Hi Luiz, > -----Original Message----- > From: Luiz Augusto von Dentz <luiz.dentz@xxxxxxxxx> > Sent: Thursday, August 29, 2024 6:50 PM > To: Iulia Tanasescu <iulia.tanasescu@xxxxxxx> > Cc: linux-bluetooth@xxxxxxxxxxxxxxx; Claudia Cristina Draghicescu > <claudia.rosu@xxxxxxx>; Mihai-Octavian Urzica <mihai- > octavian.urzica@xxxxxxx>; Vlad Pruteanu <vlad.pruteanu@xxxxxxx>; Andrei > Istodorescu <andrei.istodorescu@xxxxxxx> > Subject: Re: [PATCH BlueZ 1/2] client/assistant: Enter Broadcast Code as > string > > Hi Iulia, > > On Thu, Aug 29, 2024 at 9:25 AM Iulia Tanasescu <iulia.tanasescu@xxxxxxx> > wrote: > > > > Currently, the user sets the Broadcast Code as an array of bytes when > > prompted from the assistant submenu. However, the Bluetooth Core > > Specification requires that, on the UI level, the Broadcast Code shall > > be represented as a string (Vol 3, Part C, 3.2.6). > > Interesting, but we could go one step further can hash the string using > bt_crypto_AES-CMAC since that would always generate a 16 bits hash, we > actually have done something similar for SIRK on main.conf: > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithu > b.com%2Fbluez%2Fbluez%2Fblob%2Fmaster%2Fsrc%2Fmain.conf%23L268 > &data=05%7C02%7Ciulia.tanasescu%40nxp.com%7C55a1c6477d7440ca5aa > 208dcc842487c%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C6 > 38605434214981441%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw > MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7 > C&sdata=3fX9C6T9JKo2KBn1KzJI0NfOJmFelje3sQdCv6HElYo%3D&reserved= > 0 I think this would violate the spec, which states that the string should be converted into a number simply by placing the bytes into a 128-bit value (Vol 3, Part C, 3.2.6). Also, by hashing the string, the bytes will not match the key used by the Broadcast Source to encrypt the stream, so the controller on the Scan Delegator will use an incorrect key for decrypting. > > > This commit makes the Broadcast Code be parsed as a string from the > > assistant prompt. The bluetoothctl log below shows a Broadcast > > Assistant pushing an encrypted stream to a peer: > > > > client/bluetoothctl > > [bluetooth]# [CHG] Controller 00:60:37:31:7E:3F Pairable: yes > > [bluetooth]# AdvertisementMonitor path registered [bluetooth]# scan on > > [bluetooth]# [NEW] Device 00:60:37:31:7E:3F 00-60-37-31-7E-3F > > [bluetooth]# connect 00:60:37:31:7E:3F Attempting to connect to > > 00:60:37:31:7E:3F [CHG] Device 00:60:37:31:7E:3F Connected: yes > > [00-60-37-31-7E-3F]# Connection successful [00-60-37-31-7E-3F]# [NEW] > > Device 19:9A:7A:71:E5:8B 19-9A-7A-71-E5-8B [00-60-37-31-7E-3F]# > [NEW] > > Assistant > > > /org/bluez/hci0/src_19_9A_7A_71_E5_8B/dev_00_60_37_31_7E_3F/bis1 > > [00-60-37-31-7E-3F]# assistant.push > > > /org/bluez/hci0/src_19_9A_7A_71_E5_8B/dev_00_60_37_31_7E_3F/bis1 > > [Assistant] Enter Metadata (auto/value): a [Assistant] Enter Broadcast > > Code (auto/value): Borne House [00-60-37-31-7E-3F]# [CHG] Assistant > > > /org/bluez/hci0/src_19_9A_7A_71_E5_8B/dev_00_60_37_31_7E_3F/bis1 > > State: pending > > [00-60-37-31-7E-3F]# Assistant > > > /org/bluez/hci0/src_19_9A_7A_71_E5_8B/dev_00_60_37_31_7E_3F/bis1 > > pushed > > [00-60-37-31-7E-3F]# [CHG] Assistant > > > /org/bluez/hci0/src_19_9A_7A_71_E5_8B/dev_00_60_37_31_7E_3F/bis1 > > State: requesting > > [00-60-37-31-7E-3F]# [CHG] Assistant > > > /org/bluez/hci0/src_19_9A_7A_71_E5_8B/dev_00_60_37_31_7E_3F/bis1 > > State: active > > > > The btmon log below shows the way the Broadcast Code string is > > converted into a byte array and sent to the peer via GATT: > > > > bluetoothd[6013]: < ACL Data TX: Handle 0 flags 0x00 dlen 28 > > ATT: Write Command (0x52) len 23 > > Handle: 0x0040 Type: Broadcast Audio Scan Control Point (0x2bc7) > > Data[21]: 02018be5717a9a1900db5e3a02ffff010100000000 > > Opcode: Add Source (0x02) > > Source_Address_Type: 1 > > Source_Address: 19:9A:7A:71:E5:8B > > Source_Adv_SID: 0 > > Broadcast_ID: 0x3a5edb > > PA_Sync_State: Synchronize to PA - PAST not available > > PA_Interval: 0xffff > > Num_Subgroups: 1 > > Subgroup #0: > > BIS_Sync State: 0x00000001 > > > ACL Data RX: Handle 0 flags 0x01 dlen 2 > > ATT: Handle Multiple Value Notification (0x23) len 24 > > Length: 0x0014 > > Handle: 0x003a Type: Broadcast Receive State (0x2bc8) > > Data[20]: 01018be5717a9a1900db5e3a0201010000000000 > > Source_ID: 1 > > Source_Address_Type: 1 > > Source_Address: 19:9A:7A:71:E5:8B > > Source_Adv_SID: 0 > > Broadcast_ID: 0x3a5edb > > PA_Sync_State: Synchronized to PA > > BIG_Encryption: Broadcast_Code required > > Num_Subgroups: 1 > > Subgroup #0: > > BIS_Sync State: 0x00000000 > > bluetoothd[6013]: < ACL Data TX: Handle 0 flags 0x00 dlen 25 > > ATT: Write Command (0x52) len 20 > > Handle: 0x0040 Type: Broadcast Audio Scan Control Point (0x2bc7) > > Data[18]: 040142c3b8726e6520486f75736500000000 > > Opcode: Set Broadcast_Code (0x04) > > Source_ID: 1 > > Broadcast_Code[16]: 426f726e6520486f7573650000000000 > > > ACL Data RX: Handle 0 flags 0x01 dlen 2 > > ATT: Handle Multiple Value Notification (0x23) len 24 > > Length: 0x0014 > > Handle: 0x003a Type: Broadcast Receive State (0x2bc8) > > Data[20]: 01018be5717a9a1900db5e3a0202010100000000 > > Source_ID: 1 > > Source_Address_Type: 1 > > Source_Address: 19:9A:7A:71:E5:8B > > Source_Adv_SID: 0 > > Broadcast_ID: 0x3a5edb > > PA_Sync_State: Synchronized to PA > > BIG_Encryption: Decrypting > > Num_Subgroups: 1 > > Subgroup #0: > > BIS_Sync State: 0x00000001 > > --- > > client/assistant.c | 24 ++++++++++++++---------- > > 1 file changed, 14 insertions(+), 10 deletions(-) > > > > diff --git a/client/assistant.c b/client/assistant.c index > > 77fb78329..16e94664a 100644 > > --- a/client/assistant.c > > +++ b/client/assistant.c > > @@ -255,28 +255,32 @@ static void push_reply(DBusMessage *message, > > void *user_data) static void assistant_set_bcode_cfg(const char > > *input, void *user_data) { > > struct assistant_config *cfg = user_data; > > - char *endptr; > > - uint8_t *bcode = cfg->qos.bcast.bcode; > > > > if (!strcasecmp(input, "a") || !strcasecmp(input, "auto")) { > > - memset(bcode, 0, BCODE_LEN); > > + memset(cfg->qos.bcast.bcode, 0, BCODE_LEN); > > } else { > > - bcode[0] = strtol(input, &endptr, 16); > > + if (strlen(input) > BCODE_LEN) { > > + bt_shell_printf("Input string too long %s\n", input); > > + goto fail; > > + } > > > > - for (uint8_t i = 1; i < BCODE_LEN; i++) > > - bcode[i] = strtol(endptr, &endptr, 16); > > + memcpy(cfg->qos.bcast.bcode, input, strlen(input)); > > } > > > > if (!g_dbus_proxy_method_call(cfg->proxy, "Push", > > push_setup, push_reply, > > cfg, NULL)) { > > bt_shell_printf("Failed to push assistant\n"); > > + goto fail; > > + } > > > > - free(cfg->meta); > > - g_free(cfg); > > + return; > > > > - return bt_shell_noninteractive_quit(EXIT_FAILURE); > > - } > > +fail: > > + free(cfg->meta); > > + g_free(cfg); > > + > > + return bt_shell_noninteractive_quit(EXIT_FAILURE); > > } > > > > static void assistant_set_metadata_cfg(const char *input, void > > *user_data) > > -- > > 2.39.2 > > > > > -- > Luiz Augusto von Dentz Regards, Iulia
