Add option for Bluetooth security

src/CMakeLists.txt

@@ -420,6 +420,8 @@ list(APPEND SOURCE_FILES
         displayapp/screens/settings/SettingChimes.cpp
         displayapp/screens/settings/SettingShakeThreshold.cpp
         displayapp/screens/settings/SettingBluetooth.cpp
+        displayapp/screens/settings/SettingBluetoothMain.cpp
+        displayapp/screens/settings/SettingBluetoothSecurity.cpp
         displayapp/screens/settings/SettingOTA.cpp
 
         ## Watch faces
@@ -795,6 +797,7 @@ add_definitions(-DFREERTOS)
 add_definitions(-D__STACK_SIZE=1024)
 add_definitions(-D__HEAP_SIZE=0)
 add_definitions(-DMYNEWT_VAL_BLE_LL_RFMGMT_ENABLE_TIME=1500)
+add_definitions(-DMYNEWT_VAL_BLE_RPA_TIMEOUT=900)
 add_definitions(-DLFS_CONFIG=libs/lfs_config.h)
 
 # _sbrk is purposefully not implemented so that builds fail when it is used

src/components/ble/AlertNotificationService.cpp

@@ -2,6 +2,7 @@
 #include <hal/nrf_rtc.h>
 #include <cstring>
 #include <algorithm>
+#include "components/ble/NimbleController.h"
 #include "components/ble/NotificationManager.h"
 #include "systemtask/SystemTask.h"
 
@@ -17,6 +18,8 @@ int AlertNotificationCallback(uint16_t /*conn_handle*/, uint16_t /*attr_handle*/
 }
 
 void AlertNotificationService::Init() {
+  systemTask.nimble().AddCharacteristicSecurity(serviceDefinition);
+
   int res;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);

src/components/ble/BatteryInformationService.cpp

@@ -1,6 +1,7 @@
 #include "components/ble/BatteryInformationService.h"
 #include <nrf_log.h>
 #include "components/battery/BatteryController.h"
+#include "components/ble/NimbleController.h"
 
 using namespace Pinetime::Controllers;
 
@@ -12,8 +13,9 @@ int BatteryInformationServiceCallback(uint16_t /*conn_handle*/, uint16_t attr_ha
   return batteryInformationService->OnBatteryServiceRequested(attr_handle, ctxt);
 }
 
-BatteryInformationService::BatteryInformationService(Controllers::Battery& batteryController)
+BatteryInformationService::BatteryInformationService(Controllers::NimbleController& nimble, Controllers::Battery& batteryController)
   : batteryController {batteryController},
+    nimble {nimble},
     characteristicDefinition {{.uuid = &batteryLevelUuid.u,
                                .access_cb = BatteryInformationServiceCallback,
                                .arg = this,
@@ -30,6 +32,8 @@ BatteryInformationService::BatteryInformationService(Controllers::Battery& batte
 }
 
 void BatteryInformationService::Init() {
+  nimble.AddCharacteristicSecurity(serviceDefinition);
+
   int res = 0;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);

src/components/ble/BatteryInformationService.h

@@ -12,17 +12,19 @@ namespace Pinetime {
 
   namespace Controllers {
     class Battery;
+    class NimbleController;
 
     class BatteryInformationService {
     public:
-      BatteryInformationService(Controllers::Battery& batteryController);
+      BatteryInformationService(Controllers::NimbleController& nimble, Controllers::Battery& batteryController);
       void Init();
 
       int OnBatteryServiceRequested(uint16_t attributeHandle, ble_gatt_access_ctxt* context);
       void NotifyBatteryLevel(uint16_t connectionHandle, uint8_t level);
 
     private:
       Controllers::Battery& batteryController;
+      Controllers::NimbleController& nimble;
       static constexpr uint16_t batteryInformationServiceId {0x180F};
       static constexpr uint16_t batteryLevelId {0x2A19};
 

src/components/ble/CurrentTimeService.cpp

@@ -1,4 +1,5 @@
 #include "components/ble/CurrentTimeService.h"
+#include "components/ble/NimbleController.h"
 #include <nrf_log.h>
 
 using namespace Pinetime::Controllers;
@@ -24,6 +25,8 @@ int CurrentTimeService::OnCurrentTimeServiceAccessed(struct ble_gatt_access_ctxt
 }
 
 void CurrentTimeService::Init() {
+  nimble.AddCharacteristicSecurity(serviceDefinition);
+
   int res;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);
@@ -97,7 +100,7 @@ int CurrentTimeService::OnLocalTimeAccessed(struct ble_gatt_access_ctxt* ctxt) {
   return 0;
 }
 
-CurrentTimeService::CurrentTimeService(DateTime& dateTimeController)
+CurrentTimeService::CurrentTimeService(NimbleController& nimble, DateTime& dateTimeController)
   : characteristicDefinition {
 
                               {.uuid = &ctsLtChrUuid.u,
@@ -118,5 +121,6 @@ CurrentTimeService::CurrentTimeService(DateTime& dateTimeController)
        .characteristics = characteristicDefinition},
       {0},
     },
-    m_dateTimeController {dateTimeController} {
+    m_dateTimeController {dateTimeController},
+    nimble{nimble} {
 }

src/components/ble/CurrentTimeService.h

@@ -11,9 +11,11 @@
 
 namespace Pinetime {
   namespace Controllers {
+    class NimbleController;
+
     class CurrentTimeService {
     public:
-      CurrentTimeService(DateTime& dateTimeController);
+      CurrentTimeService(NimbleController& nimble, DateTime& dateTimeController);
       void Init();
 
       int OnCurrentTimeServiceAccessed(struct ble_gatt_access_ctxt* ctxt);
@@ -52,6 +54,7 @@ namespace Pinetime {
       } CtsLocalTimeData;
 
       DateTime& m_dateTimeController;
+      NimbleController& nimble;
     };
   }
 }

src/components/ble/DfuService.cpp

@@ -71,6 +71,8 @@ DfuService::DfuService(Pinetime::System::SystemTask& systemTask,
 }
 
 void DfuService::Init() {
+  systemTask.nimble().AddCharacteristicSecurity(serviceDefinition);
+
   int res;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);
@@ -90,6 +92,8 @@ int DfuService::OnServiceData(uint16_t connectionHandle, uint16_t attributeHandl
     systemTask.PushMessage(Pinetime::System::Messages::OnNewNotification);
     return BLE_ATT_ERR_INSUFFICIENT_AUTHOR;
   }
+  if (!systemTask.nimble().IsConnSecurityOK())
+    return BLE_ATT_ERR_INSUFFICIENT_AUTHEN;
 #endif
 
   if (bleController.IsFirmwareUpdating()) {

src/components/ble/FSService.cpp

@@ -42,6 +42,8 @@ FSService::FSService(Pinetime::System::SystemTask& systemTask, Pinetime::Control
 }
 
 void FSService::Init() {
+  systemTask.nimble().AddCharacteristicSecurity(serviceDefinition);
+
   int res = 0;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);
@@ -61,6 +63,8 @@ int FSService::OnFSServiceRequested(uint16_t connectionHandle, uint16_t attribut
     systemTask.PushMessage(Pinetime::System::Messages::OnNewNotification);
     return BLE_ATT_ERR_INSUFFICIENT_AUTHOR;
   }
+  if (!systemTask.nimble().IsConnSecurityOK())
+    return BLE_ATT_ERR_INSUFFICIENT_AUTHEN;
 #endif
 
   if (attributeHandle == versionCharacteristicHandle) {

src/components/ble/HeartRateService.cpp

@@ -37,6 +37,8 @@ HeartRateService::HeartRateService(NimbleController& nimble, Controllers::HeartR
 }
 
 void HeartRateService::Init() {
+  nimble.AddCharacteristicSecurity(serviceDefinition);
+
   int res = 0;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);
@@ -46,6 +48,9 @@ void HeartRateService::Init() {
 }
 
 int HeartRateService::OnHeartRateRequested(uint16_t attributeHandle, ble_gatt_access_ctxt* context) {
+  if (!nimble.IsConnSecurityOK())
+    return BLE_ATT_ERR_INSUFFICIENT_AUTHEN;
+
   if (attributeHandle == heartRateMeasurementHandle) {
     NRF_LOG_INFO("HEARTRATE : handle = %d", heartRateMeasurementHandle);
     uint8_t buffer[2] = {0, heartRateController.HeartRate()}; // [0] = flags, [1] = hr value
@@ -65,7 +70,7 @@ void HeartRateService::OnNewHeartRateValue(uint8_t heartRateValue) {
 
   uint16_t connectionHandle = nimble.connHandle();
 
-  if (connectionHandle == 0 || connectionHandle == BLE_HS_CONN_HANDLE_NONE) {
+  if (connectionHandle == 0 || connectionHandle == BLE_HS_CONN_HANDLE_NONE || !nimble.IsConnSecurityOK()) {
     return;
   }
 

src/components/ble/ImmediateAlertService.cpp

@@ -48,6 +48,8 @@ ImmediateAlertService::ImmediateAlertService(Pinetime::System::SystemTask& syste
 }
 
 void ImmediateAlertService::Init() {
+  systemTask.nimble().AddCharacteristicSecurity(serviceDefinition);
+
   int res = 0;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);

src/components/ble/MotionService.cpp

@@ -51,6 +51,8 @@ MotionService::MotionService(NimbleController& nimble, Controllers::MotionContro
 }
 
 void MotionService::Init() {
+  nimble.AddCharacteristicSecurity(serviceDefinition);
+
   int res = 0;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);
@@ -60,6 +62,9 @@ void MotionService::Init() {
 }
 
 int MotionService::OnStepCountRequested(uint16_t attributeHandle, ble_gatt_access_ctxt* context) {
+  if (!nimble.IsConnSecurityOK())
+    return BLE_ATT_ERR_INSUFFICIENT_AUTHEN;
+
   if (attributeHandle == stepCountHandle) {
     NRF_LOG_INFO("Motion-stepcount : handle = %d", stepCountHandle);
     uint32_t buffer = motionController.NbSteps();
@@ -86,7 +91,7 @@ void MotionService::OnNewStepCountValue(uint32_t stepCount) {
 
   uint16_t connectionHandle = nimble.connHandle();
 
-  if (connectionHandle == 0 || connectionHandle == BLE_HS_CONN_HANDLE_NONE) {
+  if (connectionHandle == 0 || connectionHandle == BLE_HS_CONN_HANDLE_NONE || !nimble.IsConnSecurityOK()) {
     return;
   }
 
@@ -103,7 +108,7 @@ void MotionService::OnNewMotionValues(int16_t x, int16_t y, int16_t z) {
 
   uint16_t connectionHandle = nimble.connHandle();
 
-  if (connectionHandle == 0 || connectionHandle == BLE_HS_CONN_HANDLE_NONE) {
+  if (connectionHandle == 0 || connectionHandle == BLE_HS_CONN_HANDLE_NONE || !nimble.IsConnSecurityOK()) {
     return;
   }
 

src/components/ble/MusicService.cpp

@@ -116,6 +116,8 @@ Pinetime::Controllers::MusicService::MusicService(Pinetime::Controllers::NimbleC
 }
 
 void Pinetime::Controllers::MusicService::Init() {
+  nimble.AddCharacteristicSecurity(serviceDefinition);
+
   uint8_t res = 0;
   res = ble_gatts_count_cfg(serviceDefinition);
   ASSERT(res == 0);