Skip to content

Commit 912cdc0

Browse files
joerchanjhedberg
joerchan
authored and
jhedberg
committed
Bluetooth: host: Allow to disable legacy pairing.
Add option to disable legacy pairing and only use secure connection. If legacy pairing was requested pairing will be denied with status insufficient authenticated Signed-off-by: Joakim Andersson <[email protected]>
1 parent 51574c1 commit 912cdc0

File tree

4 files changed

+39
-29
lines changed

4 files changed

+39
-29
lines changed

‎subsys/bluetooth/host/Kconfig

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,8 +284,18 @@ config BT_SIGNING
284284
This option enables data signing which is used for transferring
285285
authenticated data in an unencrypted connection.
286286

287+
config BT_SMP_SC_PAIR_ONLY
288+
bool "Disable legacy pairing"
289+
help
290+
This option disables LE legacy pairing and forces LE secure connection
291+
pairing. All Security Mode 1 levels can be used with legacy pairing
292+
disabled, but pairing with devices that do not support secure
293+
connections pairing will not be supported.
294+
To force a higher security level use "Secure Connections Only Mode"
295+
287296
config BT_SMP_SC_ONLY
288297
bool "Secure Connections Only Mode"
298+
select BT_SMP_SC_PAIR_ONLY
289299
help
290300
This option enables support for Secure Connection Only Mode. In this
291301
mode device shall only use Security Mode 1 Level 4 with exception

‎subsys/bluetooth/host/hci_core.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2919,7 +2919,7 @@ static void le_ltk_request(struct net_buf *buf)
29192919
goto done;
29202920
}
29212921

2922-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
2922+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
29232923
if (conn->le.keys && (conn->le.keys->keys & BT_KEYS_SLAVE_LTK) &&
29242924
!memcmp(conn->le.keys->slave_ltk.rand, &evt->rand, 8) &&
29252925
!memcmp(conn->le.keys->slave_ltk.ediv, &evt->ediv, 2)) {
@@ -2944,7 +2944,7 @@ static void le_ltk_request(struct net_buf *buf)
29442944
bt_hci_cmd_send(BT_HCI_OP_LE_LTK_REQ_REPLY, buf);
29452945
goto done;
29462946
}
2947-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
2947+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
29482948

29492949
le_ltk_neg_reply(evt->handle);
29502950

‎subsys/bluetooth/host/keys.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,9 @@ struct bt_keys {
5656
struct bt_csrk local_csrk;
5757
struct bt_csrk remote_csrk;
5858
#endif /* BT_SIGNING */
59-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
59+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
6060
struct bt_ltk slave_ltk;
61-
#endif /* CONFIG_BT_SMP_SC_ONLY */
61+
#endif /* CONFIG_BT_SMP_SC_PAIR_ONLY */
6262
};
6363

6464
#define BT_KEYS_STORAGE_LEN (sizeof(struct bt_keys) - \

‎subsys/bluetooth/host/smp.c

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ static unsigned int fixed_passkey = BT_PASSKEY_INVALID;
186186
fixed_passkey != BT_PASSKEY_INVALID && \
187187
(smp)->method == PASSKEY_DISPLAY)
188188

189-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
189+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
190190
/* based on table 2.8 Core Spec 2.3.5.1 Vol. 3 Part H */
191191
static const u8_t gen_method_legacy[5 /* remote */][5 /* local */] = {
192192
{ JUST_WORKS, JUST_WORKS, PASSKEY_INPUT, JUST_WORKS, PASSKEY_INPUT },
@@ -197,7 +197,7 @@ static const u8_t gen_method_legacy[5 /* remote */][5 /* local */] = {
197197
{ PASSKEY_DISPLAY, PASSKEY_DISPLAY, PASSKEY_INPUT, JUST_WORKS,
198198
PASSKEY_ROLE },
199199
};
200-
#endif /* CONFIG_BT_SMP_SC_ONLY */
200+
#endif /* CONFIG_BT_SMP_SC_PAIR_ONLY */
201201

