kleidos/test/ble/test_pairing_window/ at main · jmrp.io/kleidos

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

Fork 0

kleidos / test / ble / test_pairing_window /

at main 1 file

José M. Requena Plens Restrict connections to bonded hosts via the accept-list after bonding (E2) 1mo ago

bffebba7

test_pairing_window.cpp

Restrict connections to bonded hosts via the accept-list after bonding (E2) E2 (research S2) shrinks the pre-SMP attack surface once at least one host is bonded: the raw NimBLE adapter populates the controller accept-list from the bonded identity addresses and advertises with a connection filter policy (BLE_HCI_ADV_FILT_CONN), so a non-bonded central can no longer open a connection (rejected at the link layer, before SMP runs). This mitigates the CVE-2024-0230 "Hi my name is keyboard" HID-injection / spoofed-host class for a device that types passwords over BLE. - Unbonded / first-time pairing stays OPEN so onboarding works unchanged. - A new "pairing window" command on the vendor-free NimBleHostPort lets the FSM TEMPORARILY drop the filter to add an additional host, then restores the accept-list. Default = closed (enforced); every bring-up re-enforces it. The window is wired to the existing StartMode: StandbyForever (onboarding / add a new host) opens it, Bounded30s (normal typing) keeps it closed. - Coexists with E1 RPA on the controller-based-privacy path (ESP32-S3): the controller resolving list resolves a bonded host's rotating RPA to its identity, which then matches the accept-list, so bonded reconnect still works. - On the host-based-privacy path (classic ESP32) NimBLE's ble_gap_wl_set is unsupported while the host resolves the RPA (the accept-list and host-resolved RPAs are mutually exclusive there), so E2 falls back to open advertising and relies on E3 SC-only + R1 GATT-enc + E4 re-pair gate + the per-report live security gate. The fallback is logged once and never breaks pair/reconnect. Adds the setPairingWindow/isPairingWindowOpen command across the port seam (interface + shim + adapter + fake) and a native test pinning the closed-by- default posture, idempotent toggle and bring-up re-enforce. Builds clean on S3 (sticks3_debug) and classic (m5stickc_plus2_debug); native 1131 + 3 new. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

Configure Feed

Configure Feed