xref: /btstack/src/ble/att_db.c (revision eb4dccece89f38c3fa8fb13197f36188f58d954a)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "att_db.c"
39 
40 #include <string.h>
41 
42 #include "ble/att_db.h"
43 #include "ble/core.h"
44 #include "bluetooth.h"
45 #include "btstack_debug.h"
46 #include "btstack_util.h"
47 
48 // check for ENABLE_ATT_DELAYED_READ_RESPONSE -> ENABLE_ATT_DELAYED_RESPONSE,
49 #ifdef ENABLE_ATT_DELAYED_READ_RESPONSE
50     #error "ENABLE_ATT_DELAYED_READ_RESPONSE was replaced by ENABLE_ATT_DELAYED_RESPONSE. Please update btstack_config.h"
51 #endif
52 
53 typedef enum {
54     ATT_READ,
55     ATT_WRITE,
56 } att_operation_t;
57 
58 
59 static int is_Bluetooth_Base_UUID(uint8_t const *uuid){
60     // Bluetooth Base UUID 00000000-0000-1000-8000-00805F9B34FB in little endian
61     static const uint8_t bluetooth_base_uuid[] = { 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
62 
63     if (memcmp(&uuid[0],  &bluetooth_base_uuid[0], 12) != 0) return false;
64     if (memcmp(&uuid[14], &bluetooth_base_uuid[14], 2) != 0) return false;
65     return true;
66 
67 }
68 
69 static uint16_t uuid16_from_uuid(uint16_t uuid_len, uint8_t * uuid){
70     if (uuid_len == 2u) return little_endian_read_16(uuid, 0u);
71     if (!is_Bluetooth_Base_UUID(uuid)) return 0;
72     return little_endian_read_16(uuid, 12);
73 }
74 
75 // ATT Database
76 
77 // new java-style iterator
78 typedef struct att_iterator {
79     // private
80     uint8_t const * att_ptr;
81     // public
82     uint16_t size;
83     uint16_t flags;
84     uint16_t handle;
85     uint8_t  const * uuid;
86     uint16_t value_len;
87     uint8_t  const * value;
88 } att_iterator_t;
89 
90 static void att_persistent_ccc_cache(att_iterator_t * it);
91 
92 static uint8_t const * att_db = NULL;
93 static att_read_callback_t  att_read_callback  = NULL;
94 static att_write_callback_t att_write_callback = NULL;
95 static int      att_prepare_write_error_code   = 0;
96 static uint16_t att_prepare_write_error_handle = 0x0000;
97 
98 // single cache for att_is_persistent_ccc - stores flags before write callback
99 static uint16_t att_persistent_ccc_handle;
100 static uint16_t att_persistent_ccc_uuid16;
101 
102 static void att_iterator_init(att_iterator_t *it){
103     it->att_ptr = att_db;
104 }
105 
106 static bool att_iterator_has_next(att_iterator_t *it){
107     return it->att_ptr != NULL;
108 }
109 
110 static void att_iterator_fetch_next(att_iterator_t *it){
111     it->size   = little_endian_read_16(it->att_ptr, 0);
112     if (it->size == 0u){
113         it->flags = 0;
114         it->handle = 0;
115         it->uuid = NULL;
116         it->value_len = 0;
117         it->value = NULL;
118         it->att_ptr = NULL;
119         return;
120     }
121     it->flags  = little_endian_read_16(it->att_ptr, 2);
122     it->handle = little_endian_read_16(it->att_ptr, 4);
123     it->uuid   = &it->att_ptr[6];
124     // handle 128 bit UUIDs
125     if ((it->flags & ATT_PROPERTY_UUID128) != 0u){
126         it->value_len = it->size - 22u;
127         it->value  = &it->att_ptr[22];
128     } else {
129         it->value_len = it->size - 8u;
130         it->value  = &it->att_ptr[8];
131     }
132     // advance AFTER setting values
133     it->att_ptr += it->size;
134 }
135 
136 static int att_iterator_match_uuid16(att_iterator_t *it, uint16_t uuid){
137     if (it->handle == 0u) return 0u;
138     if (it->flags & ATT_PROPERTY_UUID128){
139         if (!is_Bluetooth_Base_UUID(it->uuid)) return 0;
140         return little_endian_read_16(it->uuid, 12) == uuid;
141     }
142     return little_endian_read_16(it->uuid, 0)  == uuid;
143 }
144 
145 static int att_iterator_match_uuid(att_iterator_t *it, uint8_t *uuid, uint16_t uuid_len){
146     if (it->handle == 0u) return 0u;
147     // input: UUID16
148     if (uuid_len == 2u) {
149         return att_iterator_match_uuid16(it, little_endian_read_16(uuid, 0));
150     }
151     // input and db: UUID128
152     if ((it->flags & ATT_PROPERTY_UUID128) != 0u){
153         return memcmp(it->uuid, uuid, 16) == 0;
154     }
155     // input: UUID128, db: UUID16
156     if (!is_Bluetooth_Base_UUID(uuid)) return 0;
157     return little_endian_read_16(uuid, 12) == little_endian_read_16(it->uuid, 0);
158 }
159 
160 
161 static int att_find_handle(att_iterator_t *it, uint16_t handle){
162     if (handle == 0u) return 0u;
163     att_iterator_init(it);
164     while (att_iterator_has_next(it)){
165         att_iterator_fetch_next(it);
166         if (it->handle != handle) continue;
167         return 1;
168     }
169     return 0;
170 }
171 
172 // experimental client API
173 uint16_t att_uuid_for_handle(uint16_t attribute_handle){
174     att_iterator_t it;
175     int ok = att_find_handle(&it, attribute_handle);
176     if (!ok) return 0;
177     if ((it.flags & ATT_PROPERTY_UUID128) != 0u) return 0u;
178     return little_endian_read_16(it.uuid, 0);
179 }
180 // end of client API
181 
182 static void att_update_value_len(att_iterator_t *it, hci_con_handle_t con_handle){
183     if ((it->flags & ATT_PROPERTY_DYNAMIC) == 0u) return;
184     it->value_len = (*att_read_callback)(con_handle, it->handle, 0, NULL, 0);
185     return;
186 }
187 
188 // copy attribute value from offset into buffer with given size
189 static int att_copy_value(att_iterator_t *it, uint16_t offset, uint8_t * buffer, uint16_t buffer_size, hci_con_handle_t con_handle){
190 
191     // DYNAMIC
192     if ((it->flags & ATT_PROPERTY_DYNAMIC) != 0u){
193         return (*att_read_callback)(con_handle, it->handle, offset, buffer, buffer_size);
194     }
195 
196     // STATIC
197     uint16_t bytes_to_copy = btstack_min(it->value_len - offset, buffer_size);
198     (void)memcpy(buffer, it->value, bytes_to_copy);
199     return bytes_to_copy;
200 }
201 
202 void att_set_db(uint8_t const * db){
203     // validate db version
204     if (db == NULL) return;
205     if (*db++ != ATT_DB_VERSION){
206         log_error("ATT DB version differs, please regenerate .h from .gatt file or update att_db_util.c");
207         return;
208     }
209     log_info("att_set_db %p", db);
210     att_db = db;
211 }
212 
213 void att_set_read_callback(att_read_callback_t callback){
214     att_read_callback = callback;
215 }
216 
217 void att_set_write_callback(att_write_callback_t callback){
218     att_write_callback = callback;
219 }
220 
221 void att_dump_attributes(void){
222     att_iterator_t it;
223     att_iterator_init(&it);
224     uint8_t uuid128[16];
225     log_info("att_dump_attributes, table %p", att_db);
226     while (att_iterator_has_next(&it)){
227         att_iterator_fetch_next(&it);
228         if (it.handle == 0u) {
229             log_info("Handle: END");
230             return;
231         }
232         log_info("Handle: 0x%04x, flags: 0x%04x, uuid: ", it.handle, it.flags);
233         if ((it.flags & ATT_PROPERTY_UUID128) != 0u){
234             reverse_128(it.uuid, uuid128);
235             log_info("%s", uuid128_to_str(uuid128));
236         } else {
237             log_info("%04x", little_endian_read_16(it.uuid, 0));
238         }
239         log_info(", value_len: %u, value: ", it.value_len);
240         log_info_hexdump(it.value, it.value_len);
241     }
242 }
243 
244 static void att_prepare_write_reset(void){
245     att_prepare_write_error_code = 0;
246     att_prepare_write_error_handle = 0x0000;
247 }
248 
249 static void att_prepare_write_update_errors(uint8_t error_code, uint16_t handle){
250     // first ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH has highest priority
251     if ((error_code == ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH) && (error_code != att_prepare_write_error_code)){
