Merge "Backport "Reject access to ... temp bonding [1]"" into main (cb362c51) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/btm/btm_sec.cc

+31 −0

Original line number	Original line	Diff line number	Diff line
	@@ -256,6 +256,25 @@ static tBTM_SEC_DEV_REC* btm_sec_find_dev_by_sec_state(uint8_t state) {
	return nullptr;		return nullptr;
	}		}

			/*******************************************************************************
			*
			* Function access_secure_service_from_temp_bond
			*
			* Description a utility function to test whether an access to
			* secure service from temp bonding is happening
			*
			* Returns true if the aforementioned condition holds,
			* false otherwise
			*
			******************************************************************************/
			static bool access_secure_service_from_temp_bond(const tBTM_SEC_DEV_REC* p_dev_rec,
			bool locally_initiated,
			uint16_t security_req) {
			return !locally_initiated && (security_req & BTM_SEC_IN_AUTHENTICATE) &&
			p_dev_rec->is_device_authenticated() &&
			p_dev_rec->is_bond_type_temporary();
			}

	/*******************************************************************************		/*******************************************************************************
	*		*
	* Function BTM_SecRegister		* Function BTM_SecRegister
	@@ -1701,6 +1720,11 @@ tBTM_STATUS btm_sec_l2cap_access_req_by_requirement(
	}		}

	if (rc == BTM_SUCCESS) {		if (rc == BTM_SUCCESS) {
			if (access_secure_service_from_temp_bond(p_dev_rec, is_originator, security_required)) {
			LOG_ERROR("Trying to access a secure service from a temp bonding, rejecting");
			rc = BTM_FAILED_ON_SECURITY;
			}

	if (p_callback)		if (p_callback)
	(p_callback)(&bd_addr, transport, (void)p_ref_data, rc);		(p_callback)(&bd_addr, transport, (void)p_ref_data, rc);
	return rc;		return rc;
	@@ -4569,6 +4593,13 @@ tBTM_STATUS btm_sec_execute_procedure(tBTM_SEC_DEV_REC* p_dev_rec) {
	return (BTM_FAILED_ON_SECURITY);		return (BTM_FAILED_ON_SECURITY);
	}		}

			if (access_secure_service_from_temp_bond(p_dev_rec,
			p_dev_rec->IsLocallyInitiated(),
			p_dev_rec->security_required)) {
			LOG_ERROR("Trying to access a secure service from a temp bonding, rejecting");
			return (BTM_FAILED_ON_SECURITY);
			}

	/* All required security procedures already established */		/* All required security procedures already established */
	p_dev_rec->security_required &=		p_dev_rec->security_required &=
	~(BTM_SEC_OUT_AUTHENTICATE \| BTM_SEC_IN_AUTHENTICATE \|		~(BTM_SEC_OUT_AUTHENTICATE \| BTM_SEC_IN_AUTHENTICATE \|