Skip to content

Commit 90b1dbb

Browse files
committed
Merge branch 'bugfix/fix_ble_aa_zero_c3_s3_v5.1' into 'release/v5.1'
fix(bt/ble): Update esp32c3/s3 libbtdm_app.a (555b0a2) (v5.1) See merge request espressif/esp-idf!35689
2 parents c08c117 + 22dd470 commit 90b1dbb

File tree

14 files changed

+110
-43
lines changed

14 files changed

+110
-43
lines changed

components/bt/controller/esp32c3/Kconfig.in

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -543,3 +543,10 @@ config BT_CTRL_BLE_SCAN
543543
depends on BT_CTRL_RUN_IN_FLASH_ONLY
544544
bool "Enable BLE scan feature"
545545
default y
546+
config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
547+
bool "Enable enhanced Access Address check in CONNECT_IND"
548+
default n
549+
help
550+
Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
551+
This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
552+
If disabled, only basic checks are applied, improving compatibility.

components/bt/controller/esp32c3/bt.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,7 @@ extern void ets_backup_dma_copy(uint32_t reg, uint32_t mem_addr, uint32_t num, b
273273
#endif
274274

275275
extern void btdm_cca_feature_enable(void);
276+
extern void btdm_aa_check_enhance_enable(void);
276277

277278
extern uint32_t _bt_bss_start;
278279
extern uint32_t _bt_bss_end;
@@ -962,6 +963,9 @@ static void btdm_funcs_table_ready_wrapper(void)
962963
#if BT_BLE_CCA_MODE == 2
963964
btdm_cca_feature_enable();
964965
#endif
966+
#if BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
967+
btdm_aa_check_enhance_enable();
968+
#endif
965969
}
966970

967971
bool bt_async_wakeup_request(void)

components/bt/host/bluedroid/api/esp_gap_ble_api.c

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
#include "btc/btc_manage.h"
1414
#include "btc_gap_ble.h"
1515
#include "btc/btc_ble_storage.h"
16-
16+
#include "esp_random.h"
1717

1818
esp_err_t esp_ble_gap_register_callback(esp_gap_ble_cb_t callback)
1919
{
@@ -188,6 +188,25 @@ esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_
188188
return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
189189
}
190190

191+
esp_err_t esp_ble_gap_addr_create_static(esp_bd_addr_t rand_addr)
192+
{
193+
// Static device address: First two bits are '11', rest is random
194+
rand_addr[0] = 0xC0 | (esp_random() & 0x3F);
195+
for (int i = 1; i < 6; i++) {
196+
rand_addr[i] = esp_random() & 0xFF; // Randomize remaining bits
197+
}
198+
return ESP_OK;
199+
}
200+
201+
esp_err_t esp_ble_gap_addr_create_nrpa(esp_bd_addr_t rand_addr)
202+
{
203+
// Non-resolvable private address: First two bits are '00', rest is random
204+
rand_addr[0] = (esp_random() & 0x3F);
205+
for (int i = 1; i < 6; i++) {
206+
rand_addr[i] = esp_random() & 0xFF; // Randomize remaining bits
207+
}
208+
return ESP_OK;
209+
}
191210

192211
esp_err_t esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr)
193212
{

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1716,13 +1716,13 @@ esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_
17161716
*
17171717
* @param[in] rand_addr: The address to be configured. Refer to the table below for possible address subtypes:
17181718
*
1719-
* | address [47:46] | Address Type |
1720-
* |-----------------|--------------------------|
1721-
* | 0b00 | Non-Resolvable Private |
1722-
* | | Address |
1723-
* |-----------------|--------------------------|
1724-
* | 0b11 | Static Random Address |
1725-
* |-----------------|--------------------------|
1719+
* | address [47:46] | Address Type | Corresponding API |
1720+
* |-----------------|-----------------------------|----------------------------------------|
1721+
* | 0b00 | Non-Resolvable Private | esp_ble_gap_addr_create_nrpa |
1722+
* | | Address (NRPA) | |
1723+
* |-----------------|-----------------------------|----------------------------------------|
1724+
* | 0b11 | Static Random Address | esp_ble_gap_addr_create_static |
1725+
* |-----------------|-----------------------------|----------------------------------------|
17261726
*
17271727
* @return
17281728
* - ESP_OK : success
@@ -1731,6 +1731,22 @@ esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_
17311731
*/
17321732
esp_err_t esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr);
17331733

1734+
/**
1735+
* @brief Create a static device address
1736+
* @param[out] rand_addr: Pointer to the buffer where the static device address will be stored.
1737+
* @return - ESP_OK : Success
1738+
* - Other : Failed
1739+
*/
1740+
esp_err_t esp_ble_gap_addr_create_static(esp_bd_addr_t rand_addr);
1741+
1742+
/**
1743+
* @brief Create a non-resolvable private address (NRPA)
1744+
* @param[out] rand_addr: Pointer to the buffer where the NRPA will be stored.
1745+
* @return - ESP_OK : Success
1746+
* - Other : Failed
1747+
*/
1748+
esp_err_t esp_ble_gap_addr_create_nrpa(esp_bd_addr_t rand_addr);
1749+
17341750
/**
17351751
* @brief This function sets the length of time the Controller uses a Resolvable Private Address
17361752
* before generating and starting to use a new resolvable private address.
@@ -1779,7 +1795,6 @@ esp_err_t esp_ble_gap_add_device_to_resolving_list(esp_bd_addr_t peer_addr, uint
17791795
*/
17801796
esp_err_t esp_ble_gap_clear_rand_addr(void);
17811797

1782-
17831798
/**
17841799
* @brief Enable/disable privacy (including address resolution) on the local device
17851800
*
@@ -2118,7 +2133,6 @@ esp_err_t esp_ble_remove_bond_device(esp_bd_addr_t bd_addr);
21182133
*/
21192134
int esp_ble_get_bond_device_num(void);
21202135

2121-
21222136
/**
21232137
* @brief Get the device from the security database list of peer device.
21242138
* It will return the device bonded information immediately.

components/bt/include/esp32c3/include/esp_bt.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,12 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
287287
#define BT_CTRL_BLE_SCAN (1)
288288
#endif // (BT_CTRL_RUN_IN_FLASH_ONLY == 1)
289289

290+
#ifdef CONFIG_BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
291+
#define BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED CONFIG_BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
292+
#else
293+
#define BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED 0
294+
#endif
295+
290296
#define BT_CONTROLLER_INIT_CONFIG_DEFAULT() { \
291297
.magic = ESP_BT_CTRL_CONFIG_MAGIC_VAL, \
292298
.version = ESP_BT_CTRL_CONFIG_VERSION, \
@@ -332,6 +338,7 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
332338
.qa_test = BT_CTRL_BLE_TEST, \
333339
.master_en = BT_CTRL_BLE_MASTER, \
334340
.scan_en = BT_CTRL_BLE_SCAN, \
341+
.ble_aa_check = BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED, \
335342
}
336343

337344
#else
@@ -413,6 +420,7 @@ typedef struct {
413420
bool qa_test; /*!< Controller QA test feature is enabled or not */
414421
bool master_en; /*!< Controller master feature is enabled or not */
415422
bool scan_en; /*!< Controller scan feature is enabled or not */
423+
bool ble_aa_check; /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
416424
} esp_bt_controller_config_t;
417425

418426
/**

examples/bluetooth/bluedroid/ble/gatt_client/main/gattc_demo.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -353,6 +353,8 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
353353

354354
if (adv_name != NULL) {
355355
if (strlen(remote_device_name) == adv_name_len && strncmp((char *)adv_name, remote_device_name, adv_name_len) == 0) {
356+
// Note: If there are multiple devices with the same device name, the device may connect to an unintended one.
357+
// It is recommended to change the default device name to ensure it is unique.
356358
ESP_LOGI(GATTC_TAG, "Device found %s", remote_device_name);
357359
if (connect == false) {
358360
connect = true;

examples/bluetooth/bluedroid/ble/gatt_client/tutorial/Gatt_Client_Example_Walkthrough.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,9 @@ We are interested in the `ESP_GAP_SEARCH_INQ_RES_EVT` event, which is called eve
365365
ESP_LOGI(GATTC_TAG, "\n");
366366
if (adv_name != NULL) {
367367
if (strlen(remote_device_name) == adv_name_len && strncmp((char *)adv_name, remote_device_name, adv_name_len) == 0) {
368-
ESP_LOGI(GATTC_TAG, "searched device %s\n", remote_device_name);
368+
// Note: If there are multiple devices with the same device name, the device may connect to an unintended one.
369+
// It is recommended to change the default device name to ensure it is unique.
370+
ESP_LOGI(GATTC_TAG, "searched device %s", remote_device_name);
369371
if (connect == false) {
370372
connect = true;
371373
ESP_LOGI(GATTC_TAG, "connect to the remote device.");

examples/bluetooth/bluedroid/ble/gatt_security_client/main/example_ble_sec_gattc_demo.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -452,6 +452,8 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
452452
ESP_LOG_BUFFER_CHAR(GATTC_TAG, adv_name, adv_name_len);
453453
if (adv_name != NULL) {
454454
if (strlen(remote_device_name) == adv_name_len && strncmp((char *)adv_name, remote_device_name, adv_name_len) == 0) {
455+
// Note: If there are multiple devices with the same device name, the device may connect to an unintended one.
456+
// It is recommended to change the default device name to ensure it is unique.
455457
ESP_LOGI(GATTC_TAG, "Device found %s", remote_device_name);
456458
if (connect == false) {
457459
connect = true;

examples/bluetooth/bluedroid/ble_50/ble50_security_client/main/ble50_sec_gattc_demo.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -487,6 +487,8 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
487487
ESP_BLE_AD_TYPE_NAME_CMPL,
488488
&adv_name_len);
489489
if (!connect && strlen(remote_device_name) == adv_name_len && strncmp((char *)adv_name, remote_device_name, adv_name_len) == 0) {
490+
// Note: If there are multiple devices with the same device name, the device may connect to an unintended one.
491+
// It is recommended to change the default device name to ensure it is unique.
490492
connect = true;
491493
esp_ble_gap_stop_ext_scan();
492494
ESP_LOGI(GATTC_TAG, "Device found "ESP_BD_ADDR_STR"", ESP_BD_ADDR_HEX(param->ext_adv_report.params.addr));

0 commit comments

Comments
 (0)