feat(nimble): Authorize or deauthorize a BLE device for a connection

nimble/host/include/host/ble_esp_gap.h

@@ -218,6 +218,23 @@ int ble_gap_set_chan_select(uint8_t select);
 
 #endif
 
+/**
+ * Authorizes or deauthorizes a BLE device for a connection.
+ *
+ * This function updates the security flags of a BLE connection to authorize or
+ * deauthorize a device for the specified connection.
+ *
+ * @param conn_handle           The handle corresponding to the connection to
+ *                              authorize.
+ * @param authorized            Authorized the device or not.
+ *
+ * @return                      0 on success;
+ *                              BLE_HS_ENOTCONN if the connection handle is not found.
+ *                              BLE_HS_EAUTHOR if the device is not authenticated before authorization.
+ */
+int
+ble_gap_dev_authorization(uint16_t conn_handle, bool authorized);
+
 void ble_gap_rx_test_evt(const void *buf, uint8_t len);
 void ble_gap_tx_test_evt(const void *buf, uint8_t len);
 void ble_gap_end_test_evt(const void *buf, uint8_t len);

nimble/host/include/host/ble_gap.h

@@ -213,6 +213,9 @@ struct ble_gap_sec_state {
 
     /** Size of a key used for encryption */
     unsigned key_size:5;
+
+    /** Current device security state*/
+    unsigned authorize:1;
 };
 
 /** Advertising parameters */

nimble/host/src/ble_att_svr.c

@@ -371,10 +371,13 @@ ble_att_svr_check_perms(uint16_t conn_handle, int is_read,
 
     if (author) {
         /* XXX: Prompt user for authorization. */
-        rc = ble_gap_authorize_event(conn_handle, entry->ha_handle_id, is_read);
-        if (rc == BLE_GAP_AUTHORIZE_REJECT) {
-            *out_att_err = BLE_ATT_ERR_INSUFFICIENT_AUTHOR;
-            return BLE_HS_ATT_ERR(*out_att_err);
+        conn = ble_hs_conn_find(conn_handle);
+        if(!conn->bhc_sec_state.authorize){
+            rc = ble_gap_authorize_event(conn_handle, entry->ha_handle_id, is_read);
+            if (rc == BLE_GAP_AUTHORIZE_REJECT) {
+                *out_att_err = BLE_ATT_ERR_INSUFFICIENT_AUTHOR;
+                return BLE_HS_ATT_ERR(*out_att_err);
+            }
         }
     }
 

nimble/host/src/ble_gap.c

@@ -6709,6 +6709,34 @@ done:
 #endif
 }
 
+int
+ble_gap_dev_authorization(uint16_t conn_handle, bool authorized)
+{
+    struct ble_hs_conn *conn = ble_hs_conn_find(conn_handle);
+
+    if (conn != NULL) {
+        if (!(conn->bhc_sec_state.authenticated)) {
+           // Device should be authenticated before authorization
+           BLE_HS_LOG(ERROR, "Authorized should occur after successful Authentication(MITM protection) \n");
+           return BLE_HS_EAUTHOR;
+        }
+
+        // Update connection security flags
+        if (authorized) {
+            conn->bhc_sec_state.authorize = 1;
+        } else {
+            conn->bhc_sec_state.authorize = 0;
+        }
+
+    } else {
+        // Connection handle not found
+        BLE_HS_LOG(ERROR, "Can't find connection \n");
+        return BLE_HS_ENOTCONN;
+    }
+
+    return 0;
+}
+
 int
 ble_gap_pair_initiate(uint16_t conn_handle)
 {