Google Git
Sign in
android / platform / system / bt / 70528e4ba01545652b10475aff9e6fc786ffd2a4
commit70528e4ba01545652b10475aff9e6fc786ffd2a4[log] [tgz]
authorBrian Delwiche <delwiche@google.com>Fri May 31 21:50:12 2024 +0000
committerAndroid Build Coastguard Worker <android-build-coastguard-worker@google.com>Mon Jul 15 03:40:11 2024 +0000
tree79d110efff25e3d3404c7808b3e29a52189e6444
parente7f87d23b295d3b3def26061afb3739e1ee71c99 [diff]
Disallow connect with key length downgrade

As a guard against the BLUFFS attack, check security parameters of
incoming connections against cached values and disallow connection if
these parameters are downgraded or changed from their cached values.

This CL adds the connection-time check for session key length.

To test, please validate that bonding can be established and
reestablished against devices with session key lengths of 7 and 16 bits,
that session key lengths of less than 7 bits are refused, and that basic
LE bonding functionality still works.  If it is possible to configure a
remote device to establish a bond with a session key length of 16 bits
and then reduce that key length to <16 bits before reconnection, this
should fail.

Bug: 314331379
Test: m libbluetooth
Test: manual

Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:bd88324876a8664899bd23e926675d7c1b2bbfb2)
Merged-In: I5b931ddb4876b529ed0c2e1138c02382291216ab
Change-Id: I5b931ddb4876b529ed0c2e1138c02382291216ab
1 file changed
tree: 79d110efff25e3d3404c7808b3e29a52189e6444
  1. apex/
  2. audio_a2dp_hw/
  3. audio_bluetooth_hw/
  4. audio_hal_interface/
  5. audio_hearing_aid_hw/
  6. binder/
  7. bta/
  8. btcore/
  9. btif/
  10. build/
  11. common/
  12. conf/
  13. device/
  14. doc/
  15. embdrv/
  16. gd/
  17. hci/
  18. include/
  19. internal_include/
  20. linux_include/
  21. main/
  22. osi/
  23. packet/
  24. profile/
  25. service/
  26. stack/
  27. test/
  28. tools/
  29. types/
  30. udrv/
  31. utils/
  32. vendor_libs/
  33. vnd/
  34. .clang-format
  35. .gitignore
  36. .style.yapf
  37. Android.bp
  38. AndroidTestTemplate.xml
  39. BUILD.gn
  40. build.py
  41. Cargo.toml
  42. CleanSpec.mk
  43. EventLogTags.logtags
  44. METADATA
  45. MODULE_LICENSE_APACHE2
  46. NOTICE
  47. OWNERS
  48. PREUPLOAD.cfg
  49. README.md
  50. rustfmt.toml
  51. TEST_MAPPING
README.md

Fluoride Bluetooth stack

Building and running on AOSP

Just build AOSP - Fluoride is there by default.

Building and running on Linux

Instructions for a Debian based distribution:

  • Debian Bullseye or newer
  • Ubuntu 20.10 or newer
  • Clang-11 or Clang-12
  • Flex 2.6.x
  • Bison 3.x.x (tested with 3.0.x, 3.2.x and 3.7.x)

You‘ll want to download some pre-requisite packages as well. If you’re currently configured for AOSP development, you should have all required packages. Otherwise, you can use the following apt-get list:

sudo apt-get install repo git-core gnupg flex bison gperf build-essential \
  zip curl zlib1g-dev gcc-multilib g++-multilib \
  x11proto-core-dev libx11-dev lib32z-dev libncurses5 \
  libgl1-mesa-dev libxml2-utils xsltproc unzip liblz4-tool libssl-dev \
  libc++-dev libevent-dev \
  flatbuffers-compiler libflatbuffers1 \
  openssl openssl-dev

You will also need a recent-ish version of Rust and Cargo. Please follow the instructions on Rustup to install a recent version.

Download source

mkdir ~/fluoride
cd ~/fluoride
git clone https://android.googlesource.com/platform/system/bt

Install dependencies (require sudo access). This adds some Ubuntu dependencies and also installs GN (which is the build tool we're using).

cd ~/fluoride/bt
build/install_deps.sh

The following third-party dependencies are necessary but currently unavailable via a package manager. You may have to build these from source and install them to your local environment.

  • libchrome
  • modp_b64

We provide a script to produce debian packages for those components, please follow the instructions in build/dpkg/README.txt.

The googletest packages provided by Debian/Ubuntu (libgmock-dev and libgtest-dev) do not provide pkg-config files, so you can build your own googletest using the steps below:

$ git clone https://github.com/google/googletest.git -b release-1.10.0
$ cd googletest        # Main directory of the cloned repository.
$ mkdir build          # Create a directory to hold the build output.
$ cd build
$ cmake ..             # Generate native build scripts for GoogleTest.
$ sudo make install -DCMAKE_INSTALL_PREFIX=/usr

Stage your build environment

For host build, we depend on a few other repositories:

Clone these all somewhere and create your staging environment.

export STAGING_DIR=path/to/your/staging/dir
mkdir ${STAGING_DIR}
mkdir -p ${STAGING_DIR}/external
ln -s $(readlink -f ${PLATFORM2_DIR}/common-mk) ${STAGING_DIR}/common-mk
ln -s $(readlink -f ${PLATFORM2_DIR}/.gn) ${STAGING_DIR}/.gn
ln -s $(readlink -f ${RUST_CRATE_DIR}) ${STAGING_DIR}/external/rust
ln -s $(readlink -f ${PROTO_LOG_DIR}) ${STAGING_DIR}/external/proto_logging

Build

We provide a build script to automate building assuming you've staged your build environment already as above.

./build.py --output ${OUTPUT_DIR} --platform-dir ${STAGING_DIR} --clang

This will build all targets to the output directory you've given. You can also build each stage separately (if you want to iterate on something specific):

  • prepare - Generate the GN rules
  • tools - Generate host tools
  • rust - Build the rust portion of the build
  • main - Build all the C/C++ code
  • test - Build all targets and run the tests
  • clean - Clean the output directory

You can choose to run only a specific stage by passing an arg via --target.

Currently, Rust builds are a separate stage that uses Cargo to build. See gd/rust/README.md for more information.

Run

By default on Linux, we statically link libbluetooth so you can just run the binary directly:

cd ~/fluoride/bt/out/Default
./bluetoothtbd -create-ipc-socket=fluoride