Skip to content

gateway: request Bluetooth level 2 security when supported - #122

Merged
mniestroj merged 2 commits into
mainfrom
bt-security-level-2
Dec 2, 2025
Merged

gateway: request Bluetooth level 2 security when supported#122
mniestroj merged 2 commits into
mainfrom
bt-security-level-2

Conversation

@mniestroj

@mniestroj mniestroj commented Nov 25, 2025

Copy link
Copy Markdown
Collaborator

Request Bluetooth security level 2. Continue if not supported, so that devices without SMP are still supported.

TODO:

  • reduce ROM usage for nrf9160dk

Comment thread gateway/prj.conf
CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY=y

# Bluetooth secure connections
CONFIG_BT_SMP=y

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It took me a second to figure out that this is not the Bluetooth transport for Simple Management Protocol 😅

Comment thread gateway/src/main.c Outdated
@mniestroj
mniestroj force-pushed the bt-security-level-2 branch 3 times, most recently from 2d78cdf to b58c4e4 Compare December 1, 2025 13:35
@mniestroj
mniestroj marked this pull request as ready for review December 1, 2025 13:55
@mniestroj
mniestroj requested a review from sam-golioth December 1, 2025 13:55

@sam-golioth sam-golioth left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we go ahead and make the same changes to samples/custom_connect in this PR? After golioth/pouch#110 merges, that sample will break.

Comment thread gateway/src/main.c Outdated

bt_conn_disconnect(conn, BT_HCI_ERR_REMOTE_USER_TERM_CONN);

pouch_gateway_scan_start();

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also called in bt_disconnected(), so I don't think we need to call it here.

Something else that comes to mind, but that I don't think we should address in this PR, is that we probably need some kind of backoff or quarantine for misbehaving devices so that we don't get stuck in a tight loop trying and failing to connect to the same device over and over again.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dropped pouch_gateway_scan_start().

This config pulls a lot of dependencies, so drop it to save flash
resources.

This saves ~79kB flash for nrf9160dk.
Request Bluetooth security level 2 (encryption and no authentication).

Inrease default mbedTLS heap size from 10k to 16k, so that there is enough
space for storing BT encryption context.

Signed-off-by: Marcin Niestroj <m.niestroj@emb.dev>
@mniestroj
mniestroj force-pushed the bt-security-level-2 branch from 38f1a12 to b40c5dd Compare December 1, 2025 21:06
@mniestroj

Copy link
Copy Markdown
Collaborator Author

Should we go ahead and make the same changes to samples/custom_connect in this PR? After golioth/pouch#110 merges, that sample will break.

Added changes to samples/custom_connect/, to be in sync with golioth/.

@mniestroj
mniestroj merged commit 9abdf71 into main Dec 2, 2025
10 checks passed
@mniestroj
mniestroj deleted the bt-security-level-2 branch December 2, 2025 14:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants