Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8ca617c authored by Johan Hedberg's avatar Johan Hedberg Committed by Marcel Holtmann
Browse files

Bluetooth: Don't send public key if OOB data verification fails 



When we receive the remote public key, if we have remote OOB data
there's no point in sending our public key to the remote if the OOB data
doesn't match. This patch moves the test for this higher up in the
smp_cmd_public_key() function.

Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 94ea7257

net/bluetooth/smp.c

+10 −10
Original line number Diff line number Diff line
@@ -2515,6 +2515,16 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) 


	memcpy(smp->remote_pk, key, 64);



	if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {

		err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk,

			     smp->rr, 0, cfm.confirm_val);

		if (err)

			return SMP_UNSPECIFIED;



		if (memcmp(cfm.confirm_val, smp->pcnf, 16))

			return SMP_CONFIRM_FAILED;

	}



	/* Non-initiating device sends its public key after receiving

	 * the key from the initiating device.

	 */
@@ -2562,16 +2572,6 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) 
		return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY);

	}



	if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {

		err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk,

			     smp->rr, 0, cfm.confirm_val);

		if (err)

			return SMP_UNSPECIFIED;



		if (memcmp(cfm.confirm_val, smp->pcnf, 16))

			return SMP_CONFIRM_FAILED;

	}



	if (smp->method == REQ_OOB) {

		if (hcon->out)

			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,