1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
5
6 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
7 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
8 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
9 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
10 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
11 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14
15 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
16 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
17 SOFTWARE IS DISCLAIMED.
18 */
19
20 #include <linux/debugfs.h>
21 #include <linux/scatterlist.h>
22 #include <crypto/aes-cbc-macs.h>
23 #include <crypto/aes.h>
24 #include <crypto/kpp.h>
25 #include <crypto/utils.h>
26
27 #include <net/bluetooth/bluetooth.h>
28 #include <net/bluetooth/hci_core.h>
29 #include <net/bluetooth/l2cap.h>
30 #include <net/bluetooth/mgmt.h>
31
32 #include "ecdh_helper.h"
33 #include "smp.h"
34
35 #define SMP_DEV(hdev) \
36 ((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data)
37
38 /* Low-level debug macros to be used for stuff that we don't want
39 * accidentally in dmesg, i.e. the values of the various crypto keys
40 * and the inputs & outputs of crypto functions.
41 */
42 #ifdef DEBUG
43 #define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \
44 ##__VA_ARGS__)
45 #else
46 #define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \
47 ##__VA_ARGS__)
48 #endif
49
50 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
51
52 /* Keys which are not distributed with Secure Connections */
53 #define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY)
54
55 #define SMP_TIMEOUT secs_to_jiffies(30)
56
57 #define ID_ADDR_TIMEOUT msecs_to_jiffies(200)
58
59 #define AUTH_REQ_MASK(dev) (hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \
60 0x3f : 0x07)
61 #define KEY_DIST_MASK 0x07
62
63 /* Maximum message length that can be passed to smp_aes_cmac */
64 #define CMAC_MSG_MAX 80
65
66 enum {
67 SMP_FLAG_TK_VALID,
68 SMP_FLAG_CFM_PENDING,
69 SMP_FLAG_MITM_AUTH,
70 SMP_FLAG_COMPLETE,
71 SMP_FLAG_INITIATOR,
72 SMP_FLAG_SC,
73 SMP_FLAG_REMOTE_PK,
74 SMP_FLAG_DEBUG_KEY,
75 SMP_FLAG_WAIT_USER,
76 SMP_FLAG_DHKEY_PENDING,
77 SMP_FLAG_REMOTE_OOB,
78 SMP_FLAG_LOCAL_OOB,
79 SMP_FLAG_CT2,
80 };
81
82 struct smp_dev {
83 /* Secure Connections OOB data */
84 bool local_oob;
85 u8 local_pk[64];
86 u8 local_rand[16];
87 bool debug_key;
88
89 struct crypto_kpp *tfm_ecdh;
90 };
91
92 struct smp_chan {
93 struct l2cap_conn *conn;
94 struct delayed_work security_timer;
95 unsigned long allow_cmd; /* Bitmask of allowed commands */
96
97 u8 preq[7]; /* SMP Pairing Request */
98 u8 prsp[7]; /* SMP Pairing Response */
99 u8 prnd[16]; /* SMP Pairing Random (local) */
100 u8 rrnd[16]; /* SMP Pairing Random (remote) */
101 u8 pcnf[16]; /* SMP Pairing Confirm */
102 u8 tk[16]; /* SMP Temporary Key */
103 u8 rr[16]; /* Remote OOB ra/rb value */
104 u8 lr[16]; /* Local OOB ra/rb value */
105 u8 enc_key_size;
106 u8 remote_key_dist;
107 bdaddr_t id_addr;
108 u8 id_addr_type;
109 u8 irk[16];
110 struct smp_csrk *csrk;
111 struct smp_csrk *responder_csrk;
112 struct smp_ltk *ltk;
113 struct smp_ltk *responder_ltk;
114 struct smp_irk *remote_irk;
115 u8 *link_key;
116 unsigned long flags;
117 u8 method;
118 u8 passkey_round;
119
120 /* Secure Connections variables */
121 u8 local_pk[64];
122 u8 remote_pk[64];
123 u8 dhkey[32];
124 u8 mackey[16];
125
126 struct crypto_kpp *tfm_ecdh;
127 };
128
129 /* These debug key values are defined in the SMP section of the core
130 * specification. debug_pk is the public debug key and debug_sk the
131 * private debug key.
132 */
133 static const u8 debug_pk[64] = {
134 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
135 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
136 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
137 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20,
138
139 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74,
140 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
141 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63,
142 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc,
143 };
144
145 static const u8 debug_sk[32] = {
146 0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58,
147 0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a,
148 0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74,
149 0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f,
150 };
151
swap_buf(const u8 * src,u8 * dst,size_t len)152 static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
153 {
154 size_t i;
155
156 for (i = 0; i < len; i++)
157 dst[len - 1 - i] = src[i];
158 }
159
160 /* The following functions map to the LE SC SMP crypto functions
161 * AES-CMAC, f4, f5, f6, g2 and h6.
162 */
163
smp_aes_cmac(const u8 k[16],const u8 * m,size_t len,u8 mac[16])164 static int smp_aes_cmac(const u8 k[16], const u8 *m, size_t len, u8 mac[16])
165 {
166 uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX];
167 struct aes_cmac_key key __cleanup(aes_cmac_zeroize_key);
168 int err;
169
170 if (len > CMAC_MSG_MAX)
171 return -EFBIG;
172
173 /* Swap key and message from LSB to MSB */
174 swap_buf(k, tmp, 16);
175 swap_buf(m, msg_msb, len);
176
177 SMP_DBG("msg (len %zu) %*phN", len, (int) len, m);
178 SMP_DBG("key %16phN", k);
179
180 err = aes_cmac_preparekey(&key, tmp, 16);
181 memzero_explicit(tmp, sizeof(tmp));
182 if (WARN_ON_ONCE(err)) /* Should never happen, as 16 is valid keylen */
183 return err;
184 aes_cmac(&key, msg_msb, len, mac_msb);
185
186 swap_buf(mac_msb, mac, 16);
187
188 SMP_DBG("mac %16phN", mac);
189
190 return 0;
191 }
192
smp_f4(const u8 u[32],const u8 v[32],const u8 x[16],u8 z,u8 res[16])193 static int smp_f4(const u8 u[32], const u8 v[32], const u8 x[16], u8 z,
194 u8 res[16])
195 {
196 u8 m[65];
197 int err;
198
199 SMP_DBG("u %32phN", u);
200 SMP_DBG("v %32phN", v);
201 SMP_DBG("x %16phN z %02x", x, z);
202
203 m[0] = z;
204 memcpy(m + 1, v, 32);
205 memcpy(m + 33, u, 32);
206
207 err = smp_aes_cmac(x, m, sizeof(m), res);
208 if (err)
209 return err;
210
211 SMP_DBG("res %16phN", res);
212
213 return err;
214 }
215
smp_f5(const u8 w[32],const u8 n1[16],const u8 n2[16],const u8 a1[7],const u8 a2[7],u8 mackey[16],u8 ltk[16])216 static int smp_f5(const u8 w[32], const u8 n1[16], const u8 n2[16],
217 const u8 a1[7], const u8 a2[7], u8 mackey[16], u8 ltk[16])
218 {
219 /* The btle, salt and length "magic" values are as defined in
220 * the SMP section of the Bluetooth core specification. In ASCII
221 * the btle value ends up being 'btle'. The salt is just a
222 * random number whereas length is the value 256 in little
223 * endian format.
224 */
225 const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 };
226 const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60,
227 0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c };
228 const u8 length[2] = { 0x00, 0x01 };
229 u8 m[53], t[16];
230 int err;
231
232 SMP_DBG("w %32phN", w);
233 SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
234 SMP_DBG("a1 %7phN a2 %7phN", a1, a2);
235
236 err = smp_aes_cmac(salt, w, 32, t);
237 if (err)
238 return err;
239
240 SMP_DBG("t %16phN", t);
241
242 memcpy(m, length, 2);
243 memcpy(m + 2, a2, 7);
244 memcpy(m + 9, a1, 7);
245 memcpy(m + 16, n2, 16);
246 memcpy(m + 32, n1, 16);
247 memcpy(m + 48, btle, 4);
248
249 m[52] = 0; /* Counter */
250
251 err = smp_aes_cmac(t, m, sizeof(m), mackey);
252 if (err)
253 return err;
254
255 SMP_DBG("mackey %16phN", mackey);
256
257 m[52] = 1; /* Counter */
258
259 err = smp_aes_cmac(t, m, sizeof(m), ltk);
260 if (err)
261 return err;
262
263 SMP_DBG("ltk %16phN", ltk);
264
265 return 0;
266 }
267
smp_f6(const u8 w[16],const u8 n1[16],const u8 n2[16],const u8 r[16],const u8 io_cap[3],const u8 a1[7],const u8 a2[7],u8 res[16])268 static int smp_f6(const u8 w[16], const u8 n1[16], const u8 n2[16],
269 const u8 r[16], const u8 io_cap[3], const u8 a1[7],
270 const u8 a2[7], u8 res[16])
271 {
272 u8 m[65];
273 int err;
274
275 SMP_DBG("w %16phN", w);
276 SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
277 SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2);
278
279 memcpy(m, a2, 7);
280 memcpy(m + 7, a1, 7);
281 memcpy(m + 14, io_cap, 3);
282 memcpy(m + 17, r, 16);
283 memcpy(m + 33, n2, 16);
284 memcpy(m + 49, n1, 16);
285
286 err = smp_aes_cmac(w, m, sizeof(m), res);
287 if (err)
288 return err;
289
290 SMP_DBG("res %16phN", res);
291
292 return err;
293 }
294
smp_g2(const u8 u[32],const u8 v[32],const u8 x[16],const u8 y[16],u32 * val)295 static int smp_g2(const u8 u[32], const u8 v[32], const u8 x[16],
296 const u8 y[16], u32 *val)
297 {
298 u8 m[80], tmp[16];
299 int err;
300
301 SMP_DBG("u %32phN", u);
302 SMP_DBG("v %32phN", v);
303 SMP_DBG("x %16phN y %16phN", x, y);
304
305 memcpy(m, y, 16);
306 memcpy(m + 16, v, 32);
307 memcpy(m + 48, u, 32);
308
309 err = smp_aes_cmac(x, m, sizeof(m), tmp);
310 if (err)
311 return err;
312
313 *val = get_unaligned_le32(tmp);
314 *val %= 1000000;
315
316 SMP_DBG("val %06u", *val);
317
318 return 0;
319 }
320
smp_h6(const u8 w[16],const u8 key_id[4],u8 res[16])321 static int smp_h6(const u8 w[16], const u8 key_id[4], u8 res[16])
322 {
323 int err;
324
325 SMP_DBG("w %16phN key_id %4phN", w, key_id);
326
327 err = smp_aes_cmac(w, key_id, 4, res);
328 if (err)
329 return err;
330
331 SMP_DBG("res %16phN", res);
332
333 return err;
334 }
335
smp_h7(const u8 w[16],const u8 salt[16],u8 res[16])336 static int smp_h7(const u8 w[16], const u8 salt[16], u8 res[16])
337 {
338 int err;
339
340 SMP_DBG("w %16phN salt %16phN", w, salt);
341
342 err = smp_aes_cmac(salt, w, 16, res);
343 if (err)
344 return err;
345
346 SMP_DBG("res %16phN", res);
347
348 return err;
349 }
350
351 /* The following functions map to the legacy SMP crypto functions e, c1,
352 * s1 and ah.
353 */
354
smp_e(const u8 * k,u8 * r)355 static int smp_e(const u8 *k, u8 *r)
356 {
357 struct aes_enckey aes;
358 uint8_t tmp[16], data[16];
359 int err;
360
361 SMP_DBG("k %16phN r %16phN", k, r);
362
363 /* The most significant octet of key corresponds to k[0] */
364 swap_buf(k, tmp, 16);
365
366 err = aes_prepareenckey(&aes, tmp, 16);
367 if (err) {
368 BT_ERR("cipher setkey failed: %d", err);
369 return err;
370 }
371
372 /* Most significant octet of plaintextData corresponds to data[0] */
373 swap_buf(r, data, 16);
374
375 aes_encrypt(&aes, data, data);
376
377 /* Most significant octet of encryptedData corresponds to data[0] */
378 swap_buf(data, r, 16);
379
380 SMP_DBG("r %16phN", r);
381
382 memzero_explicit(&aes, sizeof(aes));
383 return err;
384 }
385
smp_c1(const u8 k[16],const u8 r[16],const u8 preq[7],const u8 pres[7],u8 _iat,const bdaddr_t * ia,u8 _rat,const bdaddr_t * ra,u8 res[16])386 static int smp_c1(const u8 k[16],
387 const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat,
388 const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16])
389 {
390 u8 p1[16], p2[16];
391 int err;
392
393 SMP_DBG("k %16phN r %16phN", k, r);
394 SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra);
395 SMP_DBG("preq %7phN pres %7phN", preq, pres);
396
397 memset(p1, 0, 16);
398
399 /* p1 = pres || preq || _rat || _iat */
400 p1[0] = _iat;
401 p1[1] = _rat;
402 memcpy(p1 + 2, preq, 7);
403 memcpy(p1 + 9, pres, 7);
404
405 SMP_DBG("p1 %16phN", p1);
406
407 /* res = r XOR p1 */
408 crypto_xor_cpy(res, r, p1, sizeof(p1));
409
410 /* res = e(k, res) */
411 err = smp_e(k, res);
412 if (err) {
413 BT_ERR("Encrypt data error");
414 return err;
415 }
416
417 /* p2 = padding || ia || ra */
418 memcpy(p2, ra, 6);
419 memcpy(p2 + 6, ia, 6);
420 memset(p2 + 12, 0, 4);
421
422 SMP_DBG("p2 %16phN", p2);
423
424 /* res = res XOR p2 */
425 crypto_xor(res, p2, sizeof(p2));
426
427 /* res = e(k, res) */
428 err = smp_e(k, res);
429 if (err)
430 BT_ERR("Encrypt data error");
431
432 return err;
433 }
434
smp_s1(const u8 k[16],const u8 r1[16],const u8 r2[16],u8 _r[16])435 static int smp_s1(const u8 k[16],
436 const u8 r1[16], const u8 r2[16], u8 _r[16])
437 {
438 int err;
439
440 /* Just least significant octets from r1 and r2 are considered */
441 memcpy(_r, r2, 8);
442 memcpy(_r + 8, r1, 8);
443
444 err = smp_e(k, _r);
445 if (err)
446 BT_ERR("Encrypt data error");
447
448 return err;
449 }
450
smp_ah(const u8 irk[16],const u8 r[3],u8 res[3])451 static int smp_ah(const u8 irk[16], const u8 r[3], u8 res[3])
452 {
453 u8 _res[16];
454 int err;
455
456 /* r' = padding || r */
457 memcpy(_res, r, 3);
458 memset(_res + 3, 0, 13);
459
460 err = smp_e(irk, _res);
461 if (err) {
462 BT_ERR("Encrypt error");
463 return err;
464 }
465
466 /* The output of the random address function ah is:
467 * ah(k, r) = e(k, r') mod 2^24
468 * The output of the security function e is then truncated to 24 bits
469 * by taking the least significant 24 bits of the output of e as the
470 * result of ah.
471 */
472 memcpy(res, _res, 3);
473
474 return 0;
475 }
476
smp_irk_matches(struct hci_dev * hdev,const u8 irk[16],const bdaddr_t * bdaddr)477 bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16],
478 const bdaddr_t *bdaddr)
479 {
480 struct l2cap_chan *chan = hdev->smp_data;
481 u8 hash[3];
482 int err;
483
484 if (!chan || !chan->data)
485 return false;
486
487 bt_dev_dbg(hdev, "RPA %pMR IRK %*phN", bdaddr, 16, irk);
488
489 err = smp_ah(irk, &bdaddr->b[3], hash);
490 if (err)
491 return false;
492
493 return !crypto_memneq(bdaddr->b, hash, 3);
494 }
495
smp_generate_rpa(struct hci_dev * hdev,const u8 irk[16],bdaddr_t * rpa)496 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
497 {
498 struct l2cap_chan *chan = hdev->smp_data;
499 int err;
500
501 if (!chan || !chan->data)
502 return -EOPNOTSUPP;
503
504 get_random_bytes(&rpa->b[3], 3);
505
506 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
507 rpa->b[5] |= 0x40; /* Set second most significant bit */
508
509 err = smp_ah(irk, &rpa->b[3], rpa->b);
510 if (err < 0)
511 return err;
512
513 bt_dev_dbg(hdev, "RPA %pMR", rpa);
514
515 return 0;
516 }
517
smp_generate_oob(struct hci_dev * hdev,u8 hash[16],u8 rand[16])518 int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
519 {
520 struct l2cap_chan *chan = hdev->smp_data;
521 struct smp_dev *smp;
522 int err;
523
524 if (!chan || !chan->data)
525 return -EOPNOTSUPP;
526
527 smp = chan->data;
528
529 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
530 bt_dev_dbg(hdev, "Using debug keys");
531 err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk);
532 if (err)
533 return err;
534 memcpy(smp->local_pk, debug_pk, 64);
535 smp->debug_key = true;
536 } else {
537 while (true) {
538 /* Generate key pair for Secure Connections */
539 err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk);
540 if (err)
541 return err;
542
543 /* This is unlikely, but we need to check that
544 * we didn't accidentally generate a debug key.
545 */
546 if (crypto_memneq(smp->local_pk, debug_pk, 64))
547 break;
548 }
549 smp->debug_key = false;
550 }
551
552 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk);
553 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32);
554
555 get_random_bytes(smp->local_rand, 16);
556
557 err = smp_f4(smp->local_pk, smp->local_pk, smp->local_rand, 0, hash);
558 if (err < 0)
559 return err;
560
561 memcpy(rand, smp->local_rand, 16);
562
563 smp->local_oob = true;
564
565 return 0;
566 }
567
smp_send_cmd(struct l2cap_conn * conn,u8 code,u16 len,void * data)568 static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
569 {
570 struct l2cap_chan *chan = conn->smp;
571 struct smp_chan *smp;
572 struct kvec iv[2];
573 struct msghdr msg;
574
575 if (!chan)
576 return;
577
578 bt_dev_dbg(conn->hcon->hdev, "code 0x%2.2x", code);
579
580 iv[0].iov_base = &code;
581 iv[0].iov_len = 1;
582
583 iv[1].iov_base = data;
584 iv[1].iov_len = len;
585
586 memset(&msg, 0, sizeof(msg));
587
588 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iv, 2, 1 + len);
589
590 l2cap_chan_send(chan, &msg, 1 + len, NULL);
591
592 if (!chan->data)
593 return;
594
595 smp = chan->data;
596
597 cancel_delayed_work_sync(&smp->security_timer);
598 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
599 }
600
authreq_to_seclevel(u8 authreq)601 static u8 authreq_to_seclevel(u8 authreq)
602 {
603 if (authreq & SMP_AUTH_MITM) {
604 if (authreq & SMP_AUTH_SC)
605 return BT_SECURITY_FIPS;
606 else
607 return BT_SECURITY_HIGH;
608 } else {
609 return BT_SECURITY_MEDIUM;
610 }
611 }
612
seclevel_to_authreq(__u8 sec_level)613 static __u8 seclevel_to_authreq(__u8 sec_level)
614 {
615 switch (sec_level) {
616 case BT_SECURITY_FIPS:
617 case BT_SECURITY_HIGH:
618 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
619 case BT_SECURITY_MEDIUM:
620 return SMP_AUTH_BONDING;
621 default:
622 return SMP_AUTH_NONE;
623 }
624 }
625
build_pairing_cmd(struct l2cap_conn * conn,struct smp_cmd_pairing * req,struct smp_cmd_pairing * rsp,__u8 authreq)626 static void build_pairing_cmd(struct l2cap_conn *conn,
627 struct smp_cmd_pairing *req,
628 struct smp_cmd_pairing *rsp, __u8 authreq)
629 {
630 struct l2cap_chan *chan = conn->smp;
631 struct smp_chan *smp = chan->data;
632 struct hci_conn *hcon = conn->hcon;
633 struct hci_dev *hdev = hcon->hdev;
634 u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT;
635
636 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
637 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
638 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
639 authreq |= SMP_AUTH_BONDING;
640 } else {
641 authreq &= ~SMP_AUTH_BONDING;
642 }
643
644 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
645 remote_dist |= SMP_DIST_ID_KEY;
646
647 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
648 local_dist |= SMP_DIST_ID_KEY;
649
650 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
651 (authreq & SMP_AUTH_SC)) {
652 struct oob_data *oob_data;
653 u8 bdaddr_type;
654
655 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
656 local_dist |= SMP_DIST_LINK_KEY;
657 remote_dist |= SMP_DIST_LINK_KEY;
658 }
659
660 if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
661 bdaddr_type = BDADDR_LE_PUBLIC;
662 else
663 bdaddr_type = BDADDR_LE_RANDOM;
664
665 oob_data = hci_find_remote_oob_data(hdev, &hcon->dst,
666 bdaddr_type);
667 if (oob_data && oob_data->present) {
668 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags);
669 oob_flag = SMP_OOB_PRESENT;
670 memcpy(smp->rr, oob_data->rand256, 16);
671 memcpy(smp->pcnf, oob_data->hash256, 16);
672 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf);
673 SMP_DBG("OOB Remote Random: %16phN", smp->rr);
674 }
675
676 } else {
677 authreq &= ~SMP_AUTH_SC;
678 }
679
680 if (rsp == NULL) {
681 req->io_capability = conn->hcon->io_capability;
682 req->oob_flag = oob_flag;
683 req->max_key_size = hdev->le_max_key_size;
684 req->init_key_dist = local_dist;
685 req->resp_key_dist = remote_dist;
686 req->auth_req = (authreq & AUTH_REQ_MASK(hdev));
687
688 smp->remote_key_dist = remote_dist;
689 return;
690 }
691
692 rsp->io_capability = conn->hcon->io_capability;
693 rsp->oob_flag = oob_flag;
694 rsp->max_key_size = hdev->le_max_key_size;
695 rsp->init_key_dist = req->init_key_dist & remote_dist;
696 rsp->resp_key_dist = req->resp_key_dist & local_dist;
697 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev));
698
699 smp->remote_key_dist = rsp->init_key_dist;
700 }
701
check_enc_key_size(struct l2cap_conn * conn,__u8 max_key_size)702 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
703 {
704 struct l2cap_chan *chan = conn->smp;
705 struct hci_dev *hdev = conn->hcon->hdev;
706 struct smp_chan *smp = chan->data;
707
708 if (conn->hcon->pending_sec_level == BT_SECURITY_FIPS &&
709 max_key_size != SMP_MAX_ENC_KEY_SIZE)
710 return SMP_ENC_KEY_SIZE;
711
712 if (max_key_size > hdev->le_max_key_size ||
713 max_key_size < SMP_MIN_ENC_KEY_SIZE)
714 return SMP_ENC_KEY_SIZE;
715
716 smp->enc_key_size = max_key_size;
717
718 return 0;
719 }
720
smp_chan_destroy(struct l2cap_conn * conn)721 static void smp_chan_destroy(struct l2cap_conn *conn)
722 {
723 struct l2cap_chan *chan = conn->smp;
724 struct smp_chan *smp = chan->data;
725 struct hci_conn *hcon = conn->hcon;
726 bool complete;
727
728 BUG_ON(!smp);
729
730 cancel_delayed_work_sync(&smp->security_timer);
731
732 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
733 mgmt_smp_complete(hcon, complete);
734
735 kfree_sensitive(smp->csrk);
736 kfree_sensitive(smp->responder_csrk);
737 kfree_sensitive(smp->link_key);
738
739 crypto_free_kpp(smp->tfm_ecdh);
740
741 /* Ensure that we don't leave any debug key around if debug key
742 * support hasn't been explicitly enabled.
743 */
744 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG &&
745 !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) {
746 list_del_rcu(&smp->ltk->list);
747 kfree_rcu(smp->ltk, rcu);
748 smp->ltk = NULL;
749 }
750
751 /* If pairing failed clean up any keys we might have */
752 if (!complete) {
753 if (smp->ltk) {
754 list_del_rcu(&smp->ltk->list);
755 kfree_rcu(smp->ltk, rcu);
756 }
757
758 if (smp->responder_ltk) {
759 list_del_rcu(&smp->responder_ltk->list);
760 kfree_rcu(smp->responder_ltk, rcu);
761 }
762
763 if (smp->remote_irk) {
764 list_del_rcu(&smp->remote_irk->list);
765 kfree_rcu(smp->remote_irk, rcu);
766 }
767 }
768
769 chan->data = NULL;
770 kfree_sensitive(smp);
771 hci_conn_drop(hcon);
772 }
773
smp_failure(struct l2cap_conn * conn,u8 reason)774 static void smp_failure(struct l2cap_conn *conn, u8 reason)
775 {
776 struct hci_conn *hcon = conn->hcon;
777 struct l2cap_chan *chan = conn->smp;
778
779 if (reason)
780 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
781 &reason);
782
783 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
784
785 if (chan->data)
786 smp_chan_destroy(conn);
787 }
788
789 #define JUST_WORKS 0x00
790 #define JUST_CFM 0x01
791 #define REQ_PASSKEY 0x02
792 #define CFM_PASSKEY 0x03
793 #define REQ_OOB 0x04
794 #define DSP_PASSKEY 0x05
795 #define OVERLAP 0xFF
796
797 static const u8 gen_method[5][5] = {
798 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
799 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
800 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
801 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
802 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
803 };
804
805 static const u8 sc_method[5][5] = {
806 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
807 { JUST_WORKS, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
808 { DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY },
809 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
810 { DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
811 };
812
get_auth_method(struct smp_chan * smp,u8 local_io,u8 remote_io)813 static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
814 {
815 /* If either side has unknown io_caps, use JUST_CFM (which gets
816 * converted later to JUST_WORKS if we're initiators.
817 */
818 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
819 remote_io > SMP_IO_KEYBOARD_DISPLAY)
820 return JUST_CFM;
821
822 if (test_bit(SMP_FLAG_SC, &smp->flags))
823 return sc_method[remote_io][local_io];
824
825 return gen_method[remote_io][local_io];
826 }
827
tk_request(struct l2cap_conn * conn,u8 remote_oob,u8 auth,u8 local_io,u8 remote_io)828 static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
829 u8 local_io, u8 remote_io)
830 {
831 struct hci_conn *hcon = conn->hcon;
832 struct l2cap_chan *chan = conn->smp;
833 struct smp_chan *smp = chan->data;
834 u32 passkey = 0;
835 int ret;
836
837 /* Initialize key for JUST WORKS */
838 memset(smp->tk, 0, sizeof(smp->tk));
839 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
840
841 bt_dev_dbg(hcon->hdev, "auth:%u lcl:%u rem:%u", auth, local_io,
842 remote_io);
843
844 /* If neither side wants MITM, either "just" confirm an incoming
845 * request or use just-works for outgoing ones. The JUST_CFM
846 * will be converted to JUST_WORKS if necessary later in this
847 * function. If either side has MITM look up the method from the
848 * table.
849 */
850 if (!(auth & SMP_AUTH_MITM))
851 smp->method = JUST_CFM;
852 else
853 smp->method = get_auth_method(smp, local_io, remote_io);
854
855 /* Don't confirm locally initiated pairing attempts */
856 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
857 &smp->flags))
858 smp->method = JUST_WORKS;
859
860 /* Don't bother user space with no IO capabilities */
861 if (smp->method == JUST_CFM &&
862 hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
863 smp->method = JUST_WORKS;
864
865 /* If Just Works, Continue with Zero TK and ask user-space for
866 * confirmation */
867 if (smp->method == JUST_WORKS) {
868 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
869 hcon->type,
870 hcon->dst_type,
871 passkey, 1);
872 if (ret)
873 return ret;
874 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
875 return 0;
876 }
877
878 /* If this function is used for SC -> legacy fallback we
879 * can only recover the just-works case.
880 */
881 if (test_bit(SMP_FLAG_SC, &smp->flags))
882 return -EINVAL;
883
884 /* Not Just Works/Confirm results in MITM Authentication */
885 if (smp->method != JUST_CFM) {
886 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
887 if (hcon->pending_sec_level < BT_SECURITY_HIGH)
888 hcon->pending_sec_level = BT_SECURITY_HIGH;
889 }
890
891 /* If both devices have Keyboard-Display I/O, the initiator
892 * Confirms and the responder Enters the passkey.
