1 /******************************************************************************
2 *
3 * Copyright (C) 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * this file contains SDP discovery functions
22 *
23 ******************************************************************************/
24
25 #include <stdlib.h>
26 #include <string.h>
27 #include <stdio.h>
28
29 #include "common/bt_target.h"
30 #include "osi/allocator.h"
31 #include "stack/l2cdefs.h"
32 #include "stack/hcidefs.h"
33 #include "stack/hcimsgs.h"
34 #include "stack/sdp_api.h"
35 #include "sdpint.h"
36 #include "stack/btu.h"
37 #include "stack/btm_api.h"
38
39
40 #ifndef SDP_DEBUG_RAW
41 #define SDP_DEBUG_RAW FALSE
42 #endif
43
44 /********************************************************************************/
45 /* L O C A L F U N C T I O N P R O T O T Y P E S */
46 /********************************************************************************/
47 #if SDP_CLIENT_ENABLED == TRUE
48 static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply);
49 static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply);
50 static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply);
51 static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end);
52 static tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda);
53 static UINT8 *add_attr (UINT8 *p, tSDP_DISCOVERY_DB *p_db, tSDP_DISC_REC *p_rec,
54 UINT16 attr_id, tSDP_DISC_ATTR *p_parent_attr, UINT8 nest_level);
55
56 /* Safety check in case we go crazy */
57 #define MAX_NEST_LEVELS 5
58
59
60 /*******************************************************************************
61 **
62 ** Function sdpu_build_uuid_seq
63 **
64 ** Description This function builds a UUID sequence from the list of
65 ** passed UUIDs. It is also passed the address of the output
66 ** buffer.
67 **
68 ** Returns Pointer to next byte in the output buffer.
69 **
70 *******************************************************************************/
sdpu_build_uuid_seq(UINT8 * p_out,UINT16 num_uuids,tSDP_UUID * p_uuid_list)71 static UINT8 *sdpu_build_uuid_seq (UINT8 *p_out, UINT16 num_uuids, tSDP_UUID *p_uuid_list)
72 {
73 UINT16 xx;
74 UINT8 *p_len;
75
76 /* First thing is the data element header */
77 UINT8_TO_BE_STREAM (p_out, (DATA_ELE_SEQ_DESC_TYPE << 3) | SIZE_IN_NEXT_BYTE);
78
79 /* Remember where the length goes. Leave space for it. */
80 p_len = p_out;
81 p_out += 1;
82
83 /* Now, loop through and put in all the UUID(s) */
84 for (xx = 0; xx < num_uuids; xx++, p_uuid_list++) {
85 if (p_uuid_list->len == 2) {
86 UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_TWO_BYTES);
87 UINT16_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid16);
88 } else if (p_uuid_list->len == 4) {
89 UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_FOUR_BYTES);
90 UINT32_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid32);
91 } else {
92 UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES);
93 ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, p_uuid_list->len);
94 }
95 }
96
97 /* Now, put in the length */
98 xx = (UINT16)(p_out - p_len - 1);
99 UINT8_TO_BE_STREAM (p_len, xx);
100
101 return (p_out);
102 }
103
104 /*******************************************************************************
105 **
106 ** Function sdp_snd_service_search_req
107 **
108 ** Description Send a service search request to the SDP server.
109 **
110 ** Returns void
111 **
112 *******************************************************************************/
sdp_snd_service_search_req(tCONN_CB * p_ccb,UINT8 cont_len,UINT8 * p_cont)113 static void sdp_snd_service_search_req(tCONN_CB *p_ccb, UINT8 cont_len, UINT8 *p_cont)
114 {
115 UINT8 *p, *p_start, *p_param_len;
116 BT_HDR *p_cmd;
117 UINT16 param_len;
118
119 /* Get a buffer to send the packet to L2CAP */
120 if ((p_cmd = (BT_HDR *) osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) {
121 sdp_disconnect (p_ccb, SDP_NO_RESOURCES);
122 return;
123 }
124
125 p_cmd->offset = L2CAP_MIN_OFFSET;
126 p = p_start = (UINT8 *)(p_cmd + 1) + L2CAP_MIN_OFFSET;
127
128 /* Build a service search request packet */
129 UINT8_TO_BE_STREAM (p, SDP_PDU_SERVICE_SEARCH_REQ);
130 UINT16_TO_BE_STREAM (p, p_ccb->transaction_id);
131 p_ccb->transaction_id++;
132
133 /* Skip the length, we need to add it at the end */
134 p_param_len = p;
135 p += 2;
136
137 /* Build the UID sequence. */
138 #if (defined(SDP_BROWSE_PLUS) && SDP_BROWSE_PLUS == TRUE)
139 p = sdpu_build_uuid_seq (p, 1, &p_ccb->p_db->uuid_filters[p_ccb->cur_uuid_idx]);
140 #else
141 p = sdpu_build_uuid_seq (p, p_ccb->p_db->num_uuid_filters, p_ccb->p_db->uuid_filters);
142 #endif
143
144 /* Set max service record count */
145 UINT16_TO_BE_STREAM (p, sdp_cb.max_recs_per_search);
146
147 /* Set continuation state */
148 UINT8_TO_BE_STREAM (p, cont_len);
149
150 /* if this is not the first request */
151 if (cont_len && p_cont) {
152 memcpy(p, p_cont, cont_len);
153 p += cont_len;
154 }
155
156 /* Go back and put the parameter length into the buffer */
157 param_len = (UINT16)(p - p_param_len - 2);
158 UINT16_TO_BE_STREAM (p_param_len, param_len);
159
160 p_ccb->disc_state = SDP_DISC_WAIT_HANDLES;
161
162 /* Set the length of the SDP data in the buffer */
163 p_cmd->len = (UINT16)(p - p_start);
164
165 #if (SDP_DEBUG_RAW == TRUE)
166 SDP_TRACE_WARNING("sdp_snd_service_search_req cont_len :%d disc_state:%d\n", cont_len, p_ccb->disc_state);
167 #endif
168
169
170 L2CA_DataWrite (p_ccb->connection_id, p_cmd);
171
172 /* Start inactivity timer */
173 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_SDP, SDP_INACT_TIMEOUT);
174
175 }
176
177 /*******************************************************************************
178 **
179 ** Function sdp_disc_connected
180 **
181 ** Description This function is called when an SDP discovery attempt is
182 ** connected.
183 **
184 ** Returns void
185 **
186 *******************************************************************************/
sdp_disc_connected(tCONN_CB * p_ccb)187 void sdp_disc_connected (tCONN_CB *p_ccb)
188 {
189 if (p_ccb->is_attr_search) {
190 p_ccb->disc_state = SDP_DISC_WAIT_SEARCH_ATTR;
191
192 process_service_search_attr_rsp (p_ccb, NULL);
193 } else {
194 /* First step is to get a list of the handles from the server. */
195 /* We are not searching for a specific attribute, so we will */
196 /* first search for the service, then get all attributes of it */
197
198 p_ccb->num_handles = 0;
199 sdp_snd_service_search_req(p_ccb, 0, NULL);
200 }
201
202 }
203
204 /*******************************************************************************
205 **
206 ** Function sdp_disc_server_rsp
207 **
208 ** Description This function is called when there is a response from
209 ** the server.
210 **
211 ** Returns void
212 **
213 *******************************************************************************/
sdp_disc_server_rsp(tCONN_CB * p_ccb,BT_HDR * p_msg)214 void sdp_disc_server_rsp (tCONN_CB *p_ccb, BT_HDR *p_msg)
215 {
216 UINT8 *p, rsp_pdu;
217 BOOLEAN invalid_pdu = TRUE;
218
219 #if (SDP_DEBUG_RAW == TRUE)
220 SDP_TRACE_WARNING("sdp_disc_server_rsp disc_state:%d\n", p_ccb->disc_state);
221 #endif
222
223 /* stop inactivity timer when we receive a response */
224 btu_stop_timer (&p_ccb->timer_entry);
225
226 /* Got a reply!! Check what we got back */
227 p = (UINT8 *)(p_msg + 1) + p_msg->offset;
228
229 BE_STREAM_TO_UINT8 (rsp_pdu, p);
230
231 p_msg->len--;
232
233 switch (rsp_pdu) {
234 case SDP_PDU_SERVICE_SEARCH_RSP:
235 if (p_ccb->disc_state == SDP_DISC_WAIT_HANDLES) {
236 process_service_search_rsp (p_ccb, p);
237 invalid_pdu = FALSE;
238 }
239 break;
240
241 case SDP_PDU_SERVICE_ATTR_RSP:
242 if (p_ccb->disc_state == SDP_DISC_WAIT_ATTR) {
243 process_service_attr_rsp (p_ccb, p);
244 invalid_pdu = FALSE;
245 }
246 break;
247
248 case SDP_PDU_SERVICE_SEARCH_ATTR_RSP:
249 if (p_ccb->disc_state == SDP_DISC_WAIT_SEARCH_ATTR) {
250 process_service_search_attr_rsp (p_ccb, p);
251 invalid_pdu = FALSE;
252 }
253 break;
254 }
255
256 if (invalid_pdu) {
257 SDP_TRACE_WARNING ("SDP - Unexp. PDU: %d in state: %d\n", rsp_pdu, p_ccb->disc_state);
258 sdp_disconnect (p_ccb, SDP_GENERIC_ERROR);
259 }
260 }
261
262 /******************************************************************************
263 **
264 ** Function process_service_search_rsp
265 **
266 ** Description This function is called when there is a search response from
267 ** the server.
268 **
269 ** Returns void
270 **
271 *******************************************************************************/
process_service_search_rsp(tCONN_CB * p_ccb,UINT8 * p_reply)272 static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
273 {
274 UINT16 xx;
275 UINT16 total, cur_handles, orig;
276 UINT8 cont_len;
277
278 /* Skip transaction, and param len */
279 p_reply += 4;
280 BE_STREAM_TO_UINT16 (total, p_reply);
281 BE_STREAM_TO_UINT16 (cur_handles, p_reply);
282
283 orig = p_ccb->num_handles;
284 p_ccb->num_handles += cur_handles;
285 if (p_ccb->num_handles == 0) {
286 SDP_TRACE_WARNING ("SDP - Rcvd ServiceSearchRsp, no matches\n");
287 sdp_disconnect (p_ccb, SDP_NO_RECS_MATCH);
288 return;
289 }
290
291 /* Save the handles that match. We will can only process a certain number. */
292 if (total > sdp_cb.max_recs_per_search) {
293 total = sdp_cb.max_recs_per_search;
294 }
295 if (p_ccb->num_handles > sdp_cb.max_recs_per_search) {
296 p_ccb->num_handles = sdp_cb.max_recs_per_search;
297 }
298
299 for (xx = orig; xx < p_ccb->num_handles; xx++) {
300 BE_STREAM_TO_UINT32 (p_ccb->handles[xx], p_reply);
301 }
302
303 BE_STREAM_TO_UINT8 (cont_len, p_reply);
304 if (cont_len != 0) {
305 if (cont_len > SDP_MAX_CONTINUATION_LEN) {
306 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE);
307 return;
308 }
309 /* stay in the same state */
310 sdp_snd_service_search_req(p_ccb, cont_len, p_reply);
311 } else {
312 /* change state */
313 p_ccb->disc_state = SDP_DISC_WAIT_ATTR;
314
315 /* Kick off the first attribute request */
316 process_service_attr_rsp (p_ccb, NULL);
317 }
318 }
319
320 /*******************************************************************************
321 **
322 ** Function sdp_copy_raw_data
323 **
324 ** Description copy the raw data
325 **
326 **
327 ** Returns void
328 **
329 *******************************************************************************/
330 #if (SDP_RAW_DATA_INCLUDED == TRUE)
sdp_copy_raw_data(tCONN_CB * p_ccb,BOOLEAN offset)331 static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
332 {
333 unsigned int cpy_len;
334 UINT32 list_len;
335 UINT8 *p;
336 UINT8 type;
337
338 #if (SDP_DEBUG_RAW == TRUE)
339 UINT8 num_array[SDP_MAX_LIST_BYTE_COUNT];
340 UINT32 i;
341
342 for (i = 0; i < p_ccb->list_len; i++) {
343 sprintf((char *)&num_array[i * 2], "%02X\n", (UINT8)(p_ccb->rsp_list[i]));
344 }
345 SDP_TRACE_WARNING("result :%s\n", num_array);
346 #endif
347
348 if (p_ccb->p_db->raw_data) {
349 cpy_len = p_ccb->p_db->raw_size - p_ccb->p_db->raw_used;
350 list_len = p_ccb->list_len;
351 p = &p_ccb->rsp_list[0];
352
353 if (offset) {
354 type = *p++;
355 p = sdpu_get_len_from_type (p, type, &list_len);
356 }
357 if (list_len < cpy_len ) {
358 cpy_len = list_len;
359 }
360 #if (SDP_DEBUG_RAW == TRUE)
361 SDP_TRACE_DEBUG("list_len :%d cpy_len:%d raw_size:%d raw_used:%d\n",
362 list_len, cpy_len, p_ccb->p_db->raw_size, p_ccb->p_db->raw_used);
363 #endif
364 if (cpy_len != 0){
365 memcpy (&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
366 p_ccb->p_db->raw_used += cpy_len;
367 }
368 }
369 }
370 #endif
371
372 /*******************************************************************************
373 **
374 ** Function process_service_attr_rsp
375 **
376 ** Description This function is called when there is a attribute response from
377 ** the server.
378 **
379 ** Returns void
380 **
381 *******************************************************************************/
process_service_attr_rsp(tCONN_CB * p_ccb,UINT8 * p_reply)382 static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
383 {
384 UINT8 *p_start, *p_param_len;
385 UINT16 param_len, list_byte_count;
386 BOOLEAN cont_request_needed = FALSE;
387
388 #if (SDP_DEBUG_RAW == TRUE)
389 SDP_TRACE_WARNING("process_service_attr_rsp raw inc:%d\n",
390 SDP_RAW_DATA_INCLUDED);
391 #endif
392 /* If p_reply is NULL, we were called after the records handles were read */
393 if (p_reply) {
394 #if (SDP_DEBUG_RAW == TRUE)
395 SDP_TRACE_WARNING("ID & len: 0x%02x-%02x-%02x-%02x\n",
396 p_reply[0], p_reply[1], p_reply[2], p_reply[3]);
397 #endif
398 /* Skip transaction ID and length */
399 p_reply += 4;
400
401 BE_STREAM_TO_UINT16 (list_byte_count, p_reply);
402 #if (SDP_DEBUG_RAW == TRUE)
403 SDP_TRACE_WARNING("list_byte_count:%d\n", list_byte_count);
404 #endif
405
406 /* Copy the response to the scratchpad. First, a safety check on the length */
407 if ((p_ccb->list_len + list_byte_count) > SDP_MAX_LIST_BYTE_COUNT) {
408 sdp_disconnect (p_ccb, SDP_INVALID_PDU_SIZE);
409 return;
410 }
411
412 #if (SDP_DEBUG_RAW == TRUE)
413 SDP_TRACE_WARNING("list_len: %d, list_byte_count: %d\n",
414 p_ccb->list_len, list_byte_count);
415 #endif
416 if (p_ccb->rsp_list == NULL) {
417 p_ccb->rsp_list = (UINT8 *)osi_malloc (SDP_MAX_LIST_BYTE_COUNT);
418 if (p_ccb->rsp_list == NULL) {
419 SDP_TRACE_ERROR ("SDP - no gki buf to save rsp\n");
420 sdp_disconnect (p_ccb, SDP_NO_RESOURCES);
421 return;
422 }
423 }
424 memcpy (&p_ccb->rsp_list[p_ccb->list_len], p_reply, list_byte_count);
425 p_ccb->list_len += list_byte_count;
426 p_reply += list_byte_count;
427 #if (SDP_DEBUG_RAW == TRUE)
428 SDP_TRACE_WARNING("list_len: %d(attr_rsp)\n", p_ccb->list_len);
429
430 /* Check if we need to request a continuation */
431 SDP_TRACE_WARNING("*p_reply:%d(%d)\n", *p_reply, SDP_MAX_CONTINUATION_LEN);
432 #endif
433 if (*p_reply) {
434 if (*p_reply > SDP_MAX_CONTINUATION_LEN) {
435 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE);
436 return;
437 }
438 cont_request_needed = TRUE;
439 } else {
440
441 #if (SDP_RAW_DATA_INCLUDED == TRUE)
442 SDP_TRACE_WARNING("process_service_attr_rsp\n");
443 sdp_copy_raw_data (p_ccb, FALSE);
444 #endif
445
446 /* Save the response in the database. Stop on any error */
447 if (!save_attr_seq (p_ccb, &p_ccb->rsp_list[0], &p_ccb->rsp_list[p_ccb->list_len])) {
448 sdp_disconnect (p_ccb, SDP_DB_FULL);
449 return;
450 }
451 p_ccb->list_len = 0;
452 p_ccb->cur_handle++;
453 }
454 }
455
456 /* Now, ask for the next handle. Reuse the buffer we just got. */
457 if (p_ccb->cur_handle < p_ccb->num_handles) {
458 BT_HDR *p_msg = (BT_HDR *) osi_malloc(SDP_DATA_BUF_SIZE);
459 UINT8 *p;
460
461 if (!p_msg) {
462 sdp_disconnect (p_ccb, SDP_NO_RESOURCES);
463 return;
464 }
465
466 p_msg->offset = L2CAP_MIN_OFFSET;
467 p = p_start = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
468
469 /* Get all the attributes from the server */
470 UINT8_TO_BE_STREAM (p, SDP_PDU_SERVICE_ATTR_REQ);
471 UINT16_TO_BE_STREAM (p, p_ccb->transaction_id);
472 p_ccb->transaction_id++;
473
474 /* Skip the length, we need to add it at the end */
475 p_param_len = p;
476 p += 2;
477
478 UINT32_TO_BE_STREAM (p, p_ccb->handles[p_ccb->cur_handle]);
479
480 /* Max attribute byte count */
481 UINT16_TO_BE_STREAM (p, sdp_cb.max_attr_list_size);
482
483 /* If no attribute filters, build a wildcard attribute sequence */
484 if (p_ccb->p_db->num_attr_filters) {
485 p = sdpu_build_attrib_seq (p, p_ccb->p_db->attr_filters, p_ccb->p_db->num_attr_filters);
486 } else {
487 p = sdpu_build_attrib_seq (p, NULL, 0);
488 }
489
490 /* Was this a continuation request ? */
491 if (cont_request_needed) {
492 memcpy (p, p_reply, *p_reply + 1);
493 p += *p_reply + 1;
494 } else {
495 UINT8_TO_BE_STREAM (p, 0);
496 }
497
498 /* Go back and put the parameter length into the buffer */
499 param_len = (UINT16)(p - p_param_len - 2);
500 UINT16_TO_BE_STREAM (p_param_len, param_len);
501
502 /* Set the length of the SDP data in the buffer */
503 p_msg->len = (UINT16)(p - p_start);
504
505
506 L2CA_DataWrite (p_ccb->connection_id, p_msg);
507
508 /* Start inactivity timer */
509 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_SDP, SDP_INACT_TIMEOUT);
510 } else {
511 sdp_disconnect (p_ccb, SDP_SUCCESS);
512 return;
513 }
514 }
515
516
517 /*******************************************************************************
518 **
519 ** Function process_service_search_attr_rsp
520 **
521 ** Description This function is called when there is a search attribute
522 ** response from the server.
523 **
524 ** Returns void
525 **
526 *******************************************************************************/
process_service_search_attr_rsp(tCONN_CB * p_ccb,UINT8 * p_reply)527 static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
528 {
529 UINT8 *p, *p_start, *p_end, *p_param_len;
530 UINT8 type;
531 UINT32 seq_len;
532 UINT16 param_len, lists_byte_count = 0;
533 BOOLEAN cont_request_needed = FALSE;
534
535 #if (SDP_DEBUG_RAW == TRUE)
536 SDP_TRACE_WARNING("process_service_search_attr_rsp\n");
537 #endif
538 /* If p_reply is NULL, we were called for the initial read */
539 if (p_reply) {
540 #if (SDP_DEBUG_RAW == TRUE)
541 SDP_TRACE_WARNING("ID & len: 0x%02x-%02x-%02x-%02x\n",
542 p_reply[0], p_reply[1], p_reply[2], p_reply[3]);
543 #endif
544 /* Skip transaction ID and length */
545 p_reply += 4;
546
547 BE_STREAM_TO_UINT16 (lists_byte_count, p_reply);
548 #if (SDP_DEBUG_RAW == TRUE)
549 SDP_TRACE_WARNING("lists_byte_count:%d\n", lists_byte_count);
550 #endif
551
552 /* Copy the response to the scratchpad. First, a safety check on the length */
553 if ((p_ccb->list_len + lists_byte_count) > SDP_MAX_LIST_BYTE_COUNT) {
554 sdp_disconnect (p_ccb, SDP_INVALID_PDU_SIZE);
555 return;
556 }
557
558 #if (SDP_DEBUG_RAW == TRUE)
559 SDP_TRACE_WARNING("list_len: %d, list_byte_count: %d\n",
560 p_ccb->list_len, lists_byte_count);
561 #endif
562 if (p_ccb->rsp_list == NULL) {
563 p_ccb->rsp_list = (UINT8 *)osi_malloc (SDP_MAX_LIST_BYTE_COUNT);
564 if (p_ccb->rsp_list == NULL) {
565 SDP_TRACE_ERROR ("SDP - no gki buf to save rsp\n");
566 sdp_disconnect (p_ccb, SDP_NO_RESOURCES);
567 return;
568 }
569 }
570 memcpy (&p_ccb->rsp_list[p_ccb->list_len], p_reply, lists_byte_count);
571 p_ccb->list_len += lists_byte_count;
572 p_reply += lists_byte_count;
573 #if (SDP_DEBUG_RAW == TRUE)
574 SDP_TRACE_WARNING("list_len: %d(search_attr_rsp)\n", p_ccb->list_len);
575
576 /* Check if we need to request a continuation */
577 SDP_TRACE_WARNING("*p_reply:%d(%d)\n", *p_reply, SDP_MAX_CONTINUATION_LEN);
578 #endif
579 if (*p_reply) {
580 if (*p_reply > SDP_MAX_CONTINUATION_LEN) {
581 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE);
582 return;
583 }
584
585 cont_request_needed = TRUE;
586 }
587 }
588
589 #if (SDP_DEBUG_RAW == TRUE)
590 SDP_TRACE_WARNING("cont_request_needed:%d\n", cont_request_needed);
591 #endif
592 /* If continuation request (or first time request) */
593 if ((cont_request_needed) || (!p_reply)) {
594 BT_HDR *p_msg = (BT_HDR *) osi_malloc(SDP_DATA_BUF_SIZE);
595 UINT8 *p;
596
597 if (!p_msg) {
598 sdp_disconnect (p_ccb, SDP_NO_RESOURCES);
599 return;
600 }
601
602 p_msg->offset = L2CAP_MIN_OFFSET;
603 p = p_start = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
604
605 /* Build a service search request packet */
606 UINT8_TO_BE_STREAM (p, SDP_PDU_SERVICE_SEARCH_ATTR_REQ);
607 UINT16_TO_BE_STREAM (p, p_ccb->transaction_id);
608 p_ccb->transaction_id++;
609
610 /* Skip the length, we need to add it at the end */
611 p_param_len = p;
612 p += 2;
613
614 /* Build the UID sequence. */
615 #if (defined(SDP_BROWSE_PLUS) && SDP_BROWSE_PLUS == TRUE)
616 p = sdpu_build_uuid_seq (p, 1, &p_ccb->p_db->uuid_filters[p_ccb->cur_uuid_idx]);
617 #else
618 p = sdpu_build_uuid_seq (p, p_ccb->p_db->num_uuid_filters, p_ccb->p_db->uuid_filters);
619 #endif
620
621 /* Max attribute byte count */
622 UINT16_TO_BE_STREAM (p, sdp_cb.max_attr_list_size);
623
624 /* If no attribute filters, build a wildcard attribute sequence */
625 if (p_ccb->p_db->num_attr_filters) {
626 p = sdpu_build_attrib_seq (p, p_ccb->p_db->attr_filters, p_ccb->p_db->num_attr_filters);
627 } else {
628 p = sdpu_build_attrib_seq (p, NULL, 0);
629 }
630
631 /* No continuation for first request */
632 if (p_reply) {
633 memcpy (p, p_reply, *p_reply + 1);
634 p += *p_reply + 1;
635 } else {
636 UINT8_TO_BE_STREAM (p, 0);
637 }
638
639 /* Go back and put the parameter length into the buffer */
640 param_len = p - p_param_len - 2;
641 UINT16_TO_BE_STREAM (p_param_len, param_len);
642
643 /* Set the length of the SDP data in the buffer */
644 p_msg->len = p - p_start;
645
646
647 L2CA_DataWrite (p_ccb->connection_id, p_msg);
648
649 /* Start inactivity timer */
650 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_SDP, SDP_INACT_TIMEOUT);
651
652 return;
653 }
654
655
656 /*******************************************************************/
