1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies). 4 5 This program is free software; you can redistribute it and/or modify 6 it under the terms of the GNU General Public License version 2 as 7 published by the Free Software Foundation; 8 9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 20 SOFTWARE IS DISCLAIMED. 21 */ 22 23 #include <linux/debugfs.h> 24 #include <linux/scatterlist.h> 25 #include <linux/crypto.h> 26 #include <crypto/aes.h> 27 #include <crypto/algapi.h> 28 #include <crypto/b128ops.h> 29 #include <crypto/hash.h> 30 #include <crypto/kpp.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/l2cap.h> 35 #include <net/bluetooth/mgmt.h> 36 37 #include "ecdh_helper.h" 38 #include "smp.h" 39 40 #define SMP_DEV(hdev) \ 41 ((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data) 42 43 /* Low-level debug macros to be used for stuff that we don't want 44 * accidentially in dmesg, i.e. the values of the various crypto keys 45 * and the inputs & outputs of crypto functions. 46 */ 47 #ifdef DEBUG 48 #define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \ 49 ##__VA_ARGS__) 50 #else 51 #define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \ 52 ##__VA_ARGS__) 53 #endif 54 55 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd) 56 57 /* Keys which are not distributed with Secure Connections */ 58 #define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY); 59 60 #define SMP_TIMEOUT msecs_to_jiffies(30000) 61 62 #define AUTH_REQ_MASK(dev) (hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \ 63 0x3f : 0x07) 64 #define KEY_DIST_MASK 0x07 65 66 /* Maximum message length that can be passed to aes_cmac */ 67 #define CMAC_MSG_MAX 80 68 69 enum { 70 SMP_FLAG_TK_VALID, 71 SMP_FLAG_CFM_PENDING, 72 SMP_FLAG_MITM_AUTH, 73 SMP_FLAG_COMPLETE, 74 SMP_FLAG_INITIATOR, 75 SMP_FLAG_SC, 76 SMP_FLAG_REMOTE_PK, 77 SMP_FLAG_DEBUG_KEY, 78 SMP_FLAG_WAIT_USER, 79 SMP_FLAG_DHKEY_PENDING, 80 SMP_FLAG_REMOTE_OOB, 81 SMP_FLAG_LOCAL_OOB, 82 SMP_FLAG_CT2, 83 }; 84 85 struct smp_dev { 86 /* Secure Connections OOB data */ 87 bool local_oob; 88 u8 local_pk[64]; 89 u8 local_rand[16]; 90 bool debug_key; 91 92 struct crypto_shash *tfm_cmac; 93 struct crypto_kpp *tfm_ecdh; 94 }; 95 96 struct smp_chan { 97 struct l2cap_conn *conn; 98 struct delayed_work security_timer; 99 unsigned long allow_cmd; /* Bitmask of allowed commands */ 100 101 u8 preq[7]; /* SMP Pairing Request */ 102 u8 prsp[7]; /* SMP Pairing Response */ 103 u8 prnd[16]; /* SMP Pairing Random (local) */ 104 u8 rrnd[16]; /* SMP Pairing Random (remote) */ 105 u8 pcnf[16]; /* SMP Pairing Confirm */ 106 u8 tk[16]; /* SMP Temporary Key */ 107 u8 rr[16]; /* Remote OOB ra/rb value */ 108 u8 lr[16]; /* Local OOB ra/rb value */ 109 u8 enc_key_size; 110 u8 remote_key_dist; 111 bdaddr_t id_addr; 112 u8 id_addr_type; 113 u8 irk[16]; 114 struct smp_csrk *csrk; 115 struct smp_csrk *slave_csrk; 116 struct smp_ltk *ltk; 117 struct smp_ltk *slave_ltk; 118 struct smp_irk *remote_irk; 119 u8 *link_key; 120 unsigned long flags; 121 u8 method; 122 u8 passkey_round; 123 124 /* Secure Connections variables */ 125 u8 local_pk[64]; 126 u8 remote_pk[64]; 127 u8 dhkey[32]; 128 u8 mackey[16]; 129 130 struct crypto_shash *tfm_cmac; 131 struct crypto_kpp *tfm_ecdh; 132 }; 133 134 /* These debug key values are defined in the SMP section of the core 135 * specification. debug_pk is the public debug key and debug_sk the 136 * private debug key. 137 */ 138 static const u8 debug_pk[64] = { 139 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 140 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 141 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 142 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20, 143 144 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74, 145 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76, 146 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63, 147 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc, 148 }; 149 150 static const u8 debug_sk[32] = { 151 0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58, 152 0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a, 153 0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74, 154 0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f, 155 }; 156 157 static inline void swap_buf(const u8 *src, u8 *dst, size_t len) 158 { 159 size_t i; 160 161 for (i = 0; i < len; i++) 162 dst[len - 1 - i] = src[i]; 163 } 164 165 /* The following functions map to the LE SC SMP crypto functions 166 * AES-CMAC, f4, f5, f6, g2 and h6. 167 */ 168 169 static int aes_cmac(struct crypto_shash *tfm, const u8 k[16], const u8 *m, 170 size_t len, u8 mac[16]) 171 { 172 uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX]; 173 int err; 174 175 if (len > CMAC_MSG_MAX) 176 return -EFBIG; 177 178 if (!tfm) { 179 BT_ERR("tfm %p", tfm); 180 return -EINVAL; 181 } 182 183 /* Swap key and message from LSB to MSB */ 184 swap_buf(k, tmp, 16); 185 swap_buf(m, msg_msb, len); 186 187 SMP_DBG("msg (len %zu) %*phN", len, (int) len, m); 188 SMP_DBG("key %16phN", k); 189 190 err = crypto_shash_setkey(tfm, tmp, 16); 191 if (err) { 192 BT_ERR("cipher setkey failed: %d", err); 193 return err; 194 } 195 196 err = crypto_shash_tfm_digest(tfm, msg_msb, len, mac_msb); 197 if (err) { 198 BT_ERR("Hash computation error %d", err); 199 return err; 200 } 201 202 swap_buf(mac_msb, mac, 16); 203 204 SMP_DBG("mac %16phN", mac); 205 206 return 0; 207 } 208 209 static int smp_f4(struct crypto_shash *tfm_cmac, const u8 u[32], 210 const u8 v[32], const u8 x[16], u8 z, u8 res[16]) 211 { 212 u8 m[65]; 213 int err; 214 215 SMP_DBG("u %32phN", u); 216 SMP_DBG("v %32phN", v); 217 SMP_DBG("x %16phN z %02x", x, z); 218 219 m[0] = z; 220 memcpy(m + 1, v, 32); 221 memcpy(m + 33, u, 32); 222 223 err = aes_cmac(tfm_cmac, x, m, sizeof(m), res); 224 if (err) 225 return err; 226 227 SMP_DBG("res %16phN", res); 228 229 return err; 230 } 231 232 static int smp_f5(struct crypto_shash *tfm_cmac, const u8 w[32], 233 const u8 n1[16], const u8 n2[16], const u8 a1[7], 234 const u8 a2[7], u8 mackey[16], u8 ltk[16]) 235 { 236 /* The btle, salt and length "magic" values are as defined in 237 * the SMP section of the Bluetooth core specification. In ASCII 238 * the btle value ends up being 'btle'. The salt is just a 239 * random number whereas length is the value 256 in little 240 * endian format. 241 */ 242 const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 }; 243 const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60, 244 0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c }; 245 const u8 length[2] = { 0x00, 0x01 }; 246 u8 m[53], t[16]; 247 int err; 248 249 SMP_DBG("w %32phN", w); 250 SMP_DBG("n1 %16phN n2 %16phN", n1, n2); 251 SMP_DBG("a1 %7phN a2 %7phN", a1, a2); 252 253 err = aes_cmac(tfm_cmac, salt, w, 32, t); 254 if (err) 255 return err; 256 257 SMP_DBG("t %16phN", t); 258 259 memcpy(m, length, 2); 260 memcpy(m + 2, a2, 7); 261 memcpy(m + 9, a1, 7); 262 memcpy(m + 16, n2, 16); 263 memcpy(m + 32, n1, 16); 264 memcpy(m + 48, btle, 4); 265 266 m[52] = 0; /* Counter */ 267 268 err = aes_cmac(tfm_cmac, t, m, sizeof(m), mackey); 269 if (err) 270 return err; 271 272 SMP_DBG("mackey %16phN", mackey); 273 274 m[52] = 1; /* Counter */ 275 276 err = aes_cmac(tfm_cmac, t, m, sizeof(m), ltk); 277 if (err) 278 return err; 279 280 SMP_DBG("ltk %16phN", ltk); 281 282 return 0; 283 } 284 285 static int smp_f6(struct crypto_shash *tfm_cmac, const u8 w[16], 286 const u8 n1[16], const u8 n2[16], const u8 r[16], 287 const u8 io_cap[3], const u8 a1[7], const u8 a2[7], 288 u8 res[16]) 289 { 290 u8 m[65]; 291 int err; 292 293 SMP_DBG("w %16phN", w); 294 SMP_DBG("n1 %16phN n2 %16phN", n1, n2); 295 SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2); 296 297 memcpy(m, a2, 7); 298 memcpy(m + 7, a1, 7); 299 memcpy(m + 14, io_cap, 3); 300 memcpy(m + 17, r, 16); 301 memcpy(m + 33, n2, 16); 302 memcpy(m + 49, n1, 16); 303 304 err = aes_cmac(tfm_cmac, w, m, sizeof(m), res); 305 if (err) 306 return err; 307 308 SMP_DBG("res %16phN", res); 309 310 return err; 311 } 312 313 static int smp_g2(struct crypto_shash *tfm_cmac, const u8 u[32], const u8 v[32], 314 const u8 x[16], const u8 y[16], u32 *val) 315 { 316 u8 m[80], tmp[16]; 317 int err; 318 319 SMP_DBG("u %32phN", u); 320 SMP_DBG("v %32phN", v); 321 SMP_DBG("x %16phN y %16phN", x, y); 322 323 memcpy(m, y, 16); 324 memcpy(m + 16, v, 32); 325 memcpy(m + 48, u, 32); 326 327 err = aes_cmac(tfm_cmac, x, m, sizeof(m), tmp); 328 if (err) 329 return err; 330 331 *val = get_unaligned_le32(tmp); 332 *val %= 1000000; 333 334 SMP_DBG("val %06u", *val); 335 336 return 0; 337 } 338 339 static int smp_h6(struct crypto_shash *tfm_cmac, const u8 w[16], 340 const u8 key_id[4], u8 res[16]) 341 { 342 int err; 343 344 SMP_DBG("w %16phN key_id %4phN", w, key_id); 345 346 err = aes_cmac(tfm_cmac, w, key_id, 4, res); 347 if (err) 348 return err; 349 350 SMP_DBG("res %16phN", res); 351 352 return err; 353 } 354 355 static int smp_h7(struct crypto_shash *tfm_cmac, const u8 w[16], 356 const u8 salt[16], u8 res[16]) 357 { 358 int err; 359 360 SMP_DBG("w %16phN salt %16phN", w, salt); 361 362 err = aes_cmac(tfm_cmac, salt, w, 16, res); 363 if (err) 364 return err; 365 366 SMP_DBG("res %16phN", res); 367 368 return err; 369 } 370 371 /* The following functions map to the legacy SMP crypto functions e, c1, 372 * s1 and ah. 373 */ 374 375 static int smp_e(const u8 *k, u8 *r) 376 { 377 struct crypto_aes_ctx ctx; 378 uint8_t tmp[16], data[16]; 379 int err; 380 381 SMP_DBG("k %16phN r %16phN", k, r); 382 383 /* The most significant octet of key corresponds to k[0] */ 384 swap_buf(k, tmp, 16); 385 386 err = aes_expandkey(&ctx, tmp, 16); 387 if (err) { 388 BT_ERR("cipher setkey failed: %d", err); 389 return err; 390 } 391 392 /* Most significant octet of plaintextData corresponds to data[0] */ 393 swap_buf(r, data, 16); 394 395 aes_encrypt(&ctx, data, data); 396 397 /* Most significant octet of encryptedData corresponds to data[0] */ 398 swap_buf(data, r, 16); 399 400 SMP_DBG("r %16phN", r); 401 402 memzero_explicit(&ctx, sizeof (ctx)); 403 return err; 404 } 405 406 static int smp_c1(const u8 k[16], 407 const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat, 408 const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16]) 409 { 410 u8 p1[16], p2[16]; 411 int err; 412 413 SMP_DBG("k %16phN r %16phN", k, r); 414 SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra); 415 SMP_DBG("preq %7phN pres %7phN", preq, pres); 416 417 memset(p1, 0, 16); 418 419 /* p1 = pres || preq || _rat || _iat */ 420 p1[0] = _iat; 421 p1[1] = _rat; 422 memcpy(p1 + 2, preq, 7); 423 memcpy(p1 + 9, pres, 7); 424 425 SMP_DBG("p1 %16phN", p1); 426 427 /* res = r XOR p1 */ 428 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1); 429 430 /* res = e(k, res) */ 431 err = smp_e(k, res); 432 if (err) { 433 BT_ERR("Encrypt data error"); 434 return err; 435 } 436 437 /* p2 = padding || ia || ra */ 438 memcpy(p2, ra, 6); 439 memcpy(p2 + 6, ia, 6); 440 memset(p2 + 12, 0, 4); 441 442 SMP_DBG("p2 %16phN", p2); 443 444 /* res = res XOR p2 */ 445 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2); 446 447 /* res = e(k, res) */ 448 err = smp_e(k, res); 449 if (err) 450 BT_ERR("Encrypt data error"); 451 452 return err; 453 } 454 455 static int smp_s1(const u8 k[16], 456 const u8 r1[16], const u8 r2[16], u8 _r[16]) 457 { 458 int err; 459 460 /* Just least significant octets from r1 and r2 are considered */ 461 memcpy(_r, r2, 8); 462 memcpy(_r + 8, r1, 8); 463 464 err = smp_e(k, _r); 465 if (err) 466 BT_ERR("Encrypt data error"); 467 468 return err; 469 } 470 471 static int smp_ah(const u8 irk[16], const u8 r[3], u8 res[3]) 472 { 473 u8 _res[16]; 474 int err; 475 476 /* r' = padding || r */ 477 memcpy(_res, r, 3); 478 memset(_res + 3, 0, 13); 479 480 err = smp_e(irk, _res); 481 if (err) { 482 BT_ERR("Encrypt error"); 483 return err; 484 } 485 486 /* The output of the random address function ah is: 487 * ah(k, r) = e(k, r') mod 2^24 488 * The output of the security function e is then truncated to 24 bits 489 * by taking the least significant 24 bits of the output of e as the 490 * result of ah. 491 */ 492 memcpy(res, _res, 3); 493 494 return 0; 495 } 496 497 bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16], 498 const bdaddr_t *bdaddr) 499 { 500 struct l2cap_chan *chan = hdev->smp_data; 501 u8 hash[3]; 502 int err; 503 504 if (!chan || !chan->data) 505 return false; 506 507 bt_dev_dbg(hdev, "RPA %pMR IRK %*phN", bdaddr, 16, irk); 508 509 err = smp_ah(irk, &bdaddr->b[3], hash); 510 if (err) 511 return false; 512 513 return !crypto_memneq(bdaddr->b, hash, 3); 514 } 515 516 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa) 517 { 518 struct l2cap_chan *chan = hdev->smp_data; 519 int err; 520 521 if (!chan || !chan->data) 522 return -EOPNOTSUPP; 523 524 get_random_bytes(&rpa->b[3], 3); 525 526 rpa->b[5] &= 0x3f; /* Clear two most significant bits */ 527 rpa->b[5] |= 0x40; /* Set second most significant bit */ 528 529 err = smp_ah(irk, &rpa->b[3], rpa->b); 530 if (err < 0) 531 return err; 532 533 bt_dev_dbg(hdev, "RPA %pMR", rpa); 534 535 return 0; 536 } 537 538 int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16]) 539 { 540 struct l2cap_chan *chan = hdev->smp_data; 541 struct smp_dev *smp; 542 int err; 543 544 if (!chan || !chan->data) 545 return -EOPNOTSUPP; 