[PATCH 0/3] LE OOB pairing support

[PATCH 0/3] LE OOB pairing support

[Michael Brudevold]

From: Michael Brudevold <michael.brudevold@veranexsolutions.com>

This patch series implements userspace support for LE OOB pairing. It was
tested against an nRF52 dev kit with Nordic's NFC pairing example. Support is
only for reading a tag; generating and sending back OOB information was not
implemented.

Overall, LE EIR data is not dissimilar to BREDR, but the OOB blob starts off
slightly differently necessitating a different code path before reaching the
EIR parser.

Michael Brudevold (3):
  eir: parse data types for LE OOB pairing
  Accept LE formatted EIR data with neard plugin
  neard: Update D-Bus path and interface

 plugins/neard.c | 64 +++++++++++++++++++++++++++++++++++++++++++------
 src/adapter.c   |  3 ++-
 src/adapter.h   |  2 +-
 src/eir.c       | 21 ++++++++++++++++
 src/eir.h       |  4 ++++
 5 files changed, 85 insertions(+), 9 deletions(-)

-- 
2.25.1

[PATCH 1/3] eir: parse data types for LE OOB pairing

[Michael Brudevold]

From: Michael Brudevold <michael.brudevold@veranexsolutions.com>

---
 src/eir.c | 21 +++++++++++++++++++++
 src/eir.h |  4 ++++
 2 files changed, 25 insertions(+)

diff --git a/src/eir.c b/src/eir.c
index 2f9ee036f..fabfd6402 100644
--- a/src/eir.c
+++ b/src/eir.c
@@ -342,6 +342,15 @@ void eir_parse(struct eir_data *eir, const uint8_t *eir_data, uint8_t eir_len)
 			eir->did_version = data[6] | (data[7] << 8);
 			break;
 
+		case EIR_LE_DEVICE_ADDRESS:
+			if (data_len < sizeof(bdaddr_t) + 1)
+				break;
+
+			memcpy(&eir->addr, data, sizeof(bdaddr_t));
+			eir->addr_type = data[sizeof(bdaddr_t)] & 0x1 ?
+					BDADDR_LE_RANDOM : BDADDR_LE_PUBLIC;
+			break;
+
 		case EIR_SVC_DATA16:
 			eir_parse_uuid16_data(eir, data, data_len);
 			break;
@@ -354,6 +363,18 @@ void eir_parse(struct eir_data *eir, const uint8_t *eir_data, uint8_t eir_len)
 			eir_parse_uuid128_data(eir, data, data_len);
 			break;
 
+		case EIR_LE_SC_CONF:
+			if (data_len < 16)
+				break;
+			eir->hash = util_memdup(data, 16);
+			break;
+
+		case EIR_LE_SC_RAND:
+			if (data_len < 16)
+				break;
+			eir->randomizer = util_memdup(data, 16);
+			break;
+
 		case EIR_MANUFACTURER_DATA:
 			eir_parse_msd(eir, data, data_len);
 			break;
diff --git a/src/eir.h b/src/eir.h
index 6154e23ec..241e6fac9 100644
--- a/src/eir.h
+++ b/src/eir.h
@@ -33,9 +33,12 @@
 #define EIR_PUB_TRGT_ADDR           0x17  /* LE: Public Target Address */
 #define EIR_RND_TRGT_ADDR           0x18  /* LE: Random Target Address */
 #define EIR_GAP_APPEARANCE          0x19  /* GAP appearance */
+#define EIR_LE_DEVICE_ADDRESS       0x1B  /* LE: Bluetooth Device Address */
 #define EIR_SOLICIT32               0x1F  /* LE: Solicit UUIDs, 32-bit */
 #define EIR_SVC_DATA32              0x20  /* LE: Service data, 32-bit UUID */
 #define EIR_SVC_DATA128             0x21  /* LE: Service data, 128-bit UUID */
+#define EIR_LE_SC_CONF              0x22  /* LE: Secure Connections Confirmation Value */
+#define EIR_LE_SC_RAND              0x23  /* LE: Secure Connections Random Value */
 #define EIR_TRANSPORT_DISCOVERY     0x26  /* Transport Discovery Service */
 #define EIR_MANUFACTURER_DATA       0xFF  /* Manufacturer Specific Data */
 
@@ -80,6 +83,7 @@ struct eir_data {
 	uint8_t *hash;
 	uint8_t *randomizer;
 	bdaddr_t addr;
+	uint8_t addr_type;
 	uint16_t did_vendor;
 	uint16_t did_product;
 	uint16_t did_version;
-- 
2.25.1

[PATCH 2/3] Accept LE formatted EIR data with neard plugin

[Michael Brudevold]

From: Michael Brudevold <michael.brudevold@veranexsolutions.com>

LE EIR differs from BREDR EIR in that it does not start with the device
address. Add ability to handle this data and send the correct address type
when adding remote OOB.

This patch does not address requesting LE OOB data.
---
 plugins/neard.c | 60 ++++++++++++++++++++++++++++++++++++++++++++-----
 src/adapter.c   |  3 ++-
 src/adapter.h   |  2 +-
 3 files changed, 58 insertions(+), 7 deletions(-)

diff --git a/plugins/neard.c b/plugins/neard.c
index 99762482c..cc56f922f 100644
--- a/plugins/neard.c
+++ b/plugins/neard.c
@@ -56,6 +56,7 @@ enum cps {
 
 struct oob_params {
 	bdaddr_t address;
+	uint8_t address_type;
 	uint32_t class;
 	char *name;
 	GSList *services;
@@ -363,6 +364,36 @@ static int process_eir(uint8_t *eir, size_t size, struct oob_params *remote)
 	return 0;
 }
 
+static void process_eir_le(uint8_t *eir, size_t size, struct oob_params *remote)
+{
+	struct eir_data eir_data;
+
+	DBG("size %zu", size);
+
+	memset(&eir_data, 0, sizeof(eir_data));
+
+	eir_parse(&eir_data, eir, size);
+
+	bacpy(&remote->address, &eir_data.addr);
+	remote->address_type = eir_data.addr_type;
+
+	remote->class = eir_data.class;
+
+	remote->name = eir_data.name;
+	eir_data.name = NULL;
+
+	remote->services = eir_data.services;
+	eir_data.services = NULL;
+
+	remote->hash = eir_data.hash;
+	eir_data.hash = NULL;
+
+	remote->randomizer = eir_data.randomizer;
+	eir_data.randomizer = NULL;
+
+	eir_data_free(&eir_data);
+}
+
 /*
  * This is (barely documented) Nokia extension format, most work was done by
  * reverse engineering.
@@ -543,7 +574,7 @@ static int process_message(DBusMessage *msg, struct oob_params *remote)
 			uint8_t *eir;
 			int size;
 
-			/* nokia.com:bt and EIR should not be passed together */
+			/* nokia.com:bt, EIR, and EIR.le should not be passed together */
 			if (bacmp(&remote->address, BDADDR_ANY) != 0)
 				goto error;
 
@@ -561,7 +592,7 @@ static int process_message(DBusMessage *msg, struct oob_params *remote)
 			uint8_t *data;
 			int size;
 
-			/* nokia.com:bt and EIR should not be passed together */
+			/* nokia.com:bt, EIR, and EIR.le should not be passed together */
 			if (bacmp(&remote->address, BDADDR_ANY) != 0)
 				goto error;
 
@@ -574,6 +605,23 @@ static int process_message(DBusMessage *msg, struct oob_params *remote)
 
 			if (process_nokia_com_bt(data, size, remote))
 				goto error;
+		} else if (strcasecmp(key, "EIR.le") == 0) {
+			DBusMessageIter array;
+			uint8_t *eir;
+			int size;
+
+			/* nokia.com:bt, EIR, and EIR.le should not be passed together */
+			if (bacmp(&remote->address, BDADDR_ANY) != 0)
+				goto error;
+
+			if (dbus_message_iter_get_arg_type(&value) !=
+					DBUS_TYPE_ARRAY)
+				goto error;
+
+			dbus_message_iter_recurse(&value, &array);
+			dbus_message_iter_get_fixed_array(&array, &eir, &size);
+
+			process_eir_le(eir, size, remote);
 		} else if (strcasecmp(key, "State") == 0) {
 			const char *state;
 
@@ -637,6 +685,7 @@ static void store_params(struct btd_adapter *adapter, struct btd_device *device,
 
 	if (params->hash) {
 		btd_adapter_add_remote_oob_data(adapter, &params->address,
+							params->address_type,
 							params->hash,
 							params->randomizer);
 	} else if (params->pin_len) {
@@ -692,7 +741,7 @@ static DBusMessage *push_oob(DBusConnection *conn, DBusMessage *msg, void *data)
 	}
 
 	device = btd_adapter_get_device(adapter, &remote.address,
-								BDADDR_BREDR);
+								remote.address_type);
 
 	err = check_device(device);
 	if (err < 0) {
@@ -716,7 +765,7 @@ static DBusMessage *push_oob(DBusConnection *conn, DBusMessage *msg, void *data)
 	free_oob_params(&remote);
 
 	err = adapter_create_bonding(adapter, device_get_address(device),
-							BDADDR_BREDR, io_cap);
+							remote.address_type, io_cap);
 	if (err < 0)
 		return error_reply(msg, -err);
 
@@ -764,7 +813,8 @@ static DBusMessage *request_oob(DBusConnection *conn, DBusMessage *msg,
 		goto done;
 	}
 
-	device = btd_adapter_get_device(adapter, &remote.address, BDADDR_BREDR);
+	device = btd_adapter_get_device(adapter, &remote.address,
+							   remote.address_type);
 
 	err = check_device(device);
 	if (err < 0)
diff --git a/src/adapter.c b/src/adapter.c
index f7faaa263..d9823c48c 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -8769,7 +8769,7 @@ int adapter_set_io_capability(struct btd_adapter *adapter, uint8_t io_cap)
 }
 
 int btd_adapter_add_remote_oob_data(struct btd_adapter *adapter,
-					const bdaddr_t *bdaddr,
+					const bdaddr_t *bdaddr, uint8_t bdaddr_type,
 					uint8_t *hash, uint8_t *randomizer)
 {
 	struct mgmt_cp_add_remote_oob_data cp;
@@ -8780,6 +8780,7 @@ int btd_adapter_add_remote_oob_data(struct btd_adapter *adapter,
 
 	memset(&cp, 0, sizeof(cp));
 	bacpy(&cp.addr.bdaddr, bdaddr);
+	cp.addr.type = bdaddr_type;
 	memcpy(cp.hash192, hash, 16);
 
 	if (randomizer)
diff --git a/src/adapter.h b/src/adapter.h
index 688ed51c6..bbf8a42ee 100644
--- a/src/adapter.h
+++ b/src/adapter.h
@@ -213,7 +213,7 @@ int adapter_set_io_capability(struct btd_adapter *adapter, uint8_t io_cap);
 int btd_adapter_read_local_oob_data(struct btd_adapter *adapter);
 
 int btd_adapter_add_remote_oob_data(struct btd_adapter *adapter,
-					const bdaddr_t *bdaddr,
+					const bdaddr_t *bdaddr, uint8_t bdaddr_type,
 					uint8_t *hash, uint8_t *randomizer);
 
 int btd_adapter_remove_remote_oob_data(struct btd_adapter *adapter,
-- 
2.25.1

[PATCH 3/3] neard: Update D-Bus path and interface

[Michael Brudevold]

From: Michael Brudevold <michael.brudevold@veranexsolutions.com>

neard has been carrying legacy interfaces since 2013
---
 plugins/neard.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/neard.c b/plugins/neard.c
index cc56f922f..71de5964d 100644
--- a/plugins/neard.c
+++ b/plugins/neard.c
@@ -33,8 +33,8 @@
 #include "src/shared/util.h"
 
 #define NEARD_NAME "org.neard"
-#define NEARD_PATH "/"
-#define NEARD_MANAGER_INTERFACE "org.neard.Manager"
+#define NEARD_PATH "/org/neard"
+#define NEARD_MANAGER_INTERFACE "org.neard.AgentManager"
 #define AGENT_INTERFACE "org.neard.HandoverAgent"
 #define AGENT_PATH "/org/bluez/neard_handover_agent"
 #define AGENT_CARRIER_TYPE "bluetooth"
-- 
2.25.1

RE: LE OOB pairing support

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3810 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=647337

---Test result---

Test Summary:
CheckPatch                    FAIL      4.62 seconds
GitLint                       PASS      3.05 seconds
Prep - Setup ELL              PASS      46.37 seconds
Build - Prep                  PASS      0.75 seconds
Build - Configure             PASS      9.61 seconds
Build - Make                  PASS      1341.77 seconds
Make Check                    PASS      11.78 seconds
Make Check w/Valgrind         PASS      471.83 seconds
Make Distcheck                PASS      249.57 seconds
Build w/ext ELL - Configure   PASS      9.16 seconds
Build w/ext ELL - Make        PASS      1349.46 seconds
Incremental Build with patchesPASS      4218.49 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script with rule in .checkpatch.conf
Output:
[1/3] eir: parse data types for LE OOB pairing
WARNING:LONG_LINE_COMMENT: line length of 89 exceeds 80 columns
#137: FILE: src/eir.h:40:
+#define EIR_LE_SC_CONF              0x22  /* LE: Secure Connections Confirmation Value */

WARNING:LONG_LINE_COMMENT: line length of 83 exceeds 80 columns
#138: FILE: src/eir.h:41:
+#define EIR_LE_SC_RAND              0x23  /* LE: Secure Connections Random Value */

/github/workspace/src/12869444.patch total: 0 errors, 2 warnings, 52 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/12869444.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.

[2/3] Accept LE formatted EIR data with neard plugin
WARNING:LONG_LINE_COMMENT: line length of 89 exceeds 80 columns
#147: FILE: plugins/neard.c:577:
+			/* nokia.com:bt, EIR, and EIR.le should not be passed together */

WARNING:LONG_LINE_COMMENT: line length of 89 exceeds 80 columns
#156: FILE: plugins/neard.c:595:
+			/* nokia.com:bt, EIR, and EIR.le should not be passed together */

WARNING:LONG_LINE_COMMENT: line length of 89 exceeds 80 columns
#169: FILE: plugins/neard.c:613:
+			/* nokia.com:bt, EIR, and EIR.le should not be passed together */

WARNING:LONG_LINE: line length of 85 exceeds 80 columns
#197: FILE: plugins/neard.c:744:
+								remote.address_type);

WARNING:LONG_LINE: line length of 85 exceeds 80 columns
#206: FILE: plugins/neard.c:768:
+							remote.address_type, io_cap);

WARNING:LONG_LINE: line length of 84 exceeds 80 columns
#229: FILE: src/adapter.c:8772:
+					const bdaddr_t *bdaddr, uint8_t bdaddr_type,

WARNING:LONG_LINE: line length of 84 exceeds 80 columns
#250: FILE: src/adapter.h:216:
+					const bdaddr_t *bdaddr, uint8_t bdaddr_type,

/github/workspace/src/12869445.patch total: 0 errors, 7 warnings, 137 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/12869445.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




---
Regards,
Linux Bluetooth

Re: [PATCH 0/3] LE OOB pairing support

[Mike Brudevold]

More testing below.

On Fri, Jun 3, 2022 at 5:32 PM Michael Brudevold <puffy.taco@gmail.com> wrote:
>
> From: Michael Brudevold <michael.brudevold@veranexsolutions.com>
>
> This patch series implements userspace support for LE OOB pairing. It was
> tested against an nRF52 dev kit with Nordic's NFC pairing example. Support is
> only for reading a tag; generating and sending back OOB information was not
> implemented.

Further testing indicates that the OOB pairing data was not being used
(beyond BD addr).  I tried corrupting the relevant fields and it still
successfully paired.  The bluetooth capture in Wireshark shows an SMP
Pairing Request going out with the OOB data flags set to zero (OOB
auth not present).  This is a 5.13 kernel from Ubuntu 20.04, so I'll
check that it isn't a kernel version issue, but a coworker tested on
an Ubuntu 22.04 instance and had a similar high level experience.  I'm
still digging into where/how the OOB flag gets set for this request.

>
> Overall, LE EIR data is not dissimilar to BREDR, but the OOB blob starts off
> slightly differently necessitating a different code path before reaching the
> EIR parser.
>
> Michael Brudevold (3):
>   eir: parse data types for LE OOB pairing
>   Accept LE formatted EIR data with neard plugin
>   neard: Update D-Bus path and interface
>
>  plugins/neard.c | 64 +++++++++++++++++++++++++++++++++++++++++++------
>  src/adapter.c   |  3 ++-
>  src/adapter.h   |  2 +-
>  src/eir.c       | 21 ++++++++++++++++
>  src/eir.h       |  4 ++++
>  5 files changed, 85 insertions(+), 9 deletions(-)
>
> --
> 2.25.1
>

Re: [PATCH 0/3] LE OOB pairing support

[Mike Brudevold]

Found the issue.

On Fri, Jun 10, 2022 at 12:52 PM Mike Brudevold <puffy.taco@gmail.com> wrote:
>
> More testing below.
>
> On Fri, Jun 3, 2022 at 5:32 PM Michael Brudevold <puffy.taco@gmail.com> wrote:
> >
> > From: Michael Brudevold <michael.brudevold@veranexsolutions.com>
> >
> > This patch series implements userspace support for LE OOB pairing. It was
> > tested against an nRF52 dev kit with Nordic's NFC pairing example. Support is
> > only for reading a tag; generating and sending back OOB information was not
> > implemented.
>
> Further testing indicates that the OOB pairing data was not being used
> (beyond BD addr).  I tried corrupting the relevant fields and it still
> successfully paired.  The bluetooth capture in Wireshark shows an SMP
> Pairing Request going out with the OOB data flags set to zero (OOB
> auth not present).  This is a 5.13 kernel from Ubuntu 20.04, so I'll
> check that it isn't a kernel version issue, but a coworker tested on
> an Ubuntu 22.04 instance and had a similar high level experience.  I'm
> still digging into where/how the OOB flag gets set for this request.

Looks like the issue is that I need to update the adapter code to put
the rand/conf values into the appropriate hash256/rand256 for LE SC
(was only written to use hash192/rand192).  With this change, I can
corrupt these values and pairing becomes unsuccessful.  I'll get this
updated and send new patches.

>
> >
> > Overall, LE EIR data is not dissimilar to BREDR, but the OOB blob starts off
> > slightly differently necessitating a different code path before reaching the
> > EIR parser.
> >
> > Michael Brudevold (3):
> >   eir: parse data types for LE OOB pairing
> >   Accept LE formatted EIR data with neard plugin
> >   neard: Update D-Bus path and interface
> >
> >  plugins/neard.c | 64 +++++++++++++++++++++++++++++++++++++++++++------
> >  src/adapter.c   |  3 ++-
> >  src/adapter.h   |  2 +-
> >  src/eir.c       | 21 ++++++++++++++++
> >  src/eir.h       |  4 ++++
> >  5 files changed, 85 insertions(+), 9 deletions(-)
> >
> > --
> > 2.25.1
> >