* [PATCH BlueZ v2 2/5] nesh: Normalize endian of public/private ECC keys
2021-05-19 18:21 [PATCH BlueZ v2 0/5] OOB Authentication improvements Brian Gix
2021-05-19 18:21 ` [PATCH BlueZ v2 1/5] mesh: Fix delivery of PB-ACK to acceptors Brian Gix
@ 2021-05-19 18:21 ` Brian Gix
2021-05-19 18:21 ` [PATCH BlueZ v2 3/5] tools/mesh: Add all supported OOB methods to cfgclient Brian Gix
` (2 subsequent siblings)
4 siblings, 0 replies; 9+ messages in thread
From: Brian Gix @ 2021-05-19 18:21 UTC (permalink / raw)
To: linux-bluetooth; +Cc: inga.stotland, brian.gix
The Mesh profile specification defines a Mesh byte order of Big Endian
for Public keys used to calculate shared secrets. Further the
specification sample data also show this same byte order for Private
keys. However, our internal ECDH shared secret calculation requires
Little Endian byte ordering. This fixes our DBus interface, and
debugging output to use Mesh Byte Ordering (Big Endian) for all human
readable input/output.
---
mesh/prov-acceptor.c | 8 +++++++-
mesh/prov-initiator.c | 3 +++
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/mesh/prov-acceptor.c b/mesh/prov-acceptor.c
index e806b12ef..0dbb84f50 100644
--- a/mesh/prov-acceptor.c
+++ b/mesh/prov-acceptor.c
@@ -223,7 +223,11 @@ static bool acp_credentials(struct mesh_prov_acceptor *prov)
print_packet("PublicKeyProv", prov->conf_inputs.prv_pub_key, 64);
print_packet("PublicKeyDev", prov->conf_inputs.dev_pub_key, 64);
+
+ /* Normalize for debug out -- No longer needed for calculations */
+ swap_u256_bytes(prov->private_key);
print_packet("PrivateKeyLocal", prov->private_key, 32);
+
print_packet("ConfirmationInputs", &prov->conf_inputs,
sizeof(prov->conf_inputs));
print_packet("ECDHSecret", prov->secret, 32);
@@ -307,11 +311,13 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
return;
}
+ /* API delivers Mesh byte order, switch to little endian */
+ swap_u256_bytes(key);
memcpy(prov->private_key, key, 32);
ecc_make_public_key(prov->private_key,
prov->conf_inputs.dev_pub_key);
- /* Convert to Mesh byte order */
+ /* Convert Public key to Mesh byte order */
swap_u256_bytes(prov->conf_inputs.dev_pub_key);
swap_u256_bytes(prov->conf_inputs.dev_pub_key + 32);
diff --git a/mesh/prov-initiator.c b/mesh/prov-initiator.c
index ae9c646de..c62577523 100644
--- a/mesh/prov-initiator.c
+++ b/mesh/prov-initiator.c
@@ -222,6 +222,9 @@ static bool int_credentials(struct mesh_prov_initiator *prov)
print_packet("PublicKeyProv", prov->conf_inputs.prv_pub_key, 64);
print_packet("PublicKeyDev", prov->conf_inputs.dev_pub_key, 64);
+
+ /* Print DBG out in Mesh order */
+ swap_u256_bytes(prov->private_key);
print_packet("PrivateKeyLocal", prov->private_key, 32);
print_packet("ConfirmationInputs", &prov->conf_inputs,
sizeof(prov->conf_inputs));
--
2.25.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH BlueZ v2 3/5] tools/mesh: Add all supported OOB methods to cfgclient
2021-05-19 18:21 [PATCH BlueZ v2 0/5] OOB Authentication improvements Brian Gix
2021-05-19 18:21 ` [PATCH BlueZ v2 1/5] mesh: Fix delivery of PB-ACK to acceptors Brian Gix
2021-05-19 18:21 ` [PATCH BlueZ v2 2/5] nesh: Normalize endian of public/private ECC keys Brian Gix
@ 2021-05-19 18:21 ` Brian Gix
2021-05-19 18:21 ` [PATCH BlueZ v2 4/5] test/mesh: Add support for testing more OOB auth Brian Gix
2021-05-19 18:21 ` [PATCH BlueZ v2 5/5] mesh: Add single threading to prov-acp ob messaging Brian Gix
4 siblings, 0 replies; 9+ messages in thread
From: Brian Gix @ 2021-05-19 18:21 UTC (permalink / raw)
To: linux-bluetooth; +Cc: inga.stotland, brian.gix
To support the widest range of mesh devices, we need to support any
possible capability combinations that a remote device may request.
