blob: ffbfdd9e573808fbb5cbcf28732c06e773446f7c [file] [log] [blame]
Anderson Brigliaeb492e02011-06-09 18:50:40 -03001/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
23#include <net/bluetooth/bluetooth.h>
24#include <net/bluetooth/hci_core.h>
25#include <net/bluetooth/l2cap.h>
26#include <net/bluetooth/smp.h>
Anderson Brigliad22ef0b2011-06-09 18:50:44 -030027#include <linux/crypto.h>
Stephen Rothwellf70490e2011-06-23 12:58:55 +100028#include <linux/scatterlist.h>
Anderson Brigliad22ef0b2011-06-09 18:50:44 -030029#include <crypto/b128ops.h>
30
Vinicius Costa Gomes5d3de7d2011-06-14 13:37:41 -030031#define SMP_TIMEOUT 30000 /* 30 seconds */
32
Anderson Brigliad22ef0b2011-06-09 18:50:44 -030033static inline void swap128(u8 src[16], u8 dst[16])
34{
35 int i;
36 for (i = 0; i < 16; i++)
37 dst[15 - i] = src[i];
38}
39
40static inline void swap56(u8 src[7], u8 dst[7])
41{
42 int i;
43 for (i = 0; i < 7; i++)
44 dst[6 - i] = src[i];
45}
46
47static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
48{
49 struct blkcipher_desc desc;
50 struct scatterlist sg;
51 int err, iv_len;
52 unsigned char iv[128];
53
54 if (tfm == NULL) {
55 BT_ERR("tfm %p", tfm);
56 return -EINVAL;
57 }
58
59 desc.tfm = tfm;
60 desc.flags = 0;
61
62 err = crypto_blkcipher_setkey(tfm, k, 16);
63 if (err) {
64 BT_ERR("cipher setkey failed: %d", err);
65 return err;
66 }
67
68 sg_init_one(&sg, r, 16);
69
70 iv_len = crypto_blkcipher_ivsize(tfm);
71 if (iv_len) {
72 memset(&iv, 0xff, iv_len);
73 crypto_blkcipher_set_iv(tfm, iv, iv_len);
74 }
75
76 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
77 if (err)
78 BT_ERR("Encrypt data error %d", err);
79
80 return err;
81}
82
83static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
84 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
85 u8 _rat, bdaddr_t *ra, u8 res[16])
86{
87 u8 p1[16], p2[16];
88 int err;
89
90 memset(p1, 0, 16);
91
92 /* p1 = pres || preq || _rat || _iat */
93 swap56(pres, p1);
94 swap56(preq, p1 + 7);
95 p1[14] = _rat;
96 p1[15] = _iat;
97
98 memset(p2, 0, 16);
99
100 /* p2 = padding || ia || ra */
101 baswap((bdaddr_t *) (p2 + 4), ia);
102 baswap((bdaddr_t *) (p2 + 10), ra);
103
104 /* res = r XOR p1 */
105 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
106
107 /* res = e(k, res) */
108 err = smp_e(tfm, k, res);
109 if (err) {
110 BT_ERR("Encrypt data error");
111 return err;
112 }
113
114 /* res = res XOR p2 */
115 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
116
117 /* res = e(k, res) */
118 err = smp_e(tfm, k, res);
119 if (err)
120 BT_ERR("Encrypt data error");
121
122 return err;
123}
124
125static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16],
126 u8 r1[16], u8 r2[16], u8 _r[16])
127{
128 int err;
129
130 /* Just least significant octets from r1 and r2 are considered */
131 memcpy(_r, r1 + 8, 8);
132 memcpy(_r + 8, r2 + 8, 8);
133
134 err = smp_e(tfm, k, _r);
135 if (err)
136 BT_ERR("Encrypt data error");
137
138 return err;
139}
140
141static int smp_rand(u8 *buf)
142{
143 get_random_bytes(buf, 16);
144
145 return 0;
146}
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300147
148static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
149 u16 dlen, void *data)
150{
151 struct sk_buff *skb;
152 struct l2cap_hdr *lh;
153 int len;
154
155 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
156
157 if (len > conn->mtu)
158 return NULL;
159
160 skb = bt_skb_alloc(len, GFP_ATOMIC);
161 if (!skb)
162 return NULL;
163
164 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
165 lh->len = cpu_to_le16(sizeof(code) + dlen);
166 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
167
168 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
169
170 memcpy(skb_put(skb, dlen), data, dlen);
171
172 return skb;
173}
174
175static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
176{
177 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
178
179 BT_DBG("code 0x%2.2x", code);
180
181 if (!skb)
182 return;
183
184 hci_send_acl(conn->hcon, skb, 0);
185}
186
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300187static __u8 seclevel_to_authreq(__u8 level)
188{
189 switch (level) {
190 case BT_SECURITY_HIGH:
191 /* Right now we don't support bonding */
192 return SMP_AUTH_MITM;
193
194 default:
195 return SMP_AUTH_NONE;
196 }
197}
198
Vinicius Costa Gomesb8e66ea2011-06-09 18:50:52 -0300199static void build_pairing_cmd(struct l2cap_conn *conn,
Vinicius Costa Gomes54790f72011-07-07 18:59:38 -0300200 struct smp_cmd_pairing *req,
201 struct smp_cmd_pairing *rsp,
202 __u8 authreq)
Vinicius Costa Gomesb8e66ea2011-06-09 18:50:52 -0300203{
Vinicius Costa Gomes54790f72011-07-07 18:59:38 -0300204 u8 dist_keys;
205
206 dist_keys = 0;
207 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->flags)) {
208 dist_keys = SMP_DIST_ENC_KEY | SMP_DIST_ID_KEY | SMP_DIST_SIGN;
209 authreq |= SMP_AUTH_BONDING;
210 }
211
212 if (rsp == NULL) {
213 req->io_capability = conn->hcon->io_capability;
214 req->oob_flag = SMP_OOB_NOT_PRESENT;
215 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
216 req->init_key_dist = dist_keys;
217 req->resp_key_dist = dist_keys;
218 req->auth_req = authreq;
219 return;
220 }
221
222 rsp->io_capability = conn->hcon->io_capability;
223 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
224 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
225 rsp->init_key_dist = req->init_key_dist & dist_keys;
226 rsp->resp_key_dist = req->resp_key_dist & dist_keys;
227 rsp->auth_req = authreq;
Vinicius Costa Gomesb8e66ea2011-06-09 18:50:52 -0300228}
229
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300230static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
231{
232 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
233 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
234 return SMP_ENC_KEY_SIZE;
235
236 conn->smp_key_size = max_key_size;
237
238 return 0;
239}
240
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300241static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300242{
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300243 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
244 u8 key_size;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300245
246 BT_DBG("conn %p", conn);
247
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300248 conn->preq[0] = SMP_CMD_PAIRING_REQ;
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300249 memcpy(&conn->preq[1], req, sizeof(*req));
250 skb_pull(skb, sizeof(*req));
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300251
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300252 if (req->oob_flag)
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300253 return SMP_OOB_NOT_AVAIL;
254
255 /* We didn't start the pairing, so no requirements */
Vinicius Costa Gomes54790f72011-07-07 18:59:38 -0300256 build_pairing_cmd(conn, req, &rsp, SMP_AUTH_NONE);
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300257
258 key_size = min(req->max_key_size, rsp.max_key_size);
259 if (check_enc_key_size(conn, key_size))
260 return SMP_ENC_KEY_SIZE;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300261
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300262 /* Just works */
263 memset(conn->tk, 0, sizeof(conn->tk));
264
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300265 conn->prsp[0] = SMP_CMD_PAIRING_RSP;
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300266 memcpy(&conn->prsp[1], &rsp, sizeof(rsp));
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300267
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300268 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300269
Vinicius Costa Gomes5d3de7d2011-06-14 13:37:41 -0300270 mod_timer(&conn->security_timer, jiffies +
271 msecs_to_jiffies(SMP_TIMEOUT));
272
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300273 return 0;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300274}
275
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300276static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300277{
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300278 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300279 struct smp_cmd_pairing_confirm cp;
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300280 struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
281 int ret;
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300282 u8 res[16], key_size;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300283
284 BT_DBG("conn %p", conn);
285
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300286 skb_pull(skb, sizeof(*rsp));
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300287
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300288 req = (void *) &conn->preq[1];
289
290 key_size = min(req->max_key_size, rsp->max_key_size);
291 if (check_enc_key_size(conn, key_size))
292 return SMP_ENC_KEY_SIZE;
293
294 if (rsp->oob_flag)
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300295 return SMP_OOB_NOT_AVAIL;
296
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300297 /* Just works */
298 memset(conn->tk, 0, sizeof(conn->tk));
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300299
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300300 conn->prsp[0] = SMP_CMD_PAIRING_RSP;
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300301 memcpy(&conn->prsp[1], rsp, sizeof(*rsp));
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300302
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300303 ret = smp_rand(conn->prnd);
304 if (ret)
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300305 return SMP_UNSPECIFIED;
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300306
307 ret = smp_c1(tfm, conn->tk, conn->prnd, conn->preq, conn->prsp, 0,
308 conn->src, conn->hcon->dst_type, conn->dst, res);
309 if (ret)
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300310 return SMP_UNSPECIFIED;
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300311
312 swap128(res, cp.confirm_val);
313
