Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0d2c79a authored by Himanshu Rawat's avatar Himanshu Rawat
Browse files

RESTRICT AUTOMERGE Disallow unexpected incoming HID connections 

HID profile accepted any new incoming HID connection. Even when the
connection policy disabled HID connection, remote devices could initiate
HID connection.
This change ensures that incoming HID connection are accepted only if
application was interested in that HID connection.
This vulnerarbility no longer exists on the main because of feature
request b/324093729.

Test: mmm packages/modules/Bluetooth
Test: Manual | Pair and connect a HID device, disable HID connection
from Bluetooth device setting, attempt to connect from the HID device.
Bug: 308429049
Ignore-AOSP-First: security

Change-Id: Iba2ac3502bf1e6e4ac1f60ed64b1b074facd880b
parent 6f3861da

android/app/jni/com_android_bluetooth_hid_host.cpp

+5 −3
Original line number Diff line number Diff line
@@ -269,7 +269,8 @@ static jboolean connectHidNative(JNIEnv* env, jobject /* object */, 
}



static jboolean disconnectHidNative(JNIEnv* env, jobject /* object */,

                                    jbyteArray address) {

                                    jbyteArray address,

                                    jboolean reconnect_allowed) {

  jbyte* addr;

  jboolean ret = JNI_TRUE;

  if (!sBluetoothHidInterface) return JNI_FALSE;
@@ -280,7 +281,8 @@ static jboolean disconnectHidNative(JNIEnv* env, jobject /* object */, 
    return JNI_FALSE;

  }



  bt_status_t status = sBluetoothHidInterface->disconnect((RawAddress*)addr);

  bt_status_t status =

      sBluetoothHidInterface->disconnect((RawAddress*)addr, reconnect_allowed);

  if (status != BT_STATUS_SUCCESS) {

    ALOGE("Failed disconnect hid channel, status: %d", status);

    ret = JNI_FALSE;
@@ -497,7 +499,7 @@ int register_com_android_bluetooth_hid_host(JNIEnv* env) { 
      {"initializeNative", "()V", (void*)initializeNative},

      {"cleanupNative", "()V", (void*)cleanupNative},

      {"connectHidNative", "([B)Z", (void*)connectHidNative},

      {"disconnectHidNative", "([B)Z", (void*)disconnectHidNative},

      {"disconnectHidNative", "([BZ)Z", (void*)disconnectHidNative},

      {"getProtocolModeNative", "([B)Z", (void*)getProtocolModeNative},

      {"virtualUnPlugNative", "([B)Z", (void*)virtualUnPlugNative},

      {"setProtocolModeNative", "([BB)Z", (void*)setProtocolModeNative},

android/app/src/com/android/bluetooth/hid/HidHostNativeInterface.java

+3 −3
Original line number Diff line number Diff line
@@ -64,8 +64,8 @@ public class HidHostNativeInterface { 
        return connectHidNative(address);

    }



    boolean disconnectHid(byte[] address) {

        return disconnectHidNative(address);

    boolean disconnectHid(byte[] address, boolean reconnectAllowed) {

        return disconnectHidNative(address, reconnectAllowed);

    }



    boolean getProtocolMode(byte[] address) {
@@ -168,7 +168,7 @@ public class HidHostNativeInterface { 


    private native boolean connectHidNative(byte[] btAddress);



    private native boolean disconnectHidNative(byte[] btAddress);

    private native boolean disconnectHidNative(byte[] btAddress, boolean reconnectAllowed);



    private native boolean getProtocolModeNative(byte[] btAddress);

android/app/src/com/android/bluetooth/hid/HidHostService.java

+6 −4
Original line number Diff line number Diff line
@@ -196,7 +196,11 @@ public class HidHostService extends ProfileService { 
                    break;

                case MESSAGE_DISCONNECT: {

                        BluetoothDevice device = (BluetoothDevice) msg.obj;

                        if (!mNativeInterface.disconnectHid(getByteAddress(device))) {

                        int connectionPolicy = getConnectionPolicy(device);

                        boolean reconnectAllowed =

                                connectionPolicy == BluetoothProfile.CONNECTION_POLICY_ALLOWED;

                        if (!mNativeInterface.disconnectHid(getByteAddress(device),

                                    reconnectAllowed)) {

                            broadcastConnectionState(device, BluetoothProfile.STATE_DISCONNECTING);

                            broadcastConnectionState(device, BluetoothProfile.STATE_DISCONNECTED);

                            break;
@@ -347,9 +351,7 @@ public class HidHostService extends ProfileService { 
        }

    };



    /**

     * Handlers for incoming service calls

     */

    /** Handlers for incoming service calls */

    @VisibleForTesting

    static class BluetoothHidHostBinder extends IBluetoothHidHost.Stub

            implements IProfileServiceBinder {

system/btif/include/btif_hh.h

+3 −1
Original line number Diff line number Diff line
@@ -111,6 +111,7 @@ typedef struct { 
  uint8_t dev_handle;

  RawAddress bd_addr;

  tBTA_HH_ATTR_MASK attr_mask;

  bool reconnect_allowed;

} btif_hh_added_device_t;



/**
@@ -134,7 +135,8 @@ extern btif_hh_cb_t btif_hh_cb; 


btif_hh_device_t* btif_hh_find_connected_dev_by_handle(uint8_t handle);

void btif_hh_remove_device(RawAddress bd_addr);

bool btif_hh_add_added_dev(const RawAddress& bda, tBTA_HH_ATTR_MASK attr_mask);

bool btif_hh_add_added_dev(const RawAddress& bda, tBTA_HH_ATTR_MASK attr_mask,

                           bool reconnect_allowed);

bt_status_t btif_hh_virtual_unplug(const RawAddress* bd_addr);

void btif_hh_disconnect(RawAddress* bd_addr);

void btif_hh_setreport(btif_hh_device_t* p_dev, bthh_report_type_t r_type,

system/btif/include/btif_storage.h

+23 −0
Original line number Diff line number Diff line
@@ -217,6 +217,29 @@ void btif_storage_load_le_devices(void); 
 ******************************************************************************/

bt_status_t btif_storage_load_bonded_devices(void);



/*******************************************************************************

 *

 * Function         btif_storage_set_hid_connection_policy

 *

 * Description      Stores connection policy info in nvram

 *

 * Returns          BT_STATUS_SUCCESS

 *

 ******************************************************************************/

bt_status_t btif_storage_set_hid_connection_policy(const RawAddress& addr,

                                                   bool reconnect_allowed);

/*******************************************************************************

 *

 * Function         btif_storage_get_hid_connection_policy

 *

 * Description      get connection policy info from nvram

 *

 * Returns          BT_STATUS_SUCCESS

 *

 ******************************************************************************/

bt_status_t btif_storage_get_hid_connection_policy(const RawAddress& addr,

                                                   bool* reconnect_allowed);



/*******************************************************************************

 *

 * Function         btif_storage_add_hid_device_info