Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <a3757dc933d70f4f23b85d8a152d21dd54f6d2ff.camel@peiker-cee.de>
In-Reply-To: <a3757dc933d70f4f23b85d8a152d21dd54f6d2ff.camel@peiker-cee.de>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Thu, 19 Dec 2019 14:12:36 -0800
Message-ID: <CABBYNZ+xSJn9ba1w8h_hk+RoHPCb-TWDM7syTpKVUt34Rja3Pw@mail.gmail.com>
Subject: Re: GATT server does not handle "Invalid Offset" and "Invalid
 Attribute Value Length" errors properly
To:     Konstantin Forostyan <konstantin.forostyan@peiker-cee.de>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Konstantin,

On Thu, Dec 19, 2019 at 12:36 AM Konstantin Forostyan
<konstantin.forostyan@peiker-cee.de> wrote:
>
> Hi,
>
> According to Bluetooth specs (BLUETOOTH CORE SPECIFICATION Version 5.1
> | Vol 3, Part F 3.4.6.1 Prepare Write Request):
>
> "... The Attribute Value validation is done when an Execute Write
> Request is received. Hence, any Invalid Offset or Invalid Attribute
> Value Length errors are generated when an Execute Write Request is
> received. ..."
>
> In contrary to the specs, 'bluetoothd' is sending error response during
> prepare write. The following patch changes this behaviour:
>
>
> --- a/src/shared/gatt-server.c  2018-06-01 10:37:36.000000000 +0200
> +++ b/src/shared/gatt-server.c  2019-12-13 12:25:22.000000000 +0100
> @@ -1223,7 +1223,17 @@
>
>         handle = get_le16(pwcd->pdu);
>
> -       if (err) {
> +       if ((0 != err) && (BT_ATT_ERROR_INVALID_OFFSET != err)
> +               && (BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN != err)) {
>                 bt_att_send_error_rsp(pwcd->server->att,
>                                         BT_ATT_OP_PREP_WRITE_REQ,
> handle, err);
>                 free(pwcd->pdu);

Yep, I remember this one actually since we did fix something similar
in Zephyr we would need to move the error checking to execute, btw is
this with bluetoothd or gatt-server tool, the later is probably not
recommended for qualification as it is more of a validation tool it
may not be feature complete.


-- 
Luiz Augusto von Dentz