Skip to contentSkip to conversation

Bluetooth: Add support for LE Passkeys to MGMTOPS

PATCH In review Brian Gix 2 participants 3 messages Nov 9, 2011

Subsystems (2)
Bluetooth drivers Bluetooth
lore
Share & tools
lore

Brian Gix

author
#0 lore raw

PATCH 1/1 Bluetooth: Add support for LE Passkeys to MGMTOPS

LE pairing is a Host based algorythm that requires User entered passkeys to obtain Man-In-The-Middle (MITM) level protection, unlike it's BR/EDR based conterpart SSP. This interface addition enables this ability.

Signed-off-by Brian Gix <[email protected]>
---
 include/net/bluetooth/mgmt.h |   11 ++++++
 net/bluetooth/mgmt.c         |   77 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 86 insertions(+), 2 deletions(-)
include/net/bluetooth/mgmt.h +11 -0
index 3e320c9..d67683f 100644
@@ -228,6 +228,17 @@ struct mgmt_cp_set_fast_connectable {
 	__u8 enable;
 } __packed;
 
+#define MGMT_OP_USER_PASSKEY_REPLY	0x0020
+struct mgmt_cp_user_passkey_reply {
+	bdaddr_t bdaddr;
+	__le32 passkey;
+} __packed;
+
+#define MGMT_OP_USER_PASSKEY_NEG_REPLY	0x0021
+struct mgmt_cp_user_passkey_neg_reply {
+	bdaddr_t bdaddr;
+} __packed;
+
 #define MGMT_EV_CMD_COMPLETE		0x0001
 struct mgmt_ev_cmd_complete {
 	__le16 opcode;
net/bluetooth/mgmt.c +75 -2

106 lines not on this page · raw message

Signature · 6 lines
1.7.7.1
-- 
Brian Gix
[email protected]
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum
#1 lore raw

Hi Brian,

Quoted 55 lines · Brian Gix

LE pairing is a Host based algorythm that requires User entered passkeys to obtain Man-In-The-Middle (MITM) level protection, unlike it's BR/EDR based conterpart SSP. This interface addition enables this ability.

Signed-off-by Brian Gix <[email protected]>
---
 include/net/bluetooth/mgmt.h |   11 ++++++
 net/bluetooth/mgmt.c         |   77 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 86 insertions(+), 2 deletions(-)
include/net/bluetooth/mgmt.h +11 -0
index 3e320c9..d67683f 100644
@@ -228,6 +228,17 @@ struct mgmt_cp_set_fast_connectable {
 	__u8 enable;
 } __packed;
 
+#define MGMT_OP_USER_PASSKEY_REPLY	0x0020
+struct mgmt_cp_user_passkey_reply {
+	bdaddr_t bdaddr;
+	__le32 passkey;
+} __packed;
+
+#define MGMT_OP_USER_PASSKEY_NEG_REPLY	0x0021
+struct mgmt_cp_user_passkey_neg_reply {
+	bdaddr_t bdaddr;
+} __packed;
+
 #define MGMT_EV_CMD_COMPLETE		0x0001
 struct mgmt_ev_cmd_complete {
 	__le16 opcode;
net/bluetooth/mgmt.c +6 -1
index 4cb2f95..c61b31e 100644
@@ -1429,6 +1429,7 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
 	u16 mgmt_op, hci_op;
 	struct pending_cmd *cmd;
 	struct hci_dev *hdev;
+	struct hci_conn *conn;
 	int err;
 
 	BT_DBG("");

@@ -1452,19 +1453,85 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
 
 	if (!test_bit(HCI_UP, &hdev->flags)) {
 		err = cmd_status(sk, index, mgmt_op, ENETDOWN);
-		goto failed;
+		goto done;
+	}
+
+	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+	if (!conn) {

net/bluetooth/mgmt.c static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data, · line 1470

Quoted 10 lines
net/bluetooth/mgmt.c +10 -0
+		conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
+		if (!conn) {
+			err = cmd_status(sk, index, mgmt_op, ENOTCONN);
+			goto done;
+		}
+
+		/* Forward Confirm response to SMP */
+
+		err = cmd_status(sk, index, mgmt_op, 0);
+		goto done;

user_confirm_reply changes should be in a separate commit. Let's not mix things here.

Quoted 52 lines
net/bluetooth/mgmt.c +40 -1
 	}
 
 	cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
 	if (!cmd) {
 		err = -ENOMEM;
-		goto failed;
+		goto done;
 	}
 
 	err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
 	if (err < 0)
 		mgmt_pending_remove(cmd);
 
+done:
+	hci_dev_unlock_bh(hdev);
+	hci_dev_put(hdev);
+
+	return err;
+}
+
+static int user_passkey_reply(struct sock *sk, u16 index, unsigned char *data,
+							u16 len, int success)
+{
+	struct mgmt_cp_user_passkey_reply *cp = (void *) data;
+	u16 mgmt_op;
+	u32 passkey = 0;
+	struct hci_dev *hdev;
+	struct hci_conn *conn;
+	int expected_len, err = 0;
+
+	BT_DBG("");
+
+	if (success) {
+		mgmt_op = MGMT_OP_USER_PASSKEY_REPLY;
+		expected_len = sizeof(*cp);
+		passkey = le32_to_cpu(cp->passkey);
+	} else {
+		mgmt_op = MGMT_OP_USER_PASSKEY_NEG_REPLY;
+		expected_len = sizeof(struct mgmt_cp_user_passkey_neg_reply);
+	}
+
+	if (len != expected_len)
+		return cmd_status(sk, index, mgmt_op, EINVAL);
+
+	hdev = hci_dev_get(index);
+	if (!hdev)
+		return cmd_status(sk, index, mgmt_op, ENODEV);
+
+	hci_dev_lock_bh(hdev);
+
+	if (!test_bit(HCI_UP, &hdev->flags)) {
+		err = cmd_status(sk, index, mgmt_op, ENETDOWN);

net/bluetooth/mgmt.c static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data, · line 1531

Quoted 10 lines
net/bluetooth/mgmt.c +10 -0
+		goto failed;
+	}
+
+	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
+	if (!conn) {
+		err = cmd_status(sk, index, mgmt_op, ENOTCONN);
+		goto failed;
+	}
+
+	/* Forward Passkey response to SMP */

Passkey reply should work for both BR/EDR and LE, so let's do this a way that it works for both with the same command.

Gustavo

author
#2 lore raw

Hi Gustavo,

Quoted 10 lines · Gustavo Padovan

[...]

user_confirm_reply changes should be in a separate commit. Let's not mix things here.

[...]

Passkey reply should work for both BR/EDR and LE, so let's do this a way that it works for both with the same command.

Patches resubmitted as two patches, with the 2nd supporting both BR/EDR and LE.

Signature · 4 lines
Brian Gix
[email protected]
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum