projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
23#include <net/bluetooth/bluetooth.h>
24#include <net/bluetooth/hci_core.h>
25#include <net/bluetooth/l2cap.h>
26#include <net/bluetooth/smp.h>
d22ef0bc 27#include <linux/crypto.h>
f70490e6 28#include <linux/scatterlist.h>
d22ef0bc
AB		 29#include <crypto/b128ops.h>
30
5d3de7df
VCG		 31#define SMP_TIMEOUT 30000 /* 30 seconds */
32
d22ef0bc
AB		 33static inline void swap128(u8 src[16], u8 dst[16])
34{
35 int i;
36 for (i = 0; i < 16; i++)
37 dst[15 - i] = src[i];
38}
39
40static inline void swap56(u8 src[7], u8 dst[7])
41{
42 int i;
43 for (i = 0; i < 7; i++)
44 dst[6 - i] = src[i];
45}
46
47static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
48{
49 struct blkcipher_desc desc;
50 struct scatterlist sg;
51 int err, iv_len;
52 unsigned char iv[128];
53
54 if (tfm == NULL) {
55 BT_ERR("tfm %p", tfm);
56 return -EINVAL;
57 }
58
59 desc.tfm = tfm;
60 desc.flags = 0;
61
62 err = crypto_blkcipher_setkey(tfm, k, 16);
63 if (err) {
64 BT_ERR("cipher setkey failed: %d", err);
65 return err;
66 }
67
68 sg_init_one(&sg, r, 16);
69
70 iv_len = crypto_blkcipher_ivsize(tfm);
71 if (iv_len) {
72 memset(&iv, 0xff, iv_len);
73 crypto_blkcipher_set_iv(tfm, iv, iv_len);
74 }
75
76 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
77 if (err)
78 BT_ERR("Encrypt data error %d", err);
79
80 return err;
81}
82
83static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
84 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
85 u8 _rat, bdaddr_t *ra, u8 res[16])
86{
87 u8 p1[16], p2[16];
88 int err;
89
90 memset(p1, 0, 16);
91
92 /* p1 = pres || preq || _rat || _iat */
93 swap56(pres, p1);
94 swap56(preq, p1 + 7);
95 p1[14] = _rat;
96 p1[15] = _iat;
97
98 memset(p2, 0, 16);
99
100 /* p2 = padding || ia || ra */
101 baswap((bdaddr_t *) (p2 + 4), ia);
102 baswap((bdaddr_t *) (p2 + 10), ra);
103
104 /* res = r XOR p1 */
105 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
106
107 /* res = e(k, res) */
108 err = smp_e(tfm, k, res);
109 if (err) {
110 BT_ERR("Encrypt data error");
111 return err;
112 }
113
114 /* res = res XOR p2 */
115 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
116
117 /* res = e(k, res) */
118 err = smp_e(tfm, k, res);
119 if (err)
120 BT_ERR("Encrypt data error");
121
122 return err;
123}
124
125static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16],
126 u8 r1[16], u8 r2[16], u8 _r[16])
127{
128 int err;
129
130 /* Just least significant octets from r1 and r2 are considered */
131 memcpy(_r, r1 + 8, 8);
132 memcpy(_r + 8, r2 + 8, 8);
133
134 err = smp_e(tfm, k, _r);
135 if (err)
136 BT_ERR("Encrypt data error");
137
138 return err;
139}
140
141static int smp_rand(u8 *buf)
142{
143 get_random_bytes(buf, 16);
144
145 return 0;
146}
eb492e01
AB		 147
148static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
149 u16 dlen, void *data)
150{
151 struct sk_buff *skb;
152 struct l2cap_hdr *lh;
153 int len;
154
155 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
156
157 if (len > conn->mtu)
158 return NULL;
159
160 skb = bt_skb_alloc(len, GFP_ATOMIC);
161 if (!skb)
162 return NULL;
163
164 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
165 lh->len = cpu_to_le16(sizeof(code) + dlen);
166 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
167
168 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
169
170 memcpy(skb_put(skb, dlen), data, dlen);
171
172 return skb;
173}
174
175static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
176{
177 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
178
179 BT_DBG("code 0x%2.2x", code);
180
181 if (!skb)
182 return;
183
184 hci_send_acl(conn->hcon, skb, 0);
e2dcd113
VCG		 185
186 mod_timer(&conn->security_timer, jiffies +
187 msecs_to_jiffies(SMP_TIMEOUT));
eb492e01
AB		 188}
189
b8e66eac 190static void build_pairing_cmd(struct l2cap_conn *conn,
54790f73
VCG		 191 struct smp_cmd_pairing *req,
192 struct smp_cmd_pairing *rsp,
193 __u8 authreq)
b8e66eac 194{
54790f73
VCG		 195 u8 dist_keys;
196
197 dist_keys = 0;
198 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->flags)) {
ca10b5ee 199 dist_keys = SMP_DIST_ENC_KEY;
54790f73
VCG		 200 authreq |= SMP_AUTH_BONDING;
201 }
202
203 if (rsp == NULL) {
204 req->io_capability = conn->hcon->io_capability;
205 req->oob_flag = SMP_OOB_NOT_PRESENT;
206 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
207 req->init_key_dist = dist_keys;
208 req->resp_key_dist = dist_keys;
209 req->auth_req = authreq;
210 return;
211 }
212
213 rsp->io_capability = conn->hcon->io_capability;
214 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
215 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
216 rsp->init_key_dist = req->init_key_dist & dist_keys;
217 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
218 rsp->auth_req = authreq;
b8e66eac
VCG		 219}
220
3158c50c
VCG		 221static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
222{
1c1def09
VCG		 223 struct smp_chan *smp = conn->smp_chan;
224
3158c50c
VCG		 225 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
226 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
227 return SMP_ENC_KEY_SIZE;
228
1c1def09 229 smp->smp_key_size = max_key_size;
3158c50c
VCG		 230
231 return 0;
232}
233
8aab4757
VCG		 234static void confirm_work(struct work_struct *work)
235{
236 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
237 struct l2cap_conn *conn = smp->conn;
238 struct crypto_blkcipher *tfm;
239 struct smp_cmd_pairing_confirm cp;
240 int ret;
241 u8 res[16], reason;
242
243 BT_DBG("conn %p", conn);
244
245 tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
246 if (IS_ERR(tfm)) {
247 reason = SMP_UNSPECIFIED;
248 goto error;
249 }
250
251 smp->tfm = tfm;
252
253 if (conn->hcon->out)
254 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 0,
255 conn->src, conn->hcon->dst_type, conn->dst,
256 res);
257 else
258 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
259 conn->hcon->dst_type, conn->dst, 0, conn->src,
260 res);
261 if (ret) {
262 reason = SMP_UNSPECIFIED;
263 goto error;
264 }
265
266 swap128(res, cp.confirm_val);
267 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
268
269 return;
270
271error:
272 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), &reason);
273 smp_chan_destroy(conn);
274}
275
276static void random_work(struct work_struct *work)
277{
278 struct smp_chan *smp = container_of(work, struct smp_chan, random);
279 struct l2cap_conn *conn = smp->conn;
280 struct hci_conn *hcon = conn->hcon;
281 struct crypto_blkcipher *tfm = smp->tfm;
282 u8 reason, confirm[16], res[16], key[16];
283 int ret;
284
285 if (IS_ERR_OR_NULL(tfm)) {
286 reason = SMP_UNSPECIFIED;
287 goto error;
288 }
289
290 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
291
292 if (hcon->out)
293 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 0,
294 conn->src, hcon->dst_type, conn->dst,
295 res);
296 else
297 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
298 hcon->dst_type, conn->dst, 0, conn->src,
299 res);
300 if (ret) {
301 reason = SMP_UNSPECIFIED;
302 goto error;
303 }
304
305 swap128(res, confirm);
306
307 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
308 BT_ERR("Pairing failed (confirmation values mismatch)");
309 reason = SMP_CONFIRM_FAILED;
310 goto error;
311 }
312
313 if (hcon->out) {
314 u8 stk[16], rand[8];
315 __le16 ediv;
316
317 memset(rand, 0, sizeof(rand));
318 ediv = 0;
319
320 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
321 swap128(key, stk);
322
323 memset(stk + smp->smp_key_size, 0,
324 SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
325
326 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend)) {
327 reason = SMP_UNSPECIFIED;
328 goto error;
329 }
330
331 hci_le_start_enc(hcon, ediv, rand, stk);
332 hcon->enc_key_size = smp->smp_key_size;
333 } else {
334 u8 stk[16], r[16], rand[8];
335 __le16 ediv;
336
337 memset(rand, 0, sizeof(rand));
338 ediv = 0;
339
340 swap128(smp->prnd, r);
341 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
342
343 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
344 swap128(key, stk);
345
346 memset(stk + smp->smp_key_size, 0,
347 SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
348
349 hci_add_ltk(hcon->hdev, 0, conn->dst, smp->smp_key_size,
350 ediv, rand, stk);
351 }
352
353 return;
354
355error:
356 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), &reason);
357 smp_chan_destroy(conn);
358}
359
360static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
361{
362 struct smp_chan *smp;
363
364 smp = kzalloc(sizeof(struct smp_chan), GFP_ATOMIC);
365 if (!smp)
366 return NULL;
367
368 INIT_WORK(&smp->confirm, confirm_work);
369 INIT_WORK(&smp->random, random_work);
370
371 smp->conn = conn;
372 conn->smp_chan = smp;
373
374 hci_conn_hold(conn->hcon);
375
376 return smp;
377}
378
379void smp_chan_destroy(struct l2cap_conn *conn)
380{
381 kfree(conn->smp_chan);
382 hci_conn_put(conn->hcon);
383}
384
da85e5e5 385static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 386{
3158c50c 387 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 388 struct smp_chan *smp;
3158c50c 389 u8 key_size;
8aab4757 390 int ret;
88ba43b6
AB		 391
392 BT_DBG("conn %p", conn);
393
d26a2345 394 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->pend))
8aab4757
VCG		 395 smp = smp_chan_create(conn);
396
397 smp = conn->smp_chan;
d26a2345 398
1c1def09
VCG		 399 smp->preq[0] = SMP_CMD_PAIRING_REQ;
400 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 401 skb_pull(skb, sizeof(*req));
88ba43b6 402
3158c50c 403 if (req->oob_flag)
da85e5e5
VCG		 404 return SMP_OOB_NOT_AVAIL;
405
406 /* We didn't start the pairing, so no requirements */
54790f73 407 build_pairing_cmd(conn, req, &rsp, SMP_AUTH_NONE);
3158c50c
VCG		 408
409 key_size = min(req->max_key_size, rsp.max_key_size);
410 if (check_enc_key_size(conn, key_size))
411 return SMP_ENC_KEY_SIZE;
88ba43b6 412
7d24ddcc 413 /* Just works */
1c1def09 414 memset(smp->tk, 0, sizeof(smp->tk));
7d24ddcc 415
8aab4757
VCG		 416 ret = smp_rand(smp->prnd);
417 if (ret)
418 return SMP_UNSPECIFIED;
419
1c1def09
VCG		 420 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
421 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 422
3158c50c 423 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5
VCG		 424
425 return 0;
88ba43b6
AB		 426}
427
da85e5e5 428static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 429{
3158c50c 430 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 431 struct smp_chan *smp = conn->smp_chan;
8aab4757
VCG		 432 struct hci_dev *hdev = conn->hcon->hdev;
433 u8 key_size;
7d24ddcc 434 int ret;
88ba43b6
AB		 435
436 BT_DBG("conn %p", conn);
437
3158c50c
VCG		 438 skb_pull(skb, sizeof(*rsp));
439
1c1def09 440 req = (void *) &smp->preq[1];
da85e5e5 441
3158c50c
VCG		 442 key_size = min(req->max_key_size, rsp->max_key_size);
443 if (check_enc_key_size(conn, key_size))
444 return SMP_ENC_KEY_SIZE;
445
446 if (rsp->oob_flag)
da85e5e5
VCG		 447 return SMP_OOB_NOT_AVAIL;
448
7d24ddcc 449 /* Just works */
1c1def09 450 memset(smp->tk, 0, sizeof(smp->tk));
88ba43b6 451
1c1def09 452 ret = smp_rand(smp->prnd);
7d24ddcc 453 if (ret)
da85e5e5 454 return SMP_UNSPECIFIED;
7d24ddcc 455
8aab4757
VCG		 456 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
457 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 458
8aab4757 459 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 460
461 return 0;
88ba43b6
AB		 462}
463
da85e5e5 464static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 465{
1c1def09 466 struct smp_chan *smp = conn->smp_chan;
8aab4757 467 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 468
88ba43b6
AB		 469 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
470
1c1def09
VCG		 471 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
472 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 473
7d24ddcc
AB		 474 if (conn->hcon->out) {
475 u8 random[16];
88ba43b6 476
1c1def09 477 swap128(smp->prnd, random);
88ba43b6 478 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
7d24ddcc 479 random);
88ba43b6 480 } else {
8aab4757 481 queue_work(hdev->workqueue, &smp->confirm);
88ba43b6 482 }
da85e5e5
VCG		 483
484 return 0;
88ba43b6
AB		 485}
486
da85e5e5 487static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 488{
1c1def09 489 struct smp_chan *smp = conn->smp_chan;
8aab4757 490 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 491
8aab4757 492 BT_DBG("conn %p", conn);
3158c50c 493
8aab4757
VCG		 494 swap128(skb->data, smp->rrnd);
495 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 496
8aab4757 497 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 498
499 return 0;
88ba43b6
AB		 500}
501
988c5997
VCG		 502static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
503{
504 struct link_key *key;
505 struct key_master_id *master;
506 struct hci_conn *hcon = conn->hcon;
507
508 key = hci_find_link_key_type(hcon->hdev, conn->dst,
509 HCI_LK_SMP_LTK);
510 if (!key)
511 return 0;
512
513 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND,
514 &hcon->pend))
515 return 1;
516
517 master = (void *) key->data;
518 hci_le_start_enc(hcon, master->ediv, master->rand,
519 key->val);
520 hcon->enc_key_size = key->pin_len;
521
522 return 1;
523
524}
da85e5e5 525static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 526{
527 struct smp_cmd_security_req *rp = (void *) skb->data;
528 struct smp_cmd_pairing cp;
f1cb9af5 529 struct hci_conn *hcon = conn->hcon;
8aab4757 530 struct smp_chan *smp;
88ba43b6
AB		 531
532 BT_DBG("conn %p", conn);
533
feb45eb5
VCG		 534 hcon->pending_sec_level = BT_SECURITY_MEDIUM;
535
988c5997
VCG		 536 if (smp_ltk_encrypt(conn))
537 return 0;
538
d26a2345 539 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
da85e5e5 540 return 0;
f1cb9af5 541
8aab4757 542 smp = smp_chan_create(conn);
d26a2345 543
88ba43b6 544 skb_pull(skb, sizeof(*rp));
88ba43b6 545
da85e5e5 546 memset(&cp, 0, sizeof(cp));
54790f73 547 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 548
1c1def09
VCG		 549 smp->preq[0] = SMP_CMD_PAIRING_REQ;
550 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 551
88ba43b6 552 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 553
da85e5e5 554 return 0;
88ba43b6
AB		 555}
556
eb492e01
AB		 557int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
558{
3a0259bb 559 struct hci_conn *hcon = conn->hcon;
1c1def09 560 struct smp_chan *smp = conn->smp_chan;
eb492e01 561
3a0259bb
VCG		 562 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
563
2e65c9d2
AG		 564 if (!lmp_host_le_capable(hcon->hdev))
565 return 1;
566
f1cb9af5
VCG		 567 if (sec_level == BT_SECURITY_LOW)
568 return 1;
eb492e01 569
f1cb9af5 570 if (hcon->sec_level >= sec_level)
eb492e01 571 return 1;
f1cb9af5 572
988c5997
VCG		 573 if (hcon->link_mode & HCI_LM_MASTER)
574 if (smp_ltk_encrypt(conn))
02bc7455 575 goto done;
d26a2345
VCG		 576
577 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
578 return 0;
579
8aab4757 580 smp = smp_chan_create(conn);
d26a2345 581
d26a2345
VCG		 582 if (hcon->link_mode & HCI_LM_MASTER) {
583 struct smp_cmd_pairing cp;
f01ead31 584
0fb4eb6f 585 build_pairing_cmd(conn, &cp, NULL, SMP_AUTH_NONE);
1c1def09
VCG		 586 smp->preq[0] = SMP_CMD_PAIRING_REQ;
587 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 588
eb492e01
AB		 589 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
590 } else {
591 struct smp_cmd_security_req cp;
0fb4eb6f 592 cp.auth_req = SMP_AUTH_NONE;
eb492e01
AB		 593 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
594 }
595
02bc7455 596done:
f1cb9af5 597 hcon->pending_sec_level = sec_level;
f1cb9af5 598
eb492e01
AB		 599 return 0;
600}
601
7034b911
VCG		 602static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
603{
16b90839 604 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 605 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 606
607 skb_pull(skb, sizeof(*rp));
608
1c1def09 609 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 610
7034b911
VCG		 611 return 0;
612}
613
614static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
615{
16b90839 616 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 617 struct smp_chan *smp = conn->smp_chan;
16b90839
VCG		 618
619 skb_pull(skb, sizeof(*rp));
7034b911 620
1c1def09
VCG		 621 hci_add_ltk(conn->hcon->hdev, 1, conn->src, smp->smp_key_size,
622 rp->ediv, rp->rand, smp->tk);
7034b911
VCG		 623
624 smp_distribute_keys(conn, 1);
625
626 return 0;
627}
628
eb492e01
AB		 629int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
630{
631 __u8 code = skb->data[0];
632 __u8 reason;
633 int err = 0;
634
2e65c9d2
AG		 635 if (!lmp_host_le_capable(conn->hcon->hdev)) {
636 err = -ENOTSUPP;
637 reason = SMP_PAIRING_NOTSUPP;
638 goto done;
639 }
640
eb492e01
AB		 641 skb_pull(skb, sizeof(code));
642
643 switch (code) {
644 case SMP_CMD_PAIRING_REQ:
da85e5e5 645 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 646 break;
647
648 case SMP_CMD_PAIRING_FAIL:
da85e5e5
VCG		 649 reason = 0;
650 err = -EPERM;
eb492e01
AB		 651 break;
652
653 case SMP_CMD_PAIRING_RSP:
da85e5e5 654 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 655 break;
656
657 case SMP_CMD_SECURITY_REQ:
da85e5e5 658 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 659 break;
660
eb492e01 661 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 662 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 663 break;
664
eb492e01 665 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 666 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 667 break;
668
eb492e01 669 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 670 reason = smp_cmd_encrypt_info(conn, skb);
671 break;
672
eb492e01 673 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 674 reason = smp_cmd_master_ident(conn, skb);
675 break;
676
eb492e01
AB		 677 case SMP_CMD_IDENT_INFO:
678 case SMP_CMD_IDENT_ADDR_INFO:
679 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 680 /* Just ignored */
681 reason = 0;
682 break;
683
eb492e01
AB		 684 default:
685 BT_DBG("Unknown command code 0x%2.2x", code);
686
687 reason = SMP_CMD_NOTSUPP;
eb492e01 688 err = -EOPNOTSUPP;
3a0259bb 689 goto done;
eb492e01
AB		 690 }
691
3a0259bb
VCG		 692done:
693 if (reason)
694 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
695 &reason);
696
eb492e01
AB		 697 kfree_skb(skb);
698 return err;
699}
7034b911
VCG		 700
701int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
702{
703 struct smp_cmd_pairing *req, *rsp;
1c1def09 704 struct smp_chan *smp = conn->smp_chan;
7034b911
VCG		 705 __u8 *keydist;
706
707 BT_DBG("conn %p force %d", conn, force);
708
d26a2345
VCG		 709 if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->pend))
710 return 0;
711
1c1def09 712 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 713
714 /* The responder sends its keys first */
715 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
716 return 0;
717
1c1def09 718 req = (void *) &smp->preq[1];
7034b911
VCG		 719
720 if (conn->hcon->out) {
721 keydist = &rsp->init_key_dist;
722 *keydist &= req->init_key_dist;
723 } else {
724 keydist = &rsp->resp_key_dist;
725 *keydist &= req->resp_key_dist;
726 }
727
728
729 BT_DBG("keydist 0x%x", *keydist);
730
731 if (*keydist & SMP_DIST_ENC_KEY) {
732 struct smp_cmd_encrypt_info enc;
733 struct smp_cmd_master_ident ident;
734 __le16 ediv;
735
736 get_random_bytes(enc.ltk, sizeof(enc.ltk));
737 get_random_bytes(&ediv, sizeof(ediv));
738 get_random_bytes(ident.rand, sizeof(ident.rand));
739
740 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
741
1c1def09 742 hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->smp_key_size,
726b4ffc 743 ediv, ident.rand, enc.ltk);
16b90839 744
7034b911
VCG		 745 ident.ediv = cpu_to_le16(ediv);
746
747 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
748
749 *keydist &= ~SMP_DIST_ENC_KEY;
750 }
751
752 if (*keydist & SMP_DIST_ID_KEY) {
753 struct smp_cmd_ident_addr_info addrinfo;
754 struct smp_cmd_ident_info idinfo;
755
756 /* Send a dummy key */
757 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
758
759 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
760
761 /* Just public address */
762 memset(&addrinfo, 0, sizeof(addrinfo));
763 bacpy(&addrinfo.bdaddr, conn->src);
764
765 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
766 &addrinfo);
767
768 *keydist &= ~SMP_DIST_ID_KEY;
769 }
770
771 if (*keydist & SMP_DIST_SIGN) {
772 struct smp_cmd_sign_info sign;
773
774 /* Send a dummy key */
775 get_random_bytes(sign.csrk, sizeof(sign.csrk));
776
777 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
778
779 *keydist &= ~SMP_DIST_SIGN;
780 }
781
d26a2345
VCG		 782 if (conn->hcon->out || force) {
783 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->pend);
784 del_timer(&conn->security_timer);
8aab4757 785 smp_chan_destroy(conn);
d26a2345
VCG		 786 }
787
7034b911
VCG		 788 return 0;
789}
Linux kernel - Deliverables
This page took 0.647645 seconds and 5 git commands to generate.