2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
23 #include <linux/debugfs.h>
24 #include <linux/scatterlist.h>
25 #include <linux/crypto.h>
26 #include <crypto/aes.h>
27 #include <crypto/algapi.h>
28 #include <crypto/hash.h>
29 #include <crypto/kpp.h>
31 #include <net/bluetooth/bluetooth.h>
32 #include <net/bluetooth/hci_core.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
36 #include "ecdh_helper.h"
39 #define SMP_DEV(hdev) \
40 ((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data)
42 /* Low-level debug macros to be used for stuff that we don't want
43 * accidentally in dmesg, i.e. the values of the various crypto keys
44 * and the inputs & outputs of crypto functions.
47 #define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \
50 #define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \
54 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
56 /* Keys which are not distributed with Secure Connections */
57 #define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY)
59 #define SMP_TIMEOUT msecs_to_jiffies(30000)
61 #define ID_ADDR_TIMEOUT msecs_to_jiffies(200)
63 #define AUTH_REQ_MASK(dev) (hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \
65 #define KEY_DIST_MASK 0x07
67 /* Maximum message length that can be passed to aes_cmac */
68 #define CMAC_MSG_MAX 80
80 SMP_FLAG_DHKEY_PENDING,
87 /* Secure Connections OOB data */
93 struct crypto_shash *tfm_cmac;
94 struct crypto_kpp *tfm_ecdh;
98 struct l2cap_conn *conn;
99 struct delayed_work security_timer;
100 unsigned long allow_cmd; /* Bitmask of allowed commands */
102 u8 preq[7]; /* SMP Pairing Request */
103 u8 prsp[7]; /* SMP Pairing Response */
104 u8 prnd[16]; /* SMP Pairing Random (local) */
105 u8 rrnd[16]; /* SMP Pairing Random (remote) */
106 u8 pcnf[16]; /* SMP Pairing Confirm */
107 u8 tk[16]; /* SMP Temporary Key */
108 u8 rr[16]; /* Remote OOB ra/rb value */
109 u8 lr[16]; /* Local OOB ra/rb value */
115 struct smp_csrk *csrk;
116 struct smp_csrk *responder_csrk;
118 struct smp_ltk *responder_ltk;
119 struct smp_irk *remote_irk;
125 /* Secure Connections variables */
131 struct crypto_shash *tfm_cmac;
132 struct crypto_kpp *tfm_ecdh;
135 /* These debug key values are defined in the SMP section of the core
136 * specification. debug_pk is the public debug key and debug_sk the
139 static const u8 debug_pk[64] = {
140 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
141 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
142 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
143 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20,
145 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74,
146 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
147 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63,
148 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc,
151 static const u8 debug_sk[32] = {
152 0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58,
153 0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a,
154 0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74,
155 0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f,
158 static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
162 for (i = 0; i < len; i++)
163 dst[len - 1 - i] = src[i];
166 /* The following functions map to the LE SC SMP crypto functions
167 * AES-CMAC, f4, f5, f6, g2 and h6.
170 static int aes_cmac(struct crypto_shash *tfm, const u8 k[16], const u8 *m,
171 size_t len, u8 mac[16])
173 uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX];
176 if (len > CMAC_MSG_MAX)
180 BT_ERR("tfm %p", tfm);
184 /* Swap key and message from LSB to MSB */
185 swap_buf(k, tmp, 16);
186 swap_buf(m, msg_msb, len);
188 SMP_DBG("msg (len %zu) %*phN", len, (int) len, m);
189 SMP_DBG("key %16phN", k);
191 err = crypto_shash_setkey(tfm, tmp, 16);
193 BT_ERR("cipher setkey failed: %d", err);
197 err = crypto_shash_tfm_digest(tfm, msg_msb, len, mac_msb);
199 BT_ERR("Hash computation error %d", err);
203 swap_buf(mac_msb, mac, 16);
205 SMP_DBG("mac %16phN", mac);
210 static int smp_f4(struct crypto_shash *tfm_cmac, const u8 u[32],
211 const u8 v[32], const u8 x[16], u8 z, u8 res[16])
216 SMP_DBG("u %32phN", u);
217 SMP_DBG("v %32phN", v);
218 SMP_DBG("x %16phN z %02x", x, z);
221 memcpy(m + 1, v, 32);
222 memcpy(m + 33, u, 32);
224 err = aes_cmac(tfm_cmac, x, m, sizeof(m), res);
228 SMP_DBG("res %16phN", res);
233 static int smp_f5(struct crypto_shash *tfm_cmac, const u8 w[32],
234 const u8 n1[16], const u8 n2[16], const u8 a1[7],
235 const u8 a2[7], u8 mackey[16], u8 ltk[16])
237 /* The btle, salt and length "magic" values are as defined in
238 * the SMP section of the Bluetooth core specification. In ASCII
239 * the btle value ends up being 'btle'. The salt is just a
240 * random number whereas length is the value 256 in little
243 const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 };
244 const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60,
245 0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c };
246 const u8 length[2] = { 0x00, 0x01 };
250 SMP_DBG("w %32phN", w);
251 SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
252 SMP_DBG("a1 %7phN a2 %7phN", a1, a2);
254 err = aes_cmac(tfm_cmac, salt, w, 32, t);
258 SMP_DBG("t %16phN", t);
260 memcpy(m, length, 2);
261 memcpy(m + 2, a2, 7);
262 memcpy(m + 9, a1, 7);
263 memcpy(m + 16, n2, 16);
264 memcpy(m + 32, n1, 16);
265 memcpy(m + 48, btle, 4);
267 m[52] = 0; /* Counter */
269 err = aes_cmac(tfm_cmac, t, m, sizeof(m), mackey);
273 SMP_DBG("mackey %16phN", mackey);
275 m[52] = 1; /* Counter */
277 err = aes_cmac(tfm_cmac, t, m, sizeof(m), ltk);
281 SMP_DBG("ltk %16phN", ltk);
286 static int smp_f6(struct crypto_shash *tfm_cmac, const u8 w[16],
287 const u8 n1[16], const u8 n2[16], const u8 r[16],
288 const u8 io_cap[3], const u8 a1[7], const u8 a2[7],
294 SMP_DBG("w %16phN", w);
295 SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
296 SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2);
299 memcpy(m + 7, a1, 7);
300 memcpy(m + 14, io_cap, 3);
301 memcpy(m + 17, r, 16);
302 memcpy(m + 33, n2, 16);
303 memcpy(m + 49, n1, 16);
305 err = aes_cmac(tfm_cmac, w, m, sizeof(m), res);
309 SMP_DBG("res %16phN", res);
314 static int smp_g2(struct crypto_shash *tfm_cmac, const u8 u[32], const u8 v[32],
315 const u8 x[16], const u8 y[16], u32 *val)
320 SMP_DBG("u %32phN", u);
321 SMP_DBG("v %32phN", v);
322 SMP_DBG("x %16phN y %16phN", x, y);
325 memcpy(m + 16, v, 32);
326 memcpy(m + 48, u, 32);
328 err = aes_cmac(tfm_cmac, x, m, sizeof(m), tmp);
332 *val = get_unaligned_le32(tmp);
335 SMP_DBG("val %06u", *val);
340 static int smp_h6(struct crypto_shash *tfm_cmac, const u8 w[16],
341 const u8 key_id[4], u8 res[16])
345 SMP_DBG("w %16phN key_id %4phN", w, key_id);
347 err = aes_cmac(tfm_cmac, w, key_id, 4, res);
351 SMP_DBG("res %16phN", res);
356 static int smp_h7(struct crypto_shash *tfm_cmac, const u8 w[16],
357 const u8 salt[16], u8 res[16])
361 SMP_DBG("w %16phN salt %16phN", w, salt);
363 err = aes_cmac(tfm_cmac, salt, w, 16, res);
367 SMP_DBG("res %16phN", res);
372 /* The following functions map to the legacy SMP crypto functions e, c1,
376 static int smp_e(const u8 *k, u8 *r)
378 struct crypto_aes_ctx ctx;
379 uint8_t tmp[16], data[16];
382 SMP_DBG("k %16phN r %16phN", k, r);
384 /* The most significant octet of key corresponds to k[0] */
385 swap_buf(k, tmp, 16);
387 err = aes_expandkey(&ctx, tmp, 16);
389 BT_ERR("cipher setkey failed: %d", err);
393 /* Most significant octet of plaintextData corresponds to data[0] */
394 swap_buf(r, data, 16);
396 aes_encrypt(&ctx, data, data);
398 /* Most significant octet of encryptedData corresponds to data[0] */
399 swap_buf(data, r, 16);
401 SMP_DBG("r %16phN", r);
403 memzero_explicit(&ctx, sizeof(ctx));
407 static int smp_c1(const u8 k[16],
408 const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat,
409 const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16])
414 SMP_DBG("k %16phN r %16phN", k, r);
415 SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra);
416 SMP_DBG("preq %7phN pres %7phN", preq, pres);
420 /* p1 = pres || preq || _rat || _iat */
423 memcpy(p1 + 2, preq, 7);
424 memcpy(p1 + 9, pres, 7);
426 SMP_DBG("p1 %16phN", p1);
429 crypto_xor_cpy(res, r, p1, sizeof(p1));
431 /* res = e(k, res) */
434 BT_ERR("Encrypt data error");
438 /* p2 = padding || ia || ra */
440 memcpy(p2 + 6, ia, 6);
441 memset(p2 + 12, 0, 4);
443 SMP_DBG("p2 %16phN", p2);
445 /* res = res XOR p2 */
446 crypto_xor(res, p2, sizeof(p2));
448 /* res = e(k, res) */
451 BT_ERR("Encrypt data error");
456 static int smp_s1(const u8 k[16],
457 const u8 r1[16], const u8 r2[16], u8 _r[16])
461 /* Just least significant octets from r1 and r2 are considered */
463 memcpy(_r + 8, r1, 8);
467 BT_ERR("Encrypt data error");
472 static int smp_ah(const u8 irk[16], const u8 r[3], u8 res[3])
477 /* r' = padding || r */
479 memset(_res + 3, 0, 13);
481 err = smp_e(irk, _res);
483 BT_ERR("Encrypt error");
487 /* The output of the random address function ah is:
488 * ah(k, r) = e(k, r') mod 2^24
489 * The output of the security function e is then truncated to 24 bits
490 * by taking the least significant 24 bits of the output of e as the
493 memcpy(res, _res, 3);
498 bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16],
499 const bdaddr_t *bdaddr)
501 struct l2cap_chan *chan = hdev->smp_data;
505 if (!chan || !chan->data)
508 bt_dev_dbg(hdev, "RPA %pMR IRK %*phN", bdaddr, 16, irk);
510 err = smp_ah(irk, &bdaddr->b[3], hash);
514 return !crypto_memneq(bdaddr->b, hash, 3);
517 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
519 struct l2cap_chan *chan = hdev->smp_data;
522 if (!chan || !chan->data)
525 get_random_bytes(&rpa->b[3], 3);
527 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
528 rpa->b[5] |= 0x40; /* Set second most significant bit */
530 err = smp_ah(irk, &rpa->b[3], rpa->b);
534 bt_dev_dbg(hdev, "RPA %pMR", rpa);
539 int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
541 struct l2cap_chan *chan = hdev->smp_data;
545 if (!chan || !chan->data)
550 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
551 bt_dev_dbg(hdev, "Using debug keys");
552 err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk);
555 memcpy(smp->local_pk, debug_pk, 64);
556 smp->debug_key = true;
559 /* Generate key pair for Secure Connections */
560 err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk);
564 /* This is unlikely, but we need to check that
565 * we didn't accidentally generate a debug key.
567 if (crypto_memneq(smp->local_pk, debug_pk, 64))
570 smp->debug_key = false;
573 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk);
574 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32);
576 get_random_bytes(smp->local_rand, 16);
578 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk,
579 smp->local_rand, 0, hash);
583 memcpy(rand, smp->local_rand, 16);
585 smp->local_oob = true;
590 static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
592 struct l2cap_chan *chan = conn->smp;
593 struct smp_chan *smp;
600 bt_dev_dbg(conn->hcon->hdev, "code 0x%2.2x", code);
602 iv[0].iov_base = &code;
605 iv[1].iov_base = data;
608 memset(&msg, 0, sizeof(msg));
610 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iv, 2, 1 + len);
612 l2cap_chan_send(chan, &msg, 1 + len);
619 cancel_delayed_work_sync(&smp->security_timer);
620 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
623 static u8 authreq_to_seclevel(u8 authreq)
625 if (authreq & SMP_AUTH_MITM) {
626 if (authreq & SMP_AUTH_SC)
627 return BT_SECURITY_FIPS;
629 return BT_SECURITY_HIGH;
631 return BT_SECURITY_MEDIUM;
635 static __u8 seclevel_to_authreq(__u8 sec_level)
638 case BT_SECURITY_FIPS:
639 case BT_SECURITY_HIGH:
640 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
641 case BT_SECURITY_MEDIUM:
642 return SMP_AUTH_BONDING;
644 return SMP_AUTH_NONE;
648 static void build_pairing_cmd(struct l2cap_conn *conn,
649 struct smp_cmd_pairing *req,
650 struct smp_cmd_pairing *rsp, __u8 authreq)
652 struct l2cap_chan *chan = conn->smp;
653 struct smp_chan *smp = chan->data;
654 struct hci_conn *hcon = conn->hcon;
655 struct hci_dev *hdev = hcon->hdev;
656 u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT;
658 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
659 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
660 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
661 authreq |= SMP_AUTH_BONDING;
663 authreq &= ~SMP_AUTH_BONDING;
666 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
667 remote_dist |= SMP_DIST_ID_KEY;
669 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
670 local_dist |= SMP_DIST_ID_KEY;
672 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
673 (authreq & SMP_AUTH_SC)) {
674 struct oob_data *oob_data;
677 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
678 local_dist |= SMP_DIST_LINK_KEY;
679 remote_dist |= SMP_DIST_LINK_KEY;
682 if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
683 bdaddr_type = BDADDR_LE_PUBLIC;
685 bdaddr_type = BDADDR_LE_RANDOM;
687 oob_data = hci_find_remote_oob_data(hdev, &hcon->dst,
689 if (oob_data && oob_data->present) {
690 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags);
691 oob_flag = SMP_OOB_PRESENT;
692 memcpy(smp->rr, oob_data->rand256, 16);
693 memcpy(smp->pcnf, oob_data->hash256, 16);
694 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf);
695 SMP_DBG("OOB Remote Random: %16phN", smp->rr);
699 authreq &= ~SMP_AUTH_SC;
703 req->io_capability = conn->hcon->io_capability;
704 req->oob_flag = oob_flag;
705 req->max_key_size = hdev->le_max_key_size;
706 req->init_key_dist = local_dist;
707 req->resp_key_dist = remote_dist;
708 req->auth_req = (authreq & AUTH_REQ_MASK(hdev));
710 smp->remote_key_dist = remote_dist;
714 rsp->io_capability = conn->hcon->io_capability;
715 rsp->oob_flag = oob_flag;
716 rsp->max_key_size = hdev->le_max_key_size;
717 rsp->init_key_dist = req->init_key_dist & remote_dist;
718 rsp->resp_key_dist = req->resp_key_dist & local_dist;
719 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev));
721 smp->remote_key_dist = rsp->init_key_dist;
724 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
726 struct l2cap_chan *chan = conn->smp;
727 struct hci_dev *hdev = conn->hcon->hdev;
728 struct smp_chan *smp = chan->data;
730 if (conn->hcon->pending_sec_level == BT_SECURITY_FIPS &&
731 max_key_size != SMP_MAX_ENC_KEY_SIZE)
732 return SMP_ENC_KEY_SIZE;
734 if (max_key_size > hdev->le_max_key_size ||
735 max_key_size < SMP_MIN_ENC_KEY_SIZE)
736 return SMP_ENC_KEY_SIZE;
738 smp->enc_key_size = max_key_size;
743 static void smp_chan_destroy(struct l2cap_conn *conn)
745 struct l2cap_chan *chan = conn->smp;
746 struct smp_chan *smp = chan->data;
747 struct hci_conn *hcon = conn->hcon;
752 cancel_delayed_work_sync(&smp->security_timer);
754 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
755 mgmt_smp_complete(hcon, complete);
757 kfree_sensitive(smp->csrk);
758 kfree_sensitive(smp->responder_csrk);
759 kfree_sensitive(smp->link_key);
761 crypto_free_shash(smp->tfm_cmac);
762 crypto_free_kpp(smp->tfm_ecdh);
764 /* Ensure that we don't leave any debug key around if debug key
765 * support hasn't been explicitly enabled.
767 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG &&
768 !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) {
769 list_del_rcu(&smp->ltk->list);
770 kfree_rcu(smp->ltk, rcu);
774 /* If pairing failed clean up any keys we might have */
777 list_del_rcu(&smp->ltk->list);
778 kfree_rcu(smp->ltk, rcu);
781 if (smp->responder_ltk) {
782 list_del_rcu(&smp->responder_ltk->list);
783 kfree_rcu(smp->responder_ltk, rcu);
786 if (smp->remote_irk) {
787 list_del_rcu(&smp->remote_irk->list);
788 kfree_rcu(smp->remote_irk, rcu);
793 kfree_sensitive(smp);
797 static void smp_failure(struct l2cap_conn *conn, u8 reason)
799 struct hci_conn *hcon = conn->hcon;
800 struct l2cap_chan *chan = conn->smp;
803 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
806 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
809 smp_chan_destroy(conn);
812 #define JUST_WORKS 0x00
813 #define JUST_CFM 0x01
814 #define REQ_PASSKEY 0x02
815 #define CFM_PASSKEY 0x03
817 #define DSP_PASSKEY 0x05
820 static const u8 gen_method[5][5] = {
821 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
822 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
823 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
824 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
825 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
828 static const u8 sc_method[5][5] = {
829 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
830 { JUST_WORKS, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
831 { DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY },
832 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
833 { DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
836 static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
838 /* If either side has unknown io_caps, use JUST_CFM (which gets
839 * converted later to JUST_WORKS if we're initiators.
841 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
842 remote_io > SMP_IO_KEYBOARD_DISPLAY)
845 if (test_bit(SMP_FLAG_SC, &smp->flags))
846 return sc_method[remote_io][local_io];
848 return gen_method[remote_io][local_io];
851 static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
852 u8 local_io, u8 remote_io)
854 struct hci_conn *hcon = conn->hcon;
855 struct l2cap_chan *chan = conn->smp;
856 struct smp_chan *smp = chan->data;
860 /* Initialize key for JUST WORKS */
861 memset(smp->tk, 0, sizeof(smp->tk));
862 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
864 bt_dev_dbg(hcon->hdev, "auth:%u lcl:%u rem:%u", auth, local_io,
867 /* If neither side wants MITM, either "just" confirm an incoming
868 * request or use just-works for outgoing ones. The JUST_CFM
869 * will be converted to JUST_WORKS if necessary later in this
870 * function. If either side has MITM look up the method from the
873 if (!(auth & SMP_AUTH_MITM))
874 smp->method = JUST_CFM;
876 smp->method = get_auth_method(smp, local_io, remote_io);
878 /* Don't confirm locally initiated pairing attempts */
879 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
881 smp->method = JUST_WORKS;
883 /* Don't bother user space with no IO capabilities */
884 if (smp->method == JUST_CFM &&
885 hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
886 smp->method = JUST_WORKS;
888 /* If Just Works, Continue with Zero TK and ask user-space for
890 if (smp->method == JUST_WORKS) {
891 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
897 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
901 /* If this function is used for SC -> legacy fallback we
902 * can only recover the just-works case.
904 if (test_bit(SMP_FLAG_SC, &smp->flags))
907 /* Not Just Works/Confirm results in MITM Authentication */
908 if (smp->method != JUST_CFM) {
909 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
910 if (hcon->pending_sec_level < BT_SECURITY_HIGH)
911 hcon->pending_sec_level = BT_SECURITY_HIGH;
914 /* If both devices have Keyboard-Display I/O, the initiator
915 * Confirms and the responder Enters the passkey.
917 if (smp->method == OVERLAP) {
918 if (hcon->role == HCI_ROLE_MASTER)
919 smp->method = CFM_PASSKEY;
921 smp->method = REQ_PASSKEY;
924 /* Generate random passkey. */
925 if (smp->method == CFM_PASSKEY) {
926 memset(smp->tk, 0, sizeof(smp->tk));
927 get_random_bytes(&passkey, sizeof(passkey));
929 put_unaligned_le32(passkey, smp->tk);
930 bt_dev_dbg(hcon->hdev, "PassKey: %u", passkey);
931 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
934 if (smp->method == REQ_PASSKEY)
935 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
936 hcon->type, hcon->dst_type);
937 else if (smp->method == JUST_CFM)
938 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
939 hcon->type, hcon->dst_type,
942 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
943 hcon->type, hcon->dst_type,
949 static u8 smp_confirm(struct smp_chan *smp)
951 struct l2cap_conn *conn = smp->conn;
952 struct smp_cmd_pairing_confirm cp;
955 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
957 ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp,
958 conn->hcon->init_addr_type, &conn->hcon->init_addr,
959 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
962 return SMP_UNSPECIFIED;
964 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
966 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
969 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
971 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
976 static u8 smp_random(struct smp_chan *smp)
978 struct l2cap_conn *conn = smp->conn;
979 struct hci_conn *hcon = conn->hcon;
983 bt_dev_dbg(conn->hcon->hdev, "conn %p %s", conn,
984 conn->hcon->out ? "initiator" : "responder");
986 ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp,
987 hcon->init_addr_type, &hcon->init_addr,
988 hcon->resp_addr_type, &hcon->resp_addr, confirm);
990 return SMP_UNSPECIFIED;
992 if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
993 bt_dev_err(hcon->hdev, "pairing failed "
994 "(confirmation values mismatch)");
995 return SMP_CONFIRM_FAILED;
1003 smp_s1(smp->tk, smp->rrnd, smp->prnd, stk);
1005 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
1006 return SMP_UNSPECIFIED;
1008 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size);
1009 hcon->enc_key_size = smp->enc_key_size;
1010 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1016 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1019 smp_s1(smp->tk, smp->prnd, smp->rrnd, stk);
1021 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
1026 /* Even though there's no _RESPONDER suffix this is the
1027 * responder STK we're adding for later lookup (the initiator
1028 * STK never needs to be stored).
