From d69d8789f93c1d139f2c874f698e95655a7e7adc Mon Sep 17 00:00:00 2001 From: Rahul Tank Date: Wed, 22 Jan 2025 13:16:02 +0200 Subject: [PATCH] host: sm: secure connection only pairing might fail with no reason When BLE_SM_SC_ONLY is on during pairing request, the process might fail even though both SC is supported by the peer and the key size meet the requirements. --- nimble/host/src/ble_sm.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/nimble/host/src/ble_sm.c b/nimble/host/src/ble_sm.c index 59e3acaa3..22ba8ca6f 100644 --- a/nimble/host/src/ble_sm.c +++ b/nimble/host/src/ble_sm.c @@ -1931,18 +1931,18 @@ ble_sm_pair_req_rx(uint16_t conn_handle, struct os_mbuf **om, } else if (req->max_enc_key_size > BLE_SM_PAIR_KEY_SZ_MAX) { res->sm_err = BLE_SM_ERR_INVAL; res->app_status = BLE_HS_SM_US_ERR(BLE_SM_ERR_INVAL); - } else if (ble_hs_cfg.sm_sc_only) { - /* Fail if Secure Connections Only mode is on and remote does not - * meet key size requirements - MITM was checked in last step. - * Fail if SC is not supported by peer or key size is too small + } else if (ble_hs_cfg.sm_sc_only && !(req->authreq & BLE_SM_PAIR_AUTHREQ_SC)) { + /* Fail if Secure Connections Only mode is on and SC is not supported by peer */ - if (!(req->authreq & BLE_SM_PAIR_AUTHREQ_SC)) { - res->sm_err = BLE_SM_ERR_AUTHREQ; - res->app_status = BLE_HS_SM_US_ERR(BLE_SM_ERR_AUTHREQ); - } else if (req->max_enc_key_size != BLE_SM_PAIR_KEY_SZ_MAX) { - res->sm_err = BLE_SM_ERR_ENC_KEY_SZ; - res->app_status = BLE_HS_SM_US_ERR(BLE_SM_ERR_ENC_KEY_SZ); - } + res->sm_err = BLE_SM_ERR_AUTHREQ; + res->app_status = BLE_HS_SM_US_ERR(BLE_SM_ERR_AUTHREQ); + res->enc_cb = 1; + } else if (ble_hs_cfg.sm_sc_only && (req->max_enc_key_size != BLE_SM_PAIR_KEY_SZ_MAX)) { + /* Fail if Secure Connections Only mode is on and key size is too small + */ + res->sm_err = BLE_SM_ERR_ENC_KEY_SZ; + res->app_status = BLE_HS_SM_US_ERR(BLE_SM_ERR_ENC_KEY_SZ); + res->enc_cb = 1; } else if (!ble_sm_verify_auth_requirements(req->authreq)) { res->sm_err = BLE_SM_ERR_AUTHREQ; res->app_status = BLE_HS_SM_US_ERR(BLE_SM_ERR_AUTHREQ);