espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-09-16 14:09:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

host/ble_att_srv: security check for notifications/indications

Browse Source 
According to Core Specification Version 5.3, Vol 3, Part C
10.3.2.2: " Any notifications received before the security requirements
are met shall be ignored. Any indications received before the security
requirements are met shall be confirmed and then discarded. When a
client reconnects to a server and expects to receive indications or
notifications for which security is required, the client shall enable
encryption with the server."
This commit is contained in:
Krzysztof Kopyściński
2022-04-13 10:41:10 +02:00
committed by Szymon Janc
parent 14b43a457a
commit 39dcd34def
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/src/ble_att_svr.c
+20
View File
@@ -2472,6 +2472,7 @@ ble_att_svr_rx_notify(uint16_t conn_handle, struct os_mbuf **rxom)
#endif
struct ble_att_notify_req *req;
struct ble_gap_sec_state sec_state;
uint16_t handle;
int rc;
@@ -2488,6 +2489,15 @@ ble_att_svr_rx_notify(uint16_t conn_handle, struct os_mbuf **rxom)
return BLE_HS_EBADDATA;
}
ble_att_svr_get_sec_state(conn_handle, &sec_state);
/* All indications shall be confirmed, but only these with required
* security established shall be pass to application
*/
if (MYNEWT_VAL(BLE_SM_SC_LVL) >= 2 && !sec_state.encrypted) {
return 0;
}
/* Strip the request base from the front of the mbuf. */
os_mbuf_adj(*rxom, sizeof(*req));
@@ -2537,6 +2547,7 @@ ble_att_svr_rx_indicate(uint16_t conn_handle, struct os_mbuf **rxom)
#endif
struct ble_att_indicate_req *req;
struct ble_gap_sec_state sec_state;
struct os_mbuf *txom;
uint16_t handle;
uint8_t att_err;
@@ -2569,6 +2580,15 @@ ble_att_svr_rx_indicate(uint16_t conn_handle, struct os_mbuf **rxom)
goto done;
}
ble_att_svr_get_sec_state(conn_handle, &sec_state);
/* All indications shall be confirmed, but only these with required
* security established shall be pass to application
*/
if (MYNEWT_VAL(BLE_SM_SC_LVL) >= 2 && !sec_state.encrypted) {
goto done;
}
/* Strip the request base from the front of the mbuf. */
os_mbuf_adj(*rxom, sizeof(*req));