Hi Alain, On Mon, Mar 9, 2020 at 7:37 PM Alain Michaud <alainm@xxxxxxxxxxxx> wrote: > > HOGP 1.0 Section 6.1 establishes that the HOGP must require bonding. > > Reference: > https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00352.htm > --- > > profiles/input/hog.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/profiles/input/hog.c b/profiles/input/hog.c > index 83c017dcb..dfac68921 100644 > --- a/profiles/input/hog.c > +++ b/profiles/input/hog.c > @@ -186,6 +186,10 @@ static int hog_accept(struct btd_service *service) > return -EINVAL; > } > > + /* HOGP 1.0 Section 6.1 requires bonding */ > + if (!device_is_bonded(device, btd_device_get_bdaddr_type(device))) > + return -ECONNREFUSED; Perhaps attempting to elevate the security level would be better than just refuse to attach the instance since otherwise we may end up with connecting services like battery, etc, leaving the device half working. > /* TODO: Replace GAttrib with bt_gatt_client */ > bt_hog_attach(dev->hog, attrib); > > -- > 2.25.1.481.gfbce0eb801-goog > -- Luiz Augusto von Dentz
