struct smp_ltk *key;
988c5997
VCG		 2184 struct hci_conn *hcon = conn->hcon;
2185
f3a73d97 2186 key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role);
988c5997 2187 if (!key)
f81cd823 2188 return false;
988c5997 2189
a6f7833c 2190 if (smp_ltk_sec_level(key) < sec_level)
f81cd823 2191 return false;
4dab7864 2192
51a8efd7 2193 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 2194 return true;
988c5997 2195
8b76ce34 2196 hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size);
c9839a11 2197 hcon->enc_key_size = key->enc_size;
988c5997 2198
fe59a05f
JH		 2199 /* We never store STKs for master role, so clear this flag */
2200 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
2201
f81cd823 2202 return true;
988c5997 2203}
f1560463 2204
35dc6f83
JH		 2205bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
2206 enum smp_key_pref key_pref)
854f4727
JH		 2207{
2208 if (sec_level == BT_SECURITY_LOW)
2209 return true;
2210
35dc6f83
JH		 2211 /* If we're encrypted with an STK but the caller prefers using
2212 * LTK claim insufficient security. This way we allow the
2213 * connection to be re-encrypted with an LTK, even if the LTK
2214 * provides the same level of security. Only exception is if we
2215 * don't have an LTK (e.g. because of key distribution bits).
9ab65d60 2216 */
35dc6f83
JH		 2217 if (key_pref == SMP_USE_LTK &&
2218 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
f3a73d97 2219 hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role))
9ab65d60
JH		 2220 return false;
2221
854f4727
JH		 2222 if (hcon->sec_level >= sec_level)
2223 return true;
2224
2225 return false;
2226}
2227
da85e5e5 2228static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 2229{
2230 struct smp_cmd_security_req *rp = (void *) skb->data;
2231 struct smp_cmd_pairing cp;
f1cb9af5 2232 struct hci_conn *hcon = conn->hcon;
0edb14de 2233 struct hci_dev *hdev = hcon->hdev;
8aab4757 2234 struct smp_chan *smp;
c05b9339 2235 u8 sec_level, auth;
88ba43b6
AB		 2236
2237 BT_DBG("conn %p", conn);
2238
c46b98be 2239 if (skb->len < sizeof(*rp))
38e4a915 2240 return SMP_INVALID_PARAMS;
c46b98be 2241
40bef302 2242 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 2243 return SMP_CMD_NOTSUPP;
2244
0edb14de 2245 auth = rp->auth_req & AUTH_REQ_MASK(hdev);
c05b9339 2246
d7a5a11d 2247 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
903b71c7
JH		 2248 return SMP_AUTH_REQUIREMENTS;
2249
5be5e275 2250 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1afc2a1a
JH		 2251 sec_level = BT_SECURITY_MEDIUM;
2252 else
2253 sec_level = authreq_to_seclevel(auth);
2254
35dc6f83 2255 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
854f4727
JH		 2256 return 0;
2257
c7262e71
JH		 2258 if (sec_level > hcon->pending_sec_level)
2259 hcon->pending_sec_level = sec_level;
feb45eb5 2260
4dab7864 2261 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 2262 return 0;
2263
8aab4757 2264 smp = smp_chan_create(conn);
c29d2444
JH		 2265 if (!smp)
2266 return SMP_UNSPECIFIED;
d26a2345 2267
d7a5a11d 2268 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
c05b9339 2269 (auth & SMP_AUTH_BONDING))
616d55be
JH		 2270 return SMP_PAIRING_NOTSUPP;
2271
88ba43b6 2272 skb_pull(skb, sizeof(*rp));
88ba43b6 2273
da85e5e5 2274 memset(&cp, 0, sizeof(cp));
c05b9339 2275 build_pairing_cmd(conn, &cp, NULL, auth);
88ba43b6 2276
1c1def09
VCG		 2277 smp->preq[0] = SMP_CMD_PAIRING_REQ;
2278 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 2279
88ba43b6 2280 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 2281 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
f1cb9af5 2282
da85e5e5 2283 return 0;
88ba43b6
AB		 2284}
2285
cc110922 2286int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 2287{
cc110922 2288 struct l2cap_conn *conn = hcon->l2cap_data;
c68b7f12 2289 struct l2cap_chan *chan;
0a66cf20 2290 struct smp_chan *smp;
2b64d153 2291 __u8 authreq;
fc75cc86 2292 int ret;
eb492e01 2293
3a0259bb
VCG		 2294 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
2295
0a66cf20
JH		 2296 /* This may be NULL if there's an unexpected disconnection */
2297 if (!conn)
2298 return 1;
2299
c68b7f12
JH		 2300 chan = conn->smp;
2301
d7a5a11d 2302 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
2e65c9d2
AG		 2303 return 1;
2304
35dc6f83 2305 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
eb492e01 2306 return 1;
f1cb9af5 2307
c7262e71
JH		 2308 if (sec_level > hcon->pending_sec_level)
2309 hcon->pending_sec_level = sec_level;
2310
40bef302 2311 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 2312 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2313 return 0;
d26a2345 2314
fc75cc86
JH		 2315 l2cap_chan_lock(chan);
2316
2317 /* If SMP is already in progress ignore this request */
2318 if (chan->data) {
2319 ret = 0;
2320 goto unlock;
2321 }
d26a2345 2322
8aab4757 2323 smp = smp_chan_create(conn);
fc75cc86
JH		 2324 if (!smp) {
2325 ret = 1;
2326 goto unlock;
2327 }
2b64d153
BG		 2328
2329 authreq = seclevel_to_authreq(sec_level);
d26a2345 2330
d7a5a11d 2331 if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED))
d2eb9e10
JH		 2332 authreq |= SMP_AUTH_SC;
2333
79897d20
JH		 2334 /* Require MITM if IO Capability allows or the security level
2335 * requires it.
