projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Change signature of smp_conn_security()
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
eb492e01 31#include <net/bluetooth/smp.h>
d22ef0bc 32
17b02e62 33#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 34
d22ef0bc
AB		 35static inline void swap128(u8 src[16], u8 dst[16])
36{
37 int i;
38 for (i = 0; i < 16; i++)
39 dst[15 - i] = src[i];
40}
41
42static inline void swap56(u8 src[7], u8 dst[7])
43{
44 int i;
45 for (i = 0; i < 7; i++)
46 dst[6 - i] = src[i];
47}
48
49static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
50{
51 struct blkcipher_desc desc;
52 struct scatterlist sg;
53 int err, iv_len;
54 unsigned char iv[128];
55
56 if (tfm == NULL) {
57 BT_ERR("tfm %p", tfm);
58 return -EINVAL;
59 }
60
61 desc.tfm = tfm;
62 desc.flags = 0;
63
64 err = crypto_blkcipher_setkey(tfm, k, 16);
65 if (err) {
66 BT_ERR("cipher setkey failed: %d", err);
67 return err;
68 }
69
70 sg_init_one(&sg, r, 16);
71
72 iv_len = crypto_blkcipher_ivsize(tfm);
73 if (iv_len) {
74 memset(&iv, 0xff, iv_len);
75 crypto_blkcipher_set_iv(tfm, iv, iv_len);
76 }
77
78 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
79 if (err)
80 BT_ERR("Encrypt data error %d", err);
81
82 return err;
83}
84
85static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
86 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
87 u8 _rat, bdaddr_t *ra, u8 res[16])
88{
89 u8 p1[16], p2[16];
90 int err;
91
92 memset(p1, 0, 16);
93
94 /* p1 = pres || preq || _rat || _iat */
95 swap56(pres, p1);
96 swap56(preq, p1 + 7);
97 p1[14] = _rat;
98 p1[15] = _iat;
99
100 memset(p2, 0, 16);
101
102 /* p2 = padding || ia || ra */
103 baswap((bdaddr_t *) (p2 + 4), ia);
104 baswap((bdaddr_t *) (p2 + 10), ra);
105
106 /* res = r XOR p1 */
107 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
108
109 /* res = e(k, res) */
110 err = smp_e(tfm, k, res);
111 if (err) {
112 BT_ERR("Encrypt data error");
113 return err;
114 }
115
116 /* res = res XOR p2 */
117 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
118
119 /* res = e(k, res) */
120 err = smp_e(tfm, k, res);
121 if (err)
122 BT_ERR("Encrypt data error");
123
124 return err;
125}
126
127static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16],
128 u8 r1[16], u8 r2[16], u8 _r[16])
129{
130 int err;
131
132 /* Just least significant octets from r1 and r2 are considered */
133 memcpy(_r, r1 + 8, 8);
134 memcpy(_r + 8, r2 + 8, 8);
135
136 err = smp_e(tfm, k, _r);
137 if (err)
138 BT_ERR("Encrypt data error");
139
140 return err;
141}
142
143static int smp_rand(u8 *buf)
144{
145 get_random_bytes(buf, 16);
146
147 return 0;
148}
eb492e01
AB		 149
150static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
151 u16 dlen, void *data)
152{
153 struct sk_buff *skb;
154 struct l2cap_hdr *lh;
155 int len;
156
157 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
158
159 if (len > conn->mtu)
160 return NULL;
161
162 skb = bt_skb_alloc(len, GFP_ATOMIC);
163 if (!skb)
164 return NULL;
165
166 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
167 lh->len = cpu_to_le16(sizeof(code) + dlen);
168 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
169
170 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
171
172 memcpy(skb_put(skb, dlen), data, dlen);
173
174 return skb;
175}
176
177static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
178{
179 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
180
181 BT_DBG("code 0x%2.2x", code);
182
183 if (!skb)
184 return;
185
73d80deb
LAD		 186 skb->priority = HCI_PRIO_MAX;
187 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 188
6c9d42a1 189 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 190 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 191}
192
2b64d153
BG		 193static __u8 authreq_to_seclevel(__u8 authreq)
194{
195 if (authreq & SMP_AUTH_MITM)
196 return BT_SECURITY_HIGH;
197 else
198 return BT_SECURITY_MEDIUM;
199}
200
201static __u8 seclevel_to_authreq(__u8 sec_level)
202{
203 switch (sec_level) {
204 case BT_SECURITY_HIGH:
205 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
206 case BT_SECURITY_MEDIUM:
207 return SMP_AUTH_BONDING;
208 default:
209 return SMP_AUTH_NONE;
210 }
211}
212
b8e66eac 213static void build_pairing_cmd(struct l2cap_conn *conn,
54790f73
VCG		 214 struct smp_cmd_pairing *req,
215 struct smp_cmd_pairing *rsp,
216 __u8 authreq)
b8e66eac 217{
2b64d153 218 u8 dist_keys = 0;
54790f73 219
a8b2d5c2 220 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
ca10b5ee 221 dist_keys = SMP_DIST_ENC_KEY;
54790f73 222 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 223 } else {
224 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 225 }
226
227 if (rsp == NULL) {
228 req->io_capability = conn->hcon->io_capability;
229 req->oob_flag = SMP_OOB_NOT_PRESENT;
230 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 231 req->init_key_dist = 0;
54790f73
VCG		 232 req->resp_key_dist = dist_keys;
233 req->auth_req = authreq;
234 return;
235 }
236
237 rsp->io_capability = conn->hcon->io_capability;
238 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
239 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
2b64d153 240 rsp->init_key_dist = 0;
54790f73
VCG		 241 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
242 rsp->auth_req = authreq;
b8e66eac
VCG		 243}
244
3158c50c
VCG		 245static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
246{
1c1def09
VCG		 247 struct smp_chan *smp = conn->smp_chan;
248
3158c50c
VCG		 249 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
250 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
251 return SMP_ENC_KEY_SIZE;
252
f7aa611a 253 smp->enc_key_size = max_key_size;
3158c50c
VCG		 254
255 return 0;
256}
257
4f957a76
BG		 258static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
259{
bab73cb6
JH		 260 struct hci_conn *hcon = conn->hcon;
261
4f957a76
BG		 262 if (send)
263 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
264 &reason);
265
51a8efd7 266 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags);
bab73cb6 267 mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
04124681 268 hcon->dst_type, reason);
f1c09c07 269
61a0cfb0
AG		 270 cancel_delayed_work_sync(&conn->security_timer);
271
272 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
f1c09c07 273 smp_chan_destroy(conn);
4f957a76
BG		 274}
275
2b64d153
BG		 276#define JUST_WORKS 0x00
277#define JUST_CFM 0x01
278#define REQ_PASSKEY 0x02
279#define CFM_PASSKEY 0x03
280#define REQ_OOB 0x04
281#define OVERLAP 0xFF
282
283static const u8 gen_method[5][5] = {
284 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
285 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
286 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
287 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
288 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
289};
290
291static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
292 u8 local_io, u8 remote_io)
293{
294 struct hci_conn *hcon = conn->hcon;
295 struct smp_chan *smp = conn->smp_chan;
296 u8 method;
297 u32 passkey = 0;
298 int ret = 0;
299
300 /* Initialize key for JUST WORKS */
301 memset(smp->tk, 0, sizeof(smp->tk));
302 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
303
304 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
305
306 /* If neither side wants MITM, use JUST WORKS */
307 /* If either side has unknown io_caps, use JUST WORKS */
308 /* Otherwise, look up method from the table */
309 if (!(auth & SMP_AUTH_MITM) ||
310 local_io > SMP_IO_KEYBOARD_DISPLAY ||
311 remote_io > SMP_IO_KEYBOARD_DISPLAY)
312 method = JUST_WORKS;
313 else
b3ff53ff 314 method = gen_method[remote_io][local_io];
2b64d153
BG		 315
316 /* If not bonding, don't ask user to confirm a Zero TK */
317 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
318 method = JUST_WORKS;
319
320 /* If Just Works, Continue with Zero TK */
321 if (method == JUST_WORKS) {
322 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
323 return 0;
324 }
325
326 /* Not Just Works/Confirm results in MITM Authentication */
327 if (method != JUST_CFM)
328 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
329
330 /* If both devices have Keyoard-Display I/O, the master
331 * Confirms and the slave Enters the passkey.
332 */
333 if (method == OVERLAP) {
334 if (hcon->link_mode & HCI_LM_MASTER)
335 method = CFM_PASSKEY;
336 else
337 method = REQ_PASSKEY;
338 }
339
340 /* Generate random passkey. Not valid until confirmed. */
341 if (method == CFM_PASSKEY) {
342 u8 key[16];
343
344 memset(key, 0, sizeof(key));
345 get_random_bytes(&passkey, sizeof(passkey));
346 passkey %= 1000000;
347 put_unaligned_le32(passkey, key);
348 swap128(key, smp->tk);
349 BT_DBG("PassKey: %d", passkey);
350 }
351
352 hci_dev_lock(hcon->hdev);
353
354 if (method == REQ_PASSKEY)
272d90df
JH		 355 ret = mgmt_user_passkey_request(hcon->hdev, conn->dst,
356 hcon->type, hcon->dst_type);
2b64d153
BG		 357 else
358 ret = mgmt_user_confirm_request(hcon->hdev, conn->dst,
272d90df 359 hcon->type, hcon->dst_type,
2b64d153
BG		 360 cpu_to_le32(passkey), 0);
361
362 hci_dev_unlock(hcon->hdev);
363
364 return ret;
365}
366
8aab4757
VCG		 367static void confirm_work(struct work_struct *work)
368{
369 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
370 struct l2cap_conn *conn = smp->conn;
371 struct crypto_blkcipher *tfm;
372 struct smp_cmd_pairing_confirm cp;
373 int ret;
374 u8 res[16], reason;
375
376 BT_DBG("conn %p", conn);
377
378 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
379 if (IS_ERR(tfm)) {
380 reason = SMP_UNSPECIFIED;
381 goto error;
382 }
383
384 smp->tfm = tfm;
385
386 if (conn->hcon->out)
387 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 0,
04124681 388 conn->src, conn->hcon->dst_type, conn->dst, res);
8aab4757
VCG		 389 else
390 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
04124681
GP		 391 conn->hcon->dst_type, conn->dst, 0, conn->src,
392 res);
8aab4757
VCG		 393 if (ret) {
394 reason = SMP_UNSPECIFIED;
395 goto error;
396 }
397
2b64d153
BG		 398 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
399
8aab4757
VCG		 400 swap128(res, cp.confirm_val);
401 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
402
403 return;
404
405error:
4f957a76 406 smp_failure(conn, reason, 1);
8aab4757
VCG		 407}
408
409static void random_work(struct work_struct *work)
410{
411 struct smp_chan *smp = container_of(work, struct smp_chan, random);
412 struct l2cap_conn *conn = smp->conn;
413 struct hci_conn *hcon = conn->hcon;
414 struct crypto_blkcipher *tfm = smp->tfm;
415 u8 reason, confirm[16], res[16], key[16];
416 int ret;
417
418 if (IS_ERR_OR_NULL(tfm)) {
419 reason = SMP_UNSPECIFIED;
420 goto error;
421 }
422
423 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
424
425 if (hcon->out)
426 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 0,
04124681 427 conn->src, hcon->dst_type, conn->dst, res);
8aab4757
VCG		 428 else
429 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
04124681 430 hcon->dst_type, conn->dst, 0, conn->src, res);
8aab4757
VCG		 431 if (ret) {
432 reason = SMP_UNSPECIFIED;
433 goto error;
434 }
435
436 swap128(res, confirm);
437
438 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
439 BT_ERR("Pairing failed (confirmation values mismatch)");
440 reason = SMP_CONFIRM_FAILED;
441 goto error;
442 }
443
444 if (hcon->out) {
445 u8 stk[16], rand[8];
446 __le16 ediv;
447
448 memset(rand, 0, sizeof(rand));
449 ediv = 0;
450
451 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
452 swap128(key, stk);
453
f7aa611a 454 memset(stk + smp->enc_key_size, 0,
04124681 455 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 456
51a8efd7 457 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 458 reason = SMP_UNSPECIFIED;
459 goto error;
460 }
461
462 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 463 hcon->enc_key_size = smp->enc_key_size;
8aab4757
VCG		 464 } else {
465 u8 stk[16], r[16], rand[8];
466 __le16 ediv;
467
468 memset(rand, 0, sizeof(rand));
469 ediv = 0;
470
471 swap128(smp->prnd, r);
472 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
473
474 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
475 swap128(key, stk);
476
f7aa611a
VCG		 477 memset(stk + smp->enc_key_size, 0,
478 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 479
c9839a11 480 hci_add_ltk(hcon->hdev, conn->dst, hcon->dst_type,
04124681
GP		 481 HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
482 ediv, rand);
8aab4757
VCG		 483 }
484
485 return;
486
487error:
4f957a76 488 smp_failure(conn, reason, 1);
8aab4757
VCG		 489}
490
491static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
492{
493 struct smp_chan *smp;
494
495 smp = kzalloc(sizeof(struct smp_chan), GFP_ATOMIC);
496 if (!smp)
497 return NULL;
498
499 INIT_WORK(&smp->confirm, confirm_work);
500 INIT_WORK(&smp->random, random_work);
501
502 smp->conn = conn;
503 conn->smp_chan = smp;
2b64d153 504 conn->hcon->smp_conn = conn;
8aab4757
VCG		 505
506 hci_conn_hold(conn->hcon);
507
508 return smp;
509}
510
511void smp_chan_destroy(struct l2cap_conn *conn)
512{
c8eb9690
BG		 513 struct smp_chan *smp = conn->smp_chan;
514
f1c09c07 515 BUG_ON(!smp);
c8eb9690
BG		 516
517 if (smp->tfm)
518 crypto_free_blkcipher(smp->tfm);
519
520 kfree(smp);
521 conn->smp_chan = NULL;
2b64d153 522 conn->hcon->smp_conn = NULL;
8aab4757
VCG		 523 hci_conn_put(conn->hcon);
524}
525
2b64d153
BG		 526int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
527{
528 struct l2cap_conn *conn = hcon->smp_conn;
529 struct smp_chan *smp;
530 u32 value;
531 u8 key[16];
532
533 BT_DBG("");
534
535 if (!conn)
536 return -ENOTCONN;
537
538 smp = conn->smp_chan;
539
540 switch (mgmt_op) {
541 case MGMT_OP_USER_PASSKEY_REPLY:
542 value = le32_to_cpu(passkey);
543 memset(key, 0, sizeof(key));
544 BT_DBG("PassKey: %d", value);
545 put_unaligned_le32(value, key);
546 swap128(key, smp->tk);
547 /* Fall Through */
548 case MGMT_OP_USER_CONFIRM_REPLY:
549 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
550 break;
551 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
552 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
553 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
554 return 0;
555 default:
556 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
557 return -EOPNOTSUPP;
558 }
559
560 /* If it is our turn to send Pairing Confirm, do so now */
561 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
562 queue_work(hcon->hdev->workqueue, &smp->confirm);
563
564 return 0;
565}
566
da85e5e5 567static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 568{
3158c50c 569 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 570 struct smp_chan *smp;
3158c50c 571 u8 key_size;
2b64d153 572 u8 auth = SMP_AUTH_NONE;
8aab4757 573 int ret;
88ba43b6
AB		 574
575 BT_DBG("conn %p", conn);
576
2b64d153
BG		 577 if (conn->hcon->link_mode & HCI_LM_MASTER)
578 return SMP_CMD_NOTSUPP;
579
51a8efd7 580 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 581 smp = smp_chan_create(conn);
d08fd0e7
AE		 582 else
583 smp = conn->smp_chan;
8aab4757 584
d08fd0e7
AE		 585 if (!smp)
586 return SMP_UNSPECIFIED;
d26a2345 587
1c1def09
VCG		 588 smp->preq[0] = SMP_CMD_PAIRING_REQ;
589 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 590 skb_pull(skb, sizeof(*req));
88ba43b6 591
2b64d153
BG		 592 /* We didn't start the pairing, so match remote */
593 if (req->auth_req & SMP_AUTH_BONDING)
594 auth = req->auth_req;
da85e5e5 595
fdde0a26
IY		 596 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
597
2b64d153 598 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 599
600 key_size = min(req->max_key_size, rsp.max_key_size);
601 if (check_enc_key_size(conn, key_size))
602 return SMP_ENC_KEY_SIZE;
88ba43b6 603
8aab4757
VCG		 604 ret = smp_rand(smp->prnd);
605 if (ret)
606 return SMP_UNSPECIFIED;
607
1c1def09
VCG		 608 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
609 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 610
3158c50c 611 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 612
2b64d153
BG		 613 /* Request setup of TK */
614 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
615 if (ret)
616 return SMP_UNSPECIFIED;
617
da85e5e5 618 return 0;
88ba43b6
AB		 619}
620
da85e5e5 621static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 622{
3158c50c 623 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 624 struct smp_chan *smp = conn->smp_chan;
8aab4757 625 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 626 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 627 int ret;
88ba43b6
AB		 628
629 BT_DBG("conn %p", conn);
630
2b64d153
BG		 631 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
632 return SMP_CMD_NOTSUPP;
633
3158c50c
VCG		 634 skb_pull(skb, sizeof(*rsp));
635
1c1def09 636 req = (void *) &smp->preq[1];
da85e5e5 637
3158c50c
VCG		 638 key_size = min(req->max_key_size, rsp->max_key_size);
639 if (check_enc_key_size(conn, key_size))
640 return SMP_ENC_KEY_SIZE;
641
1c1def09 642 ret = smp_rand(smp->prnd);
7d24ddcc 643 if (ret)
da85e5e5 644 return SMP_UNSPECIFIED;
7d24ddcc 645
8aab4757
VCG		 646 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
647 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 648
2b64d153
BG		 649 if ((req->auth_req & SMP_AUTH_BONDING) &&
650 (rsp->auth_req & SMP_AUTH_BONDING))
651 auth = SMP_AUTH_BONDING;
652
653 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
654
476585ec 655 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 656 if (ret)
657 return SMP_UNSPECIFIED;
658
659 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
660
661 /* Can't compose response until we have been confirmed */
662 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
663 return 0;
664
8aab4757 665 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 666
667 return 0;
88ba43b6
AB		 668}
669
da85e5e5 670static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 671{
1c1def09 672 struct smp_chan *smp = conn->smp_chan;
8aab4757 673 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 674
88ba43b6
AB		 675 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
676
1c1def09
VCG		 677 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
678 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 679
7d24ddcc
AB		 680 if (conn->hcon->out) {
681 u8 random[16];
88ba43b6 682
1c1def09 683 swap128(smp->prnd, random);
88ba43b6 684 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
7d24ddcc 685 random);
2b64d153 686 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 687 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 688 } else {
689 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 690 }
da85e5e5
VCG		 691
692 return 0;
88ba43b6
AB		 693}
694
da85e5e5 695static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 696{
1c1def09 697 struct smp_chan *smp = conn->smp_chan;
8aab4757 698 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 699
8aab4757 700 BT_DBG("conn %p", conn);
3158c50c 701
8aab4757
VCG		 702 swap128(skb->data, smp->rrnd);
703 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 704
8aab4757 705 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 706
707 return 0;
88ba43b6
AB		 708}
709
4dab7864 710static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 711{
c9839a11 712 struct smp_ltk *key;
988c5997
VCG		 713 struct hci_conn *hcon = conn->hcon;
714
c9839a11 715 key = hci_find_ltk_by_addr(hcon->hdev, conn->dst, hcon->dst_type);
988c5997
VCG		 716 if (!key)
717 return 0;
718
4dab7864
JH		 719 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
720 return 0;
721
51a8efd7 722 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 723 return 1;
724
c9839a11
VCG		 725 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
726 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 727
728 return 1;
729
730}
da85e5e5 731static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 732{
733 struct smp_cmd_security_req *rp = (void *) skb->data;
734 struct smp_cmd_pairing cp;
f1cb9af5 735 struct hci_conn *hcon = conn->hcon;
8aab4757 736 struct smp_chan *smp;
88ba43b6
AB		 737
738 BT_DBG("conn %p", conn);
739
2b64d153 740 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 741
4dab7864 742 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 743 return 0;
