[PATCH v2 00/13] Bluetooth: New mgmt messages for SMP Keys

[PATCH v2 00/13] Bluetooth: New mgmt messages for SMP Keys

[Vinicius Costa Gomes]

Hi,

Changes from the last version:
- Add support for removing the SMP Keys using mgmt Remove Key command;
- Disconnect the link if the found LTK isn't accepted to encrypt the
  link;
- We still have no support for any key generation method that would give
  us MITM protection, so we shouldn't say that we require it.
- Changed the defines of the MGMT events, there was a conflict with the
  blocked device events.

Cheers,
--

Vinicius Costa Gomes (13):
  Bluetooth: Fix sending wrong authentication requirements
  Bluetooth: Use the LTK after receiving a LE Security Request
  Revert "Bluetooth: Add support for communicating keys with userspace"
  Bluetooth: Add structures for the new SMP messages
  Bluetooth: Add support for cleaning the SMP key list
  Bluetooth: Add handlers for the new mgmt messages
  Bluetooth: Rename smp_key_size to enc_size
  Bluetooth: Use the smp_keys list for accessing SMP keys
  Bluetooth: Fix not setting a pending security level
  Bluetooth: Fix setting the connection sec_level when encryption fails
  Bluetooth: Remove support for other SMP keys than the LTK
  Bluetooth: mgmt: Add support for removing SMP keys
  Bluetooth: Disconnect the link if Encryption on LE links fails

 include/net/bluetooth/hci.h      |    1 +
 include/net/bluetooth/hci_core.h |   39 ++++++---
 include/net/bluetooth/mgmt.h     |   26 ++++++-
 net/bluetooth/hci_core.c         |  104 ++++++++++++++++--------
 net/bluetooth/hci_event.c        |   13 ++-
 net/bluetooth/l2cap_core.c       |    5 +-
 net/bluetooth/mgmt.c             |  165 +++++++++++++++++++++++++++----------
 net/bluetooth/smp.c              |   97 +++++++++++-----------
 8 files changed, 298 insertions(+), 152 deletions(-)

--
1.7.6

[PATCH v2 01/13] Bluetooth: Fix sending wrong authentication requirements

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

Until we support any pairing method (Passkey Entry, OOB) that gives
MITM protection we shouldn't send that we have MITM protection.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |   19 ++-----------------
 1 files changed, 2 insertions(+), 17 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 0283d47..74afdb7 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -204,18 +204,6 @@ static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
 					msecs_to_jiffies(SMP_TIMEOUT));
 }
 
-static __u8 seclevel_to_authreq(__u8 level)
-{
-	switch (level) {
-	case BT_SECURITY_HIGH:
-		/* Right now we don't support bonding */
-		return SMP_AUTH_MITM;
-
-	default:
-		return SMP_AUTH_NONE;
-	}
-}
-
 static void build_pairing_cmd(struct l2cap_conn *conn,
 				struct smp_cmd_pairing *req,
 				struct smp_cmd_pairing *rsp,
@@ -556,7 +544,6 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
 {
 	struct hci_conn *hcon = conn->hcon;
 	struct smp_chan *smp = conn->smp_chan;
-	__u8 authreq;
 
 	BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
 
@@ -594,19 +581,17 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
 
 	smp = smp_chan_create(conn);
 
-	authreq = seclevel_to_authreq(sec_level);
-
 	if (hcon->link_mode & HCI_LM_MASTER) {
 		struct smp_cmd_pairing cp;
 
-		build_pairing_cmd(conn, &cp, NULL, authreq);
+		build_pairing_cmd(conn, &cp, NULL, SMP_AUTH_NONE);
 		smp->preq[0] = SMP_CMD_PAIRING_REQ;
 		memcpy(&smp->preq[1], &cp, sizeof(cp));
 
 		smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
 	} else {
 		struct smp_cmd_security_req cp;
-		cp.auth_req = authreq;
+		cp.auth_req = SMP_AUTH_NONE;
 		smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
 	}
 
-- 
1.7.6

[PATCH v2 02/13] Bluetooth: Use the LTK after receiving a LE Security Request

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

When receiving a security request from the remote device we should find
if there is already a LTK associated with the remote device, if found
we should use it to encrypt the link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |   46 ++++++++++++++++++++++++++++------------------
 1 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 74afdb7..fd5e1ca 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -513,6 +513,29 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 	return 0;
 }
 
+static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
+{
+	struct link_key *key;
+	struct key_master_id *master;
+	struct hci_conn *hcon = conn->hcon;
+
+	key = hci_find_link_key_type(hcon->hdev, conn->dst,
+						HCI_LK_SMP_LTK);
+	if (!key)
+		return 0;
+
+	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND,
+					&hcon->pend))
+		return 1;
+
+	master = (void *) key->data;
+	hci_le_start_enc(hcon, master->ediv, master->rand,
+						key->val);
+	hcon->enc_key_size = key->pin_len;
+
+	return 1;
+
+}
 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 {
 	struct smp_cmd_security_req *rp = (void *) skb->data;
@@ -522,6 +545,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	BT_DBG("conn %p", conn);
 
+	if (smp_ltk_encrypt(conn))
+		return 0;
+
 	if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
 		return 0;
 
@@ -556,25 +582,9 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
 	if (hcon->sec_level >= sec_level)
 		return 1;
 
-	if (hcon->link_mode & HCI_LM_MASTER) {
-		struct link_key *key;
-
-		key = hci_find_link_key_type(hcon->hdev, conn->dst,
-							HCI_LK_SMP_LTK);
-		if (key) {
-			struct key_master_id *master = (void *) key->data;
-
-			if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND,
-							&hcon->pend))
-				goto done;
-
-			hci_le_start_enc(hcon, master->ediv, master->rand,
-								key->val);
-			hcon->enc_key_size = key->pin_len;
-
+	if (hcon->link_mode & HCI_LM_MASTER)
+		if (smp_ltk_encrypt(conn))
 			goto done;
-		}
-	}
 
 	if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
 		return 0;
-- 
1.7.6

[PATCH v2 03/13] Revert "Bluetooth: Add support for communicating keys with userspace"

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

This reverts commit 5a0a8b49746771fba79866fb9185ffa051a6a183.

