Cho, Yu-Chen [Wed, 31 Oct 2018 08:15:07 +0000 (16:15 +0800)]
hcidump:fixed hci frame dump stack-buffer-overflow
hci_dump() didn't check the length of frame, and it would be
a stack-buffer-overflow error.
Change-Id: I9ed90053c242aa174485c3038ada9a182b3004ca
Signed-off-by: himanshu <h.himanshu@samsung.com>
Łukasz Rymanowski [Wed, 24 Oct 2018 10:17:18 +0000 (12:17 +0200)]
btmon: Add colors to data status in extended adv report
This patch gives color indicators to data status in extended
advertising reports. This gives better visibility on which advertising
events were completed or truncated.
Change-Id: I79a3cd8eec85eb08ad07a6083ee33a8e77b0ea5e
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 29 Oct 2018 13:13:25 +0000 (15:13 +0200)]
gatt: Fix not removing disconnect handler properly
Previous patch did not really fixed the crash since the bt_server would
be freed already which makes bt_att instance to be passed as NULL to
bt_att_unregister_disconnect which makes it not the take the expected
action.
Change-Id: Icd15b693e6ea59eb080f76d1735c9f537d61ba3b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 25 Oct 2018 07:09:37 +0000 (10:09 +0300)]
gatt: Fix crash on disconnect
This fix a crash when ATT disconnects causing the following trace:
Invalid read of size 8
at 0x47CD9A: att_disconnected (gatt-database.c:335)
by 0x4E04F5: disconn_handler (att.c:539)
by 0x4DACD0: queue_foreach (queue.c:220)
by 0x4E23D8: disconnect_cb (att.c:592)
by 0x4F0A58: watch_callback (io-glib.c:170)
by 0x50D788C: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x50D7C57: ??? (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x50D7F81: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x40D336: main (main.c:808)
Address 0x9aed3c0 is 0 bytes inside a block of size 40 free'd
at 0x4C2FDAC: free (vg_replace_malloc.c:530)
by 0x47CE78: att_disconnected (gatt-database.c:358)
by 0x47F9FF: btd_gatt_database_att_disconnected (gatt-database.c:3540)
by 0x4AAB8E: gatt_server_cleanup (device.c:584)
by 0x4AAC26: attio_cleanup (device.c:601)
by 0x4ADDF1: att_disconnected_cb (device.c:4865)
by 0x4E04F5: disconn_handler (att.c:539)
by 0x4DACD0: queue_foreach (queue.c:220)
by 0x4E23D8: disconnect_cb (att.c:592)
by 0x4F0A58: watch_callback (io-glib.c:170)
by 0x50D788C: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x50D7C57: ??? (in /usr/lib64/libglib-2.0.so.0.5600.3)
Change-Id: Ib180cf7f7abb076cc94d2e08434a0cdf91134bd0
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 25 Apr 2018 12:29:51 +0000 (15:29 +0300)]
shared/gatt-server: Add bt_gatt_server_get_att
This adds bt_gatt_server_get_att which can be used to get the bt_att
instance attached to the server.
Change-Id: If00def71f2ec7369162b8808524836fcd59c1b44
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 20 Oct 2018 05:23:11 +0000 (07:23 +0200)]
monitor: Use static inline for functions in header files
Change-Id: Ic65292f68c4e74778780dce4a1163d2e9bef7b9c
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:24:15 +0000 (23:24 +0300)]
btmon: fix segfault caused by buffer overflow
Buffer overflow vulnerability in monitor/sdp.c SDP continuation handling
caused btmon to crash. This happens in global static buffer which makes
it non-trivial to exploit.
This is nasty bug in a way that this can be triggered also over the air
by sending malformed SDP Search Attribute request to device running
btmon.
This crash was foung by fuzzing btmon with AFL. Seems to be reproducible
also with Synopsys Defensics SDP Server suite.
Change-Id: Ie149945cd95f6686183944e358cf25b485c769c4
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:23:12 +0000 (23:23 +0300)]
btmon: fix segfault caused by integer undeflow
Fix segfault caused by integer underflow. Fix is to check that
rsp->num_codecs + 3 is not bigger than size before subtracting.
Crash was found by fuzzing btmon with AFL.
Change-Id: I9af6ee12b4bf58d33ee81412ddd6c47ef49acac8
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:22:42 +0000 (23:22 +0300)]
btmon: fix segfault caused by integer underflow
Fix segfault caused by integer underflow in set_event_filter_cmd().
Fix is to check that size is big enough before subtracting to prevent
underflow.
Crash was found by fuzzing btmon with AFL.
Change-Id: I2e8c45af686bc86beb20221118240958afa58426
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:21:50 +0000 (23:21 +0300)]
btmon: fix stack buffer overflow
Arbitrary code execution vulnerability was discovered in btmon.
pklg_read_hci function read from file attacker controllable
amount of data which caused stack buffer overflow.
Fixes old and previously unfixed CVE-2016-9799.
Initially this was reported by op7ic:
https://www.spinics.net/lists/linux-bluetooth/msg68898.html
Later this was re-discovered by fuzzing btmon with AFL.
