You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@mynewt.apache.org by "gmarull (via GitHub)" <gi...@apache.org> on 2026/10/08 06:49:26 UTC
[PR] nimble/host: add a pairing request GAP event [mynewt-nimble]
gmarull opened a new pull request, #2311:
URL: https://github.com/apache/mynewt-nimble/pull/2311
A peripheral has no way to refuse a pairing request from a peer. The only point where the application is consulted is `BLE_GAP_EVENT_REPEAT_PAIRING`, which is reported for peers that are already bonded. Devices that accept new pairings only at certain times (e.g. while the user has a pairing screen open, or until a first phone is bonded) cannot enforce that, and a peer that knows the device's address can start pairing whenever it likes.
This adds `BLE_GAP_EVENT_PAIRING_REQUEST`, reported once an incoming Pairing Request has passed the local security checks and before the repeat pairing check. The application returns 0 to continue, or a `BLE_SM_ERR_*` reason (e.g. `BLE_SM_ERR_PAIR_NOT_SUPP`) that is sent to the peer in a Pairing Failed command, ending the procedure. Applications that don't handle the event are unaffected.
Tested on a peripheral that rejects pairing from unbonded peers while it is not pairable: the peer receives Pairing Failed (0x05), bonded peers still re-encrypt, and repeat pairing follows `BLE_GAP_EVENT_REPEAT_PAIRING` as before.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] nimble/host: add a pairing request GAP event [mynewt-nimble]
Posted by "gmarull (via GitHub)" <gi...@apache.org>.
gmarull commented on code in PR #2311:
URL: https://github.com/apache/mynewt-nimble/pull/2311#discussion_r4227959803
##########
nimble/host/src/ble_sm.c:
##########
@@ -1890,6 +1890,20 @@ ble_sm_pair_req_rx(uint16_t conn_handle, struct os_mbuf **om,
ble_hs_unlock();
+ /* Give the application an opportunity to reject the request. */
+ if (res->app_status == 0) {
+ rc = ble_gap_pairing_request_event(conn_handle);
+ if (rc != 0) {
+ if (rc < 0 || rc > UINT8_MAX) {
Review Comment:
Done
##########
nimble/host/src/ble_gap.c:
##########
@@ -6896,6 +6896,21 @@ ble_gap_repeat_pairing_event(const struct ble_gap_repeat_pairing *rp)
#endif
}
+int
+ble_gap_pairing_request_event(uint16_t conn_handle)
+{
+#if NIMBLE_BLE_SM && NIMBLE_BLE_CONNECT
Review Comment:
Done
##########
nimble/host/include/host/ble_gap.h:
##########
@@ -992,6 +995,23 @@ struct ble_gap_event {
*/
struct ble_gap_repeat_pairing repeat_pairing;
+ /**
+ * Represents a pairing request received from the peer. The request
+ * has already been validated against the local security
+ * configuration. Return 0 to continue the pairing procedure, or a
+ * BLE_SM_ERR_* reason code to reject it with a Pairing Failed
+ * command (e.g. BLE_SM_ERR_PAIR_NOT_SUPP when the device is not
Review Comment:
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] nimble/host: add a pairing request GAP event [mynewt-nimble]
Posted by "sjanc (via GitHub)" <gi...@apache.org>.
sjanc merged PR #2311:
URL: https://github.com/apache/mynewt-nimble/pull/2311
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] nimble/host: add a pairing request GAP event [mynewt-nimble]
Posted by "sjanc (via GitHub)" <gi...@apache.org>.
sjanc commented on code in PR #2311:
URL: https://github.com/apache/mynewt-nimble/pull/2311#discussion_r4227736902
##########
nimble/host/src/ble_sm.c:
##########
@@ -1890,6 +1890,20 @@ ble_sm_pair_req_rx(uint16_t conn_handle, struct os_mbuf **om,
ble_hs_unlock();
+ /* Give the application an opportunity to reject the request. */
+ if (res->app_status == 0) {
+ rc = ble_gap_pairing_request_event(conn_handle);
+ if (rc != 0) {
+ if (rc < 0 || rc > UINT8_MAX) {
Review Comment:
should probaly check against BLE_SM_ERR_MAX_PLUS_1 ( >=)
##########
nimble/host/include/host/ble_gap.h:
##########
@@ -992,6 +995,23 @@ struct ble_gap_event {
*/
struct ble_gap_repeat_pairing repeat_pairing;
+ /**
+ * Represents a pairing request received from the peer. The request
+ * has already been validated against the local security
+ * configuration. Return 0 to continue the pairing procedure, or a
+ * BLE_SM_ERR_* reason code to reject it with a Pairing Failed
+ * command (e.g. BLE_SM_ERR_PAIR_NOT_SUPP when the device is not
Review Comment:
hmm I'm not sure if we should allow application to return with any code, for now I'd allow only BLE_SM_ERR_PAIR_NOT_SUPP or success (and any other value returned would result in BLE_SM_ERR_UNSPECIFIED being sent)
##########
nimble/host/include/host/ble_gap.h:
##########
@@ -992,6 +995,23 @@ struct ble_gap_event {
*/
struct ble_gap_repeat_pairing repeat_pairing;
+ /**
+ * Represents a pairing request received from the peer. The request
+ * has already been validated against the local security
+ * configuration. Return 0 to continue the pairing procedure, or a
+ * BLE_SM_ERR_* reason code to reject it with a Pairing Failed
+ * command (e.g. BLE_SM_ERR_PAIR_NOT_SUPP when the device is not
+ * accepting new pairings). If the peer is already bonded, this
+ * event is reported before BLE_GAP_EVENT_REPEAT_PAIRING.
+ *
+ * Valid for the following event types:
+ * o BLE_GAP_EVENT_PAIRING_REQUEST
+ */
+ struct {
+ /** The handle of the relevant connection. */
+ uint16_t conn_handle;
Review Comment:
I guess this is enough for now, and extending event if needed is not that of a problem (eg with iocapa or auth info)
##########
nimble/host/src/ble_gap.c:
##########
@@ -6896,6 +6896,21 @@ ble_gap_repeat_pairing_event(const struct ble_gap_repeat_pairing *rp)
#endif
}
+int
+ble_gap_pairing_request_event(uint16_t conn_handle)
+{
+#if NIMBLE_BLE_SM && NIMBLE_BLE_CONNECT
Review Comment:
should probably be limited to peripheral roles support
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org