/******************************************************************************* ** ** Function smp_process_confirm ** ** Description This function is called when SConfirm/MConfirm is generated ** proceed to send the Confirm request/response to peer device. ** ** Returns void ** *******************************************************************************/ static void smp_process_confirm(tSMP_CB *p_cb, tSMP_ENC *p) { tSMP_KEY key; SMP_TRACE_DEBUG ("smp_process_confirm "); #if SMP_CONFORMANCE_TESTING == TRUE if (p_cb->enable_test_confirm_val) { BTM_TRACE_DEBUG ("Use confirm value from script"); memcpy(p_cb->confirm, p_cb->test_confirm, BT_OCTET16_LEN); } else memcpy(p_cb->confirm, p->param_buf, BT_OCTET16_LEN); #else memcpy(p_cb->confirm, p->param_buf, BT_OCTET16_LEN); #endif #if (SMP_DEBUG == TRUE) SMP_TRACE_DEBUG("Confirm Generated"); smp_debug_print_nbyte_little_endian ((UINT8 *)p_cb->confirm, (const UINT8 *)"Confirm", 16); #endif key.key_type = SMP_KEY_TYPE_CFM; key.p_data = p->param_buf; smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key); }
/******************************************************************************* ** ** Function smp_gen_p2_4_confirm ** ** Description Generate Confirm/Compare Step2: ** p2 = padding || ia || ra ** ** Returns void ** *******************************************************************************/ void smp_gen_p2_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p2) { UINT8 *p = (UINT8 *)p2; BD_ADDR remote_bda; tBLE_ADDR_TYPE addr_type = 0; if (!BTM_ReadRemoteConnectionAddr(p_cb->pairing_bda, remote_bda, &addr_type)) { SMP_TRACE_ERROR("can not generate confirm p2 for unknown device"); return; } SMP_TRACE_DEBUG ("smp_gen_p2_4_confirm"); memset(p, 0, sizeof(BT_OCTET16)); if (p_cb->role == HCI_ROLE_MASTER) { /* LSB ra */ BDADDR_TO_STREAM(p, remote_bda); /* ia */ BDADDR_TO_STREAM(p, p_cb->local_bda); } else { /* LSB ra */ BDADDR_TO_STREAM(p, p_cb->local_bda); /* ia */ BDADDR_TO_STREAM(p, remote_bda); } #if SMP_DEBUG == TRUE SMP_TRACE_DEBUG("p2 = padding || ia || ra"); smp_debug_print_nbyte_little_endian(p2, (const UINT8 *)"p2", 16); #endif }
/******************************************************************************* ** Function smp_set_state ** Returns None *******************************************************************************/ void smp_set_state(tSMP_STATE state) { if (state < SMP_STATE_MAX) { SMP_TRACE_DEBUG( "State change: %s(%d) ==> %s(%d)", smp_get_state_name(smp_cb.state), smp_cb.state, smp_get_state_name(state), state ); smp_cb.state = state; } else { SMP_TRACE_DEBUG("smp_set_state invalid state =%d", state ); } }
/******************************************************************************* ** ** Function smp_process_compare ** ** Description This function is called when Compare is generated using the ** RRand and local BDA, TK information. ** ** Returns void ** *******************************************************************************/ static void smp_process_compare(tSMP_CB *p_cb, tSMP_ENC *p) { tSMP_KEY key; SMP_TRACE_DEBUG ("smp_process_compare "); #if (SMP_DEBUG == TRUE) SMP_TRACE_DEBUG("Compare Generated"); smp_debug_print_nbyte_little_endian (p->param_buf, (const UINT8 *)"Compare", 16); #endif key.key_type = SMP_KEY_TYPE_CMP; key.p_data = p->param_buf; smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key); }
/******************************************************************************* ** ** Function smp_compute_csrk ** ** Description This function is called to calculate CSRK ** ** ** Returns void ** *******************************************************************************/ void smp_compute_csrk(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { BT_OCTET16 er; UINT8 buffer[4]; /* for (r || DIV) r=1*/ UINT16 r=1; UINT8 *p=buffer; tSMP_ENC output; tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN; UNUSED(p_data); SMP_TRACE_DEBUG ("smp_compute_csrk div=%x", p_cb->div); BTM_GetDeviceEncRoot(er); /* CSRK = d1(ER, DIV, 1) */ UINT16_TO_STREAM(p, p_cb->div); UINT16_TO_STREAM(p, r); if (!SMP_Encrypt(er, BT_OCTET16_LEN, buffer, 4, &output)) { SMP_TRACE_ERROR("smp_generate_csrk failed"); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); } else { memcpy((void *)p_cb->csrk, output.param_buf, BT_OCTET16_LEN); smp_send_csrk_info(p_cb, NULL); } }
/******************************************************************************* ** ** Function smp_proc_passkey ** ** Description This function is called to process a passkey. ** ** Returns void ** *******************************************************************************/ void smp_proc_passkey(tSMP_CB *p_cb , tBTM_RAND_ENC *p) { UINT8 *tt = p_cb->tk; tSMP_KEY key; UINT32 passkey; /* 19655 test number; */ UINT8 *pp = p->param_buf; SMP_TRACE_DEBUG ("smp_proc_passkey "); STREAM_TO_UINT32(passkey, pp); passkey &= ~SMP_PASSKEY_MASK; /* truncate by maximum value */ while (passkey > BTM_MAX_PASSKEY_VAL) passkey >>= 1; /* save the TK */ memset(p_cb->tk, 0, BT_OCTET16_LEN); UINT32_TO_STREAM(tt, passkey); key.key_type = SMP_KEY_TYPE_TK; key.p_data = p_cb->tk; if (p_cb->p_callback) { (*p_cb->p_callback)(SMP_PASSKEY_NOTIF_EVT, p_cb->pairing_bda, (tSMP_EVT_DATA *)&passkey); } smp_sm_event(p_cb, SMP_KEY_READY_EVT, (tSMP_INT_DATA *)&key); }
/******************************************************************************* ** ** Function smp_generate_stk ** ** Description This function is called to generate STK calculated by running ** AES with the TK value as key and a concatenation of the random ** values. ** ** Returns void ** *******************************************************************************/ void smp_generate_stk (tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { BT_OCTET16 ptext; UINT8 *p = ptext; tSMP_ENC output; tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN; UNUSED(p_data); SMP_TRACE_DEBUG ("smp_generate_stk "); memset(p, 0, BT_OCTET16_LEN); if (p_cb->role == HCI_ROLE_MASTER) { memcpy(p, p_cb->rand, BT_OCTET8_LEN); memcpy(&p[BT_OCTET8_LEN], p_cb->rrand, BT_OCTET8_LEN); } else { memcpy(p, p_cb->rrand, BT_OCTET8_LEN); memcpy(&p[BT_OCTET8_LEN], p_cb->rand, BT_OCTET8_LEN); } /* generate STK = Etk(rand|rrand)*/ if (!SMP_Encrypt( p_cb->tk, BT_OCTET16_LEN, ptext, BT_OCTET16_LEN, &output)) { SMP_TRACE_ERROR("smp_generate_stk failed"); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); } else { smp_process_stk(p_cb, &output); } }
/******************************************************************************* ** ** Function smp_genenrate_ltk_cont ** ** Description This function is to calculate LTK = d1(ER, DIV, 0)= e(ER, DIV) ** ** Returns void ** *******************************************************************************/ static void smp_genenrate_ltk_cont(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { BT_OCTET16 er; tSMP_ENC output; tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN; UNUSED(p_data); SMP_TRACE_DEBUG ("smp_genenrate_ltk_cont "); BTM_GetDeviceEncRoot(er); /* LTK = d1(ER, DIV, 0)= e(ER, DIV)*/ if (!SMP_Encrypt(er, BT_OCTET16_LEN, (UINT8 *)&p_cb->div, sizeof(UINT16), &output)) { SMP_TRACE_ERROR("smp_genenrate_ltk_cont failed"); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); } else { /* mask the LTK */ smp_mask_enc_key(p_cb->loc_enc_size, output.param_buf); memcpy((void *)p_cb->ltk, output.param_buf, BT_OCTET16_LEN); smp_generate_rand_vector(p_cb, NULL); } }
