Skip to content

Commit e3350e7

Browse files
chhajedjichhajedji
committed
Bluedroid: Authentication fixes in Legacy and Secure Connection.
Prevent a remote device from doing a Bluetooth Impersonation Attack (BIAS) by: - Preventing remote device to downgrade secure connection feature mask. Secure connection feature mask should remain same or increase to enabled in link key generation and authentication. - Doing a mutual authentication during Legacy Authentication. Signed-off-by: Chinmay Chhajed <[email protected]>
1 parent 26272af commit e3350e7

File tree

16 files changed

+272
-51
lines changed

16 files changed

+272
-51
lines changed

‎components/bt/Kconfig

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,19 @@ menu "Bluetooth"
9292
default BTDM_CTRL_AUTO_LATENCY if BTDM_CTRL_MODE_BTDM
9393
default n
9494

95+
config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT
96+
bool "Legacy Authentication Vendor Specific Event Enable"
97+
depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
98+
default y
99+
help
100+
To protect from BIAS attack during Legacy authentication,
101+
Legacy authentication Vendor specific event should be enabled
102+
103+
config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT_EFF
104+
bool
105+
default BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
106+
default 0
107+
95108

96109
config BTDM_CTRL_BLE_MAX_CONN_EFF
97110
int

‎components/bt/controller/lib

Submodule lib updated 1 file

‎components/bt/host/bluedroid/bta/dm/bta_dm_act.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
6363
#if (CLASSIC_BT_INCLUDED == TRUE)
6464
static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, BOOLEAN min_16_digit);
6565
#endif /// CLASSIC_BT_INCLUDED == TRUE
66-
static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type);
66+
static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type, BOOLEAN sc_support);
6767
static UINT8 bta_dm_authentication_complete_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, int result);
6868
#endif ///SMP_INCLUDED == TRUE
6969
static void bta_dm_local_name_cback(BD_ADDR bd_addr);
@@ -1063,7 +1063,7 @@ void bta_dm_add_device (tBTA_DM_MSG *p_data)
10631063

10641064
if (!BTM_SecAddDevice (p_dev->bd_addr, p_dc, p_dev->bd_name, p_dev->features,
10651065
trusted_services_mask, p_lc, p_dev->key_type, p_dev->io_cap,
1066-
p_dev->pin_length)) {
1066+
p_dev->pin_length, p_dev->sc_support)) {
10671067
APPL_TRACE_ERROR ("BTA_DM: Error adding device %08x%04x",
10681068
(p_dev->bd_addr[0] << 24) + (p_dev->bd_addr[1] << 16) + (p_dev->bd_addr[2] << 8) + p_dev->bd_addr[3],
10691069
(p_dev->bd_addr[4] << 8) + p_dev->bd_addr[5]);
@@ -2988,7 +2988,8 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
29882988
**
29892989
*******************************************************************************/
29902990
static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
2991-
BD_NAME bd_name, LINK_KEY key, UINT8 key_type)
2991+
BD_NAME bd_name, LINK_KEY key, UINT8 key_type,
2992+
BOOLEAN sc_support)
29922993
{
29932994
tBTA_DM_SEC sec_event;
29942995
tBTA_DM_AUTH_CMPL *p_auth_cmpl;
@@ -3010,6 +3011,7 @@ static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
30103011
p_auth_cmpl->key_present = TRUE;
30113012
p_auth_cmpl->key_type = key_type;
30123013
p_auth_cmpl->success = TRUE;
3014+
p_auth_cmpl->sc_support = sc_support;
30133015

30143016
memcpy(p_auth_cmpl->key, key, LINK_KEY_LEN);
30153017
sec_event.auth_cmpl.fail_reason = HCI_SUCCESS;
@@ -3287,6 +3289,7 @@ static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
32873289

32883290
switch (p_msg->event) {
32893291
case BTM_BL_CONN_EVT:
3292+
p_msg->sc_downgrade = p_data->conn.sc_downgrade;
32903293
p_msg->is_new = TRUE;
32913294
bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
32923295
#if BLE_INCLUDED == TRUE
@@ -3513,6 +3516,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
35133516
APPL_TRACE_DEBUG("%s info: 0x%x", __func__, bta_dm_cb.device_list.peer_device[i].info);
35143517

35153518
if (bta_dm_cb.p_sec_cback) {
3519+
conn.link_up.sc_downgrade = p_data->acl_change.sc_downgrade;
35163520
bta_dm_cb.p_sec_cback(BTA_DM_LINK_UP_EVT, (tBTA_DM_SEC *)&conn);
35173521
}
35183522
} else {

‎components/bt/host/bluedroid/bta/dm/bta_dm_api.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -733,7 +733,8 @@ void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passkey)
733733
*******************************************************************************/
734734
void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
735735
tBTA_SERVICE_MASK trusted_mask, BOOLEAN is_trusted,
736-
UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length)
736+
UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length,
737+
UINT8 sc_support)
737738
{
738739

739740
tBTA_DM_API_ADD_DEVICE *p_msg;
@@ -746,6 +747,7 @@ void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
746747
p_msg->tm = trusted_mask;
747748
p_msg->is_trusted = is_trusted;
748749
p_msg->io_cap = io_cap;
750+
p_msg->sc_support = sc_support;
749751

750752
if (link_key) {
751753
p_msg->link_key_known = TRUE;

‎components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,7 @@ typedef struct {
433433
UINT8 new_role;
434434
BD_ADDR bd_addr;
435435
UINT8 hci_status;
436+
BOOLEAN sc_downgrade;
436437
#if BLE_INCLUDED == TRUE
437438
UINT16 handle;
438439
#endif
@@ -474,6 +475,7 @@ typedef struct {
474475
BD_NAME bd_name;
475476
UINT8 features[BTA_FEATURE_BYTES_PER_PAGE * (BTA_EXT_FEATURES_PAGE_MAX + 1)];
476477
UINT8 pin_length;
478+
UINT8 sc_support;
477479
} tBTA_DM_API_ADD_DEVICE;
478480

479481
/* data type for BTA_DM_API_REMOVE_ACL_EVT */

‎components/bt/host/bluedroid/bta/include/bta/bta_api.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -784,6 +784,7 @@ typedef struct {
784784
tBLE_ADDR_TYPE addr_type; /* Peer device address type */
785785
tBT_DEVICE_TYPE dev_type;
786786
UINT8 auth_mode;
787+
BOOLEAN sc_support; /* Denotes if peer device supported secure connection while bonding. */
787788
} tBTA_DM_AUTH_CMPL;
788789

789790

@@ -799,6 +800,7 @@ typedef struct {
799800

800801
/* Structure associated with BTA_DM_LINK_UP_EVT */
801802
typedef struct {
803+
BOOLEAN sc_downgrade; /* Security downgrade state. */
802804
BD_ADDR bd_addr; /* BD address peer device. */
803805
#if BLE_INCLUDED == TRUE
804806
tBTA_TRANSPORT link_type;
@@ -1757,7 +1759,8 @@ extern void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passke
17571759
extern void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class,
17581760
LINK_KEY link_key, tBTA_SERVICE_MASK trusted_mask,
17591761
BOOLEAN is_trusted, UINT8 key_type,
1760-
tBTA_IO_CAP io_cap, UINT8 pin_length);
1762+
tBTA_IO_CAP io_cap, UINT8 pin_length,
1763+
UINT8 sc_support);
17611764

17621765
/*******************************************************************************
17631766
**

‎components/bt/host/bluedroid/btc/core/btc_dm.c

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,27 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
303303
#endif ///BLE_INCLUDED == TRUE
304304
#endif ///SMP_INCLUDED == TRUE
305305

306+
static void btc_dm_link_up_evt(tBTA_DM_LINK_UP *p_link_up)
307+
{
308+
BD_ADDR bd_addr;
309+
bt_bdaddr_t bt_bdaddr;
310+
311+
memcpy(bd_addr, p_link_up->bd_addr, sizeof(BD_ADDR));
312+
memcpy(bt_bdaddr.address, p_link_up->bd_addr, sizeof(BD_ADDR));
313+
314+
if (p_link_up->sc_downgrade == 1) {
315+
if (btc_storage_remove_bonded_device(&bt_bdaddr) == BT_STATUS_SUCCESS) {
316+
if (BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_BR_EDR) == BTA_SUCCESS) {
317+
BTC_TRACE_EVENT(" %s() Bonding information removed.", __FUNCTION__);
318+
} else {
319+
BTC_TRACE_ERROR(" %s() BTA_DmRemoveDevice error", __FUNCTION__);
320+
}
321+
} else {
322+
BTC_TRACE_ERROR(" %s() btc_storage_remove_bonded_device error", __FUNCTION__);
323+
}
324+
}
325+
}
326+
306327
static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
307328
{
308329
/* Save link key, if not temporary */
@@ -326,7 +347,7 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
326347
__FUNCTION__, p_auth_cmpl->key_type);
327348
ret = btc_storage_add_bonded_device(&bd_addr,
328349
p_auth_cmpl->key, p_auth_cmpl->key_type,
329-
16);
350+
16, p_auth_cmpl->sc_support);
330351
BTC_ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
331352
} else {
332353
BTC_TRACE_DEBUG("%s: Temporary key. Not storing. key_type=0x%x",
@@ -678,6 +699,7 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
678699
}
679700
#endif /* BTC_GAP_BT_INCLUDED == TRUE */
680701
case BTA_DM_LINK_UP_EVT:
702+
btc_dm_link_up_evt(&p_data->link_up);
681703
case BTA_DM_LINK_DOWN_EVT:
682704
case BTA_DM_HW_ERROR_EVT:
683705
BTC_TRACE_DEBUG( "btc_dm_sec_cback : unhandled event (%d)\n", msg->act );

‎components/bt/host/bluedroid/btc/core/btc_storage.c

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@
3737
bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
3838
LINK_KEY link_key,
3939
uint8_t key_type,
40-
uint8_t pin_length)
40+
uint8_t pin_length,
41+
BOOLEAN sc_support)
4142
{
4243
bdstr_t bdstr;
4344

@@ -48,6 +49,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
4849
int ret = btc_config_set_int(bdstr, BTC_STORAGE_LINK_KEY_TYPE_STR, (int)key_type);
4950
ret &= btc_config_set_int(bdstr, BTC_STORAGE_PIN_LENGTH_STR, (int)pin_length);
5051
ret &= btc_config_set_bin(bdstr, BTC_STORAGE_LINK_KEY_STR, link_key, sizeof(LINK_KEY));
52+
ret &= btc_config_set_bin(bdstr, BTC_STORAGE_SC_SUPPORT, (uint8_t *)&sc_support, sizeof(sc_support));
5153
/* write bonded info immediately */
5254
btc_config_flush();
5355
btc_config_unlock();
@@ -69,6 +71,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
6971
static bt_status_t btc_in_fetch_bonded_devices(int add)
7072
{
7173
BOOLEAN bt_linkkey_file_found = FALSE;
74+
UINT8 sc_support = 0;
7275

7376
btc_config_lock();
7477
for (const btc_config_section_iter_t *iter = btc_config_section_begin(); iter != btc_config_section_end(); iter = btc_config_section_next(iter)) {
@@ -93,9 +96,11 @@ static bt_status_t btc_in_fetch_bonded_devices(int add)
9396
uint2devclass((UINT32)cod, dev_class);
9497
}
9598
btc_config_get_int(name, BTC_STORAGE_PIN_LENGTH_STR, &pin_length);
99+
size = sizeof(sc_support);
100+
btc_config_get_bin(name, BTC_STORAGE_SC_SUPPORT, &sc_support, &size);
96101
#if (SMP_INCLUDED == TRUE)
97102
BTA_DmAddDevice(bd_addr.address, dev_class, link_key, 0, 0,
98-
(UINT8)linkkey_type, 0, pin_length);
103+
(UINT8)linkkey_type, 0, pin_length, (UINT8)sc_support);
99104
#endif ///SMP_INCLUDED == TRUE
100105
}
101106
bt_linkkey_file_found = TRUE;
@@ -160,6 +165,9 @@ bt_status_t btc_storage_remove_bonded_device(bt_bdaddr_t *remote_bd_addr)
160165
if (btc_config_exist(bdstr, BTC_STORAGE_LINK_KEY_STR)) {
161166
ret &= btc_config_remove(bdstr, BTC_STORAGE_LINK_KEY_STR);
162167
}
168+
if (btc_config_exist(bdstr, BTC_STORAGE_SC_SUPPORT)) {
169+
ret &= btc_config_remove(bdstr, BTC_STORAGE_SC_SUPPORT);
170+
}
163171
/* write bonded info immediately */
164172
btc_config_flush();
165173
btc_config_unlock();
@@ -187,6 +195,7 @@ int btc_storage_get_num_bt_bond_devices(void)
187195
if (string_is_bdaddr(name) &&
188196
btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
189197
btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
198+
btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
190199
btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
191200
num_dev++;
192201
}
@@ -223,6 +232,7 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
223232
if (string_is_bdaddr(name) &&
224233
btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
225234
btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
235+
btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
226236
btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
227237
string_to_bdaddr(name, &bd_addr);
228238
memcpy(bond_dev, &bd_addr, sizeof(bt_bdaddr_t));
@@ -232,4 +242,4 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
232242
btc_config_unlock();
233243

234244
return BT_STATUS_SUCCESS;
235-
}
245+
}

‎components/bt/host/bluedroid/btc/include/btc/btc_storage.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
#define BTC_STORAGE_LINK_KEY_STR "LinkKey" /* same as the ble */
2626
#define BTC_STORAGE_LINK_KEY_TYPE_STR "LinkKeyType"
2727
#define BTC_STORAGE_PIN_LENGTH_STR "PinLength"
28+
#define BTC_STORAGE_SC_SUPPORT "SCSupport"
2829

2930
/*******************************************************************************
3031
**
@@ -40,7 +41,8 @@
4041
bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
4142
LINK_KEY link_key,
4243
uint8_t key_type,
43-
uint8_t pin_length);
44+
uint8_t pin_length,
45+
BOOLEAN sc_support);
4446

4547
/*******************************************************************************
4648
**

0 commit comments

Comments
 (0)