1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies). 5 6 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 7 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 8 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 9 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 10 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 11 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 12 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 13 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 14 15 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 16 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 17 SOFTWARE IS DISCLAIMED. 18 */ 19 20 #include <linux/debugfs.h> 21 #include <linux/scatterlist.h> 22 #include <crypto/aes-cbc-macs.h> 23 #include <crypto/aes.h> 24 #include <crypto/kpp.h> 25 #include <crypto/utils.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/l2cap.h> 30 #include <net/bluetooth/mgmt.h> 31 32 #include "ecdh_helper.h" 33 #include "smp.h" 34 35 #define SMP_DEV(hdev) \ 36 ((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data) 37 38 /* Low-level debug macros to be used for stuff that we don't want 39 * accidentally in dmesg, i.e. the values of the various crypto keys 40 * and the inputs & outputs of crypto functions. 41 */ 42 #ifdef DEBUG 43 #define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \ 44 ##__VA_ARGS__) 45 #else 46 #define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \ 47 ##__VA_ARGS__) 48 #endif 49 50 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd) 51 52 /* Keys which are not distributed with Secure Connections */ 53 #define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY) 54 55 #define SMP_TIMEOUT secs_to_jiffies(30) 56 57 #define ID_ADDR_TIMEOUT msecs_to_jiffies(200) 58 59 #define AUTH_REQ_MASK(dev) (hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \ 60 0x3f : 0x07) 61 #define KEY_DIST_MASK 0x07 62 63 /* Maximum message length that can be passed to smp_aes_cmac */ 64 #define CMAC_MSG_MAX 80 65 66 enum { 67 SMP_FLAG_TK_VALID, 68 SMP_FLAG_CFM_PENDING, 69 SMP_FLAG_MITM_AUTH, 70 SMP_FLAG_COMPLETE, 71 SMP_FLAG_INITIATOR, 72 SMP_FLAG_SC, 73 SMP_FLAG_REMOTE_PK, 74 SMP_FLAG_DEBUG_KEY, 75 SMP_FLAG_WAIT_USER, 76 SMP_FLAG_DHKEY_PENDING, 77 SMP_FLAG_REMOTE_OOB, 78 SMP_FLAG_LOCAL_OOB, 79 SMP_FLAG_CT2, 80 }; 81 82 struct smp_dev { 83 /* Secure Connections OOB data */ 84 bool local_oob; 85 u8 local_pk[64]; 86 u8 local_rand[16]; 87 bool debug_key; 88 89 struct crypto_kpp *tfm_ecdh; 90 }; 91 92 struct smp_chan { 93 struct l2cap_conn *conn; 94 struct delayed_work security_timer; 95 unsigned long allow_cmd; /* Bitmask of allowed commands */ 96 97 u8 preq[7]; /* SMP Pairing Request */ 98 u8 prsp[7]; /* SMP Pairing Response */ 99 u8 prnd[16]; /* SMP Pairing Random (local) */ 100 u8 rrnd[16]; /* SMP Pairing Random (remote) */ 101 u8 pcnf[16]; /* SMP Pairing Confirm */ 102 u8 tk[16]; /* SMP Temporary Key */ 103 u8 rr[16]; /* Remote OOB ra/rb value */ 104 u8 lr[16]; /* Local OOB ra/rb value */ 105 u8 enc_key_size; 106 u8 remote_key_dist; 107 bdaddr_t id_addr; 108 u8 id_addr_type; 109 u8 irk[16]; 110 struct smp_csrk *csrk; 111 struct smp_csrk *responder_csrk; 112 struct smp_ltk *ltk; 113 struct smp_ltk *responder_ltk; 114 struct smp_irk *remote_irk; 115 u8 *link_key; 116 unsigned long flags; 117 u8 method; 118 u8 passkey_round; 119 120 /* Secure Connections variables */ 121 u8 local_pk[64]; 122 u8 remote_pk[64]; 123 u8 dhkey[32]; 124 u8 mackey[16]; 125 126 struct crypto_kpp *tfm_ecdh; 127 }; 128 129 /* These debug key values are defined in the SMP section of the core 130 * specification. debug_pk is the public debug key and debug_sk the 131 * private debug key. 132 */ 133 static const u8 debug_pk[64] = { 134 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 135 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 136 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 137 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20, 138 139 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74, 140 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76, 141 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63, 142 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc, 143 }; 144 145 static const u8 debug_sk[32] = { 146 0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58, 147 0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a, 148 0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74, 149 0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f, 150 }; 151 152 static inline void swap_buf(const u8 *src, u8 *dst, size_t len) 153 { 154 size_t i; 155 156 for (i = 0; i < len; i++) 157 dst[len - 1 - i] = src[i]; 158 } 159 160 /* The following functions map to the LE SC SMP crypto functions 161 * AES-CMAC, f4, f5, f6, g2 and h6. 162 */ 163 164 static int smp_aes_cmac(const u8 k[16], const u8 *m, size_t len, u8 mac[16]) 165 { 166 uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX]; 167 struct aes_cmac_key key __cleanup(aes_cmac_zeroize_key); 168 int err; 169 170 if (len > CMAC_MSG_MAX) 171 return -EFBIG; 172 173 /* Swap key and message from LSB to MSB */ 174 swap_buf(k, tmp, 16); 175 swap_buf(m, msg_msb, len); 176 177 SMP_DBG("msg (len %zu) %*phN", len, (int) len, m); 178 SMP_DBG("key %16phN", k); 179 180 err = aes_cmac_preparekey(&key, tmp, 16); 181 memzero_explicit(tmp, sizeof(tmp)); 182 if (WARN_ON_ONCE(err)) /* Should never happen, as 16 is valid keylen */ 183 return err; 184 aes_cmac(&key, msg_msb, len, mac_msb); 185 186 swap_buf(mac_msb, mac, 16); 187 188 SMP_DBG("mac %16phN", mac); 189 190 return 0; 191 } 192 193 static int smp_f4(const u8 u[32], const u8 v[32], const u8 x[16], u8 z, 194 u8 res[16]) 195 { 196 u8 m[65]; 197 int err; 198 199 SMP_DBG("u %32phN", u); 200 SMP_DBG("v %32phN", v); 201 SMP_DBG("x %16phN z %02x", x, z); 202 203 m[0] = z; 204 memcpy(m + 1, v, 32); 205 memcpy(m + 33, u, 32); 206 207 err = smp_aes_cmac(x, m, sizeof(m), res); 208 if (err) 209 return err; 210 211 SMP_DBG("res %16phN", res); 212 213 return err; 214 } 215 216 static int smp_f5(const u8 w[32], const u8 n1[16], const u8 n2[16], 217 const u8 a1[7], const u8 a2[7], u8 mackey[16], u8 ltk[16]) 218 { 219 /* The btle, salt and length "magic" values are as defined in 220 * the SMP section of the Bluetooth core specification. In ASCII 221 * the btle value ends up being 'btle'. The salt is just a 222 * random number whereas length is the value 256 in little 223 * endian format. 224 */ 225 const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 }; 226 const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60, 227 0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c }; 228 const u8 length[2] = { 0x00, 0x01 }; 229 u8 m[53], t[16]; 230 int err; 231 232 SMP_DBG("w %32phN", w); 233 SMP_DBG("n1 %16phN n2 %16phN", n1, n2); 234 SMP_DBG("a1 %7phN a2 %7phN", a1, a2); 235 236 err = smp_aes_cmac(salt, w, 32, t); 237 if (err) 238 return err; 239 240 SMP_DBG("t %16phN", t); 241 242 memcpy(m, length, 2); 243 memcpy(m + 2, a2, 7); 244 memcpy(m + 9, a1, 7); 245 memcpy(m + 16, n2, 16); 246 memcpy(m + 32, n1, 16); 247 memcpy(m + 48, btle, 4); 248 249 m[52] = 0; /* Counter */ 250 251 err = smp_aes_cmac(t, m, sizeof(m), mackey); 252 if (err) 253 return err; 254 255 SMP_DBG("mackey %16phN", mackey); 256 257 m[52] = 1; /* Counter */ 258 259 err = smp_aes_cmac(t, m, sizeof(m), ltk); 260 if (err) 261 return err; 262 263 SMP_DBG("ltk %16phN", ltk); 264 265 return 0; 266 } 267 268 static int smp_f6(const u8 w[16], const u8 n1[16], const u8 n2[16], 269 const u8 r[16], const u8 io_cap[3], const u8 a1[7], 270 const u8 a2[7], u8 res[16]) 271 { 272 u8 m[65]; 273 int err; 274 275 SMP_DBG("w %16phN", w); 276 SMP_DBG("n1 %16phN n2 %16phN", n1, n2); 277 SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2); 278 279 memcpy(m, a2, 7); 280 memcpy(m + 7, a1, 7); 281 memcpy(m + 14, io_cap, 3); 282 memcpy(m + 17, r, 16); 283 memcpy(m + 33, n2, 16); 284 memcpy(m + 49, n1, 16); 285 286 err = smp_aes_cmac(w, m, sizeof(m), res); 287 if (err) 288 return err; 289 290 SMP_DBG("res %16phN", res); 291 292 return err; 293 } 294 295 static int smp_g2(const u8 u[32], const u8 v[32], const u8 x[16], 296 const u8 y[16], u32 *val) 297 { 298 u8 m[80], tmp[16]; 299 int err; 300 301 SMP_DBG("u %32phN", u); 302 SMP_DBG("v %32phN", v); 303 SMP_DBG("x %16phN y %16phN", x, y); 304 305 memcpy(m, y, 16); 306 memcpy(m + 16, v, 32); 307 memcpy(m + 48, u, 32); 308 309 err = smp_aes_cmac(x, m, sizeof(m), tmp); 310 if (err) 311 return err; 312 313 *val = get_unaligned_le32(tmp); 314 *val %= 1000000; 315 316 SMP_DBG("val %06u", *val); 317 318 return 0; 319 } 320 321 static int smp_h6(const u8 w[16], const u8 key_id[4], u8 res[16]) 322 { 323 int err; 324 325 SMP_DBG("w %16phN key_id %4phN", w, key_id); 326 327 err = smp_aes_cmac(w, key_id, 4, res); 328 if (err) 329 return err; 330 331 SMP_DBG("res %16phN", res); 332 333 return err; 334 } 335 336 static int smp_h7(const u8 w[16], const u8 salt[16], u8 res[16]) 337 { 338 int err; 339 340 SMP_DBG("w %16phN salt %16phN", w, salt); 341 342 err = smp_aes_cmac(salt, w, 16, res); 343 if (err) 344 return err; 345 346 SMP_DBG("res %16phN", res); 347 348 return err; 349 } 350 351 /* The following functions map to the legacy SMP crypto functions e, c1, 352 * s1 and ah. 353 */ 354 355 static int smp_e(const u8 *k, u8 *r) 356 { 357 struct aes_enckey aes; 358 uint8_t tmp[16], data[16]; 359 int err; 360 361 SMP_DBG("k %16phN r %16phN", k, r); 362 363 /* The most significant octet of key corresponds to k[0] */ 364 swap_buf(k, tmp, 16); 365 366 err = aes_prepareenckey(&aes, tmp, 16); 367 if (err) { 368 BT_ERR("cipher setkey failed: %d", err); 369 goto out_clear; 370 } 371 372 /* Most significant octet of plaintextData corresponds to data[0] */ 373 swap_buf(r, data, 16); 374 375 aes_encrypt(&aes, data, data); 376 377 /* Most significant octet of encryptedData corresponds to data[0] */ 378 swap_buf(data, r, 16); 379 380 SMP_DBG("r %16phN", r); 381 382 out_clear: 383 memzero_explicit(tmp, sizeof(tmp)); 384 memzero_explicit(&aes, sizeof(aes)); 385 return err; 386 } 387 388 static int smp_c1(const u8 k[16], 389 const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat, 390 const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16]) 391 { 392 u8 p1[16], p2[16]; 393 int err; 394 395 SMP_DBG("k %16phN r %16phN", k, r); 396 SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra); 397 SMP_DBG("preq %7phN pres %7phN", preq, pres); 398 399 memset(p1, 0, 16); 400 401 /* p1 = pres || preq || _rat || _iat */ 402 p1[0] = _iat; 403 p1[1] = _rat; 404 memcpy(p1 + 2, preq, 7); 405 memcpy(p1 + 9, pres, 7); 406 407 SMP_DBG("p1 %16phN", p1); 408 409 /* res = r XOR p1 */ 410 crypto_xor_cpy(res, r, p1, sizeof(p1)); 411 412 /* res = e(k, res) */ 413 err = smp_e(k, res); 414 if (err) { 415 BT_ERR("Encrypt data error"); 416 return err; 417 } 418 419 /* p2 = padding || ia || ra */ 420 memcpy(p2, ra, 6); 421 memcpy(p2 + 6, ia, 6); 422 memset(p2 + 12, 0, 4); 423 424 SMP_DBG("p2 %16phN", p2); 425 426 /* res = res XOR p2 */ 427 crypto_xor(res, p2, sizeof(p2)); 428 429 /* res = e(k, res) */ 430 err = smp_e(k, res); 431 if (err) 432 BT_ERR("Encrypt data error"); 433 434 return err; 435 } 436 437 static int smp_s1(const u8 k[16], 438 const u8 r1[16], const u8 r2[16], u8 _r[16]) 439 { 440 int err; 441 442 /* Just least significant octets from r1 and r2 are considered */ 443 memcpy(_r, r2, 8); 444 memcpy(_r + 8, r1, 8); 445 446 err = smp_e(k, _r); 447 if (err) 448 BT_ERR("Encrypt data error"); 449 450 return err; 451 } 452 453 static int smp_ah(const u8 irk[16], const u8 r[3], u8 res[3]) 454 { 455 u8 _res[16]; 456 int err; 457 458 /* r' = padding || r */ 459 memcpy(_res, r, 3); 460 memset(_res + 3, 0, 13); 461 462 err = smp_e(irk, _res); 463 if (err) { 464 BT_ERR("Encrypt error"); 465 return err; 466 } 467 468 /* The output of the random address function ah is: 469 * ah(k, r) = e(k, r') mod 2^24 470 * The output of the security function e is then truncated to 24 bits 471 * by taking the least significant 24 bits of the output of e as the 472 * result of ah. 473 */ 474 memcpy(res, _res, 3); 475 476 return 0; 477 } 478 479 bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16], 480 const bdaddr_t *bdaddr) 481 { 482 struct l2cap_chan *chan = hdev->smp_data; 483 u8 hash[3]; 484 int err; 485 486 if (!chan || !chan->data) 487 return false; 488 489 bt_dev_dbg(hdev, "RPA %pMR IRK %*phN", bdaddr, 16, irk); 490 491 err = smp_ah(irk, &bdaddr->b[3], hash); 492 if (err) 493 return false; 494 495 return !crypto_memneq(bdaddr->b, hash, 3); 496 } 497 498 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa) 499 { 500 struct l2cap_chan *chan = hdev->smp_data; 501 int err; 502 503 if (!chan || !chan->data) 504 return -EOPNOTSUPP; 505 506 get_random_bytes(&rpa->b[3], 3); 507 508 rpa->b[5] &= 0x3f; /* Clear two most significant bits */ 509 rpa->b[5] |= 0x40; /* Set second most significant bit */ 510 511 err = smp_ah(irk, &rpa->b[3], rpa->b); 512 if (err < 0) 513 return err; 514 515 bt_dev_dbg(hdev, "RPA %pMR", rpa); 516 517 return 0; 518 } 519 520 int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16]) 521 { 522 struct l2cap_chan *chan = hdev->smp_data; 523 struct smp_dev *smp; 524 int err; 525 526 if (!chan || !chan->data) 527 return -EOPNOTSUPP; 528 529 smp = chan->data; 530 531 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 532 bt_dev_dbg(hdev, "Using debug keys"); 533 err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk); 534 if (err) 535 return err; 536 memcpy(smp->local_pk, debug_pk, 64); 537 smp->debug_key = true; 538 } else { 539 while (true) { 540 /* Generate key pair for Secure Connections */ 541 err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk); 542 if (err) 543 return err; 544 545 /* This is unlikely, but we need to check that 546 * we didn't accidentally generate a debug key. 547 */ 548 if (crypto_memneq(smp->local_pk, debug_pk, 64)) 549 break; 550 } 551 smp->debug_key = false; 552 } 553 554 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk); 555 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32); 556 557 get_random_bytes(smp->local_rand, 16); 558 559 err = smp_f4(smp->local_pk, smp->local_pk, smp->local_rand, 0, hash); 560 if (err < 0) 561 return err; 562 563 memcpy(rand, smp->local_rand, 16); 564 565 smp->local_oob = true; 566 567 return 0; 568 } 569 570 static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data) 571 { 572 struct l2cap_chan *chan = conn->smp; 573 struct smp_chan *smp; 574 struct kvec iv[2]; 575 struct msghdr msg; 576 577 if (!chan) 578 return; 579 580 bt_dev_dbg(conn->hcon->hdev, "code 0x%2.2x", code); 581 582 iv[0].iov_base = &code; 583 iv[0].iov_len = 1; 584 585 iv[1].iov_base = data; 586 iv[1].iov_len = len; 587 588 memset(&msg, 0, sizeof(msg)); 589 590 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iv, 2, 1 + len); 591 592 l2cap_chan_send(chan, &msg, 1 + len, NULL); 593 594 if (!chan->data) 595 return; 596 597 smp = chan->data; 598 599 cancel_delayed_work_sync(&smp->security_timer); 600 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT); 601 } 602 603 static u8 authreq_to_seclevel(u8 authreq) 604 { 605 if (authreq & SMP_AUTH_MITM) { 606 if (authreq & SMP_AUTH_SC) 607 return BT_SECURITY_FIPS; 608 else 609 return BT_SECURITY_HIGH; 610 } else { 611 return BT_SECURITY_MEDIUM; 612 } 613 } 614 615 static __u8 seclevel_to_authreq(__u8 sec_level) 616 { 617 switch (sec_level) { 618 case BT_SECURITY_FIPS: 619 case BT_SECURITY_HIGH: 620 return SMP_AUTH_MITM | SMP_AUTH_BONDING; 621 case BT_SECURITY_MEDIUM: 622 return SMP_AUTH_BONDING; 623 default: 624 return SMP_AUTH_NONE; 625 } 626 } 627 628 static void build_pairing_cmd(struct l2cap_conn *conn, 629 struct smp_cmd_pairing *req, 630 struct smp_cmd_pairing *rsp, __u8 authreq) 631 { 632 struct l2cap_chan *chan = conn->smp; 633 struct smp_chan *smp = chan->data; 634 struct hci_conn *hcon = conn->hcon; 635 struct hci_dev *hdev = hcon->hdev; 636 u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT; 637 638 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) { 639 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 640 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 641 authreq |= SMP_AUTH_BONDING; 642 } else { 643 authreq &= ~SMP_AUTH_BONDING; 644 } 645 646 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING)) 647 remote_dist |= SMP_DIST_ID_KEY; 648 649 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 650 local_dist |= SMP_DIST_ID_KEY; 651 652 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 653 (authreq & SMP_AUTH_SC)) { 654 struct oob_data *oob_data; 655 u8 bdaddr_type; 656 657 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 658 local_dist |= SMP_DIST_LINK_KEY; 659 remote_dist |= SMP_DIST_LINK_KEY; 660 } 661 662 if (hcon->dst_type == ADDR_LE_DEV_PUBLIC) 663 bdaddr_type = BDADDR_LE_PUBLIC; 664 else 665 bdaddr_type = BDADDR_LE_RANDOM; 666 667 mutex_lock(&hdev->remote_oob_lock); 668 oob_data = hci_find_remote_oob_data(hdev, &hcon->dst, 669 bdaddr_type); 670 if (oob_data && oob_data->present) { 671 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags); 672 oob_flag = SMP_OOB_PRESENT; 673 memcpy(smp->rr, oob_data->rand256, 16); 674 memcpy(smp->pcnf, oob_data->hash256, 16); 675 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf); 676 SMP_DBG("OOB Remote Random: %16phN", smp->rr); 677 } 678 mutex_unlock(&hdev->remote_oob_lock); 679 680 } else { 681 authreq &= ~SMP_AUTH_SC; 682 } 683 684 if (rsp == NULL) { 685 req->io_capability = conn->hcon->io_capability; 686 req->oob_flag = oob_flag; 687 req->max_key_size = hdev->le_max_key_size; 688 req->init_key_dist = local_dist; 689 req->resp_key_dist = remote_dist; 690 req->auth_req = (authreq & AUTH_REQ_MASK(hdev)); 691 692 smp->remote_key_dist = remote_dist; 693 return; 694 } 695 696 rsp->io_capability = conn->hcon->io_capability; 697 rsp->oob_flag = oob_flag; 698 rsp->max_key_size = hdev->le_max_key_size; 699 rsp->init_key_dist = req->init_key_dist & remote_dist; 700 rsp->resp_key_dist = req->resp_key_dist & local_dist; 701 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev)); 702 703 smp->remote_key_dist = rsp->init_key_dist; 704 } 705 706 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size) 707 { 708 struct l2cap_chan *chan = conn->smp; 709 struct hci_dev *hdev = conn->hcon->hdev; 710 struct smp_chan *smp = chan->data; 711 712 if (conn->hcon->pending_sec_level == BT_SECURITY_FIPS && 713 max_key_size != SMP_MAX_ENC_KEY_SIZE) 714 return SMP_ENC_KEY_SIZE; 715 716 if (max_key_size > hdev->le_max_key_size || 717 max_key_size < SMP_MIN_ENC_KEY_SIZE) 718 return SMP_ENC_KEY_SIZE; 719 720 smp->enc_key_size = max_key_size; 721 722 return 0; 723 } 724 725 static void smp_chan_destroy(struct l2cap_conn *conn) 726 { 727 struct l2cap_chan *chan = conn->smp; 728 struct smp_chan *smp = chan->data; 729 struct hci_conn *hcon = conn->hcon; 730 bool complete; 731 732 BUG_ON(!smp); 733 734 cancel_delayed_work_sync(&smp->security_timer); 735 736 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags); 737 mgmt_smp_complete(hcon, complete); 738 739 kfree_sensitive(smp->csrk); 740 kfree_sensitive(smp->responder_csrk); 741 kfree_sensitive(smp->link_key); 742 743 crypto_free_kpp(smp->tfm_ecdh); 744 745 /* Ensure that we don't leave any debug key around if debug key 746 * support hasn't been explicitly enabled. 747 */ 748 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG && 749 !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) { 750 list_del_rcu(&smp->ltk->list); 751 kfree_rcu(smp->ltk, rcu); 752 smp->ltk = NULL; 753 } 754 755 /* If pairing failed clean up any keys we might have */ 756 if (!complete) { 757 if (smp->ltk) { 758 list_del_rcu(&smp->ltk->list); 759 kfree_rcu(smp->ltk, rcu); 760 } 761 762 if (smp->responder_ltk) { 763 list_del_rcu(&smp->responder_ltk->list); 764 kfree_rcu(smp->responder_ltk, rcu); 765 } 766 767 if (smp->remote_irk) { 768 list_del_rcu(&smp->remote_irk->list); 769 kfree_rcu(smp->remote_irk, rcu); 770 } 771 } 772 773 chan->data = NULL; 774 kfree_sensitive(smp); 775 hci_conn_drop(hcon); 776 } 777 778 static void smp_failure(struct l2cap_conn *conn, u8 reason) 779 { 780 struct hci_conn *hcon = conn->hcon; 781 struct l2cap_chan *chan = conn->smp; 782 783 if (reason) 784 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), 785 &reason); 786 787 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE); 788 789 if (chan->data) 790 smp_chan_destroy(conn); 791 } 792 793 #define JUST_WORKS 0x00 794 #define JUST_CFM 0x01 795 #define REQ_PASSKEY 0x02 796 #define CFM_PASSKEY 0x03 797 #define REQ_OOB 0x04 798 #define DSP_PASSKEY 0x05 799 #define OVERLAP 0xFF 800 801 static const u8 gen_method[5][5] = { 802 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 803 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 804 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 805 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM }, 806 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP }, 807 }; 808 809 static const u8 sc_method[5][5] = { 810 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY }, 811 { JUST_WORKS, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 812 { DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY }, 813 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM }, 814 { DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY }, 815 }; 816 817 static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io) 818 { 819 /* If either side has unknown io_caps, use JUST_CFM (which gets 820 * converted later to JUST_WORKS if we're initiators. 821 */ 822 if (local_io > SMP_IO_KEYBOARD_DISPLAY || 823 remote_io > SMP_IO_KEYBOARD_DISPLAY) 824 return JUST_CFM; 825 826 if (test_bit(SMP_FLAG_SC, &smp->flags)) 827 return sc_method[remote_io][local_io]; 828 829 return gen_method[remote_io][local_io]; 830 } 831 832 static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth, 833 u8 local_io, u8 remote_io) 834 { 835 struct hci_conn *hcon = conn->hcon; 836 struct l2cap_chan *chan = conn->smp; 837 struct smp_chan *smp = chan->data; 838 u32 passkey = 0; 839 int ret; 840 841 /* Initialize key for JUST WORKS */ 842 memset(smp->tk, 0, sizeof(smp->tk)); 843 clear_bit(SMP_FLAG_TK_VALID, &smp->flags); 844 845 bt_dev_dbg(hcon->hdev, "auth:%u lcl:%u rem:%u", auth, local_io, 846 remote_io); 847 848 /* If neither side wants MITM, either "just" confirm an incoming 849 * request or use just-works for outgoing ones. The JUST_CFM 850 * will be converted to JUST_WORKS if necessary later in this 851 * function. If either side has MITM look up the method from the 852 * table. 853 */ 854 if (!(auth & SMP_AUTH_MITM)) 855 smp->method = JUST_CFM; 856 else 857 smp->method = get_auth_method(smp, local_io, remote_io); 858 859 /* Don't confirm locally initiated pairing attempts */ 860 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, 861 &smp->flags)) 862 smp->method = JUST_WORKS; 863 864 /* Don't bother user space with no IO capabilities */ 865 if (smp->method == JUST_CFM && 866 hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 867 smp->method = JUST_WORKS; 868 869 /* If Just Works, Continue with Zero TK and ask user-space for 870 * confirmation */ 871 if (smp->method == JUST_WORKS) { 872 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, 873 hcon->type, 874 hcon->dst_type, 875 passkey, 1); 876 if (ret) 877 return ret; 878 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 879 return 0; 880 } 881 882 /* If this function is used for SC -> legacy fallback we 883 * can only recover the just-works case. 884 */ 885 if (test_bit(SMP_FLAG_SC, &smp->flags)) 886 return -EINVAL; 887 888 /* Not Just Works/Confirm results in MITM Authentication */ 889 if (smp->method != JUST_CFM) { 890 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags); 891 if (hcon->pending_sec_level < BT_SECURITY_HIGH) 892 hcon->pending_sec_level = BT_SECURITY_HIGH; 893 } 894 895 /* If both devices have Keyboard-Display I/O, the initiator 896 * Confirms and the responder Enters the passkey. 897 */ 898 if (smp->method == OVERLAP) { 899 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 900 smp->method = CFM_PASSKEY; 901 else 902 smp->method = REQ_PASSKEY; 903 } 904 905 /* Generate random passkey. */ 906 if (smp->method == CFM_PASSKEY) { 907 memset(smp->tk, 0, sizeof(smp->tk)); 908 get_random_bytes(&passkey, sizeof(passkey)); 909 passkey %= 1000000; 910 put_unaligned_le32(passkey, smp->tk); 911 bt_dev_dbg(hcon->hdev, "PassKey: %u", passkey); 912 set_bit(SMP_FLAG_TK_VALID, &smp->flags); 913 } 914 915 if (smp->method == REQ_PASSKEY) 916 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst, 917 hcon->type, hcon->dst_type); 918 else if (smp->method == JUST_CFM) 919 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, 920 hcon->type, hcon->dst_type, 921 passkey, 1); 922 else 923 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst, 924 hcon->type, hcon->dst_type, 925 passkey, 0); 926 927 return ret; 928 } 929 930 static u8 smp_confirm(struct smp_chan *smp) 931 { 932 struct l2cap_conn *conn = smp->conn; 933 struct smp_cmd_pairing_confirm cp; 934 int ret; 935 936 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); 937 938 ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp, 939 conn->hcon->init_addr_type, &conn->hcon->init_addr, 940 conn->hcon->resp_addr_type, &conn->hcon->resp_addr, 941 cp.confirm_val); 942 if (ret) 943 return SMP_UNSPECIFIED; 944 945 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 946 947 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp); 948 949 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 950 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 951 else 952 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 953 954 return 0; 955 } 956 957 static u8 smp_random(struct smp_chan *smp) 958 { 959 struct l2cap_conn *conn = smp->conn; 960 struct hci_conn *hcon = conn->hcon; 961 u8 confirm[16]; 962 int ret; 963 964 bt_dev_dbg(conn->hcon->hdev, "conn %p %s", conn, 965 test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" : 966 "responder"); 967 968 ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp, 969 hcon->init_addr_type, &hcon->init_addr, 970 hcon->resp_addr_type, &hcon->resp_addr, confirm); 971 if (ret) 972 return SMP_UNSPECIFIED; 973 974 if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) { 975 bt_dev_err(hcon->hdev, "pairing failed " 976 "(confirmation values mismatch)"); 977 return SMP_CONFIRM_FAILED; 978 } 979 980 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 981 u8 stk[16]; 982 __le64 rand = 0; 983 __le16 ediv = 0; 984 985 smp_s1(smp->tk, smp->rrnd, smp->prnd, stk); 986 987 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) 988 return SMP_UNSPECIFIED; 989 990 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size); 991 hcon->enc_key_size = smp->enc_key_size; 992 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); 993 } else { 994 u8 stk[16], auth; 995 __le64 rand = 0; 996 __le16 ediv = 0; 997 998 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 999 smp->prnd); 1000 1001 smp_s1(smp->tk, smp->prnd, smp->rrnd, stk); 1002 1003 auth = test_bit(SMP_FLAG_MITM_AUTH, &smp->flags) ? 1 : 0; 1004 1005 /* Even though there's no _RESPONDER suffix this is the 1006 * responder STK we're adding for later lookup (the initiator 1007 * STK never needs to be stored). 1008 */ 1009 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 1010 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand); 1011 } 1012 1013 return 0; 1014 } 1015 1016 static void smp_notify_keys(struct l2cap_conn *conn) 1017 { 1018 struct l2cap_chan *chan = conn->smp; 1019 struct smp_chan *smp = chan->data; 1020 struct hci_conn *hcon = conn->hcon; 1021 struct hci_dev *hdev = hcon->hdev; 1022 struct smp_cmd_pairing *req = (void *) &smp->preq[1]; 1023 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1]; 1024 bool persistent; 1025 1026 if (hcon->type == ACL_LINK) { 1027 if (hcon->key_type == HCI_LK_DEBUG_COMBINATION) 1028 persistent = false; 1029 else 1030 persistent = !test_bit(HCI_CONN_FLUSH_KEY, 1031 &hcon->flags); 1032 } else { 1033 /* The LTKs, IRKs and CSRKs should be persistent only if 1034 * both sides had the bonding bit set in their 1035 * authentication requests. 1036 */ 1037 persistent = !!((req->auth_req & rsp->auth_req) & 1038 SMP_AUTH_BONDING); 1039 } 1040 1041 if (smp->remote_irk) { 1042 mgmt_new_irk(hdev, smp->remote_irk, persistent); 1043 1044 /* Now that user space can be considered to know the 1045 * identity address track the connection based on it 1046 * from now on (assuming this is an LE link). 1047 */ 1048 if (hcon->type == LE_LINK) { 1049 bacpy(&hcon->dst, &smp->remote_irk->bdaddr); 1050 hcon->dst_type = smp->remote_irk->addr_type; 1051 /* Use a short delay to make sure the new address is 1052 * propagated _before_ the channels. 1053 */ 1054 queue_delayed_work(hdev->workqueue, 1055 &conn->id_addr_timer, 1056 ID_ADDR_TIMEOUT); 1057 } 1058 } 1059 1060 if (smp->csrk) { 1061 smp->csrk->bdaddr_type = hcon->dst_type; 1062 bacpy(&smp->csrk->bdaddr, &hcon->dst); 1063 mgmt_new_csrk(hdev, smp->csrk, persistent); 1064 } 1065 1066 if (smp->responder_csrk) { 1067 smp->responder_csrk->bdaddr_type = hcon->dst_type; 1068 bacpy(&smp->responder_csrk->bdaddr, &hcon->dst); 1069 mgmt_new_csrk(hdev, smp->responder_csrk, persistent); 1070 } 1071 1072 if (smp->ltk) { 1073 smp->ltk->bdaddr_type = hcon->dst_type; 1074 bacpy(&smp->ltk->bdaddr, &hcon->dst); 1075 mgmt_new_ltk(hdev, smp->ltk, persistent); 1076 } 1077 1078 if (smp->responder_ltk) { 1079 smp->responder_ltk->bdaddr_type = hcon->dst_type; 1080 bacpy(&smp->responder_ltk->bdaddr, &hcon->dst); 1081 mgmt_new_ltk(hdev, smp->responder_ltk, persistent); 1082 } 1083 1084 if (smp->link_key) { 1085 struct link_key *key; 1086 u8 type; 1087 1088 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) 1089 type = HCI_LK_DEBUG_COMBINATION; 1090 else if (hcon->sec_level == BT_SECURITY_FIPS) 1091 type = HCI_LK_AUTH_COMBINATION_P256; 1092 else 1093 type = HCI_LK_UNAUTH_COMBINATION_P256; 1094 1095 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, 1096 smp->link_key, type, 0, &persistent); 1097 if (key) { 1098 mgmt_new_link_key(hdev, key, persistent); 1099 1100 /* Don't keep debug keys around if the relevant 1101 * flag is not set. 1102 */ 1103 if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) && 1104 key->type == HCI_LK_DEBUG_COMBINATION) { 1105 list_del_rcu(&key->list); 1106 kfree_rcu(key, rcu); 1107 } 1108 } 1109 } 1110 } 1111 1112 static void sc_add_ltk(struct smp_chan *smp) 1113 { 1114 struct hci_conn *hcon = smp->conn->hcon; 1115 u8 key_type, auth; 1116 1117 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) 1118 key_type = SMP_LTK_P256_DEBUG; 1119 else 1120 key_type = SMP_LTK_P256; 1121 1122 if (hcon->pending_sec_level == BT_SECURITY_FIPS) 1123 auth = 1; 1124 else 1125 auth = 0; 1126 1127 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 1128 key_type, auth, smp->tk, smp->enc_key_size, 1129 0, 0); 1130 } 1131 1132 static void sc_generate_link_key(struct smp_chan *smp) 1133 { 1134 /* From core spec. Spells out in ASCII as 'lebr'. */ 1135 const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c }; 1136 1137 smp->link_key = kzalloc(16, GFP_KERNEL); 1138 if (!smp->link_key) 1139 return; 1140 1141 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { 1142 /* SALT = 0x000000000000000000000000746D7031 */ 1143 const u8 salt[16] = { 0x31, 0x70, 0x6d, 0x74 }; 1144 1145 if (smp_h7(smp->tk, salt, smp->link_key)) { 1146 kfree_sensitive(smp->link_key); 1147 smp->link_key = NULL; 1148 return; 1149 } 1150 } else { 1151 /* From core spec. Spells out in ASCII as 'tmp1'. */ 1152 const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 }; 1153 1154 if (smp_h6(smp->tk, tmp1, smp->link_key)) { 1155 kfree_sensitive(smp->link_key); 1156 smp->link_key = NULL; 1157 return; 1158 } 1159 } 1160 1161 if (smp_h6(smp->link_key, lebr, smp->link_key)) { 1162 kfree_sensitive(smp->link_key); 1163 smp->link_key = NULL; 1164 return; 1165 } 1166 } 1167 1168 static void smp_allow_key_dist(struct smp_chan *smp) 1169 { 1170 /* Allow the first expected phase 3 PDU. The rest of the PDUs 1171 * will be allowed in each PDU handler to ensure we receive 1172 * them in the correct order. 1173 */ 1174 if (smp->remote_key_dist & SMP_DIST_ENC_KEY) 1175 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO); 1176 else if (smp->remote_key_dist & SMP_DIST_ID_KEY) 1177 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); 1178 else if (smp->remote_key_dist & SMP_DIST_SIGN) 1179 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 1180 } 1181 1182 static void sc_generate_ltk(struct smp_chan *smp) 1183 { 1184 /* From core spec. Spells out in ASCII as 'brle'. */ 1185 const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 }; 1186 struct hci_conn *hcon = smp->conn->hcon; 1187 struct hci_dev *hdev = hcon->hdev; 1188 struct link_key *key; 1189 1190 key = hci_find_link_key(hdev, &hcon->dst); 1191 if (!key) { 1192 bt_dev_err(hdev, "no Link Key found to generate LTK"); 1193 return; 1194 } 1195 1196 if (key->type == HCI_LK_DEBUG_COMBINATION) 1197 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1198 1199 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { 1200 /* SALT = 0x000000000000000000000000746D7032 */ 1201 const u8 salt[16] = { 0x32, 0x70, 0x6d, 0x74 }; 1202 1203 if (smp_h7(key->val, salt, smp->tk)) 1204 return; 1205 } else { 1206 /* From core spec. Spells out in ASCII as 'tmp2'. */ 1207 const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 }; 1208 1209 if (smp_h6(key->val, tmp2, smp->tk)) 1210 return; 1211 } 1212 1213 if (smp_h6(smp->tk, brle, smp->tk)) 1214 return; 1215 1216 sc_add_ltk(smp); 1217 } 1218 1219 static void smp_distribute_keys(struct smp_chan *smp) 1220 { 1221 struct smp_cmd_pairing *req, *rsp; 1222 struct l2cap_conn *conn = smp->conn; 1223 struct hci_conn *hcon = conn->hcon; 1224 struct hci_dev *hdev = hcon->hdev; 1225 __u8 *keydist; 1226 1227 bt_dev_dbg(hdev, "conn %p", conn); 1228 1229 rsp = (void *) &smp->prsp[1]; 1230 1231 /* The responder sends its keys first */ 1232 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags) && 1233 (smp->remote_key_dist & KEY_DIST_MASK)) { 1234 smp_allow_key_dist(smp); 1235 return; 1236 } 1237 1238 req = (void *) &smp->preq[1]; 1239 1240 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 1241 keydist = &rsp->init_key_dist; 1242 *keydist &= req->init_key_dist; 1243 } else { 1244 keydist = &rsp->resp_key_dist; 1245 *keydist &= req->resp_key_dist; 1246 } 1247 1248 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1249 if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY)) 1250 sc_generate_link_key(smp); 1251 if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY)) 1252 sc_generate_ltk(smp); 1253 1254 /* Clear the keys which are generated but not distributed */ 1255 *keydist &= ~SMP_SC_NO_DIST; 1256 } 1257 1258 bt_dev_dbg(hdev, "keydist 0x%x", *keydist); 1259 1260 if (*keydist & SMP_DIST_ENC_KEY) { 1261 struct smp_cmd_encrypt_info enc; 1262 struct smp_cmd_initiator_ident ident; 1263 struct smp_ltk *ltk; 1264 u8 authenticated; 1265 __le16 ediv; 1266 __le64 rand; 1267 1268 /* Make sure we generate only the significant amount of 1269 * bytes based on the encryption key size, and set the rest 1270 * of the value to zeroes. 1271 */ 1272 get_random_bytes(enc.ltk, smp->enc_key_size); 1273 memset(enc.ltk + smp->enc_key_size, 0, 1274 sizeof(enc.ltk) - smp->enc_key_size); 1275 1276 get_random_bytes(&ediv, sizeof(ediv)); 1277 get_random_bytes(&rand, sizeof(rand)); 1278 1279 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc); 1280 1281 authenticated = hcon->sec_level == BT_SECURITY_HIGH; 1282 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, 1283 SMP_LTK_RESPONDER, authenticated, enc.ltk, 1284 smp->enc_key_size, ediv, rand); 1285 smp->responder_ltk = ltk; 1286 1287 ident.ediv = ediv; 1288 ident.rand = rand; 1289 1290 smp_send_cmd(conn, SMP_CMD_INITIATOR_IDENT, sizeof(ident), 1291 &ident); 1292 1293 *keydist &= ~SMP_DIST_ENC_KEY; 1294 } 1295 1296 if (*keydist & SMP_DIST_ID_KEY) { 1297 struct smp_cmd_ident_addr_info addrinfo; 1298 struct smp_cmd_ident_info idinfo; 1299 1300 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk)); 1301 1302 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo); 1303 1304 /* The hci_conn contains the local identity address 1305 * after the connection has been established. 1306 * 1307 * This is true even when the connection has been 1308 * established using a resolvable random address. 1309 */ 1310 bacpy(&addrinfo.bdaddr, &hcon->src); 1311 addrinfo.addr_type = hcon->src_type; 1312 1313 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo), 1314 &addrinfo); 1315 1316 *keydist &= ~SMP_DIST_ID_KEY; 1317 } 1318 1319 if (*keydist & SMP_DIST_SIGN) { 1320 struct smp_cmd_sign_info sign; 1321 struct smp_csrk *csrk; 1322 1323 /* Generate a new random key */ 1324 get_random_bytes(sign.csrk, sizeof(sign.csrk)); 1325 1326 csrk = kzalloc_obj(*csrk); 1327 if (csrk) { 1328 if (hcon->sec_level > BT_SECURITY_MEDIUM) 1329 csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED; 1330 else 1331 csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED; 1332 memcpy(csrk->val, sign.csrk, sizeof(csrk->val)); 1333 } 1334 smp->responder_csrk = csrk; 1335 1336 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign); 1337 1338 *keydist &= ~SMP_DIST_SIGN; 1339 } 1340 1341 /* If there are still keys to be received wait for them */ 1342 if (smp->remote_key_dist & KEY_DIST_MASK) { 1343 smp_allow_key_dist(smp); 1344 return; 1345 } 1346 1347 set_bit(SMP_FLAG_COMPLETE, &smp->flags); 1348 smp_notify_keys(conn); 1349 1350 smp_chan_destroy(conn); 1351 } 1352 1353 static void smp_timeout(struct work_struct *work) 1354 { 1355 struct smp_chan *smp = container_of(work, struct smp_chan, 1356 security_timer.work); 1357 struct l2cap_conn *conn = smp->conn; 1358 1359 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); 1360 1361 hci_disconnect(conn->hcon, HCI_ERROR_AUTH_FAILURE); 1362 } 1363 1364 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn) 1365 { 1366 struct hci_conn *hcon = conn->hcon; 1367 struct l2cap_chan *chan = conn->smp; 1368 struct smp_chan *smp; 1369 1370 smp = kzalloc_obj(*smp, GFP_ATOMIC); 1371 if (!smp) 1372 return NULL; 1373 1374 smp->tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0); 1375 if (IS_ERR(smp->tfm_ecdh)) { 1376 bt_dev_err(hcon->hdev, "Unable to create ECDH crypto context"); 1377 goto zfree_smp; 1378 } 1379 1380 smp->conn = conn; 1381 chan->data = smp; 1382 1383 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL); 1384 1385 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout); 1386 1387 hci_conn_hold(hcon); 1388 1389 return smp; 1390 1391 zfree_smp: 1392 kfree_sensitive(smp); 1393 return NULL; 1394 } 1395 1396 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16]) 1397 { 1398 struct hci_conn *hcon = smp->conn->hcon; 1399 u8 *na, *nb, a[7], b[7]; 1400 1401 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 1402 na = smp->prnd; 1403 nb = smp->rrnd; 1404 } else { 1405 na = smp->rrnd; 1406 nb = smp->prnd; 1407 } 1408 1409 memcpy(a, &hcon->init_addr, 6); 1410 memcpy(b, &hcon->resp_addr, 6); 1411 a[6] = hcon->init_addr_type; 1412 b[6] = hcon->resp_addr_type; 1413 1414 return smp_f5(smp->dhkey, na, nb, a, b, mackey, ltk); 1415 } 1416 1417 static void sc_dhkey_check(struct smp_chan *smp) 1418 { 1419 struct hci_conn *hcon = smp->conn->hcon; 1420 struct smp_cmd_dhkey_check check; 1421 u8 a[7], b[7], *local_addr, *remote_addr; 1422 u8 io_cap[3], r[16]; 1423 1424 memcpy(a, &hcon->init_addr, 6); 1425 memcpy(b, &hcon->resp_addr, 6); 1426 a[6] = hcon->init_addr_type; 1427 b[6] = hcon->resp_addr_type; 1428 1429 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 1430 local_addr = a; 1431 remote_addr = b; 1432 memcpy(io_cap, &smp->preq[1], 3); 1433 } else { 1434 local_addr = b; 1435 remote_addr = a; 1436 memcpy(io_cap, &smp->prsp[1], 3); 1437 } 1438 1439 memset(r, 0, sizeof(r)); 1440 1441 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 1442 put_unaligned_le32(hcon->passkey_notify, r); 1443 1444 if (smp->method == REQ_OOB) 1445 memcpy(r, smp->rr, 16); 1446 1447 smp_f6(smp->mackey, smp->prnd, smp->rrnd, r, io_cap, local_addr, 1448 remote_addr, check.e); 1449 1450 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check); 1451 } 1452 1453 static u8 sc_passkey_send_confirm(struct smp_chan *smp) 1454 { 1455 struct l2cap_conn *conn = smp->conn; 1456 struct hci_conn *hcon = conn->hcon; 1457 struct smp_cmd_pairing_confirm cfm; 1458 u8 r; 1459 1460 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); 1461 r |= 0x80; 1462 1463 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1464 1465 if (smp_f4(smp->local_pk, smp->remote_pk, smp->prnd, r, 1466 cfm.confirm_val)) 1467 return SMP_UNSPECIFIED; 1468 1469 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm); 1470 1471 return 0; 1472 } 1473 1474 static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op) 1475 { 1476 struct l2cap_conn *conn = smp->conn; 1477 struct hci_conn *hcon = conn->hcon; 1478 struct hci_dev *hdev = hcon->hdev; 1479 u8 cfm[16], r; 1480 1481 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */ 1482 if (smp->passkey_round >= 20) 1483 return 0; 1484 1485 switch (smp_op) { 1486 case SMP_CMD_PAIRING_RANDOM: 1487 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); 1488 r |= 0x80; 1489 1490 if (smp_f4(smp->remote_pk, smp->local_pk, smp->rrnd, r, cfm)) 1491 return SMP_UNSPECIFIED; 1492 1493 if (crypto_memneq(smp->pcnf, cfm, 16)) 1494 return SMP_CONFIRM_FAILED; 1495 1496 smp->passkey_round++; 1497 1498 if (smp->passkey_round == 20) { 1499 /* Generate MacKey and LTK */ 1500 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk)) 1501 return SMP_UNSPECIFIED; 1502 } 1503 1504 /* The round is only complete when the initiator 1505 * receives pairing random. 