[Bluez-users] access restrictions after passing PIN

[Bluez-users] access restrictions after passing PIN

[Michal Nowikowski]

Hello

I've got a question. Is there any restriction of accessing services
after passing the pairing procedure? I think about situation when both
devices are paired and I suppose that now there is no restriction of
use of any services like serial port or any other. So is there a
danger of overuse of these services (i.e. in mobile phones it is
possible to manage them seemlessly through serial port from PC)?

Thanks in advance
Godfryd


-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Bluez-users mailing list
Bluez-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-users

Re: [Bluez-users] access restrictions after passing PIN

[Marcel Holtmann]

Hi Godfryd,

> I've got a question. Is there any restriction of accessing services
> after passing the pairing procedure? I think about situation when both
> devices are paired and I suppose that now there is no restriction of
> use of any services like serial port or any other. So is there a
> danger of overuse of these services (i.e. in mobile phones it is
> possible to manage them seemlessly through serial port from PC)?

this depends on if the device implements a policy manager or not. If it
uses a simple trust model based on the link key and the device address
then there are no other restrictions.

Regards

Marcel




-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Bluez-users mailing list
Bluez-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-users

Re: [Bluez-users] access restrictions after passing PIN

[Michal Nowikowski]

On 29/04/05, Marcel Holtmann <marcel@holtmann.org> wrote:
> Hi Godfryd,
>=20
> > I've got a question. Is there any restriction of accessing services
> > after passing the pairing procedure? I think about situation when both
> > devices are paired and I suppose that now there is no restriction of
> > use of any services like serial port or any other. So is there a
> > danger of overuse of these services (i.e. in mobile phones it is
> > possible to manage them seemlessly through serial port from PC)?
>=20
> this depends on if the device implements a policy manager or not. If it
> uses a simple trust model based on the link key and the device address
> then there are no other restrictions.

Is this "policy manager" specified somehow by Bluetooth SIG? Or is
this just a good will of e.g. cell phone manufaturers? I could find
anything but security modes (1,2,3) about access restrictions, but it
isn't what I need.

Godfryd


-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Bluez-users mailing list
Bluez-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-users

Re: [Bluez-users] access restrictions after passing PIN

[Marcel Holtmann]

Hi Godfryd,

> > > I've got a question. Is there any restriction of accessing services
> > > after passing the pairing procedure? I think about situation when both
> > > devices are paired and I suppose that now there is no restriction of
> > > use of any services like serial port or any other. So is there a
> > > danger of overuse of these services (i.e. in mobile phones it is
> > > possible to manage them seemlessly through serial port from PC)?
> > 
> > this depends on if the device implements a policy manager or not. If it
> > uses a simple trust model based on the link key and the device address
> > then there are no other restrictions.
> 
> Is this "policy manager" specified somehow by Bluetooth SIG? Or is
> this just a good will of e.g. cell phone manufaturers? I could find
> anything but security modes (1,2,3) about access restrictions, but it
> isn't what I need.

read the Bluetooth security whitepaper.

Regards

Marcel




-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Bluez-users mailing list
Bluez-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-users

[Bluez-users] Timeouts

[Pedro Monjo Florit]

Hi Marcel & everybody else,

I am having some trouble with the timeouts of connections under Bluetooth.

My first concern is the initial connection timeout. I try to send a file 
to a mobile phone using OpenOBEX (I use the BtOBEX_TransportConnect()). 
If the owner of the mobile phone ignores the message that appears in the 
mobile's screen (asking him/her whether to accept the connection), after 
30 seconds the connection fails with "Resource temporarily unavailable" 
(errno=11). How can I modify this 30 seconds?

I can control the page timeout issuing "hciconfig hci0 pageto 8192", 
that will limit the time for (correct me if I am wrong) completing the 
HCI connection to about 5 seconds. But my problem is at a higher level 
(RFCOMM), since the device is whithin range and the HCI connection is 
done correctly. Is there any specific command in the bluez API to change 
the overall connect() timeout? Or is this a Linux issue (something like 
setsockopt())?

In other words, what I want is that if the user does not respond within 
a few seconds (much less than 30 seconds), the connection times out. I 
need that because I may have many clients waiting and I can only 
establish a connection to one at a time and I do not want the other 
clients to wait too long.

The other problem is with the call sdp_service_search_attr_req(). There 
is one mobile that I am testing, that does not always respond (I am 
trying to track down the reason). This call takes about 2 minutes to 
give up so, in the previous scenario, it means that other clients are 
waiting for two minutes, something unacceptable. Is there a way to 
reduce this 2 minutes timeout?

Thanks & regards,

Pedro



-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Bluez-users mailing list
Bluez-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-users

Re: [Bluez-users] Timeouts

[Marcel Holtmann]

Hi Pedro,

> I am having some trouble with the timeouts of connections under Bluetooth.
> 
> My first concern is the initial connection timeout. I try to send a file 
> to a mobile phone using OpenOBEX (I use the BtOBEX_TransportConnect()). 
> If the owner of the mobile phone ignores the message that appears in the 
> mobile's screen (asking him/her whether to accept the connection), after 
> 30 seconds the connection fails with "Resource temporarily unavailable" 
> (errno=11). How can I modify this 30 seconds?

you need to integrate a connect timeout (SABM timeout) into the RFCOMM
kernel code.

> I can control the page timeout issuing "hciconfig hci0 pageto 8192", 
> that will limit the time for (correct me if I am wrong) completing the 
> HCI connection to about 5 seconds. But my problem is at a higher level 
> (RFCOMM), since the device is whithin range and the HCI connection is 
> done correctly. Is there any specific command in the bluez API to change 
> the overall connect() timeout? Or is this a Linux issue (something like 
> setsockopt())?

The page timeout is only for the underlaying ACL links. The RFCOMM stuff
is not configurable at the moment.

> The other problem is with the call sdp_service_search_attr_req(). There 
> is one mobile that I am testing, that does not always respond (I am 
> trying to track down the reason). This call takes about 2 minutes to 
> give up so, in the previous scenario, it means that other clients are 
> waiting for two minutes, something unacceptable. Is there a way to 
> reduce this 2 minutes timeout?

I have no idea. I need the phone to play with it.

Regards

Marcel




-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Bluez-users mailing list
Bluez-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-users