Feature ble host privacy #13717

pan- · 2020-10-05T11:29:11Z

Summary of changes

This PR reimplements Bluetooth privacy for all type of Bluetooth controllers (4.0 to 5.2).
As soon as privacy is enabled, a private address is used to advertise, scan or initiate connection and peers resolvable addresses are resolved if a bond with matching IRK is found in the security database.

This should solve most of the pairing issues observed on Android and iOS where the local device is not able to retrieve a previous bond.

Internally there is two implementations of the address resolution:

Host based where the software compute if the address is known or not
Controller based where the Bluetooth controller resolves automatically addresses received during advertising or scan.

New configurations flags have been added to select at compile time the implementation to use:

ble-gap-host-based-private-address-resolution Forces the system to use host based resolution
ble-gap-host-privacy-resolved-cache-size Indicate how many entries must be booked for the host based resolution cache.

This PR is the result of the following PRs merged on the feature branch

Privacy feature configuration: Host privacy feature configuration #13662
Force device mode for LL resolution: Set privacy mode to device mode in LL. #13689
Privacy enable event emission : BLE: Add function to signal privacy initialization. #13680
Improvement of Secure DB entry retrieval: BLE: Retrieve correct DB entry when RPA used #13660 and Host privacy: Set Identity address when retrieved #13658
Force identity address to be static: Cordio configure identity address #13622
Local private address management: Ble privacy scanning initiating #13582 and Host privacy implementation #13560
Peer private address management: Resolve advertising reports and connection complete #13630 and allow host resolved address to be used for connection #13685:
Fixes: Host privacy fixes #13656 and Host privacy fixes #13670
Notification when advertising start or stop: BLE: Notify application when advertising start or stop #13706

Impact of changes

Existing applications should not have anything to change regards to calls to privacy APIs as this PR enables it for all type of controllers and not just resolution when supported by the hardware.

The advertising state was showing up as enabled as soon as the function startAdvertising was called. This is was not correct as it wasn't reflecting the reality of operations. The state is now modified when advertising is actually active. Two new events have been added to Gap::EventHandler to catch the change of advertising state.

Migration actions required

Documentation

None

Pull request type

[] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[x] Feature update (New feature / Functionality change / New API)
[] Major update (Breaking change E.g. Return code change / API behaviour change)

Test results

privacy-tests.zip

[] No Tests required for this change (E.g docs only update)
[] Covered by existing mbed-os tests (Greentea or Unittest)
[x] Tests / results supplied as part of this PR

Reviewers

This PAL interface is responsible for generating, resolving private address and maintaining the controller or host resolving list. It also indicates to upper level if LL resolution is supported or not and allows them to enable it.

It controls private address generation and host or controller address resolution.

Resolution list has been removed from the pal as this is handled by the PrivateAddressController.

A race condition was present if a single event was present in the event queue and the event was generating a new event.

…een stopped

…to connect to a peer.

…advertising

… the procedure.

enabling/disabling scanning and advertising operations can be prevented if the previous operations hasn't completed. Return that the stack is busy and cannot fulfill the request at the moment rather than the state is invalid.

…platform. The function to get it has been removed as this operation is driven by the security manager.

This also ensure the random static address used by gap is the correct one.

pan- · 2020-10-12T20:05:35Z

@alexherriott-dmc You should start advertising when the privacy has been enabled. You receive that event through Gap::onPrivacyEnabled (see:

mbed-os/connectivity/FEATURE_BLE/include/ble/Gap.h

Line 557 in f32141a

virtual void onPrivacyEnabled()

)

alexherriott-dmc · 2020-10-12T23:57:46Z

@pan- thanks for that, that seems to work then. I'm still testing bonding for #13499, it works on the iOS test device. I will let you know if the Android devices also work. Another thing I have noticed, SetPeripheralPrivacyConfiguration(REJECT_NON_RESOLVED_ADDRESS) seems to be behaving differently and not rejecting unbonded devices. Instead it lets them connect and attempt to pair. Before I would see disconnects with reason 22 for encryption failure. Is there something else I need to address there?

pan- · 2020-10-13T00:20:51Z

@alexherriott-dmc In the case you described, the connection event should not be passed to the application, the system should take care of disconnecting the peer. Is it what you are observing ?
To prevent controllers to accept the connection from unknown peer you need a bt5 controller and you should enable the whitelist filled with paired addresses.
That won't work with bt4 devices because whitelist filtering is made by the controller before the address resolution on the host. So it would reject known devices advertising with a private address.

mprse · 2020-10-13T07:20:41Z

connectivity/FEATURE_BLE/source/generic/GapImpl.cpp

+    if (_connect_to_host_resolved_address_state == ConnectionToHostResolvedAddressState::scan) {
+        return BLE_ERROR_OPERATION_NOT_PERMITTED;
+    }
+#endif BLE_GAP_HOST_BASED_PRIVATE_ADDRESS_RESOLUTION


#endif //BLE_GAP_HOST_BASED_PRIVATE_ADDRESS_RESOLUTION

The connection event reported by the WB55 is incorrect if controller privacy is not enable and the peer connects with an unknown private resolvable address: The RPA field contains the connection address (it should be empty) and the peer address is all FF while it should be equal to the connection address.

Privacy workaround wb55

Fix conditional compilation for ble

pan- · 2020-10-14T12:36:04Z

@0xc0170 We consider that PR ready, anything you would like from us ?

mbed-ci · 2020-10-15T13:27:37Z

Jenkins CI Test : ✔️ SUCCESS

Build Number: 1 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_build-ARM	✔️
jenkins-ci/mbed-os-ci_build-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_greentea-test	✔️
jenkins-ci/mbed-os-ci_dynamic-memory-usage	✔️
jenkins-ci/mbed-os-ci_cloud-client-pytest	✔️

pan- and others added 30 commits October 5, 2020 11:50

BLE: Update ble::Duration to support default values

f7dfc5c

ble: Add privacy mode to the pal

bc860db

BLE: Add resolvable_address_timeout_t datatype.

7423561

BLE: Introduce PalPrivateAddressController

f1dbc89

This PAL interface is responsible for generating, resolving private address and maintaining the controller or host resolving list. It also indicates to upper level if LL resolution is supported or not and allows them to enable it.

BLE: Add cordio implementation of PalPrivateAddressController

7dacae7

BLE: Add PrivateAddressController module.

44681ee

It controls private address generation and host or controller address resolution.

BLE: Update security manager to use the PrivateAddressController

237278b

Resolution list has been removed from the pal as this is handled by the PrivateAddressController.

BLE: Pal event queue pop before execution.

23f7a18

A race condition was present if a single event was present in the event queue and the event was generating a new event.

BLE: Add gap handlers to be informed when advertising as started or b…

313676a

…een stopped

BLE: Bind address controller with Gap

7e16ee4

BLE: Remove address resolution from GAP pal

13771b8

BLE: Add initiating flag into gap to track if the local device tries …

f810ec4

…to connect to a peer.

BLE: Add resolvable and non resolvable private address rotation with …

4b85395

…advertising

BLE: rename address resolution handler.

b8549ec

BLE: Add callback for scan started and stoped.

d8c6820

BLE: Update state when scan started/stopped callback received.

924f8b1

BLE: Fix random static address storage

e512868

BLE: check LL resolution availability before enabling it.

559640c

BLE: Add routine that computes the random address to use depending on…

4685322

… the procedure.

BLE: Implement private address rotation for initiating.

c39d03a

BLE: Private address when initiating connection

19d8936

BLE: privacy tracing cleanup

3c22f8a

BLE: Fix state update when event handler not present

9df7fc9

BLE: improve scan state bookkeeping

9eac368

Cordio: Add API to set the local identity address.

f897729

BLE: Add function to get the device random static address.

5cb0595

BLE: Add function to set the identity address used by the controller/…

0b98682

…platform. The function to get it has been removed as this operation is driven by the security manager.

BLE: Set identity address to random static.

4859dbe

This also ensure the random static address used by gap is the correct one.

split resolve addres into cache and not cache

685af00

mprse reviewed Oct 13, 2020

View reviewed changes

pan- added 2 commits October 13, 2020 16:16

BLE: Take advantage of controller based address resolution on WB55

2a4a097

pan- mentioned this pull request Oct 13, 2020

Mbed OS BLE stack not allowing application to configure ADV duration timeout #13750

Closed

paul-szczepanek-arm added 2 commits October 13, 2020 17:32

Fix conditional compilation based on config

3f9798b

rename private address controller to match security manager

9f09bb4

0xc0170 added needs: work needs: review and removed needs: review needs: work labels Oct 14, 2020

pan- and others added 3 commits October 14, 2020 08:45

Merge pull request #13759 from pan-/privacy-workaround-wb55

665e453

Privacy workaround wb55

fix removed friend function

119d459

Merge pull request #13760 from paul-szczepanek-arm/privacy-fix-ifdef

5f1b716

Fix conditional compilation for ble

0xc0170 approved these changes Oct 15, 2020

View reviewed changes

mergify bot added needs: CI and removed needs: review labels Oct 15, 2020

mergify bot added ready for merge and removed needs: CI labels Oct 15, 2020

0xc0170 merged commit 75f3b6c into master Oct 15, 2020

0xc0170 deleted the feature-ble-host-privacy branch October 15, 2020 14:08

mergify bot removed the ready for merge label Oct 15, 2020

mbedmain added release-version: 6.4.0 Release-pending and removed release-type: feature Release-pending labels Oct 20, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature ble host privacy #13717

Feature ble host privacy #13717

pan- commented Oct 5, 2020 •

edited

Loading

pan- commented Oct 12, 2020

alexherriott-dmc commented Oct 12, 2020

pan- commented Oct 13, 2020

mprse Oct 13, 2020

pan- commented Oct 14, 2020

mbed-ci commented Oct 15, 2020

Feature ble host privacy #13717

Feature ble host privacy #13717

Conversation

pan- commented Oct 5, 2020 • edited Loading

Summary of changes

Impact of changes

Migration actions required

Documentation

Pull request type

Test results

Reviewers

pan- commented Oct 12, 2020

alexherriott-dmc commented Oct 12, 2020

pan- commented Oct 13, 2020

mprse Oct 13, 2020

Choose a reason for hiding this comment

pan- commented Oct 14, 2020

mbed-ci commented Oct 15, 2020

Jenkins CI Test : ✔️ SUCCESS

Build Number: 1 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

pan- commented Oct 5, 2020 •

edited

Loading