/*******************************************************************************
**
** Function SMP_ConfirmReply
**
** Description This function is called after Security Manager submitted
** numeric comparison request to the application.
**
** Parameters: bd_addr - Address of the device with which numeric
** comparison was requested
** res - comparison result SMP_SUCCESS if success
**
*******************************************************************************/
void SMP_ConfirmReply (BD_ADDR bd_addr, UINT8 res)
{
tSMP_CB *p_cb = & smp_cb;
UINT8 failure = SMP_NUMERIC_COMPAR_FAIL;
SMP_TRACE_EVENT ("%s: Result:%d", __FUNCTION__, res);
/* If timeout already expired or has been canceled, ignore the reply */
if (p_cb->cb_evt != SMP_NC_REQ_EVT) {
SMP_TRACE_WARNING ("%s() - Wrong State: %d", __FUNCTION__, p_cb->state);
return;
}
if (memcmp (bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) != 0) {
SMP_TRACE_ERROR ("%s() - Wrong BD Addr", __FUNCTION__);
return;
}
if (btm_find_dev (bd_addr) == NULL) {
SMP_TRACE_ERROR ("%s() - no dev CB", __FUNCTION__);
return;
}
if (res != SMP_SUCCESS) {
SMP_TRACE_WARNING ("%s() - Numeric Comparison fails", __FUNCTION__);
/* send pairing failure */
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure);
} else {
smp_sm_event(p_cb, SMP_SC_NC_OK_EVT, NULL);
}
}
/*******************************************************************************
**
** Function SMP_OobDataReply
**
** Description This function is called to provide the OOB data for
** SMP in response to SMP_OOB_REQ_EVT
**
** Parameters: bd_addr - Address of the peer device
** res - result of the operation SMP_SUCCESS if success
** p_data - simple pairing Randomizer C.
**
*******************************************************************************/
void SMP_OobDataReply(BD_ADDR bd_addr, tSMP_STATUS res, UINT8 len, UINT8 *p_data)
{
tSMP_CB *p_cb = & smp_cb;
UINT8 failure = SMP_OOB_FAIL;
tSMP_KEY key;
SMP_TRACE_EVENT2 ("SMP_OobDataReply State: %d res:%d",
smp_cb.state, res);
/* If timeout already expired or has been canceled, ignore the reply */
if (p_cb->state != SMP_ST_WAIT_APP_RSP || p_cb->cb_evt != SMP_OOB_REQ_EVT)
return;
if (res != SMP_SUCCESS || len == 0 || !p_data)
{
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure);
}
else
{
if (len > BT_OCTET16_LEN)
len = BT_OCTET16_LEN;
memcpy(p_cb->tk, p_data, len);
key.key_type = SMP_KEY_TYPE_TK;
key.p_data = p_cb->tk;
smp_sm_event(&smp_cb, SMP_KEY_READY_EVT, &key);
}
}
/*******************************************************************************
**
** Function SMP_SecureConnectionOobDataReply
**
** Description This function is called to provide the SC OOB data for
** SMP in response to SMP_SC_OOB_REQ_EVT
**
** Parameters: p_data - pointer to the data
**
*******************************************************************************/
void SMP_SecureConnectionOobDataReply(UINT8 *p_data)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 failure = SMP_OOB_FAIL;
tSMP_SC_OOB_DATA *p_oob = (tSMP_SC_OOB_DATA *) p_data;
if (!p_oob) {
SMP_TRACE_ERROR("%s received no data", __FUNCTION__);
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure);
return;
}
SMP_TRACE_EVENT ("%s req_oob_type: %d, loc_oob_data.present: %d, "
"peer_oob_data.present: %d",
__FUNCTION__, p_cb->req_oob_type, p_oob->loc_oob_data.present,
p_oob->peer_oob_data.present);
if (p_cb->state != SMP_STATE_WAIT_APP_RSP || p_cb->cb_evt != SMP_SC_OOB_REQ_EVT) {
return;
}
BOOLEAN data_missing = FALSE;
switch (p_cb->req_oob_type) {
case SMP_OOB_PEER:
if (!p_oob->peer_oob_data.present) {
data_missing = TRUE;
}
break;
case SMP_OOB_LOCAL:
if (!p_oob->loc_oob_data.present) {
data_missing = TRUE;
}
break;
case SMP_OOB_BOTH:
if (!p_oob->loc_oob_data.present || !p_oob->peer_oob_data.present) {
data_missing = TRUE;
}
break;
default:
SMP_TRACE_EVENT ("Unexpected OOB data type requested. Fail OOB");
data_missing = TRUE;
break;
}
if (data_missing) {
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure);
return;
}
p_cb->sc_oob_data = *p_oob;
smp_sm_event(&smp_cb, SMP_SC_OOB_DATA_EVT, p_data);
