[PATCH] Bluetooth: l2cap: Check encryption key size on incoming connection

[PATCH] Bluetooth: l2cap: Check encryption key size on incoming connection

[Frédéric Danis]

This is required for passing GAP/SEC/SEM/BI-04-C PTS test case:
  Security Mode 4 Level 4, Responder - Invalid Encryption Key Size
  - 128 bit

This tests the security key with size from 1 to 15 bytes while the
Security Mode 4 Level 4 requests 16 bytes key size.

Currently PTS fails with the following logs:
- expected:Connection Response:
    Code: [3 (0x03)] Code
    Identifier: (lt)WildCard: Exists(gt)
    Length: [8 (0x0008)]
    Destination CID: (lt)WildCard: Exists(gt)
    Source CID: [64 (0x0040)]
    Result: [3 (0x0003)] Connection refused - Security block
    Status: (lt)WildCard: Exists(gt),
but received:Connection Response:
    Code: [3 (0x03)] Code
    Identifier: [1 (0x01)]
    Length: [8 (0x0008)]
    Destination CID: [64 (0x0040)]
    Source CID: [64 (0x0040)]
    Result: [0 (0x0000)] Connection Successful
    Status: [0 (0x0000)] No further information available

And HCI logs:
< HCI Command: Read Encrypti.. (0x05|0x0008) plen 2
        Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
> HCI Event: Command Complete (0x0e) plen 7
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
        Key size: 7
> ACL Data RX: Handle 14 flags 0x02 dlen 12
      L2CAP: Connection Request (0x02) ident 1 len 4
        PSM: 4097 (0x1001)
        Source CID: 64
< ACL Data TX: Handle 14 flags 0x00 dlen 16
      L2CAP: Connection Response (0x03) ident 1 len 8
        Destination CID: 64
        Source CID: 64
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
---
 net/bluetooth/l2cap_core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index c7b66b2ea9f2..f2ab09582146 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3997,6 +3997,13 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
 		goto response;
 	}
 
+	/* Check the encryption key size */
+	if (!l2cap_check_enc_key_size(conn->hcon)) {
+		conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
+		result = L2CAP_CR_SEC_BLOCK;
+		goto response;
+	}
+
 	result = L2CAP_CR_NO_MEM;
 
 	/* Check for valid dynamic CID range (as per Erratum 3253) */
-- 
2.43.0

Re: [PATCH] Bluetooth: l2cap: Check encryption key size on incoming connection

[Luiz Augusto von Dentz]

Hi Frédéric,

On Tue, Apr 8, 2025 at 1:09 PM Frédéric Danis
<frederic.danis@collabora.com> wrote:
>
> This is required for passing GAP/SEC/SEM/BI-04-C PTS test case:
>   Security Mode 4 Level 4, Responder - Invalid Encryption Key Size
>   - 128 bit
>
> This tests the security key with size from 1 to 15 bytes while the
> Security Mode 4 Level 4 requests 16 bytes key size.
>
> Currently PTS fails with the following logs:
> - expected:Connection Response:
>     Code: [3 (0x03)] Code
>     Identifier: (lt)WildCard: Exists(gt)
>     Length: [8 (0x0008)]
>     Destination CID: (lt)WildCard: Exists(gt)
>     Source CID: [64 (0x0040)]
>     Result: [3 (0x0003)] Connection refused - Security block
>     Status: (lt)WildCard: Exists(gt),
> but received:Connection Response:
>     Code: [3 (0x03)] Code
>     Identifier: [1 (0x01)]
>     Length: [8 (0x0008)]
>     Destination CID: [64 (0x0040)]
>     Source CID: [64 (0x0040)]
>     Result: [0 (0x0000)] Connection Successful
>     Status: [0 (0x0000)] No further information available
>
> And HCI logs:
> < HCI Command: Read Encrypti.. (0x05|0x0008) plen 2
>         Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
> > HCI Event: Command Complete (0x0e) plen 7
>       Read Encryption Key Size (0x05|0x0008) ncmd 1
>         Status: Success (0x00)
>         Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
>         Key size: 7
> > ACL Data RX: Handle 14 flags 0x02 dlen 12
>       L2CAP: Connection Request (0x02) ident 1 len 4
>         PSM: 4097 (0x1001)
>         Source CID: 64
> < ACL Data TX: Handle 14 flags 0x00 dlen 16
>       L2CAP: Connection Response (0x03) ident 1 len 8
>         Destination CID: 64
>         Source CID: 64
>         Result: Connection successful (0x0000)
>         Status: No further information available (0x0000)
>
> Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
> ---
>  net/bluetooth/l2cap_core.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index c7b66b2ea9f2..f2ab09582146 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -3997,6 +3997,13 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
>                 goto response;
>         }
>
> +       /* Check the encryption key size */
> +       if (!l2cap_check_enc_key_size(conn->hcon)) {
> +               conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
> +               result = L2CAP_CR_SEC_BLOCK;
> +               goto response;
> +       }
> +

Hmm maybe we should incorporate this is the statement before:

    /* Check if the ACL is secure enough (if not SDP) */
    if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
        !hci_conn_check_link_mode(conn->hcon)) {
        conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
        result = L2CAP_CR_SEC_BLOCK;
        goto response;
    }

That said I don't quite understand why the likes of
hci_conn_check_link_mode is not checking the key size since it is
already doing security level checks, either way that indeed seem to be
missing for incoming connection requests.

>         result = L2CAP_CR_NO_MEM;
>
>         /* Check for valid dynamic CID range (as per Erratum 3253) */
> --
> 2.43.0
>
>


-- 
Luiz Augusto von Dentz

Re: [PATCH] Bluetooth: l2cap: Check encryption key size on incoming connection

[Luiz Augusto von Dentz]

Hi Frédéric,

On Tue, Apr 8, 2025 at 1:28 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Frédéric,
>
> On Tue, Apr 8, 2025 at 1:09 PM Frédéric Danis
> <frederic.danis@collabora.com> wrote:
> >
> > This is required for passing GAP/SEC/SEM/BI-04-C PTS test case:
> >   Security Mode 4 Level 4, Responder - Invalid Encryption Key Size
> >   - 128 bit
> >
> > This tests the security key with size from 1 to 15 bytes while the
> > Security Mode 4 Level 4 requests 16 bytes key size.
> >
> > Currently PTS fails with the following logs:
> > - expected:Connection Response:
> >     Code: [3 (0x03)] Code
> >     Identifier: (lt)WildCard: Exists(gt)
> >     Length: [8 (0x0008)]
> >     Destination CID: (lt)WildCard: Exists(gt)
> >     Source CID: [64 (0x0040)]
> >     Result: [3 (0x0003)] Connection refused - Security block
> >     Status: (lt)WildCard: Exists(gt),
> > but received:Connection Response:
> >     Code: [3 (0x03)] Code
> >     Identifier: [1 (0x01)]
> >     Length: [8 (0x0008)]
> >     Destination CID: [64 (0x0040)]
> >     Source CID: [64 (0x0040)]
> >     Result: [0 (0x0000)] Connection Successful
> >     Status: [0 (0x0000)] No further information available
> >
> > And HCI logs:
> > < HCI Command: Read Encrypti.. (0x05|0x0008) plen 2
> >         Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
> > > HCI Event: Command Complete (0x0e) plen 7
> >       Read Encryption Key Size (0x05|0x0008) ncmd 1
> >         Status: Success (0x00)
> >         Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
> >         Key size: 7
> > > ACL Data RX: Handle 14 flags 0x02 dlen 12
> >       L2CAP: Connection Request (0x02) ident 1 len 4
> >         PSM: 4097 (0x1001)
> >         Source CID: 64
> > < ACL Data TX: Handle 14 flags 0x00 dlen 16
> >       L2CAP: Connection Response (0x03) ident 1 len 8
> >         Destination CID: 64
> >         Source CID: 64
> >         Result: Connection successful (0x0000)
> >         Status: No further information available (0x0000)
> >
> > Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
> > ---
> >  net/bluetooth/l2cap_core.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index c7b66b2ea9f2..f2ab09582146 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -3997,6 +3997,13 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
> >                 goto response;
> >         }
> >
> > +       /* Check the encryption key size */
> > +       if (!l2cap_check_enc_key_size(conn->hcon)) {
> > +               conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
> > +               result = L2CAP_CR_SEC_BLOCK;
> > +               goto response;
> > +       }
> > +
>
> Hmm maybe we should incorporate this is the statement before:
>
>     /* Check if the ACL is secure enough (if not SDP) */
>     if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
>         !hci_conn_check_link_mode(conn->hcon)) {
>         conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
>         result = L2CAP_CR_SEC_BLOCK;
>         goto response;
>     }
>
> That said I don't quite understand why the likes of
> hci_conn_check_link_mode is not checking the key size since it is
> already doing security level checks, either way that indeed seem to be
> missing for incoming connection requests.

Also this need to add Fixes: 288c06973daa ("Bluetooth: Enforce key
size of 16 bytes on FIPS level") since apparently tha missed some code
paths.

> >         result = L2CAP_CR_NO_MEM;
> >
> >         /* Check for valid dynamic CID range (as per Erratum 3253) */
> > --
> > 2.43.0
> >
> >
>
>
> --
> Luiz Augusto von Dentz



-- 
Luiz Augusto von Dentz

RE: Bluetooth: l2cap: Check encryption key size on incoming connection

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2597 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=951217

---Test result---

Test Summary:
CheckPatch                    PENDING   0.33 seconds
GitLint                       PENDING   0.23 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      28.75 seconds
CheckAllWarning               PASS      29.00 seconds
CheckSparse                   PASS      45.36 seconds
BuildKernel32                 PASS      30.55 seconds
TestRunnerSetup               PASS      479.36 seconds
TestRunner_l2cap-tester       PASS      21.96 seconds
TestRunner_iso-tester         FAIL      121.76 seconds
TestRunner_bnep-tester        PASS      4.90 seconds
TestRunner_mgmt-tester        FAIL      131.22 seconds
TestRunner_rfcomm-tester      PASS      13.00 seconds
TestRunner_sco-tester         PASS      12.71 seconds
TestRunner_ioctl-tester       PASS      8.54 seconds
TestRunner_mesh-tester        FAIL      9.33 seconds
TestRunner_smp-tester         PASS      15.16 seconds
TestRunner_userchan-tester    PASS      6.96 seconds
IncrementalBuild              PENDING   0.79 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
BUG: KASAN: slab-use-after-free in iso_conn_hold_unless_zero+0x78/0x1c0
Total: 124, Passed: 123 (99.2%), Failed: 0, Not Run: 1
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 485 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
LL Privacy - Start Discovery 2 (Disable RL)          Failed       0.190 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76f/0x7d0
WARNING: CPU: 0 PID: 36 at kernel/workqueue.c:2257 __queue_work+0x93e/0xba0
Total: 10, Passed: 9 (90.0%), Failed: 1, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Failed       0.107 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth