Skip to content

gateway: request Bluetooth level 2 security when supported #122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mniestroj merged 2 commits into from
Dec 2, 2025
Merged

gateway: request Bluetooth level 2 security when supported #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6be9794
gateway: disable NET_SHELL by default
mniestroj Dec 1, 2025
b40c5dd
gateway: enforce Bluetooth level 2 security
mniestroj Nov 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions gateway/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,15 @@
# Copyright (c) 2025 Golioth, Inc.
# SPDX-License-Identifier: Apache-2.0

configdefault NET_SHELL
default n

configdefault MBEDTLS_USE_PSA_CRYPTO
default n

configdefault MBEDTLS_HEAP_SIZE
default 16384

configdefault BT_CTLR_DATA_LENGTH_MAX
default 251

Expand Down
6 changes: 6 additions & 0 deletions gateway/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,3 +51,9 @@ CONFIG_PSA_WANT_ALG_SHA_384=y
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
CONFIG_PSA_WANT_ECC_SECP_R1_384=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY=y

# Bluetooth secure connections
CONFIG_BT_SMP=y

@sam-golioth sam-golioth Nov 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It took me a second to figure out that this is not the Bluetooth transport for Simple Management Protocol 😅

CONFIG_MBEDTLS_ECP_C=y
# This option is implied by BT_SMP and breaks secp384r1 support
CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=n
53 changes: 53 additions & 0 deletions gateway/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,15 @@ static void bt_connected(struct bt_conn *conn, uint8_t err)

LOG_INF("Connected: %s", addr);

err = bt_conn_set_security(conn, BT_SECURITY_L2);
if (err)
{
LOG_ERR("Failed to set security (%d).", err);

bt_conn_disconnect(conn, BT_HCI_ERR_REMOTE_USER_TERM_CONN);
return;
}

pouch_gateway_bt_start(conn);
}

Expand All @@ -177,9 +186,47 @@ static void bt_disconnected(struct bt_conn *conn, uint8_t reason)
pouch_gateway_scan_start();
}

static void security_changed(struct bt_conn *conn, bt_security_t level, enum bt_security_err err)
{
LOG_INF("BT security changed to level %u, err %s(%u)", level, bt_security_err_to_str(err), err);
}

BT_CONN_CB_DEFINE(conn_callbacks) = {
.connected = bt_connected,
.disconnected = bt_disconnected,
.security_changed = security_changed,
};

static void auth_cancel(struct bt_conn *conn)
{
char addr[BT_ADDR_LE_STR_LEN];

bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

LOG_INF("Pairing cancelled: %s", addr);
}

static struct bt_conn_auth_cb auth_cb = {
.cancel = auth_cancel,
};

static void pairing_complete(struct bt_conn *conn, bool bonded)
{
LOG_INF("Pairing Complete");
}

static void pairing_failed(struct bt_conn *conn, enum bt_security_err reason)
{
LOG_WRN("Pairing Failed (%d). Disconnecting.", reason);

bt_conn_disconnect(conn,
(reason == BT_SECURITY_ERR_PAIR_NOT_ALLOWED) ? BT_HCI_ERR_PAIRING_NOT_ALLOWED
: BT_HCI_ERR_AUTH_FAIL);
}

static struct bt_conn_auth_info_cb auth_info_cb = {
.pairing_complete = pairing_complete,
.pairing_failed = pairing_failed,
};

void pouch_gateway_bt_finished(struct bt_conn *conn)
Expand All @@ -205,6 +252,12 @@ int main(void)
return err;
}

if (IS_ENABLED(CONFIG_BT_SMP))
{
bt_conn_auth_cb_register(&auth_cb);
bt_conn_auth_info_cb_register(&auth_info_cb);
}

LOG_INF("Bluetooth initialized");

pouch_gateway_scan_start();
Expand Down
6 changes: 6 additions & 0 deletions samples/custom_connect/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,15 @@
# Copyright (c) 2025 Golioth, Inc.
# SPDX-License-Identifier: Apache-2.0

configdefault NET_SHELL
default n

configdefault MBEDTLS_USE_PSA_CRYPTO
default n

configdefault MBEDTLS_HEAP_SIZE
default 16384

configdefault BT_CTLR_DATA_LENGTH_MAX
default 251

Expand Down
6 changes: 6 additions & 0 deletions samples/custom_connect/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,3 +51,9 @@ CONFIG_PSA_WANT_ALG_SHA_384=y
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
CONFIG_PSA_WANT_ECC_SECP_R1_384=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY=y

# Bluetooth secure connections
CONFIG_BT_SMP=y
CONFIG_MBEDTLS_ECP_C=y
# This option is implied by BT_SMP and breaks secp384r1 support
CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=n
53 changes: 53 additions & 0 deletions samples/custom_connect/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,15 @@ static void bt_connected(struct bt_conn *conn, uint8_t err)

LOG_INF("Connected: %s", addr);

err = bt_conn_set_security(conn, BT_SECURITY_L2);
if (err)
{
LOG_ERR("Failed to set security (%d).", err);

bt_conn_disconnect(conn, BT_HCI_ERR_REMOTE_USER_TERM_CONN);
return;
}

sync_data.conn = conn;
sync_data.counter = 0;

Expand All @@ -152,9 +161,47 @@ static void bt_disconnected(struct bt_conn *conn, uint8_t reason)
custom_scan_start();
}

static void security_changed(struct bt_conn *conn, bt_security_t level, enum bt_security_err err)
{
LOG_INF("BT security changed to level %u, err %s(%u)", level, bt_security_err_to_str(err), err);
}

BT_CONN_CB_DEFINE(conn_callbacks) = {
.connected = bt_connected,
.disconnected = bt_disconnected,
.security_changed = security_changed,
};

static void auth_cancel(struct bt_conn *conn)
{
char addr[BT_ADDR_LE_STR_LEN];

bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

LOG_INF("Pairing cancelled: %s", addr);
}

static struct bt_conn_auth_cb auth_cb = {
.cancel = auth_cancel,
};

static void pairing_complete(struct bt_conn *conn, bool bonded)
{
LOG_INF("Pairing Complete");
}

static void pairing_failed(struct bt_conn *conn, enum bt_security_err reason)
{
LOG_WRN("Pairing Failed (%d). Disconnecting.", reason);

bt_conn_disconnect(conn,
(reason == BT_SECURITY_ERR_PAIR_NOT_ALLOWED) ? BT_HCI_ERR_PAIRING_NOT_ALLOWED
: BT_HCI_ERR_AUTH_FAIL);
}

static struct bt_conn_auth_info_cb auth_info_cb = {
.pairing_complete = pairing_complete,
.pairing_failed = pairing_failed,
};

static void sync_start_handler(struct k_work *work)
Expand Down Expand Up @@ -198,6 +245,12 @@ int main(void)
return err;
}

if (IS_ENABLED(CONFIG_BT_SMP))
{
bt_conn_auth_cb_register(&auth_cb);
bt_conn_auth_info_cb_register(&auth_info_cb);
}

LOG_INF("Bluetooth initialized");

custom_scan_start();
Expand Down