---
tools/mesh-cfgclient.c | 32 +++++++++++++++++++++++++++-----
1 file changed, 27 insertions(+), 5 deletions(-)
diff --git a/tools/mesh-cfgclient.c b/tools/mesh-cfgclient.c
index 49069674f..a4a6f21ab 100644
--- a/tools/mesh-cfgclient.c
+++ b/tools/mesh-cfgclient.c
@@ -104,7 +104,17 @@ static struct model_info *cfgcli;
static struct l_queue *devices;
static bool prov_in_progress;
-static const char *caps[] = {"static-oob", "out-numeric", "in-numeric"};
+static const char * const caps[] = {"static-oob",
+ "push",
+ "twist",
+ "blink",
+ "beep",
+ "vibrate",
+ "public-oob",
+ "out-alpha",
+ "in-alpha",
+ "out-numeric",
+ "in-numeric"};
static bool have_config;
@@ -419,7 +429,7 @@ static void agent_input_done(oob_type_t type, void *buf, uint16_t len,
struct l_dbus_message *reply = NULL;
struct l_dbus_message_builder *builder;
uint32_t val_u32;
- uint8_t oob_data[16];
+ uint8_t oob_data[64];
switch (type) {
case NONE:
@@ -435,15 +445,15 @@ static void agent_input_done(oob_type_t type, void *buf, uint16_t len,
/* Fall Through */
case HEXADECIMAL:
- if (len > 16) {
+ if (len > sizeof(oob_data)) {
bt_shell_printf("Bad input length\n");
break;
}
- memset(oob_data, 0, 16);
+ memset(oob_data, 0, sizeof(oob_data));
memcpy(oob_data, buf, len);
reply = l_dbus_message_new_method_return(msg);
builder = l_dbus_message_builder_new(reply);
- append_byte_array(builder, oob_data, 16);
+ append_byte_array(builder, oob_data, len);
l_dbus_message_builder_finalize(builder);
l_dbus_message_builder_destroy(builder);
break;
@@ -580,6 +590,16 @@ static struct l_dbus_message *prompt_numeric_call(struct l_dbus *dbus,
return NULL;
}
+static struct l_dbus_message *prompt_public_call(struct l_dbus *dbus,
+ struct l_dbus_message *msg,
+ void *user_data)
+{
+ l_dbus_message_ref(msg);
+ agent_input_request(HEXADECIMAL, 64, "Enter 512 bit Public Key",
+ agent_input_done, msg);
+ return NULL;
+}
+
static struct l_dbus_message *prompt_static_call(struct l_dbus *dbus,
struct l_dbus_message *msg,
void *user_data)
@@ -618,6 +638,8 @@ static void setup_agent_iface(struct l_dbus_interface *iface)
"u", "s", "number", "type");
l_dbus_interface_method(iface, "PromptStatic", 0, prompt_static_call,
"ay", "s", "data", "type");
+ l_dbus_interface_method(iface, "PublicKey", 0, prompt_public_call,
+ "ay", "", "data");
}
static bool register_agent(void)
--
2.25.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH BlueZ v2 5/5] mesh: Add single threading to prov-acp ob messaging
2021-05-19 18:21 [PATCH BlueZ v2 0/5] OOB Authentication improvements Brian Gix
` (3 preceding siblings ...)
2021-05-19 18:21 ` [PATCH BlueZ v2 4/5] test/mesh: Add support for testing more OOB auth Brian Gix
@ 2021-05-19 18:21 ` Brian Gix
4 siblings, 0 replies; 9+ messages in thread
From: Brian Gix @ 2021-05-19 18:21 UTC (permalink / raw)
To: linux-bluetooth; +Cc: inga.stotland, brian.gix
Certain IOP and stress testing scenarios can cause additional outbound
messages to be attempted before the prior outbound message completes.
This patch adds queuing if outbpund messages are attempted too quickly
so that the additional message is not sent until the prior message is
ACKed.
---
mesh/prov-acceptor.c | 88 +++++++++++++++++++++++++++-----------------
mesh/provision.h | 1 +
2 files changed, 56 insertions(+), 33 deletions(-)
diff --git a/mesh/prov-acceptor.c b/mesh/prov-acceptor.c
index 0dbb84f50..f579a143b 100644
--- a/mesh/prov-acceptor.c
+++ b/mesh/prov-acceptor.c
@@ -42,26 +42,15 @@ static const uint16_t expected_pdu_size[] = {
#define BEACON_TYPE_UNPROVISIONED 0x00
+struct deferred_cmd {
+ uint16_t len;
+ uint8_t cmd[];
+};
+
static const uint8_t pkt_filter = MESH_AD_TYPE_PROVISION;
static const uint8_t bec_filter[] = {MESH_AD_TYPE_BEACON,
BEACON_TYPE_UNPROVISIONED};
-enum acp_state {
- ACP_PROV_IDLE = 0,
- ACP_PROV_CAPS_SENT,
- ACP_PROV_CAPS_ACKED,
- ACP_PROV_KEY_SENT,
- ACP_PROV_KEY_ACKED,
- ACP_PROV_INP_CMPLT_SENT,
- ACP_PROV_INP_CMPLT_ACKED,
- ACP_PROV_CONF_SENT,
- ACP_PROV_CONF_ACKED,
- ACP_PROV_RAND_SENT,
- ACP_PROV_RAND_ACKED,
- ACP_PROV_CMPLT_SENT,
- ACP_PROV_FAIL_SENT,
-};
-
#define MAT_REMOTE_PUBLIC 0x01
#define MAT_LOCAL_PRIVATE 0x02
#define MAT_RAND_AUTH 0x04
@@ -70,12 +59,13 @@ enum acp_state {
struct mesh_prov_acceptor {
mesh_prov_acceptor_complete_func_t cmplt;
prov_trans_tx_t trans_tx;
+ struct l_queue *ob;
void *agent;
void *caller_data;
void *trans_data;
struct l_timeout *timeout;
uint32_t to_secs;
- enum acp_state state;
+ uint8_t out_opcode;
uint8_t transport;
uint8_t material;
uint8_t expected;
@@ -99,6 +89,7 @@ static void acceptor_free(void)
return;
l_timeout_remove(prov->timeout);
+ l_queue_destroy(prov->ob, l_free);
mesh_send_cancel(bec_filter, sizeof(bec_filter));
mesh_send_cancel(&pkt_filter, sizeof(pkt_filter));
@@ -126,6 +117,21 @@ static void acp_prov_close(void *user_data, uint8_t reason)
acceptor_free();
}
+static void prov_send(struct mesh_prov_acceptor *prov, void *cmd, uint16_t len)
+{
+ struct deferred_cmd *defer;
+
+ if (prov->out_opcode == PROV_NONE) {
+ prov->out_opcode = *(uint8_t *) cmd;
+ prov->trans_tx(prov->trans_data, cmd, len);
+ } else {
+ defer = l_malloc(len + sizeof(struct deferred_cmd));
+ defer->len = len;
+ memcpy(defer->cmd, cmd, len);
+ l_queue_push_tail(prov->ob, defer);
+ }
+}
+
static void prov_to(struct l_timeout *timeout, void *user_data)
{
struct mesh_prov_acceptor *rx_prov = user_data;
@@ -140,7 +146,7 @@ static void prov_to(struct l_timeout *timeout, void *user_data)
if (prov->cmplt && prov->trans_tx) {
prov->cmplt(prov->caller_data, PROV_ERR_TIMEOUT, NULL);
prov->cmplt = NULL;
- prov->trans_tx(prov->trans_data, fail_code, 2);
+ prov_send(prov, fail_code, 2);
prov->timeout = l_timeout_create(1, prov_to, prov, NULL);
return;
}
@@ -258,7 +264,7 @@ static void number_cb(void *user_data, int err, uint32_t number)
if (err) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return;
}
@@ -267,7 +273,7 @@ static void number_cb(void *user_data, int err, uint32_t number)
l_put_be32(number, prov->rand_auth_workspace + 44);
prov->material |= MAT_RAND_AUTH;
msg.opcode = PROV_INP_CMPLT;
- prov->trans_tx(prov->trans_data, &msg.opcode, 1);
+ prov_send(prov, &msg.opcode, 1);
}
static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
@@ -281,7 +287,7 @@ static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (err || !key || len != 16) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return;
}
@@ -292,7 +298,7 @@ static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (prov->conf_inputs.start.auth_action == PROV_ACTION_IN_ALPHA) {
msg.opcode = PROV_INP_CMPLT;
- prov->trans_tx(prov->trans_data, &msg.opcode, 1);
+ prov_send(prov, &msg.opcode, 1);
}
}
@@ -307,7 +313,7 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (err || !key || len != 32) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return;
}
@@ -326,7 +332,7 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (!acp_credentials(prov)) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
}
}
@@ -339,9 +345,8 @@ static void send_caps(struct mesh_prov_acceptor *prov)
memcpy(&msg.caps, &prov->conf_inputs.caps,
sizeof(prov->conf_inputs.caps));
- prov->state = ACP_PROV_CAPS_SENT;
prov->expected = PROV_START;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
static void send_pub_key(struct mesh_prov_acceptor *prov)
@@ -350,7 +355,7 @@ static void send_pub_key(struct mesh_prov_acceptor *prov)
msg.opcode = PROV_PUB_KEY;
memcpy(msg.pub_key, prov->conf_inputs.dev_pub_key, sizeof(msg.pub_key));
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
static bool send_conf(struct mesh_prov_acceptor *prov)
@@ -365,7 +370,7 @@ static bool send_conf(struct mesh_prov_acceptor *prov)
if (!memcmp(msg.conf, prov->confirm, sizeof(msg.conf)))
return false;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return true;
}
@@ -375,7 +380,7 @@ static void send_rand(struct mesh_prov_acceptor *prov)
msg.opcode = PROV_RANDOM;
memcpy(msg.rand, prov->rand_auth_workspace, sizeof(msg.rand));
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
@@ -614,8 +619,7 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
if (result) {
prov->rand_auth_workspace[0] = PROV_COMPLETE;
- prov->trans_tx(prov->trans_data,
- prov->rand_auth_workspace, 1);
+ prov_send(prov, prov->rand_auth_workspace, 1);
goto cleanup;
} else {
fail.reason = PROV_ERR_UNEXPECTED_ERR;
@@ -638,7 +642,7 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
failure:
fail.opcode = PROV_FAILED;
- prov->trans_tx(prov->trans_data, &fail, sizeof(fail));
+ prov_send(prov, &fail, sizeof(fail));
if (prov->cmplt)
prov->cmplt(prov->caller_data, fail.reason, NULL);
prov->cmplt = NULL;
@@ -652,7 +656,23 @@ cleanup:
static void acp_prov_ack(void *user_data, uint8_t msg_num)
{
- /* TODO: Handle PB-ADV Ack */
+ struct mesh_prov_acceptor *rx_prov = user_data;
+ struct deferred_cmd *deferred;
+
+ if (rx_prov != prov)
+ return;
+
+ if (prov->out_opcode == PROV_NONE)
+ return;
+
+ prov->out_opcode = PROV_NONE;
+
+ deferred = l_queue_pop_head(prov->ob);
+ if (!deferred)
+ return;
+
+ prov_send(prov, deferred->cmd, deferred->len);
+ l_free(deferred);
}
@@ -680,7 +700,9 @@ bool acceptor_start(uint8_t num_ele, uint8_t uuid[16],
prov->to_secs = timeout;
prov->agent = agent;
prov->cmplt = complete_cb;
+ prov->ob = l_queue_new();
prov->previous = -1;
+ prov->out_opcode = PROV_NONE;
prov->caller_data = caller_data;
caps = mesh_agent_get_caps(agent);
diff --git a/mesh/provision.h b/mesh/provision.h
index 1a11b691b..1634c4d40 100644
--- a/mesh/provision.h
+++ b/mesh/provision.h
@@ -38,6 +38,7 @@ struct mesh_agent;
#define PROV_DATA 0x07
#define PROV_COMPLETE 0x08
#define PROV_FAILED 0x09
+#define PROV_NONE 0xFF
/* Spec defined Error Codes */
#define PROV_ERR_SUCCESS 0x00
--
2.25.4
^ permalink raw reply related [flat|nested] 9+ messages in thread