xref: /btstack/src/ble/sm.c (revision 7df1ef2f9ef31cd33b8e831aa192b2699c64b45f)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "sm.c"
39 
40 #include <stdio.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "ble/le_device_db.h"
45 #include "ble/core.h"
46 #include "ble/sm.h"
47 #include "bluetooth_company_id.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_linked_list.h"
51 #include "btstack_memory.h"
52 #include "gap.h"
53 #include "hci.h"
54 #include "hci_dump.h"
55 #include "l2cap.h"
56 
57 #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
58 #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
59 #endif
60 
61 #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
62 #define IS_RESPONDER(role) (role)
63 #else
64 #ifdef ENABLE_LE_CENTRAL
65 // only central - never responder (avoid 'unused variable' warnings)
66 #define IS_RESPONDER(role) (0 && role)
67 #else
68 // only peripheral - always responder (avoid 'unused variable' warnings)
69 #define IS_RESPONDER(role) (1 || role)
70 #endif
71 #endif
72 
73 #ifdef ENABLE_LE_SECURE_CONNECTIONS
74 // assert SM Public Key can be sent/received
75 #if HCI_ACL_PAYLOAD_SIZE < 69
76 #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
77 #endif
78 
79 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
80 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
81 #else
82 // #define USE_MBEDTLS_FOR_ECDH
83 #define USE_MICROECC_FOR_ECDH
84 #endif
85 #endif
86 
87 // Software ECDH implementation provided by mbedtls
88 #ifdef USE_MBEDTLS_FOR_ECDH
89 #include "mbedtls/config.h"
90 #include "mbedtls/platform.h"
91 #include "mbedtls/ecp.h"
92 #include "sm_mbedtls_allocator.h"
93 #endif
94 
95 // Software ECDH implementation provided by micro-ecc
96 #ifdef USE_MICROECC_FOR_ECDH
97 #include "uECC.h"
98 #endif
99 
100 #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
101 #define ENABLE_CMAC_ENGINE
102 #endif
103 
104 //
105 // SM internal types and globals
106 //
107 
108 typedef enum {
109     DKG_W4_WORKING,
110     DKG_CALC_IRK,
111     DKG_W4_IRK,
112     DKG_CALC_DHK,
113     DKG_W4_DHK,
114     DKG_READY
115 } derived_key_generation_t;
116 
117 typedef enum {
118     RAU_W4_WORKING,
119     RAU_IDLE,
120     RAU_GET_RANDOM,
121     RAU_W4_RANDOM,
122     RAU_GET_ENC,
123     RAU_W4_ENC,
124     RAU_SET_ADDRESS,
125 } random_address_update_t;
126 
127 typedef enum {
128     CMAC_IDLE,
129     CMAC_CALC_SUBKEYS,
130     CMAC_W4_SUBKEYS,
131     CMAC_CALC_MI,
132     CMAC_W4_MI,
133     CMAC_CALC_MLAST,
134     CMAC_W4_MLAST
135 } cmac_state_t;
136 
137 typedef enum {
138     JUST_WORKS,
139     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
140     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
141     OK_BOTH_INPUT,  // Only input on both, both input PK
142     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
143     OOB             // OOB available on both sides
144 } stk_generation_method_t;
145 
146 typedef enum {
147     SM_USER_RESPONSE_IDLE,
148     SM_USER_RESPONSE_PENDING,
149     SM_USER_RESPONSE_CONFIRM,
150     SM_USER_RESPONSE_PASSKEY,
151     SM_USER_RESPONSE_DECLINE
152 } sm_user_response_t;
153 
154 typedef enum {
155     SM_AES128_IDLE,
156     SM_AES128_ACTIVE
157 } sm_aes128_state_t;
158 
159 typedef enum {
160     ADDRESS_RESOLUTION_IDLE,
161     ADDRESS_RESOLUTION_GENERAL,
162     ADDRESS_RESOLUTION_FOR_CONNECTION,
163 } address_resolution_mode_t;
164 
165 typedef enum {
166     ADDRESS_RESOLUTION_SUCEEDED,
167     ADDRESS_RESOLUTION_FAILED,
168 } address_resolution_event_t;
169 
170 typedef enum {
171     EC_KEY_GENERATION_IDLE,
172     EC_KEY_GENERATION_ACTIVE,
173     EC_KEY_GENERATION_W4_KEY,
174     EC_KEY_GENERATION_DONE,
175 } ec_key_generation_state_t;
176 
177 typedef enum {
178     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
179 } sm_state_var_t;
180 
181 //
182 // GLOBAL DATA
183 //
184 
185 static uint8_t test_use_fixed_local_csrk;
186 
187 // configuration
188 static uint8_t sm_accepted_stk_generation_methods;
189 static uint8_t sm_max_encryption_key_size;
190 static uint8_t sm_min_encryption_key_size;
191 static uint8_t sm_auth_req = 0;
192 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
193 static uint8_t sm_slave_request_security;
194 #ifdef ENABLE_LE_SECURE_CONNECTIONS
195 static uint8_t sm_have_ec_keypair;
196 #endif
197 
198 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
199 static sm_key_t sm_persistent_er;
200 static sm_key_t sm_persistent_ir;
201 
202 // derived from sm_persistent_ir
203 static sm_key_t sm_persistent_dhk;
204 static sm_key_t sm_persistent_irk;
205 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
206 static derived_key_generation_t dkg_state;
207 
208 // derived from sm_persistent_er
209 // ..
210 
211 // random address update
212 static random_address_update_t rau_state;
213 static bd_addr_t sm_random_address;
214 
215 // CMAC Calculation: General
216 #ifdef ENABLE_CMAC_ENGINE
217 static cmac_state_t sm_cmac_state;
218 static uint16_t     sm_cmac_message_len;
219 static sm_key_t     sm_cmac_k;
220 static sm_key_t     sm_cmac_x;
221 static sm_key_t     sm_cmac_m_last;
222 static uint8_t      sm_cmac_block_current;
223 static uint8_t      sm_cmac_block_count;
224 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
225 static void         (*sm_cmac_done_handler)(uint8_t * hash);
226 #endif
227 
228 // CMAC for ATT Signed Writes
229 #ifdef ENABLE_LE_SIGNED_WRITE
230 static uint8_t      sm_cmac_header[3];
231 static const uint8_t * sm_cmac_message;
232 static uint8_t      sm_cmac_sign_counter[4];
233 #endif
234 
235 // CMAC for Secure Connection functions
236 #ifdef ENABLE_LE_SECURE_CONNECTIONS
237 static sm_connection_t * sm_cmac_connection;
238 static uint8_t           sm_cmac_sc_buffer[80];
239 #endif
240 
241 // resolvable private address lookup / CSRK calculation
242 static int       sm_address_resolution_test;
243 static int       sm_address_resolution_ah_calculation_active;
244 static uint8_t   sm_address_resolution_addr_type;
245 static bd_addr_t sm_address_resolution_address;
246 static void *    sm_address_resolution_context;
247 static address_resolution_mode_t sm_address_resolution_mode;
248 static btstack_linked_list_t sm_address_resolution_general_queue;
249 
250 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
251 static sm_aes128_state_t  sm_aes128_state;
252 static void *             sm_aes128_context;
253 
254 // use aes128 provided by MCU - not needed usually
255 #ifdef HAVE_AES128
256 static uint8_t                aes128_result_flipped[16];
257 static btstack_timer_source_t aes128_timer;
258 static void btstack_aes128_calc(uint8_t * key, uint8_t * plaintext, uint8_t * result);
259 #endif
260 
261 // random engine. store context (ususally sm_connection_t)
262 static void * sm_random_context;
263 
264 // to receive hci events
265 static btstack_packet_callback_registration_t hci_event_callback_registration;
266 
267 /* to dispatch sm event */
268 static btstack_linked_list_t sm_event_handlers;
269 
270 // LE Secure Connections
271 #ifdef ENABLE_LE_SECURE_CONNECTIONS
272 static ec_key_generation_state_t ec_key_generation_state;
273 static uint8_t ec_d[32];
274 static uint8_t ec_q[64];
275 #endif
276 
277 // Software ECDH implementation provided by mbedtls
278 #ifdef USE_MBEDTLS_FOR_ECDH
279 // group is always valid
280 static mbedtls_ecp_group   mbedtls_ec_group;
281 #ifndef HAVE_MALLOC
282 // COMP Method with Window 2
283 // 1300 bytes with 23 allocations
284 // #define MBEDTLS_ALLOC_BUFFER_SIZE (1300+23*sizeof(void *))
285 // NAIVE Method with safe cond assignments (without safe cond, order changes and allocations fail)
286 #define MBEDTLS_ALLOC_BUFFER_SIZE (700+18*sizeof(void *))
287 static uint8_t mbedtls_memory_buffer[MBEDTLS_ALLOC_BUFFER_SIZE];
288 #endif
289 #endif
290 
291 //
292 // Volume 3, Part H, Chapter 24
293 // "Security shall be initiated by the Security Manager in the device in the master role.
294 // The device in the slave role shall be the responding device."
295 // -> master := initiator, slave := responder
296 //
297 
298 // data needed for security setup
299 typedef struct sm_setup_context {
300 
301     btstack_timer_source_t sm_timeout;
302 
303     // used in all phases
304     uint8_t   sm_pairing_failed_reason;
305 
306     // user response, (Phase 1 and/or 2)
307     uint8_t   sm_user_response;
308     uint8_t   sm_keypress_notification;
309 
310     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
311     int       sm_key_distribution_send_set;
312     int       sm_key_distribution_received_set;
313 
314     // Phase 2 (Pairing over SMP)
315     stk_generation_method_t sm_stk_generation_method;
316     sm_key_t  sm_tk;
317     uint8_t   sm_use_secure_connections;
318 
319     sm_key_t  sm_c1_t3_value;   // c1 calculation
320     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
321     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
322     sm_key_t  sm_local_random;
323     sm_key_t  sm_local_confirm;
324     sm_key_t  sm_peer_random;
325     sm_key_t  sm_peer_confirm;
326     uint8_t   sm_m_addr_type;   // address and type can be removed
327     uint8_t   sm_s_addr_type;   //  ''
328     bd_addr_t sm_m_address;     //  ''
329     bd_addr_t sm_s_address;     //  ''
330     sm_key_t  sm_ltk;
331 
332     uint8_t   sm_state_vars;
333 #ifdef ENABLE_LE_SECURE_CONNECTIONS
334     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
335     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
336     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
337     sm_key_t  sm_peer_dhkey_check;
338     sm_key_t  sm_local_dhkey_check;
339     sm_key_t  sm_ra;
340     sm_key_t  sm_rb;
341     sm_key_t  sm_t;             // used for f5 and h6
342     sm_key_t  sm_mackey;
343     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
344 #endif
345 
346     // Phase 3
347 
348     // key distribution, we generate
349     uint16_t  sm_local_y;
350     uint16_t  sm_local_div;
351     uint16_t  sm_local_ediv;
352     uint8_t   sm_local_rand[8];
353     sm_key_t  sm_local_ltk;
354     sm_key_t  sm_local_csrk;
355     sm_key_t  sm_local_irk;
356     // sm_local_address/addr_type not needed
357 
358     // key distribution, received from peer
359     uint16_t  sm_peer_y;
360     uint16_t  sm_peer_div;
361     uint16_t  sm_peer_ediv;
362     uint8_t   sm_peer_rand[8];
363     sm_key_t  sm_peer_ltk;
364     sm_key_t  sm_peer_irk;
365     sm_key_t  sm_peer_csrk;
366     uint8_t   sm_peer_addr_type;
367     bd_addr_t sm_peer_address;
368 
369 } sm_setup_context_t;
370 
371 //
372 static sm_setup_context_t the_setup;
373 static sm_setup_context_t * setup = &the_setup;
374 
375 // active connection - the one for which the_setup is used for
376 static uint16_t sm_active_connection = 0;
377 
378 // @returns 1 if oob data is available
379 // stores oob data in provided 16 byte buffer if not null
380 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
381 
382 // horizontal: initiator capabilities
383 // vertial:    responder capabilities
384 static const stk_generation_method_t stk_generation_method [5] [5] = {
385     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
386     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
387     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
388     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
389     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
390 };
391 
392 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
393 #ifdef ENABLE_LE_SECURE_CONNECTIONS
394 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
395     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
396     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
397     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
398     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
399     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
400 };
401 #endif
402 
403 static void sm_run(void);
404 static void sm_done_for_handle(hci_con_handle_t con_handle);
405 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
406 static inline int sm_calc_actual_encryption_key_size(int other);
407 static int sm_validate_stk_generation_method(void);
408 static void sm_handle_encryption_result(uint8_t * data);
409 
410 static void log_info_hex16(const char * name, uint16_t value){
411     log_info("%-6s 0x%04x", name, value);
412 }
413 
414 // @returns 1 if all bytes are 0
415 static int sm_is_null(uint8_t * data, int size){
416     int i;
417     for (i=0; i < size ; i++){
418         if (data[i]) return 0;
419     }
420     return 1;
421 }
422 
423 static int sm_is_null_random(uint8_t random[8]){
424     return sm_is_null(random, 8);
425 }
426 
427 static int sm_is_null_key(uint8_t * key){
428     return sm_is_null(key, 16);
429 }
430 
431 // Key utils
432 static void sm_reset_tk(void){
433     int i;
434     for (i=0;i<16;i++){
435         setup->sm_tk[i] = 0;
436     }
437 }
438 
439 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
440 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
441 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
442     int i;
443     for (i = max_encryption_size ; i < 16 ; i++){
444         key[15-i] = 0;
445     }
446 }
447 
448 // SMP Timeout implementation
449 
450 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
451 // the Security Manager Timer shall be reset and started.
452 //
453 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
454 //
455 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
456 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
457 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
458 // established.
459 
460 static void sm_timeout_handler(btstack_timer_source_t * timer){
461     log_info("SM timeout");
462     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
463     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
464     sm_done_for_handle(sm_conn->sm_handle);
465 
466     // trigger handling of next ready connection
467     sm_run();
468 }
469 static void sm_timeout_start(sm_connection_t * sm_conn){
470     btstack_run_loop_remove_timer(&setup->sm_timeout);
471     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
472     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
473     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
474     btstack_run_loop_add_timer(&setup->sm_timeout);
475 }
476 static void sm_timeout_stop(void){
477     btstack_run_loop_remove_timer(&setup->sm_timeout);
478 }
479 static void sm_timeout_reset(sm_connection_t * sm_conn){
480     sm_timeout_stop();
481     sm_timeout_start(sm_conn);
482 }
483 
484 // end of sm timeout
485 
486 // GAP Random Address updates
487 static gap_random_address_type_t gap_random_adress_type;
488 static btstack_timer_source_t gap_random_address_update_timer;
489 static uint32_t gap_random_adress_update_period;
490 
491 static void gap_random_address_trigger(void){
492     if (rau_state != RAU_IDLE) return;
493     log_info("gap_random_address_trigger");
494     rau_state = RAU_GET_RANDOM;
495     sm_run();
496 }
497 
498 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
499     UNUSED(timer);
500 
501     log_info("GAP Random Address Update due");
502     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
503     btstack_run_loop_add_timer(&gap_random_address_update_timer);
504     gap_random_address_trigger();
505 }
506 
507 static void gap_random_address_update_start(void){
508     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
509     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
510     btstack_run_loop_add_timer(&gap_random_address_update_timer);
511 }
512 
513 static void gap_random_address_update_stop(void){
514     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
515 }
516 
517 
518 static void sm_random_start(void * context){
519     sm_random_context = context;
520     hci_send_cmd(&hci_le_rand);
521 }
522 
523 #ifdef HAVE_AES128
524 static void aes128_completed(btstack_timer_source_t * ts){
525     UNUSED(ts);
526     sm_handle_encryption_result(&aes128_result_flipped[0]);
527     sm_run();
528 }
529 #endif
530 
531 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
532 // context is made availabe to aes128 result handler by this
533 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
534     sm_aes128_state = SM_AES128_ACTIVE;
535     sm_aes128_context = context;
536 
537 #ifdef HAVE_AES128
538     // calc result directly
539     sm_key_t result;
540     btstack_aes128_calc(key, plaintext, result);
541 
542     // log
543     log_info_key("key", key);
544     log_info_key("txt", plaintext);
545     log_info_key("res", result);
546 
547     // flip
548     reverse_128(&result[0], &aes128_result_flipped[0]);
549 
550     // deliver via timer
551     btstack_run_loop_set_timer_handler(&aes128_timer, &aes128_completed);
552     btstack_run_loop_set_timer(&aes128_timer, 0);    // no delay
553     btstack_run_loop_add_timer(&aes128_timer);
554 #else
555     sm_key_t key_flipped, plaintext_flipped;
556     reverse_128(key, key_flipped);
557     reverse_128(plaintext, plaintext_flipped);
558     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
559 #endif
560 }
561 
562 // ah(k,r) helper
563 // r = padding || r
564 // r - 24 bit value
565 static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
566     // r'= padding || r
567     memset(r_prime, 0, 16);
568     memcpy(&r_prime[13], r, 3);
569 }
570 
571 // d1 helper
572 // d' = padding || r || d
573 // d,r - 16 bit values
574 static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
575     // d'= padding || r || d
576     memset(d1_prime, 0, 16);
577     big_endian_store_16(d1_prime, 12, r);
578     big_endian_store_16(d1_prime, 14, d);
579 }
580 
581 // dm helper
582 // r’ = padding || r
583 // r - 64 bit value
584 static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
585     memset(r_prime, 0, 16);
586     memcpy(&r_prime[8], r, 8);
587 }
588 
589 // calculate arguments for first AES128 operation in C1 function
590 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
591 
592     // p1 = pres || preq || rat’ || iat’
593     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
594     // cant octet of pres becomes the most significant octet of p1.
595     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
596     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
597     // p1 is 0x05000800000302070710000001010001."
598 
599     sm_key_t p1;
600     reverse_56(pres, &p1[0]);
601     reverse_56(preq, &p1[7]);
602     p1[14] = rat;
603     p1[15] = iat;
604     log_info_key("p1", p1);
605     log_info_key("r", r);
606 
607     // t1 = r xor p1
608     int i;
609     for (i=0;i<16;i++){
610         t1[i] = r[i] ^ p1[i];
611     }
612     log_info_key("t1", t1);
613 }
614 
615 // calculate arguments for second AES128 operation in C1 function
616 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
617      // p2 = padding || ia || ra
618     // "The least significant octet of ra becomes the least significant octet of p2 and
619     // the most significant octet of padding becomes the most significant octet of p2.
620     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
621     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
622 
623     sm_key_t p2;
624     memset(p2, 0, 16);
625     memcpy(&p2[4],  ia, 6);
626     memcpy(&p2[10], ra, 6);
627     log_info_key("p2", p2);
628 
629     // c1 = e(k, t2_xor_p2)
630     int i;
631     for (i=0;i<16;i++){
632         t3[i] = t2[i] ^ p2[i];
633     }
634     log_info_key("t3", t3);
635 }
636 
637 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
638     log_info_key("r1", r1);
639     log_info_key("r2", r2);
640     memcpy(&r_prime[8], &r2[8], 8);
641     memcpy(&r_prime[0], &r1[8], 8);
642 }
643 
644 #ifdef ENABLE_LE_SECURE_CONNECTIONS
645 // Software implementations of crypto toolbox for LE Secure Connection
646 // TODO: replace with code to use AES Engine of HCI Controller
647 typedef uint8_t sm_key24_t[3];
648 typedef uint8_t sm_key56_t[7];
649 typedef uint8_t sm_key256_t[32];
650 
651 #if 0
652 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
653     uint32_t rk[RKLENGTH(KEYBITS)];
654     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
655     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
656 }
657 
658 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
659     memcpy(k1, k0, 16);
660     sm_shift_left_by_one_bit_inplace(16, k1);
661     if (k0[0] & 0x80){
662         k1[15] ^= 0x87;
663     }
664     memcpy(k2, k1, 16);
665     sm_shift_left_by_one_bit_inplace(16, k2);
666     if (k1[0] & 0x80){
667         k2[15] ^= 0x87;
668     }
669 }
670 
671 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
672     sm_key_t k0, k1, k2, zero;
673     memset(zero, 0, 16);
674 
675     aes128_calc_cyphertext(key, zero, k0);
676     calc_subkeys(k0, k1, k2);
677 
678     int cmac_block_count = (cmac_message_len + 15) / 16;
679 
680     // step 3: ..
681     if (cmac_block_count==0){
682         cmac_block_count = 1;
683     }
684 
685     // step 4: set m_last
686     sm_key_t cmac_m_last;
687     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
688     int i;
689     if (sm_cmac_last_block_complete){
690         for (i=0;i<16;i++){
691             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
692         }
693     } else {
694         int valid_octets_in_last_block = cmac_message_len & 0x0f;
695         for (i=0;i<16;i++){
696             if (i < valid_octets_in_last_block){
697                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
698                 continue;
699             }
700             if (i == valid_octets_in_last_block){
701                 cmac_m_last[i] = 0x80 ^ k2[i];
702                 continue;
703             }
704             cmac_m_last[i] = k2[i];
705         }
706     }
707 
708     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
709     // LOG_KEY(cmac_m_last);
710 
711     // Step 5
712     sm_key_t cmac_x;
713     memset(cmac_x, 0, 16);
714 
715     // Step 6
716     sm_key_t sm_cmac_y;
717     for (int block = 0 ; block < cmac_block_count-1 ; block++){
718         for (i=0;i<16;i++){
719             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
720         }
721         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
722     }
723     for (i=0;i<16;i++){
724         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
725     }
726 
727     // Step 7
728     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
729 }
730 #endif
731 #endif
732 
733 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
734     event[0] = type;
735     event[1] = event_size - 2;
736     little_endian_store_16(event, 2, con_handle);
737     event[4] = addr_type;
738     reverse_bd_addr(address, &event[5]);
739 }
740 
741 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
742     UNUSED(channel);
743 
744     // log event
745     hci_dump_packet(packet_type, 1, packet, size);
746     // dispatch to all event handlers
747     btstack_linked_list_iterator_t it;
748     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
749     while (btstack_linked_list_iterator_has_next(&it)){
750         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
751         entry->callback(packet_type, 0, packet, size);
752     }
753 }
754 
755 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
756     uint8_t event[11];
757     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
758     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
759 }
760 
761 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
762     uint8_t event[15];
763     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
764     little_endian_store_32(event, 11, passkey);
765     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
766 }
767 
768 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
769     // fetch addr and addr type from db
770     bd_addr_t identity_address;
771     int identity_address_type;
772     le_device_db_info(index, &identity_address_type, identity_address, NULL);
773 
774     uint8_t event[19];
775     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
776     event[11] = identity_address_type;
777     reverse_bd_addr(identity_address, &event[12]);
778     event[18] = index;
779     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
780 }
781 
782 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
783 
784     uint8_t event[18];
785     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
786     event[11] = result;
787     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
788 }
789 
790 // decide on stk generation based on
791 // - pairing request
792 // - io capabilities
793 // - OOB data availability
794 static void sm_setup_tk(void){
795 
796     // default: just works
797     setup->sm_stk_generation_method = JUST_WORKS;
798 
799 #ifdef ENABLE_LE_SECURE_CONNECTIONS
800     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
801                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
802                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
803     memset(setup->sm_ra, 0, 16);
804     memset(setup->sm_rb, 0, 16);
805 #else
806     setup->sm_use_secure_connections = 0;
807 #endif
808 
809     // If both devices have not set the MITM option in the Authentication Requirements
810     // Flags, then the IO capabilities shall be ignored and the Just Works association
811     // model shall be used.
812     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
813     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
814         log_info("SM: MITM not required by both -> JUST WORKS");
815         return;
816     }
817 
818     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
819 
820     // If both devices have out of band authentication data, then the Authentication
821     // Requirements Flags shall be ignored when selecting the pairing method and the
822     // Out of Band pairing method shall be used.
823     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
824     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
825         log_info("SM: have OOB data");
826         log_info_key("OOB", setup->sm_tk);
827         setup->sm_stk_generation_method = OOB;
828         return;
829     }
830 
831     // Reset TK as it has been setup in sm_init_setup
832     sm_reset_tk();
833 
834     // Also use just works if unknown io capabilites
835     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
836         return;
837     }
838 
839     // Otherwise the IO capabilities of the devices shall be used to determine the
840     // pairing method as defined in Table 2.4.
841     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
842     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
843 
844 #ifdef ENABLE_LE_SECURE_CONNECTIONS
845     // table not define by default
846     if (setup->sm_use_secure_connections){
847         generation_method = stk_generation_method_with_secure_connection;
848     }
849 #endif
850     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
851 
852     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
853         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
854 }
855 
856 static int sm_key_distribution_flags_for_set(uint8_t key_set){
857     int flags = 0;
858     if (key_set & SM_KEYDIST_ENC_KEY){
859         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
860         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
861     }
862     if (key_set & SM_KEYDIST_ID_KEY){
863         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
864         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
865     }
866     if (key_set & SM_KEYDIST_SIGN){
867         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
868     }
869     return flags;
870 }
871 
872 static void sm_setup_key_distribution(uint8_t key_set){
873     setup->sm_key_distribution_received_set = 0;
874     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
875 }
876 
877 // CSRK Key Lookup
878 
879 
880 static int sm_address_resolution_idle(void){
881     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
882 }
883 
884 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
885     memcpy(sm_address_resolution_address, addr, 6);
886     sm_address_resolution_addr_type = addr_type;
887     sm_address_resolution_test = 0;
888     sm_address_resolution_mode = mode;
889     sm_address_resolution_context = context;
890     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
891 }
892 
893 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
894     // check if already in list
895     btstack_linked_list_iterator_t it;
896     sm_lookup_entry_t * entry;
897     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
898     while(btstack_linked_list_iterator_has_next(&it)){
899         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
900         if (entry->address_type != address_type) continue;
901         if (memcmp(entry->address, address, 6))  continue;
902         // already in list
903         return BTSTACK_BUSY;
904     }
905     entry = btstack_memory_sm_lookup_entry_get();
906     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
907     entry->address_type = (bd_addr_type_t) address_type;
908     memcpy(entry->address, address, 6);
909     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
910     sm_run();
911     return 0;
912 }
913 
914 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
915 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
916     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
917 }
918 static inline void dkg_next_state(void){
919     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
920 }
921 static inline void rau_next_state(void){
922     rau_state = (random_address_update_t) (((int)rau_state) + 1);
923 }
924 
925 // CMAC calculation using AES Engine
926 #ifdef ENABLE_CMAC_ENGINE
927 
928 static inline void sm_cmac_next_state(void){
929     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
930 }
931 
932 static int sm_cmac_last_block_complete(void){
933     if (sm_cmac_message_len == 0) return 0;
934     return (sm_cmac_message_len & 0x0f) == 0;
935 }
936 
937 int sm_cmac_ready(void){
938     return sm_cmac_state == CMAC_IDLE;
939 }
940 
941 // generic cmac calculation
942 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
943     // Generalized CMAC
944     memcpy(sm_cmac_k, key, 16);
945     memset(sm_cmac_x, 0, 16);
946     sm_cmac_block_current = 0;
947     sm_cmac_message_len  = message_len;
948     sm_cmac_done_handler = done_callback;
949     sm_cmac_get_byte     = get_byte_callback;
950 
951     // step 2: n := ceil(len/const_Bsize);
952     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
953 
954     // step 3: ..
955     if (sm_cmac_block_count==0){
956         sm_cmac_block_count = 1;
957     }
958     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
959 
960     // first, we need to compute l for k1, k2, and m_last
961     sm_cmac_state = CMAC_CALC_SUBKEYS;
962 
963     // let's go
964     sm_run();
965 }
966 #endif
967 
968 // cmac for ATT Message signing
969 #ifdef ENABLE_LE_SIGNED_WRITE
970 static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
971     if (offset >= sm_cmac_message_len) {
972         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
973         return 0;
974     }
975 
976     offset = sm_cmac_message_len - 1 - offset;
977 
978     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
979     if (offset < 3){
980         return sm_cmac_header[offset];
981     }
982     int actual_message_len_incl_header = sm_cmac_message_len - 4;
983     if (offset <  actual_message_len_incl_header){
984         return sm_cmac_message[offset - 3];
985     }
986     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
987 }
988 
989 void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
990     // ATT Message Signing
991     sm_cmac_header[0] = opcode;
992     little_endian_store_16(sm_cmac_header, 1, con_handle);
993     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
994     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
995     sm_cmac_message = message;
996     sm_cmac_general_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
997 }
998 #endif
999 
1000 #ifdef ENABLE_CMAC_ENGINE
1001 static void sm_cmac_handle_aes_engine_ready(void){
1002     switch (sm_cmac_state){
1003         case CMAC_CALC_SUBKEYS: {
1004             sm_key_t const_zero;
1005             memset(const_zero, 0, 16);
1006             sm_cmac_next_state();
1007             sm_aes128_start(sm_cmac_k, const_zero, NULL);
1008             break;
1009         }
1010         case CMAC_CALC_MI: {
1011             int j;
1012             sm_key_t y;
1013             for (j=0;j<16;j++){
1014                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
1015             }
1016             sm_cmac_block_current++;
1017             sm_cmac_next_state();
1018             sm_aes128_start(sm_cmac_k, y, NULL);
1019             break;
1020         }
1021         case CMAC_CALC_MLAST: {
1022             int i;
1023             sm_key_t y;
1024             for (i=0;i<16;i++){
1025                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
1026             }
1027             log_info_key("Y", y);
1028             sm_cmac_block_current++;
1029             sm_cmac_next_state();
1030             sm_aes128_start(sm_cmac_k, y, NULL);
1031             break;
1032         }
1033         default:
1034             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
1035             break;
1036     }
1037 }
1038 
1039 // CMAC Implementation using AES128 engine
1040 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
1041     int i;
1042     int carry = 0;
1043     for (i=len-1; i >= 0 ; i--){
1044         int new_carry = data[i] >> 7;
1045         data[i] = data[i] << 1 | carry;
1046         carry = new_carry;
1047     }
1048 }
1049 
1050 static void sm_cmac_handle_encryption_result(sm_key_t data){
1051     switch (sm_cmac_state){
1052         case CMAC_W4_SUBKEYS: {
1053             sm_key_t k1;
1054             memcpy(k1, data, 16);
1055             sm_shift_left_by_one_bit_inplace(16, k1);
1056             if (data[0] & 0x80){
1057                 k1[15] ^= 0x87;
1058             }
1059             sm_key_t k2;
1060             memcpy(k2, k1, 16);
1061             sm_shift_left_by_one_bit_inplace(16, k2);
1062             if (k1[0] & 0x80){
1063                 k2[15] ^= 0x87;
1064             }
1065 
1066             log_info_key("k", sm_cmac_k);
1067             log_info_key("k1", k1);
1068             log_info_key("k2", k2);
1069 
1070             // step 4: set m_last
1071             int i;
1072             if (sm_cmac_last_block_complete()){
1073                 for (i=0;i<16;i++){
1074                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
1075                 }
1076             } else {
1077                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
1078                 for (i=0;i<16;i++){
1079                     if (i < valid_octets_in_last_block){
1080                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1081                         continue;
1082                     }
1083                     if (i == valid_octets_in_last_block){
1084                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1085                         continue;
1086                     }
1087                     sm_cmac_m_last[i] = k2[i];
1088                 }
1089             }
1090 
1091             // next
1092             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1093             break;
1094         }
1095         case CMAC_W4_MI:
1096             memcpy(sm_cmac_x, data, 16);
1097             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1098             break;
1099         case CMAC_W4_MLAST:
1100             // done
1101             log_info("Setting CMAC Engine to IDLE");
1102             sm_cmac_state = CMAC_IDLE;
1103             log_info_key("CMAC", data);
1104             sm_cmac_done_handler(data);
1105             break;
1106         default:
1107             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1108             break;
1109     }
1110 }
1111 #endif
1112 
1113 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1114     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1115     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1116     switch (setup->sm_stk_generation_method){
1117         case PK_RESP_INPUT:
1118             if (IS_RESPONDER(sm_conn->sm_role)){
1119                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1120                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1121             } else {
1122                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1123             }
1124             break;
1125         case PK_INIT_INPUT:
1126             if (IS_RESPONDER(sm_conn->sm_role)){
1127                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1128             } else {
1129                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1130                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1131             }
1132             break;
1133         case OK_BOTH_INPUT:
1134             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1135             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1136             break;
1137         case NK_BOTH_INPUT:
1138             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1139             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1140             break;
1141         case JUST_WORKS:
1142             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1143             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1144             break;
1145         case OOB:
1146             // client already provided OOB data, let's skip notification.
1147             break;
1148     }
1149 }
1150 
1151 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1152     int recv_flags;
1153     if (IS_RESPONDER(sm_conn->sm_role)){
1154         // slave / responder
1155         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1156     } else {
1157         // master / initiator
1158         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1159     }
1160     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1161     return recv_flags == setup->sm_key_distribution_received_set;
1162 }
1163 
1164 static void sm_done_for_handle(hci_con_handle_t con_handle){
1165     if (sm_active_connection == con_handle){
1166         sm_timeout_stop();
1167         sm_active_connection = 0;
1168         log_info("sm: connection 0x%x released setup context", con_handle);
1169     }
1170 }
1171 
1172 static int sm_key_distribution_flags_for_auth_req(void){
1173     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1174     if (sm_auth_req & SM_AUTHREQ_BONDING){
1175         // encryption information only if bonding requested
1176         flags |= SM_KEYDIST_ENC_KEY;
1177     }
1178     return flags;
1179 }
1180 
1181 static void sm_reset_setup(void){
1182     // fill in sm setup
1183     setup->sm_state_vars = 0;
1184     setup->sm_keypress_notification = 0xff;
1185     sm_reset_tk();
1186 }
1187 
1188 static void sm_init_setup(sm_connection_t * sm_conn){
1189 
1190     // fill in sm setup
1191     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1192     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1193 
1194     // query client for OOB data
1195     int have_oob_data = 0;
1196     if (sm_get_oob_data) {
1197         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1198     }
1199 
1200     sm_pairing_packet_t * local_packet;
1201     if (IS_RESPONDER(sm_conn->sm_role)){
1202         // slave
1203         local_packet = &setup->sm_s_pres;
1204         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
1205         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1206         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1207     } else {
1208         // master
1209         local_packet = &setup->sm_m_preq;
1210         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
1211         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1212         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1213 
1214         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1215         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1216         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1217     }
1218 
1219     uint8_t auth_req = sm_auth_req;
1220     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1221     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1222     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1223     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1224 }
1225 
1226 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1227 
1228     sm_pairing_packet_t * remote_packet;
1229     int                   remote_key_request;
1230     if (IS_RESPONDER(sm_conn->sm_role)){
1231         // slave / responder
1232         remote_packet      = &setup->sm_m_preq;
1233         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1234     } else {
1235         // master / initiator
1236         remote_packet      = &setup->sm_s_pres;
1237         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1238     }
1239 
1240     // check key size
1241     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1242     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1243 
1244     // decide on STK generation method
1245     sm_setup_tk();
1246     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1247 
1248     // check if STK generation method is acceptable by client
1249     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1250 
1251     // identical to responder
1252     sm_setup_key_distribution(remote_key_request);
1253 
1254     // JUST WORKS doens't provide authentication
1255     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1256 
1257     return 0;
1258 }
1259 
1260 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1261 
1262     // cache and reset context
1263     int matched_device_id = sm_address_resolution_test;
1264     address_resolution_mode_t mode = sm_address_resolution_mode;
1265     void * context = sm_address_resolution_context;
1266 
1267     // reset context
1268     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1269     sm_address_resolution_context = NULL;
1270     sm_address_resolution_test = -1;
1271     hci_con_handle_t con_handle = 0;
1272 
1273     sm_connection_t * sm_connection;
1274 #ifdef ENABLE_LE_CENTRAL
1275     sm_key_t ltk;
1276 #endif
1277     switch (mode){
1278         case ADDRESS_RESOLUTION_GENERAL:
1279             break;
1280         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1281             sm_connection = (sm_connection_t *) context;
1282             con_handle = sm_connection->sm_handle;
1283             switch (event){
1284                 case ADDRESS_RESOLUTION_SUCEEDED:
1285                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1286                     sm_connection->sm_le_db_index = matched_device_id;
1287                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1288 #ifdef ENABLE_LE_CENTRAL
1289                     if (sm_connection->sm_role) break;
1290                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1291                     sm_connection->sm_security_request_received = 0;
1292                     sm_connection->sm_bonding_requested = 0;
1293                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1294                     if (!sm_is_null_key(ltk)){
1295                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1296                     } else {
1297                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1298                     }
1299 #endif
1300                     break;
1301                 case ADDRESS_RESOLUTION_FAILED:
1302                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1303 #ifdef ENABLE_LE_CENTRAL
1304                     if (sm_connection->sm_role) break;
1305                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1306                     sm_connection->sm_security_request_received = 0;
1307                     sm_connection->sm_bonding_requested = 0;
1308                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1309 #endif
1310                     break;
1311             }
1312             break;
1313         default:
1314             break;
1315     }
1316 
1317     switch (event){
1318         case ADDRESS_RESOLUTION_SUCEEDED:
1319             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1320             break;
1321         case ADDRESS_RESOLUTION_FAILED:
1322             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1323             break;
1324     }
1325 }
1326 
1327 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1328 
1329     int le_db_index = -1;
1330 
1331     // lookup device based on IRK
1332     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1333         int i;
1334         for (i=0; i < le_device_db_count(); i++){
1335             sm_key_t irk;
1336             bd_addr_t address;
1337             int address_type;
1338             le_device_db_info(i, &address_type, address, irk);
1339             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1340                 log_info("sm: device found for IRK, updating");
1341                 le_db_index = i;
1342                 break;
1343             }
1344         }
1345     }
1346 
1347     // if not found, lookup via public address if possible
1348     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1349     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1350         int i;
1351         for (i=0; i < le_device_db_count(); i++){
1352             bd_addr_t address;
1353             int address_type;
1354             le_device_db_info(i, &address_type, address, NULL);
1355             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1356             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1357                 log_info("sm: device found for public address, updating");
1358                 le_db_index = i;
1359                 break;
1360             }
1361         }
1362     }
1363 
1364     // if not found, add to db
1365     if (le_db_index < 0) {
1366         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1367     }
1368 
1369     sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
1370 
1371     if (le_db_index >= 0){
1372 
1373 #ifdef ENABLE_LE_SIGNED_WRITE
1374         // store local CSRK
1375         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1376             log_info("sm: store local CSRK");
1377             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1378             le_device_db_local_counter_set(le_db_index, 0);
1379         }
1380 
1381         // store remote CSRK
1382         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1383             log_info("sm: store remote CSRK");
1384             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1385             le_device_db_remote_counter_set(le_db_index, 0);
1386         }
1387 #endif
1388         // store encryption information for secure connections: LTK generated by ECDH
1389         if (setup->sm_use_secure_connections){
1390             log_info("sm: store SC LTK (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1391             uint8_t zero_rand[8];
1392             memset(zero_rand, 0, 8);
1393             le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
1394                 sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1395         }
1396 
1397         // store encryption infromation for legacy pairing: peer LTK, EDIV, RAND
1398         else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
1399                && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1400             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1401             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1402                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1403 
1404         }
1405     }
1406 
1407     // keep le_db_index
1408     sm_conn->sm_le_db_index = le_db_index;
1409 }
1410 
1411 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1412     setup->sm_pairing_failed_reason = reason;
1413     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1414 }
1415 
1416 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1417     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1418 }
1419 
1420 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1421 
1422 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1423 static int sm_passkey_used(stk_generation_method_t method);
1424 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1425 
1426 static void sm_log_ec_keypair(void){
1427     log_info("Elliptic curve: X");
1428     log_info_hexdump(&ec_q[0],32);
1429     log_info("Elliptic curve: Y");
1430     log_info_hexdump(&ec_q[32],32);
1431 }
1432 
1433 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1434     if (sm_passkey_used(setup->sm_stk_generation_method)){
1435         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1436     } else {
1437         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1438     }
1439 }
1440 
1441 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1442     if (IS_RESPONDER(sm_conn->sm_role)){
1443         // Responder
1444         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1445     } else {
1446         // Initiator role
1447         switch (setup->sm_stk_generation_method){
1448             case JUST_WORKS:
1449                 sm_sc_prepare_dhkey_check(sm_conn);
1450                 break;
1451 
1452             case NK_BOTH_INPUT:
1453                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1454                 break;
1455             case PK_INIT_INPUT:
1456             case PK_RESP_INPUT:
1457             case OK_BOTH_INPUT:
1458                 if (setup->sm_passkey_bit < 20) {
1459                     sm_sc_start_calculating_local_confirm(sm_conn);
1460                 } else {
1461                     sm_sc_prepare_dhkey_check(sm_conn);
1462                 }
1463                 break;
1464             case OOB:
1465                 // TODO: implement SC OOB
1466                 break;
1467         }
1468     }
1469 }
1470 
1471 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1472     return sm_cmac_sc_buffer[offset];
1473 }
1474 
1475 static void sm_sc_cmac_done(uint8_t * hash){
1476     log_info("sm_sc_cmac_done: ");
1477     log_info_hexdump(hash, 16);
1478 
1479     sm_connection_t * sm_conn = sm_cmac_connection;
1480     sm_cmac_connection = NULL;
1481     link_key_type_t link_key_type;
1482 
1483     switch (sm_conn->sm_engine_state){
1484         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1485             memcpy(setup->sm_local_confirm, hash, 16);
1486             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1487             break;
1488         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1489             // check
1490             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1491                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1492                 break;
1493             }
1494             sm_sc_state_after_receiving_random(sm_conn);
1495             break;
1496         case SM_SC_W4_CALCULATE_G2: {
1497             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1498             big_endian_store_32(setup->sm_tk, 12, vab);
1499             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1500             sm_trigger_user_response(sm_conn);
1501             break;
1502         }
1503         case SM_SC_W4_CALCULATE_F5_SALT:
1504             memcpy(setup->sm_t, hash, 16);
1505             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1506             break;
1507         case SM_SC_W4_CALCULATE_F5_MACKEY:
1508             memcpy(setup->sm_mackey, hash, 16);
1509             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1510             break;
1511         case SM_SC_W4_CALCULATE_F5_LTK:
1512             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1513             // Errata Service Release to the Bluetooth Specification: ESR09
1514             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1515             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1516             memcpy(setup->sm_ltk, hash, 16);
1517             memcpy(setup->sm_local_ltk, hash, 16);
1518             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1519             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1520             break;
1521         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1522             memcpy(setup->sm_local_dhkey_check, hash, 16);
1523             if (IS_RESPONDER(sm_conn->sm_role)){
1524                 // responder
1525                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1526                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1527                 } else {
1528                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1529                 }
1530             } else {
1531                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1532             }
1533             break;
1534         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1535             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1536                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1537                 break;
1538             }
1539             if (IS_RESPONDER(sm_conn->sm_role)){
1540                 // responder
1541                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1542             } else {
1543                 // initiator
1544                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1545             }
1546             break;
1547         case SM_SC_W4_CALCULATE_H6_ILK:
1548             memcpy(setup->sm_t, hash, 16);
1549             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
1550             break;
1551         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
1552             reverse_128(hash, setup->sm_t);
1553             link_key_type = sm_conn->sm_connection_authenticated ?
1554                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
1555             if (IS_RESPONDER(sm_conn->sm_role)){
1556 #ifdef ENABLE_CLASSIC
1557                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
1558 #endif
1559                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
1560             } else {
1561 #ifdef ENABLE_CLASSIC
1562                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
1563 #endif
1564                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
1565             }
1566             sm_done_for_handle(sm_conn->sm_handle);
1567             break;
1568         default:
1569             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1570             break;
1571     }
1572     sm_run();
1573 }
1574 
1575 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1576     const uint16_t message_len = 65;
1577     sm_cmac_connection = sm_conn;
1578     memcpy(sm_cmac_sc_buffer, u, 32);
1579     memcpy(sm_cmac_sc_buffer+32, v, 32);
1580     sm_cmac_sc_buffer[64] = z;
1581     log_info("f4 key");
1582     log_info_hexdump(x, 16);
1583     log_info("f4 message");
1584     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1585     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1586 }
1587 
1588 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1589 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1590 static const uint8_t f5_length[] = { 0x01, 0x00};
1591 
1592 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1593 #ifdef USE_MBEDTLS_FOR_ECDH
1594     // da * Pb
1595     mbedtls_mpi d;
1596     mbedtls_ecp_point Q;
1597     mbedtls_ecp_point DH;
1598     mbedtls_mpi_init(&d);
1599     mbedtls_ecp_point_init(&Q);
1600     mbedtls_ecp_point_init(&DH);
1601     mbedtls_mpi_read_binary(&d, ec_d, 32);
1602     mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0] , 32);
1603     mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
1604     mbedtls_mpi_lset(&Q.Z, 1);
1605     mbedtls_ecp_mul(&mbedtls_ec_group, &DH, &d, &Q, NULL, NULL);
1606     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1607     mbedtls_ecp_point_free(&DH);
1608     mbedtls_mpi_free(&d);
1609     mbedtls_ecp_point_free(&Q);
1610 #endif
1611 #ifdef USE_MICROECC_FOR_ECDH
1612     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey);
1613 #endif
1614     log_info("dhkey");
1615     log_info_hexdump(dhkey, 32);
1616 }
1617 
1618 static void f5_calculate_salt(sm_connection_t * sm_conn){
1619     // calculate DHKEY
1620     sm_key256_t dhkey;
1621     sm_sc_calculate_dhkey(dhkey);
1622 
1623     // calculate salt for f5
1624     const uint16_t message_len = 32;
1625     sm_cmac_connection = sm_conn;
1626     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1627     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1628 }
1629 
1630 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1631     const uint16_t message_len = 53;
1632     sm_cmac_connection = sm_conn;
1633 
1634     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1635     sm_cmac_sc_buffer[0] = 0;
1636     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1637     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1638     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1639     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1640     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1641     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1642     log_info("f5 key");
1643     log_info_hexdump(t, 16);
1644     log_info("f5 message for MacKey");
1645     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1646     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1647 }
1648 
1649 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1650     sm_key56_t bd_addr_master, bd_addr_slave;
1651     bd_addr_master[0] =  setup->sm_m_addr_type;
1652     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1653     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1654     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1655     if (IS_RESPONDER(sm_conn->sm_role)){
1656         // responder
1657         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1658     } else {
1659         // initiator
1660         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1661     }
1662 }
1663 
1664 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1665 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1666     const uint16_t message_len = 53;
1667     sm_cmac_connection = sm_conn;
1668     sm_cmac_sc_buffer[0] = 1;
1669     // 1..52 setup before
1670     log_info("f5 key");
1671     log_info_hexdump(t, 16);
1672     log_info("f5 message for LTK");
1673     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1674     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1675 }
1676 
1677 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1678     f5_ltk(sm_conn, setup->sm_t);
1679 }
1680 
1681 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1682     const uint16_t message_len = 65;
1683     sm_cmac_connection = sm_conn;
1684     memcpy(sm_cmac_sc_buffer, n1, 16);
1685     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1686     memcpy(sm_cmac_sc_buffer+32, r, 16);
1687     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1688     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1689     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1690     log_info("f6 key");
1691     log_info_hexdump(w, 16);
1692     log_info("f6 message");
1693     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1694     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1695 }
1696 
1697 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1698 // - U is 256 bits
1699 // - V is 256 bits
1700 // - X is 128 bits
1701 // - Y is 128 bits
1702 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1703     const uint16_t message_len = 80;
1704     sm_cmac_connection = sm_conn;
1705     memcpy(sm_cmac_sc_buffer, u, 32);
1706     memcpy(sm_cmac_sc_buffer+32, v, 32);
1707     memcpy(sm_cmac_sc_buffer+64, y, 16);
1708     log_info("g2 key");
1709     log_info_hexdump(x, 16);
1710     log_info("g2 message");
1711     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1712     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1713 }
1714 
1715 static void g2_calculate(sm_connection_t * sm_conn) {
1716     // calc Va if numeric comparison
1717     if (IS_RESPONDER(sm_conn->sm_role)){
1718         // responder
1719         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1720     } else {
1721         // initiator
1722         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1723     }
1724 }
1725 
1726 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1727     uint8_t z = 0;
1728     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1729         // some form of passkey
1730         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1731         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1732         setup->sm_passkey_bit++;
1733     }
1734     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
1735 }
1736 
1737 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1738     uint8_t z = 0;
1739     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1740         // some form of passkey
1741         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1742         // sm_passkey_bit was increased before sending confirm value
1743         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1744     }
1745     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1746 }
1747 
1748 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1749     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1750 }
1751 
1752 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1753     // calculate DHKCheck
1754     sm_key56_t bd_addr_master, bd_addr_slave;
1755     bd_addr_master[0] =  setup->sm_m_addr_type;
1756     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1757     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1758     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1759     uint8_t iocap_a[3];
1760     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1761     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1762     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1763     uint8_t iocap_b[3];
1764     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1765     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1766     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1767     if (IS_RESPONDER(sm_conn->sm_role)){
1768         // responder
1769         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1770     } else {
1771         // initiator
1772         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1773     }
1774 }
1775 
1776 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1777     // validate E = f6()
1778     sm_key56_t bd_addr_master, bd_addr_slave;
1779     bd_addr_master[0] =  setup->sm_m_addr_type;
1780     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1781     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1782     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1783 
1784     uint8_t iocap_a[3];
1785     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1786     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1787     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1788     uint8_t iocap_b[3];
1789     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1790     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1791     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1792     if (IS_RESPONDER(sm_conn->sm_role)){
1793         // responder
1794         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1795     } else {
1796         // initiator
1797         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1798     }
1799 }
1800 
1801 
1802 //
1803 // Link Key Conversion Function h6
1804 //
1805 // h6(W, keyID) = AES-CMACW(keyID)
1806 // - W is 128 bits
1807 // - keyID is 32 bits
1808 static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
1809     const uint16_t message_len = 4;
1810     sm_cmac_connection = sm_conn;
1811     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
1812     log_info("h6 key");
1813     log_info_hexdump(w, 16);
1814     log_info("h6 message");
1815     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1816     sm_cmac_general_start(w, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1817 }
1818 
1819 // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1820 // Errata Service Release to the Bluetooth Specification: ESR09
1821 //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1822 //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1823 static void h6_calculate_ilk(sm_connection_t * sm_conn){
1824     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
1825 }
1826 
1827 static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
1828     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
1829 }
1830 
1831 #endif
1832 
1833 // key management legacy connections:
1834 // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1835 // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1836 // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1837 // - responder  reconnects: responder uses LTK receveived from master
1838 
1839 // key management secure connections:
1840 // - both devices store same LTK from ECDH key exchange.
1841 
1842 #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
1843 static void sm_load_security_info(sm_connection_t * sm_connection){
1844     int encryption_key_size;
1845     int authenticated;
1846     int authorized;
1847 
1848     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1849     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1850                                 &encryption_key_size, &authenticated, &authorized);
1851     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1852     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1853     sm_connection->sm_connection_authenticated = authenticated;
1854     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1855 }
1856 #endif
1857 
1858 #ifdef ENABLE_LE_PERIPHERAL
1859 static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
1860     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1861     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1862     // re-establish used key encryption size
1863     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1864     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1865     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1866     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1867     log_info("sm: received ltk request with key size %u, authenticated %u",
1868             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1869     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1870 }
1871 #endif
1872 
1873 static void sm_run(void){
1874 
1875     btstack_linked_list_iterator_t it;
1876 
1877     // assert that we can send at least commands
1878     if (!hci_can_send_command_packet_now()) return;
1879 
1880     //
1881     // non-connection related behaviour
1882     //
1883 
1884     // distributed key generation
1885     switch (dkg_state){
1886         case DKG_CALC_IRK:
1887             // already busy?
1888             if (sm_aes128_state == SM_AES128_IDLE) {
1889                 // IRK = d1(IR, 1, 0)
1890                 sm_key_t d1_prime;
1891                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1892                 dkg_next_state();
1893                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1894                 return;
1895             }
1896             break;
1897         case DKG_CALC_DHK:
1898             // already busy?
1899             if (sm_aes128_state == SM_AES128_IDLE) {
1900                 // DHK = d1(IR, 3, 0)
1901                 sm_key_t d1_prime;
1902                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1903                 dkg_next_state();
1904                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1905                 return;
1906             }
1907             break;
1908         default:
1909             break;
1910     }
1911 
1912 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1913     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1914 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
1915         sm_random_start(NULL);
1916 #else
1917         ec_key_generation_state = EC_KEY_GENERATION_W4_KEY;
1918         hci_send_cmd(&hci_le_read_local_p256_public_key);
1919 #endif
1920         return;
1921     }
1922 #endif
1923 
1924     // random address updates
1925     switch (rau_state){
1926         case RAU_GET_RANDOM:
1927             rau_next_state();
1928             sm_random_start(NULL);
1929             return;
1930         case RAU_GET_ENC:
1931             // already busy?
1932             if (sm_aes128_state == SM_AES128_IDLE) {
1933                 sm_key_t r_prime;
1934                 sm_ah_r_prime(sm_random_address, r_prime);
1935                 rau_next_state();
1936                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1937                 return;
1938             }
1939             break;
1940         case RAU_SET_ADDRESS:
1941             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1942             rau_state = RAU_IDLE;
1943             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1944             return;
1945         default:
1946             break;
1947     }
1948 
1949 #ifdef ENABLE_CMAC_ENGINE
1950     // CMAC
1951     switch (sm_cmac_state){
1952         case CMAC_CALC_SUBKEYS:
1953         case CMAC_CALC_MI:
1954         case CMAC_CALC_MLAST:
1955             // already busy?
