1 /*
2 * ssr.c
3 *
4 * Copyright (c) 2004 Maksim Yevmenkin <m_evmenkin@yahoo.com>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $Id: ssr.c,v 1.5 2004/01/13 01:54:39 max Exp $
29 * $FreeBSD$
30 */
31
32 #include <sys/queue.h>
33 #include <sys/uio.h>
34 #include <netinet/in.h>
35 #include <arpa/inet.h>
36 #include <assert.h>
37 #include <bluetooth.h>
38 #include <errno.h>
39 #include <sdp.h>
40 #include <string.h>
41 #include "profile.h"
42 #include "provider.h"
43 #include "server.h"
44 #include "uuid-private.h"
45
46 /*
47 * Prepare SDP Service Search Response
48 */
49
50 int32_t
server_prepare_service_search_response(server_p srv,int32_t fd)51 server_prepare_service_search_response(server_p srv, int32_t fd)
52 {
53 uint8_t const *req = srv->req + sizeof(sdp_pdu_t);
54 uint8_t const *req_end = req + ((sdp_pdu_p)(srv->req))->len;
55 uint8_t *rsp = srv->fdidx[fd].rsp;
56 uint8_t const *rsp_end = rsp + NG_L2CAP_MTU_MAXIMUM;
57
58 uint8_t *ptr = NULL;
59 provider_t *provider = NULL;
60 int32_t type, ssplen, rsp_limit, rcount, cslen, cs;
61 uint128_t uuid, puuid;
62
63 /*
64 * Minimal SDP Service Search Request
65 *
66 * seq8 len8 - 2 bytes
67 * uuid16 value16 - 3 bytes ServiceSearchPattern
68 * value16 - 2 bytes MaximumServiceRecordCount
69 * value8 - 1 byte ContinuationState
70 */
71
72 if (req_end - req < 8)
73 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
74
75 /* Get size of ServiceSearchPattern */
76 ssplen = 0;
77 SDP_GET8(type, req);
78 switch (type) {
79 case SDP_DATA_SEQ8:
80 SDP_GET8(ssplen, req);
81 break;
82
83 case SDP_DATA_SEQ16:
84 SDP_GET16(ssplen, req);
85 break;
86
87 case SDP_DATA_SEQ32:
88 SDP_GET32(ssplen, req);
89 break;
90 }
91 if (ssplen <= 0)
92 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
93
94 ptr = (uint8_t *) req + ssplen;
95
96 /* Get MaximumServiceRecordCount */
97 if (ptr + 2 > req_end)
98 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
99
100 SDP_GET16(rsp_limit, ptr);
101 if (rsp_limit <= 0)
102 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
103
104 /* Get ContinuationState */
105 if (ptr + 1 > req_end)
106 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
107
108 SDP_GET8(cslen, ptr);
109 if (cslen != 0) {
110 if (cslen != 2 || req_end - ptr != 2)
111 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
112
113 SDP_GET16(cs, ptr);
114 } else
115 cs = 0;
116
117 /* Process the request. First, check continuation state */
118 if (srv->fdidx[fd].rsp_cs != cs)
119 return (SDP_ERROR_CODE_INVALID_CONTINUATION_STATE);
120 if (srv->fdidx[fd].rsp_size > 0)
121 return (0);
122
123 /*
124 * Service Search Response format
125 *
126 * value16 - 2 bytes TotalServiceRecordCount (not incl.)
127 * value16 - 2 bytes CurrentServiceRecordCount (not incl.)
128 * value32 - 4 bytes handle
129 * [ value32 ]
130 *
131 * Calculate how many record handles we can fit
132 * in our reply buffer and adjust rlimit.
133 */
134
135 ptr = rsp;
136 rcount = (rsp_end - ptr) / 4;
137 if (rcount < rsp_limit)
138 rsp_limit = rcount;
139
140 /* Look for the record handles */
141 for (rcount = 0; ssplen > 0 && rcount < rsp_limit; ) {
142 SDP_GET8(type, req);
143 ssplen --;
144
145 switch (type) {
146 case SDP_DATA_UUID16:
147 if (ssplen < 2)
148 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
149
150 memcpy(&uuid, &uuid_base, sizeof(uuid));
151 uuid.b[2] = *req ++;
152 uuid.b[3] = *req ++;
153 ssplen -= 2;
154 break;
155
156 case SDP_DATA_UUID32:
157 if (ssplen < 4)
158 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
159
160 memcpy(&uuid, &uuid_base, sizeof(uuid));
161 uuid.b[0] = *req ++;
162 uuid.b[1] = *req ++;
163 uuid.b[2] = *req ++;
164 uuid.b[3] = *req ++;
165 ssplen -= 4;
166 break;
167
168 case SDP_DATA_UUID128:
169 if (ssplen < 16)
170 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
171
172 memcpy(uuid.b, req, 16);
173 req += 16;
174 ssplen -= 16;
175 break;
176
177 default:
178 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX);
179 /* NOT REACHED */
180 }
181
182 for (provider = provider_get_first();
183 provider != NULL && rcount < rsp_limit;
184 provider = provider_get_next(provider)) {
185 if (!provider_match_bdaddr(provider, &srv->req_sa.l2cap_bdaddr))
186 continue;
187
188 memcpy(&puuid, &uuid_base, sizeof(puuid));
189 puuid.b[2] = provider->profile->uuid >> 8;
190 puuid.b[3] = provider->profile->uuid;
191
192 if (memcmp(&uuid, &puuid, sizeof(uuid)) == 0 ||
193 memcmp(&uuid, &uuid_public_browse_group, sizeof(uuid)) == 0) {
194 SDP_PUT32(provider->handle, ptr);
195 rcount ++;
196 }
197 }
198 }
199
200 /* Set reply size (not counting PDU header and continuation state) */
201 srv->fdidx[fd].rsp_limit = srv->fdidx[fd].omtu - sizeof(sdp_pdu_t) - 4;
202 srv->fdidx[fd].rsp_size = ptr - rsp;
203 srv->fdidx[fd].rsp_cs = 0;
204
205 return (0);
206 }
207
208 /*
209 * Send SDP Service Search Response
210 */
211
212 int32_t
server_send_service_search_response(server_p srv,int32_t fd)213 server_send_service_search_response(server_p srv, int32_t fd)
214 {
215 uint8_t *rsp = srv->fdidx[fd].rsp + srv->fdidx[fd].rsp_cs;
216 uint8_t *rsp_end = srv->fdidx[fd].rsp + srv->fdidx[fd].rsp_size;
217
218 struct iovec iov[4];
219 sdp_pdu_t pdu;
220 uint16_t rcounts[2];
221 uint8_t cs[3];
222 int32_t size;
223
224 /* First update continuation state (assume we will send all data) */
225 size = rsp_end - rsp;
226 srv->fdidx[fd].rsp_cs += size;
227
228 if (size + 1 > srv->fdidx[fd].rsp_limit) {
229 /*
230 * We need to split out response. Add 3 more bytes for the
231 * continuation state and move rsp_end and rsp_cs backwards.
232 */
233
234 while ((rsp_end - rsp) + 3 > srv->fdidx[fd].rsp_limit) {
235 rsp_end -= 4;
236 srv->fdidx[fd].rsp_cs -= 4;
237 }
238
239 cs[0] = 2;
240 cs[1] = srv->fdidx[fd].rsp_cs >> 8;
241 cs[2] = srv->fdidx[fd].rsp_cs & 0xff;
242 } else
243 cs[0] = 0;
244
245 assert(rsp_end >= rsp);
246
247 rcounts[0] = srv->fdidx[fd].rsp_size / 4; /* TotalServiceRecordCount */
248 rcounts[1] = (rsp_end - rsp) / 4; /* CurrentServiceRecordCount */
249
250 pdu.pid = SDP_PDU_SERVICE_SEARCH_RESPONSE;
251 pdu.tid = ((sdp_pdu_p)(srv->req))->tid;
252 pdu.len = htons(sizeof(rcounts) + rcounts[1] * 4 + 1 + cs[0]);
253
254 rcounts[0] = htons(rcounts[0]);
255 rcounts[1] = htons(rcounts[1]);
256
257 iov[0].iov_base = &pdu;
258 iov[0].iov_len = sizeof(pdu);
259
260 iov[1].iov_base = rcounts;
261 iov[1].iov_len = sizeof(rcounts);
262
263 iov[2].iov_base = rsp;
264 iov[2].iov_len = rsp_end - rsp;
265
266 iov[3].iov_base = cs;
267 iov[3].iov_len = 1 + cs[0];
268
269 do {
270 size = writev(fd, (struct iovec const *) &iov, sizeof(iov)/sizeof(iov[0]));
271 } while (size < 0 && errno == EINTR);
272
273 /* Check if we have sent (or failed to sent) last response chunk */
274 if (srv->fdidx[fd].rsp_cs == srv->fdidx[fd].rsp_size) {
275 srv->fdidx[fd].rsp_cs = 0;
276 srv->fdidx[fd].rsp_size = 0;
277 srv->fdidx[fd].rsp_limit = 0;
278 }
279
280 return ((size < 0)? errno : 0);
281 }
282
283