1030 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1031 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
1037 static void smp_notify_keys(struct l2cap_conn *conn)
1039 struct l2cap_chan *chan = conn->smp;
1040 struct smp_chan *smp = chan->data;
1041 struct hci_conn *hcon = conn->hcon;
1042 struct hci_dev *hdev = hcon->hdev;
1043 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1044 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1047 if (hcon->type == ACL_LINK) {
1048 if (hcon->key_type == HCI_LK_DEBUG_COMBINATION)
1051 persistent = !test_bit(HCI_CONN_FLUSH_KEY,
1054 /* The LTKs, IRKs and CSRKs should be persistent only if
1055 * both sides had the bonding bit set in their
1056 * authentication requests.
1058 persistent = !!((req->auth_req & rsp->auth_req) &
1062 if (smp->remote_irk) {
1063 mgmt_new_irk(hdev, smp->remote_irk, persistent);
1065 /* Now that user space can be considered to know the
1066 * identity address track the connection based on it
1067 * from now on (assuming this is an LE link).
1069 if (hcon->type == LE_LINK) {
1070 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1071 hcon->dst_type = smp->remote_irk->addr_type;
1072 /* Use a short delay to make sure the new address is
1073 * propagated _before_ the channels.
1075 queue_delayed_work(hdev->workqueue,
1076 &conn->id_addr_timer,
1082 smp->csrk->bdaddr_type = hcon->dst_type;
1083 bacpy(&smp->csrk->bdaddr, &hcon->dst);
1084 mgmt_new_csrk(hdev, smp->csrk, persistent);
1087 if (smp->responder_csrk) {
1088 smp->responder_csrk->bdaddr_type = hcon->dst_type;
1089 bacpy(&smp->responder_csrk->bdaddr, &hcon->dst);
1090 mgmt_new_csrk(hdev, smp->responder_csrk, persistent);
1094 smp->ltk->bdaddr_type = hcon->dst_type;
1095 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1096 mgmt_new_ltk(hdev, smp->ltk, persistent);
1099 if (smp->responder_ltk) {
1100 smp->responder_ltk->bdaddr_type = hcon->dst_type;
1101 bacpy(&smp->responder_ltk->bdaddr, &hcon->dst);
1102 mgmt_new_ltk(hdev, smp->responder_ltk, persistent);
1105 if (smp->link_key) {
1106 struct link_key *key;
1109 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1110 type = HCI_LK_DEBUG_COMBINATION;
1111 else if (hcon->sec_level == BT_SECURITY_FIPS)
1112 type = HCI_LK_AUTH_COMBINATION_P256;
1114 type = HCI_LK_UNAUTH_COMBINATION_P256;
1116 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst,
1117 smp->link_key, type, 0, &persistent);
1119 mgmt_new_link_key(hdev, key, persistent);
1121 /* Don't keep debug keys around if the relevant
1124 if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) &&
1125 key->type == HCI_LK_DEBUG_COMBINATION) {
1126 list_del_rcu(&key->list);
1127 kfree_rcu(key, rcu);
1133 static void sc_add_ltk(struct smp_chan *smp)
1135 struct hci_conn *hcon = smp->conn->hcon;
1138 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1139 key_type = SMP_LTK_P256_DEBUG;
1141 key_type = SMP_LTK_P256;
1143 if (hcon->pending_sec_level == BT_SECURITY_FIPS)
1148 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1149 key_type, auth, smp->tk, smp->enc_key_size,
1153 static void sc_generate_link_key(struct smp_chan *smp)
1155 /* From core spec. Spells out in ASCII as 'lebr'. */
1156 const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c };
1158 smp->link_key = kzalloc(16, GFP_KERNEL);
1162 if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1163 /* SALT = 0x000000000000000000000000746D7031 */
1164 const u8 salt[16] = { 0x31, 0x70, 0x6d, 0x74 };
1166 if (smp_h7(smp->tfm_cmac, smp->tk, salt, smp->link_key)) {
1167 kfree_sensitive(smp->link_key);
1168 smp->link_key = NULL;
1172 /* From core spec. Spells out in ASCII as 'tmp1'. */
1173 const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 };
1175 if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) {
1176 kfree_sensitive(smp->link_key);
1177 smp->link_key = NULL;
1182 if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) {
1183 kfree_sensitive(smp->link_key);
1184 smp->link_key = NULL;
1189 static void smp_allow_key_dist(struct smp_chan *smp)
1191 /* Allow the first expected phase 3 PDU. The rest of the PDUs
1192 * will be allowed in each PDU handler to ensure we receive
1193 * them in the correct order.
1195 if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
1196 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
1197 else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1198 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
1199 else if (smp->remote_key_dist & SMP_DIST_SIGN)
1200 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1203 static void sc_generate_ltk(struct smp_chan *smp)
1205 /* From core spec. Spells out in ASCII as 'brle'. */
1206 const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 };
1207 struct hci_conn *hcon = smp->conn->hcon;
1208 struct hci_dev *hdev = hcon->hdev;
1209 struct link_key *key;
1211 key = hci_find_link_key(hdev, &hcon->dst);
1213 bt_dev_err(hdev, "no Link Key found to generate LTK");
1217 if (key->type == HCI_LK_DEBUG_COMBINATION)
1218 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1220 if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1221 /* SALT = 0x000000000000000000000000746D7032 */
1222 const u8 salt[16] = { 0x32, 0x70, 0x6d, 0x74 };
1224 if (smp_h7(smp->tfm_cmac, key->val, salt, smp->tk))
1227 /* From core spec. Spells out in ASCII as 'tmp2'. */
1228 const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 };
1230 if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk))
1234 if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk))
1240 static void smp_distribute_keys(struct smp_chan *smp)
1242 struct smp_cmd_pairing *req, *rsp;
1243 struct l2cap_conn *conn = smp->conn;
1244 struct hci_conn *hcon = conn->hcon;
1245 struct hci_dev *hdev = hcon->hdev;
1248 bt_dev_dbg(hdev, "conn %p", conn);
1250 rsp = (void *) &smp->prsp[1];
1252 /* The responder sends its keys first */
1253 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
1254 smp_allow_key_dist(smp);
1258 req = (void *) &smp->preq[1];
1261 keydist = &rsp->init_key_dist;
1262 *keydist &= req->init_key_dist;
1264 keydist = &rsp->resp_key_dist;
1265 *keydist &= req->resp_key_dist;
1268 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1269 if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY))
1270 sc_generate_link_key(smp);
1271 if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY))
1272 sc_generate_ltk(smp);
1274 /* Clear the keys which are generated but not distributed */
1275 *keydist &= ~SMP_SC_NO_DIST;
1278 bt_dev_dbg(hdev, "keydist 0x%x", *keydist);
1280 if (*keydist & SMP_DIST_ENC_KEY) {
1281 struct smp_cmd_encrypt_info enc;
1282 struct smp_cmd_initiator_ident ident;
1283 struct smp_ltk *ltk;
1288 /* Make sure we generate only the significant amount of
1289 * bytes based on the encryption key size, and set the rest
1290 * of the value to zeroes.
1292 get_random_bytes(enc.ltk, smp->enc_key_size);
1293 memset(enc.ltk + smp->enc_key_size, 0,
1294 sizeof(enc.ltk) - smp->enc_key_size);
1296 get_random_bytes(&ediv, sizeof(ediv));
1297 get_random_bytes(&rand, sizeof(rand));
1299 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1301 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
1302 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
1303 SMP_LTK_RESPONDER, authenticated, enc.ltk,
1304 smp->enc_key_size, ediv, rand);
1305 smp->responder_ltk = ltk;
1310 smp_send_cmd(conn, SMP_CMD_INITIATOR_IDENT, sizeof(ident),
1313 *keydist &= ~SMP_DIST_ENC_KEY;
1316 if (*keydist & SMP_DIST_ID_KEY) {
1317 struct smp_cmd_ident_addr_info addrinfo;
1318 struct smp_cmd_ident_info idinfo;
1320 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
1322 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1324 /* The hci_conn contains the local identity address
1325 * after the connection has been established.
1327 * This is true even when the connection has been
1328 * established using a resolvable random address.
1330 bacpy(&addrinfo.bdaddr, &hcon->src);
1331 addrinfo.addr_type = hcon->src_type;
1333 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
1336 *keydist &= ~SMP_DIST_ID_KEY;
1339 if (*keydist & SMP_DIST_SIGN) {
1340 struct smp_cmd_sign_info sign;
1341 struct smp_csrk *csrk;
1343 /* Generate a new random key */
1344 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1346 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1348 if (hcon->sec_level > BT_SECURITY_MEDIUM)
1349 csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED;
1351 csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED;
1352 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1354 smp->responder_csrk = csrk;
1356 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1358 *keydist &= ~SMP_DIST_SIGN;
1361 /* If there are still keys to be received wait for them */
1362 if (smp->remote_key_dist & KEY_DIST_MASK) {
1363 smp_allow_key_dist(smp);
1367 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1368 smp_notify_keys(conn);
1370 smp_chan_destroy(conn);
1373 static void smp_timeout(struct work_struct *work)
1375 struct smp_chan *smp = container_of(work, struct smp_chan,
1376 security_timer.work);
1377 struct l2cap_conn *conn = smp->conn;
1379 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
1381 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
1384 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
1386 struct hci_conn *hcon = conn->hcon;
1387 struct l2cap_chan *chan = conn->smp;
1388 struct smp_chan *smp;
1390 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
1394 smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
1395 if (IS_ERR(smp->tfm_cmac)) {
1396 bt_dev_err(hcon->hdev, "Unable to create CMAC crypto context");
1400 smp->tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
1401 if (IS_ERR(smp->tfm_ecdh)) {
1402 bt_dev_err(hcon->hdev, "Unable to create ECDH crypto context");
1409 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
1411 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
1413 hci_conn_hold(hcon);
1418 crypto_free_shash(smp->tfm_cmac);
1420 kfree_sensitive(smp);
1424 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16])
1426 struct hci_conn *hcon = smp->conn->hcon;
1427 u8 *na, *nb, a[7], b[7];
1437 memcpy(a, &hcon->init_addr, 6);
1438 memcpy(b, &hcon->resp_addr, 6);
1439 a[6] = hcon->init_addr_type;
1440 b[6] = hcon->resp_addr_type;
1442 return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk);
1445 static void sc_dhkey_check(struct smp_chan *smp)
1447 struct hci_conn *hcon = smp->conn->hcon;
1448 struct smp_cmd_dhkey_check check;
1449 u8 a[7], b[7], *local_addr, *remote_addr;
1450 u8 io_cap[3], r[16];
1452 memcpy(a, &hcon->init_addr, 6);
1453 memcpy(b, &hcon->resp_addr, 6);
1454 a[6] = hcon->init_addr_type;
1455 b[6] = hcon->resp_addr_type;
1460 memcpy(io_cap, &smp->preq[1], 3);
1464 memcpy(io_cap, &smp->prsp[1], 3);
1467 memset(r, 0, sizeof(r));
1469 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
1470 put_unaligned_le32(hcon->passkey_notify, r);
1472 if (smp->method == REQ_OOB)
1473 memcpy(r, smp->rr, 16);
1475 smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
1476 local_addr, remote_addr, check.e);
1478 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check);
1481 static u8 sc_passkey_send_confirm(struct smp_chan *smp)
1483 struct l2cap_conn *conn = smp->conn;
1484 struct hci_conn *hcon = conn->hcon;
1485 struct smp_cmd_pairing_confirm cfm;
1488 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1491 get_random_bytes(smp->prnd, sizeof(smp->prnd));
1493 if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r,
1495 return SMP_UNSPECIFIED;
1497 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
1502 static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op)
1504 struct l2cap_conn *conn = smp->conn;
1505 struct hci_conn *hcon = conn->hcon;
1506 struct hci_dev *hdev = hcon->hdev;
1509 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */
1510 if (smp->passkey_round >= 20)
1514 case SMP_CMD_PAIRING_RANDOM:
1515 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1518 if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
1520 return SMP_UNSPECIFIED;
1522 if (crypto_memneq(smp->pcnf, cfm, 16))
1523 return SMP_CONFIRM_FAILED;
1525 smp->passkey_round++;
1527 if (smp->passkey_round == 20) {
1528 /* Generate MacKey and LTK */
1529 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk))
1530 return SMP_UNSPECIFIED;
1533 /* The round is only complete when the initiator
1534 * receives pairing random.
1537 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1538 sizeof(smp->prnd), smp->prnd);
1539 if (smp->passkey_round == 20)
1540 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1542 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1546 /* Start the next round */
1547 if (smp->passkey_round != 20)
1548 return sc_passkey_round(smp, 0);
1550 /* Passkey rounds are complete - start DHKey Check */
1551 sc_dhkey_check(smp);
1552 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1556 case SMP_CMD_PAIRING_CONFIRM:
1557 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
1558 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
1562 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1565 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1566 sizeof(smp->prnd), smp->prnd);
1570 return sc_passkey_send_confirm(smp);
1572 case SMP_CMD_PUBLIC_KEY:
1574 /* Initiating device starts the round */
1578 bt_dev_dbg(hdev, "Starting passkey round %u",
1579 smp->passkey_round + 1);
1581 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1583 return sc_passkey_send_confirm(smp);
1589 static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey)
1591 struct l2cap_conn *conn = smp->conn;
1592 struct hci_conn *hcon = conn->hcon;
1595 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags);
1598 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1599 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED);
1601 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1602 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED);
1604 case MGMT_OP_USER_PASSKEY_REPLY:
1605 hcon->passkey_notify = le32_to_cpu(passkey);
1606 smp->passkey_round = 0;
1608 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags))
1609 smp_op = SMP_CMD_PAIRING_CONFIRM;
1613 if (sc_passkey_round(smp, smp_op))
1619 /* Initiator sends DHKey check first */
1621 sc_dhkey_check(smp);
1622 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1623 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) {
1624 sc_dhkey_check(smp);
1631 int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
1633 struct l2cap_conn *conn = hcon->l2cap_data;
1634 struct l2cap_chan *chan;
1635 struct smp_chan *smp;
1642 bt_dev_dbg(conn->hcon->hdev, "");
1648 l2cap_chan_lock(chan);
1656 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1657 err = sc_user_reply(smp, mgmt_op, passkey);
1662 case MGMT_OP_USER_PASSKEY_REPLY:
1663 value = le32_to_cpu(passkey);
1664 memset(smp->tk, 0, sizeof(smp->tk));
1665 bt_dev_dbg(conn->hcon->hdev, "PassKey: %u", value);
1666 put_unaligned_le32(value, smp->tk);
1668 case MGMT_OP_USER_CONFIRM_REPLY:
1669 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
1671 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1672 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1673 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1677 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1684 /* If it is our turn to send Pairing Confirm, do so now */
1685 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
1686 u8 rsp = smp_confirm(smp);
1688 smp_failure(conn, rsp);
1692 l2cap_chan_unlock(chan);
1696 static void build_bredr_pairing_cmd(struct smp_chan *smp,
1697 struct smp_cmd_pairing *req,
1698 struct smp_cmd_pairing *rsp)
1700 struct l2cap_conn *conn = smp->conn;
1701 struct hci_dev *hdev = conn->hcon->hdev;
1702 u8 local_dist = 0, remote_dist = 0;
1704 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
1705 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1706 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1709 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
1710 remote_dist |= SMP_DIST_ID_KEY;
1712 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
1713 local_dist |= SMP_DIST_ID_KEY;
1716 memset(req, 0, sizeof(*req));
1718 req->auth_req = SMP_AUTH_CT2;
1719 req->init_key_dist = local_dist;
1720 req->resp_key_dist = remote_dist;
1721 req->max_key_size = conn->hcon->enc_key_size;
1723 smp->remote_key_dist = remote_dist;
1728 memset(rsp, 0, sizeof(*rsp));
1730 rsp->auth_req = SMP_AUTH_CT2;
1731 rsp->max_key_size = conn->hcon->enc_key_size;
1732 rsp->init_key_dist = req->init_key_dist & remote_dist;
1733 rsp->resp_key_dist = req->resp_key_dist & local_dist;
1735 smp->remote_key_dist = rsp->init_key_dist;
1738 static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
1740 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
1741 struct l2cap_chan *chan = conn->smp;
1742 struct hci_dev *hdev = conn->hcon->hdev;
1743 struct smp_chan *smp;
1744 u8 key_size, auth, sec_level;
1747 bt_dev_dbg(hdev, "conn %p", conn);
1749 if (skb->len < sizeof(*req))
1750 return SMP_INVALID_PARAMS;
1752 if (conn->hcon->role != HCI_ROLE_SLAVE)
1753 return SMP_CMD_NOTSUPP;
1756 smp = smp_chan_create(conn);
1761 return SMP_UNSPECIFIED;
1763 /* We didn't start the pairing, so match remote */
1764 auth = req->auth_req & AUTH_REQ_MASK(hdev);
1766 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
1767 (auth & SMP_AUTH_BONDING))
1768 return SMP_PAIRING_NOTSUPP;
1770 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1771 return SMP_AUTH_REQUIREMENTS;
1773 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1774 memcpy(&smp->preq[1], req, sizeof(*req));
1775 skb_pull(skb, sizeof(*req));
1777 /* If the remote side's OOB flag is set it means it has
1778 * successfully received our local OOB data - therefore set the
1779 * flag to indicate that local OOB is in use.
1781 if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1782 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1784 /* SMP over BR/EDR requires special treatment */
1785 if (conn->hcon->type == ACL_LINK) {
1786 /* We must have a BR/EDR SC link */
1787 if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) &&
1788 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
1789 return SMP_CROSS_TRANSP_NOT_ALLOWED;
1791 set_bit(SMP_FLAG_SC, &smp->flags);
1793 build_bredr_pairing_cmd(smp, req, &rsp);
1795 if (req->auth_req & SMP_AUTH_CT2)
1796 set_bit(SMP_FLAG_CT2, &smp->flags);
1798 key_size = min(req->max_key_size, rsp.max_key_size);
1799 if (check_enc_key_size(conn, key_size))
1800 return SMP_ENC_KEY_SIZE;
1802 /* Clear bits which are generated but not distributed */
1803 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1805 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1806 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1807 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1809 smp_distribute_keys(smp);
1813 build_pairing_cmd(conn, req, &rsp, auth);
1815 if (rsp.auth_req & SMP_AUTH_SC) {
1816 set_bit(SMP_FLAG_SC, &smp->flags);
1818 if (rsp.auth_req & SMP_AUTH_CT2)
1819 set_bit(SMP_FLAG_CT2, &smp->flags);
1822 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1823 sec_level = BT_SECURITY_MEDIUM;
1825 sec_level = authreq_to_seclevel(auth);
1827 if (sec_level > conn->hcon->pending_sec_level)
1828 conn->hcon->pending_sec_level = sec_level;
1830 /* If we need MITM check that it can be achieved */
1831 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1834 method = get_auth_method(smp, conn->hcon->io_capability,
1835 req->io_capability);
1836 if (method == JUST_WORKS || method == JUST_CFM)
1837 return SMP_AUTH_REQUIREMENTS;
1840 key_size = min(req->max_key_size, rsp.max_key_size);
1841 if (check_enc_key_size(conn, key_size))
1842 return SMP_ENC_KEY_SIZE;
1844 get_random_bytes(smp->prnd, sizeof(smp->prnd));
1846 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1847 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1849 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1851 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
1853 /* Strictly speaking we shouldn't allow Pairing Confirm for the
1854 * SC case, however some implementations incorrectly copy RFU auth
1855 * req bits from our security request, which may create a false
1856 * positive SC enablement.
1858 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1860 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1861 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
1862 /* Clear bits which are generated but not distributed */
1863 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1864 /* Wait for Public Key from Initiating Device */
1868 /* Request setup of TK */
1869 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
1871 return SMP_UNSPECIFIED;
1876 static u8 sc_send_public_key(struct smp_chan *smp)
1878 struct hci_dev *hdev = smp->conn->hcon->hdev;
1880 bt_dev_dbg(hdev, "");
1882 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
1883 struct l2cap_chan *chan = hdev->smp_data;
1884 struct smp_dev *smp_dev;
1886 if (!chan || !chan->data)
1887 return SMP_UNSPECIFIED;
1889 smp_dev = chan->data;
1891 memcpy(smp->local_pk, smp_dev->local_pk, 64);
1892 memcpy(smp->lr, smp_dev->local_rand, 16);
1894 if (smp_dev->debug_key)
1895 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1900 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
1901 bt_dev_dbg(hdev, "Using debug keys");
1902 if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk))
1903 return SMP_UNSPECIFIED;
1904 memcpy(smp->local_pk, debug_pk, 64);
1905 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1908 /* Generate key pair for Secure Connections */
1909 if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk))
1910 return SMP_UNSPECIFIED;
1912 /* This is unlikely, but we need to check that
1913 * we didn't accidentally generate a debug key.