1956             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1957             sm_cmac_handle_aes_engine_ready();
1958             return;
1959         default:
1960             break;
1961     }
1962 #endif
1963 
1964     // CSRK Lookup
1965     // -- if csrk lookup ready, find connection that require csrk lookup
1966     if (sm_address_resolution_idle()){
1967         hci_connections_get_iterator(&it);
1968         while(btstack_linked_list_iterator_has_next(&it)){
1969             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1970             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1971             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1972                 // and start lookup
1973                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1974                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1975                 break;
1976             }
1977         }
1978     }
1979 
1980     // -- if csrk lookup ready, resolved addresses for received addresses
1981     if (sm_address_resolution_idle()) {
1982         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1983             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1984             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1985             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1986             btstack_memory_sm_lookup_entry_free(entry);
1987         }
1988     }
1989 
1990     // -- Continue with CSRK device lookup by public or resolvable private address
1991     if (!sm_address_resolution_idle()){
1992         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
1993         while (sm_address_resolution_test < le_device_db_count()){
1994             int addr_type;
1995             bd_addr_t addr;
1996             sm_key_t irk;
1997             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1998             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1999 
2000             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
2001                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
2002                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2003                 break;
2004             }
2005 
2006             if (sm_address_resolution_addr_type == 0){
2007                 sm_address_resolution_test++;
2008                 continue;
2009             }
2010 
2011             if (sm_aes128_state == SM_AES128_ACTIVE) break;
2012 
2013             log_info("LE Device Lookup: calculate AH");
2014             log_info_key("IRK", irk);
2015 
2016             sm_key_t r_prime;
2017             sm_ah_r_prime(sm_address_resolution_address, r_prime);
2018             sm_address_resolution_ah_calculation_active = 1;
2019             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
2020             return;
2021         }
2022 
2023         if (sm_address_resolution_test >= le_device_db_count()){
2024             log_info("LE Device Lookup: not found");
2025             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
2026         }
2027     }
2028 
2029     // handle basic actions that don't requires the full context
2030     hci_connections_get_iterator(&it);
2031     while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
2032         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2033         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2034         switch(sm_connection->sm_engine_state){
2035             // responder side
2036             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2037                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2038                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2039                 return;
2040 
2041 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2042             case SM_SC_RECEIVED_LTK_REQUEST:
2043                 switch (sm_connection->sm_irk_lookup_state){
2044                     case IRK_LOOKUP_FAILED:
2045                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
2046                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2047                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2048                         return;
2049                     default:
2050                         break;
2051                 }
2052                 break;
2053 #endif
2054             default:
2055                 break;
2056         }
2057     }
2058 
2059     //
2060     // active connection handling
2061     // -- use loop to handle next connection if lock on setup context is released
2062 
2063     while (1) {
2064 
2065         // Find connections that requires setup context and make active if no other is locked
2066         hci_connections_get_iterator(&it);
2067         while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
2068             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2069             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2070             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
2071             int done = 1;
2072             int err;
2073             UNUSED(err);
2074             switch (sm_connection->sm_engine_state) {
2075 #ifdef ENABLE_LE_PERIPHERAL
2076                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
2077                     // send packet if possible,
2078                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
2079                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
2080                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
2081                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2082                     } else {
2083                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2084                     }
2085                     // don't lock sxetup context yet
2086                     done = 0;
2087                     break;
2088                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
2089                     sm_reset_setup();
2090                     sm_init_setup(sm_connection);
2091                     // recover pairing request
2092                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
2093                     err = sm_stk_generation_init(sm_connection);
2094                     if (err){
2095                         setup->sm_pairing_failed_reason = err;
2096                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2097                         break;
2098                     }
2099                     sm_timeout_start(sm_connection);
2100                     // generate random number first, if we need to show passkey
2101                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
2102                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
2103                         break;
2104                     }
2105                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2106                     break;
2107                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
2108                     sm_reset_setup();
2109                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
2110                     break;
2111 #endif
2112 #ifdef ENABLE_LE_CENTRAL
2113                 case SM_INITIATOR_PH0_HAS_LTK:
2114                     sm_reset_setup();
2115                     sm_load_security_info(sm_connection);
2116                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
2117                     break;
2118                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
2119                     sm_reset_setup();
2120                     sm_init_setup(sm_connection);
2121                     sm_timeout_start(sm_connection);
2122                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
2123                     break;
2124 #endif
2125 
2126 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2127                 case SM_SC_RECEIVED_LTK_REQUEST:
2128                     switch (sm_connection->sm_irk_lookup_state){
2129                         case IRK_LOOKUP_SUCCEEDED:
2130                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
2131                             // start using context by loading security info
2132                             sm_reset_setup();
2133                             sm_load_security_info(sm_connection);
2134                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
2135                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
2136                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2137                                 break;
2138                             }
2139                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
2140                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2141                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2142                             // don't lock setup context yet
2143                             return;
2144                         default:
2145                             // just wait until IRK lookup is completed
2146                             // don't lock setup context yet
2147                             done = 0;
2148                             break;
2149                     }
2150                     break;
2151 #endif
2152                 default:
2153                     done = 0;
2154                     break;
2155             }
2156             if (done){
2157                 sm_active_connection = sm_connection->sm_handle;
2158                 log_info("sm: connection 0x%04x locked setup context as %s", sm_active_connection, sm_connection->sm_role ? "responder" : "initiator");
2159             }
2160         }
2161 
2162         //
2163         // active connection handling
2164         //
2165 
2166         if (sm_active_connection == 0) return;
2167 
2168         // assert that we could send a SM PDU - not needed for all of the following
2169         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2170             l2cap_request_can_send_fix_channel_now_event(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2171             return;
2172         }
2173 
2174         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection);
2175         if (!connection) return;
2176 
2177         // send keypress notifications
2178         if (setup->sm_keypress_notification != 0xff){
2179             uint8_t buffer[2];
2180             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
2181             buffer[1] = setup->sm_keypress_notification;
2182             setup->sm_keypress_notification = 0xff;
2183             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2184             return;
2185         }
2186 
2187         sm_key_t plaintext;
2188         int key_distribution_flags;
2189         UNUSED(key_distribution_flags);
2190 
2191         log_info("sm_run: state %u", connection->sm_engine_state);
2192 
2193         switch (connection->sm_engine_state){
2194 
2195             // general
2196             case SM_GENERAL_SEND_PAIRING_FAILED: {
2197                 uint8_t buffer[2];
2198                 buffer[0] = SM_CODE_PAIRING_FAILED;
2199                 buffer[1] = setup->sm_pairing_failed_reason;
2200                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2201                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2202                 sm_done_for_handle(connection->sm_handle);
2203                 break;
2204             }
2205 
2206             // responding state
2207 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2208             case SM_SC_W2_GET_RANDOM_A:
2209                 sm_random_start(connection);
2210                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
2211                 break;
2212             case SM_SC_W2_GET_RANDOM_B:
2213                 sm_random_start(connection);
2214                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
2215                 break;
2216             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2217                 if (!sm_cmac_ready()) break;
2218                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2219                 sm_sc_calculate_local_confirm(connection);
2220                 break;
2221             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2222                 if (!sm_cmac_ready()) break;
2223                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2224                 sm_sc_calculate_remote_confirm(connection);
2225                 break;
2226             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2227                 if (!sm_cmac_ready()) break;
2228                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2229                 sm_sc_calculate_f6_for_dhkey_check(connection);
2230                 break;
2231             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2232                 if (!sm_cmac_ready()) break;
2233                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
2234                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
2235                 break;
2236             case SM_SC_W2_CALCULATE_F5_SALT:
2237                 if (!sm_cmac_ready()) break;
2238                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2239                 f5_calculate_salt(connection);
2240                 break;
2241             case SM_SC_W2_CALCULATE_F5_MACKEY:
2242                 if (!sm_cmac_ready()) break;
2243                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2244                 f5_calculate_mackey(connection);
2245                 break;
2246             case SM_SC_W2_CALCULATE_F5_LTK:
2247                 if (!sm_cmac_ready()) break;
2248                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2249                 f5_calculate_ltk(connection);
2250                 break;
2251             case SM_SC_W2_CALCULATE_G2:
2252                 if (!sm_cmac_ready()) break;
2253                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2254                 g2_calculate(connection);
2255                 break;
2256             case SM_SC_W2_CALCULATE_H6_ILK:
2257                 if (!sm_cmac_ready()) break;
2258                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
2259                 h6_calculate_ilk(connection);
2260                 break;
2261             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
2262                 if (!sm_cmac_ready()) break;
2263                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
2264                 h6_calculate_br_edr_link_key(connection);
2265                 break;
2266 #endif
2267 
2268 #ifdef ENABLE_LE_CENTRAL
2269             // initiator side
2270             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2271                 sm_key_t peer_ltk_flipped;
2272                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2273                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2274                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2275                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2276                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2277                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2278                 return;
2279             }
2280 
2281             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2282                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2283                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2284                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2285                 sm_timeout_reset(connection);
2286                 break;
2287 #endif
2288 
2289 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2290 
2291             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2292                 uint8_t buffer[65];
2293                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2294                 //
2295                 reverse_256(&ec_q[0],  &buffer[1]);
2296                 reverse_256(&ec_q[32], &buffer[33]);
2297 
2298                 // stk generation method
2299                 // passkey entry: notify app to show passkey or to request passkey
2300                 switch (setup->sm_stk_generation_method){
2301                     case JUST_WORKS:
2302                     case NK_BOTH_INPUT:
2303                         if (IS_RESPONDER(connection->sm_role)){
2304                             // responder
2305                             sm_sc_start_calculating_local_confirm(connection);
2306                         } else {
2307                             // initiator
2308                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2309                         }
2310                         break;
2311                     case PK_INIT_INPUT:
2312                     case PK_RESP_INPUT:
2313                     case OK_BOTH_INPUT:
2314                         // use random TK for display
2315                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2316                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2317                         setup->sm_passkey_bit = 0;
2318 
2319                         if (IS_RESPONDER(connection->sm_role)){
2320                             // responder
2321                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2322                         } else {
2323                             // initiator
2324                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2325                         }
2326                         sm_trigger_user_response(connection);
2327                         break;
2328                     case OOB:
2329                         // TODO: implement SC OOB
2330                         break;
2331                 }
2332 
2333                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2334                 sm_timeout_reset(connection);
2335                 break;
2336             }
2337             case SM_SC_SEND_CONFIRMATION: {
2338                 uint8_t buffer[17];
2339                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2340                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2341                 if (IS_RESPONDER(connection->sm_role)){
2342                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2343                 } else {
2344                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2345                 }
2346                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2347                 sm_timeout_reset(connection);
2348                 break;
2349             }
2350             case SM_SC_SEND_PAIRING_RANDOM: {
2351                 uint8_t buffer[17];
2352                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2353                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2354                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2355                     if (IS_RESPONDER(connection->sm_role)){
2356                         // responder
2357                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2358                     } else {
2359                         // initiator
2360                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2361                     }
2362                 } else {
2363                     if (IS_RESPONDER(connection->sm_role)){
2364                         // responder
2365                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2366                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2367                         } else {
2368                             sm_sc_prepare_dhkey_check(connection);
2369                         }
2370                     } else {
2371                         // initiator
2372                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2373                     }
2374                 }
2375                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2376                 sm_timeout_reset(connection);
2377                 break;
2378             }
2379             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2380                 uint8_t buffer[17];
2381                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2382                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2383 
2384                 if (IS_RESPONDER(connection->sm_role)){
2385                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2386                 } else {
2387                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2388                 }
2389 
2390                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2391                 sm_timeout_reset(connection);
2392                 break;
2393             }
2394 
2395 #endif
2396 
2397 #ifdef ENABLE_LE_PERIPHERAL
2398             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2399                 // echo initiator for now
2400                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2401                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2402 
2403                 if (setup->sm_use_secure_connections){
2404                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2405                     // skip LTK/EDIV for SC
2406                     log_info("sm: dropping encryption information flag");
2407                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2408                 } else {
2409                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2410                 }
2411 
2412                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2413                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2414                 // update key distribution after ENC was dropped
2415                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2416 
2417                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2418                 sm_timeout_reset(connection);
2419                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2420                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
2421                     sm_trigger_user_response(connection);
2422                 }
2423                 return;
2424 #endif
2425 
2426             case SM_PH2_SEND_PAIRING_RANDOM: {
2427                 uint8_t buffer[17];
2428                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2429                 reverse_128(setup->sm_local_random, &buffer[1]);
2430                 if (IS_RESPONDER(connection->sm_role)){
2431                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2432                 } else {
2433                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2434                 }
2435                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2436                 sm_timeout_reset(connection);
2437                 break;
2438             }
2439 
2440             case SM_PH2_GET_RANDOM_TK:
2441             case SM_PH2_C1_GET_RANDOM_A:
2442             case SM_PH2_C1_GET_RANDOM_B:
2443             case SM_PH3_GET_RANDOM:
2444             case SM_PH3_GET_DIV:
2445                 sm_next_responding_state(connection);
2446                 sm_random_start(connection);
2447                 return;
2448 
2449             case SM_PH2_C1_GET_ENC_B:
2450             case SM_PH2_C1_GET_ENC_D:
2451                 // already busy?
2452                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2453                 sm_next_responding_state(connection);
2454                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2455                 return;
2456 
2457             case SM_PH3_LTK_GET_ENC:
2458             case SM_RESPONDER_PH4_LTK_GET_ENC:
2459                 // already busy?
2460                 if (sm_aes128_state == SM_AES128_IDLE) {
2461                     sm_key_t d_prime;
2462                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2463                     sm_next_responding_state(connection);
2464                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2465                     return;
2466                 }
2467                 break;
2468 
2469             case SM_PH3_CSRK_GET_ENC:
2470                 // already busy?
2471                 if (sm_aes128_state == SM_AES128_IDLE) {
2472                     sm_key_t d_prime;
2473                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2474                     sm_next_responding_state(connection);
2475                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2476                     return;
2477                 }
2478                 break;
2479 
2480             case SM_PH2_C1_GET_ENC_C:
2481                 // already busy?
2482                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2483                 // calculate m_confirm using aes128 engine - step 1
2484                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2485                 sm_next_responding_state(connection);
2486                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2487                 break;
2488             case SM_PH2_C1_GET_ENC_A:
2489                 // already busy?
2490                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2491                 // calculate confirm using aes128 engine - step 1
2492                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2493                 sm_next_responding_state(connection);
2494                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2495                 break;
2496             case SM_PH2_CALC_STK:
2497                 // already busy?
2498                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2499                 // calculate STK
2500                 if (IS_RESPONDER(connection->sm_role)){
2501                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2502                 } else {
2503                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2504                 }
2505                 sm_next_responding_state(connection);
2506                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2507                 break;
2508             case SM_PH3_Y_GET_ENC:
2509                 // already busy?
2510                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2511                 // PH3B2 - calculate Y from      - enc
2512                 // Y = dm(DHK, Rand)
2513                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2514                 sm_next_responding_state(connection);
2515                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2516                 return;
2517             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2518                 uint8_t buffer[17];
2519                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2520                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2521                 if (IS_RESPONDER(connection->sm_role)){
2522                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2523                 } else {
2524                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2525                 }
2526                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2527                 sm_timeout_reset(connection);
2528                 return;
2529             }
2530 #ifdef ENABLE_LE_PERIPHERAL
2531             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2532                 sm_key_t stk_flipped;
2533                 reverse_128(setup->sm_ltk, stk_flipped);
2534                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2535                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2536                 return;
2537             }
2538             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
2539                 sm_key_t ltk_flipped;
2540                 reverse_128(setup->sm_ltk, ltk_flipped);
2541                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2542                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2543                 return;
2544             }
2545             case SM_RESPONDER_PH4_Y_GET_ENC:
2546                 // already busy?
2547                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2548                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2549                 // Y = dm(DHK, Rand)
2550                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2551                 sm_next_responding_state(connection);
2552                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2553                 return;
2554 #endif
2555 #ifdef ENABLE_LE_CENTRAL
2556             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2557                 sm_key_t stk_flipped;
2558                 reverse_128(setup->sm_ltk, stk_flipped);
2559                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2560                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2561                 return;
2562             }
2563 #endif
2564 
2565             case SM_PH3_DISTRIBUTE_KEYS:
2566                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2567                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2568                     uint8_t buffer[17];
2569                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2570                     reverse_128(setup->sm_ltk, &buffer[1]);
2571                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2572                     sm_timeout_reset(connection);
2573                     return;
2574                 }
2575                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2576                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2577                     uint8_t buffer[11];
2578                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2579                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2580                     reverse_64(setup->sm_local_rand, &buffer[3]);
2581                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2582                     sm_timeout_reset(connection);
2583                     return;
2584                 }
2585                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2586                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2587                     uint8_t buffer[17];
2588                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2589                     reverse_128(sm_persistent_irk, &buffer[1]);
2590                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2591                     sm_timeout_reset(connection);
2592                     return;
2593                 }
2594                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2595                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2596                     bd_addr_t local_address;
2597                     uint8_t buffer[8];
2598                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2599                     gap_le_get_own_address(&buffer[1], local_address);
2600                     reverse_bd_addr(local_address, &buffer[2]);
2601                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2602                     sm_timeout_reset(connection);
2603                     return;
2604                 }
2605                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2606                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2607 
2608                     // hack to reproduce test runs
2609                     if (test_use_fixed_local_csrk){
2610                         memset(setup->sm_local_csrk, 0xcc, 16);
2611                     }
2612 
2613                     uint8_t buffer[17];
2614                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2615                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2616                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2617                     sm_timeout_reset(connection);
2618                     return;
2619                 }
2620 
2621                 // keys are sent
2622                 if (IS_RESPONDER(connection->sm_role)){
2623                     // slave -> receive master keys if any
2624                     if (sm_key_distribution_all_received(connection)){
2625                         sm_key_distribution_handle_all_received(connection);
2626                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2627                         sm_done_for_handle(connection->sm_handle);
2628                     } else {
2629                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2630                     }
2631                 } else {
2632                     // master -> all done
2633                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2634                     sm_done_for_handle(connection->sm_handle);
2635                 }
2636                 break;
2637 
2638             default:
2639                 break;
2640         }
2641 
2642         // check again if active connection was released
2643         if (sm_active_connection) break;
2644     }
2645 }
2646 
2647 // note: aes engine is ready as we just got the aes result
2648 static void sm_handle_encryption_result(uint8_t * data){
2649 
2650     sm_aes128_state = SM_AES128_IDLE;
2651 
2652     if (sm_address_resolution_ah_calculation_active){
2653         sm_address_resolution_ah_calculation_active = 0;
2654         // compare calulated address against connecting device
2655         uint8_t hash[3];
2656         reverse_24(data, hash);
2657         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2658             log_info("LE Device Lookup: matched resolvable private address");
2659             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2660             return;
2661         }
2662         // no match, try next
2663         sm_address_resolution_test++;
2664         return;
2665     }
2666 
2667     switch (dkg_state){
2668         case DKG_W4_IRK:
2669             reverse_128(data, sm_persistent_irk);
2670             log_info_key("irk", sm_persistent_irk);
2671             dkg_next_state();
2672             return;
2673         case DKG_W4_DHK:
2674             reverse_128(data, sm_persistent_dhk);
2675             log_info_key("dhk", sm_persistent_dhk);
2676             dkg_next_state();
2677             // SM Init Finished
2678             return;
2679         default:
2680             break;
2681     }
2682 
2683     switch (rau_state){
2684         case RAU_W4_ENC:
2685             reverse_24(data, &sm_random_address[3]);
2686             rau_next_state();
2687             return;
2688         default:
2689             break;
2690     }
2691 
2692 #ifdef ENABLE_CMAC_ENGINE
2693     switch (sm_cmac_state){
2694         case CMAC_W4_SUBKEYS:
2695         case CMAC_W4_MI:
2696         case CMAC_W4_MLAST:
2697             {
2698             sm_key_t t;
2699             reverse_128(data, t);
2700             sm_cmac_handle_encryption_result(t);
2701             }
2702             return;
2703         default:
2704             break;
2705     }
2706 #endif
2707 
2708     // retrieve sm_connection provided to sm_aes128_start_encryption
2709     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2710     if (!connection) return;
2711     switch (connection->sm_engine_state){
2712         case SM_PH2_C1_W4_ENC_A:
2713         case SM_PH2_C1_W4_ENC_C:
2714             {
2715             sm_key_t t2;
2716             reverse_128(data, t2);
2717             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2718             }
2719             sm_next_responding_state(connection);
2720             return;
2721         case SM_PH2_C1_W4_ENC_B:
2722             reverse_128(data, setup->sm_local_confirm);
2723             log_info_key("c1!", setup->sm_local_confirm);
2724             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2725             return;
2726         case SM_PH2_C1_W4_ENC_D:
2727             {
2728             sm_key_t peer_confirm_test;
2729             reverse_128(data, peer_confirm_test);
2730             log_info_key("c1!", peer_confirm_test);
2731             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2732                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2733                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2734                 return;
2735             }
2736             if (IS_RESPONDER(connection->sm_role)){
2737                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2738             } else {
2739                 connection->sm_engine_state = SM_PH2_CALC_STK;
2740             }
2741             }
2742             return;
2743         case SM_PH2_W4_STK:
2744             reverse_128(data, setup->sm_ltk);
2745             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2746             log_info_key("stk", setup->sm_ltk);
2747             if (IS_RESPONDER(connection->sm_role)){
2748                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2749             } else {
2750                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2751             }
2752             return;
2753         case SM_PH3_Y_W4_ENC:{
2754             sm_key_t y128;
2755             reverse_128(data, y128);
2756             setup->sm_local_y = big_endian_read_16(y128, 14);
2757             log_info_hex16("y", setup->sm_local_y);
2758             // PH3B3 - calculate EDIV
2759             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2760             log_info_hex16("ediv", setup->sm_local_ediv);
2761             // PH3B4 - calculate LTK         - enc
2762             // LTK = d1(ER, DIV, 0))
2763             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2764             return;
2765         }
2766         case SM_RESPONDER_PH4_Y_W4_ENC:{
2767             sm_key_t y128;
2768             reverse_128(data, y128);
2769             setup->sm_local_y = big_endian_read_16(y128, 14);
2770             log_info_hex16("y", setup->sm_local_y);
2771 
2772             // PH3B3 - calculate DIV
2773             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2774             log_info_hex16("ediv", setup->sm_local_ediv);
2775             // PH3B4 - calculate LTK         - enc
2776             // LTK = d1(ER, DIV, 0))
2777             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2778             return;
2779         }
2780         case SM_PH3_LTK_W4_ENC:
2781             reverse_128(data, setup->sm_ltk);
2782             log_info_key("ltk", setup->sm_ltk);
2783             // calc CSRK next
2784             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2785             return;
2786         case SM_PH3_CSRK_W4_ENC:
2787             reverse_128(data, setup->sm_local_csrk);
2788             log_info_key("csrk", setup->sm_local_csrk);
2789             if (setup->sm_key_distribution_send_set){
2790                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2791             } else {
2792                 // no keys to send, just continue
2793                 if (IS_RESPONDER(connection->sm_role)){
2794                     // slave -> receive master keys
2795                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2796                 } else {
2797                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
2798                         connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
2799                     } else {
2800                         // master -> all done
2801                         connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2802                         sm_done_for_handle(connection->sm_handle);
2803                     }
2804                 }
2805             }
2806             return;
2807 #ifdef ENABLE_LE_PERIPHERAL
2808         case SM_RESPONDER_PH4_LTK_W4_ENC:
2809             reverse_128(data, setup->sm_ltk);
2810             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2811             log_info_key("ltk", setup->sm_ltk);
2812             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2813             return;
2814 #endif
2815         default:
2816             break;
2817     }
2818 }
2819 
2820 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2821 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
2822 #if !defined(WICED_VERSION) || defined(USE_MBEDTLS_FOR_ECDH)
2823 // @return OK
2824 static int sm_generate_f_rng(unsigned char * buffer, unsigned size){
2825     if (ec_key_generation_state != EC_KEY_GENERATION_ACTIVE) return 0;
2826     int offset = setup->sm_passkey_bit;
2827     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2828     while (size) {
2829         *buffer++ = setup->sm_peer_q[offset++];
2830         size--;
2831     }
2832     setup->sm_passkey_bit = offset;
2833     return 1;
2834 }
2835 #endif
2836 #ifdef USE_MBEDTLS_FOR_ECDH
2837 // @return error
2838 static int sm_generate_f_rng_mbedtls(void * context, unsigned char * buffer, size_t size){
2839     UNUSED(context);
2840     return sm_generate_f_rng(buffer, size) == 1;
2841 }
2842 #endif
2843 #endif
2844 #endif
2845 
2846 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2847 static void sm_handle_random_result(uint8_t * data){
2848 
2849 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2850 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
2851 
2852     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2853         int num_bytes = setup->sm_passkey_bit;
2854         memcpy(&setup->sm_peer_q[num_bytes], data, 8);
2855         num_bytes += 8;
2856         setup->sm_passkey_bit = num_bytes;
2857 
2858         if (num_bytes >= 64){
2859 
2860             // init pre-generated random data from sm_peer_q
2861             setup->sm_passkey_bit = 0;
2862 
2863             // generate EC key
2864 #ifdef USE_MBEDTLS_FOR_ECDH
2865             mbedtls_mpi d;
2866             mbedtls_ecp_point P;
2867             mbedtls_mpi_init(&d);
2868             mbedtls_ecp_point_init(&P);
2869             int res = mbedtls_ecp_gen_keypair(&mbedtls_ec_group, &d, &P, &sm_generate_f_rng_mbedtls, NULL);
2870             log_info("gen keypair %x", res);
2871             mbedtls_mpi_write_binary(&P.X, &ec_q[0],  32);
2872             mbedtls_mpi_write_binary(&P.Y, &ec_q[32], 32);
2873             mbedtls_mpi_write_binary(&d, ec_d, 32);
2874             mbedtls_ecp_point_free(&P);
2875             mbedtls_mpi_free(&d);
2876 #endif
2877 #ifdef USE_MICROECC_FOR_ECDH
2878 #ifndef WICED_VERSION
2879             // micro-ecc from WICED SDK uses its wiced_crypto_get_random by default
2880             uECC_set_rng(&sm_generate_f_rng);
2881 #endif
2882             uECC_make_key(ec_q, ec_d);
2883 #endif
2884 
2885             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2886             log_info("Elliptic curve: d");
2887             log_info_hexdump(ec_d,32);
2888             sm_log_ec_keypair();
2889         }
2890     }
2891 #endif
2892 #endif
2893 
2894     switch (rau_state){
2895         case RAU_W4_RANDOM:
2896             // non-resolvable vs. resolvable
2897             switch (gap_random_adress_type){
2898                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2899                     // resolvable: use random as prand and calc address hash
2900                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2901                     memcpy(sm_random_address, data, 3);
2902                     sm_random_address[0] &= 0x3f;
2903                     sm_random_address[0] |= 0x40;
2904                     rau_state = RAU_GET_ENC;
2905                     break;
2906                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2907                 default:
2908                     // "The two most significant bits of the address shall be equal to ‘0’""
2909                     memcpy(sm_random_address, data, 6);
2910                     sm_random_address[0] &= 0x3f;
2911                     rau_state = RAU_SET_ADDRESS;
2912                     break;
2913             }
2914             return;
2915         default:
2916             break;
2917     }
2918 
2919     // retrieve sm_connection provided to sm_random_start
2920     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2921     if (!connection) return;
2922     switch (connection->sm_engine_state){
2923 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2924         case SM_SC_W4_GET_RANDOM_A:
2925             memcpy(&setup->sm_local_nonce[0], data, 8);
2926             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2927             break;
2928         case SM_SC_W4_GET_RANDOM_B:
2929             memcpy(&setup->sm_local_nonce[8], data, 8);
2930             // initiator & jw/nc -> send pairing random
2931             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2932                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2933                 break;
2934             } else {
2935                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2936             }
2937             break;
2938 #endif
2939 
2940         case SM_PH2_W4_RANDOM_TK:
2941         {
2942             // map random to 0-999999 without speding much cycles on a modulus operation
2943             uint32_t tk = little_endian_read_32(data,0);
2944             tk = tk & 0xfffff;  // 1048575
2945             if (tk >= 999999){
2946                 tk = tk - 999999;
2947             }
2948             sm_reset_tk();
2949             big_endian_store_32(setup->sm_tk, 12, tk);
2950             if (IS_RESPONDER(connection->sm_role)){
2951                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2952             } else {
2953                 if (setup->sm_use_secure_connections){
2954                     connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
2955                 } else {
2956                     connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2957                     sm_trigger_user_response(connection);
2958                     // response_idle == nothing <--> sm_trigger_user_response() did not require response
2959                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2960                         connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2961                     }
2962                 }
2963             }
2964             return;
2965         }
2966         case SM_PH2_C1_W4_RANDOM_A:
2967             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2968             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2969             return;
2970         case SM_PH2_C1_W4_RANDOM_B:
2971             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
2972             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2973             return;
2974         case SM_PH3_W4_RANDOM:
2975             reverse_64(data, setup->sm_local_rand);
2976             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2977             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2978             // no db for authenticated flag hack: store flag in bit 4 of LSB
2979             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2980             connection->sm_engine_state = SM_PH3_GET_DIV;
2981             return;
2982         case SM_PH3_W4_DIV:
2983             // use 16 bit from random value as div
2984             setup->sm_local_div = big_endian_read_16(data, 0);
2985             log_info_hex16("div", setup->sm_local_div);
2986             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2987             return;
2988         default:
2989             break;
2990     }
2991 }
2992 
2993 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2994 
2995     UNUSED(channel);
2996     UNUSED(size);
2997 
2998     sm_connection_t  * sm_conn;
2999     hci_con_handle_t con_handle;
3000 
3001     switch (packet_type) {
3002 
3003 		case HCI_EVENT_PACKET:
3004 			switch (hci_event_packet_get_type(packet)) {
3005 
3006                 case BTSTACK_EVENT_STATE:
3007 					// bt stack activated, get started
3008 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
3009                         log_info("HCI Working!");
3010 
3011                         // set local addr for le device db
3012                         bd_addr_t local_bd_addr;
3013                         gap_local_bd_addr(local_bd_addr);
3014                         le_device_db_set_local_bd_addr(local_bd_addr);
3015 
3016                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
3017 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3018                         if (!sm_have_ec_keypair){
3019                             setup->sm_passkey_bit = 0;
3020                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
3021                         }
3022 #endif
3023                         // trigger Random Address generation if requested before
3024                         switch (gap_random_adress_type){
3025                             case GAP_RANDOM_ADDRESS_TYPE_OFF:
3026                                 rau_state = RAU_IDLE;
3027                                 break;
3028                             case GAP_RANDOM_ADDRESS_TYPE_STATIC:
3029                                 rau_state = RAU_SET_ADDRESS;
3030                                 break;
3031                             default:
3032                                 rau_state = RAU_GET_RANDOM;
3033                                 break;
3034                         }
3035                         sm_run();
3036 					}
3037 					break;
3038 
3039                 case HCI_EVENT_LE_META:
3040                     switch (packet[2]) {
3041                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
3042 
3043                             log_info("sm: connected");
3044 
3045                             if (packet[3]) return; // connection failed
3046 
3047                             con_handle = little_endian_read_16(packet, 4);
3048                             sm_conn = sm_get_connection_for_handle(con_handle);
3049                             if (!sm_conn) break;
3050 
3051                             sm_conn->sm_handle = con_handle;
3052                             sm_conn->sm_role = packet[6];
3053                             sm_conn->sm_peer_addr_type = packet[7];
3054                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
3055 
3056                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
3057 
3058                             // reset security properties
3059                             sm_conn->sm_connection_encrypted = 0;
3060                             sm_conn->sm_connection_authenticated = 0;
3061                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
3062                             sm_conn->sm_le_db_index = -1;
3063 
3064                             // prepare CSRK lookup (does not involve setup)
3065                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
3066 
3067                             // just connected -> everything else happens in sm_run()
3068                             if (IS_RESPONDER(sm_conn->sm_role)){
3069                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
3070                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3071                                     if (sm_slave_request_security) {
3072                                         // request security if requested by app
3073                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3074                                     } else {
3075                                         // otherwise, wait for pairing request
3076                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3077                                     }
3078                                 }
3079                                 break;
3080                             } else {
3081                                 // master
3082                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3083                             }
3084                             break;
3085 
3086                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
3087                             con_handle = little_endian_read_16(packet, 3);
3088                             sm_conn = sm_get_connection_for_handle(con_handle);
3089                             if (!sm_conn) break;
3090 
3091                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
3092                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
3093                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
3094                                 break;
3095                             }
3096                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
3097                                 // PH2 SEND LTK as we need to exchange keys in PH3
3098                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
3099                                 break;
3100                             }
3101 
3102                             // store rand and ediv
3103                             reverse_64(&packet[5], sm_conn->sm_local_rand);
3104                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
3105 
3106                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
3107                             // potentially stored LTK is from the master
3108                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
3109                                 sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
3110                                 break;
3111                             }
3112 
3113 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3114                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
3115 #else
3116                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
3117                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
3118 #endif
3119                             break;
3120 
3121 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3122                         case HCI_SUBEVENT_LE_READ_LOCAL_P256_PUBLIC_KEY_COMPLETE:
3123                             if (hci_subevent_le_read_local_p256_public_key_complete_get_status(packet)){
3124                                 log_error("Read Local P256 Public Key failed");
3125                                 break;
3126                             }
3127                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_x(packet, &ec_q[0]);
3128                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_y(packet, &ec_q[32]);
3129                             ec_key_generation_state = EC_KEY_GENERATION_DONE;
3130                             sm_log_ec_keypair();
3131                             break;
3132 #endif
3133                         default:
3134                             break;
3135                     }
3136                     break;
3137 
3138                 case HCI_EVENT_ENCRYPTION_CHANGE:
3139                     con_handle = little_endian_read_16(packet, 3);
3140                     sm_conn = sm_get_connection_for_handle(con_handle);
3141                     if (!sm_conn) break;
3142 
3143                     sm_conn->sm_connection_encrypted = packet[5];
3144                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
3145                         sm_conn->sm_actual_encryption_key_size);
3146                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3147                     if (!sm_conn->sm_connection_encrypted) break;
3148                     // continue if part of initial pairing
3149                     switch (sm_conn->sm_engine_state){
3150                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3151                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3152                             sm_done_for_handle(sm_conn->sm_handle);
3153                             break;
3154                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3155                             if (IS_RESPONDER(sm_conn->sm_role)){
3156                                 // slave
3157                                 if (setup->sm_use_secure_connections){
3158                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3159                                 } else {
3160                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3161                                 }
3162                             } else {
3163                                 // master
3164                                 if (sm_key_distribution_all_received(sm_conn)){
3165                                     // skip receiving keys as there are none
3166                                     sm_key_distribution_handle_all_received(sm_conn);
3167                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3168                                 } else {
3169                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3170                                 }
3171                             }
3172                             break;
3173                         default:
3174                             break;
3175                     }
3176                     break;
3177 
3178                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
3179                     con_handle = little_endian_read_16(packet, 3);
3180                     sm_conn = sm_get_connection_for_handle(con_handle);
3181                     if (!sm_conn) break;
3182 
3183                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
3184                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3185                     // continue if part of initial pairing
3186                     switch (sm_conn->sm_engine_state){
3187                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3188                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3189                             sm_done_for_handle(sm_conn->sm_handle);
3190                             break;
3191                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3192                             if (IS_RESPONDER(sm_conn->sm_role)){
3193                                 // slave
3194                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3195                             } else {
3196                                 // master
3197                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3198                             }
3199                             break;
3200                         default:
3201                             break;
3202                     }
3203                     break;
3204 
3205 
3206                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3207                     con_handle = little_endian_read_16(packet, 3);
3208                     sm_done_for_handle(con_handle);
3209                     sm_conn = sm_get_connection_for_handle(con_handle);
3210                     if (!sm_conn) break;
3211 
3212                     // delete stored bonding on disconnect with authentication failure in ph0
3213                     if (sm_conn->sm_role == 0
3214                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
3215                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
3216                         le_device_db_remove(sm_conn->sm_le_db_index);
3217                     }
3218 
3219                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
3220                     sm_conn->sm_handle = 0;
3221                     break;
3222 
3223 				case HCI_EVENT_COMMAND_COMPLETE:
3224                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
3225                         sm_handle_encryption_result(&packet[6]);
3226                         break;
3227                     }
3228                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
3229                         sm_handle_random_result(&packet[6]);
3230                         break;
3231                     }
3232                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
3233                         // Hack for Nordic nRF5 series that doesn't have public address:
3234                         // - with patches from port/nrf5-zephyr, hci_read_bd_addr returns random static address
3235                         // - we use this as default for advertisements/connections
3236                         if (hci_get_manufacturer() == BLUETOOTH_COMPANY_ID_NORDIC_SEMICONDUCTOR_ASA){
3237                             log_info("nRF5: using (fake) public address as random static address");
3238                             bd_addr_t addr;
3239                             reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
3240                             gap_random_address_set(addr);
3241                         }
3242                     }
3243                     break;
3244                 default:
3245                     break;
3246 			}
3247             break;
3248         default:
3249             break;
3250 	}
3251 
3252     sm_run();
3253 }
3254 
3255 static inline int sm_calc_actual_encryption_key_size(int other){
3256     if (other < sm_min_encryption_key_size) return 0;
3257     if (other < sm_max_encryption_key_size) return other;
3258     return sm_max_encryption_key_size;
3259 }
3260 
3261 
3262 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3263 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3264     switch (method){
3265         case JUST_WORKS:
3266         case NK_BOTH_INPUT:
3267             return 1;
3268         default:
3269             return 0;
3270     }
3271 }
3272 // responder
3273 
3274 static int sm_passkey_used(stk_generation_method_t method){
3275     switch (method){
3276         case PK_RESP_INPUT:
3277             return 1;
3278         default:
3279             return 0;
3280     }
3281 }
3282 #endif
3283 
3284 /**
3285  * @return ok
3286  */
3287 static int sm_validate_stk_generation_method(void){
3288     // check if STK generation method is acceptable by client
3289     switch (setup->sm_stk_generation_method){
3290         case JUST_WORKS:
3291             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
3292         case PK_RESP_INPUT:
3293         case PK_INIT_INPUT:
3294         case OK_BOTH_INPUT:
3295             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
3296         case OOB:
3297             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3298         case NK_BOTH_INPUT:
3299             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3300             return 1;
3301         default:
3302             return 0;
3303     }
3304 }
3305 
3306 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
3307 
3308     UNUSED(size);
3309 
3310     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3311         sm_run();
3312     }
3313 
3314     if (packet_type != SM_DATA_PACKET) return;
3315 
3316     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3317     if (!sm_conn) return;
3318 
3319     if (packet[0] == SM_CODE_PAIRING_FAILED){
3320         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
3321         return;
3322     }
3323 
3324     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
3325 
3326     int err;
3327     UNUSED(err);
3328 
3329     if (packet[0] == SM_CODE_KEYPRESS_NOTIFICATION){
3330         uint8_t buffer[5];
3331         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
3332         buffer[1] = 3;
3333         little_endian_store_16(buffer, 2, con_handle);
3334         buffer[4] = packet[1];
3335         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
3336         return;
3337     }
3338 
3339     switch (sm_conn->sm_engine_state){
3340 
3341         // a sm timeout requries a new physical connection
3342         case SM_GENERAL_TIMEOUT:
3343             return;
3344 
3345 #ifdef ENABLE_LE_CENTRAL
3346 
3347         // Initiator
3348         case SM_INITIATOR_CONNECTED:
3349             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3350                 sm_pdu_received_in_wrong_state(sm_conn);
3351                 break;
3352             }
3353             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
3354                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3355                 break;
3356             }
3357             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3358                 sm_key_t ltk;
3359                 le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
3360                 if (!sm_is_null_key(ltk)){
3361                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3362                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3363                 } else {
3364                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3365                 }
3366                 break;
3367             }
3368             // otherwise, store security request
3369             sm_conn->sm_security_request_received = 1;
3370             break;
3371 
3372         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3373             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
3374                 sm_pdu_received_in_wrong_state(sm_conn);
3375                 break;
3376             }
3377             // store pairing request
3378             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3379             err = sm_stk_generation_init(sm_conn);
3380             if (err){
3381                 setup->sm_pairing_failed_reason = err;
3382                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3383                 break;
3384             }
3385 
3386             // generate random number first, if we need to show passkey
3387             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3388                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3389                 break;
3390             }
3391 
3392 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3393             if (setup->sm_use_secure_connections){
3394                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3395                 if (setup->sm_stk_generation_method == JUST_WORKS){
3396                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3397                     sm_trigger_user_response(sm_conn);
3398                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3399                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3400                     }
3401                 } else {
3402                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3403                 }
3404                 break;
3405             }
3406 #endif
3407             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3408             sm_trigger_user_response(sm_conn);
3409             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3410             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3411                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3412             }
3413             break;
3414 
3415         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3416             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3417                 sm_pdu_received_in_wrong_state(sm_conn);
3418                 break;
3419             }
3420 
3421             // store s_confirm
3422             reverse_128(&packet[1], setup->sm_peer_confirm);
3423             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3424             break;
3425 
3426         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3427             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3428                 sm_pdu_received_in_wrong_state(sm_conn);
3429                 break;;
3430             }
3431 
3432             // received random value
3433             reverse_128(&packet[1], setup->sm_peer_random);
3434             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3435             break;
3436 #endif
3437 
3438 #ifdef ENABLE_LE_PERIPHERAL
3439         // Responder
3440         case SM_RESPONDER_IDLE:
3441         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3442         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3443             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3444                 sm_pdu_received_in_wrong_state(sm_conn);
3445                 break;;
3446             }
3447 
3448             // store pairing request
3449             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3450             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3451             break;
3452 #endif
3453 
3454 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3455         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3456             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3457                 sm_pdu_received_in_wrong_state(sm_conn);
3458                 break;
3459             }
3460 
3461             // store public key for DH Key calculation
3462             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3463             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3464 
3465             // validate public key
3466             err = 0;
3467 
3468 #ifdef USE_MBEDTLS_FOR_ECDH
3469             mbedtls_ecp_point Q;
3470             mbedtls_ecp_point_init( &Q );
3471             mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0], 32);
3472             mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
3473             mbedtls_mpi_lset(&Q.Z, 1);
3474             err = mbedtls_ecp_check_pubkey(&mbedtls_ec_group, &Q);
3475             mbedtls_ecp_point_free( & Q);
3476 #endif
3477 #ifdef USE_MICROECC_FOR_ECDH
3478             err = uECC_valid_public_key(setup->sm_peer_q) == 0;
3479 #endif
3480 
3481             if (err){
3482                 log_error("sm: peer public key invalid %x", err);
3483                 // uses "unspecified reason", there is no "public key invalid" error code
3484                 sm_pdu_received_in_wrong_state(sm_conn);
3485                 break;
3486             }
3487 
3488             if (IS_RESPONDER(sm_conn->sm_role)){
3489                 // responder
3490                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3491             } else {
3492                 // initiator
3493                 // stk generation method
3494                 // passkey entry: notify app to show passkey or to request passkey
3495                 switch (setup->sm_stk_generation_method){
3496                     case JUST_WORKS:
3497                     case NK_BOTH_INPUT:
3498                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3499                         break;
3500                     case PK_RESP_INPUT:
3501                         sm_sc_start_calculating_local_confirm(sm_conn);
3502                         break;
3503                     case PK_INIT_INPUT:
3504                     case OK_BOTH_INPUT:
3505                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3506                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3507                             break;
3508                         }
3509                         sm_sc_start_calculating_local_confirm(sm_conn);
3510                         break;
3511                     case OOB:
3512                         // TODO: implement SC OOB
3513                         break;
3514                 }
3515             }
3516             break;
3517 
3518         case SM_SC_W4_CONFIRMATION:
3519             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3520                 sm_pdu_received_in_wrong_state(sm_conn);
3521                 break;
3522             }
3523             // received confirm value
3524             reverse_128(&packet[1], setup->sm_peer_confirm);
3525 
3526             if (IS_RESPONDER(sm_conn->sm_role)){
3527                 // responder
3528                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3529                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3530                         // still waiting for passkey
3531                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3532                         break;
3533                     }
3534                 }
3535                 sm_sc_start_calculating_local_confirm(sm_conn);
3536             } else {
3537                 // initiator
3538                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3539                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3540                 } else {
3541                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3542                 }
3543             }
3544             break;
3545 
3546         case SM_SC_W4_PAIRING_RANDOM:
3547             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3548                 sm_pdu_received_in_wrong_state(sm_conn);
3549                 break;
3550             }
3551 
3552             // received random value
3553             reverse_128(&packet[1], setup->sm_peer_nonce);
3554 
3555             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3556             // only check for JUST WORK/NC in initiator role AND passkey entry
3557             if (sm_conn->sm_role || sm_passkey_used(setup->sm_stk_generation_method)) {
3558                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3559             }
3560 
3561             sm_sc_state_after_receiving_random(sm_conn);
3562             break;
3563 
3564         case SM_SC_W2_CALCULATE_G2:
3565         case SM_SC_W4_CALCULATE_G2:
3566         case SM_SC_W2_CALCULATE_F5_SALT:
3567         case SM_SC_W4_CALCULATE_F5_SALT:
3568         case SM_SC_W2_CALCULATE_F5_MACKEY:
3569         case SM_SC_W4_CALCULATE_F5_MACKEY:
3570         case SM_SC_W2_CALCULATE_F5_LTK:
3571         case SM_SC_W4_CALCULATE_F5_LTK:
3572         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3573         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3574         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3575             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3576                 sm_pdu_received_in_wrong_state(sm_conn);
3577                 break;
3578             }
3579             // store DHKey Check
3580             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3581             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3582 
3583             // have we been only waiting for dhkey check command?
3584             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3585                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3586             }
3587             break;
3588 #endif
3589 
3590 #ifdef ENABLE_LE_PERIPHERAL
3591         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3592             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3593                 sm_pdu_received_in_wrong_state(sm_conn);
3594                 break;
3595             }
3596 
3597             // received confirm value
3598             reverse_128(&packet[1], setup->sm_peer_confirm);
3599 
3600             // notify client to hide shown passkey
3601             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3602                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3603             }
3604 
3605             // handle user cancel pairing?
3606             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3607                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3608                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3609                 break;
3610             }
3611 
3612             // wait for user action?
3613             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3614                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3615                 break;
3616             }
3617 
3618             // calculate and send local_confirm
3619             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3620             break;
3621 
3622         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3623             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3624                 sm_pdu_received_in_wrong_state(sm_conn);
3625                 break;;
3626             }
3627 
3628             // received random value
3629             reverse_128(&packet[1], setup->sm_peer_random);
3630             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3631             break;
3632 #endif
3633 
3634         case SM_PH3_RECEIVE_KEYS:
3635             switch(packet[0]){
3636                 case SM_CODE_ENCRYPTION_INFORMATION:
3637                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3638                     reverse_128(&packet[1], setup->sm_peer_ltk);
3639                     break;
3640 
3641                 case SM_CODE_MASTER_IDENTIFICATION:
3642                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3643                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3644                     reverse_64(&packet[3], setup->sm_peer_rand);
3645                     break;
3646 
3647                 case SM_CODE_IDENTITY_INFORMATION:
3648                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3649                     reverse_128(&packet[1], setup->sm_peer_irk);
3650                     break;
3651 
3652                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3653                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3654                     setup->sm_peer_addr_type = packet[1];
3655                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3656                     break;
3657 
3658                 case SM_CODE_SIGNING_INFORMATION:
3659                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3660                     reverse_128(&packet[1], setup->sm_peer_csrk);
3661                     break;
3662                 default:
3663                     // Unexpected PDU
3664                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3665                     break;
3666             }
3667             // done with key distribution?
3668             if (sm_key_distribution_all_received(sm_conn)){
3669 
3670                 sm_key_distribution_handle_all_received(sm_conn);
3671 
3672                 if (IS_RESPONDER(sm_conn->sm_role)){
3673                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
3674                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
3675                     } else {
3676                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3677                         sm_done_for_handle(sm_conn->sm_handle);
3678                     }
3679                 } else {
3680                     if (setup->sm_use_secure_connections){
3681                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3682                     } else {
3683                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3684                     }
3685                 }
3686             }
3687             break;
3688         default:
3689             // Unexpected PDU
3690             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3691             break;
3692     }
3693 
3694     // try to send preparared packet
3695     sm_run();
3696 }
3697 
3698 // Security Manager Client API
3699 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3700     sm_get_oob_data = get_oob_data_callback;
3701 }
3702 
3703 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3704     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3705 }
3706 
3707 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3708     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3709 }
3710 
3711 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3712 	sm_min_encryption_key_size = min_size;
3713 	sm_max_encryption_key_size = max_size;
3714 }
3715 
3716 void sm_set_authentication_requirements(uint8_t auth_req){
3717     sm_auth_req = auth_req;
3718 }
3719 
3720 void sm_set_io_capabilities(io_capability_t io_capability){
3721     sm_io_capabilities = io_capability;
3722 }
3723 
3724 #ifdef ENABLE_LE_PERIPHERAL
3725 void sm_set_request_security(int enable){
3726     sm_slave_request_security = enable;
3727 }
3728 #endif
3729 
3730 void sm_set_er(sm_key_t er){
3731     memcpy(sm_persistent_er, er, 16);
3732 }
3733 
3734 void sm_set_ir(sm_key_t ir){
3735     memcpy(sm_persistent_ir, ir, 16);
3736 }
3737 
3738 // Testing support only
3739 void sm_test_set_irk(sm_key_t irk){
3740     memcpy(sm_persistent_irk, irk, 16);
3741     sm_persistent_irk_ready = 1;
3742 }
3743 
3744 void sm_test_use_fixed_local_csrk(void){
3745     test_use_fixed_local_csrk = 1;
3746 }
3747 
3748 void sm_init(void){
3749     // set some (BTstack default) ER and IR
3750     int i;
3751     sm_key_t er;
3752     sm_key_t ir;
3753     for (i=0;i<16;i++){
3754         er[i] = 0x30 + i;
3755         ir[i] = 0x90 + i;
3756     }
3757     sm_set_er(er);
3758     sm_set_ir(ir);
3759     // defaults
3760     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3761                                        | SM_STK_GENERATION_METHOD_OOB
3762                                        | SM_STK_GENERATION_METHOD_PASSKEY
3763                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3764 
3765     sm_max_encryption_key_size = 16;
3766     sm_min_encryption_key_size = 7;
3767 
3768 #ifdef ENABLE_CMAC_ENGINE
3769     sm_cmac_state  = CMAC_IDLE;
3770 #endif
3771     dkg_state = DKG_W4_WORKING;
3772     rau_state = RAU_W4_WORKING;
3773     sm_aes128_state = SM_AES128_IDLE;
3774     sm_address_resolution_test = -1;    // no private address to resolve yet
3775     sm_address_resolution_ah_calculation_active = 0;
3776     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3777     sm_address_resolution_general_queue = NULL;
3778 
3779     gap_random_adress_update_period = 15 * 60 * 1000L;
3780     sm_active_connection = 0;
3781 
3782     test_use_fixed_local_csrk = 0;
3783 
3784     // register for HCI Events from HCI
3785     hci_event_callback_registration.callback = &sm_event_packet_handler;
3786     hci_add_event_handler(&hci_event_callback_registration);
3787 
3788     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3789     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3790 
3791 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3792     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3793 #endif
3794 
3795 #ifdef USE_MBEDTLS_FOR_ECDH
3796 #ifndef HAVE_MALLOC
3797     sm_mbedtls_allocator_init(mbedtls_memory_buffer, sizeof(mbedtls_memory_buffer));
3798 #endif
3799     mbedtls_ecp_group_init(&mbedtls_ec_group);
3800     mbedtls_ecp_group_load(&mbedtls_ec_group, MBEDTLS_ECP_DP_SECP256R1);
3801 #endif
3802 }
3803 
3804 void sm_use_fixed_ec_keypair(uint8_t * qx, uint8_t * qy, uint8_t * d){
3805 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3806     memcpy(&ec_q[0],  qx, 32);
3807     memcpy(&ec_q[32], qy, 32);
3808     memcpy(ec_d, d, 32);
3809     sm_have_ec_keypair = 1;
3810     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3811 #else
3812     UNUSED(qx);
3813     UNUSED(qy);
3814     UNUSED(d);
3815 #endif
3816 }
3817 
3818 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3819 #ifndef USE_MBEDTLS_FOR_ECDH
3820 static void parse_hex(uint8_t * buffer, const char * hex_string){
3821     while (*hex_string){
3822         int high_nibble = nibble_for_char(*hex_string++);
3823         int low_nibble  = nibble_for_char(*hex_string++);
3824         *buffer++       = (high_nibble << 4) | low_nibble;
3825     }
3826 }
3827 #endif
3828 #endif
3829 
3830 void sm_test_use_fixed_ec_keypair(void){
3831 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3832     const char * ec_d_string =  "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd";
3833     const char * ec_qx_string = "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6";
3834     const char * ec_qy_string = "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b";
3835 #ifdef USE_MBEDTLS_FOR_ECDH
3836     // use test keypair from spec
3837     mbedtls_mpi x;
3838     mbedtls_mpi_init(&x);
3839     mbedtls_mpi_read_string( &x, 16, ec_d_string);
3840     mbedtls_mpi_write_binary(&x, ec_d, 32);
3841     mbedtls_mpi_read_string( &x, 16, ec_qx_string);
3842     mbedtls_mpi_write_binary(&x, &ec_q[0], 32);
3843     mbedtls_mpi_read_string( &x, 16, ec_qy_string);
3844     mbedtls_mpi_write_binary(&x, &ec_q[32], 32);
3845     mbedtls_mpi_free(&x);
3846 #else
3847     parse_hex(ec_d, ec_d_string);
3848     parse_hex(&ec_q[0],  ec_qx_string);
3849     parse_hex(&ec_q[32], ec_qy_string);
3850 #endif
3851     sm_have_ec_keypair = 1;
3852     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3853 #endif
3854 }
3855 
3856 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3857     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3858     if (!hci_con) return NULL;
3859     return &hci_con->sm_connection;
3860 }
3861 
3862 // @returns 0 if not encrypted, 7-16 otherwise
3863 int sm_encryption_key_size(hci_con_handle_t con_handle){
3864     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3865     if (!sm_conn) return 0;     // wrong connection
3866     if (!sm_conn->sm_connection_encrypted) return 0;
3867     return sm_conn->sm_actual_encryption_key_size;
3868 }
3869 
3870 int sm_authenticated(hci_con_handle_t con_handle){
3871     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3872     if (!sm_conn) return 0;     // wrong connection
3873     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3874     return sm_conn->sm_connection_authenticated;
3875 }
3876 
3877 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3878     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3879     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3880     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3881     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3882     return sm_conn->sm_connection_authorization_state;
3883 }
3884 
3885 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3886     switch (sm_conn->sm_engine_state){
3887         case SM_GENERAL_IDLE:
3888         case SM_RESPONDER_IDLE:
3889             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3890             sm_run();
3891             break;
3892         default:
3893             break;
3894     }
3895 }
3896 
3897 /**
3898  * @brief Trigger Security Request
3899  */
3900 void sm_send_security_request(hci_con_handle_t con_handle){
3901     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3902     if (!sm_conn) return;
3903     sm_send_security_request_for_connection(sm_conn);
3904 }
3905 
3906 // request pairing
3907 void sm_request_pairing(hci_con_handle_t con_handle){
3908     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3909     if (!sm_conn) return;     // wrong connection
3910 
3911     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3912     if (IS_RESPONDER(sm_conn->sm_role)){
3913         sm_send_security_request_for_connection(sm_conn);
3914     } else {
3915         // used as a trigger to start central/master/initiator security procedures
3916         uint16_t ediv;
3917         sm_key_t ltk;
3918         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3919             switch (sm_conn->sm_irk_lookup_state){
3920                 case IRK_LOOKUP_FAILED:
3921                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3922                     break;
3923                 case IRK_LOOKUP_SUCCEEDED:
3924                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3925                         if (!sm_is_null_key(ltk) || ediv){
3926                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3927                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3928                         } else {
3929                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3930                         }
3931                         break;
3932                 default:
3933                     sm_conn->sm_bonding_requested = 1;
3934                     break;
3935             }
3936         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3937             sm_conn->sm_bonding_requested = 1;
3938         }
3939     }
3940     sm_run();
3941 }
3942 
3943 // called by client app on authorization request
3944 void sm_authorization_decline(hci_con_handle_t con_handle){
3945     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3946     if (!sm_conn) return;     // wrong connection
3947     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3948     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3949 }
3950 
3951 void sm_authorization_grant(hci_con_handle_t con_handle){
3952     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3953     if (!sm_conn) return;     // wrong connection
3954     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3955     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3956 }
3957 
3958 // GAP Bonding API
3959 
3960 void sm_bonding_decline(hci_con_handle_t con_handle){
3961     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3962     if (!sm_conn) return;     // wrong connection
3963     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3964 
3965     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3966         switch (setup->sm_stk_generation_method){
3967             case PK_RESP_INPUT:
3968             case PK_INIT_INPUT:
3969             case OK_BOTH_INPUT:
3970                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3971                 break;
3972             case NK_BOTH_INPUT:
3973                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3974                 break;
3975             case JUST_WORKS:
3976             case OOB:
3977                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3978                 break;
3979         }
3980     }
3981     sm_run();
3982 }
3983 
3984 void sm_just_works_confirm(hci_con_handle_t con_handle){
3985     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3986     if (!sm_conn) return;     // wrong connection
3987     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3988     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3989         if (setup->sm_use_secure_connections){
3990             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3991         } else {
3992             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3993         }
3994     }
3995 
3996 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3997     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3998         sm_sc_prepare_dhkey_check(sm_conn);
3999     }
4000 #endif
4001 
4002     sm_run();
4003 }
4004 
4005 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
4006     // for now, it's the same
4007     sm_just_works_confirm(con_handle);
4008 }
4009 
4010 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
4011     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4012     if (!sm_conn) return;     // wrong connection
4013     sm_reset_tk();
4014     big_endian_store_32(setup->sm_tk, 12, passkey);
4015     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
4016     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4017         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4018     }
4019 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4020     memcpy(setup->sm_ra, setup->sm_tk, 16);
4021     memcpy(setup->sm_rb, setup->sm_tk, 16);
4022     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
4023         sm_sc_start_calculating_local_confirm(sm_conn);
4024     }
4025 #endif
4026     sm_run();
4027 }
4028 
4029 void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
4030     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4031     if (!sm_conn) return;     // wrong connection
4032     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
4033     setup->sm_keypress_notification = action;
4034     sm_run();
4035 }
4036 
4037 /**
4038  * @brief Identify device in LE Device DB
4039  * @param handle
4040  * @returns index from le_device_db or -1 if not found/identified
4041  */
4042 int sm_le_device_index(hci_con_handle_t con_handle ){
4043     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4044     if (!sm_conn) return -1;
4045     return sm_conn->sm_le_db_index;
4046 }
4047 
4048 static int gap_random_address_type_requires_updates(void){
4049     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4050     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4051     return 1;
4052 }
4053 
4054 static uint8_t own_address_type(void){
4055     switch (gap_random_adress_type){
4056         case GAP_RANDOM_ADDRESS_TYPE_OFF:
4057             return BD_ADDR_TYPE_LE_PUBLIC;
4058         default:
4059             return BD_ADDR_TYPE_LE_RANDOM;
4060     }
4061 }
4062 
4063 // GAP LE API
4064 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
4065     gap_random_address_update_stop();
4066     gap_random_adress_type = random_address_type;
4067     hci_le_set_own_address_type(own_address_type());
4068     if (!gap_random_address_type_requires_updates()) return;
4069     gap_random_address_update_start();
4070     gap_random_address_trigger();
4071 }
4072 
4073 gap_random_address_type_t gap_random_address_get_mode(void){
4074     return gap_random_adress_type;
4075 }
4076 
4077 void gap_random_address_set_update_period(int period_ms){
4078     gap_random_adress_update_period = period_ms;
4079     if (!gap_random_address_type_requires_updates()) return;
4080     gap_random_address_update_stop();
4081     gap_random_address_update_start();
4082 }
4083 
4084 void gap_random_address_set(bd_addr_t addr){
4085     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
4086     memcpy(sm_random_address, addr, 6);
4087     if (rau_state == RAU_W4_WORKING) return;
4088     rau_state = RAU_SET_ADDRESS;
4089     sm_run();
4090 }
4091 
4092 #ifdef ENABLE_LE_PERIPHERAL
4093 /*
4094  * @brief Set Advertisement Paramters
4095  * @param adv_int_min
4096  * @param adv_int_max
4097  * @param adv_type
4098  * @param direct_address_type
4099  * @param direct_address
4100  * @param channel_map
4101  * @param filter_policy
4102  *
4103  * @note own_address_type is used from gap_random_address_set_mode
4104  */
4105 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
4106     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4107     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
4108         direct_address_typ, direct_address, channel_map, filter_policy);
4109 }
4110 #endif
4111 
4112