Skip to contentSkip to conversation

Bluetooth: Expose debugfs entry to force resolvable private address

PATCH New Mike Ryan 2 participants 2 messages Dec 1, 2019 – Dec 2, 2019

Subsystems (2)
Bluetooth drivers Bluetooth
lore
Share & tools
lore

Mike Ryan

author
#0 lore raw

PATCH 1/1 Bluetooth: Expose debugfs entry to force resolvable private address

In order to facilitate impersonation attacks against devices using resolvable private addresses (RPAs), this debugfs entry allows the user to set a fixed RPA that is used during undirected and directed advertising. Writing 00:00:00:00:00:00 disables the forced address and will resume generating valid RPAs.

Signed-off-by Mike Ryan <[email protected]>
---
 include/net/bluetooth/hci_core.h |  1 +
 net/bluetooth/hci_debugfs.c      | 54 ++++++++++++++++++++++++++++++++++++++++
 net/bluetooth/hci_request.c      | 15 ++++++++---
 3 files changed, 66 insertions(+), 4 deletions(-)
include/net/bluetooth/hci_core.h +1 -0
index b689aceb6..a822914d7 100644
@@ -428,6 +428,7 @@ struct hci_dev {
 	__u32			rpa_timeout;
 	struct delayed_work	rpa_expired;
 	bdaddr_t		rpa;
+	bdaddr_t		force_rpa;
 
 #if IS_ENABLED(CONFIG_BT_LEDS)
 	struct led_trigger	*power_led;
net/bluetooth/hci_debugfs.c +54 -0

66 lines not on this page · raw message

net/bluetooth/hci_request.c +11 -4
index 2a1b64dbf..63f4d5c16 100644
@@ -1914,10 +1914,17 @@ int hci_update_random_address(struct hci_request *req, bool require_privacy,
 		    !bacmp(&hdev->random_addr, &hdev->rpa))
 			return 0;
 
-		err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
-		if (err < 0) {
-			bt_dev_err(hdev, "failed to generate new RPA");
-			return err;
+		/* If force_rpa is set to 00:00:00:00:00:00, generate a valid
+		 * RPA using IRK. Otherwise use the forced value.
+		 */
+		if (!bacmp(&hdev->force_rpa, BDADDR_ANY)) {
+			err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
+			if (err < 0) {
+				bt_dev_err(hdev, "failed to generate new RPA");
+				return err;
+			}
+		} else {
+			bacpy(&hdev->rpa, &hdev->force_rpa);
 		}
 
 		set_random_addr(req, &hdev->rpa);
Signature · 1 line
2.11.0
build bot
#1 lore raw
Thank you for the patch! Yet something to improve:

Hi Mike,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on bluetooth-next/master]
[cannot apply to bluetooth/master v5.4 v5.4-rc8 v5.4-rc7 next-20191129 v5.4 next-20191129] [if your patch is applied to the wrong git tree, please drop us a note to help improve the system. BTW, we also suggest to use '--base' option to specify the base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Mike-Ryan/Bluetooth-Expose-debugfs-entry-to-force-resolvable-private-address/20191202-055959
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
config: sparc64-allmodconfig (attached as .config)
compiler: sparc64-linux-gcc (GCC) 7.4.0

reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
GCC_VERSION=7.4.0 make.cross ARCH=sparc64

If you fix the issue, kindly add following tag

Reported-by kbuild test robot <[email protected]>

All errors (new ones prefixed by >>):

net/bluetooth/hci_debugfs.c: In function 'force_rpa_write':

>> net/bluetooth/hci_debugfs.c:741:6: error: implicit declaration of function 'str2ba'; did you mean 'strspn'? [-Werror=implicit-function-declaration]
     if (str2ba(buf, &rpa))
         ^~~~~~
         strspn

cc1: some warnings being treated as errors

vim +741 net/bluetooth/hci_debugfs.c

725
726 static ssize_t force_rpa_write(struct file *file, const char __user *user_buf,
727 size_t count, loff_t *ppos)
728 {
729 struct hci_dev *hdev = file->private_data;
730 char buf[18];
731 size_t buf_size = min(count, (sizeof(buf)-1));
732 bdaddr_t rpa;
733
734 if (test_bit(HCI_UP, &hdev->flags))
735 return -EBUSY;
736
737 if (copy_from_user(buf, user_buf, buf_size))
738 return -EFAULT;
739
740 buf[buf_size] = '\0';

 > 741		if (str2ba(buf, &rpa))

742 return -EINVAL;
743
744 /* The two most significant bits shall be 01 unless the address is
745 * 00:00:00:00:00:00.
746 */
747 if ((rpa.b[5] & 0xc0) != 0x40 && bacmp(&rpa, BDADDR_ANY))
748 return -EINVAL;
749
750 if (!bacmp(&hdev->force_rpa, &rpa))
751 return -EALREADY;
752
753 bacpy(&hdev->force_rpa, &rpa);
754
755 return count;
756 }
757

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org Intel Corporation