chriz/OpenMQTT-Gateway
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

[BT] Default BLE AES key empty, skip decryption without a key (#2310)

Browse Source 
* [BT] Default BLE AES key empty, skip decryption without a key

Shipping a non-empty default key caused fresh installs to attempt
decryption of every encrypted PVVX/BTHome v2/Victron advertisement with
the placeholder string from User_config.h. Frames that didn't happen to
share that key were silently dropped at the CCM auth step, masking
otherwise-decodable devices (notably Victron MPPT) until users found and
entered a per-MAC key.

Initialise ble_aes[] to "" and treat an empty default as "no default
configured" in the decryption path - mirroring Theengs Gateway, which
has no default and skips frames whose MAC has no bindkey. Per-MAC keys
in ble_aes_keys still take precedence; the BLE_AES macro remains as the
WebUI placeholder hint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [BT] clang-format: move BLE_AES default comment above #define

clang-format-9 rejected the trailing-comment continuation on the empty
BLE_AES default line. Move the explanation to a leading // block above
the #ifndef so the directive line is comment-free.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [BT] Use THEENGS_LOG_TRACE for missing-AES-key skip log

Previous commit referenced THEENGS_LOG_DEBUG, which OMG does not define
(only VERBOSE/TRACE/NOTICE/WARNING/ERROR exist), breaking every BLE
firmware build. Switch to THEENGS_LOG_TRACE — same level as the adjacent
"Custom AES key" / "Default AES key" trace lines.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
FlorianandClaude Opus 4.7 authored and GitHub committed 2026-05-16 10:26:49 -05:00
1 parent 647e437382
commit 319c05af5c
4 files changed
+14 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

main/gatewayBT.cpp
+6 -1
View File
@@ -1275,9 +1275,14 @@ void process_bledata(JsonObject& BLEdata) {
if (ble_aes_keys.containsKey(macWOdots)) {
THEENGS_LOG_TRACE(F("[BLEDecryptor] Custom AES key %s" CR), ble_aes_keys[macWOdots].as<const char*>());
bleaeskeylength = hexToBytes(ble_aes_keys[macWOdots], bleaeskey, 16);
} else {
} else if (strlen(ble_aes) >= 32) {
THEENGS_LOG_TRACE(F("[BLEDecryptor] Default AES key" CR));
bleaeskeylength = hexToBytes(ble_aes, bleaeskey, 16);
} else {
// No per-MAC key configured and no default set: skip silently rather
// than attempting decryption with a placeholder key.
THEENGS_LOG_TRACE(F("[BLEDecryptor] No AES key configured for %s, skipping" CR), macWOdots.c_str());
return;
}
// Check AES Key
if (bleaeskeylength != 16) {