espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-30 18:57:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/reset_irk_when_all_unpair_v5.0' into 'release/v5.0'

Browse Source 
fix(nimble): Fixed BLE security vulnerability when using fixed IRK (v5.0)

See merge request espressif/esp-idf!32202
This commit is contained in:
Jiang Jiang Jian
2024-08-15 15:49:37 +08:00
parent 06dba23ce0 d651e5265d
commit d7710f65b6
3 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
components/bt/host/nimble/Kconfig.in
View File

@ -163,6 +163,16 @@ config BT_NIMBLE_NVS_PERSIST
help help
Enable this flag to make bonding persistent across device reboots Enable this flag to make bonding persistent across device reboots
config BT_NIMBLE_SMP_ID_RESET
bool "Reset device identity when all bonding records are deleted"
default n
help
There are tracking risks associated with using a fixed or static IRK.
If enabled this option, Bluedroid will assign a new randomly-generated IRK
when all pairing and bonding records are deleted. This would decrease the ability
of a previously paired peer to be used to determine whether a device
with which it previously shared an IRK is within range.
menuconfig BT_NIMBLE_SECURITY_ENABLE menuconfig BT_NIMBLE_SECURITY_ENABLE
bool "Enable BLE SM feature" bool "Enable BLE SM feature"
depends on BT_NIMBLE_ENABLED depends on BT_NIMBLE_ENABLED

2
components/bt/host/nimble/nimble

Submodule components/bt/host/nimble/nimble updated: 6d147bba6c...c8f12ce6f1

8
components/bt/host/nimble/port/include/esp_nimble_cfg.h
View File

@ -824,6 +824,14 @@
#define MYNEWT_VAL_BLE_SM_THEIR_KEY_DIST (0) #define MYNEWT_VAL_BLE_SM_THEIR_KEY_DIST (0)
#endif #endif
#ifndef MYNEWT_VAL_BLE_SMP_ID_RESET
#ifdef CONFIG_BT_NIMBLE_SMP_ID_RESET
#define MYNEWT_VAL_BLE_SMP_ID_RESET CONFIG_BT_NIMBLE_SMP_ID_RESET
#else
#define MYNEWT_VAL_BLE_SMP_ID_RESET (0)
#endif
#endif
#ifndef MYNEWT_VAL_BLE_CRYPTO_STACK_MBEDTLS #ifndef MYNEWT_VAL_BLE_CRYPTO_STACK_MBEDTLS
#define MYNEWT_VAL_BLE_CRYPTO_STACK_MBEDTLS (CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS) #define MYNEWT_VAL_BLE_CRYPTO_STACK_MBEDTLS (CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS)
#endif #endif