This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 58b24d9c96d1ad55febe7799fca7262aa68f7f66 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 18:36:52 2026 +0200 nimble/host: Reject EATT bearer on unencrypted link EATT bearer establishment was accepted on an unencrypted link and encryption was only checked when data was received. Reject the connection request with Insufficient Encryption result if the link is not encrypted, as required by the specification. Assisted-by: Claude:claude-opus-5-5 --- nimble/host/src/ble_eatt.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/nimble/host/src/ble_eatt.c b/nimble/host/src/ble_eatt.c index 904e52e93..e99e87df8 100644 --- a/nimble/host/src/ble_eatt.c +++ b/nimble/host/src/ble_eatt.c @@ -239,6 +239,19 @@ ble_eatt_l2cap_event_fn(struct ble_l2cap_event *event, void *arg) break; case BLE_L2CAP_EVENT_COC_ACCEPT: BLE_EATT_LOG_DEBUG("eatt: Accept request\n"); + + /* As per BLE 5.4 Standard, Vol. 3, Part F, section 5.3.2 + * (ENHANCED ATT BEARER L2CAP INTEROPERABILITY REQUIREMENTS: + * Channel Requirements): + * The channel shall be encrypted. + * + * Reject with Insufficient Encryption if link is not encrypted. + */ + rc = ble_gap_conn_find(event->accept.conn_handle, &desc); + if (rc != 0 || !desc.sec_state.encrypted) { + return BLE_HS_EENCRYPT; + } + eatt = ble_eatt_find_by_conn_handle(event->accept.conn_handle); if (eatt) { /* For now we accept only one additional coc channel per ACL