2e233644 2336 */
79897d20 2337 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 2338 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 2339 authreq |= SMP_AUTH_MITM;
2340
40bef302 2341 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 2342 struct smp_cmd_pairing cp;
f01ead31 2343
2b64d153 2344 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 2345 smp->preq[0] = SMP_CMD_PAIRING_REQ;
2346 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 2347
eb492e01 2348 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 2349 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
eb492e01
AB		 2350 } else {
2351 struct smp_cmd_security_req cp;
2b64d153 2352 cp.auth_req = authreq;
eb492e01 2353 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
b28b4943 2354 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
eb492e01
AB		 2355 }
2356
4a74d658 2357 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
fc75cc86 2358 ret = 0;
edca792c 2359
fc75cc86
JH		 2360unlock:
2361 l2cap_chan_unlock(chan);
2362 return ret;
eb492e01
AB		 2363}
2364
7034b911
VCG		 2365static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
2366{
16b90839 2367 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 2368 struct l2cap_chan *chan = conn->smp;
2369 struct smp_chan *smp = chan->data;
16b90839 2370
c46b98be
JH		 2371 BT_DBG("conn %p", conn);
2372
2373 if (skb->len < sizeof(*rp))
38e4a915 2374 return SMP_INVALID_PARAMS;
c46b98be 2375
b28b4943 2376 SMP_ALLOW_CMD(smp, SMP_CMD_MASTER_IDENT);
6131ddc8 2377
16b90839
VCG		 2378 skb_pull(skb, sizeof(*rp));
2379
1c1def09 2380 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 2381
7034b911
VCG		 2382 return 0;
2383}
2384
2385static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
2386{
16b90839 2387 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 2388 struct l2cap_chan *chan = conn->smp;
2389 struct smp_chan *smp = chan->data;
c9839a11
VCG		 2390 struct hci_dev *hdev = conn->hcon->hdev;
2391 struct hci_conn *hcon = conn->hcon;
23d0e128 2392 struct smp_ltk *ltk;
c9839a11 2393 u8 authenticated;
16b90839 2394
c46b98be
JH		 2395 BT_DBG("conn %p", conn);
2396
2397 if (skb->len < sizeof(*rp))
38e4a915 2398 return SMP_INVALID_PARAMS;
c46b98be 2399
9747a9f3
JH		 2400 /* Mark the information as received */
2401 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
2402
b28b4943
JH		 2403 if (smp->remote_key_dist & SMP_DIST_ID_KEY)
2404 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
196332f5
JH		 2405 else if (smp->remote_key_dist & SMP_DIST_SIGN)
2406 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
b28b4943 2407
16b90839 2408 skb_pull(skb, sizeof(*rp));
7034b911 2409
ce39fb4e 2410 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 2411 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 2412 authenticated, smp->tk, smp->enc_key_size,
2413 rp->ediv, rp->rand);
2414 smp->ltk = ltk;
c6e81e9a 2415 if (!(smp->remote_key_dist & KEY_DIST_MASK))
d6268e86 2416 smp_distribute_keys(smp);
7034b911
VCG		 2417
2418 return 0;
2419}
2420
fd349c02
JH		 2421static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
2422{
2423 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 2424 struct l2cap_chan *chan = conn->smp;
2425 struct smp_chan *smp = chan->data;
fd349c02
JH		 2426
2427 BT_DBG("");
2428
2429 if (skb->len < sizeof(*info))
38e4a915 2430 return SMP_INVALID_PARAMS;
fd349c02 2431
b28b4943 2432 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
6131ddc8 2433
fd349c02
JH		 2434 skb_pull(skb, sizeof(*info));
2435
2436 memcpy(smp->irk, info->irk, 16);
2437
2438 return 0;
2439}
2440
2441static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
2442 struct sk_buff *skb)
2443{
2444 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 2445 struct l2cap_chan *chan = conn->smp;
2446 struct smp_chan *smp = chan->data;
fd349c02
JH		 2447 struct hci_conn *hcon = conn->hcon;
2448 bdaddr_t rpa;
2449
2450 BT_DBG("");
2451
2452 if (skb->len < sizeof(*info))
38e4a915 2453 return SMP_INVALID_PARAMS;
fd349c02 2454
9747a9f3
JH		 2455 /* Mark the information as received */
2456 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
2457
b28b4943
JH		 2458 if (smp->remote_key_dist & SMP_DIST_SIGN)
2459 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2460
fd349c02
JH		 2461 skb_pull(skb, sizeof(*info));
2462
a9a58f86
JH		 2463 /* Strictly speaking the Core Specification (4.1) allows sending
2464 * an empty address which would force us to rely on just the IRK
2465 * as "identity information". However, since such
2466 * implementations are not known of and in order to not over
2467 * complicate our implementation, simply pretend that we never
2468 * received an IRK for such a device.
e12af489
JH		 2469 *
2470 * The Identity Address must also be a Static Random or Public
2471 * Address, which hci_is_identity_address() checks for.
a9a58f86 2472 */
e12af489
JH		 2473 if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
2474 !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
a9a58f86 2475 BT_ERR("Ignoring IRK with no identity address");
31dd624e 2476 goto distribute;
a9a58f86
JH		 2477 }
2478
fd349c02
JH		 2479 bacpy(&smp->id_addr, &info->bdaddr);
2480 smp->id_addr_type = info->addr_type;
2481
2482 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
2483 bacpy(&rpa, &hcon->dst);
2484 else
2485 bacpy(&rpa, BDADDR_ANY);
2486
23d0e128
JH		 2487 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
2488 smp->id_addr_type, smp->irk, &rpa);
fd349c02 2489
31dd624e 2490distribute:
c6e81e9a
JH		 2491 if (!(smp->remote_key_dist & KEY_DIST_MASK))
2492 smp_distribute_keys(smp);
fd349c02
JH		 2493
2494 return 0;
2495}
2496
7ee4ea36
MH		 2497static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
2498{
2499 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 2500 struct l2cap_chan *chan = conn->smp;
2501 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 2502 struct smp_csrk *csrk;
2503
2504 BT_DBG("conn %p", conn);
2505
2506 if (skb->len < sizeof(*rp))
38e4a915 2507 return SMP_INVALID_PARAMS;
7ee4ea36 2508
7ee4ea36
MH		 2509 /* Mark the information as received */
2510 smp->remote_key_dist &= ~SMP_DIST_SIGN;
2511
2512 skb_pull(skb, sizeof(*rp));
2513
7ee4ea36
MH		 2514 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
2515 if (csrk) {
4cd3928a
JH		 2516 if (conn->hcon->sec_level > BT_SECURITY_MEDIUM)
2517 csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED;
2518 else
2519 csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED;
7ee4ea36
MH		 2520 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
2521 }
2522 smp->csrk = csrk;
d6268e86 2523 smp_distribute_keys(smp);
7ee4ea36
MH		 2524
2525 return 0;
2526}
2527
5e3d3d9b
JH		 2528static u8 sc_select_method(struct smp_chan *smp)
2529{
2530 struct l2cap_conn *conn = smp->conn;
2531 struct hci_conn *hcon = conn->hcon;
2532 struct smp_cmd_pairing *local, *remote;
2533 u8 local_mitm, remote_mitm, local_io, remote_io, method;
2534
1a8bab4f
JH		 2535 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) ||
2536 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags))
a29b0733
JH		 2537 return REQ_OOB;
2538
5e3d3d9b
JH		 2539 /* The preq/prsp contain the raw Pairing Request/Response PDUs
2540 * which are needed as inputs to some crypto functions. To get
2541 * the "struct smp_cmd_pairing" from them we need to skip the
2542 * first byte which contains the opcode.
2543 */
2544 if (hcon->out) {
2545 local = (void *) &smp->preq[1];
2546 remote = (void *) &smp->prsp[1];
2547 } else {
2548 local = (void *) &smp->prsp[1];
2549 remote = (void *) &smp->preq[1];
2550 }
2551
2552 local_io = local->io_capability;
2553 remote_io = remote->io_capability;
2554
2555 local_mitm = (local->auth_req & SMP_AUTH_MITM);
2556 remote_mitm = (remote->auth_req & SMP_AUTH_MITM);
2557
2558 /* If either side wants MITM, look up the method from the table,
2559 * otherwise use JUST WORKS.
2560 */
2561 if (local_mitm || remote_mitm)
2562 method = get_auth_method(smp, local_io, remote_io);
2563 else
2564 method = JUST_WORKS;
2565
2566 /* Don't confirm locally initiated pairing attempts */
2567 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2568 method = JUST_WORKS;
2569
2570 return method;
2571}
2572
d8f8edbe
JH		 2573static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
2574{
2575 struct smp_cmd_public_key *key = (void *) skb->data;
2576 struct hci_conn *hcon = conn->hcon;
2577 struct l2cap_chan *chan = conn->smp;
2578 struct smp_chan *smp = chan->data;
5e3d3d9b 2579 struct hci_dev *hdev = hcon->hdev;
cbbbe3e2 2580 struct smp_cmd_pairing_confirm cfm;
d8f8edbe
JH		 2581 int err;
2582
2583 BT_DBG("conn %p", conn);
2584
2585 if (skb->len < sizeof(*key))
2586 return SMP_INVALID_PARAMS;
2587
2588 memcpy(smp->remote_pk, key, 64);
2589
a8ca617c
JH		 2590 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {
2591 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk,
2592 smp->rr, 0, cfm.confirm_val);
2593 if (err)
2594 return SMP_UNSPECIFIED;
2595
2596 if (memcmp(cfm.confirm_val, smp->pcnf, 16))
2597 return SMP_CONFIRM_FAILED;
2598 }
2599
d8f8edbe
JH		 2600 /* Non-initiating device sends its public key after receiving
2601 * the key from the initiating device.
2602 */
2603 if (!hcon->out) {
2604 err = sc_send_public_key(smp);
2605 if (err)
2606 return err;
2607 }
2608
c7a3d57d 2609 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk);
e091526d 2610 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32);
d8f8edbe
JH		 2611
2612 if (!ecdh_shared_secret(smp->remote_pk, smp->local_sk, smp->dhkey))
2613 return SMP_UNSPECIFIED;
2614
c7a3d57d 2615 SMP_DBG("DHKey %32phN", smp->dhkey);
d8f8edbe
JH		 2616
2617 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags);
2618
5e3d3d9b
JH		 2619 smp->method = sc_select_method(smp);
2620
2621 BT_DBG("%s selected method 0x%02x", hdev->name, smp->method);
2622
2623 /* JUST_WORKS and JUST_CFM result in an unauthenticated key */
2624 if (smp->method == JUST_WORKS || smp->method == JUST_CFM)
2625 hcon->pending_sec_level = BT_SECURITY_MEDIUM;
2626 else
2627 hcon->pending_sec_level = BT_SECURITY_FIPS;
2628
aeb7d461
JH		 2629 if (!memcmp(debug_pk, smp->remote_pk, 64))
2630 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
2631
38606f14
JH		 2632 if (smp->method == DSP_PASSKEY) {
2633 get_random_bytes(&hcon->passkey_notify,
2634 sizeof(hcon->passkey_notify));
2635 hcon->passkey_notify %= 1000000;
2636 hcon->passkey_entered = 0;
2637 smp->passkey_round = 0;
2638 if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type,
2639 hcon->dst_type,
2640 hcon->passkey_notify,
2641 hcon->passkey_entered))
2642 return SMP_UNSPECIFIED;
2643 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2644 return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY);
2645 }
2646
94ea7257 2647 if (smp->method == REQ_OOB) {
a29b0733
JH		 2648 if (hcon->out)
2649 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2650 sizeof(smp->prnd), smp->prnd);
2651
2652 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2653
2654 return 0;
2655 }
2656
38606f14
JH		 2657 if (hcon->out)
2658 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2659
2660 if (smp->method == REQ_PASSKEY) {
2661 if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type,
2662 hcon->dst_type))
2663 return SMP_UNSPECIFIED;
2664 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2665 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2666 return 0;
2667 }
2668
cbbbe3e2
JH		 2669 /* The Initiating device waits for the non-initiating device to
2670 * send the confirm value.
2671 */
2672 if (conn->hcon->out)
2673 return 0;
2674
2675 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd,
2676 0, cfm.confirm_val);
2677 if (err)
2678 return SMP_UNSPECIFIED;
2679
2680 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
2681 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2682
d8f8edbe
JH		 2683 return 0;
2684}
2685
6433a9a2
JH		 2686static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
2687{
2688 struct smp_cmd_dhkey_check *check = (void *) skb->data;
2689 struct l2cap_chan *chan = conn->smp;
2690 struct hci_conn *hcon = conn->hcon;
2691 struct smp_chan *smp = chan->data;
2692 u8 a[7], b[7], *local_addr, *remote_addr;
2693 u8 io_cap[3], r[16], e[16];
2694 int err;
2695
2696 BT_DBG("conn %p", conn);
2697
2698 if (skb->len < sizeof(*check))
2699 return SMP_INVALID_PARAMS;
2700
2701 memcpy(a, &hcon->init_addr, 6);
2702 memcpy(b, &hcon->resp_addr, 6);
2703 a[6] = hcon->init_addr_type;
2704 b[6] = hcon->resp_addr_type;
2705
2706 if (hcon->out) {
2707 local_addr = a;
2708 remote_addr = b;
2709 memcpy(io_cap, &smp->prsp[1], 3);
2710 } else {
2711 local_addr = b;
2712 remote_addr = a;
2713 memcpy(io_cap, &smp->preq[1], 3);
2714 }
2715
2716 memset(r, 0, sizeof(r));
2717
38606f14
JH		 2718 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2719 put_unaligned_le32(hcon->passkey_notify, r);
882fafad
JH		 2720 else if (smp->method == REQ_OOB)
2721 memcpy(r, smp->lr, 16);
38606f14 2722
6433a9a2
JH		 2723 err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r,
2724 io_cap, remote_addr, local_addr, e);
2725 if (err)
2726 return SMP_UNSPECIFIED;
2727
2728 if (memcmp(check->e, e, 16))
2729 return SMP_DHKEY_CHECK_FAILED;
2730
d3e54a87
JH		 2731 if (!hcon->out) {
2732 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
2733 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags);
2734 return 0;
2735 }
d378a2d7 2736
d3e54a87
JH		 2737 /* Slave sends DHKey check as response to master */
2738 sc_dhkey_check(smp);
2739 }
d378a2d7 2740
d3e54a87 2741 sc_add_ltk(smp);
6433a9a2
JH		 2742
2743 if (hcon->out) {
8b76ce34 2744 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size);
6433a9a2
JH		 2745 hcon->enc_key_size = smp->enc_key_size;
2746 }
2747
2748 return 0;
2749}
2750
1408bb6e
JH		 2751static int smp_cmd_keypress_notify(struct l2cap_conn *conn,
2752 struct sk_buff *skb)
2753{
2754 struct smp_cmd_keypress_notify *kp = (void *) skb->data;
2755
2756 BT_DBG("value 0x%02x", kp->value);
2757
2758 return 0;
2759}
2760
4befb867 2761static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 2762{
5d88cc73 2763 struct l2cap_conn *conn = chan->conn;
7b9899db 2764 struct hci_conn *hcon = conn->hcon;
b28b4943 2765 struct smp_chan *smp;
92381f5c 2766 __u8 code, reason;
eb492e01
AB		 2767 int err = 0;
2768
8ae9b984 2769 if (skb->len < 1)
92381f5c 2770 return -EILSEQ;
92381f5c 2771
d7a5a11d 2772 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) {
2e65c9d2
AG		 2773 reason = SMP_PAIRING_NOTSUPP;
2774 goto done;
2775 }
2776
92381f5c 2777 code = skb->data[0];
eb492e01
AB		 2778 skb_pull(skb, sizeof(code));
2779
b28b4943
JH		 2780 smp = chan->data;
2781
2782 if (code > SMP_CMD_MAX)
2783 goto drop;
2784
24bd0bd9 2785 if (smp && !test_and_clear_bit(code, &smp->allow_cmd))
b28b4943
JH		 2786 goto drop;
2787
2788 /* If we don't have a context the only allowed commands are
2789 * pairing request and security request.
8cf9fa12 2790 */
b28b4943
JH		 2791 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
2792 goto drop;
8cf9fa12 2793
eb492e01
AB		 2794 switch (code) {
2795 case SMP_CMD_PAIRING_REQ:
da85e5e5 2796 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 2797 break;
2798
2799 case SMP_CMD_PAIRING_FAIL:
84794e11 2800 smp_failure(conn, 0);
da85e5e5 2801 err = -EPERM;
eb492e01
AB		 2802 break;
2803
2804 case SMP_CMD_PAIRING_RSP:
da85e5e5 2805 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 2806 break;
2807
2808 case SMP_CMD_SECURITY_REQ:
da85e5e5 2809 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 2810 break;
2811
eb492e01 2812 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 2813 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 2814 break;
2815
eb492e01 2816 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 2817 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 2818 break;
2819
eb492e01 2820 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 2821 reason = smp_cmd_encrypt_info(conn, skb);
2822 break;
2823
eb492e01 2824 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 2825 reason = smp_cmd_master_ident(conn, skb);
2826 break;
2827
eb492e01 2828 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 2829 reason = smp_cmd_ident_info(conn, skb);
2830 break;
2831
eb492e01 2832 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 2833 reason = smp_cmd_ident_addr_info(conn, skb);
2834 break;
2835
eb492e01 2836 case SMP_CMD_SIGN_INFO:
7ee4ea36 2837 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 2838 break;
2839
d8f8edbe
JH		 2840 case SMP_CMD_PUBLIC_KEY:
2841 reason = smp_cmd_public_key(conn, skb);
2842 break;
2843
6433a9a2
JH		 2844 case SMP_CMD_DHKEY_CHECK:
2845 reason = smp_cmd_dhkey_check(conn, skb);
2846 break;
2847
1408bb6e
JH		 2848 case SMP_CMD_KEYPRESS_NOTIFY:
2849 reason = smp_cmd_keypress_notify(conn, skb);
2850 break;
2851
eb492e01
AB		 2852 default:
2853 BT_DBG("Unknown command code 0x%2.2x", code);
eb492e01 2854 reason = SMP_CMD_NOTSUPP;
3a0259bb 2855 goto done;
eb492e01
AB		 2856 }
2857
3a0259bb 2858done:
9b7b18ef
JH		 2859 if (!err) {
2860 if (reason)
2861 smp_failure(conn, reason);
8ae9b984 2862 kfree_skb(skb);
9b7b18ef
JH		 2863 }
2864
eb492e01 2865 return err;
b28b4943
JH		 2866
2867drop:
2868 BT_ERR("%s unexpected SMP command 0x%02x from %pMR", hcon->hdev->name,
2869 code, &hcon->dst);
2870 kfree_skb(skb);
2871 return 0;
eb492e01 2872}
7034b911 2873
70db83c4
JH		 2874static void smp_teardown_cb(struct l2cap_chan *chan, int err)
2875{
2876 struct l2cap_conn *conn = chan->conn;
2877
2878 BT_DBG("chan %p", chan);
2879
fc75cc86 2880 if (chan->data)
5d88cc73 2881 smp_chan_destroy(conn);
5d88cc73 2882
70db83c4
JH		 2883 conn->smp = NULL;
2884 l2cap_chan_put(chan);
2885}
2886
b5ae344d
JH		 2887static void bredr_pairing(struct l2cap_chan *chan)
2888{
2889 struct l2cap_conn *conn = chan->conn;
2890 struct hci_conn *hcon = conn->hcon;
2891 struct hci_dev *hdev = hcon->hdev;
2892 struct smp_cmd_pairing req;
2893 struct smp_chan *smp;
2894
2895 BT_DBG("chan %p", chan);
2896
2897 /* Only new pairings are interesting */
2898 if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags))
2899 return;
2900
2901 /* Don't bother if we're not encrypted */
2902 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
2903 return;
2904
2905 /* Only master may initiate SMP over BR/EDR */
2906 if (hcon->role != HCI_ROLE_MASTER)
2907 return;
2908
2909 /* Secure Connections support must be enabled */
d7a5a11d 2910 if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED))
b5ae344d
JH		 2911 return;
2912
2913 /* BR/EDR must use Secure Connections for SMP */
2914 if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) &&
b7cb93e5 2915 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
b5ae344d
JH		 2916 return;
2917
2918 /* If our LE support is not enabled don't do anything */
d7a5a11d 2919 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
b5ae344d
JH		 2920 return;
2921
2922 /* Don't bother if remote LE support is not enabled */
2923 if (!lmp_host_le_capable(hcon))
2924 return;
2925
2926 /* Remote must support SMP fixed chan for BR/EDR */
2927 if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR))
2928 return;
2929
2930 /* Don't bother if SMP is already ongoing */
2931 if (chan->data)
2932 return;
2933
2934 smp = smp_chan_create(conn);
2935 if (!smp) {
2936 BT_ERR("%s unable to create SMP context for BR/EDR",
2937 hdev->name);
2938 return;
2939 }
2940
2941 set_bit(SMP_FLAG_SC, &smp->flags);
2942
2943 BT_DBG("%s starting SMP over BR/EDR", hdev->name);
2944
2945 /* Prepare and send the BR/EDR SMP Pairing Request */
2946 build_bredr_pairing_cmd(smp, &req, NULL);
2947
2948 smp->preq[0] = SMP_CMD_PAIRING_REQ;
2949 memcpy(&smp->preq[1], &req, sizeof(req));
2950
2951 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(req), &req);
2952 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
2953}
2954
44f1a7ab
JH		 2955static void smp_resume_cb(struct l2cap_chan *chan)
2956{
b68fda68 2957 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 2958 struct l2cap_conn *conn = chan->conn;
2959 struct hci_conn *hcon = conn->hcon;
2960
2961 BT_DBG("chan %p", chan);
2962
b5ae344d
JH		 2963 if (hcon->type == ACL_LINK) {
2964 bredr_pairing(chan);
ef8efe4b 2965 return;
b5ae344d 2966 }
ef8efe4b 2967
86d1407c
JH		 2968 if (!smp)
2969 return;
b68fda68 2970
84bc0db5
JH		 2971 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
2972 return;
2973
86d1407c
JH		 2974 cancel_delayed_work(&smp->security_timer);
2975
d6268e86 2976 smp_distribute_keys(smp);
44f1a7ab
JH		 2977}
2978
70db83c4
JH		 2979static void smp_ready_cb(struct l2cap_chan *chan)
2980{
2981 struct l2cap_conn *conn = chan->conn;
b5ae344d 2982 struct hci_conn *hcon = conn->hcon;
70db83c4
JH		 2983
2984 BT_DBG("chan %p", chan);
2985
2986 conn->smp = chan;
2987 l2cap_chan_hold(chan);
b5ae344d
JH		 2988
2989 if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
2990 bredr_pairing(chan);
70db83c4
JH		 2991}
2992
4befb867
JH		 2993static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
2994{
2995 int err;
2996
2997 BT_DBG("chan %p", chan);
2998
2999 err = smp_sig_channel(chan, skb);
3000 if (err) {
b68fda68 3001 struct smp_chan *smp = chan->data;
4befb867 3002
b68fda68
JH		 3003 if (smp)
3004 cancel_delayed_work_sync(&smp->security_timer);
4befb867 3005
1e91c29e 3006 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
4befb867
JH		 3007 }
3008
3009 return err;
3010}
3011
70db83c4
JH		 3012static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
3013 unsigned long hdr_len,
3014 unsigned long len, int nb)
3015{
3016 struct sk_buff *skb;
3017
3018 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
3019 if (!skb)
3020 return ERR_PTR(-ENOMEM);
3021
3022 skb->priority = HCI_PRIO_MAX;
a4368ff3 3023 bt_cb(skb)->l2cap.chan = chan;
70db83c4
JH		 3024
3025 return skb;
3026}
3027
3028static const struct l2cap_ops smp_chan_ops = {
3029 .name = "Security Manager",
3030 .ready = smp_ready_cb,
5d88cc73 3031 .recv = smp_recv_cb,
70db83c4
JH		 3032 .alloc_skb = smp_alloc_skb_cb,
3033 .teardown = smp_teardown_cb,
44f1a7ab 3034 .resume = smp_resume_cb,
70db83c4
JH		 3035
3036 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 3037 .state_change = l2cap_chan_no_state_change,
3038 .close = l2cap_chan_no_close,
3039 .defer = l2cap_chan_no_defer,
3040 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 3041 .set_shutdown = l2cap_chan_no_set_shutdown,
3042 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
70db83c4
JH		 3043};
3044
3045static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
3046{
3047 struct l2cap_chan *chan;
3048
3049 BT_DBG("pchan %p", pchan);
3050
3051 chan = l2cap_chan_create();
3052 if (!chan)
3053 return NULL;
3054
3055 chan->chan_type = pchan->chan_type;
3056 chan->ops = &smp_chan_ops;
3057 chan->scid = pchan->scid;
3058 chan->dcid = chan->scid;
3059 chan->imtu = pchan->imtu;
3060 chan->omtu = pchan->omtu;
3061 chan->mode = pchan->mode;
3062
abe84903
JH		 3063 /* Other L2CAP channels may request SMP routines in order to
3064 * change the security level. This means that the SMP channel
3065 * lock must be considered in its own category to avoid lockdep
3066 * warnings.
