Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Sender: "yudiliu via sendgmr" <yudiliu@yudiliu.mtv.corp.google.com>
Date:   Thu, 24 Sep 2020 14:05:31 -0700
Message-Id: <20200924140527.Bluez.v1.1.Iedecbb8c8ebb111b14206dddc5bea3c40dfa1771@changeid>
Mime-Version: 1.0
Subject: [Bluez PATCH v1] device: Disable auto connect when pairing failed
From:   Yu Liu <yudiliu@google.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     Yu Liu <yudiliu@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

When connecting a LE keyboard, if the user input the wrong passkey, the
stack would keep auto connect and thus allow the user to retry the
passkey indefinitely which is a security concern. This fix would
disallow the auto connect if the authentication failed.

---

Changes in v1:
- Initial change

 src/device.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/device.c b/src/device.c
index a4b5968d4..764cca60e 100644
--- a/src/device.c
+++ b/src/device.c
@@ -6033,11 +6033,17 @@ void device_bonding_complete(struct btd_device *device, uint8_t bdaddr_type,
 		device_cancel_authentication(device, TRUE);
 
 		/* Put the device back to the temporary state so that it will be
-		 * treated as a newly discovered device.
+		 * treated as a newly discovered device; also disable auto
+		 * connect.
 		 */
 		if (!device_is_paired(device, bdaddr_type) &&
-				!device_is_trusted(device))
+				!device_is_trusted(device)) {
 			btd_device_set_temporary(device, true);
+			if (device->auto_connect) {
+				device->disable_auto_connect = TRUE;
+				device_set_auto_connect(device, FALSE);
+			}
+		}
 
 		device_bonding_failed(device, status);
 		return;
-- 
2.28.0.681.g6f77f65b4e-goog