netdev - Re: [Bluez PATCH v3] bluetooth: secure bluetooth stack from bluedump attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 Feb 2020 17:37:53 +0200
From:   Johan Hedberg <johan.hedberg@...il.com>
To:     Marcel Holtmann <marcel@...tmann.org>
Cc:     Howard Chung <howardchung@...gle.com>,
        Bluez mailing list <linux-bluetooth@...r.kernel.org>,
        ChromeOS Bluetooth Upstreaming 
        <chromeos-bluetooth-upstreaming@...omium.org>,
        "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [Bluez PATCH v3] bluetooth: secure bluetooth stack from bluedump
 attack

Hi Marcel,

On 12. Feb 2020, at 17.19, Marcel Holtmann <marcel@...tmann.org> wrote:
>> +		key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
>> +				   hcon->role);
>> +
>> +		/* If there already exists link key in local host, leave the
>> +		 * decision to user space since the remote device could be
>> +		 * legitimate or malicious.
>> +		 */
>> +		if (smp->method == JUST_WORKS && key) {
>> +			err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
>> +							hcon->type,
>> +							hcon->dst_type, passkey,
>> +							1);
>> +			if (err)
>> +				return SMP_UNSPECIFIED;
>> +			set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
>> +		}
>> 	}
> 
> while this looks good, I like to optimize this to only look up the LTK when needed.
> 
> 	/* comment here */
> 	if (smp->method != JUST_WORKS)
> 		goto mackey_and_ltk;
> 
> 
> 	/* and command here */
> 	if (hci_find_ltk()) {
> 		mgmt_user_confirm_request()
> 		..
> 	}
> 
> And my preference that we also get an Ack from Johan or Luiz that double checked that this is fine.

Acked-by: Johan Hedberg <johan.hedberg@...el.com>

Johan