1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies). 4 5 This program is free software; you can redistribute it and/or modify 6 it under the terms of the GNU General Public License version 2 as 7 published by the Free Software Foundation; 8 9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 20 SOFTWARE IS DISCLAIMED. 21 */ 22 23 #include <linux/debugfs.h> 24 #include <linux/scatterlist.h> 25 #include <linux/crypto.h> 26 #include <crypto/b128ops.h> 27 #include <crypto/hash.h> 28 29 #include <net/bluetooth/bluetooth.h> 30 #include <net/bluetooth/hci_core.h> 31 #include <net/bluetooth/l2cap.h> 32 #include <net/bluetooth/mgmt.h> 33 34 #include "ecdh_helper.h" 35 #include "smp.h" 36 37 #define SMP_DEV(hdev) \ 38 ((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data) 39 40 /* Low-level debug macros to be used for stuff that we don't want 41 * accidentially in dmesg, i.e. the values of the various crypto keys 42 * and the inputs & outputs of crypto functions. 43 */ 44 #ifdef DEBUG 45 #define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \ 46 ##__VA_ARGS__) 47 #else 48 #define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \ 49 ##__VA_ARGS__) 50 #endif 51 52 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd) 53 54 /* Keys which are not distributed with Secure Connections */ 55 #define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY); 56 57 #define SMP_TIMEOUT msecs_to_jiffies(30000) 58 59 #define AUTH_REQ_MASK(dev) (hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \ 60 0x3f : 0x07) 61 #define KEY_DIST_MASK 0x07 62 63 /* Maximum message length that can be passed to aes_cmac */ 64 #define CMAC_MSG_MAX 80 65 66 enum { 67 SMP_FLAG_TK_VALID, 68 SMP_FLAG_CFM_PENDING, 69 SMP_FLAG_MITM_AUTH, 70 SMP_FLAG_COMPLETE, 71 SMP_FLAG_INITIATOR, 72 SMP_FLAG_SC, 73 SMP_FLAG_REMOTE_PK, 74 SMP_FLAG_DEBUG_KEY, 75 SMP_FLAG_WAIT_USER, 76 SMP_FLAG_DHKEY_PENDING, 77 SMP_FLAG_REMOTE_OOB, 78 SMP_FLAG_LOCAL_OOB, 79 SMP_FLAG_CT2, 80 }; 81 82 struct smp_dev { 83 /* Secure Connections OOB data */ 84 u8 local_pk[64]; 85 u8 local_sk[32]; 86 u8 local_rand[16]; 87 bool debug_key; 88 89 u8 min_key_size; 90 u8 max_key_size; 91 92 struct crypto_cipher *tfm_aes; 93 struct crypto_shash *tfm_cmac; 94 }; 95 96 struct smp_chan { 97 struct l2cap_conn *conn; 98 struct delayed_work security_timer; 99 unsigned long allow_cmd; /* Bitmask of allowed commands */ 100 101 u8 preq[7]; /* SMP Pairing Request */ 102 u8 prsp[7]; /* SMP Pairing Response */ 103 u8 prnd[16]; /* SMP Pairing Random (local) */ 104 u8 rrnd[16]; /* SMP Pairing Random (remote) */ 105 u8 pcnf[16]; /* SMP Pairing Confirm */ 106 u8 tk[16]; /* SMP Temporary Key */ 107 u8 rr[16]; /* Remote OOB ra/rb value */ 108 u8 lr[16]; /* Local OOB ra/rb value */ 109 u8 enc_key_size; 110 u8 remote_key_dist; 111 bdaddr_t id_addr; 112 u8 id_addr_type; 113 u8 irk[16]; 114 struct smp_csrk *csrk; 115 struct smp_csrk *slave_csrk; 116 struct smp_ltk *ltk; 117 struct smp_ltk *slave_ltk; 118 struct smp_irk *remote_irk; 119 u8 *link_key; 120 unsigned long flags; 121 u8 method; 122 u8 passkey_round; 123 124 /* Secure Connections variables */ 125 u8 local_pk[64]; 126 u8 local_sk[32]; 127 u8 remote_pk[64]; 128 u8 dhkey[32]; 129 u8 mackey[16]; 130 131 struct crypto_cipher *tfm_aes; 132 struct crypto_shash *tfm_cmac; 133 }; 134 135 /* These debug key values are defined in the SMP section of the core 136 * specification. debug_pk is the public debug key and debug_sk the 137 * private debug key. 138 */ 139 static const u8 debug_pk[64] = { 140 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 141 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 142 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 143 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20, 144 145 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74, 146 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76, 147 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63, 148 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc, 149 }; 150 151 static const u8 debug_sk[32] = { 152 0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58, 153 0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a, 154 0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74, 155 0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f, 156 }; 157 158 static inline void swap_buf(const u8 *src, u8 *dst, size_t len) 159 { 160 size_t i; 161 162 for (i = 0; i < len; i++) 163 dst[len - 1 - i] = src[i]; 164 } 165 166 /* The following functions map to the LE SC SMP crypto functions 167 * AES-CMAC, f4, f5, f6, g2 and h6. 168 */ 169 170 static int aes_cmac(struct crypto_shash *tfm, const u8 k[16], const u8 *m, 171 size_t len, u8 mac[16]) 172 { 173 uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX]; 174 SHASH_DESC_ON_STACK(desc, tfm); 175 int err; 176 177 if (len > CMAC_MSG_MAX) 178 return -EFBIG; 179 180 if (!tfm) { 181 BT_ERR("tfm %p", tfm); 182 return -EINVAL; 183 } 184 185 desc->tfm = tfm; 186 desc->flags = 0; 187 188 /* Swap key and message from LSB to MSB */ 189 swap_buf(k, tmp, 16); 190 swap_buf(m, msg_msb, len); 191 192 SMP_DBG("msg (len %zu) %*phN", len, (int) len, m); 193 SMP_DBG("key %16phN", k); 194 195 err = crypto_shash_setkey(tfm, tmp, 16); 196 if (err) { 197 BT_ERR("cipher setkey failed: %d", err); 198 return err; 199 } 200 201 err = crypto_shash_digest(desc, msg_msb, len, mac_msb); 202 shash_desc_zero(desc); 203 if (err) { 204 BT_ERR("Hash computation error %d", err); 205 return err; 206 } 207 208 swap_buf(mac_msb, mac, 16); 209 210 SMP_DBG("mac %16phN", mac); 211 212 return 0; 213 } 214 215 static int smp_f4(struct crypto_shash *tfm_cmac, const u8 u[32], 216 const u8 v[32], const u8 x[16], u8 z, u8 res[16]) 217 { 218 u8 m[65]; 219 int err; 220 221 SMP_DBG("u %32phN", u); 222 SMP_DBG("v %32phN", v); 223 SMP_DBG("x %16phN z %02x", x, z); 224 225 m[0] = z; 226 memcpy(m + 1, v, 32); 227 memcpy(m + 33, u, 32); 228 229 err = aes_cmac(tfm_cmac, x, m, sizeof(m), res); 230 if (err) 231 return err; 232 233 SMP_DBG("res %16phN", res); 234 235 return err; 236 } 237 238 static int smp_f5(struct crypto_shash *tfm_cmac, const u8 w[32], 239 const u8 n1[16], const u8 n2[16], const u8 a1[7], 240 const u8 a2[7], u8 mackey[16], u8 ltk[16]) 241 { 242 /* The btle, salt and length "magic" values are as defined in 243 * the SMP section of the Bluetooth core specification. In ASCII 244 * the btle value ends up being 'btle'. The salt is just a 245 * random number whereas length is the value 256 in little 246 * endian format. 247 */ 248 const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 }; 249 const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60, 250 0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c }; 251 const u8 length[2] = { 0x00, 0x01 }; 252 u8 m[53], t[16]; 253 int err; 254 255 SMP_DBG("w %32phN", w); 256 SMP_DBG("n1 %16phN n2 %16phN", n1, n2); 257 SMP_DBG("a1 %7phN a2 %7phN", a1, a2); 258 259 err = aes_cmac(tfm_cmac, salt, w, 32, t); 260 if (err) 261 return err; 262 263 SMP_DBG("t %16phN", t); 264 265 memcpy(m, length, 2); 266 memcpy(m + 2, a2, 7); 267 memcpy(m + 9, a1, 7); 268 memcpy(m + 16, n2, 16); 269 memcpy(m + 32, n1, 16); 270 memcpy(m + 48, btle, 4); 271 272 m[52] = 0; /* Counter */ 273 274 err = aes_cmac(tfm_cmac, t, m, sizeof(m), mackey); 275 if (err) 276 return err; 277 278 SMP_DBG("mackey %16phN", mackey); 279 280 m[52] = 1; /* Counter */ 281 282 err = aes_cmac(tfm_cmac, t, m, sizeof(m), ltk); 283 if (err) 284 return err; 285 286 SMP_DBG("ltk %16phN", ltk); 287 288 return 0; 289 } 290 291 static int smp_f6(struct crypto_shash *tfm_cmac, const u8 w[16], 292 const u8 n1[16], const u8 n2[16], const u8 r[16], 293 const u8 io_cap[3], const u8 a1[7], const u8 a2[7], 294 u8 res[16]) 295 { 296 u8 m[65]; 297 int err; 298 299 SMP_DBG("w %16phN", w); 300 SMP_DBG("n1 %16phN n2 %16phN", n1, n2); 301 SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2); 302 303 memcpy(m, a2, 7); 304 memcpy(m + 7, a1, 7); 305 memcpy(m + 14, io_cap, 3); 306 memcpy(m + 17, r, 16); 307 memcpy(m + 33, n2, 16); 308 memcpy(m + 49, n1, 16); 309 310 err = aes_cmac(tfm_cmac, w, m, sizeof(m), res); 311 if (err) 312 return err; 313 314 SMP_DBG("res %16phN", res); 315 316 return err; 317 } 318 319 static int smp_g2(struct crypto_shash *tfm_cmac, const u8 u[32], const u8 v[32], 320 const u8 x[16], const u8 y[16], u32 *val) 321 { 322 u8 m[80], tmp[16]; 323 int err; 324 325 SMP_DBG("u %32phN", u); 326 SMP_DBG("v %32phN", v); 327 SMP_DBG("x %16phN y %16phN", x, y); 328 329 memcpy(m, y, 16); 330 memcpy(m + 16, v, 32); 331 memcpy(m + 48, u, 32); 332 333 err = aes_cmac(tfm_cmac, x, m, sizeof(m), tmp); 334 if (err) 335 return err; 336 337 *val = get_unaligned_le32(tmp); 338 *val %= 1000000; 339 340 SMP_DBG("val %06u", *val); 341 342 return 0; 343 } 344 345 static int smp_h6(struct crypto_shash *tfm_cmac, const u8 w[16], 346 const u8 key_id[4], u8 res[16]) 347 { 348 int err; 349 350 SMP_DBG("w %16phN key_id %4phN", w, key_id); 351 352 err = aes_cmac(tfm_cmac, w, key_id, 4, res); 353 if (err) 354 return err; 355 356 SMP_DBG("res %16phN", res); 357 358 return err; 359 } 360 361 static int smp_h7(struct crypto_shash *tfm_cmac, const u8 w[16], 362 const u8 salt[16], u8 res[16]) 363 { 364 int err; 365 366 SMP_DBG("w %16phN salt %16phN", w, salt); 367 368 err = aes_cmac(tfm_cmac, salt, w, 16, res); 369 if (err) 370 return err; 371 372 SMP_DBG("res %16phN", res); 373 374 return err; 375 } 376 377 /* The following functions map to the legacy SMP crypto functions e, c1, 378 * s1 and ah. 379 */ 380 381 static int smp_e(struct crypto_cipher *tfm, const u8 *k, u8 *r) 382 { 383 uint8_t tmp[16], data[16]; 384 int err; 385 386 SMP_DBG("k %16phN r %16phN", k, r); 387 388 if (!tfm) { 389 BT_ERR("tfm %p", tfm); 390 return -EINVAL; 391 } 392 393 /* The most significant octet of key corresponds to k[0] */ 394 swap_buf(k, tmp, 16); 395 396 err = crypto_cipher_setkey(tfm, tmp, 16); 397 if (err) { 398 BT_ERR("cipher setkey failed: %d", err); 399 return err; 400 } 401 402 /* Most significant octet of plaintextData corresponds to data[0] */ 403 swap_buf(r, data, 16); 404 405 crypto_cipher_encrypt_one(tfm, data, data); 406 407 /* Most significant octet of encryptedData corresponds to data[0] */ 408 swap_buf(data, r, 16); 409 410 SMP_DBG("r %16phN", r); 411 412 return err; 413 } 414 415 static int smp_c1(struct crypto_cipher *tfm_aes, const u8 k[16], 416 const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat, 417 const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16]) 418 { 419 u8 p1[16], p2[16]; 420 int err; 421 422 SMP_DBG("k %16phN r %16phN", k, r); 423 SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra); 424 SMP_DBG("preq %7phN pres %7phN", preq, pres); 425 426 memset(p1, 0, 16); 427 428 /* p1 = pres || preq || _rat || _iat */ 429 p1[0] = _iat; 430 p1[1] = _rat; 431 memcpy(p1 + 2, preq, 7); 432 memcpy(p1 + 9, pres, 7); 433 434 SMP_DBG("p1 %16phN", p1); 435 436 /* res = r XOR p1 */ 437 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1); 438 439 /* res = e(k, res) */ 440 err = smp_e(tfm_aes, k, res); 441 if (err) { 442 BT_ERR("Encrypt data error"); 443 return err; 444 } 445 446 /* p2 = padding || ia || ra */ 447 memcpy(p2, ra, 6); 448 memcpy(p2 + 6, ia, 6); 449 memset(p2 + 12, 0, 4); 450 451 SMP_DBG("p2 %16phN", p2); 452 453 /* res = res XOR p2 */ 454 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2); 455 456 /* res = e(k, res) */ 457 err = smp_e(tfm_aes, k, res); 458 if (err) 459 BT_ERR("Encrypt data error"); 460 461 return err; 462 } 463 464 static int smp_s1(struct crypto_cipher *tfm_aes, const u8 k[16], 465 const u8 r1[16], const u8 r2[16], u8 _r[16]) 466 { 467 int err; 468 469 /* Just least significant octets from r1 and r2 are considered */ 470 memcpy(_r, r2, 8); 471 memcpy(_r + 8, r1, 8); 472 473 err = smp_e(tfm_aes, k, _r); 474 if (err) 475 BT_ERR("Encrypt data error"); 476 477 return err; 478 } 479 480 static int smp_ah(struct crypto_cipher *tfm, const u8 irk[16], 481 const u8 r[3], u8 res[3]) 482 { 483 u8 _res[16]; 484 int err; 485 486 /* r' = padding || r */ 487 memcpy(_res, r, 3); 488 memset(_res + 3, 0, 13); 489 490 err = smp_e(tfm, irk, _res); 491 if (err) { 492 BT_ERR("Encrypt error"); 493 return err; 494 } 495 496 /* The output of the random address function ah is: 497 * ah(k, r) = e(k, r') mod 2^24 498 * The output of the security function e is then truncated to 24 bits 499 * by taking the least significant 24 bits of the output of e as the 500 * result of ah. 501 */ 502 memcpy(res, _res, 3); 503 504 return 0; 505 } 506 507 bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16], 508 const bdaddr_t *bdaddr) 509 { 510 struct l2cap_chan *chan = hdev->smp_data; 511 struct smp_dev *smp; 512 u8 hash[3]; 513 int err; 514 515 if (!chan || !chan->data) 516 return false; 517 518 smp = chan->data; 519 520 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk); 521 522 err = smp_ah(smp->tfm_aes, irk, &bdaddr->b[3], hash); 523 if (err) 524 return false; 525 526 return !memcmp(bdaddr->b, hash, 3); 527 } 528 529 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa) 530 { 531 struct l2cap_chan *chan = hdev->smp_data; 532 struct smp_dev *smp; 533 int err; 534 535 if (!chan || !chan->data) 536 return -EOPNOTSUPP; 537 538 smp = chan->data; 539 540 get_random_bytes(&rpa->b[3], 3); 541 542 rpa->b[5] &= 0x3f; /* Clear two most significant bits */ 543 rpa->b[5] |= 0x40; /* Set second most significant bit */ 544 545 err = smp_ah(smp->tfm_aes, irk, &rpa->b[3], rpa->b); 546 if (err < 0) 547 return err; 548 549 BT_DBG("RPA %pMR", rpa); 550 551 return 0; 552 } 553 554 int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16]) 555 { 556 struct l2cap_chan *chan = hdev->smp_data; 557 struct smp_dev *smp; 558 int err; 559 560 if (!chan || !chan->data) 561 return -EOPNOTSUPP; 562 563 smp = chan->data; 564 565 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 566 BT_DBG("Using debug keys"); 567 memcpy(smp->local_pk, debug_pk, 64); 568 memcpy(smp->local_sk, debug_sk, 32); 569 smp->debug_key = true; 570 } else { 571 while (true) { 572 /* Seed private key with random number */ 573 get_random_bytes(smp->local_sk, 32); 574 575 /* Generate local key pair for Secure Connections */ 576 if (!generate_ecdh_keys(smp->local_pk, smp->local_sk)) 577 return -EIO; 578 579 /* This is unlikely, but we need to check that 580 * we didn't accidentially generate a debug key. 581 */ 582 if (memcmp(smp->local_sk, debug_sk, 32)) 583 break; 584 } 585 smp->debug_key = false; 586 } 587 588 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk); 589 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32); 590 SMP_DBG("OOB Private Key: %32phN", smp->local_sk); 591 592 get_random_bytes(smp->local_rand, 16); 593 594 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk, 595 smp->local_rand, 0, hash); 596 if (err < 0) 597 return err; 598 599 memcpy(rand, smp->local_rand, 16); 600 601 return 0; 602 } 603 604 static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data) 605 { 606 struct l2cap_chan *chan = conn->smp; 607 struct smp_chan *smp; 608 struct kvec iv[2]; 609 struct msghdr msg; 610 611 if (!chan) 612 return; 613 614 BT_DBG("code 0x%2.2x", code); 615 616 iv[0].iov_base = &code; 617 iv[0].iov_len = 1; 618 619 iv[1].iov_base = data; 620 iv[1].iov_len = len; 621 622 memset(&msg, 0, sizeof(msg)); 623 624 iov_iter_kvec(&msg.msg_iter, WRITE | ITER_KVEC, iv, 2, 1 + len); 625 626 l2cap_chan_send(chan, &msg, 1 + len); 627 628 if (!chan->data) 629 return; 630 631 smp = chan->data; 632 633 cancel_delayed_work_sync(&smp->security_timer); 634 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT); 635 } 636 637 static u8 authreq_to_seclevel(u8 authreq) 638 { 639 if (authreq & SMP_AUTH_MITM) { 640 if (authreq & SMP_AUTH_SC) 641 return BT_SECURITY_FIPS; 642 else 643 return BT_SECURITY_HIGH; 644 } else { 645 return BT_SECURITY_MEDIUM; 646 } 647 } 648 649 static __u8 seclevel_to_authreq(__u8 sec_level) 650 { 651 switch (sec_level) { 652 case BT_SECURITY_FIPS: 653 case BT_SECURITY_HIGH: 654 return SMP_AUTH_MITM | SMP_AUTH_BONDING; 655 case BT_SECURITY_MEDIUM: 656 return SMP_AUTH_BONDING; 657 default: 658 return SMP_AUTH_NONE; 659 } 660 } 661 662 static void build_pairing_cmd(struct l2cap_conn *conn, 663 struct smp_cmd_pairing *req, 664 struct smp_cmd_pairing *rsp, __u8 authreq) 665 { 666 struct l2cap_chan *chan = conn->smp; 667 struct smp_chan *smp = chan->data; 668 struct hci_conn *hcon = conn->hcon; 669 struct hci_dev *hdev = hcon->hdev; 670 u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT; 671 672 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) { 673 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 674 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 675 authreq |= SMP_AUTH_BONDING; 676 } else { 677 authreq &= ~SMP_AUTH_BONDING; 678 } 679 680 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING)) 681 remote_dist |= SMP_DIST_ID_KEY; 682 683 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 684 local_dist |= SMP_DIST_ID_KEY; 685 686 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 687 (authreq & SMP_AUTH_SC)) { 688 struct oob_data *oob_data; 689 u8 bdaddr_type; 690 691 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 692 local_dist |= SMP_DIST_LINK_KEY; 693 remote_dist |= SMP_DIST_LINK_KEY; 694 } 695 696 if (hcon->dst_type == ADDR_LE_DEV_PUBLIC) 697 bdaddr_type = BDADDR_LE_PUBLIC; 698 else 699 bdaddr_type = BDADDR_LE_RANDOM; 700 701 oob_data = hci_find_remote_oob_data(hdev, &hcon->dst, 702 bdaddr_type); 703 if (oob_data && oob_data->present) { 704 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags); 705 oob_flag = SMP_OOB_PRESENT; 706 memcpy(smp->rr, oob_data->rand256, 16); 707 memcpy(smp->pcnf, oob_data->hash256, 16); 708 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf); 709 SMP_DBG("OOB Remote Random: %16phN", smp->rr); 710 } 711 712 } else { 713 authreq &= ~SMP_AUTH_SC; 714 } 715 716 if (rsp == NULL) { 717 req->io_capability = conn->hcon->io_capability; 718 req->oob_flag = oob_flag; 719 req->max_key_size = SMP_DEV(hdev)->max_key_size; 720 req->init_key_dist = local_dist; 721 req->resp_key_dist = remote_dist; 722 req->auth_req = (authreq & AUTH_REQ_MASK(hdev)); 723 724 smp->remote_key_dist = remote_dist; 725 return; 726 } 727 728 rsp->io_capability = conn->hcon->io_capability; 729 rsp->oob_flag = oob_flag; 730 rsp->max_key_size = SMP_DEV(hdev)->max_key_size; 731 rsp->init_key_dist = req->init_key_dist & remote_dist; 732 rsp->resp_key_dist = req->resp_key_dist & local_dist; 733 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev)); 734 735 smp->remote_key_dist = rsp->init_key_dist; 736 } 737 738 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size) 739 { 740 struct l2cap_chan *chan = conn->smp; 741 struct hci_dev *hdev = conn->hcon->hdev; 742 struct smp_chan *smp = chan->data; 743 744 if (max_key_size > SMP_DEV(hdev)->max_key_size || 745 max_key_size < SMP_MIN_ENC_KEY_SIZE) 746 return SMP_ENC_KEY_SIZE; 747 748 smp->enc_key_size = max_key_size; 749 750 return 0; 751 } 752 753 static void smp_chan_destroy(struct l2cap_conn *conn) 754 { 755 struct l2cap_chan *chan = conn->smp; 756 struct smp_chan *smp = chan->data; 757 struct hci_conn *hcon = conn->hcon; 758 bool complete; 759 760 BUG_ON(!smp); 761 762 cancel_delayed_work_sync(&smp->security_timer); 763 764 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags); 765 mgmt_smp_complete(hcon, complete); 766 767 kzfree(smp->csrk); 768 kzfree(smp->slave_csrk); 769 kzfree(smp->link_key); 770 771 crypto_free_cipher(smp->tfm_aes); 772 crypto_free_shash(smp->tfm_cmac); 773 774 /* Ensure that we don't leave any debug key around if debug key 775 * support hasn't been explicitly enabled. 776 */ 777 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG && 778 !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) { 779 list_del_rcu(&smp->ltk->list); 780 kfree_rcu(smp->ltk, rcu); 781 smp->ltk = NULL; 782 } 783 784 /* If pairing failed clean up any keys we might have */ 785 if (!complete) { 786 if (smp->ltk) { 787 list_del_rcu(&smp->ltk->list); 788 kfree_rcu(smp->ltk, rcu); 789 } 790 791 if (smp->slave_ltk) { 792 list_del_rcu(&smp->slave_ltk->list); 793 kfree_rcu(smp->slave_ltk, rcu); 794 } 795 796 if (smp->remote_irk) { 797 list_del_rcu(&smp->remote_irk->list); 798 kfree_rcu(smp->remote_irk, rcu); 799 } 800 } 801 802 chan->data = NULL; 803 kzfree(smp); 804 hci_conn_drop(hcon); 805 } 806 807 static void smp_failure(struct l2cap_conn *conn, u8 reason) 808 { 809 struct hci_conn *hcon = conn->hcon; 810 struct l2cap_chan *chan = conn->smp; 811 812 if (reason) 813 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), 814 &reason); 815 816 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE); 817 818 if (chan->data) 819 smp_chan_destroy(conn); 820 } 821 822 #define JUST_WORKS 0x00 823 #define JUST_CFM 0x01 824 #define REQ_PASSKEY 0x02 825 #define CFM_PASSKEY 0x03 826 #define REQ_OOB 0x04 827 #define DSP_PASSKEY 0x05 828 #define OVERLAP 0xFF 829 830 static const u8 gen_method[5][5] = { 831 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 832 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 833 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 834 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM }, 835 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP }, 836 }; 837 838 static const u8 sc_method[5][5] = { 839 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 840 { JUST_WORKS, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 841 { DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY }, 842 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM }, 843 { DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 844 }; 845 846 static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io) 847 { 848 /* If either side has unknown io_caps, use JUST_CFM (which gets 849 * converted later to JUST_WORKS if we're initiators. 850 */ 851 if (local_io > SMP_IO_KEYBOARD_DISPLAY || 852 remote_io > SMP_IO_KEYBOARD_DISPLAY) 853 return JUST_CFM; 854 855 if (test_bit(SMP_FLAG_SC, &smp->flags)) 856 return sc_method[remote_io][local_io]; 857 858 return gen_method[remote_io][local_io]; 859 } 860 861 static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth, 862 u8 local_io, u8 remote_io) 863 { 864 struct hci_conn *hcon = conn->hcon; 865 struct l2cap_chan *chan = conn->smp; 866 struct smp_chan *smp = chan->data; 867 u32 passkey = 0; 868 int ret = 0; 869 870 /* Initialize key for JUST WORKS */ 871 memset(smp->tk, 0, sizeof(smp->tk)); 872 clear_bit(SMP_FLAG_TK_VALID, &smp->flags); 873 874 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io); 875 876 /* If neither side wants MITM, either "just" confirm an incoming 877 * request or use just-works for outgoing ones. The JUST_CFM 878 * will be converted to JUST_WORKS if necessary later in this 879 * function. If either side has MITM look up the method from the 880 * table. 881 */ 882 if (!(auth & SMP_AUTH_MITM)) 883 smp->method = JUST_CFM; 884 else 885 smp->method = get_auth_method(smp, local_io, remote_io); 886 887 /* Don't confirm locally initiated pairing attempts */ 888 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, 889 &smp->flags)) 890 smp->method = JUST_WORKS; 891 892 /* Don't bother user space with no IO capabilities */ 893 if (smp->method == JUST_CFM && 894 hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 895 smp->method = JUST_WORKS; 896 897 /* If Just Works, Continue with Zero TK */ 898 if (smp->method == JUST_WORKS) { 899 set_bit(SMP_FLAG_TK_VALID, &smp->flags); 900 return 0; 901 } 902 903 /* If this function is used for SC -> legacy fallback we 904 * can only recover the just-works case. 905 */ 906 if (test_bit(SMP_FLAG_SC, &smp->flags)) 907 return -EINVAL; 908 909 /* Not Just Works/Confirm results in MITM Authentication */ 910 if (smp->method != JUST_CFM) { 911 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags); 912 if (hcon->pending_sec_level < BT_SECURITY_HIGH) 913 hcon->pending_sec_level = BT_SECURITY_HIGH; 914 } 915 916 /* If both devices have Keyoard-Display I/O, the master 917 * Confirms and the slave Enters the passkey. 918 */ 919 if (smp->method == OVERLAP) { 920 if (hcon->role == HCI_ROLE_MASTER) 921 smp->method = CFM_PASSKEY; 922 else 923 smp->method = REQ_PASSKEY; 924 } 925 926 /* Generate random passkey. */ 927 if (smp->method == CFM_PASSKEY) { 928 memset(smp->tk, 0, sizeof(smp->tk)); 929 get_random_bytes(&passkey, sizeof(passkey)); 930 passkey %= 1000000; 931 put_unaligned_le32(passkey, smp->tk); 932 BT_DBG("PassKey: %d", passkey); 933 set_bit(SMP_FLAG_TK_VALID, &smp->flags); 934 } 935 936 if (smp->method == REQ_PASSKEY) 937 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst, 938 hcon->type, hcon->dst_type); 939 else if (smp->method == JUST_CFM) 940 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, 941 hcon->type, hcon->dst_type, 942 passkey, 1); 943 else 944 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst, 945 hcon->type, hcon->dst_type, 946 passkey, 0); 947 948 return ret; 949 } 950 951 static u8 smp_confirm(struct smp_chan *smp) 952 { 953 struct l2cap_conn *conn = smp->conn; 954 struct smp_cmd_pairing_confirm cp; 955 int ret; 956 957 BT_DBG("conn %p", conn); 958 959 ret = smp_c1(smp->tfm_aes, smp->tk, smp->prnd, smp->preq, smp->prsp, 960 conn->hcon->init_addr_type, &conn->hcon->init_addr, 961 conn->hcon->resp_addr_type, &conn->hcon->resp_addr, 962 cp.confirm_val); 963 if (ret) 964 return SMP_UNSPECIFIED; 965 966 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 967 968 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp); 969 970 if (conn->hcon->out) 971 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 972 else 973 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 974 975 return 0; 976 } 977 978 static u8 smp_random(struct smp_chan *smp) 979 { 980 struct l2cap_conn *conn = smp->conn; 981 struct hci_conn *hcon = conn->hcon; 982 u8 confirm[16]; 983 int ret; 984 985 if (IS_ERR_OR_NULL(smp->tfm_aes)) 986 return SMP_UNSPECIFIED; 987 988 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave"); 989 990 ret = smp_c1(smp->tfm_aes, smp->tk, smp->rrnd, smp->preq, smp->prsp, 991 hcon->init_addr_type, &hcon->init_addr, 992 hcon->resp_addr_type, &hcon->resp_addr, confirm); 993 if (ret) 994 return SMP_UNSPECIFIED; 995 996 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) { 997 BT_ERR("Pairing failed (confirmation values mismatch)"); 998 return SMP_CONFIRM_FAILED; 999 } 1000 1001 if (hcon->out) { 1002 u8 stk[16]; 1003 __le64 rand = 0; 1004 __le16 ediv = 0; 1005 1006 smp_s1(smp->tfm_aes, smp->tk, smp->rrnd, smp->prnd, stk); 1007 1008 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) 1009 return SMP_UNSPECIFIED; 1010 1011 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size); 1012 hcon->enc_key_size = smp->enc_key_size; 1013 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); 1014 } else { 1015 u8 stk[16], auth; 1016 __le64 rand = 0; 1017 __le16 ediv = 0; 1018 1019 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 1020 smp->prnd); 1021 1022 smp_s1(smp->tfm_aes, smp->tk, smp->prnd, smp->rrnd, stk); 1023 1024 if (hcon->pending_sec_level == BT_SECURITY_HIGH) 1025 auth = 1; 1026 else 1027 auth = 0; 1028 1029 /* Even though there's no _SLAVE suffix this is the 1030 * slave STK we're adding for later lookup (the master 1031 * STK never needs to be stored). 1032 */ 1033 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 1034 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand); 1035 } 1036 1037 return 0; 1038 } 1039 1040 static void smp_notify_keys(struct l2cap_conn *conn) 1041 { 1042 struct l2cap_chan *chan = conn->smp; 1043 struct smp_chan *smp = chan->data; 1044 struct hci_conn *hcon = conn->hcon; 1045 struct hci_dev *hdev = hcon->hdev; 1046 struct smp_cmd_pairing *req = (void *) &smp->preq[1]; 1047 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1]; 1048 bool persistent; 1049 1050 if (hcon->type == ACL_LINK) { 1051 if (hcon->key_type == HCI_LK_DEBUG_COMBINATION) 1052 persistent = false; 1053 else 1054 persistent = !test_bit(HCI_CONN_FLUSH_KEY, 1055 &hcon->flags); 1056 } else { 1057 /* The LTKs, IRKs and CSRKs should be persistent only if 1058 * both sides had the bonding bit set in their 1059 * authentication requests. 1060 */ 1061 persistent = !!((req->auth_req & rsp->auth_req) & 1062 SMP_AUTH_BONDING); 1063 } 1064 1065 if (smp->remote_irk) { 1066 mgmt_new_irk(hdev, smp->remote_irk, persistent); 1067 1068 /* Now that user space can be considered to know the 1069 * identity address track the connection based on it 1070 * from now on (assuming this is an LE link). 1071 */ 1072 if (hcon->type == LE_LINK) { 1073 bacpy(&hcon->dst, &smp->remote_irk->bdaddr); 1074 hcon->dst_type = smp->remote_irk->addr_type; 1075 queue_work(hdev->workqueue, &conn->id_addr_update_work); 1076 } 1077 } 1078 1079 if (smp->csrk) { 1080 smp->csrk->bdaddr_type = hcon->dst_type; 1081 bacpy(&smp->csrk->bdaddr, &hcon->dst); 1082 mgmt_new_csrk(hdev, smp->csrk, persistent); 1083 } 1084 1085 if (smp->slave_csrk) { 1086 smp->slave_csrk->bdaddr_type = hcon->dst_type; 1087 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst); 1088 mgmt_new_csrk(hdev, smp->slave_csrk, persistent); 1089 } 1090 1091 if (smp->ltk) { 1092 smp->ltk->bdaddr_type = hcon->dst_type; 1093 bacpy(&smp->ltk->bdaddr, &hcon->dst); 1094 mgmt_new_ltk(hdev, smp->ltk, persistent); 1095 } 1096 1097 if (smp->slave_ltk) { 1098 smp->slave_ltk->bdaddr_type = hcon->dst_type; 1099 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst); 1100 mgmt_new_ltk(hdev, smp->slave_ltk, persistent); 1101 } 1102 1103 if (smp->link_key) { 1104 struct link_key *key; 1105 u8 type; 1106 1107 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) 1108 type = HCI_LK_DEBUG_COMBINATION; 1109 else if (hcon->sec_level == BT_SECURITY_FIPS) 1110 type = HCI_LK_AUTH_COMBINATION_P256; 1111 else 1112 type = HCI_LK_UNAUTH_COMBINATION_P256; 1113 1114 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, 1115 smp->link_key, type, 0, &persistent); 1116 if (key) { 1117 mgmt_new_link_key(hdev, key, persistent); 1118 1119 /* Don't keep debug keys around if the relevant 1120 * flag is not set. 1121 */ 1122 if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) && 1123 key->type == HCI_LK_DEBUG_COMBINATION) { 1124 list_del_rcu(&key->list); 1125 kfree_rcu(key, rcu); 1126 } 1127 } 1128 } 1129 } 1130 1131 static void sc_add_ltk(struct smp_chan *smp) 1132 { 1133 struct hci_conn *hcon = smp->conn->hcon; 1134 u8 key_type, auth; 1135 1136 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) 1137 key_type = SMP_LTK_P256_DEBUG; 1138 else 1139 key_type = SMP_LTK_P256; 1140 1141 if (hcon->pending_sec_level == BT_SECURITY_FIPS) 1142 auth = 1; 1143 else 1144 auth = 0; 1145 1146 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 1147 key_type, auth, smp->tk, smp->enc_key_size, 1148 0, 0); 1149 } 1150 1151 static void sc_generate_link_key(struct smp_chan *smp) 1152 { 1153 /* From core spec. Spells out in ASCII as 'lebr'. */ 1154 const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c }; 1155 1156 smp->link_key = kzalloc(16, GFP_KERNEL); 1157 if (!smp->link_key) 1158 return; 1159 1160 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { 1161 /* SALT = 0x00000000000000000000000000000000746D7031 */ 1162 const u8 salt[16] = { 0x31, 0x70, 0x6d, 0x74 }; 1163 1164 if (smp_h7(smp->tfm_cmac, smp->tk, salt, smp->link_key)) { 1165 kzfree(smp->link_key); 1166 smp->link_key = NULL; 1167 return; 1168 } 1169 } else { 1170 /* From core spec. Spells out in ASCII as 'tmp1'. */ 1171 const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 }; 1172 1173 if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) { 1174 kzfree(smp->link_key); 1175 smp->link_key = NULL; 1176 return; 1177 } 1178 } 1179 1180 if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) { 1181 kzfree(smp->link_key); 1182 smp->link_key = NULL; 1183 return; 1184 } 1185 } 1186 1187 static void smp_allow_key_dist(struct smp_chan *smp) 1188 { 1189 /* Allow the first expected phase 3 PDU. The rest of the PDUs 1190 * will be allowed in each PDU handler to ensure we receive 1191 * them in the correct order. 1192 */ 1193 if (smp->remote_key_dist & SMP_DIST_ENC_KEY) 1194 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO); 1195 else if (smp->remote_key_dist & SMP_DIST_ID_KEY) 1196 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); 1197 else if (smp->remote_key_dist & SMP_DIST_SIGN) 1198 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 1199 } 1200 1201 static void sc_generate_ltk(struct smp_chan *smp) 1202 { 1203 /* From core spec. Spells out in ASCII as 'brle'. */ 1204 const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 }; 1205 struct hci_conn *hcon = smp->conn->hcon; 1206 struct hci_dev *hdev = hcon->hdev; 1207 struct link_key *key; 1208 1209 key = hci_find_link_key(hdev, &hcon->dst); 1210 if (!key) { 1211 BT_ERR("%s No Link Key found to generate LTK", hdev->name); 1212 return; 1213 } 1214 1215 if (key->type == HCI_LK_DEBUG_COMBINATION) 1216 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1217 1218 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { 1219 /* SALT = 0x00000000000000000000000000000000746D7032 */ 1220 const u8 salt[16] = { 0x32, 0x70, 0x6d, 0x74 }; 1221 1222 if (smp_h7(smp->tfm_cmac, key->val, salt, smp->tk)) 1223 return; 1224 } else { 1225 /* From core spec. Spells out in ASCII as 'tmp2'. */ 1226 const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 }; 1227 1228 if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk)) 1229 return; 1230 } 1231 1232 if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk)) 1233 return; 1234 1235 sc_add_ltk(smp); 1236 } 1237 1238 static void smp_distribute_keys(struct smp_chan *smp) 1239 { 1240 struct smp_cmd_pairing *req, *rsp; 1241 struct l2cap_conn *conn = smp->conn; 1242 struct hci_conn *hcon = conn->hcon; 1243 struct hci_dev *hdev = hcon->hdev; 1244 __u8 *keydist; 1245 1246 BT_DBG("conn %p", conn); 1247 1248 rsp = (void *) &smp->prsp[1]; 1249 1250 /* The responder sends its keys first */ 1251 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) { 1252 smp_allow_key_dist(smp); 1253 return; 1254 } 1255 1256 req = (void *) &smp->preq[1]; 1257 1258 if (hcon->out) { 1259 keydist = &rsp->init_key_dist; 1260 *keydist &= req->init_key_dist; 1261 } else { 1262 keydist = &rsp->resp_key_dist; 1263 *keydist &= req->resp_key_dist; 1264 } 1265 1266 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1267 if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY)) 1268 sc_generate_link_key(smp); 1269 if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY)) 1270 sc_generate_ltk(smp); 1271 1272 /* Clear the keys which are generated but not distributed */ 1273 *keydist &= ~SMP_SC_NO_DIST; 1274 } 1275 1276 BT_DBG("keydist 0x%x", *keydist); 1277 1278 if (*keydist & SMP_DIST_ENC_KEY) { 1279 struct smp_cmd_encrypt_info enc; 1280 struct smp_cmd_master_ident ident; 1281 struct smp_ltk *ltk; 1282 u8 authenticated; 1283 __le16 ediv; 1284 __le64 rand; 1285 1286 /* Make sure we generate only the significant amount of 1287 * bytes based on the encryption key size, and set the rest 1288 * of the value to zeroes. 1289 */ 1290 get_random_bytes(enc.ltk, smp->enc_key_size); 1291 memset(enc.ltk + smp->enc_key_size, 0, 1292 sizeof(enc.ltk) - smp->enc_key_size); 1293 1294 get_random_bytes(&ediv, sizeof(ediv)); 1295 get_random_bytes(&rand, sizeof(rand)); 1296 1297 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc); 1298 1299 authenticated = hcon->sec_level == BT_SECURITY_HIGH; 1300 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, 1301 SMP_LTK_SLAVE, authenticated, enc.ltk, 1302 smp->enc_key_size, ediv, rand); 1303 smp->slave_ltk = ltk; 1304 1305 ident.ediv = ediv; 1306 ident.rand = rand; 1307 1308 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident); 1309 1310 *keydist &= ~SMP_DIST_ENC_KEY; 1311 } 1312 1313 if (*keydist & SMP_DIST_ID_KEY) { 1314 struct smp_cmd_ident_addr_info addrinfo; 1315 struct smp_cmd_ident_info idinfo; 1316 1317 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk)); 1318 1319 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo); 1320 1321 /* The hci_conn contains the local identity address 1322 * after the connection has been established. 1323 * 1324 * This is true even when the connection has been 1325 * established using a resolvable random address. 1326 */ 1327 bacpy(&addrinfo.bdaddr, &hcon->src); 1328 addrinfo.addr_type = hcon->src_type; 1329 1330 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo), 1331 &addrinfo); 1332 1333 *keydist &= ~SMP_DIST_ID_KEY; 1334 } 1335 1336 if (*keydist & SMP_DIST_SIGN) { 1337 struct smp_cmd_sign_info sign; 1338 struct smp_csrk *csrk; 1339 1340 /* Generate a new random key */ 1341 get_random_bytes(sign.csrk, sizeof(sign.csrk)); 1342 1343 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL); 1344 if (csrk) { 1345 if (hcon->sec_level > BT_SECURITY_MEDIUM) 1346 csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED; 1347 else 1348 csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED; 1349 memcpy(csrk->val, sign.csrk, sizeof(csrk->val)); 1350 } 1351 smp->slave_csrk = csrk; 1352 1353 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign); 1354 1355 *keydist &= ~SMP_DIST_SIGN; 1356 } 1357 1358 /* If there are still keys to be received wait for them */ 1359 if (smp->remote_key_dist & KEY_DIST_MASK) { 1360 smp_allow_key_dist(smp); 1361 return; 1362 } 1363 1364 set_bit(SMP_FLAG_COMPLETE, &smp->flags); 1365 smp_notify_keys(conn); 1366 1367 smp_chan_destroy(conn); 1368 } 1369 1370 static void smp_timeout(struct work_struct *work) 1371 { 1372 struct smp_chan *smp = container_of(work, struct smp_chan, 1373 security_timer.work); 1374 struct l2cap_conn *conn = smp->conn; 1375 1376 BT_DBG("conn %p", conn); 1377 1378 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM); 1379 } 1380 1381 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn) 1382 { 1383 struct l2cap_chan *chan = conn->smp; 1384 struct smp_chan *smp; 1385 1386 smp = kzalloc(sizeof(*smp), GFP_ATOMIC); 1387 if (!smp) 1388 return NULL; 1389 1390 smp->tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC); 1391 if (IS_ERR(smp->tfm_aes)) { 1392 BT_ERR("Unable to create AES crypto context"); 1393 kzfree(smp); 1394 return NULL; 1395 } 1396 1397 smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0); 1398 if (IS_ERR(smp->tfm_cmac)) { 1399 BT_ERR("Unable to create CMAC crypto context"); 1400 crypto_free_cipher(smp->tfm_aes); 1401 kzfree(smp); 1402 return NULL; 1403 } 1404 1405 smp->conn = conn; 1406 chan->data = smp; 1407 1408 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL); 1409 1410 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout); 1411 1412 hci_conn_hold(conn->hcon); 1413 1414 return smp; 1415 } 1416 1417 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16]) 1418 { 1419 struct hci_conn *hcon = smp->conn->hcon; 1420 u8 *na, *nb, a[7], b[7]; 1421 1422 if (hcon->out) { 1423 na = smp->prnd; 1424 nb = smp->rrnd; 1425 } else { 1426 na = smp->rrnd; 1427 nb = smp->prnd; 1428 } 1429 1430 memcpy(a, &hcon->init_addr, 6); 1431 memcpy(b, &hcon->resp_addr, 6); 1432 a[6] = hcon->init_addr_type; 1433 b[6] = hcon->resp_addr_type; 1434 1435 return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk); 1436 } 1437 1438 static void sc_dhkey_check(struct smp_chan *smp) 1439 { 1440 struct hci_conn *hcon = smp->conn->hcon; 1441 struct smp_cmd_dhkey_check check; 1442 u8 a[7], b[7], *local_addr, *remote_addr; 1443 u8 io_cap[3], r[16]; 1444 1445 memcpy(a, &hcon->init_addr, 6); 1446 memcpy(b, &hcon->resp_addr, 6); 1447 a[6] = hcon->init_addr_type; 1448 b[6] = hcon->resp_addr_type; 1449 1450 if (hcon->out) { 1451 local_addr = a; 1452 remote_addr = b; 1453 memcpy(io_cap, &smp->preq[1], 3); 1454 } else { 1455 local_addr = b; 1456 remote_addr = a; 1457 memcpy(io_cap, &smp->prsp[1], 3); 1458 } 1459 1460 memset(r, 0, sizeof(r)); 1461 1462 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 1463 put_unaligned_le32(hcon->passkey_notify, r); 1464 1465 if (smp->method == REQ_OOB) 1466 memcpy(r, smp->rr, 16); 1467 1468 smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap, 1469 local_addr, remote_addr, check.e); 1470 1471 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check); 1472 } 1473 1474 static u8 sc_passkey_send_confirm(struct smp_chan *smp) 1475 { 1476 struct l2cap_conn *conn = smp->conn; 1477 struct hci_conn *hcon = conn->hcon; 1478 struct smp_cmd_pairing_confirm cfm; 1479 u8 r; 1480 1481 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); 1482 r |= 0x80; 1483 1484 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1485 1486 if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r, 1487 cfm.confirm_val)) 1488 return SMP_UNSPECIFIED; 1489 1490 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm); 1491 1492 return 0; 1493 } 1494 1495 static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op) 1496 { 1497 struct l2cap_conn *conn = smp->conn; 1498 struct hci_conn *hcon = conn->hcon; 1499 struct hci_dev *hdev = hcon->hdev; 1500 u8 cfm[16], r; 1501 1502 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */ 1503 if (smp->passkey_round >= 20) 1504 return 0; 1505 1506 switch (smp_op) { 1507 case SMP_CMD_PAIRING_RANDOM: 1508 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); 1509 r |= 0x80; 1510 1511 if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, 1512 smp->rrnd, r, cfm)) 1513 return SMP_UNSPECIFIED; 1514 1515 if (memcmp(smp->pcnf, cfm, 16)) 1516 return SMP_CONFIRM_FAILED; 1517 1518 smp->passkey_round++; 1519 1520 if (smp->passkey_round == 20) { 1521 /* Generate MacKey and LTK */ 1522 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk)) 1523 return SMP_UNSPECIFIED; 1524 } 1525 1526 /* The round is only complete when the initiator 1527 * receives pairing random. 1528 */ 1529 if (!hcon->out) { 1530 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 1531 sizeof(smp->prnd), smp->prnd); 1532 if (smp->passkey_round == 20) 1533 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1534 else 1535 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1536 return 0; 1537 } 1538 1539 /* Start the next round */ 1540 if (smp->passkey_round != 20) 1541 return sc_passkey_round(smp, 0); 1542 1543 /* Passkey rounds are complete - start DHKey Check */ 1544 sc_dhkey_check(smp); 1545 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1546 1547 break; 1548 1549 case SMP_CMD_PAIRING_CONFIRM: 1550 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { 1551 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 1552 return 0; 1553 } 1554 1555 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 1556 1557 if (hcon->out) { 1558 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 1559 sizeof(smp->prnd), smp->prnd); 1560 return 0; 1561 } 1562 1563 return sc_passkey_send_confirm(smp); 1564 1565 case SMP_CMD_PUBLIC_KEY: 1566 default: 1567 /* Initiating device starts the round */ 1568 if (!hcon->out) 1569 return 0; 1570 1571 BT_DBG("%s Starting passkey round %u", hdev->name, 1572 smp->passkey_round + 1); 1573 1574 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1575 1576 return sc_passkey_send_confirm(smp); 1577 } 1578 1579 return 0; 1580 } 1581 1582 static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey) 1583 { 1584 struct l2cap_conn *conn = smp->conn; 1585 struct hci_conn *hcon = conn->hcon; 1586 u8 smp_op; 1587 1588 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags); 1589 1590 switch (mgmt_op) { 1591 case MGMT_OP_USER_PASSKEY_NEG_REPLY: 1592 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED); 1593 return 0; 1594 case MGMT_OP_USER_CONFIRM_NEG_REPLY: 1595 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED); 1596 return 0; 1597 case MGMT_OP_USER_PASSKEY_REPLY: 1598 hcon->passkey_notify = le32_to_cpu(passkey); 1599 smp->passkey_round = 0; 1600 1601 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) 1602 smp_op = SMP_CMD_PAIRING_CONFIRM; 1603 else 1604 smp_op = 0; 1605 1606 if (sc_passkey_round(smp, smp_op)) 1607 return -EIO; 1608 1609 return 0; 1610 } 1611 1612 /* Initiator sends DHKey check first */ 1613 if (hcon->out) { 1614 sc_dhkey_check(smp); 1615 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1616 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) { 1617 sc_dhkey_check(smp); 1618 sc_add_ltk(smp); 1619 } 1620 1621 return 0; 1622 } 1623 1624 int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey) 1625 { 1626 struct l2cap_conn *conn = hcon->l2cap_data; 1627 struct l2cap_chan *chan; 1628 struct smp_chan *smp; 1629 u32 value; 1630 int err; 1631 1632 BT_DBG(""); 1633 1634 if (!conn) 1635 return -ENOTCONN; 1636 1637 chan = conn->smp; 1638 if (!chan) 1639 return -ENOTCONN; 1640 1641 l2cap_chan_lock(chan); 1642 if (!chan->data) { 1643 err = -ENOTCONN; 1644 goto unlock; 1645 } 1646 1647 smp = chan->data; 1648 1649 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1650 err = sc_user_reply(smp, mgmt_op, passkey); 1651 goto unlock; 1652 } 1653 1654 switch (mgmt_op) { 1655 case MGMT_OP_USER_PASSKEY_REPLY: 1656 value = le32_to_cpu(passkey); 1657 memset(smp->tk, 0, sizeof(smp->tk)); 1658 BT_DBG("PassKey: %d", value); 1659 put_unaligned_le32(value, smp->tk); 1660 /* Fall Through */ 1661 case MGMT_OP_USER_CONFIRM_REPLY: 1662 set_bit(SMP_FLAG_TK_VALID, &smp->flags); 1663 break; 1664 case MGMT_OP_USER_PASSKEY_NEG_REPLY: 1665 case MGMT_OP_USER_CONFIRM_NEG_REPLY: 1666 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED); 1667 err = 0; 1668 goto unlock; 1669 default: 1670 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED); 1671 err = -EOPNOTSUPP; 1672 goto unlock; 1673 } 1674 1675 err = 0; 1676 1677 /* If it is our turn to send Pairing Confirm, do so now */ 1678 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) { 1679 u8 rsp = smp_confirm(smp); 1680 if (rsp) 1681 smp_failure(conn, rsp); 1682 } 1683 1684 unlock: 1685 l2cap_chan_unlock(chan); 1686 return err; 1687 } 1688 1689 static void build_bredr_pairing_cmd(struct smp_chan *smp, 1690 struct smp_cmd_pairing *req, 1691 struct smp_cmd_pairing *rsp) 1692 { 1693 struct l2cap_conn *conn = smp->conn; 1694 struct hci_dev *hdev = conn->hcon->hdev; 1695 u8 local_dist = 0, remote_dist = 0; 1696 1697 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) { 1698 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 1699 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 1700 } 1701 1702 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING)) 1703 remote_dist |= SMP_DIST_ID_KEY; 1704 1705 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 1706 local_dist |= SMP_DIST_ID_KEY; 1707 1708 if (!rsp) { 1709 memset(req, 0, sizeof(*req)); 1710 1711 req->auth_req = SMP_AUTH_CT2; 1712 req->init_key_dist = local_dist; 1713 req->resp_key_dist = remote_dist; 1714 req->max_key_size = conn->hcon->enc_key_size; 1715 1716 smp->remote_key_dist = remote_dist; 1717 1718 return; 1719 } 1720 1721 memset(rsp, 0, sizeof(*rsp)); 1722 1723 rsp->auth_req = SMP_AUTH_CT2; 1724 rsp->max_key_size = conn->hcon->enc_key_size; 1725 rsp->init_key_dist = req->init_key_dist & remote_dist; 1726 rsp->resp_key_dist = req->resp_key_dist & local_dist; 1727 1728 smp->remote_key_dist = rsp->init_key_dist; 1729 } 1730 1731 static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) 1732 { 1733 struct smp_cmd_pairing rsp, *req = (void *) skb->data; 1734 struct l2cap_chan *chan = conn->smp; 1735 struct hci_dev *hdev = conn->hcon->hdev; 1736 struct smp_chan *smp; 1737 u8 key_size, auth, sec_level; 1738 int ret; 1739 1740 BT_DBG("conn %p", conn); 1741 1742 if (skb->len < sizeof(*req)) 1743 return SMP_INVALID_PARAMS; 1744 1745 if (conn->hcon->role != HCI_ROLE_SLAVE) 1746 return SMP_CMD_NOTSUPP; 1747 1748 if (!chan->data) 1749 smp = smp_chan_create(conn); 1750 else 1751 smp = chan->data; 1752 1753 if (!smp) 1754 return SMP_UNSPECIFIED; 1755 1756 /* We didn't start the pairing, so match remote */ 1757 auth = req->auth_req & AUTH_REQ_MASK(hdev); 1758 1759 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) && 1760 (auth & SMP_AUTH_BONDING)) 1761 return SMP_PAIRING_NOTSUPP; 1762 1763 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 1764 return SMP_AUTH_REQUIREMENTS; 1765 1766 smp->preq[0] = SMP_CMD_PAIRING_REQ; 1767 memcpy(&smp->preq[1], req, sizeof(*req)); 1768 skb_pull(skb, sizeof(*req)); 1769 1770 /* If the remote side's OOB flag is set it means it has 1771 * successfully received our local OOB data - therefore set the 1772 * flag to indicate that local OOB is in use. 1773 */ 1774 if (req->oob_flag == SMP_OOB_PRESENT) 1775 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); 1776 1777 /* SMP over BR/EDR requires special treatment */ 1778 if (conn->hcon->type == ACL_LINK) { 1779 /* We must have a BR/EDR SC link */ 1780 if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) && 1781 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 1782 return SMP_CROSS_TRANSP_NOT_ALLOWED; 1783 1784 set_bit(SMP_FLAG_SC, &smp->flags); 1785 1786 build_bredr_pairing_cmd(smp, req, &rsp); 1787 1788 if (req->auth_req & SMP_AUTH_CT2) 1789 set_bit(SMP_FLAG_CT2, &smp->flags); 1790 1791 key_size = min(req->max_key_size, rsp.max_key_size); 1792 if (check_enc_key_size(conn, key_size)) 1793 return SMP_ENC_KEY_SIZE; 1794 1795 /* Clear bits which are generated but not distributed */ 1796 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1797 1798 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1799 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); 1800 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp); 1801 1802 smp_distribute_keys(smp); 1803 return 0; 1804 } 1805 1806 build_pairing_cmd(conn, req, &rsp, auth); 1807 1808 if (rsp.auth_req & SMP_AUTH_SC) { 1809 set_bit(SMP_FLAG_SC, &smp->flags); 1810 1811 if (rsp.auth_req & SMP_AUTH_CT2) 1812 set_bit(SMP_FLAG_CT2, &smp->flags); 1813 } 1814 1815 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 1816 sec_level = BT_SECURITY_MEDIUM; 1817 else 1818 sec_level = authreq_to_seclevel(auth); 1819 1820 if (sec_level > conn->hcon->pending_sec_level) 1821 conn->hcon->pending_sec_level = sec_level; 1822 1823 /* If we need MITM check that it can be achieved */ 1824 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { 1825 u8 method; 1826 1827 method = get_auth_method(smp, conn->hcon->io_capability, 1828 req->io_capability); 1829 if (method == JUST_WORKS || method == JUST_CFM) 1830 return SMP_AUTH_REQUIREMENTS; 1831 } 1832 1833 key_size = min(req->max_key_size, rsp.max_key_size); 1834 if (check_enc_key_size(conn, key_size)) 1835 return SMP_ENC_KEY_SIZE; 1836 1837 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1838 1839 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1840 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); 1841 1842 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp); 1843 1844 clear_bit(SMP_FLAG_INITIATOR, &smp->flags); 1845 1846 /* Strictly speaking we shouldn't allow Pairing Confirm for the 1847 * SC case, however some implementations incorrectly copy RFU auth 1848 * req bits from our security request, which may create a false 1849 * positive SC enablement. 1850 */ 1851 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1852 1853 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1854 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); 1855 /* Clear bits which are generated but not distributed */ 1856 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1857 /* Wait for Public Key from Initiating Device */ 1858 return 0; 1859 } 1860 1861 /* Request setup of TK */ 1862 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability); 1863 if (ret) 1864 return SMP_UNSPECIFIED; 1865 1866 return 0; 1867 } 1868 1869 static u8 sc_send_public_key(struct smp_chan *smp) 1870 { 1871 struct hci_dev *hdev = smp->conn->hcon->hdev; 1872 1873 BT_DBG(""); 1874 1875 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { 1876 struct l2cap_chan *chan = hdev->smp_data; 1877 struct smp_dev *smp_dev; 1878 1879 if (!chan || !chan->data) 1880 return SMP_UNSPECIFIED; 1881 1882 smp_dev = chan->data; 1883 1884 memcpy(smp->local_pk, smp_dev->local_pk, 64); 1885 memcpy(smp->local_sk, smp_dev->local_sk, 32); 1886 memcpy(smp->lr, smp_dev->local_rand, 16); 1887 1888 if (smp_dev->debug_key) 1889 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1890 1891 goto done; 1892 } 1893 1894 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 1895 BT_DBG("Using debug keys"); 1896 memcpy(smp->local_pk, debug_pk, 64); 1897 memcpy(smp->local_sk, debug_sk, 32); 1898 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1899 } else { 1900 while (true) { 1901 /* Seed private key with random number */ 1902 get_random_bytes(smp->local_sk, 32); 1903 1904 /* Generate local key pair for Secure Connections */ 1905 if (!generate_ecdh_keys(smp->local_pk, smp->local_sk)) 1906 return SMP_UNSPECIFIED; 1907 1908 /* This is unlikely, but we need to check that 1909 * we didn't accidentially generate a debug key. 1910 */ 1911 if (memcmp(smp->local_sk, debug_sk, 32)) 1912 break; 1913 } 1914 } 1915 1916 done: 1917 SMP_DBG("Local Public Key X: %32phN", smp->local_pk); 1918 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32); 1919 SMP_DBG("Local Private Key: %32phN", smp->local_sk); 1920 1921 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk); 1922 1923 return 0; 1924 } 1925 1926 static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb) 1927 { 1928 struct smp_cmd_pairing *req, *rsp = (void *) skb->data; 1929 struct l2cap_chan *chan = conn->smp; 1930 struct smp_chan *smp = chan->data; 1931 struct hci_dev *hdev = conn->hcon->hdev; 1932 u8 key_size, auth; 1933 int ret; 1934 1935 BT_DBG("conn %p", conn); 1936 1937 if (skb->len < sizeof(*rsp)) 1938 return SMP_INVALID_PARAMS; 1939 1940 if (conn->hcon->role != HCI_ROLE_MASTER) 1941 return SMP_CMD_NOTSUPP; 1942 1943 skb_pull(skb, sizeof(*rsp)); 1944 1945 req = (void *) &smp->preq[1]; 1946 1947 key_size = min(req->max_key_size, rsp->max_key_size); 1948 if (check_enc_key_size(conn, key_size)) 1949 return SMP_ENC_KEY_SIZE; 1950 1951 auth = rsp->auth_req & AUTH_REQ_MASK(hdev); 1952 1953 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 1954 return SMP_AUTH_REQUIREMENTS; 1955 1956 /* If the remote side's OOB flag is set it means it has 1957 * successfully received our local OOB data - therefore set the 1958 * flag to indicate that local OOB is in use. 1959 */ 1960 if (rsp->oob_flag == SMP_OOB_PRESENT) 1961 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); 1962 1963 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1964 memcpy(&smp->prsp[1], rsp, sizeof(*rsp)); 1965 1966 /* Update remote key distribution in case the remote cleared 1967 * some bits that we had enabled in our request. 1968 */ 1969 smp->remote_key_dist &= rsp->resp_key_dist; 1970 1971 if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2)) 1972 set_bit(SMP_FLAG_CT2, &smp->flags); 1973 1974 /* For BR/EDR this means we're done and can start phase 3 */ 1975 if (conn->hcon->type == ACL_LINK) { 1976 /* Clear bits which are generated but not distributed */ 1977 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1978 smp_distribute_keys(smp); 1979 return 0; 1980 } 1981 1982 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC)) 1983 set_bit(SMP_FLAG_SC, &smp->flags); 1984 else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH) 1985 conn->hcon->pending_sec_level = BT_SECURITY_HIGH; 1986 1987 /* If we need MITM check that it can be achieved */ 1988 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { 1989 u8 method; 1990 1991 method = get_auth_method(smp, req->io_capability, 1992 rsp->io_capability); 1993 if (method == JUST_WORKS || method == JUST_CFM) 1994 return SMP_AUTH_REQUIREMENTS; 1995 } 1996 1997 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1998 1999 /* Update remote key distribution in case the remote cleared 2000 * some bits that we had enabled in our request. 2001 */ 2002 smp->remote_key_dist &= rsp->resp_key_dist; 2003 2004 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 2005 /* Clear bits which are generated but not distributed */ 2006 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 2007 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); 2008 return sc_send_public_key(smp); 2009 } 2010 2011 auth |= req->auth_req; 2012 2013 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability); 2014 if (ret) 2015 return SMP_UNSPECIFIED; 2016 2017 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 2018 2019 /* Can't compose response until we have been confirmed */ 2020 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) 2021 return smp_confirm(smp); 2022 2023 return 0; 2024 } 2025 2026 static u8 sc_check_confirm(struct smp_chan *smp) 2027 { 2028 struct l2cap_conn *conn = smp->conn; 2029 2030 BT_DBG(""); 2031 2032 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2033 return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM); 2034 2035 if (conn->hcon->out) { 2036 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2037 smp->prnd); 2038 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2039 } 2040 2041 return 0; 2042 } 2043 2044 /* Work-around for some implementations that incorrectly copy RFU bits 2045 * from our security request and thereby create the impression that 2046 * we're doing SC when in fact the remote doesn't support it. 2047 */ 2048 static int fixup_sc_false_positive(struct smp_chan *smp) 2049 { 2050 struct l2cap_conn *conn = smp->conn; 2051 struct hci_conn *hcon = conn->hcon; 2052 struct hci_dev *hdev = hcon->hdev; 2053 struct smp_cmd_pairing *req, *rsp; 2054 u8 auth; 2055 2056 /* The issue is only observed when we're in slave role */ 2057 if (hcon->out) 2058 return SMP_UNSPECIFIED; 2059 2060 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 2061 BT_ERR("Refusing SMP SC -> legacy fallback in SC-only mode"); 2062 return SMP_UNSPECIFIED; 2063 } 2064 2065 BT_ERR("Trying to fall back to legacy SMP"); 2066 2067 req = (void *) &smp->preq[1]; 2068 rsp = (void *) &smp->prsp[1]; 2069 2070 /* Rebuild key dist flags which may have been cleared for SC */ 2071 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist); 2072 2073 auth = req->auth_req & AUTH_REQ_MASK(hdev); 2074 2075 if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) { 2076 BT_ERR("Failed to fall back to legacy SMP"); 2077 return SMP_UNSPECIFIED; 2078 } 2079 2080 clear_bit(SMP_FLAG_SC, &smp->flags); 2081 2082 return 0; 2083 } 2084 2085 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb) 2086 { 2087 struct l2cap_chan *chan = conn->smp; 2088 struct smp_chan *smp = chan->data; 2089 2090 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave"); 2091 2092 if (skb->len < sizeof(smp->pcnf)) 2093 return SMP_INVALID_PARAMS; 2094 2095 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf)); 2096 skb_pull(skb, sizeof(smp->pcnf)); 2097 2098 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 2099 int ret; 2100 2101 /* Public Key exchange must happen before any other steps */ 2102 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags)) 2103 return sc_check_confirm(smp); 2104 2105 BT_ERR("Unexpected SMP Pairing Confirm"); 2106 2107 ret = fixup_sc_false_positive(smp); 2108 if (ret) 2109 return ret; 2110 } 2111 2112 if (conn->hcon->out) { 2113 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2114 smp->prnd); 2115 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2116 return 0; 2117 } 2118 2119 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) 2120 return smp_confirm(smp); 2121 2122 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 2123 2124 return 0; 2125 } 2126 2127 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb) 2128 { 2129 struct l2cap_chan *chan = conn->smp; 2130 struct smp_chan *smp = chan->data; 2131 struct hci_conn *hcon = conn->hcon; 2132 u8 *pkax, *pkbx, *na, *nb; 2133 u32 passkey; 2134 int err; 2135 2136 BT_DBG("conn %p", conn); 2137 2138 if (skb->len < sizeof(smp->rrnd)) 2139 return SMP_INVALID_PARAMS; 2140 2141 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd)); 2142 skb_pull(skb, sizeof(smp->rrnd)); 2143 2144 if (!test_bit(SMP_FLAG_SC, &smp->flags)) 2145 return smp_random(smp); 2146 2147 if (hcon->out) { 2148 pkax = smp->local_pk; 2149 pkbx = smp->remote_pk; 2150 na = smp->prnd; 2151 nb = smp->rrnd; 2152 } else { 2153 pkax = smp->remote_pk; 2154 pkbx = smp->local_pk; 2155 na = smp->rrnd; 2156 nb = smp->prnd; 2157 } 2158 2159 if (smp->method == REQ_OOB) { 2160 if (!hcon->out) 2161 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 2162 sizeof(smp->prnd), smp->prnd); 2163 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2164 goto mackey_and_ltk; 2165 } 2166 2167 /* Passkey entry has special treatment */ 2168 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2169 return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM); 2170 2171 if (hcon->out) { 2172 u8 cfm[16]; 2173 2174 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, 2175 smp->rrnd, 0, cfm); 2176 if (err) 2177 return SMP_UNSPECIFIED; 2178 2179 if (memcmp(smp->pcnf, cfm, 16)) 2180 return SMP_CONFIRM_FAILED; 2181 } else { 2182 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2183 smp->prnd); 2184 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2185 } 2186 2187 mackey_and_ltk: 2188 /* Generate MacKey and LTK */ 2189 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk); 2190 if (err) 2191 return SMP_UNSPECIFIED; 2192 2193 if (smp->method == JUST_WORKS || smp->method == REQ_OOB) { 2194 if (hcon->out) { 2195 sc_dhkey_check(smp); 2196 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2197 } 2198 return 0; 2199 } 2200 2201 err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey); 2202 if (err) 2203 return SMP_UNSPECIFIED; 2204 2205 err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type, 2206 hcon->dst_type, passkey, 0); 2207 if (err) 2208 return SMP_UNSPECIFIED; 2209 2210 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 2211 2212 return 0; 2213 } 2214 2215 static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level) 2216 { 2217 struct smp_ltk *key; 2218 struct hci_conn *hcon = conn->hcon; 2219 2220 key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role); 2221 if (!key) 2222 return false; 2223 2224 if (smp_ltk_sec_level(key) < sec_level) 2225 return false; 2226 2227 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) 2228 return true; 2229 2230 hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size); 2231 hcon->enc_key_size = key->enc_size; 2232 2233 /* We never store STKs for master role, so clear this flag */ 2234 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); 2235 2236 return true; 2237 } 2238 2239 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level, 2240 enum smp_key_pref key_pref) 2241 { 2242 if (sec_level == BT_SECURITY_LOW) 2243 return true; 2244 2245 /* If we're encrypted with an STK but the caller prefers using 2246 * LTK claim insufficient security. This way we allow the 2247 * connection to be re-encrypted with an LTK, even if the LTK 2248 * provides the same level of security. Only exception is if we 2249 * don't have an LTK (e.g. because of key distribution bits). 2250 */ 2251 if (key_pref == SMP_USE_LTK && 2252 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) && 2253 hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role)) 2254 return false; 2255 2256 if (hcon->sec_level >= sec_level) 2257 return true; 2258 2259 return false; 2260 } 2261 2262 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb) 2263 { 2264 struct smp_cmd_security_req *rp = (void *) skb->data; 2265 struct smp_cmd_pairing cp; 2266 struct hci_conn *hcon = conn->hcon; 2267 struct hci_dev *hdev = hcon->hdev; 2268 struct smp_chan *smp; 2269 u8 sec_level, auth; 2270 2271 BT_DBG("conn %p", conn); 2272 2273 if (skb->len < sizeof(*rp)) 2274 return SMP_INVALID_PARAMS; 2275 2276 if (hcon->role != HCI_ROLE_MASTER) 2277 return SMP_CMD_NOTSUPP; 2278 2279 auth = rp->auth_req & AUTH_REQ_MASK(hdev); 2280 2281 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 2282 return SMP_AUTH_REQUIREMENTS; 2283 2284 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 2285 sec_level = BT_SECURITY_MEDIUM; 2286 else 2287 sec_level = authreq_to_seclevel(auth); 2288 2289 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) 2290 return 0; 2291 2292 if (sec_level > hcon->pending_sec_level) 2293 hcon->pending_sec_level = sec_level; 2294 2295 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) 2296 return 0; 2297 2298 smp = smp_chan_create(conn); 2299 if (!smp) 2300 return SMP_UNSPECIFIED; 2301 2302 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) && 2303 (auth & SMP_AUTH_BONDING)) 2304 return SMP_PAIRING_NOTSUPP; 2305 2306 skb_pull(skb, sizeof(*rp)); 2307 2308 memset(&cp, 0, sizeof(cp)); 2309 build_pairing_cmd(conn, &cp, NULL, auth); 2310 2311 smp->preq[0] = SMP_CMD_PAIRING_REQ; 2312 memcpy(&smp->preq[1], &cp, sizeof(cp)); 2313 2314 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp); 2315 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); 2316 2317 return 0; 2318 } 2319 2320 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level) 2321 { 2322 struct l2cap_conn *conn = hcon->l2cap_data; 2323 struct l2cap_chan *chan; 2324 struct smp_chan *smp; 2325 __u8 authreq; 2326 int ret; 2327 2328 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level); 2329 2330 /* This may be NULL if there's an unexpected disconnection */ 2331 if (!conn) 2332 return 1; 2333 2334 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) 2335 return 1; 2336 2337 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) 2338 return 1; 2339 2340 if (sec_level > hcon->pending_sec_level) 2341 hcon->pending_sec_level = sec_level; 2342 2343 if (hcon->role == HCI_ROLE_MASTER) 2344 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) 2345 return 0; 2346 2347 chan = conn->smp; 2348 if (!chan) { 2349 BT_ERR("SMP security requested but not available"); 2350 return 1; 2351 } 2352 2353 l2cap_chan_lock(chan); 2354 2355 /* If SMP is already in progress ignore this request */ 2356 if (chan->data) { 2357 ret = 0; 2358 goto unlock; 2359 } 2360 2361 smp = smp_chan_create(conn); 2362 if (!smp) { 2363 ret = 1; 2364 goto unlock; 2365 } 2366 2367 authreq = seclevel_to_authreq(sec_level); 2368 2369 if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) { 2370 authreq |= SMP_AUTH_SC; 2371 if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED)) 2372 authreq |= SMP_AUTH_CT2; 2373 } 2374 2375 /* Require MITM if IO Capability allows or the security level 2376 * requires it. 2377 */ 2378 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT || 2379 hcon->pending_sec_level > BT_SECURITY_MEDIUM) 2380 authreq |= SMP_AUTH_MITM; 2381 2382 if (hcon->role == HCI_ROLE_MASTER) { 2383 struct smp_cmd_pairing cp; 2384 2385 build_pairing_cmd(conn, &cp, NULL, authreq); 2386 smp->preq[0] = SMP_CMD_PAIRING_REQ; 2387 memcpy(&smp->preq[1], &cp, sizeof(cp)); 2388 2389 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp); 2390 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); 2391 } else { 2392 struct smp_cmd_security_req cp; 2393 cp.auth_req = authreq; 2394 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp); 2395 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ); 2396 } 2397 2398 set_bit(SMP_FLAG_INITIATOR, &smp->flags); 2399 ret = 0; 2400 2401 unlock: 2402 l2cap_chan_unlock(chan); 2403 return ret; 2404 } 2405 2406 void smp_cancel_pairing(struct hci_conn *hcon) 2407 { 2408 struct l2cap_conn *conn = hcon->l2cap_data; 2409 struct l2cap_chan *chan; 2410 struct smp_chan *smp; 2411 2412 if (!conn) 2413 return; 2414 2415 chan = conn->smp; 2416 if (!chan) 2417 return; 2418 2419 l2cap_chan_lock(chan); 2420 2421 smp = chan->data; 2422 if (smp) { 2423 if (test_bit(SMP_FLAG_COMPLETE, &smp->flags)) 2424 smp_failure(conn, 0); 2425 else 2426 smp_failure(conn, SMP_UNSPECIFIED); 2427 } 2428 2429 l2cap_chan_unlock(chan); 2430 } 2431 2432 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb) 2433 { 2434 struct smp_cmd_encrypt_info *rp = (void *) skb->data; 2435 struct l2cap_chan *chan = conn->smp; 2436 struct smp_chan *smp = chan->data; 2437 2438 BT_DBG("conn %p", conn); 2439 2440 if (skb->len < sizeof(*rp)) 2441 return SMP_INVALID_PARAMS; 2442 2443 SMP_ALLOW_CMD(smp, SMP_CMD_MASTER_IDENT); 2444 2445 skb_pull(skb, sizeof(*rp)); 2446 2447 memcpy(smp->tk, rp->ltk, sizeof(smp->tk)); 2448 2449 return 0; 2450 } 2451 2452 static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb) 2453 { 2454 struct smp_cmd_master_ident *rp = (void *) skb->data; 2455 struct l2cap_chan *chan = conn->smp; 2456 struct smp_chan *smp = chan->data; 2457 struct hci_dev *hdev = conn->hcon->hdev; 2458 struct hci_conn *hcon = conn->hcon; 2459 struct smp_ltk *ltk; 2460 u8 authenticated; 2461 2462 BT_DBG("conn %p", conn); 2463 2464 if (skb->len < sizeof(*rp)) 2465 return SMP_INVALID_PARAMS; 2466 2467 /* Mark the information as received */ 2468 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY; 2469 2470 if (smp->remote_key_dist & SMP_DIST_ID_KEY) 2471 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); 2472 else if (smp->remote_key_dist & SMP_DIST_SIGN) 2473 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 2474 2475 skb_pull(skb, sizeof(*rp)); 2476 2477 authenticated = (hcon->sec_level == BT_SECURITY_HIGH); 2478 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK, 2479 authenticated, smp->tk, smp->enc_key_size, 2480 rp->ediv, rp->rand); 2481 smp->ltk = ltk; 2482 if (!(smp->remote_key_dist & KEY_DIST_MASK)) 2483 smp_distribute_keys(smp); 2484 2485 return 0; 2486 } 2487 2488 static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb) 2489 { 2490 struct smp_cmd_ident_info *info = (void *) skb->data; 2491 struct l2cap_chan *chan = conn->smp; 2492 struct smp_chan *smp = chan->data; 2493 2494 BT_DBG(""); 2495 2496 if (skb->len < sizeof(*info)) 2497 return SMP_INVALID_PARAMS; 2498 2499 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO); 2500 2501 skb_pull(skb, sizeof(*info)); 2502 2503 memcpy(smp->irk, info->irk, 16); 2504 2505 return 0; 2506 } 2507 2508 static int smp_cmd_ident_addr_info(struct l2cap_conn *conn, 2509 struct sk_buff *skb) 2510 { 2511 struct smp_cmd_ident_addr_info *info = (void *) skb->data; 2512 struct l2cap_chan *chan = conn->smp; 2513 struct smp_chan *smp = chan->data; 2514 struct hci_conn *hcon = conn->hcon; 2515 bdaddr_t rpa; 2516 2517 BT_DBG(""); 2518 2519 if (skb->len < sizeof(*info)) 2520 return SMP_INVALID_PARAMS; 2521 2522 /* Mark the information as received */ 2523 smp->remote_key_dist &= ~SMP_DIST_ID_KEY; 2524 2525 if (smp->remote_key_dist & SMP_DIST_SIGN) 2526 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 2527 2528 skb_pull(skb, sizeof(*info)); 2529 2530 /* Strictly speaking the Core Specification (4.1) allows sending 2531 * an empty address which would force us to rely on just the IRK 2532 * as "identity information". However, since such 2533 * implementations are not known of and in order to not over 2534 * complicate our implementation, simply pretend that we never 2535 * received an IRK for such a device. 2536 * 2537 * The Identity Address must also be a Static Random or Public 2538 * Address, which hci_is_identity_address() checks for. 2539 */ 2540 if (!bacmp(&info->bdaddr, BDADDR_ANY) || 2541 !hci_is_identity_address(&info->bdaddr, info->addr_type)) { 2542 BT_ERR("Ignoring IRK with no identity address"); 2543 goto distribute; 2544 } 2545 2546 bacpy(&smp->id_addr, &info->bdaddr); 2547 smp->id_addr_type = info->addr_type; 2548 2549 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type)) 2550 bacpy(&rpa, &hcon->dst); 2551 else 2552 bacpy(&rpa, BDADDR_ANY); 2553 2554 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr, 2555 smp->id_addr_type, smp->irk, &rpa); 2556 2557 distribute: 2558 if (!(smp->remote_key_dist & KEY_DIST_MASK)) 2559 smp_distribute_keys(smp); 2560 2561 return 0; 2562 } 2563 2564 static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb) 2565 { 2566 struct smp_cmd_sign_info *rp = (void *) skb->data; 2567 struct l2cap_chan *chan = conn->smp; 2568 struct smp_chan *smp = chan->data; 2569 struct smp_csrk *csrk; 2570 2571 BT_DBG("conn %p", conn); 2572 2573 if (skb->len < sizeof(*rp)) 2574 return SMP_INVALID_PARAMS; 2575 2576 /* Mark the information as received */ 2577 smp->remote_key_dist &= ~SMP_DIST_SIGN; 2578 2579 skb_pull(skb, sizeof(*rp)); 2580 2581 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL); 2582 if (csrk) { 2583 if (conn->hcon->sec_level > BT_SECURITY_MEDIUM) 2584 csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED; 2585 else 2586 csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED; 2587 memcpy(csrk->val, rp->csrk, sizeof(csrk->val)); 2588 } 2589 smp->csrk = csrk; 2590 smp_distribute_keys(smp); 2591 2592 return 0; 2593 } 2594 2595 static u8 sc_select_method(struct smp_chan *smp) 2596 { 2597 struct l2cap_conn *conn = smp->conn; 2598 struct hci_conn *hcon = conn->hcon; 2599 struct smp_cmd_pairing *local, *remote; 2600 u8 local_mitm, remote_mitm, local_io, remote_io, method; 2601 2602 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) || 2603 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) 2604 return REQ_OOB; 2605 2606 /* The preq/prsp contain the raw Pairing Request/Response PDUs 2607 * which are needed as inputs to some crypto functions. To get 2608 * the "struct smp_cmd_pairing" from them we need to skip the 2609 * first byte which contains the opcode. 2610 */ 2611 if (hcon->out) { 2612 local = (void *) &smp->preq[1]; 2613 remote = (void *) &smp->prsp[1]; 2614 } else { 2615 local = (void *) &smp->prsp[1]; 2616 remote = (void *) &smp->preq[1]; 2617 } 2618 2619 local_io = local->io_capability; 2620 remote_io = remote->io_capability; 2621 2622 local_mitm = (local->auth_req & SMP_AUTH_MITM); 2623 remote_mitm = (remote->auth_req & SMP_AUTH_MITM); 2624 2625 /* If either side wants MITM, look up the method from the table, 2626 * otherwise use JUST WORKS. 2627 */ 2628 if (local_mitm || remote_mitm) 2629 method = get_auth_method(smp, local_io, remote_io); 2630 else 2631 method = JUST_WORKS; 2632 2633 /* Don't confirm locally initiated pairing attempts */ 2634 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2635 method = JUST_WORKS; 2636 2637 return method; 2638 } 2639 2640 static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) 2641 { 2642 struct smp_cmd_public_key *key = (void *) skb->data; 2643 struct hci_conn *hcon = conn->hcon; 2644 struct l2cap_chan *chan = conn->smp; 2645 struct smp_chan *smp = chan->data; 2646 struct hci_dev *hdev = hcon->hdev; 2647 struct smp_cmd_pairing_confirm cfm; 2648 int err; 2649 2650 BT_DBG("conn %p", conn); 2651 2652 if (skb->len < sizeof(*key)) 2653 return SMP_INVALID_PARAMS; 2654 2655 memcpy(smp->remote_pk, key, 64); 2656 2657 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { 2658 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk, 2659 smp->rr, 0, cfm.confirm_val); 2660 if (err) 2661 return SMP_UNSPECIFIED; 2662 2663 if (memcmp(cfm.confirm_val, smp->pcnf, 16)) 2664 return SMP_CONFIRM_FAILED; 2665 } 2666 2667 /* Non-initiating device sends its public key after receiving 2668 * the key from the initiating device. 2669 */ 2670 if (!hcon->out) { 2671 err = sc_send_public_key(smp); 2672 if (err) 2673 return err; 2674 } 2675 2676 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk); 2677 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32); 2678 2679 if (!compute_ecdh_secret(smp->remote_pk, smp->local_sk, smp->dhkey)) 2680 return SMP_UNSPECIFIED; 2681 2682 SMP_DBG("DHKey %32phN", smp->dhkey); 2683 2684 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags); 2685 2686 smp->method = sc_select_method(smp); 2687 2688 BT_DBG("%s selected method 0x%02x", hdev->name, smp->method); 2689 2690 /* JUST_WORKS and JUST_CFM result in an unauthenticated key */ 2691 if (smp->method == JUST_WORKS || smp->method == JUST_CFM) 2692 hcon->pending_sec_level = BT_SECURITY_MEDIUM; 2693 else 2694 hcon->pending_sec_level = BT_SECURITY_FIPS; 2695 2696 if (!memcmp(debug_pk, smp->remote_pk, 64)) 2697 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 2698 2699 if (smp->method == DSP_PASSKEY) { 2700 get_random_bytes(&hcon->passkey_notify, 2701 sizeof(hcon->passkey_notify)); 2702 hcon->passkey_notify %= 1000000; 2703 hcon->passkey_entered = 0; 2704 smp->passkey_round = 0; 2705 if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type, 2706 hcon->dst_type, 2707 hcon->passkey_notify, 2708 hcon->passkey_entered)) 2709 return SMP_UNSPECIFIED; 2710 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2711 return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY); 2712 } 2713 2714 if (smp->method == REQ_OOB) { 2715 if (hcon->out) 2716 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 2717 sizeof(smp->prnd), smp->prnd); 2718 2719 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2720 2721 return 0; 2722 } 2723 2724 if (hcon->out) 2725 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2726 2727 if (smp->method == REQ_PASSKEY) { 2728 if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type, 2729 hcon->dst_type)) 2730 return SMP_UNSPECIFIED; 2731 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2732 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 2733 return 0; 2734 } 2735 2736 /* The Initiating device waits for the non-initiating device to 2737 * send the confirm value. 2738 */ 2739 if (conn->hcon->out) 2740 return 0; 2741 2742 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, 2743 0, cfm.confirm_val); 2744 if (err) 2745 return SMP_UNSPECIFIED; 2746 2747 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm); 2748 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2749 2750 return 0; 2751 } 2752 2753 static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb) 2754 { 2755 struct smp_cmd_dhkey_check *check = (void *) skb->data; 2756 struct l2cap_chan *chan = conn->smp; 2757 struct hci_conn *hcon = conn->hcon; 2758 struct smp_chan *smp = chan->data; 2759 u8 a[7], b[7], *local_addr, *remote_addr; 2760 u8 io_cap[3], r[16], e[16]; 2761 int err; 2762 2763 BT_DBG("conn %p", conn); 2764 2765 if (skb->len < sizeof(*check)) 2766 return SMP_INVALID_PARAMS; 2767 2768 memcpy(a, &hcon->init_addr, 6); 2769 memcpy(b, &hcon->resp_addr, 6); 2770 a[6] = hcon->init_addr_type; 2771 b[6] = hcon->resp_addr_type; 2772 2773 if (hcon->out) { 2774 local_addr = a; 2775 remote_addr = b; 2776 memcpy(io_cap, &smp->prsp[1], 3); 2777 } else { 2778 local_addr = b; 2779 remote_addr = a; 2780 memcpy(io_cap, &smp->preq[1], 3); 2781 } 2782 2783 memset(r, 0, sizeof(r)); 2784 2785 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2786 put_unaligned_le32(hcon->passkey_notify, r); 2787 else if (smp->method == REQ_OOB) 2788 memcpy(r, smp->lr, 16); 2789 2790 err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r, 2791 io_cap, remote_addr, local_addr, e); 2792 if (err) 2793 return SMP_UNSPECIFIED; 2794 2795 if (memcmp(check->e, e, 16)) 2796 return SMP_DHKEY_CHECK_FAILED; 2797 2798 if (!hcon->out) { 2799 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { 2800 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags); 2801 return 0; 2802 } 2803 2804 /* Slave sends DHKey check as response to master */ 2805 sc_dhkey_check(smp); 2806 } 2807 2808 sc_add_ltk(smp); 2809 2810 if (hcon->out) { 2811 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size); 2812 hcon->enc_key_size = smp->enc_key_size; 2813 } 2814 2815 return 0; 2816 } 2817 2818 static int smp_cmd_keypress_notify(struct l2cap_conn *conn, 2819 struct sk_buff *skb) 2820 { 2821 struct smp_cmd_keypress_notify *kp = (void *) skb->data; 2822 2823 BT_DBG("value 0x%02x", kp->value); 2824 2825 return 0; 2826 } 2827 2828 static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) 2829 { 2830 struct l2cap_conn *conn = chan->conn; 2831 struct hci_conn *hcon = conn->hcon; 2832 struct smp_chan *smp; 2833 __u8 code, reason; 2834 int err = 0; 2835 2836 if (skb->len < 1) 2837 return -EILSEQ; 2838 2839 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) { 2840 reason = SMP_PAIRING_NOTSUPP; 2841 goto done; 2842 } 2843 2844 code = skb->data[0]; 2845 skb_pull(skb, sizeof(code)); 2846 2847 smp = chan->data; 2848 2849 if (code > SMP_CMD_MAX) 2850 goto drop; 2851 2852 if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) 2853 goto drop; 2854 2855 /* If we don't have a context the only allowed commands are 2856 * pairing request and security request. 2857 */ 2858 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ) 2859 goto drop; 2860 2861 switch (code) { 2862 case SMP_CMD_PAIRING_REQ: 2863 reason = smp_cmd_pairing_req(conn, skb); 2864 break; 2865 2866 case SMP_CMD_PAIRING_FAIL: 2867 smp_failure(conn, 0); 2868 err = -EPERM; 2869 break; 2870 2871 case SMP_CMD_PAIRING_RSP: 2872 reason = smp_cmd_pairing_rsp(conn, skb); 2873 break; 2874 2875 case SMP_CMD_SECURITY_REQ: 2876 reason = smp_cmd_security_req(conn, skb); 2877 break; 2878 2879 case SMP_CMD_PAIRING_CONFIRM: 2880 reason = smp_cmd_pairing_confirm(conn, skb); 2881 break; 2882 2883 case SMP_CMD_PAIRING_RANDOM: 2884 reason = smp_cmd_pairing_random(conn, skb); 2885 break; 2886 2887 case SMP_CMD_ENCRYPT_INFO: 2888 reason = smp_cmd_encrypt_info(conn, skb); 2889 break; 2890 2891 case SMP_CMD_MASTER_IDENT: 2892 reason = smp_cmd_master_ident(conn, skb); 2893 break; 2894 2895 case SMP_CMD_IDENT_INFO: 2896 reason = smp_cmd_ident_info(conn, skb); 2897 break; 2898 2899 case SMP_CMD_IDENT_ADDR_INFO: 2900 reason = smp_cmd_ident_addr_info(conn, skb); 2901 break; 2902 2903 case SMP_CMD_SIGN_INFO: 2904 reason = smp_cmd_sign_info(conn, skb); 2905 break; 2906 2907 case SMP_CMD_PUBLIC_KEY: 2908 reason = smp_cmd_public_key(conn, skb); 2909 break; 2910 2911 case SMP_CMD_DHKEY_CHECK: 2912 reason = smp_cmd_dhkey_check(conn, skb); 2913 break; 2914 2915 case SMP_CMD_KEYPRESS_NOTIFY: 2916 reason = smp_cmd_keypress_notify(conn, skb); 2917 break; 2918 2919 default: 2920 BT_DBG("Unknown command code 0x%2.2x", code); 2921 reason = SMP_CMD_NOTSUPP; 2922 goto done; 2923 } 2924 2925 done: 2926 if (!err) { 2927 if (reason) 2928 smp_failure(conn, reason); 2929 kfree_skb(skb); 2930 } 2931 2932 return err; 2933 2934 drop: 2935 BT_ERR("%s unexpected SMP command 0x%02x from %pMR", hcon->hdev->name, 2936 code, &hcon->dst); 2937 kfree_skb(skb); 2938 return 0; 2939 } 2940 2941 static void smp_teardown_cb(struct l2cap_chan *chan, int err) 2942 { 2943 struct l2cap_conn *conn = chan->conn; 2944 2945 BT_DBG("chan %p", chan); 2946 2947 if (chan->data) 2948 smp_chan_destroy(conn); 2949 2950 conn->smp = NULL; 2951 l2cap_chan_put(chan); 2952 } 2953 2954 static void bredr_pairing(struct l2cap_chan *chan) 2955 { 2956 struct l2cap_conn *conn = chan->conn; 2957 struct hci_conn *hcon = conn->hcon; 2958 struct hci_dev *hdev = hcon->hdev; 2959 struct smp_cmd_pairing req; 2960 struct smp_chan *smp; 2961 2962 BT_DBG("chan %p", chan); 2963 2964 /* Only new pairings are interesting */ 2965 if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags)) 2966 return; 2967 2968 /* Don't bother if we're not encrypted */ 2969 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 2970 return; 2971 2972 /* Only master may initiate SMP over BR/EDR */ 2973 if (hcon->role != HCI_ROLE_MASTER) 2974 return; 2975 2976 /* Secure Connections support must be enabled */ 2977 if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 2978 return; 2979 2980 /* BR/EDR must use Secure Connections for SMP */ 2981 if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) && 2982 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 2983 return; 2984 2985 /* If our LE support is not enabled don't do anything */ 2986 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2987 return; 2988 2989 /* Don't bother if remote LE support is not enabled */ 2990 if (!lmp_host_le_capable(hcon)) 2991 return; 2992 2993 /* Remote must support SMP fixed chan for BR/EDR */ 2994 if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR)) 2995 return; 2996 2997 /* Don't bother if SMP is already ongoing */ 2998 if (chan->data) 2999 return; 3000 3001 smp = smp_chan_create(conn); 3002 if (!smp) { 3003 BT_ERR("%s unable to create SMP context for BR/EDR", 3004 hdev->name); 3005 return; 3006 } 3007 3008 set_bit(SMP_FLAG_SC, &smp->flags); 3009 3010 BT_DBG("%s starting SMP over BR/EDR", hdev->name); 3011 3012 /* Prepare and send the BR/EDR SMP Pairing Request */ 3013 build_bredr_pairing_cmd(smp, &req, NULL); 3014 3015 smp->preq[0] = SMP_CMD_PAIRING_REQ; 3016 memcpy(&smp->preq[1], &req, sizeof(req)); 3017 3018 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(req), &req); 3019 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); 3020 } 3021 3022 static void smp_resume_cb(struct l2cap_chan *chan) 3023 { 3024 struct smp_chan *smp = chan->data; 3025 struct l2cap_conn *conn = chan->conn; 3026 struct hci_conn *hcon = conn->hcon; 3027 3028 BT_DBG("chan %p", chan); 3029 3030 if (hcon->type == ACL_LINK) { 3031 bredr_pairing(chan); 3032 return; 3033 } 3034 3035 if (!smp) 3036 return; 3037 3038 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3039 return; 3040 3041 cancel_delayed_work(&smp->security_timer); 3042 3043 smp_distribute_keys(smp); 3044 } 3045 3046 static void smp_ready_cb(struct l2cap_chan *chan) 3047 { 3048 struct l2cap_conn *conn = chan->conn; 3049 struct hci_conn *hcon = conn->hcon; 3050 3051 BT_DBG("chan %p", chan); 3052 3053 /* No need to call l2cap_chan_hold() here since we already own 3054 * the reference taken in smp_new_conn_cb(). This is just the 3055 * first time that we tie it to a specific pointer. The code in 3056 * l2cap_core.c ensures that there's no risk this function wont 3057 * get called if smp_new_conn_cb was previously called. 3058 */ 3059 conn->smp = chan; 3060 3061 if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3062 bredr_pairing(chan); 3063 } 3064 3065 static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 3066 { 3067 int err; 3068 3069 BT_DBG("chan %p", chan); 3070 3071 err = smp_sig_channel(chan, skb); 3072 if (err) { 3073 struct smp_chan *smp = chan->data; 3074 3075 if (smp) 3076 cancel_delayed_work_sync(&smp->security_timer); 3077 3078 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE); 3079 } 3080 3081 return err; 3082 } 3083 3084 static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan, 3085 unsigned long hdr_len, 3086 unsigned long len, int nb) 3087 { 3088 struct sk_buff *skb; 3089 3090 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL); 3091 if (!skb) 3092 return ERR_PTR(-ENOMEM); 3093 3094 skb->priority = HCI_PRIO_MAX; 3095 bt_cb(skb)->l2cap.chan = chan; 3096 3097 return skb; 3098 } 3099 3100 static const struct l2cap_ops smp_chan_ops = { 3101 .name = "Security Manager", 3102 .ready = smp_ready_cb, 3103 .recv = smp_recv_cb, 3104 .alloc_skb = smp_alloc_skb_cb, 3105 .teardown = smp_teardown_cb, 3106 .resume = smp_resume_cb, 3107 3108 .new_connection = l2cap_chan_no_new_connection, 3109 .state_change = l2cap_chan_no_state_change, 3110 .close = l2cap_chan_no_close, 3111 .defer = l2cap_chan_no_defer, 3112 .suspend = l2cap_chan_no_suspend, 3113 .set_shutdown = l2cap_chan_no_set_shutdown, 3114 .get_sndtimeo = l2cap_chan_no_get_sndtimeo, 3115 }; 3116 3117 static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan) 3118 { 3119 struct l2cap_chan *chan; 3120 3121 BT_DBG("pchan %p", pchan); 3122 3123 chan = l2cap_chan_create(); 3124 if (!chan) 3125 return NULL; 3126 3127 chan->chan_type = pchan->chan_type; 3128 chan->ops = &smp_chan_ops; 3129 chan->scid = pchan->scid; 3130 chan->dcid = chan->scid; 3131 chan->imtu = pchan->imtu; 3132 chan->omtu = pchan->omtu; 3133 chan->mode = pchan->mode; 3134 3135 /* Other L2CAP channels may request SMP routines in order to 3136 * change the security level. This means that the SMP channel 3137 * lock must be considered in its own category to avoid lockdep 3138 * warnings. 3139 */ 3140 atomic_set(&chan->nesting, L2CAP_NESTING_SMP); 3141 3142 BT_DBG("created chan %p", chan); 3143 3144 return chan; 3145 } 3146 3147 static const struct l2cap_ops smp_root_chan_ops = { 3148 .name = "Security Manager Root", 3149 .new_connection = smp_new_conn_cb, 3150 3151 /* None of these are implemented for the root channel */ 3152 .close = l2cap_chan_no_close, 3153 .alloc_skb = l2cap_chan_no_alloc_skb, 3154 .recv = l2cap_chan_no_recv, 3155 .state_change = l2cap_chan_no_state_change, 3156 .teardown = l2cap_chan_no_teardown, 3157 .ready = l2cap_chan_no_ready, 3158 .defer = l2cap_chan_no_defer, 3159 .suspend = l2cap_chan_no_suspend, 3160 .resume = l2cap_chan_no_resume, 3161 .set_shutdown = l2cap_chan_no_set_shutdown, 3162 .get_sndtimeo = l2cap_chan_no_get_sndtimeo, 3163 }; 3164 3165 static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid) 3166 { 3167 struct l2cap_chan *chan; 3168 struct smp_dev *smp; 3169 struct crypto_cipher *tfm_aes; 3170 struct crypto_shash *tfm_cmac; 3171 3172 if (cid == L2CAP_CID_SMP_BREDR) { 3173 smp = NULL; 3174 goto create_chan; 3175 } 3176 3177 smp = kzalloc(sizeof(*smp), GFP_KERNEL); 3178 if (!smp) 3179 return ERR_PTR(-ENOMEM); 3180 3181 tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC); 3182 if (IS_ERR(tfm_aes)) { 3183 BT_ERR("Unable to create AES crypto context"); 3184 kzfree(smp); 3185 return ERR_CAST(tfm_aes); 3186 } 3187 3188 tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0); 3189 if (IS_ERR(tfm_cmac)) { 3190 BT_ERR("Unable to create CMAC crypto context"); 3191 crypto_free_cipher(tfm_aes); 3192 kzfree(smp); 3193 return ERR_CAST(tfm_cmac); 3194 } 3195 3196 smp->tfm_aes = tfm_aes; 3197 smp->tfm_cmac = tfm_cmac; 3198 smp->min_key_size = SMP_MIN_ENC_KEY_SIZE; 3199 smp->max_key_size = SMP_MAX_ENC_KEY_SIZE; 3200 3201 create_chan: 3202 chan = l2cap_chan_create(); 3203 if (!chan) { 3204 if (smp) { 3205 crypto_free_cipher(smp->tfm_aes); 3206 crypto_free_shash(smp->tfm_cmac); 3207 kzfree(smp); 3208 } 3209 return ERR_PTR(-ENOMEM); 3210 } 3211 3212 chan->data = smp; 3213 3214 l2cap_add_scid(chan, cid); 3215 3216 l2cap_chan_set_defaults(chan); 3217 3218 if (cid == L2CAP_CID_SMP) { 3219 u8 bdaddr_type; 3220 3221 hci_copy_identity_address(hdev, &chan->src, &bdaddr_type); 3222 3223 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 3224 chan->src_type = BDADDR_LE_PUBLIC; 3225 else 3226 chan->src_type = BDADDR_LE_RANDOM; 3227 } else { 3228 bacpy(&chan->src, &hdev->bdaddr); 3229 chan->src_type = BDADDR_BREDR; 3230 } 3231 3232 chan->state = BT_LISTEN; 3233 chan->mode = L2CAP_MODE_BASIC; 3234 chan->imtu = L2CAP_DEFAULT_MTU; 3235 chan->ops = &smp_root_chan_ops; 3236 3237 /* Set correct nesting level for a parent/listening channel */ 3238 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); 3239 3240 return chan; 3241 } 3242 3243 static void smp_del_chan(struct l2cap_chan *chan) 3244 { 3245 struct smp_dev *smp; 3246 3247 BT_DBG("chan %p", chan); 3248 3249 smp = chan->data; 3250 if (smp) { 3251 chan->data = NULL; 3252 crypto_free_cipher(smp->tfm_aes); 3253 crypto_free_shash(smp->tfm_cmac); 3254 kzfree(smp); 3255 } 3256 3257 l2cap_chan_put(chan); 3258 } 3259 3260 static ssize_t force_bredr_smp_read(struct file *file, 3261 char __user *user_buf, 3262 size_t count, loff_t *ppos) 3263 { 3264 struct hci_dev *hdev = file->private_data; 3265 char buf[3]; 3266 3267 buf[0] = hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP) ? 'Y': 'N'; 3268 buf[1] = '\n'; 3269 buf[2] = '\0'; 3270 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 3271 } 3272 3273 static ssize_t force_bredr_smp_write(struct file *file, 3274 const char __user *user_buf, 3275 size_t count, loff_t *ppos) 3276 { 3277 struct hci_dev *hdev = file->private_data; 3278 char buf[32]; 3279 size_t buf_size = min(count, (sizeof(buf)-1)); 3280 bool enable; 3281 3282 if (copy_from_user(buf, user_buf, buf_size)) 3283 return -EFAULT; 3284 3285 buf[buf_size] = '\0'; 3286 if (strtobool(buf, &enable)) 3287 return -EINVAL; 3288 3289 if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3290 return -EALREADY; 3291 3292 if (enable) { 3293 struct l2cap_chan *chan; 3294 3295 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR); 3296 if (IS_ERR(chan)) 3297 return PTR_ERR(chan); 3298 3299 hdev->smp_bredr_data = chan; 3300 } else { 3301 struct l2cap_chan *chan; 3302 3303 chan = hdev->smp_bredr_data; 3304 hdev->smp_bredr_data = NULL; 3305 smp_del_chan(chan); 3306 } 3307 3308 hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP); 3309 3310 return count; 3311 } 3312 3313 static const struct file_operations force_bredr_smp_fops = { 3314 .open = simple_open, 3315 .read = force_bredr_smp_read, 3316 .write = force_bredr_smp_write, 3317 .llseek = default_llseek, 3318 }; 3319 3320 static ssize_t le_min_key_size_read(struct file *file, 3321 char __user *user_buf, 3322 size_t count, loff_t *ppos) 3323 { 3324 struct hci_dev *hdev = file->private_data; 3325 char buf[4]; 3326 3327 snprintf(buf, sizeof(buf), "%2u\n", SMP_DEV(hdev)->min_key_size); 3328 3329 return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf)); 3330 } 3331 3332 static ssize_t le_min_key_size_write(struct file *file, 3333 const char __user *user_buf, 3334 size_t count, loff_t *ppos) 3335 { 3336 struct hci_dev *hdev = file->private_data; 3337 char buf[32]; 3338 size_t buf_size = min(count, (sizeof(buf) - 1)); 3339 u8 key_size; 3340 3341 if (copy_from_user(buf, user_buf, buf_size)) 3342 return -EFAULT; 3343 3344 buf[buf_size] = '\0'; 3345 3346 sscanf(buf, "%hhu", &key_size); 3347 3348 if (key_size > SMP_DEV(hdev)->max_key_size || 3349 key_size < SMP_MIN_ENC_KEY_SIZE) 3350 return -EINVAL; 3351 3352 SMP_DEV(hdev)->min_key_size = key_size; 3353 3354 return count; 3355 } 3356 3357 static const struct file_operations le_min_key_size_fops = { 3358 .open = simple_open, 3359 .read = le_min_key_size_read, 3360 .write = le_min_key_size_write, 3361 .llseek = default_llseek, 3362 }; 3363 3364 static ssize_t le_max_key_size_read(struct file *file, 3365 char __user *user_buf, 3366 size_t count, loff_t *ppos) 3367 { 3368 struct hci_dev *hdev = file->private_data; 3369 char buf[4]; 3370 3371 snprintf(buf, sizeof(buf), "%2u\n", SMP_DEV(hdev)->max_key_size); 3372 3373 return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf)); 3374 } 3375 3376 static ssize_t le_max_key_size_write(struct file *file, 3377 const char __user *user_buf, 3378 size_t count, loff_t *ppos) 3379 { 3380 struct hci_dev *hdev = file->private_data; 3381 char buf[32]; 3382 size_t buf_size = min(count, (sizeof(buf) - 1)); 3383 u8 key_size; 3384 3385 if (copy_from_user(buf, user_buf, buf_size)) 3386 return -EFAULT; 3387 3388 buf[buf_size] = '\0'; 3389 3390 sscanf(buf, "%hhu", &key_size); 3391 3392 if (key_size > SMP_MAX_ENC_KEY_SIZE || 3393 key_size < SMP_DEV(hdev)->min_key_size) 3394 return -EINVAL; 3395 3396 SMP_DEV(hdev)->max_key_size = key_size; 3397 3398 return count; 3399 } 3400 3401 static const struct file_operations le_max_key_size_fops = { 3402 .open = simple_open, 3403 .read = le_max_key_size_read, 3404 .write = le_max_key_size_write, 3405 .llseek = default_llseek, 3406 }; 3407 3408 int smp_register(struct hci_dev *hdev) 3409 { 3410 struct l2cap_chan *chan; 3411 3412 BT_DBG("%s", hdev->name); 3413 3414 /* If the controller does not support Low Energy operation, then 3415 * there is also no need to register any SMP channel. 3416 */ 3417 if (!lmp_le_capable(hdev)) 3418 return 0; 3419 3420 if (WARN_ON(hdev->smp_data)) { 3421 chan = hdev->smp_data; 3422 hdev->smp_data = NULL; 3423 smp_del_chan(chan); 3424 } 3425 3426 chan = smp_add_cid(hdev, L2CAP_CID_SMP); 3427 if (IS_ERR(chan)) 3428 return PTR_ERR(chan); 3429 3430 hdev->smp_data = chan; 3431 3432 debugfs_create_file("le_min_key_size", 0644, hdev->debugfs, hdev, 3433 &le_min_key_size_fops); 3434 debugfs_create_file("le_max_key_size", 0644, hdev->debugfs, hdev, 3435 &le_max_key_size_fops); 3436 3437 /* If the controller does not support BR/EDR Secure Connections 3438 * feature, then the BR/EDR SMP channel shall not be present. 3439 * 3440 * To test this with Bluetooth 4.0 controllers, create a debugfs 3441 * switch that allows forcing BR/EDR SMP support and accepting 3442 * cross-transport pairing on non-AES encrypted connections. 3443 */ 3444 if (!lmp_sc_capable(hdev)) { 3445 debugfs_create_file("force_bredr_smp", 0644, hdev->debugfs, 3446 hdev, &force_bredr_smp_fops); 3447 3448 /* Flag can be already set here (due to power toggle) */ 3449 if (!hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3450 return 0; 3451 } 3452 3453 if (WARN_ON(hdev->smp_bredr_data)) { 3454 chan = hdev->smp_bredr_data; 3455 hdev->smp_bredr_data = NULL; 3456 smp_del_chan(chan); 3457 } 3458 3459 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR); 3460 if (IS_ERR(chan)) { 3461 int err = PTR_ERR(chan); 3462 chan = hdev->smp_data; 3463 hdev->smp_data = NULL; 3464 smp_del_chan(chan); 3465 return err; 3466 } 3467 3468 hdev->smp_bredr_data = chan; 3469 3470 return 0; 3471 } 3472 3473 void smp_unregister(struct hci_dev *hdev) 3474 { 3475 struct l2cap_chan *chan; 3476 3477 if (hdev->smp_bredr_data) { 3478 chan = hdev->smp_bredr_data; 3479 hdev->smp_bredr_data = NULL; 3480 smp_del_chan(chan); 3481 } 3482 3483 if (hdev->smp_data) { 3484 chan = hdev->smp_data; 3485 hdev->smp_data = NULL; 3486 smp_del_chan(chan); 3487 } 3488 } 3489 3490 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP) 3491 3492 static inline void swap_digits(u64 *in, u64 *out, unsigned int ndigits) 3493 { 3494 int i; 3495 3496 for (i = 0; i < ndigits; i++) 3497 out[i] = __swab64(in[ndigits - 1 - i]); 3498 } 3499 3500 static int __init test_debug_key(void) 3501 { 3502 u8 pk[64], sk[32]; 3503 3504 swap_digits((u64 *)debug_sk, (u64 *)sk, 4); 3505 3506 if (!generate_ecdh_keys(pk, sk)) 3507 return -EINVAL; 3508 3509 if (memcmp(sk, debug_sk, 32)) 3510 return -EINVAL; 3511 3512 if (memcmp(pk, debug_pk, 64)) 3513 return -EINVAL; 3514 3515 return 0; 3516 } 3517 3518 static int __init test_ah(struct crypto_cipher *tfm_aes) 3519 { 3520 const u8 irk[16] = { 3521 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3522 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3523 const u8 r[3] = { 0x94, 0x81, 0x70 }; 3524 const u8 exp[3] = { 0xaa, 0xfb, 0x0d }; 3525 u8 res[3]; 3526 int err; 3527 3528 err = smp_ah(tfm_aes, irk, r, res); 3529 if (err) 3530 return err; 3531 3532 if (memcmp(res, exp, 3)) 3533 return -EINVAL; 3534 3535 return 0; 3536 } 3537 3538 static int __init test_c1(struct crypto_cipher *tfm_aes) 3539 { 3540 const u8 k[16] = { 3541 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 3542 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 3543 const u8 r[16] = { 3544 0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63, 3545 0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 }; 3546 const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 }; 3547 const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 }; 3548 const u8 _iat = 0x01; 3549 const u8 _rat = 0x00; 3550 const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } }; 3551 const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } }; 3552 const u8 exp[16] = { 3553 0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2, 3554 0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e }; 3555 u8 res[16]; 3556 int err; 3557 3558 err = smp_c1(tfm_aes, k, r, preq, pres, _iat, &ia, _rat, &ra, res); 3559 if (err) 3560 return err; 3561 3562 if (memcmp(res, exp, 16)) 3563 return -EINVAL; 3564 3565 return 0; 3566 } 3567 3568 static int __init test_s1(struct crypto_cipher *tfm_aes) 3569 { 3570 const u8 k[16] = { 3571 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 3572 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 3573 const u8 r1[16] = { 3574 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 }; 3575 const u8 r2[16] = { 3576 0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 }; 3577 const u8 exp[16] = { 3578 0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b, 3579 0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a }; 3580 u8 res[16]; 3581 int err; 3582 3583 err = smp_s1(tfm_aes, k, r1, r2, res); 3584 if (err) 3585 return err; 3586 3587 if (memcmp(res, exp, 16)) 3588 return -EINVAL; 3589 3590 return 0; 3591 } 3592 3593 static int __init test_f4(struct crypto_shash *tfm_cmac) 3594 { 3595 const u8 u[32] = { 3596 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 3597 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 3598 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 3599 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 }; 3600 const u8 v[32] = { 3601 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b, 3602 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59, 3603 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90, 3604 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 }; 3605 const u8 x[16] = { 3606 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3607 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3608 const u8 z = 0x00; 3609 const u8 exp[16] = { 3610 0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1, 3611 0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 }; 3612 u8 res[16]; 3613 int err; 3614 3615 err = smp_f4(tfm_cmac, u, v, x, z, res); 3616 if (err) 3617 return err; 3618 3619 if (memcmp(res, exp, 16)) 3620 return -EINVAL; 3621 3622 return 0; 3623 } 3624 3625 static int __init test_f5(struct crypto_shash *tfm_cmac) 3626 { 3627 const u8 w[32] = { 3628 0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86, 3629 0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99, 3630 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3631 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3632 const u8 n1[16] = { 3633 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3634 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3635 const u8 n2[16] = { 3636 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3637 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3638 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 }; 3639 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 }; 3640 const u8 exp_ltk[16] = { 3641 0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98, 3642 0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 }; 3643 const u8 exp_mackey[16] = { 3644 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd, 3645 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 }; 3646 u8 mackey[16], ltk[16]; 3647 int err; 3648 3649 err = smp_f5(tfm_cmac, w, n1, n2, a1, a2, mackey, ltk); 3650 if (err) 3651 return err; 3652 3653 if (memcmp(mackey, exp_mackey, 16)) 3654 return -EINVAL; 3655 3656 if (memcmp(ltk, exp_ltk, 16)) 3657 return -EINVAL; 3658 3659 return 0; 3660 } 3661 3662 static int __init test_f6(struct crypto_shash *tfm_cmac) 3663 { 3664 const u8 w[16] = { 3665 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd, 3666 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 }; 3667 const u8 n1[16] = { 3668 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3669 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3670 const u8 n2[16] = { 3671 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3672 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3673 const u8 r[16] = { 3674 0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08, 3675 0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 }; 3676 const u8 io_cap[3] = { 0x02, 0x01, 0x01 }; 3677 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 }; 3678 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 }; 3679 const u8 exp[16] = { 3680 0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2, 3681 0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 }; 3682 u8 res[16]; 3683 int err; 3684 3685 err = smp_f6(tfm_cmac, w, n1, n2, r, io_cap, a1, a2, res); 3686 if (err) 3687 return err; 3688 3689 if (memcmp(res, exp, 16)) 3690 return -EINVAL; 3691 3692 return 0; 3693 } 3694 3695 static int __init test_g2(struct crypto_shash *tfm_cmac) 3696 { 3697 const u8 u[32] = { 3698 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 3699 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 3700 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 3701 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 }; 3702 const u8 v[32] = { 3703 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b, 3704 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59, 3705 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90, 3706 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 }; 3707 const u8 x[16] = { 3708 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3709 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3710 const u8 y[16] = { 3711 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3712 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3713 const u32 exp_val = 0x2f9ed5ba % 1000000; 3714 u32 val; 3715 int err; 3716 3717 err = smp_g2(tfm_cmac, u, v, x, y, &val); 3718 if (err) 3719 return err; 3720 3721 if (val != exp_val) 3722 return -EINVAL; 3723 3724 return 0; 3725 } 3726 3727 static int __init test_h6(struct crypto_shash *tfm_cmac) 3728 { 3729 const u8 w[16] = { 3730 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3731 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3732 const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c }; 3733 const u8 exp[16] = { 3734 0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8, 3735 0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d }; 3736 u8 res[16]; 3737 int err; 3738 3739 err = smp_h6(tfm_cmac, w, key_id, res); 3740 if (err) 3741 return err; 3742 3743 if (memcmp(res, exp, 16)) 3744 return -EINVAL; 3745 3746 return 0; 3747 } 3748 3749 static char test_smp_buffer[32]; 3750 3751 static ssize_t test_smp_read(struct file *file, char __user *user_buf, 3752 size_t count, loff_t *ppos) 3753 { 3754 return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer, 3755 strlen(test_smp_buffer)); 3756 } 3757 3758 static const struct file_operations test_smp_fops = { 3759 .open = simple_open, 3760 .read = test_smp_read, 3761 .llseek = default_llseek, 3762 }; 3763 3764 static int __init run_selftests(struct crypto_cipher *tfm_aes, 3765 struct crypto_shash *tfm_cmac) 3766 { 3767 ktime_t calltime, delta, rettime; 3768 unsigned long long duration; 3769 int err; 3770 3771 calltime = ktime_get(); 3772 3773 err = test_debug_key(); 3774 if (err) { 3775 BT_ERR("debug_key test failed"); 3776 goto done; 3777 } 3778 3779 err = test_ah(tfm_aes); 3780 if (err) { 3781 BT_ERR("smp_ah test failed"); 3782 goto done; 3783 } 3784 3785 err = test_c1(tfm_aes); 3786 if (err) { 3787 BT_ERR("smp_c1 test failed"); 3788 goto done; 3789 } 3790 3791 err = test_s1(tfm_aes); 3792 if (err) { 3793 BT_ERR("smp_s1 test failed"); 3794 goto done; 3795 } 3796 3797 err = test_f4(tfm_cmac); 3798 if (err) { 3799 BT_ERR("smp_f4 test failed"); 3800 goto done; 3801 } 3802 3803 err = test_f5(tfm_cmac); 3804 if (err) { 3805 BT_ERR("smp_f5 test failed"); 3806 goto done; 3807 } 3808 3809 err = test_f6(tfm_cmac); 3810 if (err) { 3811 BT_ERR("smp_f6 test failed"); 3812 goto done; 3813 } 3814 3815 err = test_g2(tfm_cmac); 3816 if (err) { 3817 BT_ERR("smp_g2 test failed"); 3818 goto done; 3819 } 3820 3821 err = test_h6(tfm_cmac); 3822 if (err) { 3823 BT_ERR("smp_h6 test failed"); 3824 goto done; 3825 } 3826 3827 rettime = ktime_get(); 3828 delta = ktime_sub(rettime, calltime); 3829 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 3830 3831 BT_INFO("SMP test passed in %llu usecs", duration); 3832 3833 done: 3834 if (!err) 3835 snprintf(test_smp_buffer, sizeof(test_smp_buffer), 3836 "PASS (%llu usecs)\n", duration); 3837 else 3838 snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n"); 3839 3840 debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL, 3841 &test_smp_fops); 3842 3843 return err; 3844 } 3845 3846 int __init bt_selftest_smp(void) 3847 { 3848 struct crypto_cipher *tfm_aes; 3849 struct crypto_shash *tfm_cmac; 3850 int err; 3851 3852 tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC); 3853 if (IS_ERR(tfm_aes)) { 3854 BT_ERR("Unable to create AES crypto context"); 3855 return PTR_ERR(tfm_aes); 3856 } 3857 3858 tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, CRYPTO_ALG_ASYNC); 3859 if (IS_ERR(tfm_cmac)) { 3860 BT_ERR("Unable to create CMAC crypto context"); 3861 crypto_free_cipher(tfm_aes); 3862 return PTR_ERR(tfm_cmac); 3863 } 3864 3865 err = run_selftests(tfm_aes, tfm_cmac); 3866 3867 crypto_free_shash(tfm_cmac); 3868 crypto_free_cipher(tfm_aes); 3869 3870 return err; 3871 } 3872 3873 #endif 3874