nimble/ll: Add CS backtracking resistance

nimble/controller/src/ble_ll_cs.c

@@ -410,6 +410,8 @@ ble_ll_cs_rx_security_req(struct ble_ll_conn_sm *connsm, uint8_t *dptr,
 
     ble_ll_cs_drbg_init(&connsm->cssm->drbg_ctx);
 
+    connsm->cssm->start_procedure_count = 0;
+
     return BLE_LL_CTRL_CS_SEC_RSP;
 }
 
@@ -454,6 +456,8 @@ ble_ll_cs_rx_security_rsp(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
 
     rc = ble_ll_cs_drbg_init(drbg_ctx);
 
+    connsm->cssm->start_procedure_count = 0;
+
     /* Stop the control procedure and send an event to the host */
     ble_ll_ctrl_proc_stop(connsm, BLE_LL_CTRL_PROC_CS_SEC_START);
     ble_ll_cs_ev_sec_enable_complete(connsm, rc ? BLE_ERR_INV_LMP_LL_PARM :
@@ -1758,7 +1762,7 @@ ble_ll_cs_terminate_req_make(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
     assert(config_id < ARRAY_SIZE(cssm->config));
 
     *dptr = config_id;
-    put_le16(dptr + 1, cssm->procedure_count);
+    put_le16(dptr + 1, cssm->start_procedure_count + cssm->procedure_count);
     dptr[3] = cssm->terminate_error_code;
 }
 
@@ -1768,17 +1772,28 @@ ble_ll_cs_rx_cs_terminate_req(struct ble_ll_conn_sm *connsm, uint8_t *dptr,
 {
     struct ble_ll_cs_sm *cssm = connsm->cssm;
     uint8_t config_id = *dptr & 0b00111111;
+    uint16_t procedure_count = get_le16(dptr + 1);
+    struct ble_ll_cs_proc_params *params;
 
     if (config_id >= ARRAY_SIZE(cssm->config)) {
         ble_ll_ctrl_rej_ext_ind_make(BLE_LL_CTRL_CS_TERMINATE_REQ,
                                      BLE_ERR_INV_LMP_LL_PARM, rspbuf);
         return BLE_LL_CTRL_REJECT_IND_EXT;
     }
 
+    params = &cssm->config[config_id].proc_params;
+
+    if (procedure_count > cssm->start_procedure_count + params->max_procedure_count ||
+        procedure_count < cssm->start_procedure_count) {
+        ble_ll_ctrl_rej_ext_ind_make(BLE_LL_CTRL_CS_TERMINATE_REQ,
+                                     BLE_ERR_CMD_DISALLOWED, rspbuf);
+        return BLE_LL_CTRL_REJECT_IND_EXT;
+    }
+
     cssm->terminate_measurement = 1;
 
     *rspbuf = config_id;
-    put_le16(rspbuf + 1, cssm->procedure_count);
+    put_le16(rspbuf + 1, cssm->start_procedure_count + cssm->procedure_count);
     rspbuf[3] = BLE_ERR_SUCCESS;
 
     return BLE_LL_CTRL_CS_TERMINATE_RSP;
@@ -1790,12 +1805,21 @@ ble_ll_cs_rx_cs_terminate_rsp(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
     struct ble_ll_cs_sm *cssm = connsm->cssm;
     uint8_t config_id = *dptr & 0b00111111;
     uint8_t error_code = dptr[3];
+    uint16_t procedure_count = get_le16(dptr + 1);
+    uint16_t total_procedure_count;
 
     if (config_id != cssm->config_req_id ||
         !IS_PENDING_CTRL_PROC(connsm, BLE_LL_CTRL_PROC_CS_TERMINATE)) {
         return;
     }
 
+    total_procedure_count = cssm->start_procedure_count + cssm->procedure_count;
+    if (total_procedure_count < procedure_count) {
+        cssm->start_procedure_count = procedure_count;
+    } else {
+        cssm->start_procedure_count = total_procedure_count;
+    }
+
     ble_ll_ctrl_proc_stop(connsm, BLE_LL_CTRL_PROC_CS_TERMINATE);
 
     /* TODO: In d1.0r06 the LL_CS_TERMINATE_IND was replaced with

nimble/controller/src/ble_ll_cs_priv.h

@@ -296,6 +296,9 @@ struct ble_ll_cs_sm {
     uint8_t non_mode0_channels[72];
     uint8_t mode0_next_chan_id;
     uint8_t non_mode0_next_chan_id;
+
+    /* Procedure counter for backtracking resistance */
+    uint16_t start_procedure_count;
 };
 
 int ble_ll_cs_proc_scheduling_start(struct ble_ll_conn_sm *connsm, uint8_t config_id);

nimble/controller/src/ble_ll_cs_proc.c

@@ -100,6 +100,14 @@ ble_ll_cs_generate_channel(struct ble_ll_cs_sm *cssm)
     return 0;
 }
 
+static int
+ble_ll_cs_backtracking_resistance(struct ble_ll_cs_sm *cssm)
+{
+    cssm->drbg_ctx.nonce_v[1] += BLE_LL_CS_DRBG_BACKTRACKING_RESISTANCE;
+
+    return ble_ll_cs_drbg_f9(0, cssm->drbg_ctx.key, cssm->drbg_ctx.nonce_v);
+}
+
 /**
  * Called when scheduled event needs to be halted. This normally should not be called
  * and is only called when a scheduled item executes but scanning for sync/chain
@@ -346,7 +354,7 @@ ble_ll_cs_setup_next_procedure(struct ble_ll_cs_sm *cssm)
     cssm->step_anchor_usecs = cssm->procedure_anchor_usecs;
     cssm->subevent_anchor_usecs = cssm->step_anchor_usecs;
 
-    return 0;
+    return ble_ll_cs_backtracking_resistance(cssm);
 }
 
 static int
@@ -934,6 +942,7 @@ ble_ll_cs_proc_scheduling_start(struct ble_ll_conn_sm *connsm, uint8_t config_id
 
     cssm->steps_in_procedure_count = ~0;
     cssm->steps_in_subevent_count = ~0;
+    cssm->procedure_count = 0;
 
     cssm->mode0_next_chan_id = 0xFF;
     cssm->non_mode0_next_chan_id = 0xFF;