| /****************************************************************************** |
| * |
| * Copyright (C) 1999-2012 Broadcom Corporation |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at: |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| *****************************************************************************/ |
| |
| /****************************************************************************** |
| * |
| * This file contains functions for the SMP L2CAP utility functions |
| * |
| ******************************************************************************/ |
| #include "bt_target.h" |
| |
| #include <ctype.h> |
| #include <string.h> |
| #include "bt_types.h" |
| #include "bt_utils.h" |
| #include "btm_ble_api.h" |
| #include "btm_int.h" |
| #include "device/include/controller.h" |
| #include "hcidefs.h" |
| #include "l2c_api.h" |
| #include "l2c_int.h" |
| #include "osi/include/osi.h" |
| #include "smp_int.h" |
| |
| extern fixed_queue_t* btu_general_alarm_queue; |
| |
| #define SMP_PAIRING_REQ_SIZE 7 |
| #define SMP_CONFIRM_CMD_SIZE (BT_OCTET16_LEN + 1) |
| #define SMP_RAND_CMD_SIZE (BT_OCTET16_LEN + 1) |
| #define SMP_INIT_CMD_SIZE (BT_OCTET16_LEN + 1) |
| #define SMP_ENC_INFO_SIZE (BT_OCTET16_LEN + 1) |
| #define SMP_MASTER_ID_SIZE (BT_OCTET8_LEN + 2 + 1) |
| #define SMP_ID_INFO_SIZE (BT_OCTET16_LEN + 1) |
| #define SMP_ID_ADDR_SIZE (BD_ADDR_LEN + 1 + 1) |
| #define SMP_SIGN_INFO_SIZE (BT_OCTET16_LEN + 1) |
| #define SMP_PAIR_FAIL_SIZE 2 |
| #define SMP_SECURITY_REQUEST_SIZE 2 |
| #define SMP_PAIR_PUBL_KEY_SIZE (1 /* opcode */ + (2 * BT_OCTET32_LEN)) |
| #define SMP_PAIR_COMMITM_SIZE (1 /* opcode */ + BT_OCTET16_LEN /*Commitment*/) |
| #define SMP_PAIR_DHKEY_CHECK_SIZE \ |
| (1 /* opcode */ + BT_OCTET16_LEN /*DHKey Check*/) |
| #define SMP_PAIR_KEYPR_NOTIF_SIZE (1 /* opcode */ + 1 /*Notif Type*/) |
| |
| /* SMP command sizes per spec */ |
| static const uint8_t smp_cmd_size_per_spec[] = { |
| 0, |
| SMP_PAIRING_REQ_SIZE, /* 0x01: pairing request */ |
| SMP_PAIRING_REQ_SIZE, /* 0x02: pairing response */ |
| SMP_CONFIRM_CMD_SIZE, /* 0x03: pairing confirm */ |
| SMP_RAND_CMD_SIZE, /* 0x04: pairing random */ |
| SMP_PAIR_FAIL_SIZE, /* 0x05: pairing failed */ |
| SMP_ENC_INFO_SIZE, /* 0x06: encryption information */ |
| SMP_MASTER_ID_SIZE, /* 0x07: master identification */ |
| SMP_ID_INFO_SIZE, /* 0x08: identity information */ |
| SMP_ID_ADDR_SIZE, /* 0x09: identity address information */ |
| SMP_SIGN_INFO_SIZE, /* 0x0A: signing information */ |
| SMP_SECURITY_REQUEST_SIZE, /* 0x0B: security request */ |
| SMP_PAIR_PUBL_KEY_SIZE, /* 0x0C: pairing public key */ |
| SMP_PAIR_DHKEY_CHECK_SIZE, /* 0x0D: pairing dhkey check */ |
| SMP_PAIR_KEYPR_NOTIF_SIZE, /* 0x0E: pairing keypress notification */ |
| SMP_PAIR_COMMITM_SIZE /* 0x0F: pairing commitment */ |
| }; |
| |
| static bool smp_parameter_unconditionally_valid(tSMP_CB* p_cb); |
| static bool smp_parameter_unconditionally_invalid(tSMP_CB* p_cb); |
| |
| /* type for SMP command length validation functions */ |
| typedef bool (*tSMP_CMD_LEN_VALID)(tSMP_CB* p_cb); |
| |
| static bool smp_command_has_valid_fixed_length(tSMP_CB* p_cb); |
| |
| static const tSMP_CMD_LEN_VALID smp_cmd_len_is_valid[] = { |
| smp_parameter_unconditionally_invalid, |
| smp_command_has_valid_fixed_length, /* 0x01: pairing request */ |
| smp_command_has_valid_fixed_length, /* 0x02: pairing response */ |
| smp_command_has_valid_fixed_length, /* 0x03: pairing confirm */ |
| smp_command_has_valid_fixed_length, /* 0x04: pairing random */ |
| smp_command_has_valid_fixed_length, /* 0x05: pairing failed */ |
| smp_command_has_valid_fixed_length, /* 0x06: encryption information */ |
| smp_command_has_valid_fixed_length, /* 0x07: master identification */ |
| smp_command_has_valid_fixed_length, /* 0x08: identity information */ |
| smp_command_has_valid_fixed_length, /* 0x09: identity address information */ |
| smp_command_has_valid_fixed_length, /* 0x0A: signing information */ |
| smp_command_has_valid_fixed_length, /* 0x0B: security request */ |
| smp_command_has_valid_fixed_length, /* 0x0C: pairing public key */ |
| smp_command_has_valid_fixed_length, /* 0x0D: pairing dhkey check */ |
| smp_command_has_valid_fixed_length, /* 0x0E: pairing keypress notification*/ |
| smp_command_has_valid_fixed_length /* 0x0F: pairing commitment */ |
| }; |
| |
| /* type for SMP command parameter ranges validation functions */ |
| typedef bool (*tSMP_CMD_PARAM_RANGES_VALID)(tSMP_CB* p_cb); |
| |
| static bool smp_pairing_request_response_parameters_are_valid(tSMP_CB* p_cb); |
| static bool smp_pairing_keypress_notification_is_valid(tSMP_CB* p_cb); |
| |
| static const tSMP_CMD_PARAM_RANGES_VALID smp_cmd_param_ranges_are_valid[] = { |
| smp_parameter_unconditionally_invalid, |
| smp_pairing_request_response_parameters_are_valid, /* 0x01: pairing |
| request */ |
| smp_pairing_request_response_parameters_are_valid, /* 0x02: pairing |
| response */ |
| smp_parameter_unconditionally_valid, /* 0x03: pairing confirm */ |
| smp_parameter_unconditionally_valid, /* 0x04: pairing random */ |
| smp_parameter_unconditionally_valid, /* 0x05: pairing failed */ |
| smp_parameter_unconditionally_valid, /* 0x06: encryption information */ |
| smp_parameter_unconditionally_valid, /* 0x07: master identification */ |
| smp_parameter_unconditionally_valid, /* 0x08: identity information */ |
| smp_parameter_unconditionally_valid, /* 0x09: identity address |
| information */ |
| smp_parameter_unconditionally_valid, /* 0x0A: signing information */ |
| smp_parameter_unconditionally_valid, /* 0x0B: security request */ |
| smp_parameter_unconditionally_valid, /* 0x0C: pairing public key */ |
| smp_parameter_unconditionally_valid, /* 0x0D: pairing dhkey check */ |
| smp_pairing_keypress_notification_is_valid, /* 0x0E: pairing keypress |
| notification */ |
| smp_parameter_unconditionally_valid /* 0x0F: pairing commitment */ |
| }; |
| |
| /* type for action functions */ |
