Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 34a5cece authored by Brian Delwiche's avatar Brian Delwiche
Browse files

Remove flags for b#314331379 

bluffs_mitigation has passed soak and flags for it should be removed.

Bug: 314331379
Bug: 319541706
Flag: bluffs_mitigation
Test: m libbluetooth
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:9fc2e1e6d449e2665fc5d5d9af4ca87346863960)
Merged-In: I2f2743e1bec281823cd0ca4cb67e281f3aa1df48
Change-Id: I2f2743e1bec281823cd0ca4cb67e281f3aa1df48
parent 883b574e

flags/security.aconfig

+0 −7
Original line number Diff line number Diff line
@@ -15,13 +15,6 @@ flag { 
    bug: "333634398"

}



flag {

    name: "bluffs_mitigation"

    namespace: "bluetooth"

    description: "Cache security values to mitigate BLUFFS"

    bug: "314331379"

}



flag {

    name: "fix_le_pairing_passkey_entry_bypass"

    namespace: "bluetooth"

system/stack/btm/btm_sec.cc

+36 −70
Original line number Diff line number Diff line
@@ -3471,7 +3471,6 @@ static void read_encryption_key_size_complete_after_encryption_change( 
    return;

  }



  if (com::android::bluetooth::flags::bluffs_mitigation()) {

  if (btm_sec_is_session_key_size_downgrade(handle, key_size)) {

    log::error(

        "encryption key size lower than cached value, disconnecting. "
@@ -3485,7 +3484,6 @@ static void read_encryption_key_size_complete_after_encryption_change( 
  }



  btm_sec_update_session_key_size(handle, key_size);

  }



  // good key size - succeed

  btm_acl_encrypt_change(handle, static_cast<tHCI_STATUS>(status),
@@ -3508,7 +3506,6 @@ void smp_cancel_start_encryption_attempt(); 
 ******************************************************************************/

void btm_sec_encryption_change_evt(uint16_t handle, tHCI_STATUS status,

                                   uint8_t encr_enable) {

  if (com::android::bluetooth::flags::bluffs_mitigation()) {

  if (status != HCI_SUCCESS || encr_enable == 0 ||

      BTM_IsBleConnection(handle) ||

      !bluetooth::shim::GetController()->IsSupported(
@@ -3525,35 +3522,7 @@ void btm_sec_encryption_change_evt(uint16_t handle, tHCI_STATUS status, 
  } else {

    btsnd_hcic_read_encryption_key_size(

        handle,

          base::Bind(

              &read_encryption_key_size_complete_after_encryption_change));

    }

  } else {

    // This block added to ensure matching code flow with the bluffs_mitigation

    // flag off.  The entire block should be removed when the flag is.

    if (status != HCI_SUCCESS || encr_enable == 0 ||

        BTM_IsBleConnection(handle) ||

        !bluetooth::shim::GetController()->IsSupported(

            bluetooth::hci::OpCode::READ_ENCRYPTION_KEY_SIZE) ||

        // Skip encryption key size check when using set_min_encryption_key_size

        (bluetooth::common::init_flags::set_min_encryption_is_enabled() &&

         bluetooth::shim::GetController()->IsSupported(

             bluetooth::hci::OpCode::SET_MIN_ENCRYPTION_KEY_SIZE))) {

      if (status == HCI_ERR_CONNECTION_TOUT) {

        smp_cancel_start_encryption_attempt();

        return;

      }



      btm_acl_encrypt_change(handle, static_cast<tHCI_STATUS>(status),

                             encr_enable);

      btm_sec_encrypt_change(handle, static_cast<tHCI_STATUS>(status),

                             encr_enable);

    } else {

      btsnd_hcic_read_encryption_key_size(

          handle,

          base::Bind(

              &read_encryption_key_size_complete_after_encryption_change));

    }

        base::Bind(&read_encryption_key_size_complete_after_encryption_change));

  }

}

/*******************************************************************************
@@ -4175,8 +4144,7 @@ void btm_sec_link_key_notification(const RawAddress& p_bda, 
    }

  }



  if (com::android::bluetooth::flags::bluffs_mitigation() &&

      p_dev_rec->sec_rec.is_bond_type_persistent() &&

  if (p_dev_rec->sec_rec.is_bond_type_persistent() &&

      (p_dev_rec->is_device_type_br_edr() ||

       p_dev_rec->is_device_type_dual_mode())) {

    btm_sec_store_device_sc_support(p_dev_rec->get_br_edr_hci_handle(),
@@ -5205,7 +5173,6 @@ void btm_sec_set_peer_sec_caps(uint16_t hci_handle, bool ssp_supported, 
  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(hci_handle);

  if (p_dev_rec == nullptr) return;



  if (com::android::bluetooth::flags::bluffs_mitigation()) {

  // Drop the connection here if the remote attempts to downgrade from Secure

  // Connections mode.

  if (btm_sec_is_device_sc_downgrade(hci_handle, sc_supported)) {
@@ -5215,7 +5182,6 @@ void btm_sec_set_peer_sec_caps(uint16_t hci_handle, bool ssp_supported, 
        "attempted to downgrade from Secure Connections mode");

    return;

  }

  }



  p_dev_rec->remote_feature_received = true;

  p_dev_rec->remote_supports_hci_role_switch = hci_role_switch_supported;