1 /******************************************************************************
2 *
3 * Copyright 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * this file contains GATT authentication handling functions
22 *
23 ******************************************************************************/
24
25 #include <bluetooth/log.h>
26 #include <string.h>
27
28 #include "gatt_api.h"
29 #include "gatt_int.h"
30 #include "internal_include/bt_target.h"
31 #include "osi/include/allocator.h"
32 #include "osi/include/osi.h"
33 #include "stack/btm/btm_ble_sec.h"
34 #include "stack/btm/btm_sec.h"
35 #include "stack/include/bt_hdr.h"
36 #include "stack/include/bt_types.h"
37 #include "stack/include/btm_ble_sec_api.h"
38 #include "stack/include/btm_status.h"
39 #include "types/raw_address.h"
40
41 using namespace bluetooth;
42
43 /*******************************************************************************
44 *
45 * Function gatt_sign_data
46 *
47 * Description This function sign the data for write command.
48 *
49 * Returns true if encrypted, otherwise false.
50 *
51 ******************************************************************************/
gatt_sign_data(tGATT_CLCB * p_clcb)52 static bool gatt_sign_data(tGATT_CLCB* p_clcb) {
53 tGATT_VALUE* p_attr = (tGATT_VALUE*)p_clcb->p_attr_buf;
54 uint8_t *p_data = NULL, *p;
55 uint16_t payload_size = p_clcb->p_tcb->payload_size;
56 bool status = false;
57 uint8_t* p_signature;
58
59 /* do not need to mark channel securoty activity for data signing */
60 gatt_set_sec_act(p_clcb->p_tcb, GATT_SEC_OK);
61
62 p_data = (uint8_t*)osi_malloc(p_attr->len + 3); /* 3 = 2 byte handle + opcode */
63
64 p = p_data;
65 UINT8_TO_STREAM(p, GATT_SIGN_CMD_WRITE);
66 UINT16_TO_STREAM(p, p_attr->handle);
67 ARRAY_TO_STREAM(p, p_attr->value, p_attr->len);
68
69 /* sign data length should be attribulte value length plus 2B handle + 1B op
70 * code */
71 if ((payload_size - GATT_AUTH_SIGN_LEN - 3) < p_attr->len) {
72 p_attr->len = payload_size - GATT_AUTH_SIGN_LEN - 3;
73 }
74
75 p_signature = p_attr->value + p_attr->len;
76 if (BTM_BleDataSignature(p_clcb->p_tcb->peer_bda, p_data,
77 (uint16_t)(p_attr->len + 3), /* 3 = 2 byte handle + opcode */
78 p_signature)) {
79 p_attr->len += BTM_BLE_AUTH_SIGN_LEN;
80 gatt_set_ch_state(p_clcb->p_tcb, GATT_CH_OPEN);
81 gatt_act_write(p_clcb, GATT_SEC_SIGN_DATA);
82 } else {
83 gatt_end_operation(p_clcb, GATT_INTERNAL_ERROR, NULL);
84 }
85
86 osi_free(p_data);
87
88 return status;
89 }
90
91 /*******************************************************************************
92 *
93 * Function gatt_verify_signature
94 *
95 * Description This function start to verify the sign data when receiving
96 * the data from peer device.
97 *
98 * Returns
99 *
100 ******************************************************************************/
gatt_verify_signature(tGATT_TCB & tcb,uint16_t cid,BT_HDR * p_buf)101 void gatt_verify_signature(tGATT_TCB& tcb, uint16_t cid, BT_HDR* p_buf) {
102 uint16_t cmd_len;
103 uint8_t op_code;
104 uint8_t *p, *p_orig = (uint8_t*)(p_buf + 1) + p_buf->offset;
105 uint32_t counter;
106
107 if (p_buf->len < GATT_AUTH_SIGN_LEN + 4) {
108 log::error("Data length {} less than expected {}", p_buf->len, GATT_AUTH_SIGN_LEN + 4);
109 return;
110 }
111 cmd_len = p_buf->len - GATT_AUTH_SIGN_LEN + 4;
112 p = p_orig + cmd_len - 4;
113 STREAM_TO_UINT32(counter, p);
114
115 if (!BTM_BleVerifySignature(tcb.peer_bda, p_orig, cmd_len, counter, p)) {
116 /* if this is a bad signature, assume from attacker, ignore it */
117 log::error("Signature Verification Failed, data ignored");
118 return;
119 }
120
121 STREAM_TO_UINT8(op_code, p_orig);
122 gatt_server_handle_client_req(tcb, cid, op_code, (uint16_t)(p_buf->len - 1), p_orig);
123 }
124 /*******************************************************************************
125 *
126 * Function gatt_sec_check_complete
127 *
128 * Description security check complete and proceed to data sending action.
129 *
130 * Returns void.
131 *
132 ******************************************************************************/
gatt_sec_check_complete(bool sec_check_ok,tGATT_CLCB * p_clcb,uint8_t sec_act)133 static void gatt_sec_check_complete(bool sec_check_ok, tGATT_CLCB* p_clcb, uint8_t sec_act) {
134 if (p_clcb && p_clcb->p_tcb && p_clcb->p_tcb->pending_enc_clcb.empty()) {
135 gatt_set_sec_act(p_clcb->p_tcb, GATT_SEC_NONE);
136 }
137
138 if (!sec_check_ok) {
139 gatt_end_operation(p_clcb, GATT_AUTH_FAIL, NULL);
140 } else if (p_clcb->operation == GATTC_OPTYPE_WRITE) {
141 gatt_act_write(p_clcb, sec_act);
142 } else if (p_clcb->operation == GATTC_OPTYPE_READ) {
143 gatt_act_read(p_clcb, p_clcb->counter);
144 }
145 }
146 /*******************************************************************************
147 *
148 * Function gatt_enc_cmpl_cback
149 *
150 * Description link encryption complete callback.
151 *
152 * Returns
153 *
154 ******************************************************************************/
gatt_enc_cmpl_cback(RawAddress bd_addr,tBT_TRANSPORT transport,void *,tBTM_STATUS result)155 static void gatt_enc_cmpl_cback(RawAddress bd_addr, tBT_TRANSPORT transport, void* /* p_ref_data */,
156 tBTM_STATUS result) {
157 log::verbose("");
158 tGATT_TCB* p_tcb = gatt_find_tcb_by_addr(bd_addr, transport);
159 if (!p_tcb) {
160 log::error("enc callback for unknown bd_addr");
161 return;
162 }
163
164 if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENC_PENDING) {
165 return;
166 }
167
168 if (p_tcb->pending_enc_clcb.empty()) {
169 log::error("no operation waiting for encrypting");
170 return;
171 }
172
173 tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();
174 p_tcb->pending_enc_clcb.pop_front();
175
176 if (p_clcb != NULL) {
177 bool status = false;
178 if (result == tBTM_STATUS::BTM_SUCCESS) {
179 if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENCRYPT_MITM) {
180 status = BTM_IsLinkKeyAuthed(bd_addr, transport);
181 } else {
182 status = true;
183 }
184 }
185
186 gatt_sec_check_complete(status, p_clcb, p_tcb->sec_act);
187 }
188
189 /* start all other pending operation in queue */
190 std::deque<tGATT_CLCB*> new_pending_clcbs;
191 while (!p_tcb->pending_enc_clcb.empty()) {
192 tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();
193 p_tcb->pending_enc_clcb.pop_front();
194 if (p_clcb != NULL && gatt_security_check_start(p_clcb)) {
195 new_pending_clcbs.push_back(p_clcb);
196 }
197 }
198 p_tcb->pending_enc_clcb = new_pending_clcbs;
199 }
200
201 /*******************************************************************************
202 *
203 * Function gatt_notify_enc_cmpl
204 *
205 * Description link encryption complete notification for all encryption
206 * process initiated outside GATT.
207 *
208 * Returns
209 *
210 ******************************************************************************/
gatt_notify_enc_cmpl(const RawAddress & bd_addr)211 void gatt_notify_enc_cmpl(const RawAddress& bd_addr) {
212 tGATT_TCB* p_tcb = gatt_find_tcb_by_addr(bd_addr, BT_TRANSPORT_LE);
213 if (!p_tcb) {
214 log::verbose("notify GATT for encryption completion of unknown device");
215 return;
216 }
217
218 for (auto& [i, p_rcb] : gatt_cb.cl_rcb_map) {
219 if (p_rcb->app_cb.p_enc_cmpl_cb) {
220 (*p_rcb->app_cb.p_enc_cmpl_cb)(p_rcb->gatt_if, bd_addr);
221 }
222 }
223
224 if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENC_PENDING) {
225 gatt_set_sec_act(p_tcb, GATT_SEC_NONE);
226
227 std::deque<tGATT_CLCB*> new_pending_clcbs;
228 while (!p_tcb->pending_enc_clcb.empty()) {
229 tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();
230 p_tcb->pending_enc_clcb.pop_front();
231 if (p_clcb != NULL && gatt_security_check_start(p_clcb)) {
232 new_pending_clcbs.push_back(p_clcb);
233 }
234 }
235 p_tcb->pending_enc_clcb = new_pending_clcbs;
236 }
237 }
238 /*******************************************************************************
239 *
240 * Function gatt_set_sec_act
241 *
242 * Description This function set the sec_act in clcb
243 *
244 * Returns none
245 *
246 ******************************************************************************/
gatt_set_sec_act(tGATT_TCB * p_tcb,tGATT_SEC_ACTION sec_act)247 void gatt_set_sec_act(tGATT_TCB* p_tcb, tGATT_SEC_ACTION sec_act) {
248 if (p_tcb) {
249 p_tcb->sec_act = sec_act;
250 }
251 }
252 /*******************************************************************************
253 *
254 * Function gatt_get_sec_act
255 *
256 * Description This function get the sec_act in clcb
257 *
258 * Returns none
259 *
260 ******************************************************************************/
gatt_get_sec_act(tGATT_TCB * p_tcb)261 tGATT_SEC_ACTION gatt_get_sec_act(tGATT_TCB* p_tcb) {
262 tGATT_SEC_ACTION sec_act = GATT_SEC_NONE;
263 if (p_tcb) {
264 sec_act = p_tcb->sec_act;
265 }
266 return sec_act;
267 }
268 /**
269 * This routine determine the security action based on auth_request and current
270 * link status. Returns tGATT_SEC_ACTION (security action)
271 */
gatt_determine_sec_act(tGATT_CLCB * p_clcb)272 static tGATT_SEC_ACTION gatt_determine_sec_act(tGATT_CLCB* p_clcb) {
273 tGATT_SEC_ACTION act = GATT_SEC_OK;
274 tGATT_TCB* p_tcb = p_clcb->p_tcb;
275 tGATT_AUTH_REQ auth_req = p_clcb->auth_req;
276 bool is_link_encrypted = false;
277 bool is_link_key_known = false;
278 bool is_key_mitm = false;
279 uint8_t key_type;
280 tBTM_BLE_SEC_REQ_ACT sec_act = BTM_BLE_SEC_REQ_ACT_NONE;
281
282 if (auth_req == GATT_AUTH_REQ_NONE) {
283 return act;
284 }
285
286 btm_ble_link_sec_check(p_tcb->peer_bda, auth_req, &sec_act);
287
288 /* if a encryption is pending, need to wait */
289 if (sec_act == BTM_BLE_SEC_REQ_ACT_DISCARD && auth_req != GATT_AUTH_REQ_NONE) {
290 return GATT_SEC_ENC_PENDING;
291 }
292
293 is_link_key_known = BTM_IsBonded(p_tcb->peer_bda, p_clcb->p_tcb->transport);
294 is_link_encrypted = BTM_IsEncrypted(p_tcb->peer_bda, p_clcb->p_tcb->transport);
295 is_key_mitm = BTM_IsLinkKeyAuthed(p_tcb->peer_bda, p_clcb->p_tcb->transport);
296
297 /* first check link key upgrade required or not */
298 switch (auth_req) {
299 case GATT_AUTH_REQ_MITM:
300 case GATT_AUTH_REQ_SIGNED_MITM:
301 if (!is_key_mitm) {
302 act = GATT_SEC_ENCRYPT_MITM;
303 }
304 break;
305
306 case GATT_AUTH_REQ_NO_MITM:
307 case GATT_AUTH_REQ_SIGNED_NO_MITM:
308 if (!is_link_key_known) {
309 act = GATT_SEC_ENCRYPT_NO_MITM;
310 }
311 break;
312 default:
313 break;
314 }
315
316 /* now check link needs to be encrypted or not if the link key upgrade is not
317 * required */
318 if (act == GATT_SEC_OK) {
319 if (p_tcb->transport == BT_TRANSPORT_LE && (p_clcb->operation == GATTC_OPTYPE_WRITE) &&
320 (p_clcb->op_subtype == GATT_WRITE_NO_RSP)) {
321 /* this is a write command request
322 check data signing required or not */
323 if (!is_link_encrypted) {
324 btm_ble_get_enc_key_type(p_tcb->peer_bda, &key_type);
325
326 if ((key_type & BTM_LE_KEY_LCSRK) && ((auth_req == GATT_AUTH_REQ_SIGNED_NO_MITM) ||
327 (auth_req == GATT_AUTH_REQ_SIGNED_MITM))) {
328 act = GATT_SEC_SIGN_DATA;
329 } else {
330 act = GATT_SEC_ENCRYPT;
331 }
332 }
333 } else {
334 if (!is_link_encrypted) {
335 act = GATT_SEC_ENCRYPT;
336 }
337 }
338 }
339
340 return act;
341 }
342
343 /*******************************************************************************
344 *
345 * Function gatt_get_link_encrypt_status
346 *
347 * Description This routine get the encryption status of the specified link
348 *
349 *
350 * Returns tGATT_STATUS link encryption status
351 *
352 ******************************************************************************/
gatt_get_link_encrypt_status(tGATT_TCB & tcb)353 tGATT_STATUS gatt_get_link_encrypt_status(tGATT_TCB& tcb) {
354 tGATT_STATUS encrypt_status = GATT_NOT_ENCRYPTED;
355
356 bool encrypted = BTM_IsEncrypted(tcb.peer_bda, tcb.transport);
357 bool link_key_known = BTM_IsBonded(tcb.peer_bda, tcb.transport);
358 bool link_key_authed = BTM_IsLinkKeyAuthed(tcb.peer_bda, tcb.transport);
359
360 if (encrypted && link_key_known) {
361 encrypt_status = GATT_ENCRYPED_NO_MITM;
362 if (link_key_authed) {
363 encrypt_status = GATT_ENCRYPED_MITM;
364 }
365 }
366
367 log::verbose("gatt_get_link_encrypt_status status=0x{:x}", encrypt_status);
368 return encrypt_status;
369 }
370
371 /*******************************************************************************
372 *
373 * Function gatt_convert_sec_action
374 *
375 * Description Convert GATT security action enum into equivalent
376 * BTM BLE security action enum
377 *
378 * Returns bool true - conversation is successful
379 *
380 ******************************************************************************/
gatt_convert_sec_action(tGATT_SEC_ACTION gatt_sec_act,tBTM_BLE_SEC_ACT * p_btm_sec_act)381 static bool gatt_convert_sec_action(tGATT_SEC_ACTION gatt_sec_act,
382 tBTM_BLE_SEC_ACT* p_btm_sec_act) {
383 bool status = true;
384 switch (gatt_sec_act) {
385 case GATT_SEC_ENCRYPT:
386 *p_btm_sec_act = BTM_BLE_SEC_ENCRYPT;
387 break;
388 case GATT_SEC_ENCRYPT_NO_MITM:
389 *p_btm_sec_act = BTM_BLE_SEC_ENCRYPT_NO_MITM;
390 break;
391 case GATT_SEC_ENCRYPT_MITM:
392 *p_btm_sec_act = BTM_BLE_SEC_ENCRYPT_MITM;
393 break;
394 default:
395 status = false;
396 break;
397 }
398
399 return status;
400 }
401
402 /** check link security, return true if p_clcb should be added back to queue */
gatt_security_check_start(tGATT_CLCB * p_clcb)403 bool gatt_security_check_start(tGATT_CLCB* p_clcb) {
404 tGATT_TCB* p_tcb = p_clcb->p_tcb;
405 tGATT_SEC_ACTION sec_act_old = gatt_get_sec_act(p_tcb);
406
407 tGATT_SEC_ACTION gatt_sec_act = gatt_determine_sec_act(p_clcb);
408
409 if (sec_act_old == GATT_SEC_NONE) {
410 gatt_set_sec_act(p_tcb, gatt_sec_act);
411 }
412
413 switch (gatt_sec_act) {
414 case GATT_SEC_SIGN_DATA:
415 log::verbose("Do data signing");
416 gatt_sign_data(p_clcb);
417 break;
418 case GATT_SEC_ENCRYPT:
419 case GATT_SEC_ENCRYPT_NO_MITM:
420 case GATT_SEC_ENCRYPT_MITM:
421 if (sec_act_old < GATT_SEC_ENCRYPT) {
422 log::verbose("Encrypt now or key upgreade first");
423 tBTM_BLE_SEC_ACT btm_ble_sec_act;
424 gatt_convert_sec_action(gatt_sec_act, &btm_ble_sec_act);
425 tBTM_STATUS btm_status = BTM_SetEncryption(p_tcb->peer_bda, p_tcb->transport,
426 gatt_enc_cmpl_cback, NULL, btm_ble_sec_act);
427 if ((btm_status != tBTM_STATUS::BTM_SUCCESS) &&
428 (btm_status != tBTM_STATUS::BTM_CMD_STARTED)) {
429 log::error("BTM_SetEncryption failed btm_status={}", btm_status);
430 gatt_set_sec_act(p_tcb, GATT_SEC_NONE);
431 gatt_set_ch_state(p_tcb, GATT_CH_OPEN);
432
433 gatt_end_operation(p_clcb, GATT_INSUF_ENCRYPTION, NULL);
434 return false;
435 }
436 }
437 return true;
438 case GATT_SEC_ENC_PENDING:
439 /* wait for link encrypotion to finish */
440 return true;
441 default:
442 gatt_sec_check_complete(true, p_clcb, gatt_sec_act);
443 break;
444 }
445
446 return false;
447 }
448