2 * Routines for Bluetooth Security Manager Protocol dissection
4 * Copyright 2012, Allan M. Madsen <allan.m@madsen.dk>
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * Wireshark - Network traffic analyzer
11 * By Gerald Combs <gerald@wireshark.org>
12 * Copyright 1998 Gerald Combs
14 * SPDX-License-Identifier: GPL-2.0-or-later
19 #include <epan/packet.h>
20 #include "packet-bluetooth.h"
21 #include "packet-btl2cap.h"
23 /* Initialize the protocol and registered fields */
24 static int proto_btsmp
;
26 static int hf_btsmp_opcode
;
27 static int hf_btsmp_io_capabilities
;
28 static int hf_btsmp_oob_data_flags
;
29 static int hf_btsmp_reason
;
30 static int hf_btsmp_cfm_value
;
31 static int hf_btsmp_random
;
32 static int hf_btsmp_long_term_key
;
33 static int hf_btsmp_id_resolving_key
;
34 static int hf_btsmp_signature_key
;
35 static int hf_btsmp_bonding_flags
;
36 static int hf_btsmp_mitm_flag
;
37 static int hf_btsmp_secure_connection_flag
;
38 static int hf_btsmp_keypress_flag
;
39 static int hf_btsmp_ct2_flag
;
40 static int hf_btsmp_reserved_flag
;
41 static int hf_btsmp_max_enc_key_size
;
42 static int hf_btsmp_key_dist_enc
;
43 static int hf_btsmp_key_dist_id
;
44 static int hf_btsmp_key_dist_sign
;
45 static int hf_btsmp_key_dist_linkkey
;
46 static int hf_btsmp_key_dist_reserved
;
47 static int hf_btsmp_ediv
;
48 static int hf_btsmp_authreq
;
49 static int hf_btsmp_initiator_key_distribution
;
50 static int hf_btsmp_responder_key_distribution
;
51 static int hf_bd_addr
;
52 static int hf_address_type
;
53 static int hf_btsmp_public_key_x
;
54 static int hf_btsmp_public_key_y
;
55 static int hf_btsmp_dhkey_check
;
56 static int hf_btsmp_notification_type
;
58 static int * const hfx_btsmp_key_distribution
[] = {
59 &hf_btsmp_key_dist_reserved
,
60 &hf_btsmp_key_dist_linkkey
,
61 &hf_btsmp_key_dist_sign
,
62 &hf_btsmp_key_dist_id
,
63 &hf_btsmp_key_dist_enc
,
67 static int * const hfx_btsmp_authreq
[] = {
68 &hf_btsmp_reserved_flag
,
70 &hf_btsmp_keypress_flag
,
71 &hf_btsmp_secure_connection_flag
,
73 &hf_btsmp_bonding_flags
,
78 /* Initialize the subtree pointers */
80 static int ett_btsmp_auth_req
;
81 static int ett_btsmp_key_dist
;
83 static dissector_handle_t btsmp_handle
;
86 static const value_string opcode_vals
[] = {
87 {0x01, "Pairing Request"},
88 {0x02, "Pairing Response"},
89 {0x03, "Pairing Confirm"},
90 {0x04, "Pairing Random"},
91 {0x05, "Pairing Failed"},
92 {0x06, "Encryption Information"},
93 {0x07, "Central Identification"},
94 {0x08, "Identity Information"},
95 {0x09, "Identity Address Information"},
96 {0x0A, "Signing Information"},
97 {0x0B, "Security Request"},
98 {0x0C, "Pairing Public Key"},
99 {0x0D, "Pairing DHKey Check"},
100 {0x0E, "Pairing Keypress Notification"},
104 /* IO capabilities */
105 static const value_string io_capability_vals
[] = {
106 {0x00, "Display Only"},
107 {0x01, "Display Yes/No"},
108 {0x02, "Keyboard Only"},
109 {0x03, "No Input, No Output"},
110 {0x04, "Keyboard, Display"},
114 /* OOB Data present Flag */
115 static const value_string oob_data_flag_vals
[] = {
116 {0x00, "OOB Auth. Data Not Present"},
117 {0x01, "OOB Auth. Data From Remote Device Present"},
122 static const value_string bonding_flag_vals
[] = {
123 {0x00, "No Bonding"},
129 static const value_string reason_vals
[] = {
130 {0x01, "Passkey Entry Failed"},
131 {0x02, "OOB Not Available"},
132 {0x03, "Authentication Requirements"},
133 {0x04, "Confirm Value Failed"},
134 {0x05, "Pairing Not Supported"},
135 {0x06, "Encryption Key Size"},
136 {0x07, "Command Not Supported"},
137 {0x08, "Unspecified Reason"},
138 {0x09, "Repeated Attempts"},
139 {0x0A, "Invalid Parameters"},
140 {0x0B, "DHKey Check Failed"},
141 {0x0C, "Numeric Comparison Failed"},
142 {0x0D, "BR/EDR pairing in progress"},
143 {0x0E, "Cross-transport Key Derivation/Generation not allowed"},
147 static const value_string notification_type_vals
[] = {
148 {0x00, "Passkey Entry Started"},
149 {0x01, "Passkey Digit Entered"},
150 {0x02, "Passkey Digit Erased"},
151 {0x03, "Passkey Cleared"},
152 {0x04, "Passkey Entry Completed"},
156 /* X coordinate of debug public key. Little-endian. */
157 static const uint8_t debug_public_key_x
[32] = {
158 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
159 0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
160 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
161 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20,
164 /* Y coordinate of debug public key. Little-endian. */
165 static const uint8_t debug_public_key_y
[32] = {
166 0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74,
167 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
168 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63,
169 0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc
172 void proto_register_btsmp(void);
173 void proto_reg_handoff_btsmp(void);
176 dissect_btsmp_auth_req(tvbuff_t
*tvb
, int offset
, packet_info
*pinfo
, proto_tree
*tree
)
181 col_append_str(pinfo
->cinfo
, COL_INFO
, "AuthReq: ");
182 proto_tree_add_bitmask(tree
, tvb
, offset
, hf_btsmp_authreq
, ett_btsmp_auth_req
, hfx_btsmp_authreq
, ENC_LITTLE_ENDIAN
);
184 value
= tvb_get_uint8(tvb
, offset
);
186 ph
= val_to_str_const(value
& 0x03, bonding_flag_vals
, "<unknown>");
187 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, "", ph
);
190 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, ", ", "MITM");
192 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, ", ", "SecureConnection");
194 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, ", ", "Keypress");
196 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, ", ", "Reserved");
202 dissect_btsmp_key_dist(tvbuff_t
*tvb
, int offset
, packet_info
*pinfo
, proto_tree
*tree
, bool initiator
)
208 col_append_str(pinfo
->cinfo
, COL_INFO
, " | Initiator Key(s): ");
209 proto_tree_add_bitmask(tree
, tvb
, offset
, hf_btsmp_initiator_key_distribution
, ett_btsmp_key_dist
, hfx_btsmp_key_distribution
, ENC_LITTLE_ENDIAN
);
211 col_append_str(pinfo
->cinfo
, COL_INFO
, " | Responder Key(s): ");
212 proto_tree_add_bitmask(tree
, tvb
, offset
, hf_btsmp_responder_key_distribution
, ett_btsmp_key_dist
, hfx_btsmp_key_distribution
, ENC_LITTLE_ENDIAN
);
215 value
= tvb_get_uint8(tvb
, offset
);
218 col_append_str(pinfo
->cinfo
, COL_INFO
, "LTK");
222 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, next
? ", " : "", "IRK");
226 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, next
? ", " : "", "CSRK");
230 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, next
? ", " : "", "Linkkey");
234 col_append_sep_str(pinfo
->cinfo
, COL_INFO
, next
? ", " : "", "Reserved");
237 col_append_str(pinfo
->cinfo
, COL_INFO
, "<none>");
244 dissect_btsmp(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void *data
)
250 uint32_t interface_id
;
254 interface_id
= HCI_INTERFACE_DEFAULT
;
255 adapter_id
= HCI_ADAPTER_DEFAULT
;
256 previous_proto
= (GPOINTER_TO_INT(wmem_list_frame_data(wmem_list_frame_prev(wmem_list_tail(pinfo
->layers
)))));
257 if (data
&& previous_proto
== proto_btl2cap
) {
258 btl2cap_data_t
*l2cap_data
;
260 l2cap_data
= (btl2cap_data_t
*) data
;
262 interface_id
= l2cap_data
->interface_id
;
263 adapter_id
= l2cap_data
->adapter_id
;
267 ti
= proto_tree_add_item(tree
, proto_btsmp
, tvb
, 0, tvb_captured_length(tvb
), ENC_NA
);
268 st
= proto_item_add_subtree(ti
, ett_btsmp
);
270 col_set_str(pinfo
->cinfo
, COL_PROTOCOL
, "SMP");
272 switch (pinfo
->p2p_dir
) {
274 col_set_str(pinfo
->cinfo
, COL_INFO
, "Sent ");
277 col_set_str(pinfo
->cinfo
, COL_INFO
, "Rcvd ");
280 col_set_str(pinfo
->cinfo
, COL_INFO
, "UnknownDirection ");
284 if (tvb_reported_length(tvb
) < 1)
287 proto_tree_add_item(st
, hf_btsmp_opcode
, tvb
, 0, 1, ENC_LITTLE_ENDIAN
);
288 opcode
= tvb_get_uint8(tvb
, 0);
291 col_append_str(pinfo
->cinfo
, COL_INFO
, val_to_str_const(opcode
, opcode_vals
, "<unknown>"));
294 case 0x01: /* Pairing Request */
295 case 0x02: /* Pairing Response */
297 col_append_str(pinfo
->cinfo
, COL_INFO
, ": ");
299 proto_tree_add_item(st
, hf_btsmp_io_capabilities
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
301 proto_tree_add_item(st
, hf_btsmp_oob_data_flags
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
304 offset
= dissect_btsmp_auth_req(tvb
, offset
, pinfo
, st
);
306 proto_tree_add_item(st
, hf_btsmp_max_enc_key_size
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
309 offset
= dissect_btsmp_key_dist(tvb
, offset
, pinfo
, st
, true);
310 offset
= dissect_btsmp_key_dist(tvb
, offset
, pinfo
, st
, false);
314 case 0x03: /* Pairing Confirm */
315 proto_tree_add_item(st
, hf_btsmp_cfm_value
, tvb
, offset
, 16, ENC_NA
);
319 case 0x04: /* Pairing Random */
320 proto_tree_add_item(st
, hf_btsmp_random
, tvb
, offset
, 16, ENC_NA
);
324 case 0x05: /* Pairing Failed */
325 proto_tree_add_item(st
, hf_btsmp_reason
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
326 col_append_fstr(pinfo
->cinfo
, COL_INFO
, ": %s", val_to_str_const(tvb_get_uint8(tvb
, offset
), reason_vals
, "<unknown>"));
330 case 0x06: /* Encryption Information */
331 proto_tree_add_item(st
, hf_btsmp_long_term_key
, tvb
, offset
, 16, ENC_NA
);
335 case 0x07: /* Central Identification */
336 proto_tree_add_item(st
, hf_btsmp_ediv
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
);
338 proto_tree_add_item(st
, hf_btsmp_random
, tvb
, offset
, 8, ENC_NA
);
342 case 0x08: /* Identity Information */
343 proto_tree_add_item(st
, hf_btsmp_id_resolving_key
, tvb
, offset
, 16, ENC_NA
);
347 case 0x09: /* Identity Address Information */
348 proto_tree_add_item(st
, hf_address_type
, tvb
, offset
, 1, ENC_NA
);
351 offset
= dissect_bd_addr(hf_bd_addr
, pinfo
, st
, tvb
, offset
, false, interface_id
, adapter_id
, NULL
);
354 case 0x0A: /* Signing Information */
355 proto_tree_add_item(st
, hf_btsmp_signature_key
, tvb
, offset
, 16, ENC_NA
);
359 case 0x0B: /* Security Request */
360 col_append_str(pinfo
->cinfo
, COL_INFO
, ": ");
361 offset
= dissect_btsmp_auth_req(tvb
, offset
, pinfo
, st
);
364 case 0x0C: /* Pairing Public Key */ {
365 proto_item
*sub_item
;
367 sub_item
= proto_tree_add_item(st
, hf_btsmp_public_key_x
, tvb
, offset
, 32, ENC_NA
);
368 if (tvb_memeql(tvb
, offset
, debug_public_key_x
, 32) == 0)
369 proto_item_append_text(sub_item
, " (Debug Key)");
372 sub_item
= proto_tree_add_item(st
, hf_btsmp_public_key_y
, tvb
, offset
, 32, ENC_NA
);
373 if (tvb_memeql(tvb
, offset
, debug_public_key_y
, 32) == 0)
374 proto_item_append_text(sub_item
, " (Debug Key)");
378 case 0x0D: /* Pairing DHKey Check" */
379 proto_tree_add_item(st
, hf_btsmp_dhkey_check
, tvb
, offset
, 16, ENC_NA
);
383 case 0x0E: /* Pairing Keypress Notification */
384 proto_tree_add_item(st
, hf_btsmp_notification_type
, tvb
, offset
, 1, ENC_NA
);
385 col_append_fstr(pinfo
->cinfo
, COL_INFO
, ": %s", val_to_str_const(tvb_get_uint8(tvb
, offset
), notification_type_vals
, "<unknown>"));
397 proto_register_btsmp(void)
399 static hf_register_info hf
[] = {
401 {"Opcode", "btsmp.opcode",
402 FT_UINT8
, BASE_HEX
, VALS(opcode_vals
), 0x0,
406 {"Reason", "btsmp.reason",
407 FT_UINT8
, BASE_HEX
, VALS(reason_vals
), 0x0,
410 {&hf_btsmp_io_capabilities
,
411 {"IO Capability", "btsmp.io_capability",
412 FT_UINT8
, BASE_HEX
, VALS(io_capability_vals
), 0x0,
415 {&hf_btsmp_oob_data_flags
,
416 {"OOB Data Flags", "btsmp.oob_data_flags",
417 FT_UINT8
, BASE_HEX
, VALS(oob_data_flag_vals
), 0x0,
420 {&hf_btsmp_cfm_value
,
421 {"Confirm Value", "btsmp.cfm_value",
422 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
426 {"Random Value", "btsmp.random_value",
427 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
430 {&hf_btsmp_long_term_key
,
431 {"Long Term Key", "btsmp.long_term_key",
432 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
435 {&hf_btsmp_id_resolving_key
,
436 {"Identity Resolving Key", "btsmp.id_resolving_key",
437 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
440 {&hf_btsmp_signature_key
,
441 {"Signature Key", "btsmp.signature_key",
442 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
445 {&hf_btsmp_bonding_flags
,
446 {"Bonding Flags", "btsmp.bonding_flags",
447 FT_UINT8
, BASE_HEX
, VALS(bonding_flag_vals
), 0x03,
450 {&hf_btsmp_mitm_flag
,
451 {"MITM Flag", "btsmp.mitm_flag",
452 FT_BOOLEAN
, 8, NULL
, 0x04,
455 {&hf_btsmp_secure_connection_flag
,
456 {"Secure Connection Flag", "btsmp.sc_flag",