Proof-of-concept exploit that shutowns the machine:
$ python -c 'print "\x00\x00\x0c\x10"+ "\x90"*609 +"\x48\x31\xc0\x48\x31\xd2\x50\x6a\x77\x66\x68\x6e\x6f\x48\x89\xe3\x50\x66\x68\x2d\x68\x48\x89\xe1\x50\x49\xb8\x2f\x73\x62\x69\x6e\x2f\x2f\x2f\x49\xba\x73\x68\x75\x74\x64\x6f\x77\x6e\x41\x52\x41\x50\x48\x89\xe7\x52\x53\x51\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05"+ "\x90"*847 +"\xb0\xda\xff\xff\xff\x7f\x00\x00"' > exploit
$ ./btmon -r exploit
Proof of concept requires that ASLR is disabled and following CFLAGS are
set: -fno-stack-protector -zexecstack
Change-Id: I75934ef2c759e5dab3ed025d4d8bf5041523a2de
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:22:16 +0000 (23:22 +0300)]
btmon: fix multiple segfaults
Fix multiple segfaults caused by buffer over-read in packet_hci_command,
packet_hci_event and packet_hci_acldata. Fix is to check that index is
not bigger than MAX_INDEX before accessing index_list.
Crashes were found by fuzzing btmon with AFL.
Change-Id: Iaba0be9da71154eaeff3be86e8afa5eeb74dd354
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:19:38 +0000 (23:19 +0300)]
btmon: fix segfault caused by buffer over-read
Fix segfault caused by buffer over-read. Check that index is not
bigger than MAX_INDEX.
This bug was found by fuzzing with AFL.
Program received signal SIGSEGV, Segmentation fault.
0x0000000000420bb8 in print_packet (tv=<optimized out>, cred=<optimized out>, ident=<optimized out>, index=<optimized out>, channel=<optimized out>, color=<optimized out>,
label=<optimized out>, text=<optimized out>, extra=<optimized out>) at monitor/packet.c:317
warning: Source file is more recent than executable.
317 index_list[index].frame != last_frame) {
(gdb) bt
#0 0x0000000000420bb8 in print_packet (tv=<optimized out>, cred=<optimized out>, ident=<optimized out>, index=<optimized out>, channel=<optimized out>, color=<optimized out>,
label=<optimized out>, text=<optimized out>, extra=<optimized out>) at monitor/packet.c:317
#1 0x000000000041a8c3 in packet_new_index (tv=<optimized out>, index=<optimized out>, name=0x7fffffffda68 "rsion 4.18.0-matias-patch2 (x86_64)", label=<optimized out>,
type=<optimized out>, bus=<optimized out>) at monitor/packet.c:9818
#2 packet_monitor (tv=0x7fffffffda50, cred=<optimized out>, index=<optimized out>, opcode=<optimized out>, data=0x7fffffffda60, size=<optimized out>) at monitor/packet.c:3881
#3 0x000000000040e177 in control_reader (path=<optimized out>, pager=true) at monitor/control.c:1462
#4 0x0000000000403b00 in main (argc=<optimized out>, argv=<optimized out>) at monitor/main.c:243
Change-Id: I1c3bf298ebfb11f5cace8c245d30fdc068bc6606
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 8 Oct 2018 07:35:53 +0000 (10:35 +0300)]
shared/shell: Fix parsing of tool name
Fix leaving leading '/' when parsing tool name.
Change-Id: Ifc7fd6fde54923e64d25c1a33e1d16c873f86732
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 5 Oct 2018 08:50:46 +0000 (11:50 +0300)]
unit: Make use of tester_monitor to print input/output PDUs
tester_monitor will forward the data to btmon when -m/--monitor is
enabled which will attempt to decode the PDUs:
= test-gatt: /robustness/unkown-command - init 11:44:53.464325
= test-gatt: /robustness/unkown-command - setup
= test-gatt: /robustness/unkown-command - setup complete
= test-gatt: /robustness/unkown-command - run
< test-gatt: User Data TX
ATT: Exchange MTU Request (0x02) len 2
Client RX MTU: 23
> test-gatt: User Data RX
ATT: Exchange MTU Response (0x03) len 2
Server RX MTU: 512
< test-gatt: User Data TX
ATT: Unknown (0xff) len 1
00 .
= test-gatt: /robustness/unkown-command - test passed
= test-gatt: /robustness/unkown-command - teardown
= test-gatt: /robustness/unkown-command - teardown complete
= test-gatt: /robustness/unkown-command - done
Change-Id: I44bd1f913f02a953301dc1e0a4b87a448219e7f0
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 4 Oct 2018 13:09:22 +0000 (16:09 +0300)]
shared/tester: Add option to print to monitor
This adds option -m/--monitor that can be used together with
tester_monitor to send protocol data to be decoded by btmon.
In addition to that this also logs the tester output into btmon since
that has support to store its output on file this can be quite
convenient for reporting.
Change-Id: Ie5f3c6fef0f0f590111ddd0bf36485345e2e317f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 5 Oct 2018 08:47:47 +0000 (11:47 +0300)]
monitor: Add support for user input/output data
This detects if the user logging is an input/output and then proceed to
decode the header which inform for which CID and PSM the data is for.
Change-Id: Idc21d2f1473f4b77569cea49c4a8ccd6c5e7c78a
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 1 Oct 2018 11:10:08 +0000 (14:10 +0300)]
gatt: Fix not cleaning up device state properly
If the device is removed locally device_free would end up calling
bt_att_unref which won't trigger any disconnect callback necessary
to remove device states.
