Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity
52,121 Commits 25 Branches 192 Tags
release/v6.0
Commit Graph
47 Commits
Author SHA1 Message Date
Zhi Wei Jian 2bada5b678 feat(ble/bluedroid): reject LE re-pairing that weakens an existing bond 
Add smp_repairing_is_allowed() behind BT_BLE_SMP_HARDENED_REPAIRING so a
peer cannot replace an existing bond with one that has less MITM
protection, no Secure Connections, or a shorter key. Compare a preceding
Security Request against the pairing command AuthReq, not the
association-model result, and always allow first pairing.

A refusal keeps the stored bond. Pairing-failure erase is split by link
role: default is erase as Central and keep as Peripheral.

Closes BLERP (NDSS 2026) V3, V4 and V6.


(cherry picked from commit 88ea45be73)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-04 11:03:52 +08:00
Zhi Wei Jian 6b9b3d969e fix(ble/bluedroid): harden LE bond handling across encryption 
Keep the existing bond until the new pairing is encrypted, and on encryption
failure drop the link instead of clearing keys. Recovering from a peer that
really deleted the bond is opt-in through BT_BLE_SMP_UNBOND_ON_KEY_MISSING.

Closes BLERP (NDSS 2026) V5, and stops an unauthenticated Pairing Request
from dropping the stored keys (V2 exploitation).


(cherry picked from commit f864615d7d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-04 11:03:52 +08:00
hejiaxin 7f42eabb08 fix(bt_stack): Fix some critical bugs in classic_bt stack 
related: obex, smp, pbap, sdp, rfcomm, stack_dm

- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
 2026-07-29 17:05:31 +08:00
Island 2dc3285e57 Merge branch 'bugfix/fix_bluedroid_read_multi_v6.0' into 'release/v6.0' 
fix(ble/bluedroid): fix GATT Read Multiple response handling (6.0)

See merge request espressif/esp-idf!50709
 2026-07-15 15:38:50 +08:00
Zhi Wei Jian 1ade9c6f0e feat(ble/bluedroid): Support bluedroid dual identity 
(cherry picked from commit 2358786647)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 14:17:33 +08:00
Zhi Wei Jian 273c463497 fix(ble/bluedroid): validate SMP pair-fail reason and OOB device 
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:23 +08:00
Zhang Hai Peng d53c6ad240 fix(ble/bluedroid): downgrade numeric comparison log to warning 
(cherry picked from commit 72a49ed53b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-07-14 10:37:17 +08:00
Jiang Jiang Jian 777411abb9 Merge branch 'feat/ble-smp-multi-adv-static-random-address_v6.0' into 'release/v6.0' 
feat(ble/bluedroid): Add BLE SMP support for multi-ADV with static random addresses (6.0)

See merge request espressif/esp-idf!49789
 2026-06-29 15:41:49 +08:00
Zhang Hai Peng 4e0cdf45ec feat(ble/bluedroid): Add BLE SMP support for multi-ADV with static random addresses 
(cherry picked from commit 7986e2faa8)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-06-18 10:24:53 +08:00
Jin Cheng a7aca1c1a3 fix(bt/bluedroid): added validation for all SMP BR opcode lengths in smp_br_data_received 2026-06-12 18:32:39 +08:00
Jin Cheng 043bad5c30 fix(bt/bluedroid): fixed CTKD link key authentication downgrade in SC-Only mode 2026-06-12 18:32:39 +08:00
Jin Cheng c61e95a86e fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid 2026-05-09 11:05:19 +08:00
Island 8f8afe6c98 Merge branch 'bugfix/fix_ble_pair_fail_v6.0' into 'release/v6.0' 
fix(bt/bluedroid): fix BLE SMP pairing failure on BLE-only devices when using defalut param (6.0)

See merge request espressif/esp-idf!47401
 2026-04-28 17:24:20 +08:00
Zhi Wei Jian 344cc0a590 fix(ble/bluedroid): Null/range checks, crypto cleanup and API consistency 
- smp_api.h/smp_int.h: SMP_OPCODE_ARRAY_SIZE and SecureConnectionOobDataReply
  declaration alignment
- p_256_ecc_pp/p_256_multprecision: bounds and overflow fixes in ECC/multiprecision
- smp_act: init le_key; p_dev_rec null check in smp_key_distribution;
  smp_compute_dhkey failure notify in smp_both_have_public_keys
- smp_api: early state/cb_evt check in SMP_SecureConnectionOobDataReply
- smp_cmac: input/length validation in cmac_aes_k_calculate and
  aes_cipher_msg_auth_code
- smp_keys: smp_gen_p2_4_confirm return and smp_calculate_comfirm_cont;
  smp_process_private_key/smp_compute_dhkey cleanup and peer_pub_be clear
- smp_l2c: fix callback param types with L2CAP
- smp_main: event/state bounds in smp_sm_event; smp_get_event_name default string
- smp_utils: cmd_code<SMP_OPCODE_ARRAY_SIZE and smp_cmd_build_act check;
  smp_mask_enc_key/smp_command_has_invalid_parameters bounds


(cherry picked from commit 50747e4f63)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-04-24 15:12:54 +08:00
Zhi Wei Jian b693cb7091 fix(ble/bluedroid): fix L2CAP, SMP and HCI command issues 
- Fix active_count check in l2cu_ble_plcb_active_count
- Restore previous state if connection command fails
- Fix HCI cmd buffer size off-by-one errors
- Fix connect handle length errors
- Fix channel sounding event status handling
- Fix SMP param_len check in smp_rand_back
- Fix spelling: BROCASTER to BROADCASTER in definitions



(cherry picked from commit e118d053b3)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-04-24 15:12:53 +08:00
Zhang Hai Peng 8c5c99f665 fix(bt/bluedroid): fix BLE SMP pairing failure on BLE-only devices when using default param 
(cherry picked from commit 74a053bd4e)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-04-21 11:53:50 +08:00
zhiweijian 87655116dc feat(ble/bluedroid): Move the TinyCrypt and mbedTLS configuration items to the bt common path 2025-12-30 12:12:35 +08:00
zhiweijian 9d88119a4e feat(ble/bluedroid): Supported Bludroid host encryption using TinyCrypt 2025-12-30 12:12:35 +08:00
zhiweijian 94c4336c77 feat(ble/bluedroid): Supported Bludroid host encryption using mbedtls 2025-12-30 12:12:35 +08:00
Jin Cheng af327e091d fix(bt/bluedroid): cleaned the code according to the tool cppcheck 2025-12-19 11:17:18 +08:00
Jin Cheng 3bd5258fe4 fix(bt/bluedroid): fixed possible OOB read in smp_br_data_received 2025-12-19 11:17:18 +08:00
Jin Cheng 990dcc431a fix(bt/blurdoird): check Classic key before cross-key derivation 2025-12-19 11:17:17 +08:00
Zhang Hai Peng 9bb648684c fix(ble/bluedroid): Add length check in prepare write response 
(cherry picked from commit b03ff3cf21)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-12-03 11:54:31 +08:00
Island df80f1d9cb Merge branch 'feat/support_bluedroid_host_pawr_v6.0' into 'release/v6.0' 
feat(ble/bluedroid): Add bluedroid host PAwR and Advertising Coding Selection features (backport for v6.0)

See merge request espressif/esp-idf!43398
 2025-11-17 19:04:11 +08:00
zhiweijian 36d0885589 fix(ble/bluedroid): Fixed CTE IQ sample data copy error 2025-11-14 20:49:09 +08:00
zhiweijian 1115165ea0 feat(ble/bluedroid): Supported BLE bluedroid host pawr connection 2025-11-14 18:02:07 +08:00
Chen Jian Hua 21a2b068c6 feat(ble/bluedroid): Add more debug log for bluedroid 
(cherry picked from commit 1aeb965607)

Co-authored-by: chenjianhua <chenjianhua@espressif.com>
 2025-11-14 13:33:23 +08:00
Island 33321e59b1 Merge branch 'opt/opt_ble_log' into 'master' 
feat(ble/bluedroid): Added BLE debug LOG for bluedroid

Closes BLERP-2258

See merge request espressif/esp-idf!41567
 2025-09-28 19:18:03 +08:00
zhanghaipeng 45775a3e35 feat(ble/bluedroid): Added BLE debug LOG for bluedroid 2025-09-26 20:10:32 +08:00
JinCheng 075ed218ca fix(bt/bluedroid): fixed potential OOB in Bluedroid 2025-09-25 10:20:10 +08:00
zhanghaipeng 99121258d4 fix(ble/bluedroid): Fixed BLE SMP state machine inconsistency on disconnection 2025-05-29 10:50:50 +08:00
zhanghaipeng 76e1650161 fix(ble/bluedroid): Fixed crash issue in BLE SMP when a disconnection process is ongoing 2024-10-20 11:47:31 +08:00
zhanghaipeng d528cc598e fix(bt/bluedroid): Fix BLE SMP register log level 2023-12-01 17:21:49 +08:00
zhanghaipeng faff6d3ee3 fix(bt): Fix bug while calculating block cipher using aes-128 2023-08-22 19:38:01 +08:00
Alexey Lapshin d4b7be4a73 bt: fix gcc-12 compile errors 2023-02-22 05:33:03 +00:00
chenjianhua 2048322429 bluedroid: support oob pairing for smp secure connection 2022-12-09 13:28:31 +08:00
xiewenxiang 50748009e4 components/bt: Fix bluedroid compile issue 2021-12-30 11:54:47 +08:00
“YangZhao” 12ec4866b8 Fix the high-impact issues from the code analysis report from customer. 
For the CID10564,10384,10280,10098,10038,The memory was released in other place.
For the CID10365,it release the memory in the function when sent successfully.
For the CID10268,10011, we need not change the code.
 2021-11-22 17:38:02 +08:00
Chinmay Chhajed b75e034b3c Bluedroid: Check only x component of passkey to avoid passkey impersonation attack. 2021-05-28 14:28:54 +05:30
zwj 077722696a add option to enable multi-connection 2021-04-20 02:41:14 +00:00
zwj 7c1c669799 component/bt: add BLE v5.0 feature for bluedroid host 2021-01-15 17:55:12 +08:00
Chinmay Chhajed d73ebb570b Bluedroid: Fixes for some vulnerabilities. 
This commit fixes 'Impersonation in Passkey entry protocol'
(CVE-2020-26558) and suggests fixes for other vulnerabilites like
'Impersonation in the Pin Pairing Protocol' (CVE-2020-26555) and
'Authentication of the LE Legacy Pairing Protocol'

CVE-2020-26558 can be easily implemented if the peer device can
impersonate our public key. This commit adds a check by comparing our
and received public key and returns failed pairing if keys are same.

This commit also adds comments suggesting to use secure connection when
supported by all devices.
 2020-12-24 10:52:12 +00:00
Angus Gratton 66fb5a29bb Whitespace: Automated whitespace fixes (large commit) 
Apply the pre-commit hook whitespace fixes to all files in the repo.

(Line endings, blank lines at end of file, trailing whitespace)
 2020-11-11 07:36:35 +00:00
wangcheng 418b32e71b master missing BLE_AUTH_CMPL_EVT after restart 2020-05-13 20:33:24 +08:00
Geng Yu Chao 46c53ab8c8 btdm:fix the problem that Not getting complete Identity Address (Public Address) of the Privacy-enabled Bonded Device after bonding. beacuse of the wrong memcpy in LE_KEY callback handler. 2019-12-09 15:21:49 +08:00
Prasad Alatkar 2c3648b619 BT/Bluedroid : Add support to set min encryption key requirement 
- Modifies `smp_utils.c` to add check on encryption key size received from
  peer.
- Modifies `esp_ble_gap_set_security_param` API to add minimum encryption key
  size requirement.
 2019-09-25 11:56:47 +08:00
Hrishikesh Dhayagude 21165edf41 Bluetooth component refactoring 2019-06-30 16:39:00 +08:00