commit | bfc38f93dbf52550ccd1ef6eca748e3d4e984792 | [log] [tgz] |
---|---|---|
author | Brian Delwiche <delwiche@google.com> | Mon Apr 22 21:46:27 2024 +0000 |
committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Wed Jul 10 22:18:10 2024 +0000 |
tree | e5a553475ec669d363548d691858d02620246aa4 | |
parent | 8c36bb8ecdeb72ddb06297547393fbec43caeecf [diff] |
Disallow connect with Secure Connections downgrade As a guard against the BLUFFS attack, check security parameters of incoming connections against cached values and disallow connection if these parameters are downgraded or changed from their cached values. This CL adds the connection-time check for Secure Connections mode. Bug: 314331379 Test: m libbluetooth Test: manual To test this CL, please ensure that BR/EDR initial connections and reconnections (after cycling remote devices, cycling Bluetooth, restarting the phone, etc.) work against remote devices which both support and do not support Secure Connections mode, and with all supported bonding types. Basic validation of LE bonding functionality should be done as well. Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f20fdd9b3225a6084f6b666172817fe0a89f0679) Merged-In: I9130476600d31b59608e0e419b5136d255174265 Change-Id: I9130476600d31b59608e0e419b5136d255174265
Just build AOSP - Fluoride is there by default.
Instructions for a Debian based distribution:
You'll want to download some pre-requisite packages as well. If you're currently configured for AOSP development, you should have most required packages. Otherwise, you can use the following apt-get list or use the --run-bootstrap
option on build.py
(see below) to get a list of packages missing on your system:
sudo apt-get install repo git-core gnupg flex bison gperf build-essential \ zip curl zlib1g-dev gcc-multilib g++-multilib \ x11proto-core-dev libx11-dev libncurses5 \ libgl1-mesa-dev libxml2-utils xsltproc unzip liblz4-tool libssl-dev \ libc++-dev libevent-dev \ flatbuffers-compiler libflatbuffers1 openssl \ libflatbuffers-dev libtinyxml2-dev \ libglib2.0-dev libevent-dev libnss3-dev libdbus-1-dev \ libprotobuf-dev ninja-build generate-ninja protobuf-compiler \ libre2-9 debmake \ llvm libc++abi-dev \ libre2-dev libdouble-conversion-dev
You will also need a recent-ish version of Rust and Cargo. Please follow the instructions on Rustup to install a recent version.
mkdir ~/fluoride cd ~/fluoride git clone https://android.googlesource.com/platform/packages/modules/Bluetooth
build.py
is the helper script used to build Fluoride for Linux (i.e. Floss). It accepts a --run-bootstrap
option that will set up your build staging directory and also make sure you have all required system packages to build (should work on Debian and Ubuntu). You will still need to build some unpackaged dependencies (like libchrome, modp_b64, googletest, etc).
To use it:
./build.py --run-bootstrap
This will install your bootstrapped build environment to ~/.floss
. If you want to change this, just pass in --bootstrap-dir
to the script.
The following third-party dependencies are necessary but currently unavailable via a package manager. You may have to build these from source and install them to your local environment.
We provide a script to produce debian packages for those components. Please see the instructions in build/dpkg/README.txt for more details.
cd system/build/dpkg mkdir -p outdir/{modp_b64,libchrome} # Build and install modp_b64 pushd modp_b64 ./gen-src-pkg.sh $(readlink -f ../outdir/modp_b64) popd sudo dpkg -i outdir/modp_b64/*.deb # Build and install libchrome pushd libchrome ./gen-src-pkg.sh $(readlink -f ../outdir/libchrome) popd sudo dpkg -i outdir/libchrome/*.deb
The googletest packages provided by Debian/Ubuntu (libgmock-dev and libgtest-dev) do not provide pkg-config files, so you can build your own googletest using the steps below:
git clone https://github.com/google/googletest.git -b release-1.10.0 cd googletest # Main directory of the cloned repository. mkdir build # Create a directory to hold the build output. cd build cmake .. # Generate native build scripts for GoogleTest. sudo make install -DCMAKE_INSTALL_PREFIX=/usr # Optional steps if pkgconfig isn't installed to desired location # Modify the source (/usr/lib/x86_64-linux-gnu) and target (/usr/lib) based on # your local installation. for f in $(ls /usr/lib/x86_64-linux-gnu/pkgconfig/{gtest,gmock}*); do \ ln -sf $f /usr/lib/pkgconfig/$(basename $f); done
Note: Handled by --run-bootstrap
option.
Run the following to install Rust dependencies:
cargo install cxxbridge-cmd
Note: Handled by --run-bootstrap
option.
For host build, we depend on a few other repositories:
Clone these all somewhere and create your staging environment.
export STAGING_DIR=path/to/your/staging/dir mkdir ${STAGING_DIR} mkdir -p ${STAGING_DIR}/external ln -s $(readlink -f ${PLATFORM2_DIR}/common-mk) ${STAGING_DIR}/common-mk ln -s $(readlink -f ${PLATFORM2_DIR}/.gn) ${STAGING_DIR}/.gn ln -s $(readlink -f ${RUST_CRATE_DIR}) ${STAGING_DIR}/external/rust ln -s $(readlink -f ${PROTO_LOG_DIR}) ${STAGING_DIR}/external/proto_logging
We provide a build script to automate building assuming you've staged your build environment already as above. At this point, make sure you have all the pre-requisites installed (i.e. bootstrap option and other dependencies above) or you will see failures. In addition, you may need to set a --libdir=
if your libraries are not stored in /usr/lib
by default.
./build.py
This will build all targets to the output directory at --bootstrap-dir
(which defaults to ~/.floss
). You can also build each stage separately (if you want to iterate on something specific):
You can choose to run only a specific stage by passing an arg via --target
.
Currently, Rust builds are a separate stage that uses Cargo to build. See gd/rust/README.md for more information. If you are iterating on Rust code and want to add new crates, you may also want to use the --no-vendored-rust
option (which will let you use crates.io instead of using a pre-populated vendored crates repo).
By default on Linux, we statically link libbluetooth so you can just run the binary directly. By default, it will try to run on hci0 but you can pass it --hci=N, where N corresponds to /sys/class/bluetooth/hciN.
$OUTPUT_DIR/debug/btadapterd --hci=$HCI INIT_gd_hci=true