Skip to content

feat: improve pairing security requirements #884

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 11 commits into
base: main
Choose a base branch
from
Draft

feat: improve pairing security requirements #884

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
a417192
Work towards improving pairing security requirements
XavierBernhardt-Philips Jun 2, 2025
645ebe1
Better enum naming for ConnectionMode and ManInTheMiddleMode
MiquelJayson-Philips Jun 6, 2025
f470d63
Renamed notRequired to Disabled
MiquelJayson-Philips Jun 6, 2025
f3e8678
Rename values in SecureConnectionMode enum
MiquelJayson-Philips Jun 13, 2025
3adc019
Refactoring SecureConnectionMode and MITMMODE into 2 functions
XavierBernhardt-Philips Jun 16, 2025
5afb95c
refactoring
XavierBernhardt-Philips Jun 18, 2025
1e16bc3
Merge branch 'main' into feature/pairing-security-requirements
XavierBernhardt-Philips Jun 18, 2025
1459c1d
fixed compile error
XavierBernhardt-Philips Jun 18, 2025
4199635
Removed bracket
MiquelJayson-Philips Jun 19, 2025
64afd43
Merge branch 'main' into feature/pairing-security-requirements
XavierBernhardt-Philips Jul 10, 2025
e58827f
Merge branch 'main' into feature/pairing-security-requirements
XavierBernhardt-Philips Jul 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions services/ble/Gap.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,14 @@ namespace services
GapPairingObserver::Subject().AllowPairing(allow);
}

void GapPairingDecorator::SetSecurityMode(SecurityMode mode, SecurityLevel level)
void GapPairingDecorator::SetManInTheMiddleMode(ManInTheMiddleMode mitmMode)
{
GapPairingObserver::Subject().SetSecurityMode(mode, level);
GapPairingObserver::Subject().SetManInTheMiddleMode(mitmMode);
}

void GapPairingDecorator::SetSecureConnectionMode(SecureConnectionMode connectionMode)
{
GapPairingObserver::Subject().SetSecureConnectionMode(connectionMode);
}

void GapPairingDecorator::SetIoCapabilities(IoCapabilities caps)
Expand Down
24 changes: 21 additions & 3 deletions services/ble/Gap.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,11 +128,27 @@ namespace services
level4,
};

virtual void Pair() = 0;
enum class SecureConnectionMode
{
disabled = 0,
supported = 1,
enforced = 2,
};

enum class ManInTheMiddleMode
{
disabled = 0,
supported = 1,
enforced = 2,
};

virtual void
Pair() = 0;
Comment on lines +145 to +146
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
virtual void
Pair() = 0;
virtual void Pair() = 0;


virtual void AllowPairing(bool allow) = 0;

virtual void SetSecurityMode(SecurityMode mode, SecurityLevel level) = 0;
virtual void SetManInTheMiddleMode(ManInTheMiddleMode mitmMode) = 0;
virtual void SetSecureConnectionMode(SecureConnectionMode connectionMode) = 0;
virtual void SetIoCapabilities(IoCapabilities caps) = 0;

virtual void AuthenticateWithPasskey(uint32_t passkey) = 0;
Expand All @@ -154,7 +170,9 @@ namespace services
// Implementation of GapPairing
void Pair() override;
void AllowPairing(bool allow) override;
void SetSecurityMode(SecurityMode mode, SecurityLevel level) override;

void SetManInTheMiddleMode(ManInTheMiddleMode mitmMode) override;
void SetSecureConnectionMode(SecureConnectionMode connectionMode) override;
void SetIoCapabilities(IoCapabilities caps) override;
void AuthenticateWithPasskey(uint32_t passkey) override;
void NumericComparisonConfirm(bool accept) override;
Expand Down
29 changes: 27 additions & 2 deletions services/ble/Gap.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,28 @@ message AdvertisementType
AdvertisementTypeEnum type = 1;
}

message SecureConnectionMode {
enum SecureConnectionModeEnum
{
disabled = 0;
supported = 1;
enforced = 2;
}

SecureConnectionModeEnum secureConnectionMode = 1;
}

message ManInTheMiddleMode {
enum ManInTheMiddleModeEnum
{
disabled = 0;
supported = 1;
enforced = 2;
}

ManInTheMiddleModeEnum mitmMode = 1;
}

message SecurityModeAndLevel
{
enum SecurityLevelEnum
Expand Down Expand Up @@ -192,13 +214,15 @@ service GapPeripheral
rpc SetAdvertisementData(AdvertisementData) returns (Nothing) { option (method_id) = 3; }
rpc SetScanResponseData(AdvertisementData) returns (Nothing) { option (method_id) = 4; }
rpc SetAllowPairing(BoolValue) returns (Nothing) { option (method_id) = 5; }
rpc SetSecurityMode(SecurityModeAndLevel) returns (Nothing) { option (method_id) = 6; }
rpc SetIoCapabilities(IoCapabilities) returns (Nothing) { option (method_id) = 7; }
rpc RemoveAllBonds(Nothing) returns (Nothing) { option (method_id) = 8; }

// Allowed states: advertising
rpc GetResolvableAddress(Nothing) returns (Nothing) { option (method_id) = 9; }
rpc GetIdentityAddress(Nothing) returns (Nothing) { option (method_id) = 10; }

rpc SetSecureConnectionMode(SecureConnectionMode) returns (Nothing) { option (method_id) = 11; }
rpc SetManInTheMiddleMode(ManInTheMiddleMode) returns (Nothing) { option (method_id) = 12; }
}

service GapCentral
Expand All @@ -225,14 +249,15 @@ service GapCentral
// Allowed states: connected
rpc Pair(Nothing) returns (Nothing) { option (method_id) = 6; }

rpc SetSecurityMode(SecurityModeAndLevel) returns (Nothing) { option (method_id) = 7; }
rpc SetIoCapabilities(IoCapabilities) returns (Nothing) { option (method_id) = 8; }
rpc AuthenticateWithPasskey(UInt32Value) returns (Nothing) { option (method_id) = 9; }
rpc NumericComparisonConfirm(BoolValue) returns (Nothing) { option (method_id) = 10; }
rpc RemoveAllBonds(Nothing) returns (Nothing) { option (method_id) = 11; }
rpc SetDeviceDiscoveryFilter(DeviceDiscoveryFilter) returns (Nothing) { option (method_id) = 12; }
rpc ResolvePrivateAddress(Address) returns (Nothing) { option (method_id) = 13; }
rpc IsDeviceBonded(PeerNodeParameters) returns (Nothing) { option (method_id) = 14; }
rpc SetManInTheMiddleMode(ManInTheMiddleMode) returns (Nothing) { option (method_id) = 15; }
rpc SetSecureConnectionMode(SecureConnectionMode) returns (Nothing) { option (method_id) = 16; }
}

service GapPeripheralResponse
Expand Down
7 changes: 5 additions & 2 deletions services/ble/test/TestGapPairing.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,11 @@ namespace services
EXPECT_CALL(gapPairing, AllowPairing(::testing::IsTrue()));
decorator.AllowPairing(true);

EXPECT_CALL(gapPairing, SetSecurityMode(::testing::TypedEq<services::GapPairing::SecurityMode>(services::GapPairing::SecurityMode::mode1), ::testing::TypedEq<services::GapPairing::SecurityLevel>(services::GapPairing::SecurityLevel::level1)));
decorator.SetSecurityMode(services::GapPairing::SecurityMode::mode1, services::GapPairing::SecurityLevel::level1);
EXPECT_CALL(gapPairing, SetManInTheMiddleMode(::testing::TypedEq<services::GapPairing::ManInTheMiddleMode>(services::GapPairing::ManInTheMiddleMode::disabled)));
decorator.SetManInTheMiddleMode(services::GapPairing::ManInTheMiddleMode::disabled);

EXPECT_CALL(gapPairing, SetSecureConnectionMode(::testing::TypedEq<services::GapPairing::SecureConnectionMode>(services::GapPairing::SecureConnectionMode::disabled)));
decorator.SetSecureConnectionMode(services::GapPairing::SecureConnectionMode::disabled);

EXPECT_CALL(gapPairing, SetIoCapabilities(::testing::TypedEq<services::GapPairing::IoCapabilities>(services::GapPairing::IoCapabilities::none)));
decorator.SetIoCapabilities(services::GapPairing::IoCapabilities::none);
Expand Down
3 changes: 2 additions & 1 deletion services/ble/test_doubles/GapPairingMock.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,8 @@ namespace services
public:
MOCK_METHOD(void, Pair, ());
MOCK_METHOD(void, AllowPairing, (bool allow));
MOCK_METHOD(void, SetSecurityMode, (SecurityMode mode, SecurityLevel level));
MOCK_METHOD(void, SetManInTheMiddleMode, (ManInTheMiddleMode mitmMode));
MOCK_METHOD(void, SetSecureConnectionMode, (SecureConnectionMode connectionMode));
MOCK_METHOD(void, SetIoCapabilities, (IoCapabilities caps));
MOCK_METHOD(void, AuthenticateWithPasskey, (uint32_t passkey));
MOCK_METHOD(void, NumericComparisonConfirm, (bool accept));
Expand Down
Loading