1 /* 2 * ssar.c 3 * 4 * Copyright (c) 2004 Maksim Yevmenkin <m_evmenkin@yahoo.com> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 * $Id: ssar.c,v 1.4 2004/01/12 22:54:31 max Exp $ 29 * $FreeBSD$ 30 */ 31 32 #include <sys/queue.h> 33 #define L2CAP_SOCKET_CHECKED 34 #include <bluetooth.h> 35 #include <sdp.h> 36 #include <string.h> 37 #include "profile.h" 38 #include "provider.h" 39 #include "server.h" 40 #include "uuid-private.h" 41 42 /* from sar.c */ 43 int32_t server_prepare_attr_list(provider_p const provider, 44 uint8_t const *req, uint8_t const * const req_end, 45 uint8_t *rsp, uint8_t const * const rsp_end); 46 47 /* 48 * Prepare SDP Service Search Attribute Response 49 */ 50 51 int32_t 52 server_prepare_service_search_attribute_response(server_p srv, int32_t fd) 53 { 54 uint8_t const *req = srv->req + sizeof(sdp_pdu_t); 55 uint8_t const *req_end = req + ((sdp_pdu_p)(srv->req))->len; 56 uint8_t *rsp = srv->fdidx[fd].rsp; 57 uint8_t const *rsp_end = rsp + NG_L2CAP_MTU_MAXIMUM; 58 59 uint8_t const *sspptr = NULL, *aidptr = NULL; 60 uint8_t *ptr = NULL; 61 62 provider_t *provider = NULL; 63 int32_t type, rsp_limit, ssplen, aidlen, cslen, cs; 64 uint128_t uuid, puuid; 65 66 /* 67 * Minimal Service Search Attribute Request request 68 * 69 * seq8 len8 - 2 bytes 70 * uuid16 value16 - 3 bytes ServiceSearchPattern 71 * value16 - 2 bytes MaximumAttributeByteCount 72 * seq8 len8 - 2 bytes 73 * uint16 value16 - 3 bytes AttributeIDList 74 * value8 - 1 byte ContinuationState 75 */ 76 77 if (req_end - req < 13) 78 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 79 80 /* Get size of ServiceSearchPattern */ 81 ssplen = 0; 82 SDP_GET8(type, req); 83 switch (type) { 84 case SDP_DATA_SEQ8: 85 SDP_GET8(ssplen, req); 86 break; 87 88 case SDP_DATA_SEQ16: 89 SDP_GET16(ssplen, req); 90 break; 91 92 case SDP_DATA_SEQ32: 93 SDP_GET32(ssplen, req); 94 break; 95 } 96 if (ssplen <= 0) 97 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 98 99 sspptr = req; 100 req += ssplen; 101 102 /* Get MaximumAttributeByteCount */ 103 if (req + 2 > req_end) 104 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 105 106 SDP_GET16(rsp_limit, req); 107 if (rsp_limit <= 0) 108 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 109 110 /* Get size of AttributeIDList */ 111 if (req + 1 > req_end) 112 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 113 114 aidlen = 0; 115 SDP_GET8(type, req); 116 switch (type) { 117 case SDP_DATA_SEQ8: 118 if (req + 1 > req_end) 119 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 120 121 SDP_GET8(aidlen, req); 122 break; 123 124 case SDP_DATA_SEQ16: 125 if (req + 2 > req_end) 126 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 127 128 SDP_GET16(aidlen, req); 129 break; 130 131 case SDP_DATA_SEQ32: 132 if (req + 4 > req_end) 133 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 134 135 SDP_GET32(aidlen, req); 136 break; 137 } 138 if (aidlen <= 0) 139 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 140 141 aidptr = req; 142 req += aidlen; 143 144 /* Get ContinuationState */ 145 if (req + 1 > req_end) 146 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 147 148 SDP_GET8(cslen, req); 149 if (cslen != 0) { 150 if (cslen != 2 || req_end - req != 2) 151 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 152 153 SDP_GET16(cs, req); 154 } else 155 cs = 0; 156 157 /* Process the request. First, check continuation state */ 158 if (srv->fdidx[fd].rsp_cs != cs) 159 return (SDP_ERROR_CODE_INVALID_CONTINUATION_STATE); 160 if (srv->fdidx[fd].rsp_size > 0) 161 return (0); 162 163 /* 164 * Service Search Attribute Response format 165 * 166 * value16 - 2 bytes AttributeListByteCount (not incl.) 167 * seq8 len16 - 3 bytes 168 * attr list - 3+ bytes AttributeLists 169 * [ attr list ] 170 */ 171 172 ptr = rsp + 3; 173 174 while (ssplen > 0) { 175 SDP_GET8(type, sspptr); 176 ssplen --; 177 178 switch (type) { 179 case SDP_DATA_UUID16: 180 if (ssplen < 2) 181 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 182 183 memcpy(&uuid, &uuid_base, sizeof(uuid)); 184 uuid.b[2] = *sspptr ++; 185 uuid.b[3] = *sspptr ++; 186 ssplen -= 2; 187 break; 188 189 case SDP_DATA_UUID32: 190 if (ssplen < 4) 191 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 192 193 memcpy(&uuid, &uuid_base, sizeof(uuid)); 194 uuid.b[0] = *sspptr ++; 195 uuid.b[1] = *sspptr ++; 196 uuid.b[2] = *sspptr ++; 197 uuid.b[3] = *sspptr ++; 198 ssplen -= 4; 199 break; 200 201 case SDP_DATA_UUID128: 202 if (ssplen < 16) 203 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 204 205 memcpy(uuid.b, sspptr, 16); 206 sspptr += 16; 207 ssplen -= 16; 208 break; 209 210 default: 211 return (SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX); 212 /* NOT REACHED */ 213 } 214 215 for (provider = provider_get_first(); 216 provider != NULL; 217 provider = provider_get_next(provider)) { 218 if (!provider_match_bdaddr(provider, &srv->req_sa.l2cap_bdaddr)) 219 continue; 220 221 memcpy(&puuid, &uuid_base, sizeof(puuid)); 222 puuid.b[2] = provider->profile->uuid >> 8; 223 puuid.b[3] = provider->profile->uuid; 224 225 if (memcmp(&uuid, &puuid, sizeof(uuid)) != 0 && 226 memcmp(&uuid, &uuid_public_browse_group, sizeof(uuid)) != 0) 227 continue; 228 229 cs = server_prepare_attr_list(provider, 230 aidptr, aidptr + aidlen, ptr, rsp_end); 231 if (cs < 0) 232 return (SDP_ERROR_CODE_INSUFFICIENT_RESOURCES); 233 234 ptr += cs; 235 } 236 } 237 238 /* Set reply size (not counting PDU header and continuation state) */ 239 srv->fdidx[fd].rsp_limit = srv->fdidx[fd].omtu - sizeof(sdp_pdu_t) - 2; 240 if (srv->fdidx[fd].rsp_limit > rsp_limit) 241 srv->fdidx[fd].rsp_limit = rsp_limit; 242 243 srv->fdidx[fd].rsp_size = ptr - rsp; 244 srv->fdidx[fd].rsp_cs = 0; 245 246 /* Fix AttributeLists sequence header */ 247 ptr = rsp; 248 SDP_PUT8(SDP_DATA_SEQ16, ptr); 249 SDP_PUT16(srv->fdidx[fd].rsp_size - 3, ptr); 250 251 return (0); 252 } 253 254