2011-02-08 23:58:38

by Brian Gix

[permalink] [raw]
Subject: Kernal/User space change for LE Random Addresses


One other change that is needed, which I don't really know how to attack
is remote devices with Random Addresses. There is at least one team
here at UPF with a device with a Random Address which cannot be
connected to with either Vinicius' or the bluetooth-next kernal tips,
because the connection HCI command only specifies Public Addresses as
the remote address type.

I am not at all knowledgable about sockets, but I assume that a new
Socket option needs to be defined that specifies address type.

I can get around this inelegantly by building a secondary kernel which
hard-codes the address type to Random, and then dual booting into that
kernel for random address only remote devices.

I would love if someone who knows the bluez socket option handling (both
kernel and user space) could fix this, otherwise I will try to muddle
along on my own.


--
Brian Gix
[email protected]
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum


2011-02-09 15:38:58

by Johan Hedberg

[permalink] [raw]
Subject: Re: Kernal/User space change for LE Random Addresses

Hi Claudio,

On Wed, Feb 09, 2011, Claudio Takahasi wrote:
> An address/advertising cache will be added in the kernel, if the given
> address is found in the cache the two most significant bits will be
> checked to infer the address type,

For the public vs random address detection you need to use the address
type info in the advertising report. Only when you've determined that
the address is random will the two bits make sense. So far the only use
I can think of for these bits is to determine whether it's useful to try
to perform a lookup in our IRK list (e.g. for a non-resolvable private
key that wouldn't make sense). Are there any other uses?

> otherwise the fallback will be BR/EDR. For BR/EDR L2CAP SOCK_SEQPACKET
> sockets PSM is always provided, we can also use this information to
> distinguish BR/EDR from LE address if an advertising has not been
> detected previously.

I think we could still keep the current CID based decision on the kernel
side. If the CID implies LE but we don't have a match for the address in
the cache we just return an error to user space.

Johan

2011-02-09 09:34:09

by Claudio Takahasi

[permalink] [raw]
Subject: Re: Kernal/User space change for LE Random Addresses

Hi Brian,
On Tue, Feb 8, 2011 at 9:58 PM, Brian Gix <[email protected]> wrote:
>
> One other change that is needed, which I don't really know how to attack is
> remote devices with Random Addresses.  There is at least one team here at
> UPF with a device with a Random Address which cannot be connected to with
> either Vinicius' or the bluetooth-next kernal tips, because the connection
> HCI command only specifies Public Addresses as the remote address type.
>

We are already working on it. We discussed yesterday an approach to
address this issue.
An address/advertising cache will be added in the kernel, if the given
address is found in the cache the two most significant bits will be
checked to infer the address type, otherwise the fallback will be
BR/EDR. For BR/EDR L2CAP SOCK_SEQPACKET sockets PSM is always
provided, we can also use this information to distinguish BR/EDR from
LE address if an advertising has not been detected previously.

> I am not at all knowledgable about sockets, but I assume that a new Socket
> option needs to be defined that specifies address type.
>
> I can get around this inelegantly by building a secondary kernel which
> hard-codes the address type to Random, and then dual booting into that
> kernel for random address only remote devices.
>
> I would love if someone who knows the bluez socket option handling (both
> kernel and user space) could fix this, otherwise I will try to muddle along
> on my own.

I suggest to build a secondary kernel while we are working on it.

BR,
Claudio.