Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\))
Subject: Re: [Bluez PATCH v3] bluetooth: secure bluetooth stack from bluedump
 attack
From:   Johan Hedberg <johan.hedberg@gmail.com>
In-Reply-To: <89D0B633-381D-4700-AB33-5F803BCB6E94@holtmann.org>
Date:   Wed, 12 Feb 2020 17:37:53 +0200
Cc:     Howard Chung <howardchung@google.com>,
        Bluez mailing list <linux-bluetooth@vger.kernel.org>,
        ChromeOS Bluetooth Upstreaming 
        <chromeos-bluetooth-upstreaming@chromium.org>,
        "David S. Miller" <davem@davemloft.net>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <86D0ACD5-BEF7-45B3-B621-BA2E457AB57B@gmail.com>
References: <20200212212316.Bluez.v3.1.Ia71869d2f3e19a76a6a352c61088a085a1d41ba6@changeid>
 <89D0B633-381D-4700-AB33-5F803BCB6E94@holtmann.org>
To:     Marcel Holtmann <marcel@holtmann.org>
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Marcel,

On 12. Feb 2020, at 17.19, Marcel Holtmann <marcel@holtmann.org> wrote:
>> +		key =3D hci_find_ltk(hcon->hdev, &hcon->dst, =
hcon->dst_type,
>> +				   hcon->role);
>> +
>> +		/* If there already exists link key in local host, leave =
the
>> +		 * decision to user space since the remote device could =
be
>> +		 * legitimate or malicious.
>> +		 */
>> +		if (smp->method =3D=3D JUST_WORKS && key) {
>> +			err =3D mgmt_user_confirm_request(hcon->hdev, =
&hcon->dst,
>> +							hcon->type,
>> +							hcon->dst_type, =
passkey,
>> +							1);
>> +			if (err)
>> +				return SMP_UNSPECIFIED;
>> +			set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
>> +		}
>> 	}
>=20
> while this looks good, I like to optimize this to only look up the LTK =
when needed.
>=20
> 	/* comment here */
> 	if (smp->method !=3D JUST_WORKS)
> 		goto mackey_and_ltk;
>=20
>=20
> 	/* and command here */
> 	if (hci_find_ltk()) {
> 		mgmt_user_confirm_request()
> 		..
> 	}
>=20
> And my preference that we also get an Ack from Johan or Luiz that =
double checked that this is fine.

Acked-by: Johan Hedberg <johan.hedberg@intel.com>

Johan=