nRF52832 pm_conn_secure() return 0x3002

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Tue, 26 Jul 2022 11:08:59 GMT

Thanks for your comment!

RE: nRF52832 pm_conn_secure() return 0x3002

Hung Bui — Tue, 26 Jul 2022 11:05:04 GMT

If you use the dongle on the central side , there is a big chance that the dongle didn't store bond information.
This will lead to the issue that the dongle will try to re-bond to the device on the next connection.
And if the device is already bonded, and if it has allow_repairing = false, it will return BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP . Because a re-pair is not allowed.
So it's correct to set allow_repairing= true if your central device can't store and reuse bond information.

Also , next time when you post your code/log, please put them into the Code section (Insert -> Code)

Please try to use the example in the SDK as the referral code. If you only do the same features as the example, you wouldn't need to modify anything outside what implemented in the example.

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Tue, 26 Jul 2022 03:26:36 GMT

When I changing .allow_repairing to true in handing PM_EVT_CONN_SEC_CONFIG_REQ event. When I restart nRF connect. nRF connect pop up Windows for user to enter passkey at fist time. And nRF connect doesn't pop up Windows for user to enter passkey after second time. And no Authentication failed with status BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP issue. Is it good idea to change .allow_repairing to true?

static void _pmEvtHandler(pm_evt_t const * pEvt) {
    switch (pEvt->evt_id) {
        case PM_EVT_CONN_SEC_CONFIG_REQ:
        {
            NRF_LOG_INFO("PM_EVT_CONN_SEC_CONFIG_REQ\n");
            // Reject pairing request from an already bonded peer.
            pm_conn_sec_config_t config = {.allow_repairing = true};
            pm_conn_sec_config_reply(pEvt->conn_handle, &config);
        }
        break;
    ...
}

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Tue, 26 Jul 2022 02:28:15 GMT

I use nRF52840 dongle on the central side. But Wireshark can't find nRF sniffer.

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Tue, 26 Jul 2022 02:25:38 GMT

Thanks for your help! I have fixed error 0x3002 by adding BLE_ERROR_INVALID_CONN_HANDLE checking before calling pm_conn_secure().

static void _securityRequestHandler(void* pContext) {
    if (m_cur_conn_handle != BLE_CONN_HANDLE_INVALID) {
        const ret_code_t errCode = pm_conn_secure(m_cur_conn_handle, false);
        if (errCode != NRF_SUCCESS) {
            NRF_LOG_WARNING("pm_conn_secure() failed, errCode=0x%x\n", errCode);
            return;
        }
    }
}

But nRF Connect still can't connect to nRF52832 device with "Authentication failed with status BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP". Could you provide bonding example?

nRF52832 log messages:

0> <debug> nrf_ble_gatt: Requesting to update ATT MTU to 185 bytes on connection 0x0.
0> <info> app: PM_EVT_BONDED_PEER_CONNECTED
0>
0> <info> app: BLE_GAP_EVT_CONNECTED
0>
0> <debug> app: state=1
0>
0> <debug> nrf_ble_gatt: ATT MTU updated to 185 bytes on connection 0x0 (response).
0> <debug> app: _securityRequestHandler
0>
0> <debug> peer_manager: pm_conn_secure() e
0>
0> <debug> peer_manager_sm: sm_link_secure() e
0>
0> <debug> peer_manager_sm: link_secure() e
0>
0> <debug> peer_manager_smd: smd_link_secure() e
0>
0> <debug> peer_manager_smd: smd_link_secure() e
0>
0> <debug> peer_manager_smd: link_secure_authenticate() e
0>
0> <debug> peer_manager_smd: link_secure_authenticate() return 0x0
0>
0> <debug> peer_manager_smd: smd_link_secure() return 0x0
0>
0> <debug> peer_manager_sm: link_secure() return 0x0
0>
0> <debug> peer_manager_sm: pm_conn_secure() return 0x0
0>
0> <warning> peer_manager: pm_conn_secure() return 0x0
0>
0> <debug> peer_manager_smd: smd_params_reply() e
0>
0> <info> app: PM_EVT_CONN_SEC_CONFIG_REQ
0>
0> <debug> peer_manager_smd: smd_params_reply() BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP 2
0>
0> <debug> peer_manager_smd: smd_params_reply() return 0x0
0>
0> <info> app: BLE_GAP_EVT_SEC_PARAMS_REQUEST
0>
0> <info> app: PM_EVT_CONN_SEC_FAILED
0> <info> app: Faield to secure connection with handle 00
0>
0> <info> app: BLE_GAP_EVT_AUTH_STATUS
0>
0> <warning> app: sd_ble_gap_disconnect() failed, errCode=0x3002
0>
0> <info> app: BLE_GAP_EVT_DISCONNECTED
0>
0> <debug> app: _gFstorageState=0
0>
0> <debug> app: state=0

nRF Connect log messages:

nRF5x
F0:92:AF:29:DA:F8
Generic Access
Generic Attribute
10:42:15.236   Using nrf-device-lib-js version: 0.4.11
10:42:15.236   Using nrf-device-lib version: 0.11.8
10:42:15.237   Using nrfjprog DLL version: 10.15.4
10:42:15.237   Using JLink version: JLink_V7.66a
10:42:15.260   Installed JLink version does not match the provided version (V7.58b)
10:42:15.434   Updated list of uuids with data from github.com/.../v1
10:42:17.650   Selected device with s/n F092AF29DAF8
10:42:17.657   Device setup completed
10:42:17.658   Connectivity firmware version: ble-connectivity 4.1.4+Mar-11-2021-08-36-04. SoftDevice API version: 5. Baud rate: 1000000.
10:42:17.658   Opening adapter connected to COM5
10:42:18.592   Successfully opened COM5. Baud rate: 1000000. Flow control: none. Parity: none.
10:42:18.594   Reset performed on adapter COM5
10:42:19.662   Adapter connected to COM5 opened
10:42:21.285   Scan started
10:42:28.131   Connecting to device
10:42:30.949   Connected to device E8:20:9F:75:90:08: interval: 7.5ms, timeout: 4000ms, latency: 0
10:42:30.973   ATT MTU updated for device E8:20:9F:75:90:08, new value is 185
10:42:31.231   Attribute value read, handle: 0x03, value (0x): 41-4E-43-53-32
10:42:32.469   Authentication failed with status BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP
10:42:32.492   Disconnected from device E8:20:9F:75:90:08, reason: BLE_HCI_REMOTE_USER_TERMINATED_CONNECTION

RE: nRF52832 pm_conn_secure() return 0x3002

Hung Bui — Mon, 25 Jul 2022 12:35:11 GMT

Hi,

Error 0x3002 means BLE_ERROR_INVALID_CONN_HANDLE .
Please check how pm_conn_secure() is called.

I've noticed that you have opened quite a few support cases regarding the same issue on pairing. Please try to focus on one ticket.

I would suggest to study the example and make as few modification as possible.

Which device you used on the central side ?
Please try to capture a sniffer trace.

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Mon, 25 Jul 2022 09:14:31 GMT

I found sec_status is set to BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP in smd_params_reply(). So nRF Connect shows "Authentication failed with status BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP".

log messages.

# SEGGER J-Link RTT Viewer V6.32i Terminal Log File
# Compiled: 15:22:50 on Jul 24 2018
# Logging started @ 25 Jul 2022 17:00:50
0> <info> app: Version 1.0.0
0>
0> <info> app: ========| flash info |========
0> <info> app: erase unit: 4096 bytes
0> <info> app: program unit: 4 bytes
0> <info> app: end address: 0x7FFFF
0> <info> app: ==============================
0> <info> app_timer: RTC: initialized.
0> <debug> app: NOR_DATA_PERIOD=819
0>
0> <debug> app: NOR_RECORD_PERIOD=8192
0>
0> <info> app: bsp_button_longkey_handler 0.
0> <warning> app: Battery volage 222mV is too low
0>
0> <warning> app: Battery volage 42mV is too low
0>
0> <warning> app: Battery volage 0mV is too low
0>
0> <info> app: POWER_ON.
0> <info> app: External devices initializing start
0> <info> app: External devices initializing finish
0> <info> app: bsp_button_longkey_handler 1.
0> <debug> nrf_ble_gatt: Requesting to update ATT MTU to 185 bytes on connection 0x0.
0> <info> app: PM_EVT_BONDED_PEER_CONNECTED
0>
0> <info> app: BLE_GAP_EVT_CONNECTED
0>
0> <debug> app: state=1
0>
0> <debug> nrf_ble_gatt: ATT MTU updated to 185 bytes on connection 0x0 (response).
0> <debug> peer_manager_smd: smd_params_reply() e
0>
0> <info> app: PM_EVT_CONN_SEC_CONFIG_REQ
0>
0> <debug> peer_manager_smd: smd_params_reply() BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP 2
0>
0> <debug> peer_manager_smd: smd_params_reply() return 0x0
0>
0> <info> app: BLE_GAP_EVT_SEC_PARAMS_REQUEST
0>
0> <info> app: PM_EVT_CONN_SEC_FAILED
0> <info> app: Faield to secure connection with handle 00
0>
0> <info> app: BLE_GAP_EVT_AUTH_STATUS
0>
0> <warning> app: sd_ble_gap_disconnect() failed, errCode=0x3002
0>
0> <info> app: BLE_GAP_EVT_DISCONNECTED
0>
0> <debug> app: state=0
0>
0> <debug> app: _securityRequestHandler
0>