202202
/* based on table 2.8 Core Spec 2.3.5.1 Vol. 3 Part H */
203203
static const u8_t gen_method_sc[5 /* remote */][5 /* local */] = {
@@ -542,7 +542,7 @@ static u8_t get_encryption_key_size(struct bt_smp *smp)
542542
}
543543

544544
#if defined(CONFIG_BT_PRIVACY) || defined(CONFIG_BT_SIGNING) || \
545-
!defined(CONFIG_BT_SMP_SC_ONLY)
545+
!defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
546546
/* For TX callbacks */
547547
static void smp_pairing_complete(struct bt_smp *smp, u8_t status);
548548
#if defined(CONFIG_BT_BREDR)
@@ -1607,7 +1607,7 @@ static u8_t smp_send_pairing_random(struct bt_smp *smp)
16071607
return 0;
16081608
}
16091609

1610-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
1610+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
16111611
static void xor_128(const u8_t p[16], const u8_t q[16], u8_t r[16])
16121612
{
16131613
size_t len = 16;
@@ -1658,7 +1658,7 @@ static int smp_c1(const u8_t k[16], const u8_t r[16],
16581658

16591659
return bt_encrypt_le(k, enc_data, enc_data);
16601660
}
1661-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
1661+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
16621662

16631663
static u8_t smp_send_pairing_confirm(struct bt_smp *smp)
16641664
{
@@ -1707,7 +1707,7 @@ static u8_t smp_send_pairing_confirm(struct bt_smp *smp)
17071707
return 0;
17081708
}
17091709

1710-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
1710+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
17111711
static void ident_sent(struct bt_conn *conn)
17121712
{
17131713
smp_check_complete(conn, BT_SMP_DIST_ENC_KEY);
@@ -1772,7 +1772,7 @@ static void legacy_distribute_keys(struct bt_smp *smp)
17721772
}
17731773
}
17741774
}
1775-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
1775+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
17761776

17771777
static void bt_smp_distribute_keys(struct bt_smp *smp)
17781778
{
@@ -1784,12 +1784,12 @@ static void bt_smp_distribute_keys(struct bt_smp *smp)
17841784
return;
17851785
}
17861786

1787-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
1787+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
17881788
/* Distribute legacy pairing specific keys */
17891789
if (!atomic_test_bit(smp->flags, SMP_FLAG_SC)) {
17901790
legacy_distribute_keys(smp);
17911791
}
1792-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
1792+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
17931793

17941794
#if defined(CONFIG_BT_PRIVACY)
17951795
if (smp->local_dist & BT_SMP_DIST_ID_KEY) {
@@ -1871,7 +1871,7 @@ static u8_t send_pairing_rsp(struct bt_smp *smp)
18711871
}
18721872
#endif /* CONFIG_BT_PERIPHERAL */
18731873

1874-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
1874+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
18751875
static int smp_s1(const u8_t k[16], const u8_t r1[16],
18761876
const u8_t r2[16], u8_t out[16])
18771877
{
@@ -2250,7 +2250,7 @@ static u8_t smp_master_ident(struct bt_smp *smp, struct net_buf *buf)
22502250
{
22512251
return BT_SMP_ERR_CMD_NOTSUPP;
22522252
}
2253-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
2253+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
22542254

22552255
static int _smp_init(struct bt_smp *smp)
22562256
{
@@ -2439,11 +2439,11 @@ static u8_t smp_pairing_req(struct bt_smp *smp, struct net_buf *buf)
24392439
atomic_set_bit(smp->flags, SMP_FLAG_PAIRING);
24402440

24412441
if (!atomic_test_bit(smp->flags, SMP_FLAG_SC)) {
2442-
#if defined(CONFIG_BT_SMP_SC_ONLY)
2442+
#if defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
24432443
return BT_SMP_ERR_AUTH_REQUIREMENTS;
24442444
#else
24452445
return legacy_pairing_req(smp, req->io_capability);
2446-
#endif /* CONFIG_BT_SMP_SC_ONLY */
2446+
#endif /* CONFIG_BT_SMP_SC_PAIR_ONLY */
24472447
}
24482448

24492449
smp->method = get_pair_method(smp, req->io_capability);
@@ -2592,11 +2592,11 @@ static u8_t smp_pairing_rsp(struct bt_smp *smp, struct net_buf *buf)
25922592
}
25932593

25942594
if (!atomic_test_bit(smp->flags, SMP_FLAG_SC)) {
2595-
#if defined(CONFIG_BT_SMP_SC_ONLY)
2595+
#if defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
25962596
return BT_SMP_ERR_AUTH_REQUIREMENTS;
25972597
#else
25982598
return legacy_pairing_rsp(smp, rsp->io_capability);
2599-
#endif /* CONFIG_BT_SMP_SC_ONLY */
2599+
#endif /* CONFIG_BT_SMP_SC_PAIR_ONLY */
26002600
}
26012601

26022602
smp->method = get_pair_method(smp, rsp->io_capability);
@@ -2651,11 +2651,11 @@ static u8_t smp_pairing_confirm(struct bt_smp *smp, struct net_buf *buf)
26512651
return 0;
26522652
}
26532653

2654-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
2654+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
26552655
if (!atomic_test_bit(smp->flags, SMP_FLAG_SC)) {
26562656
return legacy_pairing_confirm(smp);
26572657
}
2658-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
2658+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
26592659

26602660
switch (smp->method) {
26612661
case PASSKEY_DISPLAY:
@@ -2900,11 +2900,11 @@ static u8_t smp_pairing_random(struct bt_smp *smp, struct net_buf *buf)
29002900

29012901
memcpy(smp->rrnd, req->val, sizeof(smp->rrnd));
29022902

2903-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
2903+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
29042904
if (!atomic_test_bit(smp->flags, SMP_FLAG_SC)) {
29052905
return legacy_pairing_random(smp);
29062906
}
2907-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
2907+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
29082908

29092909
#if defined(CONFIG_BT_CENTRAL)
29102910
if (smp->chan.chan.conn->role == BT_HCI_ROLE_MASTER) {
@@ -4240,12 +4240,12 @@ int bt_smp_auth_passkey_entry(struct bt_conn *conn, unsigned int passkey)
42404240
return -EINVAL;
42414241
}
42424242

4243-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
4243+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
42444244
if (!atomic_test_bit(smp->flags, SMP_FLAG_SC)) {
42454245
legacy_passkey_entry(smp, passkey);
42464246
return 0;
42474247
}
4248-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
4248+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
42494249

42504250
smp->passkey = sys_cpu_to_le32(passkey);
42514251

@@ -4346,7 +4346,7 @@ int bt_smp_auth_cancel(struct bt_conn *conn)
43464346
}
43474347
}
43484348

4349-
#if !defined(CONFIG_BT_SMP_SC_ONLY)
4349+
#if !defined(CONFIG_BT_SMP_SC_PAIR_ONLY)
43504350
int bt_smp_auth_pairing_confirm(struct bt_conn *conn)
43514351
{
43524352
struct bt_smp *smp;
@@ -4398,7 +4398,7 @@ int bt_smp_auth_pairing_confirm(struct bt_conn *conn)
43984398
/* confirm_pairing will never be called in LE SC only mode */
43994399
return -EINVAL;
44004400
}
4401-
#endif /* !CONFIG_BT_SMP_SC_ONLY */
4401+
#endif /* !CONFIG_BT_SMP_SC_PAIR_ONLY */
44024402

44034403
#if defined(CONFIG_BT_FIXED_PASSKEY)
44044404
int bt_passkey_set(unsigned int passkey)
@@ -4578,8 +4578,8 @@ int bt_smp_init(void)
45784578
};
45794579

45804580
sc_supported = le_sc_supported();
4581-
if (IS_ENABLED(CONFIG_BT_SMP_SC_ONLY) && !sc_supported) {
4582-
BT_ERR("SC Only Mode selected but LE SC not supported");
4581+
if (IS_ENABLED(CONFIG_BT_SMP_SC_PAIR_ONLY) && !sc_supported) {
4582+
BT_ERR("SC Pair Only Mode selected but LE SC not supported");
45834583
return -ENOENT;
45844584
}
45854585

0 commit comments

Comments
 (0)