projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: append new supported device to the list [0b05:17d0]
[linux-2.6-block.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
d22ef0bc 127static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 128 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
129 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 130{
131 u8 p1[16], p2[16];
132 int err;
133
134 memset(p1, 0, 16);
135
136 /* p1 = pres || preq || _rat || _iat */
137 swap56(pres, p1);
138 swap56(preq, p1 + 7);
139 p1[14] = _rat;
140 p1[15] = _iat;
141
142 memset(p2, 0, 16);
143
144 /* p2 = padding || ia || ra */
145 baswap((bdaddr_t *) (p2 + 4), ia);
146 baswap((bdaddr_t *) (p2 + 10), ra);
147
148 /* res = r XOR p1 */
149 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
150
151 /* res = e(k, res) */
152 err = smp_e(tfm, k, res);
153 if (err) {
154 BT_ERR("Encrypt data error");
155 return err;
156 }
157
158 /* res = res XOR p2 */
159 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
160
161 /* res = e(k, res) */
162 err = smp_e(tfm, k, res);
163 if (err)
164 BT_ERR("Encrypt data error");
165
166 return err;
167}
168
f1560463
MH		 169static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
170 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 171{
172 int err;
173
174 /* Just least significant octets from r1 and r2 are considered */
175 memcpy(_r, r1 + 8, 8);
176 memcpy(_r + 8, r2 + 8, 8);
177
178 err = smp_e(tfm, k, _r);
179 if (err)
180 BT_ERR("Encrypt data error");
181
182 return err;
183}
184
eb492e01 185static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 186 u16 dlen, void *data)
eb492e01
AB		 187{
188 struct sk_buff *skb;
189 struct l2cap_hdr *lh;
190 int len;
191
192 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
193
194 if (len > conn->mtu)
195 return NULL;
196
197 skb = bt_skb_alloc(len, GFP_ATOMIC);
198 if (!skb)
199 return NULL;
200
201 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
202 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 203 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 204
205 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
206
207 memcpy(skb_put(skb, dlen), data, dlen);
208
209 return skb;
210}
211
212static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
213{
214 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
215
216 BT_DBG("code 0x%2.2x", code);
217
218 if (!skb)
219 return;
220
73d80deb
LAD		 221 skb->priority = HCI_PRIO_MAX;
222 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 223
6c9d42a1 224 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 225 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 226}
227
2b64d153
BG		 228static __u8 authreq_to_seclevel(__u8 authreq)
229{
230 if (authreq & SMP_AUTH_MITM)
231 return BT_SECURITY_HIGH;
232 else
233 return BT_SECURITY_MEDIUM;
234}
235
236static __u8 seclevel_to_authreq(__u8 sec_level)
237{
238 switch (sec_level) {
239 case BT_SECURITY_HIGH:
240 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
241 case BT_SECURITY_MEDIUM:
242 return SMP_AUTH_BONDING;
243 default:
244 return SMP_AUTH_NONE;
245 }
246}
247
b8e66eac 248static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 249 struct smp_cmd_pairing *req,
250 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 251{
fd349c02
JH		 252 struct smp_chan *smp = conn->smp_chan;
253 struct hci_conn *hcon = conn->hcon;
254 struct hci_dev *hdev = hcon->hdev;
255 u8 local_dist = 0, remote_dist = 0;
54790f73 256
a8b2d5c2 257 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
fd349c02
JH		 258 local_dist = SMP_DIST_ENC_KEY;
259 remote_dist = SMP_DIST_ENC_KEY;
54790f73 260 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 261 } else {
262 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 263 }
264
fd349c02
JH		 265 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
266 remote_dist |= SMP_DIST_ID_KEY;
267
54790f73
VCG		 268 if (rsp == NULL) {
269 req->io_capability = conn->hcon->io_capability;
270 req->oob_flag = SMP_OOB_NOT_PRESENT;
271 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 272 req->init_key_dist = local_dist;
273 req->resp_key_dist = remote_dist;
065a13e2 274 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 275
276 smp->remote_key_dist = remote_dist;
54790f73
VCG		 277 return;
278 }
279
280 rsp->io_capability = conn->hcon->io_capability;
281 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
282 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 283 rsp->init_key_dist = req->init_key_dist & remote_dist;
284 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 285 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 286
287 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 288}
289
3158c50c
VCG		 290static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
291{
1c1def09
VCG		 292 struct smp_chan *smp = conn->smp_chan;
293
3158c50c 294 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 295 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 296 return SMP_ENC_KEY_SIZE;
297
f7aa611a 298 smp->enc_key_size = max_key_size;
3158c50c
VCG		 299
300 return 0;
301}
302
84794e11 303static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 304{
bab73cb6
JH		 305 struct hci_conn *hcon = conn->hcon;
306
84794e11 307 if (reason)
4f957a76 308 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 309 &reason);
4f957a76 310
ce39fb4e
MH		 311 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
312 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
313 HCI_ERROR_AUTH_FAILURE);
f1c09c07 314
61a0cfb0
AG		 315 cancel_delayed_work_sync(&conn->security_timer);
316
ce39fb4e 317 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 318 smp_chan_destroy(conn);
4f957a76
BG		 319}
320
2b64d153
BG		 321#define JUST_WORKS 0x00
322#define JUST_CFM 0x01
323#define REQ_PASSKEY 0x02
324#define CFM_PASSKEY 0x03
325#define REQ_OOB 0x04
326#define OVERLAP 0xFF
327
328static const u8 gen_method[5][5] = {
329 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
330 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
331 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
332 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
333 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
334};
335
336static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
337 u8 local_io, u8 remote_io)
338{
339 struct hci_conn *hcon = conn->hcon;
340 struct smp_chan *smp = conn->smp_chan;
341 u8 method;
342 u32 passkey = 0;
343 int ret = 0;
344
345 /* Initialize key for JUST WORKS */
346 memset(smp->tk, 0, sizeof(smp->tk));
347 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
348
349 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
350
351 /* If neither side wants MITM, use JUST WORKS */
352 /* If either side has unknown io_caps, use JUST WORKS */
353 /* Otherwise, look up method from the table */
354 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 355 local_io > SMP_IO_KEYBOARD_DISPLAY ||
356 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 357 method = JUST_WORKS;
358 else
b3ff53ff 359 method = gen_method[remote_io][local_io];
2b64d153
BG		 360
361 /* If not bonding, don't ask user to confirm a Zero TK */
362 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
363 method = JUST_WORKS;
364
365 /* If Just Works, Continue with Zero TK */
366 if (method == JUST_WORKS) {
367 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
368 return 0;
369 }
370
371 /* Not Just Works/Confirm results in MITM Authentication */
372 if (method != JUST_CFM)
373 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
374
375 /* If both devices have Keyoard-Display I/O, the master
376 * Confirms and the slave Enters the passkey.
377 */
378 if (method == OVERLAP) {
379 if (hcon->link_mode & HCI_LM_MASTER)
380 method = CFM_PASSKEY;
381 else
382 method = REQ_PASSKEY;
383 }
384
385 /* Generate random passkey. Not valid until confirmed. */
386 if (method == CFM_PASSKEY) {
387 u8 key[16];
388
389 memset(key, 0, sizeof(key));
390 get_random_bytes(&passkey, sizeof(passkey));
391 passkey %= 1000000;
392 put_unaligned_le32(passkey, key);
393 swap128(key, smp->tk);
394 BT_DBG("PassKey: %d", passkey);
395 }
396
397 hci_dev_lock(hcon->hdev);
398
399 if (method == REQ_PASSKEY)
ce39fb4e 400 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 401 hcon->type, hcon->dst_type);
2b64d153 402 else
ce39fb4e 403 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 404 hcon->type, hcon->dst_type,
2b64d153
BG		 405 cpu_to_le32(passkey), 0);
406
407 hci_dev_unlock(hcon->hdev);
408
409 return ret;
410}
411
8aab4757
VCG		 412static void confirm_work(struct work_struct *work)
413{
414 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
415 struct l2cap_conn *conn = smp->conn;
416 struct crypto_blkcipher *tfm;
417 struct smp_cmd_pairing_confirm cp;
418 int ret;
419 u8 res[16], reason;
420
421 BT_DBG("conn %p", conn);
422
423 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
424 if (IS_ERR(tfm)) {
425 reason = SMP_UNSPECIFIED;
426 goto error;
427 }
428
429 smp->tfm = tfm;
430
431 if (conn->hcon->out)
c8462ca6
MH		 432 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
433 conn->hcon->src_type, &conn->hcon->src,
434 conn->hcon->dst_type, &conn->hcon->dst, res);
8aab4757
VCG		 435 else
436 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
c8462ca6
MH		 437 conn->hcon->dst_type, &conn->hcon->dst,
438 conn->hcon->src_type, &conn->hcon->src, res);
8aab4757
VCG		 439 if (ret) {
440 reason = SMP_UNSPECIFIED;
441 goto error;
442 }
443
2b64d153
BG		 444 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
445
8aab4757
VCG		 446 swap128(res, cp.confirm_val);
447 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
448
449 return;
450
451error:
84794e11 452 smp_failure(conn, reason);
8aab4757
VCG		 453}
454
455static void random_work(struct work_struct *work)
456{
457 struct smp_chan *smp = container_of(work, struct smp_chan, random);
458 struct l2cap_conn *conn = smp->conn;
459 struct hci_conn *hcon = conn->hcon;
460 struct crypto_blkcipher *tfm = smp->tfm;
461 u8 reason, confirm[16], res[16], key[16];
462 int ret;
463
464 if (IS_ERR_OR_NULL(tfm)) {
465 reason = SMP_UNSPECIFIED;
466 goto error;
467 }
468
469 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
470
471 if (hcon->out)
c8462ca6
MH		 472 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
473 hcon->src_type, &hcon->src,
474 hcon->dst_type, &hcon->dst, res);
8aab4757
VCG		 475 else
476 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
c8462ca6
MH		 477 hcon->dst_type, &hcon->dst,
478 hcon->src_type, &hcon->src, res);
8aab4757
VCG		 479 if (ret) {
480 reason = SMP_UNSPECIFIED;
481 goto error;
482 }
483
484 swap128(res, confirm);
485
486 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
487 BT_ERR("Pairing failed (confirmation values mismatch)");
488 reason = SMP_CONFIRM_FAILED;
489 goto error;
490 }
491
492 if (hcon->out) {
493 u8 stk[16], rand[8];
494 __le16 ediv;
495
496 memset(rand, 0, sizeof(rand));
497 ediv = 0;
498
499 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
500 swap128(key, stk);
501
f7aa611a 502 memset(stk + smp->enc_key_size, 0,
04124681 503 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 504
51a8efd7 505 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 506 reason = SMP_UNSPECIFIED;
507 goto error;
508 }
509
510 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 511 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 512 } else {
513 u8 stk[16], r[16], rand[8];
514 __le16 ediv;
515
516 memset(rand, 0, sizeof(rand));
517 ediv = 0;
518
519 swap128(smp->prnd, r);
520 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
521
