[PATCH 0/4] Fix error reporting for SDP Requests

[PATCH 0/4] Fix error reporting for SDP Requests

[Angela Bartholomaus]

Fixed the following issues revealed while performing bluez qualification: 
- Incorrect error code was being reported for requests with invalid PDU size;
- No error was being reported if a request less than 0x07 was received.


Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 1/4] Send an Invalid PDU Size Error Response for Service Search Req

[Angela Bartholomaus]

Send error code for an SDP request received with an invalid PDU Size
---
 src/sdpd-request.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index d56ffc2..cc9fe82 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -367,7 +367,7 @@ static int service_search_req(sdp_req_t *req, sdp_buf_t *buf)
 	mlen = scanned + sizeof(uint16_t) + 1;
 	// ensure we don't read past buffer
 	if (plen < mlen || plen != mlen + *(uint8_t *)(pdata+sizeof(uint16_t))) {
-		status = SDP_INVALID_SYNTAX;
+		status = SDP_INVALID_PDU_SIZE;
 		goto done;
 	}
 
-- 
1.7.0.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 2/4] Send an Invalid PDU Size Error Response for Service Attr Req

[Angela Bartholomaus]

Send error code for an SDP request received with an invalid PDU size
---
 src/sdpd-request.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index cc9fe82..ccbd920 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -667,7 +667,7 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 	mlen = scanned + sizeof(uint32_t) + sizeof(uint16_t) + 1;
 	// ensure we don't read past buffer
 	if (plen < mlen || plen != mlen + *(uint8_t *)pdata) {
-		status = SDP_INVALID_SYNTAX;
+		status = SDP_INVALID_PDU_SIZE;
 		goto done;
 	}
 
-- 
1.7.0.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 3/4] Send an Invalid PDU Size Error Resp for Service Attr Search Req

[Angela Bartholomaus]

Send error code for an SDP request received with an invalid PDU size
---
 src/sdpd-request.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index ccbd920..8547939 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -818,7 +818,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 
 	plen = ntohs(((sdp_pdu_hdr_t *)(req->buf))->plen);
 	if (plen < totscanned || plen != totscanned + *(uint8_t *)pdata) {
-		status = SDP_INVALID_SYNTAX;
+		status = SDP_INVALID_PDU_SIZE;
 		goto done;
 	}
 
-- 
1.7.0.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 4/4] Send Invalid Syntax Error if Resp Size Less Than 0x07

[Angela Bartholomaus]

Added in error catching, when a badly formed request comes in
---
 src/sdpd-request.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index 8547939..205b27b 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -684,6 +684,15 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 	SDPDBG("max_rsp_size : %d", max_rsp_size);
 
 	/*
+	 * Check that max_rsp_size is within valid range
+	 * a minimum size of 0x0007 has to be used for data field
+	 */
+	if (max_rsp_size < 0x0007) {
+		status = SDP_INVALID_SYNTAX;
+		goto done;
+	}
+
+	/*
 	 * Calculate Attribute size acording to MTU
 	 * We can send only (MTU - sizeof(sdp_pdu_hdr_t) - sizeof(sdp_cont_state_t))
 	 */
-- 
1.7.0.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

Re: [PATCH 0/4] Fix error reporting for SDP Requests

[Marcel Holtmann]

Hi Angela,

> Fixed the following issues revealed while performing bluez qualification: 
> - Incorrect error code was being reported for requests with invalid PDU size;
> - No error was being reported if a request less than 0x07 was received.

I never needed any of these fixes when doing qualification. So why do
you? Please mention the test case numbers.

Regards

Marcel

Re: [PATCH 0/4] Fix error reporting for SDP Requests

[angelab]

Hi Marcel,

Section 4.4 of the Bluetooth Corev2.1 spec, states that the error code
shall be 0x04 when an invalid PDU size is received. BlueZ is returning
error code 0x03 for the following:
TP/SERVER/SS/BI-01-C  [PATCH 1/4]
TP/SERVER/SA/BI-03-C  [PATCH 2/4]
TP/SERVER/SSA/BI-02-C [PATCH 3/4]

For this test case I sent a bad search attribute request where the max
amount Of Attribute Data to return is 0, but blueZ fails to respond with
an error code. The "max amount of attribute data" field has to be set to a
minimum size of 0x0007 for the request to be valid.
TP/SERVER/SA/BI-02-C [PATCH 4/4]

Sincerely,
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.




> Hi Angela,
>
>> Fixed the following issues revealed while performing bluez
>> qualification:
>> - Incorrect error code was being reported for requests with invalid PDU
>> size;
>> - No error was being reported if a request less than 0x07 was received.
>
> I never needed any of these fixes when doing qualification. So why do
> you? Please mention the test case numbers.
>
> Regards
>
> Marcel
>
>
>

Re: [PATCH 0/4] Fix error reporting for SDP Requests

[Johan Hedberg]

Hi Angela,

On Tue, Aug 24, 2010, angelab@codeaurora.org wrote:
> Section 4.4 of the Bluetooth Corev2.1 spec, states that the error code
> shall be 0x04 when an invalid PDU size is received. BlueZ is returning
> error code 0x03 for the following:
> TP/SERVER/SS/BI-01-C  [PATCH 1/4]
> TP/SERVER/SA/BI-03-C  [PATCH 2/4]
> TP/SERVER/SSA/BI-02-C [PATCH 3/4]
> 
> For this test case I sent a bad search attribute request where the max
> amount Of Attribute Data to return is 0, but blueZ fails to respond with
> an error code. The "max amount of attribute data" field has to be set to a
> minimum size of 0x0007 for the request to be valid.
> TP/SERVER/SA/BI-02-C [PATCH 4/4]

Ok, so it sounds like you're using your own test system for this? I
don't think Marcel was referring to what the spec says but what the BITE
tester test vectors require in practice. So far there haven't been any
issues with the BITE with respect to this. Of course it's good to not
just pass with the BITE but to also be consistent with the spec, and so
these patches seem like a good idea. However, could you resend them with
the test case reference in each commit message as well as any other
relevant info like the section in the core spec? Thanks.

Johan