/******************************************************************************* ** ** Function smp_calculate_comfirm ** ** Description This function is called to calculate Confirm value. ** ** Returns void ** *******************************************************************************/ void smp_calculate_comfirm (tSMP_CB *p_cb, BT_OCTET16 rand, BD_ADDR bda) { BT_OCTET16 p1; tSMP_ENC output; tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN; UNUSED(bda); SMP_TRACE_DEBUG ("smp_calculate_comfirm "); /* generate p1 = pres || preq || rat' || iat' */ smp_gen_p1_4_confirm(p_cb, p1); /* p1 = rand XOR p1 */ smp_xor_128(p1, rand); smp_debug_print_nbyte_little_endian ((UINT8 *)p1, (const UINT8 *)"P1' = r XOR p1", 16); /* calculate e(k, r XOR p1), where k = TK */ if (!SMP_Encrypt(p_cb->tk, BT_OCTET16_LEN, p1, BT_OCTET16_LEN, &output)) { SMP_TRACE_ERROR("smp_generate_csrk failed"); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); } else { smp_calculate_comfirm_cont(p_cb, &output); } }
/******************************************************************************* ** ** Function smp_generate_confirm ** ** Description This function is called to start the second pairing phase by ** start generating initializer random number. ** ** ** Returns void ** *******************************************************************************/ void smp_generate_confirm (tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { UNUSED(p_data); SMP_TRACE_DEBUG ("smp_generate_confirm"); p_cb->rand_enc_proc = SMP_GEN_SRAND_MRAND; /* generate MRand or SRand */ if (!btsnd_hcic_ble_rand((void *)smp_rand_back)) smp_rand_back(NULL); }
/******************************************************************************* ** ** Function smp_gen_p1_4_confirm ** ** Description Generate Confirm/Compare Step1: ** p1 = pres || preq || rat' || iat' ** ** Returns void ** *******************************************************************************/ void smp_gen_p1_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p1) { UINT8 *p = (UINT8 *)p1; tBLE_ADDR_TYPE addr_type = 0; BD_ADDR remote_bda; SMP_TRACE_DEBUG ("smp_gen_p1_4_confirm"); if (!BTM_ReadRemoteConnectionAddr(p_cb->pairing_bda, remote_bda, &addr_type)) { SMP_TRACE_ERROR("can not generate confirm for unknown device"); return; } BTM_ReadConnectionAddr( p_cb->pairing_bda, p_cb->local_bda, &p_cb->addr_type); if (p_cb->role == HCI_ROLE_MASTER) { /* LSB : rat': initiator's(local) address type */ UINT8_TO_STREAM(p, p_cb->addr_type); /* LSB : iat': responder's address type */ UINT8_TO_STREAM(p, addr_type); /* concatinate preq */ smp_concatenate_local(p_cb, &p, SMP_OPCODE_PAIRING_REQ); /* concatinate pres */ smp_concatenate_peer(p_cb, &p, SMP_OPCODE_PAIRING_RSP); } else { /* LSB : iat': initiator's address type */ UINT8_TO_STREAM(p, addr_type); /* LSB : rat': responder's(local) address type */ UINT8_TO_STREAM(p, p_cb->addr_type); /* concatinate preq */ smp_concatenate_peer(p_cb, &p, SMP_OPCODE_PAIRING_REQ); /* concatinate pres */ smp_concatenate_local(p_cb, &p, SMP_OPCODE_PAIRING_RSP); } #if SMP_DEBUG == TRUE SMP_TRACE_DEBUG("p1 = pres || preq || rat' || iat'"); smp_debug_print_nbyte_little_endian ((UINT8 *)p1, (const UINT8 *)"P1", 16); #endif }
/******************************************************************************* ** ** Function smp_generate_compare ** ** Description This function is called to generate SConfirm for Slave device, ** or MSlave for Master device. This function can be also used for ** generating Compare number for confirm value check. ** ** Returns void ** *******************************************************************************/ void smp_generate_compare (tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { UNUSED(p_data); SMP_TRACE_DEBUG ("smp_generate_compare "); p_cb->rand_enc_proc = SMP_GEN_COMPARE; smp_debug_print_nbyte_little_endian ((UINT8 *)p_cb->rrand, (const UINT8 *)"peer rand", 16); smp_calculate_comfirm(p_cb, p_cb->rrand, p_cb->local_bda); }
/******************************************************************************* ** ** Function smp_genenrate_confirm ** ** Description This function is called when a 48 bits random number is generated ** as SRand or MRand, continue to calculate Sconfirm or MConfirm. ** ** Returns void ** *******************************************************************************/ static void smp_genenrate_confirm(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { UNUSED(p_data); SMP_TRACE_DEBUG ("smp_genenrate_confirm "); p_cb->rand_enc_proc = SMP_GEN_CONFIRM; smp_debug_print_nbyte_little_endian ((UINT8 *)p_cb->rand, (const UINT8 *)"local rand", 16); smp_calculate_comfirm(p_cb, p_cb->rand, p_cb->pairing_bda); }
/******************************************************************************* ** ** Function smp_generate_csrk ** ** Description This function is called to calculate LTK, starting with DIV ** generation. ** ** ** Returns void ** *******************************************************************************/ void smp_generate_csrk(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { BOOLEAN div_status; UNUSED(p_data); SMP_TRACE_DEBUG ("smp_generate_csrk"); div_status = btm_get_local_div(p_cb->pairing_bda, &p_cb->div); if (div_status) { smp_compute_csrk(p_cb, NULL); } else { SMP_TRACE_DEBUG ("Generate DIV for CSRK"); p_cb->rand_enc_proc = SMP_GEN_DIV_CSRK; if (!btsnd_hcic_ble_rand((void *)smp_rand_back)) smp_rand_back(NULL); } }
/******************************************************************************* ** ** Function smp_encrypt_data ** ** Description This function is called to generate passkey. ** ** Returns void ** *******************************************************************************/ BOOLEAN smp_encrypt_data (UINT8 *key, UINT8 key_len, UINT8 *plain_text, UINT8 pt_len, tSMP_ENC *p_out) { aes_context ctx; UINT8 *p_start = NULL; UINT8 *p = NULL; UINT8 *p_rev_data = NULL; /* input data in big endilan format */ UINT8 *p_rev_key = NULL; /* input key in big endilan format */ UINT8 *p_rev_output = NULL; /* encrypted output in big endilan format */ SMP_TRACE_DEBUG ("smp_encrypt_data"); if ( (p_out == NULL ) || (key_len != SMP_ENCRYT_KEY_SIZE) ) { BTM_TRACE_ERROR ("smp_encrypt_data Failed"); return(FALSE); } if ((p_start = (UINT8 *)GKI_getbuf((SMP_ENCRYT_DATA_SIZE*4))) == NULL) { BTM_TRACE_ERROR ("smp_encrypt_data Failed unable to allocate buffer"); return(FALSE); } if (pt_len > SMP_ENCRYT_DATA_SIZE) pt_len = SMP_ENCRYT_DATA_SIZE; memset(p_start, 0, SMP_ENCRYT_DATA_SIZE * 4); p = p_start; ARRAY_TO_STREAM (p, plain_text, pt_len); /* byte 0 to byte 15 */ p_rev_data = p = p_start + SMP_ENCRYT_DATA_SIZE; /* start at byte 16 */ REVERSE_ARRAY_TO_STREAM (p, p_start, SMP_ENCRYT_DATA_SIZE); /* byte 16 to byte 31 */ p_rev_key = p; /* start at byte 32 */ REVERSE_ARRAY_TO_STREAM (p, key, SMP_ENCRYT_KEY_SIZE); /* byte 32 to byte 47 */ smp_debug_print_nbyte_little_endian(key, (const UINT8 *)"Key", SMP_ENCRYT_KEY_SIZE); smp_debug_print_nbyte_little_endian(p_start, (const UINT8 *)"Plain text", SMP_ENCRYT_DATA_SIZE); p_rev_output = p; aes_set_key(p_rev_key, SMP_ENCRYT_KEY_SIZE, &ctx); aes_encrypt(p_rev_data, p, &ctx); /* outputs in byte 48 to byte 63 */ p = p_out->param_buf; REVERSE_ARRAY_TO_STREAM (p, p_rev_output, SMP_ENCRYT_DATA_SIZE); smp_debug_print_nbyte_little_endian(p_out->param_buf, (const UINT8 *)"Encrypted text", SMP_ENCRYT_KEY_SIZE); p_out->param_len = SMP_ENCRYT_KEY_SIZE; p_out->status = HCI_SUCCESS; p_out->opcode = HCI_BLE_ENCRYPT; GKI_freebuf(p_start); return(TRUE); }