893 */
894 if (smp->method == OVERLAP) {
895 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
896 smp->method = CFM_PASSKEY;
897 else
898 smp->method = REQ_PASSKEY;
899 }
900
901 /* Generate random passkey. */
902 if (smp->method == CFM_PASSKEY) {
903 memset(smp->tk, 0, sizeof(smp->tk));
904 get_random_bytes(&passkey, sizeof(passkey));
905 passkey %= 1000000;
906 put_unaligned_le32(passkey, smp->tk);
907 bt_dev_dbg(hcon->hdev, "PassKey: %u", passkey);
908 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
909 }
910
911 if (smp->method == REQ_PASSKEY)
912 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
913 hcon->type, hcon->dst_type);
914 else if (smp->method == JUST_CFM)
915 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
916 hcon->type, hcon->dst_type,
917 passkey, 1);
918 else
919 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
920 hcon->type, hcon->dst_type,
921 passkey, 0);
922
923 return ret;
924 }
925
smp_confirm(struct smp_chan * smp)926 static u8 smp_confirm(struct smp_chan *smp)
927 {
928 struct l2cap_conn *conn = smp->conn;
929 struct smp_cmd_pairing_confirm cp;
930 int ret;
931
932 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
933
934 ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp,
935 conn->hcon->init_addr_type, &conn->hcon->init_addr,
936 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
937 cp.confirm_val);
938 if (ret)
939 return SMP_UNSPECIFIED;
940
941 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
942
943 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
944
945 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
946 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
947 else
948 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
949
950 return 0;
951 }
952
smp_random(struct smp_chan * smp)953 static u8 smp_random(struct smp_chan *smp)
954 {
955 struct l2cap_conn *conn = smp->conn;
956 struct hci_conn *hcon = conn->hcon;
957 u8 confirm[16];
958 int ret;
959
960 bt_dev_dbg(conn->hcon->hdev, "conn %p %s", conn,
961 test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" :
962 "responder");
963
964 ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp,
965 hcon->init_addr_type, &hcon->init_addr,
966 hcon->resp_addr_type, &hcon->resp_addr, confirm);
967 if (ret)
968 return SMP_UNSPECIFIED;
969
970 if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
971 bt_dev_err(hcon->hdev, "pairing failed "
972 "(confirmation values mismatch)");
973 return SMP_CONFIRM_FAILED;
974 }
975
976 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
977 u8 stk[16];
978 __le64 rand = 0;
979 __le16 ediv = 0;
980
981 smp_s1(smp->tk, smp->rrnd, smp->prnd, stk);
982
983 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
984 return SMP_UNSPECIFIED;
985
986 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size);
987 hcon->enc_key_size = smp->enc_key_size;
988 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
989 } else {
990 u8 stk[16], auth;
991 __le64 rand = 0;
992 __le16 ediv = 0;
993
994 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
995 smp->prnd);
996
997 smp_s1(smp->tk, smp->prnd, smp->rrnd, stk);
998
999 auth = test_bit(SMP_FLAG_MITM_AUTH, &smp->flags) ? 1 : 0;
1000
1001 /* Even though there's no _RESPONDER suffix this is the
1002 * responder STK we're adding for later lookup (the initiator
1003 * STK never needs to be stored).
1004 */
1005 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1006 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
1007 }
1008
1009 return 0;
1010 }
1011
smp_notify_keys(struct l2cap_conn * conn)1012 static void smp_notify_keys(struct l2cap_conn *conn)
1013 {
1014 struct l2cap_chan *chan = conn->smp;
1015 struct smp_chan *smp = chan->data;
1016 struct hci_conn *hcon = conn->hcon;
1017 struct hci_dev *hdev = hcon->hdev;
1018 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1019 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1020 bool persistent;
1021
1022 if (hcon->type == ACL_LINK) {
1023 if (hcon->key_type == HCI_LK_DEBUG_COMBINATION)
1024 persistent = false;
1025 else
1026 persistent = !test_bit(HCI_CONN_FLUSH_KEY,
1027 &hcon->flags);
1028 } else {
1029 /* The LTKs, IRKs and CSRKs should be persistent only if
1030 * both sides had the bonding bit set in their
1031 * authentication requests.
1032 */
1033 persistent = !!((req->auth_req & rsp->auth_req) &
1034 SMP_AUTH_BONDING);
1035 }
1036
1037 if (smp->remote_irk) {
1038 mgmt_new_irk(hdev, smp->remote_irk, persistent);
1039
1040 /* Now that user space can be considered to know the
1041 * identity address track the connection based on it
1042 * from now on (assuming this is an LE link).
1043 */
1044 if (hcon->type == LE_LINK) {
1045 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1046 hcon->dst_type = smp->remote_irk->addr_type;
1047 /* Use a short delay to make sure the new address is
1048 * propagated _before_ the channels.
1049 */
1050 queue_delayed_work(hdev->workqueue,
1051 &conn->id_addr_timer,
1052 ID_ADDR_TIMEOUT);
1053 }
1054 }
1055
1056 if (smp->csrk) {
1057 smp->csrk->bdaddr_type = hcon->dst_type;
1058 bacpy(&smp->csrk->bdaddr, &hcon->dst);
1059 mgmt_new_csrk(hdev, smp->csrk, persistent);
1060 }
1061
1062 if (smp->responder_csrk) {
1063 smp->responder_csrk->bdaddr_type = hcon->dst_type;
1064 bacpy(&smp->responder_csrk->bdaddr, &hcon->dst);
1065 mgmt_new_csrk(hdev, smp->responder_csrk, persistent);
1066 }
1067
1068 if (smp->ltk) {
1069 smp->ltk->bdaddr_type = hcon->dst_type;
1070 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1071 mgmt_new_ltk(hdev, smp->ltk, persistent);
1072 }
1073
1074 if (smp->responder_ltk) {
1075 smp->responder_ltk->bdaddr_type = hcon->dst_type;
1076 bacpy(&smp->responder_ltk->bdaddr, &hcon->dst);
1077 mgmt_new_ltk(hdev, smp->responder_ltk, persistent);
1078 }
1079
1080 if (smp->link_key) {
1081 struct link_key *key;
1082 u8 type;
1083
1084 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1085 type = HCI_LK_DEBUG_COMBINATION;
1086 else if (hcon->sec_level == BT_SECURITY_FIPS)
1087 type = HCI_LK_AUTH_COMBINATION_P256;
1088 else
1089 type = HCI_LK_UNAUTH_COMBINATION_P256;
1090
1091 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst,
1092 smp->link_key, type, 0, &persistent);
1093 if (key) {
1094 mgmt_new_link_key(hdev, key, persistent);
1095
1096 /* Don't keep debug keys around if the relevant
1097 * flag is not set.
1098 */
1099 if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) &&
1100 key->type == HCI_LK_DEBUG_COMBINATION) {
1101 list_del_rcu(&key->list);
1102 kfree_rcu(key, rcu);
1103 }
1104 }
1105 }
1106 }
1107
sc_add_ltk(struct smp_chan * smp)1108 static void sc_add_ltk(struct smp_chan *smp)
1109 {
1110 struct hci_conn *hcon = smp->conn->hcon;
1111 u8 key_type, auth;
1112
1113 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1114 key_type = SMP_LTK_P256_DEBUG;
1115 else
1116 key_type = SMP_LTK_P256;
1117
1118 if (hcon->pending_sec_level == BT_SECURITY_FIPS)
1119 auth = 1;
1120 else
1121 auth = 0;
1122
1123 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1124 key_type, auth, smp->tk, smp->enc_key_size,
1125 0, 0);
1126 }
1127
sc_generate_link_key(struct smp_chan * smp)1128 static void sc_generate_link_key(struct smp_chan *smp)
1129 {
1130 /* From core spec. Spells out in ASCII as 'lebr'. */
1131 const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c };
1132
1133 smp->link_key = kzalloc(16, GFP_KERNEL);
1134 if (!smp->link_key)
1135 return;
1136
1137 if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1138 /* SALT = 0x000000000000000000000000746D7031 */
1139 const u8 salt[16] = { 0x31, 0x70, 0x6d, 0x74 };
1140
1141 if (smp_h7(smp->tk, salt, smp->link_key)) {
1142 kfree_sensitive(smp->link_key);
1143 smp->link_key = NULL;
1144 return;
1145 }
1146 } else {
1147 /* From core spec. Spells out in ASCII as 'tmp1'. */
1148 const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 };
1149
1150 if (smp_h6(smp->tk, tmp1, smp->link_key)) {
1151 kfree_sensitive(smp->link_key);
1152 smp->link_key = NULL;
1153 return;
1154 }
1155 }
1156
1157 if (smp_h6(smp->link_key, lebr, smp->link_key)) {
1158 kfree_sensitive(smp->link_key);
1159 smp->link_key = NULL;
1160 return;
1161 }
1162 }
1163
smp_allow_key_dist(struct smp_chan * smp)1164 static void smp_allow_key_dist(struct smp_chan *smp)
1165 {
1166 /* Allow the first expected phase 3 PDU. The rest of the PDUs
1167 * will be allowed in each PDU handler to ensure we receive
1168 * them in the correct order.
1169 */
1170 if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
1171 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
1172 else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1173 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
1174 else if (smp->remote_key_dist & SMP_DIST_SIGN)
1175 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1176 }
1177
sc_generate_ltk(struct smp_chan * smp)1178 static void sc_generate_ltk(struct smp_chan *smp)
1179 {
1180 /* From core spec. Spells out in ASCII as 'brle'. */
1181 const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 };
1182 struct hci_conn *hcon = smp->conn->hcon;
1183 struct hci_dev *hdev = hcon->hdev;
1184 struct link_key *key;
1185
1186 key = hci_find_link_key(hdev, &hcon->dst);
1187 if (!key) {
1188 bt_dev_err(hdev, "no Link Key found to generate LTK");
1189 return;
1190 }
1191
1192 if (key->type == HCI_LK_DEBUG_COMBINATION)
1193 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1194
1195 if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1196 /* SALT = 0x000000000000000000000000746D7032 */
1197 const u8 salt[16] = { 0x32, 0x70, 0x6d, 0x74 };
1198
1199 if (smp_h7(key->val, salt, smp->tk))
1200 return;
1201 } else {
1202 /* From core spec. Spells out in ASCII as 'tmp2'. */
1203 const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 };
1204
1205 if (smp_h6(key->val, tmp2, smp->tk))
1206 return;
1207 }
1208
1209 if (smp_h6(smp->tk, brle, smp->tk))
1210 return;
1211
1212 sc_add_ltk(smp);
1213 }
1214
smp_distribute_keys(struct smp_chan * smp)1215 static void smp_distribute_keys(struct smp_chan *smp)
1216 {
1217 struct smp_cmd_pairing *req, *rsp;
1218 struct l2cap_conn *conn = smp->conn;
1219 struct hci_conn *hcon = conn->hcon;
1220 struct hci_dev *hdev = hcon->hdev;
1221 __u8 *keydist;
1222
1223 bt_dev_dbg(hdev, "conn %p", conn);
1224
1225 rsp = (void *) &smp->prsp[1];
1226
1227 /* The responder sends its keys first */
1228 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags) &&
1229 (smp->remote_key_dist & KEY_DIST_MASK)) {
1230 smp_allow_key_dist(smp);
1231 return;
1232 }
1233
1234 req = (void *) &smp->preq[1];
1235
1236 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1237 keydist = &rsp->init_key_dist;
1238 *keydist &= req->init_key_dist;
1239 } else {
1240 keydist = &rsp->resp_key_dist;
1241 *keydist &= req->resp_key_dist;
1242 }
1243
1244 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1245 if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY))
1246 sc_generate_link_key(smp);
1247 if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY))
1248 sc_generate_ltk(smp);
1249
1250 /* Clear the keys which are generated but not distributed */
1251 *keydist &= ~SMP_SC_NO_DIST;
1252 }
1253
1254 bt_dev_dbg(hdev, "keydist 0x%x", *keydist);
1255
1256 if (*keydist & SMP_DIST_ENC_KEY) {
1257 struct smp_cmd_encrypt_info enc;
1258 struct smp_cmd_initiator_ident ident;
1259 struct smp_ltk *ltk;
1260 u8 authenticated;
1261 __le16 ediv;
1262 __le64 rand;
1263
1264 /* Make sure we generate only the significant amount of
1265 * bytes based on the encryption key size, and set the rest
1266 * of the value to zeroes.
1267 */
1268 get_random_bytes(enc.ltk, smp->enc_key_size);
1269 memset(enc.ltk + smp->enc_key_size, 0,
1270 sizeof(enc.ltk) - smp->enc_key_size);
1271
1272 get_random_bytes(&ediv, sizeof(ediv));
1273 get_random_bytes(&rand, sizeof(rand));
1274
1275 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1276
1277 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
1278 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
1279 SMP_LTK_RESPONDER, authenticated, enc.ltk,
1280 smp->enc_key_size, ediv, rand);
1281 smp->responder_ltk = ltk;
1282
1283 ident.ediv = ediv;
1284 ident.rand = rand;
1285
1286 smp_send_cmd(conn, SMP_CMD_INITIATOR_IDENT, sizeof(ident),
1287 &ident);
1288
1289 *keydist &= ~SMP_DIST_ENC_KEY;
1290 }
1291
1292 if (*keydist & SMP_DIST_ID_KEY) {
1293 struct smp_cmd_ident_addr_info addrinfo;
1294 struct smp_cmd_ident_info idinfo;
1295
1296 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
1297
1298 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1299
1300 /* The hci_conn contains the local identity address
1301 * after the connection has been established.
1302 *
1303 * This is true even when the connection has been
1304 * established using a resolvable random address.