1506 */ 1507 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 1508 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 1509 sizeof(smp->prnd), smp->prnd); 1510 if (smp->passkey_round == 20) 1511 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1512 else 1513 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1514 return 0; 1515 } 1516 1517 /* Start the next round */ 1518 if (smp->passkey_round != 20) 1519 return sc_passkey_round(smp, 0); 1520 1521 /* Passkey rounds are complete - start DHKey Check */ 1522 sc_dhkey_check(smp); 1523 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1524 1525 break; 1526 1527 case SMP_CMD_PAIRING_CONFIRM: 1528 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { 1529 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 1530 return 0; 1531 } 1532 1533 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 1534 1535 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 1536 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 1537 sizeof(smp->prnd), smp->prnd); 1538 return 0; 1539 } 1540 1541 return sc_passkey_send_confirm(smp); 1542 1543 case SMP_CMD_PUBLIC_KEY: 1544 default: 1545 /* Initiating device starts the round */ 1546 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 1547 return 0; 1548 1549 bt_dev_dbg(hdev, "Starting passkey round %u", 1550 smp->passkey_round + 1); 1551 1552 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1553 1554 return sc_passkey_send_confirm(smp); 1555 } 1556 1557 return 0; 1558 } 1559 1560 static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey) 1561 { 1562 struct l2cap_conn *conn = smp->conn; 1563 struct hci_conn *hcon = conn->hcon; 1564 u8 smp_op; 1565 1566 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags); 1567 1568 switch (mgmt_op) { 1569 case MGMT_OP_USER_PASSKEY_NEG_REPLY: 1570 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED); 1571 return 0; 1572 case MGMT_OP_USER_CONFIRM_NEG_REPLY: 1573 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED); 1574 return 0; 1575 case MGMT_OP_USER_PASSKEY_REPLY: 1576 hcon->passkey_notify = le32_to_cpu(passkey); 1577 smp->passkey_round = 0; 1578 1579 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) 1580 smp_op = SMP_CMD_PAIRING_CONFIRM; 1581 else 1582 smp_op = 0; 1583 1584 if (sc_passkey_round(smp, smp_op)) 1585 return -EIO; 1586 1587 return 0; 1588 } 1589 1590 /* Initiator sends DHKey check first */ 1591 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 1592 sc_dhkey_check(smp); 1593 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 1594 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) { 1595 sc_dhkey_check(smp); 1596 sc_add_ltk(smp); 1597 } 1598 1599 return 0; 1600 } 1601 1602 int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey) 1603 { 1604 struct l2cap_conn *conn = hcon->l2cap_data; 1605 struct l2cap_chan *chan; 1606 struct smp_chan *smp; 1607 u32 value; 1608 int err; 1609 1610 if (!conn) 1611 return -ENOTCONN; 1612 1613 bt_dev_dbg(conn->hcon->hdev, ""); 1614 1615 chan = conn->smp; 1616 if (!chan) 1617 return -ENOTCONN; 1618 1619 l2cap_chan_lock(chan); 1620 if (!chan->data) { 1621 err = -ENOTCONN; 1622 goto unlock; 1623 } 1624 1625 smp = chan->data; 1626 1627 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1628 err = sc_user_reply(smp, mgmt_op, passkey); 1629 goto unlock; 1630 } 1631 1632 switch (mgmt_op) { 1633 case MGMT_OP_USER_PASSKEY_REPLY: 1634 value = le32_to_cpu(passkey); 1635 memset(smp->tk, 0, sizeof(smp->tk)); 1636 bt_dev_dbg(conn->hcon->hdev, "PassKey: %u", value); 1637 put_unaligned_le32(value, smp->tk); 1638 fallthrough; 1639 case MGMT_OP_USER_CONFIRM_REPLY: 1640 set_bit(SMP_FLAG_TK_VALID, &smp->flags); 1641 break; 1642 case MGMT_OP_USER_PASSKEY_NEG_REPLY: 1643 case MGMT_OP_USER_CONFIRM_NEG_REPLY: 1644 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED); 1645 err = 0; 1646 goto unlock; 1647 default: 1648 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED); 1649 err = -EOPNOTSUPP; 1650 goto unlock; 1651 } 1652 1653 err = 0; 1654 1655 /* If it is our turn to send Pairing Confirm, do so now */ 1656 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) { 1657 u8 rsp = smp_confirm(smp); 1658 if (rsp) 1659 smp_failure(conn, rsp); 1660 } 1661 1662 unlock: 1663 l2cap_chan_unlock(chan); 1664 return err; 1665 } 1666 1667 static void build_bredr_pairing_cmd(struct smp_chan *smp, 1668 struct smp_cmd_pairing *req, 1669 struct smp_cmd_pairing *rsp) 1670 { 1671 struct l2cap_conn *conn = smp->conn; 1672 struct hci_dev *hdev = conn->hcon->hdev; 1673 u8 local_dist = 0, remote_dist = 0; 1674 1675 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) { 1676 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 1677 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN; 1678 } 1679 1680 if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING)) 1681 remote_dist |= SMP_DIST_ID_KEY; 1682 1683 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 1684 local_dist |= SMP_DIST_ID_KEY; 1685 1686 if (!rsp) { 1687 memset(req, 0, sizeof(*req)); 1688 1689 req->auth_req = SMP_AUTH_CT2; 1690 req->init_key_dist = local_dist; 1691 req->resp_key_dist = remote_dist; 1692 req->max_key_size = conn->hcon->enc_key_size; 1693 1694 smp->remote_key_dist = remote_dist; 1695 1696 return; 1697 } 1698 1699 memset(rsp, 0, sizeof(*rsp)); 1700 1701 rsp->auth_req = SMP_AUTH_CT2; 1702 rsp->max_key_size = conn->hcon->enc_key_size; 1703 rsp->init_key_dist = req->init_key_dist & remote_dist; 1704 rsp->resp_key_dist = req->resp_key_dist & local_dist; 1705 1706 smp->remote_key_dist = rsp->init_key_dist; 1707 } 1708 1709 static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) 1710 { 1711 struct smp_cmd_pairing rsp, *req = (void *) skb->data; 1712 struct l2cap_chan *chan = conn->smp; 1713 struct hci_dev *hdev = conn->hcon->hdev; 1714 struct smp_chan *smp = chan->data; 1715 u8 key_size, auth, sec_level; 1716 int ret; 1717 1718 bt_dev_dbg(hdev, "conn %p", conn); 1719 1720 if (skb->len < sizeof(*req)) 1721 return SMP_INVALID_PARAMS; 1722 1723 if (smp && test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 1724 return SMP_CMD_NOTSUPP; 1725 1726 if (!smp) { 1727 smp = smp_chan_create(conn); 1728 if (!smp) 1729 return SMP_UNSPECIFIED; 1730 } 1731 1732 /* We didn't start the pairing, so match remote */ 1733 auth = req->auth_req & AUTH_REQ_MASK(hdev); 1734 1735 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) && 1736 (auth & SMP_AUTH_BONDING)) 1737 return SMP_PAIRING_NOTSUPP; 1738 1739 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 1740 return SMP_AUTH_REQUIREMENTS; 1741 1742 smp->preq[0] = SMP_CMD_PAIRING_REQ; 1743 memcpy(&smp->preq[1], req, sizeof(*req)); 1744 skb_pull(skb, sizeof(*req)); 1745 1746 /* If the remote side's OOB flag is set it means it has 1747 * successfully received our local OOB data - therefore set the 1748 * flag to indicate that local OOB is in use. 1749 */ 1750 if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob) 1751 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); 1752 1753 /* SMP over BR/EDR requires special treatment */ 1754 if (conn->hcon->type == ACL_LINK) { 1755 /* We must have a BR/EDR SC link */ 1756 if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) && 1757 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 1758 return SMP_CROSS_TRANSP_NOT_ALLOWED; 1759 1760 set_bit(SMP_FLAG_SC, &smp->flags); 1761 1762 build_bredr_pairing_cmd(smp, req, &rsp); 1763 1764 if (req->auth_req & SMP_AUTH_CT2) 1765 set_bit(SMP_FLAG_CT2, &smp->flags); 1766 1767 key_size = min(req->max_key_size, rsp.max_key_size); 1768 if (check_enc_key_size(conn, key_size)) 1769 return SMP_ENC_KEY_SIZE; 1770 1771 /* Clear bits which are generated but not distributed */ 1772 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1773 1774 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1775 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); 1776 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp); 1777 1778 smp_distribute_keys(smp); 1779 return 0; 1780 } 1781 1782 build_pairing_cmd(conn, req, &rsp, auth); 1783 1784 if (rsp.auth_req & SMP_AUTH_SC) { 1785 set_bit(SMP_FLAG_SC, &smp->flags); 1786 1787 if (rsp.auth_req & SMP_AUTH_CT2) 1788 set_bit(SMP_FLAG_CT2, &smp->flags); 1789 } 1790 1791 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 1792 sec_level = BT_SECURITY_MEDIUM; 1793 else 1794 sec_level = authreq_to_seclevel(auth); 1795 1796 if (sec_level > conn->hcon->pending_sec_level) 1797 conn->hcon->pending_sec_level = sec_level; 1798 1799 /* If we need MITM check that it can be achieved. */ 1800 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { 1801 u8 method; 1802 1803 method = get_auth_method(smp, conn->hcon->io_capability, 1804 req->io_capability); 1805 if (method == JUST_WORKS || method == JUST_CFM) 1806 return SMP_AUTH_REQUIREMENTS; 1807 1808 /* Force MITM bit if it isn't set by the initiator. */ 1809 auth |= SMP_AUTH_MITM; 1810 rsp.auth_req |= SMP_AUTH_MITM; 1811 } 1812 1813 key_size = min(req->max_key_size, rsp.max_key_size); 1814 if (check_enc_key_size(conn, key_size)) 1815 return SMP_ENC_KEY_SIZE; 1816 1817 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1818 1819 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1820 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); 1821 1822 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp); 1823 1824 clear_bit(SMP_FLAG_INITIATOR, &smp->flags); 1825 1826 /* Strictly speaking we shouldn't allow Pairing Confirm for the 1827 * SC case, however some implementations incorrectly copy RFU auth 1828 * req bits from our security request, which may create a false 1829 * positive SC enablement. 1830 */ 1831 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 1832 1833 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1834 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); 1835 /* Clear bits which are generated but not distributed */ 1836 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1837 /* Wait for Public Key from Initiating Device */ 1838 return 0; 1839 } 1840 1841 /* Request setup of TK */ 1842 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability); 1843 if (ret) 1844 return SMP_UNSPECIFIED; 1845 1846 return 0; 1847 } 1848 1849 static u8 sc_send_public_key(struct smp_chan *smp) 1850 { 1851 struct hci_dev *hdev = smp->conn->hcon->hdev; 1852 1853 bt_dev_dbg(hdev, ""); 1854 1855 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { 1856 struct l2cap_chan *chan = hdev->smp_data; 1857 struct smp_dev *smp_dev; 1858 1859 if (!chan || !chan->data) 1860 return SMP_UNSPECIFIED; 1861 1862 smp_dev = chan->data; 1863 1864 memcpy(smp->local_pk, smp_dev->local_pk, 64); 1865 memcpy(smp->lr, smp_dev->local_rand, 16); 1866 1867 if (smp_dev->debug_key) 1868 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1869 1870 goto done; 1871 } 1872 1873 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 1874 bt_dev_dbg(hdev, "Using debug keys"); 1875 if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk)) 1876 return SMP_UNSPECIFIED; 1877 memcpy(smp->local_pk, debug_pk, 64); 1878 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 1879 } else { 1880 while (true) { 1881 /* Generate key pair for Secure Connections */ 1882 if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk)) 1883 return SMP_UNSPECIFIED; 1884 1885 /* This is unlikely, but we need to check that 1886 * we didn't accidentally generate a debug key. 1887 */ 1888 if (crypto_memneq(smp->local_pk, debug_pk, 64)) 1889 break; 1890 } 1891 } 1892 1893 done: 1894 SMP_DBG("Local Public Key X: %32phN", smp->local_pk); 1895 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32); 1896 1897 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk); 1898 1899 return 0; 1900 } 1901 1902 static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb) 1903 { 1904 struct smp_cmd_pairing *req, *rsp = (void *) skb->data; 1905 struct l2cap_chan *chan = conn->smp; 1906 struct smp_chan *smp = chan->data; 1907 struct hci_dev *hdev = conn->hcon->hdev; 1908 u8 key_size, auth; 1909 int ret; 1910 1911 bt_dev_dbg(hdev, "conn %p", conn); 1912 1913 if (skb->len < sizeof(*rsp)) 1914 return SMP_INVALID_PARAMS; 1915 1916 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 1917 return SMP_CMD_NOTSUPP; 1918 1919 skb_pull(skb, sizeof(*rsp)); 1920 1921 req = (void *) &smp->preq[1]; 1922 1923 key_size = min(req->max_key_size, rsp->max_key_size); 1924 if (check_enc_key_size(conn, key_size)) 1925 return SMP_ENC_KEY_SIZE; 1926 1927 auth = rsp->auth_req & AUTH_REQ_MASK(hdev); 1928 1929 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 1930 return SMP_AUTH_REQUIREMENTS; 1931 1932 /* If the remote side's OOB flag is set it means it has 1933 * successfully received our local OOB data - therefore set the 1934 * flag to indicate that local OOB is in use. 1935 */ 1936 if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob) 1937 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); 1938 1939 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 1940 memcpy(&smp->prsp[1], rsp, sizeof(*rsp)); 1941 1942 /* Update remote key distribution in case the remote cleared 1943 * some bits that we had enabled in our request. 1944 */ 1945 smp->remote_key_dist &= rsp->resp_key_dist; 1946 1947 if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2)) 1948 set_bit(SMP_FLAG_CT2, &smp->flags); 1949 1950 /* For BR/EDR this means we're done and can start phase 3 */ 1951 if (conn->hcon->type == ACL_LINK) { 1952 /* Clear bits which are generated but not distributed */ 1953 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1954 smp_distribute_keys(smp); 1955 return 0; 1956 } 1957 1958 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC)) 1959 set_bit(SMP_FLAG_SC, &smp->flags); 1960 else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH) 1961 conn->hcon->pending_sec_level = BT_SECURITY_HIGH; 1962 1963 /* If we need MITM check that it can be achieved */ 1964 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { 1965 u8 method; 1966 1967 method = get_auth_method(smp, req->io_capability, 1968 rsp->io_capability); 1969 if (method == JUST_WORKS || method == JUST_CFM) 1970 return SMP_AUTH_REQUIREMENTS; 1971 } 1972 1973 get_random_bytes(smp->prnd, sizeof(smp->prnd)); 1974 1975 /* Update remote key distribution in case the remote cleared 1976 * some bits that we had enabled in our request. 1977 */ 1978 smp->remote_key_dist &= rsp->resp_key_dist; 1979 1980 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 1981 /* Clear bits which are generated but not distributed */ 1982 smp->remote_key_dist &= ~SMP_SC_NO_DIST; 1983 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); 1984 return sc_send_public_key(smp); 1985 } 1986 1987 auth |= req->auth_req; 1988 1989 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability); 1990 if (ret) 1991 return SMP_UNSPECIFIED; 1992 1993 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 1994 1995 /* Can't compose response until we have been confirmed */ 1996 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) 1997 return smp_confirm(smp); 1998 1999 return 0; 2000 } 2001 2002 static u8 sc_check_confirm(struct smp_chan *smp) 2003 { 2004 struct l2cap_conn *conn = smp->conn; 2005 2006 bt_dev_dbg(conn->hcon->hdev, ""); 2007 2008 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2009 return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM); 2010 2011 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2012 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2013 smp->prnd); 2014 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2015 } 2016 2017 return 0; 2018 } 2019 2020 /* Work-around for some implementations that incorrectly copy RFU bits 2021 * from our security request and thereby create the impression that 2022 * we're doing SC when in fact the remote doesn't support it. 2023 */ 2024 static int fixup_sc_false_positive(struct smp_chan *smp) 2025 { 2026 struct l2cap_conn *conn = smp->conn; 2027 struct hci_conn *hcon = conn->hcon; 2028 struct hci_dev *hdev = hcon->hdev; 2029 struct smp_cmd_pairing *req, *rsp; 2030 u8 auth; 2031 2032 /* The issue is only observed when we're in responder role */ 2033 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2034 return SMP_UNSPECIFIED; 2035 2036 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 2037 bt_dev_err(hdev, "refusing legacy fallback in SC-only mode"); 2038 return SMP_UNSPECIFIED; 2039 } 2040 2041 bt_dev_err(hdev, "trying to fall back to legacy SMP"); 2042 2043 req = (void *) &smp->preq[1]; 2044 rsp = (void *) &smp->prsp[1]; 2045 2046 /* Rebuild key dist flags which may have been cleared for SC */ 2047 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist); 2048 2049 auth = req->auth_req & AUTH_REQ_MASK(hdev); 2050 2051 if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) { 2052 bt_dev_err(hdev, "failed to fall back to legacy SMP"); 2053 return SMP_UNSPECIFIED; 2054 } 2055 2056 clear_bit(SMP_FLAG_SC, &smp->flags); 2057 2058 return 0; 2059 } 2060 2061 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb) 2062 { 2063 struct l2cap_chan *chan = conn->smp; 2064 struct smp_chan *smp = chan->data; 2065 struct hci_conn *hcon = conn->hcon; 2066 struct hci_dev *hdev = hcon->hdev; 2067 2068 bt_dev_dbg(hdev, "conn %p %s", conn, 2069 test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" : 2070 "responder"); 2071 2072 if (skb->len < sizeof(smp->pcnf)) 2073 return SMP_INVALID_PARAMS; 2074 2075 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf)); 2076 skb_pull(skb, sizeof(smp->pcnf)); 2077 2078 if (test_bit(SMP_FLAG_SC, &smp->flags)) { 2079 int ret; 2080 2081 /* Public Key exchange must happen before any other steps */ 2082 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags)) 2083 return sc_check_confirm(smp); 2084 2085 bt_dev_err(hdev, "Unexpected SMP Pairing Confirm"); 2086 2087 ret = fixup_sc_false_positive(smp); 2088 if (ret) 2089 return ret; 2090 } 2091 2092 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2093 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2094 smp->prnd); 2095 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2096 return 0; 2097 } 2098 2099 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) 2100 return smp_confirm(smp); 2101 2102 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); 2103 2104 return 0; 2105 } 2106 2107 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb) 2108 { 2109 struct l2cap_chan *chan = conn->smp; 2110 struct smp_chan *smp = chan->data; 2111 struct hci_conn *hcon = conn->hcon; 2112 u8 *pkax, *pkbx, *na, *nb, confirm_hint; 2113 u32 passkey = 0; 2114 int err; 2115 2116 bt_dev_dbg(hcon->hdev, "conn %p", conn); 2117 2118 if (skb->len < sizeof(smp->rrnd)) 2119 return SMP_INVALID_PARAMS; 2120 2121 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd)); 2122 skb_pull(skb, sizeof(smp->rrnd)); 2123 2124 if (!test_bit(SMP_FLAG_SC, &smp->flags)) 2125 return smp_random(smp); 2126 2127 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2128 pkax = smp->local_pk; 2129 pkbx = smp->remote_pk; 2130 na = smp->prnd; 2131 nb = smp->rrnd; 2132 } else { 2133 pkax = smp->remote_pk; 2134 pkbx = smp->local_pk; 2135 na = smp->rrnd; 2136 nb = smp->prnd; 2137 } 2138 2139 if (smp->method == REQ_OOB) { 2140 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2141 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 2142 sizeof(smp->prnd), smp->prnd); 2143 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2144 goto mackey_and_ltk; 2145 } 2146 2147 /* Passkey entry has special treatment */ 2148 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2149 return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM); 2150 2151 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2152 u8 cfm[16]; 2153 2154 err = smp_f4(smp->remote_pk, smp->local_pk, smp->rrnd, 0, cfm); 2155 if (err) 2156 return SMP_UNSPECIFIED; 2157 2158 if (crypto_memneq(smp->pcnf, cfm, 16)) 2159 return SMP_CONFIRM_FAILED; 2160 } else { 2161 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), 2162 smp->prnd); 2163 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2164 } 2165 2166 mackey_and_ltk: 2167 /* Generate MacKey and LTK */ 2168 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk); 2169 if (err) 2170 return SMP_UNSPECIFIED; 2171 2172 if (smp->method == REQ_OOB) { 2173 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2174 sc_dhkey_check(smp); 2175 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); 2176 } 2177 return 0; 2178 } 2179 2180 err = smp_g2(pkax, pkbx, na, nb, &passkey); 2181 if (err) 2182 return SMP_UNSPECIFIED; 2183 2184 /* Always require user confirmation for Just-Works pairing to prevent 2185 * impersonation attacks, or in case of a legitimate device that is 2186 * repairing use the confirmation as acknowledgment to proceed with the 2187 * creation of new keys. 2188 */ 2189 confirm_hint = smp->method == JUST_WORKS ? 1 : 0; 2190 2191 err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type, 2192 hcon->dst_type, passkey, confirm_hint); 2193 if (err) 2194 return SMP_UNSPECIFIED; 2195 2196 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 2197 2198 return 0; 2199 } 2200 2201 static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level) 2202 { 2203 struct smp_ltk *key; 2204 struct hci_conn *hcon = conn->hcon; 2205 2206 key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role); 2207 if (!key) 2208 return false; 2209 2210 if (smp_ltk_sec_level(key) < sec_level) 2211 return false; 2212 2213 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) 2214 return true; 2215 2216 hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size); 2217 hcon->enc_key_size = key->enc_size; 2218 2219 /* We never store STKs for initiator role, so clear this flag */ 2220 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); 2221 2222 return true; 2223 } 2224 2225 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level, 2226 enum smp_key_pref key_pref) 2227 { 2228 if (sec_level == BT_SECURITY_LOW) 2229 return true; 2230 2231 /* If we're encrypted with an STK but the caller prefers using 2232 * LTK claim insufficient security. This way we allow the 2233 * connection to be re-encrypted with an LTK, even if the LTK 2234 * provides the same level of security. Only exception is if we 2235 * don't have an LTK (e.g. because of key distribution bits). 2236 */ 2237 if (key_pref == SMP_USE_LTK && 2238 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) && 2239 hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role)) 2240 return false; 2241 2242 if (hcon->sec_level >= sec_level) 2243 return true; 2244 2245 return false; 2246 } 2247 2248 static void smp_send_pairing_req(struct smp_chan *smp, __u8 auth) 2249 { 2250 struct smp_cmd_pairing cp; 2251 2252 if (smp->conn->hcon->type == ACL_LINK) 2253 build_bredr_pairing_cmd(smp, &cp, NULL); 2254 else 2255 build_pairing_cmd(smp->conn, &cp, NULL, auth); 2256 2257 smp->preq[0] = SMP_CMD_PAIRING_REQ; 2258 memcpy(&smp->preq[1], &cp, sizeof(cp)); 2259 2260 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp); 2261 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); 2262 2263 set_bit(SMP_FLAG_INITIATOR, &smp->flags); 2264 } 2265 2266 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb) 2267 { 2268 struct smp_cmd_security_req *rp = (void *) skb->data; 2269 struct hci_conn *hcon = conn->hcon; 2270 struct hci_dev *hdev = hcon->hdev; 2271 struct smp_chan *smp; 2272 u8 sec_level, auth; 2273 2274 bt_dev_dbg(hdev, "conn %p", conn); 2275 2276 /* SMP over BR/EDR only covers cross-transport key derivation; the 2277 * Security Request procedure has no BR/EDR counterpart. Reject it 2278 * here, otherwise smp_ltk_encrypt() finds the peer's LE LTK 2279 * (ADDR_LE_DEV_PUBLIC and BDADDR_BREDR are both 0) and issues 2280 * HCI_OP_LE_START_ENC on the ACL handle, which the controller 2281 * rejects and hci_cs_le_start_enc() turns into a disconnect. Reply 2282 * without smp_failure(): this is not an authentication failure, and 2283 * MGMT_EV_AUTH_FAILED would make bluetoothd drop the device. 2284 */ 2285 if (hcon->type != LE_LINK) { 2286 u8 reason = SMP_CMD_NOTSUPP; 2287 2288 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), 2289 &reason); 2290 return 0; 2291 } 2292 2293 if (skb->len < sizeof(*rp)) 2294 return SMP_INVALID_PARAMS; 2295 2296 if (hcon->role != HCI_ROLE_MASTER) 2297 return SMP_CMD_NOTSUPP; 2298 2299 auth = rp->auth_req & AUTH_REQ_MASK(hdev); 2300 2301 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC)) 2302 return SMP_AUTH_REQUIREMENTS; 2303 2304 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) 2305 sec_level = BT_SECURITY_MEDIUM; 2306 else 2307 sec_level = authreq_to_seclevel(auth); 2308 2309 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) { 2310 /* If link is already encrypted with sufficient security we 2311 * still need refresh encryption as per Core Spec 5.0 Vol 3, 2312 * Part H 2.4.6 2313 */ 2314 smp_ltk_encrypt(conn, hcon->sec_level); 2315 return 0; 2316 } 2317 2318 if (sec_level > hcon->pending_sec_level) 2319 hcon->pending_sec_level = sec_level; 2320 2321 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) 2322 return 0; 2323 2324 smp = smp_chan_create(conn); 2325 if (!smp) 2326 return SMP_UNSPECIFIED; 2327 2328 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) && 2329 (auth & SMP_AUTH_BONDING)) 2330 return SMP_PAIRING_NOTSUPP; 2331 2332 skb_pull(skb, sizeof(*rp)); 2333 2334 smp_send_pairing_req(smp, auth); 2335 2336 return 0; 2337 } 2338 2339 static void smp_send_security_req(struct smp_chan *smp, __u8 auth) 2340 { 2341 struct smp_cmd_security_req cp; 2342 2343 cp.auth_req = auth; 2344 smp_send_cmd(smp->conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp); 2345 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ); 2346 2347 clear_bit(SMP_FLAG_INITIATOR, &smp->flags); 2348 } 2349 2350 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level) 2351 { 2352 struct l2cap_conn *conn; 2353 struct l2cap_chan *chan; 2354 struct smp_chan *smp; 2355 __u8 authreq; 2356 int ret; 2357 2358 /* Caller shall ensure there can be no race with l2cap_conn_del() */ 2359 conn = context_unsafe(hcon->l2cap_data); 2360 2361 bt_dev_dbg(hcon->hdev, "conn %p hcon %p level 0x%2.2x", conn, hcon, 2362 sec_level); 2363 2364 /* This may be NULL if there's an unexpected disconnection */ 2365 if (!conn) 2366 return 1; 2367 2368 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) 2369 return 1; 2370 2371 if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) 2372 return 1; 2373 2374 if (sec_level > hcon->pending_sec_level) 2375 hcon->pending_sec_level = sec_level; 2376 2377 if (hcon->role == HCI_ROLE_MASTER) 2378 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) 2379 return 0; 2380 2381 chan = conn->smp; 2382 if (!chan) { 2383 bt_dev_err(hcon->hdev, "security requested but not available"); 2384 return 1; 2385 } 2386 2387 l2cap_chan_lock(chan); 2388 2389 /* If SMP is already in progress ignore this request */ 2390 if (chan->data) { 2391 ret = 0; 2392 goto unlock; 2393 } 2394 2395 smp = smp_chan_create(conn); 2396 if (!smp) { 2397 ret = 1; 2398 goto unlock; 2399 } 2400 2401 authreq = seclevel_to_authreq(sec_level); 2402 2403 if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) { 2404 authreq |= SMP_AUTH_SC; 2405 if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED)) 2406 authreq |= SMP_AUTH_CT2; 2407 } 2408 2409 /* Don't attempt to set MITM if setting is overridden by debugfs 2410 * Needed to pass certification test SM/MAS/PKE/BV-01-C 2411 */ 2412 if (!hci_dev_test_flag(hcon->hdev, HCI_FORCE_NO_MITM)) { 2413 /* Require MITM if IO Capability allows or the security level 2414 * requires it. 2415 */ 2416 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT || 2417 hcon->pending_sec_level > BT_SECURITY_MEDIUM) 2418 authreq |= SMP_AUTH_MITM; 2419 } 2420 2421 if (hcon->role == HCI_ROLE_MASTER) 2422 smp_send_pairing_req(smp, authreq); 2423 else 2424 smp_send_security_req(smp, authreq); 2425 2426 ret = 0; 2427 2428 unlock: 2429 l2cap_chan_unlock(chan); 2430 return ret; 2431 } 2432 2433 int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr, 2434 u8 addr_type) 2435 { 2436 struct hci_conn *hcon; 2437 struct l2cap_conn *conn; 2438 struct l2cap_chan *chan; 2439 struct smp_chan *smp; 2440 int err; 2441 2442 err = hci_remove_ltk(hdev, bdaddr, addr_type); 2443 hci_remove_irk(hdev, bdaddr, addr_type); 2444 2445 hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type); 2446 if (!hcon) 2447 goto done; 2448 2449 lockdep_assert_held(&hcon->hdev->lock); 2450 2451 conn = hcon->l2cap_data; 2452 if (!conn) 2453 goto done; 2454 2455 chan = conn->smp; 2456 if (!chan) 2457 goto done; 2458 2459 l2cap_chan_lock(chan); 2460 2461 smp = chan->data; 2462 if (smp) { 2463 /* Set keys to NULL to make sure smp_failure() does not try to 2464 * remove and free already invalidated rcu list entries. */ 2465 smp->ltk = NULL; 2466 smp->responder_ltk = NULL; 2467 smp->remote_irk = NULL; 2468 2469 if (test_bit(SMP_FLAG_COMPLETE, &smp->flags)) 2470 smp_failure(conn, 0); 2471 else 2472 smp_failure(conn, SMP_UNSPECIFIED); 2473 err = 0; 2474 } 2475 2476 l2cap_chan_unlock(chan); 2477 2478 done: 2479 return err; 2480 } 2481 2482 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb) 2483 { 2484 struct smp_cmd_encrypt_info *rp = (void *) skb->data; 2485 struct l2cap_chan *chan = conn->smp; 2486 struct smp_chan *smp = chan->data; 2487 2488 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); 2489 2490 if (skb->len < sizeof(*rp)) 2491 return SMP_INVALID_PARAMS; 2492 2493 /* Pairing is aborted if any blocked keys are distributed */ 2494 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_LTK, 2495 rp->ltk)) { 2496 bt_dev_warn_ratelimited(conn->hcon->hdev, 2497 "LTK blocked for %pMR", 2498 &conn->hcon->dst); 2499 return SMP_INVALID_PARAMS; 2500 } 2501 2502 SMP_ALLOW_CMD(smp, SMP_CMD_INITIATOR_IDENT); 2503 2504 skb_pull(skb, sizeof(*rp)); 2505 2506 memcpy(smp->tk, rp->ltk, sizeof(smp->tk)); 2507 2508 return 0; 2509 } 2510 2511 static int smp_cmd_initiator_ident(struct l2cap_conn *conn, struct sk_buff *skb) 2512 { 2513 struct smp_cmd_initiator_ident *rp = (void *)skb->data; 2514 struct l2cap_chan *chan = conn->smp; 2515 struct smp_chan *smp = chan->data; 2516 struct hci_dev *hdev = conn->hcon->hdev; 2517 struct hci_conn *hcon = conn->hcon; 2518 struct smp_ltk *ltk; 2519 u8 authenticated; 2520 2521 bt_dev_dbg(hdev, "conn %p", conn); 2522 2523 if (skb->len < sizeof(*rp)) 2524 return SMP_INVALID_PARAMS; 2525 2526 /* Mark the information as received */ 2527 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY; 2528 2529 if (smp->remote_key_dist & SMP_DIST_ID_KEY) 2530 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); 2531 else if (smp->remote_key_dist & SMP_DIST_SIGN) 2532 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 2533 2534 skb_pull(skb, sizeof(*rp)); 2535 2536 authenticated = (hcon->sec_level == BT_SECURITY_HIGH); 2537 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK, 2538 authenticated, smp->tk, smp->enc_key_size, 2539 rp->ediv, rp->rand); 2540 smp->ltk = ltk; 2541 if (!(smp->remote_key_dist & KEY_DIST_MASK)) 2542 smp_distribute_keys(smp); 2543 2544 return 0; 2545 } 2546 2547 static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb) 2548 { 2549 struct smp_cmd_ident_info *info = (void *) skb->data; 2550 struct l2cap_chan *chan = conn->smp; 2551 struct smp_chan *smp = chan->data; 2552 2553 bt_dev_dbg(conn->hcon->hdev, ""); 2554 2555 if (skb->len < sizeof(*info)) 2556 return SMP_INVALID_PARAMS; 2557 2558 /* Pairing is aborted if any blocked keys are distributed */ 2559 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_IRK, 2560 info->irk)) { 2561 bt_dev_warn_ratelimited(conn->hcon->hdev, 2562 "Identity key blocked for %pMR", 2563 &conn->hcon->dst); 2564 return SMP_INVALID_PARAMS; 2565 } 2566 2567 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO); 2568 2569 skb_pull(skb, sizeof(*info)); 2570 2571 memcpy(smp->irk, info->irk, 16); 2572 2573 return 0; 2574 } 2575 2576 static int smp_cmd_ident_addr_info(struct l2cap_conn *conn, 2577 struct sk_buff *skb) 2578 { 2579 struct smp_cmd_ident_addr_info *info = (void *) skb->data; 2580 struct l2cap_chan *chan = conn->smp; 2581 struct smp_chan *smp = chan->data; 2582 struct hci_conn *hcon = conn->hcon; 2583 bdaddr_t rpa; 2584 2585 bt_dev_dbg(hcon->hdev, ""); 2586 2587 if (skb->len < sizeof(*info)) 2588 return SMP_INVALID_PARAMS; 2589 2590 /* Mark the information as received */ 2591 smp->remote_key_dist &= ~SMP_DIST_ID_KEY; 2592 2593 if (smp->remote_key_dist & SMP_DIST_SIGN) 2594 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); 2595 2596 skb_pull(skb, sizeof(*info)); 2597 2598 /* Strictly speaking the Core Specification (4.1) allows sending 2599 * an empty address which would force us to rely on just the IRK 2600 * as "identity information". However, since such 2601 * implementations are not known of and in order to not over 2602 * complicate our implementation, simply pretend that we never 2603 * received an IRK for such a device. 2604 * 2605 * The Identity Address must also be a Static Random or Public 2606 * Address, which hci_is_identity_address() checks for. 2607 */ 2608 if (!bacmp(&info->bdaddr, BDADDR_ANY) || 2609 !hci_is_identity_address(&info->bdaddr, info->addr_type)) { 2610 bt_dev_err(hcon->hdev, "ignoring IRK with no identity address"); 2611 goto distribute; 2612 } 2613 2614 /* Drop IRK if peer is using identity address during pairing but is 2615 * providing different address as identity information. 2616 * 2617 * Microsoft Surface Precision Mouse is known to have this bug. 2618 */ 2619 if (hci_is_identity_address(&hcon->dst, hcon->dst_type) && 2620 (bacmp(&info->bdaddr, &hcon->dst) || 2621 info->addr_type != hcon->dst_type)) { 2622 bt_dev_err(hcon->hdev, 2623 "ignoring IRK with invalid identity address"); 2624 goto distribute; 2625 } 2626 2627 bacpy(&smp->id_addr, &info->bdaddr); 2628 smp->id_addr_type = info->addr_type; 2629 2630 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type)) 2631 bacpy(&rpa, &hcon->dst); 2632 else 2633 bacpy(&rpa, BDADDR_ANY); 2634 2635 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr, 2636 smp->id_addr_type, smp->irk, &rpa); 2637 2638 distribute: 2639 if (!(smp->remote_key_dist & KEY_DIST_MASK)) 2640 smp_distribute_keys(smp); 2641 2642 return 0; 2643 } 2644 2645 static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb) 2646 { 2647 struct smp_cmd_sign_info *rp = (void *) skb->data; 2648 struct l2cap_chan *chan = conn->smp; 2649 struct smp_chan *smp = chan->data; 2650 struct smp_csrk *csrk; 2651 2652 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); 2653 2654 if (skb->len < sizeof(*rp)) 2655 return SMP_INVALID_PARAMS; 2656 2657 /* Mark the information as received */ 2658 smp->remote_key_dist &= ~SMP_DIST_SIGN; 2659 2660 skb_pull(skb, sizeof(*rp)); 2661 2662 csrk = kzalloc_obj(*csrk); 2663 if (csrk) { 2664 if (conn->hcon->sec_level > BT_SECURITY_MEDIUM) 2665 csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED; 2666 else 2667 csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED; 2668 memcpy(csrk->val, rp->csrk, sizeof(csrk->val)); 2669 } 2670 smp->csrk = csrk; 2671 smp_distribute_keys(smp); 2672 2673 return 0; 2674 } 2675 2676 static u8 sc_select_method(struct smp_chan *smp) 2677 { 2678 struct smp_cmd_pairing *local, *remote; 2679 u8 local_mitm, remote_mitm, local_io, remote_io, method; 2680 2681 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) || 2682 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) 2683 return REQ_OOB; 2684 2685 /* The preq/prsp contain the raw Pairing Request/Response PDUs 2686 * which are needed as inputs to some crypto functions. To get 2687 * the "struct smp_cmd_pairing" from them we need to skip the 2688 * first byte which contains the opcode. 2689 */ 2690 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2691 local = (void *) &smp->preq[1]; 2692 remote = (void *) &smp->prsp[1]; 2693 } else { 2694 local = (void *) &smp->prsp[1]; 2695 remote = (void *) &smp->preq[1]; 2696 } 2697 2698 local_io = local->io_capability; 2699 remote_io = remote->io_capability; 2700 2701 local_mitm = (local->auth_req & SMP_AUTH_MITM); 2702 remote_mitm = (remote->auth_req & SMP_AUTH_MITM); 2703 2704 /* If either side wants MITM, look up the method from the table, 2705 * otherwise use JUST WORKS. 2706 */ 2707 if (local_mitm || remote_mitm) 2708 method = get_auth_method(smp, local_io, remote_io); 2709 else 2710 method = JUST_WORKS; 2711 2712 /* Don't confirm locally initiated pairing attempts */ 2713 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2714 method = JUST_WORKS; 2715 2716 return method; 2717 } 2718 2719 static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) 2720 { 2721 struct smp_cmd_public_key *key = (void *) skb->data; 2722 struct hci_conn *hcon = conn->hcon; 2723 struct l2cap_chan *chan = conn->smp; 2724 struct smp_chan *smp = chan->data; 2725 struct hci_dev *hdev = hcon->hdev; 2726 struct crypto_kpp *tfm_ecdh; 2727 struct smp_cmd_pairing_confirm cfm; 2728 int err; 2729 2730 bt_dev_dbg(hdev, "conn %p", conn); 2731 2732 if (skb->len < sizeof(*key)) 2733 return SMP_INVALID_PARAMS; 2734 2735 /* Check if remote and local public keys are the same and debug key is 2736 * not in use. 2737 */ 2738 if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && 2739 !crypto_memneq(key, smp->local_pk, 64)) { 2740 bt_dev_err(hdev, "Remote and local public keys are identical"); 2741 return SMP_DHKEY_CHECK_FAILED; 2742 } 2743 2744 memcpy(smp->remote_pk, key, 64); 2745 2746 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { 2747 err = smp_f4(smp->remote_pk, smp->remote_pk, smp->rr, 0, 2748 cfm.confirm_val); 2749 if (err) 2750 return SMP_UNSPECIFIED; 2751 2752 if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16)) 2753 return SMP_CONFIRM_FAILED; 2754 } 2755 2756 /* Non-initiating device sends its public key after receiving 2757 * the key from the initiating device. 2758 */ 2759 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2760 err = sc_send_public_key(smp); 2761 if (err) 2762 return err; 2763 } 2764 2765 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk); 2766 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32); 2767 2768 /* Compute the shared secret on the same crypto tfm on which the private 2769 * key was set/generated. 2770 */ 2771 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { 2772 struct l2cap_chan *hchan = hdev->smp_data; 2773 struct smp_dev *smp_dev; 2774 2775 if (!hchan || !hchan->data) 2776 return SMP_UNSPECIFIED; 2777 2778 smp_dev = hchan->data; 2779 2780 tfm_ecdh = smp_dev->tfm_ecdh; 2781 } else { 2782 tfm_ecdh = smp->tfm_ecdh; 2783 } 2784 2785 if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey)) 2786 return SMP_UNSPECIFIED; 2787 2788 SMP_DBG("DHKey %32phN", smp->dhkey); 2789 2790 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags); 2791 2792 smp->method = sc_select_method(smp); 2793 2794 bt_dev_dbg(hdev, "selected method 0x%02x", smp->method); 2795 2796 /* JUST_WORKS and JUST_CFM result in an unauthenticated key */ 2797 if (smp->method == JUST_WORKS || smp->method == JUST_CFM) 2798 hcon->pending_sec_level = BT_SECURITY_MEDIUM; 2799 else 2800 hcon->pending_sec_level = BT_SECURITY_FIPS; 2801 2802 if (!crypto_memneq(debug_pk, smp->remote_pk, 64)) 2803 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); 2804 2805 if (smp->method == DSP_PASSKEY) { 2806 get_random_bytes(&hcon->passkey_notify, 2807 sizeof(hcon->passkey_notify)); 2808 hcon->passkey_notify %= 1000000; 2809 hcon->passkey_entered = 0; 2810 smp->passkey_round = 0; 2811 if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type, 2812 hcon->dst_type, 2813 hcon->passkey_notify, 2814 hcon->passkey_entered)) 2815 return SMP_UNSPECIFIED; 2816 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2817 return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY); 2818 } 2819 2820 if (smp->method == REQ_OOB) { 2821 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2822 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 2823 sizeof(smp->prnd), smp->prnd); 2824 2825 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2826 2827 return 0; 2828 } 2829 2830 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2831 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2832 2833 if (smp->method == REQ_PASSKEY) { 2834 if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type, 2835 hcon->dst_type)) 2836 return SMP_UNSPECIFIED; 2837 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); 2838 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); 2839 return 0; 2840 } 2841 2842 /* The Initiating device waits for the non-initiating device to 2843 * send the confirm value. 2844 */ 2845 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) 2846 return 0; 2847 2848 err = smp_f4(smp->local_pk, smp->remote_pk, smp->prnd, 0, 2849 cfm.confirm_val); 2850 if (err) 2851 return SMP_UNSPECIFIED; 2852 2853 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm); 2854 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); 2855 2856 return 0; 2857 } 2858 2859 static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb) 2860 { 2861 struct smp_cmd_dhkey_check *check = (void *) skb->data; 2862 struct l2cap_chan *chan = conn->smp; 2863 struct hci_conn *hcon = conn->hcon; 2864 struct smp_chan *smp = chan->data; 2865 u8 a[7], b[7], *local_addr, *remote_addr; 2866 u8 io_cap[3], r[16], e[16]; 2867 int err; 2868 2869 bt_dev_dbg(hcon->hdev, "conn %p", conn); 2870 2871 if (skb->len < sizeof(*check)) 2872 return SMP_INVALID_PARAMS; 2873 2874 memcpy(a, &hcon->init_addr, 6); 2875 memcpy(b, &hcon->resp_addr, 6); 2876 a[6] = hcon->init_addr_type; 2877 b[6] = hcon->resp_addr_type; 2878 2879 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2880 local_addr = a; 2881 remote_addr = b; 2882 memcpy(io_cap, &smp->prsp[1], 3); 2883 } else { 2884 local_addr = b; 2885 remote_addr = a; 2886 memcpy(io_cap, &smp->preq[1], 3); 2887 } 2888 2889 memset(r, 0, sizeof(r)); 2890 2891 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) 2892 put_unaligned_le32(hcon->passkey_notify, r); 2893 else if (smp->method == REQ_OOB) 2894 memcpy(r, smp->lr, 16); 2895 2896 err = smp_f6(smp->mackey, smp->rrnd, smp->prnd, r, io_cap, remote_addr, 2897 local_addr, e); 2898 if (err) 2899 return SMP_UNSPECIFIED; 2900 2901 if (crypto_memneq(check->e, e, 16)) 2902 return SMP_DHKEY_CHECK_FAILED; 2903 2904 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2905 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { 2906 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags); 2907 return 0; 2908 } 2909 2910 /* Responder sends DHKey check as response to initiator */ 2911 sc_dhkey_check(smp); 2912 } 2913 2914 sc_add_ltk(smp); 2915 2916 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { 2917 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size); 2918 hcon->enc_key_size = smp->enc_key_size; 2919 } 2920 2921 return 0; 2922 } 2923 2924 static int smp_cmd_keypress_notify(struct l2cap_conn *conn, 2925 struct sk_buff *skb) 2926 { 2927 struct smp_cmd_keypress_notify *kp = (void *) skb->data; 2928 2929 bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value); 2930 2931 return 0; 2932 } 2933 2934 static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) 2935 { 2936 struct l2cap_conn *conn = chan->conn; 2937 struct hci_conn *hcon = conn->hcon; 2938 struct smp_chan *smp; 2939 __u8 code, reason; 2940 int err = 0; 2941 2942 if (skb->len < 1) 2943 return -EILSEQ; 2944 2945 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) { 2946 reason = SMP_PAIRING_NOTSUPP; 2947 goto done; 2948 } 2949 2950 code = skb->data[0]; 2951 skb_pull(skb, sizeof(code)); 2952 2953 smp = chan->data; 2954 2955 if (code > SMP_CMD_MAX) 2956 goto drop; 2957 2958 if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) { 2959 /* If there is a context and the command is not allowed consider 2960 * it a failure so the session is cleanup properly. 2961 */ 2962 switch (code) { 2963 case SMP_CMD_IDENT_INFO: 2964 case SMP_CMD_IDENT_ADDR_INFO: 2965 case SMP_CMD_SIGN_INFO: 2966 /* 3.6.1. Key distribution and generation 2967 * 2968 * A device may reject a distributed key by sending the 2969 * Pairing Failed command with the reason set to 2970 * "Key Rejected". 2971 */ 2972 smp_failure(conn, SMP_KEY_REJECTED); 2973 break; 2974 } 2975 goto drop; 2976 } 2977 2978 /* If we don't have a context the only allowed commands are 2979 * pairing request and security request. 2980 */ 2981 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ) 2982 goto drop; 2983 2984 switch (code) { 2985 case SMP_CMD_PAIRING_REQ: 2986 reason = smp_cmd_pairing_req(conn, skb); 2987 break; 2988 2989 case SMP_CMD_PAIRING_FAIL: 2990 smp_failure(conn, 0); 2991 err = -EPERM; 2992 break; 2993 2994 case SMP_CMD_PAIRING_RSP: 2995 reason = smp_cmd_pairing_rsp(conn, skb); 2996 break; 2997 2998 case SMP_CMD_SECURITY_REQ: 2999 reason = smp_cmd_security_req(conn, skb); 3000 break; 3001 3002 case SMP_CMD_PAIRING_CONFIRM: 3003 reason = smp_cmd_pairing_confirm(conn, skb); 3004 break; 3005 3006 case SMP_CMD_PAIRING_RANDOM: 3007 reason = smp_cmd_pairing_random(conn, skb); 3008 break; 3009 3010 case SMP_CMD_ENCRYPT_INFO: 3011 reason = smp_cmd_encrypt_info(conn, skb); 3012 break; 3013 3014 case SMP_CMD_INITIATOR_IDENT: 3015 reason = smp_cmd_initiator_ident(conn, skb); 3016 break; 3017 3018 case SMP_CMD_IDENT_INFO: 3019 reason = smp_cmd_ident_info(conn, skb); 3020 break; 3021 3022 case SMP_CMD_IDENT_ADDR_INFO: 3023 reason = smp_cmd_ident_addr_info(conn, skb); 3024 break; 3025 3026 case SMP_CMD_SIGN_INFO: 3027 reason = smp_cmd_sign_info(conn, skb); 3028 break; 3029 3030 case SMP_CMD_PUBLIC_KEY: 3031 reason = smp_cmd_public_key(conn, skb); 3032 break; 3033 3034 case SMP_CMD_DHKEY_CHECK: 3035 reason = smp_cmd_dhkey_check(conn, skb); 3036 break; 3037 3038 case SMP_CMD_KEYPRESS_NOTIFY: 3039 reason = smp_cmd_keypress_notify(conn, skb); 3040 break; 3041 3042 default: 3043 bt_dev_dbg(hcon->hdev, "Unknown command code 0x%2.2x", code); 3044 reason = SMP_CMD_NOTSUPP; 3045 goto done; 3046 } 3047 3048 done: 3049 if (!err) { 3050 if (reason) 3051 smp_failure(conn, reason); 3052 kfree_skb(skb); 3053 } 3054 3055 return err; 3056 3057 drop: 3058 bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR", 3059 code, &hcon->dst); 3060 kfree_skb(skb); 3061 return 0; 3062 } 3063 3064 static void smp_teardown_cb(struct l2cap_chan *chan, int err) 3065 { 3066 struct l2cap_conn *conn = chan->conn; 3067 3068 bt_dev_dbg(conn->hcon->hdev, "chan %p", chan); 3069 3070 if (chan->data) 3071 smp_chan_destroy(conn); 3072 3073 conn->smp = NULL; 3074 l2cap_chan_put(chan); 3075 } 3076 3077 static void bredr_pairing(struct l2cap_chan *chan) 3078 { 3079 struct l2cap_conn *conn = chan->conn; 3080 struct hci_conn *hcon = conn->hcon; 3081 struct hci_dev *hdev = hcon->hdev; 3082 struct smp_chan *smp; 3083 3084 bt_dev_dbg(hdev, "chan %p", chan); 3085 3086 /* Only new pairings are interesting */ 3087 if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags)) 3088 return; 3089 3090 /* Don't bother if we're not encrypted */ 3091 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3092 return; 3093 3094 /* Only initiator may initiate SMP over BR/EDR */ 3095 if (hcon->role != HCI_ROLE_MASTER) 3096 return; 3097 3098 /* Secure Connections support must be enabled */ 3099 if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 3100 return; 3101 3102 /* BR/EDR must use Secure Connections for SMP */ 3103 if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) && 3104 !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3105 return; 3106 3107 /* If our LE support is not enabled don't do anything */ 3108 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 3109 return; 3110 3111 /* Don't bother if remote LE support is not enabled */ 3112 if (!lmp_host_le_capable(hcon)) 3113 return; 3114 3115 /* Remote must support SMP fixed chan for BR/EDR */ 3116 if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR)) 3117 return; 3118 3119 /* Don't bother if SMP is already ongoing */ 3120 if (chan->data) 3121 return; 3122 3123 smp = smp_chan_create(conn); 3124 if (!smp) { 3125 bt_dev_err(hdev, "unable to create SMP context for BR/EDR"); 3126 return; 3127 } 3128 3129 set_bit(SMP_FLAG_SC, &smp->flags); 3130 3131 bt_dev_dbg(hdev, "starting SMP over BR/EDR"); 3132 3133 smp_send_pairing_req(smp, 0x00); 3134 } 3135 3136 static void smp_resume_cb(struct l2cap_chan *chan) 3137 { 3138 struct smp_chan *smp = chan->data; 3139 struct l2cap_conn *conn = chan->conn; 3140 struct hci_conn *hcon = conn->hcon; 3141 3142 bt_dev_dbg(hcon->hdev, "chan %p", chan); 3143 3144 if (hcon->type == ACL_LINK) { 3145 bredr_pairing(chan); 3146 return; 3147 } 3148 3149 if (!smp) 3150 return; 3151 3152 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3153 return; 3154 3155 cancel_delayed_work(&smp->security_timer); 3156 3157 smp_distribute_keys(smp); 3158 } 3159 3160 static void smp_ready_cb(struct l2cap_chan *chan) 3161 { 3162 struct l2cap_conn *conn = chan->conn; 3163 struct hci_conn *hcon = conn->hcon; 3164 3165 bt_dev_dbg(hcon->hdev, "chan %p", chan); 3166 3167 /* No need to call l2cap_chan_hold() here since we already own 3168 * the reference taken in smp_new_conn_cb(). This is just the 3169 * first time that we tie it to a specific pointer. The code in 3170 * l2cap_core.c ensures that there's no risk this function won't 3171 * get called if smp_new_conn_cb was previously called. 3172 */ 3173 conn->smp = chan; 3174 3175 if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) 3176 bredr_pairing(chan); 3177 } 3178 3179 static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 3180 { 3181 int err; 3182 3183 bt_dev_dbg(chan->conn->hcon->hdev, "chan %p", chan); 3184 3185 err = smp_sig_channel(chan, skb); 3186 if (err) { 3187 struct smp_chan *smp = chan->data; 3188 3189 if (smp) 3190 cancel_delayed_work_sync(&smp->security_timer); 3191 3192 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE); 3193 } 3194 3195 return err; 3196 } 3197 3198 static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan, 3199 unsigned long hdr_len, 3200 unsigned long len, int nb) 3201 { 3202 struct sk_buff *skb; 3203 3204 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL); 3205 if (!skb) 3206 return ERR_PTR(-ENOMEM); 3207 3208 skb->priority = HCI_PRIO_MAX; 3209 bt_cb(skb)->l2cap.chan = chan; 3210 3211 return skb; 3212 } 3213 3214 static const struct l2cap_ops smp_chan_ops = { 3215 .name = "Security Manager", 3216 .ready = smp_ready_cb, 3217 .recv = smp_recv_cb, 3218 .alloc_skb = smp_alloc_skb_cb, 3219 .teardown = smp_teardown_cb, 3220 .resume = smp_resume_cb, 3221 3222 .new_connection = l2cap_chan_no_new_connection, 3223 .state_change = l2cap_chan_no_state_change, 3224 .close = l2cap_chan_no_close, 3225 .defer = l2cap_chan_no_defer, 3226 .suspend = l2cap_chan_no_suspend, 3227 .set_shutdown = l2cap_chan_no_set_shutdown, 3228 .get_sndtimeo = l2cap_chan_no_get_sndtimeo, 3229 }; 3230 3231 static inline int smp_new_conn_cb(struct l2cap_chan *chan, 3232 struct l2cap_chan *new_chan) 3233 { 3234 new_chan->ops = &smp_chan_ops; 3235 3236 /* Other L2CAP channels may request SMP routines in order to 3237 * change the security level. This means that the SMP channel 3238 * lock must be considered in its own category to avoid lockdep 3239 * warnings. 3240 */ 3241 atomic_set(&new_chan->nesting, L2CAP_NESTING_SMP); 3242 3243 return 0; 3244 } 3245 3246 static const struct l2cap_ops smp_root_chan_ops = { 3247 .name = "Security Manager Root", 3248 .new_connection = smp_new_conn_cb, 3249 3250 /* None of these are implemented for the root channel */ 3251 .close = l2cap_chan_no_close, 3252 .alloc_skb = l2cap_chan_no_alloc_skb, 3253 .recv = l2cap_chan_no_recv, 3254 .state_change = l2cap_chan_no_state_change, 3255 .teardown = l2cap_chan_no_teardown, 3256 .ready = l2cap_chan_no_ready, 3257 .defer = l2cap_chan_no_defer, 3258 .suspend = l2cap_chan_no_suspend, 3259 .resume = l2cap_chan_no_resume, 3260 .set_shutdown = l2cap_chan_no_set_shutdown, 3261 .get_sndtimeo = l2cap_chan_no_get_sndtimeo, 3262 }; 3263 3264 static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid) 3265 { 3266 struct l2cap_chan *chan; 3267 struct smp_dev *smp; 3268 struct crypto_kpp *tfm_ecdh; 3269 3270 if (cid == L2CAP_CID_SMP_BREDR) { 3271 smp = NULL; 3272 goto create_chan; 3273 } 3274 3275 smp = kzalloc_obj(*smp); 3276 if (!smp) 3277 return ERR_PTR(-ENOMEM); 3278 3279 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0); 3280 if (IS_ERR(tfm_ecdh)) { 3281 bt_dev_err(hdev, "Unable to create ECDH crypto context"); 3282 kfree_sensitive(smp); 3283 return ERR_CAST(tfm_ecdh); 3284 } 3285 3286 smp->local_oob = false; 3287 smp->tfm_ecdh = tfm_ecdh; 3288 3289 create_chan: 3290 chan = l2cap_chan_create(); 3291 if (!chan) { 3292 if (smp) { 3293 crypto_free_kpp(smp->tfm_ecdh); 3294 kfree_sensitive(smp); 3295 } 3296 return ERR_PTR(-ENOMEM); 3297 } 3298 3299 chan->data = smp; 3300 3301 l2cap_add_scid(chan, cid); 3302 3303 l2cap_chan_set_defaults(chan, NULL); 3304 3305 if (cid == L2CAP_CID_SMP) { 3306 u8 bdaddr_type; 3307 3308 hci_copy_identity_address(hdev, &chan->src, &bdaddr_type); 3309 3310 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 3311 chan->src_type = BDADDR_LE_PUBLIC; 3312 else 3313 chan->src_type = BDADDR_LE_RANDOM; 3314 } else { 3315 bacpy(&chan->src, &hdev->bdaddr); 3316 chan->src_type = BDADDR_BREDR; 3317 } 3318 3319 chan->state = BT_LISTEN; 3320 chan->mode = L2CAP_MODE_BASIC; 3321 chan->imtu = L2CAP_DEFAULT_MTU; 3322 chan->ops = &smp_root_chan_ops; 3323 3324 /* Set correct nesting level for a parent/listening channel */ 3325 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); 3326 3327 return chan; 3328 } 3329 3330 static void smp_del_chan(struct l2cap_chan *chan) 3331 { 3332 struct smp_dev *smp; 3333 3334 BT_DBG("chan %p", chan); 3335 3336 smp = chan->data; 3337 if (smp) { 3338 chan->data = NULL; 3339 crypto_free_kpp(smp->tfm_ecdh); 3340 kfree_sensitive(smp); 3341 } 3342 3343 l2cap_chan_put(chan); 3344 } 3345 3346 int smp_force_bredr(struct hci_dev *hdev, bool enable) 3347 { 3348 if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3349 return -EALREADY; 3350 3351 if (enable) { 3352 struct l2cap_chan *chan; 3353 3354 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR); 3355 if (IS_ERR(chan)) 3356 return PTR_ERR(chan); 3357 3358 hdev->smp_bredr_data = chan; 3359 } else { 3360 struct l2cap_chan *chan; 3361 3362 chan = hdev->smp_bredr_data; 3363 hdev->smp_bredr_data = NULL; 3364 smp_del_chan(chan); 3365 } 3366 3367 hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP); 3368 3369 return 0; 3370 } 3371 3372 int smp_register(struct hci_dev *hdev) 3373 { 3374 struct l2cap_chan *chan; 3375 3376 bt_dev_dbg(hdev, ""); 3377 3378 /* If the controller does not support Low Energy operation, then 3379 * there is also no need to register any SMP channel. 