Re: [Bluez PATCH v3] bluetooth: secure bluetooth stack from bluedump attack

[Johan Hedberg]

Hi Marcel,

On 12. Feb 2020, at 17.19, Marcel Holtmann <marcel@xxxxxxxxxxxx> wrote:
>> +		key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
>> +				   hcon->role);
>> +
>> +		/* If there already exists link key in local host, leave the
>> +		 * decision to user space since the remote device could be
>> +		 * legitimate or malicious.
>> +		 */
>> +		if (smp->method == JUST_WORKS && key) {
>> +			err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
>> +							hcon->type,
>> +							hcon->dst_type, passkey,
>> +							1);
>> +			if (err)
>> +				return SMP_UNSPECIFIED;
>> +			set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
>> +		}
>> 	}
> 
> while this looks good, I like to optimize this to only look up the LTK when needed.
> 
> 	/* comment here */
> 	if (smp->method != JUST_WORKS)
> 		goto mackey_and_ltk;
> 
> 
> 	/* and command here */
> 	if (hci_find_ltk()) {
> 		mgmt_user_confirm_request()
> 		..
> 	}
> 
> And my preference that we also get an Ack from Johan or Luiz that double checked that this is fine.

Acked-by: Johan Hedberg <johan.hedberg@xxxxxxxxx>

Johan