ARMmbed
/
mbed-os
mirror of https://github.com/ARMmbed/mbed-os.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #12785 from LDong-Arm/port_packetcraft_ltk_improvements 

Cordio: Apply Packetcraft's fix for possible SweynTooth vulnerabilities
pull/12778/head
Martin Kojtal 2020-04-15 09:08:24 +02:00 committed by GitHub
parent c1048c6aa7 c927773115
commit 4128efdf3d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/include/smp_api.h
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -252,6 +253,17 @@ void SmpDmMsgSend(smpDmMsg_t *pMsg);
/*************************************************************************************************/
void SmpDmEncryptInd(wsfMsgHdr_t *pMsg);
/*************************************************************************************************/
/*!
* \brief Check if LE Secure Connections is enabled on the connection.
*
* \param connId Connection identifier.
*
* \return TRUE is Secure Connections is enabled, else FALSE
*/
/*************************************************************************************************/
bool_t SmpDmLescEnabled(dmConnId_t connId);
/*************************************************************************************************/
/*!
* \brief Return the STK for the given connection.

7
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/dm/dm_sec.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -117,6 +118,12 @@ void dmSecHciHandler(hciEvt_t *pEvent)
return;
}
}
else if (SmpDmLescEnabled(pCcb->connId) == TRUE)
{
/* EDIV and Rand must be zero in LE Secure Connections */
HciLeLtkReqNegReplCmd(pEvent->hdr.param);
return;
}
/* call callback to get key from app */

28
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smp_main.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -233,6 +234,7 @@ static void smpDmConnCback(dmEvt_t *pDmEvt)
pCcb->attempts = SmpDbGetFailureCount((dmConnId_t) pDmEvt->hdr.param);
pCcb->lastSentKey = 0;
pCcb->state = 0;
pCcb->keyReady = FALSE;
/* Resume the attempts state if necessary */
smpResumeAttemptsState((dmConnId_t) pDmEvt->hdr.param);
@ -693,6 +695,27 @@ uint8_t smpGetScSecLevel(smpCcb_t *pCcb)
return secLevel;
}
/*************************************************************************************************/
/*!
* \brief Check if LE Secure Connections is enabled on the connection.
*
* \param connId Connection identifier.
*
* \return TRUE is Secure Connections is enabled, else FALSE
*/
/*************************************************************************************************/
bool_t SmpDmLescEnabled(dmConnId_t connId)
{
smpCcb_t *pCcb = smpCcbByConnId(connId);
if (pCcb == NULL || pCcb->pScCcb == NULL)
{
return FALSE;
}
return pCcb->pScCcb->lescEnabled;
}
/*************************************************************************************************/
/*!
* \brief Return the STK for the given connection.
@ -710,6 +733,11 @@ uint8_t *SmpDmGetStk(dmConnId_t connId, uint8_t *pSecLevel)
/* get connection control block */
pCcb = smpCcbByConnId(connId);
if ((pCcb == NULL) || (pCcb->keyReady == FALSE))
{
return NULL;
}
if (smpCb.lescSupported && pCcb->pScCcb->lescEnabled && (pCcb->pScCcb->pLtk != NULL))
{
/* set security level */

2
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smp_main.h
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -314,6 +315,7 @@ typedef struct
uint8_t token; /* AES transaction token */
uint8_t attempts; /* Failed pairing attempts */
uint8_t lastSentKey; /* Command code of last sent key */
bool_t keyReady; /* Encryption key is ready */
smpScCcb_t *pScCcb; /* LE Secure Connection control blocks */
} smpCcb_t;

2
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpi_act.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -269,6 +270,7 @@ void smpiActStkEncrypt(smpCcb_t *pCcb, smpMsg_t *pMsg)
/* adjust key based on max key length */
memcpy(buf, pMsg->aes.pCiphertext, encKeyLen);
memset((buf + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
pCcb->keyReady = TRUE;
secLevel = (pCcb->auth & SMP_AUTH_MITM_FLAG) ? DM_SEC_LEVEL_ENC_AUTH : DM_SEC_LEVEL_ENC;
DmSmpEncryptReq(pCcb->connId, secLevel, buf);

2
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpi_sc_act.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -463,6 +464,7 @@ void smpiScActDHKeyCheckVerify(smpCcb_t *pCcb, smpMsg_t *pMsg)
/* Adjust key based on max key length */
memcpy(buf, pCcb->pScCcb->pLtk->ltk_t, encKeyLen);
memset((buf + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
pCcb->keyReady = TRUE;
/* Initiate encryption */
DmSmpEncryptReq(pCcb->connId, smpGetScSecLevel(pCcb), buf);

2
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpr_act.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -284,6 +285,7 @@ void smprActSendPairRandom(smpCcb_t *pCcb, smpMsg_t *pMsg)
/* store STK and adjust based on max key length */
memcpy(pCcb->pScr->buf.b3, pMsg->aes.pCiphertext, encKeyLen);
memset((pCcb->pScr->buf.b3 + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
pCcb->keyReady = TRUE;
/* start smp response timer */
smpStartRspTimer(pCcb);

2
features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpr_sc_act.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2009-2019 Arm Limited
* Copyright (c) 2019-2020 Packetcraft, Inc.
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -524,6 +525,7 @@ void smprScActDHKeyCheckSend(smpCcb_t *pCcb, smpMsg_t *pMsg)
pCcb->pairReq[SMP_MAXKEY_POS] : pCcb->pairRsp[SMP_MAXKEY_POS];
memset((pCcb->pScCcb->pLtk->ltk_t + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
pCcb->keyReady = TRUE;
/* Send the DH Key check Eb to the initiator */
smpScSendDHKeyCheck(pCcb, pMsg, pCcb->pScCcb->pScratch->Nb_Eb);