657 /* We now have the full response, which is a sequence of sequences */
658 /*******************************************************************/
659
660 #if (SDP_RAW_DATA_INCLUDED == TRUE)
661 SDP_TRACE_DEBUG("process_service_search_attr_rsp\n");
662 sdp_copy_raw_data (p_ccb, TRUE);
663 #endif
664
665 p = &p_ccb->rsp_list[0];
666
667 /* The contents is a sequence of attribute sequences */
668 type = *p++;
669
670 if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) {
671 SDP_TRACE_WARNING ("SDP - Wrong type: 0x%02x in attr_rsp\n", type);
672 sdp_disconnect (p_ccb, SDP_ILLEGAL_PARAMETER);
673 return;
674 }
675 p = sdpu_get_len_from_type (p, type, &seq_len);
676
677 p_end = &p_ccb->rsp_list[p_ccb->list_len];
678
679 if ((p + seq_len) != p_end) {
680 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE);
681 return;
682 }
683
684 while (p < p_end) {
685 p = save_attr_seq (p_ccb, p, &p_ccb->rsp_list[p_ccb->list_len]);
686 if (!p) {
687 sdp_disconnect (p_ccb, SDP_DB_FULL);
688 return;
689 }
690 }
691
692 /* Since we got everything we need, disconnect the call */
693 sdp_disconnect (p_ccb, SDP_SUCCESS);
694 }
695
696 /*******************************************************************************
697 **
698 ** Function save_attr_seq
699 **
700 ** Description This function is called when there is a response from
701 ** the server.
702 **
703 ** Returns pointer to next byte or NULL if error
704 **
705 *******************************************************************************/
save_attr_seq(tCONN_CB * p_ccb,UINT8 * p,UINT8 * p_msg_end)706 static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end)
707 {
708 UINT32 seq_len, attr_len;
709 UINT16 attr_id;
710 UINT8 type, *p_seq_end;
711 tSDP_DISC_REC *p_rec;
712
713 type = *p++;
714
715 if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) {
716 SDP_TRACE_WARNING ("SDP - Wrong type: 0x%02x in attr_rsp\n", type);
717 return (NULL);
718 }
719
720 p = sdpu_get_len_from_type (p, type, &seq_len);
721 if ((p + seq_len) > p_msg_end) {
722 SDP_TRACE_WARNING ("SDP - Bad len in attr_rsp %d\n", seq_len);
723 return (NULL);
724 }
725
726 /* Create a record */
727 p_rec = add_record (p_ccb->p_db, p_ccb->device_address);
728 if (!p_rec) {
729 SDP_TRACE_WARNING ("SDP - DB full add_record\n");
730 return (NULL);
731 }
732
733 p_seq_end = p + seq_len;
734
735 while (p < p_seq_end) {
736 /* First get the attribute ID */
737 type = *p++;
738 p = sdpu_get_len_from_type (p, type, &attr_len);
739 if (((type >> 3) != UINT_DESC_TYPE) || (attr_len != 2)) {
740 SDP_TRACE_WARNING ("SDP - Bad type: 0x%02x or len: %d in attr_rsp\n", type, attr_len);
741 return (NULL);
742 }
743 BE_STREAM_TO_UINT16 (attr_id, p);
744
745 /* Now, add the attribute value */
746 p = add_attr (p, p_ccb->p_db, p_rec, attr_id, NULL, 0);
747
748 if (!p) {
749 SDP_TRACE_WARNING ("SDP - DB full add_attr\n");
750 return (NULL);
751 }
752 }
753
754 return (p);
755 }
756
757
758 /*******************************************************************************
759 **
760 ** Function add_record
761 **
762 ** Description This function allocates space for a record from the DB.
763 **
764 ** Returns pointer to next byte in data stream
765 **
766 *******************************************************************************/
add_record(tSDP_DISCOVERY_DB * p_db,BD_ADDR p_bda)767 tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda)
768 {
769 tSDP_DISC_REC *p_rec;
770
771 /* See if there is enough space in the database */
772 if (p_db->mem_free < sizeof (tSDP_DISC_REC)) {
773 return (NULL);
774 }
775
776 p_rec = (tSDP_DISC_REC *) p_db->p_free_mem;
777 p_db->p_free_mem += sizeof (tSDP_DISC_REC);
778 p_db->mem_free -= sizeof (tSDP_DISC_REC);
779
780 p_rec->p_first_attr = NULL;
781 p_rec->p_next_rec = NULL;
782
783 memcpy (p_rec->remote_bd_addr, p_bda, BD_ADDR_LEN);
784
785 /* Add the record to the end of chain */
786 if (!p_db->p_first_rec) {
787 p_db->p_first_rec = p_rec;
788 } else {
789 tSDP_DISC_REC *p_rec1 = p_db->p_first_rec;
790
791 while (p_rec1->p_next_rec) {
792 p_rec1 = p_rec1->p_next_rec;
793 }
794
795 p_rec1->p_next_rec = p_rec;
796 }
797
798 return (p_rec);
799 }
800
801 #define SDP_ADDITIONAL_LIST_MASK 0x80
802 /*******************************************************************************
803 **
804 ** Function add_attr
805 **
806 ** Description This function allocates space for an attribute from the DB
807 ** and copies the data into it.
808 **
809 ** Returns pointer to next byte in data stream
810 **
811 *******************************************************************************/
add_attr(UINT8 * p,tSDP_DISCOVERY_DB * p_db,tSDP_DISC_REC * p_rec,UINT16 attr_id,tSDP_DISC_ATTR * p_parent_attr,UINT8 nest_level)812 static UINT8 *add_attr (UINT8 *p, tSDP_DISCOVERY_DB *p_db, tSDP_DISC_REC *p_rec,
813 UINT16 attr_id, tSDP_DISC_ATTR *p_parent_attr, UINT8 nest_level)
814 {
815 tSDP_DISC_ATTR *p_attr;
816 UINT32 attr_len;
817 UINT32 total_len;
818 UINT16 attr_type;
819 UINT16 id;
820 UINT8 type;
821 UINT8 *p_end;
822 UINT8 is_additional_list = nest_level & SDP_ADDITIONAL_LIST_MASK;
823
824 nest_level &= ~(SDP_ADDITIONAL_LIST_MASK);
825
826 type = *p++;
827 p = sdpu_get_len_from_type (p, type, &attr_len);
828
829 attr_len &= SDP_DISC_ATTR_LEN_MASK;
830 attr_type = (type >> 3) & 0x0f;
831
832 /* See if there is enough space in the database */
833 if (attr_len > 4) {
834 total_len = attr_len - 4 + (UINT16)sizeof (tSDP_DISC_ATTR);
835 } else {
836 total_len = sizeof (tSDP_DISC_ATTR);
837 }
838
839 /* Ensure it is a multiple of 4 */
840 total_len = (total_len + 3) & ~3;
841
842 /* See if there is enough space in the database */
843 if (p_db->mem_free < total_len) {
844 return (NULL);
845 }
846
847 p_attr = (tSDP_DISC_ATTR *) p_db->p_free_mem;
848 p_attr->attr_id = attr_id;
849 p_attr->attr_len_type = (UINT16)attr_len | (attr_type << 12);
850 p_attr->p_next_attr = NULL;
851
852 /* Store the attribute value */
853 switch (attr_type) {
854 case UINT_DESC_TYPE:
855 if ( (is_additional_list != 0) && (attr_len == 2) ) {
856 BE_STREAM_TO_UINT16 (id, p);
857 if (id != ATTR_ID_PROTOCOL_DESC_LIST) {
858 p -= 2;
859 } else {
860 /* Reserve the memory for the attribute now, as we need to add sub-attributes */
861 p_db->p_free_mem += sizeof (tSDP_DISC_ATTR);
862 p_db->mem_free -= sizeof (tSDP_DISC_ATTR);
863 p_end = p + attr_len;
864 total_len = 0;
865
866 /* SDP_TRACE_DEBUG ("SDP - attr nest level:%d(list)", nest_level); */
867 if (nest_level >= MAX_NEST_LEVELS) {
868 SDP_TRACE_ERROR ("SDP - attr nesting too deep\n");
869 return (p_end);
870 }
871
872 /* Now, add the list entry */
873 p = add_attr (p, p_db, p_rec, ATTR_ID_PROTOCOL_DESC_LIST, p_attr, (UINT8)(nest_level + 1));
874
875 break;
876 }
877 }
878 /* Case falls through */
879
880 case TWO_COMP_INT_DESC_TYPE:
881 switch (attr_len) {
882 case 1:
883 p_attr->attr_value.v.u8 = *p++;
884 break;
885 case 2:
886 BE_STREAM_TO_UINT16 (p_attr->attr_value.v.u16, p);
887 break;
888 case 4:
889 BE_STREAM_TO_UINT32 (p_attr->attr_value.v.u32, p);
890 break;
891 default:
892 BE_STREAM_TO_ARRAY (p, p_attr->attr_value.v.array, (INT32)attr_len);
893 break;
894 }
895 break;
896
897 case UUID_DESC_TYPE:
898 switch (attr_len) {
899 case 2:
900 BE_STREAM_TO_UINT16 (p_attr->attr_value.v.u16, p);
901 break;
902 case 4:
903 BE_STREAM_TO_UINT32 (p_attr->attr_value.v.u32, p);
904 if (p_attr->attr_value.v.u32 < 0x10000) {
905 attr_len = 2;
906 p_attr->attr_len_type = (UINT16)attr_len | (attr_type << 12);
907 p_attr->attr_value.v.u16 = (UINT16) p_attr->attr_value.v.u32;
908
909 }
910 break;
911 case 16:
912 /* See if we can compress his UUID down to 16 or 32bit UUIDs */
913 if (sdpu_is_base_uuid (p)) {
914 if ((p[0] == 0) && (p[1] == 0)) {
915 p_attr->attr_len_type = (p_attr->attr_len_type & ~SDP_DISC_ATTR_LEN_MASK) | 2;
916 p += 2;
917 BE_STREAM_TO_UINT16 (p_attr->attr_value.v.u16, p);
918 p += MAX_UUID_SIZE - 4;
919 } else {
920 p_attr->attr_len_type = (p_attr->attr_len_type & ~SDP_DISC_ATTR_LEN_MASK) | 4;
921 BE_STREAM_TO_UINT32 (p_attr->attr_value.v.u32, p);
922 p += MAX_UUID_SIZE - 4;
923 }
924 } else {
925 /* coverity[overrun-local] */
926 /*
927 Event overrun-local: Overrun of static array "p_attr->attr_value.v.array" of size 4 at position 15 with index variable "ijk"
928 False-positive: SDP uses scratch buffer to hold the attribute value.
929 The actual size of tSDP_DISC_ATVAL does not matter.
930 If the array size in tSDP_DISC_ATVAL is increase, we would increase the system RAM usage unnecessarily
931 */
932 BE_STREAM_TO_ARRAY (p, p_attr->attr_value.v.array, (INT32)attr_len);
933 }
934 break;
935 default:
936 SDP_TRACE_WARNING ("SDP - bad len in UUID attr: %d\n", attr_len);
937 return (p + attr_len);
938 }
939 break;
940
941 case DATA_ELE_SEQ_DESC_TYPE:
942 case DATA_ELE_ALT_DESC_TYPE:
943 /* Reserve the memory for the attribute now, as we need to add sub-attributes */
944 p_db->p_free_mem += sizeof (tSDP_DISC_ATTR);
945 p_db->mem_free -= sizeof (tSDP_DISC_ATTR);
946 p_end = p + attr_len;
947 total_len = 0;
948
949 /* SDP_TRACE_DEBUG ("SDP - attr nest level:%d", nest_level); */
950 if (nest_level >= MAX_NEST_LEVELS) {
951 SDP_TRACE_ERROR ("SDP - attr nesting too deep\n");
952 return (p_end);
953 }
954 if (is_additional_list != 0 || attr_id == ATTR_ID_ADDITION_PROTO_DESC_LISTS) {
955 nest_level |= SDP_ADDITIONAL_LIST_MASK;
956 }
957 /* SDP_TRACE_DEBUG ("SDP - attr nest level:0x%x(finish)", nest_level); */
958
959 while (p < p_end) {
960 /* Now, add the list entry */
961 p = add_attr (p, p_db, p_rec, 0, p_attr, (UINT8)(nest_level + 1));
962
963 if (!p) {
964 return (NULL);
965 }
966 }
967 break;
968
969 case TEXT_STR_DESC_TYPE:
970 case URL_DESC_TYPE:
971 BE_STREAM_TO_ARRAY (p, p_attr->attr_value.v.array, (INT32)attr_len);
972 break;
973
974 case BOOLEAN_DESC_TYPE:
975 switch (attr_len) {
976 case 1:
977 p_attr->attr_value.v.u8 = *p++;
978 break;
979 default:
980 SDP_TRACE_WARNING ("SDP - bad len in boolean attr: %d\n", attr_len);
981 return (p + attr_len);
982 }
983 break;
984
985 default: /* switch (attr_type) */
986 break;
987 }
988
989 p_db->p_free_mem += total_len;
990 p_db->mem_free -= total_len;
991
992 /* Add the attribute to the end of the chain */
993 if (!p_parent_attr) {
994 if (!p_rec->p_first_attr) {
995 p_rec->p_first_attr = p_attr;
996 } else {
997 tSDP_DISC_ATTR *p_attr1 = p_rec->p_first_attr;
998
999 while (p_attr1->p_next_attr) {
1000 p_attr1 = p_attr1->p_next_attr;
1001 }
1002
1003 p_attr1->p_next_attr = p_attr;
1004 }
1005 } else {
1006 if (!p_parent_attr->attr_value.v.p_sub_attr) {
1007 p_parent_attr->attr_value.v.p_sub_attr = p_attr;
1008 /* SDP_TRACE_DEBUG ("parent:0x%x(id:%d), ch:0x%x(id:%d)",
1009 p_parent_attr, p_parent_attr->attr_id, p_attr, p_attr->attr_id); */
1010 } else {
1011 tSDP_DISC_ATTR *p_attr1 = p_parent_attr->attr_value.v.p_sub_attr;
1012 /* SDP_TRACE_DEBUG ("parent:0x%x(id:%d), ch1:0x%x(id:%d)",
1013 p_parent_attr, p_parent_attr->attr_id, p_attr1, p_attr1->attr_id); */
1014
1015 while (p_attr1->p_next_attr) {
1016 p_attr1 = p_attr1->p_next_attr;
1017 }
1018
1019 p_attr1->p_next_attr = p_attr;
1020 /* SDP_TRACE_DEBUG ("new ch:0x%x(id:%d)", p_attr, p_attr->attr_id); */
1021 }
1022 }
1023
1024 return (p);
1025 }
1026
1027 #endif /* CLIENT_ENABLED == TRUE */
1028
