hci.c (79e0fa07b4af264228714ff4798d45a4b1efc7f9) hci.c (3817f9dfcd08534cc44884987ba917f15d47a150)
1/*
2 * Copyright (C) 2014 BlueKitchen GmbH
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * 1. Redistributions of source code must retain the above copyright

--- 2386 unchanged lines hidden (view full) ---

2395 if (level >= LEVEL_3){
2396 if (io_cap_remote >= SSP_IO_CAPABILITY_NO_INPUT_NO_OUTPUT) return false;
2397 if (io_cap_local >= SSP_IO_CAPABILITY_NO_INPUT_NO_OUTPUT) return false;
2398 if ((io_cap_remote == SSP_IO_CAPABILITY_KEYBOARD_ONLY) && (io_cap_local == SSP_IO_CAPABILITY_KEYBOARD_ONLY)) return false;
2399 }
2400 // LEVEL 2 requires SSP, which is a given
2401 return true;
2402}
1/*
2 * Copyright (C) 2014 BlueKitchen GmbH
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * 1. Redistributions of source code must retain the above copyright

--- 2386 unchanged lines hidden (view full) ---

2395 if (level >= LEVEL_3){
2396 if (io_cap_remote >= SSP_IO_CAPABILITY_NO_INPUT_NO_OUTPUT) return false;
2397 if (io_cap_local >= SSP_IO_CAPABILITY_NO_INPUT_NO_OUTPUT) return false;
2398 if ((io_cap_remote == SSP_IO_CAPABILITY_KEYBOARD_ONLY) && (io_cap_local == SSP_IO_CAPABILITY_KEYBOARD_ONLY)) return false;
2399 }
2400 // LEVEL 2 requires SSP, which is a given
2401 return true;
2402}
2403
2404static bool btstack_is_null(uint8_t * data, uint16_t size){
2405 uint16_t i;
2406 for (i=0; i < size ; i++){
2407 if (data[i] != 0) {
2408 return false;
2409 }
2410 }
2411 return true;
2412}
2413
2403#endif
2404
2405static void event_handler(uint8_t *packet, uint16_t size){
2406
2407 uint16_t event_length = packet[1];
2408
2409 // assert packet is complete
2410 if (size != (event_length + 2u)){

--- 290 unchanged lines hidden (view full) ---

2701
2702 case HCI_EVENT_LINK_KEY_NOTIFICATION: {
2703 hci_event_link_key_request_get_bd_addr(packet, addr);
2704 conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
2705 if (!conn) break;
2706
2707 hci_pairing_complete(conn, ERROR_CODE_SUCCESS);
2708
2414#endif
2415
2416static void event_handler(uint8_t *packet, uint16_t size){
2417
2418 uint16_t event_length = packet[1];
2419
2420 // assert packet is complete
2421 if (size != (event_length + 2u)){

--- 290 unchanged lines hidden (view full) ---

2712
2713 case HCI_EVENT_LINK_KEY_NOTIFICATION: {
2714 hci_event_link_key_request_get_bd_addr(packet, addr);
2715 conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
2716 if (!conn) break;
2717
2718 hci_pairing_complete(conn, ERROR_CODE_SUCCESS);
2719
2720 // CVE-2020-26555: ignore NULL link key
2721 // default link_key_type = INVALID_LINK_KEY asserts that NULL key won't be used for encryption
2722 if (btstack_is_null(&packet[8], 16)) break;
2723
2709 link_key_type_t link_key_type = (link_key_type_t)packet[24];
2710 // Change Connection Encryption keeps link key type
2711 if (link_key_type != CHANGED_COMBINATION_KEY){
2712 conn->link_key_type = link_key_type;
2713 }
2724 link_key_type_t link_key_type = (link_key_type_t)packet[24];
2725 // Change Connection Encryption keeps link key type
2726 if (link_key_type != CHANGED_COMBINATION_KEY){
2727 conn->link_key_type = link_key_type;
2728 }
2729
2714 // cache link key. link keys stored in little-endian format for legacy reasons
2715 memcpy(&conn->link_key, &packet[8], 16);
2716
2717 // only store link key:
2718 // - if bondable enabled
2719 if (hci_stack->bondable == false) break;
2720 // - if security level sufficient
2721 if (gap_security_level_for_link_key_type(link_key_type) < conn->requested_security_level) break;

--- 4022 unchanged lines hidden --- 		2730 // cache link key. link keys stored in little-endian format for legacy reasons
2731 memcpy(&conn->link_key, &packet[8], 16);
2732
2733 // only store link key:
2734 // - if bondable enabled
2735 if (hci_stack->bondable == false) break;
2736 // - if security level sufficient
2737 if (gap_security_level_for_link_key_type(link_key_type) < conn->requested_security_level) break;

--- 4022 unchanged lines hidden ---