LinuxLists.cc - [Bluez-devel] Problem with security mode 3

2003-07-02 15:46:55

Subject: [Bluez-devel] Problem with security mode 3

Hi Max,

there is a little problem with local devices in security mode 3
(hciconfig hci0 auth). If you have already paired two devices, but you
have used your dongle within another OS and paired it again to the same
remote device. The local link key stored by the hcid is outdated. But
this can not be known by the hcid and so it sends it on the next
connection request. The remote device will deny the connection because
of the wrong link key, but the error you get is not an authentication
failure. You get the timeout error from the L2CAP layer.

< HCI Command: Write Authentication Enable(0x03|0x0020) plen 1
01
> HCI Event: Command Complete(0x0e) plen 4
01 20 0C 00
< HCI Command: Create Connection(0x01|0x0005) plen 13
FD 06 81 0E 04 00 18 CC 01 00 00 00 01
> HCI Event: Command Status(0x0f) plen 4
00 01 05 04
> HCI Event: Link Key Request(0x17) plen 6
FD 06 81 0E 04 00
< HCI Command: Link Key Request Reply(0x01|0x000b) plen 22
FD 06 81 0E 04 00 38 06 D7 5D E2 DD FD 10 88 EF 5A 65 66 C2
80 26
> HCI Event: Connect Complete(0x03) plen 11
05 00 00 FD 06 81 0E 04 00 01 00

I have looked at hci_conn_complete_evt() and l2cap_connect_cfm() and the
code seems correct to me.

If you try to connect again after the timeout, you will get a "Operation
already in progress" error.

Where is the problem?

Regards

Marcel

-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

2003-07-23 00:07:29

by Max Krasnyansky

[permalink] [raw]

Subject: Re: [Bluez-devel] Problem with security mode 3

At 05:48 PM 7/3/2003, Marcel Holtmann wrote:
>Hi Max,
>
>> >there is a little problem with local devices in security mode 3
>> >(hciconfig hci0 auth). If you have already paired two devices, but you
>> >have used your dongle within another OS and paired it again to the same
>> >remote device. The local link key stored by the hcid is outdated. But
>> >this can not be known by the hcid and so it sends it on the next
>> >connection request. The remote device will deny the connection because
>> >of the wrong link key, but the error you get is not an authentication
>> >failure. You get the timeout error from the L2CAP layer.
>> >
>> > < HCI Command: Write Authentication Enable(0x03|0x0020) plen 1
>> > 01
>> > > HCI Event: Command Complete(0x0e) plen 4
>> > 01 20 0C 00
>> > < HCI Command: Create Connection(0x01|0x0005) plen 13
>> > FD 06 81 0E 04 00 18 CC 01 00 00 00 01
>> > > HCI Event: Command Status(0x0f) plen 4
>> > 00 01 05 04
>> > > HCI Event: Link Key Request(0x17) plen 6
>> > FD 06 81 0E 04 00
>> > < HCI Command: Link Key Request Reply(0x01|0x000b) plen 22
>> > FD 06 81 0E 04 00 38 06 D7 5D E2 DD FD 10 88 EF 5A 65 66 C2
>> > 80 26
>> > > HCI Event: Connect Complete(0x03) plen 11
>> > 05 00 00 FD 06 81 0E 04 00 01 00
>> >
>> >I have looked at hci_conn_complete_evt() and l2cap_connect_cfm() and the
>> >code seems correct to me.
>> >
>> >If you try to connect again after the timeout, you will get a "Operation
>> >already in progress" error.
>> >
>> >Where is the problem?
>> Did you pull all of my latest fixes ? That bug was introduced by
>> SO_LINGER patch (bt_sock_wait_state() to be more specific). I fixed it
>> some time ago (should be in -pre2). The bug is unrelated to security
>> and stuff and affects connect in general (ie it'd timeout instead of an error).
>
>it is still present in 2.4.22-pre2 :(

I can't reproduce that. I just did like you said paired two device, saved link_key file,
repaired them and restored old link_key file. So my laptop that is running latest and greatest
2.4.BK has old key now. I even got exactly the same hcidump traces.

< HCI Command: Write Authentication Enable(0x03|0x0020) plen 1
01

[root@champ bluetooth]# l2ping 00:04:23:00:3D:06
Can't connect.: Permission denied

> HCI Event: Command Complete(0x0e) plen 4
01 20 0C 00
< HCI Command: Create Connection(0x01|0x0005) plen 13
06 3D 00 23 04 00 18 CC 01 00 00 00 01
> HCI Event: Command Status(0x0f) plen 4
00 01 05 04
> HCI Event: Link Key Request(0x17) plen 6
06 3D 00 23 04 00
< HCI Command: Link Key Request Reply(0x01|0x000b) plen 22
06 3D 00 23 04 00 EC 91 7B 09 2F C9 17 F6 0D A4 1F 51 99 D7
98 7E
> HCI Event: Command Complete(0x0e) plen 10
01 0B 04 00 06 3D 00 23 04 00
> HCI Event: Connect Complete(0x03) plen 11
05 28 00 06 3D 00 23 04 00 01 00

[root@champ utils]# sdptool browse 00:04:23:00:3D:06
Failed to connect to SDP server on 00:04:23:00:3D:06: Permission denied

< HCI Command: Create Connection(0x01|0x0005) plen 13
06 3D 00 23 04 00 18 CC 01 00 00 00 01
> HCI Event: Command Status(0x0f) plen 4
00 01 05 04
> HCI Event: Link Key Request(0x17) plen 6
06 3D 00 23 04 00
< HCI Command: Link Key Request Reply(0x01|0x000b) plen 22
06 3D 00 23 04 00 EC 91 7B 09 2F C9 17 F6 0D A4 1F 51 99 D7
98 7E
> HCI Event: Command Complete(0x0e) plen 10
01 0B 04 00 06 3D 00 23 04 00
> HCI Event: Connect Complete(0x03) plen 11
05 28 00 06 3D 00 23 04 00 01 00

As you see I get correct error and no timeouts. If I remove link_key from
laptop I can pair again and everything works fine.

Max

2003-07-18 00:29:21

by Max Krasnyansky

[permalink] [raw]

Subject: Re: [Bluez-devel] Problem with security mode 3

2003-07-04 00:48:35

by Marcel Holtmann

[permalink] [raw]

Subject: Re: [Bluez-devel] Problem with security mode 3

Hi Max,

> >there is a little problem with local devices in security mode 3
> >(hciconfig hci0 auth). If you have already paired two devices, but you
> >have used your dongle within another OS and paired it again to the same
> >remote device. The local link key stored by the hcid is outdated. But
> >this can not be known by the hcid and so it sends it on the next
> >connection request. The remote device will deny the connection because
> >of the wrong link key, but the error you get is not an authentication
> >failure. You get the timeout error from the L2CAP layer.
> >
> > < HCI Command: Write Authentication Enable(0x03|0x0020) plen 1
> > 01
> > > HCI Event: Command Complete(0x0e) plen 4
> > 01 20 0C 00
> > < HCI Command: Create Connection(0x01|0x0005) plen 13
> > FD 06 81 0E 04 00 18 CC 01 00 00 00 01
> > > HCI Event: Command Status(0x0f) plen 4
> > 00 01 05 04
> > > HCI Event: Link Key Request(0x17) plen 6
> > FD 06 81 0E 04 00
> > < HCI Command: Link Key Request Reply(0x01|0x000b) plen 22
> > FD 06 81 0E 04 00 38 06 D7 5D E2 DD FD 10 88 EF 5A 65 66 C2
> > 80 26
> > > HCI Event: Connect Complete(0x03) plen 11
> > 05 00 00 FD 06 81 0E 04 00 01 00
> >
> >I have looked at hci_conn_complete_evt() and l2cap_connect_cfm() and the
> >code seems correct to me.
> >
> >If you try to connect again after the timeout, you will get a "Operation
> >already in progress" error.
> >
> >Where is the problem?
> Did you pull all of my latest fixes ? That bug was introduced by
> SO_LINGER patch (bt_sock_wait_state() to be more specific). I fixed it
> some time ago (should be in -pre2). The bug is unrelated to security
> and stuff and affects connect in general (ie it'd timeout instead of an error).

it is still present in 2.4.22-pre2 :(

Regards

Marcel

-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

2003-07-04 00:40:20

by Max Krasnyansky

[permalink] [raw]

Subject: Re: [Bluez-devel] Problem with security mode 3

At 08:46 AM 7/2/2003, Marcel Holtmann wrote:
>Hi Max,
>
>there is a little problem with local devices in security mode 3
>(hciconfig hci0 auth). If you have already paired two devices, but you
>have used your dongle within another OS and paired it again to the same
>remote device. The local link key stored by the hcid is outdated. But
>this can not be known by the hcid and so it sends it on the next
>connection request. The remote device will deny the connection because
>of the wrong link key, but the error you get is not an authentication
>failure. You get the timeout error from the L2CAP layer.
>
> < HCI Command: Write Authentication Enable(0x03|0x0020) plen 1
> 01
> > HCI Event: Command Complete(0x0e) plen 4
> 01 20 0C 00
> < HCI Command: Create Connection(0x01|0x0005) plen 13
> FD 06 81 0E 04 00 18 CC 01 00 00 00 01
> > HCI Event: Command Status(0x0f) plen 4
> 00 01 05 04
> > HCI Event: Link Key Request(0x17) plen 6
> FD 06 81 0E 04 00
> < HCI Command: Link Key Request Reply(0x01|0x000b) plen 22
> FD 06 81 0E 04 00 38 06 D7 5D E2 DD FD 10 88 EF 5A 65 66 C2
> 80 26
> > HCI Event: Connect Complete(0x03) plen 11
> 05 00 00 FD 06 81 0E 04 00 01 00
>
>I have looked at hci_conn_complete_evt() and l2cap_connect_cfm() and the
>code seems correct to me.
>
>If you try to connect again after the timeout, you will get a "Operation
>already in progress" error.
>
>Where is the problem?
Did you pull all of my latest fixes ? That bug was introduced by
SO_LINGER patch (bt_sock_wait_state() to be more specific). I fixed it
some time ago (should be in -pre2). The bug is unrelated to security
and stuff and affects connect in general (ie it'd timeout instead of an error).

Max