[PATCH 00/11] Bluetooth: New mgmt messages for SMP Keys

[PATCH 00/11] Bluetooth: New mgmt messages for SMP Keys

[Vinicius Costa Gomes]

Hi,

Using new messages for SMP keys allow for simpler code as it is always
clear from context the kind of key that is necessary.

Along with this are some fixes for problems found while implementing the
Proximity Profile.

--

Vinicius Costa Gomes (11):
  Bluetooth: Use the LTK after receiving a LE Security Request
  Revert "Bluetooth: Add support for communicating keys with userspace"
  Bluetooth: Add structures for the new SMP messages
  Bluetooth: Add support for cleaning the SMP key list
  Bluetooth: Add handlers for the new mgmt messages
  Bluetooth: Rename smp_key_size to enc_size
  Bluetooth: Use the smp_keys list for accessing SMP keys
  Bluetooth: Remove the link key if LE pairing fails
  Bluetooth: Fix not setting a pending security level
  Bluetooth: Fix setting the connection sec_level when encryption fails
  Bluetooth: Remove support for other SMP keys than the LTK

 include/net/bluetooth/hci.h      |    1 +
 include/net/bluetooth/hci_core.h |   39 ++++++---
 include/net/bluetooth/mgmt.h     |   26 ++++++-
 net/bluetooth/hci_core.c         |  103 ++++++++++++++++---------
 net/bluetooth/hci_event.c        |   13 ++-
 net/bluetooth/l2cap_core.c       |    6 +-
 net/bluetooth/mgmt.c             |  159 +++++++++++++++++++++++++++-----------
 net/bluetooth/smp.c              |   78 +++++++++++--------
 8 files changed, 291 insertions(+), 134 deletions(-)

--
1.7.6

[PATCH 01/11] Bluetooth: Use the LTK after receiving a LE Security Request

[Vinicius Costa Gomes]

When receiving a security request from the remote device we should find
if there is already a LTK associated with the remote device, if found
we should use it to encrypt the link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |   46 ++++++++++++++++++++++++++++------------------
 1 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 74afdb7..fd5e1ca 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -513,6 +513,29 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 	return 0;
 }
 
+static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
+{
+	struct link_key *key;
+	struct key_master_id *master;
+	struct hci_conn *hcon = conn->hcon;
+
+	key = hci_find_link_key_type(hcon->hdev, conn->dst,
+						HCI_LK_SMP_LTK);
+	if (!key)
+		return 0;
+
+	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND,
+					&hcon->pend))
+		return 1;
+
+	master = (void *) key->data;
+	hci_le_start_enc(hcon, master->ediv, master->rand,
+						key->val);
+	hcon->enc_key_size = key->pin_len;
+
+	return 1;
+
+}
 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 {
 	struct smp_cmd_security_req *rp = (void *) skb->data;
@@ -522,6 +545,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	BT_DBG("conn %p", conn);
 
+	if (smp_ltk_encrypt(conn))
+		return 0;
+
 	if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
 		return 0;
 
@@ -556,25 +582,9 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
 	if (hcon->sec_level >= sec_level)
 		return 1;
 
-	if (hcon->link_mode & HCI_LM_MASTER) {
-		struct link_key *key;
-
-		key = hci_find_link_key_type(hcon->hdev, conn->dst,
-							HCI_LK_SMP_LTK);
-		if (key) {
-			struct key_master_id *master = (void *) key->data;
-
-			if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND,
-							&hcon->pend))
-				goto done;
-
-			hci_le_start_enc(hcon, master->ediv, master->rand,
-								key->val);
-			hcon->enc_key_size = key->pin_len;
-
+	if (hcon->link_mode & HCI_LM_MASTER)
+		if (smp_ltk_encrypt(conn))
 			goto done;
-		}
-	}
 
 	if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
 		return 0;
-- 
1.7.6

[PATCH 02/11] Revert "Bluetooth: Add support for communicating keys with userspace"

[Vinicius Costa Gomes]

This reverts commit 5a0a8b49746771fba79866fb9185ffa051a6a183.

If we use separate messages and list for SMP specific keys we can
simplify the code.

Conflicts:

	net/bluetooth/mgmt.c

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/mgmt.c |   60 ++++++++++++-------------------------------------
 1 files changed, 15 insertions(+), 45 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index dac7d39..0e73880 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -908,7 +908,7 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 	struct hci_dev *hdev;
 	struct mgmt_cp_load_keys *cp;
 	u16 key_count, expected_len;
-	int i, err;
+	int i;
 
 	cp = (void *) data;
 
@@ -918,9 +918,9 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 	key_count = get_unaligned_le16(&cp->key_count);
 
 	expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
-	if (expected_len > len) {
-		BT_ERR("load_keys: expected at least %u bytes, got %u bytes",
-							expected_len, len);
+	if (expected_len != len) {
+		BT_ERR("load_keys: expected %u bytes, got %u bytes",
+							len, expected_len);
 		return -EINVAL;
 	}
 
@@ -942,36 +942,17 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 	else
 		clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 
-	len -= sizeof(*cp);
-	i = 0;
-
-	while (i < len) {
-		struct mgmt_key_info *key = (void *) cp->keys + i;
-
-		i += sizeof(*key) + key->dlen;
-
-		if (key->type == HCI_LK_SMP_LTK) {
-			struct key_master_id *id = (void *) key->data;
-
-			if (key->dlen != sizeof(struct key_master_id))
-				continue;
-
-			hci_add_ltk(hdev, 0, &key->bdaddr, key->pin_len,
-						id->ediv, id->rand, key->val);
-
-			continue;
-		}
+	for (i = 0; i < key_count; i++) {
+		struct mgmt_key_info *key = &cp->keys[i];
 
 		hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 								key->pin_len);
 	}
 
-	err = cmd_complete(sk, index, MGMT_OP_LOAD_KEYS, NULL, 0);
-
 	hci_dev_unlock_bh(hdev);
 	hci_dev_put(hdev);
 
-	return err;
+	return 0;
 }
 
 static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
@@ -1988,28 +1969,17 @@ int mgmt_connectable(u16 index, u8 connectable)
 
 int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
 {
-	struct mgmt_ev_new_key *ev;
-	int err, total;
-
-	total = sizeof(struct mgmt_ev_new_key) + key->dlen;
-	ev = kzalloc(total, GFP_ATOMIC);
-	if (!ev)
-		return -ENOMEM;
-
-	bacpy(&ev->key.bdaddr, &key->bdaddr);
-	ev->key.type = key->type;
-	memcpy(ev->key.val, key->val, 16);
-	ev->key.pin_len = key->pin_len;
-	ev->key.dlen = key->dlen;
-	ev->store_hint = persistent;
-
-	memcpy(ev->key.data, key->data, key->dlen);
+	struct mgmt_ev_new_key ev;
 
-	err = mgmt_event(MGMT_EV_NEW_KEY, index, ev, total, NULL);
+	memset(&ev, 0, sizeof(ev));
 
-	kfree(ev);
+	ev.store_hint = persistent;
+	bacpy(&ev.key.bdaddr, &key->bdaddr);
+	ev.key.type = key->type;
+	memcpy(ev.key.val, key->val, 16);
+	ev.key.pin_len = key->pin_len;
 
-	return err;
+	return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
 }
 
 int mgmt_connected(u16 index, bdaddr_t *bdaddr, u8 link_type)
-- 
1.7.6

[PATCH 03/11] Bluetooth: Add structures for the new SMP messages

[Vinicius Costa Gomes]

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |   24 ++++++++++++++++++++++++
 include/net/bluetooth/mgmt.h     |   24 ++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index cc1ea91..e352f63 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -89,6 +89,28 @@ struct link_key_data {
 	u8 data[0];
 } __packed;
 
+struct smp_ltk_info {
+	u8 enc_size;
+	u16 ediv;
+	u8 rand[8];
+} __packed;
+
+struct smp_irsk_info {
+	u8 addr_type;
+} __packed;
+
+struct smp_link_key {
+	struct list_head list;
+	bdaddr_t bdaddr;
+	u8 type;
+	u8 pin_len;
+	u8 val[16];
+	union {
+		struct smp_ltk_info ltk;
+		struct smp_irsk_info irsk;
+	};
+} __packed;
+
 struct link_key {
 	struct list_head list;
 	bdaddr_t bdaddr;
@@ -203,6 +225,8 @@ struct hci_dev {
 
 	struct list_head	link_keys;
 
+	struct list_head	smp_keys;
+
 	struct list_head	remote_oob_data;
 
 	struct list_head	adv_entries;
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 1c914dd..f2f09bc 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -211,6 +211,24 @@ struct mgmt_cp_unblock_device {
 	bdaddr_t bdaddr;
 } __packed;
 
+struct mgmt_smp_key_info {
+	bdaddr_t bdaddr;
+	u8 type;
+	u8 pin_len;
+	u8 val[16];
+	union {
+		struct smp_ltk_info ltk;
+		struct smp_irsk_info irsk;
+	};
+} __packed;
+
+#define MGMT_OP_LOAD_SMP_KEYS		0x001F
+struct mgmt_cp_load_smp_keys {
+	__u8 debug_keys;
+	__u16 key_count;
+	struct mgmt_smp_key_info keys[0];
+} __packed;
+
 #define MGMT_EV_CMD_COMPLETE		0x0001
 struct mgmt_ev_cmd_complete {
 	__le16 opcode;
@@ -302,3 +320,9 @@ struct mgmt_ev_remote_name {
 } __packed;
 
 #define MGMT_EV_DISCOVERING		0x0014
+
+#define MGMT_EV_NEW_SMP_KEY		0x0015
+struct mgmt_ev_new_smp_key {
+	__u8 store_hint;
+	struct mgmt_smp_key_info key;
+} __packed;
-- 
1.7.6

[PATCH 04/11] Bluetooth: Add support for cleaning the SMP key list

[Vinicius Costa Gomes]

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/hci_core.c         |   14 ++++++++++++++
 2 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index e352f63..f3a2e10 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -577,6 +577,7 @@ int hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 			bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
+int hci_smp_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
 struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
 					bdaddr_t *bdaddr, u8 type);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 534a271..c650e9b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1005,6 +1005,18 @@ int hci_link_keys_clear(struct hci_dev *hdev)
 	return 0;
 }
 
+int hci_smp_keys_clear(struct hci_dev *hdev)
+{
+	struct smp_link_key *k, *tmp;
+
+	list_for_each_entry_safe(k, tmp, &hdev->smp_keys, list) {
+		list_del(&k->list);
+		kfree(k);
+	}
+
+	return 0;
+}
+
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
 	struct list_head *p;
@@ -1502,6 +1514,7 @@ int hci_register_dev(struct hci_dev *hdev)
 	INIT_LIST_HEAD(&hdev->uuids);
 
 	INIT_LIST_HEAD(&hdev->link_keys);
+	INIT_LIST_HEAD(&hdev->smp_keys);
 
 	INIT_LIST_HEAD(&hdev->remote_oob_data);
 
@@ -1589,6 +1602,7 @@ int hci_unregister_dev(struct hci_dev *hdev)
 	hci_blacklist_clear(hdev);
 	hci_uuids_clear(hdev);
 	hci_link_keys_clear(hdev);
+	hci_smp_keys_clear(hdev);
 	hci_remote_oob_data_clear(hdev);
 	hci_adv_entries_clear(hdev);
 	hci_dev_unlock_bh(hdev);
-- 
1.7.6

[PATCH 05/11] Bluetooth: Add handlers for the new mgmt messages

[Vinicius Costa Gomes]

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci.h      |    1 +
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/mgmt.c             |   97 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 99 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index be30aab..559f4d5 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -260,6 +260,7 @@ enum {
 #define HCI_LK_AUTH_COMBINATION		0x05
 #define HCI_LK_CHANGED_COMBINATION	0x06
 /* The spec doesn't define types for SMP keys */
+#define HCI_LK_SMP_STK			0x80
 #define HCI_LK_SMP_LTK			0x81
 #define HCI_LK_SMP_IRK			0x82
 #define HCI_LK_SMP_CSRK			0x83
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index f3a2e10..94097fd 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -882,6 +882,7 @@ int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
 								u8 *eir);
 int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name);
 int mgmt_discovering(u16 index, u8 discovering);
+int mgmt_new_smp_key(u16 index, struct smp_link_key *key, u8 persistent);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0e73880..ebe6c3f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1741,6 +1741,73 @@ static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
 	return err;
 }
 