Change-Id: Iab0990928a64453dd5dfa8f519f8f88a1148dd59
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 2 Oct 2018 08:18:31 +0000 (11:18 +0300)]
gatt: Fix attempting to create device on disconnection
If ATT is disconnected and the state points to an invalid device it
must have been destroyed in the meantime and should not be recreated.
Change-Id: I60d5bafb0130188ce718b38a02e8008b151a5750
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 1 Oct 2018 12:05:15 +0000 (15:05 +0300)]
shared/att: Reset fd when disconnected
Set att->fd to -1 when considered disconnected.
Change-Id: I1b9f28d5aabb7947234e7cf9128b86fe07a6edd7
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 12 Sep 2018 10:25:56 +0000 (13:25 +0300)]
shared/shell: Set rl_readline_name
Set rl_readline_name so the binary name can be used in inputrc.
Change-Id: I1e49901db95dca3c89e0fb3815541afe90b62945
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 7 Sep 2018 08:07:11 +0000 (11:07 +0300)]
shared/shell: Print commands when --help option is given
This enables the user to see what command could be given in the
non-interactive mode e.g:
> bluetooth-player --help
bluetooth-player ver 5.50
Usage:
bluetooth-player [--options] [commands]
Options:
--timeout Timeout in seconds for non-interactive mode
--version Display version
--help Display help
Commands:
list List available players
show Player information
select Select default player
play Start playback
pause Pause playback
stop Stop playback
next Jump to next item
previous Jump to previous item
fast-forward Fast forward playback
rewind Rewind playback
equalizer Enable/Disable equalizer
repeat Set repeat mode
shuffle Set shuffle mode
scan Set scan mode
change-folder Change current folder
list-items List items of current folder
search Search items containing string
queue Add item to playlist queue
show-item Show item information
Change-Id: Ibb9572f6a9bc13e3a5bf43ebddc40c1642d6b1bc
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 27 Aug 2018 11:37:33 +0000 (14:37 +0300)]
unit: Fix out of bounds
Test /gobex/test_stream_put_req requires 5 buffers to complete.
Change-Id: I277cdcfc8c396598cb609bbf16e7944e94bc3ae0
Signed-off-by: himanshu <h.himanshu@samsung.com>
Anupam Roy [Wed, 22 Aug 2018 14:42:55 +0000 (20:12 +0530)]
btmgmt: Add support to accept multiple PHY options
Before fix-
[hci1]# phy 1MTX 1MRX 2MTX
Too many arguments: 3 > 1
After Fix-
[hci1]# phy 1MRX 1MTX 2MTX
PHY Configuration successfully set
btmon output -
@ MGMT Command: Set PHY Configuration (0x0045) plen 4
Selected PHYs: 0x0e00
LE 1M TX
LE 1M RX
LE 2M TX
< HCI Command: LE Set Default PHY (0x08|0x0031) plen 3
All PHYs preference: 0x00
TX PHYs preference: 0x03
LE 1M
LE 2M
RX PHYs preference: 0x01
LE 1M
> HCI Event: Command Complete (0x0e) plen 4
LE Set Default PHY (0x08|0x0031) ncmd 1
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 3
Set PHY Configuration (0x0045) plen 0
Status: Success (0x00)
@ MGMT Event: PHY Configuration Changed (0x0026) plen 4
Selected PHYs: 0x0e00
LE 1M TX
LE 1M RX
LE 2M TX
Change-Id: I22e38e6d381b4c5aefc5a38314fd188874c7d83e
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 1 Aug 2018 13:08:36 +0000 (16:08 +0300)]
doc/adapter-api: Fix working of Discoverable filter
Change-Id: Id74bd073c6a1da41ac7a01b6719442b781ad5d0c
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 1 Aug 2018 11:21:55 +0000 (14:21 +0300)]
client: Fix not resetting filters on scan.clear
If call to SetDiscoveryFilter comes with any value set the daemon will
not attempt to clear the filters, instead the client is suppose to send
an empty dict.
Change-Id: Iff02f62e999e0e292b645a8d300320226fa17105
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 30 Jul 2018 11:11:38 +0000 (14:11 +0300)]
client: Commit changes to scan filter if active
This detects if the command scan has been triggered and if so commit
changes to filter immediately so they take effect in the current
session.
Change-Id: Iec94318c40a7fd17d281dbc7ccfc54be740e0f60
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 26 Jul 2018 14:13:12 +0000 (17:13 +0300)]
adapter: Fix not keeping discovery filters
If the discovery has been stopped and the client has set filters those
should be put back into filter list since the client may still be
interested in using them the next time it start a scanning.
Change-Id: Ie0b0594b61f5976a802cd537692363c76f16394a
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 26 Jul 2018 12:40:55 +0000 (15:40 +0300)]
client: Add scan.clear discoverable
This implements scan.clear for discoverable filter.
Change-Id: I0fe8d6c6ba54be0ae37479edd88f47a4b71012c5
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 26 Jul 2018 12:26:30 +0000 (15:26 +0300)]
client: Add scan.discoverable command
This adds discoverable command to scan menu which can be used to set
if adapter should become discoverable while scanning:
[bluetooth]# scan.discoverable on
[bluetooth]# scan on
SetDiscoveryFilter success
[CHG] Controller XX:XX:XX:XX:XX:XX Discoverable: yes
Discovery started
[CHG] Controller XX:XX:XX:XX:XX:XX Discovering: yes
[bluetooth]# scan off
Discovery stopped
[CHG] Controller XX:XX:XX:XX:XX:XX Discoverable: no
Change-Id: Ica34e2bc17c72460b5fd41e8104cff2bb5fa0234
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 26 Jul 2018 12:23:05 +0000 (15:23 +0300)]
adapter: Discovery filter discoverable
This implements the discovery filter discoverable and tracks which
clients had enabled it and restores the settings when the last client
enabling it exits.
Change-Id: I5a81a3d9014fbf27e79d38e57b895da0aed68c64
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 26 Jul 2018 12:15:12 +0000 (15:15 +0300)]
doc/adapter-api: Add Discoverable option to SetDiscoveryFilter
This enables the client to set its discoverable setting while
discovering which is very typical situation as usually the setings
application would allow incoming pairing request while scanning, so
this would reduce the number of calls setting Discoverable and
DiscoverableTimeout and restoring after done with discovery.
Change-Id: Ifa7763436795c78ff1499971235ab3d812801552
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Wed, 25 Jul 2018 10:21:26 +0000 (15:51 +0530)]
mgmt-tester: Update Supported_settings to reflect PHY_CONFIGURATION
Change-Id: I7b7db32446914922bee471bc372a4266f8fb5945
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Wed, 25 Jul 2018 10:21:25 +0000 (15:51 +0530)]
mgmt-tester: Add support ext create connection and enh conn complete
Change-Id: I530bbf57ef32b76a8c2b62cf722fe62ac96c74be
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Wed, 25 Jul 2018 10:21:24 +0000 (15:51 +0530)]
mgmt-tester: Add tests for extended scanning and device found
Change-Id: Id848d995087c74edf220fd26b225707455eafe73
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Wed, 25 Jul 2018 10:21:23 +0000 (15:51 +0530)]
mgmt-tester: Add PHY Configuration test cases
Change-Id: Id0cfcf2c935f872acf7016e422546b1dbba24269
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Wed, 25 Jul 2018 10:21:22 +0000 (15:51 +0530)]
mgmt-tester: Add extended advertising test cases
Change-Id: Ifee5f87426349617ba8ca6067bc1c0f1a4f26b34
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Wed, 25 Jul 2018 10:21:21 +0000 (15:51 +0530)]
emulator: Add BREDR 2M & 3M, 3 & 5 Slot packet type support
Change-Id: I807811ddb10174404f72447bd5541c6663dc7658
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 27 Jul 2018 08:01:04 +0000 (11:01 +0300)]
agent: Make the first agent to register the default
This simplifies the handling of default agent and enforce the IO
capabilities to be set whenever there is an agent available in the
system.
Change-Id: I23b3fe9031d2d61ec2adeabf21af5d7a0f721a77
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 27 Jul 2018 08:14:04 +0000 (11:14 +0300)]
core: Add AlwaysPairable to main.conf
This adds a new option called AlwaysPairable to main.conf, it can be
used to enable Adapter.Pairable even in case there is no Agent
available.
Since that could be consider a security problem to allow pairing
without user's consent the option defaults to false.
Change-Id: I67e534d5e8a6490ed2c99950c629d6e1ab493e30
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 25 Jul 2018 08:39:55 +0000 (11:39 +0300)]
adapter: Check pending when setting DiscoverableTimeout
This makes DiscoverableTimeout check if discoverable is already pending
and don't attempt to set it once again which may cause discoverable to
be re-enabled when in fact the application just want to set the timeout
alone.
Change-Id: I5ffb43845cf90698ed92e0d06301e77d4fbee8b7
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 25 Jul 2018 08:27:37 +0000 (11:27 +0300)]
adapter: Track pending settings
This tracks settings being changed and in case the settings is already
pending considered it to be done.
Change-Id: Id2d5be79d8a79e2cc2301ff998d46a60d321d219
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 25 Jul 2018 07:22:45 +0000 (10:22 +0300)]
client: Make show command print DiscoverableTimeout
Controller XX:XX:XX:XX:XX:XX (public)
Name: Vudentz's T460s
Alias: Intel-1
Class: 0x004c010c
Powered: yes
Discoverable: no
DiscoverableTimeout: 0x00000000
Pairable: yes
UUID: Headset AG (
00001112-0000-1000-8000-
00805f9b34fb)
UUID: Generic Attribute Profile (
00001801-0000-1000-8000-
00805f9b34fb)
UUID: A/V Remote Control (
0000110e-0000-1000-8000-
00805f9b34fb)
UUID: SIM Access (
0000112d-0000-1000-8000-
00805f9b34fb)
UUID: Generic Access Profile (
00001800-0000-1000-8000-
00805f9b34fb)
UUID: PnP Information (
00001200-0000-1000-8000-
00805f9b34fb)
UUID: A/V Remote Control Target (
0000110c-0000-1000-8000-
00805f9b34fb)
UUID: Audio Source (
0000110a-0000-1000-8000-
00805f9b34fb)
UUID: Audio Sink (
0000110b-0000-1000-8000-
00805f9b34fb)
UUID: Headset (
00001108-0000-1000-8000-
00805f9b34fb)
Modalias: usb:v1D6Bp0246d0532
Discovering: no
Change-Id: I6cdbeb4d6a62fc2243e6746056a96298c79801f3
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 24 Jul 2018 13:03:07 +0000 (16:03 +0300)]
client: Add discoverable-timeout command
This adds discoverable-timeout command which can be used to get/set
DiscoverableTimeout property:
[bluetooth]# discoverable-timeout 180
Changing discoverable-timeout 180 succeeded
Change-Id: I294e0facc8d69dc03766f7664a8f0de31fc94a9f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Andrzej Kaczmarek [Mon, 23 Jul 2018 20:31:58 +0000 (22:31 +0200)]
tools: Fix btmon-logger service unit
Bluetooth sockets can be only created in initial network namespace thus
btmon-logger will fail to open monitor socket with PrivateNetwork=true
since this sets up new network namespace for created process.
Change-Id: Iddb6eef006269b6f944d1af9b5de4a66cd9c7c9a
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Thu, 26 Jul 2018 11:23:29 +0000 (16:53 +0530)]
emulator: Fix unsupported command for WRITE_LE_HOST_SUPPORTED
WRITE_LE_HOST_SUPPORTED command needs check for BTDEV_TYPE_LE as well.
Change-Id: I7e860ae650422141917bc9b9ccb9e27aa7a3a113
Signed-off-by: himanshu <h.himanshu@samsung.com>
Andrzej Kaczmarek [Thu, 19 Jul 2018 18:34:30 +0000 (20:34 +0200)]
monitor: Allow Ellisys injection when reading from TTY
Change-Id: I3e132a9a557d5876327064dda1429b0818db8e9f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Andrzej Kaczmarek [Thu, 19 Jul 2018 14:44:09 +0000 (16:44 +0200)]
device: Fix loading devices without Service Changed CCC
This patch provides fix for loading devices which were saved before
support for storing Service Changed CCC was added (
a0b886e26).
Without this fix, after daemon is upgraded from pre-
a0b886e26 to
current version we do not indicate Service Changed to any previously
bonded device since "loaded" CCC value is 0. This means that even if
locla GATT database is changed, bonded peer can assume it did not
change and continue to access structure which yields unexpected
results and this is exactly what happens on iOS devices.
With this patch, if "ServiceChanged" group (added by mentioned commit)
does not exist in config file of a bonded device, we assume indications
for Service Changed characteristic value were enabled by peer as per
Core 5.0, Vol 3, Part G, 7.1:
"This Characteristic Value shall be configured to be indicated,
using the Client Characteristic Configuration descriptor by a
client"
Change-Id: I9a06b3787460b4a62e5e948effc97bc4d3b9b5ab
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 19 Jul 2018 13:58:02 +0000 (16:58 +0300)]
monitor: Use BPF to filter packets by index
This uses a BPF filter to filter packets to specific index.
Change-Id: Ie73c025483c18a40de803e79a24e3a346d5156ce
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 12 Jul 2018 17:01:13 +0000 (20:01 +0300)]
core: Set GATT.Cache default in init_defaults
Change-Id: I41a373066b0fd325981b2bbd03d014186053b10d
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 12 Jul 2018 15:47:17 +0000 (18:47 +0300)]
doc/gatt-api: Fix documentation of prepare-authorize
Make it clearer what values it can assume and also fit in 80 columns.
Change-Id: Iae39d7c79d90673df27cadc9eb9b2d3049ec5e1b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 12 Jul 2018 15:29:47 +0000 (18:29 +0300)]
main.conf: Rename MinEncKeySize to KeySize
There is no conflicts, or other key/encryption related parameter, with
just calling this parameter KeySize so we don't have to just enter
initial for something one can assume it implicitly.
Change-Id: Ia2dceb976e35819864dd5b7899f2753698e42b31
Signed-off-by: himanshu <h.himanshu@samsung.com>
David Krauser [Mon, 9 Jul 2018 16:25:01 +0000 (12:25 -0400)]
gatt: provide MTU in ReadValue and WriteValue
This includes the MTU value in ReadValue and WriteValue when acting as
a server.
Note: The actual data can be bigger than the MTU in case of WriteValue
in case of Long Value is written with Prepare + Execute.
Change-Id: I718fe7378e5627aaf8c5680d5bf730c9b0f0ce0b
Signed-off-by: himanshu <h.himanshu@samsung.com>
David Krauser [Mon, 9 Jul 2018 16:27:20 +0000 (12:27 -0400)]
gatt: Make ATT MTU configurable in main.conf
This adds a new entry to GATT group called ExchangeMTU.
Change-Id: Ia026190e18bc759cc565475e629143307e231413
Signed-off-by: himanshu <h.himanshu@samsung.com>
David Krauser [Mon, 9 Jul 2018 16:28:15 +0000 (12:28 -0400)]
doc/gatt-api: Add MTU to ReadValue and WriteValue
Change-Id: Ica225118d9aef841b5d893d5174853c58afb1e73
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Thu, 28 Jun 2018 06:16:50 +0000 (11:46 +0530)]
doc/mgmt-api: Add BREDR PHYs in PHY Configuration Commands
Change-Id: I94b243f25a6d4a4531e37f2f35e28d2542f00268
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 26 Jun 2018 10:37:33 +0000 (13:37 +0300)]
policy: Add logic to connect a Sink
If HFP/HSP HS connects and the device also supports a Sink connect it
as well since some devices (e.g. Sony MW600) may not connect it
automatically.
