xref: /btstack/src/ble/sm.c (revision d40c3de009bce6994e726da5a427e08951b353d9)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "sm.c"
39 
40 #include <stdio.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "ble/le_device_db.h"
45 #include "ble/core.h"
46 #include "ble/sm.h"
47 #include "bluetooth_company_id.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_linked_list.h"
51 #include "btstack_memory.h"
52 #include "gap.h"
53 #include "hci.h"
54 #include "hci_dump.h"
55 #include "l2cap.h"
56 
57 #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
58 #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
59 #endif
60 
61 #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
62 #define IS_RESPONDER(role) (role)
63 #else
64 #ifdef ENABLE_LE_CENTRAL
65 // only central - never responder (avoid 'unused variable' warnings)
66 #define IS_RESPONDER(role) (0 && role)
67 #else
68 // only peripheral - always responder (avoid 'unused variable' warnings)
69 #define IS_RESPONDER(role) (1 || role)
70 #endif
71 #endif
72 
73 #ifdef ENABLE_LE_SECURE_CONNECTIONS
74 // assert SM Public Key can be sent/received
75 #if HCI_ACL_PAYLOAD_SIZE < 69
76 #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
77 #endif
78 
79 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
80 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
81 #else
82 // #define USE_MBEDTLS_FOR_ECDH
83 #define USE_MICROECC_FOR_ECDH
84 #endif
85 #endif
86 
87 // Software ECDH implementation provided by mbedtls
88 #ifdef USE_MBEDTLS_FOR_ECDH
89 #include "mbedtls/config.h"
90 #include "mbedtls/platform.h"
91 #include "mbedtls/ecp.h"
92 #include "sm_mbedtls_allocator.h"
93 #endif
94 
95 // Software ECDH implementation provided by micro-ecc
96 #ifdef USE_MICROECC_FOR_ECDH
97 #include "uECC.h"
98 #endif
99 
100 #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
101 #define ENABLE_CMAC_ENGINE
102 #endif
103 
104 //
105 // SM internal types and globals
106 //
107 
108 typedef enum {
109     DKG_W4_WORKING,
110     DKG_CALC_IRK,
111     DKG_W4_IRK,
112     DKG_CALC_DHK,
113     DKG_W4_DHK,
114     DKG_READY
115 } derived_key_generation_t;
116 
117 typedef enum {
118     RAU_W4_WORKING,
119     RAU_IDLE,
120     RAU_GET_RANDOM,
121     RAU_W4_RANDOM,
122     RAU_GET_ENC,
123     RAU_W4_ENC,
124     RAU_SET_ADDRESS,
125 } random_address_update_t;
126 
127 typedef enum {
128     CMAC_IDLE,
129     CMAC_CALC_SUBKEYS,
130     CMAC_W4_SUBKEYS,
131     CMAC_CALC_MI,
132     CMAC_W4_MI,
133     CMAC_CALC_MLAST,
134     CMAC_W4_MLAST
135 } cmac_state_t;
136 
137 typedef enum {
138     JUST_WORKS,
139     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
140     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
141     OK_BOTH_INPUT,  // Only input on both, both input PK
142     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
143     OOB             // OOB available on both sides
144 } stk_generation_method_t;
145 
146 typedef enum {
147     SM_USER_RESPONSE_IDLE,
148     SM_USER_RESPONSE_PENDING,
149     SM_USER_RESPONSE_CONFIRM,
150     SM_USER_RESPONSE_PASSKEY,
151     SM_USER_RESPONSE_DECLINE
152 } sm_user_response_t;
153 
154 typedef enum {
155     SM_AES128_IDLE,
156     SM_AES128_ACTIVE
157 } sm_aes128_state_t;
158 
159 typedef enum {
160     ADDRESS_RESOLUTION_IDLE,
161     ADDRESS_RESOLUTION_GENERAL,
162     ADDRESS_RESOLUTION_FOR_CONNECTION,
163 } address_resolution_mode_t;
164 
165 typedef enum {
166     ADDRESS_RESOLUTION_SUCEEDED,
167     ADDRESS_RESOLUTION_FAILED,
168 } address_resolution_event_t;
169 
170 typedef enum {
171     EC_KEY_GENERATION_IDLE,
172     EC_KEY_GENERATION_ACTIVE,
173     EC_KEY_GENERATION_W4_KEY,
174     EC_KEY_GENERATION_DONE,
175 } ec_key_generation_state_t;
176 
177 typedef enum {
178     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
179 } sm_state_var_t;
180 
181 //
182 // GLOBAL DATA
183 //
184 
185 static uint8_t test_use_fixed_local_csrk;
186 
187 // configuration
188 static uint8_t sm_accepted_stk_generation_methods;
189 static uint8_t sm_max_encryption_key_size;
190 static uint8_t sm_min_encryption_key_size;
191 static uint8_t sm_auth_req = 0;
192 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
193 static uint8_t sm_slave_request_security;
194 #ifdef ENABLE_LE_SECURE_CONNECTIONS
195 static uint8_t sm_have_ec_keypair;
196 #endif
197 
198 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
199 static sm_key_t sm_persistent_er;
200 static sm_key_t sm_persistent_ir;
201 
202 // derived from sm_persistent_ir
203 static sm_key_t sm_persistent_dhk;
204 static sm_key_t sm_persistent_irk;
205 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
206 static derived_key_generation_t dkg_state;
207 
208 // derived from sm_persistent_er
209 // ..
210 
211 // random address update
212 static random_address_update_t rau_state;
213 static bd_addr_t sm_random_address;
214 
215 // CMAC Calculation: General
216 #ifdef ENABLE_CMAC_ENGINE
217 static cmac_state_t sm_cmac_state;
218 static uint16_t     sm_cmac_message_len;
219 static sm_key_t     sm_cmac_k;
220 static sm_key_t     sm_cmac_x;
221 static sm_key_t     sm_cmac_m_last;
222 static uint8_t      sm_cmac_block_current;
223 static uint8_t      sm_cmac_block_count;
224 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
225 static void         (*sm_cmac_done_handler)(uint8_t * hash);
226 #endif
227 
228 // CMAC for ATT Signed Writes
229 #ifdef ENABLE_LE_SIGNED_WRITE
230 static uint8_t      sm_cmac_header[3];
231 static const uint8_t * sm_cmac_message;
232 static uint8_t      sm_cmac_sign_counter[4];
233 #endif
234 
235 // CMAC for Secure Connection functions
236 #ifdef ENABLE_LE_SECURE_CONNECTIONS
237 static sm_connection_t * sm_cmac_connection;
238 static uint8_t           sm_cmac_sc_buffer[80];
239 #endif
240 
241 // resolvable private address lookup / CSRK calculation
242 static int       sm_address_resolution_test;
243 static int       sm_address_resolution_ah_calculation_active;
244 static uint8_t   sm_address_resolution_addr_type;
245 static bd_addr_t sm_address_resolution_address;
246 static void *    sm_address_resolution_context;
247 static address_resolution_mode_t sm_address_resolution_mode;
248 static btstack_linked_list_t sm_address_resolution_general_queue;
249 
250 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
251 static sm_aes128_state_t  sm_aes128_state;
252 static void *             sm_aes128_context;
253 
254 // use aes128 provided by MCU - not needed usually
255 #ifdef HAVE_AES128
256 static uint8_t                aes128_result_flipped[16];
257 static btstack_timer_source_t aes128_timer;
258 void btstack_aes128_calc(uint8_t * key, uint8_t * plaintext, uint8_t * result);
259 #endif
260 
261 // random engine. store context (ususally sm_connection_t)
262 static void * sm_random_context;
263 
264 // to receive hci events
265 static btstack_packet_callback_registration_t hci_event_callback_registration;
266 
267 /* to dispatch sm event */
268 static btstack_linked_list_t sm_event_handlers;
269 
270 // LE Secure Connections
271 #ifdef ENABLE_LE_SECURE_CONNECTIONS
272 static ec_key_generation_state_t ec_key_generation_state;
273 static uint8_t ec_d[32];
274 static uint8_t ec_q[64];
275 #endif
276 
277 // Software ECDH implementation provided by mbedtls
278 #ifdef USE_MBEDTLS_FOR_ECDH
279 // group is always valid
280 static mbedtls_ecp_group   mbedtls_ec_group;
281 #ifndef HAVE_MALLOC
282 // COMP Method with Window 2
283 // 1300 bytes with 23 allocations
284 // #define MBEDTLS_ALLOC_BUFFER_SIZE (1300+23*sizeof(void *))
285 // NAIVE Method with safe cond assignments (without safe cond, order changes and allocations fail)
286 #define MBEDTLS_ALLOC_BUFFER_SIZE (700+18*sizeof(void *))
287 static uint8_t mbedtls_memory_buffer[MBEDTLS_ALLOC_BUFFER_SIZE];
288 #endif
289 #endif
290 
291 //
292 // Volume 3, Part H, Chapter 24
293 // "Security shall be initiated by the Security Manager in the device in the master role.
294 // The device in the slave role shall be the responding device."
295 // -> master := initiator, slave := responder
296 //
297 
298 // data needed for security setup
299 typedef struct sm_setup_context {
300 
301     btstack_timer_source_t sm_timeout;
302 
303     // used in all phases
304     uint8_t   sm_pairing_failed_reason;
305 
306     // user response, (Phase 1 and/or 2)
307     uint8_t   sm_user_response;
308     uint8_t   sm_keypress_notification;
309 
310     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
311     int       sm_key_distribution_send_set;
312     int       sm_key_distribution_received_set;
313 
314     // Phase 2 (Pairing over SMP)
315     stk_generation_method_t sm_stk_generation_method;
316     sm_key_t  sm_tk;
317     uint8_t   sm_use_secure_connections;
318 
319     sm_key_t  sm_c1_t3_value;   // c1 calculation
320     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
321     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
322     sm_key_t  sm_local_random;
323     sm_key_t  sm_local_confirm;
324     sm_key_t  sm_peer_random;
325     sm_key_t  sm_peer_confirm;
326     uint8_t   sm_m_addr_type;   // address and type can be removed
327     uint8_t   sm_s_addr_type;   //  ''
328     bd_addr_t sm_m_address;     //  ''
329     bd_addr_t sm_s_address;     //  ''
330     sm_key_t  sm_ltk;
331 
332     uint8_t   sm_state_vars;
333 #ifdef ENABLE_LE_SECURE_CONNECTIONS
334     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
335     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
336     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
337     sm_key_t  sm_peer_dhkey_check;
338     sm_key_t  sm_local_dhkey_check;
339     sm_key_t  sm_ra;
340     sm_key_t  sm_rb;
341     sm_key_t  sm_t;             // used for f5 and h6
342     sm_key_t  sm_mackey;
343     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
344 #endif
345 
346     // Phase 3
347 
348     // key distribution, we generate
349     uint16_t  sm_local_y;
350     uint16_t  sm_local_div;
351     uint16_t  sm_local_ediv;
352     uint8_t   sm_local_rand[8];
353     sm_key_t  sm_local_ltk;
354     sm_key_t  sm_local_csrk;
355     sm_key_t  sm_local_irk;
356     // sm_local_address/addr_type not needed
357 
358     // key distribution, received from peer
359     uint16_t  sm_peer_y;
360     uint16_t  sm_peer_div;
361     uint16_t  sm_peer_ediv;
362     uint8_t   sm_peer_rand[8];
363     sm_key_t  sm_peer_ltk;
364     sm_key_t  sm_peer_irk;
365     sm_key_t  sm_peer_csrk;
366     uint8_t   sm_peer_addr_type;
367     bd_addr_t sm_peer_address;
368 
369 } sm_setup_context_t;
370 
371 //
372 static sm_setup_context_t the_setup;
373 static sm_setup_context_t * setup = &the_setup;
374 
375 // active connection - the one for which the_setup is used for
376 static uint16_t sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
377 
378 // @returns 1 if oob data is available
379 // stores oob data in provided 16 byte buffer if not null
380 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
381 
382 // horizontal: initiator capabilities
383 // vertial:    responder capabilities
384 static const stk_generation_method_t stk_generation_method [5] [5] = {
385     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
386     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
387     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
388     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
389     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
390 };
391 
392 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
393 #ifdef ENABLE_LE_SECURE_CONNECTIONS
394 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
395     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
396     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
397     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
398     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
399     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
400 };
401 #endif
402 
403 static void sm_run(void);
404 static void sm_done_for_handle(hci_con_handle_t con_handle);
405 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
406 static inline int sm_calc_actual_encryption_key_size(int other);
407 static int sm_validate_stk_generation_method(void);
408 static void sm_handle_encryption_result(uint8_t * data);
409 
410 static void log_info_hex16(const char * name, uint16_t value){
411     log_info("%-6s 0x%04x", name, value);
412 }
413 
414 // @returns 1 if all bytes are 0
415 static int sm_is_null(uint8_t * data, int size){
416     int i;
417     for (i=0; i < size ; i++){
418         if (data[i]) return 0;
419     }
420     return 1;
421 }
422 
423 static int sm_is_null_random(uint8_t random[8]){
424     return sm_is_null(random, 8);
425 }
426 
427 static int sm_is_null_key(uint8_t * key){
428     return sm_is_null(key, 16);
429 }
430 
431 // Key utils
432 static void sm_reset_tk(void){
433     int i;
434     for (i=0;i<16;i++){
435         setup->sm_tk[i] = 0;
436     }
437 }
438 
439 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
440 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
441 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
442     int i;
443     for (i = max_encryption_size ; i < 16 ; i++){
444         key[15-i] = 0;
445     }
446 }
447 
448 // SMP Timeout implementation
449 
450 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
451 // the Security Manager Timer shall be reset and started.
452 //
453 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
454 //
455 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
456 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
457 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
458 // established.
459 
460 static void sm_timeout_handler(btstack_timer_source_t * timer){
461     log_info("SM timeout");
462     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
463     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
464     sm_done_for_handle(sm_conn->sm_handle);
465 
466     // trigger handling of next ready connection
467     sm_run();
468 }
469 static void sm_timeout_start(sm_connection_t * sm_conn){
470     btstack_run_loop_remove_timer(&setup->sm_timeout);
471     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
472     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
473     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
474     btstack_run_loop_add_timer(&setup->sm_timeout);
475 }
476 static void sm_timeout_stop(void){
477     btstack_run_loop_remove_timer(&setup->sm_timeout);
478 }
479 static void sm_timeout_reset(sm_connection_t * sm_conn){
480     sm_timeout_stop();
481     sm_timeout_start(sm_conn);
482 }
483 
484 // end of sm timeout
485 
486 // GAP Random Address updates
487 static gap_random_address_type_t gap_random_adress_type;
488 static btstack_timer_source_t gap_random_address_update_timer;
489 static uint32_t gap_random_adress_update_period;
490 
491 static void gap_random_address_trigger(void){
492     if (rau_state != RAU_IDLE) return;
493     log_info("gap_random_address_trigger");
494     rau_state = RAU_GET_RANDOM;
495     sm_run();
496 }
497 
498 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
499     UNUSED(timer);
500 
501     log_info("GAP Random Address Update due");
502     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
503     btstack_run_loop_add_timer(&gap_random_address_update_timer);
504     gap_random_address_trigger();
505 }
506 
507 static void gap_random_address_update_start(void){
508     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
509     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
510     btstack_run_loop_add_timer(&gap_random_address_update_timer);
511 }
512 
513 static void gap_random_address_update_stop(void){
514     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
515 }
516 
517 
518 static void sm_random_start(void * context){
519     sm_random_context = context;
520     hci_send_cmd(&hci_le_rand);
521 }
522 
523 #ifdef HAVE_AES128
524 static void aes128_completed(btstack_timer_source_t * ts){
525     UNUSED(ts);
526     sm_handle_encryption_result(&aes128_result_flipped[0]);
527     sm_run();
528 }
529 #endif
530 
531 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
532 // context is made availabe to aes128 result handler by this
533 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
534     sm_aes128_state = SM_AES128_ACTIVE;
535     sm_aes128_context = context;
536 
537 #ifdef HAVE_AES128
538     // calc result directly
539     sm_key_t result;
540     btstack_aes128_calc(key, plaintext, result);
541 
542     // log
543     log_info_key("key", key);
544     log_info_key("txt", plaintext);
545     log_info_key("res", result);
546 
547     // flip
548     reverse_128(&result[0], &aes128_result_flipped[0]);
549 
550     // deliver via timer
551     btstack_run_loop_set_timer_handler(&aes128_timer, &aes128_completed);
552     btstack_run_loop_set_timer(&aes128_timer, 0);    // no delay
553     btstack_run_loop_add_timer(&aes128_timer);
554 #else
555     sm_key_t key_flipped, plaintext_flipped;
556     reverse_128(key, key_flipped);
557     reverse_128(plaintext, plaintext_flipped);
558     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
559 #endif
560 }
561 
562 // ah(k,r) helper
563 // r = padding || r
564 // r - 24 bit value
565 static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
566     // r'= padding || r
567     memset(r_prime, 0, 16);
568     memcpy(&r_prime[13], r, 3);
569 }
570 
571 // d1 helper
572 // d' = padding || r || d
573 // d,r - 16 bit values
574 static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
575     // d'= padding || r || d
576     memset(d1_prime, 0, 16);
577     big_endian_store_16(d1_prime, 12, r);
578     big_endian_store_16(d1_prime, 14, d);
579 }
580 
581 // dm helper
582 // r’ = padding || r
583 // r - 64 bit value
584 static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
585     memset(r_prime, 0, 16);
586     memcpy(&r_prime[8], r, 8);
587 }
588 
589 // calculate arguments for first AES128 operation in C1 function
590 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
591 
592     // p1 = pres || preq || rat’ || iat’
593     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
594     // cant octet of pres becomes the most significant octet of p1.
595     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
596     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
597     // p1 is 0x05000800000302070710000001010001."
598 
599     sm_key_t p1;
600     reverse_56(pres, &p1[0]);
601     reverse_56(preq, &p1[7]);
602     p1[14] = rat;
603     p1[15] = iat;
604     log_info_key("p1", p1);
605     log_info_key("r", r);
606 
607     // t1 = r xor p1
608     int i;
609     for (i=0;i<16;i++){
610         t1[i] = r[i] ^ p1[i];
611     }
612     log_info_key("t1", t1);
613 }
614 
615 // calculate arguments for second AES128 operation in C1 function
616 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
617      // p2 = padding || ia || ra
618     // "The least significant octet of ra becomes the least significant octet of p2 and
619     // the most significant octet of padding becomes the most significant octet of p2.
620     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
621     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
622 
623     sm_key_t p2;
624     memset(p2, 0, 16);
625     memcpy(&p2[4],  ia, 6);
626     memcpy(&p2[10], ra, 6);
627     log_info_key("p2", p2);
628 
629     // c1 = e(k, t2_xor_p2)
630     int i;
631     for (i=0;i<16;i++){
632         t3[i] = t2[i] ^ p2[i];
633     }
634     log_info_key("t3", t3);
635 }
636 
637 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
638     log_info_key("r1", r1);
639     log_info_key("r2", r2);
640     memcpy(&r_prime[8], &r2[8], 8);
641     memcpy(&r_prime[0], &r1[8], 8);
642 }
643 
644 #ifdef ENABLE_LE_SECURE_CONNECTIONS
645 // Software implementations of crypto toolbox for LE Secure Connection
646 // TODO: replace with code to use AES Engine of HCI Controller
647 typedef uint8_t sm_key24_t[3];
648 typedef uint8_t sm_key56_t[7];
649 typedef uint8_t sm_key256_t[32];
650 
651 #if 0
652 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
653     uint32_t rk[RKLENGTH(KEYBITS)];
654     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
655     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
656 }
657 
658 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
659     memcpy(k1, k0, 16);
660     sm_shift_left_by_one_bit_inplace(16, k1);
661     if (k0[0] & 0x80){
662         k1[15] ^= 0x87;
663     }
664     memcpy(k2, k1, 16);
665     sm_shift_left_by_one_bit_inplace(16, k2);
666     if (k1[0] & 0x80){
667         k2[15] ^= 0x87;
668     }
669 }
670 
671 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
672     sm_key_t k0, k1, k2, zero;
673     memset(zero, 0, 16);
674 
675     aes128_calc_cyphertext(key, zero, k0);
676     calc_subkeys(k0, k1, k2);
677 
678     int cmac_block_count = (cmac_message_len + 15) / 16;
679 
680     // step 3: ..
681     if (cmac_block_count==0){
682         cmac_block_count = 1;
683     }
684 
685     // step 4: set m_last
686     sm_key_t cmac_m_last;
687     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
688     int i;
689     if (sm_cmac_last_block_complete){
690         for (i=0;i<16;i++){
691             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
692         }
693     } else {
694         int valid_octets_in_last_block = cmac_message_len & 0x0f;
695         for (i=0;i<16;i++){
696             if (i < valid_octets_in_last_block){
697                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
698                 continue;
699             }
700             if (i == valid_octets_in_last_block){
701                 cmac_m_last[i] = 0x80 ^ k2[i];
702                 continue;
703             }
704             cmac_m_last[i] = k2[i];
705         }
706     }
707 
708     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
709     // LOG_KEY(cmac_m_last);
710 
711     // Step 5
712     sm_key_t cmac_x;
713     memset(cmac_x, 0, 16);
714 
715     // Step 6
716     sm_key_t sm_cmac_y;
717     for (int block = 0 ; block < cmac_block_count-1 ; block++){
718         for (i=0;i<16;i++){
719             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
720         }
721         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
722     }
723     for (i=0;i<16;i++){
724         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
725     }
726 
727     // Step 7
728     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
729 }
730 #endif
731 #endif
732 
733 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
734     event[0] = type;
735     event[1] = event_size - 2;
736     little_endian_store_16(event, 2, con_handle);
737     event[4] = addr_type;
738     reverse_bd_addr(address, &event[5]);
739 }
740 
741 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
742     UNUSED(channel);
743 
744     // log event
745     hci_dump_packet(packet_type, 1, packet, size);
746     // dispatch to all event handlers
747     btstack_linked_list_iterator_t it;
748     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
749     while (btstack_linked_list_iterator_has_next(&it)){
750         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
751         entry->callback(packet_type, 0, packet, size);
752     }
753 }
754 
755 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
756     uint8_t event[11];
757     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
758     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
759 }
760 
761 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
762     uint8_t event[15];
763     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
764     little_endian_store_32(event, 11, passkey);
765     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
766 }
767 
768 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
769     // fetch addr and addr type from db
770     bd_addr_t identity_address;
771     int identity_address_type;
772     le_device_db_info(index, &identity_address_type, identity_address, NULL);
773 
774     uint8_t event[19];
775     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
776     event[11] = identity_address_type;
777     reverse_bd_addr(identity_address, &event[12]);
778     event[18] = index;
779     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
780 }
781 
782 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
783 
784     uint8_t event[18];
785     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
786     event[11] = result;
787     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
788 }
789 
790 // decide on stk generation based on
791 // - pairing request
792 // - io capabilities
793 // - OOB data availability
794 static void sm_setup_tk(void){
795 
796     // default: just works
797     setup->sm_stk_generation_method = JUST_WORKS;
798 
799 #ifdef ENABLE_LE_SECURE_CONNECTIONS
800     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
801                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
802                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
803     memset(setup->sm_ra, 0, 16);
804     memset(setup->sm_rb, 0, 16);
805 #else
806     setup->sm_use_secure_connections = 0;
807 #endif
808 
809     // If both devices have not set the MITM option in the Authentication Requirements
810     // Flags, then the IO capabilities shall be ignored and the Just Works association
811     // model shall be used.
812     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
813     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
814         log_info("SM: MITM not required by both -> JUST WORKS");
815         return;
816     }
817 
818     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
819 
820     // If both devices have out of band authentication data, then the Authentication
821     // Requirements Flags shall be ignored when selecting the pairing method and the
822     // Out of Band pairing method shall be used.
823     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
824     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
825         log_info("SM: have OOB data");
826         log_info_key("OOB", setup->sm_tk);
827         setup->sm_stk_generation_method = OOB;
828         return;
829     }
830 
831     // Reset TK as it has been setup in sm_init_setup
832     sm_reset_tk();
833 
834     // Also use just works if unknown io capabilites
835     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
836         return;
837     }
838 
839     // Otherwise the IO capabilities of the devices shall be used to determine the
840     // pairing method as defined in Table 2.4.
841     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
842     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
843 
844 #ifdef ENABLE_LE_SECURE_CONNECTIONS
845     // table not define by default
846     if (setup->sm_use_secure_connections){
847         generation_method = stk_generation_method_with_secure_connection;
848     }
849 #endif
850     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
851 
852     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
853         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
854 }
855 
856 static int sm_key_distribution_flags_for_set(uint8_t key_set){
857     int flags = 0;
858     if (key_set & SM_KEYDIST_ENC_KEY){
859         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
860         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
861     }
862     if (key_set & SM_KEYDIST_ID_KEY){
863         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
864         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
865     }
866     if (key_set & SM_KEYDIST_SIGN){
867         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
868     }
869     return flags;
870 }
871 
872 static void sm_setup_key_distribution(uint8_t key_set){
873     setup->sm_key_distribution_received_set = 0;
874     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
875 }
876 
877 // CSRK Key Lookup
878 
879 
880 static int sm_address_resolution_idle(void){
881     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
882 }
883 
884 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
885     memcpy(sm_address_resolution_address, addr, 6);
886     sm_address_resolution_addr_type = addr_type;
887     sm_address_resolution_test = 0;
888     sm_address_resolution_mode = mode;
889     sm_address_resolution_context = context;
890     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
891 }
892 
893 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
894     // check if already in list
895     btstack_linked_list_iterator_t it;
896     sm_lookup_entry_t * entry;
897     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
898     while(btstack_linked_list_iterator_has_next(&it)){
899         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
900         if (entry->address_type != address_type) continue;
901         if (memcmp(entry->address, address, 6))  continue;
902         // already in list
903         return BTSTACK_BUSY;
904     }
905     entry = btstack_memory_sm_lookup_entry_get();
906     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
907     entry->address_type = (bd_addr_type_t) address_type;
908     memcpy(entry->address, address, 6);
909     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
910     sm_run();
911     return 0;
912 }
913 
914 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
915 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
916     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
917 }
918 static inline void dkg_next_state(void){
919     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
920 }
921 static inline void rau_next_state(void){
922     rau_state = (random_address_update_t) (((int)rau_state) + 1);
923 }
924 
925 // CMAC calculation using AES Engine
926 #ifdef ENABLE_CMAC_ENGINE
927 
928 static inline void sm_cmac_next_state(void){
929     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
930 }
931 
932 static int sm_cmac_last_block_complete(void){
933     if (sm_cmac_message_len == 0) return 0;
934     return (sm_cmac_message_len & 0x0f) == 0;
935 }
936 
937 int sm_cmac_ready(void){
938     return sm_cmac_state == CMAC_IDLE;
939 }
940 
941 // generic cmac calculation
942 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
943     // Generalized CMAC
944     memcpy(sm_cmac_k, key, 16);
945     memset(sm_cmac_x, 0, 16);
946     sm_cmac_block_current = 0;
947     sm_cmac_message_len  = message_len;
948     sm_cmac_done_handler = done_callback;
949     sm_cmac_get_byte     = get_byte_callback;
950 
951     // step 2: n := ceil(len/const_Bsize);
952     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
953 
954     // step 3: ..
955     if (sm_cmac_block_count==0){
956         sm_cmac_block_count = 1;
957     }
958     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
959 
960     // first, we need to compute l for k1, k2, and m_last
961     sm_cmac_state = CMAC_CALC_SUBKEYS;
962 
963     // let's go
964     sm_run();
965 }
966 #endif
967 
968 // cmac for ATT Message signing
969 #ifdef ENABLE_LE_SIGNED_WRITE
970 static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
971     if (offset >= sm_cmac_message_len) {
972         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
973         return 0;
974     }
975 
976     offset = sm_cmac_message_len - 1 - offset;
977 
978     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
979     if (offset < 3){
980         return sm_cmac_header[offset];
981     }
982     int actual_message_len_incl_header = sm_cmac_message_len - 4;
983     if (offset <  actual_message_len_incl_header){
984         return sm_cmac_message[offset - 3];
985     }
986     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
987 }
988 
989 void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
990     // ATT Message Signing
991     sm_cmac_header[0] = opcode;
992     little_endian_store_16(sm_cmac_header, 1, con_handle);
993     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
994     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
995     sm_cmac_message = message;
996     sm_cmac_general_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
997 }
998 #endif
999 
1000 #ifdef ENABLE_CMAC_ENGINE
1001 static void sm_cmac_handle_aes_engine_ready(void){
1002     switch (sm_cmac_state){
1003         case CMAC_CALC_SUBKEYS: {
1004             sm_key_t const_zero;
1005             memset(const_zero, 0, 16);
1006             sm_cmac_next_state();
1007             sm_aes128_start(sm_cmac_k, const_zero, NULL);
1008             break;
1009         }
1010         case CMAC_CALC_MI: {
1011             int j;
1012             sm_key_t y;
1013             for (j=0;j<16;j++){
1014                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
1015             }
1016             sm_cmac_block_current++;
1017             sm_cmac_next_state();
1018             sm_aes128_start(sm_cmac_k, y, NULL);
1019             break;
1020         }
1021         case CMAC_CALC_MLAST: {
1022             int i;
1023             sm_key_t y;
1024             for (i=0;i<16;i++){
1025                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
1026             }
1027             log_info_key("Y", y);
1028             sm_cmac_block_current++;
1029             sm_cmac_next_state();
1030             sm_aes128_start(sm_cmac_k, y, NULL);
1031             break;
1032         }
1033         default:
1034             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
1035             break;
1036     }
1037 }
1038 
1039 // CMAC Implementation using AES128 engine
1040 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
1041     int i;
1042     int carry = 0;
1043     for (i=len-1; i >= 0 ; i--){
1044         int new_carry = data[i] >> 7;
1045         data[i] = data[i] << 1 | carry;
1046         carry = new_carry;
1047     }
1048 }
1049 
1050 static void sm_cmac_handle_encryption_result(sm_key_t data){
1051     switch (sm_cmac_state){
1052         case CMAC_W4_SUBKEYS: {
1053             sm_key_t k1;
1054             memcpy(k1, data, 16);
1055             sm_shift_left_by_one_bit_inplace(16, k1);
1056             if (data[0] & 0x80){
1057                 k1[15] ^= 0x87;
1058             }
1059             sm_key_t k2;
1060             memcpy(k2, k1, 16);
1061             sm_shift_left_by_one_bit_inplace(16, k2);
1062             if (k1[0] & 0x80){
1063                 k2[15] ^= 0x87;
1064             }
1065 
1066             log_info_key("k", sm_cmac_k);
1067             log_info_key("k1", k1);
1068             log_info_key("k2", k2);
1069 
1070             // step 4: set m_last
1071             int i;
1072             if (sm_cmac_last_block_complete()){
1073                 for (i=0;i<16;i++){
1074                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
1075                 }
1076             } else {
1077                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
1078                 for (i=0;i<16;i++){
1079                     if (i < valid_octets_in_last_block){
1080                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1081                         continue;
1082                     }
1083                     if (i == valid_octets_in_last_block){
1084                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1085                         continue;
1086                     }
1087                     sm_cmac_m_last[i] = k2[i];
1088                 }
1089             }
1090 
1091             // next
1092             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1093             break;
1094         }
1095         case CMAC_W4_MI:
1096             memcpy(sm_cmac_x, data, 16);
1097             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1098             break;
1099         case CMAC_W4_MLAST:
1100             // done
1101             log_info("Setting CMAC Engine to IDLE");
1102             sm_cmac_state = CMAC_IDLE;
1103             log_info_key("CMAC", data);
1104             sm_cmac_done_handler(data);
1105             break;
1106         default:
1107             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1108             break;
1109     }
1110 }
1111 #endif
1112 
1113 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1114     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1115     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1116     switch (setup->sm_stk_generation_method){
1117         case PK_RESP_INPUT:
1118             if (IS_RESPONDER(sm_conn->sm_role)){
1119                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1120                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1121             } else {
1122                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1123             }
1124             break;
1125         case PK_INIT_INPUT:
1126             if (IS_RESPONDER(sm_conn->sm_role)){
1127                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1128             } else {
1129                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1130                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1131             }
1132             break;
1133         case OK_BOTH_INPUT:
1134             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1135             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1136             break;
1137         case NK_BOTH_INPUT:
1138             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1139             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1140             break;
1141         case JUST_WORKS:
1142             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1143             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1144             break;
1145         case OOB:
1146             // client already provided OOB data, let's skip notification.
1147             break;
1148     }
1149 }
1150 
1151 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1152     int recv_flags;
1153     if (IS_RESPONDER(sm_conn->sm_role)){
1154         // slave / responder
1155         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1156     } else {
1157         // master / initiator
1158         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1159     }
1160     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1161     return recv_flags == setup->sm_key_distribution_received_set;
1162 }
1163 
1164 static void sm_done_for_handle(hci_con_handle_t con_handle){
1165     if (sm_active_connection_handle == con_handle){
1166         sm_timeout_stop();
1167         sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
1168         log_info("sm: connection 0x%x released setup context", con_handle);
1169     }
1170 }
1171 
1172 static int sm_key_distribution_flags_for_auth_req(void){
1173     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1174     if (sm_auth_req & SM_AUTHREQ_BONDING){
1175         // encryption information only if bonding requested
1176         flags |= SM_KEYDIST_ENC_KEY;
1177     }
1178     return flags;
1179 }
1180 
1181 static void sm_reset_setup(void){
1182     // fill in sm setup
1183     setup->sm_state_vars = 0;
1184     setup->sm_keypress_notification = 0xff;
1185     sm_reset_tk();
1186 }
1187 
1188 static void sm_init_setup(sm_connection_t * sm_conn){
1189 
1190     // fill in sm setup
1191     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1192     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1193 
1194     // query client for OOB data
1195     int have_oob_data = 0;
1196     if (sm_get_oob_data) {
1197         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1198     }
1199 
1200     sm_pairing_packet_t * local_packet;
1201     if (IS_RESPONDER(sm_conn->sm_role)){
1202         // slave
1203         local_packet = &setup->sm_s_pres;
1204         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
1205         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1206         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1207     } else {
1208         // master
1209         local_packet = &setup->sm_m_preq;
1210         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
1211         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1212         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1213 
1214         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1215         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1216         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1217     }
1218 
1219     uint8_t auth_req = sm_auth_req;
1220     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1221     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1222     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1223     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1224 }
1225 
1226 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1227 
1228     sm_pairing_packet_t * remote_packet;
1229     int                   remote_key_request;
1230     if (IS_RESPONDER(sm_conn->sm_role)){
1231         // slave / responder
1232         remote_packet      = &setup->sm_m_preq;
1233         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1234     } else {
1235         // master / initiator
1236         remote_packet      = &setup->sm_s_pres;
1237         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1238     }
1239 
1240     // check key size
1241     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1242     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1243 
1244     // decide on STK generation method
1245     sm_setup_tk();
1246     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1247 
1248     // check if STK generation method is acceptable by client
1249     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1250 
1251     // identical to responder
1252     sm_setup_key_distribution(remote_key_request);
1253 
1254     // JUST WORKS doens't provide authentication
1255     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1256 
1257     return 0;
1258 }
1259 
1260 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1261 
1262     // cache and reset context
1263     int matched_device_id = sm_address_resolution_test;
1264     address_resolution_mode_t mode = sm_address_resolution_mode;
1265     void * context = sm_address_resolution_context;
1266 
1267     // reset context
1268     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1269     sm_address_resolution_context = NULL;
1270     sm_address_resolution_test = -1;
1271     hci_con_handle_t con_handle = 0;
1272 
1273     sm_connection_t * sm_connection;
1274 #ifdef ENABLE_LE_CENTRAL
1275     sm_key_t ltk;
1276 #endif
1277     switch (mode){
1278         case ADDRESS_RESOLUTION_GENERAL:
1279             break;
1280         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1281             sm_connection = (sm_connection_t *) context;
1282             con_handle = sm_connection->sm_handle;
1283             switch (event){
1284                 case ADDRESS_RESOLUTION_SUCEEDED:
1285                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1286                     sm_connection->sm_le_db_index = matched_device_id;
1287                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1288 #ifdef ENABLE_LE_CENTRAL
1289                     if (sm_connection->sm_role) break;
1290                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1291                     sm_connection->sm_security_request_received = 0;
1292                     sm_connection->sm_bonding_requested = 0;
1293                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1294                     if (!sm_is_null_key(ltk)){
1295                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1296                     } else {
1297                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1298                     }
1299 #endif
1300                     break;
1301                 case ADDRESS_RESOLUTION_FAILED:
1302                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1303 #ifdef ENABLE_LE_CENTRAL
1304                     if (sm_connection->sm_role) break;
1305                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1306                     sm_connection->sm_security_request_received = 0;
1307                     sm_connection->sm_bonding_requested = 0;
1308                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1309 #endif
1310                     break;
1311             }
1312             break;
1313         default:
1314             break;
1315     }
1316 
1317     switch (event){
1318         case ADDRESS_RESOLUTION_SUCEEDED:
1319             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1320             break;
1321         case ADDRESS_RESOLUTION_FAILED:
1322             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1323             break;
1324     }
1325 }
1326 
1327 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1328 
1329     int le_db_index = -1;
1330 
1331     // lookup device based on IRK
1332     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1333         int i;
1334         for (i=0; i < le_device_db_count(); i++){
1335             sm_key_t irk;
1336             bd_addr_t address;
1337             int address_type;
1338             le_device_db_info(i, &address_type, address, irk);
1339             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1340                 log_info("sm: device found for IRK, updating");
1341                 le_db_index = i;
1342                 break;
1343             }
1344         }
1345     }
1346 
1347     // if not found, lookup via public address if possible
1348     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1349     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1350         int i;
1351         for (i=0; i < le_device_db_count(); i++){
1352             bd_addr_t address;
1353             int address_type;
1354             le_device_db_info(i, &address_type, address, NULL);
1355             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1356             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1357                 log_info("sm: device found for public address, updating");
1358                 le_db_index = i;
1359                 break;
1360             }
1361         }
1362     }
1363 
1364     // if not found, add to db
1365     if (le_db_index < 0) {
1366         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1367     }
1368 
1369     sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
1370 
1371     if (le_db_index >= 0){
1372 
1373 #ifdef ENABLE_LE_SIGNED_WRITE
1374         // store local CSRK
1375         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1376             log_info("sm: store local CSRK");
1377             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1378             le_device_db_local_counter_set(le_db_index, 0);
1379         }
1380 
1381         // store remote CSRK
1382         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1383             log_info("sm: store remote CSRK");
1384             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1385             le_device_db_remote_counter_set(le_db_index, 0);
1386         }
1387 #endif
1388         // store encryption information for secure connections: LTK generated by ECDH
1389         if (setup->sm_use_secure_connections){
1390             log_info("sm: store SC LTK (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1391             uint8_t zero_rand[8];
1392             memset(zero_rand, 0, 8);
1393             le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
1394                 sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1395         }
1396 
1397         // store encryption infromation for legacy pairing: peer LTK, EDIV, RAND
1398         else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
1399                && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1400             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1401             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1402                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1403 
1404         }
1405     }
1406 
1407     // keep le_db_index
1408     sm_conn->sm_le_db_index = le_db_index;
1409 }
1410 
1411 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1412     setup->sm_pairing_failed_reason = reason;
1413     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1414 }
1415 
1416 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1417     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1418 }
1419 
1420 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1421 
1422 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1423 static int sm_passkey_used(stk_generation_method_t method);
1424 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1425 
1426 static void sm_log_ec_keypair(void){
1427     log_info("Elliptic curve: X");
1428     log_info_hexdump(&ec_q[0],32);
1429     log_info("Elliptic curve: Y");
1430     log_info_hexdump(&ec_q[32],32);
1431 }
1432 
1433 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1434     if (sm_passkey_used(setup->sm_stk_generation_method)){
1435         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1436     } else {
1437         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1438     }
1439 }
1440 
1441 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1442     if (IS_RESPONDER(sm_conn->sm_role)){
1443         // Responder
1444         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1445     } else {
1446         // Initiator role
1447         switch (setup->sm_stk_generation_method){
1448             case JUST_WORKS:
1449                 sm_sc_prepare_dhkey_check(sm_conn);
1450                 break;
1451 
1452             case NK_BOTH_INPUT:
1453                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1454                 break;
1455             case PK_INIT_INPUT:
1456             case PK_RESP_INPUT:
1457             case OK_BOTH_INPUT:
1458                 if (setup->sm_passkey_bit < 20) {
1459                     sm_sc_start_calculating_local_confirm(sm_conn);
1460                 } else {
1461                     sm_sc_prepare_dhkey_check(sm_conn);
1462                 }
1463                 break;
1464             case OOB:
1465                 // TODO: implement SC OOB
1466                 break;
1467         }
1468     }
1469 }
1470 
1471 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1472     return sm_cmac_sc_buffer[offset];
1473 }
1474 
1475 static void sm_sc_cmac_done(uint8_t * hash){
1476     log_info("sm_sc_cmac_done: ");
1477     log_info_hexdump(hash, 16);
1478 
1479     sm_connection_t * sm_conn = sm_cmac_connection;
1480     sm_cmac_connection = NULL;
1481     link_key_type_t link_key_type;
1482 
1483     switch (sm_conn->sm_engine_state){
1484         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1485             memcpy(setup->sm_local_confirm, hash, 16);
1486             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1487             break;
1488         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1489             // check
1490             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1491                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1492                 break;
1493             }
1494             sm_sc_state_after_receiving_random(sm_conn);
1495             break;
1496         case SM_SC_W4_CALCULATE_G2: {
1497             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1498             big_endian_store_32(setup->sm_tk, 12, vab);
1499             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1500             sm_trigger_user_response(sm_conn);
1501             break;
1502         }
1503         case SM_SC_W4_CALCULATE_F5_SALT:
1504             memcpy(setup->sm_t, hash, 16);
1505             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1506             break;
1507         case SM_SC_W4_CALCULATE_F5_MACKEY:
1508             memcpy(setup->sm_mackey, hash, 16);
1509             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1510             break;
1511         case SM_SC_W4_CALCULATE_F5_LTK:
1512             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1513             // Errata Service Release to the Bluetooth Specification: ESR09
1514             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1515             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1516             memcpy(setup->sm_ltk, hash, 16);
1517             memcpy(setup->sm_local_ltk, hash, 16);
1518             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1519             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1520             break;
1521         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1522             memcpy(setup->sm_local_dhkey_check, hash, 16);
1523             if (IS_RESPONDER(sm_conn->sm_role)){
1524                 // responder
1525                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1526                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1527                 } else {
1528                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1529                 }
1530             } else {
1531                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1532             }
1533             break;
1534         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1535             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1536                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1537                 break;
1538             }
1539             if (IS_RESPONDER(sm_conn->sm_role)){
1540                 // responder
1541                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1542             } else {
1543                 // initiator
1544                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1545             }
1546             break;
1547         case SM_SC_W4_CALCULATE_H6_ILK:
1548             memcpy(setup->sm_t, hash, 16);
1549             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
1550             break;
1551         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
1552             reverse_128(hash, setup->sm_t);
1553             link_key_type = sm_conn->sm_connection_authenticated ?
1554                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
1555             if (IS_RESPONDER(sm_conn->sm_role)){
1556 #ifdef ENABLE_CLASSIC
1557                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
1558 #endif
1559                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
1560             } else {
1561 #ifdef ENABLE_CLASSIC
1562                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
1563 #endif
1564                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
1565             }
1566             sm_done_for_handle(sm_conn->sm_handle);
1567             break;
1568         default:
1569             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1570             break;
1571     }
1572     sm_run();
1573 }
1574 
1575 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1576     const uint16_t message_len = 65;
1577     sm_cmac_connection = sm_conn;
1578     memcpy(sm_cmac_sc_buffer, u, 32);
1579     memcpy(sm_cmac_sc_buffer+32, v, 32);
1580     sm_cmac_sc_buffer[64] = z;
1581     log_info("f4 key");
1582     log_info_hexdump(x, 16);
1583     log_info("f4 message");
1584     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1585     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1586 }
1587 
1588 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1589 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1590 static const uint8_t f5_length[] = { 0x01, 0x00};
1591 
1592 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1593     memset(dhkey, 0, 32);
1594 #ifdef USE_MBEDTLS_FOR_ECDH
1595     // da * Pb
1596     mbedtls_mpi d;
1597     mbedtls_ecp_point Q;
1598     mbedtls_ecp_point DH;
1599     mbedtls_mpi_init(&d);
1600     mbedtls_ecp_point_init(&Q);
1601     mbedtls_ecp_point_init(&DH);
1602     mbedtls_mpi_read_binary(&d, ec_d, 32);
1603     mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0] , 32);
1604     mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
1605     mbedtls_mpi_lset(&Q.Z, 1);
1606     mbedtls_ecp_mul(&mbedtls_ec_group, &DH, &d, &Q, NULL, NULL);
1607     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1608     mbedtls_ecp_point_free(&DH);
1609     mbedtls_mpi_free(&d);
1610     mbedtls_ecp_point_free(&Q);
1611 #endif
1612 #ifdef USE_MICROECC_FOR_ECDH
1613 #if uECC_SUPPORTS_secp256r1
1614     // standard version
1615     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey, uECC_secp256r1());
1616 #else
1617     // static version
1618     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey);
1619 #endif
1620 #endif
1621     log_info("dhkey");
1622     log_info_hexdump(dhkey, 32);
1623 }
1624 
1625 static void f5_calculate_salt(sm_connection_t * sm_conn){
1626     // calculate DHKEY
1627     sm_key256_t dhkey;
1628     sm_sc_calculate_dhkey(dhkey);
1629 
1630     // calculate salt for f5
1631     const uint16_t message_len = 32;
1632     sm_cmac_connection = sm_conn;
1633     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1634     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1635 }
1636 
1637 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1638     const uint16_t message_len = 53;
1639     sm_cmac_connection = sm_conn;
1640 
1641     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1642     sm_cmac_sc_buffer[0] = 0;
1643     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1644     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1645     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1646     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1647     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1648     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1649     log_info("f5 key");
1650     log_info_hexdump(t, 16);
1651     log_info("f5 message for MacKey");
1652     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1653     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1654 }
1655 
1656 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1657     sm_key56_t bd_addr_master, bd_addr_slave;
1658     bd_addr_master[0] =  setup->sm_m_addr_type;
1659     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1660     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1661     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1662     if (IS_RESPONDER(sm_conn->sm_role)){
1663         // responder
1664         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1665     } else {
1666         // initiator
1667         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1668     }
1669 }
1670 
1671 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1672 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1673     const uint16_t message_len = 53;
1674     sm_cmac_connection = sm_conn;
1675     sm_cmac_sc_buffer[0] = 1;
1676     // 1..52 setup before
1677     log_info("f5 key");
1678     log_info_hexdump(t, 16);
1679     log_info("f5 message for LTK");
1680     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1681     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1682 }
1683 
1684 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1685     f5_ltk(sm_conn, setup->sm_t);
1686 }
1687 
1688 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1689     const uint16_t message_len = 65;
1690     sm_cmac_connection = sm_conn;
1691     memcpy(sm_cmac_sc_buffer, n1, 16);
1692     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1693     memcpy(sm_cmac_sc_buffer+32, r, 16);
1694     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1695     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1696     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1697     log_info("f6 key");
1698     log_info_hexdump(w, 16);
1699     log_info("f6 message");
1700     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1701     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1702 }
1703 
1704 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1705 // - U is 256 bits
1706 // - V is 256 bits
1707 // - X is 128 bits
1708 // - Y is 128 bits
1709 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1710     const uint16_t message_len = 80;
1711     sm_cmac_connection = sm_conn;
1712     memcpy(sm_cmac_sc_buffer, u, 32);
1713     memcpy(sm_cmac_sc_buffer+32, v, 32);
1714     memcpy(sm_cmac_sc_buffer+64, y, 16);
1715     log_info("g2 key");
1716     log_info_hexdump(x, 16);
1717     log_info("g2 message");
1718     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1719     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1720 }
1721 
1722 static void g2_calculate(sm_connection_t * sm_conn) {
1723     // calc Va if numeric comparison
1724     if (IS_RESPONDER(sm_conn->sm_role)){
1725         // responder
1726         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1727     } else {
1728         // initiator
1729         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1730     }
1731 }
1732 
1733 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1734     uint8_t z = 0;
1735     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1736         // some form of passkey
1737         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1738         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1739         setup->sm_passkey_bit++;
1740     }
1741     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
1742 }
1743 
1744 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1745     uint8_t z = 0;
1746     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1747         // some form of passkey
1748         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1749         // sm_passkey_bit was increased before sending confirm value
1750         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1751     }
1752     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1753 }
1754 
1755 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1756     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1757 }
1758 
1759 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1760     // calculate DHKCheck
1761     sm_key56_t bd_addr_master, bd_addr_slave;
1762     bd_addr_master[0] =  setup->sm_m_addr_type;
1763     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1764     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1765     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1766     uint8_t iocap_a[3];
1767     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1768     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1769     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1770     uint8_t iocap_b[3];
1771     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1772     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1773     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1774     if (IS_RESPONDER(sm_conn->sm_role)){
1775         // responder
1776         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1777     } else {
1778         // initiator
1779         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1780     }
1781 }
1782 
1783 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1784     // validate E = f6()
1785     sm_key56_t bd_addr_master, bd_addr_slave;
1786     bd_addr_master[0] =  setup->sm_m_addr_type;
1787     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1788     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1789     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1790 
1791     uint8_t iocap_a[3];
1792     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1793     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1794     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1795     uint8_t iocap_b[3];
1796     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1797     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1798     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1799     if (IS_RESPONDER(sm_conn->sm_role)){
1800         // responder
1801         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1802     } else {
1803         // initiator
1804         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1805     }
1806 }
1807 
1808 
1809 //
1810 // Link Key Conversion Function h6
1811 //
1812 // h6(W, keyID) = AES-CMACW(keyID)
1813 // - W is 128 bits
1814 // - keyID is 32 bits
1815 static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
1816     const uint16_t message_len = 4;
1817     sm_cmac_connection = sm_conn;
1818     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
1819     log_info("h6 key");
1820     log_info_hexdump(w, 16);
1821     log_info("h6 message");
1822     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1823     sm_cmac_general_start(w, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1824 }
1825 
1826 // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1827 // Errata Service Release to the Bluetooth Specification: ESR09
1828 //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1829 //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1830 static void h6_calculate_ilk(sm_connection_t * sm_conn){
1831     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
1832 }
1833 
1834 static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
1835     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
1836 }
1837 
1838 #endif
1839 
1840 // key management legacy connections:
1841 // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1842 // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1843 // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1844 // - responder  reconnects: responder uses LTK receveived from master
1845 
1846 // key management secure connections:
1847 // - both devices store same LTK from ECDH key exchange.
1848 
1849 #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
1850 static void sm_load_security_info(sm_connection_t * sm_connection){
1851     int encryption_key_size;
1852     int authenticated;
1853     int authorized;
1854 
1855     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1856     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1857                                 &encryption_key_size, &authenticated, &authorized);
1858     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1859     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1860     sm_connection->sm_connection_authenticated = authenticated;
1861     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1862 }
1863 #endif
1864 
1865 #ifdef ENABLE_LE_PERIPHERAL
1866 static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
1867     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1868     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1869     // re-establish used key encryption size
1870     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1871     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1872     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1873     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1874     log_info("sm: received ltk request with key size %u, authenticated %u",
1875             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1876     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1877 }
1878 #endif
1879 
1880 static void sm_run(void){
1881 
1882     btstack_linked_list_iterator_t it;
1883 
1884     // assert that stack has already bootet
1885     if (hci_get_state() != HCI_STATE_WORKING) return;
1886 
1887     // assert that we can send at least commands
1888     if (!hci_can_send_command_packet_now()) return;
1889 
1890     //
1891     // non-connection related behaviour
1892     //
1893 
1894     // distributed key generation
1895     switch (dkg_state){
1896         case DKG_CALC_IRK:
1897             // already busy?
1898             if (sm_aes128_state == SM_AES128_IDLE) {
1899                 // IRK = d1(IR, 1, 0)
1900                 sm_key_t d1_prime;
1901                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1902                 dkg_next_state();
1903                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1904                 return;
1905             }
1906             break;
1907         case DKG_CALC_DHK:
1908             // already busy?
1909             if (sm_aes128_state == SM_AES128_IDLE) {
1910                 // DHK = d1(IR, 3, 0)
1911                 sm_key_t d1_prime;
1912                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1913                 dkg_next_state();
1914                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1915                 return;
1916             }
1917             break;
1918         default:
1919             break;
1920     }
1921 
1922 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1923     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1924 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
1925         sm_random_start(NULL);
1926 #else
1927         ec_key_generation_state = EC_KEY_GENERATION_W4_KEY;
1928         hci_send_cmd(&hci_le_read_local_p256_public_key);
1929 #endif
1930         return;
1931     }
1932 #endif
1933 
1934     // random address updates
1935     switch (rau_state){
1936         case RAU_GET_RANDOM:
1937             rau_next_state();
1938             sm_random_start(NULL);
1939             return;
1940         case RAU_GET_ENC:
1941             // already busy?
1942             if (sm_aes128_state == SM_AES128_IDLE) {
1943                 sm_key_t r_prime;
1944                 sm_ah_r_prime(sm_random_address, r_prime);
1945                 rau_next_state();
1946                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1947                 return;
1948             }
1949             break;
1950         case RAU_SET_ADDRESS:
1951             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1952             rau_state = RAU_IDLE;
1953             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1954             return;
1955         default:
1956             break;
1957     }
1958 
1959 #ifdef ENABLE_CMAC_ENGINE
1960     // CMAC
1961     switch (sm_cmac_state){
1962         case CMAC_CALC_SUBKEYS:
1963         case CMAC_CALC_MI:
1964         case CMAC_CALC_MLAST:
1965             // already busy?
1966             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1967             sm_cmac_handle_aes_engine_ready();
1968             return;
1969         default:
1970             break;
1971     }
1972 #endif
1973 
1974     // CSRK Lookup
1975     // -- if csrk lookup ready, find connection that require csrk lookup
1976     if (sm_address_resolution_idle()){
1977         hci_connections_get_iterator(&it);
1978         while(btstack_linked_list_iterator_has_next(&it)){
1979             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1980             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1981             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1982                 // and start lookup
1983                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1984                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1985                 break;
1986             }
1987         }
1988     }
1989 
1990     // -- if csrk lookup ready, resolved addresses for received addresses
1991     if (sm_address_resolution_idle()) {
1992         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1993             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1994             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1995             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1996             btstack_memory_sm_lookup_entry_free(entry);
1997         }
1998     }
1999 
2000     // -- Continue with CSRK device lookup by public or resolvable private address
2001     if (!sm_address_resolution_idle()){
2002         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
2003         while (sm_address_resolution_test < le_device_db_count()){
2004             int addr_type;
2005             bd_addr_t addr;
2006             sm_key_t irk;
2007             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
2008             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
2009 
2010             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
2011                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
2012                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2013                 break;
2014             }
2015 
2016             if (sm_address_resolution_addr_type == 0){
2017                 sm_address_resolution_test++;
2018                 continue;
2019             }
2020 
2021             if (sm_aes128_state == SM_AES128_ACTIVE) break;
2022 
2023             log_info("LE Device Lookup: calculate AH");
2024             log_info_key("IRK", irk);
2025 
2026             sm_key_t r_prime;
2027             sm_ah_r_prime(sm_address_resolution_address, r_prime);
2028             sm_address_resolution_ah_calculation_active = 1;
2029             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
2030             return;
2031         }
2032 
2033         if (sm_address_resolution_test >= le_device_db_count()){
2034             log_info("LE Device Lookup: not found");
2035             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
2036         }
2037     }
2038 
2039     // handle basic actions that don't requires the full context
2040     hci_connections_get_iterator(&it);
2041     while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
2042         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2043         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2044         switch(sm_connection->sm_engine_state){
2045             // responder side
2046             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2047                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2048                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2049                 return;
2050 
2051 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2052             case SM_SC_RECEIVED_LTK_REQUEST:
2053                 switch (sm_connection->sm_irk_lookup_state){
2054                     case IRK_LOOKUP_FAILED:
2055                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
2056                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2057                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2058                         return;
2059                     default:
2060                         break;
2061                 }
2062                 break;
2063 #endif
2064             default:
2065                 break;
2066         }
2067     }
2068 
2069     //
2070     // active connection handling
2071     // -- use loop to handle next connection if lock on setup context is released
2072 
2073     while (1) {
2074 
2075         // Find connections that requires setup context and make active if no other is locked
2076         hci_connections_get_iterator(&it);
2077         while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
2078             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2079             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2080             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
2081             int done = 1;
2082             int err;
2083             UNUSED(err);
2084             switch (sm_connection->sm_engine_state) {
2085 #ifdef ENABLE_LE_PERIPHERAL
2086                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
2087                     // send packet if possible,
2088                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
2089                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
2090                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
2091                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2092                     } else {
2093                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2094                     }
2095                     // don't lock sxetup context yet
2096                     done = 0;
2097                     break;
2098                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
2099                     sm_reset_setup();
2100                     sm_init_setup(sm_connection);
2101                     // recover pairing request
2102                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
2103                     err = sm_stk_generation_init(sm_connection);
2104                     if (err){
2105                         setup->sm_pairing_failed_reason = err;
2106                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2107                         break;
2108                     }
2109                     sm_timeout_start(sm_connection);
2110                     // generate random number first, if we need to show passkey
2111                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
2112                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
2113                         break;
2114                     }
2115                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2116                     break;
2117                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
2118                     sm_reset_setup();
2119                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
2120                     break;
2121 #endif
2122 #ifdef ENABLE_LE_CENTRAL
2123                 case SM_INITIATOR_PH0_HAS_LTK:
2124                     sm_reset_setup();
2125                     sm_load_security_info(sm_connection);
2126                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
2127                     break;
2128                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
2129                     sm_reset_setup();
2130                     sm_init_setup(sm_connection);
2131                     sm_timeout_start(sm_connection);
2132                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
2133                     break;
2134 #endif
2135 
2136 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2137                 case SM_SC_RECEIVED_LTK_REQUEST:
2138                     switch (sm_connection->sm_irk_lookup_state){
2139                         case IRK_LOOKUP_SUCCEEDED:
2140                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
2141                             // start using context by loading security info
2142                             sm_reset_setup();
2143                             sm_load_security_info(sm_connection);
2144                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
2145                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
2146                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2147                                 break;
2148                             }
2149                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
2150                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2151                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2152                             // don't lock setup context yet
2153                             return;
2154                         default:
2155                             // just wait until IRK lookup is completed
2156                             // don't lock setup context yet
2157                             done = 0;
2158                             break;
2159                     }
2160                     break;
2161 #endif
2162                 default:
2163                     done = 0;
2164                     break;
2165             }
2166             if (done){
2167                 sm_active_connection_handle = sm_connection->sm_handle;
2168                 log_info("sm: connection 0x%04x locked setup context as %s, state %u", sm_active_connection_handle, sm_connection->sm_role ? "responder" : "initiator", sm_connection->sm_engine_state);
2169             }
2170         }
2171 
2172         //
2173         // active connection handling
2174         //
2175 
2176         if (sm_active_connection_handle == HCI_CON_HANDLE_INVALID) return;
2177 
2178         // assert that we could send a SM PDU - not needed for all of the following
2179         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2180             log_info("cannot send now, requesting can send now event");
2181             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2182             return;
2183         }
2184 
2185         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection_handle);
2186         if (!connection) {
2187             log_info("no connection for handle 0x%04x", sm_active_connection_handle);
2188             return;
2189         }
2190 
2191         // send keypress notifications
2192         if (setup->sm_keypress_notification != 0xff){
2193             uint8_t buffer[2];
2194             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
2195             buffer[1] = setup->sm_keypress_notification;
2196             setup->sm_keypress_notification = 0xff;
2197             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2198             return;
2199         }
2200 
2201         sm_key_t plaintext;
2202         int key_distribution_flags;
2203         UNUSED(key_distribution_flags);
2204 
2205         log_info("sm_run: state %u", connection->sm_engine_state);
2206 
2207         switch (connection->sm_engine_state){
2208 
2209             // general
2210             case SM_GENERAL_SEND_PAIRING_FAILED: {
2211                 uint8_t buffer[2];
2212                 buffer[0] = SM_CODE_PAIRING_FAILED;
2213                 buffer[1] = setup->sm_pairing_failed_reason;
2214                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2215                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2216                 sm_done_for_handle(connection->sm_handle);
2217                 break;
2218             }
2219 
2220             // responding state
2221 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2222             case SM_SC_W2_GET_RANDOM_A:
2223                 sm_random_start(connection);
2224                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
2225                 break;
2226             case SM_SC_W2_GET_RANDOM_B:
2227                 sm_random_start(connection);
2228                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
2229                 break;
2230             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2231                 if (!sm_cmac_ready()) break;
2232                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2233                 sm_sc_calculate_local_confirm(connection);
2234                 break;
2235             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2236                 if (!sm_cmac_ready()) break;
2237                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2238                 sm_sc_calculate_remote_confirm(connection);
2239                 break;
2240             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2241                 if (!sm_cmac_ready()) break;
2242                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2243                 sm_sc_calculate_f6_for_dhkey_check(connection);
2244                 break;
2245             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2246                 if (!sm_cmac_ready()) break;
2247                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
2248                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
2249                 break;
2250             case SM_SC_W2_CALCULATE_F5_SALT:
2251                 if (!sm_cmac_ready()) break;
2252                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2253                 f5_calculate_salt(connection);
2254                 break;
2255             case SM_SC_W2_CALCULATE_F5_MACKEY:
2256                 if (!sm_cmac_ready()) break;
2257                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2258                 f5_calculate_mackey(connection);
2259                 break;
2260             case SM_SC_W2_CALCULATE_F5_LTK:
2261                 if (!sm_cmac_ready()) break;
2262                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2263                 f5_calculate_ltk(connection);
2264                 break;
2265             case SM_SC_W2_CALCULATE_G2:
2266                 if (!sm_cmac_ready()) break;
2267                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2268                 g2_calculate(connection);
2269                 break;
2270             case SM_SC_W2_CALCULATE_H6_ILK:
2271                 if (!sm_cmac_ready()) break;
2272                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
2273                 h6_calculate_ilk(connection);
2274                 break;
2275             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
2276                 if (!sm_cmac_ready()) break;
2277                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
2278                 h6_calculate_br_edr_link_key(connection);
2279                 break;
2280 #endif
2281 
2282 #ifdef ENABLE_LE_CENTRAL
2283             // initiator side
2284             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2285                 sm_key_t peer_ltk_flipped;
2286                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2287                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2288                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2289                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2290                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2291                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2292                 return;
2293             }
2294 
2295             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2296                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2297                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2298                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2299                 sm_timeout_reset(connection);
2300                 break;
2301 #endif
2302 
2303 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2304 
2305             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2306                 uint8_t buffer[65];
2307                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2308                 //
2309                 reverse_256(&ec_q[0],  &buffer[1]);
2310                 reverse_256(&ec_q[32], &buffer[33]);
2311 
2312                 // stk generation method
2313                 // passkey entry: notify app to show passkey or to request passkey
2314                 switch (setup->sm_stk_generation_method){
2315                     case JUST_WORKS:
2316                     case NK_BOTH_INPUT:
2317                         if (IS_RESPONDER(connection->sm_role)){
2318                             // responder
2319                             sm_sc_start_calculating_local_confirm(connection);
2320                         } else {
2321                             // initiator
2322                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2323                         }
2324                         break;
2325                     case PK_INIT_INPUT:
2326                     case PK_RESP_INPUT:
2327                     case OK_BOTH_INPUT:
2328                         // use random TK for display
2329                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2330                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2331                         setup->sm_passkey_bit = 0;
2332 
2333                         if (IS_RESPONDER(connection->sm_role)){
2334                             // responder
2335                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2336                         } else {
2337                             // initiator
2338                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2339                         }
2340                         sm_trigger_user_response(connection);
2341                         break;
2342                     case OOB:
2343                         // TODO: implement SC OOB
2344                         break;
2345                 }
2346 
2347                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2348                 sm_timeout_reset(connection);
2349                 break;
2350             }
2351             case SM_SC_SEND_CONFIRMATION: {
2352                 uint8_t buffer[17];
2353                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2354                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2355                 if (IS_RESPONDER(connection->sm_role)){
2356                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2357                 } else {
2358                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2359                 }
2360                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2361                 sm_timeout_reset(connection);
2362                 break;
2363             }
2364             case SM_SC_SEND_PAIRING_RANDOM: {
2365                 uint8_t buffer[17];
2366                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2367                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2368                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2369                     if (IS_RESPONDER(connection->sm_role)){
2370                         // responder
2371                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2372                     } else {
2373                         // initiator
2374                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2375                     }
2376                 } else {
2377                     if (IS_RESPONDER(connection->sm_role)){
2378                         // responder
2379                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2380                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2381                         } else {
2382                             sm_sc_prepare_dhkey_check(connection);
2383                         }
2384                     } else {
2385                         // initiator
2386                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2387                     }
2388                 }
2389                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2390                 sm_timeout_reset(connection);
2391                 break;
2392             }
2393             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2394                 uint8_t buffer[17];
2395                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2396                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2397 
2398                 if (IS_RESPONDER(connection->sm_role)){
2399                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2400                 } else {
2401                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2402                 }
2403 
2404                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2405                 sm_timeout_reset(connection);
2406                 break;
2407             }
2408 
2409 #endif
2410 
2411 #ifdef ENABLE_LE_PERIPHERAL
2412             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2413                 // echo initiator for now
2414                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2415                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2416 
2417                 if (setup->sm_use_secure_connections){
2418                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2419                     // skip LTK/EDIV for SC
2420                     log_info("sm: dropping encryption information flag");
2421                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2422                 } else {
2423                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2424                 }
2425 
2426                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2427                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2428                 // update key distribution after ENC was dropped
2429                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2430 
2431                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2432                 sm_timeout_reset(connection);
2433                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2434                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
2435                     sm_trigger_user_response(connection);
2436                 }
2437                 return;
2438 #endif
2439 
2440             case SM_PH2_SEND_PAIRING_RANDOM: {
2441                 uint8_t buffer[17];
2442                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2443                 reverse_128(setup->sm_local_random, &buffer[1]);
2444                 if (IS_RESPONDER(connection->sm_role)){
2445                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2446                 } else {
2447                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2448                 }
2449                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2450                 sm_timeout_reset(connection);
2451                 break;
2452             }
2453 
2454             case SM_PH2_GET_RANDOM_TK:
2455             case SM_PH2_C1_GET_RANDOM_A:
2456             case SM_PH2_C1_GET_RANDOM_B:
2457             case SM_PH3_GET_RANDOM:
2458             case SM_PH3_GET_DIV:
2459                 sm_next_responding_state(connection);
2460                 sm_random_start(connection);
2461                 return;
2462 
2463             case SM_PH2_C1_GET_ENC_B:
2464             case SM_PH2_C1_GET_ENC_D:
2465                 // already busy?
2466                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2467                 sm_next_responding_state(connection);
2468                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2469                 return;
2470 
2471             case SM_PH3_LTK_GET_ENC:
2472             case SM_RESPONDER_PH4_LTK_GET_ENC:
2473                 // already busy?
2474                 if (sm_aes128_state == SM_AES128_IDLE) {
2475                     sm_key_t d_prime;
2476                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2477                     sm_next_responding_state(connection);
2478                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2479                     return;
2480                 }
2481                 break;
2482 
2483             case SM_PH3_CSRK_GET_ENC:
2484                 // already busy?
2485                 if (sm_aes128_state == SM_AES128_IDLE) {
2486                     sm_key_t d_prime;
2487                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2488                     sm_next_responding_state(connection);
2489                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2490                     return;
2491                 }
2492                 break;
2493 
2494             case SM_PH2_C1_GET_ENC_C:
2495                 // already busy?
2496                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2497                 // calculate m_confirm using aes128 engine - step 1
2498                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2499                 sm_next_responding_state(connection);
2500                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2501                 break;
2502             case SM_PH2_C1_GET_ENC_A:
2503                 // already busy?
2504                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2505                 // calculate confirm using aes128 engine - step 1
2506                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2507                 sm_next_responding_state(connection);
2508                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2509                 break;
2510             case SM_PH2_CALC_STK:
2511                 // already busy?
2512                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2513                 // calculate STK
2514                 if (IS_RESPONDER(connection->sm_role)){
2515                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2516                 } else {
2517                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2518                 }
2519                 sm_next_responding_state(connection);
2520                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2521                 break;
2522             case SM_PH3_Y_GET_ENC:
2523                 // already busy?
2524                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2525                 // PH3B2 - calculate Y from      - enc
2526                 // Y = dm(DHK, Rand)
2527                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2528                 sm_next_responding_state(connection);
2529                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2530                 return;
2531             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2532                 uint8_t buffer[17];
2533                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2534                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2535                 if (IS_RESPONDER(connection->sm_role)){
2536                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2537                 } else {
2538                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2539                 }
2540                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2541                 sm_timeout_reset(connection);
2542                 return;
2543             }
2544 #ifdef ENABLE_LE_PERIPHERAL
2545             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2546                 sm_key_t stk_flipped;
2547                 reverse_128(setup->sm_ltk, stk_flipped);
2548                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2549                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2550                 return;
2551             }
2552             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
2553                 sm_key_t ltk_flipped;
2554                 reverse_128(setup->sm_ltk, ltk_flipped);
2555                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2556                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2557                 return;
2558             }
2559             case SM_RESPONDER_PH4_Y_GET_ENC:
2560                 // already busy?
2561                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2562                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2563                 // Y = dm(DHK, Rand)
2564                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2565                 sm_next_responding_state(connection);
2566                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2567                 return;
2568 #endif
2569 #ifdef ENABLE_LE_CENTRAL
2570             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2571                 sm_key_t stk_flipped;
2572                 reverse_128(setup->sm_ltk, stk_flipped);
2573                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2574                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2575                 return;
2576             }
2577 #endif
2578 
2579             case SM_PH3_DISTRIBUTE_KEYS:
2580                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2581                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2582                     uint8_t buffer[17];
2583                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2584                     reverse_128(setup->sm_ltk, &buffer[1]);
2585                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2586                     sm_timeout_reset(connection);
2587                     return;
2588                 }
2589                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2590                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2591                     uint8_t buffer[11];
2592                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2593                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2594                     reverse_64(setup->sm_local_rand, &buffer[3]);
2595                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2596                     sm_timeout_reset(connection);
2597                     return;
2598                 }
2599                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2600                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2601                     uint8_t buffer[17];
2602                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2603                     reverse_128(sm_persistent_irk, &buffer[1]);
2604                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2605                     sm_timeout_reset(connection);
2606                     return;
2607                 }
2608                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2609                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2610                     bd_addr_t local_address;
2611                     uint8_t buffer[8];
2612                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2613                     gap_le_get_own_address(&buffer[1], local_address);
2614                     reverse_bd_addr(local_address, &buffer[2]);
2615                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2616                     sm_timeout_reset(connection);
2617                     return;
2618                 }
2619                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2620                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2621 
2622                     // hack to reproduce test runs
2623                     if (test_use_fixed_local_csrk){
2624                         memset(setup->sm_local_csrk, 0xcc, 16);
2625                     }
2626 
2627                     uint8_t buffer[17];
2628                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2629                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2630                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2631                     sm_timeout_reset(connection);
2632                     return;
2633                 }
2634 
2635                 // keys are sent
2636                 if (IS_RESPONDER(connection->sm_role)){
2637                     // slave -> receive master keys if any
2638                     if (sm_key_distribution_all_received(connection)){
2639                         sm_key_distribution_handle_all_received(connection);
2640                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2641                         sm_done_for_handle(connection->sm_handle);
2642                     } else {
2643                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2644                     }
2645                 } else {
2646                     // master -> all done
2647                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2648                     sm_done_for_handle(connection->sm_handle);
2649                 }
2650                 break;
2651 
2652             default:
2653                 break;
2654         }
2655 
2656         // check again if active connection was released
2657         if (sm_active_connection_handle != HCI_CON_HANDLE_INVALID) break;
2658     }
2659 }
2660 
2661 // note: aes engine is ready as we just got the aes result
2662 static void sm_handle_encryption_result(uint8_t * data){
2663 
2664     sm_aes128_state = SM_AES128_IDLE;
2665 
2666     if (sm_address_resolution_ah_calculation_active){
2667         sm_address_resolution_ah_calculation_active = 0;
2668         // compare calulated address against connecting device
2669         uint8_t hash[3];
2670         reverse_24(data, hash);
2671         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2672             log_info("LE Device Lookup: matched resolvable private address");
2673             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2674             return;
2675         }
2676         // no match, try next
2677         sm_address_resolution_test++;
2678         return;
2679     }
2680 
2681     switch (dkg_state){
2682         case DKG_W4_IRK:
2683             reverse_128(data, sm_persistent_irk);
2684             log_info_key("irk", sm_persistent_irk);
2685             dkg_next_state();
2686             return;
2687         case DKG_W4_DHK:
2688             reverse_128(data, sm_persistent_dhk);
2689             log_info_key("dhk", sm_persistent_dhk);
2690             dkg_next_state();
2691             // SM Init Finished
2692             return;
2693         default:
2694             break;
2695     }
2696 
2697     switch (rau_state){
2698         case RAU_W4_ENC:
2699             reverse_24(data, &sm_random_address[3]);
2700             rau_next_state();
2701             return;
2702         default:
2703             break;
2704     }
2705 
2706 #ifdef ENABLE_CMAC_ENGINE
2707     switch (sm_cmac_state){
2708         case CMAC_W4_SUBKEYS:
2709         case CMAC_W4_MI:
2710         case CMAC_W4_MLAST:
2711             {
2712             sm_key_t t;
2713             reverse_128(data, t);
2714             sm_cmac_handle_encryption_result(t);
2715             }
2716             return;
2717         default:
2718             break;
2719     }
2720 #endif
2721 
2722     // retrieve sm_connection provided to sm_aes128_start_encryption
2723     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2724     if (!connection) return;
2725     switch (connection->sm_engine_state){
2726         case SM_PH2_C1_W4_ENC_A:
2727         case SM_PH2_C1_W4_ENC_C:
2728             {
2729             sm_key_t t2;
2730             reverse_128(data, t2);
2731             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2732             }
2733             sm_next_responding_state(connection);
2734             return;
2735         case SM_PH2_C1_W4_ENC_B:
2736             reverse_128(data, setup->sm_local_confirm);
2737             log_info_key("c1!", setup->sm_local_confirm);
2738             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2739             return;
2740         case SM_PH2_C1_W4_ENC_D:
2741             {
2742             sm_key_t peer_confirm_test;
2743             reverse_128(data, peer_confirm_test);
2744             log_info_key("c1!", peer_confirm_test);
2745             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2746                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2747                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2748                 return;
2749             }
2750             if (IS_RESPONDER(connection->sm_role)){
2751                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2752             } else {
2753                 connection->sm_engine_state = SM_PH2_CALC_STK;
2754             }
2755             }
2756             return;
2757         case SM_PH2_W4_STK:
2758             reverse_128(data, setup->sm_ltk);
2759             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2760             log_info_key("stk", setup->sm_ltk);
2761             if (IS_RESPONDER(connection->sm_role)){
2762                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2763             } else {
2764                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2765             }
2766             return;
2767         case SM_PH3_Y_W4_ENC:{
2768             sm_key_t y128;
2769             reverse_128(data, y128);
2770             setup->sm_local_y = big_endian_read_16(y128, 14);
2771             log_info_hex16("y", setup->sm_local_y);
2772             // PH3B3 - calculate EDIV
2773             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2774             log_info_hex16("ediv", setup->sm_local_ediv);
2775             // PH3B4 - calculate LTK         - enc
2776             // LTK = d1(ER, DIV, 0))
2777             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2778             return;
2779         }
2780         case SM_RESPONDER_PH4_Y_W4_ENC:{
2781             sm_key_t y128;
2782             reverse_128(data, y128);
2783             setup->sm_local_y = big_endian_read_16(y128, 14);
2784             log_info_hex16("y", setup->sm_local_y);
2785 
2786             // PH3B3 - calculate DIV
2787             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2788             log_info_hex16("ediv", setup->sm_local_ediv);
2789             // PH3B4 - calculate LTK         - enc
2790             // LTK = d1(ER, DIV, 0))
2791             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2792             return;
2793         }
2794         case SM_PH3_LTK_W4_ENC:
2795             reverse_128(data, setup->sm_ltk);
2796             log_info_key("ltk", setup->sm_ltk);
2797             // calc CSRK next
2798             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2799             return;
2800         case SM_PH3_CSRK_W4_ENC:
2801             reverse_128(data, setup->sm_local_csrk);
2802             log_info_key("csrk", setup->sm_local_csrk);
2803             if (setup->sm_key_distribution_send_set){
2804                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2805             } else {
2806                 // no keys to send, just continue
2807                 if (IS_RESPONDER(connection->sm_role)){
2808                     // slave -> receive master keys
2809                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2810                 } else {
2811                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
2812                         connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
2813                     } else {
2814                         // master -> all done
2815                         connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2816                         sm_done_for_handle(connection->sm_handle);
2817                     }
2818                 }
2819             }
2820             return;
2821 #ifdef ENABLE_LE_PERIPHERAL
2822         case SM_RESPONDER_PH4_LTK_W4_ENC:
2823             reverse_128(data, setup->sm_ltk);
2824             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2825             log_info_key("ltk", setup->sm_ltk);
2826             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2827             return;
2828 #endif
2829         default:
2830             break;
2831     }
2832 }
2833 
2834 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2835 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
2836 #if !defined(WICED_VERSION) || defined(USE_MBEDTLS_FOR_ECDH)
2837 // @return OK
2838 static int sm_generate_f_rng(unsigned char * buffer, unsigned size){
2839     if (ec_key_generation_state != EC_KEY_GENERATION_ACTIVE) return 0;
2840     int offset = setup->sm_passkey_bit;
2841     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2842     while (size) {
2843         *buffer++ = setup->sm_peer_q[offset++];
2844         size--;
2845     }
2846     setup->sm_passkey_bit = offset;
2847     return 1;
2848 }
2849 #endif
2850 #ifdef USE_MBEDTLS_FOR_ECDH
2851 // @return error
2852 static int sm_generate_f_rng_mbedtls(void * context, unsigned char * buffer, size_t size){
2853     UNUSED(context);
2854     return sm_generate_f_rng(buffer, size) == 1;
2855 }
2856 #endif
2857 #endif
2858 #endif
2859 
2860 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2861 static void sm_handle_random_result(uint8_t * data){
2862 
2863 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2864 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
2865 
2866     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2867         int num_bytes = setup->sm_passkey_bit;
2868         memcpy(&setup->sm_peer_q[num_bytes], data, 8);
2869         num_bytes += 8;
2870         setup->sm_passkey_bit = num_bytes;
2871 
2872         if (num_bytes >= 64){
2873 
2874             // init pre-generated random data from sm_peer_q
2875             setup->sm_passkey_bit = 0;
2876 
2877             // generate EC key
2878 #ifdef USE_MBEDTLS_FOR_ECDH
2879             mbedtls_mpi d;
2880             mbedtls_ecp_point P;
2881             mbedtls_mpi_init(&d);
2882             mbedtls_ecp_point_init(&P);
2883             int res = mbedtls_ecp_gen_keypair(&mbedtls_ec_group, &d, &P, &sm_generate_f_rng_mbedtls, NULL);
2884             log_info("gen keypair %x", res);
2885             mbedtls_mpi_write_binary(&P.X, &ec_q[0],  32);
2886             mbedtls_mpi_write_binary(&P.Y, &ec_q[32], 32);
2887             mbedtls_mpi_write_binary(&d, ec_d, 32);
2888             mbedtls_ecp_point_free(&P);
2889             mbedtls_mpi_free(&d);
2890 #endif
2891 
2892 #ifdef USE_MICROECC_FOR_ECDH
2893 
2894 #ifndef WICED_VERSION
2895             // micro-ecc from WICED SDK uses its wiced_crypto_get_random by default - no need to set it
2896             uECC_set_rng(&sm_generate_f_rng);
2897 #endif /* WICED_VERSION */
2898 
2899 #if uECC_SUPPORTS_secp256r1
2900             // standard version
2901             uECC_make_key(ec_q, ec_d, uECC_secp256r1());
2902 #else
2903             // static version
2904             uECC_make_key(ec_q, ec_d);
2905 #endif /* USE_MICROECC_FOR_ECDH */
2906 
2907 #ifndef WICED_VERSION
2908             // disable rng generator as we don't have any random bits left
2909             // we can do this because we don't generate another key
2910             // we need to to this because shared key calculation fails if rng returns 0
2911             uECC_set_rng(NULL);
2912 #endif /* WICED_VERSION */
2913 
2914 #endif /* USE_MICROECC_FOR_ECDH */
2915 
2916             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2917             log_info("Elliptic curve: d");
2918             log_info_hexdump(ec_d,32);
2919             sm_log_ec_keypair();
2920         }
2921     }
2922 #endif
2923 #endif
2924 
2925     switch (rau_state){
2926         case RAU_W4_RANDOM:
2927             // non-resolvable vs. resolvable
2928             switch (gap_random_adress_type){
2929                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2930                     // resolvable: use random as prand and calc address hash
2931                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2932                     memcpy(sm_random_address, data, 3);
2933                     sm_random_address[0] &= 0x3f;
2934                     sm_random_address[0] |= 0x40;
2935                     rau_state = RAU_GET_ENC;
2936                     break;
2937                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2938                 default:
2939                     // "The two most significant bits of the address shall be equal to ‘0’""
2940                     memcpy(sm_random_address, data, 6);
2941                     sm_random_address[0] &= 0x3f;
2942                     rau_state = RAU_SET_ADDRESS;
2943                     break;
2944             }
2945             return;
2946         default:
2947             break;
2948     }
2949 
2950     // retrieve sm_connection provided to sm_random_start
2951     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2952     if (!connection) return;
2953     switch (connection->sm_engine_state){
2954 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2955         case SM_SC_W4_GET_RANDOM_A:
2956             memcpy(&setup->sm_local_nonce[0], data, 8);
2957             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2958             break;
2959         case SM_SC_W4_GET_RANDOM_B:
2960             memcpy(&setup->sm_local_nonce[8], data, 8);
2961             // initiator & jw/nc -> send pairing random
2962             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2963                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2964                 break;
2965             } else {
2966                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2967             }
2968             break;
2969 #endif
2970 
2971         case SM_PH2_W4_RANDOM_TK:
2972         {
2973             // map random to 0-999999 without speding much cycles on a modulus operation
2974             uint32_t tk = little_endian_read_32(data,0);
2975             tk = tk & 0xfffff;  // 1048575
2976             if (tk >= 999999){
2977                 tk = tk - 999999;
2978             }
2979             sm_reset_tk();
2980             big_endian_store_32(setup->sm_tk, 12, tk);
2981             if (IS_RESPONDER(connection->sm_role)){
2982                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2983             } else {
2984                 if (setup->sm_use_secure_connections){
2985                     connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
2986                 } else {
2987                     connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2988                     sm_trigger_user_response(connection);
2989                     // response_idle == nothing <--> sm_trigger_user_response() did not require response
2990                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2991                         connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2992                     }
2993                 }
2994             }
2995             return;
2996         }
2997         case SM_PH2_C1_W4_RANDOM_A:
2998             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2999             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
3000             return;
3001         case SM_PH2_C1_W4_RANDOM_B:
3002             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
3003             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
3004             return;
3005         case SM_PH3_W4_RANDOM:
3006             reverse_64(data, setup->sm_local_rand);
3007             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
3008             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
3009             // no db for authenticated flag hack: store flag in bit 4 of LSB
3010             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
3011             connection->sm_engine_state = SM_PH3_GET_DIV;
3012             return;
3013         case SM_PH3_W4_DIV:
3014             // use 16 bit from random value as div
3015             setup->sm_local_div = big_endian_read_16(data, 0);
3016             log_info_hex16("div", setup->sm_local_div);
3017             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
3018             return;
3019         default:
3020             break;
3021     }
3022 }
3023 
3024 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
3025 
3026     UNUSED(channel);
3027     UNUSED(size);
3028 
3029     sm_connection_t  * sm_conn;
3030     hci_con_handle_t con_handle;
3031 
3032     switch (packet_type) {
3033 
3034 		case HCI_EVENT_PACKET:
3035 			switch (hci_event_packet_get_type(packet)) {
3036 
3037                 case BTSTACK_EVENT_STATE:
3038 					// bt stack activated, get started
3039 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
3040                         log_info("HCI Working!");
3041 
3042                         // set local addr for le device db
3043                         bd_addr_t local_bd_addr;
3044                         gap_local_bd_addr(local_bd_addr);
3045                         le_device_db_set_local_bd_addr(local_bd_addr);
3046 
3047                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
3048 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3049                         if (!sm_have_ec_keypair){
3050                             setup->sm_passkey_bit = 0;
3051                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
3052                         }
3053 #endif
3054                         // trigger Random Address generation if requested before
3055                         switch (gap_random_adress_type){
3056                             case GAP_RANDOM_ADDRESS_TYPE_OFF:
3057                                 rau_state = RAU_IDLE;
3058                                 break;
3059                             case GAP_RANDOM_ADDRESS_TYPE_STATIC:
3060                                 rau_state = RAU_SET_ADDRESS;
3061                                 break;
3062                             default:
3063                                 rau_state = RAU_GET_RANDOM;
3064                                 break;
3065                         }
3066                         sm_run();
3067 					}
3068 					break;
3069 
3070                 case HCI_EVENT_LE_META:
3071                     switch (packet[2]) {
3072                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
3073 
3074                             log_info("sm: connected");
3075 
3076                             if (packet[3]) return; // connection failed
3077 
3078                             con_handle = little_endian_read_16(packet, 4);
3079                             sm_conn = sm_get_connection_for_handle(con_handle);
3080                             if (!sm_conn) break;
3081 
3082                             sm_conn->sm_handle = con_handle;
3083                             sm_conn->sm_role = packet[6];
3084                             sm_conn->sm_peer_addr_type = packet[7];
3085                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
3086 
3087                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
3088 
3089                             // reset security properties
3090                             sm_conn->sm_connection_encrypted = 0;
3091                             sm_conn->sm_connection_authenticated = 0;
3092                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
3093                             sm_conn->sm_le_db_index = -1;
3094 
3095                             // prepare CSRK lookup (does not involve setup)
3096                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
3097 
3098                             // just connected -> everything else happens in sm_run()
3099                             if (IS_RESPONDER(sm_conn->sm_role)){
3100                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
3101                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3102                                     if (sm_slave_request_security) {
3103                                         // request security if requested by app
3104                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3105                                     } else {
3106                                         // otherwise, wait for pairing request
3107                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3108                                     }
3109                                 }
3110                                 break;
3111                             } else {
3112                                 // master
3113                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3114                             }
3115                             break;
3116 
3117                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
3118                             con_handle = little_endian_read_16(packet, 3);
3119                             sm_conn = sm_get_connection_for_handle(con_handle);
3120                             if (!sm_conn) break;
3121 
3122                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
3123                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
3124                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
3125                                 break;
3126                             }
3127                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
3128                                 // PH2 SEND LTK as we need to exchange keys in PH3
3129                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
3130                                 break;
3131                             }
3132 
3133                             // store rand and ediv
3134                             reverse_64(&packet[5], sm_conn->sm_local_rand);
3135                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
3136 
3137                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
3138                             // potentially stored LTK is from the master
3139                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
3140                                 sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
3141                                 break;
3142                             }
3143 
3144 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3145                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
3146 #else
3147                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
3148                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
3149 #endif
3150                             break;
3151 
3152 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3153                         case HCI_SUBEVENT_LE_READ_LOCAL_P256_PUBLIC_KEY_COMPLETE:
3154                             if (hci_subevent_le_read_local_p256_public_key_complete_get_status(packet)){
3155                                 log_error("Read Local P256 Public Key failed");
3156                                 break;
3157                             }
3158                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_x(packet, &ec_q[0]);
3159                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_y(packet, &ec_q[32]);
3160                             ec_key_generation_state = EC_KEY_GENERATION_DONE;
3161                             sm_log_ec_keypair();
3162                             break;
3163 #endif
3164                         default:
3165                             break;
3166                     }
3167                     break;
3168 
3169                 case HCI_EVENT_ENCRYPTION_CHANGE:
3170                     con_handle = little_endian_read_16(packet, 3);
3171                     sm_conn = sm_get_connection_for_handle(con_handle);
3172                     if (!sm_conn) break;
3173 
3174                     sm_conn->sm_connection_encrypted = packet[5];
3175                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
3176                         sm_conn->sm_actual_encryption_key_size);
3177                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3178                     if (!sm_conn->sm_connection_encrypted) break;
3179                     // continue if part of initial pairing
3180                     switch (sm_conn->sm_engine_state){
3181                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3182                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3183                             sm_done_for_handle(sm_conn->sm_handle);
3184                             break;
3185                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3186                             if (IS_RESPONDER(sm_conn->sm_role)){
3187                                 // slave
3188                                 if (setup->sm_use_secure_connections){
3189                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3190                                 } else {
3191                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3192                                 }
3193                             } else {
3194                                 // master
3195                                 if (sm_key_distribution_all_received(sm_conn)){
3196                                     // skip receiving keys as there are none
3197                                     sm_key_distribution_handle_all_received(sm_conn);
3198                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3199                                 } else {
3200                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3201                                 }
3202                             }
3203                             break;
3204                         default:
3205                             break;
3206                     }
3207                     break;
3208 
3209                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
3210                     con_handle = little_endian_read_16(packet, 3);
3211                     sm_conn = sm_get_connection_for_handle(con_handle);
3212                     if (!sm_conn) break;
3213 
3214                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
3215                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3216                     // continue if part of initial pairing
3217                     switch (sm_conn->sm_engine_state){
3218                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3219                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3220                             sm_done_for_handle(sm_conn->sm_handle);
3221                             break;
3222                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3223                             if (IS_RESPONDER(sm_conn->sm_role)){
3224                                 // slave
3225                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3226                             } else {
3227                                 // master
3228                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3229                             }
3230                             break;
3231                         default:
3232                             break;
3233                     }
3234                     break;
3235 
3236 
3237                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3238                     con_handle = little_endian_read_16(packet, 3);
3239                     sm_done_for_handle(con_handle);
3240                     sm_conn = sm_get_connection_for_handle(con_handle);
3241                     if (!sm_conn) break;
3242 
3243                     // delete stored bonding on disconnect with authentication failure in ph0
3244                     if (sm_conn->sm_role == 0
3245                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
3246                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
3247                         le_device_db_remove(sm_conn->sm_le_db_index);
3248                     }
3249 
3250                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
3251                     sm_conn->sm_handle = 0;
3252                     break;
3253 
3254 				case HCI_EVENT_COMMAND_COMPLETE:
3255                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
3256                         sm_handle_encryption_result(&packet[6]);
3257                         break;
3258                     }
3259                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
3260                         sm_handle_random_result(&packet[6]);
3261                         break;
3262                     }
3263                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
3264                         // Hack for Nordic nRF5 series that doesn't have public address:
3265                         // - with patches from port/nrf5-zephyr, hci_read_bd_addr returns random static address
3266                         // - we use this as default for advertisements/connections
3267                         if (hci_get_manufacturer() == BLUETOOTH_COMPANY_ID_NORDIC_SEMICONDUCTOR_ASA){
3268                             log_info("nRF5: using (fake) public address as random static address");
3269                             bd_addr_t addr;
3270                             reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
3271                             gap_random_address_set(addr);
3272                         }
3273                     }
3274                     break;
3275                 default:
3276                     break;
3277 			}
3278             break;
3279         default:
3280             break;
3281 	}
3282 
3283     sm_run();
3284 }
3285 
3286 static inline int sm_calc_actual_encryption_key_size(int other){
3287     if (other < sm_min_encryption_key_size) return 0;
3288     if (other < sm_max_encryption_key_size) return other;
3289     return sm_max_encryption_key_size;
3290 }
3291 
3292 
3293 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3294 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3295     switch (method){
3296         case JUST_WORKS:
3297         case NK_BOTH_INPUT:
3298             return 1;
3299         default:
3300             return 0;
3301     }
3302 }
3303 // responder
3304 
3305 static int sm_passkey_used(stk_generation_method_t method){
3306     switch (method){
3307         case PK_RESP_INPUT:
3308             return 1;
3309         default:
3310             return 0;
3311     }
3312 }
3313 #endif
3314 
3315 /**
3316  * @return ok
3317  */
3318 static int sm_validate_stk_generation_method(void){
3319     // check if STK generation method is acceptable by client
3320     switch (setup->sm_stk_generation_method){
3321         case JUST_WORKS:
3322             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
3323         case PK_RESP_INPUT:
3324         case PK_INIT_INPUT:
3325         case OK_BOTH_INPUT:
3326             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
3327         case OOB:
3328             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3329         case NK_BOTH_INPUT:
3330             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3331             return 1;
3332         default:
3333             return 0;
3334     }
3335 }
3336 
3337 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
3338 
3339     UNUSED(size);
3340 
3341     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3342         sm_run();
3343     }
3344 
3345     if (packet_type != SM_DATA_PACKET) return;
3346 
3347     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3348     if (!sm_conn) return;
3349 
3350     if (packet[0] == SM_CODE_PAIRING_FAILED){
3351         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
3352         return;
3353     }
3354 
3355     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
3356 
3357     int err;
3358     UNUSED(err);
3359 
3360     if (packet[0] == SM_CODE_KEYPRESS_NOTIFICATION){
3361         uint8_t buffer[5];
3362         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
3363         buffer[1] = 3;
3364         little_endian_store_16(buffer, 2, con_handle);
3365         buffer[4] = packet[1];
3366         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
3367         return;
3368     }
3369 
3370     switch (sm_conn->sm_engine_state){
3371 
3372         // a sm timeout requries a new physical connection
3373         case SM_GENERAL_TIMEOUT:
3374             return;
3375 
3376 #ifdef ENABLE_LE_CENTRAL
3377 
3378         // Initiator
3379         case SM_INITIATOR_CONNECTED:
3380             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3381                 sm_pdu_received_in_wrong_state(sm_conn);
3382                 break;
3383             }
3384             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
3385                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3386                 break;
3387             }
3388             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3389                 sm_key_t ltk;
3390                 le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
3391                 if (!sm_is_null_key(ltk)){
3392                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3393                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3394                 } else {
3395                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3396                 }
3397                 break;
3398             }
3399             // otherwise, store security request
3400             sm_conn->sm_security_request_received = 1;
3401             break;
3402 
3403         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3404             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
3405                 sm_pdu_received_in_wrong_state(sm_conn);
3406                 break;
3407             }
3408             // store pairing request
3409             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3410             err = sm_stk_generation_init(sm_conn);
3411             if (err){
3412                 setup->sm_pairing_failed_reason = err;
3413                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3414                 break;
3415             }
3416 
3417             // generate random number first, if we need to show passkey
3418             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3419                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3420                 break;
3421             }
3422 
3423 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3424             if (setup->sm_use_secure_connections){
3425                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3426                 if (setup->sm_stk_generation_method == JUST_WORKS){
3427                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3428                     sm_trigger_user_response(sm_conn);
3429                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3430                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3431                     }
3432                 } else {
3433                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3434                 }
3435                 break;
3436             }
3437 #endif
3438             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3439             sm_trigger_user_response(sm_conn);
3440             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3441             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3442                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3443             }
3444             break;
3445 
3446         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3447             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3448                 sm_pdu_received_in_wrong_state(sm_conn);
3449                 break;
3450             }
3451 
3452             // store s_confirm
3453             reverse_128(&packet[1], setup->sm_peer_confirm);
3454             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3455             break;
3456 
3457         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3458             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3459                 sm_pdu_received_in_wrong_state(sm_conn);
3460                 break;;
3461             }
3462 
3463             // received random value
3464             reverse_128(&packet[1], setup->sm_peer_random);
3465             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3466             break;
3467 #endif
3468 
3469 #ifdef ENABLE_LE_PERIPHERAL
3470         // Responder
3471         case SM_RESPONDER_IDLE:
3472         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3473         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3474             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3475                 sm_pdu_received_in_wrong_state(sm_conn);
3476                 break;;
3477             }
3478 
3479             // store pairing request
3480             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3481             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3482             break;
3483 #endif
3484 
3485 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3486         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3487             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3488                 sm_pdu_received_in_wrong_state(sm_conn);
3489                 break;
3490             }
3491 
3492             // store public key for DH Key calculation
3493             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3494             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3495 
3496             // validate public key
3497             err = 0;
3498 
3499 #ifdef USE_MBEDTLS_FOR_ECDH
3500             mbedtls_ecp_point Q;
3501             mbedtls_ecp_point_init( &Q );
3502             mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0], 32);
3503             mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
3504             mbedtls_mpi_lset(&Q.Z, 1);
3505             err = mbedtls_ecp_check_pubkey(&mbedtls_ec_group, &Q);
3506             mbedtls_ecp_point_free( & Q);
3507 #endif
3508 #ifdef USE_MICROECC_FOR_ECDH
3509 #if uECC_SUPPORTS_secp256r1
3510             // standard version
3511             err = uECC_valid_public_key(setup->sm_peer_q, uECC_secp256r1()) == 0;
3512 #else
3513             // static version
3514             err = uECC_valid_public_key(setup->sm_peer_q) == 0;
3515 #endif
3516 #endif
3517 
3518             if (err){
3519                 log_error("sm: peer public key invalid %x", err);
3520                 // uses "unspecified reason", there is no "public key invalid" error code
3521                 sm_pdu_received_in_wrong_state(sm_conn);
3522                 break;
3523             }
3524 
3525             if (IS_RESPONDER(sm_conn->sm_role)){
3526                 // responder
3527                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3528             } else {
3529                 // initiator
3530                 // stk generation method
3531                 // passkey entry: notify app to show passkey or to request passkey
3532                 switch (setup->sm_stk_generation_method){
3533                     case JUST_WORKS:
3534                     case NK_BOTH_INPUT:
3535                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3536                         break;
3537                     case PK_RESP_INPUT:
3538                         sm_sc_start_calculating_local_confirm(sm_conn);
3539                         break;
3540                     case PK_INIT_INPUT:
3541                     case OK_BOTH_INPUT:
3542                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3543                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3544                             break;
3545                         }
3546                         sm_sc_start_calculating_local_confirm(sm_conn);
3547                         break;
3548                     case OOB:
3549                         // TODO: implement SC OOB
3550                         break;
3551                 }
3552             }
3553             break;
3554 
3555         case SM_SC_W4_CONFIRMATION:
3556             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3557                 sm_pdu_received_in_wrong_state(sm_conn);
3558                 break;
3559             }
3560             // received confirm value
3561             reverse_128(&packet[1], setup->sm_peer_confirm);
3562 
3563             if (IS_RESPONDER(sm_conn->sm_role)){
3564                 // responder
3565                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3566                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3567                         // still waiting for passkey
3568                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3569                         break;
3570                     }
3571                 }
3572                 sm_sc_start_calculating_local_confirm(sm_conn);
3573             } else {
3574                 // initiator
3575                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3576                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3577                 } else {
3578                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3579                 }
3580             }
3581             break;
3582 
3583         case SM_SC_W4_PAIRING_RANDOM:
3584             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3585                 sm_pdu_received_in_wrong_state(sm_conn);
3586                 break;
3587             }
3588 
3589             // received random value
3590             reverse_128(&packet[1], setup->sm_peer_nonce);
3591 
3592             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3593             // only check for JUST WORK/NC in initiator role AND passkey entry
3594             if (sm_conn->sm_role || sm_passkey_used(setup->sm_stk_generation_method)) {
3595                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3596             }
3597 
3598             sm_sc_state_after_receiving_random(sm_conn);
3599             break;
3600 
3601         case SM_SC_W2_CALCULATE_G2:
3602         case SM_SC_W4_CALCULATE_G2:
3603         case SM_SC_W2_CALCULATE_F5_SALT:
3604         case SM_SC_W4_CALCULATE_F5_SALT:
3605         case SM_SC_W2_CALCULATE_F5_MACKEY:
3606         case SM_SC_W4_CALCULATE_F5_MACKEY:
3607         case SM_SC_W2_CALCULATE_F5_LTK:
3608         case SM_SC_W4_CALCULATE_F5_LTK:
3609         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3610         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3611         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3612             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3613                 sm_pdu_received_in_wrong_state(sm_conn);
3614                 break;
3615             }
3616             // store DHKey Check
3617             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3618             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3619 
3620             // have we been only waiting for dhkey check command?
3621             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3622                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3623             }
3624             break;
3625 #endif
3626 
3627 #ifdef ENABLE_LE_PERIPHERAL
3628         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3629             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3630                 sm_pdu_received_in_wrong_state(sm_conn);
3631                 break;
3632             }
3633 
3634             // received confirm value
3635             reverse_128(&packet[1], setup->sm_peer_confirm);
3636 
3637             // notify client to hide shown passkey
3638             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3639                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3640             }
3641 
3642             // handle user cancel pairing?
3643             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3644                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3645                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3646                 break;
3647             }
3648 
3649             // wait for user action?
3650             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3651                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3652                 break;
3653             }
3654 
3655             // calculate and send local_confirm
3656             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3657             break;
3658 
3659         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3660             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3661                 sm_pdu_received_in_wrong_state(sm_conn);
3662                 break;;
3663             }
3664 
3665             // received random value
3666             reverse_128(&packet[1], setup->sm_peer_random);
3667             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3668             break;
3669 #endif
3670 
3671         case SM_PH3_RECEIVE_KEYS:
3672             switch(packet[0]){
3673                 case SM_CODE_ENCRYPTION_INFORMATION:
3674                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3675                     reverse_128(&packet[1], setup->sm_peer_ltk);
3676                     break;
3677 
3678                 case SM_CODE_MASTER_IDENTIFICATION:
3679                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3680                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3681                     reverse_64(&packet[3], setup->sm_peer_rand);
3682                     break;
3683 
3684                 case SM_CODE_IDENTITY_INFORMATION:
3685                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3686                     reverse_128(&packet[1], setup->sm_peer_irk);
3687                     break;
3688 
3689                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3690                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3691                     setup->sm_peer_addr_type = packet[1];
3692                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3693                     break;
3694 
3695                 case SM_CODE_SIGNING_INFORMATION:
3696                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3697                     reverse_128(&packet[1], setup->sm_peer_csrk);
3698                     break;
3699                 default:
3700                     // Unexpected PDU
3701                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3702                     break;
3703             }
3704             // done with key distribution?
3705             if (sm_key_distribution_all_received(sm_conn)){
3706 
3707                 sm_key_distribution_handle_all_received(sm_conn);
3708 
3709                 if (IS_RESPONDER(sm_conn->sm_role)){
3710                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
3711                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
3712                     } else {
3713                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3714                         sm_done_for_handle(sm_conn->sm_handle);
3715                     }
3716                 } else {
3717                     if (setup->sm_use_secure_connections){
3718                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3719                     } else {
3720                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3721                     }
3722                 }
3723             }
3724             break;
3725         default:
3726             // Unexpected PDU
3727             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3728             break;
3729     }
3730 
3731     // try to send preparared packet
3732     sm_run();
3733 }
3734 
3735 // Security Manager Client API
3736 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3737     sm_get_oob_data = get_oob_data_callback;
3738 }
3739 
3740 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3741     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3742 }
3743 
3744 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3745     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3746 }
3747 
3748 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3749 	sm_min_encryption_key_size = min_size;
3750 	sm_max_encryption_key_size = max_size;
3751 }
3752 
3753 void sm_set_authentication_requirements(uint8_t auth_req){
3754     sm_auth_req = auth_req;
3755 }
3756 
3757 void sm_set_io_capabilities(io_capability_t io_capability){
3758     sm_io_capabilities = io_capability;
3759 }
3760 
3761 #ifdef ENABLE_LE_PERIPHERAL
3762 void sm_set_request_security(int enable){
3763     sm_slave_request_security = enable;
3764 }
3765 #endif
3766 
3767 void sm_set_er(sm_key_t er){
3768     memcpy(sm_persistent_er, er, 16);
3769 }
3770 
3771 void sm_set_ir(sm_key_t ir){
3772     memcpy(sm_persistent_ir, ir, 16);
3773 }
3774 
3775 // Testing support only
3776 void sm_test_set_irk(sm_key_t irk){
3777     memcpy(sm_persistent_irk, irk, 16);
3778     sm_persistent_irk_ready = 1;
3779 }
3780 
3781 void sm_test_use_fixed_local_csrk(void){
3782     test_use_fixed_local_csrk = 1;
3783 }
3784 
3785 void sm_init(void){
3786     // set some (BTstack default) ER and IR
3787     int i;
3788     sm_key_t er;
3789     sm_key_t ir;
3790     for (i=0;i<16;i++){
3791         er[i] = 0x30 + i;
3792         ir[i] = 0x90 + i;
3793     }
3794     sm_set_er(er);
3795     sm_set_ir(ir);
3796     // defaults
3797     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3798                                        | SM_STK_GENERATION_METHOD_OOB
3799                                        | SM_STK_GENERATION_METHOD_PASSKEY
3800                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3801 
3802     sm_max_encryption_key_size = 16;
3803     sm_min_encryption_key_size = 7;
3804 
3805 #ifdef ENABLE_CMAC_ENGINE
3806     sm_cmac_state  = CMAC_IDLE;
3807 #endif
3808     dkg_state = DKG_W4_WORKING;
3809     rau_state = RAU_W4_WORKING;
3810     sm_aes128_state = SM_AES128_IDLE;
3811     sm_address_resolution_test = -1;    // no private address to resolve yet
3812     sm_address_resolution_ah_calculation_active = 0;
3813     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3814     sm_address_resolution_general_queue = NULL;
3815 
3816     gap_random_adress_update_period = 15 * 60 * 1000L;
3817     sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
3818 
3819     test_use_fixed_local_csrk = 0;
3820 
3821     // register for HCI Events from HCI
3822     hci_event_callback_registration.callback = &sm_event_packet_handler;
3823     hci_add_event_handler(&hci_event_callback_registration);
3824 
3825     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3826     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3827 
3828 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3829     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3830 #endif
3831 
3832 #ifdef USE_MBEDTLS_FOR_ECDH
3833 #ifndef HAVE_MALLOC
3834     sm_mbedtls_allocator_init(mbedtls_memory_buffer, sizeof(mbedtls_memory_buffer));
3835 #endif
3836     mbedtls_ecp_group_init(&mbedtls_ec_group);
3837     mbedtls_ecp_group_load(&mbedtls_ec_group, MBEDTLS_ECP_DP_SECP256R1);
3838 #endif
3839 }
3840 
3841 void sm_use_fixed_ec_keypair(uint8_t * qx, uint8_t * qy, uint8_t * d){
3842 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3843     memcpy(&ec_q[0],  qx, 32);
3844     memcpy(&ec_q[32], qy, 32);
3845     memcpy(ec_d, d, 32);
3846     sm_have_ec_keypair = 1;
3847     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3848 #else
3849     UNUSED(qx);
3850     UNUSED(qy);
3851     UNUSED(d);
3852 #endif
3853 }
3854 
3855 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3856 #ifndef USE_MBEDTLS_FOR_ECDH
3857 static void parse_hex(uint8_t * buffer, const char * hex_string){
3858     while (*hex_string){
3859         int high_nibble = nibble_for_char(*hex_string++);
3860         int low_nibble  = nibble_for_char(*hex_string++);
3861         *buffer++       = (high_nibble << 4) | low_nibble;
3862     }
3863 }
3864 #endif
3865 #endif
3866 
3867 void sm_test_use_fixed_ec_keypair(void){
3868 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3869     const char * ec_d_string =  "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd";
3870     const char * ec_qx_string = "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6";
3871     const char * ec_qy_string = "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b";
3872 #ifdef USE_MBEDTLS_FOR_ECDH
3873     // use test keypair from spec
3874     mbedtls_mpi x;
3875     mbedtls_mpi_init(&x);
3876     mbedtls_mpi_read_string( &x, 16, ec_d_string);
3877     mbedtls_mpi_write_binary(&x, ec_d, 32);
3878     mbedtls_mpi_read_string( &x, 16, ec_qx_string);
3879     mbedtls_mpi_write_binary(&x, &ec_q[0], 32);
3880     mbedtls_mpi_read_string( &x, 16, ec_qy_string);
3881     mbedtls_mpi_write_binary(&x, &ec_q[32], 32);
3882     mbedtls_mpi_free(&x);
3883 #else
3884     parse_hex(ec_d, ec_d_string);
3885     parse_hex(&ec_q[0],  ec_qx_string);
3886     parse_hex(&ec_q[32], ec_qy_string);
3887 #endif
3888     sm_have_ec_keypair = 1;
3889     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3890 #endif
3891 }
3892 
3893 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3894     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3895     if (!hci_con) return NULL;
3896     return &hci_con->sm_connection;
3897 }
3898 
3899 // @returns 0 if not encrypted, 7-16 otherwise
3900 int sm_encryption_key_size(hci_con_handle_t con_handle){
3901     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3902     if (!sm_conn) return 0;     // wrong connection
3903     if (!sm_conn->sm_connection_encrypted) return 0;
3904     return sm_conn->sm_actual_encryption_key_size;
3905 }
3906 
3907 int sm_authenticated(hci_con_handle_t con_handle){
3908     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3909     if (!sm_conn) return 0;     // wrong connection
3910     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3911     return sm_conn->sm_connection_authenticated;
3912 }
3913 
3914 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3915     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3916     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3917     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3918     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3919     return sm_conn->sm_connection_authorization_state;
3920 }
3921 
3922 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3923     switch (sm_conn->sm_engine_state){
3924         case SM_GENERAL_IDLE:
3925         case SM_RESPONDER_IDLE:
3926             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3927             sm_run();
3928             break;
3929         default:
3930             break;
3931     }
3932 }
3933 
3934 /**
3935  * @brief Trigger Security Request
3936  */
3937 void sm_send_security_request(hci_con_handle_t con_handle){
3938     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3939     if (!sm_conn) return;
3940     sm_send_security_request_for_connection(sm_conn);
3941 }
3942 
3943 // request pairing
3944 void sm_request_pairing(hci_con_handle_t con_handle){
3945     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3946     if (!sm_conn) return;     // wrong connection
3947 
3948     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3949     if (IS_RESPONDER(sm_conn->sm_role)){
3950         sm_send_security_request_for_connection(sm_conn);
3951     } else {
3952         // used as a trigger to start central/master/initiator security procedures
3953         uint16_t ediv;
3954         sm_key_t ltk;
3955         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3956             switch (sm_conn->sm_irk_lookup_state){
3957                 case IRK_LOOKUP_FAILED:
3958                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3959                     break;
3960                 case IRK_LOOKUP_SUCCEEDED:
3961                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3962                         if (!sm_is_null_key(ltk) || ediv){
3963                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3964                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3965                         } else {
3966                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3967                         }
3968                         break;
3969                 default:
3970                     sm_conn->sm_bonding_requested = 1;
3971                     break;
3972             }
3973         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3974             sm_conn->sm_bonding_requested = 1;
3975         }
3976     }
3977     sm_run();
3978 }
3979 
3980 // called by client app on authorization request
3981 void sm_authorization_decline(hci_con_handle_t con_handle){
3982     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3983     if (!sm_conn) return;     // wrong connection
3984     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3985     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3986 }
3987 
3988 void sm_authorization_grant(hci_con_handle_t con_handle){
3989     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3990     if (!sm_conn) return;     // wrong connection
3991     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3992     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3993 }
3994 
3995 // GAP Bonding API
3996 
3997 void sm_bonding_decline(hci_con_handle_t con_handle){
3998     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3999     if (!sm_conn) return;     // wrong connection
4000     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
4001 
4002     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4003         switch (setup->sm_stk_generation_method){
4004             case PK_RESP_INPUT:
4005             case PK_INIT_INPUT:
4006             case OK_BOTH_INPUT:
4007                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
4008                 break;
4009             case NK_BOTH_INPUT:
4010                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
4011                 break;
4012             case JUST_WORKS:
4013             case OOB:
4014                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
4015                 break;
4016         }
4017     }
4018     sm_run();
4019 }
4020 
4021 void sm_just_works_confirm(hci_con_handle_t con_handle){
4022     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4023     if (!sm_conn) return;     // wrong connection
4024     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
4025     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4026         if (setup->sm_use_secure_connections){
4027             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
4028         } else {
4029             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4030         }
4031     }
4032 
4033 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4034     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
4035         sm_sc_prepare_dhkey_check(sm_conn);
4036     }
4037 #endif
4038 
4039     sm_run();
4040 }
4041 
4042 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
4043     // for now, it's the same
4044     sm_just_works_confirm(con_handle);
4045 }
4046 
4047 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
4048     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4049     if (!sm_conn) return;     // wrong connection
4050     sm_reset_tk();
4051     big_endian_store_32(setup->sm_tk, 12, passkey);
4052     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
4053     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4054         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4055     }
4056 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4057     memcpy(setup->sm_ra, setup->sm_tk, 16);
4058     memcpy(setup->sm_rb, setup->sm_tk, 16);
4059     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
4060         sm_sc_start_calculating_local_confirm(sm_conn);
4061     }
4062 #endif
4063     sm_run();
4064 }
4065 
4066 void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
4067     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4068     if (!sm_conn) return;     // wrong connection
4069     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
4070     setup->sm_keypress_notification = action;
4071     sm_run();
4072 }
4073 
4074 /**
4075  * @brief Identify device in LE Device DB
4076  * @param handle
4077  * @returns index from le_device_db or -1 if not found/identified
4078  */
4079 int sm_le_device_index(hci_con_handle_t con_handle ){
4080     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4081     if (!sm_conn) return -1;
4082     return sm_conn->sm_le_db_index;
4083 }
4084 
4085 static int gap_random_address_type_requires_updates(void){
4086     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4087     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4088     return 1;
4089 }
4090 
4091 static uint8_t own_address_type(void){
4092     switch (gap_random_adress_type){
4093         case GAP_RANDOM_ADDRESS_TYPE_OFF:
4094             return BD_ADDR_TYPE_LE_PUBLIC;
4095         default:
4096             return BD_ADDR_TYPE_LE_RANDOM;
4097     }
4098 }
4099 
4100 // GAP LE API
4101 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
4102     gap_random_address_update_stop();
4103     gap_random_adress_type = random_address_type;
4104     hci_le_set_own_address_type(own_address_type());
4105     if (!gap_random_address_type_requires_updates()) return;
4106     gap_random_address_update_start();
4107     gap_random_address_trigger();
4108 }
4109 
4110 gap_random_address_type_t gap_random_address_get_mode(void){
4111     return gap_random_adress_type;
4112 }
4113 
4114 void gap_random_address_set_update_period(int period_ms){
4115     gap_random_adress_update_period = period_ms;
4116     if (!gap_random_address_type_requires_updates()) return;
4117     gap_random_address_update_stop();
4118     gap_random_address_update_start();
4119 }
4120 
4121 void gap_random_address_set(bd_addr_t addr){
4122     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
4123     memcpy(sm_random_address, addr, 6);
4124     if (rau_state == RAU_W4_WORKING) return;
4125     rau_state = RAU_SET_ADDRESS;
4126     sm_run();
4127 }
4128 
4129 #ifdef ENABLE_LE_PERIPHERAL
4130 /*
4131  * @brief Set Advertisement Paramters
4132  * @param adv_int_min
4133  * @param adv_int_max
4134  * @param adv_type
4135  * @param direct_address_type
4136  * @param direct_address
4137  * @param channel_map
4138  * @param filter_policy
4139  *
4140  * @note own_address_type is used from gap_random_address_set_mode
4141  */
4142 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
4143     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4144     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
4145         direct_address_typ, direct_address, channel_map, filter_policy);
4146 }
4147 #endif
4148 
4149