457 FT_BOOLEAN
, 8, NULL
, 0x08,
460 {&hf_btsmp_keypress_flag
,
461 {"Keypress Flag", "btsmp.keypress_flag",
462 FT_BOOLEAN
, 8, NULL
, 0x10,
466 {"CT2 Flag", "btsmp.ct2_flag",
467 FT_BOOLEAN
, 8, NULL
, 0x20,
470 {&hf_btsmp_reserved_flag
,
471 {"Reserved", "btsmp.reserved_flags",
472 FT_UINT8
, BASE_HEX
, NULL
, 0xC0,
475 {&hf_btsmp_max_enc_key_size
,
476 {"Max Encryption Key Size", "btsmp.max_enc_key_size",
477 FT_UINT8
, BASE_DEC
, NULL
, 0x00,
480 {&hf_btsmp_key_dist_enc
,
481 {"Encryption Key (LTK)", "btsmp.key_dist_enc",
482 FT_BOOLEAN
, 8, NULL
, 0x01,
485 {&hf_btsmp_key_dist_id
,
486 {"Id Key (IRK)", "btsmp.key_dist_id",
487 FT_BOOLEAN
, 8, NULL
, 0x02,
490 {&hf_btsmp_key_dist_sign
,
491 {"Signature Key (CSRK)", "btsmp.key_dist_sign",
492 FT_BOOLEAN
, 8, NULL
, 0x04,
495 {&hf_btsmp_key_dist_linkkey
,
496 {"Link Key", "btsmp.key_dist_linkkey",
497 FT_BOOLEAN
, 8, NULL
, 0x08,
500 {&hf_btsmp_key_dist_reserved
,
501 {"Reserved", "btsmp.key_dist_reserved",
502 FT_UINT8
, BASE_HEX
, NULL
, 0xF0,
506 {"Encrypted Diversifier (EDIV)", "btsmp.ediv",
507 FT_UINT16
, BASE_HEX
, NULL
, 0x00,
511 {"AuthReq", "btsmp.authreq",
512 FT_UINT8
, BASE_HEX
, NULL
, 0x00,
515 {&hf_btsmp_initiator_key_distribution
,
516 {"Initiator Key Distribution", "btsmp.initiator_key_distribution",
517 FT_UINT8
, BASE_HEX
, NULL
, 0x00,
520 {&hf_btsmp_responder_key_distribution
,
521 {"Responder Key Distribution", "btsmp.responder_key_distribution",
522 FT_UINT8
, BASE_HEX
, NULL
, 0x00,
526 { "BD_ADDR", "btsmp.bd_addr",
527 FT_ETHER
, BASE_NONE
, NULL
, 0x0,
528 "Bluetooth Device Address", HFILL
}
531 { "Address Type", "btsmp.address_type",
532 FT_UINT8
, BASE_HEX
, VALS(bluetooth_address_type_vals
), 0x0,
535 {&hf_btsmp_public_key_x
,
536 {"Public Key X", "btsmp.public_key_x",
537 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
540 {&hf_btsmp_public_key_y
,
541 {"Public Key Y", "btsmp.public_key_y",
542 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
545 {&hf_btsmp_dhkey_check
,
546 {"DHKey Check", "btsmp.dhkey_check",
547 FT_BYTES
, BASE_NONE
, NULL
, 0x0,
550 {&hf_btsmp_notification_type
,
551 {"Notification Type", "btsmp.notification_type",
552 FT_UINT8
, BASE_HEX
, VALS(notification_type_vals
), 0x0,
557 /* Setup protocol subtree array */
558 static int *ett
[] = {
564 /* Register the protocol name and description */
565 proto_btsmp
= proto_register_protocol("Bluetooth Security Manager Protocol",
568 btsmp_handle
= register_dissector("btsmp", dissect_btsmp
, proto_btsmp
);
570 /* Required function calls to register the header fields and subtrees used */
571 proto_register_field_array(proto_btsmp
, hf
, array_length(hf
));
572 proto_register_subtree_array(ett
, array_length(ett
));
576 proto_reg_handoff_btsmp(void)
578 dissector_add_uint("btl2cap.cid", BTL2CAP_FIXED_CID_SMP
, btsmp_handle
);
579 dissector_add_uint("btl2cap.cid", BTL2CAP_FIXED_CID_BR_EDR_SM
, btsmp_handle
);
583 * Editor modelines - https://www.wireshark.org/tools/modelines.html
588 * indent-tabs-mode: nil
591 * vi: set shiftwidth=4 tabstop=8 expandtab:
592 * :indentSize=4:tabSize=8:noTabs=true: