Commit 301317e8 authored by Joakim Andersson's avatar Joakim Andersson Committed by Anas Nashif
Browse files

Bluetooth: host: Handle multiple step security elevation 



When ATT resends an ATT request it is sent as a "response" instead of
as a request. This causes the ATT request buffer to be released and
the ATT request cannot be resent one more time.

This causes a problem when the ATT request requires authentication
but the elevation of security is not enforcing MITM protection.
In this case the ATT will first require security level 2 and then resend
the request once this has been reached.
This will lead to a new ATT error response and ATT will require security
level L3.

Signed-off-by: default avatarJoakim Andersson <joakim.andersson@nordicsemi.no>
parent 2f588f94

subsys/bluetooth/host/att.c

+9 −9
Original line number Diff line number Diff line
@@ -119,6 +119,7 @@ static void att_req_destroy(struct bt_att_req *req) 


	if (req->buf) {

		net_buf_unref(req->buf);

		req->buf = NULL;

	}



	if (req->destroy) {
@@ -2074,14 +2075,9 @@ static uint8_t att_error_rsp(struct bt_att_chan *chan, struct net_buf *buf) 


	err = rsp->error;

#if defined(CONFIG_BT_SMP)

	if (chan->req->retrying) {

		goto done;

	}



	/* Check if security needs to be changed */

	/* Check if error can be handled by elevating security. */

	if (!att_change_security(chan->chan.chan.conn, err)) {

		chan->req->retrying = true;

		/* Wait security_changed: TODO: Handle fail case */

		return 0;

	}

#endif /* CONFIG_BT_SMP */
@@ -2725,10 +2721,14 @@ static void bt_att_encrypt_change(struct bt_l2cap_chan *chan, 
	BT_DBG("Retrying");



	/* Resend buffer */

	bt_att_chan_send_rsp(att_chan, att_chan->req->buf,

			     chan_cb(att_chan->req->buf));



	att_chan->req->buf = NULL;

	/* Since packets are created in ATT and released in L2CAP we need to

	 * take a new reference to "create" the packet in ATT again.

	 */

	if (chan_send(att_chan, net_buf_ref(att_chan->req->buf), NULL)) {

		net_buf_unref(att_chan->req->buf);

		att_handle_rsp(att_chan, NULL, 0, BT_ATT_ERR_AUTHENTICATION);

	}

}

#endif /* CONFIG_BT_SMP */

CRA Git | Maintained and supported by SUSTech CRA and CCSE