1915 if (crypto_memneq(smp->local_pk, debug_pk, 64))
1921 SMP_DBG("Local Public Key X: %32phN", smp->local_pk);
1922 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32);
1924 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk);
1929 static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
1931 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1932 struct l2cap_chan *chan = conn->smp;
1933 struct smp_chan *smp = chan->data;
1934 struct hci_dev *hdev = conn->hcon->hdev;
1938 bt_dev_dbg(hdev, "conn %p", conn);
1940 if (skb->len < sizeof(*rsp))
1941 return SMP_INVALID_PARAMS;
1943 if (conn->hcon->role != HCI_ROLE_MASTER)
1944 return SMP_CMD_NOTSUPP;
1946 skb_pull(skb, sizeof(*rsp));
1948 req = (void *) &smp->preq[1];
1950 key_size = min(req->max_key_size, rsp->max_key_size);
1951 if (check_enc_key_size(conn, key_size))
1952 return SMP_ENC_KEY_SIZE;
1954 auth = rsp->auth_req & AUTH_REQ_MASK(hdev);
1956 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1957 return SMP_AUTH_REQUIREMENTS;
1959 /* If the remote side's OOB flag is set it means it has
1960 * successfully received our local OOB data - therefore set the
1961 * flag to indicate that local OOB is in use.
1963 if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1964 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1966 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1967 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
1969 /* Update remote key distribution in case the remote cleared
1970 * some bits that we had enabled in our request.
1972 smp->remote_key_dist &= rsp->resp_key_dist;
1974 if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2))
1975 set_bit(SMP_FLAG_CT2, &smp->flags);
1977 /* For BR/EDR this means we're done and can start phase 3 */
1978 if (conn->hcon->type == ACL_LINK) {
1979 /* Clear bits which are generated but not distributed */
1980 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1981 smp_distribute_keys(smp);
1985 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC))
1986 set_bit(SMP_FLAG_SC, &smp->flags);
1987 else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH)
1988 conn->hcon->pending_sec_level = BT_SECURITY_HIGH;
1990 /* If we need MITM check that it can be achieved */
1991 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1994 method = get_auth_method(smp, req->io_capability,
1995 rsp->io_capability);
1996 if (method == JUST_WORKS || method == JUST_CFM)
1997 return SMP_AUTH_REQUIREMENTS;
2000 get_random_bytes(smp->prnd, sizeof(smp->prnd));
2002 /* Update remote key distribution in case the remote cleared
2003 * some bits that we had enabled in our request.
2005 smp->remote_key_dist &= rsp->resp_key_dist;
2007 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2008 /* Clear bits which are generated but not distributed */
2009 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
2010 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
2011 return sc_send_public_key(smp);
2014 auth |= req->auth_req;
2016 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2018 return SMP_UNSPECIFIED;
2020 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2022 /* Can't compose response until we have been confirmed */
2023 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
2024 return smp_confirm(smp);
2029 static u8 sc_check_confirm(struct smp_chan *smp)
2031 struct l2cap_conn *conn = smp->conn;
2033 bt_dev_dbg(conn->hcon->hdev, "");
2035 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2036 return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM);
2038 if (conn->hcon->out) {
2039 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2041 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2047 /* Work-around for some implementations that incorrectly copy RFU bits
2048 * from our security request and thereby create the impression that
2049 * we're doing SC when in fact the remote doesn't support it.
2051 static int fixup_sc_false_positive(struct smp_chan *smp)
2053 struct l2cap_conn *conn = smp->conn;
2054 struct hci_conn *hcon = conn->hcon;
2055 struct hci_dev *hdev = hcon->hdev;
2056 struct smp_cmd_pairing *req, *rsp;
2059 /* The issue is only observed when we're in responder role */
2061 return SMP_UNSPECIFIED;
2063 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
2064 bt_dev_err(hdev, "refusing legacy fallback in SC-only mode");
2065 return SMP_UNSPECIFIED;
2068 bt_dev_err(hdev, "trying to fall back to legacy SMP");
2070 req = (void *) &smp->preq[1];
2071 rsp = (void *) &smp->prsp[1];
2073 /* Rebuild key dist flags which may have been cleared for SC */
2074 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist);
2076 auth = req->auth_req & AUTH_REQ_MASK(hdev);
2078 if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) {
2079 bt_dev_err(hdev, "failed to fall back to legacy SMP");
2080 return SMP_UNSPECIFIED;
2083 clear_bit(SMP_FLAG_SC, &smp->flags);
2088 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
2090 struct l2cap_chan *chan = conn->smp;
2091 struct smp_chan *smp = chan->data;
2092 struct hci_conn *hcon = conn->hcon;
2093 struct hci_dev *hdev = hcon->hdev;
2095 bt_dev_dbg(hdev, "conn %p %s", conn,
2096 hcon->out ? "initiator" : "responder");
2098 if (skb->len < sizeof(smp->pcnf))
2099 return SMP_INVALID_PARAMS;
2101 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
2102 skb_pull(skb, sizeof(smp->pcnf));
2104 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2107 /* Public Key exchange must happen before any other steps */
2108 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags))
2109 return sc_check_confirm(smp);
2111 bt_dev_err(hdev, "Unexpected SMP Pairing Confirm");
2113 ret = fixup_sc_false_positive(smp);
2118 if (conn->hcon->out) {
2119 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2121 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2125 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
2126 return smp_confirm(smp);
2128 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2133 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
2135 struct l2cap_chan *chan = conn->smp;
2136 struct smp_chan *smp = chan->data;
2137 struct hci_conn *hcon = conn->hcon;
2138 u8 *pkax, *pkbx, *na, *nb, confirm_hint;
2142 bt_dev_dbg(hcon->hdev, "conn %p", conn);
2144 if (skb->len < sizeof(smp->rrnd))
2145 return SMP_INVALID_PARAMS;
2147 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
2148 skb_pull(skb, sizeof(smp->rrnd));
2150 if (!test_bit(SMP_FLAG_SC, &smp->flags))
2151 return smp_random(smp);
2154 pkax = smp->local_pk;
2155 pkbx = smp->remote_pk;
2159 pkax = smp->remote_pk;
2160 pkbx = smp->local_pk;
2165 if (smp->method == REQ_OOB) {
2167 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2168 sizeof(smp->prnd), smp->prnd);
2169 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2170 goto mackey_and_ltk;
2173 /* Passkey entry has special treatment */
2174 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2175 return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM);
2180 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
2183 return SMP_UNSPECIFIED;
2185 if (crypto_memneq(smp->pcnf, cfm, 16))
2186 return SMP_CONFIRM_FAILED;
2188 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2190 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2192 /* Only Just-Works pairing requires extra checks */
2193 if (smp->method != JUST_WORKS)
2194 goto mackey_and_ltk;
2196 /* If there already exists long term key in local host, leave
2197 * the decision to user space since the remote device could
2198 * be legitimate or malicious.
2200 if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2202 /* Set passkey to 0. The value can be any number since
2203 * it'll be ignored anyway.
2212 /* Generate MacKey and LTK */
2213 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk);
2215 return SMP_UNSPECIFIED;
2217 if (smp->method == REQ_OOB) {
2219 sc_dhkey_check(smp);
2220 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2225 err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey);
2227 return SMP_UNSPECIFIED;
2232 if (smp->method == JUST_WORKS)
2235 err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
2236 hcon->dst_type, passkey, confirm_hint);
2238 return SMP_UNSPECIFIED;
2240 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2245 static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
2247 struct smp_ltk *key;
2248 struct hci_conn *hcon = conn->hcon;
2250 key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role);
2254 if (smp_ltk_sec_level(key) < sec_level)
2257 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
2260 hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size);
2261 hcon->enc_key_size = key->enc_size;
2263 /* We never store STKs for initiator role, so clear this flag */
2264 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
2269 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
2270 enum smp_key_pref key_pref)
2272 if (sec_level == BT_SECURITY_LOW)
2275 /* If we're encrypted with an STK but the caller prefers using
2276 * LTK claim insufficient security. This way we allow the
2277 * connection to be re-encrypted with an LTK, even if the LTK
2278 * provides the same level of security. Only exception is if we
2279 * don't have an LTK (e.g. because of key distribution bits).
2281 if (key_pref == SMP_USE_LTK &&
2282 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
2283 hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role))
2286 if (hcon->sec_level >= sec_level)
2292 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
2294 struct smp_cmd_security_req *rp = (void *) skb->data;
2295 struct smp_cmd_pairing cp;
2296 struct hci_conn *hcon = conn->hcon;
2297 struct hci_dev *hdev = hcon->hdev;
2298 struct smp_chan *smp;
2301 bt_dev_dbg(hdev, "conn %p", conn);
2303 if (skb->len < sizeof(*rp))
2304 return SMP_INVALID_PARAMS;
2306 if (hcon->role != HCI_ROLE_MASTER)
2307 return SMP_CMD_NOTSUPP;
2309 auth = rp->auth_req & AUTH_REQ_MASK(hdev);
2311 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
2312 return SMP_AUTH_REQUIREMENTS;
2314 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
2315 sec_level = BT_SECURITY_MEDIUM;
2317 sec_level = authreq_to_seclevel(auth);
2319 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
2320 /* If link is already encrypted with sufficient security we
2321 * still need refresh encryption as per Core Spec 5.0 Vol 3,
2324 smp_ltk_encrypt(conn, hcon->sec_level);
2328 if (sec_level > hcon->pending_sec_level)
2329 hcon->pending_sec_level = sec_level;
2331 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2334 smp = smp_chan_create(conn);
2336 return SMP_UNSPECIFIED;
2338 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2339 (auth & SMP_AUTH_BONDING))
2340 return SMP_PAIRING_NOTSUPP;
2342 skb_pull(skb, sizeof(*rp));
2344 memset(&cp, 0, sizeof(cp));
2345 build_pairing_cmd(conn, &cp, NULL, auth);
2347 smp->preq[0] = SMP_CMD_PAIRING_REQ;
2348 memcpy(&smp->preq[1], &cp, sizeof(cp));
2350 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
2351 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
2356 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
2358 struct l2cap_conn *conn = hcon->l2cap_data;
2359 struct l2cap_chan *chan;
2360 struct smp_chan *smp;
2364 bt_dev_dbg(hcon->hdev, "conn %p hcon %p level 0x%2.2x", conn, hcon,
2367 /* This may be NULL if there's an unexpected disconnection */
2371 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
2374 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
2377 if (sec_level > hcon->pending_sec_level)
2378 hcon->pending_sec_level = sec_level;
2380 if (hcon->role == HCI_ROLE_MASTER)
2381 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2386 bt_dev_err(hcon->hdev, "security requested but not available");
2390 l2cap_chan_lock(chan);
2392 /* If SMP is already in progress ignore this request */
2398 smp = smp_chan_create(conn);
2404 authreq = seclevel_to_authreq(sec_level);
2406 if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) {
2407 authreq |= SMP_AUTH_SC;
2408 if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED))
2409 authreq |= SMP_AUTH_CT2;
2412 /* Don't attempt to set MITM if setting is overridden by debugfs
2413 * Needed to pass certification test SM/MAS/PKE/BV-01-C
2415 if (!hci_dev_test_flag(hcon->hdev, HCI_FORCE_NO_MITM)) {
2416 /* Require MITM if IO Capability allows or the security level
2419 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
2420 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2421 authreq |= SMP_AUTH_MITM;
2424 if (hcon->role == HCI_ROLE_MASTER) {
2425 struct smp_cmd_pairing cp;
2427 build_pairing_cmd(conn, &cp, NULL, authreq);
2428 smp->preq[0] = SMP_CMD_PAIRING_REQ;
2429 memcpy(&smp->preq[1], &cp, sizeof(cp));
2431 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
2432 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
2434 struct smp_cmd_security_req cp;
2435 cp.auth_req = authreq;
2436 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
2437 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
2440 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
2444 l2cap_chan_unlock(chan);
2448 int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
2451 struct hci_conn *hcon;
2452 struct l2cap_conn *conn;
2453 struct l2cap_chan *chan;
2454 struct smp_chan *smp;
2457 err = hci_remove_ltk(hdev, bdaddr, addr_type);
2458 hci_remove_irk(hdev, bdaddr, addr_type);
2460 hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type);
2464 conn = hcon->l2cap_data;
2472 l2cap_chan_lock(chan);
2476 /* Set keys to NULL to make sure smp_failure() does not try to
2477 * remove and free already invalidated rcu list entries. */
2479 smp->responder_ltk = NULL;
2480 smp->remote_irk = NULL;
2482 if (test_bit(SMP_FLAG_COMPLETE, &smp->flags))
2483 smp_failure(conn, 0);
2485 smp_failure(conn, SMP_UNSPECIFIED);
2489 l2cap_chan_unlock(chan);
2495 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
2497 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
2498 struct l2cap_chan *chan = conn->smp;
2499 struct smp_chan *smp = chan->data;
2501 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2503 if (skb->len < sizeof(*rp))
2504 return SMP_INVALID_PARAMS;
2506 /* Pairing is aborted if any blocked keys are distributed */
2507 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2509 bt_dev_warn_ratelimited(conn->hcon->hdev,
2510 "LTK blocked for %pMR",
2512 return SMP_INVALID_PARAMS;
2515 SMP_ALLOW_CMD(smp, SMP_CMD_INITIATOR_IDENT);
2517 skb_pull(skb, sizeof(*rp));
2519 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
2524 static int smp_cmd_initiator_ident(struct l2cap_conn *conn, struct sk_buff *skb)
2526 struct smp_cmd_initiator_ident *rp = (void *)skb->data;
2527 struct l2cap_chan *chan = conn->smp;
2528 struct smp_chan *smp = chan->data;
2529 struct hci_dev *hdev = conn->hcon->hdev;
2530 struct hci_conn *hcon = conn->hcon;
2531 struct smp_ltk *ltk;
2534 bt_dev_dbg(hdev, "conn %p", conn);
2536 if (skb->len < sizeof(*rp))
2537 return SMP_INVALID_PARAMS;
2539 /* Mark the information as received */
2540 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
2542 if (smp->remote_key_dist & SMP_DIST_ID_KEY)
2543 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
2544 else if (smp->remote_key_dist & SMP_DIST_SIGN)
2545 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2547 skb_pull(skb, sizeof(*rp));
2549 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2550 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
2551 authenticated, smp->tk, smp->enc_key_size,
2552 rp->ediv, rp->rand);
2554 if (!(smp->remote_key_dist & KEY_DIST_MASK))
2555 smp_distribute_keys(smp);
2560 static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
2562 struct smp_cmd_ident_info *info = (void *) skb->data;
2563 struct l2cap_chan *chan = conn->smp;
2564 struct smp_chan *smp = chan->data;
2566 bt_dev_dbg(conn->hcon->hdev, "");
2568 if (skb->len < sizeof(*info))
2569 return SMP_INVALID_PARAMS;
2571 /* Pairing is aborted if any blocked keys are distributed */
2572 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2574 bt_dev_warn_ratelimited(conn->hcon->hdev,
2575 "Identity key blocked for %pMR",
2577 return SMP_INVALID_PARAMS;
2580 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
2582 skb_pull(skb, sizeof(*info));
2584 memcpy(smp->irk, info->irk, 16);
2589 static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
2590 struct sk_buff *skb)
2592 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
2593 struct l2cap_chan *chan = conn->smp;
2594 struct smp_chan *smp = chan->data;
2595 struct hci_conn *hcon = conn->hcon;
2598 bt_dev_dbg(hcon->hdev, "");
2600 if (skb->len < sizeof(*info))
2601 return SMP_INVALID_PARAMS;
2603 /* Mark the information as received */
2604 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
2606 if (smp->remote_key_dist & SMP_DIST_SIGN)
2607 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2609 skb_pull(skb, sizeof(*info));
2611 /* Strictly speaking the Core Specification (4.1) allows sending
2612 * an empty address which would force us to rely on just the IRK
2613 * as "identity information". However, since such
2614 * implementations are not known of and in order to not over
2615 * complicate our implementation, simply pretend that we never
2616 * received an IRK for such a device.
2618 * The Identity Address must also be a Static Random or Public
2619 * Address, which hci_is_identity_address() checks for.
2621 if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
2622 !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
2623 bt_dev_err(hcon->hdev, "ignoring IRK with no identity address");
2627 /* Drop IRK if peer is using identity address during pairing but is
2628 * providing different address as identity information.
2630 * Microsoft Surface Precision Mouse is known to have this bug.
2632 if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
2633 (bacmp(&info->bdaddr, &hcon->dst) ||
2634 info->addr_type != hcon->dst_type)) {
2635 bt_dev_err(hcon->hdev,
2636 "ignoring IRK with invalid identity address");
2640 bacpy(&smp->id_addr, &info->bdaddr);
2641 smp->id_addr_type = info->addr_type;
2643 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
2644 bacpy(&rpa, &hcon->dst);
2646 bacpy(&rpa, BDADDR_ANY);
2648 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
2649 smp->id_addr_type, smp->irk, &rpa);
2652 if (!(smp->remote_key_dist & KEY_DIST_MASK))
2653 smp_distribute_keys(smp);
2658 static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
2660 struct smp_cmd_sign_info *rp = (void *) skb->data;
2661 struct l2cap_chan *chan = conn->smp;
2662 struct smp_chan *smp = chan->data;
2663 struct smp_csrk *csrk;
2665 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2667 if (skb->len < sizeof(*rp))
2668 return SMP_INVALID_PARAMS;
2670 /* Mark the information as received */
2671 smp->remote_key_dist &= ~SMP_DIST_SIGN;
2673 skb_pull(skb, sizeof(*rp));
2675 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
2677 if (conn->hcon->sec_level > BT_SECURITY_MEDIUM)
2678 csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED;
2680 csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED;
2681 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
2684 smp_distribute_keys(smp);
2689 static u8 sc_select_method(struct smp_chan *smp)
2691 struct l2cap_conn *conn = smp->conn;
2692 struct hci_conn *hcon = conn->hcon;
2693 struct smp_cmd_pairing *local, *remote;
2694 u8 local_mitm, remote_mitm, local_io, remote_io, method;
2696 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) ||
2697 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags))
2700 /* The preq/prsp contain the raw Pairing Request/Response PDUs
2701 * which are needed as inputs to some crypto functions. To get
2702 * the "struct smp_cmd_pairing" from them we need to skip the
2703 * first byte which contains the opcode.
2706 local = (void *) &smp->preq[1];
2707 remote = (void *) &smp->prsp[1];
2709 local = (void *) &smp->prsp[1];
2710 remote = (void *) &smp->preq[1];
2713 local_io = local->io_capability;
2714 remote_io = remote->io_capability;
2716 local_mitm = (local->auth_req & SMP_AUTH_MITM);
2717 remote_mitm = (remote->auth_req & SMP_AUTH_MITM);
2719 /* If either side wants MITM, look up the method from the table,
2720 * otherwise use JUST WORKS.
2722 if (local_mitm || remote_mitm)
2723 method = get_auth_method(smp, local_io, remote_io);
2725 method = JUST_WORKS;
2727 /* Don't confirm locally initiated pairing attempts */
2728 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2729 method = JUST_WORKS;
2734 static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
2736 struct smp_cmd_public_key *key = (void *) skb->data;
2737 struct hci_conn *hcon = conn->hcon;
2738 struct l2cap_chan *chan = conn->smp;
2739 struct smp_chan *smp = chan->data;
2740 struct hci_dev *hdev = hcon->hdev;
2741 struct crypto_kpp *tfm_ecdh;
2742 struct smp_cmd_pairing_confirm cfm;
2745 bt_dev_dbg(hdev, "conn %p", conn);
2747 if (skb->len < sizeof(*key))
2748 return SMP_INVALID_PARAMS;
2750 /* Check if remote and local public keys are the same and debug key is
2753 if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
2754 !crypto_memneq(key, smp->local_pk, 64)) {
2755 bt_dev_err(hdev, "Remote and local public keys are identical");
2756 return SMP_UNSPECIFIED;
2759 memcpy(smp->remote_pk, key, 64);
2761 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {
2762 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk,
2763 smp->rr, 0, cfm.confirm_val);
2765 return SMP_UNSPECIFIED;
2767 if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16))
2768 return SMP_CONFIRM_FAILED;
2771 /* Non-initiating device sends its public key after receiving
2772 * the key from the initiating device.
2775 err = sc_send_public_key(smp);
2780 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk);
2781 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32);
2783 /* Compute the shared secret on the same crypto tfm on which the private
2784 * key was set/generated.
2786 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
2787 struct l2cap_chan *hchan = hdev->smp_data;
2788 struct smp_dev *smp_dev;
2790 if (!hchan || !hchan->data)
2791 return SMP_UNSPECIFIED;
2793 smp_dev = hchan->data;
2795 tfm_ecdh = smp_dev->tfm_ecdh;
2797 tfm_ecdh = smp->tfm_ecdh;
2800 if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey))
2801 return SMP_UNSPECIFIED;
2803 SMP_DBG("DHKey %32phN", smp->dhkey);
2805 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags);
2807 smp->method = sc_select_method(smp);
2809 bt_dev_dbg(hdev, "selected method 0x%02x", smp->method);
2811 /* JUST_WORKS and JUST_CFM result in an unauthenticated key */
2812 if (smp->method == JUST_WORKS || smp->method == JUST_CFM)
2813 hcon->pending_sec_level = BT_SECURITY_MEDIUM;
2815 hcon->pending_sec_level = BT_SECURITY_FIPS;
2817 if (!crypto_memneq(debug_pk, smp->remote_pk, 64))
2818 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
2820 if (smp->method == DSP_PASSKEY) {
2821 get_random_bytes(&hcon->passkey_notify,
2822 sizeof(hcon->passkey_notify));
2823 hcon->passkey_notify %= 1000000;
2824 hcon->passkey_entered = 0;
2825 smp->passkey_round = 0;
2826 if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type,
2828 hcon->passkey_notify,
2829 hcon->passkey_entered))
2830 return SMP_UNSPECIFIED;
2831 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2832 return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY);
2835 if (smp->method == REQ_OOB) {
2837 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2838 sizeof(smp->prnd), smp->prnd);
2840 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2846 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2848 if (smp->method == REQ_PASSKEY) {
2849 if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type,
2851 return SMP_UNSPECIFIED;
2852 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2853 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2857 /* The Initiating device waits for the non-initiating device to
2858 * send the confirm value.
2860 if (conn->hcon->out)
2863 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd,
2864 0, cfm.confirm_val);
2866 return SMP_UNSPECIFIED;
2868 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
2869 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2874 static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
2876 struct smp_cmd_dhkey_check *check = (void *) skb->data;
2877 struct l2cap_chan *chan = conn->smp;
2878 struct hci_conn *hcon = conn->hcon;
2879 struct smp_chan *smp = chan->data;
2880 u8 a[7], b[7], *local_addr, *remote_addr;
2881 u8 io_cap[3], r[16], e[16];
2884 bt_dev_dbg(hcon->hdev, "conn %p", conn);
2886 if (skb->len < sizeof(*check))
2887 return SMP_INVALID_PARAMS;
2889 memcpy(a, &hcon->init_addr, 6);
2890 memcpy(b, &hcon->resp_addr, 6);
2891 a[6] = hcon->init_addr_type;
2892 b[6] = hcon->resp_addr_type;
2897 memcpy(io_cap, &smp->prsp[1], 3);
2901 memcpy(io_cap, &smp->preq[1], 3);
2904 memset(r, 0, sizeof(r));
2906 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2907 put_unaligned_le32(hcon->passkey_notify, r);
2908 else if (smp->method == REQ_OOB)
2909 memcpy(r, smp->lr, 16);
2911 err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r,
2912 io_cap, remote_addr, local_addr, e);
2914 return SMP_UNSPECIFIED;
2916 if (crypto_memneq(check->e, e, 16))
2917 return SMP_DHKEY_CHECK_FAILED;
2920 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
2921 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags);
2925 /* Responder sends DHKey check as response to initiator */
2926 sc_dhkey_check(smp);
2932 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size);
2933 hcon->enc_key_size = smp->enc_key_size;
2939 static int smp_cmd_keypress_notify(struct l2cap_conn *conn,
2940 struct sk_buff *skb)
2942 struct smp_cmd_keypress_notify *kp = (void *) skb->data;
2944 bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value);
2949 static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
2951 struct l2cap_conn *conn = chan->conn;
2952 struct hci_conn *hcon = conn->hcon;
2953 struct smp_chan *smp;
2960 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) {
2961 reason = SMP_PAIRING_NOTSUPP;
2965 code = skb->data[0];
2966 skb_pull(skb, sizeof(code));
2970 if (code > SMP_CMD_MAX)
2973 if (smp && !test_and_clear_bit(code, &smp->allow_cmd))
2976 /* If we don't have a context the only allowed commands are
2977 * pairing request and security request.
2979 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
2983 case SMP_CMD_PAIRING_REQ:
2984 reason = smp_cmd_pairing_req(conn, skb);
2987 case SMP_CMD_PAIRING_FAIL:
2988 smp_failure(conn, 0);
2992 case SMP_CMD_PAIRING_RSP:
2993 reason = smp_cmd_pairing_rsp(conn, skb);
2996 case SMP_CMD_SECURITY_REQ:
2997 reason = smp_cmd_security_req(conn, skb);
3000 case SMP_CMD_PAIRING_CONFIRM:
3001 reason = smp_cmd_pairing_confirm(conn, skb);
3004 case SMP_CMD_PAIRING_RANDOM:
3005 reason = smp_cmd_pairing_random(conn, skb);
3008 case SMP_CMD_ENCRYPT_INFO:
3009 reason = smp_cmd_encrypt_info(conn, skb);
3012 case SMP_CMD_INITIATOR_IDENT:
3013 reason = smp_cmd_initiator_ident(conn, skb);
3016 case SMP_CMD_IDENT_INFO:
3017 reason = smp_cmd_ident_info(conn, skb);
3020 case SMP_CMD_IDENT_ADDR_INFO:
3021 reason = smp_cmd_ident_addr_info(conn, skb);
3024 case SMP_CMD_SIGN_INFO:
3025 reason = smp_cmd_sign_info(conn, skb);
3028 case SMP_CMD_PUBLIC_KEY:
3029 reason = smp_cmd_public_key(conn, skb);
3032 case SMP_CMD_DHKEY_CHECK:
3033 reason = smp_cmd_dhkey_check(conn, skb);
3036 case SMP_CMD_KEYPRESS_NOTIFY:
3037 reason = smp_cmd_keypress_notify(conn, skb);
3041 bt_dev_dbg(hcon->hdev, "Unknown command code 0x%2.2x", code);
3042 reason = SMP_CMD_NOTSUPP;
3049 smp_failure(conn, reason);
3056 bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR",
3062 static void smp_teardown_cb(struct l2cap_chan *chan, int err)
3064 struct l2cap_conn *conn = chan->conn;
3066 bt_dev_dbg(conn->hcon->hdev, "chan %p", chan);
3069 smp_chan_destroy(conn);
3072 l2cap_chan_put(chan);
3075 static void bredr_pairing(struct l2cap_chan *chan)
3077 struct l2cap_conn *conn = chan->conn;
3078 struct hci_conn *hcon = conn->hcon;
3079 struct hci_dev *hdev = hcon->hdev;
3080 struct smp_cmd_pairing req;
3081 struct smp_chan *smp;
3083 bt_dev_dbg(hdev, "chan %p", chan);
3085 /* Only new pairings are interesting */
3086 if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags))
3089 /* Don't bother if we're not encrypted */
3090 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3093 /* Only initiator may initiate SMP over BR/EDR */
3094 if (hcon->role != HCI_ROLE_MASTER)
3097 /* Secure Connections support must be enabled */
3098 if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED))
3101 /* BR/EDR must use Secure Connections for SMP */
3102 if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) &&
3103 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3106 /* If our LE support is not enabled don't do anything */
3107 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
3110 /* Don't bother if remote LE support is not enabled */
3111 if (!lmp_host_le_capable(hcon))
3114 /* Remote must support SMP fixed chan for BR/EDR */
3115 if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR))
3118 /* Don't bother if SMP is already ongoing */
3122 smp = smp_chan_create(conn);
3124 bt_dev_err(hdev, "unable to create SMP context for BR/EDR");
3128 set_bit(SMP_FLAG_SC, &smp->flags);
3130 bt_dev_dbg(hdev, "starting SMP over BR/EDR");
3132 /* Prepare and send the BR/EDR SMP Pairing Request */
3133 build_bredr_pairing_cmd(smp, &req, NULL);
3135 smp->preq[0] = SMP_CMD_PAIRING_REQ;
3136 memcpy(&smp->preq[1], &req, sizeof(req));
3138 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(req), &req);
3139 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
3142 static void smp_resume_cb(struct l2cap_chan *chan)
3144 struct smp_chan *smp = chan->data;
3145 struct l2cap_conn *conn = chan->conn;
3146 struct hci_conn *hcon = conn->hcon;
3148 bt_dev_dbg(hcon->hdev, "chan %p", chan);
3150 if (hcon->type == ACL_LINK) {
3151 bredr_pairing(chan);
3158 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3161 cancel_delayed_work(&smp->security_timer);
3163 smp_distribute_keys(smp);
3166 static void smp_ready_cb(struct l2cap_chan *chan)
3168 struct l2cap_conn *conn = chan->conn;
3169 struct hci_conn *hcon = conn->hcon;
3171 bt_dev_dbg(hcon->hdev, "chan %p", chan);
3173 /* No need to call l2cap_chan_hold() here since we already own
3174 * the reference taken in smp_new_conn_cb(). This is just the
3175 * first time that we tie it to a specific pointer. The code in
3176 * l2cap_core.c ensures that there's no risk this function wont
3177 * get called if smp_new_conn_cb was previously called.