3380 */ 3381 if (!lmp_le_capable(hdev)) 3382 return 0; 3383 3384 if (WARN_ON(hdev->smp_data)) { 3385 chan = hdev->smp_data; 3386 hdev->smp_data = NULL; 3387 smp_del_chan(chan); 3388 } 3389 3390 chan = smp_add_cid(hdev, L2CAP_CID_SMP); 3391 if (IS_ERR(chan)) 3392 return PTR_ERR(chan); 3393 3394 hdev->smp_data = chan; 3395 3396 if (!lmp_sc_capable(hdev)) { 3397 /* Flag can be already set here (due to power toggle) */ 3398 if (!hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP)) 3399 return 0; 3400 } 3401 3402 if (WARN_ON(hdev->smp_bredr_data)) { 3403 chan = hdev->smp_bredr_data; 3404 hdev->smp_bredr_data = NULL; 3405 smp_del_chan(chan); 3406 } 3407 3408 chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR); 3409 if (IS_ERR(chan)) { 3410 int err = PTR_ERR(chan); 3411 chan = hdev->smp_data; 3412 hdev->smp_data = NULL; 3413 smp_del_chan(chan); 3414 return err; 3415 } 3416 3417 hdev->smp_bredr_data = chan; 3418 3419 return 0; 3420 } 3421 3422 void smp_unregister(struct hci_dev *hdev) 3423 { 3424 struct l2cap_chan *chan; 3425 3426 if (hdev->smp_bredr_data) { 3427 chan = hdev->smp_bredr_data; 3428 hdev->smp_bredr_data = NULL; 3429 smp_del_chan(chan); 3430 } 3431 3432 if (hdev->smp_data) { 3433 chan = hdev->smp_data; 3434 hdev->smp_data = NULL; 3435 smp_del_chan(chan); 3436 } 3437 } 3438 3439 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP) 3440 3441 static int __init test_debug_key(struct crypto_kpp *tfm_ecdh) 3442 { 3443 u8 pk[64]; 3444 int err; 3445 3446 err = set_ecdh_privkey(tfm_ecdh, debug_sk); 3447 if (err) 3448 return err; 3449 3450 err = generate_ecdh_public_key(tfm_ecdh, pk); 3451 if (err) 3452 return err; 3453 3454 if (crypto_memneq(pk, debug_pk, 64)) 3455 return -EINVAL; 3456 3457 return 0; 3458 } 3459 3460 static int __init test_ah(void) 3461 { 3462 const u8 irk[16] = { 3463 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3464 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3465 const u8 r[3] = { 0x94, 0x81, 0x70 }; 3466 const u8 exp[3] = { 0xaa, 0xfb, 0x0d }; 3467 u8 res[3]; 3468 int err; 3469 3470 err = smp_ah(irk, r, res); 3471 if (err) 3472 return err; 3473 3474 if (crypto_memneq(res, exp, 3)) 3475 return -EINVAL; 3476 3477 return 0; 3478 } 3479 3480 static int __init test_c1(void) 3481 { 3482 const u8 k[16] = { 3483 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 3484 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 3485 const u8 r[16] = { 3486 0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63, 3487 0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 }; 3488 const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 }; 3489 const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 }; 3490 const u8 _iat = 0x01; 3491 const u8 _rat = 0x00; 3492 const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } }; 3493 const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } }; 3494 const u8 exp[16] = { 3495 0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2, 3496 0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e }; 3497 u8 res[16]; 3498 int err; 3499 3500 err = smp_c1(k, r, preq, pres, _iat, &ia, _rat, &ra, res); 3501 if (err) 3502 return err; 3503 3504 if (crypto_memneq(res, exp, 16)) 3505 return -EINVAL; 3506 3507 return 0; 3508 } 3509 3510 static int __init test_s1(void) 3511 { 3512 const u8 k[16] = { 3513 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 3514 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 3515 const u8 r1[16] = { 3516 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 }; 3517 const u8 r2[16] = { 3518 0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 }; 3519 const u8 exp[16] = { 3520 0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b, 3521 0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a }; 3522 u8 res[16]; 3523 int err; 3524 3525 err = smp_s1(k, r1, r2, res); 3526 if (err) 3527 return err; 3528 3529 if (crypto_memneq(res, exp, 16)) 3530 return -EINVAL; 3531 3532 return 0; 3533 } 3534 3535 static int __init test_f4(void) 3536 { 3537 const u8 u[32] = { 3538 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 3539 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 3540 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 3541 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 }; 3542 const u8 v[32] = { 3543 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b, 3544 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59, 3545 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90, 3546 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 }; 3547 const u8 x[16] = { 3548 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3549 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3550 const u8 z = 0x00; 3551 const u8 exp[16] = { 3552 0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1, 3553 0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 }; 3554 u8 res[16]; 3555 int err; 3556 3557 err = smp_f4(u, v, x, z, res); 3558 if (err) 3559 return err; 3560 3561 if (crypto_memneq(res, exp, 16)) 3562 return -EINVAL; 3563 3564 return 0; 3565 } 3566 3567 static int __init test_f5(void) 3568 { 3569 const u8 w[32] = { 3570 0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86, 3571 0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99, 3572 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3573 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3574 const u8 n1[16] = { 3575 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3576 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3577 const u8 n2[16] = { 3578 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3579 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3580 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 }; 3581 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 }; 3582 const u8 exp_ltk[16] = { 3583 0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98, 3584 0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 }; 3585 const u8 exp_mackey[16] = { 3586 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd, 3587 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 }; 3588 u8 mackey[16], ltk[16]; 3589 int err; 3590 3591 err = smp_f5(w, n1, n2, a1, a2, mackey, ltk); 3592 if (err) 3593 return err; 3594 3595 if (crypto_memneq(mackey, exp_mackey, 16)) 3596 return -EINVAL; 3597 3598 if (crypto_memneq(ltk, exp_ltk, 16)) 3599 return -EINVAL; 3600 3601 return 0; 3602 } 3603 3604 static int __init test_f6(void) 3605 { 3606 const u8 w[16] = { 3607 0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd, 3608 0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 }; 3609 const u8 n1[16] = { 3610 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3611 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3612 const u8 n2[16] = { 3613 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3614 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3615 const u8 r[16] = { 3616 0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08, 3617 0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 }; 3618 const u8 io_cap[3] = { 0x02, 0x01, 0x01 }; 3619 const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 }; 3620 const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 }; 3621 const u8 exp[16] = { 3622 0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2, 3623 0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 }; 3624 u8 res[16]; 3625 int err; 3626 3627 err = smp_f6(w, n1, n2, r, io_cap, a1, a2, res); 3628 if (err) 3629 return err; 3630 3631 if (crypto_memneq(res, exp, 16)) 3632 return -EINVAL; 3633 3634 return 0; 3635 } 3636 3637 static int __init test_g2(void) 3638 { 3639 const u8 u[32] = { 3640 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 3641 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef, 3642 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e, 3643 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 }; 3644 const u8 v[32] = { 3645 0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b, 3646 0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59, 3647 0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90, 3648 0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 }; 3649 const u8 x[16] = { 3650 0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff, 3651 0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 }; 3652 const u8 y[16] = { 3653 0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21, 3654 0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 }; 3655 const u32 exp_val = 0x2f9ed5ba % 1000000; 3656 u32 val; 3657 int err; 3658 3659 err = smp_g2(u, v, x, y, &val); 3660 if (err) 3661 return err; 3662 3663 if (val != exp_val) 3664 return -EINVAL; 3665 3666 return 0; 3667 } 3668 3669 static int __init test_h6(void) 3670 { 3671 const u8 w[16] = { 3672 0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34, 3673 0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec }; 3674 const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c }; 3675 const u8 exp[16] = { 3676 0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8, 3677 0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d }; 3678 u8 res[16]; 3679 int err; 3680 3681 err = smp_h6(w, key_id, res); 3682 if (err) 3683 return err; 3684 3685 if (crypto_memneq(res, exp, 16)) 3686 return -EINVAL; 3687 3688 return 0; 3689 } 3690 3691 static char test_smp_buffer[32]; 3692 3693 static ssize_t test_smp_read(struct file *file, char __user *user_buf, 3694 size_t count, loff_t *ppos) 3695 { 3696 return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer, 3697 strlen(test_smp_buffer)); 3698 } 3699 3700 static const struct file_operations test_smp_fops = { 3701 .owner = THIS_MODULE, 3702 .open = simple_open, 3703 .read = test_smp_read, 3704 .llseek = default_llseek, 3705 }; 3706 3707 static int __init run_selftests(struct crypto_kpp *tfm_ecdh) 3708 { 3709 ktime_t calltime, delta, rettime; 3710 unsigned long long duration; 3711 int err; 3712 3713 calltime = ktime_get(); 3714 3715 err = test_debug_key(tfm_ecdh); 3716 if (err) { 3717 BT_ERR("debug_key test failed"); 3718 goto done; 3719 } 3720 3721 err = test_ah(); 3722 if (err) { 3723 BT_ERR("smp_ah test failed"); 3724 goto done; 3725 } 3726 3727 err = test_c1(); 3728 if (err) { 3729 BT_ERR("smp_c1 test failed"); 3730 goto done; 3731 } 3732 3733 err = test_s1(); 3734 if (err) { 3735 BT_ERR("smp_s1 test failed"); 3736 goto done; 3737 } 3738 3739 err = test_f4(); 3740 if (err) { 3741 BT_ERR("smp_f4 test failed"); 3742 goto done; 3743 } 3744 3745 err = test_f5(); 3746 if (err) { 3747 BT_ERR("smp_f5 test failed"); 3748 goto done; 3749 } 3750 3751 err = test_f6(); 3752 if (err) { 3753 BT_ERR("smp_f6 test failed"); 3754 goto done; 3755 } 3756 3757 err = test_g2(); 3758 if (err) { 3759 BT_ERR("smp_g2 test failed"); 3760 goto done; 3761 } 3762 3763 err = test_h6(); 3764 if (err) { 3765 BT_ERR("smp_h6 test failed"); 3766 goto done; 3767 } 3768 3769 rettime = ktime_get(); 3770 delta = ktime_sub(rettime, calltime); 3771 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 3772 3773 BT_INFO("SMP test passed in %llu usecs", duration); 3774 3775 done: 3776 if (!err) 3777 snprintf(test_smp_buffer, sizeof(test_smp_buffer), 3778 "PASS (%llu usecs)\n", duration); 3779 else 3780 snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n"); 3781 3782 debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL, 3783 &test_smp_fops); 3784 3785 return err; 3786 } 3787 3788 int __init bt_selftest_smp(void) 3789 { 3790 struct crypto_kpp *tfm_ecdh; 3791 int err; 3792 3793 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0); 3794 if (IS_ERR(tfm_ecdh)) { 3795 BT_ERR("Unable to create ECDH crypto context"); 3796 return PTR_ERR(tfm_ecdh); 3797 } 3798 3799 err = run_selftests(tfm_ecdh); 3800 3801 crypto_free_kpp(tfm_ecdh); 3802 3803 return err; 3804 } 3805 3806 #endif 3807