Bluetooth: Ignore IRKs with no Identity Address

The Core Specification (4.1) leaves room for sending an SMP Identity
Address Information PDU with an all-zeros BD_ADDR value. This
essentially means that we would not have an Identity Address for the
device and the only means of identifying it would be the IRK value
itself.

Due to lack of any known implementations behaving like this it's best to
keep our implementation as simple as possible as far as handling such
situations is concerned. This patch updates the Identity Address
Information handler function to simply ignore the IRK received from such
a device.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 79a80f4..50355d0 100644 (file)
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1003,6 +1003,19 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
 
        skb_pull(skb, sizeof(*info));
 
+       /* Strictly speaking the Core Specification (4.1) allows sending
+        * an empty address which would force us to rely on just the IRK
+        * as "identity information". However, since such
+        * implementations are not known of and in order to not over
+        * complicate our implementation, simply pretend that we never
+        * received an IRK for such a device.
+        */
+       if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
+               BT_ERR("Ignoring IRK with no identity address");
+               smp_distribute_keys(conn, 1);
+               return 0;
+       }
+
        bacpy(&smp->id_addr, &info->bdaddr);
        smp->id_addr_type = info->addr_type;