+static int load_smp_keys(struct sock *sk, u16 index, unsigned char *data,
+								u16 len)
+{
+	struct hci_dev *hdev;
+	struct mgmt_cp_load_smp_keys *cp;
+	u16 key_count, expected_len;
+	int i;
+
+	cp = (void *) data;
+
+	if (len < sizeof(*cp))
+		return -EINVAL;
+
+	key_count = get_unaligned_le16(&cp->key_count);
+
+	expected_len = sizeof(*cp) + key_count *
+					sizeof(struct mgmt_smp_key_info);
+	if (expected_len != len) {
+		BT_ERR("load_keys: expected %u bytes, got %u bytes",
+							len, expected_len);
+		return -EINVAL;
+	}
+
+	hdev = hci_dev_get(index);
+	if (!hdev)
+		return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, ENODEV);
+
+	BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
+								key_count);
+
+	hci_dev_lock_bh(hdev);
+
+	hci_smp_keys_clear(hdev);
+
+	set_bit(HCI_LINK_KEYS, &hdev->flags);
+
+	if (cp->debug_keys)
+		set_bit(HCI_DEBUG_KEYS, &hdev->flags);
+	else
+		clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
+
+	for (i = 0; i < key_count; i++) {
+		struct mgmt_smp_key_info *key = &cp->keys[i];
+		struct smp_ltk_info *ltk;
+
+		switch (key->type) {
+		case HCI_LK_SMP_STK:
+			BT_DBG("This key shouldn't be stored");
+			break;
+
+		case HCI_LK_SMP_LTK:
+			ltk = &key->ltk;
+			/* Add key to the smp list */
+			break;
+
+		default:
+			BT_DBG("Not supported");
+			break;
+		}
+	}
+
+	hci_dev_unlock_bh(hdev);
+	hci_dev_put(hdev);
+
+	return 0;
+}
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 {
 	unsigned char *buf;
@@ -1861,6 +1928,9 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 	case MGMT_OP_UNBLOCK_DEVICE:
 		err = unblock_device(sk, index, buf + sizeof(*hdr), len);
 		break;
+	case MGMT_OP_LOAD_SMP_KEYS:
+		err = load_smp_keys(sk, index, buf + sizeof(*hdr), len);
+		break;
 	default:
 		BT_DBG("Unknown op %u", opcode);
 		err = cmd_status(sk, index, opcode, 0x01);
@@ -2268,3 +2338,30 @@ int mgmt_discovering(u16 index, u8 discovering)
 	return mgmt_event(MGMT_EV_DISCOVERING, index, &discovering,
 						sizeof(discovering), NULL);
 }
+
+int mgmt_new_smp_key(u16 index, struct smp_link_key *key, u8 persistent)
+{
+	struct mgmt_ev_new_smp_key ev;
+	struct smp_ltk_info *ltk;
+	struct smp_irsk_info *irsk;
+
+	memset(&ev, 0, sizeof(ev));
+
+	ev.store_hint = persistent;
+	bacpy(&ev.key.bdaddr, &key->bdaddr);
+	ev.key.type = key->type;
+	memcpy(ev.key.val, key->val, 16);
+
+	switch (key->type) {
+	case HCI_LK_SMP_LTK:
+		ltk = &ev.key.ltk;
+		memcpy(ltk, &key->ltk, sizeof(*ltk));
+		break;
+	case HCI_LK_SMP_IRK:
+		irsk = &ev.key.irsk;
+		memcpy(irsk, &key->irsk, sizeof(*irsk));
+		break;
+	}
+
+	return mgmt_event(MGMT_EV_NEW_SMP_KEY, index, &ev, sizeof(ev), NULL);
+}
-- 
1.7.6

[PATCH 06/11] Bluetooth: Rename smp_key_size to enc_size

[Vinicius Costa Gomes]

This makes it more clear that the encryption size (effective
size of the key used for encrypting the link) is a different
concept than the pin code lenght.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |   20 ++++++++++----------
 1 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index fd5e1ca..eb9e3e7 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -41,7 +41,7 @@ struct smp_chan {
 	u8		rrnd[16]; /* SMP Pairing Random (remote) */
 	u8		pcnf[16]; /* SMP Pairing Confirm */
 	u8		tk[16]; /* SMP Temporary Key */
-	u8		smp_key_size;
+	u8		enc_size;
 	struct crypto_blkcipher	*tfm;
 	struct work_struct confirm;
 	struct work_struct random;
@@ -243,7 +243,7 @@ static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
 			(max_key_size < SMP_MIN_ENC_KEY_SIZE))
 		return SMP_ENC_KEY_SIZE;
 
-	smp->smp_key_size = max_key_size;
+	smp->enc_size = max_key_size;
 
 	return 0;
 }
@@ -337,8 +337,8 @@ static void random_work(struct work_struct *work)
 		smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
 		swap128(key, stk);
 
-		memset(stk + smp->smp_key_size, 0,
-				SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
+		memset(stk + smp->enc_size, 0,
+				SMP_MAX_ENC_KEY_SIZE - smp->enc_size);
 
 		if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend)) {
 			reason = SMP_UNSPECIFIED;
@@ -346,7 +346,7 @@ static void random_work(struct work_struct *work)
 		}
 
 		hci_le_start_enc(hcon, ediv, rand, stk);
-		hcon->enc_key_size = smp->smp_key_size;
+		hcon->enc_key_size = smp->enc_size;
 	} else {
 		u8 stk[16], r[16], rand[8];
 		__le16 ediv;
@@ -360,10 +360,10 @@ static void random_work(struct work_struct *work)
 		smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
 		swap128(key, stk);
 
-		memset(stk + smp->smp_key_size, 0,
-				SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
+		memset(stk + smp->enc_size, 0,
+				SMP_MAX_ENC_KEY_SIZE - smp->enc_size);
 
-		hci_add_ltk(hcon->hdev, 0, conn->dst, smp->smp_key_size,
+		hci_add_ltk(hcon->hdev, 0, conn->dst, smp->enc_size,
 							ediv, rand, stk);
 	}
 
@@ -630,7 +630,7 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	skb_pull(skb, sizeof(*rp));
 
-	hci_add_ltk(conn->hcon->hdev, 1, conn->src, smp->smp_key_size,
+	hci_add_ltk(conn->hcon->hdev, 1, conn->src, smp->enc_size,
 						rp->ediv, rp->rand, smp->tk);
 
 	smp_distribute_keys(conn, 1);
@@ -754,7 +754,7 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
 		smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
 
-		hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->smp_key_size,
+		hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->enc_size,
 						ediv, ident.rand, enc.ltk);
 
 		ident.ediv = cpu_to_le16(ediv);
-- 
1.7.6

[PATCH 07/11] Bluetooth: Use the smp_keys list for accessing SMP keys

[Vinicius Costa Gomes]

Now that we have a separate key list for SMP, we may use it.

For now, there is only support for the Short Term Key (which should
be used only once) and LTK (which should be sent to userspace for
storage).

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |   26 +++----------
 include/net/bluetooth/mgmt.h     |    2 -
 net/bluetooth/hci_core.c         |   73 +++++++++++++++++++------------------
 net/bluetooth/hci_event.c        |   13 ++++---
 net/bluetooth/mgmt.c             |    4 ++-
 net/bluetooth/smp.c              |   26 +++++++------
 6 files changed, 68 insertions(+), 76 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 94097fd..15ee163 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -75,20 +75,6 @@ struct bt_uuid {
 	u8 svc_hint;
 };
 
-struct key_master_id {
-	__le16 ediv;
-	u8 rand[8];
-} __packed;
-
-struct link_key_data {
-	bdaddr_t bdaddr;
-	u8 type;
-	u8 val[16];
-	u8 pin_len;
-	u8 dlen;
-	u8 data[0];
-} __packed;
-
 struct smp_ltk_info {
 	u8 enc_size;
 	u16 ediv;
@@ -117,8 +103,6 @@ struct link_key {
 	u8 type;
 	u8 val[16];
 	u8 pin_len;
-	u8 dlen;
-	u8 data[0];
 };
 
 struct oob_data {
@@ -578,11 +562,13 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 			bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
 int hci_smp_keys_clear(struct hci_dev *hdev);
-struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
-struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
+struct smp_link_key *hci_find_smp_enc_key(struct hci_dev *hdev, __le16 ediv,
+							u8 rand[8]);
+struct smp_link_key *hci_find_smp_key_type(struct hci_dev *hdev,
 					bdaddr_t *bdaddr, u8 type);
-int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-			u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16]);
+int hci_add_smp_enc_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 new_key,
+					u8 type, u8 pin_len, u8 tk[16],
+					u8 enc_size, u16 ediv, u8 rand[8]);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 int hci_remote_oob_data_clear(struct hci_dev *hdev);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index f2f09bc..6d103a6 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -101,8 +101,6 @@ struct mgmt_key_info {
 	u8 type;
 	u8 val[16];
 	u8 pin_len;
-	u8 dlen;
-	u8 data[0];
 } __packed;
 
 #define MGMT_OP_LOAD_KEYS		0x000D
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c650e9b..f53ae60 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1069,41 +1069,42 @@ static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
 	return 0;
 }
 
-struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
+/* In the case that the key returned is a STK it should be freed after use */
+struct smp_link_key *hci_find_smp_enc_key(struct hci_dev *hdev, __le16 ediv,
+								u8 rand[8])
 {
-	struct link_key *k;
+	struct smp_link_key *k, *tmp;
 
-	list_for_each_entry(k, &hdev->link_keys, list) {
-		struct key_master_id *id;
+	list_for_each_entry_safe(k, tmp, &hdev->smp_keys, list) {
+		struct smp_ltk_info *info = &k->ltk;
 
-		if (k->type != HCI_LK_SMP_LTK)
+		if (info->ediv != ediv ||
+				memcmp(rand, info->rand, sizeof(info->rand)))
 			continue;
 
-		if (k->dlen != sizeof(*id))
-			continue;
+		/* The STK should be used just once */
+		if (k->type == HCI_LK_SMP_STK)
+			list_del(&k->list);
 
-		id = (void *) &k->data;
-		if (id->ediv == ediv &&
-				(memcmp(rand, id->rand, sizeof(id->rand)) == 0))
-			return k;
+		return k;
 	}
 
 	return NULL;
 }
-EXPORT_SYMBOL(hci_find_ltk);
+EXPORT_SYMBOL(hci_find_smp_enc_key);
 
-struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
+struct smp_link_key *hci_find_smp_key_type(struct hci_dev *hdev,
 					bdaddr_t *bdaddr, u8 type)
 {
-	struct link_key *k;
+	struct smp_link_key *k;
 
-	list_for_each_entry(k, &hdev->link_keys, list)
+	list_for_each_entry(k, &hdev->smp_keys, list)
 		if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
 			return k;
 
 	return NULL;
 }
-EXPORT_SYMBOL(hci_find_link_key_type);
+EXPORT_SYMBOL(hci_find_smp_key_type);
 
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 				bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
@@ -1160,40 +1161,40 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 	return 0;
 }
 
-int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-			u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
+int hci_add_smp_enc_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 new_key,
+					u8 type, u8 pin_len, u8 tk[16],
+					u8 enc_size, u16 ediv, u8 rand[8])
 {
-	struct link_key *key, *old_key;
-	struct key_master_id *id;
-	u8 old_key_type;
+	struct smp_link_key *key, *old_key;
+	struct smp_ltk_info *info;
+
+	BT_DBG("%s addr %s type 0x%2.2x", hdev->name, batostr(bdaddr), type);
 
-	BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
+	if (type != HCI_LK_SMP_STK && type != HCI_LK_SMP_LTK)
+		return 0;
 
-	old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
+	old_key = hci_find_smp_key_type(hdev, bdaddr, type);
 	if (old_key) {
 		key = old_key;
-		old_key_type = old_key->type;
 	} else {
-		key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
+		key = kzalloc(sizeof(*key), GFP_ATOMIC);
 		if (!key)
 			return -ENOMEM;
-		list_add(&key->list, &hdev->link_keys);
-		old_key_type = 0xff;
+		list_add(&key->list, &hdev->smp_keys);
 	}
 
-	key->dlen = sizeof(*id);
-
 	bacpy(&key->bdaddr, bdaddr);
-	memcpy(key->val, ltk, sizeof(key->val));
-	key->type = HCI_LK_SMP_LTK;
-	key->pin_len = key_size;
+	memcpy(key->val, tk, sizeof(key->val));
+	key->pin_len = pin_len;
+	key->type = type;
 
-	id = (void *) &key->data;
-	id->ediv = ediv;
-	memcpy(id->rand, rand, sizeof(id->rand));
+	info = &key->ltk;
+	info->enc_size = enc_size;
+	info->ediv = ediv;
+	memcpy(info->rand, rand, sizeof(info->rand));
 
 	if (new_key)
-		mgmt_new_key(hdev->id, key, old_key_type);
+		mgmt_new_smp_key(hdev->id, key, 1);
 
 	return 0;
 }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 8483cab..bfab54c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2860,7 +2860,7 @@ static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
 	struct hci_cp_le_ltk_reply cp;
 	struct hci_cp_le_ltk_neg_reply neg;
 	struct hci_conn *conn;
-	struct link_key *ltk;
+	struct smp_link_key *tk;
 
 	BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
 
@@ -2870,16 +2870,19 @@ static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
 	if (conn == NULL)
 		goto not_found;
 
-	ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
-	if (ltk == NULL)
+	tk = hci_find_smp_enc_key(hdev, ev->ediv, ev->random);
+	if (tk == NULL)
 		goto not_found;
 
-	memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
+	memcpy(cp.ltk, tk->val, sizeof(tk->val));
 	cp.handle = cpu_to_le16(conn->handle);
-	conn->pin_length = ltk->pin_len;
+	conn->pin_length = tk->pin_len;
 
 	hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
+	if (tk->type == HCI_LK_SMP_STK)
+		kfree(tk);
+
 	hci_dev_unlock(hdev);
 
 	return;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index ebe6c3f..2e73b77 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1793,7 +1793,9 @@ static int load_smp_keys(struct sock *sk, u16 index, unsigned char *data,
 
 		case HCI_LK_SMP_LTK:
 			ltk = &key->ltk;
-			/* Add key to the smp list */
+			hci_add_smp_enc_key(hdev, &key->bdaddr, 0, key->type,
+					key->pin_len, key->val, ltk->enc_size,
+					ltk->ediv, ltk->rand);
 			break;
 
 		default:
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index eb9e3e7..4531681 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -363,8 +363,8 @@ static void random_work(struct work_struct *work)
 		memset(stk + smp->enc_size, 0,
 				SMP_MAX_ENC_KEY_SIZE - smp->enc_size);
 
-		hci_add_ltk(hcon->hdev, 0, conn->dst, smp->enc_size,
-							ediv, rand, stk);
+		hci_add_smp_enc_key(hcon->hdev, conn->dst, 0, HCI_LK_SMP_STK,
+				0, stk, smp->enc_size, ediv, rand);
 	}
 
 	return;
@@ -515,11 +515,11 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 
 static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
 {
-	struct link_key *key;
-	struct key_master_id *master;
+	struct smp_link_key *key;
+	struct smp_ltk_info *info;
 	struct hci_conn *hcon = conn->hcon;
 
-	key = hci_find_link_key_type(hcon->hdev, conn->dst,
+	key = hci_find_smp_key_type(hcon->hdev, conn->dst,
 						HCI_LK_SMP_LTK);
 	if (!key)
 		return 0;
@@ -528,10 +528,10 @@ static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
 					&hcon->pend))
 		return 1;
 
-	master = (void *) key->data;
-	hci_le_start_enc(hcon, master->ediv, master->rand,
+	info = &key->ltk;
+	hci_le_start_enc(hcon, info->ediv, info->rand,
 						key->val);
-	hcon->enc_key_size = key->pin_len;
+	hcon->enc_key_size = info->enc_size;
 
 	return 1;
 
@@ -630,8 +630,9 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	skb_pull(skb, sizeof(*rp));
 
-	hci_add_ltk(conn->hcon->hdev, 1, conn->src, smp->enc_size,
-						rp->ediv, rp->rand, smp->tk);
+	hci_add_smp_enc_key(conn->hcon->hdev, conn->dst, 1, HCI_LK_SMP_LTK,
+					conn->hcon->pin_length, smp->tk,
+					smp->enc_size, rp->ediv, rp->rand);
 
 	smp_distribute_keys(conn, 1);
 
@@ -754,8 +755,9 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
 		smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
 
-		hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->enc_size,
-						ediv, ident.rand, enc.ltk);
+		hci_add_smp_enc_key(conn->hcon->hdev, conn->src, 1,
+				HCI_LK_SMP_LTK, conn->hcon->pin_length,
+				enc.ltk, smp->enc_size, ediv, ident.rand);
 
 		ident.ediv = cpu_to_le16(ediv);
 
-- 
1.7.6

[PATCH 08/11] Bluetooth: Remove the link key if LE pairing fails

[Vinicius Costa Gomes]

If the pairing attempt fails, remove the link key.

In the case that the link key wasn't found by the remote device, force
pairing to happen again. This is the correct behaviour when one of the
devices "forgot" its keys.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/hci_core.c         |   16 ++++++++++++++++
 net/bluetooth/l2cap_core.c       |    6 +++++-
 3 files changed, 22 insertions(+), 1 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 15ee163..ec3815a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -570,6 +570,7 @@ int hci_add_smp_enc_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 new_key,
 					u8 type, u8 pin_len, u8 tk[16],
 					u8 enc_size, u16 ediv, u8 rand[8]);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_remove_smp_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 
 int hci_remote_oob_data_clear(struct hci_dev *hdev);
 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f53ae60..7f6940b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1215,6 +1215,22 @@ int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
 	return 0;
 }
 
+int hci_remove_smp_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
+{
+	struct smp_link_key *key;
+
+	key = hci_find_smp_key_type(hdev, bdaddr, type);
+	if (!key)
+		return -ENOENT;
+
+	BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
+
+	list_del(&key->list);
+	kfree(key);
+
+	return 0;
+}
+
 /* HCI command timer function */
 static void hci_cmd_timer(unsigned long arg)
 {
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 5b63381..6e930c4 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4037,9 +4037,13 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
 	BT_DBG("conn %p", conn);
 
-	if (hcon->type == LE_LINK) {
+	if (hcon->type == LE_LINK && !status) {
 		smp_distribute_keys(conn, 0);
 		del_timer(&conn->security_timer);
+	} else if (hcon->type == LE_LINK && status == 0x06) {
+		hci_remove_smp_key(hcon->hdev, &hcon->dst, HCI_LK_SMP_LTK);
+		clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend);
+		smp_conn_security(conn, hcon->pending_sec_level);
 	}
 
 	read_lock(&conn->chan_lock);
-- 
1.7.6

Re: [PATCH 08/11] Bluetooth: Remove the link key if LE pairing fails

[Vinicius Costa Gomes]

Hi,

On 21:08 Fri 19 Aug, Vinicius Costa Gomes wrote:
> If the pairing attempt fails, remove the link key.
> 
> In the case that the link key wasn't found by the remote device, force
> pairing to happen again. This is the correct behaviour when one of the
> devices "forgot" its keys.
> 

This specific commit has some possible security implications, please
ignore it.


Cheers,
-- 
Vinicius

[PATCH 09/11] Bluetooth: Fix not setting a pending security level

[Vinicius Costa Gomes]

For slave initiated security, we should set a default security level,
for now BT_SECURITY_MEDIUM.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 4531681..5e6ee28 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -545,6 +545,8 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	BT_DBG("conn %p", conn);
 
+	hcon->pending_sec_level = BT_SECURITY_MEDIUM;
+
 	if (smp_ltk_encrypt(conn))
 		return 0;
 
-- 
1.7.6

[PATCH 10/11] Bluetooth: Fix setting the connection sec_level when encryption fails

[Vinicius Costa Gomes]

If the encryption changed event indicates that happened an error we
should not set the security level of the connection.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ec3815a..536f87a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -782,7 +782,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
 	if (conn->sec_level == BT_SECURITY_SDP)
 		conn->sec_level = BT_SECURITY_LOW;
 
-	if (conn->pending_sec_level > conn->sec_level)
+	if (!status && conn->pending_sec_level > conn->sec_level)
 		conn->sec_level = conn->pending_sec_level;
 
 	hci_proto_encrypt_cfm(conn, status, encrypt);
-- 
1.7.6

[PATCH 11/11] Bluetooth: Remove support for other SMP keys than the LTK

[Vinicius Costa Gomes]

For now, only the LTK is properly supported. We are able to receive
and generate the other types of keys, but we are not able to use
them. So it's better not request them to be distributed.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 5e6ee28..2a96621 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -213,7 +213,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
 
 	dist_keys = 0;
 	if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->flags)) {
-		dist_keys = SMP_DIST_ENC_KEY | SMP_DIST_ID_KEY | SMP_DIST_SIGN;
+		dist_keys = SMP_DIST_ENC_KEY;
 		authreq |= SMP_AUTH_BONDING;
 	}
 
-- 
1.7.6

Re: [PATCH 00/11] Bluetooth: New mgmt messages for SMP Keys

[Vinicius Costa Gomes]

Hi,

On 21:08 Fri 19 Aug, Vinicius Costa Gomes wrote:
> Hi,
> 
> Using new messages for SMP keys allow for simpler code as it is always
> clear from context the kind of key that is necessary.

I guess it's time to bring some threads back from the dead. How about
starting with this one.

I think that the most controversial thing about this series are how the
new messages are organized (the union thing). Comments are very welcome
:-)

> 
> Along with this are some fixes for problems found while implementing the
> Proximity Profile.
> 
> --
> 
> Vinicius Costa Gomes (11):
>   Bluetooth: Use the LTK after receiving a LE Security Request
>   Revert "Bluetooth: Add support for communicating keys with userspace"
>   Bluetooth: Add structures for the new SMP messages
>   Bluetooth: Add support for cleaning the SMP key list
>   Bluetooth: Add handlers for the new mgmt messages
>   Bluetooth: Rename smp_key_size to enc_size
>   Bluetooth: Use the smp_keys list for accessing SMP keys
>   Bluetooth: Remove the link key if LE pairing fails
>   Bluetooth: Fix not setting a pending security level
>   Bluetooth: Fix setting the connection sec_level when encryption fails
>   Bluetooth: Remove support for other SMP keys than the LTK
> 
>  include/net/bluetooth/hci.h      |    1 +
>  include/net/bluetooth/hci_core.h |   39 ++++++---
>  include/net/bluetooth/mgmt.h     |   26 ++++++-
>  net/bluetooth/hci_core.c         |  103 ++++++++++++++++---------
>  net/bluetooth/hci_event.c        |   13 ++-
>  net/bluetooth/l2cap_core.c       |    6 +-
>  net/bluetooth/mgmt.c             |  159 +++++++++++++++++++++++++++-----------
>  net/bluetooth/smp.c              |   78 +++++++++++--------
>  8 files changed, 291 insertions(+), 134 deletions(-)
> 
> --
> 1.7.6
> 

Cheers,
-- 
Vinicius