1305 */
1306 bacpy(&addrinfo.bdaddr, &hcon->src);
1307 addrinfo.addr_type = hcon->src_type;
1308
1309 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
1310 &addrinfo);
1311
1312 *keydist &= ~SMP_DIST_ID_KEY;
1313 }
1314
1315 if (*keydist & SMP_DIST_SIGN) {
1316 struct smp_cmd_sign_info sign;
1317 struct smp_csrk *csrk;
1318
1319 /* Generate a new random key */
1320 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1321
1322 csrk = kzalloc_obj(*csrk);
1323 if (csrk) {
1324 if (hcon->sec_level > BT_SECURITY_MEDIUM)
1325 csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED;
1326 else
1327 csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED;
1328 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1329 }
1330 smp->responder_csrk = csrk;
1331
1332 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1333
1334 *keydist &= ~SMP_DIST_SIGN;
1335 }
1336
1337 /* If there are still keys to be received wait for them */
1338 if (smp->remote_key_dist & KEY_DIST_MASK) {
1339 smp_allow_key_dist(smp);
1340 return;
1341 }
1342
1343 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1344 smp_notify_keys(conn);
1345
1346 smp_chan_destroy(conn);
1347 }
1348
smp_timeout(struct work_struct * work)1349 static void smp_timeout(struct work_struct *work)
1350 {
1351 struct smp_chan *smp = container_of(work, struct smp_chan,
1352 security_timer.work);
1353 struct l2cap_conn *conn = smp->conn;
1354
1355 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
1356
1357 hci_disconnect(conn->hcon, HCI_ERROR_AUTH_FAILURE);
1358 }
1359
smp_chan_create(struct l2cap_conn * conn)1360 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
1361 {
1362 struct hci_conn *hcon = conn->hcon;
1363 struct l2cap_chan *chan = conn->smp;
1364 struct smp_chan *smp;
1365
1366 smp = kzalloc_obj(*smp, GFP_ATOMIC);
1367 if (!smp)
1368 return NULL;
1369
1370 smp->tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
1371 if (IS_ERR(smp->tfm_ecdh)) {
1372 bt_dev_err(hcon->hdev, "Unable to create ECDH crypto context");
1373 goto zfree_smp;
1374 }
1375
1376 smp->conn = conn;
1377 chan->data = smp;
1378
1379 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
1380
1381 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
1382
1383 hci_conn_hold(hcon);
1384
1385 return smp;
1386
1387 zfree_smp:
1388 kfree_sensitive(smp);
1389 return NULL;
1390 }
1391
sc_mackey_and_ltk(struct smp_chan * smp,u8 mackey[16],u8 ltk[16])1392 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16])
1393 {
1394 struct hci_conn *hcon = smp->conn->hcon;
1395 u8 *na, *nb, a[7], b[7];
1396
1397 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1398 na = smp->prnd;
1399 nb = smp->rrnd;
1400 } else {
1401 na = smp->rrnd;
1402 nb = smp->prnd;
1403 }
1404
1405 memcpy(a, &hcon->init_addr, 6);
1406 memcpy(b, &hcon->resp_addr, 6);
1407 a[6] = hcon->init_addr_type;
1408 b[6] = hcon->resp_addr_type;
1409
1410 return smp_f5(smp->dhkey, na, nb, a, b, mackey, ltk);
1411 }
1412
sc_dhkey_check(struct smp_chan * smp)1413 static void sc_dhkey_check(struct smp_chan *smp)
1414 {
1415 struct hci_conn *hcon = smp->conn->hcon;
1416 struct smp_cmd_dhkey_check check;
1417 u8 a[7], b[7], *local_addr, *remote_addr;
1418 u8 io_cap[3], r[16];
1419
1420 memcpy(a, &hcon->init_addr, 6);
1421 memcpy(b, &hcon->resp_addr, 6);
1422 a[6] = hcon->init_addr_type;
1423 b[6] = hcon->resp_addr_type;
1424
1425 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1426 local_addr = a;
1427 remote_addr = b;
1428 memcpy(io_cap, &smp->preq[1], 3);
1429 } else {
1430 local_addr = b;
1431 remote_addr = a;
1432 memcpy(io_cap, &smp->prsp[1], 3);
1433 }
1434
1435 memset(r, 0, sizeof(r));
1436
1437 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
1438 put_unaligned_le32(hcon->passkey_notify, r);
1439
1440 if (smp->method == REQ_OOB)
1441 memcpy(r, smp->rr, 16);
1442
1443 smp_f6(smp->mackey, smp->prnd, smp->rrnd, r, io_cap, local_addr,
1444 remote_addr, check.e);
1445
1446 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check);
1447 }
1448
sc_passkey_send_confirm(struct smp_chan * smp)1449 static u8 sc_passkey_send_confirm(struct smp_chan *smp)
1450 {
1451 struct l2cap_conn *conn = smp->conn;
1452 struct hci_conn *hcon = conn->hcon;
1453 struct smp_cmd_pairing_confirm cfm;
1454 u8 r;
1455
1456 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1457 r |= 0x80;
1458
1459 get_random_bytes(smp->prnd, sizeof(smp->prnd));
1460
1461 if (smp_f4(smp->local_pk, smp->remote_pk, smp->prnd, r,
1462 cfm.confirm_val))
1463 return SMP_UNSPECIFIED;
1464
1465 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
1466
1467 return 0;
1468 }
1469
sc_passkey_round(struct smp_chan * smp,u8 smp_op)1470 static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op)
1471 {
1472 struct l2cap_conn *conn = smp->conn;
1473 struct hci_conn *hcon = conn->hcon;
1474 struct hci_dev *hdev = hcon->hdev;
1475 u8 cfm[16], r;
1476
1477 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */
1478 if (smp->passkey_round >= 20)
1479 return 0;
1480
1481 switch (smp_op) {
1482 case SMP_CMD_PAIRING_RANDOM:
1483 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1484 r |= 0x80;
1485
1486 if (smp_f4(smp->remote_pk, smp->local_pk, smp->rrnd, r, cfm))
1487 return SMP_UNSPECIFIED;
1488
1489 if (crypto_memneq(smp->pcnf, cfm, 16))
1490 return SMP_CONFIRM_FAILED;
1491
1492 smp->passkey_round++;
1493
1494 if (smp->passkey_round == 20) {
1495 /* Generate MacKey and LTK */
1496 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk))
1497 return SMP_UNSPECIFIED;
1498 }
1499
1500 /* The round is only complete when the initiator
1501 * receives pairing random.
1502 */
1503 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1504 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1505 sizeof(smp->prnd), smp->prnd);
1506 if (smp->passkey_round == 20)
1507 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1508 else
1509 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1510 return 0;
1511 }
1512
1513 /* Start the next round */
1514 if (smp->passkey_round != 20)
1515 return sc_passkey_round(smp, 0);
1516
1517 /* Passkey rounds are complete - start DHKey Check */
1518 sc_dhkey_check(smp);
1519 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1520
1521 break;
1522
1523 case SMP_CMD_PAIRING_CONFIRM:
1524 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
1525 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
1526 return 0;
1527 }
1528
1529 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1530
1531 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1532 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1533 sizeof(smp->prnd), smp->prnd);
1534 return 0;
1535 }
1536
1537 return sc_passkey_send_confirm(smp);
1538
1539 case SMP_CMD_PUBLIC_KEY:
1540 default:
1541 /* Initiating device starts the round */
1542 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
1543 return 0;
1544
1545 bt_dev_dbg(hdev, "Starting passkey round %u",
1546 smp->passkey_round + 1);
1547
1548 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1549
1550 return sc_passkey_send_confirm(smp);
1551 }
1552
1553 return 0;
1554 }
1555
sc_user_reply(struct smp_chan * smp,u16 mgmt_op,__le32 passkey)1556 static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey)
1557 {
1558 struct l2cap_conn *conn = smp->conn;
1559 struct hci_conn *hcon = conn->hcon;
1560 u8 smp_op;
1561
1562 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags);
1563
1564 switch (mgmt_op) {
1565 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1566 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED);
1567 return 0;
1568 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1569 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED);
1570 return 0;
1571 case MGMT_OP_USER_PASSKEY_REPLY:
1572 hcon->passkey_notify = le32_to_cpu(passkey);
1573 smp->passkey_round = 0;
1574
1575 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags))
1576 smp_op = SMP_CMD_PAIRING_CONFIRM;
1577 else
1578 smp_op = 0;
1579
1580 if (sc_passkey_round(smp, smp_op))
1581 return -EIO;
1582
1583 return 0;
1584 }
1585
1586 /* Initiator sends DHKey check first */
1587 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1588 sc_dhkey_check(smp);
1589 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1590 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) {
1591 sc_dhkey_check(smp);
1592 sc_add_ltk(smp);
1593 }
1594
1595 return 0;
1596 }
1597
smp_user_confirm_reply(struct hci_conn * hcon,u16 mgmt_op,__le32 passkey)1598 int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
1599 {
1600 struct l2cap_conn *conn = hcon->l2cap_data;
1601 struct l2cap_chan *chan;
1602 struct smp_chan *smp;
1603 u32 value;
1604 int err;
1605
1606 if (!conn)
1607 return -ENOTCONN;
1608
1609 bt_dev_dbg(conn->hcon->hdev, "");
1610
1611 chan = conn->smp;
1612 if (!chan)
1613 return -ENOTCONN;
1614
1615 l2cap_chan_lock(chan);
1616 if (!chan->data) {
1617 err = -ENOTCONN;
1618 goto unlock;
1619 }
1620
1621 smp = chan->data;
1622
1623 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1624 err = sc_user_reply(smp, mgmt_op, passkey);
1625 goto unlock;
1626 }
1627
1628 switch (mgmt_op) {
1629 case MGMT_OP_USER_PASSKEY_REPLY:
1630 value = le32_to_cpu(passkey);
1631 memset(smp->tk, 0, sizeof(smp->tk));
1632 bt_dev_dbg(conn->hcon->hdev, "PassKey: %u", value);
1633 put_unaligned_le32(value, smp->tk);
1634 fallthrough;
1635 case MGMT_OP_USER_CONFIRM_REPLY:
1636 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
1637 break;
1638 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1639 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1640 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1641 err = 0;
1642 goto unlock;
1643 default:
1644 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1645 err = -EOPNOTSUPP;
1646 goto unlock;
1647 }
1648
1649 err = 0;
1650
1651 /* If it is our turn to send Pairing Confirm, do so now */
1652 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
1653 u8 rsp = smp_confirm(smp);
1654 if (rsp)
1655 smp_failure(conn, rsp);
1656 }
1657
1658 unlock:
1659 l2cap_chan_unlock(chan);
1660 return err;
1661 }
1662
build_bredr_pairing_cmd(struct smp_chan * smp,struct smp_cmd_pairing * req,struct smp_cmd_pairing * rsp)1663 static void build_bredr_pairing_cmd(struct smp_chan *smp,
1664 struct smp_cmd_pairing *req,
1665 struct smp_cmd_pairing *rsp)
1666 {
1667 struct l2cap_conn *conn = smp->conn;
1668 struct hci_dev *hdev = conn->hcon->hdev;
1669 u8 local_dist = 0, remote_dist = 0;
1670
1671 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
1672 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1673 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1674 }
1675
1676 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
1677 remote_dist |= SMP_DIST_ID_KEY;
1678
1679 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
1680 local_dist |= SMP_DIST_ID_KEY;
1681
1682 if (!rsp) {
1683 memset(req, 0, sizeof(*req));
1684
1685 req->auth_req = SMP_AUTH_CT2;
1686 req->init_key_dist = local_dist;
1687 req->resp_key_dist = remote_dist;
1688 req->max_key_size = conn->hcon->enc_key_size;
1689
1690 smp->remote_key_dist = remote_dist;
1691
1692 return;
1693 }
1694
1695 memset(rsp, 0, sizeof(*rsp));
1696
1697 rsp->auth_req = SMP_AUTH_CT2;
1698 rsp->max_key_size = conn->hcon->enc_key_size;
1699 rsp->init_key_dist = req->init_key_dist & remote_dist;
1700 rsp->resp_key_dist = req->resp_key_dist & local_dist;
1701
1702 smp->remote_key_dist = rsp->init_key_dist;
1703 }
1704
smp_cmd_pairing_req(struct l2cap_conn * conn,struct sk_buff * skb)1705 static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
1706 {
1707 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
1708 struct l2cap_chan *chan = conn->smp;
1709 struct hci_dev *hdev = conn->hcon->hdev;
1710 struct smp_chan *smp = chan->data;
1711 u8 key_size, auth, sec_level;
1712 int ret;
1713
1714 bt_dev_dbg(hdev, "conn %p", conn);
1715
1716 if (skb->len < sizeof(*req))
1717 return SMP_INVALID_PARAMS;
1718
1719 if (smp && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
1720 return SMP_CMD_NOTSUPP;
1721
1722 if (!smp) {
1723 smp = smp_chan_create(conn);
1724 if (!smp)
1725 return SMP_UNSPECIFIED;
1726 }
1727
1728 /* We didn't start the pairing, so match remote */
1729 auth = req->auth_req & AUTH_REQ_MASK(hdev);
1730
1731 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
1732 (auth & SMP_AUTH_BONDING))
1733 return SMP_PAIRING_NOTSUPP;
1734
1735 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1736 return SMP_AUTH_REQUIREMENTS;
1737
1738 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1739 memcpy(&smp->preq[1], req, sizeof(*req));
1740 skb_pull(skb, sizeof(*req));
1741
1742 /* If the remote side's OOB flag is set it means it has
1743 * successfully received our local OOB data - therefore set the
1744 * flag to indicate that local OOB is in use.
1745 */
1746 if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1747 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1748
1749 /* SMP over BR/EDR requires special treatment */
1750 if (conn->hcon->type == ACL_LINK) {
1751 /* We must have a BR/EDR SC link */
1752 if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) &&
1753 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
1754 return SMP_CROSS_TRANSP_NOT_ALLOWED;
1755
1756 set_bit(SMP_FLAG_SC, &smp->flags);
1757
1758 build_bredr_pairing_cmd(smp, req, &rsp);
1759
1760 if (req->auth_req & SMP_AUTH_CT2)
1761 set_bit(SMP_FLAG_CT2, &smp->flags);
1762
1763 key_size = min(req->max_key_size, rsp.max_key_size);
1764 if (check_enc_key_size(conn, key_size))
1765 return SMP_ENC_KEY_SIZE;
1766
1767 /* Clear bits which are generated but not distributed */
1768 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1769
1770 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1771 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1772 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1773
1774 smp_distribute_keys(smp);
1775 return 0;
1776 }
1777
1778 build_pairing_cmd(conn, req, &rsp, auth);
1779
1780 if (rsp.auth_req & SMP_AUTH_SC) {
1781 set_bit(SMP_FLAG_SC, &smp->flags);
1782
1783 if (rsp.auth_req & SMP_AUTH_CT2)
1784 set_bit(SMP_FLAG_CT2, &smp->flags);
1785 }
1786
1787 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1788 sec_level = BT_SECURITY_MEDIUM;
1789 else
1790 sec_level = authreq_to_seclevel(auth);
1791
1792 if (sec_level > conn->hcon->pending_sec_level)
1793 conn->hcon->pending_sec_level = sec_level;
1794
1795 /* If we need MITM check that it can be achieved. */
1796 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1797 u8 method;
1798
1799 method = get_auth_method(smp, conn->hcon->io_capability,
1800 req->io_capability);
1801 if (method == JUST_WORKS || method == JUST_CFM)
1802 return SMP_AUTH_REQUIREMENTS;
1803
1804 /* Force MITM bit if it isn't set by the initiator. */
1805 auth |= SMP_AUTH_MITM;
1806 rsp.auth_req |= SMP_AUTH_MITM;
1807 }
1808
1809 key_size = min(req->max_key_size, rsp.max_key_size);
1810 if (check_enc_key_size(conn, key_size))
1811 return SMP_ENC_KEY_SIZE;
1812
1813 get_random_bytes(smp->prnd, sizeof(smp->prnd));
1814
1815 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1816 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1817
1818 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1819
1820 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
1821
1822 /* Strictly speaking we shouldn't allow Pairing Confirm for the
1823 * SC case, however some implementations incorrectly copy RFU auth
1824 * req bits from our security request, which may create a false
1825 * positive SC enablement.
1826 */
1827 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1828
1829 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1830 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
1831 /* Clear bits which are generated but not distributed */
1832 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1833 /* Wait for Public Key from Initiating Device */
1834 return 0;
1835 }
1836
1837 /* Request setup of TK */
1838 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
1839 if (ret)
1840 return SMP_UNSPECIFIED;
1841
1842 return 0;
1843 }
1844
sc_send_public_key(struct smp_chan * smp)1845 static u8 sc_send_public_key(struct smp_chan *smp)
1846 {
1847 struct hci_dev *hdev = smp->conn->hcon->hdev;
1848
1849 bt_dev_dbg(hdev, "");
1850
1851 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
1852 struct l2cap_chan *chan = hdev->smp_data;
1853 struct smp_dev *smp_dev;
1854
1855 if (!chan || !chan->data)
1856 return SMP_UNSPECIFIED;
1857
1858 smp_dev = chan->data;
1859
1860 memcpy(smp->local_pk, smp_dev->local_pk, 64);
1861 memcpy(smp->lr, smp_dev->local_rand, 16);
1862
1863 if (smp_dev->debug_key)
1864 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1865
1866 goto done;
1867 }
1868
1869 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
1870 bt_dev_dbg(hdev, "Using debug keys");
1871 if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk))
1872 return SMP_UNSPECIFIED;
1873 memcpy(smp->local_pk, debug_pk, 64);
1874 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1875 } else {
1876 while (true) {
1877 /* Generate key pair for Secure Connections */
1878 if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk))
1879 return SMP_UNSPECIFIED;
1880
1881 /* This is unlikely, but we need to check that
1882 * we didn't accidentally generate a debug key.
1883 */
1884 if (crypto_memneq(smp->local_pk, debug_pk, 64))
1885 break;
1886 }
1887 }
1888
1889 done:
1890 SMP_DBG("Local Public Key X: %32phN", smp->local_pk);
1891 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32);
1892
1893 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk);
1894
1895 return 0;
1896 }
1897
smp_cmd_pairing_rsp(struct l2cap_conn * conn,struct sk_buff * skb)1898 static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
1899 {
1900 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1901 struct l2cap_chan *chan = conn->smp;
1902 struct smp_chan *smp = chan->data;
1903 struct hci_dev *hdev = conn->hcon->hdev;
1904 u8 key_size, auth;
1905 int ret;
1906
1907 bt_dev_dbg(hdev, "conn %p", conn);
1908
1909 if (skb->len < sizeof(*rsp))
1910 return SMP_INVALID_PARAMS;
1911
1912 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
1913 return SMP_CMD_NOTSUPP;
1914
1915 skb_pull(skb, sizeof(*rsp));
1916
1917 req = (void *) &smp->preq[1];
1918
1919 key_size = min(req->max_key_size, rsp->max_key_size);
1920 if (check_enc_key_size(conn, key_size))
1921 return SMP_ENC_KEY_SIZE;
1922
1923 auth = rsp->auth_req & AUTH_REQ_MASK(hdev);
1924
1925 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1926 return SMP_AUTH_REQUIREMENTS;
1927
1928 /* If the remote side's OOB flag is set it means it has
1929 * successfully received our local OOB data - therefore set the
1930 * flag to indicate that local OOB is in use.
1931 */
1932 if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1933 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1934
1935 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1936 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
1937
1938 /* Update remote key distribution in case the remote cleared
1939 * some bits that we had enabled in our request.
1940 */
1941 smp->remote_key_dist &= rsp->resp_key_dist;
1942
1943 if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2))
1944 set_bit(SMP_FLAG_CT2, &smp->flags);
1945
1946 /* For BR/EDR this means we're done and can start phase 3 */
1947 if (conn->hcon->type == ACL_LINK) {
1948 /* Clear bits which are generated but not distributed */
1949 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1950 smp_distribute_keys(smp);
1951 return 0;
1952 }
1953
1954 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC))
1955 set_bit(SMP_FLAG_SC, &smp->flags);
1956 else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH)
1957 conn->hcon->pending_sec_level = BT_SECURITY_HIGH;
1958
1959 /* If we need MITM check that it can be achieved */
1960 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1961 u8 method;
1962
1963 method = get_auth_method(smp, req->io_capability,
1964 rsp->io_capability);
1965 if (method == JUST_WORKS || method == JUST_CFM)
1966 return SMP_AUTH_REQUIREMENTS;
1967 }
1968
1969 get_random_bytes(smp->prnd, sizeof(smp->prnd));
1970
1971 /* Update remote key distribution in case the remote cleared
1972 * some bits that we had enabled in our request.
1973 */
1974 smp->remote_key_dist &= rsp->resp_key_dist;
1975
1976 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1977 /* Clear bits which are generated but not distributed */
1978 smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1979 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
1980 return sc_send_public_key(smp);
1981 }
1982
1983 auth |= req->auth_req;
1984
1985 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
1986 if (ret)
1987 return SMP_UNSPECIFIED;
1988
1989 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
1990
1991 /* Can't compose response until we have been confirmed */
1992 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1993 return smp_confirm(smp);
1994
1995 return 0;
1996 }
1997
sc_check_confirm(struct smp_chan * smp)1998 static u8 sc_check_confirm(struct smp_chan *smp)
1999 {
2000 struct l2cap_conn *conn = smp->conn;
2001
2002 bt_dev_dbg(conn->hcon->hdev, "");
2003
2004 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2005 return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM);
2006
2007 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2008 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2009 smp->prnd);
2010 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2011 }
2012
2013 return 0;
2014 }
2015
2016 /* Work-around for some implementations that incorrectly copy RFU bits
2017 * from our security request and thereby create the impression that
2018 * we're doing SC when in fact the remote doesn't support it.
2019 */
fixup_sc_false_positive(struct smp_chan * smp)2020 static int fixup_sc_false_positive(struct smp_chan *smp)
2021 {
2022 struct l2cap_conn *conn = smp->conn;
2023 struct hci_conn *hcon = conn->hcon;
2024 struct hci_dev *hdev = hcon->hdev;
2025 struct smp_cmd_pairing *req, *rsp;
2026 u8 auth;
2027
2028 /* The issue is only observed when we're in responder role */
2029 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2030 return SMP_UNSPECIFIED;
2031
2032 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
2033 bt_dev_err(hdev, "refusing legacy fallback in SC-only mode");
2034 return SMP_UNSPECIFIED;
2035 }
2036
2037 bt_dev_err(hdev, "trying to fall back to legacy SMP");
2038
2039 req = (void *) &smp->preq[1];
2040 rsp = (void *) &smp->prsp[1];
2041
2042 /* Rebuild key dist flags which may have been cleared for SC */
2043 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist);
2044
2045 auth = req->auth_req & AUTH_REQ_MASK(hdev);
2046
2047 if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) {
2048 bt_dev_err(hdev, "failed to fall back to legacy SMP");
2049 return SMP_UNSPECIFIED;
2050 }
2051
2052 clear_bit(SMP_FLAG_SC, &smp->flags);
2053
2054 return 0;
2055 }
2056
smp_cmd_pairing_confirm(struct l2cap_conn * conn,struct sk_buff * skb)2057 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
2058 {
2059 struct l2cap_chan *chan = conn->smp;
2060 struct smp_chan *smp = chan->data;
2061 struct hci_conn *hcon = conn->hcon;
2062 struct hci_dev *hdev = hcon->hdev;
2063
2064 bt_dev_dbg(hdev, "conn %p %s", conn,
2065 test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" :
2066 "responder");
2067
2068 if (skb->len < sizeof(smp->pcnf))
2069 return SMP_INVALID_PARAMS;
2070
2071 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
2072 skb_pull(skb, sizeof(smp->pcnf));
2073
2074 if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2075 int ret;
2076
2077 /* Public Key exchange must happen before any other steps */
2078 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags))
2079 return sc_check_confirm(smp);
2080
2081 bt_dev_err(hdev, "Unexpected SMP Pairing Confirm");
2082
2083 ret = fixup_sc_false_positive(smp);
2084 if (ret)
2085 return ret;
2086 }
2087
2088 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2089 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2090 smp->prnd);
2091 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2092 return 0;
2093 }
2094
2095 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
2096 return smp_confirm(smp);
2097
2098 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2099
2100 return 0;
2101 }
2102
smp_cmd_pairing_random(struct l2cap_conn * conn,struct sk_buff * skb)2103 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
2104 {
2105 struct l2cap_chan *chan = conn->smp;
2106 struct smp_chan *smp = chan->data;
2107 struct hci_conn *hcon = conn->hcon;
2108 u8 *pkax, *pkbx, *na, *nb, confirm_hint;
2109 u32 passkey = 0;
2110 int err;
2111
2112 bt_dev_dbg(hcon->hdev, "conn %p", conn);
2113
2114 if (skb->len < sizeof(smp->rrnd))
2115 return SMP_INVALID_PARAMS;
2116
2117 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
2118 skb_pull(skb, sizeof(smp->rrnd));
2119
2120 if (!test_bit(SMP_FLAG_SC, &smp->flags))
2121 return smp_random(smp);
2122
2123 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2124 pkax = smp->local_pk;
2125 pkbx = smp->remote_pk;
2126 na = smp->prnd;
2127 nb = smp->rrnd;
2128 } else {
2129 pkax = smp->remote_pk;
2130 pkbx = smp->local_pk;
2131 na = smp->rrnd;
2132 nb = smp->prnd;
2133 }
2134
2135 if (smp->method == REQ_OOB) {
2136 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2137 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2138 sizeof(smp->prnd), smp->prnd);
2139 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2140 goto mackey_and_ltk;
2141 }
2142
2143 /* Passkey entry has special treatment */
2144 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2145 return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM);
2146
2147 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2148 u8 cfm[16];
2149
2150 err = smp_f4(smp->remote_pk, smp->local_pk, smp->rrnd, 0, cfm);
2151 if (err)
2152 return SMP_UNSPECIFIED;
2153
2154 if (crypto_memneq(smp->pcnf, cfm, 16))
2155 return SMP_CONFIRM_FAILED;
2156 } else {
2157 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2158 smp->prnd);
2159 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2160 }
2161
2162 mackey_and_ltk:
2163 /* Generate MacKey and LTK */
2164 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk);
2165 if (err)
2166 return SMP_UNSPECIFIED;
2167
2168 if (smp->method == REQ_OOB) {
2169 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2170 sc_dhkey_check(smp);
2171 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2172 }
2173 return 0;
2174 }
2175
2176 err = smp_g2(pkax, pkbx, na, nb, &passkey);
2177 if (err)
2178 return SMP_UNSPECIFIED;
2179
2180 /* Always require user confirmation for Just-Works pairing to prevent
2181 * impersonation attacks, or in case of a legitimate device that is
2182 * repairing use the confirmation as acknowledgment to proceed with the
2183 * creation of new keys.
2184 */
2185 confirm_hint = smp->method == JUST_WORKS ? 1 : 0;
2186
2187 err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
2188 hcon->dst_type, passkey, confirm_hint);
2189 if (err)
2190 return SMP_UNSPECIFIED;
2191
2192 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2193
2194 return 0;
2195 }
2196
smp_ltk_encrypt(struct l2cap_conn * conn,u8 sec_level)2197 static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
2198 {
2199 struct smp_ltk *key;
2200 struct hci_conn *hcon = conn->hcon;
2201
2202 key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role);
2203 if (!key)
2204 return false;
2205
2206 if (smp_ltk_sec_level(key) < sec_level)
2207 return false;
2208
2209 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
2210 return true;
2211
2212 hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size);
2213 hcon->enc_key_size = key->enc_size;
2214
2215 /* We never store STKs for initiator role, so clear this flag */
2216 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
2217
2218 return true;
2219 }
2220
smp_sufficient_security(struct hci_conn * hcon,u8 sec_level,enum smp_key_pref key_pref)2221 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
2222 enum smp_key_pref key_pref)
2223 {
2224 if (sec_level == BT_SECURITY_LOW)
2225 return true;
2226
2227 /* If we're encrypted with an STK but the caller prefers using
2228 * LTK claim insufficient security. This way we allow the
2229 * connection to be re-encrypted with an LTK, even if the LTK
2230 * provides the same level of security. Only exception is if we
2231 * don't have an LTK (e.g. because of key distribution bits).
2232 */
2233 if (key_pref == SMP_USE_LTK &&
2234 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
2235 hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role))
2236 return false;
2237
2238 if (hcon->sec_level >= sec_level)
2239 return true;
2240
2241 return false;
2242 }
2243
smp_send_pairing_req(struct smp_chan * smp,__u8 auth)2244 static void smp_send_pairing_req(struct smp_chan *smp, __u8 auth)
2245 {
2246 struct smp_cmd_pairing cp;
2247
2248 if (smp->conn->hcon->type == ACL_LINK)
2249 build_bredr_pairing_cmd(smp, &cp, NULL);
2250 else
2251 build_pairing_cmd(smp->conn, &cp, NULL, auth);
2252
2253 smp->preq[0] = SMP_CMD_PAIRING_REQ;
2254 memcpy(&smp->preq[1], &cp, sizeof(cp));
2255
2256 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
2257 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
2258
2259 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
2260 }
2261
smp_cmd_security_req(struct l2cap_conn * conn,struct sk_buff * skb)2262 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
2263 {
2264 struct smp_cmd_security_req *rp = (void *) skb->data;
2265 struct hci_conn *hcon = conn->hcon;
2266 struct hci_dev *hdev = hcon->hdev;
2267 struct smp_chan *smp;
2268 u8 sec_level, auth;
2269
2270 bt_dev_dbg(hdev, "conn %p", conn);
2271
2272 /* SMP over BR/EDR only covers cross-transport key derivation; the
2273 * Security Request procedure has no BR/EDR counterpart. Reject it
2274 * here, otherwise smp_ltk_encrypt() finds the peer's LE LTK
2275 * (ADDR_LE_DEV_PUBLIC and BDADDR_BREDR are both 0) and issues
2276 * HCI_OP_LE_START_ENC on the ACL handle, which the controller
2277 * rejects and hci_cs_le_start_enc() turns into a disconnect. Reply
2278 * without smp_failure(): this is not an authentication failure, and
2279 * MGMT_EV_AUTH_FAILED would make bluetoothd drop the device.
2280 */
2281 if (hcon->type != LE_LINK) {
2282 u8 reason = SMP_CMD_NOTSUPP;
2283
2284 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
2285 &reason);
2286 return 0;
2287 }
2288
2289 if (skb->len < sizeof(*rp))
2290 return SMP_INVALID_PARAMS;
2291
2292 if (hcon->role != HCI_ROLE_MASTER)
2293 return SMP_CMD_NOTSUPP;
2294
2295 auth = rp->auth_req & AUTH_REQ_MASK(hdev);
2296
2297 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
2298 return SMP_AUTH_REQUIREMENTS;
2299
2300 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
2301 sec_level = BT_SECURITY_MEDIUM;
2302 else
2303 sec_level = authreq_to_seclevel(auth);
2304
2305 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
2306 /* If link is already encrypted with sufficient security we
2307 * still need refresh encryption as per Core Spec 5.0 Vol 3,
2308 * Part H 2.4.6
2309 */
2310 smp_ltk_encrypt(conn, hcon->sec_level);
2311 return 0;
2312 }
2313
2314 if (sec_level > hcon->pending_sec_level)
2315 hcon->pending_sec_level = sec_level;
2316
2317 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2318 return 0;
2319
2320 smp = smp_chan_create(conn);
2321 if (!smp)
2322 return SMP_UNSPECIFIED;
2323
2324 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2325 (auth & SMP_AUTH_BONDING))
2326 return SMP_PAIRING_NOTSUPP;
2327
2328 skb_pull(skb, sizeof(*rp));
2329
2330 smp_send_pairing_req(smp, auth);
2331
2332 return 0;
2333 }
2334
smp_send_security_req(struct smp_chan * smp,__u8 auth)2335 static void smp_send_security_req(struct smp_chan *smp, __u8 auth)
2336 {
2337 struct smp_cmd_security_req cp;
2338
2339 cp.auth_req = auth;
2340 smp_send_cmd(smp->conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
2341 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
2342
2343 clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
2344 }
2345
smp_conn_security(struct hci_conn * hcon,__u8 sec_level)2346 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
2347 {
2348 struct l2cap_conn *conn;
2349 struct l2cap_chan *chan;
2350 struct smp_chan *smp;
2351 __u8 authreq;
2352 int ret;
2353
2354 /* Caller shall ensure there can be no race with l2cap_conn_del() */
2355 conn = context_unsafe(hcon->l2cap_data);
2356
2357 bt_dev_dbg(hcon->hdev, "conn %p hcon %p level 0x%2.2x", conn, hcon,
2358 sec_level);
2359
2360 /* This may be NULL if there's an unexpected disconnection */
2361 if (!conn)
2362 return 1;
2363
2364 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
2365 return 1;
2366
2367 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
2368 return 1;
2369
2370 if (sec_level > hcon->pending_sec_level)
2371 hcon->pending_sec_level = sec_level;
2372
2373 if (hcon->role == HCI_ROLE_MASTER)
2374 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2375 return 0;
2376
2377 chan = conn->smp;
2378 if (!chan) {
2379 bt_dev_err(hcon->hdev, "security requested but not available");
2380 return 1;
2381 }
2382
2383 l2cap_chan_lock(chan);
2384
2385 /* If SMP is already in progress ignore this request */
2386 if (chan->data) {
2387 ret = 0;
2388 goto unlock;
2389 }
2390
2391 smp = smp_chan_create(conn);
2392 if (!smp) {
2393 ret = 1;
2394 goto unlock;
2395 }
2396
2397 authreq = seclevel_to_authreq(sec_level);
2398
2399 if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) {
2400 authreq |= SMP_AUTH_SC;
2401 if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED))
2402 authreq |= SMP_AUTH_CT2;
2403 }
2404
2405 /* Don't attempt to set MITM if setting is overridden by debugfs
2406 * Needed to pass certification test SM/MAS/PKE/BV-01-C
2407 */
2408 if (!hci_dev_test_flag(hcon->hdev, HCI_FORCE_NO_MITM)) {
2409 /* Require MITM if IO Capability allows or the security level
2410 * requires it.
2411 */
2412 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
2413 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2414 authreq |= SMP_AUTH_MITM;
2415 }
2416
2417 if (hcon->role == HCI_ROLE_MASTER)
2418 smp_send_pairing_req(smp, authreq);
2419 else
2420 smp_send_security_req(smp, authreq);
2421
2422 ret = 0;
2423
2424 unlock:
2425 l2cap_chan_unlock(chan);
2426 return ret;
2427 }
2428
smp_cancel_and_remove_pairing(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type)2429 int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
2430 u8 addr_type)
2431 {
2432 struct hci_conn *hcon;
2433 struct l2cap_conn *conn;
2434 struct l2cap_chan *chan;
2435 struct smp_chan *smp;
2436 int err;
2437
2438 err = hci_remove_ltk(hdev, bdaddr, addr_type);
2439 hci_remove_irk(hdev, bdaddr, addr_type);
2440
2441 hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type);
2442 if (!hcon)
2443 goto done;
2444
2445 lockdep_assert_held(&hcon->hdev->lock);
2446
2447 conn = hcon->l2cap_data;
2448 if (!conn)
2449 goto done;
2450
2451 chan = conn->smp;
2452 if (!chan)
2453 goto done;
2454
2455 l2cap_chan_lock(chan);
2456
2457 smp = chan->data;
2458 if (smp) {
2459 /* Set keys to NULL to make sure smp_failure() does not try to
2460 * remove and free already invalidated rcu list entries. */
2461 smp->ltk = NULL;
2462 smp->responder_ltk = NULL;
2463 smp->remote_irk = NULL;
2464
2465 if (test_bit(SMP_FLAG_COMPLETE, &smp->flags))
2466 smp_failure(conn, 0);
2467 else
2468 smp_failure(conn, SMP_UNSPECIFIED);
2469 err = 0;
2470 }
2471
2472 l2cap_chan_unlock(chan);
2473
2474 done:
2475 return err;
2476 }
2477
smp_cmd_encrypt_info(struct l2cap_conn * conn,struct sk_buff * skb)2478 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
2479 {
2480 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
2481 struct l2cap_chan *chan = conn->smp;
2482 struct smp_chan *smp = chan->data;
2483
2484 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2485
2486 if (skb->len < sizeof(*rp))
2487 return SMP_INVALID_PARAMS;
2488
2489 /* Pairing is aborted if any blocked keys are distributed */
2490 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2491 rp->ltk)) {
2492 bt_dev_warn_ratelimited(conn->hcon->hdev,
2493 "LTK blocked for %pMR",
2494 &conn->hcon->dst);
2495 return SMP_INVALID_PARAMS;
2496 }
2497
2498 SMP_ALLOW_CMD(smp, SMP_CMD_INITIATOR_IDENT);
2499
2500 skb_pull(skb, sizeof(*rp));
2501
2502 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
2503
2504 return 0;
2505 }
2506
smp_cmd_initiator_ident(struct l2cap_conn * conn,struct sk_buff * skb)2507 static int smp_cmd_initiator_ident(struct l2cap_conn *conn, struct sk_buff *skb)
2508 {
2509 struct smp_cmd_initiator_ident *rp = (void *)skb->data;
2510 struct l2cap_chan *chan = conn->smp;
2511 struct smp_chan *smp = chan->data;
2512 struct hci_dev *hdev = conn->hcon->hdev;
2513 struct hci_conn *hcon = conn->hcon;
2514 struct smp_ltk *ltk;
2515 u8 authenticated;
2516
2517 bt_dev_dbg(hdev, "conn %p", conn);
2518
2519 if (skb->len < sizeof(*rp))
2520 return SMP_INVALID_PARAMS;
2521
2522 /* Mark the information as received */
2523 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
2524
2525 if (smp->remote_key_dist & SMP_DIST_ID_KEY)
2526 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
2527 else if (smp->remote_key_dist & SMP_DIST_SIGN)
2528 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2529
2530 skb_pull(skb, sizeof(*rp));
2531
2532 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2533 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
2534 authenticated, smp->tk, smp->enc_key_size,
2535 rp->ediv, rp->rand);
2536 smp->ltk = ltk;
2537 if (!(smp->remote_key_dist & KEY_DIST_MASK))
2538 smp_distribute_keys(smp);
2539
2540 return 0;
2541 }
2542
smp_cmd_ident_info(struct l2cap_conn * conn,struct sk_buff * skb)2543 static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
2544 {
2545 struct smp_cmd_ident_info *info = (void *) skb->data;
2546 struct l2cap_chan *chan = conn->smp;
2547 struct smp_chan *smp = chan->data;
2548
2549 bt_dev_dbg(conn->hcon->hdev, "");
2550
2551 if (skb->len < sizeof(*info))
2552 return SMP_INVALID_PARAMS;
2553
2554 /* Pairing is aborted if any blocked keys are distributed */
2555 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2556 info->irk)) {
2557 bt_dev_warn_ratelimited(conn->hcon->hdev,
2558 "Identity key blocked for %pMR",
2559 &conn->hcon->dst);
2560 return SMP_INVALID_PARAMS;
2561 }
2562
2563 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
2564
2565 skb_pull(skb, sizeof(*info));
2566
2567 memcpy(smp->irk, info->irk, 16);
2568
2569 return 0;
2570 }
2571
smp_cmd_ident_addr_info(struct l2cap_conn * conn,struct sk_buff * skb)2572 static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
2573 struct sk_buff *skb)
2574 {
2575 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
2576 struct l2cap_chan *chan = conn->smp;
2577 struct smp_chan *smp = chan->data;
2578 struct hci_conn *hcon = conn->hcon;
2579 bdaddr_t rpa;
2580
2581 bt_dev_dbg(hcon->hdev, "");
2582
2583 if (skb->len < sizeof(*info))
2584 return SMP_INVALID_PARAMS;
2585
2586 /* Mark the information as received */
2587 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
2588
2589 if (smp->remote_key_dist & SMP_DIST_SIGN)
2590 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2591
2592 skb_pull(skb, sizeof(*info));
2593
2594 /* Strictly speaking the Core Specification (4.1) allows sending
2595 * an empty address which would force us to rely on just the IRK
2596 * as "identity information". However, since such
2597 * implementations are not known of and in order to not over
2598 * complicate our implementation, simply pretend that we never
2599 * received an IRK for such a device.
2600 *
2601 * The Identity Address must also be a Static Random or Public
2602 * Address, which hci_is_identity_address() checks for.
2603 */
2604 if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
2605 !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
2606 bt_dev_err(hcon->hdev, "ignoring IRK with no identity address");
2607 goto distribute;
2608 }
2609
2610 /* Drop IRK if peer is using identity address during pairing but is
2611 * providing different address as identity information.
2612 *
2613 * Microsoft Surface Precision Mouse is known to have this bug.
2614 */
2615 if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
2616 (bacmp(&info->bdaddr, &hcon->dst) ||
2617 info->addr_type != hcon->dst_type)) {
2618 bt_dev_err(hcon->hdev,
2619 "ignoring IRK with invalid identity address");
2620 goto distribute;
2621 }
2622
2623 bacpy(&smp->id_addr, &info->bdaddr);
2624 smp->id_addr_type = info->addr_type;
2625
2626 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
2627 bacpy(&rpa, &hcon->dst);
2628 else
2629 bacpy(&rpa, BDADDR_ANY);
2630
2631 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
2632 smp->id_addr_type, smp->irk, &rpa);
2633
2634 distribute:
2635 if (!(smp->remote_key_dist & KEY_DIST_MASK))
2636 smp_distribute_keys(smp);
2637
2638 return 0;
2639 }
2640
smp_cmd_sign_info(struct l2cap_conn * conn,struct sk_buff * skb)2641 static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
2642 {
2643 struct smp_cmd_sign_info *rp = (void *) skb->data;
2644 struct l2cap_chan *chan = conn->smp;
2645 struct smp_chan *smp = chan->data;
2646 struct smp_csrk *csrk;
2647
2648 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2649
2650 if (skb->len < sizeof(*rp))
2651 return SMP_INVALID_PARAMS;
2652
2653 /* Mark the information as received */
2654 smp->remote_key_dist &= ~SMP_DIST_SIGN;
2655
2656 skb_pull(skb, sizeof(*rp));
2657
2658 csrk = kzalloc_obj(*csrk);
2659 if (csrk) {
2660 if (conn->hcon->sec_level > BT_SECURITY_MEDIUM)
2661 csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED;
2662 else
2663 csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED;
2664 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
2665 }
2666 smp->csrk = csrk;
2667 smp_distribute_keys(smp);
2668
2669 return 0;
2670 }
2671
sc_select_method(struct smp_chan * smp)2672 static u8 sc_select_method(struct smp_chan *smp)
2673 {
2674 struct smp_cmd_pairing *local, *remote;
2675 u8 local_mitm, remote_mitm, local_io, remote_io, method;
2676
2677 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) ||
2678 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags))
2679 return REQ_OOB;
2680
2681 /* The preq/prsp contain the raw Pairing Request/Response PDUs
2682 * which are needed as inputs to some crypto functions. To get
2683 * the "struct smp_cmd_pairing" from them we need to skip the
2684 * first byte which contains the opcode.
2685 */
2686 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2687 local = (void *) &smp->preq[1];
2688 remote = (void *) &smp->prsp[1];
2689 } else {
2690 local = (void *) &smp->prsp[1];
2691 remote = (void *) &smp->preq[1];
2692 }
2693
2694 local_io = local->io_capability;
2695 remote_io = remote->io_capability;
2696
2697 local_mitm = (local->auth_req & SMP_AUTH_MITM);
2698 remote_mitm = (remote->auth_req & SMP_AUTH_MITM);
2699
2700 /* If either side wants MITM, look up the method from the table,
2701 * otherwise use JUST WORKS.
2702 */
2703 if (local_mitm || remote_mitm)
2704 method = get_auth_method(smp, local_io, remote_io);
2705 else
2706 method = JUST_WORKS;
2707
2708 /* Don't confirm locally initiated pairing attempts */
2709 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2710 method = JUST_WORKS;
2711
2712 return method;
2713 }
2714
smp_cmd_public_key(struct l2cap_conn * conn,struct sk_buff * skb)2715 static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
2716 {
2717 struct smp_cmd_public_key *key = (void *) skb->data;
2718 struct hci_conn *hcon = conn->hcon;
2719 struct l2cap_chan *chan = conn->smp;
2720 struct smp_chan *smp = chan->data;
2721 struct hci_dev *hdev = hcon->hdev;
2722 struct crypto_kpp *tfm_ecdh;
2723 struct smp_cmd_pairing_confirm cfm;
2724 int err;
2725
2726 bt_dev_dbg(hdev, "conn %p", conn);
2727
2728 if (skb->len < sizeof(*key))
2729 return SMP_INVALID_PARAMS;
2730
2731 /* Check if remote and local public keys are the same and debug key is
2732 * not in use.
2733 */
2734 if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
2735 !crypto_memneq(key, smp->local_pk, 64)) {
2736 bt_dev_err(hdev, "Remote and local public keys are identical");
2737 return SMP_DHKEY_CHECK_FAILED;
2738 }
2739
2740 memcpy(smp->remote_pk, key, 64);
2741
2742 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {
2743 err = smp_f4(smp->remote_pk, smp->remote_pk, smp->rr, 0,
2744 cfm.confirm_val);
2745 if (err)
2746 return SMP_UNSPECIFIED;
2747
2748 if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16))
2749 return SMP_CONFIRM_FAILED;
2750 }
2751
2752 /* Non-initiating device sends its public key after receiving
2753 * the key from the initiating device.
2754 */
2755 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2756 err = sc_send_public_key(smp);
2757 if (err)
2758 return err;
2759 }
2760
2761 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk);
2762 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32);
2763
2764 /* Compute the shared secret on the same crypto tfm on which the private
2765 * key was set/generated.
2766 */
2767 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
2768 struct l2cap_chan *hchan = hdev->smp_data;
2769 struct smp_dev *smp_dev;
2770
2771 if (!hchan || !hchan->data)
2772 return SMP_UNSPECIFIED;
2773
2774 smp_dev = hchan->data;
2775
2776 tfm_ecdh = smp_dev->tfm_ecdh;
2777 } else {
2778 tfm_ecdh = smp->tfm_ecdh;
2779 }
2780
2781 if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey))
2782 return SMP_UNSPECIFIED;
2783
2784 SMP_DBG("DHKey %32phN", smp->dhkey);
2785
2786 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags);
2787
2788 smp->method = sc_select_method(smp);
2789
2790 bt_dev_dbg(hdev, "selected method 0x%02x", smp->method);
2791
2792 /* JUST_WORKS and JUST_CFM result in an unauthenticated key */
2793 if (smp->method == JUST_WORKS || smp->method == JUST_CFM)
2794 hcon->pending_sec_level = BT_SECURITY_MEDIUM;
2795 else
2796 hcon->pending_sec_level = BT_SECURITY_FIPS;
2797
2798 if (!crypto_memneq(debug_pk, smp->remote_pk, 64))
2799 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
2800
2801 if (smp->method == DSP_PASSKEY) {
2802 get_random_bytes(&hcon->passkey_notify,
2803 sizeof(hcon->passkey_notify));
2804 hcon->passkey_notify %= 1000000;
2805 hcon->passkey_entered = 0;
2806 smp->passkey_round = 0;
2807 if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type,
2808 hcon->dst_type,
2809 hcon->passkey_notify,
2810 hcon->passkey_entered))
2811 return SMP_UNSPECIFIED;
2812 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2813 return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY);
2814 }
2815
2816 if (smp->method == REQ_OOB) {
2817 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2818 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2819 sizeof(smp->prnd), smp->prnd);
2820
2821 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2822
2823 return 0;
2824 }
2825
2826 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2827 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2828
2829 if (smp->method == REQ_PASSKEY) {
2830 if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type,
2831 hcon->dst_type))
2832 return SMP_UNSPECIFIED;
2833 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2834 set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2835 return 0;
2836 }
2837
2838 /* The Initiating device waits for the non-initiating device to
2839 * send the confirm value.
2840 */
2841 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2842 return 0;
2843
2844 err = smp_f4(smp->local_pk, smp->remote_pk, smp->prnd, 0,
2845 cfm.confirm_val);
2846 if (err)
2847 return SMP_UNSPECIFIED;
2848
2849 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
2850 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2851
2852 return 0;
2853 }
2854
smp_cmd_dhkey_check(struct l2cap_conn * conn,struct sk_buff * skb)2855 static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
2856 {
2857 struct smp_cmd_dhkey_check *check = (void *) skb->data;
2858 struct l2cap_chan *chan = conn->smp;
2859 struct hci_conn *hcon = conn->hcon;
2860 struct smp_chan *smp = chan->data;
2861 u8 a[7], b[7], *local_addr, *remote_addr;
2862 u8 io_cap[3], r[16], e[16];
2863 int err;
2864
2865 bt_dev_dbg(hcon->hdev, "conn %p", conn);
2866
2867 if (skb->len < sizeof(*check))
2868 return SMP_INVALID_PARAMS;
2869
2870 memcpy(a, &hcon->init_addr, 6);
2871 memcpy(b, &hcon->resp_addr, 6);
2872 a[6] = hcon->init_addr_type;
2873 b[6] = hcon->resp_addr_type;
2874
2875 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2876 local_addr = a;
2877 remote_addr = b;
2878 memcpy(io_cap, &smp->prsp[1], 3);
2879 } else {
2880 local_addr = b;
2881 remote_addr = a;
2882 memcpy(io_cap, &smp->preq[1], 3);
2883 }
2884
2885 memset(r, 0, sizeof(r));
2886
2887 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2888 put_unaligned_le32(hcon->passkey_notify, r);
2889 else if (smp->method == REQ_OOB)
2890 memcpy(r, smp->lr, 16);
2891
2892 err = smp_f6(smp->mackey, smp->rrnd, smp->prnd, r, io_cap, remote_addr,
2893 local_addr, e);
2894 if (err)
2895 return SMP_UNSPECIFIED;
2896
2897 if (crypto_memneq(check->e, e, 16))
2898 return SMP_DHKEY_CHECK_FAILED;
2899
2900 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2901 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
2902 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags);
2903 return 0;
2904 }
2905
2906 /* Responder sends DHKey check as response to initiator */
2907 sc_dhkey_check(smp);
2908 }
2909
2910 sc_add_ltk(smp);
2911
2912 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2913 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size);
2914 hcon->enc_key_size = smp->enc_key_size;
2915 }
2916
2917 return 0;
2918 }
2919
smp_cmd_keypress_notify(struct l2cap_conn * conn,struct sk_buff * skb)2920 static int smp_cmd_keypress_notify(struct l2cap_conn *conn,
2921 struct sk_buff *skb)
2922 {
2923 struct smp_cmd_keypress_notify *kp = (void *) skb->data;
2924
2925 bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value);
2926
2927 return 0;
2928 }
2929
smp_sig_channel(struct l2cap_chan * chan,struct sk_buff * skb)2930 static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
2931 {
2932 struct l2cap_conn *conn = chan->conn;
2933 struct hci_conn *hcon = conn->hcon;
2934 struct smp_chan *smp;
2935 __u8 code, reason;
2936 int err = 0;
2937
2938 if (skb->len < 1)
2939 return -EILSEQ;
2940
2941 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) {
2942 reason = SMP_PAIRING_NOTSUPP;
2943 goto done;
2944 }
2945
2946 code = skb->data[0];
2947 skb_pull(skb, sizeof(code));
2948
2949 smp = chan->data;
2950
2951 if (code > SMP_CMD_MAX)
2952 goto drop;
2953
2954 if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) {
2955 /* If there is a context and the command is not allowed consider
2956 * it a failure so the session is cleanup properly.
2957 */
2958 switch (code) {
2959 case SMP_CMD_IDENT_INFO:
2960 case SMP_CMD_IDENT_ADDR_INFO:
2961 case SMP_CMD_SIGN_INFO:
2962 /* 3.6.1. Key distribution and generation
2963 *
2964 * A device may reject a distributed key by sending the
2965 * Pairing Failed command with the reason set to
2966 * "Key Rejected".
2967 */
2968 smp_failure(conn, SMP_KEY_REJECTED);
2969 break;
2970 }
2971 goto drop;
2972 }
2973
2974 /* If we don't have a context the only allowed commands are
2975 * pairing request and security request.
2976 */
2977 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
2978 goto drop;
2979
2980 switch (code) {
2981 case SMP_CMD_PAIRING_REQ:
2982 reason = smp_cmd_pairing_req(conn, skb);
2983 break;
2984
2985 case SMP_CMD_PAIRING_FAIL:
2986 smp_failure(conn, 0);
2987 err = -EPERM;
2988 break;
2989
2990 case SMP_CMD_PAIRING_RSP:
2991 reason = smp_cmd_pairing_rsp(conn, skb);
2992 break;
2993
2994 case SMP_CMD_SECURITY_REQ:
2995 reason = smp_cmd_security_req(conn, skb);
2996 break;
2997
2998 case SMP_CMD_PAIRING_CONFIRM:
2999 reason = smp_cmd_pairing_confirm(conn, skb);
3000 break;
3001
3002 case SMP_CMD_PAIRING_RANDOM:
3003 reason = smp_cmd_pairing_random(conn, skb);
3004 break;
3005
3006 case SMP_CMD_ENCRYPT_INFO:
3007 reason = smp_cmd_encrypt_info(conn, skb);
3008 break;
3009
3010 case SMP_CMD_INITIATOR_IDENT:
3011 reason = smp_cmd_initiator_ident(conn, skb);
3012 break;
3013
3014 case SMP_CMD_IDENT_INFO:
3015 reason = smp_cmd_ident_info(conn, skb);
3016 break;
3017
3018 case SMP_CMD_IDENT_ADDR_INFO:
3019 reason = smp_cmd_ident_addr_info(conn, skb);
3020 break;
3021
3022 case SMP_CMD_SIGN_INFO:
3023 reason = smp_cmd_sign_info(conn, skb);
3024 break;
3025
3026 case SMP_CMD_PUBLIC_KEY:
3027 reason = smp_cmd_public_key(conn, skb);
3028 break;
3029
3030 case SMP_CMD_DHKEY_CHECK:
3031 reason = smp_cmd_dhkey_check(conn, skb);
3032 break;
3033
3034 case SMP_CMD_KEYPRESS_NOTIFY:
3035 reason = smp_cmd_keypress_notify(conn, skb);
3036 break;
3037
3038 default:
3039 bt_dev_dbg(hcon->hdev, "Unknown command code 0x%2.2x", code);
3040 reason = SMP_CMD_NOTSUPP;
3041 goto done;
3042 }
3043
3044 done:
3045 if (!err) {
3046 if (reason)
3047 smp_failure(conn, reason);
3048 kfree_skb(skb);
3049 }
3050
3051 return err;
3052
3053 drop:
3054 bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR",
3055 code, &hcon->dst);
3056 kfree_skb(skb);
3057 return 0;
3058 }
3059
smp_teardown_cb(struct l2cap_chan * chan,int err)3060 static void smp_teardown_cb(struct l2cap_chan *chan, int err)
3061 {
3062 struct l2cap_conn *conn = chan->conn;
3063
3064 bt_dev_dbg(conn->hcon->hdev, "chan %p", chan);
3065
3066 if (chan->data)
3067 smp_chan_destroy(conn);
3068
3069 conn->smp = NULL;
3070 l2cap_chan_put(chan);
3071 }
3072
bredr_pairing(struct l2cap_chan * chan)3073 static void bredr_pairing(struct l2cap_chan *chan)
3074 {
3075 struct l2cap_conn *conn = chan->conn;
3076 struct hci_conn *hcon = conn->hcon;
3077 struct hci_dev *hdev = hcon->hdev;
3078 struct smp_chan *smp;
3079
3080 bt_dev_dbg(hdev, "chan %p", chan);
3081
3082 /* Only new pairings are interesting */
3083 if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags))
3084 return;
3085
3086 /* Don't bother if we're not encrypted */
3087 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3088 return;
3089
3090 /* Only initiator may initiate SMP over BR/EDR */
3091 if (hcon->role != HCI_ROLE_MASTER)
3092 return;
3093
3094 /* Secure Connections support must be enabled */
3095 if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED))
3096 return;
3097
3098 /* BR/EDR must use Secure Connections for SMP */
3099 if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) &&
3100 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3101 return;
3102
3103 /* If our LE support is not enabled don't do anything */
3104 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
3105 return;
3106
3107 /* Don't bother if remote LE support is not enabled */
3108 if (!lmp_host_le_capable(hcon))
3109 return;
3110
3111 /* Remote must support SMP fixed chan for BR/EDR */
3112 if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR))
3113 return;
3114
3115 /* Don't bother if SMP is already ongoing */
3116 if (chan->data)
3117 return;
3118
3119 smp = smp_chan_create(conn);
3120 if (!smp) {
3121 bt_dev_err(hdev, "unable to create SMP context for BR/EDR");
3122 return;
3123 }
3124
3125 set_bit(SMP_FLAG_SC, &smp->flags);
3126
3127 bt_dev_dbg(hdev, "starting SMP over BR/EDR");
3128
3129 smp_send_pairing_req(smp, 0x00);
3130 }
3131
smp_resume_cb(struct l2cap_chan * chan)3132 static void smp_resume_cb(struct l2cap_chan *chan)
3133 {
3134 struct smp_chan *smp = chan->data;
3135 struct l2cap_conn *conn = chan->conn;
3136 struct hci_conn *hcon = conn->hcon;
3137
3138 bt_dev_dbg(hcon->hdev, "chan %p", chan);
3139
3140 if (hcon->type == ACL_LINK) {
3141 bredr_pairing(chan);
3142 return;
3143 }
3144
3145 if (!smp)
3146 return;
3147
3148 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3149 return;
3150
3151 cancel_delayed_work(&smp->security_timer);
3152
3153 smp_distribute_keys(smp);
3154 }
3155
smp_ready_cb(struct l2cap_chan * chan)3156 static void smp_ready_cb(struct l2cap_chan *chan)
3157 {
3158 struct l2cap_conn *conn = chan->conn;
3159 struct hci_conn *hcon = conn->hcon;
3160
3161 bt_dev_dbg(hcon->hdev, "chan %p", chan);
3162
3163 /* No need to call l2cap_chan_hold() here since we already own
3164 * the reference taken in smp_new_conn_cb(). This is just the
3165 * first time that we tie it to a specific pointer. The code in
3166 * l2cap_core.c ensures that there's no risk this function won't
3167 * get called if smp_new_conn_cb was previously called.
3168 */
3169 conn->smp = chan;
3170
3171 if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3172 bredr_pairing(chan);
3173 }
3174
smp_recv_cb(struct l2cap_chan * chan,struct sk_buff * skb)3175 static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
3176 {
3177 int err;
3178
3179 bt_dev_dbg(chan->conn->hcon->hdev, "chan %p", chan);
3180
3181 err = smp_sig_channel(chan, skb);
3182 if (err) {
3183 struct smp_chan *smp = chan->data;
3184
3185 if (smp)
3186 cancel_delayed_work_sync(&smp->security_timer);
3187
3188 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
3189 }
3190
3191 return err;
3192 }
3193
smp_alloc_skb_cb(struct l2cap_chan * chan,unsigned long hdr_len,unsigned long len,int nb)3194 static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
3195 unsigned long hdr_len,
3196 unsigned long len, int nb)
3197 {
3198 struct sk_buff *skb;
3199
3200 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
3201 if (!skb)
3202 return ERR_PTR(-ENOMEM);
3203
3204 skb->priority = HCI_PRIO_MAX;
3205 bt_cb(skb)->l2cap.chan = chan;
3206
3207 return skb;
3208 }
3209
3210 static const struct l2cap_ops smp_chan_ops = {
3211 .name = "Security Manager",
3212 .ready = smp_ready_cb,
3213 .recv = smp_recv_cb,
3214 .alloc_skb = smp_alloc_skb_cb,
3215 .teardown = smp_teardown_cb,
3216 .resume = smp_resume_cb,
3217
3218 .new_connection = l2cap_chan_no_new_connection,
3219 .state_change = l2cap_chan_no_state_change,
3220 .close = l2cap_chan_no_close,
3221 .defer = l2cap_chan_no_defer,
3222 .suspend = l2cap_chan_no_suspend,
3223 .set_shutdown = l2cap_chan_no_set_shutdown,
3224 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
3225 };
3226
smp_new_conn_cb(struct l2cap_chan * chan,struct l2cap_chan * new_chan)3227 static inline int smp_new_conn_cb(struct l2cap_chan *chan,
3228 struct l2cap_chan *new_chan)
3229 {
3230 new_chan->ops = &smp_chan_ops;
3231
3232 /* Other L2CAP channels may request SMP routines in order to
3233 * change the security level. This means that the SMP channel
3234 * lock must be considered in its own category to avoid lockdep
3235 * warnings.
3236 */
3237 atomic_set(&new_chan->nesting, L2CAP_NESTING_SMP);
3238
3239 return 0;
3240 }
3241
3242 static const struct l2cap_ops smp_root_chan_ops = {
3243 .name = "Security Manager Root",
3244 .new_connection = smp_new_conn_cb,
3245
3246 /* None of these are implemented for the root channel */
3247 .close = l2cap_chan_no_close,
3248 .alloc_skb = l2cap_chan_no_alloc_skb,
3249 .recv = l2cap_chan_no_recv,
3250 .state_change = l2cap_chan_no_state_change,
3251 .teardown = l2cap_chan_no_teardown,
3252 .ready = l2cap_chan_no_ready,
3253 .defer = l2cap_chan_no_defer,
3254 .suspend = l2cap_chan_no_suspend,
3255 .resume = l2cap_chan_no_resume,
3256 .set_shutdown = l2cap_chan_no_set_shutdown,
3257 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
3258 };
3259
smp_add_cid(struct hci_dev * hdev,u16 cid)3260 static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
3261 {
3262 struct l2cap_chan *chan;
3263 struct smp_dev *smp;
3264 struct crypto_kpp *tfm_ecdh;
3265
3266 if (cid == L2CAP_CID_SMP_BREDR) {
3267 smp = NULL;
3268 goto create_chan;
3269 }
3270
3271 smp = kzalloc_obj(*smp);
3272 if (!smp)
3273 return ERR_PTR(-ENOMEM);
3274
3275 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3276 if (IS_ERR(tfm_ecdh)) {
3277 bt_dev_err(hdev, "Unable to create ECDH crypto context");
3278 kfree_sensitive(smp);
3279 return ERR_CAST(tfm_ecdh);
3280 }
3281
3282 smp->local_oob = false;
3283 smp->tfm_ecdh = tfm_ecdh;
3284
3285 create_chan:
3286 chan = l2cap_chan_create();
3287 if (!chan) {
3288 if (smp) {
3289 crypto_free_kpp(smp->tfm_ecdh);
3290 kfree_sensitive(smp);
3291 }
3292 return ERR_PTR(-ENOMEM);
3293 }
3294
3295 chan->data = smp;
3296
3297 l2cap_add_scid(chan, cid);
3298
3299 l2cap_chan_set_defaults(chan, NULL);
3300
3301 if (cid == L2CAP_CID_SMP) {
3302 u8 bdaddr_type;
3303
3304 hci_copy_identity_address(hdev, &chan->src, &bdaddr_type);
3305
3306 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
3307 chan->src_type = BDADDR_LE_PUBLIC;
3308 else
3309 chan->src_type = BDADDR_LE_RANDOM;
3310 } else {
3311 bacpy(&chan->src, &hdev->bdaddr);
3312 chan->src_type = BDADDR_BREDR;
3313 }
3314
3315 chan->state = BT_LISTEN;
3316 chan->mode = L2CAP_MODE_BASIC;
3317 chan->imtu = L2CAP_DEFAULT_MTU;
3318 chan->ops = &smp_root_chan_ops;
3319
3320 /* Set correct nesting level for a parent/listening channel */
3321 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
3322
3323 return chan;
3324 }
3325
smp_del_chan(struct l2cap_chan * chan)3326 static void smp_del_chan(struct l2cap_chan *chan)
3327 {
3328 struct smp_dev *smp;
3329
3330 BT_DBG("chan %p", chan);
3331
3332 smp = chan->data;
3333 if (smp) {
3334 chan->data = NULL;
3335 crypto_free_kpp(smp->tfm_ecdh);
3336 kfree_sensitive(smp);
3337 }
3338
3339 l2cap_chan_put(chan);
3340 }
3341
smp_force_bredr(struct hci_dev * hdev,bool enable)3342 int smp_force_bredr(struct hci_dev *hdev, bool enable)
3343 {
3344 if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3345 return -EALREADY;
3346
3347 if (enable) {
3348 struct l2cap_chan *chan;
3349
3350 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3351 if (IS_ERR(chan))
3352 return PTR_ERR(chan);
3353
3354 hdev->smp_bredr_data = chan;
3355 } else {
3356 struct l2cap_chan *chan;
3357
3358 chan = hdev->smp_bredr_data;
3359 hdev->smp_bredr_data = NULL;
3360 smp_del_chan(chan);
3361 }
3362
3363 hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP);
3364
3365 return 0;
3366 }
3367
smp_register(struct hci_dev * hdev)3368 int smp_register(struct hci_dev *hdev)
3369 {
3370 struct l2cap_chan *chan;
3371
3372 bt_dev_dbg(hdev, "");
3373
3374 /* If the controller does not support Low Energy operation, then
3375 * there is also no need to register any SMP channel.
3376 */
3377 if (!lmp_le_capable(hdev))
3378 return 0;
3379
3380 if (WARN_ON(hdev->smp_data)) {
3381 chan = hdev->smp_data;
3382 hdev->smp_data = NULL;
3383 smp_del_chan(chan);
3384 }
3385
3386 chan = smp_add_cid(hdev, L2CAP_CID_SMP);
3387 if (IS_ERR(chan))
3388 return PTR_ERR(chan);
3389
3390 hdev->smp_data = chan;
3391
3392 if (!lmp_sc_capable(hdev)) {
3393 /* Flag can be already set here (due to power toggle) */
3394 if (!hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3395 return 0;
3396 }
3397
3398 if (WARN_ON(hdev->smp_bredr_data)) {
3399 chan = hdev->smp_bredr_data;
3400 hdev->smp_bredr_data = NULL;
3401 smp_del_chan(chan);
3402 }
3403
3404 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3405 if (IS_ERR(chan)) {
3406 int err = PTR_ERR(chan);
3407 chan = hdev->smp_data;
3408 hdev->smp_data = NULL;
3409 smp_del_chan(chan);
3410 return err;
3411 }
3412
3413 hdev->smp_bredr_data = chan;
3414
3415 return 0;
3416 }
3417
smp_unregister(struct hci_dev * hdev)3418 void smp_unregister(struct hci_dev *hdev)
3419 {
3420 struct l2cap_chan *chan;
3421
3422 if (hdev->smp_bredr_data) {
3423 chan = hdev->smp_bredr_data;
3424 hdev->smp_bredr_data = NULL;
3425 smp_del_chan(chan);
3426 }
3427
3428 if (hdev->smp_data) {
3429 chan = hdev->smp_data;
3430 hdev->smp_data = NULL;
3431 smp_del_chan(chan);
3432 }
3433 }
3434
3435 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP)
3436
test_debug_key(struct crypto_kpp * tfm_ecdh)3437 static int __init test_debug_key(struct crypto_kpp *tfm_ecdh)
3438 {
3439 u8 pk[64];
3440 int err;
3441
3442 err = set_ecdh_privkey(tfm_ecdh, debug_sk);
3443 if (err)
3444 return err;
3445
3446 err = generate_ecdh_public_key(tfm_ecdh, pk);
3447 if (err)
3448 return err;
3449
3450 if (crypto_memneq(pk, debug_pk, 64))
3451 return -EINVAL;
3452
3453 return 0;
3454 }
3455
test_ah(void)3456 static int __init test_ah(void)
3457 {
3458 const u8 irk[16] = {
3459 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3460 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3461 const u8 r[3] = { 0x94, 0x81, 0x70 };
3462 const u8 exp[3] = { 0xaa, 0xfb, 0x0d };
3463 u8 res[3];
3464 int err;
3465
3466 err = smp_ah(irk, r, res);
3467 if (err)
3468 return err;
3469
3470 if (crypto_memneq(res, exp, 3))
3471 return -EINVAL;
3472
3473 return 0;
3474 }
3475
test_c1(void)3476 static int __init test_c1(void)
3477 {
3478 const u8 k[16] = {
3479 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3480 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3481 const u8 r[16] = {
3482 0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63,
3483 0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 };
3484 const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 };
3485 const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 };
3486 const u8 _iat = 0x01;
3487 const u8 _rat = 0x00;
3488 const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } };
3489 const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } };
3490 const u8 exp[16] = {
3491 0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2,
3492 0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e };
3493 u8 res[16];
3494 int err;
3495
3496 err = smp_c1(k, r, preq, pres, _iat, &ia, _rat, &ra, res);
3497 if (err)
3498 return err;
3499
3500 if (crypto_memneq(res, exp, 16))
3501 return -EINVAL;
3502
3503 return 0;
3504 }
3505
test_s1(void)3506 static int __init test_s1(void)
3507 {
3508 const u8 k[16] = {
3509 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3510 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3511 const u8 r1[16] = {
3512 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 };
3513 const u8 r2[16] = {
3514 0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 };
3515 const u8 exp[16] = {
3516 0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b,
3517 0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a };
3518 u8 res[16];
3519 int err;
3520
3521 err = smp_s1(k, r1, r2, res);
3522 if (err)
3523 return err;
3524
3525 if (crypto_memneq(res, exp, 16))
3526 return -EINVAL;
3527
3528 return 0;
3529 }
3530
test_f4(void)3531 static int __init test_f4(void)
3532 {
3533 const u8 u[32] = {
3534 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3535 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3536 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3537 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3538 const u8 v[32] = {
3539 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3540 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3541 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3542 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3543 const u8 x[16] = {
3544 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3545 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3546 const u8 z = 0x00;
3547 const u8 exp[16] = {
3548 0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1,
3549 0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 };
3550 u8 res[16];
3551 int err;
3552
3553 err = smp_f4(u, v, x, z, res);
3554 if (err)
3555 return err;
3556
3557 if (crypto_memneq(res, exp, 16))
3558 return -EINVAL;
3559
3560 return 0;
3561 }
3562
test_f5(void)3563 static int __init test_f5(void)
3564 {
3565 const u8 w[32] = {
3566 0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86,
3567 0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99,
3568 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3569 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3570 const u8 n1[16] = {
3571 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3572 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3573 const u8 n2[16] = {
3574 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3575 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3576 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3577 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3578 const u8 exp_ltk[16] = {
3579 0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98,
3580 0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 };
3581 const u8 exp_mackey[16] = {
3582 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3583 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3584 u8 mackey[16], ltk[16];
3585 int err;
3586
3587 err = smp_f5(w, n1, n2, a1, a2, mackey, ltk);
3588 if (err)
3589 return err;
3590
3591 if (crypto_memneq(mackey, exp_mackey, 16))
3592 return -EINVAL;
3593
3594 if (crypto_memneq(ltk, exp_ltk, 16))
3595 return -EINVAL;
3596
3597 return 0;
3598 }
3599
test_f6(void)3600 static int __init test_f6(void)
3601 {
3602 const u8 w[16] = {
3603 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3604 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3605 const u8 n1[16] = {
3606 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3607 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3608 const u8 n2[16] = {
3609 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3610 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3611 const u8 r[16] = {
3612 0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08,
3613 0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 };
3614 const u8 io_cap[3] = { 0x02, 0x01, 0x01 };
3615 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3616 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3617 const u8 exp[16] = {
3618 0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2,
3619 0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 };
3620 u8 res[16];
3621 int err;
3622
3623 err = smp_f6(w, n1, n2, r, io_cap, a1, a2, res);
3624 if (err)
3625 return err;
3626
3627 if (crypto_memneq(res, exp, 16))
3628 return -EINVAL;
3629
3630 return 0;
3631 }
3632
test_g2(void)3633 static int __init test_g2(void)
3634 {
3635 const u8 u[32] = {
3636 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3637 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3638 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3639 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3640 const u8 v[32] = {
3641 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3642 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3643 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3644 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3645 const u8 x[16] = {
3646 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3647 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3648 const u8 y[16] = {
3649 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3650 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3651 const u32 exp_val = 0x2f9ed5ba % 1000000;
3652 u32 val;
3653 int err;
3654
3655 err = smp_g2(u, v, x, y, &val);
3656 if (err)
3657 return err;
3658
3659 if (val != exp_val)
3660 return -EINVAL;
3661
3662 return 0;
3663 }
3664
test_h6(void)3665 static int __init test_h6(void)
3666 {
3667 const u8 w[16] = {
3668 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3669 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3670 const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c };
3671 const u8 exp[16] = {
3672 0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8,
3673 0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d };
3674 u8 res[16];
3675 int err;
3676
3677 err = smp_h6(w, key_id, res);
3678 if (err)
3679 return err;
3680
3681 if (crypto_memneq(res, exp, 16))
3682 return -EINVAL;
3683
3684 return 0;
3685 }
3686
3687 static char test_smp_buffer[32];
3688
test_smp_read(struct file * file,char __user * user_buf,size_t count,loff_t * ppos)3689 static ssize_t test_smp_read(struct file *file, char __user *user_buf,
3690 size_t count, loff_t *ppos)
3691 {
3692 return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer,
3693 strlen(test_smp_buffer));
3694 }
3695
3696 static const struct file_operations test_smp_fops = {
3697 .open = simple_open,
3698 .read = test_smp_read,
3699 .llseek = default_llseek,
3700 };
3701
run_selftests(struct crypto_kpp * tfm_ecdh)3702 static int __init run_selftests(struct crypto_kpp *tfm_ecdh)
3703 {
3704 ktime_t calltime, delta, rettime;
3705 unsigned long long duration;
3706 int err;
3707
3708 calltime = ktime_get();
3709
3710 err = test_debug_key(tfm_ecdh);
3711 if (err) {
3712 BT_ERR("debug_key test failed");
3713 goto done;
3714 }
3715
3716 err = test_ah();
3717 if (err) {
3718 BT_ERR("smp_ah test failed");
3719 goto done;
3720 }
3721
3722 err = test_c1();
3723 if (err) {
3724 BT_ERR("smp_c1 test failed");
3725 goto done;
3726 }
3727
3728 err = test_s1();
3729 if (err) {
3730 BT_ERR("smp_s1 test failed");
3731 goto done;
3732 }
3733
3734 err = test_f4();
3735 if (err) {
3736 BT_ERR("smp_f4 test failed");
3737 goto done;
3738 }
3739
3740 err = test_f5();
3741 if (err) {
3742 BT_ERR("smp_f5 test failed");
3743 goto done;
3744 }
3745
3746 err = test_f6();
3747 if (err) {
3748 BT_ERR("smp_f6 test failed");
3749 goto done;
3750 }
3751
3752 err = test_g2();
3753 if (err) {
3754 BT_ERR("smp_g2 test failed");
3755 goto done;
3756 }
3757
3758 err = test_h6();
3759 if (err) {
3760 BT_ERR("smp_h6 test failed");
3761 goto done;
3762 }
3763
3764 rettime = ktime_get();
3765 delta = ktime_sub(rettime, calltime);
3766 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
3767
3768 BT_INFO("SMP test passed in %llu usecs", duration);
3769
3770 done:
3771 if (!err)
3772 snprintf(test_smp_buffer, sizeof(test_smp_buffer),
3773 "PASS (%llu usecs)\n", duration);
3774 else
3775 snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n");
3776
3777 debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL,
3778 &test_smp_fops);
3779
3780 return err;
3781 }
3782
bt_selftest_smp(void)3783 int __init bt_selftest_smp(void)
3784 {
3785 struct crypto_kpp *tfm_ecdh;
3786 int err;
3787
3788 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3789 if (IS_ERR(tfm_ecdh)) {
3790 BT_ERR("Unable to create ECDH crypto context");
3791 return PTR_ERR(tfm_ecdh);
3792 }
3793
3794 err = run_selftests(tfm_ecdh);
3795
3796 crypto_free_kpp(tfm_ecdh);
3797
3798 return err;
3799 }
3800
3801 #endif
3802