RE: [Bluez-devel] Service level security for RFCOMM

[Marcel Holtmann <marcel@holtmann.org>]

Hi Steve,

> > However this also leads to a security problem, because I can scan the
> > RFCOMM ports of a remote device without forcing the security mechanism.
> > I only have to do the PN exchange and then disconnect. What should a
> > remote device do when a PN CMD comes in for a channel without a service
> > behind it?
> 
> If the spec says that authentication can only happen on receipt of SABM,
> then I guess this leaves it open to port scans. 
> 
> However, does this really matter? If you want to protect _all_ services,
> use security mode 3. If you're in security mode 2, it's most likely that
> you can do SDP searches without performing a security procedure and
> discover open channels that way.

yes, it matters, because security mode 3 is never the answer to any
security related problems. You still need a very good policy engine
behind the security manager to protect your device. I would advice
anybody not to use security mode 3, even if the device supports only a
single service. A single trust model is not working.

> > Sorry, I don't get the point. Why should a client care about security
> > mode 2, when it want to connect to a server in security mode 1. Actually
> > the server must know what services to protect and not the client. If you
> > have such server running, then this is a wrong designed server from my
> > point of view.
> 
> Well, for example, a client may wish to authenticate a server before
> connecting to it, irrespective of the security the service wants for
> itself.

I still don't see the full need behind this, but send in a clean patch
for it and I will apply it. There should be no problem to support it.

Regards

Marcel




-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel