1 /* 2 * Copyright (C) 2014 BlueKitchen GmbH 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the copyright holders nor the names of 14 * contributors may be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * 4. Any redistribution, use, or modification is done solely for 17 * personal benefit and not for any commercial purpose or for 18 * monetary gain. 19 * 20 * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS 24 * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 27 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 28 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 29 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF 30 * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * Please inquire about commercial licensing options at 34 * [email protected] 35 * 36 */ 37 38 #define BTSTACK_FILE__ "att_db.c" 39 40 #include <string.h> 41 42 #include "ble/att_db.h" 43 #include "ble/core.h" 44 #include "bluetooth.h" 45 #include "btstack_debug.h" 46 #include "btstack_util.h" 47 48 // check for ENABLE_ATT_DELAYED_READ_RESPONSE -> ENABLE_ATT_DELAYED_RESPONSE, 49 #ifdef ENABLE_ATT_DELAYED_READ_RESPONSE 50 #error "ENABLE_ATT_DELAYED_READ_RESPONSE was replaced by ENABLE_ATT_DELAYED_RESPONSE. Please update btstack_config.h" 51 #endif 52 53 typedef enum { 54 ATT_READ, 55 ATT_WRITE, 56 } att_operation_t; 57 58 59 static int is_Bluetooth_Base_UUID(uint8_t const *uuid){ 60 // Bluetooth Base UUID 00000000-0000-1000-8000-00805F9B34FB in little endian 61 static const uint8_t bluetooth_base_uuid[] = { 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 62 63 if (memcmp(&uuid[0], &bluetooth_base_uuid[0], 12) != 0) return false; 64 if (memcmp(&uuid[14], &bluetooth_base_uuid[14], 2) != 0) return false; 65 return true; 66 67 } 68 69 static uint16_t uuid16_from_uuid(uint16_t uuid_len, uint8_t * uuid){ 70 if (uuid_len == 2u) return little_endian_read_16(uuid, 0u); 71 if (!is_Bluetooth_Base_UUID(uuid)) return 0; 72 return little_endian_read_16(uuid, 12); 73 } 74 75 // ATT Database 76 77 // new java-style iterator 78 typedef struct att_iterator { 79 // private 80 uint8_t const * att_ptr; 81 // public 82 uint16_t size; 83 uint16_t flags; 84 uint16_t handle; 85 uint8_t const * uuid; 86 uint16_t value_len; 87 uint8_t const * value; 88 } att_iterator_t; 89 90 static void att_persistent_ccc_cache(att_iterator_t * it); 91 92 static uint8_t const * att_db = NULL; 93 static att_read_callback_t att_read_callback = NULL; 94 static att_write_callback_t att_write_callback = NULL; 95 static int att_prepare_write_error_code = 0; 96 static uint16_t att_prepare_write_error_handle = 0x0000; 97 98 // single cache for att_is_persistent_ccc - stores flags before write callback 99 static uint16_t att_persistent_ccc_handle; 100 static uint16_t att_persistent_ccc_uuid16; 101 102 static void att_iterator_init(att_iterator_t *it){ 103 it->att_ptr = att_db; 104 } 105 106 static bool att_iterator_has_next(att_iterator_t *it){ 107 return it->att_ptr != NULL; 108 } 109 110 static void att_iterator_fetch_next(att_iterator_t *it){ 111 it->size = little_endian_read_16(it->att_ptr, 0); 112 if (it->size == 0u){ 113 it->flags = 0; 114 it->handle = 0; 115 it->uuid = NULL; 116 it->value_len = 0; 117 it->value = NULL; 118 it->att_ptr = NULL; 119 return; 120 } 121 it->flags = little_endian_read_16(it->att_ptr, 2); 122 it->handle = little_endian_read_16(it->att_ptr, 4); 123 it->uuid = &it->att_ptr[6]; 124 // handle 128 bit UUIDs 125 if ((it->flags & ATT_PROPERTY_UUID128) != 0u){ 126 it->value_len = it->size - 22u; 127 it->value = &it->att_ptr[22]; 128 } else { 129 it->value_len = it->size - 8u; 130 it->value = &it->att_ptr[8]; 131 } 132 // advance AFTER setting values 133 it->att_ptr += it->size; 134 } 135 136 static int att_iterator_match_uuid16(att_iterator_t *it, uint16_t uuid){ 137 if (it->handle == 0u) return 0u; 138 if (it->flags & ATT_PROPERTY_UUID128){ 139 if (!is_Bluetooth_Base_UUID(it->uuid)) return 0; 140 return little_endian_read_16(it->uuid, 12) == uuid; 141 } 142 return little_endian_read_16(it->uuid, 0) == uuid; 143 } 144 145 static int att_iterator_match_uuid(att_iterator_t *it, uint8_t *uuid, uint16_t uuid_len){ 146 if (it->handle == 0u) return 0u; 147 // input: UUID16 148 if (uuid_len == 2u) { 149 return att_iterator_match_uuid16(it, little_endian_read_16(uuid, 0)); 150 } 151 // input and db: UUID128 152 if ((it->flags & ATT_PROPERTY_UUID128) != 0u){ 153 return memcmp(it->uuid, uuid, 16) == 0; 154 } 155 // input: UUID128, db: UUID16 156 if (!is_Bluetooth_Base_UUID(uuid)) return 0; 157 return little_endian_read_16(uuid, 12) == little_endian_read_16(it->uuid, 0); 158 } 159 160 161 static int att_find_handle(att_iterator_t *it, uint16_t handle){ 162 if (handle == 0u) return 0u; 163 att_iterator_init(it); 164 while (att_iterator_has_next(it)){ 165 att_iterator_fetch_next(it); 166 if (it->handle != handle) continue; 167 return 1; 168 } 169 return 0; 170 } 171 172 // experimental client API 173 uint16_t att_uuid_for_handle(uint16_t attribute_handle){ 174 att_iterator_t it; 175 int ok = att_find_handle(&it, attribute_handle); 176 if (!ok) return 0; 177 if ((it.flags & ATT_PROPERTY_UUID128) != 0u) return 0u; 178 return little_endian_read_16(it.uuid, 0); 179 } 180 // end of client API 181 182 static void att_update_value_len(att_iterator_t *it, hci_con_handle_t con_handle){ 183 if ((it->flags & ATT_PROPERTY_DYNAMIC) == 0u) return; 184 it->value_len = (*att_read_callback)(con_handle, it->handle, 0, NULL, 0); 185 return; 186 } 187 188 // copy attribute value from offset into buffer with given size 189 static int att_copy_value(att_iterator_t *it, uint16_t offset, uint8_t * buffer, uint16_t buffer_size, hci_con_handle_t con_handle){ 190 191 // DYNAMIC 192 if ((it->flags & ATT_PROPERTY_DYNAMIC) != 0u){ 193 return (*att_read_callback)(con_handle, it->handle, offset, buffer, buffer_size); 194 } 195 196 // STATIC 197 uint16_t bytes_to_copy = btstack_min(it->value_len - offset, buffer_size); 198 (void)memcpy(buffer, it->value, bytes_to_copy); 199 return bytes_to_copy; 200 } 201 202 void att_set_db(uint8_t const * db){ 203 // validate db version 204 if (db == NULL) return; 205 if (*db++ != ATT_DB_VERSION){ 206 log_error("ATT DB version differs, please regenerate .h from .gatt file or update att_db_util.c"); 207 return; 208 } 209 log_info("att_set_db %p", db); 210 att_db = db; 211 } 212 213 void att_set_read_callback(att_read_callback_t callback){ 214 att_read_callback = callback; 215 } 216 217 void att_set_write_callback(att_write_callback_t callback){ 218 att_write_callback = callback; 219 } 220 221 void att_dump_attributes(void){ 222 att_iterator_t it; 223 att_iterator_init(&it); 224 uint8_t uuid128[16]; 225 log_info("att_dump_attributes, table %p", att_db); 226 while (att_iterator_has_next(&it)){ 227 att_iterator_fetch_next(&it); 228 if (it.handle == 0u) { 229 log_info("Handle: END"); 230 return; 231 } 232 log_info("Handle: 0x%04x, flags: 0x%04x, uuid: ", it.handle, it.flags); 233 if ((it.flags & ATT_PROPERTY_UUID128) != 0u){ 234 reverse_128(it.uuid, uuid128); 235 log_info("%s", uuid128_to_str(uuid128)); 236 } else { 237 log_info("%04x", little_endian_read_16(it.uuid, 0)); 238 } 239 log_info(", value_len: %u, value: ", it.value_len); 240 log_info_hexdump(it.value, it.value_len); 241 } 242 } 243 244 static void att_prepare_write_reset(void){ 245 att_prepare_write_error_code = 0; 246 att_prepare_write_error_handle = 0x0000; 247 } 248 249 static void att_prepare_write_update_errors(uint8_t error_code, uint16_t handle){ 250 // first ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH has highest priority 251 if ((error_code == ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH) && (error_code != att_prepare_write_error_code)){ 252 att_prepare_write_error_code = error_code; 253 att_prepare_write_error_handle = handle; 254 return; 255 } 256 // first ATT_ERROR_INVALID_OFFSET is next 257 if ((error_code == ATT_ERROR_INVALID_OFFSET) && (att_prepare_write_error_code == 0)){ 258 att_prepare_write_error_code = error_code; 259 att_prepare_write_error_handle = handle; 260 return; 261 } 262 } 263 264 static uint16_t setup_error(uint8_t * response_buffer, uint16_t request, uint16_t handle, uint8_t error_code){ 265 response_buffer[0] = ATT_ERROR_RESPONSE; 266 response_buffer[1] = request; 267 little_endian_store_16(response_buffer, 2, handle); 268 response_buffer[4] = error_code; 269 return 5; 270 } 271 272 static inline uint16_t setup_error_read_not_permitted(uint8_t * response_buffer, uint16_t request, uint16_t start_handle){ 273 return setup_error(response_buffer, request, start_handle, ATT_ERROR_READ_NOT_PERMITTED); 274 } 275 276 static inline uint16_t setup_error_write_not_permitted(uint8_t * response_buffer, uint16_t request, uint16_t start_handle){ 277 return setup_error(response_buffer, request, start_handle, ATT_ERROR_WRITE_NOT_PERMITTED); 278 } 279 280 static inline uint16_t setup_error_atribute_not_found(uint8_t * response_buffer, uint16_t request, uint16_t start_handle){ 281 return setup_error(response_buffer, request, start_handle, ATT_ERROR_ATTRIBUTE_NOT_FOUND); 282 } 283 284 static inline uint16_t setup_error_invalid_handle(uint8_t * response_buffer, uint16_t request, uint16_t handle){ 285 return setup_error(response_buffer, request, handle, ATT_ERROR_INVALID_HANDLE); 286 } 287 288 static inline uint16_t setup_error_invalid_offset(uint8_t * response_buffer, uint16_t request, uint16_t handle){ 289 return setup_error(response_buffer, request, handle, ATT_ERROR_INVALID_OFFSET); 290 } 291 292 static inline uint16_t setup_error_invalid_pdu(uint8_t *response_buffer, uint16_t request) { 293 return setup_error(response_buffer, request, 0, ATT_ERROR_INVALID_PDU); 294 } 295 296 static uint8_t att_validate_security(att_connection_t * att_connection, att_operation_t operation, att_iterator_t * it){ 297 int required_security_level = 0; 298 bool requires_secure_connection = false; 299 switch (operation){ 300 case ATT_READ: 301 if ((it->flags & ATT_PROPERTY_READ_PERMISSION_BIT_0) != 0u){ 302 required_security_level |= 1; 303 } 304 if ((it->flags & ATT_PROPERTY_READ_PERMISSION_BIT_1) != 0u){ 305 required_security_level |= 2; 306 } 307 if ((it->flags & ATT_PROPERTY_READ_PERMISSION_SC) != 0u){ 308 requires_secure_connection = true; 309 } 310 break; 311 case ATT_WRITE: 312 if ((it->flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_0) != 0u){ 313 required_security_level |= 1; 314 } 315 if ((it->flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_1) != 0u){ 316 required_security_level |= 2; 317 } 318 if ((it->flags & ATT_PROPERTY_WRITE_PERMISSION_SC) != 0u){ 319 requires_secure_connection = true; 320 } 321 break; 322 default: 323 btstack_assert(false); 324 break; 325 } 326 327 uint8_t required_encryption_size = it->flags >> 12; 328 if (required_encryption_size != 0) required_encryption_size++; // store -1 to fit into 4 bit 329 330 log_debug("att_validate_security. flags 0x%04x (=> security level %u, key size %u) authorized %u, authenticated %u, encryption_key_size %u, secure connection %u", 331 it->flags, required_security_level, required_encryption_size, att_connection->authorized, att_connection->authenticated, att_connection->encryption_key_size, att_connection->secure_connection); 332 333 bool sc_missing = requires_secure_connection && (att_connection->secure_connection == 0u); 334 switch (required_security_level){ 335 case ATT_SECURITY_AUTHORIZED: 336 if ((att_connection->authorized == 0u) || sc_missing){ 337 return ATT_ERROR_INSUFFICIENT_AUTHORIZATION; 338 } 339 /* fall through */ 340 case ATT_SECURITY_AUTHENTICATED: 341 if ((att_connection->authenticated == 0u) || sc_missing){ 342 return ATT_ERROR_INSUFFICIENT_AUTHENTICATION; 343 } 344 /* fall through */ 345 case ATT_SECURITY_ENCRYPTED: 346 if ((required_encryption_size > 0u) && ((att_connection->encryption_key_size == 0u) || sc_missing)){ 347 return ATT_ERROR_INSUFFICIENT_ENCRYPTION; 348 } 349 if (required_encryption_size > att_connection->encryption_key_size){ 350 return ATT_ERROR_INSUFFICIENT_ENCRYPTION_KEY_SIZE; 351 } 352 break; 353 default: 354 break; 355 } 356 return ATT_ERROR_SUCCESS; 357 } 358 359 // 360 // MARK: ATT_EXCHANGE_MTU_REQUEST 361 // 362 static uint16_t handle_exchange_mtu_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 363 uint8_t * response_buffer){ 364 365 if (request_len != 3u) return setup_error_invalid_pdu(response_buffer, ATT_EXCHANGE_MTU_REQUEST); 366 367 uint16_t client_rx_mtu = little_endian_read_16(request_buffer, 1); 368 369 // find min(local max mtu, remote mtu) >= ATT_DEFAULT_MTU and use as mtu for this connection 370 uint16_t min_mtu = btstack_min(client_rx_mtu, att_connection->max_mtu); 371 uint16_t new_mtu = btstack_max(ATT_DEFAULT_MTU, min_mtu); 372 att_connection->mtu_exchanged = true; 373 att_connection->mtu = new_mtu; 374 375 response_buffer[0] = ATT_EXCHANGE_MTU_RESPONSE; 376 little_endian_store_16(response_buffer, 1, att_connection->mtu); 377 return 3; 378 } 379 380 381 // 382 // MARK: ATT_FIND_INFORMATION_REQUEST 383 // 384 // TODO: handle other types then GATT_PRIMARY_SERVICE_UUID and GATT_SECONDARY_SERVICE_UUID 385 // 386 static uint16_t handle_find_information_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, 387 uint16_t start_handle, uint16_t end_handle){ 388 389 UNUSED(att_connection); 390 391 log_info("ATT_FIND_INFORMATION_REQUEST: from %04X to %04X", start_handle, end_handle); 392 uint8_t request_type = ATT_FIND_INFORMATION_REQUEST; 393 394 if ((start_handle > end_handle) || (start_handle == 0u)){ 395 return setup_error_invalid_handle(response_buffer, request_type, start_handle); 396 } 397 398 uint16_t offset = 1; 399 uint16_t uuid_len = 0; 400 401 att_iterator_t it; 402 att_iterator_init(&it); 403 while (att_iterator_has_next(&it)){ 404 att_iterator_fetch_next(&it); 405 if (!it.handle) break; 406 if (it.handle > end_handle) break; 407 if (it.handle < start_handle) continue; 408 409 // log_info("Handle 0x%04x", it.handle); 410 411 uint16_t this_uuid_len = (it.flags & ATT_PROPERTY_UUID128) ? 16 : 2; 412 413 // check if value has same len as last one if not first result 414 if (offset > 1u){ 415 if (this_uuid_len != uuid_len) { 416 break; 417 } 418 } 419 420 // first 421 if (offset == 1u) { 422 uuid_len = this_uuid_len; 423 // set format field 424 response_buffer[offset] = (it.flags & ATT_PROPERTY_UUID128) ? 0x02 : 0x01; 425 offset++; 426 } 427 428 // space? 429 if ((offset + 2u + uuid_len) > response_buffer_size) break; 430 431 // store 432 little_endian_store_16(response_buffer, offset, it.handle); 433 offset += 2u; 434 435 (void)memcpy(response_buffer + offset, it.uuid, uuid_len); 436 offset += uuid_len; 437 } 438 439 if (offset == 1u){ 440 return setup_error_atribute_not_found(response_buffer, request_type, start_handle); 441 } 442 443 response_buffer[0] = ATT_FIND_INFORMATION_REPLY; 444 return offset; 445 } 446 447 static uint16_t handle_find_information_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 448 uint8_t * response_buffer, uint16_t response_buffer_size){ 449 450 if (request_len != 5u) return setup_error_invalid_pdu(response_buffer, ATT_FIND_INFORMATION_REQUEST); 451 452 uint16_t start_handle = little_endian_read_16(request_buffer, 1); 453 uint16_t end_handle = little_endian_read_16(request_buffer, 3); 454 return handle_find_information_request2(att_connection, response_buffer, response_buffer_size, start_handle, end_handle); 455 } 456 457 // 458 // MARK: ATT_FIND_BY_TYPE_VALUE 459 // 460 // "Only attributes with attribute handles between and including the Starting Handle parameter 461 // and the Ending Handle parameter that match the requested attri- bute type and the attribute 462 // value that have sufficient permissions to allow reading will be returned" -> (1) 463 // 464 // TODO: handle other types then GATT_PRIMARY_SERVICE_UUID and GATT_SECONDARY_SERVICE_UUID 465 // 466 // NOTE: doesn't handle DYNAMIC values 467 // NOTE: only supports 16 bit UUIDs 468 // 469 static uint16_t handle_find_by_type_value_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 470 uint8_t * response_buffer, uint16_t response_buffer_size){ 471 UNUSED(att_connection); 472 473 if (request_len < 7u) return setup_error_invalid_pdu(response_buffer, ATT_FIND_BY_TYPE_VALUE_REQUEST); 474 475 // parse request 476 uint16_t start_handle = little_endian_read_16(request_buffer, 1); 477 uint16_t end_handle = little_endian_read_16(request_buffer, 3); 478 uint16_t attribute_type = little_endian_read_16(request_buffer, 5); 479 const uint8_t *attribute_value = &request_buffer[7]; 480 uint16_t attribute_len = request_len - 7u; 481 482 log_info("ATT_FIND_BY_TYPE_VALUE_REQUEST: from %04X to %04X, type %04X, value: ", start_handle, end_handle, attribute_type); 483 log_info_hexdump(attribute_value, attribute_len); 484 uint8_t request_type = ATT_FIND_BY_TYPE_VALUE_REQUEST; 485 486 if ((start_handle > end_handle) || (start_handle == 0u)){ 487 return setup_error_invalid_handle(response_buffer, request_type, start_handle); 488 } 489 490 uint16_t offset = 1; 491 uint16_t in_group = 0; 492 uint16_t prev_handle = 0; 493 494 att_iterator_t it; 495 att_iterator_init(&it); 496 while (att_iterator_has_next(&it)){ 497 att_iterator_fetch_next(&it); 498 499 if (it.handle && (it.handle < start_handle)) continue; 500 if (it.handle > end_handle) break; // (1) 501 502 // close current tag, if within a group and a new service definition starts or we reach end of att db 503 if (in_group && 504 ((it.handle == 0u) || att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID))){ 505 506 log_info("End of group, handle 0x%04x", prev_handle); 507 little_endian_store_16(response_buffer, offset, prev_handle); 508 offset += 2u; 509 in_group = 0; 510 511 // check if space for another handle pair available 512 if ((offset + 4u) > response_buffer_size){ 513 break; 514 } 515 } 516 517 // keep track of previous handle 518 prev_handle = it.handle; 519 520 // does current attribute match 521 if (it.handle && att_iterator_match_uuid16(&it, attribute_type) && (attribute_len == it.value_len) && (memcmp(attribute_value, it.value, it.value_len) == 0)){ 522 log_info("Begin of group, handle 0x%04x", it.handle); 523 little_endian_store_16(response_buffer, offset, it.handle); 524 offset += 2u; 525 in_group = 1; 526 } 527 } 528 529 if (offset == 1u){ 530 return setup_error_atribute_not_found(response_buffer, request_type, start_handle); 531 } 532 533 response_buffer[0] = ATT_FIND_BY_TYPE_VALUE_RESPONSE; 534 return offset; 535 } 536 537 // 538 // MARK: ATT_READ_BY_TYPE_REQUEST 539 // 540 static uint16_t handle_read_by_type_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, 541 uint16_t start_handle, uint16_t end_handle, 542 uint16_t attribute_type_len, uint8_t * attribute_type){ 543 544 log_info("ATT_READ_BY_TYPE_REQUEST: from %04X to %04X, type: ", start_handle, end_handle); 545 log_info_hexdump(attribute_type, attribute_type_len); 546 uint8_t request_type = ATT_READ_BY_TYPE_REQUEST; 547 548 if ((start_handle > end_handle) || (start_handle == 0u)){ 549 return setup_error_invalid_handle(response_buffer, request_type, start_handle); 550 } 551 552 uint16_t offset = 1; 553 uint16_t pair_len = 0; 554 555 att_iterator_t it; 556 att_iterator_init(&it); 557 uint8_t error_code = 0; 558 uint16_t first_matching_but_unreadable_handle = 0; 559 560 while (att_iterator_has_next(&it)){ 561 att_iterator_fetch_next(&it); 562 563 if ((it.handle == 0u ) || (it.handle > end_handle)) break; 564 565 if (it.handle < start_handle) continue; 566 567 // does current attribute match 568 if (!att_iterator_match_uuid(&it, attribute_type, attribute_type_len)) continue; 569 570 // skip handles that cannot be read but remember that there has been at least one 571 if ((it.flags & ATT_PROPERTY_READ) == 0u) { 572 if (first_matching_but_unreadable_handle == 0u) { 573 first_matching_but_unreadable_handle = it.handle; 574 } 575 continue; 576 } 577 578 // check security requirements 579 error_code = att_validate_security(att_connection, ATT_READ, &it); 580 if (error_code != 0u) break; 581 582 att_update_value_len(&it, att_connection->con_handle); 583 584 #ifdef ENABLE_ATT_DELAYED_RESPONSE 585 if (it.value_len == ATT_READ_RESPONSE_PENDING){ 586 return ATT_READ_RESPONSE_PENDING; 587 } 588 #endif 589 590 // allow to return ATT Error Code in ATT Read Callback 591 if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){ 592 error_code = it.value_len - ATT_READ_ERROR_CODE_OFFSET; 593 break; 594 } 595 596 // check if value has same len as last one 597 uint16_t this_pair_len = 2u + it.value_len; 598 if ((offset > 1u) && (pair_len != this_pair_len)) { 599 break; 600 } 601 602 // first 603 if (offset == 1u) { 604 pair_len = this_pair_len; 605 response_buffer[offset] = pair_len; 606 offset++; 607 } 608 609 // space? 610 if ((offset + pair_len) > response_buffer_size) { 611 if (offset > 2u) break; 612 it.value_len = response_buffer_size - 4u; 613 response_buffer[1u] = 2u + it.value_len; 614 } 615 616 // store 617 little_endian_store_16(response_buffer, offset, it.handle); 618 offset += 2u; 619 uint16_t bytes_copied = att_copy_value(&it, 0, response_buffer + offset, it.value_len, att_connection->con_handle); 620 offset += bytes_copied; 621 } 622 623 // at least one attribute could be read 624 if (offset > 1u){ 625 response_buffer[0] = ATT_READ_BY_TYPE_RESPONSE; 626 return offset; 627 } 628 629 // first attribute had an error 630 if (error_code != 0u){ 631 return setup_error(response_buffer, request_type, start_handle, error_code); 632 } 633 634 // no other errors, but all found attributes had been non-readable 635 if (first_matching_but_unreadable_handle != 0u){ 636 return setup_error_read_not_permitted(response_buffer, request_type, first_matching_but_unreadable_handle); 637 } 638 639 // attribute not found 640 return setup_error_atribute_not_found(response_buffer, request_type, start_handle); 641 } 642 643 static uint16_t handle_read_by_type_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 644 uint8_t * response_buffer, uint16_t response_buffer_size){ 645 646 uint16_t attribute_type_len; 647 switch (request_len){ 648 case 7: 649 attribute_type_len = 2; 650 break; 651 case 21: 652 attribute_type_len = 16; 653 break; 654 default: 655 return setup_error_invalid_pdu(response_buffer, ATT_READ_BY_TYPE_REQUEST); 656 } 657 658 uint16_t start_handle = little_endian_read_16(request_buffer, 1); 659 uint16_t end_handle = little_endian_read_16(request_buffer, 3); 660 return handle_read_by_type_request2(att_connection, response_buffer, response_buffer_size, start_handle, end_handle, attribute_type_len, &request_buffer[5]); 661 } 662 663 // 664 // MARK: ATT_READ_BY_TYPE_REQUEST 665 // 666 static uint16_t handle_read_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, uint16_t handle){ 667 668 log_info("ATT_READ_REQUEST: handle %04x", handle); 669 uint8_t request_type = ATT_READ_REQUEST; 670 671 att_iterator_t it; 672 int ok = att_find_handle(&it, handle); 673 if (!ok){ 674 return setup_error_invalid_handle(response_buffer, request_type, handle); 675 } 676 677 // check if handle can be read 678 if ((it.flags & ATT_PROPERTY_READ) == 0u) { 679 return setup_error_read_not_permitted(response_buffer, request_type, handle); 680 } 681 682 // check security requirements 683 uint8_t error_code = att_validate_security(att_connection, ATT_READ, &it); 684 if (error_code != 0) { 685 return setup_error(response_buffer, request_type, handle, error_code); 686 } 687 688 att_update_value_len(&it, att_connection->con_handle); 689 690 #ifdef ENABLE_ATT_DELAYED_RESPONSE 691 if (it.value_len == ATT_READ_RESPONSE_PENDING) return ATT_READ_RESPONSE_PENDING; 692 #endif 693 694 // allow to return ATT Error Code in ATT Read Callback 695 if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){ 696 error_code = it.value_len - ATT_READ_ERROR_CODE_OFFSET; 697 return setup_error(response_buffer, request_type, handle, error_code); 698 } 699 700 // store 701 uint16_t offset = 1; 702 uint16_t bytes_copied = att_copy_value(&it, 0, response_buffer + offset, response_buffer_size - offset, att_connection->con_handle); 703 offset += bytes_copied; 704 705 response_buffer[0] = ATT_READ_RESPONSE; 706 return offset; 707 } 708 709 static uint16_t handle_read_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 710 uint8_t * response_buffer, uint16_t response_buffer_size){ 711 712 if (request_len != 3u) return setup_error_invalid_pdu(response_buffer, ATT_READ_REQUEST); 713 714 uint16_t handle = little_endian_read_16(request_buffer, 1); 715 return handle_read_request2(att_connection, response_buffer, response_buffer_size, handle); 716 } 717 718 //s 719 // MARK: ATT_READ_BLOB_REQUEST 0x0c 720 // 721 static uint16_t handle_read_blob_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, uint16_t handle, uint16_t value_offset){ 722 log_info("ATT_READ_BLOB_REQUEST: handle %04x, offset %u", handle, value_offset); 723 uint8_t request_type = ATT_READ_BLOB_REQUEST; 724 725 att_iterator_t it; 726 int ok = att_find_handle(&it, handle); 727 if (!ok){ 728 return setup_error_invalid_handle(response_buffer, request_type, handle); 729 } 730 731 // check if handle can be read 732 if ((it.flags & ATT_PROPERTY_READ) == 0u) { 733 return setup_error_read_not_permitted(response_buffer, request_type, handle); 734 } 735 736 // check security requirements 737 uint8_t error_code = att_validate_security(att_connection, ATT_READ, &it); 738 if (error_code != 0) { 739 return setup_error(response_buffer, request_type, handle, error_code); 740 } 741 742 att_update_value_len(&it, att_connection->con_handle); 743 744 #ifdef ENABLE_ATT_DELAYED_RESPONSE 745 if (it.value_len == ATT_READ_RESPONSE_PENDING) return ATT_READ_RESPONSE_PENDING; 746 #endif 747 748 // allow to return ATT Error Code in ATT Read Callback 749 if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){ 750 error_code = it.value_len - ATT_READ_ERROR_CODE_OFFSET; 751 return setup_error(response_buffer, request_type, handle, error_code); 752 } 753 754 if (value_offset > it.value_len){ 755 return setup_error_invalid_offset(response_buffer, request_type, handle); 756 } 757 758 // prepare response 759 response_buffer[0] = ATT_READ_BLOB_RESPONSE; 760 uint16_t offset = 1; 761 762 // fetch more data if available 763 if (value_offset < it.value_len){ 764 uint16_t bytes_copied = att_copy_value(&it, value_offset, &response_buffer[offset], response_buffer_size - offset, att_connection->con_handle); 765 offset += bytes_copied; 766 } 767 return offset; 768 } 769 770 static uint16_t handle_read_blob_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 771 uint8_t * response_buffer, uint16_t response_buffer_size){ 772 773 if (request_len != 5u) return setup_error_invalid_pdu(response_buffer, ATT_READ_BLOB_REQUEST); 774 775 uint16_t handle = little_endian_read_16(request_buffer, 1); 776 uint16_t value_offset = little_endian_read_16(request_buffer, 3); 777 return handle_read_blob_request2(att_connection, response_buffer, response_buffer_size, handle, value_offset); 778 } 779 780 // 781 // MARK: ATT_READ_MULTIPLE_REQUEST 0x0e 782 // 783 static uint16_t handle_read_multiple_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, uint16_t num_handles, uint8_t * handles){ 784 log_info("ATT_READ_MULTIPLE_REQUEST: num handles %u", num_handles); 785 uint8_t request_type = ATT_READ_MULTIPLE_REQUEST; 786 787 uint16_t offset = 1; 788 789 int i; 790 uint8_t error_code = 0; 791 uint16_t handle = 0; 792 793 #ifdef ENABLE_ATT_DELAYED_RESPONSE 794 bool read_request_pending = false; 795 #endif 796 797 for (i=0;i<num_handles;i++){ 798 handle = little_endian_read_16(handles, i << 1); 799 800 if (handle == 0u){ 801 return setup_error_invalid_handle(response_buffer, request_type, handle); 802 } 803 804 att_iterator_t it; 805 806 int ok = att_find_handle(&it, handle); 807 if (!ok){ 808 return setup_error_invalid_handle(response_buffer, request_type, handle); 809 } 810 811 // check if handle can be read 812 if ((it.flags & ATT_PROPERTY_READ) == 0u) { 813 error_code = ATT_ERROR_READ_NOT_PERMITTED; 814 break; 815 } 816 817 // check security requirements 818 error_code = att_validate_security(att_connection, ATT_READ, &it); 819 if (error_code != 0) break; 820 821 att_update_value_len(&it, att_connection->con_handle); 822 823 #ifdef ENABLE_ATT_DELAYED_RESPONSE 824 if (it.value_len == ATT_READ_RESPONSE_PENDING) { 825 read_request_pending = true; 826 } 827 if (read_request_pending) continue; 828 #endif 829 830 // allow to return ATT Error Code in ATT Read Callback 831 if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){ 832 error_code = it.value_len -ATT_READ_ERROR_CODE_OFFSET; 833 break; 834 } 835 836 // store 837 uint16_t bytes_copied = att_copy_value(&it, 0, response_buffer + offset, response_buffer_size - offset, att_connection->con_handle); 838 offset += bytes_copied; 839 } 840 841 if (error_code != 0){ 842 return setup_error(response_buffer, request_type, handle, error_code); 843 } 844 845 response_buffer[0] = ATT_READ_MULTIPLE_RESPONSE; 846 return offset; 847 } 848 static uint16_t handle_read_multiple_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 849 uint8_t * response_buffer, uint16_t response_buffer_size){ 850 851 // 1 byte opcode + two or more attribute handles (2 bytes each) 852 if ( (request_len < 5u) || ((request_len & 1u) == 0u) ) return setup_error_invalid_pdu(response_buffer, 853 ATT_READ_MULTIPLE_REQUEST); 854 855 int num_handles = (request_len - 1u) >> 1u; 856 return handle_read_multiple_request2(att_connection, response_buffer, response_buffer_size, num_handles, &request_buffer[1]); 857 } 858 859 // 860 // MARK: ATT_READ_BY_GROUP_TYPE_REQUEST 0x10 861 // 862 // Only handles GATT_PRIMARY_SERVICE_UUID and GATT_SECONDARY_SERVICE_UUID 863 // Core v4.0, vol 3, part g, 2.5.3 864 // "The «Primary Service» and «Secondary Service» grouping types may be used in the Read By Group Type Request. 865 // The «Characteristic» grouping type shall not be used in the ATT Read By Group Type Request." 866 // 867 // NOTE: doesn't handle DYNAMIC values 868 // 869 // NOTE: we don't check for security as PRIMARY and SECONDAY SERVICE definition shouldn't be protected 870 // Core 4.0, vol 3, part g, 8.1 871 // "The list of services and characteristics that a device supports is not considered private or 872 // confidential information, and therefore the Service and Characteristic Discovery procedures 873 // shall always be permitted. " 874 // 875 static uint16_t handle_read_by_group_type_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, 876 uint16_t start_handle, uint16_t end_handle, 877 uint16_t attribute_type_len, uint8_t * attribute_type){ 878 879 UNUSED(att_connection); 880 881 log_info("ATT_READ_BY_GROUP_TYPE_REQUEST: from %04X to %04X, buffer size %u, type: ", start_handle, end_handle, response_buffer_size); 882 log_info_hexdump(attribute_type, attribute_type_len); 883 uint8_t request_type = ATT_READ_BY_GROUP_TYPE_REQUEST; 884 885 if ((start_handle > end_handle) || (start_handle == 0u)){ 886 return setup_error_invalid_handle(response_buffer, request_type, start_handle); 887 } 888 889 // assert UUID is primary or secondary service uuid 890 uint16_t uuid16 = uuid16_from_uuid(attribute_type_len, attribute_type); 891 if ((uuid16 != GATT_PRIMARY_SERVICE_UUID) && (uuid16 != GATT_SECONDARY_SERVICE_UUID)){ 892 return setup_error(response_buffer, request_type, start_handle, ATT_ERROR_UNSUPPORTED_GROUP_TYPE); 893 } 894 895 uint16_t offset = 1; 896 uint16_t pair_len = 0; 897 uint16_t in_group = 0; 898 uint16_t group_start_handle = 0; 899 uint8_t const * group_start_value = NULL; 900 uint16_t prev_handle = 0; 901 902 att_iterator_t it; 903 att_iterator_init(&it); 904 while (att_iterator_has_next(&it)){ 905 att_iterator_fetch_next(&it); 906 907 if (it.handle && (it.handle < start_handle)) continue; 908 if (it.handle > end_handle) break; // (1) 909 910 // log_info("Handle 0x%04x", it.handle); 911 912 // close current tag, if within a group and a new service definition starts or we reach end of att db 913 if (in_group && 914 ((it.handle == 0u) || att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID))){ 915 // log_info("End of group, handle 0x%04x, val_len: %u", prev_handle, pair_len - 4); 916 917 little_endian_store_16(response_buffer, offset, group_start_handle); 918 offset += 2u; 919 little_endian_store_16(response_buffer, offset, prev_handle); 920 offset += 2u; 921 (void)memcpy(response_buffer + offset, group_start_value, 922 pair_len - 4u); 923 offset += pair_len - 4u; 924 in_group = 0; 925 926 // check if space for another handle pair available 927 if ((offset + pair_len) > response_buffer_size){ 928 break; 929 } 930 } 931 932 // keep track of previous handle 933 prev_handle = it.handle; 934 935 // does current attribute match 936 // log_info("compare: %04x == %04x", *(uint16_t*) context->attribute_type, *(uint16_t*) uuid); 937 if (it.handle && att_iterator_match_uuid(&it, attribute_type, attribute_type_len)) { 938 939 // check if value has same len as last one 940 uint16_t this_pair_len = 4u + it.value_len; 941 if (offset > 1u){ 942 if (this_pair_len != pair_len) { 943 break; 944 } 945 } 946 947 // log_info("Begin of group, handle 0x%04x", it.handle); 948 949 // first 950 if (offset == 1u) { 951 pair_len = this_pair_len; 952 response_buffer[offset] = this_pair_len; 953 offset++; 954 } 955 956 group_start_handle = it.handle; 957 group_start_value = it.value; 958 in_group = 1; 959 } 960 } 961 962 if (offset == 1u){ 963 return setup_error_atribute_not_found(response_buffer, request_type, start_handle); 964 } 965 966 response_buffer[0] = ATT_READ_BY_GROUP_TYPE_RESPONSE; 967 return offset; 968 } 969 static uint16_t handle_read_by_group_type_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 970 uint8_t * response_buffer, uint16_t response_buffer_size){ 971 uint16_t attribute_type_len; 972 switch (request_len){ 973 case 7: 974 attribute_type_len = 2; 975 break; 976 case 21: 977 attribute_type_len = 16; 978 break; 979 default: 980 return setup_error_invalid_pdu(response_buffer, ATT_READ_BY_GROUP_TYPE_REQUEST); 981 } 982 983 uint16_t start_handle = little_endian_read_16(request_buffer, 1); 984 uint16_t end_handle = little_endian_read_16(request_buffer, 3); 985 return handle_read_by_group_type_request2(att_connection, response_buffer, response_buffer_size, start_handle, end_handle, attribute_type_len, &request_buffer[5]); 986 } 987 988 // 989 // MARK: ATT_WRITE_REQUEST 0x12 990 static uint16_t handle_write_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 991 uint8_t * response_buffer, uint16_t response_buffer_size){ 992 993 UNUSED(response_buffer_size); 994 995 if (request_len < 3u) return setup_error_invalid_pdu(response_buffer, ATT_WRITE_REQUEST); 996 997 uint8_t request_type = ATT_WRITE_REQUEST; 998 999 uint16_t handle = little_endian_read_16(request_buffer, 1); 1000 att_iterator_t it; 1001 int ok = att_find_handle(&it, handle); 1002 if (!ok) { 1003 return setup_error_invalid_handle(response_buffer, request_type, handle); 1004 } 1005 if (att_write_callback == NULL) { 1006 return setup_error_write_not_permitted(response_buffer, request_type, handle); 1007 } 1008 if ((it.flags & ATT_PROPERTY_WRITE) == 0u) { 1009 return setup_error_write_not_permitted(response_buffer, request_type, handle); 1010 } 1011 if ((it.flags & ATT_PROPERTY_DYNAMIC) == 0u) { 1012 return setup_error_write_not_permitted(response_buffer, request_type, handle); 1013 } 1014 // check security requirements 1015 int error_code = att_validate_security(att_connection, ATT_WRITE, &it); 1016 if (error_code != 0) { 1017 return setup_error(response_buffer, request_type, handle, error_code); 1018 } 1019 att_persistent_ccc_cache(&it); 1020 error_code = (*att_write_callback)(att_connection->con_handle, handle, ATT_TRANSACTION_MODE_NONE, 0u, request_buffer + 3u, request_len - 3u); 1021 1022 #ifdef ENABLE_ATT_DELAYED_RESPONSE 1023 if (error_code == ATT_ERROR_WRITE_RESPONSE_PENDING) return ATT_INTERNAL_WRITE_RESPONSE_PENDING; 1024 #endif 1025 1026 if (error_code != 0) { 1027 return setup_error(response_buffer, request_type, handle, error_code); 1028 } 1029 response_buffer[0] = ATT_WRITE_RESPONSE; 1030 return 1; 1031 } 1032 1033 // 1034 // MARK: ATT_PREPARE_WRITE_REQUEST 0x16 1035 static uint16_t handle_prepare_write_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 1036 uint8_t * response_buffer, uint16_t response_buffer_size){ 1037 1038 uint8_t request_type = ATT_PREPARE_WRITE_REQUEST; 1039 1040 if (request_len < 5u) return setup_error_invalid_pdu(response_buffer, request_type); 1041 1042 uint16_t handle = little_endian_read_16(request_buffer, 1); 1043 uint16_t offset = little_endian_read_16(request_buffer, 3); 1044 if (att_write_callback == NULL) { 1045 return setup_error_write_not_permitted(response_buffer, request_type, handle); 1046 } 1047 att_iterator_t it; 1048 if (att_find_handle(&it, handle) == 0) { 1049 return setup_error_invalid_handle(response_buffer, request_type, handle); 1050 } 1051 if ((it.flags & ATT_PROPERTY_WRITE) == 0u) { 1052 return setup_error_write_not_permitted(response_buffer, request_type, handle); 1053 } 1054 if ((it.flags & ATT_PROPERTY_DYNAMIC) == 0u) { 1055 return setup_error_write_not_permitted(response_buffer, request_type, handle); 1056 } 1057 // check security requirements 1058 int error_code = att_validate_security(att_connection, ATT_WRITE, &it); 1059 if (error_code != 0) { 1060 return setup_error(response_buffer, request_type, handle, error_code); 1061 } 1062 1063 error_code = (*att_write_callback)(att_connection->con_handle, handle, ATT_TRANSACTION_MODE_ACTIVE, offset, request_buffer + 5u, request_len - 5u); 1064 switch (error_code){ 1065 case 0: 1066 break; 1067 case ATT_ERROR_INVALID_OFFSET: 1068 case ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH: 1069 // postpone to execute write request 1070 att_prepare_write_update_errors(error_code, handle); 1071 break; 1072 #ifdef ENABLE_ATT_DELAYED_RESPONSE 1073 case ATT_ERROR_WRITE_RESPONSE_PENDING: 1074 return ATT_INTERNAL_WRITE_RESPONSE_PENDING; 1075 #endif 1076 default: 1077 return setup_error(response_buffer, request_type, handle, error_code); 1078 } 1079 1080 // response: echo request 1081 uint16_t bytes_to_echo = btstack_min(request_len, response_buffer_size); 1082 (void)memcpy(response_buffer, request_buffer, bytes_to_echo); 1083 response_buffer[0] = ATT_PREPARE_WRITE_RESPONSE; 1084 return request_len; 1085 } 1086 1087 /* 1088 * @brief transcation queue of prepared writes, e.g., after disconnect 1089 */ 1090 void att_clear_transaction_queue(att_connection_t * att_connection){ 1091 (*att_write_callback)(att_connection->con_handle, 0, ATT_TRANSACTION_MODE_CANCEL, 0, NULL, 0); 1092 } 1093 1094 // MARK: ATT_EXECUTE_WRITE_REQUEST 0x18 1095 // NOTE: security has been verified by handle_prepare_write_request 1096 static uint16_t handle_execute_write_request(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, 1097 uint8_t * response_buffer, uint16_t response_buffer_size){ 1098 1099 UNUSED(response_buffer_size); 1100 1101 uint8_t request_type = ATT_EXECUTE_WRITE_REQUEST; 1102 1103 if (request_len < 2u) return setup_error_invalid_pdu(response_buffer, request_type); 1104 1105 if (att_write_callback == NULL) { 1106 return setup_error_write_not_permitted(response_buffer, request_type, 0); 1107 } 1108 1109 if (request_buffer[1]) { 1110 // validate queued write 1111 if (att_prepare_write_error_code == 0){ 1112 att_prepare_write_error_code = (*att_write_callback)(att_connection->con_handle, 0, ATT_TRANSACTION_MODE_VALIDATE, 0, NULL, 0); 1113 } 1114 #ifdef ENABLE_ATT_DELAYED_RESPONSE 1115 if (att_prepare_write_error_code == ATT_ERROR_WRITE_RESPONSE_PENDING) return ATT_INTERNAL_WRITE_RESPONSE_PENDING; 1116 #endif 1117 // deliver queued errors 1118 if (att_prepare_write_error_code != 0){ 1119 att_clear_transaction_queue(att_connection); 1120 uint8_t error_code = att_prepare_write_error_code; 1121 uint16_t handle = att_prepare_write_error_handle; 1122 att_prepare_write_reset(); 1123 return setup_error(response_buffer, request_type, handle, error_code); 1124 } 1125 att_write_callback(att_connection->con_handle, 0, ATT_TRANSACTION_MODE_EXECUTE, 0, NULL, 0); 1126 } else { 1127 att_clear_transaction_queue(att_connection); 1128 } 1129 response_buffer[0] = ATT_EXECUTE_WRITE_RESPONSE; 1130 return 1; 1131 } 1132 1133 // MARK: ATT_WRITE_COMMAND 0x52 1134 // Core 4.0, vol 3, part F, 3.4.5.3 1135 // "No Error Response or Write Response shall be sent in response to this command" 1136 static void handle_write_command(att_connection_t * att_connection, uint8_t * request_buffer, uint16_t request_len, uint16_t required_flags){ 1137 1138 if (request_len < 3u) return; 1139 1140 uint16_t handle = little_endian_read_16(request_buffer, 1); 1141 if (att_write_callback == NULL) return; 1142 1143 att_iterator_t it; 1144 int ok = att_find_handle(&it, handle); 1145 if (!ok) return; 1146 if ((it.flags & ATT_PROPERTY_DYNAMIC) == 0u) return; 1147 if ((it.flags & required_flags) == 0u) return; 1148 if (att_validate_security(att_connection, ATT_WRITE, &it)) return; 1149 att_persistent_ccc_cache(&it); 1150 (*att_write_callback)(att_connection->con_handle, handle, ATT_TRANSACTION_MODE_NONE, 0u, request_buffer + 3u, request_len - 3u); 1151 } 1152 1153 // MARK: helper for ATT_HANDLE_VALUE_NOTIFICATION and ATT_HANDLE_VALUE_INDICATION 1154 static uint16_t prepare_handle_value(att_connection_t * att_connection, 1155 uint16_t handle, 1156 const uint8_t *value, 1157 uint16_t value_len, 1158 uint8_t * response_buffer){ 1159 little_endian_store_16(response_buffer, 1, handle); 1160 if (value_len > (att_connection->mtu - 3u)){ 1161 value_len = att_connection->mtu - 3u; 1162 } 1163 (void)memcpy(&response_buffer[3], value, value_len); 1164 return value_len + 3u; 1165 } 1166 1167 // MARK: ATT_HANDLE_VALUE_NOTIFICATION 0x1b 1168 uint16_t att_prepare_handle_value_notification(att_connection_t * att_connection, 1169 uint16_t handle, 1170 const uint8_t *value, 1171 uint16_t value_len, 1172 uint8_t * response_buffer){ 1173 1174 response_buffer[0] = ATT_HANDLE_VALUE_NOTIFICATION; 1175 return prepare_handle_value(att_connection, handle, value, value_len, response_buffer); 1176 } 1177 1178 // MARK: ATT_HANDLE_VALUE_INDICATION 0x1d 1179 uint16_t att_prepare_handle_value_indication(att_connection_t * att_connection, 1180 uint16_t handle, 1181 const uint8_t *value, 1182 uint16_t value_len, 1183 uint8_t * response_buffer){ 1184 1185 response_buffer[0] = ATT_HANDLE_VALUE_INDICATION; 1186 return prepare_handle_value(att_connection, handle, value, value_len, response_buffer); 1187 } 1188 1189 // MARK: Dispatcher 1190 uint16_t att_handle_request(att_connection_t * att_connection, 1191 uint8_t * request_buffer, 1192 uint16_t request_len, 1193 uint8_t * response_buffer){ 1194 uint16_t response_len = 0; 1195 const uint16_t response_buffer_size = att_connection->mtu; 1196 const uint8_t request_opcode = request_buffer[0]; 1197 1198 switch (request_opcode){ 1199 case ATT_EXCHANGE_MTU_REQUEST: 1200 response_len = handle_exchange_mtu_request(att_connection, request_buffer, request_len, response_buffer); 1201 break; 1202 case ATT_FIND_INFORMATION_REQUEST: 1203 response_len = handle_find_information_request(att_connection, request_buffer, request_len,response_buffer, response_buffer_size); 1204 break; 1205 case ATT_FIND_BY_TYPE_VALUE_REQUEST: 1206 response_len = handle_find_by_type_value_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1207 break; 1208 case ATT_READ_BY_TYPE_REQUEST: 1209 response_len = handle_read_by_type_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1210 break; 1211 case ATT_READ_REQUEST: 1212 response_len = handle_read_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1213 break; 1214 case ATT_READ_BLOB_REQUEST: 1215 response_len = handle_read_blob_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1216 break; 1217 case ATT_READ_MULTIPLE_REQUEST: 1218 response_len = handle_read_multiple_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1219 break; 1220 case ATT_READ_BY_GROUP_TYPE_REQUEST: 1221 response_len = handle_read_by_group_type_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1222 break; 1223 case ATT_WRITE_REQUEST: 1224 response_len = handle_write_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1225 break; 1226 case ATT_PREPARE_WRITE_REQUEST: 1227 response_len = handle_prepare_write_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1228 break; 1229 case ATT_EXECUTE_WRITE_REQUEST: 1230 response_len = handle_execute_write_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size); 1231 break; 1232 case ATT_WRITE_COMMAND: 1233 handle_write_command(att_connection, request_buffer, request_len, ATT_PROPERTY_WRITE_WITHOUT_RESPONSE); 1234 break; 1235 #ifdef ENABLE_LE_SIGNED_WRITE 1236 case ATT_SIGNED_WRITE_COMMAND: 1237 handle_write_command(att_connection, request_buffer, request_len, ATT_PROPERTY_AUTHENTICATED_SIGNED_WRITE); 1238 break; 1239 #endif 1240 default: 1241 response_len = setup_error(response_buffer, request_opcode, 0, ATT_ERROR_REQUEST_NOT_SUPPORTED); 1242 break; 1243 } 1244 return response_len; 1245 } 1246 1247 // returns 1 if service found. only primary service. 1248 bool gatt_server_get_get_handle_range_for_service_with_uuid16(uint16_t uuid16, uint16_t * start_handle, uint16_t * end_handle){ 1249 uint16_t in_group = 0; 1250 uint16_t prev_handle = 0; 1251 1252 uint8_t attribute_value[2]; 1253 int attribute_len = sizeof(attribute_value); 1254 little_endian_store_16(attribute_value, 0, uuid16); 1255 1256 att_iterator_t it; 1257 att_iterator_init(&it); 1258 while (att_iterator_has_next(&it)){ 1259 att_iterator_fetch_next(&it); 1260 int new_service_started = att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID); 1261 1262 // close current tag, if within a group and a new service definition starts or we reach end of att db 1263 if (in_group && 1264 ((it.handle == 0u) || new_service_started)){ 1265 *end_handle = prev_handle; 1266 return true; 1267 } 1268 1269 // keep track of previous handle 1270 prev_handle = it.handle; 1271 1272 // check if found 1273 if (it.handle && new_service_started && (attribute_len == it.value_len) && (memcmp(attribute_value, it.value, it.value_len) == 0)){ 1274 *start_handle = it.handle; 1275 in_group = true; 1276 } 1277 } 1278 return false; 1279 } 1280 1281 // returns false if not found 1282 uint16_t gatt_server_get_value_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t uuid16){ 1283 att_iterator_t it; 1284 att_iterator_init(&it); 1285 while (att_iterator_has_next(&it)){ 1286 att_iterator_fetch_next(&it); 1287 if (it.handle && (it.handle < start_handle)) continue; 1288 if (it.handle > end_handle) break; // (1) 1289 if (it.handle == 0u) break; 1290 if (att_iterator_match_uuid16(&it, uuid16)) return it.handle; 1291 } 1292 return 0; 1293 } 1294 1295 uint16_t gatt_server_get_descriptor_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t characteristic_uuid16, uint16_t descriptor_uuid16){ 1296 att_iterator_t it; 1297 att_iterator_init(&it); 1298 bool characteristic_found = false; 1299 while (att_iterator_has_next(&it)){ 1300 att_iterator_fetch_next(&it); 1301 if (it.handle && (it.handle < start_handle)) continue; 1302 if (it.handle > end_handle) break; // (1) 1303 if (it.handle == 0u) break; 1304 if (att_iterator_match_uuid16(&it, characteristic_uuid16)){ 1305 characteristic_found = true; 1306 continue; 1307 } 1308 if (att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) 1309 || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID) 1310 || att_iterator_match_uuid16(&it, GATT_CHARACTERISTICS_UUID)){ 1311 if (characteristic_found) break; 1312 continue; 1313 } 1314 if (characteristic_found && att_iterator_match_uuid16(&it, descriptor_uuid16)){ 1315 return it.handle; 1316 } 1317 } 1318 return 0; 1319 } 1320 1321 // returns 0 if not found 1322 uint16_t gatt_server_get_client_configuration_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t characteristic_uuid16){ 1323 return gatt_server_get_descriptor_handle_for_characteristic_with_uuid16(start_handle, end_handle, characteristic_uuid16, GATT_CLIENT_CHARACTERISTICS_CONFIGURATION); 1324 } 1325 // returns 0 if not found 1326 1327 uint16_t gatt_server_get_server_configuration_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t characteristic_uuid16){ 1328 return gatt_server_get_descriptor_handle_for_characteristic_with_uuid16(start_handle, end_handle, characteristic_uuid16, GATT_SERVER_CHARACTERISTICS_CONFIGURATION); 1329 } 1330 1331 // returns 1 if service found. only primary service. 1332 int gatt_server_get_get_handle_range_for_service_with_uuid128(const uint8_t * uuid128, uint16_t * start_handle, uint16_t * end_handle){ 1333 uint16_t in_group = 0; 1334 uint16_t prev_handle = 0; 1335 1336 uint8_t attribute_value[16]; 1337 int attribute_len = sizeof(attribute_value); 1338 reverse_128(uuid128, attribute_value); 1339 1340 att_iterator_t it; 1341 att_iterator_init(&it); 1342 while (att_iterator_has_next(&it)){ 1343 att_iterator_fetch_next(&it); 1344 int new_service_started = att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID); 1345 1346 // close current tag, if within a group and a new service definition starts or we reach end of att db 1347 if (in_group && 1348 ((it.handle == 0u) || new_service_started)){ 1349 *end_handle = prev_handle; 1350 return 1; 1351 } 1352 1353 // keep track of previous handle 1354 prev_handle = it.handle; 1355 1356 // check if found 1357 if (it.handle && new_service_started && (attribute_len == it.value_len) && (memcmp(attribute_value, it.value, it.value_len) == 0)){ 1358 *start_handle = it.handle; 1359 in_group = 1; 1360 } 1361 } 1362 return 0; 1363 } 1364 1365 // returns 0 if not found 1366 uint16_t gatt_server_get_value_handle_for_characteristic_with_uuid128(uint16_t start_handle, uint16_t end_handle, const uint8_t * uuid128){ 1367 uint8_t attribute_value[16]; 1368 reverse_128(uuid128, attribute_value); 1369 att_iterator_t it; 1370 att_iterator_init(&it); 1371 while (att_iterator_has_next(&it)){ 1372 att_iterator_fetch_next(&it); 1373 if (it.handle && (it.handle < start_handle)) continue; 1374 if (it.handle > end_handle) break; // (1) 1375 if (it.handle == 0u) break; 1376 if (att_iterator_match_uuid(&it, attribute_value, 16)) return it.handle; 1377 } 1378 return 0; 1379 } 1380 1381 // returns 0 if not found 1382 uint16_t gatt_server_get_client_configuration_handle_for_characteristic_with_uuid128(uint16_t start_handle, uint16_t end_handle, const uint8_t * uuid128){ 1383 uint8_t attribute_value[16]; 1384 reverse_128(uuid128, attribute_value); 1385 att_iterator_t it; 1386 att_iterator_init(&it); 1387 int characteristic_found = 0; 1388 while (att_iterator_has_next(&it)){ 1389 att_iterator_fetch_next(&it); 1390 if (it.handle && (it.handle < start_handle)) continue; 1391 if (it.handle > end_handle) break; // (1) 1392 if (it.handle == 0u) break; 1393 if (att_iterator_match_uuid(&it, attribute_value, 16)){ 1394 characteristic_found = 1; 1395 continue; 1396 } 1397 if (att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) 1398 || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID) 1399 || att_iterator_match_uuid16(&it, GATT_CHARACTERISTICS_UUID)){ 1400 if (characteristic_found) break; 1401 continue; 1402 } 1403 if (characteristic_found && att_iterator_match_uuid16(&it, GATT_CLIENT_CHARACTERISTICS_CONFIGURATION)){ 1404 return it.handle; 1405 } 1406 } 1407 return 0; 1408 } 1409 1410 1411 // 1-item cache to optimize query during write_callback 1412 static void att_persistent_ccc_cache(att_iterator_t * it){ 1413 att_persistent_ccc_handle = it->handle; 1414 if (it->flags & ATT_PROPERTY_UUID128){ 1415 att_persistent_ccc_uuid16 = 0; 1416 } else { 1417 att_persistent_ccc_uuid16 = little_endian_read_16(it->uuid, 0); 1418 } 1419 } 1420 1421 bool att_is_persistent_ccc(uint16_t handle){ 1422 if (handle != att_persistent_ccc_handle){ 1423 att_iterator_t it; 1424 int ok = att_find_handle(&it, handle); 1425 if (!ok) return false; 1426 att_persistent_ccc_cache(&it); 1427 } 1428 return att_persistent_ccc_uuid16 == GATT_CLIENT_CHARACTERISTICS_CONFIGURATION; 1429 } 1430 1431 // att_read_callback helpers 1432 uint16_t att_read_callback_handle_blob(const uint8_t * blob, uint16_t blob_size, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){ 1433 btstack_assert(blob != NULL); 1434 1435 if (buffer != NULL){ 1436 uint16_t bytes_to_copy = 0; 1437 if (blob_size >= offset){ 1438 bytes_to_copy = btstack_min(blob_size - offset, buffer_size); 1439 (void)memcpy(buffer, &blob[offset], bytes_to_copy); 1440 } 1441 return bytes_to_copy; 1442 } else { 1443 return blob_size; 1444 } 1445 } 1446 1447 uint16_t att_read_callback_handle_little_endian_32(uint32_t value, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){ 1448 uint8_t value_buffer[4]; 1449 little_endian_store_32(value_buffer, 0, value); 1450 return att_read_callback_handle_blob(value_buffer, sizeof(value_buffer), offset, buffer, buffer_size); 1451 } 1452 1453 uint16_t att_read_callback_handle_little_endian_16(uint16_t value, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){ 1454 uint8_t value_buffer[2]; 1455 little_endian_store_16(value_buffer, 0, value); 1456 return att_read_callback_handle_blob(value_buffer, sizeof(value_buffer), offset, buffer, buffer_size); 1457 } 1458 1459 uint16_t att_read_callback_handle_byte(uint8_t value, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){ 1460 uint8_t value_buffer[1]; 1461 value_buffer[0] = value; 1462 return att_read_callback_handle_blob(value_buffer, sizeof(value_buffer), offset, buffer, buffer_size); 1463 } 1464 1465 1466 #ifdef ENABLE_BTP 1467 1468 // start of auto-PTS testing code, not used in production 1469 // LCOV_EXCL_START 1470 #include "btp.h" 1471 1472 static uint8_t btp_permissions_for_flags(uint16_t flags){ 1473 1474 // see BT_GATT_PERM_* 1475 // https://docs.zephyrproject.org/latest/reference/bluetooth/gatt.html 1476 // set bit indicates requirement, e.g. BTP_GATT_PERM_READ_AUTHN requires authenticated connection 1477 1478 uint8_t permissions = 0; 1479 1480 uint8_t read_security_level = 0; 1481 uint8_t write_security_level = 0; 1482 if (flags & ATT_PROPERTY_READ){ 1483 if (flags & ATT_PROPERTY_READ_PERMISSION_BIT_0) { 1484 read_security_level |= 1; 1485 } 1486 if (flags & ATT_PROPERTY_READ_PERMISSION_BIT_1) { 1487 read_security_level |= 2; 1488 } 1489 if (read_security_level == ATT_SECURITY_AUTHORIZED) { 1490 permissions |= BTP_GATT_PERM_READ_AUTHZ; 1491 } 1492 if (read_security_level == ATT_SECURITY_AUTHENTICATED) { 1493 permissions |= BTP_GATT_PERM_READ_AUTHN; 1494 } 1495 if (read_security_level == ATT_SECURITY_ENCRYPTED) { 1496 permissions |= BTP_GATT_PERM_READ_ENC; 1497 } 1498 if (read_security_level == ATT_SECURITY_NONE) { 1499 permissions |= BTP_GATT_PERM_READ; 1500 } 1501 } 1502 if (flags & (ATT_PROPERTY_WRITE | ATT_PROPERTY_WRITE_WITHOUT_RESPONSE)){ 1503 if (flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_0) { 1504 write_security_level |= 1; 1505 } 1506 if (flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_1) { 1507 write_security_level |= 2; 1508 } 1509 if (write_security_level == ATT_SECURITY_AUTHORIZED) { 1510 permissions |= BTP_GATT_PERM_WRITE_AUTHZ; 1511 } 1512 if (write_security_level == ATT_SECURITY_AUTHENTICATED) { 1513 permissions |= BTP_GATT_PERM_WRITE_AUTHN; 1514 } 1515 if (write_security_level == ATT_SECURITY_ENCRYPTED) { 1516 permissions |= BTP_GATT_PERM_WRITE_ENC; 1517 } 1518 if (write_security_level == ATT_SECURITY_NONE) { 1519 permissions |= BTP_GATT_PERM_WRITE; 1520 } 1521 } 1522 return permissions; 1523 } 1524 1525 uint16_t btp_att_get_attributes_by_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t uuid16, uint8_t * response_buffer, uint16_t response_buffer_size){ 1526 log_info("btp_att_get_attributes_by_uuid16 %04x from 0x%04x to 0x%04x, db %p", uuid16, start_handle, end_handle, att_db); 1527 att_dump_attributes(); 1528 1529 uint8_t num_attributes = 0; 1530 uint16_t pos = 1; 1531 1532 att_iterator_t it; 1533 att_iterator_init(&it); 1534 while (att_iterator_has_next(&it) && ((pos + 6) < response_buffer_size)){ 1535 att_iterator_fetch_next(&it); 1536 log_info("handle %04x", it.handle); 1537 if (it.handle == 0) break; 1538 if (it.handle < start_handle) continue; 1539 if (it.handle > end_handle) break; 1540 if ((uuid16 == 0) || att_iterator_match_uuid16(&it, uuid16)){ 1541 little_endian_store_16(response_buffer, pos, it.handle); 1542 pos += 2; 1543 response_buffer[pos++] = btp_permissions_for_flags(it.flags); 1544 response_buffer[pos++] = 2; 1545 little_endian_store_16(response_buffer, pos, uuid16); 1546 pos += 2; 1547 num_attributes++; 1548 } 1549 } 1550 response_buffer[0] = num_attributes; 1551 return pos; 1552 } 1553 1554 uint16_t btp_att_get_attributes_by_uuid128(uint16_t start_handle, uint16_t end_handle, const uint8_t * uuid128, uint8_t * response_buffer, uint16_t response_buffer_size){ 1555 uint8_t num_attributes = 0; 1556 uint16_t pos = 1; 1557 att_iterator_t it; 1558 att_iterator_init(&it); 1559 while (att_iterator_has_next(&it) && ((pos + 20) < response_buffer_size)){ 1560 att_iterator_fetch_next(&it); 1561 if (it.handle == 0) break; 1562 if (it.handle < start_handle) continue; 1563 if (it.handle > end_handle) break; 1564 if (att_iterator_match_uuid(&it, (uint8_t*) uuid128, 16)){ 1565 little_endian_store_16(response_buffer, pos, it.handle); 1566 pos += 2; 1567 response_buffer[pos++] = btp_permissions_for_flags(it.flags); 1568 response_buffer[pos++] = 16; 1569 reverse_128(uuid128, &response_buffer[pos]); 1570 pos += 16; 1571 num_attributes++; 1572 } 1573 } 1574 response_buffer[0] = num_attributes; 1575 return pos; 1576 } 1577 1578 uint16_t btp_att_get_attribute_value(att_connection_t * att_connection, uint16_t attribute_handle, uint8_t * response_buffer, uint16_t response_buffer_size){ 1579 att_iterator_t it; 1580 int ok = att_find_handle(&it, attribute_handle); 1581 if (!ok) return 0; 1582 1583 uint16_t pos = 0; 1584 // field: ATT_Response - simulate READ operation on given connection 1585 response_buffer[pos++] = att_validate_security(att_connection, ATT_READ, &it); 1586 // fetch len 1587 // assume: con handle not relevant here, else, it needs to get passed in 1588 // att_update_value_len(&it, HCI_CON_HANDLE_INVALID); 1589 uint16_t bytes_to_copy = btstack_min( response_buffer_size - 3, it.value_len); 1590 little_endian_store_16(response_buffer, pos, bytes_to_copy); 1591 pos += 2; 1592 // get value - only works for non-dynamic data 1593 if (it.value){ 1594 memcpy(&response_buffer[pos], it.value, bytes_to_copy); 1595 pos += bytes_to_copy; 1596 } 1597 return pos; 1598 } 1599 // LCOV_EXCL_STOP 1600 #endif 1601