Use new BTSecurityLevel instead of uint8_t BT_SECURITY value; DBTDevice: Add [set|get]SecurityLevel() using BTSecurityLevel, overriding auto-determined mode.

9 files changed, 148 insertions, 46 deletions

diff --git a/api/direct_bt/BTTypes.hpp b/api/direct_bt/BTTypes.hpp
index da9ce9d8..91faa246 100644
--- a/api/direct_bt/BTTypes.hpp
+++ b/api/direct_bt/BTTypes.hpp
@@ -90,16 +90,16 @@ namespace direct_bt {
         return static_cast<uint64_t>(rhs);
     }
     constexpr LEFeatures operator ^(const LEFeatures lhs, const LEFeatures rhs) noexcept {
-        return static_cast<LEFeatures> ( static_cast<uint8_t>(lhs) ^ static_cast<uint8_t>(rhs) );
+        return static_cast<LEFeatures> ( number(lhs) ^ number(rhs) );
     }
     constexpr LEFeatures operator |(const LEFeatures lhs, const LEFeatures rhs) noexcept {
-        return static_cast<LEFeatures> ( static_cast<uint8_t>(lhs) | static_cast<uint8_t>(rhs) );
+        return static_cast<LEFeatures> ( number(lhs) | number(rhs) );
     }
     constexpr LEFeatures operator &(const LEFeatures lhs, const LEFeatures rhs) noexcept {
-        return static_cast<LEFeatures> ( static_cast<uint8_t>(lhs) & static_cast<uint8_t>(rhs) );
+        return static_cast<LEFeatures> ( number(lhs) & number(rhs) );
     }
     constexpr bool operator ==(const LEFeatures lhs, const LEFeatures rhs) noexcept {
-        return static_cast<uint8_t>(lhs) == static_cast<uint8_t>(rhs);
+        return number(lhs) == number(rhs);
     }
     constexpr bool operator !=(const LEFeatures lhs, const LEFeatures rhs) noexcept {
         return !( lhs == rhs );
@@ -109,6 +109,54 @@ namespace direct_bt {
     }
 
     /**
+     * Bluetooth Security Level.
+     * <p>
+     * This BTSecurityLevel is natively compatible
+     * with Linux/BlueZ's BT_SECURITY values 1-4.
+     * </p>
+     */
+    enum class BTSecurityLevel : uint8_t {
+        /** Security Level not set. */
+        UNSET         = 0,       /**< UNSET */
+        /** No encryption and no authentication. Also known as BT_SECURITY_LOW 1. */
+        NONE          = 1,       /**< NONE */
+        /** Encryption and no authentication (no MITM). Also known as BT_SECURITY_MEDIUM 2. */
+        ENC_ONLY      = 2,       /**< ENC_ONLY */
+        /** Encryption and authentication (MITM). Also known as BT_SECURITY_HIGH 3. */
+        ENC_AUTH      = 3,       /**< ENC_AUTH */
+        /** Authenticated Secure Connections. Also known as BT_SECURITY_FIPS 4. */
+        ENC_AUTH_FIPS = 4        /**< ENC_AUTH_FIPS */
+    };
+    constexpr uint8_t number(const BTSecurityLevel rhs) noexcept {
+        return static_cast<uint8_t>(rhs);
+    }
+    constexpr bool operator ==(const BTSecurityLevel lhs, const BTSecurityLevel rhs) noexcept {
+        return number(lhs) == number(rhs);
+    }
+    constexpr bool operator !=(const BTSecurityLevel lhs, const BTSecurityLevel rhs) noexcept {
+        return !( lhs == rhs );
+    }
+    constexpr bool operator <(const BTSecurityLevel lhs, const BTSecurityLevel rhs) noexcept {
+        return number(lhs) < number(rhs);
+    }
+    constexpr bool operator <=(const BTSecurityLevel lhs, const BTSecurityLevel rhs) noexcept {
+        return number(lhs) <= number(rhs);
+    }
+    constexpr bool operator >(const BTSecurityLevel lhs, const BTSecurityLevel rhs) noexcept {
+        return number(lhs) > number(rhs);
+    }
+    constexpr bool operator >=(const BTSecurityLevel lhs, const BTSecurityLevel rhs) noexcept {
+        return number(lhs) >= number(rhs);
+    }
+    constexpr BTSecurityLevel getBTSecurityLevel(const uint8_t v) noexcept {
+        if( 1 <= v && v <= 4 ) {
+            return static_cast<BTSecurityLevel>(v);
+        }
+        return BTSecurityLevel::UNSET;
+    }
+    std::string getBTSecurityLevelString(const BTSecurityLevel v) noexcept;
+
+    /**
      * Bluetooth secure pairing mode
      * <pre>
      * BT Core Spec v5.2: Vol 1, Part A, 5 Security Overview
@@ -157,19 +205,19 @@ namespace direct_bt {
         return static_cast<uint8_t>(rhs);
     }
     constexpr ScanType operator ~(const ScanType val) noexcept {
-        return static_cast<ScanType> ( ~static_cast<uint8_t>(val) );
+        return static_cast<ScanType> ( ~number(val) );
     }
     constexpr ScanType operator ^(const ScanType lhs, const ScanType rhs) noexcept {
-        return static_cast<ScanType> ( static_cast<uint8_t>(lhs) ^ static_cast<uint8_t>(rhs) );
+        return static_cast<ScanType> ( number(lhs) ^ number(rhs) );
     }
     constexpr ScanType operator |(const ScanType lhs, const ScanType rhs) noexcept {
-        return static_cast<ScanType> ( static_cast<uint8_t>(lhs) | static_cast<uint8_t>(rhs) );
+        return static_cast<ScanType> ( number(lhs) | number(rhs) );
     }
     constexpr ScanType operator &(const ScanType lhs, const ScanType rhs) noexcept {
-        return static_cast<ScanType> ( static_cast<uint8_t>(lhs) & static_cast<uint8_t>(rhs) );
+        return static_cast<ScanType> ( number(lhs) & number(rhs) );
     }
     constexpr bool operator ==(const ScanType lhs, const ScanType rhs) noexcept {
-        return static_cast<uint8_t>(lhs) == static_cast<uint8_t>(rhs);
+        return number(lhs) == number(rhs);
     }
     constexpr bool operator !=(const ScanType lhs, const ScanType rhs) noexcept {
         return !( lhs == rhs );
diff --git a/api/direct_bt/DBTDevice.hpp b/api/direct_bt/DBTDevice.hpp
index 74dab0a8..8983e72f 100644
--- a/api/direct_bt/DBTDevice.hpp
+++ b/api/direct_bt/DBTDevice.hpp
@@ -80,6 +80,7 @@ namespace direct_bt {
             std::atomic<bool> allowDisconnect; // allowDisconnect = isConnected || 'isConnectIssued'
 
             struct PairingData {
+                jau::ordered_atomic<BTSecurityLevel, std::memory_order_relaxed> sec_level=BTSecurityLevel::UNSET, sec_level_user=BTSecurityLevel::UNSET;
                 jau::ordered_atomic<SMPPairingState, std::memory_order_relaxed> state;
                 jau::ordered_atomic<PairingMode, std::memory_order_relaxed> mode;
                 jau::relaxed_atomic_bool res_requested_sec;
@@ -121,22 +122,22 @@ namespace direct_bt {
             void processL2CAPSetup(std::shared_ptr<DBTDevice> sthis);
 
             /**
-             * Established SMP host connection and security for L2CAP connection if sec_level > BT_SECURITY_LOW.
+             * Established SMP host connection and security for L2CAP connection if sec_level > BTSecurityLevel::NONE.
              * <p>
              * Will be performed after connectLE(..), i.e. notifyConnected() and notifyLEFeatures().<br>
              * Called from processL2CAPSetup, if supported.
              * </p>
              * <p>
-             * If sec_level > BT_SECURITY_LOW, sets the BlueZ's L2CAP socket BT_SECURITY sec_level, determining the SMP security mode per connection.
+             * If sec_level > BTSecurityLevel::NONE, sets the BlueZ's L2CAP socket BT_SECURITY sec_level, determining the SMP security mode per connection.
              * </p>
              * <p>
              * The SMPHandler is managed by this device instance and closed via disconnectSMP().
              * </p>
              *
-             * @param sec_level BT_SECURITY_LOW, BT_SECURITY_MEDIUM, BT_SECURITY_HIGH or BT_SECURITY_FIPS. sec_level <= BT_SECURITY_LOW leads to not set security level.
-             * @return true if a security level > BT_SECURITY_LOW has been set successfully, false if no security level has been set or if it failed.
+             * @param sec_level sec_level <= BTSecurityLevel::NONE will not set security level and returns false.
+             * @return true if a security level > BTSecurityLevel::NONE has been set successfully, false if no security level has been set or if it failed.
              */
-            bool connectSMP(std::shared_ptr<DBTDevice> sthis, const uint8_t sec_level) noexcept;
+            bool connectSMP(std::shared_ptr<DBTDevice> sthis, const BTSecurityLevel sec_level) noexcept;
 
             /**
              * Forwarded from HCIHandler -> DBTAdapter -> this DBTDevice
@@ -447,6 +448,16 @@ namespace direct_bt {
             HCIStatusCode setPairingPasskeyNegative() noexcept;
 
             /**
+             * Set the overriding security level used at device connection.
+             */
+            void setSecurityLevel(const BTSecurityLevel sec_level) noexcept { pairing_data.sec_level_user = sec_level; }
+
+            /**
+             * Return the currently set security level.
+             */
+            BTSecurityLevel getCurrentSecurityLevel() const noexcept { return pairing_data.sec_level; }
+
+            /**
              * Method sets the numeric comparison result, see PairingMode::NUMERIC_COMPARE_ini.
              * <p>
              * Call this method if the device shall be securely paired with PairingMode::NUMERIC_COMPARE_ini,
diff --git a/api/direct_bt/L2CAPComm.hpp b/api/direct_bt/L2CAPComm.hpp
index 9c57164a..879c8247 100644
--- a/api/direct_bt/L2CAPComm.hpp
+++ b/api/direct_bt/L2CAPComm.hpp
@@ -180,12 +180,15 @@ namespace direct_bt {
             std::recursive_mutex & mutex_write() { return mtx_write; }
 
             /**
-             * If sec_level > BT_SECURITY_LOW, sets the BlueZ's L2CAP socket BT_SECURITY sec_level, determining the SMP security mode per connection.
+             * If sec_level > BTSecurityLevel::NONE, sets the BlueZ's L2CAP socket BT_SECURITY sec_level, determining the SMP security mode per connection.
+             * <p>
+             * To unset security, the L2CAP socket should be closed and opened again.
+             * </p>
              *
-             * @param sec_level BT_SECURITY_LOW, BT_SECURITY_MEDIUM, BT_SECURITY_HIGH or BT_SECURITY_FIPS. sec_level <= BT_SECURITY_LOW leads to not set security level.
-             * @return true if a security level > BT_SECURITY_LOW has been set successfully, false if no security level has been set or if it failed.
+             * @param sec_level sec_level <= BTSecurityLevel::NONE will not set security level and returns false.
+             * @return true if a security level > BTSecurityLevel::NONE has been set successfully, false if no security level has been set or if it failed.
              */
-            bool setBTSecurityLevel(const uint8_t sec_level);
+            bool setBTSecurityLevel(const BTSecurityLevel sec_level);
 
             /** Generic read, w/o locking suitable for a unique ringbuffer sink. Using L2CAPEnv::L2CAP_READER_POLL_TIMEOUT.*/
             jau::snsize_t read(uint8_t* buffer, const jau::nsize_t capacity);
diff --git a/api/direct_bt/SMPHandler.hpp b/api/direct_bt/SMPHandler.hpp
index c75a12a2..6f16eaae 100644
--- a/api/direct_bt/SMPHandler.hpp
+++ b/api/direct_bt/SMPHandler.hpp
@@ -216,12 +216,12 @@ namespace direct_bt {
             std::string getStateString() const noexcept { return L2CAPComm::getStateString(is_connected, has_ioerror); }
 
             /**
-             * If sec_level > BT_SECURITY_LOW, establish security level per L2CAP connection.
+             * If sec_level > BTSecurityLevel::NONE, establish security level per L2CAP connection.
              *
-             * @param sec_level BT_SECURITY_LOW, BT_SECURITY_MEDIUM, BT_SECURITY_HIGH or BT_SECURITY_FIPS. sec_level <= BT_SECURITY_LOW leads to not set security level.
-             * @return true if a security level > BT_SECURITY_LOW has been set successfully, false if no security level has been set or if it failed.
+             * @param sec_level sec_level <= BTSecurityLevel::NONE will not set security level and returns false.
+             * @return true if a security level > BTSecurityLevel::NONE has been set successfully, false if no security level has been set or if it failed.
              */
-            bool establishSecurity(const uint8_t sec_level);
+            bool establishSecurity(const BTSecurityLevel sec_level);
 
             /**
              * Disconnect this GATTHandler and optionally the associated device
diff --git a/examples/direct_bt_scanner10/dbt_scanner10.cpp b/examples/direct_bt_scanner10/dbt_scanner10.cpp
index 4f605f5f..632ff0ee 100644
--- a/examples/direct_bt_scanner10/dbt_scanner10.cpp
+++ b/examples/direct_bt_scanner10/dbt_scanner10.cpp
@@ -73,7 +73,9 @@ static bool QUIET = false;
 
 static std::vector<EUI48> waitForDevices;
 
-static uint32_t pairing_passkey = 0;
+const static uint32_t NO_PASSKEY = 0xffffffffU;
+static uint32_t pairing_passkey = NO_PASSKEY;
+static BTSecurityLevel sec_level = BTSecurityLevel::UNSET;
 
 static void connectDiscoveredDevice(std::shared_ptr<DBTDevice> device);
 
@@ -243,8 +245,13 @@ class MyAdapterStatusListener : public AdapterStatusListener {
                 // next: PASSKEY_EXPECTED... or PROCESS_STARTED
                 break;
             case SMPPairingState::PASSKEY_EXPECTED: {
-                std::thread dc(&DBTDevice::setPairingPasskey, device, pairing_passkey); // @suppress("Invalid arguments")
-                dc.detach();
+                if( pairing_passkey != NO_PASSKEY ) {
+                    std::thread dc(&DBTDevice::setPairingPasskey, device, pairing_passkey); // @suppress("Invalid arguments")
+                    dc.detach();
+                } /* else {
+                    std::thread dc(&DBTDevice::setPairingPasskeyNegative, device); // @suppress("Invalid arguments")
+                    dc.detach();
+                } */
                 // next: PROCESS_STARTED or FAILED
               } break;
             case SMPPairingState::NUMERIC_COMPARE_EXPECTED: {
@@ -352,6 +359,9 @@ class MyGATTEventListener : public AssociatedGATTCharacteristicListener {
 static void connectDiscoveredDevice(std::shared_ptr<DBTDevice> device) {
     fprintf(stderr, "****** Connecting Device: Start %s\n", device->toString().c_str());
     device->getAdapter().stopDiscovery();
+    if( BTSecurityLevel::UNSET < sec_level ) {
+        device->setSecurityLevel(sec_level);
+    }
     HCIStatusCode res;
     if( !USE_WHITELIST ) {
         res = device->connectDefault();
@@ -711,6 +721,8 @@ int main(int argc, char *argv[])
             USE_WHITELIST = true;
         } else if( !strcmp("-passkey", argv[i]) && argc > (i+1) ) {
             pairing_passkey = atoi(argv[++i]);
+        } else if( !strcmp("-seclevel", argv[i]) && argc > (i+1) ) {
+            sec_level = getBTSecurityLevel(atoi(argv[++i]));
         } else if( !strcmp("-disconnect", argv[i]) ) {
             KEEP_CONNECTED = false;
         } else if( !strcmp("-enableGATTPing", argv[i]) ) {
@@ -750,6 +762,7 @@ int main(int argc, char *argv[])
     fprintf(stderr, "QUIET %d\n", QUIET);
     fprintf(stderr, "btmode %s\n", getBTModeString(btMode).c_str());
     fprintf(stderr, "passkey %u\n", pairing_passkey);
+    fprintf(stderr, "seclevel %s\n", getBTSecurityLevelString(sec_level).c_str());
 
