[Bluez-devel] Sending own L2CAP packets to HCI

[Bluez-devel] Sending own L2CAP packets to HCI

[Matthias Bruné]

Dear Marcel,
I wrote a program that builds its own L2CAP packets together.
And now I want to inject these L2CAP packets to a mobile phone.
I begin the transmission with a simple "connection request", but the command is 
rejected with reason 0 (command not understood).
Can you tell me how to inject L2CAP packets to HCI without using the BlueZ 
L2CAP layer?

best regards 
Matthias

hci dump:
HCIDump - HCI packet analyzer ver 1.7
device: hci0 snap_len: 1028 filter: 0xffffffff
 HCI Command: Create Connection(0x01|0x0005) plen 13
 HCI Event: Command Status(0x0f) plen 4
 HCI Event: Connect Complete(0x03) plen 11
 HCI Command: Write Link Policy Settings(0x02|0x000d) plen 4
 ACL data: handle 0x0029 flags 0x02 dlen 12
   L2CAP(s): Connect req: psm 1 scid 0x005d
 HCI Event: Number of Completed Packets(0x13) plen 5
 HCI Event: Command Complete(0x0e) plen 6
 HCI Event: Page Scan Repetition Mode Change(0x20) plen 7
 HCI Event: Max Slots Change(0x1b) plen 3
 ACL data: handle 0x0029 flags 0x02 dlen 16
   L2CAP(s): Connect rsp: dcid 0x0040 scid 0x005d result 0 status 0
 ACL data: handle 0x0029 flags 0x02 dlen 10
   L2CAP(s): Command rej: reason 0
 ACL data: handle 0x0029 flags 0x02 dlen 12
   L2CAP(s): Config req: dcid 0x005d flags 0x0000 clen 0
 ACL data: handle 0x0029 flags 0x02 dlen 10
   L2CAP(s): Command rej: reason 0
 HCI Event: Number of Completed Packets(0x13) plen 5
 HCI Event: Number of Completed Packets(0x13) plen 5
 ACL data: handle 0x0029 flags 0x02 dlen 12
   L2CAP(s): Config req: dcid 0x0040 flags 0x0000 clen 0
 HCI Event: Number of Completed Packets(0x13) plen 5
 ACL data: handle 0x0029 flags 0x02 dlen 14
   L2CAP(s): Config rsp: scid 0x0040 flags 0x0000 result 0 clen 0
 ACL data: handle 0x0029 flags 0x02 dlen 14
   L2CAP(s): Command rej: reason 2
 HCI Event: Number of Completed Packets(0x13) plen 5
 ACL data: handle 0x0029 flags 0x02 dlen 12
   L2CAP(s): Disconn req: dcid 0x0040 scid 0x005d
 HCI Event: Number of Completed Packets(0x13) plen 5
 ACL data: handle 0x0029 flags 0x02 dlen 14
   L2CAP(s): Command rej: reason 2
 HCI Command: Disconnect(0x01|0x0006) plen 3
 HCI Event: Command Status(0x0f) plen 4
 HCI Event: Disconn Complete(0x05) plen 4



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] Sending own L2CAP packets to HCI

[Marcel Holtmann]

Hi Matthias,

> I wrote a program that builds its own L2CAP packets together.
> And now I want to inject these L2CAP packets to a mobile phone.
> I begin the transmission with a simple "connection request", but the command is 
> rejected with reason 0 (command not understood).
> Can you tell me how to inject L2CAP packets to HCI without using the BlueZ 
> L2CAP layer?

look at the l2ping program, because it does exactly this for the echo
command and responses.

Regards

Marcel




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

[Bluez-devel] Re: Sending own L2CAP packets to HCI

[Matthias Brune]

Hi Marcel, 
 
i tried to change the l2ping program by using another command header.  
Instead of L2CAP_ECHO_REQ and L2CAP_ECHO_RES i used L2CAP_CONN_REQ and 
L2CAP_CONN_RES, because i want to build a full connection with connect, 
configure and disconnect later... 
It seemed that it works, but hcidump said that the connect request is 
rejected.  
Is it in general possible to inject own L2CAP packets (with configure 
requests) to a phone by using the l2ping programm. I mean is the socket setup 
in this program for this use sufficient or do i have to inject the packets 
directly to the usb driver? Because i think the command reject comes from the 
Bluez stack and i have to inject the L2CAP packets without using the BlueZ 
stack? 
 
HCI Command: Create Connection(0x01|0x0005) plen 13 
65 CF 93 EE 02 00 18 CC 02 00 00 00 01 
HCI Event: Command Status(0x0f) plen 4 
00 01 05 04 
HCI Event: Connect Complete(0x03) plen 11 
00 29 00 65 CF 93 EE 02 00 01 00 
HCI Command: Write Link Policy Settings(0x02|0x000d) plen 4 
29 00 0F 00 
ACL data: handle 0x0029 flags 0x02 dlen 28 
L2CAP(s): Connect req: psm 17989 scid 0x4847 
HCI Event: Number of Completed Packets(0x13) plen 5 
01 29 00 01 00 
HCI Event: Command Complete(0x0e) plen 6 
01 0D 08 00 29 00 
HCI Event: Page Scan Repetition Mode Change(0x20) plen 7 
65 CF 93 EE 02 00 01 
HCI Event: Max Slots Change(0x1b) plen 3 
29 00 05 
ACL data: handle 0x0029 flags 0x02 dlen 16 
 
L2CAP(s): Connect rsp: dcid 0x0000 scid 0x0000 result 2 status 0 
 
ACL data: handle 0x0029 flags 0x02 dlen 10 
L2CAP(s): Command rej: reason 0 
 
HCI Event: Number of Completed Packets(0x13) plen 5 
01 29 00 01 00 
HCI Command: Disconnect(0x01|0x0006) plen 3 
29 00 13 
HCI Event: Command Status(0x0f) plen 4 
00 01 06 04 
HCI Event: Disconn Complete(0x05) plen 4 
00 29 00 16 
 



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] Re: Sending own L2CAP packets to HCI

[Marcel Holtmann]

Hi Matthias,

> i tried to change the l2ping program by using another command header.  
> Instead of L2CAP_ECHO_REQ and L2CAP_ECHO_RES i used L2CAP_CONN_REQ and 
> L2CAP_CONN_RES, because i want to build a full connection with connect, 
> configure and disconnect later... 
> It seemed that it works, but hcidump said that the connect request is 
> rejected.  
> Is it in general possible to inject own L2CAP packets (with configure 
> requests) to a phone by using the l2ping programm. I mean is the socket setup 
> in this program for this use sufficient or do i have to inject the packets 
> directly to the usb driver? Because i think the command reject comes from the 
> Bluez stack and i have to inject the L2CAP packets without using the BlueZ 
> stack? 

you can use the L2CAP raw socket for this, but actually you should read
the Bluetooth specification and understand it.
 
> HCI Command: Create Connection(0x01|0x0005) plen 13 
> 65 CF 93 EE 02 00 18 CC 02 00 00 00 01 
> HCI Event: Command Status(0x0f) plen 4 
> 00 01 05 04 
> HCI Event: Connect Complete(0x03) plen 11 
> 00 29 00 65 CF 93 EE 02 00 01 00 
> HCI Command: Write Link Policy Settings(0x02|0x000d) plen 4 
> 29 00 0F 00 
> ACL data: handle 0x0029 flags 0x02 dlen 28 
> L2CAP(s): Connect req: psm 17989 scid 0x4847 

The PSM and the scid are looking wrong.

> HCI Event: Number of Completed Packets(0x13) plen 5 
> 01 29 00 01 00 
> HCI Event: Command Complete(0x0e) plen 6 
> 01 0D 08 00 29 00 
> HCI Event: Page Scan Repetition Mode Change(0x20) plen 7 
> 65 CF 93 EE 02 00 01 
> HCI Event: Max Slots Change(0x1b) plen 3 
> 29 00 05 
> ACL data: handle 0x0029 flags 0x02 dlen 16 
>  
> L2CAP(s): Connect rsp: dcid 0x0000 scid 0x0000 result 2 status 0 

Read the specification. It says that result code 2 means PSM not
supported. See comment above.

Regards

Marcel




-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel