Merge "Fix an authentication bypass bug in SMP" into main (dba590af) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/smp/smp_act.cc

+14 −0

Original line number	Diff line number	Diff line
		@@ -320,6 +320,7 @@ void smp_send_pair_rsp(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
		void smp_send_confirm(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
		LOG_VERBOSE("addr:%s", ADDRESS_TO_LOGGABLE_CSTR(p_cb->pairing_bda));
		smp_send_cmd(SMP_OPCODE_CONFIRM, p_cb);
		p_cb->flags \|= SMP_PAIR_FLAGS_CMD_CONFIRM_SENT;
		}

		/*******************************************************************************
		@@ -685,6 +686,19 @@ void smp_proc_rand(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
		return;
		}

		if (IS_FLAG_ENABLED(fix_le_pairing_passkey_entry_bypass)) {
		if (!((p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT) &&
		(p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT)) &&
		!(p_cb->flags & SMP_PAIR_FLAGS_CMD_CONFIRM_SENT)) {
		// in legacy pairing, the peer should send its rand after
		// we send our confirm
		tSMP_INT_DATA smp_int_data{};
		smp_int_data.status = SMP_INVALID_PARAMETERS;
		smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
		return;
		}
		}

		/* save the SRand for comparison */
		STREAM_TO_ARRAY(p_cb->rrand.data(), p, OCTET16_LEN);
		}

+2 −0

Original line number	Diff line number	Diff line
		@@ -264,6 +264,8 @@ typedef union {
		#define SMP_PAIR_FLAG_HAVE_LOCAL_PUBL_KEY \
		(1 << 8) /* used on peripheral to resolve race condition */

		#define SMP_PAIR_FLAGS_CMD_CONFIRM_SENT (1 << 9)

		/* check if authentication requirement need MITM protection */
		#define SMP_NO_MITM_REQUIRED(x) (((x)&SMP_AUTH_YN_BIT) == 0)