xref: /btstack/src/ble/sm.c (revision 103fa6b0798d18dcc0df18650d8acb4f9763ceb2)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "sm.c"
39 
40 #include <string.h>
41 #include <inttypes.h>
42 
43 #include "ble/le_device_db.h"
44 #include "ble/core.h"
45 #include "ble/sm.h"
46 #include "bluetooth_company_id.h"
47 #include "btstack_crypto.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_linked_list.h"
51 #include "btstack_memory.h"
52 #include "gap.h"
53 #include "hci.h"
54 #include "hci_dump.h"
55 #include "l2cap.h"
56 
57 #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
58 #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
59 #endif
60 
61 // assert SM Public Key can be sent/received
62 #ifdef ENABLE_LE_SECURE_CONNECTIONS
63 #if HCI_ACL_PAYLOAD_SIZE < 69
64 #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
65 #endif
66 #endif
67 
68 #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
69 #define IS_RESPONDER(role) (role)
70 #else
71 #ifdef ENABLE_LE_CENTRAL
72 // only central - never responder (avoid 'unused variable' warnings)
73 #define IS_RESPONDER(role) (0 && role)
74 #else
75 // only peripheral - always responder (avoid 'unused variable' warnings)
76 #define IS_RESPONDER(role) (1 || role)
77 #endif
78 #endif
79 
80 #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
81 #define USE_CMAC_ENGINE
82 #endif
83 
84 //
85 // SM internal types and globals
86 //
87 
88 typedef enum {
89     DKG_W4_WORKING,
90     DKG_CALC_IRK,
91     DKG_CALC_DHK,
92     DKG_READY
93 } derived_key_generation_t;
94 
95 typedef enum {
96     RAU_IDLE,
97     RAU_GET_RANDOM,
98     RAU_W4_RANDOM,
99     RAU_GET_ENC,
100     RAU_W4_ENC,
101     RAU_SET_ADDRESS,
102 } random_address_update_t;
103 
104 typedef enum {
105     CMAC_IDLE,
106     CMAC_CALC_SUBKEYS,
107     CMAC_W4_SUBKEYS,
108     CMAC_CALC_MI,
109     CMAC_W4_MI,
110     CMAC_CALC_MLAST,
111     CMAC_W4_MLAST
112 } cmac_state_t;
113 
114 typedef enum {
115     JUST_WORKS,
116     PK_RESP_INPUT,       // Initiator displays PK, responder inputs PK
117     PK_INIT_INPUT,       // Responder displays PK, initiator inputs PK
118     PK_BOTH_INPUT,       // Only input on both, both input PK
119     NUMERIC_COMPARISON,  // Only numerical compparison (yes/no) on on both sides
120     OOB                  // OOB available on one (SC) or both sides (legacy)
121 } stk_generation_method_t;
122 
123 typedef enum {
124     SM_USER_RESPONSE_IDLE,
125     SM_USER_RESPONSE_PENDING,
126     SM_USER_RESPONSE_CONFIRM,
127     SM_USER_RESPONSE_PASSKEY,
128     SM_USER_RESPONSE_DECLINE
129 } sm_user_response_t;
130 
131 typedef enum {
132     SM_AES128_IDLE,
133     SM_AES128_ACTIVE
134 } sm_aes128_state_t;
135 
136 typedef enum {
137     ADDRESS_RESOLUTION_IDLE,
138     ADDRESS_RESOLUTION_GENERAL,
139     ADDRESS_RESOLUTION_FOR_CONNECTION,
140 } address_resolution_mode_t;
141 
142 typedef enum {
143     ADDRESS_RESOLUTION_SUCEEDED,
144     ADDRESS_RESOLUTION_FAILED,
145 } address_resolution_event_t;
146 
147 typedef enum {
148     EC_KEY_GENERATION_IDLE,
149     EC_KEY_GENERATION_ACTIVE,
150     EC_KEY_GENERATION_DONE,
151 } ec_key_generation_state_t;
152 
153 typedef enum {
154     SM_STATE_VAR_DHKEY_NEEDED = 1 << 0,
155     SM_STATE_VAR_DHKEY_CALCULATED = 1 << 1,
156     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 2,
157 } sm_state_var_t;
158 
159 typedef enum {
160     SM_SC_OOB_IDLE,
161     SM_SC_OOB_W4_RANDOM,
162     SM_SC_OOB_W2_CALC_CONFIRM,
163     SM_SC_OOB_W4_CONFIRM,
164 } sm_sc_oob_state_t;
165 
166 typedef uint8_t sm_key24_t[3];
167 typedef uint8_t sm_key56_t[7];
168 typedef uint8_t sm_key256_t[32];
169 
170 //
171 // GLOBAL DATA
172 //
173 
174 static uint8_t test_use_fixed_local_csrk;
175 
176 #ifdef ENABLE_TESTING_SUPPORT
177 static uint8_t test_pairing_failure;
178 #endif
179 
180 // configuration
181 static uint8_t sm_accepted_stk_generation_methods;
182 static uint8_t sm_max_encryption_key_size;
183 static uint8_t sm_min_encryption_key_size;
184 static uint8_t sm_auth_req = 0;
185 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
186 static uint8_t sm_slave_request_security;
187 static uint32_t sm_fixed_passkey_in_display_role;
188 static uint8_t sm_reconstruct_ltk_without_le_device_db_entry;
189 
190 #ifdef ENABLE_LE_SECURE_CONNECTIONS
191 static uint8_t sm_sc_oob_random[16];
192 static void (*sm_sc_oob_callback)(const uint8_t * confirm_value, const uint8_t * random_value);
193 static sm_sc_oob_state_t sm_sc_oob_state;
194 #endif
195 
196 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
197 static sm_key_t sm_persistent_er;
198 static sm_key_t sm_persistent_ir;
199 
200 // derived from sm_persistent_ir
201 static sm_key_t sm_persistent_dhk;
202 static sm_key_t sm_persistent_irk;
203 static derived_key_generation_t dkg_state;
204 
205 // derived from sm_persistent_er
206 // ..
207 
208 // random address update
209 static random_address_update_t rau_state;
210 static bd_addr_t sm_random_address;
211 
212 #ifdef USE_CMAC_ENGINE
213 // CMAC Calculation: General
214 static btstack_crypto_aes128_cmac_t sm_cmac_request;
215 static void (*sm_cmac_done_callback)(uint8_t hash[8]);
216 static uint8_t sm_cmac_active;
217 static uint8_t sm_cmac_hash[16];
218 #endif
219 
220 // CMAC for ATT Signed Writes
221 #ifdef ENABLE_LE_SIGNED_WRITE
222 static uint16_t        sm_cmac_signed_write_message_len;
223 static uint8_t         sm_cmac_signed_write_header[3];
224 static const uint8_t * sm_cmac_signed_write_message;
225 static uint8_t         sm_cmac_signed_write_sign_counter[4];
226 #endif
227 
228 // CMAC for Secure Connection functions
229 #ifdef ENABLE_LE_SECURE_CONNECTIONS
230 static sm_connection_t * sm_cmac_connection;
231 static uint8_t           sm_cmac_sc_buffer[80];
232 #endif
233 
234 // resolvable private address lookup / CSRK calculation
235 static int       sm_address_resolution_test;
236 static int       sm_address_resolution_ah_calculation_active;
237 static uint8_t   sm_address_resolution_addr_type;
238 static bd_addr_t sm_address_resolution_address;
239 static void *    sm_address_resolution_context;
240 static address_resolution_mode_t sm_address_resolution_mode;
241 static btstack_linked_list_t sm_address_resolution_general_queue;
242 
243 // aes128 crypto engine.
244 static sm_aes128_state_t  sm_aes128_state;
245 
246 // crypto
247 static btstack_crypto_random_t   sm_crypto_random_request;
248 static btstack_crypto_aes128_t   sm_crypto_aes128_request;
249 #ifdef ENABLE_LE_SECURE_CONNECTIONS
250 static btstack_crypto_ecc_p256_t sm_crypto_ecc_p256_request;
251 static btstack_crypto_random_t   sm_crypto_random_oob_request;
252 #endif
253 
254 // temp storage for random data
255 static uint8_t sm_random_data[8];
256 static uint8_t sm_aes128_key[16];
257 static uint8_t sm_aes128_plaintext[16];
258 static uint8_t sm_aes128_ciphertext[16];
259 
260 // to receive hci events
261 static btstack_packet_callback_registration_t hci_event_callback_registration;
262 
263 /* to dispatch sm event */
264 static btstack_linked_list_t sm_event_handlers;
265 
266 // LE Secure Connections
267 #ifdef ENABLE_LE_SECURE_CONNECTIONS
268 static ec_key_generation_state_t ec_key_generation_state;
269 static uint8_t ec_q[64];
270 #endif
271 
272 //
273 // Volume 3, Part H, Chapter 24
274 // "Security shall be initiated by the Security Manager in the device in the master role.
275 // The device in the slave role shall be the responding device."
276 // -> master := initiator, slave := responder
277 //
278 
279 // data needed for security setup
280 typedef struct sm_setup_context {
281 
282     btstack_timer_source_t sm_timeout;
283 
284     // used in all phases
285     uint8_t   sm_pairing_failed_reason;
286 
287     // user response, (Phase 1 and/or 2)
288     uint8_t   sm_user_response;
289     uint8_t   sm_keypress_notification; // bitmap: passkey started, digit entered, digit erased, passkey cleared, passkey complete, 3 bit count
290 
291     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
292     int       sm_key_distribution_send_set;
293     int       sm_key_distribution_received_set;
294 
295     // Phase 2 (Pairing over SMP)
296     stk_generation_method_t sm_stk_generation_method;
297     sm_key_t  sm_tk;
298     uint8_t   sm_have_oob_data;
299     uint8_t   sm_use_secure_connections;
300 
301     sm_key_t  sm_c1_t3_value;   // c1 calculation
302     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
303     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
304     sm_key_t  sm_local_random;
305     sm_key_t  sm_local_confirm;
306     sm_key_t  sm_peer_random;
307     sm_key_t  sm_peer_confirm;
308     uint8_t   sm_m_addr_type;   // address and type can be removed
309     uint8_t   sm_s_addr_type;   //  ''
310     bd_addr_t sm_m_address;     //  ''
311     bd_addr_t sm_s_address;     //  ''
312     sm_key_t  sm_ltk;
313 
314     uint8_t   sm_state_vars;
315 #ifdef ENABLE_LE_SECURE_CONNECTIONS
316     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
317     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
318     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
319     sm_key_t  sm_dhkey;
320     sm_key_t  sm_peer_dhkey_check;
321     sm_key_t  sm_local_dhkey_check;
322     sm_key_t  sm_ra;
323     sm_key_t  sm_rb;
324     sm_key_t  sm_t;             // used for f5 and h6
325     sm_key_t  sm_mackey;
326     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
327 #endif
328 
329     // Phase 3
330 
331     // key distribution, we generate
332     uint16_t  sm_local_y;
333     uint16_t  sm_local_div;
334     uint16_t  sm_local_ediv;
335     uint8_t   sm_local_rand[8];
336     sm_key_t  sm_local_ltk;
337     sm_key_t  sm_local_csrk;
338     sm_key_t  sm_local_irk;
339     // sm_local_address/addr_type not needed
340 
341     // key distribution, received from peer
342     uint16_t  sm_peer_y;
343     uint16_t  sm_peer_div;
344     uint16_t  sm_peer_ediv;
345     uint8_t   sm_peer_rand[8];
346     sm_key_t  sm_peer_ltk;
347     sm_key_t  sm_peer_irk;
348     sm_key_t  sm_peer_csrk;
349     uint8_t   sm_peer_addr_type;
350     bd_addr_t sm_peer_address;
351 
352 } sm_setup_context_t;
353 
354 //
355 static sm_setup_context_t the_setup;
356 static sm_setup_context_t * setup = &the_setup;
357 
358 // active connection - the one for which the_setup is used for
359 static uint16_t sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
360 
361 // @returns 1 if oob data is available
362 // stores oob data in provided 16 byte buffer if not null
363 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
364 static int (*sm_get_sc_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random);
365 
366 // horizontal: initiator capabilities
367 // vertial:    responder capabilities
368 static const stk_generation_method_t stk_generation_method [5] [5] = {
369     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
370     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
371     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
372     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
373     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
374 };
375 
376 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
377 #ifdef ENABLE_LE_SECURE_CONNECTIONS
378 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
379     { JUST_WORKS,      JUST_WORKS,         PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT      },
380     { JUST_WORKS,      NUMERIC_COMPARISON, PK_INIT_INPUT,   JUST_WORKS,    NUMERIC_COMPARISON },
381     { PK_RESP_INPUT,   PK_RESP_INPUT,      PK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT      },
382     { JUST_WORKS,      JUST_WORKS,         JUST_WORKS,      JUST_WORKS,    JUST_WORKS         },
383     { PK_RESP_INPUT,   NUMERIC_COMPARISON, PK_INIT_INPUT,   JUST_WORKS,    NUMERIC_COMPARISON },
384 };
385 #endif
386 
387 static void sm_run(void);
388 #ifdef USE_CMAC_ENGINE
389 static void sm_cmac_message_start(const sm_key_t key, uint16_t message_len, const uint8_t * message, void (*done_callback)(uint8_t * hash));
390 #endif
391 static void sm_done_for_handle(hci_con_handle_t con_handle);
392 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
393 static inline int sm_calc_actual_encryption_key_size(int other);
394 static int sm_validate_stk_generation_method(void);
395 static void sm_handle_encryption_result_address_resolution(void *arg);
396 static void sm_handle_encryption_result_dkg_dhk(void *arg);
397 static void sm_handle_encryption_result_dkg_irk(void *arg);
398 static void sm_handle_encryption_result_enc_a(void *arg);
399 static void sm_handle_encryption_result_enc_b(void *arg);
400 static void sm_handle_encryption_result_enc_c(void *arg);
401 static void sm_handle_encryption_result_enc_csrk(void *arg);
402 static void sm_handle_encryption_result_enc_d(void * arg);
403 static void sm_handle_encryption_result_enc_ph3_ltk(void *arg);
404 static void sm_handle_encryption_result_enc_ph3_y(void *arg);
405 #ifdef ENABLE_LE_PERIPHERAL
406 static void sm_handle_encryption_result_enc_ph4_ltk(void *arg);
407 static void sm_handle_encryption_result_enc_ph4_y(void *arg);
408 #endif
409 static void sm_handle_encryption_result_enc_stk(void *arg);
410 static void sm_handle_encryption_result_rau(void *arg);
411 static void sm_handle_random_result_ph2_tk(void * arg);
412 static void sm_handle_random_result_rau(void * arg);
413 #ifdef ENABLE_LE_SECURE_CONNECTIONS
414 static void sm_ec_generate_new_key(void);
415 static void sm_handle_random_result_sc_get_random(void * arg);
416 static int sm_passkey_entry(stk_generation_method_t method);
417 #endif
418 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason);
419 
420 static void log_info_hex16(const char * name, uint16_t value){
421     log_info("%-6s 0x%04x", name, value);
422 }
423 
424 // static inline uint8_t sm_pairing_packet_get_code(sm_pairing_packet_t packet){
425 //     return packet[0];
426 // }
427 static inline uint8_t sm_pairing_packet_get_io_capability(sm_pairing_packet_t packet){
428     return packet[1];
429 }
430 static inline uint8_t sm_pairing_packet_get_oob_data_flag(sm_pairing_packet_t packet){
431     return packet[2];
432 }
433 static inline uint8_t sm_pairing_packet_get_auth_req(sm_pairing_packet_t packet){
434     return packet[3];
435 }
436 static inline uint8_t sm_pairing_packet_get_max_encryption_key_size(sm_pairing_packet_t packet){
437     return packet[4];
438 }
439 static inline uint8_t sm_pairing_packet_get_initiator_key_distribution(sm_pairing_packet_t packet){
440     return packet[5];
441 }
442 static inline uint8_t sm_pairing_packet_get_responder_key_distribution(sm_pairing_packet_t packet){
443     return packet[6];
444 }
445 
446 static inline void sm_pairing_packet_set_code(sm_pairing_packet_t packet, uint8_t code){
447     packet[0] = code;
448 }
449 static inline void sm_pairing_packet_set_io_capability(sm_pairing_packet_t packet, uint8_t io_capability){
450     packet[1] = io_capability;
451 }
452 static inline void sm_pairing_packet_set_oob_data_flag(sm_pairing_packet_t packet, uint8_t oob_data_flag){
453     packet[2] = oob_data_flag;
454 }
455 static inline void sm_pairing_packet_set_auth_req(sm_pairing_packet_t packet, uint8_t auth_req){
456     packet[3] = auth_req;
457 }
458 static inline void sm_pairing_packet_set_max_encryption_key_size(sm_pairing_packet_t packet, uint8_t max_encryption_key_size){
459     packet[4] = max_encryption_key_size;
460 }
461 static inline void sm_pairing_packet_set_initiator_key_distribution(sm_pairing_packet_t packet, uint8_t initiator_key_distribution){
462     packet[5] = initiator_key_distribution;
463 }
464 static inline void sm_pairing_packet_set_responder_key_distribution(sm_pairing_packet_t packet, uint8_t responder_key_distribution){
465     packet[6] = responder_key_distribution;
466 }
467 
468 // @returns 1 if all bytes are 0
469 static int sm_is_null(uint8_t * data, int size){
470     int i;
471     for (i=0; i < size ; i++){
472         if (data[i]) return 0;
473     }
474     return 1;
475 }
476 
477 static int sm_is_null_random(uint8_t random[8]){
478     return sm_is_null(random, 8);
479 }
480 
481 static int sm_is_null_key(uint8_t * key){
482     return sm_is_null(key, 16);
483 }
484 
485 // Key utils
486 static void sm_reset_tk(void){
487     int i;
488     for (i=0;i<16;i++){
489         setup->sm_tk[i] = 0;
490     }
491 }
492 
493 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
494 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
495 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
496     int i;
497     for (i = max_encryption_size ; i < 16 ; i++){
498         key[15-i] = 0;
499     }
500 }
501 
502 // SMP Timeout implementation
503 
504 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
505 // the Security Manager Timer shall be reset and started.
506 //
507 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
508 //
509 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
510 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
511 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
512 // established.
513 
514 static void sm_timeout_handler(btstack_timer_source_t * timer){
515     log_info("SM timeout");
516     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
517     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
518     sm_notify_client_status_reason(sm_conn, ERROR_CODE_CONNECTION_TIMEOUT, 0);
519     sm_done_for_handle(sm_conn->sm_handle);
520 
521     // trigger handling of next ready connection
522     sm_run();
523 }
524 static void sm_timeout_start(sm_connection_t * sm_conn){
525     btstack_run_loop_remove_timer(&setup->sm_timeout);
526     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
527     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
528     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
529     btstack_run_loop_add_timer(&setup->sm_timeout);
530 }
531 static void sm_timeout_stop(void){
532     btstack_run_loop_remove_timer(&setup->sm_timeout);
533 }
534 static void sm_timeout_reset(sm_connection_t * sm_conn){
535     sm_timeout_stop();
536     sm_timeout_start(sm_conn);
537 }
538 
539 // end of sm timeout
540 
541 // GAP Random Address updates
542 static gap_random_address_type_t gap_random_adress_type;
543 static btstack_timer_source_t gap_random_address_update_timer;
544 static uint32_t gap_random_adress_update_period;
545 
546 static void gap_random_address_trigger(void){
547     log_info("gap_random_address_trigger");
548     if (rau_state != RAU_IDLE) return;
549     rau_state = RAU_GET_RANDOM;
550     sm_run();
551 }
552 
553 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
554     UNUSED(timer);
555 
556     log_info("GAP Random Address Update due");
557     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
558     btstack_run_loop_add_timer(&gap_random_address_update_timer);
559     gap_random_address_trigger();
560 }
561 
562 static void gap_random_address_update_start(void){
563     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
564     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
565     btstack_run_loop_add_timer(&gap_random_address_update_timer);
566 }
567 
568 static void gap_random_address_update_stop(void){
569     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
570 }
571 
572 // ah(k,r) helper
573 // r = padding || r
574 // r - 24 bit value
575 static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
576     // r'= padding || r
577     memset(r_prime, 0, 16);
578     memcpy(&r_prime[13], r, 3);
579 }
580 
581 // d1 helper
582 // d' = padding || r || d
583 // d,r - 16 bit values
584 static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
585     // d'= padding || r || d
586     memset(d1_prime, 0, 16);
587     big_endian_store_16(d1_prime, 12, r);
588     big_endian_store_16(d1_prime, 14, d);
589 }
590 
591 // dm helper
592 // r’ = padding || r
593 // r - 64 bit value
594 static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
595     memset(r_prime, 0, 16);
596     memcpy(&r_prime[8], r, 8);
597 }
598 
599 // calculate arguments for first AES128 operation in C1 function
600 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
601 
602     // p1 = pres || preq || rat’ || iat’
603     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
604     // cant octet of pres becomes the most significant octet of p1.
605     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
606     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
607     // p1 is 0x05000800000302070710000001010001."
608 
609     sm_key_t p1;
610     reverse_56(pres, &p1[0]);
611     reverse_56(preq, &p1[7]);
612     p1[14] = rat;
613     p1[15] = iat;
614     log_info_key("p1", p1);
615     log_info_key("r", r);
616 
617     // t1 = r xor p1
618     int i;
619     for (i=0;i<16;i++){
620         t1[i] = r[i] ^ p1[i];
621     }
622     log_info_key("t1", t1);
623 }
624 
625 // calculate arguments for second AES128 operation in C1 function
626 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
627      // p2 = padding || ia || ra
628     // "The least significant octet of ra becomes the least significant octet of p2 and
629     // the most significant octet of padding becomes the most significant octet of p2.
630     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
631     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
632 
633     sm_key_t p2;
634     memset(p2, 0, 16);
635     memcpy(&p2[4],  ia, 6);
636     memcpy(&p2[10], ra, 6);
637     log_info_key("p2", p2);
638 
639     // c1 = e(k, t2_xor_p2)
640     int i;
641     for (i=0;i<16;i++){
642         t3[i] = t2[i] ^ p2[i];
643     }
644     log_info_key("t3", t3);
645 }
646 
647 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
648     log_info_key("r1", r1);
649     log_info_key("r2", r2);
650     memcpy(&r_prime[8], &r2[8], 8);
651     memcpy(&r_prime[0], &r1[8], 8);
652 }
653 
654 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
655     UNUSED(channel);
656 
657     // log event
658     hci_dump_packet(packet_type, 1, packet, size);
659     // dispatch to all event handlers
660     btstack_linked_list_iterator_t it;
661     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
662     while (btstack_linked_list_iterator_has_next(&it)){
663         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
664         entry->callback(packet_type, 0, packet, size);
665     }
666 }
667 
668 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
669     event[0] = type;
670     event[1] = event_size - 2;
671     little_endian_store_16(event, 2, con_handle);
672     event[4] = addr_type;
673     reverse_bd_addr(address, &event[5]);
674 }
675 
676 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
677     uint8_t event[11];
678     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
679     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
680 }
681 
682 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
683     uint8_t event[15];
684     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
685     little_endian_store_32(event, 11, passkey);
686     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
687 }
688 
689 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
690     // fetch addr and addr type from db
691     bd_addr_t identity_address;
692     int identity_address_type;
693     le_device_db_info(index, &identity_address_type, identity_address, NULL);
694 
695     uint8_t event[20];
696     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
697     event[11] = identity_address_type;
698     reverse_bd_addr(identity_address, &event[12]);
699     little_endian_store_16(event, 18, index);
700     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
701 }
702 
703 static void sm_notify_client_status(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t status){
704     uint8_t event[12];
705     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
706     event[11] = status;
707     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
708 }
709 
710 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason){
711     uint8_t event[13];
712     sm_setup_event_base(event, sizeof(event), SM_EVENT_PAIRING_COMPLETE, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address);
713     event[11] = status;
714     event[12] = reason;
715     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
716 }
717 
718 // decide on stk generation based on
719 // - pairing request
720 // - io capabilities
721 // - OOB data availability
722 static void sm_setup_tk(void){
723 
724     // default: just works
725     setup->sm_stk_generation_method = JUST_WORKS;
726 
727 #ifdef ENABLE_LE_SECURE_CONNECTIONS
728     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
729                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
730                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
731 #else
732     setup->sm_use_secure_connections = 0;
733 #endif
734     log_info("Secure pairing: %u", setup->sm_use_secure_connections);
735 
736 
737     // decide if OOB will be used based on SC vs. Legacy and oob flags
738     int use_oob = 0;
739     if (setup->sm_use_secure_connections){
740         // In LE Secure Connections pairing, the out of band method is used if at least
741         // one device has the peer device's out of band authentication data available.
742         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) | sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
743     } else {
744         // In LE legacy pairing, the out of band method is used if both the devices have
745         // the other device's out of band authentication data available.
746         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) & sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
747     }
748     if (use_oob){
749         log_info("SM: have OOB data");
750         log_info_key("OOB", setup->sm_tk);
751         setup->sm_stk_generation_method = OOB;
752         return;
753     }
754 
755     // If both devices have not set the MITM option in the Authentication Requirements
756     // Flags, then the IO capabilities shall be ignored and the Just Works association
757     // model shall be used.
758     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
759     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
760         log_info("SM: MITM not required by both -> JUST WORKS");
761         return;
762     }
763 
764     // Reset TK as it has been setup in sm_init_setup
765     sm_reset_tk();
766 
767     // Also use just works if unknown io capabilites
768     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
769         return;
770     }
771 
772     // Otherwise the IO capabilities of the devices shall be used to determine the
773     // pairing method as defined in Table 2.4.
774     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
775     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
776 
777 #ifdef ENABLE_LE_SECURE_CONNECTIONS
778     // table not define by default
779     if (setup->sm_use_secure_connections){
780         generation_method = stk_generation_method_with_secure_connection;
781     }
782 #endif
783     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
784 
785     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
786         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
787 }
788 
789 static int sm_key_distribution_flags_for_set(uint8_t key_set){
790     int flags = 0;
791     if (key_set & SM_KEYDIST_ENC_KEY){
792         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
793         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
794     }
795     if (key_set & SM_KEYDIST_ID_KEY){
796         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
797         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
798     }
799     if (key_set & SM_KEYDIST_SIGN){
800         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
801     }
802     return flags;
803 }
804 
805 static void sm_setup_key_distribution(uint8_t key_set){
806     setup->sm_key_distribution_received_set = 0;
807     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
808 }
809 
810 // CSRK Key Lookup
811 
812 
813 static int sm_address_resolution_idle(void){
814     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
815 }
816 
817 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
818     memcpy(sm_address_resolution_address, addr, 6);
819     sm_address_resolution_addr_type = addr_type;
820     sm_address_resolution_test = 0;
821     sm_address_resolution_mode = mode;
822     sm_address_resolution_context = context;
823     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
824 }
825 
826 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
827     // check if already in list
828     btstack_linked_list_iterator_t it;
829     sm_lookup_entry_t * entry;
830     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
831     while(btstack_linked_list_iterator_has_next(&it)){
832         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
833         if (entry->address_type != address_type) continue;
834         if (memcmp(entry->address, address, 6))  continue;
835         // already in list
836         return BTSTACK_BUSY;
837     }
838     entry = btstack_memory_sm_lookup_entry_get();
839     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
840     entry->address_type = (bd_addr_type_t) address_type;
841     memcpy(entry->address, address, 6);
842     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
843     sm_run();
844     return 0;
845 }
846 
847 // CMAC calculation using AES Engineq
848 #ifdef USE_CMAC_ENGINE
849 
850 static void sm_cmac_done_trampoline(void * arg){
851     UNUSED(arg);
852     sm_cmac_active = 0;
853     (*sm_cmac_done_callback)(sm_cmac_hash);
854     sm_run();
855 }
856 
857 int sm_cmac_ready(void){
858     return sm_cmac_active == 0;
859 }
860 
861 // generic cmac calculation
862 static void sm_cmac_message_start(const sm_key_t key, uint16_t message_len, const uint8_t * message, void (*done_callback)(uint8_t * hash)){
863     sm_cmac_active = 1;
864     sm_cmac_done_callback = done_callback;
865     btstack_crypto_aes128_cmac_message(&sm_cmac_request, key, message_len, message, sm_cmac_hash, sm_cmac_done_trampoline, NULL);
866 }
867 #endif
868 
869 // cmac for ATT Message signing
870 #ifdef ENABLE_LE_SIGNED_WRITE
871 
872 static void sm_cmac_generator_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t * hash)){
873     sm_cmac_active = 1;
874     sm_cmac_done_callback = done_callback;
875     btstack_crypto_aes128_cmac_generator(&sm_cmac_request, key, message_len, get_byte_callback, sm_cmac_hash, sm_cmac_done_trampoline, NULL);
876 }
877 
878 static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
879     if (offset >= sm_cmac_signed_write_message_len) {
880         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_signed_write_message_len);
881         return 0;
882     }
883 
884     offset = sm_cmac_signed_write_message_len - 1 - offset;
885 
886     // sm_cmac_signed_write_header[3] | message[] | sm_cmac_signed_write_sign_counter[4]
887     if (offset < 3){
888         return sm_cmac_signed_write_header[offset];
889     }
890     int actual_message_len_incl_header = sm_cmac_signed_write_message_len - 4;
891     if (offset <  actual_message_len_incl_header){
892         return sm_cmac_signed_write_message[offset - 3];
893     }
894     return sm_cmac_signed_write_sign_counter[offset - actual_message_len_incl_header];
895 }
896 
897 void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
898     // ATT Message Signing
899     sm_cmac_signed_write_header[0] = opcode;
900     little_endian_store_16(sm_cmac_signed_write_header, 1, con_handle);
901     little_endian_store_32(sm_cmac_signed_write_sign_counter, 0, sign_counter);
902     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
903     sm_cmac_signed_write_message     = message;
904     sm_cmac_signed_write_message_len = total_message_len;
905     sm_cmac_generator_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
906 }
907 #endif
908 
909 static void sm_trigger_user_response(sm_connection_t * sm_conn){
910     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
911     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
912     switch (setup->sm_stk_generation_method){
913         case PK_RESP_INPUT:
914             if (IS_RESPONDER(sm_conn->sm_role)){
915                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
916                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
917             } else {
918                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
919             }
920             break;
921         case PK_INIT_INPUT:
922             if (IS_RESPONDER(sm_conn->sm_role)){
923                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
924             } else {
925                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
926                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
927             }
928             break;
929         case PK_BOTH_INPUT:
930             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
931             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
932             break;
933         case NUMERIC_COMPARISON:
934             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
935             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
936             break;
937         case JUST_WORKS:
938             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
939             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
940             break;
941         case OOB:
942             // client already provided OOB data, let's skip notification.
943             break;
944     }
945 }
946 
947 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
948     int recv_flags;
949     if (IS_RESPONDER(sm_conn->sm_role)){
950         // slave / responder
951         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
952     } else {
953         // master / initiator
954         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
955     }
956 
957 #ifdef ENABLE_LE_SECURE_CONNECTIONS
958     // LTK (= encyrption information & master identification) only used exchanged for LE Legacy Connection
959     if (setup->sm_use_secure_connections){
960         recv_flags &= ~(SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION | SM_KEYDIST_FLAG_MASTER_IDENTIFICATION);
961     }
962 #endif
963 
964     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
965     return (setup->sm_key_distribution_received_set & recv_flags) == recv_flags;
966 }
967 
968 static void sm_done_for_handle(hci_con_handle_t con_handle){
969     if (sm_active_connection_handle == con_handle){
970         sm_timeout_stop();
971         sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
972         log_info("sm: connection 0x%x released setup context", con_handle);
973 
974 #ifdef ENABLE_LE_SECURE_CONNECTIONS
975         // generate new ec key after each pairing (that used it)
976         if (setup->sm_use_secure_connections){
977             sm_ec_generate_new_key();
978         }
979 #endif
980     }
981 }
982 
983 static int sm_key_distribution_flags_for_auth_req(void){
984 
985     int flags = SM_KEYDIST_ID_KEY;
986     if (sm_auth_req & SM_AUTHREQ_BONDING){
987         // encryption and signing information only if bonding requested
988         flags |= SM_KEYDIST_ENC_KEY;
989 #ifdef ENABLE_LE_SIGNED_WRITE
990         flags |= SM_KEYDIST_SIGN;
991 #endif
992     }
993     return flags;
994 }
995 
996 static void sm_reset_setup(void){
997     // fill in sm setup
998     setup->sm_state_vars = 0;
999     setup->sm_keypress_notification = 0;
1000     sm_reset_tk();
1001 }
1002 
1003 static void sm_init_setup(sm_connection_t * sm_conn){
1004 
1005     // fill in sm setup
1006     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1007     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1008 
1009     // query client for Legacy Pairing OOB data
1010     setup->sm_have_oob_data = 0;
1011     if (sm_get_oob_data) {
1012         setup->sm_have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1013     }
1014 
1015     // if available and SC supported, also ask for SC OOB Data
1016 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1017     memset(setup->sm_ra, 0, 16);
1018     memset(setup->sm_rb, 0, 16);
1019     if (setup->sm_have_oob_data && (sm_auth_req & SM_AUTHREQ_SECURE_CONNECTION)){
1020         if (sm_get_sc_oob_data){
1021             if (IS_RESPONDER(sm_conn->sm_role)){
1022                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1023                     sm_conn->sm_peer_addr_type,
1024                     sm_conn->sm_peer_address,
1025                     setup->sm_peer_confirm,
1026                     setup->sm_ra);
1027             } else {
1028                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1029                     sm_conn->sm_peer_addr_type,
1030                     sm_conn->sm_peer_address,
1031                     setup->sm_peer_confirm,
1032                     setup->sm_rb);
1033             }
1034         } else {
1035             setup->sm_have_oob_data = 0;
1036         }
1037     }
1038 #endif
1039 
1040     sm_pairing_packet_t * local_packet;
1041     if (IS_RESPONDER(sm_conn->sm_role)){
1042         // slave
1043         local_packet = &setup->sm_s_pres;
1044         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
1045         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1046         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1047     } else {
1048         // master
1049         local_packet = &setup->sm_m_preq;
1050         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
1051         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1052         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1053 
1054         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1055         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1056         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1057     }
1058 
1059     uint8_t auth_req = sm_auth_req;
1060     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1061     sm_pairing_packet_set_oob_data_flag(*local_packet, setup->sm_have_oob_data);
1062     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1063     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1064 }
1065 
1066 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1067 
1068     sm_pairing_packet_t * remote_packet;
1069     int                   remote_key_request;
1070     if (IS_RESPONDER(sm_conn->sm_role)){
1071         // slave / responder
1072         remote_packet      = &setup->sm_m_preq;
1073         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1074     } else {
1075         // master / initiator
1076         remote_packet      = &setup->sm_s_pres;
1077         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1078     }
1079 
1080     // check key size
1081     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1082     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1083 
1084     // decide on STK generation method / SC
1085     sm_setup_tk();
1086     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1087 
1088     // check if STK generation method is acceptable by client
1089     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1090 
1091 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1092     // LTK (= encyrption information & master identification) only used exchanged for LE Legacy Connection
1093     if (setup->sm_use_secure_connections){
1094         remote_key_request &= ~SM_KEYDIST_ENC_KEY;
1095     }
1096 #endif
1097 
1098     // identical to responder
1099     sm_setup_key_distribution(remote_key_request);
1100 
1101     // JUST WORKS doens't provide authentication
1102     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1103 
1104     return 0;
1105 }
1106 
1107 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1108 
1109     // cache and reset context
1110     int matched_device_id = sm_address_resolution_test;
1111     address_resolution_mode_t mode = sm_address_resolution_mode;
1112     void * context = sm_address_resolution_context;
1113 
1114     // reset context
1115     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1116     sm_address_resolution_context = NULL;
1117     sm_address_resolution_test = -1;
1118     hci_con_handle_t con_handle = 0;
1119 
1120     sm_connection_t * sm_connection;
1121 #ifdef ENABLE_LE_CENTRAL
1122     sm_key_t ltk;
1123     int have_ltk;
1124     int pairing_need;
1125 #endif
1126     switch (mode){
1127         case ADDRESS_RESOLUTION_GENERAL:
1128             break;
1129         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1130             sm_connection = (sm_connection_t *) context;
1131             con_handle = sm_connection->sm_handle;
1132             switch (event){
1133                 case ADDRESS_RESOLUTION_SUCEEDED:
1134                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1135                     sm_connection->sm_le_db_index = matched_device_id;
1136                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1137                     if (sm_connection->sm_role) {
1138                         // LTK request received before, IRK required -> start LTK calculation
1139                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1140                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
1141                         }
1142                         break;
1143                     }
1144 #ifdef ENABLE_LE_CENTRAL
1145                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1146                     have_ltk = !sm_is_null_key(ltk);
1147                     pairing_need = sm_connection->sm_pairing_requested || sm_connection->sm_security_request_received;
1148                     log_info("central: pairing request local %u, remote %u => action %u. have_ltk %u",
1149                         sm_connection->sm_pairing_requested, sm_connection->sm_security_request_received, pairing_need, have_ltk);
1150                     // reset requests
1151                     sm_connection->sm_security_request_received = 0;
1152                     sm_connection->sm_pairing_requested = 0;
1153 
1154                     // have ltk -> start encryption
1155                     // Core 5, Vol 3, Part C, 10.3.2 Initiating a Service Request
1156                     // "When a bond has been created between two devices, any reconnection should result in the local device
1157                     //  enabling or requesting encryption with the remote device before initiating any service request."
1158                     if (have_ltk){
1159 #ifdef ENABLE_LE_CENTRAL_AUTO_ENCRYPTION
1160                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1161                         break;
1162 #else
1163                         log_info("central: defer enabling encryption for bonded device");
1164 #endif
1165                     }
1166                     // pairint_request -> send pairing request
1167                     if (pairing_need){
1168                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1169                         break;
1170                     }
1171 #endif
1172                     break;
1173                 case ADDRESS_RESOLUTION_FAILED:
1174                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1175                     if (sm_connection->sm_role) {
1176                         // LTK request received before, IRK required -> negative LTK reply
1177                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1178                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1179                         }
1180                         break;
1181                     }
1182 #ifdef ENABLE_LE_CENTRAL
1183                     if (!sm_connection->sm_pairing_requested && !sm_connection->sm_security_request_received) break;
1184                     sm_connection->sm_security_request_received = 0;
1185                     sm_connection->sm_pairing_requested = 0;
1186                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1187 #endif
1188                     break;
1189             }
1190             break;
1191         default:
1192             break;
1193     }
1194 
1195     switch (event){
1196         case ADDRESS_RESOLUTION_SUCEEDED:
1197             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1198             break;
1199         case ADDRESS_RESOLUTION_FAILED:
1200             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1201             break;
1202     }
1203 }
1204 
1205 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1206 
1207     int le_db_index = -1;
1208 
1209     // only store pairing information if both sides are bondable, i.e., the bonadble flag is set
1210     int bonding_enabed = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
1211                          & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
1212                          & SM_AUTHREQ_BONDING ) != 0;
1213 
1214     if (bonding_enabed){
1215 
1216         // lookup device based on IRK
1217         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1218             int i;
1219             for (i=0; i < le_device_db_max_count(); i++){
1220                 sm_key_t irk;
1221                 bd_addr_t address;
1222                 int address_type = BD_ADDR_TYPE_UNKNOWN;
1223                 le_device_db_info(i, &address_type, address, irk);
1224                 // check if valid entry retrieved
1225                 if (address_type == BD_ADDR_TYPE_UNKNOWN) continue;
1226                 // compare IRK
1227                 if (memcmp(irk, setup->sm_peer_irk, 16) != 0) continue;
1228 
1229                 log_info("sm: device found for IRK, updating");
1230                 le_db_index = i;
1231                 break;
1232             }
1233         } else {
1234             // assert IRK is set to zero
1235             memset(setup->sm_peer_irk, 0, 16);
1236         }
1237 
1238         // if not found, lookup via public address if possible
1239         log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1240         if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1241             int i;
1242             for (i=0; i < le_device_db_max_count(); i++){
1243                 bd_addr_t address;
1244                 int address_type;
1245                 le_device_db_info(i, &address_type, address, NULL);
1246                 log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1247                 if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1248                     log_info("sm: device found for public address, updating");
1249                     le_db_index = i;
1250                     break;
1251                 }
1252             }
1253         }
1254 
1255         // if not found, add to db
1256         if (le_db_index < 0) {
1257             le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1258         }
1259 
1260         if (le_db_index >= 0){
1261 
1262             sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
1263 
1264 #ifdef ENABLE_LE_SIGNED_WRITE
1265             // store local CSRK
1266             if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1267                 log_info("sm: store local CSRK");
1268                 le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1269                 le_device_db_local_counter_set(le_db_index, 0);
1270             }
1271 
1272             // store remote CSRK
1273             if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1274                 log_info("sm: store remote CSRK");
1275                 le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1276                 le_device_db_remote_counter_set(le_db_index, 0);
1277             }
1278 #endif
1279             // store encryption information for secure connections: LTK generated by ECDH
1280             if (setup->sm_use_secure_connections){
1281                 log_info("sm: store SC LTK (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1282                 uint8_t zero_rand[8];
1283                 memset(zero_rand, 0, 8);
1284                 le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
1285                     sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1286             }
1287 
1288             // store encryption information for legacy pairing: peer LTK, EDIV, RAND
1289             else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
1290                    && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1291                 log_info("sm: set encryption information (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1292                 le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1293                     sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1294 
1295             }
1296         }
1297     } else {
1298         log_info("Ignoring received keys, bonding not enabled");
1299     }
1300 
1301     // keep le_db_index
1302     sm_conn->sm_le_db_index = le_db_index;
1303 }
1304 
1305 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1306     setup->sm_pairing_failed_reason = reason;
1307     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1308 }
1309 
1310 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1311     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1312 }
1313 
1314 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1315 
1316 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1317 static int sm_passkey_used(stk_generation_method_t method);
1318 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1319 
1320 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1321     if (sm_passkey_used(setup->sm_stk_generation_method)){
1322         // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1323         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
1324     } else {
1325         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1326     }
1327 }
1328 
1329 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1330     if (IS_RESPONDER(sm_conn->sm_role)){
1331         // Responder
1332         if (setup->sm_stk_generation_method == OOB){
1333             // generate Nb
1334             log_info("Generate Nb");
1335             // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1336             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
1337         } else {
1338             sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1339         }
1340     } else {
1341         // Initiator role
1342         switch (setup->sm_stk_generation_method){
1343             case JUST_WORKS:
1344                 sm_sc_prepare_dhkey_check(sm_conn);
1345                 break;
1346 
1347             case NUMERIC_COMPARISON:
1348                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1349                 break;
1350             case PK_INIT_INPUT:
1351             case PK_RESP_INPUT:
1352             case PK_BOTH_INPUT:
1353                 if (setup->sm_passkey_bit < 20) {
1354                     sm_sc_start_calculating_local_confirm(sm_conn);
1355                 } else {
1356                     sm_sc_prepare_dhkey_check(sm_conn);
1357                 }
1358                 break;
1359             case OOB:
1360                 sm_sc_prepare_dhkey_check(sm_conn);
1361                 break;
1362         }
1363     }
1364 }
1365 
1366 static void sm_sc_cmac_done(uint8_t * hash){
1367     log_info("sm_sc_cmac_done: ");
1368     log_info_hexdump(hash, 16);
1369 
1370     if (sm_sc_oob_state == SM_SC_OOB_W4_CONFIRM){
1371         sm_sc_oob_state = SM_SC_OOB_IDLE;
1372         (*sm_sc_oob_callback)(hash, sm_sc_oob_random);
1373         return;
1374     }
1375 
1376     sm_connection_t * sm_conn = sm_cmac_connection;
1377     sm_cmac_connection = NULL;
1378 #ifdef ENABLE_CLASSIC
1379     link_key_type_t link_key_type;
1380 #endif
1381 
1382     switch (sm_conn->sm_engine_state){
1383         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1384             memcpy(setup->sm_local_confirm, hash, 16);
1385             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1386             break;
1387         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1388             // check
1389             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1390                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1391                 break;
1392             }
1393             sm_sc_state_after_receiving_random(sm_conn);
1394             break;
1395         case SM_SC_W4_CALCULATE_G2: {
1396             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1397             big_endian_store_32(setup->sm_tk, 12, vab);
1398             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1399             sm_trigger_user_response(sm_conn);
1400             break;
1401         }
1402         case SM_SC_W4_CALCULATE_F5_SALT:
1403             memcpy(setup->sm_t, hash, 16);
1404             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1405             break;
1406         case SM_SC_W4_CALCULATE_F5_MACKEY:
1407             memcpy(setup->sm_mackey, hash, 16);
1408             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1409             break;
1410         case SM_SC_W4_CALCULATE_F5_LTK:
1411             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1412             // Errata Service Release to the Bluetooth Specification: ESR09
1413             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1414             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1415             memcpy(setup->sm_ltk, hash, 16);
1416             memcpy(setup->sm_local_ltk, hash, 16);
1417             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1418             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1419             break;
1420         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1421             memcpy(setup->sm_local_dhkey_check, hash, 16);
1422             if (IS_RESPONDER(sm_conn->sm_role)){
1423                 // responder
1424                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1425                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1426                 } else {
1427                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1428                 }
1429             } else {
1430                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1431             }
1432             break;
1433         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1434             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1435                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1436                 break;
1437             }
1438             if (IS_RESPONDER(sm_conn->sm_role)){
1439                 // responder
1440                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1441             } else {
1442                 // initiator
1443                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1444             }
1445             break;
1446         case SM_SC_W4_CALCULATE_H6_ILK:
1447             memcpy(setup->sm_t, hash, 16);
1448             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
1449             break;
1450         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
1451 #ifdef ENABLE_CLASSIC
1452             reverse_128(hash, setup->sm_t);
1453             link_key_type = sm_conn->sm_connection_authenticated ?
1454                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
1455             log_info("Derived classic link key from LE using h6, type %u", (int) link_key_type);
1456             if (IS_RESPONDER(sm_conn->sm_role)){
1457                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
1458             } else {
1459                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
1460             }
1461 #endif
1462             if (IS_RESPONDER(sm_conn->sm_role)){
1463                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
1464             } else {
1465                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
1466             }
1467             sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
1468             sm_done_for_handle(sm_conn->sm_handle);
1469             break;
1470         default:
1471             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1472             break;
1473     }
1474     sm_run();
1475 }
1476 
1477 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1478     const uint16_t message_len = 65;
1479     sm_cmac_connection = sm_conn;
1480     memcpy(sm_cmac_sc_buffer, u, 32);
1481     memcpy(sm_cmac_sc_buffer+32, v, 32);
1482     sm_cmac_sc_buffer[64] = z;
1483     log_info("f4 key");
1484     log_info_hexdump(x, 16);
1485     log_info("f4 message");
1486     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1487     sm_cmac_message_start(x, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1488 }
1489 
1490 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1491 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1492 static const uint8_t f5_length[] = { 0x01, 0x00};
1493 
1494 static void f5_calculate_salt(sm_connection_t * sm_conn){
1495     log_info("f5_calculate_salt");
1496     // calculate salt for f5
1497     const uint16_t message_len = 32;
1498     sm_cmac_connection = sm_conn;
1499     memcpy(sm_cmac_sc_buffer, setup->sm_dhkey, message_len);
1500     sm_cmac_message_start(f5_salt, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1501 }
1502 
1503 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1504     const uint16_t message_len = 53;
1505     sm_cmac_connection = sm_conn;
1506 
1507     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1508     sm_cmac_sc_buffer[0] = 0;
1509     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1510     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1511     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1512     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1513     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1514     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1515     log_info("f5 key");
1516     log_info_hexdump(t, 16);
1517     log_info("f5 message for MacKey");
1518     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1519     sm_cmac_message_start(t, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1520 }
1521 
1522 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1523     sm_key56_t bd_addr_master, bd_addr_slave;
1524     bd_addr_master[0] =  setup->sm_m_addr_type;
1525     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1526     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1527     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1528     if (IS_RESPONDER(sm_conn->sm_role)){
1529         // responder
1530         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1531     } else {
1532         // initiator
1533         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1534     }
1535 }
1536 
1537 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1538 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1539     const uint16_t message_len = 53;
1540     sm_cmac_connection = sm_conn;
1541     sm_cmac_sc_buffer[0] = 1;
1542     // 1..52 setup before
1543     log_info("f5 key");
1544     log_info_hexdump(t, 16);
1545     log_info("f5 message for LTK");
1546     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1547     sm_cmac_message_start(t, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1548 }
1549 
1550 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1551     f5_ltk(sm_conn, setup->sm_t);
1552 }
1553 
1554 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1555     const uint16_t message_len = 65;
1556     sm_cmac_connection = sm_conn;
1557     memcpy(sm_cmac_sc_buffer, n1, 16);
1558     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1559     memcpy(sm_cmac_sc_buffer+32, r, 16);
1560     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1561     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1562     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1563     log_info("f6 key");
1564     log_info_hexdump(w, 16);
1565     log_info("f6 message");
1566     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1567     sm_cmac_message_start(w, 65, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1568 }
1569 
1570 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1571 // - U is 256 bits
1572 // - V is 256 bits
1573 // - X is 128 bits
1574 // - Y is 128 bits
1575 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1576     const uint16_t message_len = 80;
1577     sm_cmac_connection = sm_conn;
1578     memcpy(sm_cmac_sc_buffer, u, 32);
1579     memcpy(sm_cmac_sc_buffer+32, v, 32);
1580     memcpy(sm_cmac_sc_buffer+64, y, 16);
1581     log_info("g2 key");
1582     log_info_hexdump(x, 16);
1583     log_info("g2 message");
1584     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1585     sm_cmac_message_start(x, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1586 }
1587 
1588 static void g2_calculate(sm_connection_t * sm_conn) {
1589     // calc Va if numeric comparison
1590     if (IS_RESPONDER(sm_conn->sm_role)){
1591         // responder
1592         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1593     } else {
1594         // initiator
1595         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1596     }
1597 }
1598 
1599 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1600     uint8_t z = 0;
1601     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1602         // some form of passkey
1603         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1604         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1605         setup->sm_passkey_bit++;
1606     }
1607     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
1608 }
1609 
1610 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1611     // OOB
1612     if (setup->sm_stk_generation_method == OOB){
1613         if (IS_RESPONDER(sm_conn->sm_role)){
1614             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_ra, 0);
1615         } else {
1616             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_rb, 0);
1617         }
1618         return;
1619     }
1620 
1621     uint8_t z = 0;
1622     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1623         // some form of passkey
1624         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1625         // sm_passkey_bit was increased before sending confirm value
1626         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1627     }
1628     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1629 }
1630 
1631 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1632     log_info("sm_sc_prepare_dhkey_check, DHKEY calculated %u", setup->sm_state_vars & SM_STATE_VAR_DHKEY_CALCULATED ? 1 : 0);
1633 
1634     if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_CALCULATED){
1635         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1636         return;
1637     } else {
1638         sm_conn->sm_engine_state = SM_SC_W4_CALCULATE_DHKEY;
1639     }
1640 }
1641 
1642 static void sm_sc_dhkey_calculated(void * arg){
1643     sm_connection_t * sm_conn = (sm_connection_t *) arg;
1644     log_info("dhkey");
1645     log_info_hexdump(&setup->sm_dhkey[0], 32);
1646     setup->sm_state_vars |= SM_STATE_VAR_DHKEY_CALCULATED;
1647     // trigger next step
1648     if (sm_conn->sm_engine_state == SM_SC_W4_CALCULATE_DHKEY){
1649         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1650     }
1651     sm_run();
1652 }
1653 
1654 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1655     // calculate DHKCheck
1656     sm_key56_t bd_addr_master, bd_addr_slave;
1657     bd_addr_master[0] =  setup->sm_m_addr_type;
1658     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1659     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1660     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1661     uint8_t iocap_a[3];
1662     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1663     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1664     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1665     uint8_t iocap_b[3];
1666     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1667     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1668     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1669     if (IS_RESPONDER(sm_conn->sm_role)){
1670         // responder
1671         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1672     } else {
1673         // initiator
1674         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1675     }
1676 }
1677 
1678 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1679     // validate E = f6()
1680     sm_key56_t bd_addr_master, bd_addr_slave;
1681     bd_addr_master[0] =  setup->sm_m_addr_type;
1682     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1683     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1684     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1685 
1686     uint8_t iocap_a[3];
1687     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1688     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1689     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1690     uint8_t iocap_b[3];
1691     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1692     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1693     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1694     if (IS_RESPONDER(sm_conn->sm_role)){
1695         // responder
1696         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1697     } else {
1698         // initiator
1699         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1700     }
1701 }
1702 
1703 
1704 //
1705 // Link Key Conversion Function h6
1706 //
1707 // h6(W, keyID) = AES-CMACW(keyID)
1708 // - W is 128 bits
1709 // - keyID is 32 bits
1710 static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
1711     const uint16_t message_len = 4;
1712     sm_cmac_connection = sm_conn;
1713     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
1714     log_info("h6 key");
1715     log_info_hexdump(w, 16);
1716     log_info("h6 message");
1717     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1718     sm_cmac_message_start(w, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1719 }
1720 
1721 // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1722 // Errata Service Release to the Bluetooth Specification: ESR09
1723 //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1724 //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1725 static void h6_calculate_ilk(sm_connection_t * sm_conn){
1726     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
1727 }
1728 
1729 static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
1730     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
1731 }
1732 
1733 #endif
1734 
1735 // key management legacy connections:
1736 // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1737 // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1738 // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1739 // - responder  reconnects: responder uses LTK receveived from master
1740 
1741 // key management secure connections:
1742 // - both devices store same LTK from ECDH key exchange.
1743 
1744 #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
1745 static void sm_load_security_info(sm_connection_t * sm_connection){
1746     int encryption_key_size;
1747     int authenticated;
1748     int authorized;
1749 
1750     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1751     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1752                                 &encryption_key_size, &authenticated, &authorized);
1753     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1754     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1755     sm_connection->sm_connection_authenticated = authenticated;
1756     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1757 }
1758 #endif
1759 
1760 #ifdef ENABLE_LE_PERIPHERAL
1761 static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
1762     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1763     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1764     // re-establish used key encryption size
1765     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1766     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1767     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1768     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1769     log_info("sm: received ltk request with key size %u, authenticated %u",
1770             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1771     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1772     sm_run();
1773 }
1774 #endif
1775 
1776 static void sm_run(void){
1777 
1778     btstack_linked_list_iterator_t it;
1779 
1780     // assert that stack has already bootet
1781     if (hci_get_state() != HCI_STATE_WORKING) return;
1782 
1783     // assert that we can send at least commands
1784     if (!hci_can_send_command_packet_now()) return;
1785 
1786     //
1787     // non-connection related behaviour
1788     //
1789 
1790     // distributed key generation
1791     switch (dkg_state){
1792         case DKG_CALC_IRK:
1793             // already busy?
1794             if (sm_aes128_state == SM_AES128_IDLE) {
1795                 log_info("DKG_CALC_IRK started");
1796                 // IRK = d1(IR, 1, 0)
1797                 sm_d1_d_prime(1, 0, sm_aes128_plaintext);  // plaintext = d1 prime
1798                 sm_aes128_state = SM_AES128_ACTIVE;
1799                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_ir, sm_aes128_plaintext, sm_persistent_irk, sm_handle_encryption_result_dkg_irk, NULL);
1800                 return;
1801             }
1802             break;
1803         case DKG_CALC_DHK:
1804             // already busy?
1805             if (sm_aes128_state == SM_AES128_IDLE) {
1806                 log_info("DKG_CALC_DHK started");
1807                 // DHK = d1(IR, 3, 0)
1808                 sm_d1_d_prime(3, 0, sm_aes128_plaintext);  // plaintext = d1 prime
1809                 sm_aes128_state = SM_AES128_ACTIVE;
1810                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_ir, sm_aes128_plaintext, sm_persistent_dhk, sm_handle_encryption_result_dkg_dhk, NULL);
1811                 return;
1812             }
1813             break;
1814         default:
1815             break;
1816     }
1817 
1818     // random address updates
1819     switch (rau_state){
1820         case RAU_GET_RANDOM:
1821             rau_state = RAU_W4_RANDOM;
1822             btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_address, 8, &sm_handle_random_result_rau, NULL);
1823             return;
1824         case RAU_GET_ENC:
1825             // already busy?
1826             if (sm_aes128_state == SM_AES128_IDLE) {
1827                 sm_ah_r_prime(sm_random_address, sm_aes128_plaintext);
1828                 sm_aes128_state = SM_AES128_ACTIVE;
1829                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_irk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_rau, NULL);
1830                 return;
1831             }
1832             break;
1833         case RAU_SET_ADDRESS:
1834             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1835             rau_state = RAU_IDLE;
1836             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1837             return;
1838         default:
1839             break;
1840     }
1841 
1842     // CSRK Lookup
1843     // -- if csrk lookup ready, find connection that require csrk lookup
1844     if (sm_address_resolution_idle()){
1845         hci_connections_get_iterator(&it);
1846         while(btstack_linked_list_iterator_has_next(&it)){
1847             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1848             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1849             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1850                 // and start lookup
1851                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1852                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1853                 break;
1854             }
1855         }
1856     }
1857 
1858     // -- if csrk lookup ready, resolved addresses for received addresses
1859     if (sm_address_resolution_idle()) {
1860         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1861             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1862             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1863             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1864             btstack_memory_sm_lookup_entry_free(entry);
1865         }
1866     }
1867 
1868     // -- Continue with CSRK device lookup by public or resolvable private address
1869     if (!sm_address_resolution_idle()){
1870         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_max_count());
1871         while (sm_address_resolution_test < le_device_db_max_count()){
1872             int addr_type;
1873             bd_addr_t addr;
1874             sm_key_t irk;
1875             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1876             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1877 
1878             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1879                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1880                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1881                 break;
1882             }
1883 
1884             if (sm_address_resolution_addr_type == 0){
1885                 sm_address_resolution_test++;
1886                 continue;
1887             }
1888 
1889             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1890 
1891             log_info("LE Device Lookup: calculate AH");
1892             log_info_key("IRK", irk);
1893 
1894             memcpy(sm_aes128_key, irk, 16);
1895             sm_ah_r_prime(sm_address_resolution_address, sm_aes128_plaintext);
1896             sm_address_resolution_ah_calculation_active = 1;
1897             sm_aes128_state = SM_AES128_ACTIVE;
1898             btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_aes128_key, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_address_resolution, NULL);
1899             return;
1900         }
1901 
1902         if (sm_address_resolution_test >= le_device_db_max_count()){
1903             log_info("LE Device Lookup: not found");
1904             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1905         }
1906     }
1907 
1908 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1909     switch (sm_sc_oob_state){
1910         case SM_SC_OOB_W2_CALC_CONFIRM:
1911             if (!sm_cmac_ready()) break;
1912             sm_sc_oob_state = SM_SC_OOB_W4_CONFIRM;
1913             f4_engine(NULL, ec_q, ec_q, sm_sc_oob_random, 0);
1914             return;
1915         default:
1916             break;
1917     }
1918 #endif
1919 
1920     // assert that we can send at least commands - cmd might have been sent by crypto engine
1921     if (!hci_can_send_command_packet_now()) return;
1922 
1923     // handle basic actions that don't requires the full context
1924     hci_connections_get_iterator(&it);
1925     while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
1926         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1927         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1928         switch(sm_connection->sm_engine_state){
1929             // responder side
1930             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
1931                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
1932                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
1933                 return;
1934 
1935 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1936             case SM_SC_RECEIVED_LTK_REQUEST:
1937                 switch (sm_connection->sm_irk_lookup_state){
1938                     case IRK_LOOKUP_FAILED:
1939                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
1940                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
1941                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
1942                         return;
1943                     default:
1944                         break;
1945                 }
1946                 break;
1947 #endif
1948             default:
1949                 break;
1950         }
1951     }
1952 
1953     //
1954     // active connection handling
1955     // -- use loop to handle next connection if lock on setup context is released
1956 
1957     while (1) {
1958 
1959         // Find connections that requires setup context and make active if no other is locked
1960         hci_connections_get_iterator(&it);
1961         while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
1962             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1963             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1964             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1965             int done = 1;
1966             int err;
1967             UNUSED(err);
1968 
1969 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1970             // assert ec key is ready
1971             if (sm_connection->sm_engine_state == SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED
1972             ||  sm_connection->sm_engine_state == SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST){
1973                 if (ec_key_generation_state == EC_KEY_GENERATION_IDLE){
1974                     sm_ec_generate_new_key();
1975                 }
1976                 if (ec_key_generation_state != EC_KEY_GENERATION_DONE){
1977                     continue;
1978                 }
1979            }
1980 #endif
1981 
1982             switch (sm_connection->sm_engine_state) {
1983 #ifdef ENABLE_LE_PERIPHERAL
1984                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1985                     // send packet if possible,
1986                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1987                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1988                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1989                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1990                     } else {
1991                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1992                     }
1993                     // don't lock sxetup context yet
1994                     done = 0;
1995                     break;
1996                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1997                     sm_reset_setup();
1998                     sm_init_setup(sm_connection);
1999                     // recover pairing request
2000                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
2001                     err = sm_stk_generation_init(sm_connection);
2002 
2003 #ifdef ENABLE_TESTING_SUPPORT
2004                     if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
2005                         log_info("testing_support: respond with pairing failure %u", test_pairing_failure);
2006                         err = test_pairing_failure;
2007                     }
2008 #endif
2009                     if (err){
2010                         setup->sm_pairing_failed_reason = err;
2011                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2012                         break;
2013                     }
2014                     sm_timeout_start(sm_connection);
2015                     // generate random number first, if we need to show passkey
2016                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
2017                         btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph2_tk, sm_connection);
2018                         break;
2019                     }
2020                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2021                     break;
2022                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
2023                     sm_reset_setup();
2024                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
2025                     break;
2026 
2027 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2028                 case SM_SC_RECEIVED_LTK_REQUEST:
2029                     switch (sm_connection->sm_irk_lookup_state){
2030                         case IRK_LOOKUP_SUCCEEDED:
2031                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
2032                             // start using context by loading security info
2033                             sm_reset_setup();
2034                             sm_load_security_info(sm_connection);
2035                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
2036                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
2037                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2038                                 break;
2039                             }
2040                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
2041                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2042                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2043                             // don't lock setup context yet
2044                             return;
2045                         default:
2046                             // just wait until IRK lookup is completed
2047                             // don't lock setup context yet
2048                             done = 0;
2049                             break;
2050                     }
2051                     break;
2052 #endif /* ENABLE_LE_SECURE_CONNECTIONS */
2053 #endif /* ENABLE_LE_PERIPHERAL */
2054 
2055 #ifdef ENABLE_LE_CENTRAL
2056                 case SM_INITIATOR_PH0_HAS_LTK:
2057                     sm_reset_setup();
2058                     sm_load_security_info(sm_connection);
2059                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
2060                     break;
2061                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
2062                     sm_reset_setup();
2063                     sm_init_setup(sm_connection);
2064                     sm_timeout_start(sm_connection);
2065                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
2066                     break;
2067 #endif
2068 
2069                 default:
2070                     done = 0;
2071                     break;
2072             }
2073             if (done){
2074                 sm_active_connection_handle = sm_connection->sm_handle;
2075                 log_info("sm: connection 0x%04x locked setup context as %s, state %u", sm_active_connection_handle, sm_connection->sm_role ? "responder" : "initiator", sm_connection->sm_engine_state);
2076             }
2077         }
2078 
2079         //
2080         // active connection handling
2081         //
2082 
2083         if (sm_active_connection_handle == HCI_CON_HANDLE_INVALID) return;
2084 
2085         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection_handle);
2086         if (!connection) {
2087             log_info("no connection for handle 0x%04x", sm_active_connection_handle);
2088             return;
2089         }
2090 
2091         // assert that we could send a SM PDU - not needed for all of the following
2092         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2093             log_info("cannot send now, requesting can send now event");
2094             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2095             return;
2096         }
2097 
2098         // send keypress notifications
2099         if (setup->sm_keypress_notification){
2100             int i;
2101             uint8_t flags       = setup->sm_keypress_notification & 0x1f;
2102             uint8_t num_actions = setup->sm_keypress_notification >> 5;
2103             uint8_t action = 0;
2104             for (i=SM_KEYPRESS_PASSKEY_ENTRY_STARTED;i<=SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED;i++){
2105                 if (flags & (1<<i)){
2106                     int clear_flag = 1;
2107                     switch (i){
2108                         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
2109                         case SM_KEYPRESS_PASSKEY_CLEARED:
2110                         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
2111                         default:
2112                             break;
2113                         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
2114                         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
2115                             num_actions--;
2116                             clear_flag = num_actions == 0;
2117                             break;
2118                     }
2119                     if (clear_flag){
2120                         flags &= ~(1<<i);
2121                     }
2122                     action = i;
2123                     break;
2124                 }
2125             }
2126             setup->sm_keypress_notification = (num_actions << 5) | flags;
2127 
2128             // send keypress notification
2129             uint8_t buffer[2];
2130             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
2131             buffer[1] = action;
2132             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2133 
2134             // try
2135             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2136             return;
2137         }
2138 
2139         int key_distribution_flags;
2140         UNUSED(key_distribution_flags);
2141 
2142         log_info("sm_run: state %u", connection->sm_engine_state);
2143         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2144             log_info("sm_run // cannot send");
2145         }
2146         switch (connection->sm_engine_state){
2147 
2148             // general
2149             case SM_GENERAL_SEND_PAIRING_FAILED: {
2150                 uint8_t buffer[2];
2151                 buffer[0] = SM_CODE_PAIRING_FAILED;
2152                 buffer[1] = setup->sm_pairing_failed_reason;
2153                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2154                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2155                 sm_notify_client_status_reason(connection, ERROR_CODE_AUTHENTICATION_FAILURE, setup->sm_pairing_failed_reason);
2156                 sm_done_for_handle(connection->sm_handle);
2157                 break;
2158             }
2159 
2160             // responding state
2161 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2162             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2163                 if (!sm_cmac_ready()) break;
2164                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2165                 sm_sc_calculate_local_confirm(connection);
2166                 break;
2167             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2168                 if (!sm_cmac_ready()) break;
2169                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2170                 sm_sc_calculate_remote_confirm(connection);
2171                 break;
2172             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2173                 if (!sm_cmac_ready()) break;
2174                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2175                 sm_sc_calculate_f6_for_dhkey_check(connection);
2176                 break;
2177             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2178                 if (!sm_cmac_ready()) break;
2179                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
2180                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
2181                 break;
2182             case SM_SC_W2_CALCULATE_F5_SALT:
2183                 if (!sm_cmac_ready()) break;
2184                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2185                 f5_calculate_salt(connection);
2186                 break;
2187             case SM_SC_W2_CALCULATE_F5_MACKEY:
2188                 if (!sm_cmac_ready()) break;
2189                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2190                 f5_calculate_mackey(connection);
2191                 break;
2192             case SM_SC_W2_CALCULATE_F5_LTK:
2193                 if (!sm_cmac_ready()) break;
2194                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2195                 f5_calculate_ltk(connection);
2196                 break;
2197             case SM_SC_W2_CALCULATE_G2:
2198                 if (!sm_cmac_ready()) break;
2199                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2200                 g2_calculate(connection);
2201                 break;
2202             case SM_SC_W2_CALCULATE_H6_ILK:
2203                 if (!sm_cmac_ready()) break;
2204                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
2205                 h6_calculate_ilk(connection);
2206                 break;
2207             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
2208                 if (!sm_cmac_ready()) break;
2209                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
2210                 h6_calculate_br_edr_link_key(connection);
2211                 break;
2212 #endif
2213 
2214 #ifdef ENABLE_LE_CENTRAL
2215             // initiator side
2216             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2217                 sm_key_t peer_ltk_flipped;
2218                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2219                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2220                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2221                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2222                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2223                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2224                 return;
2225             }
2226 
2227             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2228                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2229                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2230                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2231                 sm_timeout_reset(connection);
2232                 break;
2233 #endif
2234 
2235 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2236 
2237             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2238                 int trigger_user_response = 0;
2239 
2240                 uint8_t buffer[65];
2241                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2242                 //
2243                 reverse_256(&ec_q[0],  &buffer[1]);
2244                 reverse_256(&ec_q[32], &buffer[33]);
2245 
2246 #ifdef ENABLE_TESTING_SUPPORT
2247                 if (test_pairing_failure == SM_REASON_DHKEY_CHECK_FAILED){
2248                     log_info("testing_support: invalidating public key");
2249                     // flip single bit of public key coordinate
2250                     buffer[1] ^= 1;
2251                 }
2252 #endif
2253 
2254                 // stk generation method
2255                 // passkey entry: notify app to show passkey or to request passkey
2256                 switch (setup->sm_stk_generation_method){
2257                     case JUST_WORKS:
2258                     case NUMERIC_COMPARISON:
2259                         if (IS_RESPONDER(connection->sm_role)){
2260                             // responder
2261                             sm_sc_start_calculating_local_confirm(connection);
2262                         } else {
2263                             // initiator
2264                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2265                         }
2266                         break;
2267                     case PK_INIT_INPUT:
2268                     case PK_RESP_INPUT:
2269                     case PK_BOTH_INPUT:
2270                         // use random TK for display
2271                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2272                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2273                         setup->sm_passkey_bit = 0;
2274 
2275                         if (IS_RESPONDER(connection->sm_role)){
2276                             // responder
2277                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2278                         } else {
2279                             // initiator
2280                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2281                         }
2282                         trigger_user_response = 1;
2283                         break;
2284                     case OOB:
2285                         if (IS_RESPONDER(connection->sm_role)){
2286                             // responder
2287                             connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2288                         } else {
2289                             // initiator
2290                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2291                         }
2292                         break;
2293                 }
2294 
2295                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2296                 sm_timeout_reset(connection);
2297 
2298                 // trigger user response after sending pdu
2299                 if (trigger_user_response){
2300                     sm_trigger_user_response(connection);
2301                 }
2302                 break;
2303             }
2304             case SM_SC_SEND_CONFIRMATION: {
2305                 uint8_t buffer[17];
2306                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2307                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2308                 if (IS_RESPONDER(connection->sm_role)){
2309                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2310                 } else {
2311                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2312                 }
2313                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2314                 sm_timeout_reset(connection);
2315                 break;
2316             }
2317             case SM_SC_SEND_PAIRING_RANDOM: {
2318                 uint8_t buffer[17];
2319                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2320                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2321                 log_info("stk method %u, num bits %u", setup->sm_stk_generation_method, setup->sm_passkey_bit);
2322                 if (sm_passkey_entry(setup->sm_stk_generation_method) && setup->sm_passkey_bit < 20){
2323                     log_info("SM_SC_SEND_PAIRING_RANDOM A");
2324                     if (IS_RESPONDER(connection->sm_role)){
2325                         // responder
2326                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2327                     } else {
2328                         // initiator
2329                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2330                     }
2331                 } else {
2332                     log_info("SM_SC_SEND_PAIRING_RANDOM B");
2333                     if (IS_RESPONDER(connection->sm_role)){
2334                         // responder
2335                         if (setup->sm_stk_generation_method == NUMERIC_COMPARISON){
2336                             log_info("SM_SC_SEND_PAIRING_RANDOM B1");
2337                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2338                         } else {
2339                             log_info("SM_SC_SEND_PAIRING_RANDOM B2");
2340                             sm_sc_prepare_dhkey_check(connection);
2341                         }
2342                     } else {
2343                         // initiator
2344                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2345                     }
2346                 }
2347                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2348                 sm_timeout_reset(connection);
2349                 break;
2350             }
2351             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2352                 uint8_t buffer[17];
2353                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2354                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2355 
2356                 if (IS_RESPONDER(connection->sm_role)){
2357                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2358                 } else {
2359                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2360                 }
2361 
2362                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2363                 sm_timeout_reset(connection);
2364                 break;
2365             }
2366 
2367 #endif
2368 
2369 #ifdef ENABLE_LE_PERIPHERAL
2370             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2371                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2372 
2373                 // start with initiator key dist flags
2374                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2375 
2376 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2377                 // LTK (= encyrption information & master identification) only exchanged for LE Legacy Connection
2378                 if (setup->sm_use_secure_connections){
2379                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2380                 }
2381 #endif
2382                 // setup in response
2383                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2384                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2385 
2386                 // update key distribution after ENC was dropped
2387                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2388 
2389                 if (setup->sm_use_secure_connections){
2390                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2391                 } else {
2392                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2393                 }
2394 
2395                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2396                 sm_timeout_reset(connection);
2397                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2398                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
2399                     sm_trigger_user_response(connection);
2400                 }
2401                 return;
2402 #endif
2403 
2404             case SM_PH2_SEND_PAIRING_RANDOM: {
2405                 uint8_t buffer[17];
2406                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2407                 reverse_128(setup->sm_local_random, &buffer[1]);
2408                 if (IS_RESPONDER(connection->sm_role)){
2409                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2410                 } else {
2411                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2412                 }
2413                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2414                 sm_timeout_reset(connection);
2415                 break;
2416             }
2417 
2418             case SM_PH2_C1_GET_ENC_A:
2419                 // already busy?
2420                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2421                 // calculate confirm using aes128 engine - step 1
2422                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, sm_aes128_plaintext);
2423                 connection->sm_engine_state = SM_PH2_C1_W4_ENC_A;
2424                 sm_aes128_state = SM_AES128_ACTIVE;
2425                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_a, connection);
2426                 break;
2427 
2428             case SM_PH2_C1_GET_ENC_C:
2429                 // already busy?
2430                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2431                 // calculate m_confirm using aes128 engine - step 1
2432                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, sm_aes128_plaintext);
2433                 connection->sm_engine_state = SM_PH2_C1_W4_ENC_C;
2434                 sm_aes128_state = SM_AES128_ACTIVE;
2435                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_c, connection);
2436                 break;
2437 
2438             case SM_PH2_CALC_STK:
2439                 // already busy?
2440                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2441                 // calculate STK
2442                 if (IS_RESPONDER(connection->sm_role)){
2443                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, sm_aes128_plaintext);
2444                 } else {
2445                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, sm_aes128_plaintext);
2446                 }
2447                 connection->sm_engine_state = SM_PH2_W4_STK;
2448                 sm_aes128_state = SM_AES128_ACTIVE;
2449                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_stk, connection);
2450                 break;
2451 
2452             case SM_PH3_Y_GET_ENC:
2453                 // already busy?
2454                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2455                 // PH3B2 - calculate Y from      - enc
2456                 // Y = dm(DHK, Rand)
2457                 sm_dm_r_prime(setup->sm_local_rand, sm_aes128_plaintext);
2458                 connection->sm_engine_state = SM_PH3_Y_W4_ENC;
2459                 sm_aes128_state = SM_AES128_ACTIVE;
2460                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_dhk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_ph3_y, connection);
2461                 break;
2462 
2463             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2464                 uint8_t buffer[17];
2465                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2466                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2467                 if (IS_RESPONDER(connection->sm_role)){
2468                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2469                 } else {
2470                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2471                 }
2472                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2473                 sm_timeout_reset(connection);
2474                 return;
2475             }
2476 #ifdef ENABLE_LE_PERIPHERAL
2477             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2478                 sm_key_t stk_flipped;
2479                 reverse_128(setup->sm_ltk, stk_flipped);
2480                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2481                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2482                 return;
2483             }
2484             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
2485                 sm_key_t ltk_flipped;
2486                 reverse_128(setup->sm_ltk, ltk_flipped);
2487                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2488                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2489                 sm_done_for_handle(connection->sm_handle);
2490                 return;
2491             }
2492             case SM_RESPONDER_PH4_Y_GET_ENC:
2493                 // already busy?
2494                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2495                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2496                 // Y = dm(DHK, Rand)
2497                 sm_dm_r_prime(setup->sm_local_rand, sm_aes128_plaintext);
2498                 connection->sm_engine_state = SM_RESPONDER_PH4_Y_W4_ENC;
2499                 sm_aes128_state = SM_AES128_ACTIVE;
2500                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_dhk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_ph4_y, connection);
2501                 return;
2502 #endif
2503 #ifdef ENABLE_LE_CENTRAL
2504             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2505                 sm_key_t stk_flipped;
2506                 reverse_128(setup->sm_ltk, stk_flipped);
2507                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2508                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2509                 return;
2510             }
2511 #endif
2512 
2513             case SM_PH3_DISTRIBUTE_KEYS:
2514                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2515                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2516                     uint8_t buffer[17];
2517                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2518                     reverse_128(setup->sm_ltk, &buffer[1]);
2519                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2520                     sm_timeout_reset(connection);
2521                     return;
2522                 }
2523                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2524                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2525                     uint8_t buffer[11];
2526                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2527                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2528                     reverse_64(setup->sm_local_rand, &buffer[3]);
2529                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2530                     sm_timeout_reset(connection);
2531                     return;
2532                 }
2533                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2534                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2535                     uint8_t buffer[17];
2536                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2537                     reverse_128(sm_persistent_irk, &buffer[1]);
2538                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2539                     sm_timeout_reset(connection);
2540                     return;
2541                 }
2542                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2543                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2544                     bd_addr_t local_address;
2545                     uint8_t buffer[8];
2546                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2547                     switch (gap_random_address_get_mode()){
2548                         case GAP_RANDOM_ADDRESS_TYPE_OFF:
2549                         case GAP_RANDOM_ADDRESS_TYPE_STATIC:
2550                             // public or static random
2551                             gap_le_get_own_address(&buffer[1], local_address);
2552                             break;
2553                         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2554                         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2555                             // fallback to public
2556                             gap_local_bd_addr(local_address);
2557                             buffer[1] = 0;
2558                             break;
2559                     }
2560                     reverse_bd_addr(local_address, &buffer[2]);
2561                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2562                     sm_timeout_reset(connection);
2563                     return;
2564                 }
2565                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2566                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2567 
2568                     // hack to reproduce test runs
2569                     if (test_use_fixed_local_csrk){
2570                         memset(setup->sm_local_csrk, 0xcc, 16);
2571                     }
2572 
2573                     uint8_t buffer[17];
2574                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2575                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2576                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2577                     sm_timeout_reset(connection);
2578                     return;
2579                 }
2580 
2581                 // keys are sent
2582                 if (IS_RESPONDER(connection->sm_role)){
2583                     // slave -> receive master keys if any
2584                     if (sm_key_distribution_all_received(connection)){
2585                         sm_key_distribution_handle_all_received(connection);
2586                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2587                         sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2588                         sm_done_for_handle(connection->sm_handle);
2589                     } else {
2590                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2591                     }
2592                 } else {
2593                     // master -> all done
2594                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2595                     sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2596                     sm_done_for_handle(connection->sm_handle);
2597                 }
2598                 break;
2599 
2600             default:
2601                 break;
2602         }
2603 
2604         // check again if active connection was released
2605         if (sm_active_connection_handle != HCI_CON_HANDLE_INVALID) break;
2606     }
2607 }
2608 
2609 // sm_aes128_state stays active
2610 static void sm_handle_encryption_result_enc_a(void *arg){
2611     sm_connection_t * connection = (sm_connection_t*) arg;
2612     sm_c1_t3(sm_aes128_ciphertext, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2613     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, setup->sm_c1_t3_value, setup->sm_local_confirm, sm_handle_encryption_result_enc_b, connection);
2614 }
2615 
2616 static void sm_handle_encryption_result_enc_b(void *arg){
2617     sm_connection_t * connection = (sm_connection_t*) arg;
2618     sm_aes128_state = SM_AES128_IDLE;
2619     log_info_key("c1!", setup->sm_local_confirm);
2620     connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2621     sm_run();
2622 }
2623 
2624 // sm_aes128_state stays active
2625 static void sm_handle_encryption_result_enc_c(void *arg){
2626     sm_connection_t * connection = (sm_connection_t*) arg;
2627     sm_c1_t3(sm_aes128_ciphertext, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2628     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, setup->sm_c1_t3_value, sm_aes128_ciphertext, sm_handle_encryption_result_enc_d, connection);
2629 }
2630 
2631 static void sm_handle_encryption_result_enc_d(void * arg){
2632     sm_connection_t * connection = (sm_connection_t*) arg;
2633     sm_aes128_state = SM_AES128_IDLE;
2634     log_info_key("c1!", sm_aes128_ciphertext);
2635     if (memcmp(setup->sm_peer_confirm, sm_aes128_ciphertext, 16) != 0){
2636         setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2637         connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2638         sm_run();
2639         return;
2640     }
2641     if (IS_RESPONDER(connection->sm_role)){
2642         connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2643         sm_run();
2644     } else {
2645         sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, sm_aes128_plaintext);
2646         sm_aes128_state = SM_AES128_ACTIVE;
2647         btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_stk, connection);
2648     }
2649 }
2650 
2651 static void sm_handle_encryption_result_enc_stk(void *arg){
2652     sm_connection_t * connection = (sm_connection_t*) arg;
2653     sm_aes128_state = SM_AES128_IDLE;
2654     sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2655     log_info_key("stk", setup->sm_ltk);
2656     if (IS_RESPONDER(connection->sm_role)){
2657         connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2658     } else {
2659         connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2660     }
2661     sm_run();
2662 }
2663 
2664 // sm_aes128_state stays active
2665 static void sm_handle_encryption_result_enc_ph3_y(void *arg){
2666     sm_connection_t * connection = (sm_connection_t*) arg;
2667     setup->sm_local_y = big_endian_read_16(sm_aes128_ciphertext, 14);
2668     log_info_hex16("y", setup->sm_local_y);
2669     // PH3B3 - calculate EDIV
2670     setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2671     log_info_hex16("ediv", setup->sm_local_ediv);
2672     // PH3B4 - calculate LTK         - enc
2673     // LTK = d1(ER, DIV, 0))
2674     sm_d1_d_prime(setup->sm_local_div, 0, sm_aes128_plaintext);
2675     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_ph3_ltk, connection);
2676 }
2677 
2678 #ifdef ENABLE_LE_PERIPHERAL
2679 // sm_aes128_state stays active
2680 static void sm_handle_encryption_result_enc_ph4_y(void *arg){
2681     sm_connection_t * connection = (sm_connection_t*) arg;
2682     setup->sm_local_y = big_endian_read_16(sm_aes128_ciphertext, 14);
2683     log_info_hex16("y", setup->sm_local_y);
2684 
2685     // PH3B3 - calculate DIV
2686     setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2687     log_info_hex16("ediv", setup->sm_local_ediv);
2688     // PH3B4 - calculate LTK         - enc
2689     // LTK = d1(ER, DIV, 0))
2690     sm_d1_d_prime(setup->sm_local_div, 0, sm_aes128_plaintext);
2691     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_ph4_ltk, connection);
2692 }
2693 #endif
2694 
2695 // sm_aes128_state stays active
2696 static void sm_handle_encryption_result_enc_ph3_ltk(void *arg){
2697     sm_connection_t * connection = (sm_connection_t*) arg;
2698     log_info_key("ltk", setup->sm_ltk);
2699     // calc CSRK next
2700     sm_d1_d_prime(setup->sm_local_div, 1, sm_aes128_plaintext);
2701     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_local_csrk, sm_handle_encryption_result_enc_csrk, connection);
2702 }
2703 
2704 static void sm_handle_encryption_result_enc_csrk(void *arg){
2705     sm_connection_t * connection = (sm_connection_t*) arg;
2706     sm_aes128_state = SM_AES128_IDLE;
2707     log_info_key("csrk", setup->sm_local_csrk);
2708     if (setup->sm_key_distribution_send_set){
2709         connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2710     } else {
2711         // no keys to send, just continue
2712         if (IS_RESPONDER(connection->sm_role)){
2713             // slave -> receive master keys
2714             connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2715         } else {
2716             if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
2717                 connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
2718             } else {
2719                 // master -> all done
2720                 connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2721                 sm_done_for_handle(connection->sm_handle);
2722             }
2723         }
2724     }
2725     sm_run();
2726 }
2727 
2728 #ifdef ENABLE_LE_PERIPHERAL
2729 static void sm_handle_encryption_result_enc_ph4_ltk(void *arg){
2730     sm_connection_t * connection = (sm_connection_t*) arg;
2731     sm_aes128_state = SM_AES128_IDLE;
2732     sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2733     log_info_key("ltk", setup->sm_ltk);
2734     connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2735     sm_run();
2736 }
2737 #endif
2738 
2739 static void sm_handle_encryption_result_address_resolution(void *arg){
2740     UNUSED(arg);
2741     sm_aes128_state = SM_AES128_IDLE;
2742     sm_address_resolution_ah_calculation_active = 0;
2743     // compare calulated address against connecting device
2744     uint8_t * hash = &sm_aes128_ciphertext[13];
2745     if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2746         log_info("LE Device Lookup: matched resolvable private address");
2747         sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2748         sm_run();
2749         return;
2750     }
2751     // no match, try next
2752     sm_address_resolution_test++;
2753     sm_run();
2754 }
2755 
2756 static void sm_handle_encryption_result_dkg_irk(void *arg){
2757     UNUSED(arg);
2758     sm_aes128_state = SM_AES128_IDLE;
2759     log_info_key("irk", sm_persistent_irk);
2760     dkg_state = DKG_CALC_DHK;
2761     sm_run();
2762 }
2763 
2764 static void sm_handle_encryption_result_dkg_dhk(void *arg){
2765     UNUSED(arg);
2766     sm_aes128_state = SM_AES128_IDLE;
2767     log_info_key("dhk", sm_persistent_dhk);
2768     dkg_state = DKG_READY;
2769     // DKG calculation complete => SM Init Finished
2770     sm_run();
2771 }
2772 
2773 static void sm_handle_encryption_result_rau(void *arg){
2774     UNUSED(arg);
2775     sm_aes128_state = SM_AES128_IDLE;
2776     memcpy(&sm_random_address[3], &sm_aes128_ciphertext[13], 3);
2777     rau_state = RAU_SET_ADDRESS;
2778     sm_run();
2779 }
2780 
2781 static void sm_handle_random_result_rau(void * arg){
2782     UNUSED(arg);
2783     // non-resolvable vs. resolvable
2784     switch (gap_random_adress_type){
2785         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2786             // resolvable: use random as prand and calc address hash
2787             // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2788             sm_random_address[0] &= 0x3f;
2789             sm_random_address[0] |= 0x40;
2790             rau_state = RAU_GET_ENC;
2791             break;
2792         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2793         default:
2794             // "The two most significant bits of the address shall be equal to ‘0’""
2795             sm_random_address[0] &= 0x3f;
2796             rau_state = RAU_SET_ADDRESS;
2797             break;
2798     }
2799     sm_run();
2800 }
2801 
2802 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2803 static void sm_handle_random_result_sc_get_random(void * arg){
2804     sm_connection_t * connection = (sm_connection_t*) arg;
2805 
2806     // OOB
2807     if (setup->sm_stk_generation_method == OOB){
2808         connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2809         sm_run();
2810         return;
2811     }
2812 
2813     // initiator & jw/nc -> send pairing random
2814     if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2815         connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2816     } else {
2817         connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2818     }
2819     sm_run();
2820 }
2821 #endif
2822 
2823 static void sm_handle_random_result_ph2_random(void * arg){
2824     sm_connection_t * connection = (sm_connection_t*) arg;
2825     connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2826     sm_run();
2827 }
2828 
2829 static void sm_handle_random_result_ph2_tk(void * arg){
2830     sm_connection_t * connection = (sm_connection_t*) arg;
2831     sm_reset_tk();
2832     uint32_t tk;
2833     if (sm_fixed_passkey_in_display_role == 0xffffffff){
2834         // map random to 0-999999 without speding much cycles on a modulus operation
2835         tk = little_endian_read_32(sm_random_data,0);
2836         tk = tk & 0xfffff;  // 1048575
2837         if (tk >= 999999){
2838             tk = tk - 999999;
2839         }
2840     } else {
2841         // override with pre-defined passkey
2842         tk = sm_fixed_passkey_in_display_role;
2843     }
2844     big_endian_store_32(setup->sm_tk, 12, tk);
2845     if (IS_RESPONDER(connection->sm_role)){
2846         connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2847     } else {
2848         if (setup->sm_use_secure_connections){
2849             connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
2850         } else {
2851             connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2852             sm_trigger_user_response(connection);
2853             // response_idle == nothing <--> sm_trigger_user_response() did not require response
2854             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2855                 btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, connection);
2856             }
2857         }
2858     }
2859     sm_run();
2860 }
2861 
2862 static void sm_handle_random_result_ph3_div(void * arg){
2863     sm_connection_t * connection = (sm_connection_t*) arg;
2864     // use 16 bit from random value as div
2865     setup->sm_local_div = big_endian_read_16(sm_random_data, 0);
2866     log_info_hex16("div", setup->sm_local_div);
2867     connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2868     sm_run();
2869 }
2870 
2871 static void sm_handle_random_result_ph3_random(void * arg){
2872     sm_connection_t * connection = (sm_connection_t*) arg;
2873     reverse_64(sm_random_data, setup->sm_local_rand);
2874     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2875     setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2876     // no db for authenticated flag hack: store flag in bit 4 of LSB
2877     setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2878     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 2, &sm_handle_random_result_ph3_div, connection);
2879 }
2880 
2881 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2882 
2883     UNUSED(channel);    // ok: there is no channel
2884     UNUSED(size);       // ok: fixed format HCI events
2885 
2886     sm_connection_t  * sm_conn;
2887     hci_con_handle_t con_handle;
2888 
2889     switch (packet_type) {
2890 
2891 		case HCI_EVENT_PACKET:
2892 			switch (hci_event_packet_get_type(packet)) {
2893 
2894                 case BTSTACK_EVENT_STATE:
2895 					// bt stack activated, get started
2896 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2897                         log_info("HCI Working!");
2898 					}
2899 					break;
2900 
2901                 case HCI_EVENT_LE_META:
2902                     switch (packet[2]) {
2903                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2904 
2905                             log_info("sm: connected");
2906 
2907                             if (packet[3]) return; // connection failed
2908 
2909                             con_handle = little_endian_read_16(packet, 4);
2910                             sm_conn = sm_get_connection_for_handle(con_handle);
2911                             if (!sm_conn) break;
2912 
2913                             sm_conn->sm_handle = con_handle;
2914                             sm_conn->sm_role = packet[6];
2915                             sm_conn->sm_peer_addr_type = packet[7];
2916                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
2917 
2918                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2919 
2920                             // reset security properties
2921                             sm_conn->sm_connection_encrypted = 0;
2922                             sm_conn->sm_connection_authenticated = 0;
2923                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2924                             sm_conn->sm_le_db_index = -1;
2925 
2926                             // prepare CSRK lookup (does not involve setup)
2927                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2928 
2929                             // just connected -> everything else happens in sm_run()
2930                             if (IS_RESPONDER(sm_conn->sm_role)){
2931                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2932                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2933                                     if (sm_slave_request_security) {
2934                                         // request security if requested by app
2935                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2936                                     } else {
2937                                         // otherwise, wait for pairing request
2938                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2939                                     }
2940                                 }
2941                                 break;
2942                             } else {
2943                                 // master
2944                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2945                             }
2946                             break;
2947 
2948                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2949                             con_handle = little_endian_read_16(packet, 3);
2950                             sm_conn = sm_get_connection_for_handle(con_handle);
2951                             if (!sm_conn) break;
2952 
2953                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2954                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2955                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2956                                 break;
2957                             }
2958                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2959                                 // PH2 SEND LTK as we need to exchange keys in PH3
2960                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2961                                 break;
2962                             }
2963 
2964                             // store rand and ediv
2965                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2966                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
2967 
2968                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
2969                             // potentially stored LTK is from the master
2970                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
2971                                 if (sm_reconstruct_ltk_without_le_device_db_entry){
2972                                     sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
2973                                     break;
2974                                 }
2975                                 // additionally check if remote is in LE Device DB if requested
2976                                 switch(sm_conn->sm_irk_lookup_state){
2977                                     case IRK_LOOKUP_FAILED:
2978                                         log_info("LTK Request: device not in device db");
2979                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2980                                         break;
2981                                     case IRK_LOOKUP_SUCCEEDED:
2982                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
2983                                         break;
2984                                     default:
2985                                         // wait for irk look doen
2986                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK;
2987                                         break;
2988                                 }
2989                                 break;
2990                             }
2991 
2992 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2993                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
2994 #else
2995                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
2996                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2997 #endif
2998                             break;
2999 
3000                         default:
3001                             break;
3002                     }
3003                     break;
3004 
3005                 case HCI_EVENT_ENCRYPTION_CHANGE:
3006                     con_handle = little_endian_read_16(packet, 3);
3007                     sm_conn = sm_get_connection_for_handle(con_handle);
3008                     if (!sm_conn) break;
3009 
3010                     sm_conn->sm_connection_encrypted = packet[5];
3011                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
3012                         sm_conn->sm_actual_encryption_key_size);
3013                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3014 
3015                     // encryption change event concludes re-encryption for bonded devices (even if it fails)
3016                     if (sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED){
3017                         sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3018                         // notify client, if pairing was requested before
3019                         if (sm_conn->sm_pairing_requested){
3020                             sm_conn->sm_pairing_requested = 0;
3021                             if (sm_conn->sm_connection_encrypted){
3022                                 sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
3023                             } else {
3024                                 sm_notify_client_status_reason(sm_conn, ERROR_CODE_AUTHENTICATION_FAILURE, 0);
3025                             }
3026                         }
3027                         sm_done_for_handle(sm_conn->sm_handle);
3028                         break;
3029                     }
3030 
3031                     if (!sm_conn->sm_connection_encrypted) break;
3032 
3033                     // continue pairing
3034                     switch (sm_conn->sm_engine_state){
3035                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3036                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3037                             sm_done_for_handle(sm_conn->sm_handle);
3038                             break;
3039                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3040                             if (IS_RESPONDER(sm_conn->sm_role)){
3041                                 // slave
3042                                 if (setup->sm_use_secure_connections){
3043                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3044                                 } else {
3045                                     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3046                                 }
3047                             } else {
3048                                 // master
3049                                 if (sm_key_distribution_all_received(sm_conn)){
3050                                     // skip receiving keys as there are none
3051                                     sm_key_distribution_handle_all_received(sm_conn);
3052                                     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3053                                 } else {
3054                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3055                                 }
3056                             }
3057                             break;
3058                         default:
3059                             break;
3060                     }
3061                     break;
3062 
3063                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
3064                     con_handle = little_endian_read_16(packet, 3);
3065                     sm_conn = sm_get_connection_for_handle(con_handle);
3066                     if (!sm_conn) break;
3067 
3068                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
3069                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3070                     // continue if part of initial pairing
3071                     switch (sm_conn->sm_engine_state){
3072                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3073                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3074                             sm_done_for_handle(sm_conn->sm_handle);
3075                             break;
3076                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3077                             if (IS_RESPONDER(sm_conn->sm_role)){
3078                                 // slave
3079                                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3080                             } else {
3081                                 // master
3082                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3083                             }
3084                             break;
3085                         default:
3086                             break;
3087                     }
3088                     break;
3089 
3090 
3091                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3092                     con_handle = little_endian_read_16(packet, 3);
3093                     sm_done_for_handle(con_handle);
3094                     sm_conn = sm_get_connection_for_handle(con_handle);
3095                     if (!sm_conn) break;
3096 
3097                     // delete stored bonding on disconnect with authentication failure in ph0
3098                     if (sm_conn->sm_role == 0
3099                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
3100                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
3101                         le_device_db_remove(sm_conn->sm_le_db_index);
3102                     }
3103 
3104                     // pairing failed, if it was ongoing
3105                     if (sm_conn->sm_engine_state != SM_INITIATOR_CONNECTED && sm_conn->sm_engine_state != SM_GENERAL_IDLE){
3106                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION, 0);
3107                     }
3108 
3109                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
3110                     sm_conn->sm_handle = 0;
3111                     break;
3112 
3113 				case HCI_EVENT_COMMAND_COMPLETE:
3114                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
3115                         // set local addr for le device db
3116                         bd_addr_t addr;
3117                         reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
3118                         le_device_db_set_local_bd_addr(addr);
3119                     }
3120                     break;
3121                 default:
3122                     break;
3123 			}
3124             break;
3125         default:
3126             break;
3127 	}
3128 
3129     sm_run();
3130 }
3131 
3132 static inline int sm_calc_actual_encryption_key_size(int other){
3133     if (other < sm_min_encryption_key_size) return 0;
3134     if (other < sm_max_encryption_key_size) return other;
3135     return sm_max_encryption_key_size;
3136 }
3137 
3138 
3139 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3140 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3141     switch (method){
3142         case JUST_WORKS:
3143         case NUMERIC_COMPARISON:
3144             return 1;
3145         default:
3146             return 0;
3147     }
3148 }
3149 // responder
3150 
3151 static int sm_passkey_used(stk_generation_method_t method){
3152     switch (method){
3153         case PK_RESP_INPUT:
3154             return 1;
3155         default:
3156             return 0;
3157     }
3158 }
3159 
3160 static int sm_passkey_entry(stk_generation_method_t method){
3161     switch (method){
3162         case PK_RESP_INPUT:
3163         case PK_INIT_INPUT:
3164         case PK_BOTH_INPUT:
3165             return 1;
3166         default:
3167             return 0;
3168     }
3169 }
3170 
3171 #endif
3172 
3173 /**
3174  * @return ok
3175  */
3176 static int sm_validate_stk_generation_method(void){
3177     // check if STK generation method is acceptable by client
3178     switch (setup->sm_stk_generation_method){
3179         case JUST_WORKS:
3180             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
3181         case PK_RESP_INPUT:
3182         case PK_INIT_INPUT:
3183         case PK_BOTH_INPUT:
3184             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
3185         case OOB:
3186             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3187         case NUMERIC_COMPARISON:
3188             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3189         default:
3190             return 0;
3191     }
3192 }
3193 
3194 // size of complete sm_pdu used to validate input
3195 static const uint8_t sm_pdu_size[] = {
3196     0,  // 0x00 invalid opcode
3197     7,  // 0x01 pairing request
3198     7,  // 0x02 pairing response
3199     17, // 0x03 pairing confirm
3200     17, // 0x04 pairing random
3201     2,  // 0x05 pairing failed
3202     17, // 0x06 encryption information
3203     11, // 0x07 master identification
3204     17, // 0x08 identification information
3205     8,  // 0x09 identify address information
3206     17, // 0x0a signing information
3207     2,  // 0x0b security request
3208     65, // 0x0c pairing public key
3209     17, // 0x0d pairing dhk check
3210     2,  // 0x0e keypress notification
3211 };
3212 
3213 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
3214 
3215     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3216         sm_run();
3217     }
3218 
3219     if (packet_type != SM_DATA_PACKET) return;
3220     if (size == 0) return;
3221 
3222     uint8_t sm_pdu_code = packet[0];
3223 
3224     // validate pdu size
3225     if (sm_pdu_code >= sizeof(sm_pdu_size)) return;
3226     if (sm_pdu_size[sm_pdu_code] != size)   return;
3227 
3228     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3229     if (!sm_conn) return;
3230 
3231     if (sm_pdu_code == SM_CODE_PAIRING_FAILED){
3232         sm_notify_client_status_reason(sm_conn, ERROR_CODE_AUTHENTICATION_FAILURE, packet[1]);
3233         sm_done_for_handle(con_handle);
3234         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
3235         return;
3236     }
3237 
3238     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, sm_pdu_code);
3239 
3240     int err;
3241     UNUSED(err);
3242 
3243     if (sm_pdu_code == SM_CODE_KEYPRESS_NOTIFICATION){
3244         uint8_t buffer[5];
3245         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
3246         buffer[1] = 3;
3247         little_endian_store_16(buffer, 2, con_handle);
3248         buffer[4] = packet[1];
3249         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
3250         return;
3251     }
3252 
3253     switch (sm_conn->sm_engine_state){
3254 
3255         // a sm timeout requries a new physical connection
3256         case SM_GENERAL_TIMEOUT:
3257             return;
3258 
3259 #ifdef ENABLE_LE_CENTRAL
3260 
3261         // Initiator
3262         case SM_INITIATOR_CONNECTED:
3263             if ((sm_pdu_code != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3264                 sm_pdu_received_in_wrong_state(sm_conn);
3265                 break;
3266             }
3267 
3268             // IRK complete?
3269             switch (sm_conn->sm_irk_lookup_state){
3270                 case IRK_LOOKUP_FAILED:
3271                 case IRK_LOOKUP_SUCCEEDED:
3272                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3273                     break;
3274                 default:
3275                     break;
3276             }
3277 
3278             // otherwise, store security request
3279             sm_conn->sm_security_request_received = 1;
3280             break;
3281 
3282         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3283             // Core 5, Vol 3, Part H, 2.4.6:
3284             // "The master shall ignore the slave’s Security Request if the master has sent a Pairing Request
3285             //  without receiving a Pairing Response from the slave or if the master has initiated encryption mode setup."
3286             if (sm_pdu_code == SM_CODE_SECURITY_REQUEST){
3287                 log_info("Ignoring Security Request");
3288                 break;
3289             }
3290 
3291             // all other pdus are incorrect
3292             if (sm_pdu_code != SM_CODE_PAIRING_RESPONSE){
3293                 sm_pdu_received_in_wrong_state(sm_conn);
3294                 break;
3295             }
3296 
3297             // store pairing request
3298             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3299             err = sm_stk_generation_init(sm_conn);
3300 
3301 #ifdef ENABLE_TESTING_SUPPORT
3302             if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
3303                 log_info("testing_support: abort with pairing failure %u", test_pairing_failure);
3304                 err = test_pairing_failure;
3305             }
3306 #endif
3307 
3308             if (err){
3309                 setup->sm_pairing_failed_reason = err;
3310                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3311                 break;
3312             }
3313 
3314             // generate random number first, if we need to show passkey
3315             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3316                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph2_tk, sm_conn);
3317                 break;
3318             }
3319 
3320 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3321             if (setup->sm_use_secure_connections){
3322                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3323                 if (setup->sm_stk_generation_method == JUST_WORKS){
3324                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3325                     sm_trigger_user_response(sm_conn);
3326                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3327                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3328                     }
3329                 } else {
3330                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3331                 }
3332                 break;
3333             }
3334 #endif
3335             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3336             sm_trigger_user_response(sm_conn);
3337             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3338             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3339                 btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3340             }
3341             break;
3342 
3343         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3344             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3345                 sm_pdu_received_in_wrong_state(sm_conn);
3346                 break;
3347             }
3348 
3349             // store s_confirm
3350             reverse_128(&packet[1], setup->sm_peer_confirm);
3351 
3352 #ifdef ENABLE_TESTING_SUPPORT
3353             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3354                 log_info("testing_support: reset confirm value");
3355                 memset(setup->sm_peer_confirm, 0, 16);
3356             }
3357 #endif
3358             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3359             break;
3360 
3361         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3362             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3363                 sm_pdu_received_in_wrong_state(sm_conn);
3364                 break;;
3365             }
3366 
3367             // received random value
3368             reverse_128(&packet[1], setup->sm_peer_random);
3369             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3370             break;
3371 #endif
3372 
3373 #ifdef ENABLE_LE_PERIPHERAL
3374         // Responder
3375         case SM_RESPONDER_IDLE:
3376         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3377         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3378             if (sm_pdu_code != SM_CODE_PAIRING_REQUEST){
3379                 sm_pdu_received_in_wrong_state(sm_conn);
3380                 break;;
3381             }
3382 
3383             // store pairing request
3384             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3385             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3386             break;
3387 #endif
3388 
3389 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3390         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3391             if (sm_pdu_code != SM_CODE_PAIRING_PUBLIC_KEY){
3392                 sm_pdu_received_in_wrong_state(sm_conn);
3393                 break;
3394             }
3395 
3396             // store public key for DH Key calculation
3397             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3398             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3399 
3400             // validate public key
3401             err = btstack_crypto_ecc_p256_validate_public_key(setup->sm_peer_q);
3402             if (err){
3403                 log_error("sm: peer public key invalid %x", err);
3404                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
3405                 break;
3406             }
3407 
3408             // start calculating dhkey
3409             btstack_crypto_ecc_p256_calculate_dhkey(&sm_crypto_ecc_p256_request, setup->sm_peer_q, setup->sm_dhkey, sm_sc_dhkey_calculated, sm_conn);
3410 
3411 
3412             log_info("public key received, generation method %u", setup->sm_stk_generation_method);
3413             if (IS_RESPONDER(sm_conn->sm_role)){
3414                 // responder
3415                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3416             } else {
3417                 // initiator
3418                 // stk generation method
3419                 // passkey entry: notify app to show passkey or to request passkey
3420                 switch (setup->sm_stk_generation_method){
3421                     case JUST_WORKS:
3422                     case NUMERIC_COMPARISON:
3423                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3424                         break;
3425                     case PK_RESP_INPUT:
3426                         sm_sc_start_calculating_local_confirm(sm_conn);
3427                         break;
3428                     case PK_INIT_INPUT:
3429                     case PK_BOTH_INPUT:
3430                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3431                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3432                             break;
3433                         }
3434                         sm_sc_start_calculating_local_confirm(sm_conn);
3435                         break;
3436                     case OOB:
3437                         // generate Nx
3438                         log_info("Generate Na");
3439                         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
3440                         break;
3441                 }
3442             }
3443             break;
3444 
3445         case SM_SC_W4_CONFIRMATION:
3446             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3447                 sm_pdu_received_in_wrong_state(sm_conn);
3448                 break;
3449             }
3450             // received confirm value
3451             reverse_128(&packet[1], setup->sm_peer_confirm);
3452 
3453 #ifdef ENABLE_TESTING_SUPPORT
3454             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3455                 log_info("testing_support: reset confirm value");
3456                 memset(setup->sm_peer_confirm, 0, 16);
3457             }
3458 #endif
3459             if (IS_RESPONDER(sm_conn->sm_role)){
3460                 // responder
3461                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3462                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3463                         // still waiting for passkey
3464                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3465                         break;
3466                     }
3467                 }
3468                 sm_sc_start_calculating_local_confirm(sm_conn);
3469             } else {
3470                 // initiator
3471                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3472                     // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3473                     btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
3474                 } else {
3475                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3476                 }
3477             }
3478             break;
3479 
3480         case SM_SC_W4_PAIRING_RANDOM:
3481             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3482                 sm_pdu_received_in_wrong_state(sm_conn);
3483                 break;
3484             }
3485 
3486             // received random value
3487             reverse_128(&packet[1], setup->sm_peer_nonce);
3488 
3489             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3490             // only check for JUST WORK/NC in initiator role OR passkey entry
3491             if ( (!IS_RESPONDER(sm_conn->sm_role) && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method))
3492             ||   (sm_passkey_used(setup->sm_stk_generation_method)) ) {
3493                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3494                  break;
3495             }
3496 
3497             // OOB
3498             if (setup->sm_stk_generation_method == OOB){
3499 
3500                 // setup local random, set to zero if remote did not receive our data
3501                 log_info("Received nonce, setup local random ra/rb for dhkey check");
3502                 if (IS_RESPONDER(sm_conn->sm_role)){
3503                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) == 0){
3504                         log_info("Reset rb as A does not have OOB data");
3505                         memset(setup->sm_rb, 0, 16);
3506                     } else {
3507                         memcpy(setup->sm_rb, sm_sc_oob_random, 16);
3508                         log_info("Use stored rb");
3509                         log_info_hexdump(setup->sm_rb, 16);
3510                     }
3511                 }  else {
3512                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres) == 0){
3513                         log_info("Reset ra as B does not have OOB data");
3514                         memset(setup->sm_ra, 0, 16);
3515                     } else {
3516                         memcpy(setup->sm_ra, sm_sc_oob_random, 16);
3517                         log_info("Use stored ra");
3518                         log_info_hexdump(setup->sm_ra, 16);
3519                     }
3520                 }
3521 
3522                 // validate confirm value if Cb = f4(PKb, Pkb, rb, 0) for OOB if data received
3523                 if (setup->sm_have_oob_data){
3524                      sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3525                      break;
3526                 }
3527             }
3528 
3529             // TODO: we only get here for Responder role with JW/NC
3530             sm_sc_state_after_receiving_random(sm_conn);
3531             break;
3532 
3533         case SM_SC_W2_CALCULATE_G2:
3534         case SM_SC_W4_CALCULATE_G2:
3535         case SM_SC_W4_CALCULATE_DHKEY:
3536         case SM_SC_W2_CALCULATE_F5_SALT:
3537         case SM_SC_W4_CALCULATE_F5_SALT:
3538         case SM_SC_W2_CALCULATE_F5_MACKEY:
3539         case SM_SC_W4_CALCULATE_F5_MACKEY:
3540         case SM_SC_W2_CALCULATE_F5_LTK:
3541         case SM_SC_W4_CALCULATE_F5_LTK:
3542         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3543         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3544         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3545             if (sm_pdu_code != SM_CODE_PAIRING_DHKEY_CHECK){
3546                 sm_pdu_received_in_wrong_state(sm_conn);
3547                 break;
3548             }
3549             // store DHKey Check
3550             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3551             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3552 
3553             // have we been only waiting for dhkey check command?
3554             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3555                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3556             }
3557             break;
3558 #endif
3559 
3560 #ifdef ENABLE_LE_PERIPHERAL
3561         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3562             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3563                 sm_pdu_received_in_wrong_state(sm_conn);
3564                 break;
3565             }
3566 
3567             // received confirm value
3568             reverse_128(&packet[1], setup->sm_peer_confirm);
3569 
3570 #ifdef ENABLE_TESTING_SUPPORT
3571             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3572                 log_info("testing_support: reset confirm value");
3573                 memset(setup->sm_peer_confirm, 0, 16);
3574             }
3575 #endif
3576             // notify client to hide shown passkey
3577             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3578                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3579             }
3580 
3581             // handle user cancel pairing?
3582             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3583                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEY_ENTRY_FAILED;
3584                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3585                 break;
3586             }
3587 
3588             // wait for user action?
3589             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3590                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3591                 break;
3592             }
3593 
3594             // calculate and send local_confirm
3595             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3596             break;
3597 
3598         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3599             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3600                 sm_pdu_received_in_wrong_state(sm_conn);
3601                 break;;
3602             }
3603 
3604             // received random value
3605             reverse_128(&packet[1], setup->sm_peer_random);
3606             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3607             break;
3608 #endif
3609 
3610         case SM_PH3_RECEIVE_KEYS:
3611             switch(sm_pdu_code){
3612                 case SM_CODE_ENCRYPTION_INFORMATION:
3613                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3614                     reverse_128(&packet[1], setup->sm_peer_ltk);
3615                     break;
3616 
3617                 case SM_CODE_MASTER_IDENTIFICATION:
3618                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3619                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3620                     reverse_64(&packet[3], setup->sm_peer_rand);
3621                     break;
3622 
3623                 case SM_CODE_IDENTITY_INFORMATION:
3624                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3625                     reverse_128(&packet[1], setup->sm_peer_irk);
3626                     break;
3627 
3628                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3629                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3630                     setup->sm_peer_addr_type = packet[1];
3631                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3632                     break;
3633 
3634                 case SM_CODE_SIGNING_INFORMATION:
3635                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3636                     reverse_128(&packet[1], setup->sm_peer_csrk);
3637                     break;
3638                 default:
3639                     // Unexpected PDU
3640                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3641                     break;
3642             }
3643             // done with key distribution?
3644             if (sm_key_distribution_all_received(sm_conn)){
3645 
3646                 sm_key_distribution_handle_all_received(sm_conn);
3647 
3648                 if (IS_RESPONDER(sm_conn->sm_role)){
3649                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
3650                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
3651                     } else {
3652                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3653                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
3654                         sm_done_for_handle(sm_conn->sm_handle);
3655                     }
3656                 } else {
3657                     if (setup->sm_use_secure_connections){
3658                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3659                     } else {
3660                         btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3661                     }
3662                 }
3663             }
3664             break;
3665         default:
3666             // Unexpected PDU
3667             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3668             break;
3669     }
3670 
3671     // try to send preparared packet
3672     sm_run();
3673 }
3674 
3675 // Security Manager Client API
3676 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_data)){
3677     sm_get_oob_data = get_oob_data_callback;
3678 }
3679 
3680 void sm_register_sc_oob_data_callback( int (*get_sc_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random)){
3681     sm_get_sc_oob_data = get_sc_oob_data_callback;
3682 }
3683 
3684 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3685     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3686 }
3687 
3688 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3689     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3690 }
3691 
3692 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3693 	sm_min_encryption_key_size = min_size;
3694 	sm_max_encryption_key_size = max_size;
3695 }
3696 
3697 void sm_set_authentication_requirements(uint8_t auth_req){
3698 #ifndef ENABLE_LE_SECURE_CONNECTIONS
3699     if (auth_req & SM_AUTHREQ_SECURE_CONNECTION){
3700         log_error("ENABLE_LE_SECURE_CONNECTIONS not defined, but requested by app. Dropping SC flag");
3701         auth_req &= ~SM_AUTHREQ_SECURE_CONNECTION;
3702     }
3703 #endif
3704     sm_auth_req = auth_req;
3705 }
3706 
3707 void sm_set_io_capabilities(io_capability_t io_capability){
3708     sm_io_capabilities = io_capability;
3709 }
3710 
3711 #ifdef ENABLE_LE_PERIPHERAL
3712 void sm_set_request_security(int enable){
3713     sm_slave_request_security = enable;
3714 }
3715 #endif
3716 
3717 void sm_set_er(sm_key_t er){
3718     memcpy(sm_persistent_er, er, 16);
3719 }
3720 
3721 void sm_set_ir(sm_key_t ir){
3722     memcpy(sm_persistent_ir, ir, 16);
3723 }
3724 
3725 // Testing support only
3726 void sm_test_set_irk(sm_key_t irk){
3727     memcpy(sm_persistent_irk, irk, 16);
3728     dkg_state = DKG_CALC_DHK;
3729 }
3730 
3731 void sm_test_use_fixed_local_csrk(void){
3732     test_use_fixed_local_csrk = 1;
3733 }
3734 
3735 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3736 static void sm_ec_generated(void * arg){
3737     UNUSED(arg);
3738     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3739     // trigger pairing if pending for ec key
3740     sm_run();
3741 }
3742 static void sm_ec_generate_new_key(void){
3743     log_info("sm: generate new ec key");
3744     ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
3745     btstack_crypto_ecc_p256_generate_key(&sm_crypto_ecc_p256_request, ec_q, &sm_ec_generated, NULL);
3746 }
3747 #endif
3748 
3749 #ifdef ENABLE_TESTING_SUPPORT
3750 void sm_test_set_pairing_failure(int reason){
3751     test_pairing_failure = reason;
3752 }
3753 #endif
3754 
3755 void sm_init(void){
3756     // set some (BTstack default) ER and IR
3757     int i;
3758     sm_key_t er;
3759     sm_key_t ir;
3760     for (i=0;i<16;i++){
3761         er[i] = 0x30 + i;
3762         ir[i] = 0x90 + i;
3763     }
3764     sm_set_er(er);
3765     sm_set_ir(ir);
3766     // defaults
3767     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3768                                        | SM_STK_GENERATION_METHOD_OOB
3769                                        | SM_STK_GENERATION_METHOD_PASSKEY
3770                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3771 
3772     sm_max_encryption_key_size = 16;
3773     sm_min_encryption_key_size = 7;
3774 
3775     sm_fixed_passkey_in_display_role = 0xffffffff;
3776     sm_reconstruct_ltk_without_le_device_db_entry = 1;
3777 
3778 #ifdef USE_CMAC_ENGINE
3779     sm_cmac_active  = 0;
3780 #endif
3781     dkg_state = DKG_CALC_IRK;
3782     rau_state = RAU_IDLE;
3783     sm_aes128_state = SM_AES128_IDLE;
3784     sm_address_resolution_test = -1;    // no private address to resolve yet
3785     sm_address_resolution_ah_calculation_active = 0;
3786     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3787     sm_address_resolution_general_queue = NULL;
3788 
3789     gap_random_adress_update_period = 15 * 60 * 1000L;
3790     sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
3791 
3792     test_use_fixed_local_csrk = 0;
3793 
3794     // register for HCI Events from HCI
3795     hci_event_callback_registration.callback = &sm_event_packet_handler;
3796     hci_add_event_handler(&hci_event_callback_registration);
3797 
3798     //
3799     btstack_crypto_init();
3800 
3801     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3802     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3803 
3804 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3805     sm_ec_generate_new_key();
3806 #endif
3807 }
3808 
3809 void sm_use_fixed_passkey_in_display_role(uint32_t passkey){
3810     sm_fixed_passkey_in_display_role = passkey;
3811 }
3812 
3813 void sm_allow_ltk_reconstruction_without_le_device_db_entry(int allow){
3814     sm_reconstruct_ltk_without_le_device_db_entry = allow;
3815 }
3816 
3817 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3818     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3819     if (!hci_con) return NULL;
3820     return &hci_con->sm_connection;
3821 }
3822 
3823 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3824     switch (sm_conn->sm_engine_state){
3825         case SM_GENERAL_IDLE:
3826         case SM_RESPONDER_IDLE:
3827             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3828             sm_run();
3829             break;
3830         default:
3831             break;
3832     }
3833 }
3834 
3835 /**
3836  * @brief Trigger Security Request
3837  */
3838 void sm_send_security_request(hci_con_handle_t con_handle){
3839     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3840     if (!sm_conn) return;
3841     sm_send_security_request_for_connection(sm_conn);
3842 }
3843 
3844 // request pairing
3845 void sm_request_pairing(hci_con_handle_t con_handle){
3846     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3847     if (!sm_conn) return;     // wrong connection
3848 
3849     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3850     if (IS_RESPONDER(sm_conn->sm_role)){
3851         sm_send_security_request_for_connection(sm_conn);
3852     } else {
3853         // used as a trigger to start central/master/initiator security procedures
3854         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3855             uint8_t ltk[16];
3856             switch (sm_conn->sm_irk_lookup_state){
3857                 case IRK_LOOKUP_SUCCEEDED:
3858 #ifndef ENABLE_LE_CENTRAL_AUTO_ENCRYPTION
3859                     le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
3860                     int have_ltk = !sm_is_null_key(ltk);
3861                     log_info("have ltk %u", have_ltk);
3862                     // trigger 'pairing complete' event on encryption change
3863                     sm_conn->sm_pairing_requested = 1;
3864                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3865                     break;
3866 #endif
3867                      /* explicit fall-through */
3868 
3869                 case IRK_LOOKUP_FAILED:
3870                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3871                     break;
3872                 default:
3873                     log_info("irk lookup pending");
3874                     sm_conn->sm_pairing_requested = 1;
3875                     break;
3876             }
3877         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3878             sm_conn->sm_pairing_requested = 1;
3879         }
3880     }
3881     sm_run();
3882 }
3883 
3884 // called by client app on authorization request
3885 void sm_authorization_decline(hci_con_handle_t con_handle){
3886     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3887     if (!sm_conn) return;     // wrong connection
3888     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3889     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3890 }
3891 
3892 void sm_authorization_grant(hci_con_handle_t con_handle){
3893     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3894     if (!sm_conn) return;     // wrong connection
3895     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3896     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3897 }
3898 
3899 // GAP Bonding API
3900 
3901 void sm_bonding_decline(hci_con_handle_t con_handle){
3902     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3903     if (!sm_conn) return;     // wrong connection
3904     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3905     log_info("decline, state %u", sm_conn->sm_engine_state);
3906     switch(sm_conn->sm_engine_state){
3907 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3908         case SM_SC_W4_USER_RESPONSE:
3909         case SM_SC_W4_CONFIRMATION:
3910         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3911 #endif
3912         case SM_PH1_W4_USER_RESPONSE:
3913             switch (setup->sm_stk_generation_method){
3914                 case PK_RESP_INPUT:
3915                 case PK_INIT_INPUT:
3916                 case PK_BOTH_INPUT:
3917                     sm_pairing_error(sm_conn, SM_REASON_PASSKEY_ENTRY_FAILED);
3918                     break;
3919                 case NUMERIC_COMPARISON:
3920                     sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3921                     break;
3922                 case JUST_WORKS:
3923                 case OOB:
3924                     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3925                     break;
3926             }
3927             break;
3928         default:
3929             break;
3930     }
3931     sm_run();
3932 }
3933 
3934 void sm_just_works_confirm(hci_con_handle_t con_handle){
3935     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3936     if (!sm_conn) return;     // wrong connection
3937     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3938     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3939         if (setup->sm_use_secure_connections){
3940             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3941         } else {
3942             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3943         }
3944     }
3945 
3946 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3947     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3948         sm_sc_prepare_dhkey_check(sm_conn);
3949     }
3950 #endif
3951 
3952     sm_run();
3953 }
3954 
3955 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3956     // for now, it's the same
3957     sm_just_works_confirm(con_handle);
3958 }
3959 
3960 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3961     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3962     if (!sm_conn) return;     // wrong connection
3963     sm_reset_tk();
3964     big_endian_store_32(setup->sm_tk, 12, passkey);
3965     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3966     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3967         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3968     }
3969 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3970     memcpy(setup->sm_ra, setup->sm_tk, 16);
3971     memcpy(setup->sm_rb, setup->sm_tk, 16);
3972     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3973         sm_sc_start_calculating_local_confirm(sm_conn);
3974     }
3975 #endif
3976     sm_run();
3977 }
3978 
3979 void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
3980     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3981     if (!sm_conn) return;     // wrong connection
3982     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
3983     uint8_t num_actions = setup->sm_keypress_notification >> 5;
3984     uint8_t flags = setup->sm_keypress_notification & 0x1f;
3985     switch (action){
3986         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
3987         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
3988             flags |= (1 << action);
3989             break;
3990         case SM_KEYPRESS_PASSKEY_CLEARED:
3991             // clear counter, keypress & erased flags + set passkey cleared
3992             flags = (flags & 0x19) | (1 << SM_KEYPRESS_PASSKEY_CLEARED);
3993             break;
3994         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
3995             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED)){
3996                 // erase actions queued
3997                 num_actions--;
3998                 if (num_actions == 0){
3999                     // clear counter, keypress & erased flags
4000                     flags &= 0x19;
4001                 }
4002                 break;
4003             }
4004             num_actions++;
4005             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED);
4006             break;
4007         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
4008             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED)){
4009                 // enter actions queued
4010                 num_actions--;
4011                 if (num_actions == 0){
4012                     // clear counter, keypress & erased flags
4013                     flags &= 0x19;
4014                 }
4015                 break;
4016             }
4017             num_actions++;
4018             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED);
4019             break;
4020         default:
4021             break;
4022     }
4023     setup->sm_keypress_notification = (num_actions << 5) | flags;
4024     sm_run();
4025 }
4026 
4027 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4028 static void sm_handle_random_result_oob(void * arg){
4029     UNUSED(arg);
4030     sm_sc_oob_state = SM_SC_OOB_W2_CALC_CONFIRM;
4031     sm_run();
4032 }
4033 uint8_t sm_generate_sc_oob_data(void (*callback)(const uint8_t * confirm_value, const uint8_t * random_value)){
4034     if (sm_sc_oob_state != SM_SC_OOB_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
4035     sm_sc_oob_callback = callback;
4036     sm_sc_oob_state = SM_SC_OOB_W4_RANDOM;
4037     btstack_crypto_random_generate(&sm_crypto_random_oob_request, sm_sc_oob_random, 16, &sm_handle_random_result_oob, NULL);
4038     return 0;
4039 }
4040 #endif
4041 
4042 /**
4043  * @brief Identify device in LE Device DB
4044  * @param handle
4045  * @returns index from le_device_db or -1 if not found/identified
4046  */
4047 int sm_le_device_index(hci_con_handle_t con_handle ){
4048     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4049     if (!sm_conn) return -1;
4050     return sm_conn->sm_le_db_index;
4051 }
4052 
4053 static int gap_random_address_type_requires_updates(void){
4054     switch (gap_random_adress_type){
4055         case GAP_RANDOM_ADDRESS_TYPE_OFF:
4056         case GAP_RANDOM_ADDRESS_TYPE_STATIC:
4057             return 0;
4058         default:
4059             return 1;
4060     }
4061 }
4062 
4063 static uint8_t own_address_type(void){
4064     switch (gap_random_adress_type){
4065         case GAP_RANDOM_ADDRESS_TYPE_OFF:
4066             return BD_ADDR_TYPE_LE_PUBLIC;
4067         default:
4068             return BD_ADDR_TYPE_LE_RANDOM;
4069     }
4070 }
4071 
4072 // GAP LE API
4073 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
4074     gap_random_address_update_stop();
4075     gap_random_adress_type = random_address_type;
4076     hci_le_set_own_address_type(own_address_type());
4077     if (!gap_random_address_type_requires_updates()) return;
4078     gap_random_address_update_start();
4079     gap_random_address_trigger();
4080 }
4081 
4082 gap_random_address_type_t gap_random_address_get_mode(void){
4083     return gap_random_adress_type;
4084 }
4085 
4086 void gap_random_address_set_update_period(int period_ms){
4087     gap_random_adress_update_period = period_ms;
4088     if (!gap_random_address_type_requires_updates()) return;
4089     gap_random_address_update_stop();
4090     gap_random_address_update_start();
4091 }
4092 
4093 void gap_random_address_set(bd_addr_t addr){
4094     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
4095     memcpy(sm_random_address, addr, 6);
4096     rau_state = RAU_SET_ADDRESS;
4097     sm_run();
4098 }
4099 
4100 #ifdef ENABLE_LE_PERIPHERAL
4101 /*
4102  * @brief Set Advertisement Paramters
4103  * @param adv_int_min
4104  * @param adv_int_max
4105  * @param adv_type
4106  * @param direct_address_type
4107  * @param direct_address
4108  * @param channel_map
4109  * @param filter_policy
4110  *
4111  * @note own_address_type is used from gap_random_address_set_mode
4112  */
4113 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
4114     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4115     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
4116         direct_address_typ, direct_address, channel_map, filter_policy);
4117 }
4118 #endif
4119 
4120 int gap_reconnect_security_setup_active(hci_con_handle_t con_handle){
4121     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4122      // wrong connection
4123     if (!sm_conn) return 0;
4124     // already encrypted
4125     if (sm_conn->sm_connection_encrypted) return 0;
4126     // only central can re-encrypt
4127     if (sm_conn->sm_role == HCI_ROLE_SLAVE) return 0;
4128     // irk status?
4129     switch(sm_conn->sm_irk_lookup_state){
4130         case IRK_LOOKUP_FAILED:
4131             // done, cannot setup encryption
4132             return 0;
4133         case IRK_LOOKUP_SUCCEEDED:
4134             break;
4135         default:
4136             // IR Lookup pending
4137             return 1;
4138     }
4139     // IRK Lookup Succeeded, re-encryption should be initiated. When done, state gets reset
4140     return sm_conn->sm_engine_state != SM_INITIATOR_CONNECTED;
4141 }
4142