Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: G9qlvWBLHNqe0ctE+oeyWJY6oRWPvJQbgJ8o/BjYQCB/09z3/e7cKnDQSTn6ZI9m7JN/E5qbeN
 OlXzZSEVczUw==
IronPort-SDR: kp4/LWq3XYx+2T8q5+q/Lcb1XYfUIZRDNZyaNBwKBTsYlc7suKxsSxxRIb+yOwGXSuK9GUFQ4/
 k/gUDeti9PFw==
From:   Brian Gix <brian.gix@intel.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     inga.stotland@intel.com, brian.gix@intel.com
Subject: [PATCH BlueZ] mesh: Add Provisioning Confirmation validity check
Date:   Thu,  8 Apr 2021 12:09:28 -0700
Message-Id: <20210408190928.1645427-1-brian.gix@intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Validate generated and received confirmation data is unique during
provisioning.
---
 mesh/prov-acceptor.c  | 13 +++++++++++--
 mesh/prov-initiator.c |  8 ++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/mesh/prov-acceptor.c b/mesh/prov-acceptor.c
index 4ec6ea34a..e806b12ef 100644
--- a/mesh/prov-acceptor.c
+++ b/mesh/prov-acceptor.c
@@ -347,14 +347,20 @@ static void send_pub_key(struct mesh_prov_acceptor *prov)
 	prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
 }
 
-static void send_conf(struct mesh_prov_acceptor *prov)
+static bool send_conf(struct mesh_prov_acceptor *prov)
 {
 	struct prov_conf_msg msg;
 
 	msg.opcode = PROV_CONFIRM;
 	mesh_crypto_aes_cmac(prov->calc_key, prov->rand_auth_workspace, 32,
 								msg.conf);
+
+	/* Fail if confirmations match */
+	if (!memcmp(msg.conf, prov->confirm, sizeof(msg.conf)))
+		return false;
+
 	prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+	return true;
 }
 
 static void send_rand(struct mesh_prov_acceptor *prov)
@@ -529,7 +535,10 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
 		memcpy(prov->confirm, data, 16);
 		prov->expected = PROV_RANDOM;
 
-		send_conf(prov);
+		if (!send_conf(prov)) {
+			fail.reason = PROV_ERR_INVALID_PDU;
+			goto failure;
+		}
 		break;
 
 	case PROV_RANDOM: /* Random Value */
diff --git a/mesh/prov-initiator.c b/mesh/prov-initiator.c
index 4f492a49c..ae9c646de 100644
--- a/mesh/prov-initiator.c
+++ b/mesh/prov-initiator.c
@@ -279,6 +279,7 @@ static void send_confirm(struct mesh_prov_initiator *prov)
 	msg.opcode = PROV_CONFIRM;
 	mesh_crypto_aes_cmac(prov->calc_key, prov->rand_auth_workspace,
 			32, msg.conf);
+	memcpy(prov->confirm, msg.conf, sizeof(prov->confirm));
 	prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
 	prov->state = INT_PROV_CONF_SENT;
 	prov->expected = PROV_CONFIRM;
@@ -732,6 +733,13 @@ static void int_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
 	case PROV_CONFIRM: /* Confirmation */
 		prov->state = INT_PROV_CONF_ACKED;
 		/* RXed Device Confirmation */
+
+		/* Disallow echoed values */
+		if (!memcmp(prov->confirm, data, 16)) {
+			fail_code[1] = PROV_ERR_INVALID_PDU;
+			goto failure;
+		}
+
 		memcpy(prov->confirm, data, 16);
 		print_packet("ConfirmationDevice", prov->confirm, 16);
 		send_random(prov);
-- 
2.25.4