     printList( "waitForDevice: ", waitForDevices);
 
diff --git a/src/direct_bt/BTTypes.cpp b/src/direct_bt/BTTypes.cpp
index 886bf37e..79a52591 100644
--- a/src/direct_bt/BTTypes.cpp
+++ b/src/direct_bt/BTTypes.cpp
@@ -218,6 +218,17 @@ BTMode direct_bt::getBTMode(const std::string & value) noexcept {
     return BTMode::NONE;
 }
 
+std::string direct_bt::getBTSecurityLevelString(const BTSecurityLevel v) noexcept {
+    switch(v) {
+        case BTSecurityLevel::UNSET:         return "UNSET";
+        case BTSecurityLevel::NONE:          return "NONE";
+        case BTSecurityLevel::ENC_ONLY:      return "ENC_ONLY";
+        case BTSecurityLevel::ENC_AUTH:      return "ENC_AUTH";
+        case BTSecurityLevel::ENC_AUTH_FIPS: return "ENC_AUTH_FIPS";
+    }
+    return "Unknown BTSecurityLevel";
+}
+
 std::string direct_bt::getPairingModeString(const PairingMode v) noexcept {
     switch(v) {
         case PairingMode::NONE:                return "NONE";
diff --git a/src/direct_bt/DBTDevice.cpp b/src/direct_bt/DBTDevice.cpp
index 7dd6d999..f68512ca 100644
--- a/src/direct_bt/DBTDevice.cpp
+++ b/src/direct_bt/DBTDevice.cpp
@@ -414,13 +414,18 @@ void DBTDevice::processL2CAPSetup(std::shared_ptr<DBTDevice> sthis) {
     DBG_PRINT("DBTDevice::processL2CAPSetup: %s", toString().c_str());
     if( isLEAddressType() && !l2cap_att.isOpen() ) {
         const bool responderLikesEncryption = pairing_data.res_requested_sec || isLEFeaturesBitSet(le_features, LEFeatures::LE_Encryption);
-        uint8_t sec_level;
-        if( responderLikesEncryption && adapter.hasSecureConnections() ) {
-            sec_level = BT_SECURITY_FIPS; // 4
-        } else if( responderLikesEncryption ) {
-            sec_level = BT_SECURITY_HIGH; // 3
+        const BTSecurityLevel sec_level_user = pairing_data.sec_level_user;
+        BTSecurityLevel sec_level = pairing_data.sec_level;
+        if( BTSecurityLevel::UNSET != sec_level_user ) {
+            sec_level = sec_level_user;
         } else {
-            sec_level = 0;
+            if( responderLikesEncryption && adapter.hasSecureConnections() ) {
+                sec_level = BTSecurityLevel::ENC_AUTH_FIPS;
+            } else if( responderLikesEncryption ) {
+                sec_level = BTSecurityLevel::ENC_AUTH;
+            } else {
+                sec_level = BTSecurityLevel::NONE;
+            }
         }
         const bool l2cap_open = l2cap_att.open(*this);
         const bool l2cap_sec = l2cap_open && l2cap_att.setBTSecurityLevel(sec_level); // initiates hciSMPMsgCallback() if sec_level > BT_SECURITY_LOW
@@ -429,13 +434,16 @@ void DBTDevice::processL2CAPSetup(std::shared_ptr<DBTDevice> sthis) {
 #else
         const bool smp_sec = false;
 #endif
-        DBG_PRINT("DBTDevice::processL2CAPSetup: sec_level %u, connect[SMP %d, l2cap[open %d, sec %d]], %s",
-                sec_level, smp_sec, l2cap_open, l2cap_sec, toString().c_str());
+        DBG_PRINT("DBTDevice::processL2CAPSetup: sec_level %s, connect[smp %d, l2cap[open %d, sec %d]], %s",
+                getBTSecurityLevelString(sec_level).c_str(), smp_sec, l2cap_open, l2cap_sec, toString().c_str());
         if( !l2cap_open ) {
             disconnect(HCIStatusCode::INTERNAL_FAILURE);
         } else if( !l2cap_sec && !smp_sec ) {
             // No security and hence no SMP dialogue, i.e. hciSMPMsgCallback():
+            pairing_data.sec_level = BTSecurityLevel::NONE;
             processDeviceReady(sthis, jau::getCurrentMilliseconds());
+        } else {
+            pairing_data.sec_level = sec_level;
         }
     }
 }
@@ -496,11 +504,18 @@ void DBTDevice::hciSMPMsgCallback(std::shared_ptr<DBTDevice> sthis, std::shared_
             pairing_data.res_requested_sec = false;
 
             // After a failed encryption/authentication, we try without security!
-            bool res_l2cap_close = l2cap_att.close();
-            bool res_l2cap_open = l2cap_att.open(*this);
-            DBG_PRINT("DBTDevice:hci:SMP: l2cap ATT reopen: close %d, open %d", res_l2cap_close, res_l2cap_open);
+            BTSecurityLevel sec_level = pairing_data.sec_level;
+            if( BTSecurityLevel::NONE < sec_level ) {
+                sec_level = BTSecurityLevel::NONE;
+                pairing_data.sec_level = sec_level;
+            }
+            const bool l2cap_close = l2cap_att.close();
+            const bool l2cap_open = l2cap_att.open(*this);
+            is_device_ready = l2cap_open;
+
+            DBG_PRINT("DBTDevice:hci:SMP: l2cap ATT reopen: ready %d, sec_level %s, l2cap[close %d, open %d], %s",
+                    is_device_ready, getBTSecurityLevelString(sec_level).c_str(), l2cap_close, l2cap_open, toString().c_str());
 
-            is_device_ready = res_l2cap_open;
           } break;
 
         case SMPPDUMsg::Opcode::SECURITY_REQUEST:
@@ -653,6 +668,7 @@ HCIStatusCode DBTDevice::setPairingNumericComparison(const bool positive) noexce
 void DBTDevice::clearSMPStates() noexcept {
     const std::lock_guard<std::mutex> lock(mtx_pairing); // RAII-style acquire and relinquish via destructor
 
+    pairing_data.sec_level = BTSecurityLevel::UNSET;
     pairing_data.mode = PairingMode::NONE;
     pairing_data.state = SMPPairingState::NONE;
     pairing_data.res_requested_sec = false;
@@ -684,7 +700,7 @@ void DBTDevice::disconnectSMP(int caller) noexcept {
   #endif
 }
 
-bool DBTDevice::connectSMP(std::shared_ptr<DBTDevice> sthis, const uint8_t sec_level) noexcept {
+bool DBTDevice::connectSMP(std::shared_ptr<DBTDevice> sthis, const BTSecurityLevel sec_level) noexcept {
   #if SMP_SUPPORTED_BY_OS
     if( !isConnected || !allowDisconnect) {
         ERR_PRINT("DBTDevice::connectSMP(%u): Device not connected: %s", sec_level, toString().c_str());
@@ -696,7 +712,7 @@ bool DBTDevice::connectSMP(std::shared_ptr<DBTDevice> sthis, const uint8_t sec_l
         return false;
     }
 
-    if( BT_SECURITY_LOW >= sec_level ) {
+    if( BTSecurityLevel::NONE >= sec_level ) {
         return false;
     }
 
diff --git a/src/direct_bt/L2CAPComm.cpp b/src/direct_bt/L2CAPComm.cpp
index 1a5f9d14..3eeae8a6 100644
--- a/src/direct_bt/L2CAPComm.cpp
+++ b/src/direct_bt/L2CAPComm.cpp
@@ -238,7 +238,7 @@ bool L2CAPComm::close() noexcept {
     return true;
 }
 
-bool L2CAPComm::setBTSecurityLevel(const uint8_t sec_level) {
+bool L2CAPComm::setBTSecurityLevel(const BTSecurityLevel sec_level) {
     if( !is_open ) {
         DBG_PRINT("L2CAPComm::setBTSecurityLevel: Not connected: %s, dd %d, %s, psm %u, cid %u",
                   getStateString().c_str(), socket_descriptor.load(), deviceString.c_str(), psm, cid);
@@ -246,22 +246,22 @@ bool L2CAPComm::setBTSecurityLevel(const uint8_t sec_level) {
     }
     const std::lock_guard<std::recursive_mutex> lock(mtx_write); // RAII-style acquire and relinquish via destructor
 
-    if( BT_SECURITY_LOW < sec_level ) {
+    if( BTSecurityLevel::NONE < sec_level ) {
         #if USE_LINUX_BT_SECURITY
             struct bt_security bt_sec;
             int result;
 
             bzero(&bt_sec, sizeof(bt_sec));
-            bt_sec.level = sec_level;
+            bt_sec.level = direct_bt::number(sec_level);
             result = setsockopt(socket_descriptor, SOL_BLUETOOTH, BT_SECURITY, &bt_sec, sizeof(bt_sec));
             if ( 0 == result ) {
-                DBG_PRINT("L2CAPComm::setBTSecurityLevel: sec_level %u, success", sec_level);
+                DBG_PRINT("L2CAPComm::setBTSecurityLevel: sec_level %s, success", getBTSecurityLevelString(sec_level).c_str());
                 return true;
             } else {
-                ERR_PRINT("L2CAPComm::setBTSecurityLevel: sec_level %u, failed", sec_level);
+                ERR_PRINT("L2CAPComm::setBTSecurityLevel: sec_level %s, failed", getBTSecurityLevelString(sec_level).c_str());
             }
         #else
-            DBG_PRINT("L2CAPComm::setBTSecurityLevel: sec_level %u, not implemented", sec_level);
+            DBG_PRINT("L2CAPComm::setBTSecurityLevel: sec_level %s, not implemented", getBTSecurityLevelString(sec_level).c_str());
         #endif
     }
     return false;
diff --git a/src/direct_bt/SMPHandler.cpp b/src/direct_bt/SMPHandler.cpp
index 3255aaf8..352f53b0 100644
--- a/src/direct_bt/SMPHandler.cpp
+++ b/src/direct_bt/SMPHandler.cpp
@@ -200,7 +200,7 @@ SMPHandler::~SMPHandler() noexcept {
     clearAllCallbacks();
 }
 
-bool SMPHandler::establishSecurity(const uint8_t sec_level) {
+bool SMPHandler::establishSecurity(const BTSecurityLevel sec_level) {
     // FIXME: Start negotiating security!
     // FIXME: Return true only if security has been established (encryption and optionally authentication)
     (void)sec_level;