michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: Host: Update LE legacy pairing check

Browse source 
Updates the LE legacy pairing procedure as a result of errata ES-24491.
New part:
If the initiating device receives an LP_CONFIRM_R value that is equal to
the LP_CONFIRM_I value, the pairing process shall be aborted and fail
with "Confirm Value Failed" as reason.

Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>
This commit is contained in:
Håvard Reierstad 2025-06-05 15:48:25 +02:00 • committed by Dan Kalowsky
commit 2a8118c945
1 changed files with 18 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

23
subsys/bluetooth/host/smp.c
View file

@ -2555,22 +2555,35 @@ static uint8_t legacy_pairing_req(struct bt_smp *smp)
static uint8_t legacy_pairing_random(struct bt_smp *smp) static uint8_t legacy_pairing_random(struct bt_smp *smp)
{ {
struct bt_conn *conn = smp->chan.chan.conn; struct bt_conn *conn = smp->chan.chan.conn;
uint8_t tmp[16]; uint8_t tmp[16], cfm_i[16];
int err; int err;
LOG_DBG(""); LOG_DBG("");
/* calculate confirmation */ /* calculate LP_CONFIRM_R */
err = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp, err = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp,
&conn->le.init_addr, &conn->le.resp_addr, tmp); &conn->le.init_addr, &conn->le.resp_addr, tmp);
if (err) { if (err) {
return BT_SMP_ERR_UNSPECIFIED; return BT_SMP_ERR_UNSPECIFIED;
} }
LOG_DBG("pcnf %s", bt_hex(smp->pcnf, 16)); /* calculate LP_CONFIRM_I */
LOG_DBG("cfm %s", bt_hex(tmp, 16)); err = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp,
&conn->le.init_addr, &conn->le.resp_addr, cfm_i);
if (err) {
return BT_SMP_ERR_UNSPECIFIED;
}
if (memcmp(smp->pcnf, tmp, sizeof(smp->pcnf))) { LOG_DBG("pcnf %s", bt_hex(smp->pcnf, 16));
LOG_DBG("cfm (remote) %s", bt_hex(tmp, 16));
LOG_DBG("cfm (local) %s", bt_hex(cfm_i, 16));
/* Core Specification, Vol 3, Part H, section 2.3.5.5 (Errata ES-24491): If the computed
* LP_CONFIRM_R value is not equal to the received LP_CONFIRM_R value, or the received
* LP_CONFIRM_R value is equal to the LP_CONFIRM_I value, fail pairing.
*/
if (memcmp(smp->pcnf, tmp, sizeof(smp->pcnf)) ||
!memcmp(smp->pcnf, cfm_i, sizeof(smp->pcnf))) {
return BT_SMP_ERR_CONFIRM_FAILED; return BT_SMP_ERR_CONFIRM_FAILED;
} }