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300314 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300315
316 return 0;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300317}
318
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300319static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300320{
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300321 struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
322
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300323 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
324
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300325 memcpy(conn->pcnf, skb->data, sizeof(conn->pcnf));
326 skb_pull(skb, sizeof(conn->pcnf));
327
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300328 if (conn->hcon->out) {
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300329 u8 random[16];
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300330
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300331 swap128(conn->prnd, random);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300332 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300333 random);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300334 } else {
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300335 struct smp_cmd_pairing_confirm cp;
336 int ret;
337 u8 res[16];
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300338
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300339 ret = smp_rand(conn->prnd);
340 if (ret)
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300341 return SMP_UNSPECIFIED;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300342
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300343 ret = smp_c1(tfm, conn->tk, conn->prnd, conn->preq, conn->prsp,
344 conn->hcon->dst_type, conn->dst,
345 0, conn->src, res);
346 if (ret)
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300347 return SMP_CONFIRM_FAILED;
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300348
349 swap128(res, cp.confirm_val);
350
351 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300352 }
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300353
Vinicius Costa Gomes5d3de7d2011-06-14 13:37:41 -0300354 mod_timer(&conn->security_timer, jiffies +
355 msecs_to_jiffies(SMP_TIMEOUT));
356
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300357 return 0;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300358}
359
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300360static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300361{
Vinicius Costa Gomesa7a595f2011-06-09 18:50:47 -0300362 struct hci_conn *hcon = conn->hcon;
363 struct crypto_blkcipher *tfm = hcon->hdev->tfm;
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300364 int ret;
Vinicius Costa Gomes9b3d6742011-06-09 18:50:48 -0300365 u8 key[16], res[16], random[16], confirm[16];
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300366
367 swap128(skb->data, random);
368 skb_pull(skb, sizeof(random));
369
Vinicius Costa Gomesa7a595f2011-06-09 18:50:47 -0300370 memset(hcon->ltk, 0, sizeof(hcon->ltk));
371
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300372 if (conn->hcon->out)
373 ret = smp_c1(tfm, conn->tk, random, conn->preq, conn->prsp, 0,
374 conn->src, conn->hcon->dst_type, conn->dst,
375 res);
376 else
377 ret = smp_c1(tfm, conn->tk, random, conn->preq, conn->prsp,
378 conn->hcon->dst_type, conn->dst, 0, conn->src,
379 res);
380 if (ret)
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300381 return SMP_UNSPECIFIED;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300382
383 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
384
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300385 swap128(res, confirm);
386
387 if (memcmp(conn->pcnf, confirm, sizeof(conn->pcnf)) != 0) {
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300388 BT_ERR("Pairing failed (confirmation values mismatch)");
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300389 return SMP_CONFIRM_FAILED;
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300390 }
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300391
392 if (conn->hcon->out) {
Vinicius Costa Gomesa7a595f2011-06-09 18:50:47 -0300393 __le16 ediv;
394 u8 rand[8];
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300395
Vinicius Costa Gomesa7a595f2011-06-09 18:50:47 -0300396 smp_s1(tfm, conn->tk, random, conn->prnd, key);
397 swap128(key, hcon->ltk);
398
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300399 memset(hcon->ltk + conn->smp_key_size, 0,
400 SMP_MAX_ENC_KEY_SIZE - conn->smp_key_size);
401
Vinicius Costa Gomesa7a595f2011-06-09 18:50:47 -0300402 memset(rand, 0, sizeof(rand));
403 ediv = 0;
404 hci_le_start_enc(hcon, ediv, rand, hcon->ltk);
Anderson Briglia7d24ddc2011-06-09 18:50:46 -0300405 } else {
406 u8 r[16];
407
408 swap128(conn->prnd, r);
409 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
410
411 smp_s1(tfm, conn->tk, conn->prnd, random, key);
Vinicius Costa Gomesa7a595f2011-06-09 18:50:47 -0300412 swap128(key, hcon->ltk);
Vinicius Costa Gomes3158c502011-06-14 13:37:42 -0300413
414 memset(hcon->ltk + conn->smp_key_size, 0,
415 SMP_MAX_ENC_KEY_SIZE - conn->smp_key_size);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300416 }
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300417
418 return 0;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300419}
420
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300421static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300422{
423 struct smp_cmd_security_req *rp = (void *) skb->data;
424 struct smp_cmd_pairing cp;
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300425 struct hci_conn *hcon = conn->hcon;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300426
427 BT_DBG("conn %p", conn);
428
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300429 if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300430 return 0;
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300431
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300432 skb_pull(skb, sizeof(*rp));
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300433
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300434 memset(&cp, 0, sizeof(cp));
Vinicius Costa Gomes54790f72011-07-07 18:59:38 -0300435 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300436
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300437 conn->preq[0] = SMP_CMD_PAIRING_REQ;
438 memcpy(&conn->preq[1], &cp, sizeof(cp));
439
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300440 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300441
Vinicius Costa Gomes5d3de7d2011-06-14 13:37:41 -0300442 mod_timer(&conn->security_timer, jiffies +
443 msecs_to_jiffies(SMP_TIMEOUT));
444
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300445 set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300446
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300447 return 0;
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300448}
449
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300450int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
451{
Vinicius Costa Gomes3a0259b2011-06-09 18:50:43 -0300452 struct hci_conn *hcon = conn->hcon;
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300453 __u8 authreq;
454
Vinicius Costa Gomes3a0259b2011-06-09 18:50:43 -0300455 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
456
Andre Guedes2e65c9d2011-06-30 19:20:56 -0300457 if (!lmp_host_le_capable(hcon->hdev))
458 return 1;
459
Vinicius Costa Gomes3a0259b2011-06-09 18:50:43 -0300460 if (IS_ERR(hcon->hdev->tfm))
461 return 1;
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300462
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300463 if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
464 return 0;
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300465
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300466 if (sec_level == BT_SECURITY_LOW)
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300467 return 1;
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300468
469 if (hcon->sec_level >= sec_level)
470 return 1;
471
472 authreq = seclevel_to_authreq(sec_level);
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300473
Vinicius Costa Gomes3a0259b2011-06-09 18:50:43 -0300474 if (hcon->link_mode & HCI_LM_MASTER) {
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300475 struct smp_cmd_pairing cp;
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300476
Vinicius Costa Gomes54790f72011-07-07 18:59:38 -0300477 build_pairing_cmd(conn, &cp, NULL, authreq);
Anderson Brigliaf01ead32011-06-09 18:50:45 -0300478 conn->preq[0] = SMP_CMD_PAIRING_REQ;
479 memcpy(&conn->preq[1], &cp, sizeof(cp));
480
Vinicius Costa Gomes5d3de7d2011-06-14 13:37:41 -0300481 mod_timer(&conn->security_timer, jiffies +
482 msecs_to_jiffies(SMP_TIMEOUT));
483
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300484 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
485 } else {
486 struct smp_cmd_security_req cp;
487 cp.auth_req = authreq;
488 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
489 }
490
Vinicius Costa Gomesf1cb9af2011-01-26 21:42:57 -0300491 hcon->pending_sec_level = sec_level;
492 set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
493
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300494 return 0;
495}
496
Vinicius Costa Gomes7034b912011-07-07 18:59:34 -0300497static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
498{
499 BT_DBG("conn %p", conn);
500 /* FIXME: store the ltk */
501 return 0;
502}
503
504static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
505{
506 struct smp_cmd_pairing *paircmd = (void *) &conn->prsp[1];
507 u8 keydist = paircmd->init_key_dist;
508
509 BT_DBG("keydist 0x%x", keydist);
510 /* FIXME: store ediv and rand */
511
512 smp_distribute_keys(conn, 1);
513
514 return 0;
515}
516
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300517int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
518{
519 __u8 code = skb->data[0];
520 __u8 reason;
521 int err = 0;
522
Andre Guedes2e65c9d2011-06-30 19:20:56 -0300523 if (!lmp_host_le_capable(conn->hcon->hdev)) {
524 err = -ENOTSUPP;
525 reason = SMP_PAIRING_NOTSUPP;
526 goto done;
527 }
528
Vinicius Costa Gomes3a0259b2011-06-09 18:50:43 -0300529 if (IS_ERR(conn->hcon->hdev->tfm)) {
530 err = PTR_ERR(conn->hcon->hdev->tfm);
531 reason = SMP_PAIRING_NOTSUPP;
532 goto done;
533 }
534
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300535 skb_pull(skb, sizeof(code));
536
537 switch (code) {
538 case SMP_CMD_PAIRING_REQ:
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300539 reason = smp_cmd_pairing_req(conn, skb);
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300540 break;
541
542 case SMP_CMD_PAIRING_FAIL:
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300543 reason = 0;
544 err = -EPERM;
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300545 break;
546
547 case SMP_CMD_PAIRING_RSP:
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300548 reason = smp_cmd_pairing_rsp(conn, skb);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300549 break;
550
551 case SMP_CMD_SECURITY_REQ:
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300552 reason = smp_cmd_security_req(conn, skb);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300553 break;
554
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300555 case SMP_CMD_PAIRING_CONFIRM:
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300556 reason = smp_cmd_pairing_confirm(conn, skb);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300557 break;
558
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300559 case SMP_CMD_PAIRING_RANDOM:
Vinicius Costa Gomesda85e5e2011-06-09 18:50:53 -0300560 reason = smp_cmd_pairing_random(conn, skb);
Anderson Briglia88ba43b2011-06-09 18:50:42 -0300561 break;
562
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300563 case SMP_CMD_ENCRYPT_INFO:
Vinicius Costa Gomes7034b912011-07-07 18:59:34 -0300564 reason = smp_cmd_encrypt_info(conn, skb);
565 break;
566
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300567 case SMP_CMD_MASTER_IDENT:
Vinicius Costa Gomes7034b912011-07-07 18:59:34 -0300568 reason = smp_cmd_master_ident(conn, skb);
569 break;
570
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300571 case SMP_CMD_IDENT_INFO:
572 case SMP_CMD_IDENT_ADDR_INFO:
573 case SMP_CMD_SIGN_INFO:
Vinicius Costa Gomes7034b912011-07-07 18:59:34 -0300574 /* Just ignored */
575 reason = 0;
576 break;
577
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300578 default:
579 BT_DBG("Unknown command code 0x%2.2x", code);
580
581 reason = SMP_CMD_NOTSUPP;
Vinicius Costa Gomes3a0259b2011-06-09 18:50:43 -0300582 err = -EOPNOTSUPP;
583 goto done;
584 }
585
586done:
587 if (reason)
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300588 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
589 &reason);
Anderson Brigliaeb492e02011-06-09 18:50:40 -0300590
591 kfree_skb(skb);
592 return err;
593}
Vinicius Costa Gomes7034b912011-07-07 18:59:34 -0300594
595int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
596{
597 struct smp_cmd_pairing *req, *rsp;
598 __u8 *keydist;
599
600 BT_DBG("conn %p force %d", conn, force);
601
602 if (IS_ERR(conn->hcon->hdev->tfm))
603 return PTR_ERR(conn->hcon->hdev->tfm);
604
605 rsp = (void *) &conn->prsp[1];
606
607 /* The responder sends its keys first */
608 if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
609 return 0;
610
611 req = (void *) &conn->preq[1];
612
613 if (conn->hcon->out) {
614 keydist = &rsp->init_key_dist;
615 *keydist &= req->init_key_dist;
616 } else {
617 keydist = &rsp->resp_key_dist;
618 *keydist &= req->resp_key_dist;
619 }
620
621
622 BT_DBG("keydist 0x%x", *keydist);
623
624 if (*keydist & SMP_DIST_ENC_KEY) {
625 struct smp_cmd_encrypt_info enc;
626 struct smp_cmd_master_ident ident;
627 __le16 ediv;
628
629 get_random_bytes(enc.ltk, sizeof(enc.ltk));
630 get_random_bytes(&ediv, sizeof(ediv));
631 get_random_bytes(ident.rand, sizeof(ident.rand));
632
633 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
634
635 ident.ediv = cpu_to_le16(ediv);
636
637 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
638
639 *keydist &= ~SMP_DIST_ENC_KEY;
640 }
641
642 if (*keydist & SMP_DIST_ID_KEY) {
643 struct smp_cmd_ident_addr_info addrinfo;
644 struct smp_cmd_ident_info idinfo;
645
646 /* Send a dummy key */
647 get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
648
649 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
650
651 /* Just public address */
652 memset(&addrinfo, 0, sizeof(addrinfo));
653 bacpy(&addrinfo.bdaddr, conn->src);
654
655 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
656 &addrinfo);
657
658 *keydist &= ~SMP_DIST_ID_KEY;
659 }
660
661 if (*keydist & SMP_DIST_SIGN) {
662 struct smp_cmd_sign_info sign;
663
664 /* Send a dummy key */
665 get_random_bytes(sign.csrk, sizeof(sign.csrk));
666
667 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
668
669 *keydist &= ~SMP_DIST_SIGN;
670 }
671
672 return 0;
673}