Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e49c2157 authored by Jacky Cheung's avatar Jacky Cheung Committed by Jakub Pawlowski
Browse files

Fix BLE remote address resolution 

The hash segment of the resolvable device address needs to be extracted
for comparison.

Bug: 62589903
Test: manual
(cherry picked from commit 7c58ca38433bc923c653c334b712fb05d25cab36)

Merged-In: I979a8ad3074b692503b0c882bd90041ba4fbfb4d
Change-Id: I5db8f266c9ee3022b2a8a882540870e5eecd0736
parent 75f1c7ca

system/stack/btm/btm_ble_addr.cc

+18 −17
Original line number Original line Diff line number Diff line
@@ -182,22 +182,21 @@ void btm_gen_non_resolvable_private_addr(tBTM_BLE_ADDR_CBACK* p_cback, 
 * Returns          true on match, false otherwise

 * Returns          true on match, false otherwise

 *

 *

 ******************************************************************************/

 ******************************************************************************/

static bool btm_ble_proc_resolve_x(tSMP_ENC* p) {

static bool btm_ble_proc_resolve_x(const tSMP_ENC& encrypt_output,

  tBTM_LE_RANDOM_CB* p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;

                                   const bt_bdaddr_t& random_bda) {

  uint8_t comp[3];

  BTM_TRACE_EVENT("btm_ble_proc_resolve_x");

  BTM_TRACE_EVENT("btm_ble_proc_resolve_x");



  /* compare the hash with 3 LSB of bd address */

  /* compare the hash with 3 LSB of bd address */

  comp[0] = p_mgnt_cb->random_bda[5];

  uint8_t comp[3];

  comp[1] = p_mgnt_cb->random_bda[4];

  comp[0] = random_bda.address[5];

  comp[2] = p_mgnt_cb->random_bda[3];

  comp[1] = random_bda.address[4];

  comp[2] = random_bda.address[3];





  if (p) {

  if (!memcmp(encrypt_output.param_buf, comp, 3)) {

    if (!memcmp(p->param_buf, &comp[0], 3)) {

      /* match is found */

    BTM_TRACE_EVENT("match is found");

    BTM_TRACE_EVENT("match is found");

    return true;

    return true;

  }

  }

  }



  return false;

  return false;

}

}
@@ -276,13 +275,15 @@ bool btm_ble_addr_resolvable(BD_ADDR rpa, tBTM_SEC_DEV_REC* p_dev_rec) { 
 *

 *

 ******************************************************************************/

 ******************************************************************************/

static bool btm_ble_match_random_bda(void* data, void* context) {

static bool btm_ble_match_random_bda(void* data, void* context) {

  uint8_t* random_bda = (uint8_t*)context;

  bt_bdaddr_t random_bda;

  bdcpy(random_bda.address, (uint8_t *)context);



  /* use the 3 MSB of bd address as prand */

  /* use the 3 MSB of bd address as prand */





  uint8_t rand[3];

  uint8_t rand[3];

  rand[0] = random_bda[2];

  rand[0] = random_bda.address[2];

  rand[1] = random_bda[1];

  rand[1] = random_bda.address[1];

  rand[2] = random_bda[0];

  rand[2] = random_bda.address[0];





  BTM_TRACE_EVENT("%s next iteration", __func__);

  BTM_TRACE_EVENT("%s next iteration", __func__);
@@ -299,7 +300,7 @@ static bool btm_ble_match_random_bda(void* data, void* context) { 
  /* generate X = E irk(R0, R1, R2) and R is random address 3 LSO */

  /* generate X = E irk(R0, R1, R2) and R is random address 3 LSO */

  SMP_Encrypt(p_dev_rec->ble.keys.irk, BT_OCTET16_LEN, &rand[0], 3, &output);

  SMP_Encrypt(p_dev_rec->ble.keys.irk, BT_OCTET16_LEN, &rand[0], 3, &output);

  // if it was match, finish iteration, otherwise continue

  // if it was match, finish iteration, otherwise continue

  return !btm_ble_proc_resolve_x(&output);

  return !btm_ble_proc_resolve_x(output, random_bda);

}

}





/*******************************************************************************

/*******************************************************************************