252         att_prepare_write_error_code = error_code;
253         att_prepare_write_error_handle = handle;
254         return;
255     }
256     // first ATT_ERROR_INVALID_OFFSET is next
257     if ((error_code == ATT_ERROR_INVALID_OFFSET) && (att_prepare_write_error_code == 0)){
258         att_prepare_write_error_code = error_code;
259         att_prepare_write_error_handle = handle;
260         return;
261     }
262 }
263 
264 static uint16_t setup_error(uint8_t * response_buffer, uint16_t request, uint16_t handle, uint8_t error_code){
265     response_buffer[0] = ATT_ERROR_RESPONSE;
266     response_buffer[1] = request;
267     little_endian_store_16(response_buffer, 2, handle);
268     response_buffer[4] = error_code;
269     return 5;
270 }
271 
272 static inline uint16_t setup_error_read_not_permitted(uint8_t * response_buffer, uint16_t request, uint16_t start_handle){
273     return setup_error(response_buffer, request, start_handle, ATT_ERROR_READ_NOT_PERMITTED);
274 }
275 
276 static inline uint16_t setup_error_write_not_permitted(uint8_t * response_buffer, uint16_t request, uint16_t start_handle){
277     return setup_error(response_buffer, request, start_handle, ATT_ERROR_WRITE_NOT_PERMITTED);
278 }
279 
280 static inline uint16_t setup_error_atribute_not_found(uint8_t * response_buffer, uint16_t request, uint16_t start_handle){
281     return setup_error(response_buffer, request, start_handle, ATT_ERROR_ATTRIBUTE_NOT_FOUND);
282 }
283 
284 static inline uint16_t setup_error_invalid_handle(uint8_t * response_buffer, uint16_t request, uint16_t handle){
285     return setup_error(response_buffer, request, handle, ATT_ERROR_INVALID_HANDLE);
286 }
287 
288 static inline uint16_t setup_error_invalid_offset(uint8_t * response_buffer, uint16_t request, uint16_t handle){
289     return setup_error(response_buffer, request, handle, ATT_ERROR_INVALID_OFFSET);
290 }
291 
292 static inline uint16_t setup_error_invalid_pdu(uint8_t *response_buffer, uint16_t request) {
293     return setup_error(response_buffer, request, 0, ATT_ERROR_INVALID_PDU);
294 }
295 
296 static uint8_t att_validate_security(att_connection_t * att_connection, att_operation_t operation, att_iterator_t * it){
297     int required_security_level = 0;
298     bool requires_secure_connection = false;
299     switch (operation){
300         case ATT_READ:
301             if ((it->flags & ATT_PROPERTY_READ_PERMISSION_BIT_0) != 0u){
302                 required_security_level |= 1;
303             }
304             if ((it->flags & ATT_PROPERTY_READ_PERMISSION_BIT_1) != 0u){
305                 required_security_level |= 2;
306             }
307             if ((it->flags & ATT_PROPERTY_READ_PERMISSION_SC) != 0u){
308                 requires_secure_connection = true;
309             }
310             break;
311         case ATT_WRITE:
312             if ((it->flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_0) != 0u){
313                 required_security_level |= 1;
314             }
315             if ((it->flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_1) != 0u){
316                 required_security_level |= 2;
317             }
318             if ((it->flags & ATT_PROPERTY_WRITE_PERMISSION_SC) != 0u){
319                 requires_secure_connection = true;
320             }
321             break;
322         default:
323             btstack_assert(false);
324             break;
325     }
326 
327     uint8_t required_encryption_size = it->flags >> 12;
328     if (required_encryption_size != 0) required_encryption_size++;   // store -1 to fit into 4 bit
329 
330     log_debug("att_validate_security. flags 0x%04x (=> security level %u, key size %u) authorized %u, authenticated %u, encryption_key_size %u, secure connection %u",
331         it->flags, required_security_level, required_encryption_size, att_connection->authorized, att_connection->authenticated, att_connection->encryption_key_size, att_connection->secure_connection);
332 
333     bool sc_missing = requires_secure_connection && (att_connection->secure_connection == 0u);
334     switch (required_security_level){
335         case ATT_SECURITY_AUTHORIZED:
336             if ((att_connection->authorized == 0u) || sc_missing){
337                 return ATT_ERROR_INSUFFICIENT_AUTHORIZATION;
338             }
339             /* fall through */
340         case ATT_SECURITY_AUTHENTICATED:
341             if ((att_connection->authenticated == 0u) || sc_missing){
342                 return ATT_ERROR_INSUFFICIENT_AUTHENTICATION;
343             }
344             /* fall through */
345         case ATT_SECURITY_ENCRYPTED:
346             if ((required_encryption_size > 0u) && ((att_connection->encryption_key_size == 0u) || sc_missing)){
347                 return ATT_ERROR_INSUFFICIENT_ENCRYPTION;
348             }
349             if (required_encryption_size > att_connection->encryption_key_size){
350                 return ATT_ERROR_INSUFFICIENT_ENCRYPTION_KEY_SIZE;
351             }
352             break;
353         default:
354             break;
355     }
356     return ATT_ERROR_SUCCESS;
357 }
358 
359 //
360 // MARK: ATT_EXCHANGE_MTU_REQUEST
361 //
362 static uint16_t handle_exchange_mtu_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
363                                          uint8_t * response_buffer){
364 
365     if (request_len != 3u) return setup_error_invalid_pdu(response_buffer, ATT_EXCHANGE_MTU_REQUEST);
366 
367     uint16_t client_rx_mtu = little_endian_read_16(request_buffer, 1);
368 
369     // find min(local max mtu, remote mtu) >= ATT_DEFAULT_MTU and use as mtu for this connection
370     uint16_t min_mtu = btstack_min(client_rx_mtu, att_connection->max_mtu);
371     uint16_t new_mtu = btstack_max(ATT_DEFAULT_MTU, min_mtu);
372     att_connection->mtu_exchanged = true;
373     att_connection->mtu = new_mtu;
374 
375     response_buffer[0] = ATT_EXCHANGE_MTU_RESPONSE;
376     little_endian_store_16(response_buffer, 1, att_connection->mtu);
377     return 3;
378 }
379 
380 
381 //
382 // MARK: ATT_FIND_INFORMATION_REQUEST
383 //
384 // TODO: handle other types then GATT_PRIMARY_SERVICE_UUID and GATT_SECONDARY_SERVICE_UUID
385 //
386 static uint16_t handle_find_information_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size,
387                                            uint16_t start_handle, uint16_t end_handle){
388 
389     UNUSED(att_connection);
390 
391     log_info("ATT_FIND_INFORMATION_REQUEST: from %04X to %04X", start_handle, end_handle);
392     uint8_t request_type = ATT_FIND_INFORMATION_REQUEST;
393 
394     if ((start_handle > end_handle) || (start_handle == 0u)){
395         return setup_error_invalid_handle(response_buffer, request_type, start_handle);
396     }
397 
398     uint16_t offset   = 1;
399     uint16_t uuid_len = 0;
400 
401     att_iterator_t it;
402     att_iterator_init(&it);
403     while (att_iterator_has_next(&it)){
404         att_iterator_fetch_next(&it);
405         if (!it.handle) break;
406         if (it.handle > end_handle) break;
407         if (it.handle < start_handle) continue;
408 
409         // log_info("Handle 0x%04x", it.handle);
410 
411         uint16_t this_uuid_len = (it.flags & ATT_PROPERTY_UUID128) ? 16 : 2;
412 
413         // check if value has same len as last one if not first result
414         if (offset > 1u){
415             if (this_uuid_len != uuid_len) {
416                 break;
417             }
418         }
419 
420         // first
421         if (offset == 1u) {
422             uuid_len = this_uuid_len;
423             // set format field
424             response_buffer[offset] = (it.flags & ATT_PROPERTY_UUID128) ? 0x02 : 0x01;
425             offset++;
426         }
427 
428         // space?
429         if ((offset + 2u + uuid_len) > response_buffer_size) break;
430 
431         // store
432         little_endian_store_16(response_buffer, offset, it.handle);
433         offset += 2u;
434 
435         (void)memcpy(response_buffer + offset, it.uuid, uuid_len);
436         offset += uuid_len;
437     }
438 
439     if (offset == 1u){
440         return setup_error_atribute_not_found(response_buffer, request_type, start_handle);
441     }
442 
443     response_buffer[0] = ATT_FIND_INFORMATION_REPLY;
444     return offset;
445 }
446 
447 static uint16_t handle_find_information_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
448                                          uint8_t * response_buffer, uint16_t response_buffer_size){
449 
450     if (request_len != 5u) return setup_error_invalid_pdu(response_buffer, ATT_FIND_INFORMATION_REQUEST);
451 
452     uint16_t start_handle = little_endian_read_16(request_buffer, 1);
453     uint16_t end_handle = little_endian_read_16(request_buffer, 3);
454     return handle_find_information_request2(att_connection, response_buffer, response_buffer_size, start_handle, end_handle);
455 }
456 
457 //
458 // MARK: ATT_FIND_BY_TYPE_VALUE
459 //
460 // "Only attributes with attribute handles between and including the Starting Handle parameter
461 // and the Ending Handle parameter that match the requested attri- bute type and the attribute
462 // value that have sufficient permissions to allow reading will be returned" -> (1)
463 //
464 // TODO: handle other types then GATT_PRIMARY_SERVICE_UUID and GATT_SECONDARY_SERVICE_UUID
465 //
466 // NOTE: doesn't handle DYNAMIC values
467 // NOTE: only supports 16 bit UUIDs
468 //
469 static uint16_t handle_find_by_type_value_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
470                                            uint8_t * response_buffer, uint16_t response_buffer_size){
471     UNUSED(att_connection);
472 
473     if (request_len < 7u) return setup_error_invalid_pdu(response_buffer, ATT_FIND_BY_TYPE_VALUE_REQUEST);
474 
475     // parse request
476     uint16_t start_handle = little_endian_read_16(request_buffer, 1);
477     uint16_t end_handle = little_endian_read_16(request_buffer, 3);
478     uint16_t attribute_type = little_endian_read_16(request_buffer, 5);
479     const uint8_t *attribute_value = &request_buffer[7];
480     uint16_t attribute_len = request_len - 7u;
481 
482     log_info("ATT_FIND_BY_TYPE_VALUE_REQUEST: from %04X to %04X, type %04X, value: ", start_handle, end_handle, attribute_type);
483     log_info_hexdump(attribute_value, attribute_len);
484     uint8_t request_type = ATT_FIND_BY_TYPE_VALUE_REQUEST;
485 
486     if ((start_handle > end_handle) || (start_handle == 0u)){
487         return setup_error_invalid_handle(response_buffer, request_type, start_handle);
488     }
489 
490     uint16_t offset      = 1;
491     uint16_t in_group    = 0;
492     uint16_t prev_handle = 0;
493 
494     att_iterator_t it;
495     att_iterator_init(&it);
496     while (att_iterator_has_next(&it)){
497         att_iterator_fetch_next(&it);
498 
499         if (it.handle && (it.handle < start_handle)) continue;
500         if (it.handle > end_handle) break;  // (1)
501 
502         // close current tag, if within a group and a new service definition starts or we reach end of att db
503         if (in_group &&
504             ((it.handle == 0u) || att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID))){
505 
506             log_info("End of group, handle 0x%04x", prev_handle);
507             little_endian_store_16(response_buffer, offset, prev_handle);
508             offset += 2u;
509             in_group = 0;
510 
511             // check if space for another handle pair available
512             if ((offset + 4u) > response_buffer_size){
513                 break;
514             }
515         }
516 
517         // keep track of previous handle
518         prev_handle = it.handle;
519 
520         // does current attribute match
521         if (it.handle && att_iterator_match_uuid16(&it, attribute_type) && (attribute_len == it.value_len) && (memcmp(attribute_value, it.value, it.value_len) == 0)){
522             log_info("Begin of group, handle 0x%04x", it.handle);
523             little_endian_store_16(response_buffer, offset, it.handle);
524             offset += 2u;
525             in_group = 1;
526         }
527     }
528 
529     if (offset == 1u){
530         return setup_error_atribute_not_found(response_buffer, request_type, start_handle);
531     }
532 
533     response_buffer[0] = ATT_FIND_BY_TYPE_VALUE_RESPONSE;
534     return offset;
535 }
536 
537 //
538 // MARK: ATT_READ_BY_TYPE_REQUEST
539 //
540 static uint16_t handle_read_by_type_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size,
541                                       uint16_t start_handle, uint16_t end_handle,
542                                       uint16_t attribute_type_len, uint8_t * attribute_type){
543 
544     log_info("ATT_READ_BY_TYPE_REQUEST: from %04X to %04X, type: ", start_handle, end_handle);
545     log_info_hexdump(attribute_type, attribute_type_len);
546     uint8_t request_type = ATT_READ_BY_TYPE_REQUEST;
547 
548     if ((start_handle > end_handle) || (start_handle == 0u)){
549         return setup_error_invalid_handle(response_buffer, request_type, start_handle);
550     }
551 
552     uint16_t offset   = 1;
553     uint16_t pair_len = 0;
554 
555     att_iterator_t it;
556     att_iterator_init(&it);
557     uint8_t error_code = 0;
558     uint16_t first_matching_but_unreadable_handle = 0;
559 
560     while (att_iterator_has_next(&it)){
561         att_iterator_fetch_next(&it);
562 
563         if ((it.handle == 0u ) || (it.handle > end_handle)) break;
564 
565         if (it.handle < start_handle) continue;
566 
567         // does current attribute match
568         if (!att_iterator_match_uuid(&it, attribute_type, attribute_type_len)) continue;
569 
570         // skip handles that cannot be read but remember that there has been at least one
571         if ((it.flags & ATT_PROPERTY_READ) == 0u) {
572             if (first_matching_but_unreadable_handle == 0u) {
573                 first_matching_but_unreadable_handle = it.handle;
574             }
575             continue;
576         }
577 
578         // check security requirements
579         error_code = att_validate_security(att_connection, ATT_READ, &it);
580         if (error_code != 0u) break;
581 
582         att_update_value_len(&it, att_connection->con_handle);
583 
584 #ifdef ENABLE_ATT_DELAYED_RESPONSE
585         if (it.value_len == ATT_READ_RESPONSE_PENDING){
586             return ATT_READ_RESPONSE_PENDING;
587         }
588 #endif
589 
590         // allow to return ATT Error Code in ATT Read Callback
591         if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){
592             error_code =  it.value_len - ATT_READ_ERROR_CODE_OFFSET;
593             break;
594         }
595 
596         // check if value has same len as last one
597         uint16_t this_pair_len = 2u + it.value_len;
598         if ((offset > 1u) && (pair_len != this_pair_len)) {
599             break;
600         }
601 
602         // first
603         if (offset == 1u) {
604             pair_len = this_pair_len;
605             response_buffer[offset] = pair_len;
606             offset++;
607         }
608 
609         // space?
