Remove flags for b#314331379 bluffs_mitigation has passed soak and flags for it should be removed. Bug: 314331379 Bug: 319541706 Flag: bluffs_mitigation Test: m libbluetooth Tag: #security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:9fc2e1e6d449e2665fc5d5d9af4ca87346863960) (cherry picked from https://android-review.googlesource.com/q/commit:34a5ceced396f40eae30747d295e07d31f18e59d) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:d82f9ffa1181f48e6467ab518033d92a8d24a0c3) Merged-In: I2f2743e1bec281823cd0ca4cb67e281f3aa1df48 Change-Id: I2f2743e1bec281823cd0ca4cb67e281f3aa1df48
diff --git a/flags/security.aconfig b/flags/security.aconfig index e3acba1..a3b59c9 100644 --- a/flags/security.aconfig +++ b/flags/security.aconfig
@@ -23,13 +23,6 @@ } flag { - name: "bluffs_mitigation" - namespace: "bluetooth" - description: "Cache security values to mitigate BLUFFS" - bug: "314331379" -} - -flag { name: "fix_pairing_failure_reason_from_remote" namespace: "bluetooth" description: "Correct the pairing failure reason reported from remote"
diff --git a/system/stack/btm/btm_sec.cc b/system/stack/btm/btm_sec.cc index fd2f0fb..c9d52cc 100644 --- a/system/stack/btm/btm_sec.cc +++ b/system/stack/btm/btm_sec.cc
@@ -3503,22 +3503,20 @@ return; } - if (com::android::bluetooth::flags::bluffs_mitigation()) { - if (btm_sec_is_session_key_size_downgrade(handle, key_size)) { - log::error( - "encryption key size lower than cached value, disconnecting. " - "handle: 0x{:x} attempted key size: {}", - handle, key_size); - acl_disconnect_from_handle( - handle, HCI_ERR_HOST_REJECT_SECURITY, - "stack::btu::btu_hcif::read_encryption_key_size_complete_after_" - "encryption_change Key Size Downgrade"); - return; - } - - btm_sec_update_session_key_size(handle, key_size); + if (btm_sec_is_session_key_size_downgrade(handle, key_size)) { + log::error( + "encryption key size lower than cached value, disconnecting. " + "handle: 0x{:x} attempted key size: {}", + handle, key_size); + acl_disconnect_from_handle( + handle, HCI_ERR_HOST_REJECT_SECURITY, + "stack::btu::btu_hcif::read_encryption_key_size_complete_after_" + "encryption_change Key Size Downgrade"); + return; } + btm_sec_update_session_key_size(handle, key_size); + // good key size - succeed btm_acl_encrypt_change(handle, static_cast<tHCI_STATUS>(status), 1 /* enable */); @@ -3540,52 +3538,23 @@ ******************************************************************************/ void btm_sec_encryption_change_evt(uint16_t handle, tHCI_STATUS status, uint8_t encr_enable) { - if (com::android::bluetooth::flags::bluffs_mitigation()) { - if (status != HCI_SUCCESS || encr_enable == 0 || - BTM_IsBleConnection(handle) || - !bluetooth::shim::GetController()->IsSupported( - bluetooth::hci::OpCode::READ_ENCRYPTION_KEY_SIZE)) { - if (status == HCI_ERR_CONNECTION_TOUT) { - smp_cancel_start_encryption_attempt(); - return; - } - - btm_acl_encrypt_change(handle, static_cast<tHCI_STATUS>(status), - encr_enable); - btm_sec_encrypt_change(handle, static_cast<tHCI_STATUS>(status), - encr_enable); - } else { - btsnd_hcic_read_encryption_key_size( - handle, - base::Bind( - &read_encryption_key_size_complete_after_encryption_change)); + if (status != HCI_SUCCESS || encr_enable == 0 || + BTM_IsBleConnection(handle) || + !bluetooth::shim::GetController()->IsSupported( + bluetooth::hci::OpCode::READ_ENCRYPTION_KEY_SIZE)) { + if (status == HCI_ERR_CONNECTION_TOUT) { + smp_cancel_start_encryption_attempt(); + return; } + + btm_acl_encrypt_change(handle, static_cast<tHCI_STATUS>(status), + encr_enable); + btm_sec_encrypt_change(handle, static_cast<tHCI_STATUS>(status), + encr_enable); } else { - // This block added to ensure matching code flow with the bluffs_mitigation - // flag off. The entire block should be removed when the flag is. - if (status != HCI_SUCCESS || encr_enable == 0 || - BTM_IsBleConnection(handle) || - !bluetooth::shim::GetController()->IsSupported( - bluetooth::hci::OpCode::READ_ENCRYPTION_KEY_SIZE) || - // Skip encryption key size check when using set_min_encryption_key_size - (bluetooth::common::init_flags::set_min_encryption_is_enabled() && - bluetooth::shim::GetController()->IsSupported( - bluetooth::hci::OpCode::SET_MIN_ENCRYPTION_KEY_SIZE))) { - if (status == HCI_ERR_CONNECTION_TOUT) { - smp_cancel_start_encryption_attempt(); - return; - } - - btm_acl_encrypt_change(handle, static_cast<tHCI_STATUS>(status), - encr_enable); - btm_sec_encrypt_change(handle, static_cast<tHCI_STATUS>(status), - encr_enable); - } else { - btsnd_hcic_read_encryption_key_size( - handle, - base::Bind( - &read_encryption_key_size_complete_after_encryption_change)); - } + btsnd_hcic_read_encryption_key_size( + handle, + base::Bind(&read_encryption_key_size_complete_after_encryption_change)); } } /******************************************************************************* @@ -4213,8 +4182,7 @@ } } - if (com::android::bluetooth::flags::bluffs_mitigation() && - p_dev_rec->sec_rec.is_bond_type_persistent() && + if (p_dev_rec->sec_rec.is_bond_type_persistent() && (p_dev_rec->is_device_type_br_edr() || p_dev_rec->is_device_type_dual_mode())) { btm_sec_store_device_sc_support(p_dev_rec->get_br_edr_hci_handle(), @@ -5239,16 +5207,14 @@ tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(hci_handle); if (p_dev_rec == nullptr) return; - if (com::android::bluetooth::flags::bluffs_mitigation()) { - // Drop the connection here if the remote attempts to downgrade from Secure - // Connections mode. - if (btm_sec_is_device_sc_downgrade(hci_handle, sc_supported)) { - acl_set_disconnect_reason(HCI_ERR_HOST_REJECT_SECURITY); - btm_sec_send_hci_disconnect( - p_dev_rec, HCI_ERR_AUTH_FAILURE, hci_handle, - "attempted to downgrade from Secure Connections mode"); - return; - } + // Drop the connection here if the remote attempts to downgrade from Secure + // Connections mode. + if (btm_sec_is_device_sc_downgrade(hci_handle, sc_supported)) { + acl_set_disconnect_reason(HCI_ERR_HOST_REJECT_SECURITY); + btm_sec_send_hci_disconnect( + p_dev_rec, HCI_ERR_AUTH_FAILURE, hci_handle, + "attempted to downgrade from Secure Connections mode"); + return; } p_dev_rec->remote_feature_received = true;