[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / smp.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
#include <net/bluetooth/l2cap.h>
#include <net/bluetooth/smp.h>

static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
						u16 dlen, void *data)
{
	struct sk_buff *skb;
	struct l2cap_hdr *lh;
	int len;

	len = L2CAP_HDR_SIZE + sizeof(code) + dlen;

	if (len > conn->mtu)
		return NULL;

	skb = bt_skb_alloc(len, GFP_ATOMIC);
	if (!skb)
		return NULL;

	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
	lh->len = cpu_to_le16(sizeof(code) + dlen);
	lh->cid = cpu_to_le16(L2CAP_CID_SMP);

	memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));

	memcpy(skb_put(skb, dlen), data, dlen);

	return skb;
}

static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
{
	struct sk_buff *skb = smp_build_cmd(conn, code, len, data);

	BT_DBG("code 0x%2.2x", code);

	if (!skb)
		return;

	hci_send_acl(conn->hcon, skb, 0);
}

static void smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
{
	struct smp_cmd_pairing *rp = (void *) skb->data;

	BT_DBG("conn %p", conn);

	skb_pull(skb, sizeof(*rp));

	rp->io_capability = 0x00;
	rp->oob_flag = 0x00;
	rp->max_key_size = 16;
	rp->init_key_dist = 0x00;
	rp->resp_key_dist = 0x00;
	rp->auth_req &= (SMP_AUTH_BONDING | SMP_AUTH_MITM);

	smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(*rp), rp);
}

static void smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
{
	struct smp_cmd_pairing_confirm cp;

	BT_DBG("conn %p", conn);

	memset(&cp, 0, sizeof(cp));

	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
}

static void smp_cmd_pairing_confirm(struct l2cap_conn *conn,
							struct sk_buff *skb)
{
	BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");

	if (conn->hcon->out) {
		struct smp_cmd_pairing_random random;

		memset(&random, 0, sizeof(random));

		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
								&random);
	} else {
		struct smp_cmd_pairing_confirm confirm;

		memset(&confirm, 0, sizeof(confirm));

		smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(confirm),
								&confirm);
	}
}

static void smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
{
	struct smp_cmd_pairing_random cp;

	BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");

	skb_pull(skb, sizeof(cp));

	if (conn->hcon->out) {
		/* FIXME: start encryption */
	} else {
		memset(&cp, 0, sizeof(cp));

		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(cp), &cp);
	}
}

static void smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
{
	struct smp_cmd_security_req *rp = (void *) skb->data;
	struct smp_cmd_pairing cp;

	BT_DBG("conn %p", conn);

	skb_pull(skb, sizeof(*rp));
	memset(&cp, 0, sizeof(cp));

	cp.io_capability = 0x00;
	cp.oob_flag = 0x00;
	cp.max_key_size = 16;
	cp.init_key_dist = 0x00;
	cp.resp_key_dist = 0x00;
	cp.auth_req = rp->auth_req & (SMP_AUTH_BONDING | SMP_AUTH_MITM);

	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
}

int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
{
	struct hci_conn *hcon = conn->hcon;
	__u8 authreq;

	BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);

	if (IS_ERR(hcon->hdev->tfm))
		return 1;

	switch (sec_level) {
	case BT_SECURITY_MEDIUM:
		/* Encrypted, no MITM protection */
		authreq = HCI_AT_NO_BONDING_MITM;
		break;

	case BT_SECURITY_HIGH:
		/* Bonding, MITM protection */
		authreq = HCI_AT_GENERAL_BONDING_MITM;
		break;

	case BT_SECURITY_LOW:
	default:
		return 1;
	}

	if (hcon->link_mode & HCI_LM_MASTER) {
		struct smp_cmd_pairing cp;
		cp.io_capability = 0x00;
		cp.oob_flag = 0x00;
		cp.max_key_size = 16;
		cp.init_key_dist = 0x00;
		cp.resp_key_dist = 0x00;
		cp.auth_req = authreq;
		smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
	} else {
		struct smp_cmd_security_req cp;
		cp.auth_req = authreq;
		smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
	}

	return 0;
}

int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
{
	__u8 code = skb->data[0];
	__u8 reason;
	int err = 0;

	if (IS_ERR(conn->hcon->hdev->tfm)) {
		err = PTR_ERR(conn->hcon->hdev->tfm);
		reason = SMP_PAIRING_NOTSUPP;
		goto done;
	}

	skb_pull(skb, sizeof(code));

	switch (code) {
	case SMP_CMD_PAIRING_REQ:
		smp_cmd_pairing_req(conn, skb);
		break;

	case SMP_CMD_PAIRING_FAIL:
		break;

	case SMP_CMD_PAIRING_RSP:
		smp_cmd_pairing_rsp(conn, skb);
		break;

