Skip to content

bluetooth: smp: CTKD issue when cross br and ble connections and security #90574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+32 −0
Open

bluetooth: smp: CTKD issue when cross br and ble connections and security #90574

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions subsys/bluetooth/host/smp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@

#include "conn_internal.h"
#include "common/bt_str.h"
#include "common/rpa.h"
#include "crypto/bt_crypto.h"
#include "ecc.h"
#include "hci_core.h"
Expand Down Expand Up @@ -1513,12 +1514,33 @@ static uint8_t smp_br_ident_info(struct bt_smp_br *smp, struct net_buf *buf)
return 0;
}

static void convert_to_id_on_irk_match(struct bt_conn *conn, void *data)
{
struct bt_keys *keys = data;

if (!bt_addr_le_is_rpa(&conn->le.dst)) {
return;
}

if (bt_rpa_irk_matches(keys->irk.val, &conn->le.dst.a)) {
if (conn->le.keys != NULL && conn->le.keys != keys) {
bt_keys_clear(conn->le.keys);
}

conn->le.keys = keys;
/* always update last use RPA */
bt_addr_copy(&keys->irk.rpa, &conn->le.dst.a);
bt_addr_le_copy(&conn->le.dst, &keys->addr);
}
}

static uint8_t smp_br_ident_addr_info(struct bt_smp_br *smp,
struct net_buf *buf)
{
struct bt_conn *conn = smp->chan.chan.conn;
struct bt_smp_ident_addr_info *req = (void *)buf->data;
bt_addr_le_t addr;
struct bt_keys *keys;

LOG_DBG("identity %s", bt_addr_le_str(&req->addr));

Expand All @@ -1541,6 +1563,16 @@ static uint8_t smp_br_ident_addr_info(struct bt_smp_br *smp,
atomic_set_bit(smp->allowed_cmds, BT_SMP_CMD_SIGNING_INFO);
}

/* Check the BLE connections that has RPA matched with this IRK */
keys = bt_keys_get_type(BT_KEYS_IRK, conn->id, &addr);
if (keys) {
bt_conn_foreach(BT_CONN_TYPE_LE,
convert_to_id_on_irk_match,
keys);
} else {
LOG_ERR("Unable to get keys for %s", bt_addr_le_str(&addr));
}

if (conn->role == BT_CONN_ROLE_CENTRAL && !smp->remote_dist) {
smp_br_distribute_keys(smp);
}
Expand Down