projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add new structures for handling SMP Long Term Keys
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
23#include <net/bluetooth/bluetooth.h>
24#include <net/bluetooth/hci_core.h>
25#include <net/bluetooth/l2cap.h>
2b64d153 26#include <net/bluetooth/mgmt.h>
eb492e01 27#include <net/bluetooth/smp.h>
d22ef0bc 28#include <linux/crypto.h>
f70490e6 29#include <linux/scatterlist.h>
d22ef0bc
AB		 30#include <crypto/b128ops.h>
31
5d3de7df
VCG		 32#define SMP_TIMEOUT 30000 /* 30 seconds */
33
d22ef0bc
AB		 34static inline void swap128(u8 src[16], u8 dst[16])
35{
36 int i;
37 for (i = 0; i < 16; i++)
38 dst[15 - i] = src[i];
39}
40
41static inline void swap56(u8 src[7], u8 dst[7])
42{
43 int i;
44 for (i = 0; i < 7; i++)
45 dst[6 - i] = src[i];
46}
47
48static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
49{
50 struct blkcipher_desc desc;
51 struct scatterlist sg;
52 int err, iv_len;
53 unsigned char iv[128];
54
55 if (tfm == NULL) {
56 BT_ERR("tfm %p", tfm);
57 return -EINVAL;
58 }
59
60 desc.tfm = tfm;
61 desc.flags = 0;
62
63 err = crypto_blkcipher_setkey(tfm, k, 16);
64 if (err) {
65 BT_ERR("cipher setkey failed: %d", err);
66 return err;
67 }
68
69 sg_init_one(&sg, r, 16);
70
71 iv_len = crypto_blkcipher_ivsize(tfm);
72 if (iv_len) {
73 memset(&iv, 0xff, iv_len);
74 crypto_blkcipher_set_iv(tfm, iv, iv_len);
75 }
76
77 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
78 if (err)
79 BT_ERR("Encrypt data error %d", err);
80
81 return err;
82}
83
84static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
85 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
86 u8 _rat, bdaddr_t *ra, u8 res[16])
87{
88 u8 p1[16], p2[16];
89 int err;
90
91 memset(p1, 0, 16);
92
93 /* p1 = pres || preq || _rat || _iat */
94 swap56(pres, p1);
95 swap56(preq, p1 + 7);
96 p1[14] = _rat;
97 p1[15] = _iat;
98
99 memset(p2, 0, 16);
100
101 /* p2 = padding || ia || ra */
102 baswap((bdaddr_t *) (p2 + 4), ia);
103 baswap((bdaddr_t *) (p2 + 10), ra);
104
105 /* res = r XOR p1 */
106 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
107
108 /* res = e(k, res) */
109 err = smp_e(tfm, k, res);
110 if (err) {
111 BT_ERR("Encrypt data error");
112 return err;
113 }
114
115 /* res = res XOR p2 */
116 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
117
118 /* res = e(k, res) */
119 err = smp_e(tfm, k, res);
120 if (err)
121 BT_ERR("Encrypt data error");
122
123 return err;
124}
125
126static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16],
127 u8 r1[16], u8 r2[16], u8 _r[16])
128{
129 int err;
130
131 /* Just least significant octets from r1 and r2 are considered */
132 memcpy(_r, r1 + 8, 8);
133 memcpy(_r + 8, r2 + 8, 8);
134
135 err = smp_e(tfm, k, _r);
136 if (err)
137 BT_ERR("Encrypt data error");
138
139 return err;
140}
141
142static int smp_rand(u8 *buf)
143{
144 get_random_bytes(buf, 16);
145
146 return 0;
147}
eb492e01
AB		 148
149static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
150 u16 dlen, void *data)
151{
152 struct sk_buff *skb;
153 struct l2cap_hdr *lh;
154 int len;
155
156 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
157
158 if (len > conn->mtu)
159 return NULL;
160
161 skb = bt_skb_alloc(len, GFP_ATOMIC);
162 if (!skb)
163 return NULL;
164
165 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
166 lh->len = cpu_to_le16(sizeof(code) + dlen);
167 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
168
169 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
170
171 memcpy(skb_put(skb, dlen), data, dlen);
172
173 return skb;
174}
175
176static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
177{
178 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
179
180 BT_DBG("code 0x%2.2x", code);
181
182 if (!skb)
183 return;
184
73d80deb
LAD		 185 skb->priority = HCI_PRIO_MAX;
186 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 187
6c9d42a1
GP		 188 cancel_delayed_work_sync(&conn->security_timer);
189 schedule_delayed_work(&conn->security_timer,
e2dcd113 190 msecs_to_jiffies(SMP_TIMEOUT));
eb492e01
AB		 191}
192
2b64d153
BG		 193static __u8 authreq_to_seclevel(__u8 authreq)
194{
195 if (authreq & SMP_AUTH_MITM)
196 return BT_SECURITY_HIGH;
197 else
198 return BT_SECURITY_MEDIUM;
199}
200
201static __u8 seclevel_to_authreq(__u8 sec_level)
202{
203 switch (sec_level) {
204 case BT_SECURITY_HIGH:
205 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
206 case BT_SECURITY_MEDIUM:
207 return SMP_AUTH_BONDING;
208 default:
209 return SMP_AUTH_NONE;
210 }
211}
212
b8e66eac 213static void build_pairing_cmd(struct l2cap_conn *conn,
54790f73
VCG		 214 struct smp_cmd_pairing *req,
215 struct smp_cmd_pairing *rsp,
216 __u8 authreq)
b8e66eac 217{
2b64d153 218 u8 dist_keys = 0;
54790f73 219
a8b2d5c2 220 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
ca10b5ee 221 dist_keys = SMP_DIST_ENC_KEY;
54790f73 222 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 223 } else {
224 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 225 }
226
227 if (rsp == NULL) {
228 req->io_capability = conn->hcon->io_capability;
229 req->oob_flag = SMP_OOB_NOT_PRESENT;
230 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 231 req->init_key_dist = 0;
54790f73
VCG		 232 req->resp_key_dist = dist_keys;
233 req->auth_req = authreq;
234 return;
235 }
236
237 rsp->io_capability = conn->hcon->io_capability;
238 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
239 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 240 rsp->init_key_dist = 0;
54790f73
VCG		 241 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
242 rsp->auth_req = authreq;
b8e66eac
VCG		 243}
244
3158c50c
VCG		 245static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
246{
1c1def09
VCG		 247 struct smp_chan *smp = conn->smp_chan;
248
3158c50c
VCG		 249 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
250 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
251 return SMP_ENC_KEY_SIZE;
252
f7aa611a 253 smp->enc_key_size = max_key_size;
3158c50c
VCG		 254
255 return 0;
256}
257
4f957a76
BG		 258static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
259{
260 if (send)
261 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
262 &reason);
263
51a8efd7 264 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags);
4f957a76 265 mgmt_auth_failed(conn->hcon->hdev, conn->dst, reason);
f1c09c07
VCG		 266
267 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
268 cancel_delayed_work_sync(&conn->security_timer);
269 smp_chan_destroy(conn);
270 }
4f957a76
BG		 271}
272
2b64d153
BG		 273#define JUST_WORKS 0x00
274#define JUST_CFM 0x01
275#define REQ_PASSKEY 0x02
276#define CFM_PASSKEY 0x03
277#define REQ_OOB 0x04
278#define OVERLAP 0xFF
279
280static const u8 gen_method[5][5] = {
281 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
282 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
283 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
284 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
285 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
286};
287
288static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
289 u8 local_io, u8 remote_io)
290{
291 struct hci_conn *hcon = conn->hcon;
292 struct smp_chan *smp = conn->smp_chan;
293 u8 method;
294 u32 passkey = 0;
295 int ret = 0;
296
297 /* Initialize key for JUST WORKS */
298 memset(smp->tk, 0, sizeof(smp->tk));
299 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
300
301 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
302
303 /* If neither side wants MITM, use JUST WORKS */
304 /* If either side has unknown io_caps, use JUST WORKS */
305 /* Otherwise, look up method from the table */
306 if (!(auth & SMP_AUTH_MITM) ||
307 local_io > SMP_IO_KEYBOARD_DISPLAY ||
308 remote_io > SMP_IO_KEYBOARD_DISPLAY)
309 method = JUST_WORKS;
310 else
311 method = gen_method[local_io][remote_io];
312
313 /* If not bonding, don't ask user to confirm a Zero TK */
314 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
315 method = JUST_WORKS;
316
317 /* If Just Works, Continue with Zero TK */
318 if (method == JUST_WORKS) {
319 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
320 return 0;
321 }
322
323 /* Not Just Works/Confirm results in MITM Authentication */
324 if (method != JUST_CFM)
325 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
326
327 /* If both devices have Keyoard-Display I/O, the master
328 * Confirms and the slave Enters the passkey.
329 */
330 if (method == OVERLAP) {
331 if (hcon->link_mode & HCI_LM_MASTER)
332 method = CFM_PASSKEY;
333 else
334 method = REQ_PASSKEY;
335 }
336
337 /* Generate random passkey. Not valid until confirmed. */
338 if (method == CFM_PASSKEY) {
339 u8 key[16];
340
341 memset(key, 0, sizeof(key));
342 get_random_bytes(&passkey, sizeof(passkey));
343 passkey %= 1000000;
344 put_unaligned_le32(passkey, key);
345 swap128(key, smp->tk);
346 BT_DBG("PassKey: %d", passkey);
347 }
348
349 hci_dev_lock(hcon->hdev);
350
351 if (method == REQ_PASSKEY)
352 ret = mgmt_user_passkey_request(hcon->hdev, conn->dst);
353 else
354 ret = mgmt_user_confirm_request(hcon->hdev, conn->dst,
355 cpu_to_le32(passkey), 0);
356
357 hci_dev_unlock(hcon->hdev);
358
359 return ret;
360}
361
8aab4757
VCG		 362static void confirm_work(struct work_struct *work)
363{
364 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
365 struct l2cap_conn *conn = smp->conn;
366 struct crypto_blkcipher *tfm;
367 struct smp_cmd_pairing_confirm cp;
368 int ret;
369 u8 res[16], reason;
370
371 BT_DBG("conn %p", conn);
372
373 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
374 if (IS_ERR(tfm)) {
375 reason = SMP_UNSPECIFIED;
376 goto error;
377 }
378
379 smp->tfm = tfm;
380
381 if (conn->hcon->out)
382 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 0,
383 conn->src, conn->hcon->dst_type, conn->dst,
384 res);
385 else
386 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
387 conn->hcon->dst_type, conn->dst, 0, conn->src,
388 res);
389 if (ret) {
390 reason = SMP_UNSPECIFIED;
391 goto error;
392 }
393
2b64d153
BG		 394 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
395
8aab4757
VCG		 396 swap128(res, cp.confirm_val);
397 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
398
399 return;
400
401error:
4f957a76 402 smp_failure(conn, reason, 1);
8aab4757
VCG		 403}
404
405static void random_work(struct work_struct *work)
406{
407 struct smp_chan *smp = container_of(work, struct smp_chan, random);
408 struct l2cap_conn *conn = smp->conn;
409 struct hci_conn *hcon = conn->hcon;
410 struct crypto_blkcipher *tfm = smp->tfm;
411 u8 reason, confirm[16], res[16], key[16];
412 int ret;
413
414 if (IS_ERR_OR_NULL(tfm)) {
415 reason = SMP_UNSPECIFIED;
416 goto error;
417 }
418
419 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
420
421 if (hcon->out)
422 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 0,
423 conn->src, hcon->dst_type, conn->dst,
424 res);
425 else
426 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
427 hcon->dst_type, conn->dst, 0, conn->src,
428 res);
429 if (ret) {
430 reason = SMP_UNSPECIFIED;
431 goto error;
432 }
433
434 swap128(res, confirm);
435
436 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
437 BT_ERR("Pairing failed (confirmation values mismatch)");
438 reason = SMP_CONFIRM_FAILED;
439 goto error;
440 }
441
442 if (hcon->out) {
443 u8 stk[16], rand[8];
444 __le16 ediv;
445
446 memset(rand, 0, sizeof(rand));
447 ediv = 0;
448
449 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
450 swap128(key, stk);
451
f7aa611a
VCG		 452 memset(stk + smp->enc_key_size, 0,
453 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 454
51a8efd7 455 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 456 reason = SMP_UNSPECIFIED;
457 goto error;
458 }
459
460 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 461 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 462 } else {
463 u8 stk[16], r[16], rand[8];
464 __le16 ediv;
465
466 memset(rand, 0, sizeof(rand));
467 ediv = 0;
468
469 swap128(smp->prnd, r);
470 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
471
472 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
473 swap128(key, stk);
474
f7aa611a
VCG		 475 memset(stk + smp->enc_key_size, 0,
476 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 477
f7aa611a 478 hci_add_ltk(hcon->hdev, 0, conn->dst, smp->enc_key_size,
8aab4757
VCG		 479 ediv, rand, stk);
480 }
481
482 return;
483
484error:
4f957a76 485 smp_failure(conn, reason, 1);
8aab4757
VCG		 486}
487
488static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
489{
490 struct smp_chan *smp;
491
492 smp = kzalloc(sizeof(struct smp_chan), GFP_ATOMIC);
493 if (!smp)
494 return NULL;
495
496 INIT_WORK(&smp->confirm, confirm_work);
497 INIT_WORK(&smp->random, random_work);
498
499 smp->conn = conn;
500 conn->smp_chan = smp;
2b64d153 501 conn->hcon->smp_conn = conn;
8aab4757
VCG		 502
503 hci_conn_hold(conn->hcon);
504
505 return smp;
506}
507
508void smp_chan_destroy(struct l2cap_conn *conn)
509{
c8eb9690
BG		 510 struct smp_chan *smp = conn->smp_chan;
511
f1c09c07 512 BUG_ON(!smp);
c8eb9690
BG		 513
514 if (smp->tfm)
515 crypto_free_blkcipher(smp->tfm);
516
517 kfree(smp);
518 conn->smp_chan = NULL;
2b64d153 519 conn->hcon->smp_conn = NULL;
8aab4757
VCG		 520 hci_conn_put(conn->hcon);
521}
522
2b64d153
BG		 523int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
524{
525 struct l2cap_conn *conn = hcon->smp_conn;
526 struct smp_chan *smp;
527 u32 value;
528 u8 key[16];
529
530 BT_DBG("");
531
532 if (!conn)
533 return -ENOTCONN;
534
535 smp = conn->smp_chan;
536
537 switch (mgmt_op) {
538 case MGMT_OP_USER_PASSKEY_REPLY:
539 value = le32_to_cpu(passkey);
540 memset(key, 0, sizeof(key));
541 BT_DBG("PassKey: %d", value);
542 put_unaligned_le32(value, key);
543 swap128(key, smp->tk);
544 /* Fall Through */
545 case MGMT_OP_USER_CONFIRM_REPLY:
546 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
547 break;
548 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
549 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
550 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
551 return 0;
552 default:
553 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
554 return -EOPNOTSUPP;
555 }
556
557 /* If it is our turn to send Pairing Confirm, do so now */
558 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
559 queue_work(hcon->hdev->workqueue, &smp->confirm);
560
561 return 0;
562}
563
da85e5e5 564static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 565{
3158c50c 566 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 567 struct smp_chan *smp;
3158c50c 568 u8 key_size;
2b64d153 569 u8 auth = SMP_AUTH_NONE;
8aab4757 570 int ret;
88ba43b6
AB		 571
572 BT_DBG("conn %p", conn);
573
2b64d153
BG		 574 if (conn->hcon->link_mode & HCI_LM_MASTER)
575 return SMP_CMD_NOTSUPP;
576
51a8efd7 577 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757
VCG		 578 smp = smp_chan_create(conn);
579
580 smp = conn->smp_chan;
d26a2345 581
1c1def09
VCG		 582 smp->preq[0] = SMP_CMD_PAIRING_REQ;
583 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 584 skb_pull(skb, sizeof(*req));
88ba43b6 585
2b64d153
BG		 586 /* We didn't start the pairing, so match remote */
587 if (req->auth_req & SMP_AUTH_BONDING)
588 auth = req->auth_req;
da85e5e5 589
2b64d153 590 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 591
592 key_size = min(req->max_key_size, rsp.max_key_size);
593 if (check_enc_key_size(conn, key_size))
594 return SMP_ENC_KEY_SIZE;
88ba43b6 595
8aab4757
VCG		 596 ret = smp_rand(smp->prnd);
597 if (ret)
598 return SMP_UNSPECIFIED;
599
1c1def09
VCG		 600 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
601 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 602
3158c50c 603 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 604
2b64d153
BG		 605 /* Request setup of TK */
606 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
607 if (ret)
608 return SMP_UNSPECIFIED;
609
da85e5e5 610 return 0;
88ba43b6
AB		 611}
612
da85e5e5 613static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 614{
3158c50c 615 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 616 struct smp_chan *smp = conn->smp_chan;
8aab4757 617 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 618 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 619 int ret;
88ba43b6
AB		 620
621 BT_DBG("conn %p", conn);
622
2b64d153
BG		 623 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
624 return SMP_CMD_NOTSUPP;
625
3158c50c
VCG		 626 skb_pull(skb, sizeof(*rsp));
627
1c1def09 628 req = (void *) &smp->preq[1];
da85e5e5 629
3158c50c
VCG		 630 key_size = min(req->max_key_size, rsp->max_key_size);
631 if (check_enc_key_size(conn, key_size))
632 return SMP_ENC_KEY_SIZE;
633
1c1def09 634 ret = smp_rand(smp->prnd);
7d24ddcc 635 if (ret)
da85e5e5 636 return SMP_UNSPECIFIED;
7d24ddcc 637
8aab4757
VCG		 638 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
639 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 640
2b64d153
BG		 641 if ((req->auth_req & SMP_AUTH_BONDING) &&
642 (rsp->auth_req & SMP_AUTH_BONDING))
643 auth = SMP_AUTH_BONDING;
644
645 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
646
647 ret = tk_request(conn, 0, auth, rsp->io_capability, req->io_capability);
648 if (ret)
649 return SMP_UNSPECIFIED;
650
651 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
652
653 /* Can't compose response until we have been confirmed */
654 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
655 return 0;
656
8aab4757 657 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 658
659 return 0;
88ba43b6
AB		 660}
661
da85e5e5 662static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 663{
1c1def09 664 struct smp_chan *smp = conn->smp_chan;
8aab4757 665 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 666
88ba43b6
AB		 667 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
668
1c1def09
VCG		 669 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
670 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 671
7d24ddcc
AB		 672 if (conn->hcon->out) {
673 u8 random[16];
88ba43b6 674
1c1def09 675 swap128(smp->prnd, random);
88ba43b6 676 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
7d24ddcc 677 random);
2b64d153 678 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 679 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 680 } else {
681 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 682 }
da85e5e5
VCG		 683
684 return 0;
88ba43b6
AB		 685}
686
da85e5e5 687static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 688{
1c1def09 689 struct smp_chan *smp = conn->smp_chan;
8aab4757 690 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 691
8aab4757 692 BT_DBG("conn %p", conn);
3158c50c 693
8aab4757
VCG		 694 swap128(skb->data, smp->rrnd);
695 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 696
8aab4757 697 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 698
699 return 0;
88ba43b6
AB		 700}
701
988c5997
VCG		 702static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
703{
704 struct link_key *key;
705 struct key_master_id *master;
706 struct hci_conn *hcon = conn->hcon;
707
708 key = hci_find_link_key_type(hcon->hdev, conn->dst,
709 HCI_LK_SMP_LTK);
710 if (!key)
711 return 0;
712
51a8efd7 713 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 714 return 1;
715
716 master = (void *) key->data;
717 hci_le_start_enc(hcon, master->ediv, master->rand,
718 key->val);
719 hcon->enc_key_size = key->pin_len;
720
721 return 1;
722
723}
da85e5e5 724static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 725{
726 struct smp_cmd_security_req *rp = (void *) skb->data;
727 struct smp_cmd_pairing cp;
f1cb9af5 728 struct hci_conn *hcon = conn->hcon;
8aab4757 729 struct smp_chan *smp;
88ba43b6
AB		 730
731 BT_DBG("conn %p", conn);
732
2b64d153 733 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 734
988c5997
VCG		 735 if (smp_ltk_encrypt(conn))
736 return 0;
737
51a8efd7 738 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 739 return 0;
f1cb9af5 740
8aab4757 741 smp = smp_chan_create(conn);
d26a2345 742
88ba43b6 743 skb_pull(skb, sizeof(*rp));
88ba43b6 744
da85e5e5 745 memset(&cp, 0, sizeof(cp));
54790f73 746 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 747
1c1def09
VCG		 748 smp->preq[0] = SMP_CMD_PAIRING_REQ;
749 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 750
88ba43b6 751 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 752
da85e5e5 753 return 0;
88ba43b6
AB		 754}
755
eb492e01
AB		 756int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
757{
3a0259bb 758 struct hci_conn *hcon = conn->hcon;
1c1def09 759 struct smp_chan *smp = conn->smp_chan;
2b64d153 760 __u8 authreq;
eb492e01 761
3a0259bb
VCG		 762 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
763
2e65c9d2
AG		 764 if (!lmp_host_le_capable(hcon->hdev))
765 return 1;
766
f1cb9af5
VCG		 767 if (sec_level == BT_SECURITY_LOW)
768 return 1;
eb492e01 769
f1cb9af5 770 if (hcon->sec_level >= sec_level)
eb492e01 771 return 1;
f1cb9af5 772
988c5997
VCG		 773 if (hcon->link_mode & HCI_LM_MASTER)
774 if (smp_ltk_encrypt(conn))
02bc7455 775 goto done;
d26a2345 776
51a8efd7 777 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 778 return 0;
779
8aab4757 780 smp = smp_chan_create(conn);
2b64d153
BG		 781 if (!smp)
782 return 1;
783
784 authreq = seclevel_to_authreq(sec_level);
d26a2345 785
d26a2345
VCG		 786 if (hcon->link_mode & HCI_LM_MASTER) {
787 struct smp_cmd_pairing cp;
f01ead31 788
2b64d153 789 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 790 smp->preq[0] = SMP_CMD_PAIRING_REQ;
791 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 792
eb492e01
AB		 793 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
794 } else {
795 struct smp_cmd_security_req cp;
2b64d153 796 cp.auth_req = authreq;
eb492e01
AB		 797 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
798 }
799
02bc7455 800done:
f1cb9af5 801 hcon->pending_sec_level = sec_level;
f1cb9af5 802
eb492e01
AB		 803 return 0;
804}
805
7034b911
VCG		 806static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
807{
16b90839 808 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 809 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 810
811 skb_pull(skb, sizeof(*rp));
812
1c1def09 813 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 814
7034b911
VCG		 815 return 0;
816}
817
818static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
819{
16b90839 820 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 821 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 822
823 skb_pull(skb, sizeof(*rp));
7034b911 824
f7aa611a 825 hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->enc_key_size,
1c1def09 826 rp->ediv, rp->rand, smp->tk);
7034b911
VCG		 827
828 smp_distribute_keys(conn, 1);
829
830 return 0;
831}
832
eb492e01
AB		 833int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
834{
835 __u8 code = skb->data[0];
836 __u8 reason;
837 int err = 0;
838
2e65c9d2
AG		 839 if (!lmp_host_le_capable(conn->hcon->hdev)) {
840 err = -ENOTSUPP;
841 reason = SMP_PAIRING_NOTSUPP;
842 goto done;
843 }
844
eb492e01
AB		 845 skb_pull(skb, sizeof(code));
846
847 switch (code) {
848 case SMP_CMD_PAIRING_REQ:
da85e5e5 849 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 850 break;
851
852 case SMP_CMD_PAIRING_FAIL:
4f957a76 853 smp_failure(conn, skb->data[0], 0);
da85e5e5
VCG		 854 reason = 0;
855 err = -EPERM;
eb492e01
AB		 856 break;
857
858 case SMP_CMD_PAIRING_RSP:
da85e5e5 859 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 860 break;
861
862 case SMP_CMD_SECURITY_REQ:
da85e5e5 863 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 864 break;
865
eb492e01 866 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 867 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 868 break;
869
eb492e01 870 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 871 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 872 break;
873
eb492e01 874 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 875 reason = smp_cmd_encrypt_info(conn, skb);
876 break;
877
eb492e01 878 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 879 reason = smp_cmd_master_ident(conn, skb);
880 break;
881
eb492e01
AB		 882 case SMP_CMD_IDENT_INFO:
883 case SMP_CMD_IDENT_ADDR_INFO:
884 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 885 /* Just ignored */
886 reason = 0;
887 break;
888
eb492e01
AB		 889 default:
890 BT_DBG("Unknown command code 0x%2.2x", code);
891
892 reason = SMP_CMD_NOTSUPP;
eb492e01 893 err = -EOPNOTSUPP;
3a0259bb 894 goto done;
eb492e01
AB		 895 }
896
3a0259bb
VCG		 897done:
898 if (reason)
4f957a76 899 smp_failure(conn, reason, 1);
3a0259bb 900
eb492e01
AB		 901 kfree_skb(skb);
902 return err;
903}
7034b911
VCG		 904
905int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
906{
907 struct smp_cmd_pairing *req, *rsp;
1c1def09 908 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 909 __u8 *keydist;
910
911 BT_DBG("conn %p force %d", conn, force);
912
51a8efd7 913 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
d26a2345
VCG		 914 return 0;
915
1c1def09 916 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 917
918 /* The responder sends its keys first */
919 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
920 return 0;
921
1c1def09 922 req = (void *) &smp->preq[1];
7034b911
VCG		 923
924 if (conn->hcon->out) {
925 keydist = &rsp->init_key_dist;
926 *keydist &= req->init_key_dist;
927 } else {
928 keydist = &rsp->resp_key_dist;
929 *keydist &= req->resp_key_dist;
930 }
931
932
933 BT_DBG("keydist 0x%x", *keydist);
934
935 if (*keydist & SMP_DIST_ENC_KEY) {
936 struct smp_cmd_encrypt_info enc;
937 struct smp_cmd_master_ident ident;
938 __le16 ediv;
939
940 get_random_bytes(enc.ltk, sizeof(enc.ltk));
941 get_random_bytes(&ediv, sizeof(ediv));
942 get_random_bytes(ident.rand, sizeof(ident.rand));
943
944 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
945
f7aa611a 946 hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->enc_key_size,
726b4ffc 947 ediv, ident.rand, enc.ltk);
16b90839 948
7034b911
VCG		 949 ident.ediv = cpu_to_le16(ediv);
950
951 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
952
953 *keydist &= ~SMP_DIST_ENC_KEY;
954 }
955
956 if (*keydist & SMP_DIST_ID_KEY) {
957 struct smp_cmd_ident_addr_info addrinfo;
958 struct smp_cmd_ident_info idinfo;
959
960 /* Send a dummy key */
961 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
962
963 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
964
965 /* Just public address */
966 memset(&addrinfo, 0, sizeof(addrinfo));
967 bacpy(&addrinfo.bdaddr, conn->src);
968
969 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
970 &addrinfo);
971
972 *keydist &= ~SMP_DIST_ID_KEY;
973 }
974
975 if (*keydist & SMP_DIST_SIGN) {
976 struct smp_cmd_sign_info sign;
977
978 /* Send a dummy key */
979 get_random_bytes(sign.csrk, sizeof(sign.csrk));
980
981 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
982
983 *keydist &= ~SMP_DIST_SIGN;
984 }
985
d26a2345 986 if (conn->hcon->out || force) {
51a8efd7 987 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6c9d42a1 988 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 989 smp_chan_destroy(conn);
d26a2345
VCG		 990 }
991
7034b911
VCG		 992 return 0;
993}
kernel source for telekom puls (alcatel/mediatek)