522 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
523 swap128(key, stk);
524
f7aa611a 525 memset(stk + smp->enc_key_size, 0,
f1560463 526 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 527
ce39fb4e 528 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
04124681
GP		 529 HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
530 ediv, rand);
8aab4757
VCG		 531 }
532
533 return;
534
535error:
84794e11 536 smp_failure(conn, reason);
8aab4757
VCG		 537}
538
539static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
540{
541 struct smp_chan *smp;
542
f1560463 543 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 544 if (!smp)
545 return NULL;
546
547 INIT_WORK(&smp->confirm, confirm_work);
548 INIT_WORK(&smp->random, random_work);
549
550 smp->conn = conn;
551 conn->smp_chan = smp;
2b64d153 552 conn->hcon->smp_conn = conn;
8aab4757
VCG		 553
554 hci_conn_hold(conn->hcon);
555
556 return smp;
557}
558
559void smp_chan_destroy(struct l2cap_conn *conn)
560{
c8eb9690
BG		 561 struct smp_chan *smp = conn->smp_chan;
562
f1c09c07 563 BUG_ON(!smp);
c8eb9690
BG		 564
565 if (smp->tfm)
566 crypto_free_blkcipher(smp->tfm);
567
568 kfree(smp);
569 conn->smp_chan = NULL;
2b64d153 570 conn->hcon->smp_conn = NULL;
76a68ba0 571 hci_conn_drop(conn->hcon);
8aab4757
VCG		 572}
573
2b64d153
BG		 574int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
575{
576 struct l2cap_conn *conn = hcon->smp_conn;
577 struct smp_chan *smp;
578 u32 value;
579 u8 key[16];
580
581 BT_DBG("");
582
583 if (!conn)
584 return -ENOTCONN;
585
586 smp = conn->smp_chan;
587
588 switch (mgmt_op) {
589 case MGMT_OP_USER_PASSKEY_REPLY:
590 value = le32_to_cpu(passkey);
591 memset(key, 0, sizeof(key));
592 BT_DBG("PassKey: %d", value);
593 put_unaligned_le32(value, key);
594 swap128(key, smp->tk);
595 /* Fall Through */
596 case MGMT_OP_USER_CONFIRM_REPLY:
597 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
598 break;
599 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
600 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 601 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 602 return 0;
603 default:
84794e11 604 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 605 return -EOPNOTSUPP;
606 }
607
608 /* If it is our turn to send Pairing Confirm, do so now */
609 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
610 queue_work(hcon->hdev->workqueue, &smp->confirm);
611
612 return 0;
613}
614
da85e5e5 615static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 616{
3158c50c 617 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 618 struct smp_chan *smp;
3158c50c 619 u8 key_size;
2b64d153 620 u8 auth = SMP_AUTH_NONE;
8aab4757 621 int ret;
88ba43b6
AB		 622
623 BT_DBG("conn %p", conn);
624
c46b98be
JH		 625 if (skb->len < sizeof(*req))
626 return SMP_UNSPECIFIED;
627
2b64d153
BG		 628 if (conn->hcon->link_mode & HCI_LM_MASTER)
629 return SMP_CMD_NOTSUPP;
630
51a8efd7 631 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 632 smp = smp_chan_create(conn);
d08fd0e7
AE		 633 else
634 smp = conn->smp_chan;
8aab4757 635
d08fd0e7
AE		 636 if (!smp)
637 return SMP_UNSPECIFIED;
d26a2345 638
1c1def09
VCG		 639 smp->preq[0] = SMP_CMD_PAIRING_REQ;
640 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 641 skb_pull(skb, sizeof(*req));
88ba43b6 642
2b64d153
BG		 643 /* We didn't start the pairing, so match remote */
644 if (req->auth_req & SMP_AUTH_BONDING)
645 auth = req->auth_req;
da85e5e5 646
fdde0a26
IY		 647 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
648
2b64d153 649 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 650
651 key_size = min(req->max_key_size, rsp.max_key_size);
652 if (check_enc_key_size(conn, key_size))
653 return SMP_ENC_KEY_SIZE;
88ba43b6 654
e84a6b13 655 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 656
1c1def09
VCG		 657 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
658 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 659
3158c50c 660 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 661
2b64d153
BG		 662 /* Request setup of TK */
663 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
664 if (ret)
665 return SMP_UNSPECIFIED;
666
da85e5e5 667 return 0;
88ba43b6
AB		 668}
669
da85e5e5 670static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 671{
3158c50c 672 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 673 struct smp_chan *smp = conn->smp_chan;
8aab4757 674 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 675 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 676 int ret;
88ba43b6
AB		 677
678 BT_DBG("conn %p", conn);
679
c46b98be
JH		 680 if (skb->len < sizeof(*rsp))
681 return SMP_UNSPECIFIED;
682
2b64d153
BG		 683 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
684 return SMP_CMD_NOTSUPP;
685
3158c50c
VCG		 686 skb_pull(skb, sizeof(*rsp));
687
1c1def09 688 req = (void *) &smp->preq[1];
da85e5e5 689
3158c50c
VCG		 690 key_size = min(req->max_key_size, rsp->max_key_size);
691 if (check_enc_key_size(conn, key_size))
692 return SMP_ENC_KEY_SIZE;
693
e84a6b13 694 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 695
8aab4757
VCG		 696 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
697 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 698
2b64d153 699 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 700 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 701 auth = SMP_AUTH_BONDING;
702
703 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
704
476585ec 705 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 706 if (ret)
707 return SMP_UNSPECIFIED;
708
709 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
710
711 /* Can't compose response until we have been confirmed */
712 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
713 return 0;
714
8aab4757 715 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 716
717 return 0;
88ba43b6
AB		 718}
719
da85e5e5 720static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 721{
1c1def09 722 struct smp_chan *smp = conn->smp_chan;
8aab4757 723 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 724
88ba43b6
AB		 725 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
726
c46b98be
JH		 727 if (skb->len < sizeof(smp->pcnf))
728 return SMP_UNSPECIFIED;
729
1c1def09
VCG		 730 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
731 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 732
7d24ddcc
AB		 733 if (conn->hcon->out) {
734 u8 random[16];
88ba43b6 735
1c1def09 736 swap128(smp->prnd, random);
88ba43b6 737 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 738 random);
2b64d153 739 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 740 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 741 } else {
742 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 743 }
da85e5e5
VCG		 744
745 return 0;
88ba43b6
AB		 746}
747
da85e5e5 748static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 749{
1c1def09 750 struct smp_chan *smp = conn->smp_chan;
8aab4757 751 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 752
8aab4757 753 BT_DBG("conn %p", conn);
3158c50c 754
c46b98be
JH		 755 if (skb->len < sizeof(smp->rrnd))
756 return SMP_UNSPECIFIED;
757
8aab4757
VCG		 758 swap128(skb->data, smp->rrnd);
759 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 760
8aab4757 761 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 762
763 return 0;
88ba43b6
AB		 764}
765
4dab7864 766static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 767{
c9839a11 768 struct smp_ltk *key;
988c5997
VCG		 769 struct hci_conn *hcon = conn->hcon;
770
98a0b845
JH		 771 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
772 hcon->out);
988c5997
VCG		 773 if (!key)
774 return 0;
775
4dab7864
JH		 776 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
777 return 0;
778
51a8efd7 779 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 780 return 1;
781
c9839a11
VCG		 782 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
783 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 784
785 return 1;
988c5997 786}
f1560463 787
da85e5e5 788static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 789{
790 struct smp_cmd_security_req *rp = (void *) skb->data;
791 struct smp_cmd_pairing cp;
f1cb9af5 792 struct hci_conn *hcon = conn->hcon;
8aab4757 793 struct smp_chan *smp;
88ba43b6
AB		 794
795 BT_DBG("conn %p", conn);
796
c46b98be
JH		 797 if (skb->len < sizeof(*rp))
798 return SMP_UNSPECIFIED;
799
86ca9eac
JH		 800 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
801 return SMP_CMD_NOTSUPP;
802
2b64d153 803 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 804
4dab7864 805 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 806 return 0;
807
51a8efd7 808 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 809 return 0;
f1cb9af5 810
8aab4757 811 smp = smp_chan_create(conn);
d26a2345 812
88ba43b6 813 skb_pull(skb, sizeof(*rp));
88ba43b6 814
da85e5e5 815 memset(&cp, 0, sizeof(cp));
54790f73 816 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 817
1c1def09
VCG		 818 smp->preq[0] = SMP_CMD_PAIRING_REQ;
819 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 820
88ba43b6 821 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 822
da85e5e5 823 return 0;
88ba43b6
AB		 824}
825
ad32a2f5
JH		 826bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
827{
828 if (sec_level == BT_SECURITY_LOW)
829 return true;
830
831 if (hcon->sec_level >= sec_level)
832 return true;
833
834 return false;
835}
836
cc110922 837int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 838{
cc110922 839 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 840 struct smp_chan *smp = conn->smp_chan;
2b64d153 841 __u8 authreq;
eb492e01 842
3a0259bb
VCG		 843 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
844
757aee0f 845 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 846 return 1;
847
ad32a2f5 848 if (smp_sufficient_security(hcon, sec_level))
eb492e01 849 return 1;
f1cb9af5 850
988c5997 851 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 852 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 853 goto done;
d26a2345 854
51a8efd7 855 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 856 return 0;
857
8aab4757 858 smp = smp_chan_create(conn);
2b64d153
BG		 859 if (!smp)
860 return 1;
861
862 authreq = seclevel_to_authreq(sec_level);
d26a2345 863
d26a2345
VCG		 864 if (hcon->link_mode & HCI_LM_MASTER) {
865 struct smp_cmd_pairing cp;
f01ead31 866
2b64d153 867 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 868 smp->preq[0] = SMP_CMD_PAIRING_REQ;
869 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 870
eb492e01
AB		 871 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
872 } else {
873 struct smp_cmd_security_req cp;
2b64d153 874 cp.auth_req = authreq;
eb492e01
AB		 875 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
876 }
877
02bc7455 878done:
f1cb9af5 879 hcon->pending_sec_level = sec_level;
f1cb9af5 880
eb492e01
AB		 881 return 0;
882}
883
7034b911
VCG		 884static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
885{
16b90839 886 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 887 struct smp_chan *smp = conn->smp_chan;
16b90839 888
c46b98be
JH		 889 BT_DBG("conn %p", conn);
890
891 if (skb->len < sizeof(*rp))
892 return SMP_UNSPECIFIED;
893
6131ddc8
JH		 894 /* Ignore this PDU if it wasn't requested */
895 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
896 return 0;
897
16b90839
VCG		 898 skb_pull(skb, sizeof(*rp));
899
1c1def09 900 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 901
7034b911
VCG		 902 return 0;
903}
904
905static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
906{
16b90839 907 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 908 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 909 struct hci_dev *hdev = conn->hcon->hdev;
910 struct hci_conn *hcon = conn->hcon;
911 u8 authenticated;
16b90839 912
c46b98be
JH		 913 BT_DBG("conn %p", conn);
914
915 if (skb->len < sizeof(*rp))
916 return SMP_UNSPECIFIED;
917
6131ddc8
JH		 918 /* Ignore this PDU if it wasn't requested */
919 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
920 return 0;
921
16b90839 922 skb_pull(skb, sizeof(*rp));
7034b911 923
c9839a11 924 hci_dev_lock(hdev);
ce39fb4e
MH		 925 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
926 hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK, 1,
927 authenticated, smp->tk, smp->enc_key_size,
04124681 928 rp->ediv, rp->rand);
fd349c02
JH		 929 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
930 smp_distribute_keys(conn, 1);
c9839a11 931 hci_dev_unlock(hdev);
7034b911
VCG		 932
933 return 0;
934}
935
fd349c02
JH		 936static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
937{
938 struct smp_cmd_ident_info *info = (void *) skb->data;
939 struct smp_chan *smp = conn->smp_chan;
940
941 BT_DBG("");
942
943 if (skb->len < sizeof(*info))
944 return SMP_UNSPECIFIED;
945
6131ddc8
JH		 946 /* Ignore this PDU if it wasn't requested */
947 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
948 return 0;
949
fd349c02
JH		 950 skb_pull(skb, sizeof(*info));
951
952 memcpy(smp->irk, info->irk, 16);
953
954 return 0;
955}
956
957static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
958 struct sk_buff *skb)
959{
960 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
961 struct smp_chan *smp = conn->smp_chan;
962 struct hci_conn *hcon = conn->hcon;
963 bdaddr_t rpa;
964
965 BT_DBG("");
966
967 if (skb->len < sizeof(*info))
968 return SMP_UNSPECIFIED;
969
6131ddc8
JH		 970 /* Ignore this PDU if it wasn't requested */
971 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
972 return 0;
973
fd349c02
JH		 974 skb_pull(skb, sizeof(*info));
975
976 bacpy(&smp->id_addr, &info->bdaddr);
977 smp->id_addr_type = info->addr_type;
978
979 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
980 bacpy(&rpa, &hcon->dst);
981 else
982 bacpy(&rpa, BDADDR_ANY);
983
984 hci_add_irk(conn->hcon->hdev, &smp->id_addr, smp->id_addr_type,
985 smp->irk, &rpa);
986
987 smp_distribute_keys(conn, 1);
988
989 return 0;
990}
991
eb492e01
AB		 992int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
993{
7b9899db 994 struct hci_conn *hcon = conn->hcon;
92381f5c 995 __u8 code, reason;
eb492e01
AB		 996 int err = 0;
997
7b9899db
MH		 998 if (hcon->type != LE_LINK) {
999 kfree_skb(skb);
3432711f 1000 return 0;
7b9899db
MH		 1001 }
1002
92381f5c
MH		 1003 if (skb->len < 1) {
1004 kfree_skb(skb);
1005 return -EILSEQ;
1006 }
1007
06ae3314 1008 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1009 err = -ENOTSUPP;
1010 reason = SMP_PAIRING_NOTSUPP;
1011 goto done;
1012 }
1013
92381f5c 1014 code = skb->data[0];
eb492e01
AB		 1015 skb_pull(skb, sizeof(code));
1016
8cf9fa12
JH		 1017 /*
1018 * The SMP context must be initialized for all other PDUs except
1019 * pairing and security requests. If we get any other PDU when
1020 * not initialized simply disconnect (done if this function
1021 * returns an error).
1022 */
1023 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1024 !conn->smp_chan) {
1025 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1026 kfree_skb(skb);
1027 return -ENOTSUPP;
1028 }
1029
eb492e01
AB		 1030 switch (code) {
1031 case SMP_CMD_PAIRING_REQ:
da85e5e5 1032 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1033 break;
1034
1035 case SMP_CMD_PAIRING_FAIL:
84794e11 1036 smp_failure(conn, 0);
da85e5e5
VCG		 1037 reason = 0;
1038 err = -EPERM;
eb492e01
AB		 1039 break;
1040
1041 case SMP_CMD_PAIRING_RSP:
da85e5e5 1042 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1043 break;
1044
1045 case SMP_CMD_SECURITY_REQ:
da85e5e5 1046 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1047 break;
1048
eb492e01 1049 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1050 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1051 break;
1052
eb492e01 1053 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1054 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1055 break;
1056
eb492e01 1057 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1058 reason = smp_cmd_encrypt_info(conn, skb);
1059 break;
1060
eb492e01 1061 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1062 reason = smp_cmd_master_ident(conn, skb);
1063 break;
1064
eb492e01 1065 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1066 reason = smp_cmd_ident_info(conn, skb);
1067 break;
1068
eb492e01 1069 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1070 reason = smp_cmd_ident_addr_info(conn, skb);
1071 break;
1072
eb492e01 1073 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 1074 /* Just ignored */
1075 reason = 0;
1076 break;
1077
eb492e01
AB		 1078 default:
1079 BT_DBG("Unknown command code 0x%2.2x", code);
1080
1081 reason = SMP_CMD_NOTSUPP;
eb492e01 1082 err = -EOPNOTSUPP;
3a0259bb 1083 goto done;
eb492e01
AB		 1084 }
1085
3a0259bb
VCG		 1086done:
1087 if (reason)
84794e11 1088 smp_failure(conn, reason);
3a0259bb 1089
eb492e01
AB		 1090 kfree_skb(skb);
1091 return err;
1092}
7034b911
VCG		 1093
1094int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
1095{
1096 struct smp_cmd_pairing *req, *rsp;
1c1def09 1097 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 1098 __u8 *keydist;
1099
1100 BT_DBG("conn %p force %d", conn, force);
1101
51a8efd7 1102 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
d26a2345
VCG		 1103 return 0;
1104
1c1def09 1105 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1106
1107 /* The responder sends its keys first */
1108 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
1109 return 0;
1110
1c1def09 1111 req = (void *) &smp->preq[1];
7034b911
VCG		 1112
1113 if (conn->hcon->out) {
1114 keydist = &rsp->init_key_dist;
1115 *keydist &= req->init_key_dist;
1116 } else {
1117 keydist = &rsp->resp_key_dist;
1118 *keydist &= req->resp_key_dist;
1119 }
1120
7034b911
VCG		 1121 BT_DBG("keydist 0x%x", *keydist);
1122
1123 if (*keydist & SMP_DIST_ENC_KEY) {
1124 struct smp_cmd_encrypt_info enc;
1125 struct smp_cmd_master_ident ident;
c9839a11
VCG		 1126 struct hci_conn *hcon = conn->hcon;
1127 u8 authenticated;
7034b911
VCG		 1128 __le16 ediv;
1129
1130 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1131 get_random_bytes(&ediv, sizeof(ediv));
1132 get_random_bytes(ident.rand, sizeof(ident.rand));
1133
1134 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1135
c9839a11 1136 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
ce39fb4e 1137 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
04124681
GP		 1138 HCI_SMP_LTK_SLAVE, 1, authenticated,
1139 enc.ltk, smp->enc_key_size, ediv, ident.rand);
16b90839 1140
58115373 1141 ident.ediv = ediv;
7034b911
VCG		 1142
1143 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1144
1145 *keydist &= ~SMP_DIST_ENC_KEY;
1146 }
1147
1148 if (*keydist & SMP_DIST_ID_KEY) {
1149 struct smp_cmd_ident_addr_info addrinfo;
1150 struct smp_cmd_ident_info idinfo;
1151
1152 /* Send a dummy key */
1153 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
1154
1155 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1156
1157 /* Just public address */
1158 memset(&addrinfo, 0, sizeof(addrinfo));
2b36a562 1159 bacpy(&addrinfo.bdaddr, &conn->hcon->src);
7034b911
VCG		 1160
1161 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1162 &addrinfo);
7034b911
VCG		 1163
1164 *keydist &= ~SMP_DIST_ID_KEY;
1165 }
1166
1167 if (*keydist & SMP_DIST_SIGN) {
1168 struct smp_cmd_sign_info sign;
1169
1170 /* Send a dummy key */
1171 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1172
1173 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1174
1175 *keydist &= ~SMP_DIST_SIGN;
1176 }
1177
b7d448d7 1178 if (conn->hcon->out || force || !(rsp->init_key_dist & 0x07)) {
51a8efd7 1179 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6c9d42a1 1180 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1181 smp_chan_destroy(conn);
d26a2345
VCG		 1182 }
1183
7034b911
VCG		 1184 return 0;
1185}
Linux 6.x block layer and io_uring tree(s)