Hi Archie, > According to the spec Ver 5.2, Vol 3, Part C, Sec 5.2.2.8: > Device in security mode 4 level 4 shall enforce: > 128-bit equivalent strength for link and encryption keys required > using FIPS approved algorithms (E0 not allowed, SAFER+ not allowed, > and P-192 not allowed; encryption key not shortened) > > This patch rejects connection with key size below 16 for FIPS level > services. > > Signed-off-by: Archie Pusaka <apus...@chromium.org> > Reviewed-by: Alain Michaud <ala...@chromium.org> > > --- > > net/bluetooth/l2cap_core.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c > index ade83e224567..306616ec26e6 100644 > --- a/net/bluetooth/l2cap_core.c > +++ b/net/bluetooth/l2cap_core.c > @@ -1515,8 +1515,13 @@ static bool l2cap_check_enc_key_size(struct hci_conn > *hcon) > * that have no key size requirements. Ensure that the link is > * actually encrypted before enforcing a key size. > */ > + int min_key_size = hcon->hdev->min_enc_key_size; > + > + if (hcon->sec_level == BT_SECURITY_FIPS) > + min_key_size = 16; > + > return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || > - hcon->enc_key_size >= hcon->hdev->min_enc_key_size); > + hcon->enc_key_size >= min_key_size); > }
I think this is fine at this position. It is a L2CAP socket requirement to be in FIPS mode since you will set it via socket option. However I would extend the comment above to describe what is going on. And generally the variable declaration might be better placed before the comment. Regards Marcel