}
/*******************************************************************************
**
** Function smp_process_confirm
**
** Description This function is called when SConfirm/MConfirm is generated
** proceed to send the Confirm request/response to peer device.
**
** Returns void
**
*******************************************************************************/
static void smp_process_confirm(tSMP_CB *p_cb, tSMP_ENC *p)
{
tSMP_KEY key;
SMP_TRACE_DEBUG0 ("smp_process_confirm ");
#if SMP_CONFORMANCE_TESTING == TRUE
if (p_cb->enable_test_confirm_val)
{
BTM_TRACE_DEBUG0 ("Use confirm value from script");
memcpy(p_cb->confirm, p_cb->test_confirm, BT_OCTET16_LEN);
}
else
memcpy(p_cb->confirm, p->param_buf, BT_OCTET16_LEN);
#else
memcpy(p_cb->confirm, p->param_buf, BT_OCTET16_LEN);
#endif
#if (SMP_DEBUG == TRUE)
SMP_TRACE_DEBUG0("Confirm Generated");
smp_debug_print_nbyte_little_endian ((UINT8 *)p_cb->confirm, (const UINT8 *)"Confirm", 16);
#endif
key.key_type = SMP_KEY_TYPE_CFM;
key.p_data = p->param_buf;
smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key);
}
/*******************************************************************************
**
** Function smp_calculate_comfirm
**
** Description This function is called to calculate Confirm value.
**
** Returns void
**
*******************************************************************************/
void smp_calculate_comfirm (tSMP_CB *p_cb, BT_OCTET16 rand, BD_ADDR bda)
{
BT_OCTET16 p1;
tSMP_ENC output;
tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
SMP_TRACE_DEBUG0 ("smp_calculate_comfirm ");
/* generate p1 = pres || preq || rat' || iat' */
smp_gen_p1_4_confirm(p_cb, p1);
/* p1 = rand XOR p1 */
smp_xor_128(p1, rand);
smp_debug_print_nbyte_little_endian ((UINT8 *)p1, (const UINT8 *)"P1' = r XOR p1", 16);
/* calculate e(k, r XOR p1), where k = TK */
if (!SMP_Encrypt(p_cb->tk, BT_OCTET16_LEN, p1, BT_OCTET16_LEN, &output))
{
SMP_TRACE_ERROR0("smp_generate_csrk failed");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
}
else
{
smp_calculate_comfirm_cont(p_cb, &output);
}
}
/*******************************************************************************
**
** Function smp_compute_csrk
**
** Description This function is called to calculate CSRK
**
**
** Returns void
**
*******************************************************************************/
void smp_compute_csrk(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
{
BT_OCTET16 er;
UINT8 buffer[4]; /* for (r || DIV) r=1*/
UINT16 r=1;
UINT8 *p=buffer;
tSMP_ENC output;
tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
SMP_TRACE_DEBUG1 ("smp_compute_csrk div=%x", p_cb->div);
BTM_GetDeviceEncRoot(er);
/* CSRK = d1(ER, DIV, 1) */
UINT16_TO_STREAM(p, p_cb->div);
UINT16_TO_STREAM(p, r);
if (!SMP_Encrypt(er, BT_OCTET16_LEN, buffer, 4, &output))
{
SMP_TRACE_ERROR0("smp_generate_csrk failed");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
}
else
{
memcpy((void *)p_cb->csrk, output.param_buf, BT_OCTET16_LEN);
smp_send_csrk_info(p_cb, NULL);
}
}
/*******************************************************************************
**
** Function smp_proc_passkey
**
** Description This function is called to process a passkey.
**
** Returns void
**
*******************************************************************************/
void smp_proc_passkey(tSMP_CB *p_cb , tBTM_RAND_ENC *p)
{
UINT8 *tt = p_cb->tk;
tSMP_KEY key;
UINT32 passkey; /* 19655 test number; */
UINT8 *pp = p->param_buf;
SMP_TRACE_DEBUG0 ("smp_proc_passkey ");
STREAM_TO_UINT32(passkey, pp);
passkey &= ~SMP_PASSKEY_MASK;
/* truncate by maximum value */
while (passkey > BTM_MAX_PASSKEY_VAL)
passkey >>= 1;
SMP_TRACE_ERROR1("Passkey generated = %d", passkey);
/* save the TK */
memset(p_cb->tk, 0, BT_OCTET16_LEN);
UINT32_TO_STREAM(tt, passkey);
key.key_type = SMP_KEY_TYPE_TK;
key.p_data = p_cb->tk;
if (p_cb->p_callback)
{
(*p_cb->p_callback)(SMP_PASSKEY_NOTIF_EVT, p_cb->pairing_bda, (tSMP_EVT_DATA *)&passkey);
}
smp_sm_event(p_cb, SMP_KEY_READY_EVT, (tSMP_INT_DATA *)&key);
}
/*******************************************************************************
**
** Function SMP_SecurityGrant
**
** Description This function is called to grant security process.
**
** Parameters bd_addr - peer device bd address.
** res - result of the operation SMP_SUCCESS if success.
** Otherwise, SMP_REPEATED_ATTEMPTS is too many attempts.
**
** Returns None
**
*******************************************************************************/
void SMP_SecurityGrant(BD_ADDR bd_addr, UINT8 res)
{
SMP_TRACE_EVENT ("SMP_SecurityGrant ");
if (smp_cb.smp_over_br) {
if (smp_cb.br_state != SMP_BR_STATE_WAIT_APP_RSP ||
smp_cb.cb_evt != SMP_SEC_REQUEST_EVT ||
memcmp (smp_cb.pairing_bda, bd_addr, BD_ADDR_LEN)) {
return;
}
/* clear the SMP_SEC_REQUEST_EVT event after get grant */
/* avoid generating duplicate pair request */
smp_cb.cb_evt = 0;
smp_br_state_machine_event(&smp_cb, SMP_BR_API_SEC_GRANT_EVT, &res);
return;
}
if (smp_cb.state != SMP_STATE_WAIT_APP_RSP ||
smp_cb.cb_evt != SMP_SEC_REQUEST_EVT ||
memcmp (smp_cb.pairing_bda, bd_addr, BD_ADDR_LEN)) {
return;
}
/* clear the SMP_SEC_REQUEST_EVT event after get grant */
/* avoid generate duplicate pair request */
smp_cb.cb_evt = 0;
smp_sm_event(&smp_cb, SMP_API_SEC_GRANT_EVT, &res);
}
/*******************************************************************************
**
** Function SMP_Pair
**
** Description This function call to perform a SMP pairing with peer device.
** Device support one SMP pairing at one time.
**
** Parameters bd_addr - peer device bd address.
**
** Returns None
**
*******************************************************************************/
tSMP_STATUS SMP_Pair (BD_ADDR bd_addr)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 status = SMP_PAIR_INTERNAL_ERR;
SMP_TRACE_EVENT ("%s state=%d br_state=%d flag=0x%x \n",
__FUNCTION__, p_cb->state, p_cb->br_state, p_cb->flags);
if (p_cb->state != SMP_STATE_IDLE || p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD ||
p_cb->smp_over_br) {
/* pending security on going, reject this one */
return SMP_BUSY;
} else {
p_cb->flags = SMP_PAIR_FLAGS_WE_STARTED_DD;
memcpy (p_cb->pairing_bda, bd_addr, BD_ADDR_LEN);
if (!L2CA_ConnectFixedChnl (L2CAP_SMP_CID, bd_addr, BLE_ADDR_UNKNOWN_TYPE)) {
SMP_TRACE_ERROR("%s: L2C connect fixed channel failed.\n", __FUNCTION__);
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
return status;
}
return SMP_STARTED;
}
}
/*******************************************************************************
**
** Function smp_genenrate_ltk_cont
**
** Description This function is to calculate LTK = d1(ER, DIV, 0)= e(ER, DIV)
**
** Returns void
**
*******************************************************************************/
static void smp_genenrate_ltk_cont(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
{
BT_OCTET16 er;
tSMP_ENC output;
tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
SMP_TRACE_DEBUG0 ("smp_genenrate_ltk_cont ");
BTM_GetDeviceEncRoot(er);
/* LTK = d1(ER, DIV, 0)= e(ER, DIV)*/
if (!SMP_Encrypt(er, BT_OCTET16_LEN, (UINT8 *)&p_cb->div,
sizeof(UINT16), &output))
{
SMP_TRACE_ERROR0("smp_genenrate_ltk_cont failed");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
}
else
{
/* mask the LTK */
smp_mask_enc_key(p_cb->loc_enc_size, output.param_buf);
memcpy((void *)p_cb->ltk, output.param_buf, BT_OCTET16_LEN);
smp_generate_rand_vector(p_cb, NULL);
}
}
/*******************************************************************************
**
** Function SMP_CreateLocalSecureConnectionsOobData
**
** Description This function is called to start creation of local SC OOB
** data set (tSMP_LOC_OOB_DATA).
**
** Parameters: bd_addr - Address of the device to send OOB data block to
**
** Returns Boolean - TRUE: creation of local SC OOB data set started.
*******************************************************************************/
BOOLEAN SMP_CreateLocalSecureConnectionsOobData (tBLE_BD_ADDR *addr_to_send_to)
{
tSMP_CB *p_cb = &smp_cb;
#if (!CONFIG_BT_STACK_NO_LOG)
UINT8 *bd_addr;
#endif
if (addr_to_send_to == NULL) {
SMP_TRACE_ERROR ("%s addr_to_send_to is not provided", __FUNCTION__);
return FALSE;
}
#if (!CONFIG_BT_STACK_NO_LOG)
bd_addr = addr_to_send_to->bda;
#endif
SMP_TRACE_EVENT ("%s addr type: %u, BDA: %08x%04x, state: %u, br_state: %u",
__FUNCTION__, addr_to_send_to->type,
(bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
(bd_addr[4] << 8) + bd_addr[5],
p_cb->state,
p_cb->br_state);
if ((p_cb->state != SMP_STATE_IDLE) || (p_cb->smp_over_br)) {
SMP_TRACE_WARNING ("%s creation of local OOB data set "\
"starts only in IDLE state", __FUNCTION__);
return FALSE;
}
p_cb->sc_oob_data.loc_oob_data.addr_sent_to = *addr_to_send_to;
smp_sm_event(p_cb, SMP_CR_LOC_SC_OOB_DATA_EVT, NULL);
return TRUE;