610         if ((offset + pair_len) > response_buffer_size) {
611             if (offset > 2u) break;
612             it.value_len = response_buffer_size - 4u;
613             response_buffer[1u] = 2u + it.value_len;
614         }
615 
616         // store
617         little_endian_store_16(response_buffer, offset, it.handle);
618         offset += 2u;
619         uint16_t bytes_copied = att_copy_value(&it, 0, response_buffer + offset, it.value_len, att_connection->con_handle);
620         offset += bytes_copied;
621     }
622 
623     // at least one attribute could be read
624     if (offset > 1u){
625         response_buffer[0] = ATT_READ_BY_TYPE_RESPONSE;
626         return offset;
627     }
628 
629     // first attribute had an error
630     if (error_code != 0u){
631         return setup_error(response_buffer, request_type, start_handle, error_code);
632     }
633 
634     // no other errors, but all found attributes had been non-readable
635     if (first_matching_but_unreadable_handle != 0u){
636         return setup_error_read_not_permitted(response_buffer, request_type, first_matching_but_unreadable_handle);
637     }
638 
639     // attribute not found
640     return setup_error_atribute_not_found(response_buffer, request_type, start_handle);
641 }
642 
643 static uint16_t handle_read_by_type_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
644                                      uint8_t * response_buffer, uint16_t response_buffer_size){
645 
646     uint16_t attribute_type_len;
647     switch (request_len){
648         case 7:
649             attribute_type_len = 2;
650             break;
651         case 21:
652             attribute_type_len = 16;
653             break;
654         default:
655             return setup_error_invalid_pdu(response_buffer, ATT_READ_BY_TYPE_REQUEST);
656     }
657 
658     uint16_t start_handle = little_endian_read_16(request_buffer, 1);
659     uint16_t end_handle = little_endian_read_16(request_buffer, 3);
660     return handle_read_by_type_request2(att_connection, response_buffer, response_buffer_size, start_handle, end_handle, attribute_type_len, &request_buffer[5]);
661 }
662 
663 //
664 // MARK: ATT_READ_BY_TYPE_REQUEST
665 //
666 static uint16_t handle_read_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, uint16_t handle){
667 
668     log_info("ATT_READ_REQUEST: handle %04x", handle);
669     uint8_t request_type = ATT_READ_REQUEST;
670 
671     att_iterator_t it;
672     int ok = att_find_handle(&it, handle);
673     if (!ok){
674         return setup_error_invalid_handle(response_buffer, request_type, handle);
675     }
676 
677     // check if handle can be read
678     if ((it.flags & ATT_PROPERTY_READ) == 0u) {
679         return setup_error_read_not_permitted(response_buffer, request_type, handle);
680     }
681 
682     // check security requirements
683     uint8_t error_code = att_validate_security(att_connection, ATT_READ, &it);
684     if (error_code != 0) {
685         return setup_error(response_buffer, request_type, handle, error_code);
686     }
687 
688     att_update_value_len(&it, att_connection->con_handle);
689 
690 #ifdef ENABLE_ATT_DELAYED_RESPONSE
691     if (it.value_len == ATT_READ_RESPONSE_PENDING) return ATT_READ_RESPONSE_PENDING;
692 #endif
693 
694     // allow to return ATT Error Code in ATT Read Callback
695     if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){
696         error_code = it.value_len - ATT_READ_ERROR_CODE_OFFSET;
697         return setup_error(response_buffer, request_type, handle, error_code);
698     }
699 
700     // store
701     uint16_t offset   = 1;
702     uint16_t bytes_copied = att_copy_value(&it, 0, response_buffer + offset, response_buffer_size - offset, att_connection->con_handle);
703     offset += bytes_copied;
704 
705     response_buffer[0] = ATT_READ_RESPONSE;
706     return offset;
707 }
708 
709 static uint16_t handle_read_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
710                              uint8_t * response_buffer, uint16_t response_buffer_size){
711 
712     if (request_len != 3u) return setup_error_invalid_pdu(response_buffer, ATT_READ_REQUEST);
713 
714     uint16_t handle = little_endian_read_16(request_buffer, 1);
715     return handle_read_request2(att_connection, response_buffer, response_buffer_size, handle);
716 }
717 
718 //s
719 // MARK: ATT_READ_BLOB_REQUEST 0x0c
720 //
721 static uint16_t handle_read_blob_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, uint16_t handle, uint16_t value_offset){
722     log_info("ATT_READ_BLOB_REQUEST: handle %04x, offset %u", handle, value_offset);
723     uint8_t request_type = ATT_READ_BLOB_REQUEST;
724 
725     att_iterator_t it;
726     int ok = att_find_handle(&it, handle);
727     if (!ok){
728         return setup_error_invalid_handle(response_buffer, request_type, handle);
729     }
730 
731     // check if handle can be read
732     if ((it.flags & ATT_PROPERTY_READ) == 0u) {
733         return setup_error_read_not_permitted(response_buffer, request_type, handle);
734     }
735 
736     // check security requirements
737     uint8_t error_code = att_validate_security(att_connection, ATT_READ, &it);
738     if (error_code != 0) {
739         return setup_error(response_buffer, request_type, handle, error_code);
740     }
741 
742     att_update_value_len(&it, att_connection->con_handle);
743 
744 #ifdef ENABLE_ATT_DELAYED_RESPONSE
745     if (it.value_len == ATT_READ_RESPONSE_PENDING) return ATT_READ_RESPONSE_PENDING;
746 #endif
747 
748     // allow to return ATT Error Code in ATT Read Callback
749     if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){
750         error_code = it.value_len - ATT_READ_ERROR_CODE_OFFSET;
751         return setup_error(response_buffer, request_type, handle, error_code);
752     }
753 
754     if (value_offset > it.value_len){
755         return setup_error_invalid_offset(response_buffer, request_type, handle);
756     }
757 
758     // prepare response
759     response_buffer[0] = ATT_READ_BLOB_RESPONSE;
760     uint16_t offset   = 1;
761 
762     // fetch more data if available
763     if (value_offset < it.value_len){
764         uint16_t bytes_copied = att_copy_value(&it, value_offset, &response_buffer[offset], response_buffer_size - offset, att_connection->con_handle);
765         offset += bytes_copied;
766     }
767     return offset;
768 }
769 
770 static uint16_t handle_read_blob_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
771                                   uint8_t * response_buffer, uint16_t response_buffer_size){
772 
773     if (request_len != 5u) return setup_error_invalid_pdu(response_buffer, ATT_READ_BLOB_REQUEST);
774 
775     uint16_t handle = little_endian_read_16(request_buffer, 1);
776     uint16_t value_offset = little_endian_read_16(request_buffer, 3);
777     return handle_read_blob_request2(att_connection, response_buffer, response_buffer_size, handle, value_offset);
778 }
779 
780 //
781 // MARK: ATT_READ_MULTIPLE_REQUEST 0x0e
782 //
783 static uint16_t handle_read_multiple_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size, uint16_t num_handles, uint8_t * handles){
784     log_info("ATT_READ_MULTIPLE_REQUEST: num handles %u", num_handles);
785     uint8_t request_type = ATT_READ_MULTIPLE_REQUEST;
786 
787     uint16_t offset   = 1;
788 
789     int i;
790     uint8_t error_code = 0;
791     uint16_t handle = 0;
792 
793 #ifdef ENABLE_ATT_DELAYED_RESPONSE
794     bool read_request_pending = false;
795 #endif
796 
797     for (i=0;i<num_handles;i++){
798         handle = little_endian_read_16(handles, i << 1);
799 
800         if (handle == 0u){
801             return setup_error_invalid_handle(response_buffer, request_type, handle);
802         }
803 
804         att_iterator_t it;
805 
806         int ok = att_find_handle(&it, handle);
807         if (!ok){
808             return setup_error_invalid_handle(response_buffer, request_type, handle);
809         }
810 
811         // check if handle can be read
812         if ((it.flags & ATT_PROPERTY_READ) == 0u) {
813             error_code = ATT_ERROR_READ_NOT_PERMITTED;
814             break;
815         }
816 
817         // check security requirements
818         error_code = att_validate_security(att_connection, ATT_READ, &it);
819         if (error_code != 0) break;
820 
821         att_update_value_len(&it, att_connection->con_handle);
822 
823 #ifdef ENABLE_ATT_DELAYED_RESPONSE
824         if (it.value_len == ATT_READ_RESPONSE_PENDING) {
825             read_request_pending = true;
826         }
827         if (read_request_pending) continue;
828 #endif
829 
830         // allow to return ATT Error Code in ATT Read Callback
831         if (it.value_len > ATT_READ_ERROR_CODE_OFFSET){
832             error_code = it.value_len -ATT_READ_ERROR_CODE_OFFSET;
833             break;
834         }
835 
836         // store
837         uint16_t bytes_copied = att_copy_value(&it, 0, response_buffer + offset, response_buffer_size - offset, att_connection->con_handle);
838         offset += bytes_copied;
839     }
840 
841     if (error_code != 0){
842         return setup_error(response_buffer, request_type, handle, error_code);
843     }
844 
845     response_buffer[0] = ATT_READ_MULTIPLE_RESPONSE;
846     return offset;
847 }
848 static uint16_t handle_read_multiple_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
849                                       uint8_t * response_buffer, uint16_t response_buffer_size){
850 
851     // 1 byte opcode + two or more attribute handles (2 bytes each)
852     if ( (request_len < 5u) || ((request_len & 1u) == 0u) ) return setup_error_invalid_pdu(response_buffer,
853                                                                                         ATT_READ_MULTIPLE_REQUEST);
854 
855     int num_handles = (request_len - 1u) >> 1u;
856     return handle_read_multiple_request2(att_connection, response_buffer, response_buffer_size, num_handles, &request_buffer[1]);
857 }
858 
859 //
860 // MARK: ATT_READ_BY_GROUP_TYPE_REQUEST 0x10
861 //
862 // Only handles GATT_PRIMARY_SERVICE_UUID and GATT_SECONDARY_SERVICE_UUID
863 // Core v4.0, vol 3, part g, 2.5.3
864 // "The «Primary Service» and «Secondary Service» grouping types may be used in the Read By Group Type Request.
865 //  The «Characteristic» grouping type shall not be used in the ATT Read By Group Type Request."
866 //
867 // NOTE: doesn't handle DYNAMIC values
868 //
869 // NOTE: we don't check for security as PRIMARY and SECONDAY SERVICE definition shouldn't be protected
870 // Core 4.0, vol 3, part g, 8.1
871 // "The list of services and characteristics that a device supports is not considered private or
872 //  confidential information, and therefore the Service and Characteristic Discovery procedures
873 //  shall always be permitted. "
874 //
875 static uint16_t handle_read_by_group_type_request2(att_connection_t * att_connection, uint8_t * response_buffer, uint16_t response_buffer_size,
876                                             uint16_t start_handle, uint16_t end_handle,
877                                             uint16_t attribute_type_len, uint8_t * attribute_type){
878 
879     UNUSED(att_connection);
880 
881     log_info("ATT_READ_BY_GROUP_TYPE_REQUEST: from %04X to %04X, buffer size %u, type: ", start_handle, end_handle, response_buffer_size);
882     log_info_hexdump(attribute_type, attribute_type_len);
883     uint8_t request_type = ATT_READ_BY_GROUP_TYPE_REQUEST;
884 
885     if ((start_handle > end_handle) || (start_handle == 0u)){
886         return setup_error_invalid_handle(response_buffer, request_type, start_handle);
887     }
888 
889     // assert UUID is primary or secondary service uuid
890     uint16_t uuid16 = uuid16_from_uuid(attribute_type_len, attribute_type);
891     if ((uuid16 != GATT_PRIMARY_SERVICE_UUID) && (uuid16 != GATT_SECONDARY_SERVICE_UUID)){
892         return setup_error(response_buffer, request_type, start_handle, ATT_ERROR_UNSUPPORTED_GROUP_TYPE);
893     }
894 
895     uint16_t offset   = 1;
896     uint16_t pair_len = 0;
897     uint16_t in_group = 0;
898     uint16_t group_start_handle = 0;
899     uint8_t const * group_start_value = NULL;
900     uint16_t prev_handle = 0;
901 
902     att_iterator_t it;
903     att_iterator_init(&it);
904     while (att_iterator_has_next(&it)){
905         att_iterator_fetch_next(&it);
906 
907         if (it.handle && (it.handle < start_handle)) continue;
908         if (it.handle > end_handle) break;  // (1)
909 
910         // log_info("Handle 0x%04x", it.handle);
911 
912         // close current tag, if within a group and a new service definition starts or we reach end of att db
913         if (in_group &&
914             ((it.handle == 0u) || att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID))){
915             // log_info("End of group, handle 0x%04x, val_len: %u", prev_handle, pair_len - 4);
916 
917             little_endian_store_16(response_buffer, offset, group_start_handle);
918             offset += 2u;
919             little_endian_store_16(response_buffer, offset, prev_handle);
920             offset += 2u;
921             (void)memcpy(response_buffer + offset, group_start_value,
922                          pair_len - 4u);
923             offset += pair_len - 4u;
924             in_group = 0;
925 
926             // check if space for another handle pair available
927             if ((offset + pair_len) > response_buffer_size){
928                 break;
929             }
930         }
931 
932         // keep track of previous handle
933         prev_handle = it.handle;
934 
935         // does current attribute match
936         // log_info("compare: %04x == %04x", *(uint16_t*) context->attribute_type, *(uint16_t*) uuid);
937         if (it.handle && att_iterator_match_uuid(&it, attribute_type, attribute_type_len)) {
938 
939             // check if value has same len as last one
940             uint16_t this_pair_len = 4u + it.value_len;
941             if (offset > 1u){
942                 if (this_pair_len != pair_len) {
943                     break;
944                 }
945             }
946 
947             // log_info("Begin of group, handle 0x%04x", it.handle);
948 
949             // first
950             if (offset == 1u) {
951                 pair_len = this_pair_len;
952                 response_buffer[offset] = this_pair_len;
953                 offset++;
954             }
955 
956             group_start_handle = it.handle;
957             group_start_value  = it.value;
958             in_group = 1;
959         }
960     }
961 
962     if (offset == 1u){
963         return setup_error_atribute_not_found(response_buffer, request_type, start_handle);
964     }
965 
966     response_buffer[0] = ATT_READ_BY_GROUP_TYPE_RESPONSE;
967     return offset;
968 }
969 static uint16_t handle_read_by_group_type_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
970                                            uint8_t * response_buffer, uint16_t response_buffer_size){
971     uint16_t attribute_type_len;
972     switch (request_len){
973         case 7:
974             attribute_type_len = 2;
975             break;
976         case 21:
977             attribute_type_len = 16;
978             break;
979         default:
980             return setup_error_invalid_pdu(response_buffer, ATT_READ_BY_GROUP_TYPE_REQUEST);
981     }
982 
983     uint16_t start_handle = little_endian_read_16(request_buffer, 1);
984     uint16_t end_handle = little_endian_read_16(request_buffer, 3);
985     return handle_read_by_group_type_request2(att_connection, response_buffer, response_buffer_size, start_handle, end_handle, attribute_type_len, &request_buffer[5]);
986 }
987 
988 //
989 // MARK: ATT_WRITE_REQUEST 0x12
990 static uint16_t handle_write_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
991                               uint8_t * response_buffer, uint16_t response_buffer_size){
992 
993     UNUSED(response_buffer_size);
994 
995     if (request_len < 3u) return setup_error_invalid_pdu(response_buffer, ATT_WRITE_REQUEST);
996 
997     uint8_t request_type = ATT_WRITE_REQUEST;
998 
999     uint16_t handle = little_endian_read_16(request_buffer, 1);
1000     att_iterator_t it;
1001     int ok = att_find_handle(&it, handle);
1002     if (!ok) {
1003         return setup_error_invalid_handle(response_buffer, request_type, handle);
1004     }
1005     if (att_write_callback == NULL) {
1006         return setup_error_write_not_permitted(response_buffer, request_type, handle);
1007     }
1008     if ((it.flags & ATT_PROPERTY_WRITE) == 0u) {
1009         return setup_error_write_not_permitted(response_buffer, request_type, handle);
1010     }
1011     if ((it.flags & ATT_PROPERTY_DYNAMIC) == 0u) {
1012         return setup_error_write_not_permitted(response_buffer, request_type, handle);
1013     }
1014     // check security requirements
1015     int error_code = att_validate_security(att_connection, ATT_WRITE, &it);
1016     if (error_code != 0) {
1017         return setup_error(response_buffer, request_type, handle, error_code);
1018     }
1019     att_persistent_ccc_cache(&it);
1020     error_code = (*att_write_callback)(att_connection->con_handle, handle, ATT_TRANSACTION_MODE_NONE, 0u, request_buffer + 3u, request_len - 3u);
1021 
1022 #ifdef ENABLE_ATT_DELAYED_RESPONSE
1023     if (error_code == ATT_ERROR_WRITE_RESPONSE_PENDING) return ATT_INTERNAL_WRITE_RESPONSE_PENDING;
1024 #endif
1025 
1026     if (error_code != 0) {
1027         return setup_error(response_buffer, request_type, handle, error_code);
1028     }
1029     response_buffer[0] = ATT_WRITE_RESPONSE;
1030     return 1;
1031 }
1032 
1033 //
1034 // MARK: ATT_PREPARE_WRITE_REQUEST 0x16
1035 static uint16_t handle_prepare_write_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
1036                                       uint8_t * response_buffer, uint16_t response_buffer_size){
1037 
1038     uint8_t request_type = ATT_PREPARE_WRITE_REQUEST;
1039 
1040     if (request_len < 5u) return setup_error_invalid_pdu(response_buffer, request_type);
1041 
1042     uint16_t handle = little_endian_read_16(request_buffer, 1);
1043     uint16_t offset = little_endian_read_16(request_buffer, 3);
1044     if (att_write_callback == NULL) {
1045         return setup_error_write_not_permitted(response_buffer, request_type, handle);
1046     }
1047     att_iterator_t it;
1048     if (att_find_handle(&it, handle) == 0) {
1049         return setup_error_invalid_handle(response_buffer, request_type, handle);
1050     }
1051     if ((it.flags & ATT_PROPERTY_WRITE) == 0u) {
1052         return setup_error_write_not_permitted(response_buffer, request_type, handle);
1053     }
1054     if ((it.flags & ATT_PROPERTY_DYNAMIC) == 0u) {
1055         return setup_error_write_not_permitted(response_buffer, request_type, handle);
1056     }
1057     // check security requirements
1058     int error_code = att_validate_security(att_connection, ATT_WRITE, &it);
1059     if (error_code != 0) {
1060         return setup_error(response_buffer, request_type, handle, error_code);
1061     }
1062 
1063     error_code = (*att_write_callback)(att_connection->con_handle, handle, ATT_TRANSACTION_MODE_ACTIVE, offset, request_buffer + 5u, request_len - 5u);
1064     switch (error_code){
1065         case 0:
1066             break;
1067         case ATT_ERROR_INVALID_OFFSET:
1068         case ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH:
1069             // postpone to execute write request
1070             att_prepare_write_update_errors(error_code, handle);
1071             break;
1072 #ifdef ENABLE_ATT_DELAYED_RESPONSE
1073         case ATT_ERROR_WRITE_RESPONSE_PENDING:
1074             return ATT_INTERNAL_WRITE_RESPONSE_PENDING;
1075 #endif
1076         default:
1077             return setup_error(response_buffer, request_type, handle, error_code);
1078     }
1079 
1080     // response: echo request
1081     uint16_t bytes_to_echo = btstack_min(request_len, response_buffer_size);
1082     (void)memcpy(response_buffer, request_buffer, bytes_to_echo);
1083     response_buffer[0] = ATT_PREPARE_WRITE_RESPONSE;
1084     return request_len;
1085 }
1086 
1087 /*
1088  * @brief transcation queue of prepared writes, e.g., after disconnect
1089  */
1090 void att_clear_transaction_queue(att_connection_t * att_connection){
1091     (*att_write_callback)(att_connection->con_handle, 0, ATT_TRANSACTION_MODE_CANCEL, 0, NULL, 0);
1092 }
1093 
1094 // MARK: ATT_EXECUTE_WRITE_REQUEST 0x18
1095 // NOTE: security has been verified by handle_prepare_write_request
1096 static uint16_t handle_execute_write_request(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len,
1097                                       uint8_t * response_buffer, uint16_t response_buffer_size){
1098 
1099     UNUSED(response_buffer_size);
1100 
1101     uint8_t request_type = ATT_EXECUTE_WRITE_REQUEST;
1102 
1103     if (request_len < 2u) return setup_error_invalid_pdu(response_buffer, request_type);
1104 
1105     if (att_write_callback == NULL) {
1106         return setup_error_write_not_permitted(response_buffer, request_type, 0);
1107     }
1108 
1109     if (request_buffer[1]) {
1110         // validate queued write
1111         if (att_prepare_write_error_code == 0){
1112             att_prepare_write_error_code = (*att_write_callback)(att_connection->con_handle, 0, ATT_TRANSACTION_MODE_VALIDATE, 0, NULL, 0);
1113         }
1114 #ifdef ENABLE_ATT_DELAYED_RESPONSE
1115         if (att_prepare_write_error_code == ATT_ERROR_WRITE_RESPONSE_PENDING) return ATT_INTERNAL_WRITE_RESPONSE_PENDING;
1116 #endif
1117         // deliver queued errors
1118         if (att_prepare_write_error_code != 0){
1119             att_clear_transaction_queue(att_connection);
1120             uint8_t  error_code = att_prepare_write_error_code;
1121             uint16_t handle     = att_prepare_write_error_handle;
1122             att_prepare_write_reset();
1123             return setup_error(response_buffer, request_type, handle, error_code);
1124         }
1125         att_write_callback(att_connection->con_handle, 0, ATT_TRANSACTION_MODE_EXECUTE, 0, NULL, 0);
1126     } else {
1127         att_clear_transaction_queue(att_connection);
1128     }
1129     response_buffer[0] = ATT_EXECUTE_WRITE_RESPONSE;
1130     return 1;
1131 }
1132 
1133 // MARK: ATT_WRITE_COMMAND 0x52
1134 // Core 4.0, vol 3, part F, 3.4.5.3
1135 // "No Error Response or Write Response shall be sent in response to this command"
1136 static void handle_write_command(att_connection_t * att_connection, uint8_t * request_buffer,  uint16_t request_len, uint16_t required_flags){
1137 
1138     if (request_len < 3u) return;
1139 
1140     uint16_t handle = little_endian_read_16(request_buffer, 1);
1141     if (att_write_callback == NULL) return;
1142 
1143     att_iterator_t it;
1144     int ok = att_find_handle(&it, handle);
1145     if (!ok) return;
1146     if ((it.flags & ATT_PROPERTY_DYNAMIC) == 0u) return;
1147     if ((it.flags & required_flags) == 0u) return;
1148     if (att_validate_security(att_connection, ATT_WRITE, &it)) return;
1149     att_persistent_ccc_cache(&it);
1150     (*att_write_callback)(att_connection->con_handle, handle, ATT_TRANSACTION_MODE_NONE, 0u, request_buffer + 3u, request_len - 3u);
1151 }
1152 
1153 // MARK: helper for ATT_HANDLE_VALUE_NOTIFICATION and ATT_HANDLE_VALUE_INDICATION
1154 static uint16_t prepare_handle_value(att_connection_t * att_connection,
1155                                      uint16_t handle,
1156                                      const uint8_t *value,
1157                                      uint16_t value_len,
1158                                      uint8_t * response_buffer){
1159     little_endian_store_16(response_buffer, 1, handle);
1160     if (value_len > (att_connection->mtu - 3u)){
1161         value_len = att_connection->mtu - 3u;
1162     }
1163     (void)memcpy(&response_buffer[3], value, value_len);
1164     return value_len + 3u;
1165 }
1166 
1167 // MARK: ATT_HANDLE_VALUE_NOTIFICATION 0x1b
1168 uint16_t att_prepare_handle_value_notification(att_connection_t * att_connection,
1169                                                uint16_t handle,
1170                                                const uint8_t *value,
1171                                                uint16_t value_len,
1172                                                uint8_t * response_buffer){
1173 
1174     response_buffer[0] = ATT_HANDLE_VALUE_NOTIFICATION;
1175     return prepare_handle_value(att_connection, handle, value, value_len, response_buffer);
1176 }
1177 
1178 // MARK: ATT_HANDLE_VALUE_INDICATION 0x1d
1179 uint16_t att_prepare_handle_value_indication(att_connection_t * att_connection,
1180                                              uint16_t handle,
1181                                              const uint8_t *value,
1182                                              uint16_t value_len,
1183                                              uint8_t * response_buffer){
1184 
1185     response_buffer[0] = ATT_HANDLE_VALUE_INDICATION;
1186     return prepare_handle_value(att_connection, handle, value, value_len, response_buffer);
1187 }
1188 
1189 // MARK: Dispatcher
1190 uint16_t att_handle_request(att_connection_t * att_connection,
1191                             uint8_t * request_buffer,
1192                             uint16_t request_len,
1193                             uint8_t * response_buffer){
1194     uint16_t response_len = 0;
1195     const uint16_t response_buffer_size = att_connection->mtu;
1196     const uint8_t  request_opcode = request_buffer[0];
1197 
1198     switch (request_opcode){
1199         case ATT_EXCHANGE_MTU_REQUEST:
1200             response_len = handle_exchange_mtu_request(att_connection, request_buffer, request_len, response_buffer);
1201             break;
1202         case ATT_FIND_INFORMATION_REQUEST:
1203             response_len = handle_find_information_request(att_connection, request_buffer, request_len,response_buffer, response_buffer_size);
1204             break;
1205         case ATT_FIND_BY_TYPE_VALUE_REQUEST:
1206             response_len = handle_find_by_type_value_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1207             break;
1208         case ATT_READ_BY_TYPE_REQUEST:
1209             response_len = handle_read_by_type_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1210             break;
1211         case ATT_READ_REQUEST:
1212             response_len = handle_read_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1213             break;
1214         case ATT_READ_BLOB_REQUEST:
1215             response_len = handle_read_blob_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1216             break;
1217         case ATT_READ_MULTIPLE_REQUEST:
1218             response_len = handle_read_multiple_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1219             break;
1220         case ATT_READ_BY_GROUP_TYPE_REQUEST:
1221             response_len = handle_read_by_group_type_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1222             break;
1223         case ATT_WRITE_REQUEST:
1224             response_len = handle_write_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1225             break;
1226         case ATT_PREPARE_WRITE_REQUEST:
1227             response_len = handle_prepare_write_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1228             break;
1229         case ATT_EXECUTE_WRITE_REQUEST:
1230             response_len = handle_execute_write_request(att_connection, request_buffer, request_len, response_buffer, response_buffer_size);
1231             break;
1232         case ATT_WRITE_COMMAND:
1233             handle_write_command(att_connection, request_buffer, request_len, ATT_PROPERTY_WRITE_WITHOUT_RESPONSE);
1234             break;
1235 #ifdef ENABLE_LE_SIGNED_WRITE
1236         case ATT_SIGNED_WRITE_COMMAND:
1237             handle_write_command(att_connection, request_buffer, request_len, ATT_PROPERTY_AUTHENTICATED_SIGNED_WRITE);
1238             break;
1239 #endif
1240         default:
1241             response_len = setup_error(response_buffer, request_opcode, 0, ATT_ERROR_REQUEST_NOT_SUPPORTED);
1242             break;
1243     }
1244     return response_len;
1245 }
1246 
1247 // returns 1 if service found. only primary service.
1248 bool gatt_server_get_get_handle_range_for_service_with_uuid16(uint16_t uuid16, uint16_t * start_handle, uint16_t * end_handle){
1249     uint16_t in_group    = 0;
1250     uint16_t prev_handle = 0;
1251 
1252     uint8_t attribute_value[2];
1253     int attribute_len = sizeof(attribute_value);
1254     little_endian_store_16(attribute_value, 0, uuid16);
1255 
1256     att_iterator_t it;
1257     att_iterator_init(&it);
1258     while (att_iterator_has_next(&it)){
1259         att_iterator_fetch_next(&it);
1260         int new_service_started = att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID);
1261 
1262         // close current tag, if within a group and a new service definition starts or we reach end of att db
1263         if (in_group &&
1264             ((it.handle == 0u) || new_service_started)){
1265             *end_handle = prev_handle;
1266             return true;
1267         }
1268 
1269         // keep track of previous handle
1270         prev_handle = it.handle;
1271 
1272         // check if found
1273         if (it.handle && new_service_started && (attribute_len == it.value_len) && (memcmp(attribute_value, it.value, it.value_len) == 0)){
1274             *start_handle = it.handle;
1275             in_group = true;
1276         }
1277     }
1278     return false;
1279 }
1280 
1281 // returns false if not found
1282 uint16_t gatt_server_get_value_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t uuid16){
1283     att_iterator_t it;
1284     att_iterator_init(&it);
1285     while (att_iterator_has_next(&it)){
1286         att_iterator_fetch_next(&it);
1287         if (it.handle && (it.handle < start_handle)) continue;
1288         if (it.handle > end_handle) break;  // (1)
1289         if (it.handle == 0u) break;
1290         if (att_iterator_match_uuid16(&it, uuid16)) return it.handle;
1291     }
1292     return 0;
1293 }
1294 
1295 uint16_t gatt_server_get_descriptor_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t characteristic_uuid16, uint16_t descriptor_uuid16){
1296     att_iterator_t it;
1297     att_iterator_init(&it);
1298     bool characteristic_found = false;
1299     while (att_iterator_has_next(&it)){
1300         att_iterator_fetch_next(&it);
1301         if (it.handle && (it.handle < start_handle)) continue;
1302         if (it.handle > end_handle) break;  // (1)
1303         if (it.handle == 0u) break;
1304         if (att_iterator_match_uuid16(&it, characteristic_uuid16)){
1305             characteristic_found = true;
1306             continue;
1307         }
1308         if (att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID)
1309          || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID)
1310          || att_iterator_match_uuid16(&it, GATT_CHARACTERISTICS_UUID)){
1311             if (characteristic_found) break;
1312             continue;
1313         }
1314         if (characteristic_found && att_iterator_match_uuid16(&it, descriptor_uuid16)){
1315             return it.handle;
1316         }
1317     }
1318     return 0;
1319 }
1320 
1321 // returns 0 if not found
1322 uint16_t gatt_server_get_client_configuration_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t characteristic_uuid16){
1323     return gatt_server_get_descriptor_handle_for_characteristic_with_uuid16(start_handle, end_handle, characteristic_uuid16, GATT_CLIENT_CHARACTERISTICS_CONFIGURATION);
1324 }
1325 // returns 0 if not found
1326 
1327 uint16_t gatt_server_get_server_configuration_handle_for_characteristic_with_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t characteristic_uuid16){
1328     return gatt_server_get_descriptor_handle_for_characteristic_with_uuid16(start_handle, end_handle, characteristic_uuid16, GATT_SERVER_CHARACTERISTICS_CONFIGURATION);
1329 }
1330 
1331 // returns 1 if service found. only primary service.
1332 int gatt_server_get_get_handle_range_for_service_with_uuid128(const uint8_t * uuid128, uint16_t * start_handle, uint16_t * end_handle){
1333     uint16_t in_group    = 0;
1334     uint16_t prev_handle = 0;
1335 
1336     uint8_t attribute_value[16];
1337     int attribute_len = sizeof(attribute_value);
1338     reverse_128(uuid128, attribute_value);
1339 
1340     att_iterator_t it;
1341     att_iterator_init(&it);
1342     while (att_iterator_has_next(&it)){
1343         att_iterator_fetch_next(&it);
1344         int new_service_started = att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID) || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID);
1345 
1346         // close current tag, if within a group and a new service definition starts or we reach end of att db
1347         if (in_group &&
1348             ((it.handle == 0u) || new_service_started)){
1349             *end_handle = prev_handle;
1350             return 1;
1351         }
1352 
1353         // keep track of previous handle
1354         prev_handle = it.handle;
1355 
1356         // check if found
1357         if (it.handle && new_service_started && (attribute_len == it.value_len) && (memcmp(attribute_value, it.value, it.value_len) == 0)){
1358             *start_handle = it.handle;
1359             in_group = 1;
1360         }
1361     }
1362     return 0;
1363 }
1364 
1365 // returns 0 if not found
1366 uint16_t gatt_server_get_value_handle_for_characteristic_with_uuid128(uint16_t start_handle, uint16_t end_handle, const uint8_t * uuid128){
1367     uint8_t attribute_value[16];
1368     reverse_128(uuid128, attribute_value);
1369     att_iterator_t it;
1370     att_iterator_init(&it);
1371     while (att_iterator_has_next(&it)){
1372         att_iterator_fetch_next(&it);
1373         if (it.handle && (it.handle < start_handle)) continue;
1374         if (it.handle > end_handle) break;  // (1)
1375         if (it.handle == 0u) break;
1376         if (att_iterator_match_uuid(&it, attribute_value, 16)) return it.handle;
1377     }
1378     return 0;
1379 }
1380 
1381 // returns 0 if not found
1382 uint16_t gatt_server_get_client_configuration_handle_for_characteristic_with_uuid128(uint16_t start_handle, uint16_t end_handle, const uint8_t * uuid128){
1383     uint8_t attribute_value[16];
1384     reverse_128(uuid128, attribute_value);
1385     att_iterator_t it;
1386     att_iterator_init(&it);
1387     int characteristic_found = 0;
1388     while (att_iterator_has_next(&it)){
1389         att_iterator_fetch_next(&it);
1390         if (it.handle && (it.handle < start_handle)) continue;
1391         if (it.handle > end_handle) break;  // (1)
1392         if (it.handle == 0u) break;
1393         if (att_iterator_match_uuid(&it, attribute_value, 16)){
1394             characteristic_found = 1;
1395             continue;
1396         }
1397         if (att_iterator_match_uuid16(&it, GATT_PRIMARY_SERVICE_UUID)
1398          || att_iterator_match_uuid16(&it, GATT_SECONDARY_SERVICE_UUID)
1399          || att_iterator_match_uuid16(&it, GATT_CHARACTERISTICS_UUID)){
1400             if (characteristic_found) break;
1401             continue;
1402         }
1403         if (characteristic_found && att_iterator_match_uuid16(&it, GATT_CLIENT_CHARACTERISTICS_CONFIGURATION)){
1404             return it.handle;
1405         }
1406     }
1407     return 0;
1408 }
1409 
1410 
1411 // 1-item cache to optimize query during write_callback
1412 static void att_persistent_ccc_cache(att_iterator_t * it){
1413     att_persistent_ccc_handle = it->handle;
1414     if (it->flags & ATT_PROPERTY_UUID128){
1415         att_persistent_ccc_uuid16 = 0;
1416     } else {
1417         att_persistent_ccc_uuid16 = little_endian_read_16(it->uuid, 0);
1418     }
1419 }
1420 
1421 bool att_is_persistent_ccc(uint16_t handle){
1422     if (handle != att_persistent_ccc_handle){
1423         att_iterator_t it;
1424         int ok = att_find_handle(&it, handle);
1425         if (!ok) return false;
1426         att_persistent_ccc_cache(&it);
1427     }
1428     return att_persistent_ccc_uuid16 == GATT_CLIENT_CHARACTERISTICS_CONFIGURATION;
1429 }
1430 
1431 // att_read_callback helpers
1432 uint16_t att_read_callback_handle_blob(const uint8_t * blob, uint16_t blob_size, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){
1433     btstack_assert(blob != NULL);
1434 
1435     if (buffer != NULL){
1436         uint16_t bytes_to_copy = 0;
1437         if (blob_size >= offset){
1438             bytes_to_copy = btstack_min(blob_size - offset, buffer_size);
1439             (void)memcpy(buffer, &blob[offset], bytes_to_copy);
1440         }
1441         return bytes_to_copy;
1442     } else {
1443         return blob_size;
1444     }
1445 }
1446 
1447 uint16_t att_read_callback_handle_little_endian_32(uint32_t value, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){
1448     uint8_t value_buffer[4];
1449     little_endian_store_32(value_buffer, 0, value);
1450     return att_read_callback_handle_blob(value_buffer, sizeof(value_buffer), offset, buffer, buffer_size);
1451 }
1452 
1453 uint16_t att_read_callback_handle_little_endian_16(uint16_t value, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){
1454     uint8_t value_buffer[2];
1455     little_endian_store_16(value_buffer, 0, value);
1456     return att_read_callback_handle_blob(value_buffer, sizeof(value_buffer), offset, buffer, buffer_size);
1457 }
1458 
1459 uint16_t att_read_callback_handle_byte(uint8_t value, uint16_t offset, uint8_t * buffer, uint16_t buffer_size){
1460     uint8_t value_buffer[1];
1461     value_buffer[0] = value;
1462     return att_read_callback_handle_blob(value_buffer, sizeof(value_buffer), offset, buffer, buffer_size);
1463 }
1464 
1465 
1466 #ifdef ENABLE_BTP
1467 
1468 // start of auto-PTS testing code, not used in production
1469 // LCOV_EXCL_START
1470 #include "btp.h"
1471 
1472 static uint8_t btp_permissions_for_flags(uint16_t flags){
1473 
1474     // see BT_GATT_PERM_*
1475     // https://docs.zephyrproject.org/latest/reference/bluetooth/gatt.html
1476     // set bit indicates requirement, e.g. BTP_GATT_PERM_READ_AUTHN requires authenticated connection
1477 
1478     uint8_t permissions = 0;
1479 
1480     uint8_t read_security_level = 0;
1481     uint8_t write_security_level = 0;
1482     if (flags & ATT_PROPERTY_READ){
1483         if (flags & ATT_PROPERTY_READ_PERMISSION_BIT_0) {
1484             read_security_level |= 1;
1485         }
1486         if (flags & ATT_PROPERTY_READ_PERMISSION_BIT_1) {
1487             read_security_level |= 2;
1488         }
1489         if (read_security_level == ATT_SECURITY_AUTHORIZED) {
1490             permissions |= BTP_GATT_PERM_READ_AUTHZ;
1491         }
1492         if (read_security_level == ATT_SECURITY_AUTHENTICATED) {
1493             permissions |= BTP_GATT_PERM_READ_AUTHN;
1494         }
1495         if (read_security_level == ATT_SECURITY_ENCRYPTED) {
1496             permissions |= BTP_GATT_PERM_READ_ENC;
1497         }
1498         if (read_security_level == ATT_SECURITY_NONE) {
1499             permissions |= BTP_GATT_PERM_READ;
1500         }
1501     }
1502     if (flags & (ATT_PROPERTY_WRITE | ATT_PROPERTY_WRITE_WITHOUT_RESPONSE)){
1503         if (flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_0) {
1504             write_security_level |= 1;
1505         }
1506         if (flags & ATT_PROPERTY_WRITE_PERMISSION_BIT_1) {
1507             write_security_level |= 2;
1508         }
1509         if (write_security_level == ATT_SECURITY_AUTHORIZED) {
1510             permissions |= BTP_GATT_PERM_WRITE_AUTHZ;
1511         }
1512         if (write_security_level == ATT_SECURITY_AUTHENTICATED) {
1513             permissions |= BTP_GATT_PERM_WRITE_AUTHN;
1514         }
1515         if (write_security_level == ATT_SECURITY_ENCRYPTED) {
1516             permissions |= BTP_GATT_PERM_WRITE_ENC;
1517         }
1518         if (write_security_level == ATT_SECURITY_NONE) {
1519             permissions |= BTP_GATT_PERM_WRITE;
1520         }
1521     }
1522     return permissions;
1523 }
1524 
1525 uint16_t btp_att_get_attributes_by_uuid16(uint16_t start_handle, uint16_t end_handle, uint16_t uuid16, uint8_t * response_buffer, uint16_t response_buffer_size){
1526     log_info("btp_att_get_attributes_by_uuid16 %04x from 0x%04x to 0x%04x, db %p", uuid16, start_handle, end_handle, att_db);
1527     att_dump_attributes();
1528 
1529     uint8_t num_attributes = 0;
1530     uint16_t pos = 1;
1531 
1532     att_iterator_t  it;
1533     att_iterator_init(&it);
1534     while (att_iterator_has_next(&it) && ((pos + 6) < response_buffer_size)){
1535         att_iterator_fetch_next(&it);
1536         log_info("handle %04x", it.handle);
1537         if (it.handle == 0) break;
1538         if (it.handle < start_handle) continue;
1539         if (it.handle > end_handle) break;
1540         if ((uuid16 == 0) || att_iterator_match_uuid16(&it, uuid16)){
1541             little_endian_store_16(response_buffer, pos, it.handle);
1542             pos += 2;
1543             response_buffer[pos++] = btp_permissions_for_flags(it.flags);
1544             response_buffer[pos++] = 2;
1545             little_endian_store_16(response_buffer, pos, uuid16);
1546             pos += 2;
1547             num_attributes++;
1548         }
1549     }
1550     response_buffer[0] = num_attributes;
1551     return pos;
1552 }
1553 
1554 uint16_t btp_att_get_attributes_by_uuid128(uint16_t start_handle, uint16_t end_handle, const uint8_t * uuid128, uint8_t * response_buffer, uint16_t response_buffer_size){
1555     uint8_t num_attributes = 0;
1556     uint16_t pos = 1;
1557     att_iterator_t  it;
1558     att_iterator_init(&it);
1559     while (att_iterator_has_next(&it) && ((pos + 20) < response_buffer_size)){
1560         att_iterator_fetch_next(&it);
1561         if (it.handle == 0) break;
1562         if (it.handle < start_handle) continue;
1563         if (it.handle > end_handle) break;
1564         if (att_iterator_match_uuid(&it, (uint8_t*) uuid128, 16)){
1565             little_endian_store_16(response_buffer, pos, it.handle);
1566             pos += 2;
1567             response_buffer[pos++] = btp_permissions_for_flags(it.flags);
1568             response_buffer[pos++] = 16;
1569             reverse_128(uuid128, &response_buffer[pos]);
1570             pos += 16;
1571             num_attributes++;
1572         }
1573     }
1574     response_buffer[0] = num_attributes;
1575     return pos;
1576 }
1577 
1578 uint16_t btp_att_get_attribute_value(att_connection_t * att_connection, uint16_t attribute_handle, uint8_t * response_buffer, uint16_t response_buffer_size){
1579     att_iterator_t it;
1580     int ok = att_find_handle(&it, attribute_handle);
1581     if (!ok) return 0;
1582 
1583     uint16_t pos = 0;
1584     // field: ATT_Response - simulate READ operation on given connection
1585     response_buffer[pos++] = att_validate_security(att_connection, ATT_READ, &it);
1586     // fetch len
1587     // assume: con handle not relevant here, else, it needs to get passed in
1588     // att_update_value_len(&it, HCI_CON_HANDLE_INVALID);
1589     uint16_t bytes_to_copy = btstack_min( response_buffer_size - 3, it.value_len);
1590     little_endian_store_16(response_buffer, pos, bytes_to_copy);
1591     pos += 2;
1592     // get value - only works for non-dynamic data
1593     if (it.value){
1594         memcpy(&response_buffer[pos], it.value, bytes_to_copy);
1595         pos += bytes_to_copy;
1596     }
1597     return pos;
1598 }
1599 // LCOV_EXCL_STOP
1600 #endif
1601