546 547 smp = chan->data; 548 549 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 550 bt_dev_dbg(hdev, "Using debug keys"); 551 err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk); 552 if (err) 553 return err; 554 memcpy(smp->local_pk, debug_pk, 64); 555 smp->debug_key = true; 556 } else { 557 while (true) { 558 /* Generate key pair for Secure Connections */ 559 err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk); 560 if (err) 561 return err; 562 563 /* This is unlikely, but we need to check that 564 * we didn't accidentially generate a debug key. 565 */ 566 if (crypto_memneq(smp->local_pk, debug_pk, 64)) 567 break; 568 } 569 smp->debug_key = false; 570 } 571 572 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk); 573 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32); 574 575 get_random_bytes(smp->local_rand, 16); 576 577 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk, 578 smp->local_rand, 0, hash); 579 if (err < 0) 580 return err; 581 582 memcpy(rand, smp->local_rand, 16); 583 584 smp->local_oob = true; 585 586 return 0; 587 } 588 589 static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data) 590 { 591 struct l2cap_chan *chan = conn->smp; 592 struct smp_chan *smp; 593 struct kvec iv[2]; 594 struct msghdr msg; 595 596 if (!chan) 597 return; 598 599 BT_DBG("code 0x%2.2x", code); 600 601 iv[0].iov_base = &code; 602 iv[0].iov_len = 1; 603 604 iv[1].iov_base = data; 605 iv[1].iov_len = len; 606 607 memset(&msg, 0, sizeof(msg)); 608 609 iov_iter_kvec(&msg.msg_iter, WRITE, iv, 2, 1 + len); 610 611 l2cap_chan_send(chan, &msg, 1 + len); 612 613 if (!chan->data) 614 return; 615 616 smp = chan->data; 617 618 cancel_delayed_work_sync(&smp->security_timer); 619 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT); 620 } 621 622 static u8 authreq_to_seclevel(u8 authreq) 623 { 624 if (authreq & SMP_AUTH_MITM) { 625 if (authreq & SMP_AUTH_SC) 626 return BT_SECURITY_FIPS; 627 else 628 return BT_SECURITY_HIGH; 629 } else { 630 return BT_SECURITY_MEDIUM; 631 } 632 } 633 634 static __u8 seclevel_to_authreq(__u8 sec_level) 635 { 636 switch (sec_level) { 637 case BT_SECURITY_FIPS: 638 case BT_SECURITY_HIGH: 639 return SMP_AUTH_MITM | SMP_AUTH_BONDING; 640 case BT_SECURITY_MEDIUM: 641 return SMP_AUTH_BONDING; 642 default: 643 return SMP_AUTH_NONE; 644 } 645 } 646 647 static void build_pairing_cmd(struct l2cap_conn *conn, 648 struct smp_cmd_pairing *req, 649 struct smp_cmd_pairing *rsp, __u8 authreq) 650 { 651 struct l2cap_chan *chan = conn->smp; 652 struct smp_chan *smp = chan->data; 653 struct hci_conn *hcon = conn->hcon; 654 struct hci_dev *hdev = hcon->hdev; 655 u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT; 656 657 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) { 658 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 659 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 660 authreq |= SMP_AUTH_BONDING; 661 } else { 662 authreq &= ~SMP_AUTH_BONDING; 663 } 664 665 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING)) 666 remote_dist |= SMP_DIST_ID_KEY; 667 668 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 669 local_dist |= SMP_DIST_ID_KEY; 670 671 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 672 (authreq & SMP_AUTH_SC)) { 673 struct oob_data *oob_data; 674 u8 bdaddr_type; 675 676 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 677 local_dist |= SMP_DIST_LINK_KEY; 678 remote_dist |= SMP_DIST_LINK_KEY; 679 } 680 681 if (hcon->dst_type == ADDR_LE_DEV_PUBLIC) 682 bdaddr_type = BDADDR_LE_PUBLIC; 683 else 684 bdaddr_type = BDADDR_LE_RANDOM; 685 686 oob_data = hci_find_remote_oob_data(hdev, &hcon->dst, 687 bdaddr_type); 688 if (oob_data && oob_data->present) { 689 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags); 690 oob_flag = SMP_OOB_PRESENT; 691 memcpy(smp->rr, oob_data->rand256, 16); 692 memcpy(smp->pcnf, oob_data->hash256, 16); 693 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf); 694 SMP_DBG("OOB Remote Random: %16phN", smp->rr); 695 } 696 697 } else { 698 authreq &= ~SMP_AUTH_SC; 699 } 700 701 if (rsp == NULL) { 702 req->io_capability = conn->hcon->io_capability; 703 req->oob_flag = oob_flag; 704 req->max_key_size = hdev->le_max_key_size; 705 req->init_key_dist = local_dist; 706 req->resp_key_dist = remote_dist; 707 req->auth_req = (authreq & AUTH_REQ_MASK(hdev)); 708 709 smp->remote_key_dist = remote_dist; 710 return; 711 } 712 713 rsp->io_capability = conn->hcon->io_capability; 714 rsp->oob_flag = oob_flag; 715 rsp->max_key_size = hdev->le_max_key_size; 716 rsp->init_key_dist = req->init_key_dist & remote_dist; 717 rsp->resp_key_dist = req->resp_key_dist & local_dist; 718 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev)); 719 720 smp->remote_key_dist = rsp->init_key_dist; 721 } 722 723 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size) 724 { 725 struct l2cap_chan *chan = conn->smp; 726 struct hci_dev *hdev = conn->hcon->hdev; 727 struct smp_chan *smp = chan->data; 728 729 if (conn->hcon->pending_sec_level == BT_SECURITY_FIPS && 730 max_key_size != SMP_MAX_ENC_KEY_SIZE) 731 return SMP_ENC_KEY_SIZE; 732 733 if (max_key_size > hdev->le_max_key_size || 734 max_key_size < SMP_MIN_ENC_KEY_SIZE) 735 return SMP_ENC_KEY_SIZE; 736 737 smp->enc_key_size = max_key_size; 738 739 return 0; 740 } 741 742 static void smp_chan_destroy(struct l2cap_conn *conn) 743 { 744 struct l2cap_chan *chan = conn->smp; 745 struct smp_chan *smp = chan->data; 746 struct hci_conn *hcon = conn->hcon; 747 bool complete; 748 749 BUG_ON(!smp); 750 751 cancel_delayed_work_sync(&smp->security_timer); 752 753 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags); 754 mgmt_smp_complete(hcon, complete); 755 756 kfree_sensitive(smp->csrk); 757 kfree_sensitive(smp->slave_csrk); 758 kfree_sensitive(smp->link_key); 759 760 crypto_free_shash(smp->tfm_cmac); 761 crypto_free_kpp(smp->tfm_ecdh); 762 763 /* Ensure that we don't leave any debug key around if debug key 764 * support hasn't been explicitly enabled. 765 */ 766 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG && 767 !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) { 768 list_del_rcu(&smp->ltk->list); 769 kfree_rcu(smp->ltk, rcu); 770 smp->ltk = NULL; 771 } 772 773 /* If pairing failed clean up any keys we might have */ 774 if (!complete) { 775 if (smp->ltk) { 776 list_del_rcu(&smp->ltk->list); 777 kfree_rcu(smp->ltk, rcu); 778 } 779 780 if (smp->slave_ltk) { 781 list_del_rcu(&smp->slave_ltk->list); 782 kfree_rcu(smp->slave_ltk, rcu); 783 } 784 785 if (smp->remote_irk) { 786 list_del_rcu(&smp->remote_irk->list); 787 kfree_rcu(smp->remote_irk, rcu); 788 } 789 } 790 791 chan->data = NULL; 792 kfree_sensitive(smp); 793 hci_conn_drop(hcon); 794 } 795 796 static void smp_failure(struct l2cap_conn *conn, u8 reason) 797 { 798 struct hci_conn *hcon = conn->hcon; 799 struct l2cap_chan *chan = conn->smp; 800 801 if (reason) 802 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), 803 &reason); 804 805 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE); 806 807 if (chan->data) 808 smp_chan_destroy(conn); 809 } 810 811 #define JUST_WORKS 0x00 812 #define JUST_CFM 0x01 813 #define REQ_PASSKEY 0x02 814 #define CFM_PASSKEY 0x03 815 #define REQ_OOB 0x04 816 #define DSP_PASSKEY 0x05 817 #define OVERLAP 0xFF 818 819 static const u8 gen_method[5][5] = { 820 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 821 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 822 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 823 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM }, 824 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP }, 825 }; 826 827 static const u8 sc_method[5][5] = { 828 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 829 { JUST_WORKS, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 830 { DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY }, 831 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM }, 832 { DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 833 }; 834 835 static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io) 836 { 837 /* If either side has unknown io_caps, use JUST_CFM (which gets 838 * converted later to JUST_WORKS if we're initiators. 839 */ 840 if (local_io > SMP_IO_KEYBOARD_DISPLAY || 841 remote_io > SMP_IO_KEYBOARD_DISPLAY) 842 return JUST_CFM; 843 844 if (test_bit(SMP_FLAG_SC, &smp->flags)) 845 return sc_method[remote_io][local_io]; 846 847 return gen_method[remote_io][local_io]; 848 } 849 850 static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth, 851 u8 local_io, u8 remote_io) 852 { 853 struct hci_conn *hcon = conn->hcon; 854 struct l2cap_chan *chan = conn->smp; 855 struct smp_chan *smp = chan->data; 856 u32 passkey = 0; 857 int ret; 858 859 /* Initialize key for JUST WORKS */ 860 memset(smp->tk, 0, sizeof(smp->tk)); 861 clear_bit(SMP_FLAG_TK_VALID, &smp->flags); 862 863 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io); 864 865 /* If neither side wants MITM, either "just" confirm an incoming 866 * request or use just-works for outgoing ones. The JUST_CFM 867 * will be converted to JUST_WORKS if necessary later in this 868 * function. If either side has MITM look up the method from the 869 * table. 870 */ 871 if (!(auth & SMP_AUTH_MITM)) 872 smp->method = JUST_CFM; 873 else 874 smp->method = get_auth_method(smp, local_io, remote_io); 875 876 /* Don't confirm locally initiated pairing attempts */ 877 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, 878 &smp->flags)) 879 smp->method = JUST_WORKS; 880 881 /* Don't bother user space with no IO capabilities */ 882 if (smp->method == JUST_CFM && 883 hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 884 smp->method = JUST_WORKS; 885 886 /* If Just Works, Continue with Zero TK and ask user-space for 887 * confirmation */ 888 if (smp->method == JUST_WORKS) { 889 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, 890 hcon->type, 891 hcon->dst_type, 892 passkey, 1); 893 if (ret) 894 return ret; 895 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 896 return 0; 897 } 898 899 /* If this function is used for SC -> legacy fallback we 900 * can only recover the just-works case. 901 */ 902 if (test_bit(SMP_FLAG_SC, &smp->flags)) 903 return -EINVAL; 904 905 /* Not Just Works/Confirm results in MITM Authentication */ 906 if (smp->method != JUST_CFM) { 907 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags); 908 if (hcon->pending_sec_level < BT_SECURITY_HIGH) 909 hcon->pending_sec_level = BT_SECURITY_HIGH; 910 } 911 912 /* If both devices have Keyoard-Display I/O, the master 913 * Confirms and the slave Enters the passkey. 914 */ 915 if (smp->method == OVERLAP) { 916 if (hcon->role == HCI_ROLE_MASTER) 917 smp->method = CFM_PASSKEY; 918 else 919 smp->method = REQ_PASSKEY; 920 } 921 922 /* Generate random passkey. */ 923 if (smp->method == CFM_PASSKEY) { 924 memset(smp->tk, 0, sizeof(smp->tk)); 925 get_random_bytes(&passkey, sizeof(passkey)); 926 passkey %= 1000000; 927 put_unaligned_le32(passkey, smp->tk); 928 BT_DBG("PassKey: %d", passkey); 929 set_bit(SMP_FLAG_TK_VALID, &smp->flags); 930 } 931 932 if (smp->method == REQ_PASSKEY) 933 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst, 934 hcon->type, hcon->dst_type); 935 else if (smp->method == JUST_CFM) 936 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, 937 hcon->type, hcon->dst_type, 938 passkey, 1); 939 else 940 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst, 941 hcon->type, hcon->dst_type, 942 passkey, 0); 943 944 return ret; 945 } 946 947 static u8 smp_confirm(struct smp_chan *smp) 948 { 949 struct l2cap_conn *conn = smp->conn; 950 struct smp_cmd_pairing_confirm cp; 951 int ret; 952 953 BT_DBG("conn %p", conn); 954 955 ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp, 956 conn->hcon->init_addr_type, &conn->hcon->init_addr, 957 conn->hcon->resp_addr_type, &conn->hcon->resp_addr, 958 cp.confirm_val); 959 if (ret) 960 return SMP_UNSPECIFIED; 961 962 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 963 964 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp); 965 966 if (conn->hcon->out) 967 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 968 else 969 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 970 971 return 0; 972 } 973 974 static u8 smp_random(struct smp_chan *smp) 975 { 976 struct l2cap_conn *conn = smp->conn; 977 struct hci_conn *hcon = conn->hcon; 978 u8 confirm[16]; 979 int ret; 980 981 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave"); 982 983 ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp, 984 hcon->init_addr_type, &hcon->init_addr, 985 hcon->resp_addr_type, &hcon->resp_addr, confirm); 986 if (ret) 987 return SMP_UNSPECIFIED; 988 989 if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) { 990 bt_dev_err(hcon->hdev, "pairing failed " 991 "(confirmation values mismatch)"); 992 return SMP_CONFIRM_FAILED; 993 } 994 995 if (hcon->out) { 996 u8 stk[16]; 997 __le64 rand = 0; 998 __le16 ediv = 0; 999 1000 smp_s1(smp->tk, smp->rrnd, smp->prnd, stk); 1001 1002 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) 1003 return SMP_UNSPECIFIED; 1004 1005 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size); 1006 hcon->enc_key_size = smp->enc_key_size; 1007 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); 1008 } else { 1009 u8 stk[16], auth; 1010 __le64 rand = 0; 1011 __le16 ediv = 0; 1012 1013 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 1014 smp->prnd); 1015 1016 smp_s1(smp->tk, smp->prnd, smp->rrnd, stk); 1017 1018 if (hcon->pending_sec_level == BT_SECURITY_HIGH) 1019 auth = 1; 1020 else 1021 auth = 0; 1022 1023 /* Even though there's no _SLAVE suffix this is the 1024 * slave STK we're adding for later lookup (the master 1025 * STK never needs to be stored). 1026 */ 1027 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 1028 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand); 1029 } 1030 1031 return 0; 1032 } 1033 1034 static void smp_notify_keys(struct l2cap_conn *conn) 1035 { 1036 struct l2cap_chan *chan = conn->smp; 1037 struct smp_chan *smp = chan->data; 1038 struct hci_conn *hcon = conn->hcon; 1039 struct hci_dev *hdev = hcon->hdev; 1040 struct smp_cmd_pairing *req = (void *) &smp->preq[1]; 1041 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1]; 1042 bool persistent; 1043 1044 if (hcon->type == ACL_LINK) { 1045 if (hcon->key_type == HCI_LK_DEBUG_COMBINATION) 1046 persistent = false; 1047 else 1048 persistent = !test_bit(HCI_CONN_FLUSH_KEY, 1049 &hcon->flags); 1050 } else { 1051 /* The LTKs, IRKs and CSRKs should be persistent only if 1052 * both sides had the bonding bit set in their 1053 * authentication requests. 1054 */ 1055 persistent = !!((req->auth_req & rsp->auth_req) & 1056 SMP_AUTH_BONDING); 1057 } 1058 1059 if (smp->remote_irk) { 1060 mgmt_new_irk(hdev, smp->remote_irk, persistent); 1061 1062 /* Now that user space can be considered to know the 1063 * identity address track the connection based on it 1064 * from now on (assuming this is an LE link). 1065 */ 1066 if (hcon->type == LE_LINK) { 1067 bacpy(&hcon->dst, &smp->remote_irk->bdaddr); 1068 hcon->dst_type = smp->remote_irk->addr_type; 1069 queue_work(hdev->workqueue, &conn->id_addr_update_work); 1070 } 1071 } 1072 1073 if (smp->csrk) { 1074 smp->csrk->bdaddr_type = hcon->dst_type; 1075 bacpy(&smp->csrk->bdaddr, &hcon->dst); 1076 mgmt_new_csrk(hdev, smp->csrk, persistent); 1077 } 1078 1079 if (smp->slave_csrk) { 1080 smp->slave_csrk->bdaddr_type = hcon->dst_type; 1081 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst); 1082 mgmt_new_csrk(hdev, smp->slave_csrk, persistent); 1083 } 1084 1085 if (smp->ltk) { 1086 smp->ltk->bdaddr_type = hcon->dst_type; 1087 bacpy(&smp->ltk->bdaddr, &hcon->dst); 1088 mgmt_new_ltk(hdev, smp->ltk, persistent); 1089 } 1090 1091 if (smp->slave_ltk) { 1092 smp->slave_ltk->bdaddr_type = hcon->dst_type; 1093 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst); 1094 mgmt_new_ltk(hdev, smp->slave_ltk, persistent); 1095 } 1096 1097 if (smp->link_key) { 1098 struct link_key *key; 1099 u8 type; 1100 1101 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) 1102 type = HCI_LK_DEBUG_COMBINATION; 1103 else if (hcon->sec_level == BT_SECURITY_FIPS) 1104 type = HCI_LK_AUTH_COMBINATION_P256; 1105 else 1106 type = HCI_LK_UNAUTH_COMBINATION_P256; 1107 1108 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, 1109 smp->link_key, type, 0, &persistent); 1110 if (key) { 1111 mgmt_new_link_key(hdev, key, persistent); 1112 1113 /* Don't keep debug keys around if the relevant 1114 * flag is not set. 1115 */ 1116 if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) && 1117 key->type == HCI_LK_DEBUG_COMBINATION) { 1118 list_del_rcu(&key->list); 1119 kfree_rcu(key, rcu); 1120 } 1121 } 1122 } 1123 } 1124 1125 static void sc_add_ltk(struct smp_chan *smp) 1126 { 1127 struct hci_conn *hcon = smp->conn->hcon; 1128 u8 key_type, auth; 1129 1130 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) 1131 key_type = SMP_LTK_P256_DEBUG; 1132 else 1133 key_type = SMP_LTK_P256; 1134 1135 if (hcon->pending_sec_level == BT_SECURITY_FIPS) 1136 auth = 1; 1137 else 1138 auth = 0; 1139 1140 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 1141 key_type, auth, smp->tk, smp->enc_key_size, 1142 0, 0); 1143 } 1144 1145 static void sc_generate_link_key(struct smp_chan *smp) 1146 { 1147 /* From core spec. Spells out in ASCII as 'lebr'. */ 1148 const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c }; 1149 1150 smp->link_key = kzalloc(16, GFP_KERNEL); 1151 if (!smp->link_key) 1152 return; 1153 1154 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { 1155 /* SALT = 0x000000000000000000000000746D7031 */ 1156 const u8 salt[16] = { 0x31, 0x70, 0x6d, 0x74 }; 1157 1158 if (smp_h7(smp->tfm_cmac, smp->tk, salt, smp->link_key)) { 1159 kfree_sensitive(smp->link_key); 1160 smp->link_key = NULL; 1161 return; 1162 } 1163 } else { 1164 /* From core spec. Spells out in ASCII as 'tmp1'. */ 1165 const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 }; 1166 1167 if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) { 1168 kfree_sensitive(smp->link_key); 1169 smp->link_key = NULL; 1170 return; 1171 } 1172 } 1173 1174 if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) { 1175 kfree_sensitive(smp->link_key); 1176 smp->link_key = NULL; 1177 return; 1178 } 1179 } 1180 1181 static void smp_allow_key_dist(struct smp_chan *smp) 1182 { 1183 /* Allow the first expected phase 3 PDU. The rest of the PDUs 1184 * will be allowed in each PDU handler to ensure we receive 1185 * them in the correct order. 1186 */ 1187 if (smp->remote_key_dist & SMP_DIST_ENC_KEY) 1188 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO); 1189 else if (smp->remote_key_dist & SMP_DIST_ID_KEY) 1190 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); 1191 else if (smp->remote_key_dist & SMP_DIST_SIGN) 1192 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 1193 } 1194 1195 static void sc_generate_ltk(struct smp_chan *smp) 1196 { 1197 /* From core spec. Spells out in ASCII as 'brle'. */ 1198 const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 }; 1199 struct hci_conn *hcon = smp->conn->hcon; 1200 struct hci_dev *hdev = hcon->hdev; 1201 struct link_key *key; 1202 1203 key = hci_find_link_key(hdev, &hcon->dst); 1204 if (!key) { 1205 bt_dev_err(hdev, "no Link Key found to generate LTK"); 1206 return; 1207 } 1208 1209 if (key->type == HCI_LK_DEBUG_COMBINATION) 1210 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1211 1212 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { 1213 /* SALT = 0x000000000000000000000000746D7032 */ 1214 const u8 salt[16] = { 0x32, 0x70, 0x6d, 0x74 }; 1215 1216 if (smp_h7(smp->tfm_cmac, key->val, salt, smp->tk)) 1217 return; 1218 } else { 1219 /* From core spec. Spells out in ASCII as 'tmp2'. */ 1220 const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 }; 1221 1222 if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk)) 1223 return; 1224 } 1225 1226 if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk)) 1227 return; 1228 1229 sc_add_ltk(smp); 1230 } 1231 1232 static void smp_distribute_keys(struct smp_chan *smp) 1233 { 1234 struct smp_cmd_pairing *req, *rsp; 1235 struct l2cap_conn *conn = smp->conn; 1236 struct hci_conn *hcon = conn->hcon; 1237 struct hci_dev *hdev = hcon->hdev; 1238 __u8 *keydist; 1239 1240 BT_DBG("conn %p", conn); 1241 1242 rsp = (void *) &smp->prsp[1]; 1243 1244 /* The responder sends its keys first */ 1245 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) { 1246 smp_allow_key_dist(smp); 1247 return; 1248 } 1249 1250 req = (void *) &smp->preq[1]; 1251 1252 if (hcon->out) { 1253 keydist = &rsp->init_key_dist; 1254 *keydist &= req->init_key_dist; 1255 } else { 1256 keydist = &rsp->resp_key_dist; 1257 *keydist &= req->resp_key_dist; 1258 } 1259 1260 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1261 if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY)) 1262 sc_generate_link_key(smp); 1263 if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY)) 1264 sc_generate_ltk(smp); 1265 1266 /* Clear the keys which are generated but not distributed */ 1267 *keydist &= ~SMP_SC_NO_DIST; 1268 } 1269 1270 BT_DBG("keydist 0x%x", *keydist); 1271 1272 if (*keydist & SMP_DIST_ENC_KEY) { 1273 struct smp_cmd_encrypt_info enc; 1274 struct smp_cmd_master_ident ident; 1275 struct smp_ltk *ltk; 1276 u8 authenticated; 1277 __le16 ediv; 1278 __le64 rand; 1279 1280 /* Make sure we generate only the significant amount of 1281 * bytes based on the encryption key size, and set the rest 1282 * of the value to zeroes. 1283 */ 1284 get_random_bytes(enc.ltk, smp->enc_key_size); 1285 memset(enc.ltk + smp->enc_key_size, 0, 1286 sizeof(enc.ltk) - smp->enc_key_size); 1287 1288 get_random_bytes(&ediv, sizeof(ediv)); 1289 get_random_bytes(&rand, sizeof(rand)); 1290 1291 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc); 1292 1293 authenticated = hcon->sec_level == BT_SECURITY_HIGH; 1294 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, 1295 SMP_LTK_SLAVE, authenticated, enc.ltk, 1296 smp->enc_key_size, ediv, rand); 1297 smp->slave_ltk = ltk; 1298 1299 ident.ediv = ediv; 1300 ident.rand = rand; 1301 1302 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident); 1303 1304 *keydist &= ~SMP_DIST_ENC_KEY; 1305 } 1306 1307 if (*keydist & SMP_DIST_ID_KEY) { 1308 struct smp_cmd_ident_addr_info addrinfo; 1309 struct smp_cmd_ident_info idinfo; 1310 1311 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk)); 1312 1313 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo); 1314 1315 /* The hci_conn contains the local identity address 1316 * after the connection has been established. 1317 * 1318 * This is true even when the connection has been 1319 * established using a resolvable random address. 1320 */ 1321 bacpy(&addrinfo.bdaddr, &hcon->src); 1322 addrinfo.addr_type = hcon->src_type; 1323 1324 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo), 1325 &addrinfo); 1326 1327 *keydist &= ~SMP_DIST_ID_KEY; 1328 } 1329 1330 if (*keydist & SMP_DIST_SIGN) { 1331 struct smp_cmd_sign_info sign; 1332 struct smp_csrk *csrk; 1333 1334 /* Generate a new random key */ 1335 get_random_bytes(sign.csrk, sizeof(sign.csrk)); 1336 1337 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL); 1338 if (csrk) { 1339 if (hcon->sec_level > BT_SECURITY_MEDIUM) 1340 csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED; 1341 else 1342 csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED; 1343 memcpy(csrk->val, sign.csrk, sizeof(csrk->val)); 1344 } 1345 smp->slave_csrk = csrk; 1346 1347 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign); 1348 1349 *keydist &= ~SMP_DIST_SIGN; 1350 } 1351 1352 /* If there are still keys to be received wait for them */ 1353 if (smp->remote_key_dist & KEY_DIST_MASK) { 1354 smp_allow_key_dist(smp); 1355 return; 1356 } 1357 1358 set_bit(SMP_FLAG_COMPLETE, &smp->flags); 1359 smp_notify_keys(conn); 1360 1361 smp_chan_destroy(conn); 1362 } 1363 1364 static void smp_timeout(struct work_struct *work) 1365 { 1366 struct smp_chan *smp = container_of(work, struct smp_chan, 1367 security_timer.work); 1368 struct l2cap_conn *conn = smp->conn; 1369 1370 BT_DBG("conn %p", conn); 1371 1372 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM); 1373 } 1374 1375 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn) 1376 { 1377 struct l2cap_chan *chan = conn->smp; 1378 struct smp_chan *smp; 1379 1380 smp = kzalloc(sizeof(*smp), GFP_ATOMIC); 1381 if (!smp) 1382 return NULL; 1383 1384 smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0); 1385 if (IS_ERR(smp->tfm_cmac)) { 1386 BT_ERR("Unable to create CMAC crypto context"); 1387 goto zfree_smp; 1388 } 1389 1390 smp->tfm_ecdh = crypto_alloc_kpp("ecdh", 0, 0); 1391 if (IS_ERR(smp->tfm_ecdh)) { 1392 BT_ERR("Unable to create ECDH crypto context"); 1393 goto free_shash; 1394 } 1395 1396 smp->conn = conn; 1397 chan->data = smp; 1398 1399 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL); 1400 1401 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout); 1402 1403 hci_conn_hold(conn->hcon); 1404 1405 return smp; 1406 1407 free_shash: 1408 crypto_free_shash(smp->tfm_cmac); 1409 zfree_smp: 1410 kfree_sensitive(smp); 1411 return NULL; 1412 } 1413 1414 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16]) 1415 { 1416 struct hci_conn *hcon = smp->conn->hcon; 1417 u8 *na, *nb, a[7], b[7]; 1418 1419 if (hcon->out) { 1420 na = smp->prnd; 1421 nb = smp->rrnd; 1422 } else { 1423 na = smp->rrnd; 1424 nb = smp->prnd; 1425 } 1426 1427 memcpy(a, &hcon->init_addr, 6); 1428 memcpy(b, &hcon->resp_addr, 6); 1429 a[6] = hcon->init_addr_type; 1430 b[6] = hcon->resp_addr_type; 1431 1432 return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk); 1433 } 1434 1435 static void sc_dhkey_check(struct smp_chan *smp) 1436 { 1437 struct hci_conn *hcon = smp->conn->hcon; 1438 struct smp_cmd_dhkey_check check; 1439 u8 a[7], b[7], *local_addr, *remote_addr; 1440 u8 io_cap[3], r[16]; 1441 1442 memcpy(a, &hcon->init_addr, 6); 1443 memcpy(b, &hcon->resp_addr, 6); 1444 a[6] = hcon->init_addr_type; 1445 b[6] = hcon->resp_addr_type; 1446 1447 if (hcon->out) { 1448 local_addr = a; 1449 remote_addr = b; 1450 memcpy(io_cap, &smp->preq[1], 3); 1451 } else { 1452 local_addr = b; 1453 remote_addr = a; 1454 memcpy(io_cap, &smp->prsp[1], 3); 1455 } 1456 1457 memset(r, 0, sizeof(r)); 1458 1459 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 1460 put_unaligned_le32(hcon->passkey_notify, r); 1461 1462 if (smp->method == REQ_OOB) 1463 memcpy(r, smp->rr, 16); 1464 1465 smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap, 1466 local_addr, remote_addr, check.e); 1467 1468 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check); 1469 } 1470 1471 static u8 sc_passkey_send_confirm(struct smp_chan *smp) 1472 { 1473 struct l2cap_conn *conn = smp->conn; 1474 struct hci_conn *hcon = conn->hcon; 1475 struct smp_cmd_pairing_confirm cfm; 1476 u8 r; 1477 1478 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); 1479 r |= 0x80; 1480 1481 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1482 1483 if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r, 1484 cfm.confirm_val)) 1485 return SMP_UNSPECIFIED; 1486 1487 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm); 1488 1489 return 0; 1490 } 1491 1492 static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op) 1493 { 1494 struct l2cap_conn *conn = smp->conn; 1495 struct hci_conn *hcon = conn->hcon; 1496 struct hci_dev *hdev = hcon->hdev; 1497 u8 cfm[16], r; 1498 1499 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */ 1500 if (smp->passkey_round >= 20) 1501 return 0; 1502 1503 switch (smp_op) { 1504 case SMP_CMD_PAIRING_RANDOM: 1505 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); 1506 r |= 0x80; 1507 1508 if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, 1509 smp->rrnd, r, cfm)) 1510 return SMP_UNSPECIFIED; 1511 1512 if (crypto_memneq(smp->pcnf, cfm, 16)) 1513 return SMP_CONFIRM_FAILED; 1514 1515 smp->passkey_round++; 1516 1517 if (smp->passkey_round == 20) { 1518 /* Generate MacKey and LTK */ 1519 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk)) 1520 return SMP_UNSPECIFIED; 1521 } 1522 1523 /* The round is only complete when the initiator 1524 * receives pairing random. 1525 */ 1526 if (!hcon->out) { 1527 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 1528 sizeof(smp->prnd), smp->prnd); 1529 if (smp->passkey_round == 20) 1530 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1531 else 1532 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1533 return 0; 1534 } 1535 1536 /* Start the next round */ 1537 if (smp->passkey_round != 20) 1538 return sc_passkey_round(smp, 0); 1539 1540 /* Passkey rounds are complete - start DHKey Check */ 1541 sc_dhkey_check(smp); 1542 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1543 1544 break; 1545 1546 case SMP_CMD_PAIRING_CONFIRM: 1547 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { 1548 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 1549 return 0; 1550 } 1551 1552 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 1553 1554 if (hcon->out) { 1555 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 1556 sizeof(smp->prnd), smp->prnd); 1557 return 0; 1558 } 1559 1560 return sc_passkey_send_confirm(smp); 1561 1562 case SMP_CMD_PUBLIC_KEY: 1563 default: 1564 /* Initiating device starts the round */ 1565 if (!hcon->out) 1566 return 0; 1567 1568 BT_DBG("%s Starting passkey round %u", hdev->name, 1569 smp->passkey_round + 1); 1570 1571 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1572 1573 return sc_passkey_send_confirm(smp); 1574 } 1575 1576 return 0; 1577 } 1578 1579 static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey) 1580 { 1581 struct l2cap_conn *conn = smp->conn; 1582 struct hci_conn *hcon = conn->hcon; 1583 u8 smp_op; 1584 1585 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags); 1586 1587 switch (mgmt_op) { 1588 case MGMT_OP_USER_PASSKEY_NEG_REPLY: 1589 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED); 1590 return 0; 1591 case MGMT_OP_USER_CONFIRM_NEG_REPLY: 1592 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED); 1593 return 0; 1594 case MGMT_OP_USER_PASSKEY_REPLY: 1595 hcon->passkey_notify = le32_to_cpu(passkey); 1596 smp->passkey_round = 0; 1597 1598 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) 1599 smp_op = SMP_CMD_PAIRING_CONFIRM; 1600 else 1601 smp_op = 0; 1602 1603 if (sc_passkey_round(smp, smp_op)) 1604 return -EIO; 1605 1606 return 0; 1607 } 1608 1609 /* Initiator sends DHKey check first */ 1610 if (hcon->out) { 1611 sc_dhkey_check(smp); 1612 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1613 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) { 1614 sc_dhkey_check(smp); 1615 sc_add_ltk(smp); 1616 } 1617 1618 return 0; 1619 } 1620 1621 int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey) 1622 { 1623 struct l2cap_conn *conn = hcon->l2cap_data; 1624 struct l2cap_chan *chan; 1625 struct smp_chan *smp; 1626 u32 value; 1627 int err; 1628 1629 BT_DBG(""); 1630 1631 if (!conn) 1632 return -ENOTCONN; 1633 1634 chan = conn->smp; 1635 if (!chan) 1636 return -ENOTCONN; 1637 1638 l2cap_chan_lock(chan); 1639 if (!chan->data) { 1640 err = -ENOTCONN; 1641 goto unlock; 1642 } 1643 1644 smp = chan->data; 1645 1646 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1647 err = sc_user_reply(smp, mgmt_op, passkey); 1648 goto unlock; 1649 } 1650 1651 switch (mgmt_op) { 1652 case MGMT_OP_USER_PASSKEY_REPLY: 1653 value = le32_to_cpu(passkey); 1654 memset(smp->tk, 0, sizeof(smp->tk)); 1655 BT_DBG("PassKey: %d", value); 1656 put_unaligned_le32(value, smp->tk); 1657 fallthrough; 1658 case MGMT_OP_USER_CONFIRM_REPLY: 1659 set_bit(SMP_FLAG_TK_VALID, &smp->flags); 1660 break; 1661 case MGMT_OP_USER_PASSKEY_NEG_REPLY: 1662 case MGMT_OP_USER_CONFIRM_NEG_REPLY: 1663 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED); 1664 err = 0; 1665 goto unlock; 1666 default: 1667 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED); 1668 err = -EOPNOTSUPP; 1669 goto unlock; 1670 } 1671 1672 err = 0; 1673 1674 /* If it is our turn to send Pairing Confirm, do so now */ 1675 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) { 1676 u8 rsp = smp_confirm(smp); 1677 if (rsp) 1678 smp_failure(conn, rsp); 1679 } 1680 1681 unlock: 1682 l2cap_chan_unlock(chan); 1683 return err; 1684 } 1685 1686 static void build_bredr_pairing_cmd(struct smp_chan *smp, 1687 struct smp_cmd_pairing *req, 1688 struct smp_cmd_pairing *rsp) 1689 { 1690 struct l2cap_conn *conn = smp->conn; 1691 struct hci_dev *hdev = conn->hcon->hdev; 1692 u8 local_dist = 0, remote_dist = 0; 1693 1694 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) { 1695 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 1696 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 1697 } 1698 1699 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING)) 1700 remote_dist |= SMP_DIST_ID_KEY; 1701 1702 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 1703 local_dist |= SMP_DIST_ID_KEY; 1704 1705 if (!rsp) { 1706 memset(req, 0, sizeof(*req)); 1707 1708 req->auth_req = SMP_AUTH_CT2; 1709 req->init_key_dist = local_dist; 1710 req->resp_key_dist = remote_dist; 1711 req->max_key_size = conn->hcon->enc_key_size; 1712 1713 smp->remote_key_dist = remote_dist; 1714 1715 return; 1716 } 1717 1718 memset(rsp, 0, sizeof(*rsp)); 1719 1720 rsp->auth_req = SMP_AUTH_CT2; 1721 rsp->max_key_size = conn->hcon->enc_key_size; 1722 rsp->init_key_dist = req->init_key_dist & remote_dist; 1723 rsp->resp_key_dist = req->resp_key_dist & local_dist; 1724 1725 smp->remote_key_dist = rsp->init_key_dist; 1726 } 1727 1728 static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) 1729 { 1730 struct smp_cmd_pairing rsp, *req = (void *) skb->data; 1731 struct l2cap_chan *chan = conn->smp; 1732 struct hci_dev *hdev = conn->hcon->hdev; 1733 struct smp_chan *smp; 1734 u8 key_size, auth, sec_level; 1735 int ret; 1736 1737 BT_DBG("conn %p", conn); 1738 1739 if (skb->len < sizeof(*req)) 1740 return SMP_INVALID_PARAMS; 1741 1742 if (conn->hcon->role != HCI_ROLE_SLAVE) 1743 return SMP_CMD_NOTSUPP; 1744 1745 if (!chan->data) 1746 smp = smp_chan_create(conn); 1747 else 1748 smp = chan->data; 1749 1750 if (!smp) 1751 return SMP_UNSPECIFIED; 1752 1753 /* We didn't start the pairing, so match remote */ 1754 auth = req->auth_req & AUTH_REQ_MASK(hdev); 1755 1756 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) && 1757 (auth & SMP_AUTH_BONDING)) 1758 return SMP_PAIRING_NOTSUPP; 1759 1760 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 1761 return SMP_AUTH_REQUIREMENTS; 1762 1763 smp->preq[0] = SMP_CMD_PAIRING_REQ; 1764 memcpy(&smp->preq[1], req, sizeof(*req)); 1765 skb_pull(skb, sizeof(*req)); 1766 1767 /* If the remote side's OOB flag is set it means it has 1768 * successfully received our local OOB data - therefore set the 1769 * flag to indicate that local OOB is in use. 1770 */ 1771 if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob) 1772 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); 1773 1774 /* SMP over BR/EDR requires special treatment */ 1775 if (conn->hcon->type == ACL_LINK) { 1776 /* We must have a BR/EDR SC link */ 1777 if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) && 1778 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 1779 return SMP_CROSS_TRANSP_NOT_ALLOWED; 1780 1781 set_bit(SMP_FLAG_SC, &smp->flags); 1782 1783 build_bredr_pairing_cmd(smp, req, &rsp); 1784 1785 if (req->auth_req & SMP_AUTH_CT2) 1786 set_bit(SMP_FLAG_CT2, &smp->flags); 1787 1788 key_size = min(req->max_key_size, rsp.max_key_size); 1789 if (check_enc_key_size(conn, key_size)) 1790 return SMP_ENC_KEY_SIZE; 1791 1792 /* Clear bits which are generated but not distributed */ 1793 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1794 1795 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1796 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); 1797 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp); 1798 1799 smp_distribute_keys(smp); 1800 return 0; 1801 } 1802 1803 build_pairing_cmd(conn, req, &rsp, auth); 1804 1805 if (rsp.auth_req & SMP_AUTH_SC) { 1806 set_bit(SMP_FLAG_SC, &smp->flags); 1807 1808 if (rsp.auth_req & SMP_AUTH_CT2) 1809 set_bit(SMP_FLAG_CT2, &smp->flags); 1810 } 1811 1812 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 1813 sec_level = BT_SECURITY_MEDIUM; 1814 else 1815 sec_level = authreq_to_seclevel(auth); 1816 1817 if (sec_level > conn->hcon->pending_sec_level) 1818 conn->hcon->pending_sec_level = sec_level; 1819 1820 /* If we need MITM check that it can be achieved */ 1821 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { 1822 u8 method; 1823 1824 method = get_auth_method(smp, conn->hcon->io_capability, 1825 req->io_capability); 1826 if (method == JUST_WORKS || method == JUST_CFM) 1827 return SMP_AUTH_REQUIREMENTS; 1828 } 1829 1830 key_size = min(req->max_key_size, rsp.max_key_size); 1831 if (check_enc_key_size(conn, key_size)) 1832 return SMP_ENC_KEY_SIZE; 1833 1834 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1835 1836 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1837 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); 1838 1839 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp); 1840 1841 clear_bit(SMP_FLAG_INITIATOR, &smp->flags); 1842 1843 /* Strictly speaking we shouldn't allow Pairing Confirm for the 1844 * SC case, however some implementations incorrectly copy RFU auth 1845 * req bits from our security request, which may create a false 1846 * positive SC enablement. 1847 */ 1848 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1849 1850 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1851 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); 1852 /* Clear bits which are generated but not distributed */ 1853 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1854 /* Wait for Public Key from Initiating Device */ 1855 return 0; 1856 } 1857 1858 /* Request setup of TK */ 1859 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability); 1860 if (ret) 1861 return SMP_UNSPECIFIED; 1862 1863 return 0; 1864 } 1865 1866 static u8 sc_send_public_key(struct smp_chan *smp) 1867 { 1868 struct hci_dev *hdev = smp->conn->hcon->hdev; 1869 1870 bt_dev_dbg(hdev, ""); 1871 1872 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { 1873 struct l2cap_chan *chan = hdev->smp_data; 1874 struct smp_dev *smp_dev; 1875 1876 if (!chan || !chan->data) 1877 return SMP_UNSPECIFIED; 1878 1879 smp_dev = chan->data; 1880 1881 memcpy(smp->local_pk, smp_dev->local_pk, 64); 1882 memcpy(smp->lr, smp_dev->local_rand, 16); 1883 1884 if (smp_dev->debug_key) 1885 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1886 1887 goto done; 1888 } 1889 1890 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 1891 BT_DBG("Using debug keys"); 1892 if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk)) 1893 return SMP_UNSPECIFIED; 1894 memcpy(smp->local_pk, debug_pk, 64); 1895 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1896 } else { 1897 while (true) { 1898 /* Generate key pair for Secure Connections */ 1899 if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk)) 1900 return SMP_UNSPECIFIED; 1901 1902 /* This is unlikely, but we need to check that 1903 * we didn't accidentially generate a debug key. 1904 */ 1905 if (crypto_memneq(smp->local_pk, debug_pk, 64)) 1906 break; 1907 } 1908 } 1909 1910 done: 1911 SMP_DBG("Local Public Key X: %32phN", smp->local_pk); 1912 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32); 1913 1914 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk); 1915 1916 return 0; 1917 } 1918 1919 static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb) 1920 { 1921 struct smp_cmd_pairing *req, *rsp = (void *) skb->data; 1922 struct l2cap_chan *chan = conn->smp; 1923 struct smp_chan *smp = chan->data; 1924 struct hci_dev *hdev = conn->hcon->hdev; 1925 u8 key_size, auth; 1926 int ret; 1927 1928 BT_DBG("conn %p", conn); 1929 1930 if (skb->len < sizeof(*rsp)) 1931 return SMP_INVALID_PARAMS; 1932 1933 if (conn->hcon->role != HCI_ROLE_MASTER) 1934 return SMP_CMD_NOTSUPP; 1935 1936 skb_pull(skb, sizeof(*rsp)); 1937 1938 req = (void *) &smp->preq[1]; 1939 1940 key_size = min(req->max_key_size, rsp->max_key_size); 1941 if (check_enc_key_size(conn, key_size)) 1942 return SMP_ENC_KEY_SIZE; 1943 1944 auth = rsp->auth_req & AUTH_REQ_MASK(hdev); 1945 1946 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 1947 return SMP_AUTH_REQUIREMENTS; 1948 1949 /* If the remote side's OOB flag is set it means it has 1950 * successfully received our local OOB data - therefore set the 1951 * flag to indicate that local OOB is in use. 1952 */ 1953 if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob) 1954 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); 1955 1956 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1957 memcpy(&smp->prsp[1], rsp, sizeof(*rsp)); 1958 1959 /* Update remote key distribution in case the remote cleared 1960 * some bits that we had enabled in our request. 1961 */ 1962 smp->remote_key_dist &= rsp->resp_key_dist; 1963 1964 if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2)) 1965 set_bit(SMP_FLAG_CT2, &smp->flags); 1966 1967 /* For BR/EDR this means we're done and can start phase 3 */ 1968 if (conn->hcon->type == ACL_LINK) { 1969 /* Clear bits which are generated but not distributed */ 1970 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1971 smp_distribute_keys(smp); 1972 return 0; 1973 } 1974 1975 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC)) 1976 set_bit(SMP_FLAG_SC, &smp->flags); 1977 else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH) 1978 conn->hcon->pending_sec_level = BT_SECURITY_HIGH; 1979 1980 /* If we need MITM check that it can be achieved */ 1981 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { 1982 u8 method; 1983 1984 method = get_auth_method(smp, req->io_capability, 1985 rsp->io_capability); 1986 if (method == JUST_WORKS || method == JUST_CFM) 1987 return SMP_AUTH_REQUIREMENTS; 1988 } 1989 1990 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1991 1992 /* Update remote key distribution in case the remote cleared 1993 * some bits that we had enabled in our request. 1994 */ 1995 smp->remote_key_dist &= rsp->resp_key_dist; 1996 1997 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1998 /* Clear bits which are generated but not distributed */ 1999 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 2000 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); 2001 return sc_send_public_key(smp); 2002 } 2003 2004 auth |= req->auth_req; 2005 2006 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability); 2007 if (ret) 2008 return SMP_UNSPECIFIED; 2009 2010 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 2011 2012 /* Can't compose response until we have been confirmed */ 2013 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) 2014 return smp_confirm(smp); 2015 2016 return 0; 2017 } 2018 2019 static u8 sc_check_confirm(struct smp_chan *smp) 2020 { 2021 struct l2cap_conn *conn = smp->conn; 2022 2023 BT_DBG(""); 2024 2025 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2026 return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM); 2027 2028 if (conn->hcon->out) { 2029 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2030 smp->prnd); 2031 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2032 } 2033 2034 return 0; 2035 } 2036 2037 /* Work-around for some implementations that incorrectly copy RFU bits 2038 * from our security request and thereby create the impression that 2039 * we're doing SC when in fact the remote doesn't support it. 2040 */ 2041 static int fixup_sc_false_positive(struct smp_chan *smp) 2042 { 2043 struct l2cap_conn *conn = smp->conn; 2044 struct hci_conn *hcon = conn->hcon; 2045 struct hci_dev *hdev = hcon->hdev; 2046 struct smp_cmd_pairing *req, *rsp; 2047 u8 auth; 2048 2049 /* The issue is only observed when we're in slave role */ 2050 if (hcon->out) 2051 return SMP_UNSPECIFIED; 2052 2053 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 2054 bt_dev_err(hdev, "refusing legacy fallback in SC-only mode"); 2055 return SMP_UNSPECIFIED; 2056 } 2057 2058 bt_dev_err(hdev, "trying to fall back to legacy SMP"); 2059 2060 req = (void *) &smp->preq[1]; 2061 rsp = (void *) &smp->prsp[1]; 2062 2063 /* Rebuild key dist flags which may have been cleared for SC */ 2064 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist); 2065 2066 auth = req->auth_req & AUTH_REQ_MASK(hdev); 2067 2068 if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) { 2069 bt_dev_err(hdev, "failed to fall back to legacy SMP"); 2070 return SMP_UNSPECIFIED; 2071 } 2072 2073 clear_bit(SMP_FLAG_SC, &smp->flags); 2074 2075 return 0; 2076 } 2077 2078 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb) 2079 { 2080 struct l2cap_chan *chan = conn->smp; 2081 struct smp_chan *smp = chan->data; 2082 2083 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave"); 2084 2085 if (skb->len < sizeof(smp->pcnf)) 2086 return SMP_INVALID_PARAMS; 2087 2088 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf)); 2089 skb_pull(skb, sizeof(smp->pcnf)); 2090 2091 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 2092 int ret; 2093 2094 /* Public Key exchange must happen before any other steps */ 2095 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags)) 2096 return sc_check_confirm(smp); 2097 2098 BT_ERR("Unexpected SMP Pairing Confirm"); 2099 2100 ret = fixup_sc_false_positive(smp); 2101 if (ret) 2102 return ret; 2103 } 2104 2105 if (conn->hcon->out) { 2106 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2107 smp->prnd); 2108 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2109 return 0; 2110 } 2111 2112 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) 2113 return smp_confirm(smp); 2114 2115 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 2116 2117 return 0; 2118 } 2119 2120 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb) 2121 { 2122 struct l2cap_chan *chan = conn->smp; 2123 struct smp_chan *smp = chan->data; 2124 struct hci_conn *hcon = conn->hcon; 2125 u8 *pkax, *pkbx, *na, *nb, confirm_hint; 2126 u32 passkey; 2127 int err; 2128 2129 BT_DBG("conn %p", conn); 2130 2131 if (skb->len < sizeof(smp->rrnd)) 2132 return SMP_INVALID_PARAMS; 2133 2134 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd)); 2135 skb_pull(skb, sizeof(smp->rrnd)); 2136 2137 if (!test_bit(SMP_FLAG_SC, &smp->flags)) 2138 return smp_random(smp); 2139 2140 if (hcon->out) { 2141 pkax = smp->local_pk; 2142 pkbx = smp->remote_pk; 2143 na = smp->prnd; 2144 nb = smp->rrnd; 2145 } else { 2146 pkax = smp->remote_pk; 2147 pkbx = smp->local_pk; 2148 na = smp->rrnd; 2149 nb = smp->prnd; 2150 } 2151 2152 if (smp->method == REQ_OOB) { 2153 if (!hcon->out) 2154 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 2155 sizeof(smp->prnd), smp->prnd); 2156 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2157 goto mackey_and_ltk; 2158 } 2159 2160 /* Passkey entry has special treatment */ 2161 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2162 return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM); 2163 2164 if (hcon->out) { 2165 u8 cfm[16]; 2166 2167 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, 2168 smp->rrnd, 0, cfm); 2169 if (err) 2170 return SMP_UNSPECIFIED; 2171 2172 if (crypto_memneq(smp->pcnf, cfm, 16)) 2173 return SMP_CONFIRM_FAILED; 2174 } else { 2175 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2176 smp->prnd); 2177 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2178 2179 /* Only Just-Works pairing requires extra checks */ 2180 if (smp->method != JUST_WORKS) 2181 goto mackey_and_ltk; 2182 2183 /* If there already exists long term key in local host, leave 2184 * the decision to user space since the remote device could 2185 * be legitimate or malicious. 2186 */ 2187 if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 2188 hcon->role)) { 2189 /* Set passkey to 0. The value can be any number since 2190 * it'll be ignored anyway. 2191 */ 2192 passkey = 0; 2193 confirm_hint = 1; 2194 goto confirm; 2195 } 2196 } 2197 2198 mackey_and_ltk: 2199 /* Generate MacKey and LTK */ 2200 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk); 2201 if (err) 2202 return SMP_UNSPECIFIED; 2203 2204 if (smp->method == REQ_OOB) { 2205 if (hcon->out) { 2206 sc_dhkey_check(smp); 2207 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2208 } 2209 return 0; 2210 } 2211 2212 err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey); 2213 if (err) 2214 return SMP_UNSPECIFIED; 2215 2216 confirm_hint = 0; 2217 2218 confirm: 2219 if (smp->method == JUST_WORKS) 2220 confirm_hint = 1; 2221 2222 err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type, 2223 hcon->dst_type, passkey, confirm_hint); 2224 if (err) 2225 return SMP_UNSPECIFIED; 2226 2227 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 2228 2229 return 0; 2230 } 2231 2232 static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level) 2233 { 2234 struct smp_ltk *key; 2235 struct hci_conn *hcon = conn->hcon; 2236 2237 key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role); 2238 if (!key) 2239 return false; 2240 2241 if (smp_ltk_sec_level(key) < sec_level) 2242 return false; 2243 2244 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) 2245 return true; 2246 2247 hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size); 2248 hcon->enc_key_size = key->enc_size; 2249 2250 /* We never store STKs for master role, so clear this flag */ 2251 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); 2252 2253 return true; 2254 } 2255 2256 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level, 2257 enum smp_key_pref key_pref) 2258 { 2259 if (sec_level == BT_SECURITY_LOW) 2260 return true; 2261 2262 /* If we're encrypted with an STK but the caller prefers using 2263 * LTK claim insufficient security. This way we allow the 2264 * connection to be re-encrypted with an LTK, even if the LTK 2265 * provides the same level of security. Only exception is if we 2266 * don't have an LTK (e.g. because of key distribution bits). 2267 */ 2268 if (key_pref == SMP_USE_LTK && 2269 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) && 2270 hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role)) 2271 return false; 2272 2273 if (hcon->sec_level >= sec_level) 2274 return true; 2275 2276 return false; 2277 } 2278 2279 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb) 2280 { 2281 struct smp_cmd_security_req *rp = (void *) skb->data; 2282 struct smp_cmd_pairing cp; 2283 struct hci_conn *hcon = conn->hcon; 2284 struct hci_dev *hdev = hcon->hdev; 2285 struct smp_chan *smp; 2286 u8 sec_level, auth; 2287 2288 BT_DBG("conn %p", conn); 2289 2290 if (skb->len < sizeof(*rp)) 2291 return SMP_INVALID_PARAMS; 2292 2293 if (hcon->role != HCI_ROLE_MASTER) 2294 return SMP_CMD_NOTSUPP; 2295 2296 auth = rp->auth_req & AUTH_REQ_MASK(hdev); 2297 2298 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 2299 return SMP_AUTH_REQUIREMENTS; 2300 2301 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 2302 sec_level = BT_SECURITY_MEDIUM; 2303 else 2304 sec_level = authreq_to_seclevel(auth); 2305 2306 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) { 2307 /* If link is already encrypted with sufficient security we 2308 * still need refresh encryption as per Core Spec 5.0 Vol 3, 2309 * Part H 2.4.6 2310 */ 2311 smp_ltk_encrypt(conn, hcon->sec_level); 2312 return 0; 2313 } 2314 2315 if (sec_level > hcon->pending_sec_level) 2316 hcon->pending_sec_level = sec_level; 2317 2318 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) 2319 return 0; 2320 2321 smp = smp_chan_create(conn); 2322 if (!smp) 2323 return SMP_UNSPECIFIED; 2324 2325 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) && 2326 (auth & SMP_AUTH_BONDING)) 2327 return SMP_PAIRING_NOTSUPP; 2328 2329 skb_pull(skb, sizeof(*rp)); 2330 2331 memset(&cp, 0, sizeof(cp)); 2332 build_pairing_cmd(conn, &cp, NULL, auth); 2333 2334 smp->preq[0] = SMP_CMD_PAIRING_REQ; 2335 memcpy(&smp->preq[1], &cp, sizeof(cp)); 2336 2337 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp); 2338 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); 2339 2340 return 0; 2341 } 2342 2343 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level) 2344 { 2345 struct l2cap_conn *conn = hcon->l2cap_data; 2346 struct l2cap_chan *chan; 2347 struct smp_chan *smp; 2348 __u8 authreq; 2349 int ret; 2350 2351 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level); 2352 2353 /* This may be NULL if there's an unexpected disconnection */ 2354 if (!conn) 2355 return 1; 2356 2357 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) 2358 return 1; 2359 2360 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) 2361 return 1; 2362 2363 if (sec_level > hcon->pending_sec_level) 2364 hcon->pending_sec_level = sec_level; 2365 2366 if (hcon->role == HCI_ROLE_MASTER) 2367 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) 2368 return 0; 2369 2370 chan = conn->smp; 2371 if (!chan) { 2372 bt_dev_err(hcon->hdev, "security requested but not available"); 2373 return 1; 2374 } 2375 2376 l2cap_chan_lock(chan); 2377 2378 /* If SMP is already in progress ignore this request */ 2379 if (chan->data) { 2380 ret = 0; 2381 goto unlock; 2382 } 2383 2384 smp = smp_chan_create(conn); 2385 if (!smp) { 2386 ret = 1; 2387 goto unlock; 2388 } 2389 2390 authreq = seclevel_to_authreq(sec_level); 2391 2392 if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) { 2393 authreq |= SMP_AUTH_SC; 2394 if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED)) 2395 authreq |= SMP_AUTH_CT2; 2396 } 2397 2398 /* Don't attempt to set MITM if setting is overridden by debugfs 2399 * Needed to pass certification test SM/MAS/PKE/BV-01-C 2400 */ 2401 if (!hci_dev_test_flag(hcon->hdev, HCI_FORCE_NO_MITM)) { 2402 /* Require MITM if IO Capability allows or the security level 2403 * requires it. 2404 */ 2405 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT || 2406 hcon->pending_sec_level > BT_SECURITY_MEDIUM) 2407 authreq |= SMP_AUTH_MITM; 2408 } 2409 2410 if (hcon->role == HCI_ROLE_MASTER) { 2411 struct smp_cmd_pairing cp; 2412 2413 build_pairing_cmd(conn, &cp, NULL, authreq); 2414 smp->preq[0] = SMP_CMD_PAIRING_REQ; 2415 memcpy(&smp->preq[1], &cp, sizeof(cp)); 2416 2417 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp); 2418 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); 2419 } else { 2420 struct smp_cmd_security_req cp; 2421 cp.auth_req = authreq; 2422 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp); 2423 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ); 2424 } 2425 2426 set_bit(SMP_FLAG_INITIATOR, &smp->flags); 2427 ret = 0; 2428 2429 unlock: 2430 l2cap_chan_unlock(chan); 2431 return ret; 2432 } 2433 2434 int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr, 2435 u8 addr_type) 2436 { 2437 struct hci_conn *hcon; 2438 struct l2cap_conn *conn; 2439 struct l2cap_chan *chan; 2440 struct smp_chan *smp; 2441 int err; 2442 2443 err = hci_remove_ltk(hdev, bdaddr, addr_type); 2444 hci_remove_irk(hdev, bdaddr, addr_type); 2445 2446 hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type); 2447 if (!hcon) 2448 goto done; 2449 2450 conn = hcon->l2cap_data; 2451 if (!conn) 2452 goto done; 2453 2454 chan = conn->smp; 2455 if (!chan) 2456 goto done; 2457 2458 l2cap_chan_lock(chan); 2459 2460 smp = chan->data; 2461 if (smp) { 2462 /* Set keys to NULL to make sure smp_failure() does not try to 2463 * remove and free already invalidated rcu list entries. */ 2464 smp->ltk = NULL; 2465 smp->slave_ltk = NULL; 2466 smp->remote_irk = NULL; 2467 2468 if (test_bit(SMP_FLAG_COMPLETE, &smp->flags)) 2469 smp_failure(conn, 0); 2470 else 2471 smp_failure(conn, SMP_UNSPECIFIED); 2472 err = 0; 2473 } 2474 2475 l2cap_chan_unlock(chan); 2476 2477 done: 2478 return err; 2479 } 2480 2481 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb) 2482 { 2483 struct smp_cmd_encrypt_info *rp = (void *) skb->data; 2484 struct l2cap_chan *chan = conn->smp; 2485 struct smp_chan *smp = chan->data; 2486 2487 BT_DBG("conn %p", conn); 2488 2489 if (skb->len < sizeof(*rp)) 2490 return SMP_INVALID_PARAMS; 2491 2492 /* Pairing is aborted if any blocked keys are distributed */ 2493 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_LTK, 2494 rp->ltk)) { 2495 bt_dev_warn_ratelimited(conn->hcon->hdev, 2496 "LTK blocked for %pMR", 2497 &conn->hcon->dst); 2498 return SMP_INVALID_PARAMS; 2499 } 2500 2501 SMP_ALLOW_CMD(smp, SMP_CMD_MASTER_IDENT); 2502 2503 skb_pull(skb, sizeof(*rp)); 2504 2505 memcpy(smp->tk, rp->ltk, sizeof(smp->tk)); 2506 2507 return 0; 2508 } 2509 2510 static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb) 2511 { 2512 struct smp_cmd_master_ident *rp = (void *) skb->data; 2513 struct l2cap_chan *chan = conn->smp; 2514 struct smp_chan *smp = chan->data; 2515 struct hci_dev *hdev = conn->hcon->hdev; 2516 struct hci_conn *hcon = conn->hcon; 2517 struct smp_ltk *ltk; 2518 u8 authenticated; 2519 2520 BT_DBG("conn %p", conn); 2521 2522 if (skb->len < sizeof(*rp)) 2523 return SMP_INVALID_PARAMS; 2524 2525 /* Mark the information as received */ 2526 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY; 2527 2528 if (smp->remote_key_dist & SMP_DIST_ID_KEY) 2529 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); 2530 else if (smp->remote_key_dist & SMP_DIST_SIGN) 2531 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 2532 2533 skb_pull(skb, sizeof(*rp)); 2534 2535 authenticated = (hcon->sec_level == BT_SECURITY_HIGH); 2536 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK, 2537 authenticated, smp->tk, smp->enc_key_size, 2538 rp->ediv, rp->rand); 2539 smp->ltk = ltk; 2540 if (!(smp->remote_key_dist & KEY_DIST_MASK)) 2541 smp_distribute_keys(smp); 2542 2543 return 0; 2544 } 2545 2546 static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb) 2547 { 2548 struct smp_cmd_ident_info *info = (void *) skb->data; 2549 struct l2cap_chan *chan = conn->smp; 2550 struct smp_chan *smp = chan->data; 2551 2552 BT_DBG(""); 2553 2554 if (skb->len < sizeof(*info)) 2555 return SMP_INVALID_PARAMS; 2556 2557 /* Pairing is aborted if any blocked keys are distributed */ 2558 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_IRK, 2559 info->irk)) { 2560 bt_dev_warn_ratelimited(conn->hcon->hdev, 2561 "Identity key blocked for %pMR", 2562 &conn->hcon->dst); 2563 return SMP_INVALID_PARAMS; 2564 } 2565 2566 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO); 2567 2568 skb_pull(skb, sizeof(*info)); 2569 2570 memcpy(smp->irk, info->irk, 16); 2571 2572 return 0; 2573 } 2574 2575 static int smp_cmd_ident_addr_info(struct l2cap_conn *conn, 2576 struct sk_buff *skb) 2577 { 2578 struct smp_cmd_ident_addr_info *info = (void *) skb->data; 2579 struct l2cap_chan *chan = conn->smp; 2580 struct smp_chan *smp = chan->data; 2581 struct hci_conn *hcon = conn->hcon; 2582 bdaddr_t rpa; 2583 2584 BT_DBG(""); 2585 2586 if (skb->len < sizeof(*info)) 2587 return SMP_INVALID_PARAMS; 2588 2589 /* Mark the information as received */ 2590 smp->remote_key_dist &= ~SMP_DIST_ID_KEY; 2591 2592 if (smp->remote_key_dist & SMP_DIST_SIGN) 2593 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 2594 2595 skb_pull(skb, sizeof(*info)); 2596 2597 /* Strictly speaking the Core Specification (4.1) allows sending 2598 * an empty address which would force us to rely on just the IRK 2599 * as "identity information". However, since such 2600 * implementations are not known of and in order to not over 2601 * complicate our implementation, simply pretend that we never 2602 * received an IRK for such a device. 2603 * 2604 * The Identity Address must also be a Static Random or Public 2605 * Address, which hci_is_identity_address() checks for. 2606 */ 2607 if (!bacmp(&info->bdaddr, BDADDR_ANY) || 2608 !hci_is_identity_address(&info->bdaddr, info->addr_type)) { 2609 bt_dev_err(hcon->hdev, "ignoring IRK with no identity address"); 2610 goto distribute; 2611 } 2612 2613 /* Drop IRK if peer is using identity address during pairing but is 2614 * providing different address as identity information. 2615 * 2616 * Microsoft Surface Precision Mouse is known to have this bug. 2617 */ 2618 if (hci_is_identity_address(&hcon->dst, hcon->dst_type) && 2619 (bacmp(&info->bdaddr, &hcon->dst) || 2620 info->addr_type != hcon->dst_type)) { 2621 bt_dev_err(hcon->hdev, 2622 "ignoring IRK with invalid identity address"); 2623 goto distribute; 2624 } 2625 2626 bacpy(&smp->id_addr, &info->bdaddr); 2627 smp->id_addr_type = info->addr_type; 2628 2629 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type)) 2630 bacpy(&rpa, &hcon->dst); 2631 else 2632 bacpy(&rpa, BDADDR_ANY); 2633 2634 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr, 2635 smp->id_addr_type, smp->irk, &rpa); 2636 2637 distribute: 2638 if (!(smp->remote_key_dist & KEY_DIST_MASK)) 2639 smp_distribute_keys(smp); 2640 2641 return 0; 2642 } 2643 2644 static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb) 2645 { 2646 struct smp_cmd_sign_info *rp = (void *) skb->data; 2647 struct l2cap_chan *chan = conn->smp; 2648 struct smp_chan *smp = chan->data; 2649 struct smp_csrk *csrk; 2650 2651 BT_DBG("conn %p", conn); 2652 2653 if (skb->len < sizeof(*rp)) 2654 return SMP_INVALID_PARAMS; 2655 2656 /* Mark the information as received */ 2657 smp->remote_key_dist &= ~SMP_DIST_SIGN; 2658 2659 skb_pull(skb, sizeof(*rp)); 2660 2661 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL); 2662 if (csrk) { 2663 if (conn->hcon->sec_level > BT_SECURITY_MEDIUM) 2664 csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED; 2665 else 2666 csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED; 2667 memcpy(csrk->val, rp->csrk, sizeof(csrk->val)); 2668 } 2669 smp->csrk = csrk; 2670 smp_distribute_keys(smp); 2671 2672 return 0; 2673 } 2674 2675 static u8 sc_select_method(struct smp_chan *smp) 2676 { 2677 struct l2cap_conn *conn = smp->conn; 2678 struct hci_conn *hcon = conn->hcon; 2679 struct smp_cmd_pairing *local, *remote; 2680 u8 local_mitm, remote_mitm, local_io, remote_io, method; 2681 2682 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) || 2683 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) 2684 return REQ_OOB; 2685 2686 /* The preq/prsp contain the raw Pairing Request/Response PDUs 2687 * which are needed as inputs to some crypto functions. To get 2688 * the "struct smp_cmd_pairing" from them we need to skip the 2689 * first byte which contains the opcode. 2690 */ 2691 if (hcon->out) { 2692 local = (void *) &smp->preq[1]; 2693 remote = (void *) &smp->prsp[1]; 2694 } else { 2695 local = (void *) &smp->prsp[1]; 2696 remote = (void *) &smp->preq[1]; 2697 } 2698 2699 local_io = local->io_capability; 2700 remote_io = remote->io_capability; 2701 2702 local_mitm = (local->auth_req & SMP_AUTH_MITM); 2703 remote_mitm = (remote->auth_req & SMP_AUTH_MITM); 2704 2705 /* If either side wants MITM, look up the method from the table, 2706 * otherwise use JUST WORKS. 2707 */ 2708 if (local_mitm || remote_mitm) 2709 method = get_auth_method(smp, local_io, remote_io); 2710 else 2711 method = JUST_WORKS; 2712 2713 /* Don't confirm locally initiated pairing attempts */ 2714 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2715 method = JUST_WORKS; 2716 2717 return method; 2718 } 2719 2720 static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) 2721 { 2722 struct smp_cmd_public_key *key = (void *) skb->data; 2723 struct hci_conn *hcon = conn->hcon; 2724 struct l2cap_chan *chan = conn->smp; 2725 struct smp_chan *smp = chan->data; 2726 struct hci_dev *hdev = hcon->hdev; 2727 struct crypto_kpp *tfm_ecdh; 2728 struct smp_cmd_pairing_confirm cfm; 2729 int err; 2730 2731 BT_DBG("conn %p", conn); 2732 2733 if (skb->len < sizeof(*key)) 2734 return SMP_INVALID_PARAMS; 2735 2736 memcpy(smp->remote_pk, key, 64); 2737 2738 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { 2739 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk, 2740 smp->rr, 0, cfm.confirm_val); 2741 if (err) 2742 return SMP_UNSPECIFIED; 2743 2744 if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16)) 2745 return SMP_CONFIRM_FAILED; 2746 } 2747 2748 /* Non-initiating device sends its public key after receiving 2749 * the key from the initiating device. 2750 */ 2751 if (!hcon->out) { 2752 err = sc_send_public_key(smp); 2753 if (err) 2754 return err; 2755 } 2756 2757 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk); 2758 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32); 2759 2760 /* Compute the shared secret on the same crypto tfm on which the private 2761 * key was set/generated. 2762 */ 2763 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { 2764 struct l2cap_chan *hchan = hdev->smp_data; 2765 struct smp_dev *smp_dev; 2766 2767 if (!hchan || !hchan->data) 2768 return SMP_UNSPECIFIED; 2769 2770 smp_dev = hchan->data; 2771 2772 tfm_ecdh = smp_dev->tfm_ecdh; 2773 } else { 2774 tfm_ecdh = smp->tfm_ecdh; 2775 } 2776 2777 if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey)) 2778 return SMP_UNSPECIFIED; 2779 2780 SMP_DBG("DHKey %32phN", smp->dhkey); 2781 2782 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags); 2783 2784 smp->method = sc_select_method(smp); 2785 2786 BT_DBG("%s selected method 0x%02x", hdev->name, smp->method); 2787 2788 /* JUST_WORKS and JUST_CFM result in an unauthenticated key */ 2789 if (smp->method == JUST_WORKS || smp->method == JUST_CFM) 2790 hcon->pending_sec_level = BT_SECURITY_MEDIUM; 2791 else 2792 hcon->pending_sec_level = BT_SECURITY_FIPS; 2793 2794 if (!crypto_memneq(debug_pk, smp->remote_pk, 64)) 2795 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 2796 2797 if (smp->method == DSP_PASSKEY) { 2798 get_random_bytes(&hcon->passkey_notify, 2799 sizeof(hcon->passkey_notify)); 2800 hcon->passkey_notify %= 1000000; 2801 hcon->passkey_entered = 0; 2802 smp->passkey_round = 0; 2803 if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type, 2804 hcon->dst_type, 2805 hcon->passkey_notify, 2806 hcon->passkey_entered)) 2807 return SMP_UNSPECIFIED; 2808 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2809 return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY); 2810 } 2811 2812 if (smp->method == REQ_OOB) { 2813 if (hcon->out) 2814 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 2815 sizeof(smp->prnd), smp->prnd); 2816 2817 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2818 2819 return 0; 2820 } 2821 2822 if (hcon->out) 2823 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2824 2825 if (smp->method == REQ_PASSKEY) { 2826 if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type, 2827 hcon->dst_type)) 2828 return SMP_UNSPECIFIED; 2829 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2830 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 2831 return 0; 2832 } 2833 2834 /* The Initiating device waits for the non-initiating device to 2835 * send the confirm value. 2836 */ 2837 if (conn->hcon->out) 2838 return 0; 2839 2840 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, 2841 0, cfm.confirm_val); 2842 if (err) 2843 return SMP_UNSPECIFIED; 2844 2845 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm); 2846 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2847 2848 return 0; 2849 } 2850 2851 static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb) 2852 { 2853 struct smp_cmd_dhkey_check *check = (void *) skb->data; 2854 struct l2cap_chan *chan = conn->smp; 2855 struct hci_conn *hcon = conn->hcon; 2856 struct smp_chan *smp = chan->data; 2857 u8 a[7], b[7], *local_addr, *remote_addr; 2858 u8 io_cap[3], r[16], e[16]; 2859 int err; 2860 2861 BT_DBG("conn %p", conn); 2862 2863 if (skb->len < sizeof(*check)) 2864 return SMP_INVALID_PARAMS; 2865 2866 memcpy(a, &hcon->init_addr, 6); 2867 memcpy(b, &hcon->resp_addr, 6); 2868 a[6] = hcon->init_addr_type; 2869 b[6] = hcon->resp_addr_type; 2870 2871 if (hcon->out) { 2872 local_addr = a; 2873 remote_addr = b; 2874 memcpy(io_cap, &smp->prsp[1], 3); 2875 } else { 2876 local_addr = b; 2877 remote_addr = a; 2878 memcpy(io_cap, &smp->preq[1], 3); 2879 } 2880 2881 memset(r, 0, sizeof(r)); 2882 2883 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2884 put_unaligned_le32(hcon->passkey_notify, r); 2885 else if (smp->method == REQ_OOB) 2886 memcpy(r, smp->lr, 16); 2887 2888 err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r, 2889 io_cap, remote_addr, local_addr, e); 2890 if (err) 2891 return SMP_UNSPECIFIED; 2892 2893 if (crypto_memneq(check->e, e, 16)) 2894 return SMP_DHKEY_CHECK_FAILED; 2895 2896 if (!hcon->out) { 2897 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { 2898 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags); 2899 return 0; 2900 } 2901 2902 /* Slave sends DHKey check as response to master */ 2903 sc_dhkey_check(smp); 2904 } 2905 2906 sc_add_ltk(smp); 2907 2908 if (hcon->out) { 2909 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size); 2910 hcon->enc_key_size = smp->enc_key_size; 2911 } 2912 2913 return 0; 2914 } 2915 2916 static int smp_cmd_keypress_notify(struct l2cap_conn *conn, 2917 struct sk_buff *skb) 2918 { 2919 struct smp_cmd_keypress_notify *kp = (void *) skb->data; 2920 2921 BT_DBG("value 0x%02x", kp->value); 2922 2923 return 0; 2924 } 2925 2926 static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) 2927 { 2928 struct l2cap_conn *conn = chan->conn; 2929 struct hci_conn *hcon = conn->hcon; 2930 struct smp_chan *smp; 2931 __u8 code, reason; 2932 int err = 0; 2933 2934 if (skb->len < 1) 2935 return -EILSEQ; 2936 2937 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) { 2938 reason = SMP_PAIRING_NOTSUPP; 2939 goto done; 2940 } 2941 2942 code = skb->data[0]; 2943 skb_pull(skb, sizeof(code)); 2944 2945 smp = chan->data; 2946 2947 if (code > SMP_CMD_MAX) 2948 goto drop; 2949 2950 if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) 2951 goto drop; 2952 2953 /* If we don't have a context the only allowed commands are 2954 * pairing request and security request. 2955 */ 2956 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ) 2957 goto drop; 2958 2959 switch (code) { 2960 case SMP_CMD_PAIRING_REQ: 2961 reason = smp_cmd_pairing_req(conn, skb); 2962 break; 2963 2964 case SMP_CMD_PAIRING_FAIL: 2965 smp_failure(conn, 0); 2966 err = -EPERM; 2967 break; 2968 2969 case SMP_CMD_PAIRING_RSP: 2970 reason = smp_cmd_pairing_rsp(conn, skb); 2971 break; 2972 2973 case SMP_CMD_SECURITY_REQ: 2974 reason = smp_cmd_security_req(conn, skb); 2975 break; 2976 2977 case SMP_CMD_PAIRING_CONFIRM: 2978 reason = smp_cmd_pairing_confirm(conn, skb); 2979 break; 2980 2981 case SMP_CMD_PAIRING_RANDOM: 2982 reason = smp_cmd_pairing_random(conn, skb); 2983 break; 2984 2985 case SMP_CMD_ENCRYPT_INFO: 2986 reason = smp_cmd_encrypt_info(conn, skb); 2987 break; 2988 2989 case SMP_CMD_MASTER_IDENT: 2990 reason = smp_cmd_master_ident(conn, skb); 2991 break; 2992 2993 case SMP_CMD_IDENT_INFO: 2994 reason = smp_cmd_ident_info(conn, skb); 2995 break; 2996 2997 case SMP_CMD_IDENT_ADDR_INFO: 2998 reason = smp_cmd_ident_addr_info(conn, skb); 2999 break; 3000 3001 case SMP_CMD_SIGN_INFO: 3002 reason = smp_cmd_sign_info(conn, skb); 3003 break; 3004 3005 case SMP_CMD_PUBLIC_KEY: 3006 reason = smp_cmd_public_key(conn, skb); 3007 break; 3008 3009 case SMP_CMD_DHKEY_CHECK: 3010 reason = smp_cmd_dhkey_check(conn, skb); 3011 break; 3012 3013 case SMP_CMD_KEYPRESS_NOTIFY: 3014 reason = smp_cmd_keypress_notify(conn, skb); 3015 break; 3016 3017 default: 3018 BT_DBG("Unknown command code 0x%2.2x", code); 3019 reason = SMP_CMD_NOTSUPP; 3020 goto done; 3021 } 3022 3023 done: 3024 if (!err) { 3025 if (reason) 3026 smp_failure(conn, reason); 3027 kfree_skb(skb); 3028 } 3029 3030 return err; 3031 3032 drop: 3033 bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR", 3034 code, &hcon->dst); 3035 kfree_skb(skb); 3036 return 0; 3037 } 3038 3039 static void smp_teardown_cb(struct l2cap_chan *chan, int err) 3040 { 3041 struct l2cap_conn *conn = chan->conn; 3042 3043 BT_DBG("chan %p", chan); 3044 3045 if (chan->data) 3046 smp_chan_destroy(conn); 3047 3048 conn->smp = NULL; 3049 l2cap_chan_put(chan); 3050 } 3051 3052 static void bredr_pairing(struct l2cap_chan *chan) 3053 { 3054 struct l2cap_conn *conn = chan->conn; 3055 struct hci_conn *hcon = conn->hcon; 3056 struct hci_dev *hdev = hcon->hdev; 3057 struct smp_cmd_pairing req; 3058 struct smp_chan *smp; 3059 3060 BT_DBG("chan %p", chan); 3061 3062 /* Only new pairings are interesting */ 3063 if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags)) 3064 return; 3065 3066 /* Don't bother if we're not encrypted */ 3067 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3068 return; 3069 3070 /* Only master may initiate SMP over BR/EDR */ 3071 if (hcon->role != HCI_ROLE_MASTER) 3072 return; 3073 3074 /* Secure Connections support must be enabled */ 3075 if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 3076 return; 3077 3078 /* BR/EDR must use Secure Connections for SMP */ 3079 if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) && 3080 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3081 return; 3082 3083 /* If our LE support is not enabled don't do anything */ 3084 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 3085 return; 3086 3087 /* Don't bother if remote LE support is not enabled */ 3088 if (!lmp_host_le_capable(hcon)) 3089 return; 3090 3091 /* Remote must support SMP fixed chan for BR/EDR */ 3092 if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR)) 3093 return; 3094 3095 /* Don't bother if SMP is already ongoing */ 3096 if (chan->data) 3097 return; 3098 3099 smp = smp_chan_create(conn); 3100 if (!smp) { 3101 bt_dev_err(hdev, "unable to create SMP context for BR/EDR"); 3102 return; 3103 } 3104 3105 set_bit(SMP_FLAG_SC, &smp->flags); 3106 3107 BT_DBG("%s starting SMP over BR/EDR", hdev->name); 3108 3109 /* Prepare and send the BR/EDR SMP Pairing Request */ 3110 build_bredr_pairing_cmd(smp, &req, NULL); 3111 3112 smp->preq[0] = SMP_CMD_PAIRING_REQ; 3113 memcpy(&smp->preq[1], &req, sizeof(req)); 3114 3115 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(req), &req); 3116 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); 3117 } 3118 3119 static void smp_resume_cb(struct l2cap_chan *chan) 3120 { 3121 struct smp_chan *smp = chan->data; 3122 struct l2cap_conn *conn = chan->conn; 3123 struct hci_conn *hcon = conn->hcon; 3124 3125 BT_DBG("chan %p", chan); 3126 3127 if (hcon->type == ACL_LINK) { 3128 bredr_pairing(chan); 3129 return; 3130 } 3131 3132 if (!smp) 3133 return; 3134 3135 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3136 return; 3137 3138 cancel_delayed_work(&smp->security_timer); 3139 3140 smp_distribute_keys(smp); 3141 } 3142 3143 static void smp_ready_cb(struct l2cap_chan *chan) 3144 { 3145 struct l2cap_conn *conn = chan->conn; 3146 struct hci_conn *hcon = conn->hcon; 3147 3148 BT_DBG("chan %p", chan); 3149 3150 /* No need to call l2cap_chan_hold() here since we already own 3151 * the reference taken in smp_new_conn_cb(). This is just the 3152 * first time that we tie it to a specific pointer. The code in 3153 * l2cap_core.c ensures that there's no risk this function wont 3154 * get called if smp_new_conn_cb was previously called. 3155 */ 3156 conn->smp = chan; 3157 3158 if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3159 bredr_pairing(chan); 3160 } 3161 3162 static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 3163 { 3164 int err; 3165 3166 BT_DBG("chan %p", chan); 3167 3168 err = smp_sig_channel(chan, skb); 3169 if (err) { 3170 struct smp_chan *smp = chan->data; 3171 3172 if (smp) 3173 cancel_delayed_work_sync(&smp->security_timer); 3174 3175 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE); 3176 } 3177 3178 return err; 3179 } 3180 3181 static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan, 3182 unsigned long hdr_len, 3183 unsigned long len, int nb) 3184 { 3185 struct sk_buff *skb; 3186 3187 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL); 3188 if (!skb) 3189 return ERR_PTR(-ENOMEM); 3190 3191 skb->priority = HCI_PRIO_MAX; 3192 bt_cb(skb)->l2cap.chan = chan; 3193 3194 return skb; 3195 } 3196 3197 static const struct l2cap_ops smp_chan_ops = { 3198 .name = "Security Manager", 3199 .ready = smp_ready_cb, 3200 .recv = smp_recv_cb, 3201 .alloc_skb = smp_alloc_skb_cb, 3202 .teardown = smp_teardown_cb, 3203 .resume = smp_resume_cb, 3204 3205 .new_connection = l2cap_chan_no_new_connection, 3206 .state_change = l2cap_chan_no_state_change, 3207 .close = l2cap_chan_no_close, 3208 .defer = l2cap_chan_no_defer, 3209 .suspend = l2cap_chan_no_suspend, 3210 .set_shutdown = l2cap_chan_no_set_shutdown, 3211 .get_sndtimeo = l2cap_chan_no_get_sndtimeo, 3212 }; 3213 3214 static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan) 3215 { 3216 struct l2cap_chan *chan; 3217 3218 BT_DBG("pchan %p", pchan); 3219 3220 chan = l2cap_chan_create(); 3221 if (!chan) 3222 return NULL; 3223 3224 chan->chan_type = pchan->chan_type; 3225 chan->ops = &smp_chan_ops; 3226 chan->scid = pchan->scid; 3227 chan->dcid = chan->scid; 3228 chan->imtu = pchan->imtu; 3229 chan->omtu = pchan->omtu; 3230 chan->mode = pchan->mode; 3231 3232 /* Other L2CAP channels may request SMP routines in order to 3233 * change the security level. This means that the SMP channel 3234 * lock must be considered in its own category to avoid lockdep 3235 * warnings. 3236 */ 3237 atomic_set(&chan->nesting, L2CAP_NESTING_SMP); 3238 3239 BT_DBG("created chan %p", chan); 3240 3241 return chan; 3242 } 3243 3244 static const struct l2cap_ops smp_root_chan_ops = { 3245 .name = "Security Manager Root", 3246 .new_connection = smp_new_conn_cb, 3247 3248 /* None of these are implemented for the root channel */ 3249 .close = l2cap_chan_no_close, 3250 .alloc_skb = l2cap_chan_no_alloc_skb, 3251 .recv = l2cap_chan_no_recv, 3252 .state_change = l2cap_chan_no_state_change, 3253 .teardown = l2cap_chan_no_teardown, 3254 .ready = l2cap_chan_no_ready, 3255 .defer = l2cap_chan_no_defer, 3256 .suspend = l2cap_chan_no_suspend, 3257 .resume = l2cap_chan_no_resume, 3258 .set_shutdown = l2cap_chan_no_set_shutdown, 3259 .get_sndtimeo = l2cap_chan_no_get_sndtimeo, 3260 }; 3261 3262 static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid) 3263 { 3264 struct l2cap_chan *chan; 3265 struct smp_dev *smp; 3266 struct crypto_shash *tfm_cmac; 3267 struct crypto_kpp *tfm_ecdh; 3268 3269 if (cid == L2CAP_CID_SMP_BREDR) { 3270 smp = NULL; 3271 goto create_chan; 3272 } 3273 3274 smp = kzalloc(sizeof(*smp), GFP_KERNEL); 3275 if (!smp) 3276 return ERR_PTR(-ENOMEM); 3277 3278 tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0); 3279 if (IS_ERR(tfm_cmac)) { 3280 BT_ERR("Unable to create CMAC crypto context"); 3281 kfree_sensitive(smp); 3282 return ERR_CAST(tfm_cmac); 3283 } 3284 3285 tfm_ecdh = crypto_alloc_kpp("ecdh", 0, 0); 3286 if (IS_ERR(tfm_ecdh)) { 3287 BT_ERR("Unable to create ECDH crypto context"); 3288 crypto_free_shash(tfm_cmac); 3289 kfree_sensitive(smp); 3290 return ERR_CAST(tfm_ecdh); 3291 } 3292 3293 smp->local_oob = false; 3294 smp->tfm_cmac = tfm_cmac; 3295 smp->tfm_ecdh = tfm_ecdh; 3296 3297 create_chan: 3298 chan = l2cap_chan_create(); 3299 if (!chan) { 3300 if (smp) { 3301 crypto_free_shash(smp->tfm_cmac); 3302 crypto_free_kpp(smp->tfm_ecdh); 3303 kfree_sensitive(smp); 3304 } 3305 return ERR_PTR(-ENOMEM); 3306 } 3307 3308 chan->data = smp; 3309 3310 l2cap_add_scid(chan, cid); 3311 3312 l2cap_chan_set_defaults(chan); 3313 3314 if (cid == L2CAP_CID_SMP) { 3315 u8 bdaddr_type; 3316 3317 hci_copy_identity_address(hdev, &chan->src, &bdaddr_type); 3318 3319 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 3320 chan->src_type = BDADDR_LE_PUBLIC; 3321 else 3322 chan->src_type = BDADDR_LE_RANDOM; 3323 } else { 3324 bacpy(&chan->src, &hdev->bdaddr); 3325 chan->src_type = BDADDR_BREDR; 3326 } 3327 3328 chan->state = BT_LISTEN; 3329 chan->mode = L2CAP_MODE_BASIC; 3330 chan->imtu = L2CAP_DEFAULT_MTU; 3331 chan->ops = &smp_root_chan_ops; 3332 3333 /* Set correct nesting level for a parent/listening channel */ 3334 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); 3335 3336 return chan; 3337 } 3338 3339 static void smp_del_chan(struct l2cap_chan *chan) 3340 { 3341 struct smp_dev *smp; 3342 3343 BT_DBG("chan %p", chan); 3344 3345 smp = chan->data; 3346 if (smp) { 3347 chan->data = NULL; 3348 crypto_free_shash(smp->tfm_cmac); 3349 crypto_free_kpp(smp->tfm_ecdh); 3350 kfree_sensitive(smp); 3351 } 3352 3353 l2cap_chan_put(chan); 3354 } 3355 3356 int smp_force_bredr(struct hci_dev *hdev, bool enable) 3357 { 3358 if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3359 return -EALREADY; 3360 3361 if (enable) { 3362 struct l2cap_chan *chan; 3363 3364 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR); 3365 if (IS_ERR(chan)) 3366 return PTR_ERR(chan); 3367 3368 hdev->smp_bredr_data = chan; 3369 } else { 3370 struct l2cap_chan *chan; 3371 3372 chan = hdev->smp_bredr_data; 3373 hdev->smp_bredr_data = NULL; 3374 smp_del_chan(chan); 3375 } 3376 3377 hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP); 3378 3379 return 0; 3380 } 3381 3382 int smp_register(struct hci_dev *hdev) 3383 { 3384 struct l2cap_chan *chan; 3385 3386 BT_DBG("%s", hdev->name); 3387 3388 /* If the controller does not support Low Energy operation, then 3389 * there is also no need to register any SMP channel. 3390 */ 3391 if (!lmp_le_capable(hdev)) 3392 return 0; 3393 3394 if (WARN_ON(hdev->smp_data)) { 3395 chan = hdev->smp_data; 3396 hdev->smp_data = NULL; 3397 smp_del_chan(chan); 3398 } 3399 3400 chan = smp_add_cid(hdev, L2CAP_CID_SMP); 3401 if (IS_ERR(chan)) 3402 return PTR_ERR(chan); 3403 3404 hdev->smp_data = chan; 3405 3406 if (!lmp_sc_capable(hdev)) { 3407 /* Flag can be already set here (due to power toggle) */ 3408 if (!hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3409 return 0; 3410 } 3411 3412 if (WARN_ON(hdev->smp_bredr_data)) { 3413 chan = hdev->smp_bredr_data; 3414 hdev->smp_bredr_data = NULL; 3415 smp_del_chan(chan); 3416 } 3417 3418 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR); 3419 if (IS_ERR(chan)) { 3420 int err = PTR_ERR(chan); 3421 chan = hdev->smp_data; 3422 hdev->smp_data = NULL; 3423 smp_del_chan(chan); 3424 return err; 3425 } 3426 3427 hdev->smp_bredr_data = chan; 3428 3429 return 0; 3430 } 3431 3432 void smp_unregister(struct hci_dev *hdev) 3433 { 3434 struct l2cap_chan *chan; 3435 3436 if (hdev->smp_bredr_data) { 3437 chan = hdev->smp_bredr_data; 3438 hdev->smp_bredr_data = NULL; 3439 smp_del_chan(chan); 3440 } 3441 3442 if (hdev->smp_data) { 3443 chan = hdev->smp_data; 3444 hdev->smp_data = NULL; 3445 smp_del_chan(chan); 3446 } 3447 } 3448 3449 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP) 3450 3451 static int __init test_debug_key(struct crypto_kpp *tfm_ecdh) 3452 { 3453 u8 pk[64]; 3454 int err; 3455 3456 err = set_ecdh_privkey(tfm_ecdh, debug_sk); 3457 if (err) 3458 return err; 3459 3460 err = generate_ecdh_public_key(tfm_ecdh, pk); 3461 if (err) 3462 return err; 3463 3464 if (crypto_memneq(pk, debug_pk, 64)) 3465 return -EINVAL; 3466 3467 return 0; 3468 } 3469 3470 static int __init test_ah(void) 3471 { 3472 const u8 irk[16] = { 3473 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3474 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3475 const u8 r[3] = { 0x94, 0x81, 0x70 }; 3476 const u8 exp[3] = { 0xaa, 0xfb, 0x0d }; 3477 u8 res[3]; 3478 int err; 3479 3480 err = smp_ah(irk, r, res); 3481 if (err) 3482 return err; 3483 3484 if (crypto_memneq(res, exp, 3)) 3485 return -EINVAL; 3486 3487 return 0; 3488 } 3489 3490 static int __init test_c1(void) 3491 { 3492 const u8 k[16] = { 3493 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 3494 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 3495 const u8 r[16] = { 3496 0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63, 3497 0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 }; 3498 const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 }; 3499 const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 }; 3500 const u8 _iat = 0x01; 3501 const u8 _rat = 0x00; 3502 const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } }; 3503 const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } }; 3504 const u8 exp[16] = { 3505 0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2, 3506 0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e }; 3507 u8 res[16]; 3508 int err; 3509 3510 err = smp_c1(k, r, preq, pres, _iat, &ia, _rat, &ra, res); 3511 if (err) 3512 return err; 3513 3514 if (crypto_memneq(res, exp, 16)) 3515 return -EINVAL; 3516 3517 return 0; 3518 } 3519 3520 static int __init test_s1(void) 3521 { 3522 const u8 k[16] = { 3523 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 3524 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 3525 const u8 r1[16] = { 3526 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 }; 3527 const u8 r2[16] = { 3528 0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 }; 3529 const u8 exp[16] = { 3530 0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b, 3531 0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a }; 3532 u8 res[16]; 3533 int err; 3534 3535 err = smp_s1(k, r1, r2, res); 3536 if (err) 3537 return err; 3538 3539 if (crypto_memneq(res, exp, 16)) 3540 return -EINVAL; 3541 3542 return 0; 3543 } 3544 3545 static int __init test_f4(struct crypto_shash *tfm_cmac) 3546 { 3547 const u8 u[32] = { 3548 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 3549 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 3550 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 3551 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 }; 3552 const u8 v[32] = { 3553 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b, 3554 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59, 3555 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90, 3556 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 }; 3557 const u8 x[16] = { 3558 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3559 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3560 const u8 z = 0x00; 3561 const u8 exp[16] = { 3562 0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1, 3563 0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 }; 3564 u8 res[16]; 3565 int err; 3566 3567 err = smp_f4(tfm_cmac, u, v, x, z, res); 3568 if (err) 3569 return err; 3570 3571 if (crypto_memneq(res, exp, 16)) 3572 return -EINVAL; 3573 3574 return 0; 3575 } 3576 3577 static int __init test_f5(struct crypto_shash *tfm_cmac) 3578 { 3579 const u8 w[32] = { 3580 0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86, 3581 0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99, 3582 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3583 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3584 const u8 n1[16] = { 3585 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3586 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3587 const u8 n2[16] = { 3588 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3589 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3590 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 }; 3591 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 }; 3592 const u8 exp_ltk[16] = { 3593 0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98, 3594 0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 }; 3595 const u8 exp_mackey[16] = { 3596 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd, 3597 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 }; 3598 u8 mackey[16], ltk[16]; 3599 int err; 3600 3601 err = smp_f5(tfm_cmac, w, n1, n2, a1, a2, mackey, ltk); 3602 if (err) 3603 return err; 3604 3605 if (crypto_memneq(mackey, exp_mackey, 16)) 3606 return -EINVAL; 3607 3608 if (crypto_memneq(ltk, exp_ltk, 16)) 3609 return -EINVAL; 3610 3611 return 0; 3612 } 3613 3614 static int __init test_f6(struct crypto_shash *tfm_cmac) 3615 { 3616 const u8 w[16] = { 3617 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd, 3618 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 }; 3619 const u8 n1[16] = { 3620 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3621 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3622 const u8 n2[16] = { 3623 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3624 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3625 const u8 r[16] = { 3626 0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08, 3627 0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 }; 3628 const u8 io_cap[3] = { 0x02, 0x01, 0x01 }; 3629 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 }; 3630 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 }; 3631 const u8 exp[16] = { 3632 0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2, 3633 0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 }; 3634 u8 res[16]; 3635 int err; 3636 3637 err = smp_f6(tfm_cmac, w, n1, n2, r, io_cap, a1, a2, res); 3638 if (err) 3639 return err; 3640 3641 if (crypto_memneq(res, exp, 16)) 3642 return -EINVAL; 3643 3644 return 0; 3645 } 3646 3647 static int __init test_g2(struct crypto_shash *tfm_cmac) 3648 { 3649 const u8 u[32] = { 3650 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 3651 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 3652 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 3653 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 }; 3654 const u8 v[32] = { 3655 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b, 3656 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59, 3657 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90, 3658 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 }; 3659 const u8 x[16] = { 3660 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3661 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3662 const u8 y[16] = { 3663 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3664 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3665 const u32 exp_val = 0x2f9ed5ba % 1000000; 3666 u32 val; 3667 int err; 3668 3669 err = smp_g2(tfm_cmac, u, v, x, y, &val); 3670 if (err) 3671 return err; 3672 3673 if (val != exp_val) 3674 return -EINVAL; 3675 3676 return 0; 3677 } 3678 3679 static int __init test_h6(struct crypto_shash *tfm_cmac) 3680 { 3681 const u8 w[16] = { 3682 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3683 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3684 const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c }; 3685 const u8 exp[16] = { 3686 0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8, 3687 0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d }; 3688 u8 res[16]; 3689 int err; 3690 3691 err = smp_h6(tfm_cmac, w, key_id, res); 3692 if (err) 3693 return err; 3694 3695 if (crypto_memneq(res, exp, 16)) 3696 return -EINVAL; 3697 3698 return 0; 3699 } 3700 3701 static char test_smp_buffer[32]; 3702 3703 static ssize_t test_smp_read(struct file *file, char __user *user_buf, 3704 size_t count, loff_t *ppos) 3705 { 3706 return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer, 3707 strlen(test_smp_buffer)); 3708 } 3709 3710 static const struct file_operations test_smp_fops = { 3711 .open = simple_open, 3712 .read = test_smp_read, 3713 .llseek = default_llseek, 3714 }; 3715 3716 static int __init run_selftests(struct crypto_shash *tfm_cmac, 3717 struct crypto_kpp *tfm_ecdh) 3718 { 3719 ktime_t calltime, delta, rettime; 3720 unsigned long long duration; 3721 int err; 3722 3723 calltime = ktime_get(); 3724 3725 err = test_debug_key(tfm_ecdh); 3726 if (err) { 3727 BT_ERR("debug_key test failed"); 3728 goto done; 3729 } 3730 3731 err = test_ah(); 3732 if (err) { 3733 BT_ERR("smp_ah test failed"); 3734 goto done; 3735 } 3736 3737 err = test_c1(); 3738 if (err) { 3739 BT_ERR("smp_c1 test failed"); 3740 goto done; 3741 } 3742 3743 err = test_s1(); 3744 if (err) { 3745 BT_ERR("smp_s1 test failed"); 3746 goto done; 3747 } 3748 3749 err = test_f4(tfm_cmac); 3750 if (err) { 3751 BT_ERR("smp_f4 test failed"); 3752 goto done; 3753 } 3754 3755 err = test_f5(tfm_cmac); 3756 if (err) { 3757 BT_ERR("smp_f5 test failed"); 3758 goto done; 3759 } 3760 3761 err = test_f6(tfm_cmac); 3762 if (err) { 3763 BT_ERR("smp_f6 test failed"); 3764 goto done; 3765 } 3766 3767 err = test_g2(tfm_cmac); 3768 if (err) { 3769 BT_ERR("smp_g2 test failed"); 3770 goto done; 3771 } 3772 3773 err = test_h6(tfm_cmac); 3774 if (err) { 3775 BT_ERR("smp_h6 test failed"); 3776 goto done; 3777 } 3778 3779 rettime = ktime_get(); 3780 delta = ktime_sub(rettime, calltime); 3781 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 3782 3783 BT_INFO("SMP test passed in %llu usecs", duration); 3784 3785 done: 3786 if (!err) 3787 snprintf(test_smp_buffer, sizeof(test_smp_buffer), 3788 "PASS (%llu usecs)\n", duration); 3789 else 3790 snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n"); 3791 3792 debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL, 3793 &test_smp_fops); 3794 3795 return err; 3796 } 3797 3798 int __init bt_selftest_smp(void) 3799 { 3800 struct crypto_shash *tfm_cmac; 3801 struct crypto_kpp *tfm_ecdh; 3802 int err; 3803 3804 tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0); 3805 if (IS_ERR(tfm_cmac)) { 3806 BT_ERR("Unable to create CMAC crypto context"); 3807 return PTR_ERR(tfm_cmac); 3808 } 3809 3810 tfm_ecdh = crypto_alloc_kpp("ecdh", 0, 0); 3811 if (IS_ERR(tfm_ecdh)) { 3812 BT_ERR("Unable to create ECDH crypto context"); 3813 crypto_free_shash(tfm_cmac); 3814 return PTR_ERR(tfm_ecdh); 3815 } 3816 3817 err = run_selftests(tfm_cmac, tfm_ecdh); 3818 3819 crypto_free_shash(tfm_cmac); 3820 crypto_free_kpp(tfm_ecdh); 3821 3822 return err; 3823 } 3824 3825 #endif 3826