3181 if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3182 bredr_pairing(chan);
3185 static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
3189 bt_dev_dbg(chan->conn->hcon->hdev, "chan %p", chan);
3191 err = smp_sig_channel(chan, skb);
3193 struct smp_chan *smp = chan->data;
3196 cancel_delayed_work_sync(&smp->security_timer);
3198 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
3204 static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
3205 unsigned long hdr_len,
3206 unsigned long len, int nb)
3208 struct sk_buff *skb;
3210 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
3212 return ERR_PTR(-ENOMEM);
3214 skb->priority = HCI_PRIO_MAX;
3215 bt_cb(skb)->l2cap.chan = chan;
3220 static const struct l2cap_ops smp_chan_ops = {
3221 .name = "Security Manager",
3222 .ready = smp_ready_cb,
3223 .recv = smp_recv_cb,
3224 .alloc_skb = smp_alloc_skb_cb,
3225 .teardown = smp_teardown_cb,
3226 .resume = smp_resume_cb,
3228 .new_connection = l2cap_chan_no_new_connection,
3229 .state_change = l2cap_chan_no_state_change,
3230 .close = l2cap_chan_no_close,
3231 .defer = l2cap_chan_no_defer,
3232 .suspend = l2cap_chan_no_suspend,
3233 .set_shutdown = l2cap_chan_no_set_shutdown,
3234 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
3237 static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
3239 struct l2cap_chan *chan;
3241 BT_DBG("pchan %p", pchan);
3243 chan = l2cap_chan_create();
3247 chan->chan_type = pchan->chan_type;
3248 chan->ops = &smp_chan_ops;
3249 chan->scid = pchan->scid;
3250 chan->dcid = chan->scid;
3251 chan->imtu = pchan->imtu;
3252 chan->omtu = pchan->omtu;
3253 chan->mode = pchan->mode;
3255 /* Other L2CAP channels may request SMP routines in order to
3256 * change the security level. This means that the SMP channel
3257 * lock must be considered in its own category to avoid lockdep
3260 atomic_set(&chan->nesting, L2CAP_NESTING_SMP);
3262 BT_DBG("created chan %p", chan);
3267 static const struct l2cap_ops smp_root_chan_ops = {
3268 .name = "Security Manager Root",
3269 .new_connection = smp_new_conn_cb,
3271 /* None of these are implemented for the root channel */
3272 .close = l2cap_chan_no_close,
3273 .alloc_skb = l2cap_chan_no_alloc_skb,
3274 .recv = l2cap_chan_no_recv,
3275 .state_change = l2cap_chan_no_state_change,
3276 .teardown = l2cap_chan_no_teardown,
3277 .ready = l2cap_chan_no_ready,
3278 .defer = l2cap_chan_no_defer,
3279 .suspend = l2cap_chan_no_suspend,
3280 .resume = l2cap_chan_no_resume,
3281 .set_shutdown = l2cap_chan_no_set_shutdown,
3282 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
3285 static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
3287 struct l2cap_chan *chan;
3288 struct smp_dev *smp;
3289 struct crypto_shash *tfm_cmac;
3290 struct crypto_kpp *tfm_ecdh;
3292 if (cid == L2CAP_CID_SMP_BREDR) {
3297 smp = kzalloc(sizeof(*smp), GFP_KERNEL);
3299 return ERR_PTR(-ENOMEM);
3301 tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
3302 if (IS_ERR(tfm_cmac)) {
3303 bt_dev_err(hdev, "Unable to create CMAC crypto context");
3304 kfree_sensitive(smp);
3305 return ERR_CAST(tfm_cmac);
3308 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3309 if (IS_ERR(tfm_ecdh)) {
3310 bt_dev_err(hdev, "Unable to create ECDH crypto context");
3311 crypto_free_shash(tfm_cmac);
3312 kfree_sensitive(smp);
3313 return ERR_CAST(tfm_ecdh);
3316 smp->local_oob = false;
3317 smp->tfm_cmac = tfm_cmac;
3318 smp->tfm_ecdh = tfm_ecdh;
3321 chan = l2cap_chan_create();
3324 crypto_free_shash(smp->tfm_cmac);
3325 crypto_free_kpp(smp->tfm_ecdh);
3326 kfree_sensitive(smp);
3328 return ERR_PTR(-ENOMEM);
3333 l2cap_add_scid(chan, cid);
3335 l2cap_chan_set_defaults(chan);
3337 if (cid == L2CAP_CID_SMP) {
3340 hci_copy_identity_address(hdev, &chan->src, &bdaddr_type);
3342 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
3343 chan->src_type = BDADDR_LE_PUBLIC;
3345 chan->src_type = BDADDR_LE_RANDOM;
3347 bacpy(&chan->src, &hdev->bdaddr);
3348 chan->src_type = BDADDR_BREDR;
3351 chan->state = BT_LISTEN;
3352 chan->mode = L2CAP_MODE_BASIC;
3353 chan->imtu = L2CAP_DEFAULT_MTU;
3354 chan->ops = &smp_root_chan_ops;
3356 /* Set correct nesting level for a parent/listening channel */
3357 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
3362 static void smp_del_chan(struct l2cap_chan *chan)
3364 struct smp_dev *smp;
3366 BT_DBG("chan %p", chan);
3371 crypto_free_shash(smp->tfm_cmac);
3372 crypto_free_kpp(smp->tfm_ecdh);
3373 kfree_sensitive(smp);
3376 l2cap_chan_put(chan);
3379 int smp_force_bredr(struct hci_dev *hdev, bool enable)
3381 if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3385 struct l2cap_chan *chan;
3387 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3389 return PTR_ERR(chan);
3391 hdev->smp_bredr_data = chan;
3393 struct l2cap_chan *chan;
3395 chan = hdev->smp_bredr_data;
3396 hdev->smp_bredr_data = NULL;
3400 hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP);
3405 int smp_register(struct hci_dev *hdev)
3407 struct l2cap_chan *chan;
3409 bt_dev_dbg(hdev, "");
3411 /* If the controller does not support Low Energy operation, then
3412 * there is also no need to register any SMP channel.
3414 if (!lmp_le_capable(hdev))
3417 if (WARN_ON(hdev->smp_data)) {
3418 chan = hdev->smp_data;
3419 hdev->smp_data = NULL;
3423 chan = smp_add_cid(hdev, L2CAP_CID_SMP);
3425 return PTR_ERR(chan);
3427 hdev->smp_data = chan;
3429 if (!lmp_sc_capable(hdev)) {
3430 /* Flag can be already set here (due to power toggle) */
3431 if (!hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3435 if (WARN_ON(hdev->smp_bredr_data)) {
3436 chan = hdev->smp_bredr_data;
3437 hdev->smp_bredr_data = NULL;
3441 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3443 int err = PTR_ERR(chan);
3444 chan = hdev->smp_data;
3445 hdev->smp_data = NULL;
3450 hdev->smp_bredr_data = chan;
3455 void smp_unregister(struct hci_dev *hdev)
3457 struct l2cap_chan *chan;
3459 if (hdev->smp_bredr_data) {
3460 chan = hdev->smp_bredr_data;
3461 hdev->smp_bredr_data = NULL;
3465 if (hdev->smp_data) {
3466 chan = hdev->smp_data;
3467 hdev->smp_data = NULL;
3472 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP)
3474 static int __init test_debug_key(struct crypto_kpp *tfm_ecdh)
3479 err = set_ecdh_privkey(tfm_ecdh, debug_sk);
3483 err = generate_ecdh_public_key(tfm_ecdh, pk);
3487 if (crypto_memneq(pk, debug_pk, 64))
3493 static int __init test_ah(void)
3495 const u8 irk[16] = {
3496 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3497 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3498 const u8 r[3] = { 0x94, 0x81, 0x70 };
3499 const u8 exp[3] = { 0xaa, 0xfb, 0x0d };
3503 err = smp_ah(irk, r, res);
3507 if (crypto_memneq(res, exp, 3))
3513 static int __init test_c1(void)
3516 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3517 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3519 0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63,
3520 0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 };
3521 const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 };
3522 const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 };
3523 const u8 _iat = 0x01;
3524 const u8 _rat = 0x00;
3525 const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } };
3526 const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } };
3527 const u8 exp[16] = {
3528 0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2,
3529 0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e };
3533 err = smp_c1(k, r, preq, pres, _iat, &ia, _rat, &ra, res);
3537 if (crypto_memneq(res, exp, 16))
3543 static int __init test_s1(void)
3546 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3547 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3549 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 };
3551 0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 };
3552 const u8 exp[16] = {
3553 0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b,
3554 0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a };
3558 err = smp_s1(k, r1, r2, res);
3562 if (crypto_memneq(res, exp, 16))
3568 static int __init test_f4(struct crypto_shash *tfm_cmac)
3571 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3572 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3573 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3574 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3576 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3577 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3578 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3579 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3581 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3582 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3584 const u8 exp[16] = {
3585 0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1,
3586 0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 };
3590 err = smp_f4(tfm_cmac, u, v, x, z, res);
3594 if (crypto_memneq(res, exp, 16))
3600 static int __init test_f5(struct crypto_shash *tfm_cmac)
3603 0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86,
3604 0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99,
3605 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3606 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3608 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3609 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3611 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3612 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3613 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3614 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3615 const u8 exp_ltk[16] = {
3616 0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98,
3617 0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 };
3618 const u8 exp_mackey[16] = {
3619 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3620 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3621 u8 mackey[16], ltk[16];
3624 err = smp_f5(tfm_cmac, w, n1, n2, a1, a2, mackey, ltk);
3628 if (crypto_memneq(mackey, exp_mackey, 16))
3631 if (crypto_memneq(ltk, exp_ltk, 16))
3637 static int __init test_f6(struct crypto_shash *tfm_cmac)
3640 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3641 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3643 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3644 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3646 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3647 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3649 0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08,
3650 0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 };
3651 const u8 io_cap[3] = { 0x02, 0x01, 0x01 };
3652 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3653 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3654 const u8 exp[16] = {
3655 0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2,
3656 0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 };
3660 err = smp_f6(tfm_cmac, w, n1, n2, r, io_cap, a1, a2, res);
3664 if (crypto_memneq(res, exp, 16))
3670 static int __init test_g2(struct crypto_shash *tfm_cmac)
3673 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3674 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3675 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3676 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3678 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3679 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3680 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3681 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3683 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3684 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3686 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3687 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3688 const u32 exp_val = 0x2f9ed5ba % 1000000;
3692 err = smp_g2(tfm_cmac, u, v, x, y, &val);
3702 static int __init test_h6(struct crypto_shash *tfm_cmac)
3705 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3706 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3707 const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c };
3708 const u8 exp[16] = {
3709 0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8,
3710 0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d };
3714 err = smp_h6(tfm_cmac, w, key_id, res);
3718 if (crypto_memneq(res, exp, 16))
3724 static char test_smp_buffer[32];
3726 static ssize_t test_smp_read(struct file *file, char __user *user_buf,
3727 size_t count, loff_t *ppos)
3729 return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer,
3730 strlen(test_smp_buffer));
3733 static const struct file_operations test_smp_fops = {
3734 .open = simple_open,
3735 .read = test_smp_read,
3736 .llseek = default_llseek,
3739 static int __init run_selftests(struct crypto_shash *tfm_cmac,
3740 struct crypto_kpp *tfm_ecdh)
3742 ktime_t calltime, delta, rettime;
3743 unsigned long long duration;
3746 calltime = ktime_get();
3748 err = test_debug_key(tfm_ecdh);
3750 BT_ERR("debug_key test failed");
3756 BT_ERR("smp_ah test failed");
3762 BT_ERR("smp_c1 test failed");
3768 BT_ERR("smp_s1 test failed");
3772 err = test_f4(tfm_cmac);
3774 BT_ERR("smp_f4 test failed");
3778 err = test_f5(tfm_cmac);
3780 BT_ERR("smp_f5 test failed");
3784 err = test_f6(tfm_cmac);
3786 BT_ERR("smp_f6 test failed");
3790 err = test_g2(tfm_cmac);
3792 BT_ERR("smp_g2 test failed");
3796 err = test_h6(tfm_cmac);
3798 BT_ERR("smp_h6 test failed");
3802 rettime = ktime_get();
3803 delta = ktime_sub(rettime, calltime);
3804 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
3806 BT_INFO("SMP test passed in %llu usecs", duration);
3810 snprintf(test_smp_buffer, sizeof(test_smp_buffer),
3811 "PASS (%llu usecs)\n", duration);
3813 snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n");
3815 debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL,
3821 int __init bt_selftest_smp(void)
3823 struct crypto_shash *tfm_cmac;
3824 struct crypto_kpp *tfm_ecdh;
3827 tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
3828 if (IS_ERR(tfm_cmac)) {
3829 BT_ERR("Unable to create CMAC crypto context");
3830 return PTR_ERR(tfm_cmac);
3833 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3834 if (IS_ERR(tfm_ecdh)) {
3835 BT_ERR("Unable to create ECDH crypto context");
3836 crypto_free_shash(tfm_cmac);
3837 return PTR_ERR(tfm_ecdh);
3840 err = run_selftests(tfm_cmac, tfm_ecdh);
3842 crypto_free_shash(tfm_cmac);
3843 crypto_free_kpp(tfm_ecdh);