If we use separate messages and list for SMP specific keys we can
simplify the code.

Conflicts:

	net/bluetooth/mgmt.c

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/mgmt.c |   60 ++++++++++++-------------------------------------
 1 files changed, 15 insertions(+), 45 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 4f91a00..5809559 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -908,7 +908,7 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 	struct hci_dev *hdev;
 	struct mgmt_cp_load_keys *cp;
 	u16 key_count, expected_len;
-	int i, err;
+	int i;
 
 	cp = (void *) data;
 
@@ -918,9 +918,9 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 	key_count = get_unaligned_le16(&cp->key_count);
 
 	expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
-	if (expected_len > len) {
-		BT_ERR("load_keys: expected at least %u bytes, got %u bytes",
-							expected_len, len);
+	if (expected_len != len) {
+		BT_ERR("load_keys: expected %u bytes, got %u bytes",
+							len, expected_len);
 		return -EINVAL;
 	}
 
@@ -942,36 +942,17 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 	else
 		clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 
-	len -= sizeof(*cp);
-	i = 0;
-
-	while (i < len) {
-		struct mgmt_key_info *key = (void *) cp->keys + i;
-
-		i += sizeof(*key) + key->dlen;
-
-		if (key->type == HCI_LK_SMP_LTK) {
-			struct key_master_id *id = (void *) key->data;
-
-			if (key->dlen != sizeof(struct key_master_id))
-				continue;
-
-			hci_add_ltk(hdev, 0, &key->bdaddr, key->pin_len,
-						id->ediv, id->rand, key->val);
-
-			continue;
-		}
+	for (i = 0; i < key_count; i++) {
+		struct mgmt_key_info *key = &cp->keys[i];
 
 		hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 								key->pin_len);
 	}
 
-	err = cmd_complete(sk, index, MGMT_OP_LOAD_KEYS, NULL, 0);
-
 	hci_dev_unlock_bh(hdev);
 	hci_dev_put(hdev);
 
-	return err;
+	return 0;
 }
 
 static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
@@ -2012,28 +1993,17 @@ int mgmt_connectable(u16 index, u8 connectable)
 
 int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
 {
-	struct mgmt_ev_new_key *ev;
-	int err, total;
-
-	total = sizeof(struct mgmt_ev_new_key) + key->dlen;
-	ev = kzalloc(total, GFP_ATOMIC);
-	if (!ev)
-		return -ENOMEM;
-
-	bacpy(&ev->key.bdaddr, &key->bdaddr);
-	ev->key.type = key->type;
-	memcpy(ev->key.val, key->val, 16);
-	ev->key.pin_len = key->pin_len;
-	ev->key.dlen = key->dlen;
-	ev->store_hint = persistent;
-
-	memcpy(ev->key.data, key->data, key->dlen);
+	struct mgmt_ev_new_key ev;
 
-	err = mgmt_event(MGMT_EV_NEW_KEY, index, ev, total, NULL);
+	memset(&ev, 0, sizeof(ev));
 
-	kfree(ev);
+	ev.store_hint = persistent;
+	bacpy(&ev.key.bdaddr, &key->bdaddr);
+	ev.key.type = key->type;
+	memcpy(ev.key.val, key->val, 16);
+	ev.key.pin_len = key->pin_len;
 
-	return err;
+	return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
 }
 
 int mgmt_connected(u16 index, bdaddr_t *bdaddr, u8 link_type)
-- 
1.7.6

[PATCH v2 04/13] Bluetooth: Add structures for the new SMP messages

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |   24 ++++++++++++++++++++++++
 include/net/bluetooth/mgmt.h     |   24 ++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 5b92442..8ae02c7 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -89,6 +89,28 @@ struct link_key_data {
 	u8 data[0];
 } __packed;
 
+struct smp_ltk_info {
+	u8 enc_size;
+	u16 ediv;
+	u8 rand[8];
+} __packed;
+
+struct smp_irsk_info {
+	u8 addr_type;
+} __packed;
+
+struct smp_link_key {
+	struct list_head list;
+	bdaddr_t bdaddr;
+	u8 type;
+	u8 pin_len;
+	u8 val[16];
+	union {
+		struct smp_ltk_info ltk;
+		struct smp_irsk_info irsk;
+	};
+} __packed;
+
 struct link_key {
 	struct list_head list;
 	bdaddr_t bdaddr;
@@ -203,6 +225,8 @@ struct hci_dev {
 
 	struct list_head	link_keys;
 
+	struct list_head	smp_keys;
+
 	struct list_head	remote_oob_data;
 
 	struct list_head	adv_entries;
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 4ecf4a5..fcc6e5f 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -211,6 +211,24 @@ struct mgmt_cp_unblock_device {
 	bdaddr_t bdaddr;
 } __packed;
 
+struct mgmt_smp_key_info {
+	bdaddr_t bdaddr;
+	u8 type;
+	u8 pin_len;
+	u8 val[16];
+	union {
+		struct smp_ltk_info ltk;
+		struct smp_irsk_info irsk;
+	};
+} __packed;
+
+#define MGMT_OP_LOAD_SMP_KEYS		0x001F
+struct mgmt_cp_load_smp_keys {
+	__u8 debug_keys;
+	__u16 key_count;
+	struct mgmt_smp_key_info keys[0];
+} __packed;
+
 #define MGMT_EV_CMD_COMPLETE		0x0001
 struct mgmt_ev_cmd_complete {
 	__le16 opcode;
@@ -312,3 +330,9 @@ struct mgmt_ev_device_blocked {
 struct mgmt_ev_device_unblocked {
 	bdaddr_t bdaddr;
 } __packed;
+
+#define MGMT_EV_NEW_SMP_KEY		0x0017
+struct mgmt_ev_new_smp_key {
+	__u8 store_hint;
+	struct mgmt_smp_key_info key;
+} __packed;
-- 
1.7.6

[PATCH v2 05/13] Bluetooth: Add support for cleaning the SMP key list

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/hci_core.c         |   14 ++++++++++++++
 2 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 8ae02c7..4da0f16 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -593,6 +593,7 @@ int hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 			bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
+int hci_smp_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
 struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
 					bdaddr_t *bdaddr, u8 type);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 0f1d2d8..6f05cc5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1005,6 +1005,18 @@ int hci_link_keys_clear(struct hci_dev *hdev)
 	return 0;
 }
 
+int hci_smp_keys_clear(struct hci_dev *hdev)
+{
+	struct smp_link_key *k, *tmp;
+
+	list_for_each_entry_safe(k, tmp, &hdev->smp_keys, list) {
+		list_del(&k->list);
+		kfree(k);
+	}
+
+	return 0;
+}
+
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
 	struct list_head *p;
@@ -1486,6 +1498,7 @@ int hci_register_dev(struct hci_dev *hdev)
 	INIT_LIST_HEAD(&hdev->uuids);
 
 	INIT_LIST_HEAD(&hdev->link_keys);
+	INIT_LIST_HEAD(&hdev->smp_keys);
 
 	INIT_LIST_HEAD(&hdev->remote_oob_data);
 
@@ -1573,6 +1586,7 @@ int hci_unregister_dev(struct hci_dev *hdev)
 	hci_blacklist_clear(hdev);
 	hci_uuids_clear(hdev);
 	hci_link_keys_clear(hdev);
+	hci_smp_keys_clear(hdev);
 	hci_remote_oob_data_clear(hdev);
 	hci_adv_entries_clear(hdev);
 	hci_dev_unlock_bh(hdev);
-- 
1.7.6

[PATCH v2 06/13] Bluetooth: Add handlers for the new mgmt messages

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci.h      |    1 +
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/mgmt.c             |   97 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 99 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index be30aab..559f4d5 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -260,6 +260,7 @@ enum {
 #define HCI_LK_AUTH_COMBINATION		0x05
 #define HCI_LK_CHANGED_COMBINATION	0x06
 /* The spec doesn't define types for SMP keys */
+#define HCI_LK_SMP_STK			0x80
 #define HCI_LK_SMP_LTK			0x81
 #define HCI_LK_SMP_IRK			0x82
 #define HCI_LK_SMP_CSRK			0x83
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 4da0f16..44616f7 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -900,6 +900,7 @@ int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name);
 int mgmt_discovering(u16 index, u8 discovering);
 int mgmt_device_blocked(u16 index, bdaddr_t *bdaddr);
 int mgmt_device_unblocked(u16 index, bdaddr_t *bdaddr);
+int mgmt_new_smp_key(u16 index, struct smp_link_key *key, u8 persistent);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 5809559..8b8990a 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1765,6 +1765,73 @@ failed:
 	return err;
 }
 
