| Message ID | 20250408170915.623602-1-frederic.danis@collabora.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Bluetooth: l2cap: Check encryption key size on incoming connection | expand |
Hi Frédéric, On Tue, Apr 8, 2025 at 1:09 PM Frédéric Danis <frederic.danis@collabora.com> wrote: > > This is required for passing GAP/SEC/SEM/BI-04-C PTS test case: > Security Mode 4 Level 4, Responder - Invalid Encryption Key Size > - 128 bit > > This tests the security key with size from 1 to 15 bytes while the > Security Mode 4 Level 4 requests 16 bytes key size. > > Currently PTS fails with the following logs: > - expected:Connection Response: > Code: [3 (0x03)] Code > Identifier: (lt)WildCard: Exists(gt) > Length: [8 (0x0008)] > Destination CID: (lt)WildCard: Exists(gt) > Source CID: [64 (0x0040)] > Result: [3 (0x0003)] Connection refused - Security block > Status: (lt)WildCard: Exists(gt), > but received:Connection Response: > Code: [3 (0x03)] Code > Identifier: [1 (0x01)] > Length: [8 (0x0008)] > Destination CID: [64 (0x0040)] > Source CID: [64 (0x0040)] > Result: [0 (0x0000)] Connection Successful > Status: [0 (0x0000)] No further information available > > And HCI logs: > < HCI Command: Read Encrypti.. (0x05|0x0008) plen 2 > Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) > > HCI Event: Command Complete (0x0e) plen 7 > Read Encryption Key Size (0x05|0x0008) ncmd 1 > Status: Success (0x00) > Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) > Key size: 7 > > ACL Data RX: Handle 14 flags 0x02 dlen 12 > L2CAP: Connection Request (0x02) ident 1 len 4 > PSM: 4097 (0x1001) > Source CID: 64 > < ACL Data TX: Handle 14 flags 0x00 dlen 16 > L2CAP: Connection Response (0x03) ident 1 len 8 > Destination CID: 64 > Source CID: 64 > Result: Connection successful (0x0000) > Status: No further information available (0x0000) > > Signed-off-by: Frédéric Danis <frederic.danis@collabora.com> > --- > net/bluetooth/l2cap_core.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c > index c7b66b2ea9f2..f2ab09582146 100644 > --- a/net/bluetooth/l2cap_core.c > +++ b/net/bluetooth/l2cap_core.c > @@ -3997,6 +3997,13 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, > goto response; > } > > + /* Check the encryption key size */ > + if (!l2cap_check_enc_key_size(conn->hcon)) { > + conn->disc_reason = HCI_ERROR_AUTH_FAILURE; > + result = L2CAP_CR_SEC_BLOCK; > + goto response; > + } > + Hmm maybe we should incorporate this is the statement before: /* Check if the ACL is secure enough (if not SDP) */ if (psm != cpu_to_le16(L2CAP_PSM_SDP) && !hci_conn_check_link_mode(conn->hcon)) { conn->disc_reason = HCI_ERROR_AUTH_FAILURE; result = L2CAP_CR_SEC_BLOCK; goto response; } That said I don't quite understand why the likes of hci_conn_check_link_mode is not checking the key size since it is already doing security level checks, either way that indeed seem to be missing for incoming connection requests. > result = L2CAP_CR_NO_MEM; > > /* Check for valid dynamic CID range (as per Erratum 3253) */ > -- > 2.43.0 > >
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=951217 ---Test result--- Test Summary: CheckPatch PENDING 0.33 seconds GitLint PENDING 0.23 seconds SubjectPrefix PASS 0.12 seconds BuildKernel PASS 28.75 seconds CheckAllWarning PASS 29.00 seconds CheckSparse PASS 45.36 seconds BuildKernel32 PASS 30.55 seconds TestRunnerSetup PASS 479.36 seconds TestRunner_l2cap-tester PASS 21.96 seconds TestRunner_iso-tester FAIL 121.76 seconds TestRunner_bnep-tester PASS 4.90 seconds TestRunner_mgmt-tester FAIL 131.22 seconds TestRunner_rfcomm-tester PASS 13.00 seconds TestRunner_sco-tester PASS 12.71 seconds TestRunner_ioctl-tester PASS 8.54 seconds TestRunner_mesh-tester FAIL 9.33 seconds TestRunner_smp-tester PASS 15.16 seconds TestRunner_userchan-tester PASS 6.96 seconds IncrementalBuild PENDING 0.79 seconds Details ############################## Test: CheckPatch - PENDING Desc: Run checkpatch.pl script Output: ############################## Test: GitLint - PENDING Desc: Run gitlint Output: ############################## Test: TestRunner_iso-tester - FAIL Desc: Run iso-tester with test-runner Output: BUG: KASAN: slab-use-after-free in iso_conn_hold_unless_zero+0x78/0x1c0 Total: 124, Passed: 123 (99.2%), Failed: 0, Not Run: 1 ############################## Test: TestRunner_mgmt-tester - FAIL Desc: Run mgmt-tester with test-runner Output: Total: 490, Passed: 485 (99.0%), Failed: 1, Not Run: 4 Failed Test Cases LL Privacy - Start Discovery 2 (Disable RL) Failed 0.190 seconds ############################## Test: TestRunner_mesh-tester - FAIL Desc: Run mesh-tester with test-runner Output: BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76f/0x7d0 WARNING: CPU: 0 PID: 36 at kernel/workqueue.c:2257 __queue_work+0x93e/0xba0 Total: 10, Passed: 9 (90.0%), Failed: 1, Not Run: 0 Failed Test Cases Mesh - Send cancel - 1 Failed 0.107 seconds ############################## Test: IncrementalBuild - PENDING Desc: Incremental build with the patches in the series Output: --- Regards, Linux Bluetooth
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index c7b66b2ea9f2..f2ab09582146 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3997,6 +3997,13 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, goto response; } + /* Check the encryption key size */ + if (!l2cap_check_enc_key_size(conn->hcon)) { + conn->disc_reason = HCI_ERROR_AUTH_FAILURE; + result = L2CAP_CR_SEC_BLOCK; + goto response; + } + result = L2CAP_CR_NO_MEM; /* Check for valid dynamic CID range (as per Erratum 3253) */
This is required for passing GAP/SEC/SEM/BI-04-C PTS test case: Security Mode 4 Level 4, Responder - Invalid Encryption Key Size - 128 bit This tests the security key with size from 1 to 15 bytes while the Security Mode 4 Level 4 requests 16 bytes key size. Currently PTS fails with the following logs: - expected:Connection Response: Code: [3 (0x03)] Code Identifier: (lt)WildCard: Exists(gt) Length: [8 (0x0008)] Destination CID: (lt)WildCard: Exists(gt) Source CID: [64 (0x0040)] Result: [3 (0x0003)] Connection refused - Security block Status: (lt)WildCard: Exists(gt), but received:Connection Response: Code: [3 (0x03)] Code Identifier: [1 (0x01)] Length: [8 (0x0008)] Destination CID: [64 (0x0040)] Source CID: [64 (0x0040)] Result: [0 (0x0000)] Connection Successful Status: [0 (0x0000)] No further information available And HCI logs: < HCI Command: Read Encrypti.. (0x05|0x0008) plen 2 Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) > HCI Event: Command Complete (0x0e) plen 7 Read Encryption Key Size (0x05|0x0008) ncmd 1 Status: Success (0x00) Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) Key size: 7 > ACL Data RX: Handle 14 flags 0x02 dlen 12 L2CAP: Connection Request (0x02) ident 1 len 4 PSM: 4097 (0x1001) Source CID: 64 < ACL Data TX: Handle 14 flags 0x00 dlen 16 L2CAP: Connection Response (0x03) ident 1 len 8 Destination CID: 64 Source CID: 64 Result: Connection successful (0x0000) Status: No further information available (0x0000) Signed-off-by: Frédéric Danis <frederic.danis@collabora.com> --- net/bluetooth/l2cap_core.c | 7 +++++++ 1 file changed, 7 insertions(+)