Merge pull request #12785 from LDong-Arm/port_packetcraft_ltk_improve…

…ments

Cordio: Apply Packetcraft's fix for possible SweynTooth vulnerabilities

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/include/smp_api.h

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -252,6 +253,17 @@ void SmpDmMsgSend(smpDmMsg_t *pMsg);
 /*************************************************************************************************/
 void SmpDmEncryptInd(wsfMsgHdr_t *pMsg);
 
+/*************************************************************************************************/
+/*!
+ * \brief Check if LE Secure Connections is enabled on the connection.
+ *
+ * \param connId Connection identifier.
+ *
+ * \return TRUE is Secure Connections is enabled, else FALSE
+ */
+/*************************************************************************************************/
+bool_t SmpDmLescEnabled(dmConnId_t connId);
+
 /*************************************************************************************************/
 /*!
  * \brief Return the STK for the given connection.

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/dm/dm_sec.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -117,6 +118,12 @@ void dmSecHciHandler(hciEvt_t *pEvent)
  return;
  }
  }
+ else if (SmpDmLescEnabled(pCcb->connId) == TRUE)
+ {
+ /* EDIV and Rand must be zero in LE Secure Connections */
+ HciLeLtkReqNegReplCmd(pEvent->hdr.param);
+ return;
+ }
 
  /* call callback to get key from app */
 

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smp_main.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -233,6 +234,7 @@ static void smpDmConnCback(dmEvt_t *pDmEvt)
  pCcb->attempts = SmpDbGetFailureCount((dmConnId_t) pDmEvt->hdr.param);
  pCcb->lastSentKey = 0;
  pCcb->state = 0;
+ pCcb->keyReady = FALSE;
 
  /* Resume the attempts state if necessary */
  smpResumeAttemptsState((dmConnId_t) pDmEvt->hdr.param);
@@ -693,6 +695,27 @@ uint8_t smpGetScSecLevel(smpCcb_t *pCcb)
  return secLevel;
 }
 
+/*************************************************************************************************/
+/*!
+ * \brief Check if LE Secure Connections is enabled on the connection.
+ *
+ * \param connId Connection identifier.
+ *
+ * \return TRUE is Secure Connections is enabled, else FALSE
+ */
+/*************************************************************************************************/
+bool_t SmpDmLescEnabled(dmConnId_t connId)
+{
+ smpCcb_t *pCcb = smpCcbByConnId(connId);
+
+ if (pCcb == NULL || pCcb->pScCcb == NULL)
+ {
+ return FALSE;
+ }
+
+ return pCcb->pScCcb->lescEnabled;
+}
+
 /*************************************************************************************************/
 /*!
  * \brief Return the STK for the given connection.
@@ -710,6 +733,11 @@ uint8_t *SmpDmGetStk(dmConnId_t connId, uint8_t *pSecLevel)
  /* get connection control block */
  pCcb = smpCcbByConnId(connId);
 
+ if ((pCcb == NULL) || (pCcb->keyReady == FALSE))
+ {
+ return NULL;
+ }
+
  if (smpCb.lescSupported && pCcb->pScCcb->lescEnabled && (pCcb->pScCcb->pLtk != NULL))
  {
  /* set security level */

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smp_main.h

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -314,6 +315,7 @@ typedef struct
  uint8_t token; /* AES transaction token */
  uint8_t attempts; /* Failed pairing attempts */
  uint8_t lastSentKey; /* Command code of last sent key */
+ bool_t keyReady; /* Encryption key is ready */
  smpScCcb_t *pScCcb; /* LE Secure Connection control blocks */
 } smpCcb_t;
 

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpi_act.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -269,6 +270,7 @@ void smpiActStkEncrypt(smpCcb_t *pCcb, smpMsg_t *pMsg)
  /* adjust key based on max key length */
  memcpy(buf, pMsg->aes.pCiphertext, encKeyLen);
  memset((buf + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
+ pCcb->keyReady = TRUE;
 
  secLevel = (pCcb->auth & SMP_AUTH_MITM_FLAG) ? DM_SEC_LEVEL_ENC_AUTH : DM_SEC_LEVEL_ENC;
  DmSmpEncryptReq(pCcb->connId, secLevel, buf);

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpi_sc_act.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -463,6 +464,7 @@ void smpiScActDHKeyCheckVerify(smpCcb_t *pCcb, smpMsg_t *pMsg)
  /* Adjust key based on max key length */
  memcpy(buf, pCcb->pScCcb->pLtk->ltk_t, encKeyLen);
  memset((buf + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
+ pCcb->keyReady = TRUE;
 
  /* Initiate encryption */
  DmSmpEncryptReq(pCcb->connId, smpGetScSecLevel(pCcb), buf);

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpr_act.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -284,6 +285,7 @@ void smprActSendPairRandom(smpCcb_t *pCcb, smpMsg_t *pMsg)
  /* store STK and adjust based on max key length */
  memcpy(pCcb->pScr->buf.b3, pMsg->aes.pCiphertext, encKeyLen);
  memset((pCcb->pScr->buf.b3 + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
+ pCcb->keyReady = TRUE;
 
  /* start smp response timer */
  smpStartRspTimer(pCcb);

features/FEATURE_BLE/targets/TARGET_CORDIO/stack/ble-host/sources/stack/smp/smpr_sc_act.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2009-2019 Arm Limited
+ * Copyright (c) 2019-2020 Packetcraft, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -524,6 +525,7 @@ void smprScActDHKeyCheckSend(smpCcb_t *pCcb, smpMsg_t *pMsg)
  pCcb->pairReq[SMP_MAXKEY_POS] : pCcb->pairRsp[SMP_MAXKEY_POS];
 
  memset((pCcb->pScCcb->pLtk->ltk_t + encKeyLen), 0, (SMP_KEY_LEN - encKeyLen));
+ pCcb->keyReady = TRUE;
 
  /* Send the DH Key check Eb to the initiator */
  smpScSendDHKeyCheck(pCcb, pMsg, pCcb->pScCcb->pScratch->Nb_Eb);