Change or upgrade the bluetooth security level #993
Replies: 2 comments 3 replies
-
|
@Vudentz could you please help me here? |
Beta Was this translation helpful? Give feedback.
-
|
@Prashaanth06 for GATT we do the encryption when an attribute return an error: https://github.com/bluez/bluez/blob/master/src/shared/att.c#L748 So we follow what the security required by the server, otherwise we could end up requesting a security level that the server doesn't support and fail in the process. Btw, the security is then set via socket option BT_SECURITY: https://github.com/bluez/bluez/blob/master/doc/l2cap.rst#bt_security-since-linux-2630 So if the security is left to BT_SECURITY_LOW it probably means there is no attribute requiring encryption to change the security. |
Beta Was this translation helpful? Give feedback.
-
|
I figured out up to some extent that when I initiate the pairing only then I can move to security level 2. I changed the alwaysPairable = true in the main.conf file and it triggered the pairing pop up when I initiate pairing it's choosing the passkey pairing mechanism instead of just works pairing. I don't have a monitor in my embedded device so I don't want MITM and I am trying to achieve only encryption. So, using the sniffer I checked the logs during the pairing process the MITM flag is true. These are the btmon logs:
When I check in bluez 5.55 code i couldn't figure out how where the security level is set to high I believe because of that only it's initiating to security level 3 instead of level 2. How do I achieve just works pairing? How do I move to security level 2? |
Beta Was this translation helpful? Give feedback.
-
Well this explain it already, you don't have any agent registered to authorize the pairing, note that authorization != authentication, so even if just works method is used you still will need an agent to authorize the pairing to proceed, you can use bluetoothctl -a auto if you want to automatically authorize pairing. |
Beta Was this translation helpful? Give feedback.
-
|
I have registered an agent now and it's set to default agent I could see that pairing process is going good and it's moving to security level2 also. I wont be able to use bluetoothctl because that's disabled for me, currently I am doing it through c programming with sd-bus.h library which runs in linux platform. I have one api to register an agent and make that default and another api to authenticate the request. busctl monitor logs from org.bluez:
Once the device is Paired and Bonded the properties are changing to true but once pairing is successful the services resolved property is also toggling from True to false. Why is that happening? @Vudentz please provide your inputs to resolve this issue? When I just register agent alone and don't perform my custom request authentication it returns with this error daemon logs: I tried this way to get rid of the services resolved issue but doesn't happen. I went through this page where Request authorization method is inbuilt available how to use that I am using sd-bus.h library and trying to check after registering the agent. Should I do any additional step? I have moved to bluez 5.65 now |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Currently I am using bluez 5.55 version and I have developed a gatt server for read, write and notify and things are working as expected, able to send and receive data. When I checked for the security level of bluetooth I got to know that it is falling back to security mode 1 and level 1(got to know after performing bluetooth sniffing using nrf52840 dongle) which has no encryption and authentication.
I am using Just works pairing mechanism so my aim is to atleast move to security mode 1 and level 2(encryption: yes and authentication: No) I checked in the main.conf file of bluez 5.55 I dont have any properties related to security so, I tried to move to bluez 5.78 which is the latest and tried setting this property SecureConnection = on and SecureConnection = only then restarted the bluetooth daemon,
Logs after the change:
bluetoothd[1269]: Bluetooth daemon 5.78
bluetoothd[1269]: src/main.c:check_config() Unknown group AVRCP in /etc/bluetooth/main.conf
bluetoothd[1269]: src/main.c:parse_config() parsing /etc/bluetooth/main.conf
bluetoothd[1269]: src/main.c:parse_config_string() General.SecureConnections = only
bluetoothd[1269]: src/adapter.c:adapter_init() sending read version command
bluetoothd[1269]: Starting SDP server
In logs I could see that the secureconnections properties is configured to only and I am using bluez 5.78 but still I see it's in security level 1. How to upgrade to security level2 ?
I am checking the security level when it's pairing with a nomadic device. I am pretty sure that the nomadic device also supports secured connections. Am I missing something how do I approach to upgrade to security level 2?
Beta Was this translation helpful? Give feedback.
All reactions