| typedef BT_HDR* (*tSMP_CMD_ACT)(uint8_t cmd_code, tSMP_CB* p_cb); |
| |
| static BT_HDR* smp_build_pairing_cmd(uint8_t cmd_code, tSMP_CB* p_cb); |
| static BT_HDR* smp_build_confirm_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_rand_cmd(UNUSED_ATTR uint8_t cmd_code, tSMP_CB* p_cb); |
| static BT_HDR* smp_build_pairing_fail(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_identity_info_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_encrypt_info_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_security_request(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_signing_info_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_master_id_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_id_addr_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_pair_public_key_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_pairing_commitment_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_pair_dhkey_check_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb); |
| static BT_HDR* smp_build_pairing_keypress_notification_cmd( |
| UNUSED_ATTR uint8_t cmd_code, tSMP_CB* p_cb); |
| |
| static const tSMP_CMD_ACT smp_cmd_build_act[] = { |
| NULL, smp_build_pairing_cmd, /* 0x01: pairing request */ |
| smp_build_pairing_cmd, /* 0x02: pairing response */ |
| smp_build_confirm_cmd, /* 0x03: pairing confirm */ |
| smp_build_rand_cmd, /* 0x04: pairing random */ |
| smp_build_pairing_fail, /* 0x05: pairing failure */ |
| smp_build_encrypt_info_cmd, /* 0x06: encryption information */ |
| smp_build_master_id_cmd, /* 0x07: master identification */ |
| smp_build_identity_info_cmd, /* 0x08: identity information */ |
| smp_build_id_addr_cmd, /* 0x09: identity address information */ |
| smp_build_signing_info_cmd, /* 0x0A: signing information */ |
| smp_build_security_request, /* 0x0B: security request */ |
| smp_build_pair_public_key_cmd, /* 0x0C: pairing public key */ |
| smp_build_pair_dhkey_check_cmd, /* 0x0D: pairing DHKey check */ |
| smp_build_pairing_keypress_notification_cmd, /* 0x0E: pairing keypress |
| notification */ |
| smp_build_pairing_commitment_cmd /* 0x0F: pairing commitment */ |
| }; |
| |
| static const uint8_t smp_association_table[2][SMP_IO_CAP_MAX][SMP_IO_CAP_MAX] = |
| { |
| /* display only */ /* Display Yes/No */ /* keyboard only */ |
| /* No Input/Output */ /* keyboard display */ |
| |
| /* initiator */ |
| /* model = tbl[peer_io_caps][loc_io_caps] */ |
| /* Display Only */ |
| {{SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_PASSKEY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}, |
| |
| /* Display Yes/No */ |
| {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_PASSKEY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}, |
| |
| /* Keyboard only */ |
| {SMP_MODEL_KEY_NOTIF, SMP_MODEL_KEY_NOTIF, SMP_MODEL_PASSKEY, |
| SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}, |
| |
| /* No Input No Output */ |
| {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_ENCRYPTION_ONLY}, |
| |
| /* keyboard display */ |
| {SMP_MODEL_KEY_NOTIF, SMP_MODEL_KEY_NOTIF, SMP_MODEL_PASSKEY, |
| SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}}, |
| |
| /* responder */ |
| /* model = tbl[loc_io_caps][peer_io_caps] */ |
| /* Display Only */ |
| {{SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_KEY_NOTIF, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}, |
| |
| /* Display Yes/No */ |
| {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_KEY_NOTIF, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}, |
| |
| /* keyboard only */ |
| {SMP_MODEL_PASSKEY, SMP_MODEL_PASSKEY, SMP_MODEL_PASSKEY, |
| SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}, |
| |
| /* No Input No Output */ |
| {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, |
| SMP_MODEL_ENCRYPTION_ONLY}, |
| |
| /* keyboard display */ |
| {SMP_MODEL_PASSKEY, SMP_MODEL_PASSKEY, SMP_MODEL_KEY_NOTIF, |
| SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}}}; |
| |
| static const uint8_t |
| smp_association_table_sc[2][SMP_IO_CAP_MAX][SMP_IO_CAP_MAX] = { |
| /* display only */ /* Display Yes/No */ /* keyboard only */ |
| /* No InputOutput */ /* keyboard display */ |
| |
| /* initiator */ |
| /* model = tbl[peer_io_caps][loc_io_caps] */ |
| |
| /* Display Only */ |
| {{SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_PASSKEY_ENT, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_PASSKEY_ENT}, |
| |
| /* Display Yes/No */ |
| {SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_NUM_COMP, |
| SMP_MODEL_SEC_CONN_PASSKEY_ENT, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_NUM_COMP}, |
| |
| /* keyboard only */ |
| {SMP_MODEL_SEC_CONN_PASSKEY_DISP, SMP_MODEL_SEC_CONN_PASSKEY_DISP, |
| SMP_MODEL_SEC_CONN_PASSKEY_ENT, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_PASSKEY_DISP}, |
| |
| /* No Input No Output */ |
| {SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_JUSTWORKS}, |
| |
| /* keyboard display */ |
| {SMP_MODEL_SEC_CONN_PASSKEY_DISP, SMP_MODEL_SEC_CONN_NUM_COMP, |
| SMP_MODEL_SEC_CONN_PASSKEY_ENT, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_NUM_COMP}}, |
| |
| /* responder */ |
| /* model = tbl[loc_io_caps][peer_io_caps] */ |
| |
| /* Display Only */ |
| {{SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_PASSKEY_DISP, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_PASSKEY_DISP}, |
| |
| /* Display Yes/No */ |
| {SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_NUM_COMP, |
| SMP_MODEL_SEC_CONN_PASSKEY_DISP, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_NUM_COMP}, |
| |
| /* keyboard only */ |
| {SMP_MODEL_SEC_CONN_PASSKEY_ENT, SMP_MODEL_SEC_CONN_PASSKEY_ENT, |
| SMP_MODEL_SEC_CONN_PASSKEY_ENT, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_PASSKEY_ENT}, |
| |
| /* No Input No Output */ |
| {SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_JUSTWORKS, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_JUSTWORKS}, |
| |
| /* keyboard display */ |
| {SMP_MODEL_SEC_CONN_PASSKEY_ENT, SMP_MODEL_SEC_CONN_NUM_COMP, |
| SMP_MODEL_SEC_CONN_PASSKEY_DISP, SMP_MODEL_SEC_CONN_JUSTWORKS, |
| SMP_MODEL_SEC_CONN_NUM_COMP}}}; |
| |
| static tSMP_ASSO_MODEL smp_select_legacy_association_model(tSMP_CB* p_cb); |
| static tSMP_ASSO_MODEL smp_select_association_model_secure_connections( |
| tSMP_CB* p_cb); |
| |
| /******************************************************************************* |
| * |
| * Function smp_send_msg_to_L2CAP |
| * |
| * Description Send message to L2CAP. |
| * |
| ******************************************************************************/ |
| bool smp_send_msg_to_L2CAP(const RawAddress& rem_bda, BT_HDR* p_toL2CAP) { |
| uint16_t l2cap_ret; |
| uint16_t fixed_cid = L2CAP_SMP_CID; |
| |
| if (smp_cb.smp_over_br) { |
| fixed_cid = L2CAP_SMP_BR_CID; |
| } |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| smp_cb.total_tx_unacked += 1; |
| |
| l2cap_ret = L2CA_SendFixedChnlData(fixed_cid, rem_bda, p_toL2CAP); |
| if (l2cap_ret == L2CAP_DW_FAILED) { |
| smp_cb.total_tx_unacked -= 1; |
| SMP_TRACE_ERROR("SMP failed to pass msg:0x%0x to L2CAP", |
| *((uint8_t*)(p_toL2CAP + 1) + p_toL2CAP->offset)); |
| return false; |
| } else |
| return true; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_send_cmd |
| * |
| * Description send a SMP command on L2CAP channel. |
| * |
| ******************************************************************************/ |
| bool smp_send_cmd(uint8_t cmd_code, tSMP_CB* p_cb) { |
| BT_HDR* p_buf; |
| bool sent = false; |
| uint8_t failure = SMP_PAIR_INTERNAL_ERR; |
| SMP_TRACE_EVENT("smp_send_cmd on l2cap cmd_code=0x%x", cmd_code); |
| if (cmd_code <= (SMP_OPCODE_MAX + 1 /* for SMP_OPCODE_PAIR_COMMITM */) && |
| smp_cmd_build_act[cmd_code] != NULL) { |
| p_buf = (*smp_cmd_build_act[cmd_code])(cmd_code, p_cb); |
| |
| if (p_buf != NULL && smp_send_msg_to_L2CAP(p_cb->pairing_bda, p_buf)) { |
| sent = true; |
| alarm_set_on_queue(p_cb->smp_rsp_timer_ent, SMP_WAIT_FOR_RSP_TIMEOUT_MS, |
| smp_rsp_timeout, NULL, btu_general_alarm_queue); |
| } |
| } |
| |
| if (!sent) { |
| if (p_cb->smp_over_br) { |
| smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &failure); |
| } else { |
| smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure); |
| } |
| } |
| return sent; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_rsp_timeout |
| * |
| * Description Called when SMP wait for SMP command response timer expires |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_rsp_timeout(UNUSED_ATTR void* data) { |
| tSMP_CB* p_cb = &smp_cb; |
| uint8_t failure = SMP_RSP_TIMEOUT; |
| |
| SMP_TRACE_EVENT("%s state:%d br_state:%d", __func__, p_cb->state, |
| p_cb->br_state); |
| |
| if (p_cb->smp_over_br) { |
| smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &failure); |
| } else { |
| smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure); |
| } |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_delayed_auth_complete_timeout |
| * |
| * Description Called when no pairing failed command received within |
| * timeout period. |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_delayed_auth_complete_timeout(UNUSED_ATTR void* data) { |
| /* |
| * Waited for potential pair failure. Send SMP_AUTH_CMPL_EVT if |
| * the state is still in bond pending. |
| */ |
| if (smp_get_state() == SMP_STATE_BOND_PENDING) { |
| uint8_t reason = SMP_SUCCESS; |
| SMP_TRACE_EVENT("%s sending delayed auth complete.", __func__); |
| smp_sm_event(&smp_cb, SMP_AUTH_CMPL_EVT, &reason); |
| } |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_pairing_req_cmd |
| * |
| * Description Build pairing request command. |
| * |
| ******************************************************************************/ |
| BT_HDR* smp_build_pairing_cmd(uint8_t cmd_code, tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_PAIRING_REQ_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, cmd_code); |
| UINT8_TO_STREAM(p, p_cb->local_io_capability); |
| UINT8_TO_STREAM(p, p_cb->loc_oob_flag); |
| UINT8_TO_STREAM(p, p_cb->loc_auth_req); |
| UINT8_TO_STREAM(p, p_cb->loc_enc_size); |
| UINT8_TO_STREAM(p, p_cb->local_i_key); |
| UINT8_TO_STREAM(p, p_cb->local_r_key); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| /* 1B ERR_RSP op code + 1B cmd_op_code + 2B handle + 1B status */ |
| p_buf->len = SMP_PAIRING_REQ_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_confirm_cmd |
| * |
| * Description Build confirm request command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_confirm_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_CONFIRM_CMD_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| |
| UINT8_TO_STREAM(p, SMP_OPCODE_CONFIRM); |
| ARRAY_TO_STREAM(p, p_cb->confirm, BT_OCTET16_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_CONFIRM_CMD_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_rand_cmd |
| * |
| * Description Build Random command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_rand_cmd(UNUSED_ATTR uint8_t cmd_code, tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_RAND_CMD_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_RAND); |
| ARRAY_TO_STREAM(p, p_cb->rand, BT_OCTET16_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_RAND_CMD_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_encrypt_info_cmd |
| * |
| * Description Build security information command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_encrypt_info_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_ENC_INFO_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_ENCRYPT_INFO); |
| ARRAY_TO_STREAM(p, p_cb->ltk, BT_OCTET16_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_ENC_INFO_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_master_id_cmd |
| * |
| * Description Build security information command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_master_id_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_MASTER_ID_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_MASTER_ID); |
| UINT16_TO_STREAM(p, p_cb->ediv); |