}
/*******************************************************************************
**
** Function SMP_KeypressNotification
**
** Description This function is called to notify Security Manager about Keypress Notification.
**
** Parameters: bd_addr Address of the device to send keypress notification to
** value Keypress notification parameter value
**
*******************************************************************************/
void SMP_KeypressNotification (BD_ADDR bd_addr, UINT8 value)
{
tSMP_CB *p_cb = &smp_cb;
SMP_TRACE_EVENT ("%s: Value: %d", __FUNCTION__, value);
if (memcmp (bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) != 0) {
SMP_TRACE_ERROR ("%s() - Wrong BD Addr", __FUNCTION__);
return;
}
if (btm_find_dev (bd_addr) == NULL) {
SMP_TRACE_ERROR ("%s() - no dev CB", __FUNCTION__);
return;
}
/* Keypress Notification is used by a device with KeyboardOnly IO capabilities */
/* during the passkey entry protocol */
if (p_cb->local_io_capability != SMP_IO_CAP_IN) {
SMP_TRACE_ERROR ("%s() - wrong local IO capabilities %d",
__FUNCTION__, p_cb->local_io_capability);
return;
}
if (p_cb->selected_association_model != SMP_MODEL_SEC_CONN_PASSKEY_ENT) {
SMP_TRACE_ERROR ("%s() - wrong protocol %d", __FUNCTION__,
p_cb->selected_association_model);
return;
}
smp_sm_event(p_cb, SMP_KEYPRESS_NOTIFICATION_EVENT, &value);
}
/*******************************************************************************
**
** Function smp_generate_stk
**
** Description This function is called to generate STK calculated by running
** AES with the TK value as key and a concatenation of the random
** values.
**
** Returns void
**
*******************************************************************************/
void smp_generate_stk (tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
{
BT_OCTET16 ptext;
UINT8 *p = ptext;
tSMP_ENC output;
tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
SMP_TRACE_DEBUG0 ("smp_generate_stk ");
memset(p, 0, BT_OCTET16_LEN);
if (p_cb->role == HCI_ROLE_MASTER)
{
memcpy(p, p_cb->rand, BT_OCTET8_LEN);
memcpy(&p[BT_OCTET8_LEN], p_cb->rrand, BT_OCTET8_LEN);
}
else
{
memcpy(p, p_cb->rrand, BT_OCTET8_LEN);
memcpy(&p[BT_OCTET8_LEN], p_cb->rand, BT_OCTET8_LEN);
}
/* generate STK = Etk(rand|rrand)*/
if (!SMP_Encrypt( p_cb->tk, BT_OCTET16_LEN, ptext, BT_OCTET16_LEN, &output))
{
SMP_TRACE_ERROR0("smp_generate_stk failed");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
}
else
{
smp_process_stk(p_cb, &output);
}
}
/*******************************************************************************
**
** Function SMP_Pair
**
** Description This function call to perform a SMP pairing with peer device.
** Device support one SMP pairing at one time.
**
** Parameters bd_addr - peer device bd address.
**
** Returns None
**
*******************************************************************************/
tSMP_STATUS SMP_Pair (BD_ADDR bd_addr)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 status = SMP_PAIR_INTERNAL_ERR;
BTM_TRACE_EVENT2 ("SMP_Pair state=%d flag=0x%x ", p_cb->state, p_cb->flags);
if (p_cb->state != SMP_ST_IDLE || p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)
{
/* pending security on going, reject this one */
return SMP_BUSY;
}
else
{
p_cb->flags = SMP_PAIR_FLAGS_WE_STARTED_DD;
memcpy (p_cb->pairing_bda, bd_addr, BD_ADDR_LEN);
if (!L2CA_ConnectFixedChnl (L2CAP_SMP_CID, bd_addr))
{
SMP_TRACE_ERROR0("SMP_Pair: L2C connect fixed channel failed.");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
return status;
}
return SMP_STARTED;
}
}
/*******************************************************************************
**
** Function smp_connect_callback
**
** Description This callback function is called by L2CAP to indicate that
** SMP channel is
** connected (conn = TRUE)/disconnected (conn = FALSE).
**
*******************************************************************************/
static void smp_connect_callback (UINT16 channel, BD_ADDR bd_addr, BOOLEAN connected, UINT16 reason,
tBT_TRANSPORT transport)
{
tSMP_CB *p_cb = &smp_cb;
tSMP_INT_DATA int_data;
BD_ADDR dummy_bda = {0};
SMP_TRACE_EVENT ("SMDBG l2c %s", __FUNCTION__);
if (transport == BT_TRANSPORT_BR_EDR || memcmp(bd_addr, dummy_bda, BD_ADDR_LEN) == 0)
return;
if (memcmp(bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) == 0)
{
SMP_TRACE_EVENT ("%s() for pairing BDA: %08x%04x Event: %s",
__FUNCTION__,
(bd_addr[0]<<24)+(bd_addr[1]<<16)+(bd_addr[2]<<8) + bd_addr[3],
(bd_addr[4]<<8)+bd_addr[5],
(connected) ? "connected" : "disconnected");
if (connected)
{
if(!p_cb->connect_initialized)
{
p_cb->connect_initialized = TRUE;
/* initiating connection established */
p_cb->role = L2CA_GetBleConnRole(bd_addr);
/* initialize local i/r key to be default keys */
p_cb->local_r_key = p_cb->local_i_key = SMP_SEC_DEFAULT_KEY;
p_cb->loc_auth_req = p_cb->peer_auth_req = SMP_DEFAULT_AUTH_REQ;
p_cb->cb_evt = SMP_IO_CAP_REQ_EVT;
smp_sm_event(p_cb, SMP_L2CAP_CONN_EVT, NULL);
}
}
else
{
int_data.reason = reason;
/* Disconnected while doing security */
smp_sm_event(p_cb, SMP_L2CAP_DISCONN_EVT, &int_data);
}
}
}
/*******************************************************************************
**
** Function SMP_SecurityGrant
**
** Description This function is called to grant security process.
**
** Parameters bd_addr - peer device bd address.
** res - result of the operation SMP_SUCCESS if success.
** Otherwise, SMP_REPEATED_ATTEMPTS is too many attempts.
**
** Returns None
**
*******************************************************************************/
void SMP_SecurityGrant(BD_ADDR bd_addr, UINT8 res)
{
SMP_TRACE_EVENT0 ("SMP_SecurityGrant ");
if (smp_cb.state != SMP_ST_WAIT_APP_RSP ||
(smp_cb.cb_evt != SMP_SEC_REQUEST_EVT && smp_cb.cb_evt != SMP_PASSKEY_REQ_EVT) ||
memcmp (smp_cb.pairing_bda, bd_addr, BD_ADDR_LEN))
return;
smp_sm_event(&smp_cb, SMP_API_SEC_GRANT_EVT, &res);
}
/*******************************************************************************
**
** Function smp_rand_back
**
** Description This function is to process the rand command finished,
** process the random/encrypted number for further action.
**
** Returns void
**
*******************************************************************************/
static void smp_rand_back(tBTM_RAND_ENC *p)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 *pp = p->param_buf;
UINT8 failure = SMP_PAIR_FAIL_UNKNOWN;
UINT8 state = p_cb->rand_enc_proc & ~0x80;
SMP_TRACE_DEBUG1 ("smp_rand_back state=0x%x", state);
if (p && p->status == HCI_SUCCESS)
{
switch (state)
{
case SMP_GEN_SRAND_MRAND:
memcpy((void *)p_cb->rand, p->param_buf, p->param_len);
smp_genenrate_rand_cont(p_cb, NULL);
break;
case SMP_GEN_SRAND_MRAND_CONT:
memcpy((void *)&p_cb->rand[8], p->param_buf, p->param_len);
smp_genenrate_confirm(p_cb, NULL);
break;
case SMP_GEN_DIV_LTK:
STREAM_TO_UINT16(p_cb->div, pp);
smp_genenrate_ltk_cont(p_cb, NULL);
break;
case SMP_GEN_DIV_CSRK:
STREAM_TO_UINT16(p_cb->div, pp);
smp_compute_csrk(p_cb, NULL);
break;
case SMP_GEN_TK:
smp_proc_passkey(p_cb, p);
break;
case SMP_GEN_RAND_V:
memcpy(p_cb->enc_rand, p->param_buf, BT_OCTET8_LEN);
smp_generate_y(p_cb, NULL);
break;
}
return;
}
SMP_TRACE_ERROR1("smp_rand_back Key generation failed: (%d)", p_cb->rand_enc_proc);
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure);
}
/*******************************************************************************
**
** Function smp_process_compare
**
** Description This function is called when Compare is generated using the
** RRand and local BDA, TK information.
**
** Returns void
**
*******************************************************************************/
static void smp_process_compare(tSMP_CB *p_cb, tSMP_ENC *p)
{
tSMP_KEY key;
SMP_TRACE_DEBUG0 ("smp_process_compare ");
#if (SMP_DEBUG == TRUE)
SMP_TRACE_DEBUG0("Compare Generated");
smp_debug_print_nbyte_little_endian (p->param_buf, (const UINT8 *)"Compare", 16);
#endif
key.key_type = SMP_KEY_TYPE_CMP;
key.p_data = p->param_buf;
smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key);
