Reject remote just-works SSP attempts when MITM protection is required
If we require MITM but the remote device can't provide that (it has
NoInputNoOutput) then reject the confirmation request. The only
exception is when we're dedicated bonding initiators since then we
always have the MITM bit set.
diff --git a/src/dbus-hci.c b/src/dbus-hci.c
index 678b8e2..45f9c4c 100644
--- a/src/dbus-hci.c
+++ b/src/dbus-hci.c
@@ -318,7 +318,9 @@
struct btd_adapter *adapter;
struct btd_device *device;
uint8_t remcap, remauth, type;
+ gboolean bonding_initiator;
uint16_t dev_id;
+ int dd;
if (!get_adapter_and_device(sba, dba, &adapter, &device, TRUE))
return -ENODEV;
@@ -326,20 +328,8 @@
dev_id = adapter_get_dev_id(adapter);
if (get_auth_requirements(sba, dba, &type) < 0) {
- int dd;
-
- dd = hci_open_dev(dev_id);
- if (dd < 0) {
- error("Unable to open hci%d", dev_id);
- return -1;
- }
-
- hci_send_cmd(dd, OGF_LINK_CTL,
- OCF_USER_CONFIRM_NEG_REPLY, 6, dba);
-
- hci_close_dev(dd);
-
- return 0;
+ error("Unable to get local authentication requirements");
+ goto fail;
}
DBG("confirm authentication requirement is 0x%02x", type);
@@ -350,6 +340,16 @@
DBG("remote IO capabilities are 0x%02x", remcap);
DBG("remote authentication requirement is 0x%02x", remauth);
+ /* If we require MITM but the remote device can't provide that
+ * (it has NoInputNoOutput) then reject the confirmation
+ * request. The only exception is when we're dedicated bonding
+ * initiators since then we always have the MITM bit set. */
+ bonding_initiator = device_is_bonding(device, NULL);
+ if (!bonding_initiator && (type & 0x01) && remcap == 0x03) {
+ error("Rejecting request: remote device can't provide MITM");
+ goto fail;
+ }
+
/* If no side requires MITM protection; auto-accept */
if (!(remauth & 0x01) &&
(type == 0xff || !(type & 0x01) || remcap == 0x03)) {
@@ -377,6 +377,20 @@
return device_request_authentication(device, AUTH_TYPE_CONFIRM,
passkey, confirm_cb);
+
+fail:
+ dd = hci_open_dev(dev_id);
+ if (dd < 0) {
+ error("Unable to open hci%d", dev_id);
+ return -1;
+ }
+
+ hci_send_cmd(dd, OGF_LINK_CTL,
+ OCF_USER_CONFIRM_NEG_REPLY, 6, dba);
+
+ hci_close_dev(dd);
+
+ return 0;
}
int hcid_dbus_user_passkey(bdaddr_t *sba, bdaddr_t *dba)
