Frédéric Danis 9e3114958d Bluetooth: l2cap: Check encryption key size on incoming connection ...

[ Upstream commit 522e9ed157 ]

This is required for passing GAP/SEC/SEM/BI-04-C PTS test case:
  Security Mode 4 Level 4, Responder - Invalid Encryption Key Size
  - 128 bit

This tests the security key with size from 1 to 15 bytes while the
Security Mode 4 Level 4 requests 16 bytes key size.

Currently PTS fails with the following logs:
- expected:Connection Response:
    Code: [3 (0x03)] Code
    Identifier: (lt)WildCard: Exists(gt)
    Length: [8 (0x0008)]
    Destination CID: (lt)WildCard: Exists(gt)
    Source CID: [64 (0x0040)]
    Result: [3 (0x0003)] Connection refused - Security block
    Status: (lt)WildCard: Exists(gt),
but received:Connection Response:
    Code: [3 (0x03)] Code
    Identifier: [1 (0x01)]
    Length: [8 (0x0008)]
    Destination CID: [64 (0x0040)]
    Source CID: [64 (0x0040)]
    Result: [0 (0x0000)] Connection Successful
    Status: [0 (0x0000)] No further information available

And HCI logs:
< HCI Command: Read Encrypti.. (0x05|0x0008) plen 2
        Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
> HCI Event: Command Complete (0x0e) plen 7
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
        Key size: 7
> ACL Data RX: Handle 14 flags 0x02 dlen 12
      L2CAP: Connection Request (0x02) ident 1 len 4
        PSM: 4097 (0x1001)
        Source CID: 64
< ACL Data TX: Handle 14 flags 0x00 dlen 16
      L2CAP: Connection Response (0x03) ident 1 len 8
        Destination CID: 64
        Source CID: 64
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)

Fixes: 288c06973d ("Bluetooth: Enforce key size of 16 bytes on FIPS level")
Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-04-25 10:45:40 +02:00

..

bnep

Bluetooth: bnep: fix wild-memory-access in proto_unregister

2024-11-01 01:58:24 +01:00

cmtp

Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2022-01-17 05:49:30 +02:00

hidp

Bluetooth: Init sk_peer_* on bt_sock_alloc

2023-08-11 11:37:22 -07:00

rfcomm

Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"

2025-03-22 12:50:38 -07:00

6lowpan.c

Bluetooth: Fix error code in chan_alloc_skb_cb()

2025-03-28 21:59:53 +01:00

af_bluetooth.c

Bluetooth: SCO: Fix UAF on sco_sock_timeout

2024-11-01 01:58:30 +01:00

aosp.c

Bluetooth: Fix null pointer deref on unexpected status event

2022-08-08 17:04:37 -07:00

aosp.h

Bluetooth: aosp: Support AOSP Bluetooth Quality Report

2021-11-02 19:37:52 +01:00

coredump.c

Bluetooth: Remove unnecessary NULL check before vfree()

2023-08-11 11:56:54 -07:00

ecdh_helper.c

Bluetooth: Use crypto_wait_req

2023-02-13 18:34:48 +08:00

ecdh_helper.h

Fix misc new gcc warnings

2021-04-27 17:05:53 -07:00

eir.c

Bluetooth: Fix eir name length

2024-03-26 18:19:39 -04:00

eir.h

Bluetooth: Add initial implementation of BIS connections

2022-07-22 17:13:56 -07:00

hci_codec.c

Bluetooth: Fix support for Read Local Supported Codecs V2

2022-12-02 13:09:31 -08:00

hci_codec.h

Bluetooth: Add support for Read Local Supported Codecs V2

2021-09-07 14:09:18 -07:00

hci_conn.c

Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions

2025-01-09 13:31:43 +01:00

hci_core.c

Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"

2025-03-22 12:50:38 -07:00

hci_debugfs.c

Bluetooth: Fix TOCTOU in HCI debugfs implementation

2024-04-10 16:35:49 +02:00

hci_debugfs.h

Bluetooth: hci_core: Move all debugfs handling to hci_debugfs.c

2021-09-22 16:17:13 +02:00

hci_event.c

Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address

2025-04-25 10:45:40 +02:00

hci_request.c

Bluetooth: Fix memory leak in hci_req_sync_complete()

2024-04-17 11:19:25 +02:00

hci_request.h

Bluetooth: Delete unused hci_req_prepare_suspend() declaration

2023-09-20 10:55:29 -07:00

hci_sock.c

Bluetooth: hci_sock: Fix not validating setsockopt user input

2024-10-10 11:57:19 +02:00

hci_sync.c

Bluetooth: hci_sync: Fix not setting Random Address when required

2025-01-17 13:36:13 +01:00

hci_sysfs.c

Bluetooth: fix use-after-free in device_for_each_child()

2024-12-09 10:32:11 +01:00

iso.c

Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"

2025-03-22 12:50:38 -07:00

Kconfig

Bluetooth: Remove BT_HS

2024-03-26 18:19:37 -04:00

l2cap_core.c

Bluetooth: l2cap: Check encryption key size on incoming connection

2025-04-25 10:45:40 +02:00

l2cap_sock.c

Bluetooth: L2CAP: Fix corrupted list in hci_chan_del

2025-03-22 12:50:50 -07:00

leds.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

leds.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

lib.c

Bluetooth: Fix EALREADY and ELOOP cases in bt_status()

2022-12-12 14:19:24 -08:00

Makefile

Bluetooth: Remove BT_HS

2024-03-26 18:19:37 -04:00

mgmt_config.c

Bluetooth: mgmt: Use the correct print format

2021-06-26 07:12:42 +02:00

mgmt_config.h

Bluetooth: mgmt: Add commands for runtime configuration

2020-06-18 13:11:03 +03:00

mgmt_util.c

Bluetooth: Implement support for Mesh

2022-09-06 13:18:24 -07:00

mgmt_util.h

Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

2023-01-17 15:50:10 -08:00

mgmt.c

Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()

2025-03-13 12:58:26 +01:00

msft.c

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

2024-05-17 12:02:21 +02:00

msft.h

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

2024-05-17 12:02:21 +02:00

sco.c

Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"

2025-03-22 12:50:38 -07:00

selftest.c

crypto: ecdh - move curve_id of ECDH from the key to algorithm name

2021-03-13 00:04:03 +11:00

selftest.h

…

smp.c

Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"

2024-09-12 11:11:26 +02:00

smp.h

Bluetooth: use inclusive language in SMP

2021-06-26 07:12:37 +02:00