From 465ffa69b8e402989b9c1a08090b269261abbd74 Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 22 Sep 2022 17:21:58 +0200
Subject: [PATCH] nimble/ll: Fix initiator on aux with RPA and no peer IRK

This is follow up on 8447ec2969. We allow peer RPA to be used in the
same way as identity address if we do not have peer IRK, so we also need
to update checks for AUX_CONNECT_RSP.
---
 nimble/controller/src/ble_ll_scan_aux.c | 41 +++++++++++++------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/nimble/controller/src/ble_ll_scan_aux.c b/nimble/controller/src/ble_ll_scan_aux.c
index ed69055b1..23f4986eb 100644
--- a/nimble/controller/src/ble_ll_scan_aux.c
+++ b/nimble/controller/src/ble_ll_scan_aux.c
@@ -1502,6 +1502,7 @@ ble_ll_scan_aux_check_connect_rsp(uint8_t *rxbuf,
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
     struct ble_ll_resolv_entry *rl = NULL;
 #endif
+    uint8_t match_adva = 1;
 
     pdu_hdr = rxbuf[0];
     pdu_len = rxbuf[1];
@@ -1534,34 +1535,34 @@ ble_ll_scan_aux_check_connect_rsp(uint8_t *rxbuf,
     targeta_type = !!(pdu_hdr & BLE_ADV_PDU_HDR_RXADD_RAND);
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
-    /* If we have IRK for peer and AdvA is an RPA, we need to check if current
-     * RPA resolves using that IRK. This is to verify AdvA in case RPS changed
-     * due to timeout or AdvA in advertising was an identity address but is an
-     * RPA in AUX_CONNECT_RSP.
-     * Otherwise, it shall be the same as in AUX_CONNECT_REQ.
+    /* If AdvA is an RPA and we have peer IRK, we need to check if it resolves
+     * using that RPA because peer can change RPA between advertising PDU and
+     * AUX_CONNECT_RSP. In other case, we expect AdvA to be the same as in
+     * advertising PDU.
      */
     if ((addrd->rpa_index >= 0) && ble_ll_is_rpa(adva, adva_type)) {
         rl = &g_ble_ll_resolv_list[addrd->rpa_index];
 
-        if (!ble_ll_resolv_rpa(adva, rl->rl_peer_irk)) {
-            return -1;
-        }
+        if (rl->rl_has_peer) {
+            if (!ble_ll_resolv_rpa(adva, rl->rl_peer_irk)) {
+                return -1;
+            }
 
-        addrd->adva_resolved = 1;
-        addrd->adva = adva;
-        addrd->adva_type = adva_type;
-    } else if ((adva_type !=
-                !!(pdu_data->hdr_byte & BLE_ADV_PDU_HDR_RXADD_MASK)) ||
-               (memcmp(adva, pdu_data->adva, 6) != 0)) {
-            return -1;
-    }
-#else
-    if ((adva_type != !!(pdu_data->hdr_byte & BLE_ADV_PDU_HDR_RXADD_MASK)) ||
-        (memcmp(adva, pdu_data->adva, 6) != 0)) {
-            return -1;
+            addrd->adva_resolved = 1;
+            addrd->adva = adva;
+            addrd->adva_type = adva_type;
+
+            match_adva = 0;
+        }
     }
 #endif /* BLE_LL_CFG_FEAT_LL_PRIVACY */
 
+    if (match_adva &&
+        ((adva_type != !!(pdu_data->hdr_byte & BLE_ADV_PDU_HDR_RXADD_MASK)) ||
+         (memcmp(adva, pdu_data->adva, 6) != 0))) {
+        return -1;
+    }
+
     if ((targeta_type != !!(pdu_data->hdr_byte & BLE_ADV_PDU_HDR_TXADD_MASK)) ||
         (memcmp(targeta, pdu_data->inita, 6) != 0)) {
         return -1;