744
51a8efd7 745 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 746 return 0;
f1cb9af5 747
8aab4757 748 smp = smp_chan_create(conn);
d26a2345 749
88ba43b6 750 skb_pull(skb, sizeof(*rp));
88ba43b6 751
da85e5e5 752 memset(&cp, 0, sizeof(cp));
54790f73 753 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 754
1c1def09
VCG		 755 smp->preq[0] = SMP_CMD_PAIRING_REQ;
756 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 757
88ba43b6 758 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 759
da85e5e5 760 return 0;
88ba43b6
AB		 761}
762
cc110922 763int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 764{
cc110922 765 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 766 struct smp_chan *smp = conn->smp_chan;
2b64d153 767 __u8 authreq;
eb492e01 768
3a0259bb
VCG		 769 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
770
2e65c9d2
AG		 771 if (!lmp_host_le_capable(hcon->hdev))
772 return 1;
773
f1cb9af5
VCG		 774 if (sec_level == BT_SECURITY_LOW)
775 return 1;
eb492e01 776
f1cb9af5 777 if (hcon->sec_level >= sec_level)
eb492e01 778 return 1;
f1cb9af5 779
988c5997 780 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 781 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 782 goto done;
d26a2345 783
51a8efd7 784 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 785 return 0;
786
8aab4757 787 smp = smp_chan_create(conn);
2b64d153
BG		 788 if (!smp)
789 return 1;
790
791 authreq = seclevel_to_authreq(sec_level);
d26a2345 792
d26a2345
VCG		 793 if (hcon->link_mode & HCI_LM_MASTER) {
794 struct smp_cmd_pairing cp;
f01ead31 795
2b64d153 796 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 797 smp->preq[0] = SMP_CMD_PAIRING_REQ;
798 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 799
eb492e01
AB		 800 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
801 } else {
802 struct smp_cmd_security_req cp;
2b64d153 803 cp.auth_req = authreq;
eb492e01
AB		 804 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
805 }
806
02bc7455 807done:
f1cb9af5 808 hcon->pending_sec_level = sec_level;
f1cb9af5 809
eb492e01
AB		 810 return 0;
811}
812
7034b911
VCG		 813static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
814{
16b90839 815 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 816 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 817
818 skb_pull(skb, sizeof(*rp));
819
1c1def09 820 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 821
7034b911
VCG		 822 return 0;
823}
824
825static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
826{
16b90839 827 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 828 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 829 struct hci_dev *hdev = conn->hcon->hdev;
830 struct hci_conn *hcon = conn->hcon;
831 u8 authenticated;
16b90839
VCG		 832
833 skb_pull(skb, sizeof(*rp));
7034b911 834
c9839a11
VCG		 835 hci_dev_lock(hdev);
836 authenticated = (conn->hcon->sec_level == BT_SECURITY_HIGH);
837 hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
04124681
GP		 838 HCI_SMP_LTK, 1, authenticated, smp->tk, smp->enc_key_size,
839 rp->ediv, rp->rand);
7034b911 840 smp_distribute_keys(conn, 1);
c9839a11 841 hci_dev_unlock(hdev);
7034b911
VCG		 842
843 return 0;
844}
845
eb492e01
AB		 846int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
847{
848 __u8 code = skb->data[0];
849 __u8 reason;
850 int err = 0;
851
2e65c9d2
AG		 852 if (!lmp_host_le_capable(conn->hcon->hdev)) {
853 err = -ENOTSUPP;
854 reason = SMP_PAIRING_NOTSUPP;
855 goto done;
856 }
857
eb492e01
AB		 858 skb_pull(skb, sizeof(code));
859
860 switch (code) {
861 case SMP_CMD_PAIRING_REQ:
da85e5e5 862 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 863 break;
864
865 case SMP_CMD_PAIRING_FAIL:
4f957a76 866 smp_failure(conn, skb->data[0], 0);
da85e5e5
VCG		 867 reason = 0;
868 err = -EPERM;
eb492e01
AB		 869 break;
870
871 case SMP_CMD_PAIRING_RSP:
da85e5e5 872 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 873 break;
874
875 case SMP_CMD_SECURITY_REQ:
da85e5e5 876 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 877 break;
878
eb492e01 879 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 880 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 881 break;
882
eb492e01 883 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 884 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 885 break;
886
eb492e01 887 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 888 reason = smp_cmd_encrypt_info(conn, skb);
889 break;
890
eb492e01 891 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 892 reason = smp_cmd_master_ident(conn, skb);
893 break;
894
eb492e01
AB		 895 case SMP_CMD_IDENT_INFO:
896 case SMP_CMD_IDENT_ADDR_INFO:
897 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 898 /* Just ignored */
899 reason = 0;
900 break;
901
eb492e01
AB		 902 default:
903 BT_DBG("Unknown command code 0x%2.2x", code);
904
905 reason = SMP_CMD_NOTSUPP;
eb492e01 906 err = -EOPNOTSUPP;
3a0259bb 907 goto done;
eb492e01
AB		 908 }
909
3a0259bb
VCG		 910done:
911 if (reason)
4f957a76 912 smp_failure(conn, reason, 1);
3a0259bb 913
eb492e01
AB		 914 kfree_skb(skb);
915 return err;
916}
7034b911
VCG		 917
918int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
919{
920 struct smp_cmd_pairing *req, *rsp;
1c1def09 921 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 922 __u8 *keydist;
923
924 BT_DBG("conn %p force %d", conn, force);
925
51a8efd7 926 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
d26a2345
VCG		 927 return 0;
928
1c1def09 929 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 930
931 /* The responder sends its keys first */
932 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
933 return 0;
934
1c1def09 935 req = (void *) &smp->preq[1];
7034b911
VCG		 936
937 if (conn->hcon->out) {
938 keydist = &rsp->init_key_dist;
939 *keydist &= req->init_key_dist;
940 } else {
941 keydist = &rsp->resp_key_dist;
942 *keydist &= req->resp_key_dist;
943 }
944
945
946 BT_DBG("keydist 0x%x", *keydist);
947
948 if (*keydist & SMP_DIST_ENC_KEY) {
949 struct smp_cmd_encrypt_info enc;
950 struct smp_cmd_master_ident ident;
c9839a11
VCG		 951 struct hci_conn *hcon = conn->hcon;
952 u8 authenticated;
7034b911
VCG		 953 __le16 ediv;
954
955 get_random_bytes(enc.ltk, sizeof(enc.ltk));
956 get_random_bytes(&ediv, sizeof(ediv));
957 get_random_bytes(ident.rand, sizeof(ident.rand));
958
959 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
960
c9839a11
VCG		 961 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
962 hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
04124681
GP		 963 HCI_SMP_LTK_SLAVE, 1, authenticated,
964 enc.ltk, smp->enc_key_size, ediv, ident.rand);
16b90839 965
58115373 966 ident.ediv = ediv;
7034b911
VCG		 967
968 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
969
970 *keydist &= ~SMP_DIST_ENC_KEY;
971 }
972
973 if (*keydist & SMP_DIST_ID_KEY) {
974 struct smp_cmd_ident_addr_info addrinfo;
975 struct smp_cmd_ident_info idinfo;
976
977 /* Send a dummy key */
978 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
979
980 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
981
982 /* Just public address */
983 memset(&addrinfo, 0, sizeof(addrinfo));
984 bacpy(&addrinfo.bdaddr, conn->src);
985
986 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
987 &addrinfo);
988
989 *keydist &= ~SMP_DIST_ID_KEY;
990 }
991
992 if (*keydist & SMP_DIST_SIGN) {
993 struct smp_cmd_sign_info sign;
994
995 /* Send a dummy key */
996 get_random_bytes(sign.csrk, sizeof(sign.csrk));
997
998 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
999
1000 *keydist &= ~SMP_DIST_SIGN;
1001 }
1002
d26a2345 1003 if (conn->hcon->out || force) {
51a8efd7 1004 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6c9d42a1 1005 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1006 smp_chan_destroy(conn);
d26a2345
VCG		 1007 }
1008
7034b911
VCG		 1009 return 0;
1010}
kernel source for telekom puls (alcatel/mediatek)