/******************************************************************************* ** ** Function SMP_SetStaticPasskey ** ** Description This function is called to set static passkey ** ** ** Parameters: add - set static passkey when add is TRUE ** clear static passkey when add is FALSE ** passkey - static passkey ** ** *******************************************************************************/ void SMP_SetStaticPasskey (BOOLEAN add, UINT32 passkey) { SMP_TRACE_DEBUG("static passkey %6d", passkey); tSMP_CB *p_cb = & smp_cb; if(add) { p_cb->static_passkey = passkey; p_cb->use_static_passkey = true; } else { p_cb->static_passkey = 0; p_cb->use_static_passkey = false; } }
/******************************************************************************* ** ** Function smp_generate_rand_vector ** ** Description This function is called when LTK is generated, send state machine ** event to SMP. ** ** Returns void ** *******************************************************************************/ static void smp_generate_rand_vector (tSMP_CB *p_cb, tSMP_INT_DATA *p) { UNUSED(p); /* generate EDIV and rand now */ /* generate random vector */ SMP_TRACE_DEBUG ("smp_generate_rand_vector "); p_cb->rand_enc_proc = SMP_GEN_RAND_V; if (!btsnd_hcic_ble_rand((void *)smp_rand_back)) smp_rand_back(NULL); }
static void smp_debug_print_nbyte_little_endian (UINT8 *p, const UINT8 *key_name, UINT8 len) { int i, x = 0; UINT8 p_buf[100]; memset(p_buf, 0, 100); for (i = 0; i < len; i ++) { x += sprintf ((char *)&p_buf[x], "%02x ", p[i]); } SMP_TRACE_DEBUG("%s(LSB ~ MSB) = %s", key_name, p_buf); }
/******************************************************************************* ** ** Function cmac_aes_k_calculate ** ** Description This function is the calculation of block cipher using AES-128. ** ** Returns void ** *******************************************************************************/ static BOOLEAN cmac_aes_k_calculate(BT_OCTET16 key, UINT8 *p_signature, UINT16 tlen) { tSMP_ENC output; UINT8 i = 1, err = 0; UINT8 x[16] = {0}; UINT8 *p_mac; SMP_TRACE_EVENT ("cmac_aes_k_calculate "); while (i <= cmac_cb.round) { smp_xor_128(&cmac_cb.text[(cmac_cb.round - i)*BT_OCTET16_LEN], x); /* Mi' := Mi (+) X */ if (!SMP_Encrypt(key, BT_OCTET16_LEN, &cmac_cb.text[(cmac_cb.round - i)*BT_OCTET16_LEN], BT_OCTET16_LEN, &output)) { err = 1; break; } memcpy(x, output.param_buf, BT_OCTET16_LEN); i ++; } if (!err) { p_mac = output.param_buf + (BT_OCTET16_LEN - tlen); memcpy(p_signature, p_mac, tlen); SMP_TRACE_DEBUG("tlen = %d p_mac = %d", tlen, p_mac); SMP_TRACE_DEBUG("p_mac[0] = 0x%02x p_mac[1] = 0x%02x p_mac[2] = 0x%02x p_mac[3] = 0x%02x", *p_mac, *(p_mac + 1), *(p_mac + 2), *(p_mac + 3)); SMP_TRACE_DEBUG("p_mac[4] = 0x%02x p_mac[5] = 0x%02x p_mac[6] = 0x%02x p_mac[7] = 0x%02x", *(p_mac + 4), *(p_mac + 5), *(p_mac + 6), *(p_mac + 7)); return TRUE; } else return FALSE; }
/******************************************************************************* ** ** Function smp_rand_back ** ** Description This function is to process the rand command finished, ** process the random/encrypted number for further action. ** ** Returns void ** *******************************************************************************/ static void smp_rand_back(tBTM_RAND_ENC *p) { tSMP_CB *p_cb = &smp_cb; UINT8 *pp = p->param_buf; UINT8 failure = SMP_PAIR_FAIL_UNKNOWN; UINT8 state = p_cb->rand_enc_proc & ~0x80; SMP_TRACE_DEBUG ("smp_rand_back state=0x%x", state); if (p && p->status == HCI_SUCCESS) { switch (state) { case SMP_GEN_SRAND_MRAND: memcpy((void *)p_cb->rand, p->param_buf, p->param_len); smp_genenrate_rand_cont(p_cb, NULL); break; case SMP_GEN_SRAND_MRAND_CONT: memcpy((void *)&p_cb->rand[8], p->param_buf, p->param_len); smp_genenrate_confirm(p_cb, NULL); break; case SMP_GEN_DIV_LTK: STREAM_TO_UINT16(p_cb->div, pp); smp_genenrate_ltk_cont(p_cb, NULL); break; case SMP_GEN_DIV_CSRK: STREAM_TO_UINT16(p_cb->div, pp); smp_compute_csrk(p_cb, NULL); break; case SMP_GEN_TK: smp_proc_passkey(p_cb, p); break; case SMP_GEN_RAND_V: memcpy(p_cb->enc_rand, p->param_buf, BT_OCTET8_LEN); smp_generate_y(p_cb, NULL); break; } return; } SMP_TRACE_ERROR("smp_rand_back Key generation failed: (%d)", p_cb->rand_enc_proc); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &failure); }
/******************************************************************************* ** ** Function smp_generate_ltk ** ** Description This function is called to calculate LTK, starting with DIV ** generation. ** ** ** Returns void ** *******************************************************************************/ void smp_generate_ltk(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { BOOLEAN div_status; UNUSED(p_data); SMP_TRACE_DEBUG ("smp_generate_ltk "); div_status = btm_get_local_div(p_cb->pairing_bda, &p_cb->div); if (div_status) { smp_genenrate_ltk_cont(p_cb, NULL); } else { SMP_TRACE_DEBUG ("Generate DIV for LTK"); p_cb->rand_enc_proc = SMP_GEN_DIV_LTK; /* generate MRand or SRand */ if (!btsnd_hcic_ble_rand((void *)smp_rand_back)) smp_rand_back(NULL); } }
/******************************************************************************* ** ** Function smp_calculate_comfirm_cont ** ** Description This function is called when SConfirm/MConfirm is generated ** proceed to send the Confirm request/response to peer device. ** ** Returns void ** *******************************************************************************/ static void smp_calculate_comfirm_cont(tSMP_CB *p_cb, tSMP_ENC *p) { BT_OCTET16 p2; tSMP_ENC output; tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN; SMP_TRACE_DEBUG ("smp_calculate_comfirm_cont "); #if SMP_DEBUG == TRUE SMP_TRACE_DEBUG("Confirm step 1 p1' = e(k, r XOR p1) Generated"); smp_debug_print_nbyte_little_endian (p->param_buf, (const UINT8 *)"C1", 16); #endif smp_gen_p2_4_confirm(p_cb, p2); /* calculate p2 = (p1' XOR p2) */ smp_xor_128(p2, p->param_buf); smp_debug_print_nbyte_little_endian ((UINT8 *)p2, (const UINT8 *)"p2' = C1 xor p2", 16); /* calculate: Confirm = E(k, p1' XOR p2) */ if (!SMP_Encrypt(p_cb->tk, BT_OCTET16_LEN, p2, BT_OCTET16_LEN, &output)) { SMP_TRACE_ERROR("smp_calculate_comfirm_cont failed"); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); } else { switch (p_cb->rand_enc_proc) { case SMP_GEN_CONFIRM: smp_process_confirm(p_cb, &output); break; case SMP_GEN_COMPARE: smp_process_compare(p_cb, &output); break; } } }
/******************************************************************************* ** ** Function smp_process_stk ** ** Description This function is called when STK is generated ** proceed to send the encrypt the link using STK. ** ** Returns void ** *******************************************************************************/ static void smp_process_stk(tSMP_CB *p_cb, tSMP_ENC *p) { tSMP_KEY key; SMP_TRACE_DEBUG ("smp_process_stk "); #if (SMP_DEBUG == TRUE) SMP_TRACE_ERROR("STK Generated"); #endif smp_mask_enc_key(p_cb->loc_enc_size, p->param_buf); key.key_type = SMP_KEY_TYPE_STK; key.p_data = p->param_buf; smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key); }
/******************************************************************************* ** Function smp_concatenate_peer ** add pairing command received from peer device into p1. *******************************************************************************/ void smp_concatenate_peer( tSMP_CB *p_cb, UINT8 **p_data, UINT8 op_code) { UINT8 *p = *p_data; SMP_TRACE_DEBUG ("smp_concatenate_peer "); UINT8_TO_STREAM(p, op_code); UINT8_TO_STREAM(p, p_cb->peer_io_caps); UINT8_TO_STREAM(p, p_cb->peer_oob_flag); UINT8_TO_STREAM(p, p_cb->peer_auth_req); UINT8_TO_STREAM(p, p_cb->peer_enc_size); UINT8_TO_STREAM(p, p_cb->peer_i_key); UINT8_TO_STREAM(p, p_cb->peer_r_key); *p_data = p; }
/******************************************************************************* ** ** Function SMP_PairCancel ** ** Description This function call to cancel a SMP pairing with peer device. ** ** Parameters bd_addr - peer device bd address. ** ** Returns TRUE - Pairining is cancelled ** *******************************************************************************/ BOOLEAN SMP_PairCancel (BD_ADDR bd_addr) { tSMP_CB *p_cb = &smp_cb; UINT8 err_code = SMP_PAIR_FAIL_UNKNOWN; BOOLEAN status = FALSE; BTM_TRACE_EVENT ("SMP_CancelPair state=%d flag=0x%x ", p_cb->state, p_cb->flags); if ( (p_cb->state != SMP_STATE_IDLE) && (!memcmp (p_cb->pairing_bda, bd_addr, BD_ADDR_LEN)) ) { p_cb->is_pair_cancel = TRUE; SMP_TRACE_DEBUG("Cancel Pairing: set fail reason Unknown"); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &err_code); status = TRUE; } return status; }
/******************************************************************************* ** ** Function smp_genenrate_smp_process_edivltk_cont ** ** Description This function is to calculate EDIV = Y xor DIV ** ** Returns void ** *******************************************************************************/ static void smp_process_ediv(tSMP_CB *p_cb, tSMP_ENC *p) { tSMP_KEY key; UINT8 *pp= p->param_buf; UINT16 y; SMP_TRACE_DEBUG ("smp_process_ediv "); STREAM_TO_UINT16(y, pp); /* EDIV = Y xor DIV */ p_cb->ediv = p_cb->div ^ y; /* send LTK ready */ SMP_TRACE_ERROR("LTK ready"); key.key_type = SMP_KEY_TYPE_LTK; key.p_data = p->param_buf; smp_sm_event(p_cb, SMP_KEY_READY_EVT, &key); }
/******************************************************************************* ** ** Function smp_generate_y ** ** Description This function is to proceed generate Y = E(DHK, Rand) ** ** Returns void ** *******************************************************************************/ static void smp_generate_y(tSMP_CB *p_cb, tSMP_INT_DATA *p) { BT_OCTET16 dhk; tSMP_ENC output; tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN; UNUSED(p); SMP_TRACE_DEBUG ("smp_generate_y "); BTM_GetDeviceDHK(dhk); if (!SMP_Encrypt(dhk, BT_OCTET16_LEN, p_cb->enc_rand, BT_OCTET8_LEN, &output)) { SMP_TRACE_ERROR("smp_generate_y failed"); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); } else { smp_process_ediv(p_cb, &output); } }
/******************************************************************************* ** ** Function smp_sm_event ** ** Description Handle events to the state machine. It looks up the entry ** in the smp_entry_table array. ** If it is a valid entry, it gets the state table.Set the next state, ** if not NULL state.Execute the action function according to the ** state table. If the state returned by action function is not NULL ** state, adjust the new state to the returned state.If (api_evt != MAX), ** call callback function. ** ** Returns void. ** *******************************************************************************/ void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data) { UINT8 