Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [PATCH v2] btdev: Add proper checks for own_addr_type for LE (extended) scan
Date:   Wed, 14 Jul 2021 16:58:32 -0700
Message-Id: <20210714235832.2992619-1-luiz.dentz@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

own_addr_type 0x01 and 0x03 shall check that a random address has
properly been set:

BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2496:

  'If LE_Scan_Enable is set to 0x01, the scanning parameters'
  Own_Address_Type parameter is set to 0x01 or 0x03, and the random
  ddress for the device has not been initialized, the Controller shall
  return the error code Invalid HCI Command Parameters (0x12).'

BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2614:

  'If Enable is set to 0x01, the scanning parameters' Own_Address_Type
  parameter is set to 0x01 or 0x03, and the random address for the
  device has not been initialized, the Controller shall return the
  error code Invalid HCI Command Parameters (0x12).'
---
 emulator/btdev.c | 101 ++++++++++++++++++++++++++++++++++++-----------
 src/main.conf    |   4 +-
 2 files changed, 81 insertions(+), 24 deletions(-)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index abd0263d1..e4612ec9e 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -3220,10 +3220,28 @@ static void le_set_adv_enable_complete(struct btdev *btdev)
 	}
 }
 
+#define RL_ADDR_EQUAL(_rl, _type, _addr) \
+	(_rl->type == _type && !bacmp(&_rl->addr, (bdaddr_t *)_addr))
+
+static struct btdev_rl *rl_find(struct btdev *dev, uint8_t type, uint8_t *addr)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(dev->le_rl); i++) {
+		struct btdev_rl *rl = &dev->le_rl[i];
+
+		if (RL_ADDR_EQUAL(rl, type, addr))
+			return rl;
+	}
+
+	return NULL;
+}
+
 static int cmd_set_adv_enable(struct btdev *dev, const void *data, uint8_t len)
 {
 	const struct bt_hci_cmd_le_set_ext_adv_enable *cmd = data;
 	uint8_t status;
+	bool random_addr;
 
 	if (dev->le_adv_enable == cmd->enable) {
 		status = BT_HCI_ERR_COMMAND_DISALLOWED;
@@ -3233,6 +3251,36 @@ static int cmd_set_adv_enable(struct btdev *dev, const void *data, uint8_t len)
 	dev->le_adv_enable = cmd->enable;
 	status = BT_HCI_ERR_SUCCESS;
 
+	if (!cmd->enable)
+		goto done;
+
+	random_addr = bacmp((bdaddr_t *)dev->random_addr, BDADDR_ANY);
+
+	/* If Advertising_Enable is set to 0x01, the advertising parameters'
+	 * Own_Address_Type parameter is set to 0x01, and the random address for
+	 * the device has not been initialized, the Controller shall return the
+	 * error code Invalid HCI Command Parameters (0x12).
+	 */
+	if (dev->le_adv_own_addr == 0x01 && !random_addr) {
+		status = BT_HCI_ERR_INVALID_PARAMETERS;
+		goto done;
+	}
+
+	/* If Advertising_Enable is set to 0x01, the advertising parameters'
+	 * Own_Address_Type parameter is set to 0x03, the controller's resolving
+	 * list did not contain a matching entry, and the random address for the
+	 * device has not been initialized, the Controller shall return the
+	 * error code Invalid HCI Command Parameters (0x12).
+	 */
+	if (dev->le_adv_own_addr == 0x03 && !random_addr) {
+		if (!dev->le_rl_enable ||
+				!rl_find(dev, dev->le_adv_direct_addr_type,
+					dev->le_adv_direct_addr)) {
+			status = BT_HCI_ERR_INVALID_PARAMETERS;
+			goto done;
+		}
+	}
+
 done:
 	cmd_complete(dev, BT_HCI_CMD_LE_SET_ADV_ENABLE, &status,
 						sizeof(status));
@@ -3275,6 +3323,18 @@ static int cmd_set_scan_enable(struct btdev *dev, const void *data, uint8_t len)
 		goto done;
 	}
 
+	/* If LE_Scan_Enable is set to 0x01, the scanning parameters'
+	 * Own_Address_Type parameter is set to 0x01 or 0x03, and the random
+	 * address for the device has not been initialized, the Controller shall
+	 * return the error code Invalid HCI Command Parameters (0x12).
+	 */
+	if ((dev->le_scan_own_addr_type == 0x01 ||
+			dev->le_scan_own_addr_type == 0x03) &&
+			!bacmp((bdaddr_t *)dev->random_addr, BDADDR_ANY)) {
+		status = BT_HCI_ERR_INVALID_PARAMETERS;
+		goto done;
+	}
+
 	dev->le_scan_enable = cmd->enable;
 	dev->le_filter_dup = cmd->filter_dup;
 	status = BT_HCI_ERR_SUCCESS;
@@ -3586,9 +3646,6 @@ static int cmd_remove_wl(struct btdev *dev, const void *data, uint8_t len)
 	return 0;
 }
 
-#define RL_ADDR_EQUAL(_rl, _type, _addr) \
-	(_rl->type == _type && !bacmp(&_rl->addr, (bdaddr_t *)_addr))
-
 static int cmd_add_rl(struct btdev *dev, const void *data, uint8_t len)
 {
 	const struct bt_hci_cmd_le_add_to_resolv_list *cmd = data;
@@ -4538,20 +4595,6 @@ static bool ext_adv_timeout(void *user_data)
 	return false;
 }
 
-static struct btdev_rl *rl_find(struct btdev *dev, uint8_t type, uint8_t *addr)
-{
-	unsigned int i;
-
-	for (i = 0; i < ARRAY_SIZE(dev->le_rl); i++) {
-		struct btdev_rl *rl = &dev->le_rl[i];
-
-		if (RL_ADDR_EQUAL(rl, type, addr))
-			return rl;
-	}
-
-	return NULL;
-}
-
 static int cmd_set_ext_adv_enable(struct btdev *dev, const void *data,
 							uint8_t len)
 {
@@ -4819,14 +4862,28 @@ static int cmd_set_ext_scan_enable(struct btdev *dev, const void *data,
 	const struct bt_hci_cmd_le_set_ext_scan_enable *cmd = data;
 	uint8_t status;
 
-	if (dev->le_scan_enable == cmd->enable)
+	if (dev->le_scan_enable == cmd->enable) {
 		status = BT_HCI_ERR_COMMAND_DISALLOWED;
-	else {
-		dev->le_scan_enable = cmd->enable;
-		dev->le_filter_dup = cmd->filter_dup;
-		status = BT_HCI_ERR_SUCCESS;
+		goto done;
+	}
+
+	/* If Enable is set to 0x01, the scanning parameters' Own_Address_Type
+	 * parameter is set to 0x01 or 0x03, and the random address for the
+	 * device has not been initialized, the Controller shall return the
+	 * error code Invalid HCI Command Parameters (0x12).
+	 */
+	if ((dev->le_scan_own_addr_type == 0x01 ||
+			dev->le_scan_own_addr_type == 0x03) &&
+			!bacmp((bdaddr_t *)dev->random_addr, BDADDR_ANY)) {
+		status = BT_HCI_ERR_INVALID_PARAMETERS;
+		goto done;
 	}
 
+	dev->le_scan_enable = cmd->enable;
+	dev->le_filter_dup = cmd->filter_dup;
+	status = BT_HCI_ERR_SUCCESS;
+
+done:
 	cmd_complete(dev, BT_HCI_CMD_LE_SET_EXT_SCAN_ENABLE, &status,
 							sizeof(status));
 
diff --git a/src/main.conf b/src/main.conf
index 198899541..791b0f909 100644
--- a/src/main.conf
+++ b/src/main.conf
@@ -70,7 +70,7 @@
 # Possible values: "off", "device", "network"
 # "network" option not supported currently
 # Defaults to "off"
-# Privacy = off
+Privacy = device
 
 # Specify the policy to the JUST-WORKS repairing initiated by peer
 # Possible values: "never", "confirm", "always"
@@ -88,7 +88,7 @@
 
 # Enables experimental features and interfaces.
 # Defaults to false.
-#Experimental = false
+Experimental = true
 
 [BR]
 # The following values are used to load default adapter parameters for BR/EDR.
-- 
2.31.1