Linux-Bluetooth Archive on lore.kernel.org
 help / color / Atom feed
From: Prathyusha Nelluri <prathyusha.n@samsung.com>
To: linux-bluetooth@vger.kernel.org
Cc: s.syam@samsung.com, Prathyusha N <prathyusha.n@samsung.com>
Subject: [PATCH 1/1] mesh: Handle invalid public keys
Date: Wed, 25 Mar 2020 00:57:18 +0530
Message-ID: <1585078044-14974-4-git-send-email-prathyusha.n@samsung.com> (raw)
In-Reply-To: <1585078044-14974-1-git-send-email-prathyusha.n@samsung.com>

From: Prathyusha N <prathyusha.n@samsung.com>

Check for invalid public keys received and send provision failed.
---
 mesh/prov-acceptor.c | 38 ++++++++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/mesh/prov-acceptor.c b/mesh/prov-acceptor.c
index 03972c227..d395bc5f2 100644
--- a/mesh/prov-acceptor.c
+++ b/mesh/prov-acceptor.c
@@ -180,7 +180,7 @@ static void swap_u256_bytes(uint8_t *u256)
 	}
 }
 
-static void prov_calc_secret(const uint8_t *pub, const uint8_t *priv,
+static bool prov_calc_secret(const uint8_t *pub, const uint8_t *priv,
 							uint8_t *secret)
 {
 	uint8_t tmp[64];
@@ -190,22 +190,27 @@ static void prov_calc_secret(const uint8_t *pub, const uint8_t *priv,
 	swap_u256_bytes(tmp);
 	swap_u256_bytes(tmp + 32);
 
-	ecdh_shared_secret(tmp, priv, secret);
+	if (!ecdh_shared_secret(tmp, priv, secret))
+		return false;
 
 	/* Convert to Mesh byte order */
 	swap_u256_bytes(secret);
+	return true;
 }
 
-static void acp_credentials(struct mesh_prov_acceptor *prov)
+static bool acp_credentials(struct mesh_prov_acceptor *prov)
 {
-	prov_calc_secret(prov->conf_inputs.prv_pub_key,
-			prov->private_key, prov->secret);
+	if (!prov_calc_secret(prov->conf_inputs.prv_pub_key,
+			prov->private_key, prov->secret))
+		return false;
 
-	mesh_crypto_s1(&prov->conf_inputs,
-			sizeof(prov->conf_inputs), prov->salt);
+	if (!mesh_crypto_s1(&prov->conf_inputs,
+			sizeof(prov->conf_inputs), prov->salt))
+		return false;
 
-	mesh_crypto_prov_conf_key(prov->secret, prov->salt,
-			prov->calc_key);
+	if (!mesh_crypto_prov_conf_key(prov->secret, prov->salt,
+			prov->calc_key))
+		return false;
 
 	l_getrandom(prov->rand_auth_workspace, 16);
 
@@ -218,6 +223,7 @@ static void acp_credentials(struct mesh_prov_acceptor *prov)
 	print_packet("LocalRandom", prov->rand_auth_workspace, 16);
 	print_packet("ConfirmationSalt", prov->salt, 16);
 	print_packet("ConfirmationKey", prov->calc_key, 16);
+	return true;
 }
 
 static uint32_t digit_mod(uint8_t power)
@@ -298,8 +304,13 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
 	swap_u256_bytes(prov->conf_inputs.dev_pub_key + 32);
 
 	prov->material |= MAT_LOCAL_PRIVATE;
-	if ((prov->material & MAT_SECRET) == MAT_SECRET)
-		acp_credentials(prov);
+	if ((prov->material & MAT_SECRET) == MAT_SECRET) {
+		if (!acp_credentials(prov)) {
+			msg.opcode = PROV_FAILED;
+			msg.reason = PROV_ERR_UNEXPECTED_ERR;
+			prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+		}
+	}
 }
 
 static void send_caps(struct mesh_prov_acceptor *prov)
@@ -423,7 +434,10 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
 		if ((prov->material & MAT_SECRET) != MAT_SECRET)
 			return;
 
-		acp_credentials(prov);
+		if (!acp_credentials(prov)) {
+			fail.reason = PROV_ERR_UNEXPECTED_ERR;
+			goto failure;
+		}
 
 		if (!prov->conf_inputs.start.pub_key)
 			send_pub_key(prov);
-- 
2.17.1


  parent reply index

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <CGME20200324192821epcas5p3e756863feafcf1f8eab993a237c19521@epcas5p3.samsung.com>
2020-03-24 19:27 ` [PATCH 1/1] mesh: Add mesh agent cleanup to mesh cleanup Prathyusha Nelluri
     [not found]   ` <CGME20200324192820epcas5p10a4ae9a6d7e7dab22f4a5ab4ee752099@epcas5p1.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Check limits for count and interval of relay Prathyusha Nelluri
2020-03-25 19:12       ` Gix, Brian
2020-03-26 17:02         ` Gix, Brian
     [not found]   ` <CGME20200324192821epcas5p1cc8182aac6ed0b096c76e3ccbd269688@epcas5p1.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Handle close for Acceptor Prathyusha Nelluri
     [not found]   ` <CGME20200324192822epcas5p2986c35616c596051bb7826457439c893@epcas5p2.samsung.com>
2020-03-24 19:27     ` Prathyusha Nelluri [this message]
2020-03-26 17:03       ` [PATCH 1/1] mesh: Handle invalid public keys Gix, Brian
     [not found]   ` <CGME20200324192823epcas5p3b25363353b98e206a50d7fd4572c9552@epcas5p3.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Handle KeyRefresh phase 1 to phase 3 Prathyusha Nelluri
     [not found]   ` <CGME20200324192824epcas5p4886d88a31b8f9b31eeaf2fa38385698b@epcas5p4.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Handle KeyRefresh phase set to 3 Prathyusha Nelluri
     [not found]   ` <CGME20200324192824epcas5p1de37a38491d79ea6dca2cc5da50cd289@epcas5p1.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Handle netkey delete when netkey is not in netkeylist Prathyusha Nelluri
2020-03-26 17:03       ` Gix, Brian
     [not found]   ` <CGME20200324192825epcas5p4c038b652414de6be433f224a655a2244@epcas5p4.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Initialize local_acked to zero Prathyusha Nelluri
     [not found]   ` <CGME20200324192826epcas5p2eb80e44ac061329faf5421ba3b76e5f8@epcas5p2.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Send input complete for input OOB Authentication Prathyusha Nelluri
2020-03-26 17:02       ` Gix, Brian
     [not found]   ` <CGME20200324192827epcas5p3f70d5e24d6042786ffea8bdbd5ddc8e8@epcas5p3.samsung.com>
2020-03-24 19:27     ` [PATCH 1/1] mesh: Validate Provisioning Start PDU values Prathyusha Nelluri

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1585078044-14974-4-git-send-email-prathyusha.n@samsung.com \
    --to=prathyusha.n@samsung.com \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=s.syam@samsung.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Bluetooth Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-bluetooth/0 linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ https://lore.kernel.org/linux-bluetooth \
		linux-bluetooth@vger.kernel.org
	public-inbox-index linux-bluetooth

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-bluetooth


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git