When connecting a LE keyboard, if the user input the wrong passkey, the
stack would keep auto connect and thus allow the user to retry the
passkey indefinitely which is a security concern. This fix would
disallow the auto connect if the authentication failed.
---
Changes in v1:
- Initial change
src/device.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/device.c b/src/device.c
index a4b5968d4..764cca60e 100644
--- a/src/device.c
+++ b/src/device.c
@@ -6033,11 +6033,17 @@ void device_bonding_complete(struct btd_device *device, uint8_t bdaddr_type,
device_cancel_authentication(device, TRUE);
/* Put the device back to the temporary state so that it will be
- * treated as a newly discovered device.
+ * treated as a newly discovered device; also disable auto
+ * connect.
*/
if (!device_is_paired(device, bdaddr_type) &&
- !device_is_trusted(device))
+ !device_is_trusted(device)) {
btd_device_set_temporary(device, true);
+ if (device->auto_connect) {
+ device->disable_auto_connect = TRUE;
+ device_set_auto_connect(device, FALSE);
+ }
+ }
device_bonding_failed(device, status);
return;
--
2.28.0.681.g6f77f65b4e-goog