	case SMP_CMD_SECURITY_REQ:
		smp_cmd_security_req(conn, skb);
		break;

	case SMP_CMD_PAIRING_CONFIRM:
		smp_cmd_pairing_confirm(conn, skb);
		break;

	case SMP_CMD_PAIRING_RANDOM:
		smp_cmd_pairing_random(conn, skb);
		break;

	case SMP_CMD_ENCRYPT_INFO:
	case SMP_CMD_MASTER_IDENT:
	case SMP_CMD_IDENT_INFO:
	case SMP_CMD_IDENT_ADDR_INFO:
	case SMP_CMD_SIGN_INFO:
	default:
		BT_DBG("Unknown command code 0x%2.2x", code);

		reason = SMP_CMD_NOTSUPP;
		err = -EOPNOTSUPP;
		goto done;
	}

done:
	if (reason)
		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
								&reason);

	kfree_skb(skb);
	return err;
}
Commit	Line	Data
eb492e01 AB	1	/*
	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
	4
	5	This program is free software; you can redistribute it and/or modify
	6	it under the terms of the GNU General Public License version 2 as
	7	published by the Free Software Foundation;
	8
	9	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	10	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	11	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	12	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
	13	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	14	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	15	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	16	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	17
	18	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
	19	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
	20	SOFTWARE IS DISCLAIMED.
	21	*/
	22
	23	#include <net/bluetooth/bluetooth.h>
	24	#include <net/bluetooth/hci_core.h>
	25	#include <net/bluetooth/l2cap.h>
	26	#include <net/bluetooth/smp.h>
	27
	28	static struct sk_buff smp_build_cmd(struct l2cap_conn conn, u8 code,
	29	u16 dlen, void *data)
	30	{
	31	struct sk_buff *skb;
	32	struct l2cap_hdr *lh;
	33	int len;
	34
	35	len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
	36
	37	if (len > conn->mtu)
	38	return NULL;
	39
	40	skb = bt_skb_alloc(len, GFP_ATOMIC);
	41	if (!skb)
	42	return NULL;
	43
	44	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
	45	lh->len = cpu_to_le16(sizeof(code) + dlen);
	46	lh->cid = cpu_to_le16(L2CAP_CID_SMP);
	47
	48	memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
	49
	50	memcpy(skb_put(skb, dlen), data, dlen);
	51
	52	return skb;
	53	}
	54
	55	static void smp_send_cmd(struct l2cap_conn conn, u8 code, u16 len, void data)
	56	{
	57	struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
	58
	59	BT_DBG("code 0x%2.2x", code);
	60
	61	if (!skb)
	62	return;
	63
	64	hci_send_acl(conn->hcon, skb, 0);
65	}
66
88ba43b6 AB	67	static void smp_cmd_pairing_req(struct l2cap_conn conn, struct sk_buff skb)
	68	{
	69	struct smp_cmd_pairing rp = (void ) skb->data;
	70
	71	BT_DBG("conn %p", conn);
	72
	73	skb_pull(skb, sizeof(*rp));
	74
	75	rp->io_capability = 0x00;
	76	rp->oob_flag = 0x00;
	77	rp->max_key_size = 16;
	78	rp->init_key_dist = 0x00;
	79	rp->resp_key_dist = 0x00;
	80	rp->auth_req &= (SMP_AUTH_BONDING \| SMP_AUTH_MITM);
	81
	82	smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(*rp), rp);
	83	}
	84
	85	static void smp_cmd_pairing_rsp(struct l2cap_conn conn, struct sk_buff skb)
	86	{
	87	struct smp_cmd_pairing_confirm cp;
	88
	89	BT_DBG("conn %p", conn);
	90
	91	memset(&cp, 0, sizeof(cp));
	92
	93	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
	94	}
	95
	96	static void smp_cmd_pairing_confirm(struct l2cap_conn *conn,
	97	struct sk_buff *skb)
	98	{
	99	BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
	100
	101	if (conn->hcon->out) {
	102	struct smp_cmd_pairing_random random;
	103
	104	memset(&random, 0, sizeof(random));
	105
	106	smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
	107	&random);
	108	} else {
	109	struct smp_cmd_pairing_confirm confirm;
	110
	111	memset(&confirm, 0, sizeof(confirm));
	112
	113	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(confirm),
	114	&confirm);
	115	}
	116	}
	117
	118	static void smp_cmd_pairing_random(struct l2cap_conn conn, struct sk_buff skb)
	119	{
	120	struct smp_cmd_pairing_random cp;
	121
	122	BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
	123
	124	skb_pull(skb, sizeof(cp));
	125
	126	if (conn->hcon->out) {
	127	/* FIXME: start encryption */
	128	} else {
	129	memset(&cp, 0, sizeof(cp));
	130
131	smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(cp), &cp);
132	}
133	}
134
135	static void smp_cmd_security_req(struct l2cap_conn conn, struct sk_buff skb)
136	{
137	struct smp_cmd_security_req rp = (void ) skb->data;
138	struct smp_cmd_pairing cp;
139
140	BT_DBG("conn %p", conn);
141
142	skb_pull(skb, sizeof(*rp));
143	memset(&cp, 0, sizeof(cp));
144
145	cp.io_capability = 0x00;
146	cp.oob_flag = 0x00;
147	cp.max_key_size = 16;
148	cp.init_key_dist = 0x00;
149	cp.resp_key_dist = 0x00;
150	cp.auth_req = rp->auth_req & (SMP_AUTH_BONDING \| SMP_AUTH_MITM);
151
152	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
153	}
154
eb492e01 AB	155	int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
eb492e01 AB	156	{
3a0259bb	157	struct hci_conn *hcon = conn->hcon;
eb492e01 AB	158	__u8 authreq;
eb492e01 AB	159
3a0259bb VCG	160	BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
	161
	162	if (IS_ERR(hcon->hdev->tfm))
	163	return 1;
eb492e01 AB	164
	165	switch (sec_level) {
	166	case BT_SECURITY_MEDIUM:
	167	/* Encrypted, no MITM protection */
	168	authreq = HCI_AT_NO_BONDING_MITM;
	169	break;
	170
	171	case BT_SECURITY_HIGH:
	172	/* Bonding, MITM protection */
	173	authreq = HCI_AT_GENERAL_BONDING_MITM;
	174	break;
	175
	176	case BT_SECURITY_LOW:
	177	default:
	178	return 1;
	179	}
	180
3a0259bb	181	if (hcon->link_mode & HCI_LM_MASTER) {
eb492e01 AB	182	struct smp_cmd_pairing cp;
	183	cp.io_capability = 0x00;
	184	cp.oob_flag = 0x00;
	185	cp.max_key_size = 16;
	186	cp.init_key_dist = 0x00;
	187	cp.resp_key_dist = 0x00;
	188	cp.auth_req = authreq;
	189	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
	190	} else {
	191	struct smp_cmd_security_req cp;
	192	cp.auth_req = authreq;
	193	smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
	194	}
	195
	196	return 0;
	197	}
	198
	199	int smp_sig_channel(struct l2cap_conn conn, struct sk_buff skb)
	200	{
	201	__u8 code = skb->data[0];
	202	__u8 reason;
	203	int err = 0;
	204
3a0259bb VCG	205	if (IS_ERR(conn->hcon->hdev->tfm)) {
	206	err = PTR_ERR(conn->hcon->hdev->tfm);
	207	reason = SMP_PAIRING_NOTSUPP;
	208	goto done;
	209	}
	210
eb492e01 AB	211	skb_pull(skb, sizeof(code));
	212
	213	switch (code) {
	214	case SMP_CMD_PAIRING_REQ:
88ba43b6	215	smp_cmd_pairing_req(conn, skb);
eb492e01 AB	216	break;
	217
	218	case SMP_CMD_PAIRING_FAIL:
	219	break;
	220
	221	case SMP_CMD_PAIRING_RSP:
88ba43b6 AB	222	smp_cmd_pairing_rsp(conn, skb);
	223	break;
	224
	225	case SMP_CMD_SECURITY_REQ:
	226	smp_cmd_security_req(conn, skb);
	227	break;
	228
eb492e01	229	case SMP_CMD_PAIRING_CONFIRM:
88ba43b6 AB	230	smp_cmd_pairing_confirm(conn, skb);
	231	break;
	232
eb492e01	233	case SMP_CMD_PAIRING_RANDOM:
88ba43b6 AB	234	smp_cmd_pairing_random(conn, skb);
	235	break;
	236
eb492e01 AB	237	case SMP_CMD_ENCRYPT_INFO:
	238	case SMP_CMD_MASTER_IDENT:
	239	case SMP_CMD_IDENT_INFO:
	240	case SMP_CMD_IDENT_ADDR_INFO:
	241	case SMP_CMD_SIGN_INFO:
eb492e01 AB	242	default:
	243	BT_DBG("Unknown command code 0x%2.2x", code);
	244
	245	reason = SMP_CMD_NOTSUPP;
eb492e01	246	err = -EOPNOTSUPP;
3a0259bb	247	goto done;
eb492e01 AB	248	}
eb492e01 AB	249
3a0259bb VCG	250	done:
	251	if (reason)
	252	smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
	253	&reason);
	254
eb492e01 AB	255	kfree_skb(skb);
	256	return err;
	257	}