Skip to content

btd: net.connect does not travel over an authenticated link, and the comment said it did #286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pierre-rouanet merged 1 commit into from
Sep 14, 2026
Merged

btd: net.connect does not travel over an authenticated link, and the comment said it did #286

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions btd/src/route.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,10 +136,22 @@ fn permits(call: &proto::Call) -> bool {
// are permitted, including the two that change things.
NetStatus => true,
NetScan => true,
// Carries a wifi passphrase, which §7 requires to travel over a paired, encrypted link.
// It does: the characteristic sets `encrypt_authenticated_write` and the PIN agent makes
// the bond an authenticated one (`crate::pairing`). Routing this before that existed
// would have been the ordering mistake.
// Carries a wifi passphrase, and this arm used to claim that travels over a paired,
// authenticated link. It does not, and the claim was wrong in both halves.
//
// The characteristic sets `encrypt_write`, not `encrypt_authenticated_write`
// (`crate::bluez`) — and it sets it from `--require-pairing`, which is **off by default**,
// so on an ordinary board there is no encryption on this link at all. Nor could the
// stronger flag be satisfied if it were set: the agent leaves every handler `None`, which
// BlueZ publishes as `NoInputNoOutput`, so the bond is just-works and therefore encrypted
// but *unauthenticated*. `crate::pairing` records why a headless robot cannot do better,
// and `docs/design/app-path-design.md` §5.5 is the state of it.
//
// So what actually stands behind this route today is the PIN check in `crate::session` and
// the ten metres of radio range, and the passphrase crosses in clear. That is a known,
// accepted, pre-shipping cost — `btd` warns about it at every start — and §8.1 is the
// blocker that has to close before a robot goes to anyone. Routed anyway because a robot
// with no network cannot be given one any other way, which is what this transport is for.
NetConnect(_) => true,
NetForget(_) => true,

Expand Down
Loading