2016-06-29 07:24:45

by François Beaufort

[permalink] [raw]
Subject: Notify on succeeds while no apparent descriptor

I have a bogus BLE device which exposes "badly" a characteristic
notification. Even though it doesn't find a characteristic descriptor,
I'm still able to start notifications and even receive value changed
events.

For info, Android and macOS raise an exception when trying to start
notifications. See
https://github.com/WebBluetoothCG/ble-test-peripheral-android/issues/63

See logs:

< ACL Data TX: Handle 32 flags 0x00 dlen 9
[hci0] 403.621325
ATT: Find Information Request (0x04) len 4
Handle range: 0x002b-0xffff
> HCI Event: Number of Completed Packets (0x13) plen 5 [hci0] 403.689256
Num handles: 1
Handle: 32
Count: 1
> ACL Data RX: Handle 32 flags 0x02 dlen 9 [hci0] 403.755926
ATT: Error Response (0x01) len 4
Find Information Request (0x04)
Handle: 0x002b
Error: Attribute Not Found (0x0a)

---

[Nexus 5X]# list-attributes
Primary Service
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0001
Generic Attribute Profile
Characteristic
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0001/char0002
Service Changed
Primary Service
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0028
Battery Service
Characteristic
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
Battery Level
[Nexus 5X]# select-attribute
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
[Nexus 5X:/service0028/char0029]# notify on
[CHG] Attribute
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
yes
Notify started
[CHG] Attribute
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Value: 0x32
[Nexus 5X:/service0028/char0029]# notify off
[CHG] Attribute
/org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
no
Notify stopped


2016-06-30 11:41:51

by François Beaufort

[permalink] [raw]
Subject: Re: Notify on succeeds while no apparent descriptor

Thank you Luiz, I'm not sure what are most OSes there because macOS
and Android don't allow register characteristics without a CCC.

I'll ping armansito@ and let you know ;)

On Thu, Jun 30, 2016 at 1:36 PM, Luiz Augusto von Dentz
<[email protected]> wrote:
> Hi François,
>
> On Wed, Jun 29, 2016 at 10:24 AM, François Beaufort
> <[email protected]> wrote:
>> I have a bogus BLE device which exposes "badly" a characteristic
>> notification. Even though it doesn't find a characteristic descriptor,
>> I'm still able to start notifications and even receive value changed
>> events.
>>
>> For info, Android and macOS raise an exception when trying to start
>> notifications. See
>> https://github.com/WebBluetoothCG/ble-test-peripheral-android/issues/63
>>
>> See logs:
>>
>> < ACL Data TX: Handle 32 flags 0x00 dlen 9
>> [hci0] 403.621325
>> ATT: Find Information Request (0x04) len 4
>> Handle range: 0x002b-0xffff
>>> HCI Event: Number of Completed Packets (0x13) plen 5 [hci0] 403.689256
>> Num handles: 1
>> Handle: 32
>> Count: 1
>>> ACL Data RX: Handle 32 flags 0x02 dlen 9 [hci0] 403.755926
>> ATT: Error Response (0x01) len 4
>> Find Information Request (0x04)
>> Handle: 0x002b
>> Error: Attribute Not Found (0x0a)
>>
>> ---
>>
>> [Nexus 5X]# list-attributes
>> Primary Service
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0001
>> Generic Attribute Profile
>> Characteristic
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0001/char0002
>> Service Changed
>> Primary Service
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028
>> Battery Service
>> Characteristic
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
>> Battery Level
>> [Nexus 5X]# select-attribute
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
>> [Nexus 5X:/service0028/char0029]# notify on
>> [CHG] Attribute
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
>> yes
>> Notify started
>> [CHG] Attribute
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Value: 0x32
>> [Nexus 5X:/service0028/char0029]# notify off
>> [CHG] Attribute
>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
>> no
>> Notify stopped
>> --
>
> Just to make it public what I have stated in the irc, currently we
> allow enabling notification even without CCC (out of the spect
> unsolicited notification):
>
> commit 46aad83687251bef0fa0ac60583e5898170b0f10
> Author: Arman Uguray <[email protected]>
> Date: Tue Feb 3 19:58:22 2015 -0800
> shared/gatt: Allow register_notify without CCC
>
> Most OSes allow to register characteristics without a CCC even if they
> do support notification/indication, this is not according to the
> specification and may not even work in practice since there is no way
> to enable notifications/indications without a CCC to write to but there
> has been some applications that do that anyway.
>
> Perhaps Arman had it exactly for these broken application that don't
> register a CCC which Im guessing is because the GATT API don't do it
> by default (Android?) leaving it up to the app which can screw up we
> can observe here.
>
>
> --
> Luiz Augusto von Dentz

2016-06-30 11:36:34

by Luiz Augusto von Dentz

[permalink] [raw]
Subject: Re: Notify on succeeds while no apparent descriptor

Hi François,

On Wed, Jun 29, 2016 at 10:24 AM, François Beaufort
<[email protected]> wrote:
> I have a bogus BLE device which exposes "badly" a characteristic
> notification. Even though it doesn't find a characteristic descriptor,
> I'm still able to start notifications and even receive value changed
> events.
>
> For info, Android and macOS raise an exception when trying to start
> notifications. See
> https://github.com/WebBluetoothCG/ble-test-peripheral-android/issues/63
>
> See logs:
>
> < ACL Data TX: Handle 32 flags 0x00 dlen 9
> [hci0] 403.621325
> ATT: Find Information Request (0x04) len 4
> Handle range: 0x002b-0xffff
>> HCI Event: Number of Completed Packets (0x13) plen 5 [hci0] 403.689256
> Num handles: 1
> Handle: 32
> Count: 1
>> ACL Data RX: Handle 32 flags 0x02 dlen 9 [hci0] 403.755926
> ATT: Error Response (0x01) len 4
> Find Information Request (0x04)
> Handle: 0x002b
> Error: Attribute Not Found (0x0a)
>
> ---
>
> [Nexus 5X]# list-attributes
> Primary Service
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0001
> Generic Attribute Profile
> Characteristic
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0001/char0002
> Service Changed
> Primary Service
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028
> Battery Service
> Characteristic
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
> Battery Level
> [Nexus 5X]# select-attribute
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
> [Nexus 5X:/service0028/char0029]# notify on
> [CHG] Attribute
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
> yes
> Notify started
> [CHG] Attribute
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Value: 0x32
> [Nexus 5X:/service0028/char0029]# notify off
> [CHG] Attribute
> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
> no
> Notify stopped
> --

Just to make it public what I have stated in the irc, currently we
allow enabling notification even without CCC (out of the spect
unsolicited notification):

commit 46aad83687251bef0fa0ac60583e5898170b0f10
Author: Arman Uguray <[email protected]>
Date: Tue Feb 3 19:58:22 2015 -0800
shared/gatt: Allow register_notify without CCC

Most OSes allow to register characteristics without a CCC even if they
do support notification/indication, this is not according to the
specification and may not even work in practice since there is no way
to enable notifications/indications without a CCC to write to but there
has been some applications that do that anyway.

Perhaps Arman had it exactly for these broken application that don't
register a CCC which Im guessing is because the GATT API don't do it
by default (Android?) leaving it up to the app which can screw up we
can observe here.


--
Luiz Augusto von Dentz

2016-07-18 09:23:20

by Luiz Augusto von Dentz

[permalink] [raw]
Subject: Re: Notify on succeeds while no apparent descriptor

HI François,

On Mon, Jul 18, 2016 at 11:52 AM, François Beaufort
<[email protected]> wrote:
> For info, we'll track check for CCC descriptors at
> https://bugs.chromium.org/p/chromium/issues/detail?id=624763

Up to you, but we may as well just disallow that over D-Bus if we
don't have a reason to keep this policy, but then again this is a
reflection of stacks that don't manage notification themselves so
there is always a risk the application will not get these details
quite right breaking the notifications, if I were to enforce this I
would probably file an errata to the spec outlining the requirements
to support notification which may or may not end up allowing
unsolicited notifications/indications. Note that unsolicited
notifications may not be a bad idea since the implementation of CCC is
quite expensive given that it needs to be persisted, also for services
provided by application it may not be possible to restore the CCC
because the database may have changed.

Luiz Augusto von Dentz

2016-07-18 08:52:51

by François Beaufort

[permalink] [raw]
Subject: Re: Notify on succeeds while no apparent descriptor

For info, we'll track check for CCC descriptors at
https://bugs.chromium.org/p/chromium/issues/detail?id=624763

On Thu, Jun 30, 2016 at 1:41 PM, François Beaufort
<[email protected]> wrote:
> Thank you Luiz, I'm not sure what are most OSes there because macOS
> and Android don't allow register characteristics without a CCC.
>
> I'll ping armansito@ and let you know ;)
>
> On Thu, Jun 30, 2016 at 1:36 PM, Luiz Augusto von Dentz
> <[email protected]> wrote:
>> Hi François,
>>
>> On Wed, Jun 29, 2016 at 10:24 AM, François Beaufort
>> <[email protected]> wrote:
>>> I have a bogus BLE device which exposes "badly" a characteristic
>>> notification. Even though it doesn't find a characteristic descriptor,
>>> I'm still able to start notifications and even receive value changed
>>> events.
>>>
>>> For info, Android and macOS raise an exception when trying to start
>>> notifications. See
>>> https://github.com/WebBluetoothCG/ble-test-peripheral-android/issues/63
>>>
>>> See logs:
>>>
>>> < ACL Data TX: Handle 32 flags 0x00 dlen 9
>>> [hci0] 403.621325
>>> ATT: Find Information Request (0x04) len 4
>>> Handle range: 0x002b-0xffff
>>>> HCI Event: Number of Completed Packets (0x13) plen 5 [hci0] 403.689256
>>> Num handles: 1
>>> Handle: 32
>>> Count: 1
>>>> ACL Data RX: Handle 32 flags 0x02 dlen 9 [hci0] 403.755926
>>> ATT: Error Response (0x01) len 4
>>> Find Information Request (0x04)
>>> Handle: 0x002b
>>> Error: Attribute Not Found (0x0a)
>>>
>>> ---
>>>
>>> [Nexus 5X]# list-attributes
>>> Primary Service
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0001
>>> Generic Attribute Profile
>>> Characteristic
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0001/char0002
>>> Service Changed
>>> Primary Service
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028
>>> Battery Service
>>> Characteristic
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
>>> Battery Level
>>> [Nexus 5X]# select-attribute
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029
>>> [Nexus 5X:/service0028/char0029]# notify on
>>> [CHG] Attribute
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
>>> yes
>>> Notify started
>>> [CHG] Attribute
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Value: 0x32
>>> [Nexus 5X:/service0028/char0029]# notify off
>>> [CHG] Attribute
>>> /org/bluez/hci0/dev_46_EE_57_93_31_08/service0028/char0029 Notifying:
>>> no
>>> Notify stopped
>>> --
>>
>> Just to make it public what I have stated in the irc, currently we
>> allow enabling notification even without CCC (out of the spect
>> unsolicited notification):
>>
>> commit 46aad83687251bef0fa0ac60583e5898170b0f10
>> Author: Arman Uguray <[email protected]>
>> Date: Tue Feb 3 19:58:22 2015 -0800
>> shared/gatt: Allow register_notify without CCC
>>
>> Most OSes allow to register characteristics without a CCC even if they
>> do support notification/indication, this is not according to the
>> specification and may not even work in practice since there is no way
>> to enable notifications/indications without a CCC to write to but there
>> has been some applications that do that anyway.
>>
>> Perhaps Arman had it exactly for these broken application that don't
>> register a CCC which Im guessing is because the GATT API don't do it
>> by default (Android?) leaving it up to the app which can screw up we
>> can observe here.
>>
>>
>> --
>> Luiz Augusto von Dentz