1 /*
2 * ssar.c
3 *
4 * Copyright (c) 2004 Maksim Yevmenkin <m_evmenkin@yahoo.com>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $Id: ssar.c,v 1.4 2004/01/12 22:54:31 max Exp $
29 * $FreeBSD$
30 */
31
32 #include <sys/queue.h>
33 #define L2CAP_SOCKET_CHECKED
34 #include <bluetooth.h>
35 #include <sdp.h>
36 #include <string.h>
37 #include "profile.h"
38 #include "provider.h"
39 #include "server.h"
40 #include "uuid-private.h"
41
42 /* from sar.c */
43 int32_t server_prepare_attr_list(provider_p const provider,
44 uint8_t const *req, uint8_t const * const req_end,
45 uint8_t *rsp, uint8_t const * const rsp_end);
46
47 /*
48 * Prepare SDP Service Search Attribute Response
49 */
50
51 int32_t
server_prepare_service_search_attribute_response(server_p srv,int32_t fd)52 server_prepare_service_search_attribute_response(server_p srv, int32_t fd)
53 {
54 uint8_t const *req = srv->req + sizeof(sdp_pdu_t);
55 uint8_t const *req_end = req + ((sdp_pdu_p)(srv->req))->len;
56 uint8_t *rsp = srv->fdidx[fd].rsp;
57 uint8_t const *rsp_end = rsp + NG_L2CAP_MTU_MAXIMUM;
58
59 uint8_t const *sspptr = NULL, *aidptr = NULL;
60 uint8_t *ptr = NULL;
61
62 provider_t *provider = NULL;
63 int32_t type, rsp_limit, ssplen, aidlen, cslen, cs;
64 uint128_t uuid, puuid;
65
66 /*
67 * Minimal Service Search Attribute Request request
68 *
69 * seq8 len8 - 2 bytes
70 * uuid16 value16 - 3 bytes ServiceSearchPattern
71 * value16 - 2 bytes MaximumAttributeByteCount
72 * seq8 len8 - 2 bytes
73 * uint16 value16 - 3 bytes AttributeIDList
74 * value8 - 1 byte ContinuationState
75 */
76
77 if (req_end - req < 13)
78 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
79
80 /* Get size of ServiceSearchPattern */
81 ssplen = 0;
82 SDP_GET8(type, req);
83 switch (type) {
84 case SDP_DATA_SEQ8:
85 SDP_GET8(ssplen, req);
86 break;
87
88 case SDP_DATA_SEQ16:
89 SDP_GET16(ssplen, req);
90 break;
91
92 case SDP_DATA_SEQ32:
93 SDP_GET32(ssplen, req);
94 break;
95 }
96 if (ssplen <= 0)
97 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
98
99 sspptr = req;
100 req += ssplen;
101
102 /* Get MaximumAttributeByteCount */
103 if (req + 2 > req_end)
104 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
105
106 SDP_GET16(rsp_limit, req);
107 if (rsp_limit <= 0)
108 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
109
110 /* Get size of AttributeIDList */
111 if (req + 1 > req_end)
112 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
113
114 aidlen = 0;
115 SDP_GET8(type, req);
116 switch (type) {
117 case SDP_DATA_SEQ8:
118 if (req + 1 > req_end)
119 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
120
121 SDP_GET8(aidlen, req);
122 break;
123
124 case SDP_DATA_SEQ16:
125 if (req + 2 > req_end)
126 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
127
128 SDP_GET16(aidlen, req);
129 break;
130
131 case SDP_DATA_SEQ32:
132 if (req + 4 > req_end)
133 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
134
135 SDP_GET32(aidlen, req);
136 break;
137 }
138 if (aidlen <= 0)
139 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
140
141 aidptr = req;
142 req += aidlen;
143
144 /* Get ContinuationState */
145 if (req + 1 > req_end)
146 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
147
148 SDP_GET8(cslen, req);
149 if (cslen != 0) {
150 if (cslen != 2 || req_end - req != 2)
151 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
152
153 SDP_GET16(cs, req);
154 } else
155 cs = 0;
156
157 /* Process the request. First, check continuation state */
158 if (srv->fdidx[fd].rsp_cs != cs)
159 return (SDP_ERROR_CODE_INVALID_CONTINUATION_STATE);
160 if (srv->fdidx[fd].rsp_size > 0)
161 return (0);
162
163 /*
164 * Service Search Attribute Response format
165 *
166 * value16 - 2 bytes AttributeListByteCount (not incl.)
167 * seq8 len16 - 3 bytes
168 * attr list - 3+ bytes AttributeLists
169 * [ attr list ]
170 */
171
172 ptr = rsp + 3;
173
174 while (ssplen > 0) {
175 SDP_GET8(type, sspptr);
176 ssplen --;
177
178 switch (type) {
179 case SDP_DATA_UUID16:
180 if (ssplen < 2)
181 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
182
183 memcpy(&uuid, &uuid_base, sizeof(uuid));
184 uuid.b[2] = *sspptr ++;
185 uuid.b[3] = *sspptr ++;
186 ssplen -= 2;
187 break;
188
189 case SDP_DATA_UUID32:
190 if (ssplen < 4)
191 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
192
193 memcpy(&uuid, &uuid_base, sizeof(uuid));
194 uuid.b[0] = *sspptr ++;
195 uuid.b[1] = *sspptr ++;
196 uuid.b[2] = *sspptr ++;
197 uuid.b[3] = *sspptr ++;
198 ssplen -= 4;
199 break;
200
201 case SDP_DATA_UUID128:
202 if (ssplen < 16)
203 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
204
205 memcpy(uuid.b, sspptr, 16);
206 sspptr += 16;
207 ssplen -= 16;
208 break;
209
210 default:
211 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
212 /* NOT REACHED */
213 }
214
215 for (provider = provider_get_first();
216 provider != NULL;
217 provider = provider_get_next(provider)) {
218 if (!provider_match_bdaddr(provider, &srv->req_sa.l2cap_bdaddr))
219 continue;
220
221 memcpy(&puuid, &uuid_base, sizeof(puuid));
222 puuid.b[2] = provider->profile->uuid >> 8;
223 puuid.b[3] = provider->profile->uuid;
224
225 if (memcmp(&uuid, &puuid, sizeof(uuid)) != 0 &&
226 memcmp(&uuid, &uuid_public_browse_group, sizeof(uuid)) != 0)
227 continue;
228
229 cs = server_prepare_attr_list(provider,
230 aidptr, aidptr + aidlen, ptr, rsp_end);
231 if (cs < 0)
232 return (SDP_ERROR_CODE_INSUFFICIENT_RESOURCES);
233
234 ptr += cs;
235 }
236 }
237
238 /* Set reply size (not counting PDU header and continuation state) */
239 srv->fdidx[fd].rsp_limit = srv->fdidx[fd].omtu - sizeof(sdp_pdu_t) - 2;
240 if (srv->fdidx[fd].rsp_limit > rsp_limit)
241 srv->fdidx[fd].rsp_limit = rsp_limit;
242
243 srv->fdidx[fd].rsp_size = ptr - rsp;
244 srv->fdidx[fd].rsp_cs = 0;
245
246 /* Fix AttributeLists sequence header */
247 ptr = rsp;
248 SDP_PUT8(SDP_DATA_SEQ16, ptr);
249 SDP_PUT16(srv->fdidx[fd].rsp_size - 3, ptr);
250
251 return (0);
252 }
253
254