Change-Id: Ie328028bc5ef7751e501ff056521114bf4385117
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Thu, 14 Jun 2018 12:21:20 +0000 (17:51 +0530)]
emulator: Add 5.0 feature support
This adds new hciemu for BT 5.0. Also adds extended advertising,
scanning and connection support in btdev and bthost
Change-Id: Ifb49b0e088b2d7bacc9a09c1989aa4c8b1a6cd2c
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Thu, 14 Jun 2018 12:21:18 +0000 (17:51 +0530)]
monitor: Add support for Secondary PHY flags in Add Advertising
Change-Id: I8f09089d0fa373d43b1d0eb249b730e9bb0326ad
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Thu, 14 Jun 2018 12:21:15 +0000 (17:51 +0530)]
doc/mgmt-api: Add advertising phys support to flags
Change-Id: Ie0941101f8d0cfbd7c0ac0f306c06ef95f663176
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Thu, 14 Jun 2018 12:21:14 +0000 (17:51 +0530)]
doc/mgmt-api: Add support for Set Phy Configuration command
This also adds PHY Configuration Changed Event.
Change-Id: I30900e4dbed3a1282ad87baa6fda610283af2c00
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 16 Jun 2018 23:05:05 +0000 (01:05 +0200)]
btsnoop: Enable SCO packets for Packet Logger format
Change-Id: Ib04155a4d3a482c3b365d2bbba0c950569fcdf4b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 16 Jun 2018 20:53:04 +0000 (22:53 +0200)]
monitor: Add support for decoding Broadcom Enable WBS command
Change-Id: I215bb5976a287ae5544927902c400b032a3ac984
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 16 Jun 2018 20:27:51 +0000 (22:27 +0200)]
monitor: Add support for decoding Broadcom Raw RSSI command
Change-Id: Icf75bdfb5d31bb2a9464bf2db261b661e4dc7e86
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 16 Jun 2018 20:17:40 +0000 (22:17 +0200)]
monitor: Add support for decoding Broadcom high priority connection
Change-Id: I6c335959231197ed76fbb17590dbe1506e2f5e39
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 16 Jun 2018 20:11:28 +0000 (22:11 +0200)]
monitor: Add support for providing fallback manufacturer
Change-Id: Ic91151c25ac11765d0b5d18eaf825282b2245f92
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 16 Jun 2018 19:18:47 +0000 (21:18 +0200)]
monitor: Fix command parameter ordering
Change-Id: I3cdb596baffff23ae78fcb4252bc85a54e8f32c2
Signed-off-by: himanshu <h.himanshu@samsung.com>
Tedd Ho-Jeong An [Wed, 13 Jun 2018 19:52:18 +0000 (12:52 -0700)]
monitor: Fix printing params for HCI Intel DDC command
The offset of value for HCI Intel DDC command is incorrect.
HCI Intel DDC parameter has a combination of following structure:
struct intel_ddc {
u8 len;
u16 id;
u8 *value;
}
The offset of value should be sum of len and id which is 3.
Change-Id: I76278eb72b7742d47a2279f805d25aaeec4a5ef8
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 14 Jun 2018 13:27:51 +0000 (16:27 +0300)]
shared/shell: Fix code style
Remove empty lines
Change-Id: If543623a3a9697a23e6299052eca119b3249d3b5
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 13 Jun 2018 12:55:36 +0000 (15:55 +0300)]
shared/shell: Add history support
This uses read_history/write_history to load and save input history.
Change-Id: Iaca94569f29a8c3017cb2b5427aaa5e036bb3ad1
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 13 Jun 2018 11:19:28 +0000 (14:19 +0300)]
shared/shell: Set shell name on SHELL env
This set SHELL to the first argument given.
Change-Id: I51d0e2f67d7c61a6123b5100f09acb36955f9fce
Signed-off-by: himanshu <h.himanshu@samsung.com>
injun.yang [Mon, 30 Dec 2019 08:46:21 +0000 (17:46 +0900)]
Remove redundant debug message
Change-Id: I7c40721f4b30aaa45d80abb517b26aed4bf72cd9
DoHyun Pyun [Mon, 30 Dec 2019 04:21:38 +0000 (13:21 +0900)]
Adjust the position of GCC build option
Change-Id: Ifb5ab3083ade1638b80a25167314d5ffb118a7f2
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
DoHyun Pyun [Mon, 30 Dec 2019 00:29:47 +0000 (09:29 +0900)]
Add the build exception for GCC9
Change-Id: Iec7c24e4db833b7c49ff24a6feaea206910d624e
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
Amit Purwar [Fri, 27 Dec 2019 10:49:45 +0000 (16:19 +0530)]
Fix build issue for strncpy
Change-Id: Ife86ad79f4a271179a184faf47e489fa88c2f0fa
Signed-off-by: Amit Purwar <amit.purwar@samsung.com>
Pyun DoHyun [Tue, 24 Dec 2019 03:25:57 +0000 (03:25 +0000)]
Merge "Support the keyboard plugin" into tizen
DoHyun Pyun [Mon, 23 Dec 2019 23:42:10 +0000 (08:42 +0900)]
Support the keyboard plugin
Change-Id: Ia5a640caf07cba2a355af94998aa9000500bb82a
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
Inga Stotland [Sun, 11 Aug 2019 07:00:45 +0000 (00:00 -0700)]
shared/mainloop: Add ell-based mainloop implementation
This adds implementation of wrapper mainloop functions to interact with
ell main APIs, enabling support for the applications that link with ell
library and use mainloop functionality.
Change-Id: I9a52c5589097d0acb7a488af88600e9a99d38070
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
DoHyun Pyun [Fri, 20 Dec 2019 03:53:56 +0000 (12:53 +0900)]
Merge branch 'meshd_integrate' into tizen
Change-Id: I1d361e7c478b6a61680f96e6e9724ad96f82bc27
Brian Gix [Wed, 4 Dec 2019 19:15:16 +0000 (11:15 -0800)]
build: Include dependencies for ell/settings.[ch]
Including settings.[ch] in a build requires the following chained
dependencies:
PEM
CERT
KEY
PKSC5
BASE64
Change-Id: I29e6478c9c445cbf30b3681a5248185fdf1c19eb
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Inga Stotland [Wed, 11 Dec 2019 00:56:16 +0000 (16:56 -0800)]
mesh: Add mesh-main.conf file with general mesh configuration
This adds key file with default settings for the mesh daemon.
The following settings are included:
Beacon: Default setting for to indicate whether
secure network beaconing is enabled for a
node whose Beacon state hasn't been configured
by a configuration client, i.e., this setting
apllies to a newly provisioned, created or
imported node.
Relay: Default setting for supporting relay
Friendship: Default setting for supporting Friendship
CRPL: Default depth of replay protection list.
FriendQueueSize: Default size of friend queue: the number
of messages that each Friend node can store
for the Low Power node.
ProvTimeout: Provisioning timeout in seconds.
Change-Id: Ia5f40ef9d5d866e8d94a2ff5cac7cf6339015eca
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Aurelien Jarno [Tue, 10 Dec 2019 22:22:50 +0000 (23:22 +0100)]
tools/mesh-cfgclient: add friend get/set commands
Add friend-get and friend-set commands as per Mesh Profile 4.3.2.55,
4.3.2.56 and 4.3.2.57.
Change-Id: I4375267c2b4a18a68ebafc6610bf22e067ecd663
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Aurelien Jarno [Mon, 11 Nov 2019 19:55:30 +0000 (20:55 +0100)]
tools/mesh-cfgclient: add network transmit get/set commands
Add network-transmit-get and network-transmit-set commands as per
Mesh Profile 4.3.2.69, 4.3.2.70 and 4.3.2.71.
Change-Id: I622480b77bd07d474d4ae8259e0edc1eda552471
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Brian Gix [Fri, 13 Dec 2019 20:25:02 +0000 (12:25 -0800)]
mesh: Cleanup unused LPN code
The daemon does not support the LPN role, and this is unreferenced code.
Change-Id: I8e201453bec2800c27e57d856b1258c127a67388
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Brian Gix [Fri, 13 Dec 2019 20:15:05 +0000 (12:15 -0800)]
mesh: Refactor Secure Network Beaconing
The daemon handles multiple nodes, that may or may not be on the same
mesh network. While each node my be seperately configured to beacon or
not beacon, there is nothing gained (except redundent traffic) for each
node to beacon seperately. Beaconing is therefore centralized with the
Network Key the SNB represents, with each *received* beacon delivered
to each node. But for SNBs generated, we keep a count of how many nodes
want beacons sent for a specific key. If 1 or more, we beacon, if 0
nodes want the beacon sent, then we do not beacon.
Change-Id: Id186b6e93d70b09553d585ee9cc4d1b8c7e8b268
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Inga Stotland [Wed, 11 Dec 2019 23:28:47 +0000 (15:28 -0800)]
mesh: Add more checks for element properties
This adds consistency checks for mandatory properties on
org.bluez.mesh.Element1 interface:
- disallow duplicate models on the same element
- disallow elements with duplicate indices
- disallow configuration server model on any element but primary
Change-Id: If4174021b50a0f05c7c25911054cfb98042a06c8
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Inga Stotland [Tue, 10 Dec 2019 23:06:00 +0000 (15:06 -0800)]
mesh: Remove redundant code in mesh IO mgmt
This removes unnecessary housekeeping for hci controllers
Change-Id: I38cf74c18d447d5df6ad340e8cbe0e8f40640122
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Inga Stotland [Fri, 6 Dec 2019 20:57:49 +0000 (12:57 -0800)]
mesh: Initialize net modes based on node configuration
This correctly initializes net settings related to node features
based on node configuration: either defaults in the case of
a newly node created/provisioned/imported node or the configured
values read from stored existing node.
Change-Id: Id0d7a7e2ba2ea7e4dc3cdc17b241250581a14af1
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Inga Stotland [Fri, 6 Dec 2019 20:57:48 +0000 (12:57 -0800)]
mesh: Clean up node.c
This change makes the node initialization a bit easier to follow.
Replace if-else with switch when processing request type, descriptive
function names, more predictable code flow.
Change-Id: Id81f673224878a64d3ff341c7eb574a78bd8be0b
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Biman Paul [Tue, 17 Dec 2019 08:18:57 +0000 (17:18 +0900)]
Add custom uuid support to trusted profile
[Model] Z400F
[BinType] AP
[Customer] OPEN
[Issue#] NA
[Request] Monitoring Test
[Occurrence Version] Z4 Daily
[Problem] SPP authorization request is always shown
even if we select "do not show again".
[Cause & Measure] We are not marking SPP uuid as trusted
Measure: Add custom uuid support to trusted profile
[Checking Method] Request SPP connect from remote device
[Team] Basic Connection
[Developer] Biman Paul <biman.paul@samsung.com>
[Solution company] Samsung
[Change Type] N/A
Change-Id: I9bb537cd0da01b1f86a99f7b4f1c8765c409ce6f
Signed-off-by: Deokhyun Kim <dukan.kim@samsung.com>
Inga Stotland [Fri, 6 Dec 2019 20:57:47 +0000 (12:57 -0800)]
mesh: Delete unused function
This removes node_parse_composition() implementation as it is not used
anywhere in the rest of the code base.
Change-Id: Ifb628a4c8cd447f327cfd560b631b04f435837c6
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Inga Stotland [Tue, 10 Dec 2019 17:45:22 +0000 (09:45 -0800)]
tools/mesh-cfgclient: Fix appkey/netkey commands
This fixes the checks for the presence of AppKeys and Netkeys.
Change-Id: I095c36f5be5846b789c56673fed8deb4d882cf7e
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Inga Stotland [Sat, 7 Dec 2019 06:12:45 +0000 (22:12 -0800)]
tools/mesh-cfgclient: Disallow sending a non-existing key
Prior to sending either NetKeyAdd or AppKeyAdd message to a
remote node, check if the key exists locally.
Change-Id: I7ba29c91b15ccbffbdffa0ef206e659843f955ea
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Brian Gix [Tue, 3 Dec 2019 21:04:10 +0000 (13:04 -0800)]
mesh: Fix memory leak in Join() API call
Change-Id: I69da675134c83fea589056e52882df5339ec9092
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Brian Gix [Tue, 3 Dec 2019 21:04:09 +0000 (13:04 -0800)]
mesh: Rearrange PB-ACK for possible session close
In certain circumstances, reception of PB-ADV messages may trigger
session close. This rearrange ACKs new verified messages before
performing call-back to avoid situations where the session no longer
exists after the message has been handled.
This caused static analysis errors during provisioning, which are now
addressed.
Change-Id: I272e8066f307374c848cb78326259b49acaf4e20
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Prathyusha N [Tue, 3 Dec 2019 10:01:25 +0000 (15:31 +0530)]
mesh: Fix to send close indication on timeout
If pb_session is freed in timeout, close indication will not be sent.
pb_session is freed in pb_adv_unreg() and hence removed from tx_timeout.
Added acceptor_free() in acp_prov_close() to ensure pb_session is freed.
Change-Id: I4649bfa038cf14fb613f13c6b910314f7f710403
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Prathyusha N [Tue, 3 Dec 2019 10:01:23 +0000 (15:31 +0530)]
mesh: Fix string of public-oob and static-oob
Fix string typo as per mesh-api.txt
Change-Id: I58742118a47a0b304468bcf6245c4871f692b75b
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Prathyusha N [Tue, 3 Dec 2019 10:01:24 +0000 (15:31 +0530)]
mesh: Fix invalid transaction number in PROV_INVITE
For initiator, transaction number starts from 0x00 where as for acceptor
transaction number starts from 0x80. Since transaction number is
pre-incremented and sent in every packet, initialize it with 0xFF for
initiator and 0x7F for acceptor.
Change-Id: I833335c962f06b6a58ff70d63c603938d335005c
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Nagaraj D R [Tue, 3 Dec 2019 09:53:27 +0000 (15:23 +0530)]
mesh: Fix invalid netkey index in appkey add/delete
8 LSbs of netkey index should be packed into the first octet
Change-Id: Ia2226334e4ef9702e44a9fa96a28e8273780ac04
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Aurelien Jarno [Mon, 11 Nov 2019 19:54:06 +0000 (20:54 +0100)]
mesh: fix (re)transmit count & interval steps
The Foundation Model Layer uses little endian ordering. As a
consequence the (re)transmit count and interval steps in the Config
Relay, Config Model Publication and Config Network Transmit messages
use the lower 3 bits for the (re)transmission count and the higher 5
bits for the interval steps.
The figure 4.5 in section 4.3.2.16 of the Mesh Profile Bluetooth
Specification provides a good clarification.
This patch therefore fixes those messages for both the daemon and
configuration client parts.
Change-Id: I3473d43c2ca9a7de79faa93c6d0c6953377d0f31
Signed-off-by: Anupam Roy <anupam.r@samsung.com>
Brian Gix [Wed, 27 Nov 2019 21:39:39 +0000 (13:39 -0800)]
mesh: Friendship clean-up and rewrite
Friendship support re-written such that it can now support multiple
nodes (on multiple mesh networks) as friends to remote Low Power Nodes
(LPNs). Validated to properly respond to Friend Requests when enabled,
and a hard coded Friend Queue size of 32 (FRND_CACHE_MAX).
Change-Id: Ia50bba5f000eb9bd30e5a7d54045a22d2978428a
Signed-off-by: Anupam Roy <anupam.r@samsung.com>