andrzej-kaczmarek closed pull request #809: nimble: Fixes for privacy
URL: https://github.com/apache/mynewt-core/pull/809
This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:
As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):
diff --git a/net/nimble/controller/include/controller/ble_ll_scan.h
b/net/nimble/controller/include/controller/ble_ll_scan.h
index 8a4cee537..35cbeb44a 100644
--- a/net/nimble/controller/include/controller/ble_ll_scan.h
+++ b/net/nimble/controller/include/controller/ble_ll_scan.h
@@ -119,6 +119,10 @@ struct ble_ll_scan_sm
uint8_t scan_rsp_cons_ok;
int8_t scan_rpa_index;
uint8_t scan_peer_rpa[BLE_DEV_ADDR_LEN];
+#if (MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY) == 1)
+ uint32_t scan_nrpa_timer;
+ uint8_t scan_nrpa[BLE_DEV_ADDR_LEN];
+#endif
/* XXX: Shall we count backoff per phy? */
uint16_t upper_limit;
diff --git a/net/nimble/controller/src/ble_ll_adv.c
b/net/nimble/controller/src/ble_ll_adv.c
index f50aea79c..e2bf15ab5 100644
--- a/net/nimble/controller/src/ble_ll_adv.c
+++ b/net/nimble/controller/src/ble_ll_adv.c
@@ -186,6 +186,38 @@ static void ble_ll_adv_make_done(struct ble_ll_adv_sm
*advsm, struct ble_mbuf_hd
static void ble_ll_adv_sm_init(struct ble_ll_adv_sm *advsm);
#if (MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY) == 1)
+static void
+ble_ll_adv_rpa_update(struct ble_ll_adv_sm *advsm)
+{
+ ble_ll_resolv_gen_rpa(advsm->peer_addr, advsm->peer_addr_type,
+ advsm->adva, 1);
+
+ if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_DIRECTED) {
+ ble_ll_resolv_gen_rpa(advsm->peer_addr, advsm->peer_addr_type,
+ advsm->initiator_addr, 0);
+ if (ble_ll_is_rpa(advsm->initiator_addr, 1)) {
+ advsm->flags |= BLE_LL_ADV_SM_FLAG_RX_ADD;
+ } else {
+ if (advsm->own_addr_type & 1) {
+ advsm->flags |= BLE_LL_ADV_SM_FLAG_RX_ADD;
+ } else {
+ advsm->flags &= ~BLE_LL_ADV_SM_FLAG_RX_ADD;
+ }
+ }
+ }
+
+ /* May have to reset txadd bit */
+ if (ble_ll_is_rpa(advsm->adva, 1)) {
+ advsm->flags |= BLE_LL_ADV_SM_FLAG_TX_ADD;
+ } else {
+ if (advsm->own_addr_type & 1) {
+ advsm->flags |= BLE_LL_ADV_SM_FLAG_TX_ADD;
+ } else {
+ advsm->flags &= ~BLE_LL_ADV_SM_FLAG_TX_ADD;
+ }
+ }
+}
+
/**
* Called to change advertisers ADVA and INITA (for directed advertisements)
* as an advertiser needs to adhere to the resolvable private address
generation
@@ -208,38 +240,14 @@ ble_ll_adv_chk_rpa_timeout(struct ble_ll_adv_sm *advsm)
{
uint32_t now;
- if (advsm->own_addr_type > BLE_HCI_ADV_OWN_ADDR_RANDOM) {
- now = os_time_get();
- if ((int32_t)(now - advsm->adv_rpa_timer) >= 0) {
- ble_ll_resolv_gen_rpa(advsm->peer_addr, advsm->peer_addr_type,
- advsm->adva, 1);
-
- if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_DIRECTED) {
- ble_ll_resolv_gen_rpa(advsm->peer_addr, advsm->peer_addr_type,
- advsm->initiator_addr, 0);
- if (ble_ll_is_rpa(advsm->initiator_addr, 1)) {
- advsm->flags |= BLE_LL_ADV_SM_FLAG_RX_ADD;
- } else {
- if (advsm->own_addr_type & 1) {
- advsm->flags |= BLE_LL_ADV_SM_FLAG_RX_ADD;
- } else {
- advsm->flags &= ~BLE_LL_ADV_SM_FLAG_RX_ADD;
- }
- }
- }
- advsm->adv_rpa_timer = now + ble_ll_resolv_get_rpa_tmo();
+ if (advsm->own_addr_type < BLE_HCI_ADV_OWN_ADDR_PRIV_PUB) {
+ return;
+ }
- /* May have to reset txadd bit */
- if (ble_ll_is_rpa(advsm->adva, 1)) {
- advsm->flags |= BLE_LL_ADV_SM_FLAG_TX_ADD;
- } else {
- if (advsm->own_addr_type & 1) {
- advsm->flags |= BLE_LL_ADV_SM_FLAG_TX_ADD;
- } else {
- advsm->flags &= ~BLE_LL_ADV_SM_FLAG_TX_ADD;
- }
- }
- }
+ now = os_time_get();
+ if ((int32_t)(now - advsm->adv_rpa_timer) >= 0) {
+ ble_ll_adv_rpa_update(advsm);
+ advsm->adv_rpa_timer = now + ble_ll_resolv_get_rpa_tmo();
}
}
#endif
@@ -1619,9 +1627,11 @@ ble_ll_adv_sm_start(struct ble_ll_adv_sm *advsm)
}
}
- /* This will generate an RPA for both initiator addr and adva */
#if (MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY) == 1)
- ble_ll_adv_chk_rpa_timeout(advsm);
+ /* This will generate an RPA for both initiator addr and adva */
+ if (advsm->own_addr_type > BLE_HCI_ADV_OWN_ADDR_RANDOM) {
+ ble_ll_adv_rpa_update(advsm);
+ }
#endif
/* Set flag telling us that advertising is enabled */
diff --git a/net/nimble/controller/src/ble_ll_conn.c
b/net/nimble/controller/src/ble_ll_conn.c
index 909083a10..9123cf629 100644
--- a/net/nimble/controller/src/ble_ll_conn.c
+++ b/net/nimble/controller/src/ble_ll_conn.c
@@ -2728,6 +2728,11 @@ ble_ll_conn_req_pdu_update(struct os_mbuf *m, uint8_t
*adva, uint8_t addr_type,
}
}
+ /*
+ * If peer in on resolving list, we use RPA generated with Local IRK
+ * from resolving list entry. In other case, we need to use our
identity
+ * address (see Core 5.0, Vol 6, Part B, section 6.4).
+ */
if (rl) {
hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
ble_ll_resolv_gen_priv_addr(rl, 1, dptr);
diff --git a/net/nimble/controller/src/ble_ll_scan.c
b/net/nimble/controller/src/ble_ll_scan.c
index 5aa984b9c..b20cbfc99 100644
--- a/net/nimble/controller/src/ble_ll_scan.c
+++ b/net/nimble/controller/src/ble_ll_scan.c
@@ -263,6 +263,24 @@ ble_ll_scan_req_backoff(struct ble_ll_scan_sm *scansm, int
success)
assert(scansm->backoff_count <= 256);
}
+#if (MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY) == 1)
+static void
+ble_ll_scan_refresh_nrpa(struct ble_ll_scan_sm *scansm)
+{
+ uint32_t now;
+
+ now = os_time_get();
+ if ((int32_t)(now - scansm->scan_nrpa_timer) >= 0) {
+ /* Generate new NRPA */
+ ble_ll_rand_data_get(scansm->scan_nrpa, BLE_DEV_ADDR_LEN);
+ scansm->scan_nrpa[5] &= ~0xc0;
+
+ /* We'll use the same timeout as for RPA rotation */
+ scansm->scan_nrpa_timer = now + ble_ll_resolv_get_rpa_tmo();
+ }
+}
+#endif
+
/**
* ble ll scan req pdu make
*
@@ -318,11 +336,22 @@ ble_ll_scan_req_pdu_make(struct ble_ll_scan_sm *scansm,
uint8_t *adv_addr,
}
}
+ /*
+ * If advertising device is on our resolving list, we use RPA generated
+ * using Local IRK from resolving list entry as ScanA. In other case,
+ * we use NRPA as ScanA as allowed by spec to prevent our device from
+ * being tracked when doing an active scan (see Core 5.0, Vol 6, Part
B,
+ * section 6.3).
+ */
if (rl) {
ble_ll_resolv_gen_priv_addr(rl, 1, rpa);
scana = rpa;
- pdu_type |= BLE_ADV_PDU_HDR_TXADD_RAND;
+ } else {
+ ble_ll_scan_refresh_nrpa(scansm);
+ scana = scansm->scan_nrpa;
}
+
+ pdu_type |= BLE_ADV_PDU_HDR_TXADD_RAND;
}
#endif
@@ -3044,6 +3073,11 @@ ble_ll_scan_init(void)
scansm->phy_data[PHY_CODED].phy = BLE_PHY_CODED;
#endif
+#if (MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY) == 1)
+ /* Make sure we'll generate new NRPA if necessary */
+ scansm->scan_nrpa_timer = os_time_get();
+#endif
+
/* Initialize scanning timer */
os_cputime_timer_init(&scansm->scan_timer, ble_ll_scan_timer_cb, scansm);
diff --git a/net/nimble/host/src/ble_hs_pvcy.c
b/net/nimble/host/src/ble_hs_pvcy.c
index dbabb720c..e744b55b1 100644
--- a/net/nimble/host/src/ble_hs_pvcy.c
+++ b/net/nimble/host/src/ble_hs_pvcy.c
@@ -202,8 +202,6 @@ ble_hs_pvcy_set_our_irk(const uint8_t *irk)
uint8_t new_irk[16];
int rc;
- memset(new_irk, 0, sizeof(new_irk));
-
if (irk != NULL) {
memcpy(new_irk, irk, 16);
} else {
@@ -229,12 +227,16 @@ ble_hs_pvcy_set_our_irk(const uint8_t *irk)
return rc;
}
- /* Push a null address identity to the controller. The controller uses
- * this entry to generate an RPA when we do advertising with
- * own-addr-type = rpa.
+ /*
+ * Add local IRK entry with 00:00:00:00:00:00 address. This entry will
+ * be used to generate RPA for non-directed advertising if
own_addr_type
+ * is set to rpa_pub since we use all-zero address as peer addres in
+ * such case. Peer IRK should be left all-zero since this is not for an
+ * actual peer.
*/
memset(tmp_addr, 0, 6);
- rc = ble_hs_pvcy_add_entry(tmp_addr, 0, ble_hs_pvcy_irk);
+ memset(new_irk, 0, 16);
+ rc = ble_hs_pvcy_add_entry(tmp_addr, 0, new_irk);
if (rc != 0) {
return rc;
}
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
With regards,
Apache Git Services
