From 65311f0ea9bbe840f8f5cebf92fb76ce8bc27707 Mon Sep 17 00:00:00 2001
From: liquidraver <504870+liquidraver@users.noreply.github.com>
Date: Wed, 20 May 2026 16:00:17 +0200
Subject: [PATCH] fix(ble): resolve two Phase 3 audit findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. CONFIG_BT_DEVICE_NAME_GATT_WRITABLE=y removed. The default GAP
   Device Name write permission is plain BT_GATT_PERM_WRITE — no
   bonding required (Zephyr gap_svc.c:158). Any connected peer
   (bonded or not) could rename the device. Worse, a GAP write
   updates bt_get_name() but NOT prefs.node_name, so the advertised
   name wouldn't track the renamed value. Rename now flows
   exclusively through CMD_SET_ADVERT_NAME, which is NUS-protected
   (AUTHEN required) and properly propagates via
   zephcore_ble_update_name() to prefs + GATT + adv data.

2. CONFIG_BT_DIS_FW_REV_STR synced from "1.13.0" to "v1.15.1-zephyr"
   to match CompanionMesh.cpp CMD_DEVICE_QUERY's version string.
   Comment added requiring the two to stay in sync.
---
 zephcore/boards/common/zephcore_common.conf | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/zephcore/boards/common/zephcore_common.conf b/zephcore/boards/common/zephcore_common.conf
index 0206ef0..df18959 100644
--- a/zephcore/boards/common/zephcore_common.conf
+++ b/zephcore/boards/common/zephcore_common.conf
@@ -73,7 +73,15 @@ CONFIG_BT_PERIPHERAL=y
 CONFIG_BT_DEVICE_NAME="MeshCore"
 CONFIG_BT_DEVICE_NAME_DYNAMIC=y
 CONFIG_BT_DEVICE_NAME_MAX=29
-CONFIG_BT_DEVICE_NAME_GATT_WRITABLE=y
+# GAP Device Name is read-only over BLE. Renames happen via the
+# NUS-protected CMD_SET_ADVERT_NAME command, which updates prefs.node_name,
+# calls bt_set_name(), and triggers an adv-data rebuild (see
+# zephcore_ble_update_name in ZephyrBLE.cpp). Allowing GAP writes would
+# (a) expose an unbonded-peer rename surface (default perm is plain WRITE
+# unless WRITABLE_AUTHEN is also set), and (b) create two sources of
+# truth — the GAP write updates bt_get_name() but not prefs.node_name,
+# so the advertised name wouldn't track the GAP-written name.
+# CONFIG_BT_DEVICE_NAME_GATT_WRITABLE=y
 CONFIG_BT_DEVICE_APPEARANCE=0
 CONFIG_BT_MAX_CONN=1
 
@@ -140,7 +148,10 @@ CONFIG_BT_DIS_MANUF_NAME_STR="ZephCore"
 CONFIG_BT_DIS_MODEL_NUMBER=y
 CONFIG_BT_DIS_MODEL_NUMBER_STR="ZephCore"
 CONFIG_BT_DIS_FW_REV=y
-CONFIG_BT_DIS_FW_REV_STR="1.13.0"
+# Keep in sync with the version string in CompanionMesh.cpp CMD_DEVICE_QUERY
+# response (the v1.15.1-zephyr literal). Phones that read DIS and phones
+# that query CMD_DEVICE_QUERY should see the same version.
+CONFIG_BT_DIS_FW_REV_STR="v1.15.1-zephyr"
 CONFIG_BT_DIS_SW_REV=y
 CONFIG_BT_DIS_SW_REV_STR="Zephyr"
 CONFIG_BT_DIS_PNP=n