| ARRAY_TO_STREAM(p, p_cb->enc_rand, BT_OCTET8_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_MASTER_ID_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_identity_info_cmd |
| * |
| * Description Build identity information command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_identity_info_cmd(UNUSED_ATTR uint8_t cmd_code, |
| UNUSED_ATTR tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_OCTET16 irk; |
| BT_HDR* p_buf = |
| (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_ID_INFO_SIZE + L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| |
| BTM_GetDeviceIDRoot(irk); |
| |
| UINT8_TO_STREAM(p, SMP_OPCODE_IDENTITY_INFO); |
| ARRAY_TO_STREAM(p, irk, BT_OCTET16_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_ID_INFO_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_id_addr_cmd |
| * |
| * Description Build identity address information command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_id_addr_cmd(UNUSED_ATTR uint8_t cmd_code, |
| UNUSED_ATTR tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = |
| (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_ID_ADDR_SIZE + L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_ID_ADDR); |
| UINT8_TO_STREAM(p, 0); |
| BDADDR_TO_STREAM(p, *controller_get_interface()->get_address()); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_ID_ADDR_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_signing_info_cmd |
| * |
| * Description Build signing information command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_signing_info_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_SIGN_INFO_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_SIGN_INFO); |
| ARRAY_TO_STREAM(p, p_cb->csrk, BT_OCTET16_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_SIGN_INFO_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_pairing_fail |
| * |
| * Description Build Pairing Fail command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_pairing_fail(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_PAIR_FAIL_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_PAIRING_FAILED); |
| UINT8_TO_STREAM(p, p_cb->failure); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_PAIR_FAIL_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_security_request |
| * |
| * Description Build security request command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_security_request(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + 2 + L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_SEC_REQ); |
| UINT8_TO_STREAM(p, p_cb->loc_auth_req); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_SECURITY_REQUEST_SIZE; |
| |
| SMP_TRACE_EVENT("opcode=%d auth_req=0x%x", SMP_OPCODE_SEC_REQ, |
| p_cb->loc_auth_req); |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_pair_public_key_cmd |
| * |
| * Description Build pairing public key command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_pair_public_key_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| uint8_t publ_key[2 * BT_OCTET32_LEN]; |
| uint8_t* p_publ_key = publ_key; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_PAIR_PUBL_KEY_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| memcpy(p_publ_key, p_cb->loc_publ_key.x, BT_OCTET32_LEN); |
| memcpy(p_publ_key + BT_OCTET32_LEN, p_cb->loc_publ_key.y, BT_OCTET32_LEN); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_PAIR_PUBLIC_KEY); |
| ARRAY_TO_STREAM(p, p_publ_key, 2 * BT_OCTET32_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_PAIR_PUBL_KEY_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_pairing_commitment_cmd |
| * |
| * Description Build pairing commitment command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_pairing_commitment_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_PAIR_COMMITM_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_CONFIRM); |
| ARRAY_TO_STREAM(p, p_cb->commitment, BT_OCTET16_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_PAIR_COMMITM_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_pair_dhkey_check_cmd |
| * |
| * Description Build pairing DHKey check command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_pair_dhkey_check_cmd(UNUSED_ATTR uint8_t cmd_code, |
| tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc( |
| sizeof(BT_HDR) + SMP_PAIR_DHKEY_CHECK_SIZE + L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_PAIR_DHKEY_CHECK); |
| ARRAY_TO_STREAM(p, p_cb->dhkey_check, BT_OCTET16_LEN); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_PAIR_DHKEY_CHECK_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_build_pairing_keypress_notification_cmd |
| * |
| * Description Build keypress notification command. |
| * |
| ******************************************************************************/ |
| static BT_HDR* smp_build_pairing_keypress_notification_cmd( |
| UNUSED_ATTR uint8_t cmd_code, tSMP_CB* p_cb) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc( |
| sizeof(BT_HDR) + SMP_PAIR_KEYPR_NOTIF_SIZE + L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_PAIR_KEYPR_NOTIF); |
| UINT8_TO_STREAM(p, p_cb->local_keypress_notification); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_PAIR_KEYPR_NOTIF_SIZE; |
| |
| return p_buf; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_convert_string_to_tk |
| * |
| * Description This function is called to convert a 6 to 16 digits numeric |
| * character string into SMP TK. |
| * |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_convert_string_to_tk(BT_OCTET16 tk, uint32_t passkey) { |
| uint8_t* p = tk; |
| tSMP_KEY key; |
| SMP_TRACE_EVENT("smp_convert_string_to_tk"); |
| UINT32_TO_STREAM(p, passkey); |
| |
| key.key_type = SMP_KEY_TYPE_TK; |
| key.p_data = tk; |
| |
| smp_sm_event(&smp_cb, SMP_KEY_READY_EVT, &key); |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_mask_enc_key |
| * |
| * Description This function is called to mask off the encryption key based |
| * on the maximum encryption key size. |
| * |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_mask_enc_key(uint8_t loc_enc_size, uint8_t* p_data) { |
| SMP_TRACE_EVENT("smp_mask_enc_key"); |
| if (loc_enc_size < BT_OCTET16_LEN) { |
| for (; loc_enc_size < BT_OCTET16_LEN; loc_enc_size++) |
| *(p_data + loc_enc_size) = 0; |
| } |
| return; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_xor_128 |
| * |
| * Description utility function to do an biteise exclusive-OR of two bit |
| * strings of the length of BT_OCTET16_LEN. |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_xor_128(BT_OCTET16 a, BT_OCTET16 b) { |
| uint8_t i, *aa = a, *bb = b; |
| |
| SMP_TRACE_EVENT("smp_xor_128"); |
| for (i = 0; i < BT_OCTET16_LEN; i++) { |
| aa[i] = aa[i] ^ bb[i]; |
| } |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_cb_cleanup |
| * |
| * Description Clean up SMP control block |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_cb_cleanup(tSMP_CB* p_cb) { |
| tSMP_CALLBACK* p_callback = p_cb->p_callback; |
| uint8_t trace_level = p_cb->trace_level; |
| alarm_t* smp_rsp_timer_ent = p_cb->smp_rsp_timer_ent; |
| alarm_t* delayed_auth_timer_ent = p_cb->delayed_auth_timer_ent; |
| |
| SMP_TRACE_EVENT("smp_cb_cleanup"); |
| |
| alarm_cancel(p_cb->smp_rsp_timer_ent); |
| alarm_cancel(p_cb->delayed_auth_timer_ent); |
| memset(p_cb, 0, sizeof(tSMP_CB)); |
| p_cb->p_callback = p_callback; |
| p_cb->trace_level = trace_level; |
| p_cb->smp_rsp_timer_ent = smp_rsp_timer_ent; |
| p_cb->delayed_auth_timer_ent = delayed_auth_timer_ent; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_remove_fixed_channel |
| * |
| * Description This function is called to remove the fixed channel |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_remove_fixed_channel(tSMP_CB* p_cb) { |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| if (p_cb->smp_over_br) |
| L2CA_RemoveFixedChnl(L2CAP_SMP_BR_CID, p_cb->pairing_bda); |
| else |
| L2CA_RemoveFixedChnl(L2CAP_SMP_CID, p_cb->pairing_bda); |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_reset_control_value |
| * |
| * Description This function is called to reset the control block value |
| * when the pairing procedure finished. |
| * |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_reset_control_value(tSMP_CB* p_cb) { |
| SMP_TRACE_EVENT("%s", __func__); |
| |
| alarm_cancel(p_cb->smp_rsp_timer_ent); |
| p_cb->flags = 0; |
| /* set the link idle timer to drop the link when pairing is done |
| usually service discovery will follow authentication complete, to avoid |
| racing condition for a link down/up, set link idle timer to be |
| SMP_LINK_TOUT_MIN to guarantee SMP key exchange */ |
| L2CA_SetIdleTimeoutByBdAddr(p_cb->pairing_bda, SMP_LINK_TOUT_MIN, |
| BT_TRANSPORT_LE); |
| |
| /* We can tell L2CAP to remove the fixed channel (if it has one) */ |
| smp_remove_fixed_channel(p_cb); |
| smp_cb_cleanup(p_cb); |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_proc_pairing_cmpl |
| * |
| * Description This function is called to process pairing complete |
| * |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_proc_pairing_cmpl(tSMP_CB* p_cb) { |
| tSMP_EVT_DATA evt_data = {0}; |
| tSMP_CALLBACK* p_callback = p_cb->p_callback; |
| |
| SMP_TRACE_DEBUG("smp_proc_pairing_cmpl "); |
| |
| evt_data.cmplt.reason = p_cb->status; |
| evt_data.cmplt.smp_over_br = p_cb->smp_over_br; |
| |
| if (p_cb->status == SMP_SUCCESS) evt_data.cmplt.sec_level = p_cb->sec_level; |
| |
| evt_data.cmplt.is_pair_cancel = false; |
| |
| if (p_cb->is_pair_cancel) evt_data.cmplt.is_pair_cancel = true; |
| |
| SMP_TRACE_DEBUG("send SMP_COMPLT_EVT reason=0x%0x sec_level=0x%0x", |
| evt_data.cmplt.reason, evt_data.cmplt.sec_level); |
| |
| RawAddress pairing_bda = p_cb->pairing_bda; |
| |
| smp_reset_control_value(p_cb); |
| |
| if (p_callback) (*p_callback)(SMP_COMPLT_EVT, pairing_bda, &evt_data); |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_command_has_invalid_parameters |
| * |
| * Description Checks if the received SMP command has invalid parameters |
| * i.e. if the command length is valid and the command |
| * parameters are inside specified range. |
| * It returns true if the command has invalid parameters. |
| * |
| * Returns true if the command has invalid parameters, false otherwise. |
| * |
| ******************************************************************************/ |
| bool smp_command_has_invalid_parameters(tSMP_CB* p_cb) { |
| uint8_t cmd_code = p_cb->rcvd_cmd_code; |
| |
| if ((cmd_code > (SMP_OPCODE_MAX + 1 /* for SMP_OPCODE_PAIR_COMMITM */)) || |
| (cmd_code < SMP_OPCODE_MIN)) { |
| SMP_TRACE_WARNING("%s: Received command with RESERVED code 0x%02x", |
| __func__, cmd_code); |
| return true; |
| } |
| |
| if (!(*smp_cmd_len_is_valid[cmd_code])(p_cb)) { |
| SMP_TRACE_WARNING("%s: Command length not valid for cmd_code 0x%02x", |
| __func__, cmd_code); |
| return true; |
| } |
| |
| if (!(*smp_cmd_param_ranges_are_valid[cmd_code])(p_cb)) { |
| SMP_TRACE_WARNING("%s: Parameter ranges not valid code 0x%02x", __func__, |
| cmd_code); |
| return true; |
| } |
| |
| return false; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_command_has_valid_fixed_length |
| * |
| * Description Checks if the received command size is equal to the size |
| * according to specs. |
| * |
| * Returns true if the command size is as expected, false otherwise. |
| * |
| * Note The command is expected to have fixed length. |
| ******************************************************************************/ |
| bool smp_command_has_valid_fixed_length(tSMP_CB* p_cb) { |
| uint8_t cmd_code = p_cb->rcvd_cmd_code; |
| |
| SMP_TRACE_DEBUG("%s for cmd code 0x%02x", __func__, cmd_code); |
| |
| if (p_cb->rcvd_cmd_len != smp_cmd_size_per_spec[cmd_code]) { |
| SMP_TRACE_WARNING( |
| "Rcvd from the peer cmd 0x%02x with invalid length " |
| "0x%02x (per spec the length is 0x%02x).", |
| cmd_code, p_cb->rcvd_cmd_len, smp_cmd_size_per_spec[cmd_code]); |
| return false; |
| } |
| |
| return true; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_pairing_request_response_parameters_are_valid |
| * |
| * Description Validates parameter ranges in the received SMP command |
| * pairing request or pairing response. |
| * The parameters to validate: |
| * IO capability, |
| * OOB data flag, |
| * Bonding_flags in AuthReq |
| * Maximum encryption key size. |
| * Returns false if at least one of these parameters is out of |
| * range. |
| * |
| ******************************************************************************/ |
| bool smp_pairing_request_response_parameters_are_valid(tSMP_CB* p_cb) { |
| uint8_t io_caps = p_cb->peer_io_caps; |
| uint8_t oob_flag = p_cb->peer_oob_flag; |
| uint8_t bond_flag = |
| p_cb->peer_auth_req & 0x03; // 0x03 is gen bond with appropriate mask |
| uint8_t enc_size = p_cb->peer_enc_size; |
| |
| SMP_TRACE_DEBUG("%s for cmd code 0x%02x", __func__, p_cb->rcvd_cmd_code); |
| |
| if (io_caps >= BTM_IO_CAP_MAX) { |
| SMP_TRACE_WARNING( |
| "Rcvd from the peer cmd 0x%02x with IO Capability " |
| "value (0x%02x) out of range).", |
| p_cb->rcvd_cmd_code, io_caps); |
| return false; |
| } |
| |
| if (!((oob_flag == SMP_OOB_NONE) || (oob_flag == SMP_OOB_PRESENT))) { |
| SMP_TRACE_WARNING( |
| "Rcvd from the peer cmd 0x%02x with OOB data flag value " |
| "(0x%02x) out of range).", |
| p_cb->rcvd_cmd_code, oob_flag); |
| return false; |
| } |
| |
| if (!((bond_flag == SMP_AUTH_NO_BOND) || (bond_flag == SMP_AUTH_BOND))) { |
| SMP_TRACE_WARNING( |
| "Rcvd from the peer cmd 0x%02x with Bonding_Flags value (0x%02x) " |
| "out of range).", |
| p_cb->rcvd_cmd_code, bond_flag); |
| return false; |
| } |
| |
| if ((enc_size < SMP_ENCR_KEY_SIZE_MIN) || |
| (enc_size > SMP_ENCR_KEY_SIZE_MAX)) { |
| SMP_TRACE_WARNING( |
| "Rcvd from the peer cmd 0x%02x with Maximum Encryption " |
| "Key value (0x%02x) out of range).", |
| p_cb->rcvd_cmd_code, enc_size); |
| return false; |
| } |
| |
| return true; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_pairing_keypress_notification_is_valid |
| * |
| * Description Validates Notification Type parameter range in the received |
| * SMP command pairing keypress notification. |
| * Returns false if this parameter is out of range. |
| * |
| ******************************************************************************/ |
| bool smp_pairing_keypress_notification_is_valid(tSMP_CB* p_cb) { |
| tBTM_SP_KEY_TYPE keypress_notification = p_cb->peer_keypress_notification; |
| |
| SMP_TRACE_DEBUG("%s for cmd code 0x%02x", __func__, p_cb->rcvd_cmd_code); |
| |
| if (keypress_notification >= BTM_SP_KEY_OUT_OF_RANGE) { |
| SMP_TRACE_WARNING( |
| "Rcvd from the peer cmd 0x%02x with Pairing Keypress " |
| "Notification value (0x%02x) out of range).", |
| p_cb->rcvd_cmd_code, keypress_notification); |
| return false; |
| } |
| |
| return true; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_parameter_unconditionally_valid |
| * |
| * Description Always returns true. |
| * |
| ******************************************************************************/ |
| bool smp_parameter_unconditionally_valid(UNUSED_ATTR tSMP_CB* p_cb) { |
| return true; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_parameter_unconditionally_invalid |
| * |
| * Description Always returns false. |
| * |
| ******************************************************************************/ |
| bool smp_parameter_unconditionally_invalid(UNUSED_ATTR tSMP_CB* p_cb) { |
| return false; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_reject_unexpected_pairing_command |
| * |
| * Description send pairing failure to an unexpected pairing command during |
| * an active pairing process. |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_reject_unexpected_pairing_command(const RawAddress& bd_addr) { |
| uint8_t* p; |
| BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + SMP_PAIR_FAIL_SIZE + |
| L2CAP_MIN_OFFSET); |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; |
| UINT8_TO_STREAM(p, SMP_OPCODE_PAIRING_FAILED); |
| UINT8_TO_STREAM(p, SMP_PAIR_NOT_SUPPORT); |
| |
| p_buf->offset = L2CAP_MIN_OFFSET; |
| p_buf->len = SMP_PAIR_FAIL_SIZE; |
| |
| smp_send_msg_to_L2CAP(bd_addr, p_buf); |
| } |
| |
| /******************************************************************************* |
| * Function smp_select_association_model |
| * |
| * Description This function selects association model to use for STK |
| * generation. Selection is based on both sides' io capability, |
| * oob data flag and authentication request. |
| * |
| * Note If Secure Connections Only mode is required locally then we |
| * come to this point only if both sides support Secure |
| * Connections mode, i.e. |
| * if p_cb->secure_connections_only_mode_required = true |
| * then we come to this point only if |
| * (p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT) == |
| * (p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT) == |
| * SMP_SC_SUPPORT_BIT |
| * |
| ******************************************************************************/ |
| tSMP_ASSO_MODEL smp_select_association_model(tSMP_CB* p_cb) { |
| tSMP_ASSO_MODEL model = SMP_MODEL_OUT_OF_RANGE; |
| p_cb->le_secure_connections_mode_is_used = false; |
| |
| SMP_TRACE_EVENT("%s", __func__); |
| SMP_TRACE_DEBUG("%s p_cb->peer_io_caps = %d p_cb->local_io_capability = %d", |
| __func__, p_cb->peer_io_caps, p_cb->local_io_capability); |
| SMP_TRACE_DEBUG("%s p_cb->peer_oob_flag = %d p_cb->loc_oob_flag = %d", |
| __func__, p_cb->peer_oob_flag, p_cb->loc_oob_flag); |
| SMP_TRACE_DEBUG("%s p_cb->peer_auth_req = 0x%02x p_cb->loc_auth_req = 0x%02x", |
| __func__, p_cb->peer_auth_req, p_cb->loc_auth_req); |
| SMP_TRACE_DEBUG( |
| "%s p_cb->secure_connections_only_mode_required = %s", __func__, |
| p_cb->secure_connections_only_mode_required ? "true" : "false"); |
| |
| if ((p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT) && |
| (p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT)) { |
| p_cb->le_secure_connections_mode_is_used = true; |
| } |
| |
| if ((p_cb->peer_auth_req & SMP_H7_SUPPORT_BIT) && |
| (p_cb->loc_auth_req & SMP_H7_SUPPORT_BIT)) { |
| p_cb->key_derivation_h7_used = TRUE; |
| } |
| |
| SMP_TRACE_DEBUG("use_sc_process = %d, h7 use = %d", |
| p_cb->le_secure_connections_mode_is_used, |
| p_cb->key_derivation_h7_used); |
| |
| if (p_cb->le_secure_connections_mode_is_used) { |
| model = smp_select_association_model_secure_connections(p_cb); |
| } else { |
| model = smp_select_legacy_association_model(p_cb); |
| } |
| return model; |
| } |
| |
| /******************************************************************************* |
| * Function smp_select_legacy_association_model |
| * |
| * Description This function is called to select association mode if at |
| * least one side doesn't support secure connections. |
| * |
| ******************************************************************************/ |
| tSMP_ASSO_MODEL smp_select_legacy_association_model(tSMP_CB* p_cb) { |
| tSMP_ASSO_MODEL model = SMP_MODEL_OUT_OF_RANGE; |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| /* if OOB data is present on both devices, then use OOB association model */ |
| if (p_cb->peer_oob_flag == SMP_OOB_PRESENT && |
| p_cb->loc_oob_flag == SMP_OOB_PRESENT) |
| return SMP_MODEL_OOB; |
| |
| /* else if neither device requires MITM, then use Just Works association model |
| */ |
| if (SMP_NO_MITM_REQUIRED(p_cb->peer_auth_req) && |
| SMP_NO_MITM_REQUIRED(p_cb->loc_auth_req)) |
| return SMP_MODEL_ENCRYPTION_ONLY; |
| |
| /* otherwise use IO capability to select association model */ |
| if (p_cb->peer_io_caps < SMP_IO_CAP_MAX && |
| p_cb->local_io_capability < SMP_IO_CAP_MAX) { |
| if (p_cb->role == HCI_ROLE_MASTER) { |
| model = smp_association_table[p_cb->role][p_cb->peer_io_caps] |
| [p_cb->local_io_capability]; |
| } else { |
| model = smp_association_table[p_cb->role][p_cb->local_io_capability] |
| [p_cb->peer_io_caps]; |
| } |
| } |
| |
| return model; |
| } |
| |
| /******************************************************************************* |
| * Function smp_select_association_model_secure_connections |
| * |
| * Description This function is called to select association mode if both |
| * sides support secure connections. |
| * |
| ******************************************************************************/ |
| tSMP_ASSO_MODEL smp_select_association_model_secure_connections(tSMP_CB* p_cb) { |
| tSMP_ASSO_MODEL model = SMP_MODEL_OUT_OF_RANGE; |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| /* if OOB data is present on at least one device, then use OOB association |
| * model */ |
| if (p_cb->peer_oob_flag == SMP_OOB_PRESENT || |
| p_cb->loc_oob_flag == SMP_OOB_PRESENT) |
| return SMP_MODEL_SEC_CONN_OOB; |
| |
| /* else if neither device requires MITM, then use Just Works association model |
| */ |
| if (SMP_NO_MITM_REQUIRED(p_cb->peer_auth_req) && |
| SMP_NO_MITM_REQUIRED(p_cb->loc_auth_req)) |
| return SMP_MODEL_SEC_CONN_JUSTWORKS; |
| |
| /* otherwise use IO capability to select association model */ |
| if (p_cb->peer_io_caps < SMP_IO_CAP_MAX && |
| p_cb->local_io_capability < SMP_IO_CAP_MAX) { |
| if (p_cb->role == HCI_ROLE_MASTER) { |
| model = smp_association_table_sc[p_cb->role][p_cb->peer_io_caps] |
| [p_cb->local_io_capability]; |
| } else { |
| model = smp_association_table_sc[p_cb->role][p_cb->local_io_capability] |
| [p_cb->peer_io_caps]; |
| } |
| } |
| |
| return model; |
| } |
| |
| /******************************************************************************* |
| * Function smp_reverse_array |
| * |
| * Description This function reverses array bytes |
| * |
| ******************************************************************************/ |
| void smp_reverse_array(uint8_t* arr, uint8_t len) { |
| uint8_t i = 0, tmp; |
| |
| SMP_TRACE_DEBUG("smp_reverse_array"); |
| |
| for (i = 0; i < len / 2; i++) { |
| tmp = arr[i]; |
| arr[i] = arr[len - 1 - i]; |
| arr[len - 1 - i] = tmp; |
| } |
| } |
| |
| /******************************************************************************* |
| * Function smp_calculate_random_input |
| * |
| * Description This function returns random input value to be used in |
| * commitment calculation for SC passkey entry association mode |
| * (if bit["round"] in "random" array == 1 then returns 0x81 |
| * else returns 0x80). |
| * |
| * Returns ri value |
| * |
| ******************************************************************************/ |
| uint8_t smp_calculate_random_input(uint8_t* random, uint8_t round) { |
| uint8_t i = round / 8; |
| uint8_t j = round % 8; |
| uint8_t ri; |
| |
| SMP_TRACE_DEBUG("random: 0x%02x, round: %d, i: %d, j: %d", random[i], round, |
| i, j); |
| ri = ((random[i] >> j) & 1) | 0x80; |
| SMP_TRACE_DEBUG("%s ri=0x%02x", __func__, ri); |
| return ri; |
| } |
| |
| /******************************************************************************* |
| * Function smp_collect_local_io_capabilities |
| * |
| * Description This function puts into IOcap array local device |
| * IOCapability, OOB data, AuthReq. |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_collect_local_io_capabilities(uint8_t* iocap, tSMP_CB* p_cb) { |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| iocap[0] = p_cb->local_io_capability; |
| iocap[1] = p_cb->loc_oob_flag; |
| iocap[2] = p_cb->loc_auth_req; |
| } |
| |
| /******************************************************************************* |
| * Function smp_collect_peer_io_capabilities |
| * |
| * Description This function puts into IOcap array peer device |
| * IOCapability, OOB data, AuthReq. |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_collect_peer_io_capabilities(uint8_t* iocap, tSMP_CB* p_cb) { |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| iocap[0] = p_cb->peer_io_caps; |
| iocap[1] = p_cb->peer_oob_flag; |
| iocap[2] = p_cb->peer_auth_req; |
| } |
| |
| /******************************************************************************* |
| * Function smp_collect_local_ble_address |
| * |
| * Description Put the the local device LE address into the le_addr array: |
| * le_addr[0-5] = local BD ADDR, |
| * le_addr[6] = local le address type (PUBLIC/RANDOM). |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_collect_local_ble_address(uint8_t* le_addr, tSMP_CB* p_cb) { |
| tBLE_ADDR_TYPE addr_type = 0; |
| RawAddress bda; |
| uint8_t* p = le_addr; |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| BTM_ReadConnectionAddr(p_cb->pairing_bda, bda, &addr_type); |
| BDADDR_TO_STREAM(p, bda); |
| UINT8_TO_STREAM(p, addr_type); |
| } |
| |
| /******************************************************************************* |
| * Function smp_collect_peer_ble_address |
| * |
| * Description Put the peer device LE addr into the le_addr array: |
| * le_addr[0-5] = peer BD ADDR, |
| * le_addr[6] = peer le address type (PUBLIC/RANDOM). |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_collect_peer_ble_address(uint8_t* le_addr, tSMP_CB* p_cb) { |
| tBLE_ADDR_TYPE addr_type = 0; |
| RawAddress bda; |
| uint8_t* p = le_addr; |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| if (!BTM_ReadRemoteConnectionAddr(p_cb->pairing_bda, bda, &addr_type)) { |
| SMP_TRACE_ERROR( |
| "can not collect peer le addr information for unknown device"); |
| return; |
| } |
| |
| BDADDR_TO_STREAM(p, bda); |
| UINT8_TO_STREAM(p, addr_type); |
| } |
| |
| /******************************************************************************* |
| * Function smp_check_commitment |
| * |
| * Description This function compares peer commitment values: |
| * - expected (i.e. calculated locally), |
| * - received from the peer. |
| * |
| * Returns true if the values are the same |
| * false otherwise |
| * |
| ******************************************************************************/ |
| bool smp_check_commitment(tSMP_CB* p_cb) { |
| BT_OCTET16 expected; |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| smp_calculate_peer_commitment(p_cb, expected); |
| print128(expected, (const uint8_t*)"calculated peer commitment"); |
| print128(p_cb->remote_commitment, (const uint8_t*)"received peer commitment"); |
| |
| if (memcmp(p_cb->remote_commitment, expected, BT_OCTET16_LEN)) { |
| SMP_TRACE_WARNING("%s: Commitment check fails", __func__); |
| return false; |
| } |
| |
| SMP_TRACE_DEBUG("%s: Commitment check succeeds", __func__); |
| return true; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_save_secure_connections_long_term_key |
| * |
| * Description The function saves SC LTK as BLE key for future use as local |
| * and/or peer key. |
| * |
| * Returns void |
| * |
| ******************************************************************************/ |
| void smp_save_secure_connections_long_term_key(tSMP_CB* p_cb) { |
| tBTM_LE_LENC_KEYS lle_key; |
| tBTM_LE_PENC_KEYS ple_key; |
| |
| SMP_TRACE_DEBUG("%s-Save LTK as local LTK key", __func__); |
| memcpy(lle_key.ltk, p_cb->ltk, BT_OCTET16_LEN); |
| lle_key.div = 0; |
| lle_key.key_size = p_cb->loc_enc_size; |
| lle_key.sec_level = p_cb->sec_level; |
| btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_LENC, |
| (tBTM_LE_KEY_VALUE*)&lle_key, true); |
| |
| SMP_TRACE_DEBUG("%s-Save LTK as peer LTK key", __func__); |
| ple_key.ediv = 0; |
| memset(ple_key.rand, 0, BT_OCTET8_LEN); |
| memcpy(ple_key.ltk, p_cb->ltk, BT_OCTET16_LEN); |
| ple_key.sec_level = p_cb->sec_level; |
| ple_key.key_size = p_cb->loc_enc_size; |
| btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_PENC, |
| (tBTM_LE_KEY_VALUE*)&ple_key, true); |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_calculate_f5_mackey_and_long_term_key |
| * |
| * Description The function calculates MacKey and LTK and saves them in CB. |
| * To calculate MacKey and LTK it calls smp_calc_f5(...). |
| * MacKey is used in dhkey calculation, LTK is used to encrypt |
| * the link. |
| * |
| * Returns false if out of resources, true otherwise. |
| * |
| ******************************************************************************/ |
| bool smp_calculate_f5_mackey_and_long_term_key(tSMP_CB* p_cb) { |
| uint8_t a[7]; |
| uint8_t b[7]; |
| uint8_t* p_na; |
| uint8_t* p_nb; |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| if (p_cb->role == HCI_ROLE_MASTER) { |
| smp_collect_local_ble_address(a, p_cb); |
| smp_collect_peer_ble_address(b, p_cb); |
| p_na = p_cb->rand; |
| p_nb = p_cb->rrand; |
| } else { |
| smp_collect_local_ble_address(b, p_cb); |
| smp_collect_peer_ble_address(a, p_cb); |
| p_na = p_cb->rrand; |
| p_nb = p_cb->rand; |
| } |
| |
| if (!smp_calculate_f5(p_cb->dhkey, p_na, p_nb, a, b, p_cb->mac_key, |
| p_cb->ltk)) { |
| SMP_TRACE_ERROR("%s failed", __func__); |
| return false; |
| } |
| |
| SMP_TRACE_EVENT("%s is completed", __func__); |
| return true; |
| } |
| |
| /******************************************************************************* |
| * |
| * Function smp_request_oob_data |
| * |
| * Description Requests application to provide OOB data. |
| * |
| * Returns true - OOB data has to be provided by application |
| * false - otherwise (unexpected) |
| * |
| ******************************************************************************/ |
| bool smp_request_oob_data(tSMP_CB* p_cb) { |
| tSMP_OOB_DATA_TYPE req_oob_type = SMP_OOB_INVALID_TYPE; |
| |
| SMP_TRACE_DEBUG("%s", __func__); |
| |
| if (p_cb->peer_oob_flag == SMP_OOB_PRESENT && |
| p_cb->loc_oob_flag == SMP_OOB_PRESENT) { |
| /* both local and peer rcvd data OOB */ |
| req_oob_type = SMP_OOB_BOTH; |
| } else if (p_cb->peer_oob_flag == SMP_OOB_PRESENT) { |
| /* peer rcvd OOB local data, local didn't receive OOB peer data */ |
| req_oob_type = SMP_OOB_LOCAL; |
| } else if (p_cb->loc_oob_flag == SMP_OOB_PRESENT) { |
| req_oob_type = SMP_OOB_PEER; |
| } |
| |
| SMP_TRACE_DEBUG("req_oob_type = %d", req_oob_type); |
| |
| if (req_oob_type == SMP_OOB_INVALID_TYPE) return false; |
| |
| p_cb->req_oob_type = req_oob_type; |
| p_cb->cb_evt = SMP_SC_OOB_REQ_EVT; |
| smp_sm_event(p_cb, SMP_TK_REQ_EVT, &req_oob_type); |
| |
| return true; |
| } |