ret_code_t smd_params_reply(uint16_t                 conn_handle,
                            ble_gap_sec_params_t   * p_sec_params,
                            ble_gap_lesc_p256_pk_t * p_public_key)
{
    NRF_LOG_DEBUG("smd_params_reply() e\n");
    NRF_PM_DEBUG_CHECK(m_module_initialized);

    uint8_t              role       = ble_conn_state_role(conn_handle);
    ret_code_t           err_code   = NRF_SUCCESS;
    uint8_t              sec_status = BLE_GAP_SEC_STATUS_SUCCESS;
    ble_gap_sec_keyset_t sec_keyset;

    memset(&sec_keyset, 0, sizeof(ble_gap_sec_keyset_t));
    if (role == BLE_GAP_ROLE_PERIPH)
    {
        // Set the default value for allowing repairing at the start of the sec proc. (for peripheral)
        ble_conn_state_user_flag_set(conn_handle, m_flag_allow_repairing, false);
    }

    if (role == BLE_GAP_ROLE_INVALID)
    {
        return BLE_ERROR_INVALID_CONN_HANDLE;
    }

#if PM_RA_PROTECTION_ENABLED
    if (ast_peer_blacklisted(conn_handle)) //Check for repeated attempts here.
    {
        sec_status = BLE_GAP_SEC_STATUS_REPEATED_ATTEMPTS;
    }
    else
#endif // PM_RA_PROTECTION_ENABLED
    if (p_sec_params == NULL)
    {
        // NULL params means reject pairing.
        sec_status = BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP;
        NRF_LOG_DEBUG("smd_params_reply() BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP 1\n");
    }
    else
    {
        if ((im_peer_id_get_by_conn_handle(conn_handle) != PM_PEER_ID_INVALID) &&
            (role == BLE_GAP_ROLE_PERIPH) &&
            !allow_repairing(conn_handle))
        {
            // Bond already exists. Reject the pairing request if the user doesn't intervene.
            send_config_req(conn_handle);
            if (!allow_repairing(conn_handle))
            {
                // Reject pairing.
                sec_status = BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP;
                NRF_LOG_DEBUG("smd_params_reply() BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP 2\n");
            }
        }

        if (!p_sec_params->bond)
        {
            // Pairing, no bonding.
            sec_keyset.keys_own.p_pk = p_public_key;
            sec_keyset.keys_peer.p_pk = &m_peer_pk;
        }
        else if (sec_status != BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP)
        {
            // Bonding is to be performed, prepare to receive bonding data.
            err_code = sec_keyset_fill(conn_handle, role, p_public_key, &sec_keyset);
        }
    }

    if (err_code == NRF_SUCCESS)
    {
        // Everything OK, reply to SoftDevice. If an error happened, the user is given an
        // opportunity to change the parameters and retry the call.
        if (role == BLE_GAP_ROLE_PERIPH)
        {
            err_code = sd_ble_gap_sec_params_reply(conn_handle, sec_status, p_sec_params, &sec_keyset);
        }
        else
        {
            err_code = sd_ble_gap_sec_params_reply(conn_handle, sec_status, NULL, &sec_keyset);
        }
    }

    NRF_LOG_DEBUG("smd_params_reply() return 0x%x\n", err_code);
    return err_code;
}

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Mon, 25 Jul 2022 05:49:19 GMT

int main(void) {

    timerInit();
    peerManagerInit();
    gapParamsInit();
    services_init();
    advertisingInit();
    conn_params_init();
    ...
}

#define SECURITY_REQUEST_PERIOD         APP_TIMER_TICKS(2500)

int timerInit(void) {
    ret_code_t errCode = app_timer_create(&_gSecRequestTimerID, APP_TIMER_MODE_SINGLE_SHOT, _securityRequestHandler);
    if (errCode != NRF_SUCCESS) {
        NRF_LOG_WARNING("app_timer_create(_gSecRequestTimerID) failed\n");
        return ERROR_TIMER_CREATE_FAIL;
    }

    _gTimerSecRequestRunning      = false;

    ...

    return 0;
}

int timerSecRequestStart(void) {
    if (!_gTimerSecRequestRunning) {
        const ret_code_t errCode = app_timer_start(_gSecRequestTimerID, SECURITY_REQUEST_PERIOD, NULL);
        if (errCode != NRF_SUCCESS) {
            NRF_LOG_WARNING("app_timer_start(_gSecRequestTimerID) failed\n");
            return ERROR_TIMER_START_FAIL;
        }
    }

    _gTimerSecRequestRunning = true;

    return 0;
}

static void ble_evt_handler(ble_evt_t const* pBleEvt, void* pContext)
{
    ret_code_t errCode = NRF_SUCCESS;

    switch (pBleEvt->header.evt_id)
    {
        case BLE_GAP_EVT_CONNECTED:
        {
            NRF_LOG_INFO("BLE_GAP_EVT_CONNECTED\n");
            BLE_UART_SetState(BLE_NUS_STATE_CONNECT);
            errCode = bsp_indication_set(BSP_INDICATE_CONNECTED);
            if (errCode != NRF_SUCCESS) {
                NRF_LOG_WARNING("bsp_indication_set() failed, errCode=0x%x\n", errCode);
                return;
            }

            m_cur_conn_handle = pBleEvt->evt.gap_evt.conn_handle;

            errCode = nrf_ble_qwr_conn_handle_assign(&m_qwr, m_cur_conn_handle);
            if (errCode != NRF_SUCCESS) {
                NRF_LOG_WARNING("nrf_ble_qwr_conn_handle_assign() failed, errCode=0x%x\n", errCode);
                return;
            }

#if PASSKEY_ENABLED
            ble_gap_sec_params_t secParam;
            securityParametersGet(&secParam);
            //secParam.bond           = SEC_PARAM_BOND;
            //secParam.mitm           = SEC_PARAM_MITM;
            errCode = sd_ble_gap_authenticate(m_cur_conn_handle, &secParam);
            if (errCode != NRF_SUCCESS) {
                NRF_LOG_WARNING("sd_ble_gap_authenticate() failed, errCode=0x%x\n", errCode);
                return;
            }
#endif
        }
        break;

        case BLE_GAP_EVT_DISCONNECTED:
        {
            NRF_LOG_INFO("BLE_GAP_EVT_DISCONNECTED\n");
            if (fstorageGetState() == FSTORAGE_STATE_ERASED) {
                fstorageWaitUpdateRecordFinish();
            }
            BLE_UART_SetState(BLE_NUS_STATE_DISCONNECT);
            m_cur_conn_handle = BLE_CONN_HANDLE_INVALID;
        }
        break;

        case BLE_GAP_EVT_SEC_PARAMS_REQUEST:
        {
            NRF_LOG_INFO("BLE_GAP_EVT_SEC_PARAMS_REQUEST\n");
#if 0

            ble_gap_sec_params_t secParam;
            securityParametersGet(&secParam);
            errCode = sd_ble_gap_sec_params_reply(m_cur_conn_handle,
                                                  BLE_GAP_SEC_STATUS_SUCCESS,
                                                  &secParam,
                                                  NULL);
            if ((errCode != NRF_SUCCESS) && (errCode != NRF_ERROR_INVALID_STATE)) {
                NRF_LOG_WARNING("sd_ble_gap_sec_params_reply() failed, errCode=0x%x\n", errCode);
                return;
            }

#endif
        }
        break;

        case BLE_GAP_EVT_AUTH_STATUS:
        {
            NRF_LOG_INFO("BLE_GAP_EVT_AUTH_STATUS\n");
#if PASSKEY_ENABLED
            if (pBleEvt->evt.gap_evt.params.auth_status.auth_status != BLE_GAP_SEC_STATUS_SUCCESS) {
                errCode = sd_ble_gap_disconnect(m_cur_conn_handle,
                                                BLE_HCI_REMOTE_USER_TERMINATED_CONNECTION);
                if (errCode != NRF_SUCCESS) {
                    NRF_LOG_WARNING("sd_ble_gap_disconnect() failed, errCode=0x%x\n", errCode);
                    return;
                }
            }
#endif
        }
        break;

        default:
            // No implementation needed.
        break;
    }
}

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Mon, 25 Jul 2022 05:48:06 GMT

devzone.nordicsemi.com/.../1018.security.c devzone.nordicsemi.com/.../8865.gap.h devzone.nordicsemi.com/.../6712.gap.c devzone.nordicsemi.com/.../5226.security.h

RE: nRF52832 pm_conn_secure() return 0x3002

snowuyl — Mon, 25 Jul 2022 05:47:07 GMT