Security config

applications/firmware_loader/ble_mcumgr/src/main.c

@@ -189,6 +189,9 @@ int main(void)
 			.uuid = BLE_MCUMGR_SERVICE_UUID_SUB,
 		},
 	};
+	struct ble_mcumgr_config mcumgr_cfg = {
+		.sec_mode = BLE_MCUMGR_CONFIG_SEC_MODE_DEFAULT,
+	};
 
 	LOG_INF("BLE MCUmgr sample started");
 	mgmt_callback_register(&os_mgmt_reboot_callback);
@@ -211,7 +214,7 @@ int main(void)
 
 	LOG_INF("Bluetooth enabled");
 
-	nrf_err = ble_mcumgr_init();
+	nrf_err = ble_mcumgr_init(&mcumgr_cfg);
 
 	if (nrf_err) {
 		LOG_ERR("Failed to initialize MCUmgr service, nrf_error %#x", nrf_err);

doc/nrf-bm/libraries/bluetooth/services/ble_dis.rst

@@ -42,12 +42,6 @@ The DIS service can be configured by using the following Kconfig options:
 * :kconfig:option:`BLE_DIS_PNP_VER` - Sets the product version.
 * :kconfig:option:`BLE_DIS_REGULATORY_CERT` - Includes IEEE regulatory certifications.
 * :kconfig:option:`BLE_DIS_REGULATORY_CERT_LIST` - Sets the regulatory certification list.
-* :kconfig:option:`BLE_DIS_CHAR_SEC_MODE_JUST_WORKS` - Sets the service security mode to open link.
-* :kconfig:option:`BLE_DIS_CHAR_SEC_MODE_ENCRYPTED` - Sets the service security mode to encrypted.
-* :kconfig:option:`BLE_DIS_CHAR_SEC_MODE_ENCRYPTED_MITM` - Sets the service security mode to encrypted with man in the middle protection.
-* :kconfig:option:`BLE_DIS_CHAR_SEC_MODE_LESC_ENCRYPTED_MITM` - Sets the service security mode to LESC encryption with man-in-the-middle protection.
-* :kconfig:option:`BLE_DIS_CHAR_SEC_MODE_SIGNED` - Sets the service security mode to signing or encryption required.
-* :kconfig:option:`BLE_DIS_CHAR_SEC_MODE_SIGNED_MITM` - Sets the service security mode to signing or encryption required, with man in the middle protection.
 
 Initialization
 ==============

doc/nrf-bm/libraries/bluetooth/services/ble_mcumgr.rst

@@ -15,6 +15,7 @@ Configuration
 *************
 
 Set the :kconfig:option:`CONFIG_BLE_MCUMGR` Kconfig option to enable the service.
+The characteristic security mode is configured in the :c:struct:`ble_mcumgr_config` structure provided during initialization.
 
 Initialization
 ==============

doc/nrf-bm/release_notes/release_notes_changelog.rst

@@ -105,7 +105,7 @@ Libraries
 
 * Added the :ref:`lib_ble_radio_notification` library.
 
-* Updated the following libraries and BLE services to return ``nrf_errors`` instead of ``errnos``:
+* Updated the following libraries and Bluetooth LE services to return ``nrf_errors`` instead of ``errnos``:
 
   * :ref:`lib_ble_adv` library.
   * :ref:`lib_ble_conn_params` library.
@@ -117,7 +117,7 @@ Libraries
   * :ref:`lib_ble_service_lbs` service.
   * :ref:`lib_ble_service_mcumgr` service.
   * :ref:`lib_ble_service_nus` service.
-  * BLE Record Access Control Point library.
+  * Bluetooth LE Record Access Control Point library.
 
 * :ref:`lib_ble_conn_params` library:
 
@@ -198,6 +198,20 @@ Libraries
     * To use errno instead of nrf_errors.
     * The :c:func:`bm_storage_init` function to expect an additional input parameter of type pointer to struct :c:struct:`bm_storage_config` for configuring the storage instance that is being initialized.
 