}
/*******************************************************************************
**
** Function SMP_PasskeyReply
**
** Description This function is called after Security Manager submitted
** passkey request to the application.
**
** Parameters: bd_addr - Address of the device for which passkey was requested
** res - result of the operation SMP_SUCCESS if success
** passkey - numeric value in the range of
** BTM_MIN_PASSKEY_VAL(0) - BTM_MAX_PASSKEY_VAL(999999(0xF423F)).
**
*******************************************************************************/
void SMP_PasskeyReply (BD_ADDR bd_addr, UINT8 res, UINT32 passkey)
{
tSMP_CB *p_cb = & smp_cb;
UINT8 failure = SMP_PASSKEY_ENTRY_FAIL;
SMP_TRACE_EVENT ("SMP_PasskeyReply: Key: %d Result:%d",
passkey, res);
/* If timeout already expired or has been canceled, ignore the reply */
if (p_cb->cb_evt != SMP_PASSKEY_REQ_EVT) {
SMP_TRACE_WARNING ("SMP_PasskeyReply() - Wrong State: %d", p_cb->state);
return;
}
if (memcmp (bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) != 0) {
SMP_TRACE_ERROR ("SMP_PasskeyReply() - Wrong BD Addr");
return;
}
if (btm_find_dev (bd_addr) == NULL) {
SMP_TRACE_ERROR ("SMP_PasskeyReply() - no dev CB");
return;
}
if (passkey > BTM_MAX_PASSKEY_VAL || res != SMP_SUCCESS) {
SMP_TRACE_WARNING ("SMP_PasskeyReply() - Wrong key len: %d or passkey entry fail", passkey);
/* send pairing failure */
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure);
} else if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_PASSKEY_ENT) {
smp_sm_event(&smp_cb, SMP_SC_KEY_READY_EVT, &passkey);
} else {
smp_convert_string_to_tk(p_cb->tk, passkey);
}
return;
}
/*******************************************************************************
**
** Function smp_process_stk
**
** Description This function is called when STK is generated
** proceed to send the encrypt the link using STK.
**
** Returns void
**
*******************************************************************************/
static void smp_process_stk(tSMP_CB *p_cb, tSMP_ENC *p)
{
tSMP_KEY key;
SMP_TRACE_DEBUG0 ("smp_process_stk ");
#if (SMP_DEBUG == TRUE)
SMP_TRACE_ERROR0("STK Generated");
#endif
smp_mask_enc_key(p_cb->loc_enc_size, p->param_buf);
key.key_type = SMP_KEY_TYPE_STK;
key.p_data = p->param_buf;
smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key);
}
/*******************************************************************************
**
** Function SMP_PairCancel
**
** Description This function call to cancel a SMP pairing with peer device.
**
** Parameters bd_addr - peer device bd address.
**
** Returns TRUE - Pairining is cancelled
**
*******************************************************************************/
BOOLEAN SMP_PairCancel (BD_ADDR bd_addr)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 err_code = SMP_PAIR_FAIL_UNKNOWN;
BOOLEAN status = FALSE;
BTM_TRACE_EVENT ("SMP_CancelPair state=%d flag=0x%x ", p_cb->state, p_cb->flags);
if ( (p_cb->state != SMP_STATE_IDLE) &&
(!memcmp (p_cb->pairing_bda, bd_addr, BD_ADDR_LEN)) ) {
p_cb->is_pair_cancel = TRUE;
SMP_TRACE_DEBUG("Cancel Pairing: set fail reason Unknown");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &err_code);
status = TRUE;
}
return status;
}
/*******************************************************************************
**
** Function smp_tx_complete_callback
**
** Description SMP channel tx complete callback
**
*******************************************************************************/
static void smp_tx_complete_callback (UINT16 cid, UINT16 num_pkt)
{
tSMP_CB *p_cb = &smp_cb;
if (p_cb->total_tx_unacked >= num_pkt)
p_cb->total_tx_unacked -= num_pkt;
else
SMP_TRACE_ERROR("Unexpected %s: num_pkt = %d", __func__,num_pkt);
UINT8 reason = SMP_SUCCESS;
if (p_cb->total_tx_unacked == 0 && p_cb->wait_for_authorization_complete)
{
if (cid == L2CAP_SMP_CID)
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
else
smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &reason);
}
}
/*******************************************************************************
**
** Function smp_genenrate_smp_process_edivltk_cont
**
** Description This function is to calculate EDIV = Y xor DIV
**
** Returns void
**
*******************************************************************************/
static void smp_process_ediv(tSMP_CB *p_cb, tSMP_ENC *p)
{
tSMP_KEY key;
UINT8 *pp= p->param_buf;
UINT16 y;
SMP_TRACE_DEBUG0 ("smp_process_ediv ");
STREAM_TO_UINT16(y, pp);
/* EDIV = Y xor DIV */
p_cb->ediv = p_cb->div ^ y;
/* send LTK ready */
SMP_TRACE_ERROR0("LTK ready");
key.key_type = SMP_KEY_TYPE_LTK;
key.p_data = p->param_buf;
smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key);
}
/*******************************************************************************
**
** Function smp_generate_y
**
** Description This function is to proceed generate Y = E(DHK, Rand)
**
** Returns void
**
*******************************************************************************/
static void smp_generate_y(tSMP_CB *p_cb, tSMP_INT_DATA *p)
{
BT_OCTET16 dhk;
tSMP_ENC output;
tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
SMP_TRACE_DEBUG0 ("smp_generate_y ");
BTM_GetDeviceDHK(dhk);
if (!SMP_Encrypt(dhk, BT_OCTET16_LEN, p_cb->enc_rand,
BT_OCTET8_LEN, &output))
{
SMP_TRACE_ERROR0("smp_generate_y failed");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
}
else
{
smp_process_ediv(p_cb, &output);
}
}
/*******************************************************************************
**
** Function smp_calculate_comfirm_cont
**
** Description This function is called when SConfirm/MConfirm is generated
** proceed to send the Confirm request/response to peer device.
**
** Returns void
**
*******************************************************************************/
static void smp_calculate_comfirm_cont(tSMP_CB *p_cb, tSMP_ENC *p)
{
BT_OCTET16 p2;
tSMP_ENC output;
tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
SMP_TRACE_DEBUG0 ("smp_calculate_comfirm_cont ");
#if SMP_DEBUG == TRUE
SMP_TRACE_DEBUG0("Confirm step 1 p1' = e(k, r XOR p1) Generated");
smp_debug_print_nbyte_little_endian (p->param_buf, (const UINT8 *)"C1", 16);
#endif
smp_gen_p2_4_confirm(p_cb, p2);
/* calculate p2 = (p1' XOR p2) */
smp_xor_128(p2, p->param_buf);
smp_debug_print_nbyte_little_endian ((UINT8 *)p2, (const UINT8 *)"p2' = C1 xor p2", 16);
/* calculate: Confirm = E(k, p1' XOR p2) */
if (!SMP_Encrypt(p_cb->tk, BT_OCTET16_LEN, p2, BT_OCTET16_LEN, &output))
{
SMP_TRACE_ERROR0("smp_calculate_comfirm_cont failed");
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
}
else
{
switch (p_cb->rand_enc_proc)
{
case SMP_GEN_CONFIRM:
smp_process_confirm(p_cb, &output);
break;
case SMP_GEN_COMPARE:
smp_process_compare(p_cb, &output);
break;
}
}
}
/*******************************************************************************
**
** Function smp_data_received
**
** Description This function is called when data is received from L2CAP on
** SMP channel.
**
**
** Returns void
**
*******************************************************************************/
static void smp_data_received(UINT16 channel, BD_ADDR bd_addr, BT_HDR *p_buf)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 *p = (UINT8 *)(p_buf + 1) + p_buf->offset;
UINT8 cmd ;
SMP_TRACE_EVENT ("SMDBG l2c %s", __FUNCTION__);
STREAM_TO_UINT8(cmd, p);
/* sanity check */
if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd))
{
SMP_TRACE_WARNING( "Ignore received command with RESERVED code 0x%02x", cmd);
GKI_freebuf (p_buf);
return;
}
/* reject the pairing request if there is an on-going SMP pairing */
if (SMP_OPCODE_PAIRING_REQ == cmd || SMP_OPCODE_SEC_REQ == cmd)
{
if ((p_cb->state == SMP_STATE_IDLE) && (p_cb->br_state == SMP_BR_STATE_IDLE) &&
!(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD))
{
p_cb->role = L2CA_GetBleConnRole(bd_addr);
memcpy(&p_cb->pairing_bda[0], bd_addr, BD_ADDR_LEN);
}
else if (memcmp(&bd_addr[0], p_cb->pairing_bda, BD_ADDR_LEN))
{
GKI_freebuf (p_buf);
smp_reject_unexpected_pairing_command(bd_addr);
return;
}
/* else, out of state pairing request/security request received, passed into SM */
}
if (memcmp(&bd_addr[0], p_cb->pairing_bda, BD_ADDR_LEN) == 0)
{
btu_stop_timer (&p_cb->rsp_timer_ent);
btu_start_timer (&p_cb->rsp_timer_ent, BTU_TTYPE_SMP_PAIRING_CMD,
SMP_WAIT_FOR_RSP_TOUT);
if (cmd == SMP_OPCODE_CONFIRM)
{
SMP_TRACE_DEBUG ("in %s cmd = 0x%02x, peer_auth_req = 0x%02x,"
"loc_auth_req = 0x%02x",
__FUNCTION__, cmd, p_cb->peer_auth_req, p_cb->loc_auth_req);
if ((p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT) &&
(p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT))
{
cmd = SMP_OPCODE_PAIR_COMMITM;
}
}
p_cb->rcvd_cmd_code = cmd;
p_cb->rcvd_cmd_len = (UINT8) p_buf->len;
smp_sm_event(p_cb, cmd, p);
}
GKI_freebuf (p_buf);
}
/*******************************************************************************
**
** Function smp_sm_event
**
** Description Handle events to the state machine. It looks up the entry
** in the smp_entry_table array.
** If it is a valid entry, it gets the state table.Set the next state,
** if not NULL state.Execute the action function according to the
** state table. If the state returned by action function is not NULL
** state, adjust the new state to the returned state.If (api_evt != MAX),
** call callback function.
**
** Returns void.
**
*******************************************************************************/
void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data)
{
UINT8 curr_state = p_cb->state;
tSMP_SM_TBL state_table;
UINT8 action, entry, i;
tSMP_ENTRY_TBL entry_table = smp_entry_table[p_cb->role];
SMP_TRACE_EVENT0("main smp_sm_event");
if (curr_state >= SMP_ST_MAX)
{
SMP_TRACE_DEBUG1( "Invalid state: %d", curr_state) ;
return;
}
SMP_TRACE_DEBUG5( "SMP Role: %s State: [%s (%d)], Event: [%s (%d)]",\
(p_cb->role == 0x01) ?"Slave" : "Master", smp_get_state_name( p_cb->state),
p_cb->state, smp_get_event_name(event), event) ;
/* look up the state table for the current state */
/* lookup entry /w event & curr_state */
/* If entry is ignore, return.
* Otherwise, get state table (according to curr_state or all_state) */
if ((event < SMP_MAX_EVT) && ( (entry = entry_table[event - 1][curr_state]) != SMP_SM_IGNORE ))
{
if (entry & SMP_ALL_TBL_MASK)
{
entry &= ~SMP_ALL_TBL_MASK;
state_table = smp_all_table;
}
else
state_table = smp_state_table[curr_state][p_cb->role];
}
else
{
#ifdef BLUETOOTH_RTK
if(event == SMP_MASTER_ID_EVT && p_cb->state == SMP_ST_ENC_PENDING) {
SMP_TRACE_EVENT1("need to pending event(%d) until SMP_BOND_REQ_EVT", event);
master_id_pending.pending = TRUE;
master_id_pending.p_cb = p_cb;
master_id_pending.event = event;
master_id_pending.p_data = GKI_getbuf(sizeof(BT_OCTET16)+sizeof(BT_OCTET8));
memcpy(master_id_pending.p_data, p_data, sizeof(BT_OCTET16)+sizeof(BT_OCTET8));
} else if(event == SMP_ENCRPTION_INFO_EVT && p_cb->state == SMP_ST_ENC_PENDING) {
SMP_TRACE_EVENT1("need to pending event(%d) until SMP_BOND_REQ_EVT", event);
enc_info_pending.pending = TRUE;
enc_info_pending.p_cb = p_cb;
enc_info_pending.event = event;
enc_info_pending.p_data = GKI_getbuf(sizeof(BT_OCTET16));
memcpy(enc_info_pending.p_data, p_data, sizeof(BT_OCTET16));
} else
#endif
SMP_TRACE_DEBUG4( "Ignore event [%s (%d)] in state [%s (%d)]",
smp_get_event_name(event), event, smp_get_state_name(curr_state), curr_state);
return;
}
/* Get possible next state from state table. */
smp_set_state(state_table[entry-1][SMP_SME_NEXT_STATE]);
/* If action is not ignore, clear param, exec action and get next state.
* The action function may set the Param for cback.
* Depending on param, call cback or free buffer. */
/* execute action */
/* execute action functions */
for (i = 0; i < SMP_NUM_ACTIONS; i++)
{
if ((action = state_table[entry-1][i]) != SMP_SM_NO_ACTION)
{
(*smp_sm_action[action])(p_cb, (tSMP_INT_DATA *)p_data);
}
else
{
break;
}
}
SMP_TRACE_DEBUG1( "result state = %s", smp_get_state_name( p_cb->state ) ) ;
#ifdef BLUETOOTH_RTK
if(event == SMP_BOND_REQ_EVT && enc_info_pending.pending == TRUE) {
SMP_TRACE_EVENT0("to process pending event SMP_ENCRPTION_INFO_EVT");
smp_sm_event(enc_info_pending.p_cb, enc_info_pending.event, enc_info_pending.p_data);
enc_info_pending.pending = FALSE;
GKI_freebuf(enc_info_pending.p_data);
}
if(event == SMP_BOND_REQ_EVT && master_id_pending.pending == TRUE) {
SMP_TRACE_EVENT0("to process pending event SMP_ID_INFO_EVT");
smp_sm_event(master_id_pending.p_cb, master_id_pending.event, master_id_pending.p_data);
master_id_pending.pending = FALSE;
GKI_freebuf(master_id_pending.p_data);
}
if(event == SMP_L2CAP_CONN_EVT && p_cb->state == SMP_ST_IDLE) {
SMP_TRACE_EVENT0("clean enc_info_pending");
memset(&enc_info_pending, 0 , sizeof(enc_info_pending));
memset(&master_id_pending, 0 , sizeof(master_id_pending));
}
#endif
}