3067 */
3068 atomic_set(&chan->nesting, L2CAP_NESTING_SMP);
3069
70db83c4
JH		 3070 BT_DBG("created chan %p", chan);
3071
3072 return chan;
3073}
3074
3075static const struct l2cap_ops smp_root_chan_ops = {
3076 .name = "Security Manager Root",
3077 .new_connection = smp_new_conn_cb,
3078
3079 /* None of these are implemented for the root channel */
3080 .close = l2cap_chan_no_close,
3081 .alloc_skb = l2cap_chan_no_alloc_skb,
3082 .recv = l2cap_chan_no_recv,
3083 .state_change = l2cap_chan_no_state_change,
3084 .teardown = l2cap_chan_no_teardown,
3085 .ready = l2cap_chan_no_ready,
3086 .defer = l2cap_chan_no_defer,
3087 .suspend = l2cap_chan_no_suspend,
3088 .resume = l2cap_chan_no_resume,
3089 .set_shutdown = l2cap_chan_no_set_shutdown,
3090 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
70db83c4
JH		 3091};
3092
ef8efe4b 3093static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
711eafe3 3094{
70db83c4 3095 struct l2cap_chan *chan;
88a479d9
MH		 3096 struct smp_dev *smp;
3097 struct crypto_blkcipher *tfm_aes;
6e2dc6d1 3098 struct crypto_hash *tfm_cmac;
70db83c4 3099
ef8efe4b 3100 if (cid == L2CAP_CID_SMP_BREDR) {
88a479d9 3101 smp = NULL;
ef8efe4b
JH		 3102 goto create_chan;
3103 }
711eafe3 3104
88a479d9
MH		 3105 smp = kzalloc(sizeof(*smp), GFP_KERNEL);
3106 if (!smp)
3107 return ERR_PTR(-ENOMEM);
3108
3109 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
defce9e8 3110 if (IS_ERR(tfm_aes)) {
88a479d9
MH		 3111 BT_ERR("Unable to create ECB crypto context");
3112 kzfree(smp);
fe700771 3113 return ERR_CAST(tfm_aes);
711eafe3
JH		 3114 }
3115
6e2dc6d1
MH		 3116 tfm_cmac = crypto_alloc_hash("cmac(aes)", 0, CRYPTO_ALG_ASYNC);
3117 if (IS_ERR(tfm_cmac)) {
3118 BT_ERR("Unable to create CMAC crypto context");
3119 crypto_free_blkcipher(tfm_aes);
3120 kzfree(smp);
3121 return ERR_CAST(tfm_cmac);
3122 }
3123
88a479d9 3124 smp->tfm_aes = tfm_aes;
6e2dc6d1 3125 smp->tfm_cmac = tfm_cmac;
88a479d9 3126
ef8efe4b 3127create_chan:
70db83c4
JH		 3128 chan = l2cap_chan_create();
3129 if (!chan) {
63511f6d
MH		 3130 if (smp) {
3131 crypto_free_blkcipher(smp->tfm_aes);
3132 crypto_free_hash(smp->tfm_cmac);
3133 kzfree(smp);
3134 }
ef8efe4b 3135 return ERR_PTR(-ENOMEM);
70db83c4
JH		 3136 }
3137
88a479d9 3138 chan->data = smp;
defce9e8 3139
ef8efe4b 3140 l2cap_add_scid(chan, cid);
70db83c4
JH		 3141
3142 l2cap_chan_set_defaults(chan);
3143
157029ba 3144 if (cid == L2CAP_CID_SMP) {
39e3e744
JH		 3145 u8 bdaddr_type;
3146
3147 hci_copy_identity_address(hdev, &chan->src, &bdaddr_type);
3148
3149 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
157029ba 3150 chan->src_type = BDADDR_LE_PUBLIC;
39e3e744
JH		 3151 else
3152 chan->src_type = BDADDR_LE_RANDOM;
157029ba
MH		 3153 } else {
3154 bacpy(&chan->src, &hdev->bdaddr);
ef8efe4b 3155 chan->src_type = BDADDR_BREDR;
157029ba
MH		 3156 }
3157
70db83c4
JH		 3158 chan->state = BT_LISTEN;
3159 chan->mode = L2CAP_MODE_BASIC;
3160 chan->imtu = L2CAP_DEFAULT_MTU;
3161 chan->ops = &smp_root_chan_ops;
3162
abe84903
JH		 3163 /* Set correct nesting level for a parent/listening channel */
3164 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
3165
ef8efe4b 3166 return chan;
711eafe3
JH		 3167}
3168
ef8efe4b 3169static void smp_del_chan(struct l2cap_chan *chan)
711eafe3 3170{
88a479d9 3171 struct smp_dev *smp;
70db83c4 3172
ef8efe4b 3173 BT_DBG("chan %p", chan);
711eafe3 3174
88a479d9
MH		 3175 smp = chan->data;
3176 if (smp) {
defce9e8 3177 chan->data = NULL;
88a479d9
MH		 3178 if (smp->tfm_aes)
3179 crypto_free_blkcipher(smp->tfm_aes);
6e2dc6d1
MH		 3180 if (smp->tfm_cmac)
3181 crypto_free_hash(smp->tfm_cmac);
88a479d9 3182 kzfree(smp);
711eafe3 3183 }
70db83c4 3184
70db83c4 3185 l2cap_chan_put(chan);
711eafe3 3186}
ef8efe4b 3187
300acfde
MH		 3188static ssize_t force_bredr_smp_read(struct file *file,
3189 char __user *user_buf,
3190 size_t count, loff_t *ppos)
3191{
3192 struct hci_dev *hdev = file->private_data;
3193 char buf[3];
3194
b7cb93e5 3195 buf[0] = hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP) ? 'Y': 'N';
300acfde
MH		 3196 buf[1] = '\n';
3197 buf[2] = '\0';
3198 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
3199}
3200
3201static ssize_t force_bredr_smp_write(struct file *file,
3202 const char __user *user_buf,
3203 size_t count, loff_t *ppos)
3204{
3205 struct hci_dev *hdev = file->private_data;
3206 char buf[32];
3207 size_t buf_size = min(count, (sizeof(buf)-1));
3208 bool enable;
3209
3210 if (copy_from_user(buf, user_buf, buf_size))
3211 return -EFAULT;
3212
3213 buf[buf_size] = '\0';
3214 if (strtobool(buf, &enable))
3215 return -EINVAL;
3216
b7cb93e5 3217 if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
300acfde
MH		 3218 return -EALREADY;
3219
3220 if (enable) {
3221 struct l2cap_chan *chan;
3222
3223 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3224 if (IS_ERR(chan))
3225 return PTR_ERR(chan);
3226
3227 hdev->smp_bredr_data = chan;
3228 } else {
3229 struct l2cap_chan *chan;
3230
3231 chan = hdev->smp_bredr_data;
3232 hdev->smp_bredr_data = NULL;
3233 smp_del_chan(chan);
3234 }
3235
b7cb93e5 3236 hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP);
300acfde
MH		 3237
3238 return count;
3239}
3240
3241static const struct file_operations force_bredr_smp_fops = {
3242 .open = simple_open,
3243 .read = force_bredr_smp_read,
3244 .write = force_bredr_smp_write,
3245 .llseek = default_llseek,
3246};
3247
ef8efe4b
JH		 3248int smp_register(struct hci_dev *hdev)
3249{
3250 struct l2cap_chan *chan;
3251
3252 BT_DBG("%s", hdev->name);
3253
7e7ec445
MH		 3254 /* If the controller does not support Low Energy operation, then
3255 * there is also no need to register any SMP channel.
3256 */
3257 if (!lmp_le_capable(hdev))
3258 return 0;
3259
2b8df323
MH		 3260 if (WARN_ON(hdev->smp_data)) {
3261 chan = hdev->smp_data;
3262 hdev->smp_data = NULL;
3263 smp_del_chan(chan);
3264 }
3265
ef8efe4b
JH		 3266 chan = smp_add_cid(hdev, L2CAP_CID_SMP);
3267 if (IS_ERR(chan))
3268 return PTR_ERR(chan);
3269
3270 hdev->smp_data = chan;
3271
300acfde
MH		 3272 /* If the controller does not support BR/EDR Secure Connections
3273 * feature, then the BR/EDR SMP channel shall not be present.
3274 *
3275 * To test this with Bluetooth 4.0 controllers, create a debugfs
3276 * switch that allows forcing BR/EDR SMP support and accepting
3277 * cross-transport pairing on non-AES encrypted connections.
3278 */
3279 if (!lmp_sc_capable(hdev)) {
3280 debugfs_create_file("force_bredr_smp", 0644, hdev->debugfs,
3281 hdev, &force_bredr_smp_fops);
ef8efe4b 3282 return 0;
300acfde 3283 }
ef8efe4b 3284
2b8df323
MH		 3285 if (WARN_ON(hdev->smp_bredr_data)) {
3286 chan = hdev->smp_bredr_data;
3287 hdev->smp_bredr_data = NULL;
3288 smp_del_chan(chan);
3289 }
3290
ef8efe4b
JH		 3291 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3292 if (IS_ERR(chan)) {
3293 int err = PTR_ERR(chan);
3294 chan = hdev->smp_data;
3295 hdev->smp_data = NULL;
3296 smp_del_chan(chan);
3297 return err;
3298 }
3299
3300 hdev->smp_bredr_data = chan;
3301
3302 return 0;
3303}
3304
3305void smp_unregister(struct hci_dev *hdev)
3306{
3307 struct l2cap_chan *chan;
3308
3309 if (hdev->smp_bredr_data) {
3310 chan = hdev->smp_bredr_data;
3311 hdev->smp_bredr_data = NULL;
3312 smp_del_chan(chan);
3313 }
3314
3315 if (hdev->smp_data) {
3316 chan = hdev->smp_data;
3317 hdev->smp_data = NULL;
3318 smp_del_chan(chan);
3319 }
3320}
0a2b0f04
JH		 3321
3322#if IS_ENABLED(CONFIG_BT_SELFTEST_SMP)
3323
cfc4198e
JH		 3324static int __init test_ah(struct crypto_blkcipher *tfm_aes)
3325{
3326 const u8 irk[16] = {
3327 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3328 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3329 const u8 r[3] = { 0x94, 0x81, 0x70 };
3330 const u8 exp[3] = { 0xaa, 0xfb, 0x0d };
3331 u8 res[3];
3332 int err;
3333
3334 err = smp_ah(tfm_aes, irk, r, res);
3335 if (err)
3336 return err;
3337
3338 if (memcmp(res, exp, 3))
3339 return -EINVAL;
3340
3341 return 0;
3342}
3343
3344static int __init test_c1(struct crypto_blkcipher *tfm_aes)
3345{
3346 const u8 k[16] = {
3347 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3348 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3349 const u8 r[16] = {
3350 0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63,
3351 0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 };
3352 const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 };
3353 const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 };
3354 const u8 _iat = 0x01;
3355 const u8 _rat = 0x00;
3356 const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } };
3357 const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } };
3358 const u8 exp[16] = {
3359 0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2,
3360 0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e };
3361 u8 res[16];
3362 int err;
3363
3364 err = smp_c1(tfm_aes, k, r, preq, pres, _iat, &ia, _rat, &ra, res);
3365 if (err)
3366 return err;
3367
3368 if (memcmp(res, exp, 16))
3369 return -EINVAL;
3370
3371 return 0;
3372}
3373
3374static int __init test_s1(struct crypto_blkcipher *tfm_aes)
3375{
3376 const u8 k[16] = {
3377 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3378 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3379 const u8 r1[16] = {
3380 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 };
3381 const u8 r2[16] = {
3382 0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 };
3383 const u8 exp[16] = {
3384 0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b,
3385 0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a };
3386 u8 res[16];
3387 int err;
3388
3389 err = smp_s1(tfm_aes, k, r1, r2, res);
3390 if (err)
3391 return err;
3392
3393 if (memcmp(res, exp, 16))
3394 return -EINVAL;
3395
3396 return 0;
3397}
3398
fb2969a3
JH		 3399static int __init test_f4(struct crypto_hash *tfm_cmac)
3400{
3401 const u8 u[32] = {
3402 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3403 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3404 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3405 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3406 const u8 v[32] = {
3407 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3408 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3409 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3410 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3411 const u8 x[16] = {
3412 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3413 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3414 const u8 z = 0x00;
3415 const u8 exp[16] = {
3416 0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1,
3417 0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 };
3418 u8 res[16];
3419 int err;
3420
3421 err = smp_f4(tfm_cmac, u, v, x, z, res);
3422 if (err)
3423 return err;
3424
3425 if (memcmp(res, exp, 16))
3426 return -EINVAL;
3427
3428 return 0;
3429}
3430
3431static int __init test_f5(struct crypto_hash *tfm_cmac)
3432{
3433 const u8 w[32] = {
3434 0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86,
3435 0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99,
3436 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3437 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3438 const u8 n1[16] = {
3439 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3440 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3441 const u8 n2[16] = {
3442 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3443 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3444 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3445 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3446 const u8 exp_ltk[16] = {
3447 0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98,
3448 0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 };
3449 const u8 exp_mackey[16] = {
3450 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3451 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3452 u8 mackey[16], ltk[16];
3453 int err;
3454
3455 err = smp_f5(tfm_cmac, w, n1, n2, a1, a2, mackey, ltk);
3456 if (err)
3457 return err;
3458
3459 if (memcmp(mackey, exp_mackey, 16))
3460 return -EINVAL;
3461
3462 if (memcmp(ltk, exp_ltk, 16))
3463 return -EINVAL;
3464
3465 return 0;
3466}
3467
3468static int __init test_f6(struct crypto_hash *tfm_cmac)
3469{
3470 const u8 w[16] = {
3471 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3472 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3473 const u8 n1[16] = {
3474 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3475 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3476 const u8 n2[16] = {
3477 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3478 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3479 const u8 r[16] = {
3480 0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08,
3481 0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 };
3482 const u8 io_cap[3] = { 0x02, 0x01, 0x01 };
3483 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3484 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3485 const u8 exp[16] = {
3486 0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2,
3487 0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 };
3488 u8 res[16];
3489 int err;
3490
3491 err = smp_f6(tfm_cmac, w, n1, n2, r, io_cap, a1, a2, res);
3492 if (err)
3493 return err;
3494
3495 if (memcmp(res, exp, 16))
3496 return -EINVAL;
3497
3498 return 0;
3499}
3500
3501static int __init test_g2(struct crypto_hash *tfm_cmac)
3502{
3503 const u8 u[32] = {
3504 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3505 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3506 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3507 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3508 const u8 v[32] = {
3509 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3510 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3511 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3512 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3513 const u8 x[16] = {
3514 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3515 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3516 const u8 y[16] = {
3517 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3518 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3519 const u32 exp_val = 0x2f9ed5ba % 1000000;
3520 u32 val;
3521 int err;
3522
3523 err = smp_g2(tfm_cmac, u, v, x, y, &val);
3524 if (err)
3525 return err;
3526
3527 if (val != exp_val)
3528 return -EINVAL;
3529
3530 return 0;
3531}
3532
3533static int __init test_h6(struct crypto_hash *tfm_cmac)
3534{
3535 const u8 w[16] = {
3536 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3537 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3538 const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c };
3539 const u8 exp[16] = {
3540 0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8,
3541 0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d };
3542 u8 res[16];
3543 int err;
3544
3545 err = smp_h6(tfm_cmac, w, key_id, res);
3546 if (err)
3547 return err;
3548
3549 if (memcmp(res, exp, 16))
3550 return -EINVAL;
3551
3552 return 0;
3553}
3554
64dd374e
MH		 3555static char test_smp_buffer[32];
3556
3557static ssize_t test_smp_read(struct file *file, char __user *user_buf,
3558 size_t count, loff_t *ppos)
3559{
3560 return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer,
3561 strlen(test_smp_buffer));
3562}
3563
3564static const struct file_operations test_smp_fops = {
3565 .open = simple_open,
3566 .read = test_smp_read,
3567 .llseek = default_llseek,
3568};
3569
0a2b0f04
JH		 3570static int __init run_selftests(struct crypto_blkcipher *tfm_aes,
3571 struct crypto_hash *tfm_cmac)
3572{
255047b0
MH		 3573 ktime_t calltime, delta, rettime;
3574 unsigned long long duration;
cfc4198e
JH		 3575 int err;
3576
255047b0
MH		 3577 calltime = ktime_get();
3578
cfc4198e
JH		 3579 err = test_ah(tfm_aes);
3580 if (err) {
3581 BT_ERR("smp_ah test failed");
64dd374e 3582 goto done;
cfc4198e
JH		 3583 }
3584
3585 err = test_c1(tfm_aes);
3586 if (err) {
3587 BT_ERR("smp_c1 test failed");
64dd374e 3588 goto done;
cfc4198e
JH		 3589 }
3590
3591 err = test_s1(tfm_aes);
3592 if (err) {
3593 BT_ERR("smp_s1 test failed");
64dd374e 3594 goto done;
cfc4198e
JH		 3595 }
3596
fb2969a3
JH		 3597 err = test_f4(tfm_cmac);
3598 if (err) {
3599 BT_ERR("smp_f4 test failed");
64dd374e 3600 goto done;
fb2969a3
JH		 3601 }
3602
3603 err = test_f5(tfm_cmac);
3604 if (err) {
3605 BT_ERR("smp_f5 test failed");
64dd374e 3606 goto done;
fb2969a3
JH		 3607 }
3608
3609 err = test_f6(tfm_cmac);
3610 if (err) {
3611 BT_ERR("smp_f6 test failed");
64dd374e 3612 goto done;
fb2969a3
JH		 3613 }
3614
3615 err = test_g2(tfm_cmac);
3616 if (err) {
3617 BT_ERR("smp_g2 test failed");
64dd374e 3618 goto done;
fb2969a3
JH		 3619 }
3620
3621 err = test_h6(tfm_cmac);
3622 if (err) {
3623 BT_ERR("smp_h6 test failed");
64dd374e 3624 goto done;
fb2969a3
JH		 3625 }
3626
255047b0
MH		 3627 rettime = ktime_get();
3628 delta = ktime_sub(rettime, calltime);
3629 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
3630
5ced2464 3631 BT_INFO("SMP test passed in %llu usecs", duration);
0a2b0f04 3632
64dd374e
MH		 3633done:
3634 if (!err)
3635 snprintf(test_smp_buffer, sizeof(test_smp_buffer),
3636 "PASS (%llu usecs)\n", duration);
3637 else
3638 snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n");
3639
3640 debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL,
3641 &test_smp_fops);
3642
3643 return err;
0a2b0f04
JH		 3644}
3645
3646int __init bt_selftest_smp(void)
3647{
3648 struct crypto_blkcipher *tfm_aes;
3649 struct crypto_hash *tfm_cmac;
3650 int err;
3651
3652 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
3653 if (IS_ERR(tfm_aes)) {
3654 BT_ERR("Unable to create ECB crypto context");
3655 return PTR_ERR(tfm_aes);
3656 }
3657
3658 tfm_cmac = crypto_alloc_hash("cmac(aes)", 0, CRYPTO_ALG_ASYNC);
3659 if (IS_ERR(tfm_cmac)) {
3660 BT_ERR("Unable to create CMAC crypto context");
3661 crypto_free_blkcipher(tfm_aes);
3662 return PTR_ERR(tfm_cmac);
3663 }
3664
3665 err = run_selftests(tfm_aes, tfm_cmac);
3666
3667 crypto_free_hash(tfm_cmac);
3668 crypto_free_blkcipher(tfm_aes);
3669
3670 return err;
3671}
3672
3673#endif
Linux 6.x block layer and io_uring tree(s)