+Bluetooth LE Services
+------------
+
+* Updated how to configure the characteristic security for the following Bluetooth LE services:
+
+  * :ref:`lib_ble_service_bas` service.
+  * :ref:`lib_ble_service_cgms` service.
+  * :ref:`lib_ble_service_dis` service.
+  * :ref:`lib_ble_service_hids` service.
+  * :ref:`lib_ble_service_hrs` service.
+  * :ref:`lib_ble_service_lbs` service.
+  * :ref:`lib_ble_service_mcumgr` service.
+  * :ref:`lib_ble_service_nus` service.
+
 * :ref:`lib_ble_service_bas` service:
 
   * Added the error event to align event handling with other services.

include/bm/bluetooth/services/ble_bas.h

@@ -16,6 +16,7 @@
 #include <stdbool.h>
 #include <ble.h>
 #include <bm/softdevice_handler/nrf_sdh_ble.h>
+#include <bm/bluetooth/services/common.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -31,6 +32,16 @@ extern "C" {
 	extern void ble_bas_on_ble_evt(const ble_evt_t *ble_evt, void *ctx);                       \
 	NRF_SDH_BLE_OBSERVER(_name##_obs, ble_bas_on_ble_evt, &_name, HIGH)
 
+/** @brief Default security configuration. */
+#define BLE_BAS_CONFIG_SEC_MODE_DEFAULT                                                            \
+	{                                                                                          \
+		.battery_lvl_char = {                                                              \
+			.read = BLE_GAP_CONN_SEC_MODE_OPEN,                                        \
+			.cccd_write = BLE_GAP_CONN_SEC_MODE_OPEN,                                  \
+		},                                                                                 \
+		.battery_report_ref.read = BLE_GAP_CONN_SEC_MODE_OPEN,                             \
+	}
+
 /**
  * @brief Battery service event types.
  */
@@ -113,18 +124,21 @@ struct ble_bas_config {
 	 * @brief Initial battery level.
 	 */
 	uint8_t battery_level;
-	/**
-	 * @brief Security requirement for reading the battery level characteristic value.
-	 */
-	ble_gap_conn_sec_mode_t batt_rd_sec;
-	/**
-	 * @brief Security requirement for writing the battery level characteristic CCCD.
-	 */
-	ble_gap_conn_sec_mode_t cccd_wr_sec;
-	/**
-	 * @brief Security requirement for reading the Report Reference characteristic descriptor.
-	 */
-	ble_gap_conn_sec_mode_t report_ref_rd_sec;
+	/** Characteristic security. */
+	struct {
+		/**  Battery Level characteristic */
+		struct {
+			/** Security requirement for reading battery level characteristic value. */
+			ble_gap_conn_sec_mode_t read;
+			/** Security requirement for writing battery level characteristic CCCD. */
+			ble_gap_conn_sec_mode_t cccd_write;
+		} battery_lvl_char;
+		/** Battery Service report reference. */
+		struct {
+			/** Security requirement for reading Battery Service report reference. */
+			ble_gap_conn_sec_mode_t read;
+		} battery_report_ref;
+	} sec_mode;
 };
 
 /**

include/bm/bluetooth/services/ble_cgms.h

@@ -26,6 +26,7 @@
 
 #include <bm/bluetooth/ble_gq.h>
 #include <bm/bluetooth/ble_racp.h>
+#include <bm/bluetooth/services/common.h>
 #include <bm/softdevice_handler/nrf_sdh_ble.h>
 #include <zephyr/sys/util.h>
 
@@ -45,6 +46,29 @@ extern "C" {
 			     ble_cgms_on_ble_evt, &_name,                                          \
 			     HIGH)
 
+/** @brief Default security configuration. */
+#define BLE_CGMS_CONFIG_SEC_MODE_DEFAULT                                                           \
+	{                                                                                          \
+		.feature_char.read = BLE_GAP_CONN_SEC_MODE_OPEN,                                   \
+		.status_char.read = BLE_GAP_CONN_SEC_MODE_OPEN,                                    \
+		.srt_char.read = BLE_GAP_CONN_SEC_MODE_OPEN,                                       \
+		.meas_char = {                                                                     \
+			.cccd_write = BLE_GAP_CONN_SEC_MODE_OPEN,                                  \
+		},                                                                                 \
+		.racp_char = {                                                                     \
+			.write = BLE_GAP_CONN_SEC_MODE_OPEN,                                       \
+			.cccd_write = BLE_GAP_CONN_SEC_MODE_OPEN,                                  \
+		},                                                                                 \
+		.socp_char = {                                                                     \
+			.write = BLE_GAP_CONN_SEC_MODE_OPEN,                                       \
+			.cccd_write = BLE_GAP_CONN_SEC_MODE_OPEN,                                  \
+		},                                                                                 \
+		.sst_char = {                                                                      \
+			.read = BLE_GAP_CONN_SEC_MODE_OPEN,                                        \
+			.write = BLE_GAP_CONN_SEC_MODE_OPEN,                                       \
+		},                                                                                 \
+	}
+
 #define OPCODE_LENGTH 1
 #define HANDLE_LENGTH 2
 
@@ -390,6 +414,64 @@ struct ble_cgms_config {
 	struct ble_cgms_status initial_sensor_status;
 	/** Run time. */
 	uint16_t initial_run_time;
+	/** Characteristic security. */
+	struct {
+		/** Feature characteristic */
+		struct {
+			/** Security requirement for reading feature characteristic value. */
+			ble_gap_conn_sec_mode_t read;
+		} feature_char;
+		/** Status characteristic */
+		struct {
+			/** Security requirement for reading status characteristic value. */
+			ble_gap_conn_sec_mode_t read;
+		} status_char;
+		/** Session Run Time characteristic */
+		struct {
+			/** Security requirement for reading Session Run Time (SRT) characteristic
+			 * value.
+			 */
+			ble_gap_conn_sec_mode_t read;
+		} srt_char;
+		/** Measurement characteristic */
+		struct {
+			/** Security requirement for writing measurement characteristic CCCD. */
+			ble_gap_conn_sec_mode_t cccd_write;
+		} meas_char;
+		/** Record Access Control Point  */
+		struct {
+			/** Security requirement for writing Record Access Control Point (RACP)
+			 *  characteristic value.
+			 */
+			ble_gap_conn_sec_mode_t write;
+			/** Security requirement for writing Record Access Control Point (RACP)
+			 *  characteristic CCCD.
+			 */
+			ble_gap_conn_sec_mode_t cccd_write;
+		} racp_char;
+		/** Specific Operation Control Point (SOCP) */
+		struct {
+			/** Security requirement for writing Specific Operation Control Point (SOCP)
+			 *  characteristic value.
+			 */
+			ble_gap_conn_sec_mode_t write;
+			/** Security requirement for writing Specific Operation Control Point (SOCP)
+			 *  characteristic CCCD.
+			 */
+			ble_gap_conn_sec_mode_t cccd_write;
+		} socp_char;
+		/** Session Start Time (SST) */
+		struct {
+			/** Security requirement for reading Session Start Time (SST) characteristic
+			 *  value.
+			 */
+			ble_gap_conn_sec_mode_t read;
+			/** Security requirement for writing Session Start Time (SST) characteristic
+			 *  value.
+			 */
+			ble_gap_conn_sec_mode_t write;
+		} sst_char;
+	} sec_mode;
 };
 
 /** @brief Specific Operation Control Point response structure. */

include/bm/bluetooth/services/ble_dis.h

@@ -22,22 +22,47 @@
 #define BLE_DIS_H__
 
 #include <stdint.h>
+#include <bm/bluetooth/services/common.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+/** @brief Default security configuration. */
+#define BLE_DIS_CONFIG_SEC_MODE_DEFAULT                                                            \
+	{                                                                                          \
+		.device_info_char.read = BLE_GAP_CONN_SEC_MODE_OPEN,                               \
+	}
+
 /**
- * @brief Function for initializing the Device Information Service.
+ * @brief Device Information service configuration.
+ */
+struct ble_dis_config {
+	/** Security configuration. */
+	struct {
+		/** Device information characteristic */
+		struct {
+			/** Security requirement for reading all characteristic values of the
+			 * device information service.
+			 */
+			ble_gap_conn_sec_mode_t read;
+		} device_info_char;
+	} sec_mode;
+};
+
+/**
+ * @brief Initialize the Device Information Service.
  *
  * @details This call allows the application to initialize the device information service.
- *          It adds the DIS service and DIS characteristics to the database, using the initial
- *          values supplied through the p_dis_init parameter. Characteristics which are not to be
- *          added, shall be set to NULL in p_dis_init.
+ *          It adds the DIS service and DIS characteristics to the database, using the
+ *          values supplied through the Kconfig options.
+ *
+ * @param dis_config Device Information Service configuration.
  *
- * @return NRF_SUCCESS on successful initialization of service or nrf_error on failure.
+ * @return NRF_SUCCESS on successful initialization of service.
+ * @retval NRF_ERROR_NULL If @p dis_config is @c NULL.
  */
-uint32_t ble_dis_init(void);
+uint32_t ble_dis_init(const struct ble_dis_config *dis_config);
 
 #ifdef __cplusplus
 }