curr_state = p_cb->state; tSMP_SM_TBL state_table; UINT8 action, entry, i; tSMP_ENTRY_TBL entry_table = smp_entry_table[p_cb->role]; SMP_TRACE_EVENT("main smp_sm_event"); if (curr_state >= SMP_STATE_MAX) { SMP_TRACE_DEBUG( "Invalid state: %d", curr_state) ; return; } SMP_TRACE_DEBUG( "SMP Role: %s State: [%s (%d)], Event: [%s (%d)]",\ (p_cb->role == 0x01) ?"Slave" : "Master", smp_get_state_name( p_cb->state), p_cb->state, smp_get_event_name(event), event) ; /* look up the state table for the current state */ /* lookup entry /w event & curr_state */ /* If entry is ignore, return. * Otherwise, get state table (according to curr_state or all_state) */ if ((event <= SMP_MAX_EVT) && ( (entry = entry_table[event - 1][curr_state]) != SMP_SM_IGNORE )) { if (entry & SMP_ALL_TBL_MASK) { entry &= ~SMP_ALL_TBL_MASK; state_table = smp_all_table; } else state_table = smp_state_table[curr_state][p_cb->role]; } else { SMP_TRACE_DEBUG( "Ignore event [%s (%d)] in state [%s (%d)]", smp_get_event_name(event), event, smp_get_state_name(curr_state), curr_state); return; } /* Get possible next state from state table. */ smp_set_state(state_table[entry-1][SMP_SME_NEXT_STATE]); /* If action is not ignore, clear param, exec action and get next state. * The action function may set the Param for cback. * Depending on param, call cback or free buffer. */ /* execute action */ /* execute action functions */ for (i = 0; i < SMP_NUM_ACTIONS; i++) { if ((action = state_table[entry-1][i]) != SMP_SM_NO_ACTION) { (*smp_sm_action[action])(p_cb, (tSMP_INT_DATA *)p_data); } else { break; } } SMP_TRACE_DEBUG( "result state = %s", smp_get_state_name( p_cb->state ) ) ; }
/******************************************************************************* ** ** Function smp_data_received ** ** Description This function is called when data is received from L2CAP on ** SMP channel. ** ** ** Returns void ** *******************************************************************************/ static void smp_data_received(UINT16 channel, BD_ADDR bd_addr, BT_HDR *p_buf) { tSMP_CB *p_cb = &smp_cb; UINT8 *p = (UINT8 *)(p_buf + 1) + p_buf->offset; UINT8 cmd ; SMP_TRACE_EVENT ("SMDBG l2c %s", __FUNCTION__); STREAM_TO_UINT8(cmd, p); /* sanity check */ if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) { SMP_TRACE_WARNING( "Ignore received command with RESERVED code 0x%02x", cmd); GKI_freebuf (p_buf); return; } /* reject the pairing request if there is an on-going SMP pairing */ if (SMP_OPCODE_PAIRING_REQ == cmd || SMP_OPCODE_SEC_REQ == cmd) { if ((p_cb->state == SMP_STATE_IDLE) && (p_cb->br_state == SMP_BR_STATE_IDLE) && !(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)) { p_cb->role = L2CA_GetBleConnRole(bd_addr); memcpy(&p_cb->pairing_bda[0], bd_addr, BD_ADDR_LEN); } else if (memcmp(&bd_addr[0], p_cb->pairing_bda, BD_ADDR_LEN)) { GKI_freebuf (p_buf); smp_reject_unexpected_pairing_command(bd_addr); return; } /* else, out of state pairing request/security request received, passed into SM */ } if (memcmp(&bd_addr[0], p_cb->pairing_bda, BD_ADDR_LEN) == 0) { btu_stop_timer (&p_cb->rsp_timer_ent); btu_start_timer (&p_cb->rsp_timer_ent, BTU_TTYPE_SMP_PAIRING_CMD, SMP_WAIT_FOR_RSP_TOUT); if (cmd == SMP_OPCODE_CONFIRM) { SMP_TRACE_DEBUG ("in %s cmd = 0x%02x, peer_auth_req = 0x%02x," "loc_auth_req = 0x%02x", __FUNCTION__, cmd, p_cb->peer_auth_req, p_cb->loc_auth_req); if ((p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT) && (p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT)) { cmd = SMP_OPCODE_PAIR_COMMITM; } } p_cb->rcvd_cmd_code = cmd; p_cb->rcvd_cmd_len = (UINT8) p_buf->len; smp_sm_event(p_cb, cmd, p); } GKI_freebuf (p_buf); }