whitelist not working: Unable to connect after aci_gap_set_undirected_connectable

[VVain.1]

I'm trying to allow re-connects only for whitelisted devices.

I have a phone which is bonded (pass key security) and connected with no problems.

On device disconnect i do the following:

aci_gap_configure_whitelist();
aci_gap_set_undirected_connectable(Advertising_Interval_Min, Advertising_Interval_Max, 0, WHITE_LIST_FOR_ALL);

I'm trying to connect again with the same device, but it's not able to.

No one is able to connect at this point, even though device is discoverable.

I have verified with aci_gap_is_device_bonded before calling aci_gap_configure_whitelist and the device is bonded, so the call to aci_gap_configure_whitelist should have added the device to whitelist. I also tried adding the device to whitelist with hci_le_add_device_to_white_list but got same results.

Using BLE FW Stack: 1.8.0

[Remi QUINTIN]

When the bonding_mode parameter is set to 1 in the aci_gap_set_authentication_requirement function, devices requiring secure connection (pairing) are automatically added to the bonded list as soon as the paring is successful;

aci_gap_get_bonded_devices and aci_gap_is_device_bonded functions inform about the devices being part of that bonded list. This list is managed by the controller (on CM0+ core) and is automatically saved in Flash memory when there is no RF activity.

The white list is a different list which is managed by the application (on CM4 core) and located in SRAM. This list is populated using the aci_gap_configure_whitelist function. But this list is not automatically saved in flash memory. The application has save it when the devices are disconnected.

So it all depends if the white list was saved to the flash memory before reset.

Then you can use the aci_gap_set_undirected_connectable function that has a filter policy parameter for advertising (0x03: Allow scan request from white list only, allow connect request from white list only).

Avoid using the aci_gap_clear_security_db function which clears all security information (white list included).

[VVain.1]

Thanks for the detailed explanation, it became much more clearer now.

But i do not try to reconnect after reset, but right after disconnect.

After reset i do the following:

0. call aci_gap_configure_whitelist

1. enter normal discovery mode.

2. connect with bonded device.

3. disconnect the bonded device.

4. on disconnect i enter undirected connectable mode

5. try to connect with the same bonded device.

But unable to.

I've also tried calling aci_gap_configure_whitelist and hci_le_add_to_whitelist after steo 3, and still was unable to connect.

[Remi QUINTIN]

0. call aci_gap_configure_whitelist: All the devices part of the bonded list are moved to the white list. As the bonded list was saved in Flash memory , all bonded devices resulting from previous sessions should be part of the white list.

1. enter normal discovery mode.

2. connect with bonded device.

3. disconnect the bonded device : Was this device already part of the white list? if not you should call the aci_gap_configure_whitelist before reconnecting.

4. on disconnect i enter undirected connectable mode:

5. connect with the same bonded device: Which should be part of the white list if you called the aci_gap_configure_whitelist function just after disconnecting.

[VVain.1]

Yes, in step 3 device was already part of the whitelist, just to be sure, i added another call to aci_gap_configure_whitelist, it didn't help.

I only able to connect, if i change Adv_Filter_Policy to NO_WHITE_LIST_USE (0x0).

I even tried calling aci_gap_is_device_bonded before calling aci_gap_configure_whitelist and the device is bonded right before a call to aci_gap_configure_whitelist, yet i'm unable to connect after calling aci_gap_set_undirected_connectable with Adv_Filter_Policy set to WHITE_LIST_FOR_ALL (0x3).

I also tried calling hci_le_add_device_to_white_list on disconnect, and still, unable to connect.

[Remi QUINTIN]

​We did the following expriment and all works fine

Device 1 and device2 initialization (bonding enabled)

Device2 is advertising, device1 is scanning and issuing a connection request with a pairing.

The connection is successfull and so device 1 becomes part of the bonded (trusted) devices for device 2.… and vis versa (Device 2 becomes part of the bonded devices for device 1)

Disconnection

On device 2, call aci_gap_configure_whitelist to move all bonded devices in the whitelist 

Device2 calls aci_gap_set_undirected_connectable (with adv_filter_policy=0x03: allow scan request from white list only, allow connect request from white list only.

Device1 starts a aci_gap_start_general_connection_establishment_proc (avec scanning_filter_policy=1), and get the advertising repports from device2

Device1 performs a aci_gap_create_connection(addr device2) -> connection complete

 So it works!!

[VVain.1]

Can you please provide a working example project? I'm still unable to make it work.

I took example project from STM32Cube_FW_WB_V1.8.0 Firmware package: Projects/P-NUCLEO-WB55.Nucleo/Applications/BLE/BLE_HeartRate and modified it, see patch attached. It doesn't work.

The test flow:

Device 1 is STM32WB55 Nucleo with FW 1.8.0

Device 2 is an Android phone with "nRF Connect" app.

Device 1 starts the modified BLE_HeartRate example.

Device 2 creates a bond, and connects to the device.

Device 1 is reset, normal boot flow occurs, aci_gap_configure_whitelist is called.

Device 2 connects to Device 1.

Device 2 disconnects from Device 1.

Device 1 enter undirect_connectable mode.

Device 2 tries to connect to Device 1. <- Not connecting at this point.

Patch file:

diff -r BLE_HeartRate_Orig/STM32_WPAN/App/app_ble.c BLE_HeartRate/STM32_WPAN/App/app_ble.c
409c409
< Adv_Request(APP_BLE_FAST_ADV);
---
> Adv_Request(APP_BLE_FAST_ADV_WHITELIST);
869c869
< if (New_Status == APP_BLE_FAST_ADV)
---
> if (New_Status == APP_BLE_FAST_ADV || New_Status == APP_BLE_FAST_ADV_WHITELIST)
890c890,891
< || (BleApplicationContext.Device_Connection_Status == APP_BLE_LP_ADV)))
---
> || (BleApplicationContext.Device_Connection_Status == APP_BLE_LP_ADV)
> || (BleApplicationContext.Device_Connection_Status == APP_BLE_FAST_ADV_WHITELIST)))
906,917c907,926
< ret = aci_gap_set_discoverable(
< ADV_IND,
< Min_Inter,
< Max_Inter,
< PUBLIC_ADDR,
< NO_WHITE_LIST_USE, /* use white list */
< sizeof(local_name),
< (uint8_t*) &local_name,
< BleApplicationContext.BleApplicationContext_legacy.advtServUUIDlen,
< BleApplicationContext.BleApplicationContext_legacy.advtServUUID,
< 0,
< 0);
---
> if (New_Status == APP_BLE_FAST_ADV_WHITELIST) {
> /* Update Advertising data */
> aci_gap_update_adv_data(sizeof(manuf_data), (uint8_t*) manuf_data);
> ret = aci_gap_set_undirected_connectable(Min_Inter, Max_Inter, PUBLIC_ADDR,WHITE_LIST_FOR_ALL);
> } else {
> aci_gap_set_discoverable(
> ADV_IND,
> Min_Inter,
> Max_Inter,
> PUBLIC_ADDR,
> NO_WHITE_LIST_USE, /* use white list */
> sizeof(local_name),
> (uint8_t*) &local_name,
> BleApplicationContext.BleApplicationContext_legacy.advtServUUIDlen,
> BleApplicationContext.BleApplicationContext_legacy.advtServUUID,
> 0,
> 0);
> /* Update Advertising data */
> ret = aci_gap_update_adv_data(sizeof(manuf_data), (uint8_t*) manuf_data);
> }
919,920d927
< /* Update Advertising data */
< ret = aci_gap_update_adv_data(sizeof(manuf_data), (uint8_t*) manuf_data);
947a955,956
> 
> 
diff -r BLE_HeartRate_Orig/STM32_WPAN/App/app_ble.h BLE_HeartRate/STM32_WPAN/App/app_ble.h
43a44
> 	 APP_BLE_FAST_ADV_WHITELIST,

Basically, on EVT_DISCONN_COMPLETE, i call Adv_Request with new mode: APP_BLE_FAST_ADV_WHITELIST

which instead of aci_gap_set_discoverable calls to aci_gap_set_undirected_connectable. And it does not work.

[VVain.1]

Would be really nice if ST could provide a working whitelist example project.

Thanks.

[JDeco.1]

Did you ever get it figured out? I have some further input on what appears to be the exact same issue:

When I call aci_gap_set_discoverable with any white list parameter other than NO_WHITE_LIST_USE (0x00) I get ret = 0x42 : BLE_STATUS_INVALID_PARAMS

and the device stops advertising...

Is there a reason I can't call this with WHITE_LIST_FOR_ALL (0x03)?

[JDeco.1]

In the meantime, I think I found a workaround in the form:

ret = hci_le_set_advertise_enable(0);

ret = hci_le_set_advertising_parameters( Advertising_Interval_Min,

                     Advertising_Interval_Max,

                     advType,

                     BLE_ADDR_TYPE,

                     0,

                     0,

                     0x07,

                     whitelist );

ret = hci_le_set_advertise_enable(1);

in place of aci_gap_set_discoverable

[VVain.1]

Hi,

I've tried your solution with no luck. Are you sure this works for you?

When i call this methods, i do not see the device when i scan for it, and I'm unable to connect to it, not from the bonded (whitelisted) device, not from any other device.

I've tried with:

advType = ADV_IND,

BLE_ADDR_TYPE = 0x00,

whitelist = 0x03 (or 0x02)

[JPrin.3]

Is there a solution for this already?

[sstel.1]

Any solution?

[crwper]

I am having the exact same issue described above. Has anyone found a solution?

ST: A working example of a whitelist application would be very helpful.

[crwper]

Something I've just noticed, and I'm wondering if it's relevant. When I connect to my peripheral using a mobile device, I see the following as part of the debug output:

Connection established with Central: @:59:65:27:a4:c0:c4
Address type: 01

But then later, when I dump the output of `aci_gap_get_bonded_devices`, I get:

Address: @:0c:d7:46:74:1f:d3
Address type: 00

It looks like the central device is using a random device address (address type 0x01), but in the results from `aci_gap_get_bonded_devices`, a different public device address (address type 0x00) is shown. These may correspond with the same central device, but I wanted to make sure that the whitelist will work with devices that are using random device addresses without additional configuration.

In PM0271, section 5.3.1, an example is given using controller-based privacy *and* device filtering. I guess what I'm wondering is if it's possible to use *just* device filtering without controller-based privacy, if the peripheral will need to connnect to devices using random addresses.