Reject non-LESC pairing (not allowing Legacy pairing)

[Nathan O.]

Hi,

I am working on a product based on an nRF52832 (SDK 15.3, Softdevice S112 v6.1).

For security purposes, I would like to restrict the pairing / bonding procedure to LE Secure connections. It should therefore forbid any pre-4.2 BLE device to connect to my product but that's ok.

To achieve that, I tried the following code :

        case BLE_GAP_EVT_SEC_PARAMS_REQUEST:
            NRF_LOG_DEBUG("BLE_GAP_EVT_SEC_PARAMS_REQUEST");
            if (p_ble_evt->evt.gap_evt.params.sec_params_request.peer_params.lesc == 0)
            {
                NRF_LOG_DEBUG("Legacy security request, not LESC");
                // Reject pairing
                err_code = sd_ble_gap_sec_params_reply(m_conn_handle, BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP, NULL, NULL);
                APP_ERROR_CHECK(err_code);
            }

Unfortunately, when I do that and try to connect with an old smartphone, I get the following error log :

<info> app: Connected<\r><\r><\n>
<debug> nrf_ble_gatt: ATT MTU updated to 247 bytes on connection 0x0 (response).<\r><\r><\n>
<info> app: Data len is set to 0xF4(244)<\r><\r><\n>
<debug> app: ATT MTU exchange completed. central 0xF7 peripheral 0xF7<\r><\r><\n>
<debug> peer_manager_handler: Event PM_EVT_CONN_SEC_START<\r><\r><\n>
<debug> peer_manager_handler: Connection security procedure started: role: Peripheral, conn_handle: 0, procedure: Bonding<\r><\r><\n>
<debug> peer_manager_handler: Event PM_EVT_CONN_SEC_PARAMS_REQ<\r><\r><\n>
<debug> peer_manager_handler: Security parameter request<\r><\r><\n>
<debug> app: BLE_GAP_EVT_SEC_PARAMS_REQUEST<\r><\r><\n>
<debug> app: Legacy security request, not LESC<\r><\r><\n>
<error> app: ERROR 8 [NRF_ERROR_INVALID_STATE] at C:\Workspace\loreal_b4_billy\billy_firmware\billy_ble\billy_connection.c:503<\r><\r><\n>
PC at: 0x00030A39<\r><\r><\n>
<error> app: End of error report<\r><\r><\n>

The documentation states that this error should happen if the function is called outside of the SEC_PARAMS_REQUEST event but I am indeed in this event so I don't understand the error.

Anyone has an idea ?

Thanks.

[Turbo J]

The BLE_GAP_EVT_SEC_PARAMS_REQUEST is handled by the peer manager, which probably has already called sd_ble_gap_sec_params_reply() function.

Try the PM_EVT_CONN_SEC_PARAMS_REQ event in the peer manager event handler function - using pm_conn_sec_params_reply() with a NULL p_sec_params pointer (that rejects security procedure).

[Nathan O.]

Thanks.

I have implemented this change and it first seemed to work.

Unfortunately, it seems that I still have an issue :

When I connect to my device with a smartphone that supports LESC, the connection is established correctly. If I disconnect and try reconnecting again, I get into an error because PM_EVT_CONN_SEC_PARAMS_REQ seems to happen before BLE_GAP_EVT_CONNECTED, so I end up calling sd_ble_gap_sec_params_reply with a conn_handle of 0xFFFF.

Is it normal to get PM_EVT before GAP_EVT_CONNECTED ?

[Turbo J]

You are not supposed to call sd_ble_gap_sec_params_reply directly - use pm_conn_sec_params_reply instead.

The PM events all supply a conn_handle in the event argument

And yes, dependig on how handlers priorities are set up, you might get the PM event before the BLE_GAP_EVT_CONNECTED was delivered to your applications event handler.

[Nathan O.]

Thanks, I no longer have an error.

I am still wondering though why I am getting SEC_PARAMS_REQ event with lesc flag at 0 on connections after the first one (to a bonded device). Can you explain this ?