+static int load_smp_keys(struct sock *sk, u16 index, unsigned char *data,
+								u16 len)
+{
+	struct hci_dev *hdev;
+	struct mgmt_cp_load_smp_keys *cp;
+	u16 key_count, expected_len;
+	int i;
+
+	cp = (void *) data;
+
+	if (len < sizeof(*cp))
+		return -EINVAL;
+
+	key_count = get_unaligned_le16(&cp->key_count);
+
+	expected_len = sizeof(*cp) + key_count *
+					sizeof(struct mgmt_smp_key_info);
+	if (expected_len != len) {
+		BT_ERR("load_keys: expected %u bytes, got %u bytes",
+							len, expected_len);
+		return -EINVAL;
+	}
+
+	hdev = hci_dev_get(index);
+	if (!hdev)
+		return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, ENODEV);
+
+	BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
+								key_count);
+
+	hci_dev_lock_bh(hdev);
+
+	hci_smp_keys_clear(hdev);
+
+	set_bit(HCI_LINK_KEYS, &hdev->flags);
+
+	if (cp->debug_keys)
+		set_bit(HCI_DEBUG_KEYS, &hdev->flags);
+	else
+		clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
+
+	for (i = 0; i < key_count; i++) {
+		struct mgmt_smp_key_info *key = &cp->keys[i];
+		struct smp_ltk_info *ltk;
+
+		switch (key->type) {
+		case HCI_LK_SMP_STK:
+			BT_DBG("This key shouldn't be stored");
+			break;
+
+		case HCI_LK_SMP_LTK:
+			ltk = &key->ltk;
+			/* Add key to the smp list */
+			break;
+
+		default:
+			BT_DBG("Not supported");
+			break;
+		}
+	}
+
+	hci_dev_unlock_bh(hdev);
+	hci_dev_put(hdev);
+
+	return 0;
+}
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 {
 	unsigned char *buf;
@@ -1885,6 +1952,9 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 	case MGMT_OP_UNBLOCK_DEVICE:
 		err = unblock_device(sk, index, buf + sizeof(*hdr), len);
 		break;
+	case MGMT_OP_LOAD_SMP_KEYS:
+		err = load_smp_keys(sk, index, buf + sizeof(*hdr), len);
+		break;
 	default:
 		BT_DBG("Unknown op %u", opcode);
 		err = cmd_status(sk, index, opcode, 0x01);
@@ -2318,3 +2388,30 @@ int mgmt_device_unblocked(u16 index, bdaddr_t *bdaddr)
 	return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, index, &ev, sizeof(ev),
 						cmd ? cmd->sk : NULL);
 }
+
+int mgmt_new_smp_key(u16 index, struct smp_link_key *key, u8 persistent)
+{
+	struct mgmt_ev_new_smp_key ev;
+	struct smp_ltk_info *ltk;
+	struct smp_irsk_info *irsk;
+
+	memset(&ev, 0, sizeof(ev));
+
+	ev.store_hint = persistent;
+	bacpy(&ev.key.bdaddr, &key->bdaddr);
+	ev.key.type = key->type;
+	memcpy(ev.key.val, key->val, 16);
+
+	switch (key->type) {
+	case HCI_LK_SMP_LTK:
+		ltk = &ev.key.ltk;
+		memcpy(ltk, &key->ltk, sizeof(*ltk));
+		break;
+	case HCI_LK_SMP_IRK:
+		irsk = &ev.key.irsk;
+		memcpy(irsk, &key->irsk, sizeof(*irsk));
+		break;
+	}
+
+	return mgmt_event(MGMT_EV_NEW_SMP_KEY, index, &ev, sizeof(ev), NULL);
+}
-- 
1.7.6

[PATCH v2 07/13] Bluetooth: Rename smp_key_size to enc_size

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

This makes it more clear that the encryption size (effective
size of the key used for encrypting the link) is a different
concept than the pin code lenght.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |   20 ++++++++++----------
 1 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index fd5e1ca..eb9e3e7 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -41,7 +41,7 @@ struct smp_chan {
 	u8		rrnd[16]; /* SMP Pairing Random (remote) */
 	u8		pcnf[16]; /* SMP Pairing Confirm */
 	u8		tk[16]; /* SMP Temporary Key */
-	u8		smp_key_size;
+	u8		enc_size;
 	struct crypto_blkcipher	*tfm;
 	struct work_struct confirm;
 	struct work_struct random;
@@ -243,7 +243,7 @@ static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
 			(max_key_size < SMP_MIN_ENC_KEY_SIZE))
 		return SMP_ENC_KEY_SIZE;
 
-	smp->smp_key_size = max_key_size;
+	smp->enc_size = max_key_size;
 
 	return 0;
 }
@@ -337,8 +337,8 @@ static void random_work(struct work_struct *work)
 		smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
 		swap128(key, stk);
 
-		memset(stk + smp->smp_key_size, 0,
-				SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
+		memset(stk + smp->enc_size, 0,
+				SMP_MAX_ENC_KEY_SIZE - smp->enc_size);
 
 		if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend)) {
 			reason = SMP_UNSPECIFIED;
@@ -346,7 +346,7 @@ static void random_work(struct work_struct *work)
 		}
 
 		hci_le_start_enc(hcon, ediv, rand, stk);
-		hcon->enc_key_size = smp->smp_key_size;
+		hcon->enc_key_size = smp->enc_size;
 	} else {
 		u8 stk[16], r[16], rand[8];
 		__le16 ediv;
@@ -360,10 +360,10 @@ static void random_work(struct work_struct *work)
 		smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
 		swap128(key, stk);
 
-		memset(stk + smp->smp_key_size, 0,
-				SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
+		memset(stk + smp->enc_size, 0,
+				SMP_MAX_ENC_KEY_SIZE - smp->enc_size);
 
-		hci_add_ltk(hcon->hdev, 0, conn->dst, smp->smp_key_size,
+		hci_add_ltk(hcon->hdev, 0, conn->dst, smp->enc_size,
 							ediv, rand, stk);
 	}
 
@@ -630,7 +630,7 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	skb_pull(skb, sizeof(*rp));
 
-	hci_add_ltk(conn->hcon->hdev, 1, conn->src, smp->smp_key_size,
+	hci_add_ltk(conn->hcon->hdev, 1, conn->src, smp->enc_size,
 						rp->ediv, rp->rand, smp->tk);
 
 	smp_distribute_keys(conn, 1);
@@ -754,7 +754,7 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
 		smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
 
-		hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->smp_key_size,
+		hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->enc_size,
 						ediv, ident.rand, enc.ltk);
 
 		ident.ediv = cpu_to_le16(ediv);
-- 
1.7.6

[PATCH v2 08/13] Bluetooth: Use the smp_keys list for accessing SMP keys

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

Now that we have a separate key list for SMP, we may use it.

For now, there is only support for the Short Term Key (which should
be used only once) and LTK (which should be sent to userspace for
storage).

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |   26 +++----------
 include/net/bluetooth/mgmt.h     |    2 -
 net/bluetooth/hci_core.c         |   73 +++++++++++++++++++------------------
 net/bluetooth/hci_event.c        |   13 ++++---
 net/bluetooth/mgmt.c             |    4 ++-
 net/bluetooth/smp.c              |   26 +++++++------
 6 files changed, 68 insertions(+), 76 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 44616f7..7aa02e2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -75,20 +75,6 @@ struct bt_uuid {
 	u8 svc_hint;
 };
 
-struct key_master_id {
-	__le16 ediv;
-	u8 rand[8];
-} __packed;
-
-struct link_key_data {
-	bdaddr_t bdaddr;
-	u8 type;
-	u8 val[16];
-	u8 pin_len;
-	u8 dlen;
-	u8 data[0];
-} __packed;
-
 struct smp_ltk_info {
 	u8 enc_size;
 	u16 ediv;
@@ -117,8 +103,6 @@ struct link_key {
 	u8 type;
 	u8 val[16];
 	u8 pin_len;
-	u8 dlen;
-	u8 data[0];
 };
 
 struct oob_data {
@@ -594,11 +578,13 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 			bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
 int hci_smp_keys_clear(struct hci_dev *hdev);
-struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
-struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
+struct smp_link_key *hci_find_smp_enc_key(struct hci_dev *hdev, __le16 ediv,
+							u8 rand[8]);
+struct smp_link_key *hci_find_smp_key_type(struct hci_dev *hdev,
 					bdaddr_t *bdaddr, u8 type);
-int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-			u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16]);
+int hci_add_smp_enc_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 new_key,
+					u8 type, u8 pin_len, u8 tk[16],
+					u8 enc_size, u16 ediv, u8 rand[8]);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 int hci_remote_oob_data_clear(struct hci_dev *hdev);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index fcc6e5f..b3a0893 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -101,8 +101,6 @@ struct mgmt_key_info {
 	u8 type;
 	u8 val[16];
 	u8 pin_len;
-	u8 dlen;
-	u8 data[0];
 } __packed;
 
 #define MGMT_OP_LOAD_KEYS		0x000D
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 6f05cc5..a0f7862 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1069,41 +1069,42 @@ static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
 	return 0;
 }
 
-struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
+/* In the case that the key returned is a STK it should be freed after use */
+struct smp_link_key *hci_find_smp_enc_key(struct hci_dev *hdev, __le16 ediv,
+								u8 rand[8])
 {
-	struct link_key *k;
+	struct smp_link_key *k, *tmp;
 
-	list_for_each_entry(k, &hdev->link_keys, list) {
-		struct key_master_id *id;
+	list_for_each_entry_safe(k, tmp, &hdev->smp_keys, list) {
+		struct smp_ltk_info *info = &k->ltk;
 
-		if (k->type != HCI_LK_SMP_LTK)
+		if (info->ediv != ediv ||
+				memcmp(rand, info->rand, sizeof(info->rand)))
 			continue;
 
-		if (k->dlen != sizeof(*id))
-			continue;
+		/* The STK should be used just once */
+		if (k->type == HCI_LK_SMP_STK)
+			list_del(&k->list);
 
-		id = (void *) &k->data;
-		if (id->ediv == ediv &&
-				(memcmp(rand, id->rand, sizeof(id->rand)) == 0))
-			return k;
+		return k;
 	}
 
 	return NULL;
 }
-EXPORT_SYMBOL(hci_find_ltk);
+EXPORT_SYMBOL(hci_find_smp_enc_key);
 
-struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
+struct smp_link_key *hci_find_smp_key_type(struct hci_dev *hdev,
 					bdaddr_t *bdaddr, u8 type)
 {
-	struct link_key *k;
+	struct smp_link_key *k;
 
-	list_for_each_entry(k, &hdev->link_keys, list)
+	list_for_each_entry(k, &hdev->smp_keys, list)
 		if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
 			return k;
 
 	return NULL;
 }
-EXPORT_SYMBOL(hci_find_link_key_type);
+EXPORT_SYMBOL(hci_find_smp_key_type);
 
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 				bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
@@ -1160,40 +1161,40 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 	return 0;
 }
 
-int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-			u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
+int hci_add_smp_enc_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 new_key,
+					u8 type, u8 pin_len, u8 tk[16],
+					u8 enc_size, u16 ediv, u8 rand[8])
 {
-	struct link_key *key, *old_key;
-	struct key_master_id *id;
-	u8 old_key_type;
+	struct smp_link_key *key, *old_key;
+	struct smp_ltk_info *info;
+
+	BT_DBG("%s addr %s type 0x%2.2x", hdev->name, batostr(bdaddr), type);
 
-	BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
+	if (type != HCI_LK_SMP_STK && type != HCI_LK_SMP_LTK)
+		return 0;
 
-	old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
+	old_key = hci_find_smp_key_type(hdev, bdaddr, type);
 	if (old_key) {
 		key = old_key;
-		old_key_type = old_key->type;
 	} else {
-		key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
+		key = kzalloc(sizeof(*key), GFP_ATOMIC);
 		if (!key)
 			return -ENOMEM;
-		list_add(&key->list, &hdev->link_keys);
-		old_key_type = 0xff;
+		list_add(&key->list, &hdev->smp_keys);
 	}
 
-	key->dlen = sizeof(*id);
-
 	bacpy(&key->bdaddr, bdaddr);
-	memcpy(key->val, ltk, sizeof(key->val));
-	key->type = HCI_LK_SMP_LTK;
-	key->pin_len = key_size;
+	memcpy(key->val, tk, sizeof(key->val));
+	key->pin_len = pin_len;
+	key->type = type;
 
-	id = (void *) &key->data;
-	id->ediv = ediv;
-	memcpy(id->rand, rand, sizeof(id->rand));
+	info = &key->ltk;
+	info->enc_size = enc_size;
+	info->ediv = ediv;
+	memcpy(info->rand, rand, sizeof(info->rand));
 
 	if (new_key)
-		mgmt_new_key(hdev->id, key, old_key_type);
+		mgmt_new_smp_key(hdev->id, key, 1);
 
 	return 0;
 }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 8483cab..bfab54c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2860,7 +2860,7 @@ static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
 	struct hci_cp_le_ltk_reply cp;
 	struct hci_cp_le_ltk_neg_reply neg;
 	struct hci_conn *conn;
-	struct link_key *ltk;
+	struct smp_link_key *tk;
 
 	BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
 
@@ -2870,16 +2870,19 @@ static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
 	if (conn == NULL)
 		goto not_found;
 
-	ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
-	if (ltk == NULL)
+	tk = hci_find_smp_enc_key(hdev, ev->ediv, ev->random);
+	if (tk == NULL)
 		goto not_found;
 
-	memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
+	memcpy(cp.ltk, tk->val, sizeof(tk->val));
 	cp.handle = cpu_to_le16(conn->handle);
-	conn->pin_length = ltk->pin_len;
+	conn->pin_length = tk->pin_len;
 
 	hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
+	if (tk->type == HCI_LK_SMP_STK)
+		kfree(tk);
+
 	hci_dev_unlock(hdev);
 
 	return;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 8b8990a..44f2d05 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1817,7 +1817,9 @@ static int load_smp_keys(struct sock *sk, u16 index, unsigned char *data,
 
 		case HCI_LK_SMP_LTK:
 			ltk = &key->ltk;
-			/* Add key to the smp list */
+			hci_add_smp_enc_key(hdev, &key->bdaddr, 0, key->type,
+					key->pin_len, key->val, ltk->enc_size,
+					ltk->ediv, ltk->rand);
 			break;
 
 		default:
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index eb9e3e7..4531681 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -363,8 +363,8 @@ static void random_work(struct work_struct *work)
 		memset(stk + smp->enc_size, 0,
 				SMP_MAX_ENC_KEY_SIZE - smp->enc_size);
 
-		hci_add_ltk(hcon->hdev, 0, conn->dst, smp->enc_size,
-							ediv, rand, stk);
+		hci_add_smp_enc_key(hcon->hdev, conn->dst, 0, HCI_LK_SMP_STK,
+				0, stk, smp->enc_size, ediv, rand);
 	}
 
 	return;
@@ -515,11 +515,11 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 
 static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
 {
-	struct link_key *key;
-	struct key_master_id *master;
+	struct smp_link_key *key;
+	struct smp_ltk_info *info;
 	struct hci_conn *hcon = conn->hcon;
 
-	key = hci_find_link_key_type(hcon->hdev, conn->dst,
+	key = hci_find_smp_key_type(hcon->hdev, conn->dst,
 						HCI_LK_SMP_LTK);
 	if (!key)
 		return 0;
@@ -528,10 +528,10 @@ static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
 					&hcon->pend))
 		return 1;
 
-	master = (void *) key->data;
-	hci_le_start_enc(hcon, master->ediv, master->rand,
+	info = &key->ltk;
+	hci_le_start_enc(hcon, info->ediv, info->rand,
 						key->val);
-	hcon->enc_key_size = key->pin_len;
+	hcon->enc_key_size = info->enc_size;
 
 	return 1;
 
@@ -630,8 +630,9 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	skb_pull(skb, sizeof(*rp));
 
-	hci_add_ltk(conn->hcon->hdev, 1, conn->src, smp->enc_size,
-						rp->ediv, rp->rand, smp->tk);
+	hci_add_smp_enc_key(conn->hcon->hdev, conn->dst, 1, HCI_LK_SMP_LTK,
+					conn->hcon->pin_length, smp->tk,
+					smp->enc_size, rp->ediv, rp->rand);
 
 	smp_distribute_keys(conn, 1);
 
@@ -754,8 +755,9 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
 		smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
 
-		hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->enc_size,
-						ediv, ident.rand, enc.ltk);
+		hci_add_smp_enc_key(conn->hcon->hdev, conn->src, 1,
+				HCI_LK_SMP_LTK, conn->hcon->pin_length,
+				enc.ltk, smp->enc_size, ediv, ident.rand);
 
 		ident.ediv = cpu_to_le16(ediv);
 
-- 
1.7.6

[PATCH v2 09/13] Bluetooth: Fix not setting a pending security level

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

For slave initiated security, we should set a default security level,
for now BT_SECURITY_MEDIUM.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 4531681..5e6ee28 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -545,6 +545,8 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	BT_DBG("conn %p", conn);
 
+	hcon->pending_sec_level = BT_SECURITY_MEDIUM;
+
 	if (smp_ltk_encrypt(conn))
 		return 0;
 
-- 
1.7.6

[PATCH v2 10/13] Bluetooth: Fix setting the connection sec_level when encryption fails

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

If the encryption changed event indicates that happened an error we
should not set the security level of the connection.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 include/net/bluetooth/hci_core.h |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7aa02e2..b6f1865 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -797,7 +797,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
 	if (conn->sec_level == BT_SECURITY_SDP)
 		conn->sec_level = BT_SECURITY_LOW;
 
-	if (conn->pending_sec_level > conn->sec_level)
+	if (!status && conn->pending_sec_level > conn->sec_level)
 		conn->sec_level = conn->pending_sec_level;
 
 	hci_proto_encrypt_cfm(conn, status, encrypt);
-- 
1.7.6

[PATCH v2 11/13] Bluetooth: Remove support for other SMP keys than the LTK

[Vinicius Costa Gomes]

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

For now, only the LTK is properly supported. We are able to receive
and generate the other types of keys, but we are not able to use
them. So it's better not request them to be distributed.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
---
 net/bluetooth/smp.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 5e6ee28..2a96621 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -213,7 +213,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
 
 	dist_keys = 0;
 	if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->flags)) {
-		dist_keys = SMP_DIST_ENC_KEY | SMP_DIST_ID_KEY | SMP_DIST_SIGN;
+		dist_keys = SMP_DIST_ENC_KEY;
 		authreq |= SMP_AUTH_BONDING;
 	}
 
-- 
1.7.6

[PATCH v2 12/13] Bluetooth: mgmt: Add support for removing SMP keys

[Vinicius Costa Gomes]

The mgmt command to remove keys is used for removing associations
with a remote device, so it makes sense to also use the same
command to remove SMP keys.

Signed-off-by: Vinicius Costa Gomes <vcgomes@gmail.com>
---
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/hci_core.c         |   17 +++++++++++++++++
 net/bluetooth/mgmt.c             |    6 ++++++
 3 files changed, 24 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index b6f1865..4b836d2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -586,6 +586,7 @@ int hci_add_smp_enc_key(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 new_key,
 					u8 type, u8 pin_len, u8 tk[16],
 					u8 enc_size, u16 ediv, u8 rand[8]);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_remove_smp_keys(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 int hci_remote_oob_data_clear(struct hci_dev *hdev);
 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index a0f7862..2d13762 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1215,6 +1215,23 @@ int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
 	return 0;
 }
 
+int hci_remove_smp_keys(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+	struct smp_link_key *k, *tmp;
+
+	list_for_each_entry_safe(k, tmp, &hdev->smp_keys, list) {
+		if (bacmp(bdaddr, &k->bdaddr))
+			continue;
+
+		BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
+
+		list_del(&k->list);
+		kfree(k);
+	}
+
+	return 0;
+}
+
 /* HCI command timer function */
 static void hci_cmd_timer(unsigned long arg)
 {
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 44f2d05..89152be 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -973,6 +973,12 @@ static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
 	hci_dev_lock_bh(hdev);
 
+	err = hci_remove_smp_keys(hdev, &cp->bdaddr);
+	if (err < 0) {
+		err = cmd_status(sk, index, MGMT_OP_REMOVE_KEY, -err);
+		goto unlock;
+	}
+
 	err = hci_remove_link_key(hdev, &cp->bdaddr);
 	if (err < 0) {
 		err = cmd_status(sk, index, MGMT_OP_REMOVE_KEY, -err);
-- 
1.7.6

[PATCH v2 13/13] Bluetooth: Disconnect the link if Encryption on LE links fails

[Vinicius Costa Gomes]

With the last commit this solves a security issue, in the case
that a device spoofs the address of an already bonded device, if
we try encryption, we will receive an error that there's no agreed
key between those devices.

The solution is to disconnect the link as soon as the error is
detected and report the error. So the user can remove the ofending
key and start the pairing process from the begining.

Signed-off-by: Vinicius Costa Gomes <vcgomes@gmail.com>
---
 net/bluetooth/l2cap_core.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index cff4475..34f66b6 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4034,10 +4034,11 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
 	BT_DBG("conn %p", conn);
 
-	if (hcon->type == LE_LINK) {
+	if (hcon->type == LE_LINK && !status) {
 		smp_distribute_keys(conn, 0);
 		del_timer(&conn->security_timer);
-	}
+	} else if (hcon->type == LE_LINK)
+		l2cap_conn_del(hcon, bt_to_errno(status));
 
 	read_lock(&conn->chan_lock);
 
-- 
1.7.6

Re: [PATCH v2 10/13] Bluetooth: Fix setting the connection sec_level when encryption fails

[Peter Hurley]

Hi Vinicius,

On Thu, 2011-08-25 at 19:02 -0400, Vinicius Costa Gomes wrote:
> From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> 
> If the encryption changed event indicates that happened an error we
> should not set the security level of the connection.
> 
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  include/net/bluetooth/hci_core.h |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
> index 7aa02e2..b6f1865 100644
> --- a/include/net/bluetooth/hci_core.h
> +++ b/include/net/bluetooth/hci_core.h
> @@ -797,7 +797,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
>  	if (conn->sec_level == BT_SECURITY_SDP)
>  		conn->sec_level = BT_SECURITY_LOW;
>  
> -	if (conn->pending_sec_level > conn->sec_level)
> +	if (!status && conn->pending_sec_level > conn->sec_level)
>  		conn->sec_level = conn->pending_sec_level;

I think this should be moved out of hci_encrypt_cfm and directly into
hci_encrypt_change_evt. Currently, the only place this assignment is
valid is on receipt of a successful Encryption Change Event (Although,
where is the Encryption Key Refresh Complete Event handling? Or does the
current SMP implementation not allow sec_level elevation?)

Also, I believe that this assignment should only occur on LE links
(which should be specifically tested for). For example, what if an ACL
link authenticates at BT_SECURITY_MEDIUM level successfully but then
later a specific service attempts to authenticates at BT_SECURITY_HIGH
level but fails. The pending_sec_level will still be set to
BT_SECURITY_HIGH so SET_CONN_ENCRYPT just needs to be resent and the ACL
link will be promoted to BT_SECURITY_HIGH.

Maybe instead of testing for an LE link, a new pend bit should be
introduced to indicate that this link is specifically expecting to set
the link sec_level as a result of sending the LE_START_ENCRYPTION cmd?

Regards,
Peter Hurley

Re: [PATCH v2 10/13] Bluetooth: Fix setting the connection sec_level when encryption fails

[Vinicius Costa Gomes]

Hi Peter,

On 15:39 Tue 06 Sep, Peter Hurley wrote:
> Hi Vinicius,
> 
> On Thu, 2011-08-25 at 19:02 -0400, Vinicius Costa Gomes wrote:
> > From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> > 
> > If the encryption changed event indicates that happened an error we
> > should not set the security level of the connection.
> > 
> > Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> > ---
> >  include/net/bluetooth/hci_core.h |    2 +-
> >  1 files changed, 1 insertions(+), 1 deletions(-)
> > 
> > diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
> > index 7aa02e2..b6f1865 100644
> > --- a/include/net/bluetooth/hci_core.h
> > +++ b/include/net/bluetooth/hci_core.h
> > @@ -797,7 +797,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
> >  	if (conn->sec_level == BT_SECURITY_SDP)
> >  		conn->sec_level = BT_SECURITY_LOW;
> >  
> > -	if (conn->pending_sec_level > conn->sec_level)
> > +	if (!status && conn->pending_sec_level > conn->sec_level)
> >  		conn->sec_level = conn->pending_sec_level;
> 
> I think this should be moved out of hci_encrypt_cfm and directly into
> hci_encrypt_change_evt. Currently, the only place this assignment is
> valid is on receipt of a successful Encryption Change Event (Although,
> where is the Encryption Key Refresh Complete Event handling? Or does the
> current SMP implementation not allow sec_level elevation?)

Security elevation in SMP isn't supported right now, as the only supported
security level is MEDIUM, because we don't support anything that would
offer MITM protection, that we are using as a condition for the HIGH
security level.

But your point, that this isn't the best place for this assignment is
good. See below.

> 
> Also, I believe that this assignment should only occur on LE links
> (which should be specifically tested for). For example, what if an ACL
> link authenticates at BT_SECURITY_MEDIUM level successfully but then
> later a specific service attempts to authenticates at BT_SECURITY_HIGH
> level but fails. The pending_sec_level will still be set to
> BT_SECURITY_HIGH so SET_CONN_ENCRYPT just needs to be resent and the ACL
> link will be promoted to BT_SECURITY_HIGH.

Again, good point. But that's an problem that already existed before my
patch. What my patch tries to solve is a much simpler issue: in case of
failure of a single security procedure, the security level of the link
shouldn't be promoted.

> 
> Maybe instead of testing for an LE link, a new pend bit should be
> introduced to indicate that this link is specifically expecting to set
> the link sec_level as a result of sending the LE_START_ENCRYPTION cmd?

I like it.

> 
> Regards,
> Peter Hurley

Cheers,
-- 
Vinicius

Re: [PATCH v2 01/13] Bluetooth: Fix sending wrong authentication requirements

[Gustavo Padovan]

Hi Vinicius,

* Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2011-08-25 20:02:27 -0300]:

> From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> 
> Until we support any pairing method (Passkey Entry, OOB) that gives
> MITM protection we shouldn't send that we have MITM protection.
> 
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  net/bluetooth/smp.c |   19 ++-----------------
>  1 files changed, 2 insertions(+), 17 deletions(-)

Patch has been applied, thanks.

	Gustavo

Re: [PATCH v2 02/13] Bluetooth: Use the LTK after receiving a LE Security Request

[Gustavo Padovan]

* Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2011-08-25 20:02:28 -0300]:

> From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> 
> When receiving a security request from the remote device we should find
> if there is already a LTK associated with the remote device, if found
> we should use it to encrypt the link.
> 
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  net/bluetooth/smp.c |   46 ++++++++++++++++++++++++++++------------------
>  1 files changed, 28 insertions(+), 18 deletions(-)

Applied, thanks.

	Gustavo

Re: [PATCH v2 03/13] Revert "Bluetooth: Add support for communicating keys with userspace"

[Gustavo Padovan]

* Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2011-08-25 20:02:29 -0300]:

> From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> 
> This reverts commit 5a0a8b49746771fba79866fb9185ffa051a6a183.
> 
> If we use separate messages and list for SMP specific keys we can
> simplify the code.
> 
> Conflicts:
> 
> 	net/bluetooth/mgmt.c
> 
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  net/bluetooth/mgmt.c |   60 ++++++++++++-------------------------------------
>  1 files changed, 15 insertions(+), 45 deletions(-)

Applied, thanks.

	Gustavo

Re: [PATCH v2 05/13] Bluetooth: Add support for cleaning the SMP key list

[Gustavo Padovan]

* Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2011-08-25 20:02:31 -0300]:

> From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> 
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  include/net/bluetooth/hci_core.h |    1 +
>  net/bluetooth/hci_core.c         |   14 ++++++++++++++
>  2 files changed, 15 insertions(+), 0 deletions(-)

Applied, thanks.

	Gustavo

Re: [PATCH v2 09/13] Bluetooth: Fix not setting a pending security level

[Gustavo Padovan]

* Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2011-08-25 20:02:35 -0300]:

> From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> 
> For slave initiated security, we should set a default security level,
> for now BT_SECURITY_MEDIUM.
> 
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  net/bluetooth/smp.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)

Applied, thanks.

	Gustavo

Re: [PATCH v2 11/13] Bluetooth: Remove support for other SMP keys than the LTK

[Gustavo Padovan]

* Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2011-08-25 20:02:37 -0300]:

> From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> 
> For now, only the LTK is properly supported. We are able to receive
> and generate the other types of keys, but we are not able to use
> them. So it's better not request them to be distributed.
> 
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  net/bluetooth/smp.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)

Applied, thanks.

	Gustavo