espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-10-02 13:27:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/ll: Fix LL_LENGTH_REQ/RSP handling

Browse Source 
We should reply LL_UNKNOWN_RSP if CtrlData received from peer are
invalid [1]. This means, we only have to check if TX/RX values for time
and octets are not less than 328 and 27 respectively [2]. Any other
value received shall be accepted - we will calculate effective values
for both octets and time to be within limits anyway.

In addidion, even if LL_LENGTH_RSP does not have valid data we should
end procedure since there is no exception for this in spec [3]. We do
not apply invalid parameters, but also won't hit procedure timeout.

Core specification v5.0, Vol 6, Part B
[1] section 2.4.2
[2] section 2.4.2.21
[3] section 5.1.10

X-Original-Commit: faf673657f07b4215befe2a11ed1546a27ce4d96
This commit is contained in:
Andrzej Kaczmarek
2018-02-05 14:21:41 +01:00
parent 573a764370
commit 32ba8b3eab
1 changed files with 9 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/controller/src/ble_ll_ctrl.c
+9 -35
View File
@@ -161,35 +161,6 @@ ble_ll_ctrl_rej_ext_ind_make(uint8_t rej_opcode, uint8_t err, uint8_t *ctrdata)
ctrdata[1] = err;
}
static int
ble_ll_ctrl_chk_supp_bytes(uint16_t bytes)
{
int rc;
if ((bytes < BLE_LL_CONN_SUPP_BYTES_MIN) ||
(bytes > BLE_LL_CONN_SUPP_BYTES_MAX)) {
rc = 0;
} else {
rc = 1;
}
return rc;
}
static int
ble_ll_ctrl_chk_supp_time(uint16_t t)
{
int rc;
if ((t < BLE_LL_CONN_SUPP_TIME_MIN) || (t > BLE_LL_CONN_SUPP_TIME_MAX)) {
rc = 0;
} else {
rc = 1;
}
return rc;
}
#if (BLE_LL_BT5_PHY_SUPPORTED == 1)
/**
* Called to cancel a phy update procedure.
@@ -226,10 +197,10 @@ ble_ll_ctrl_len_proc(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
ctrl_req.max_tx_bytes = get_le16(dptr + 4);
ctrl_req.max_tx_time = get_le16(dptr + 6);
if (!ble_ll_ctrl_chk_supp_bytes(ctrl_req.max_rx_bytes) ||
!ble_ll_ctrl_chk_supp_bytes(ctrl_req.max_tx_bytes) ||
!ble_ll_ctrl_chk_supp_time(ctrl_req.max_tx_time) ||
!ble_ll_ctrl_chk_supp_time(ctrl_req.max_rx_time)) {
if ((ctrl_req.max_rx_bytes < BLE_LL_CONN_SUPP_BYTES_MIN) ||
(ctrl_req.max_rx_time < BLE_LL_CONN_SUPP_TIME_MIN) ||
(ctrl_req.max_tx_bytes < BLE_LL_CONN_SUPP_BYTES_MIN) ||
(ctrl_req.max_tx_time < BLE_LL_CONN_SUPP_TIME_MIN)) {
rc = 1;
} else {
/* Update the connection with the new parameters */
@@ -2228,11 +2199,14 @@ ble_ll_ctrl_rx_pdu(struct ble_ll_conn_sm *connsm, struct os_mbuf *om)
case BLE_LL_CTRL_LENGTH_RSP:
/* According to specification, process this only if we asked for it. */
if (connsm->cur_ctrl_proc == BLE_LL_CTRL_PROC_DATA_LEN_UPD) {
/* Process the received data */
/*
* Process the received data. If received data is invalid, we'll
* reply with LL_UNKNOWN_RSP as per spec, but we still need to stop
* control procedure to avoid timeout.
*/
if (ble_ll_ctrl_len_proc(connsm, dptr)) {
rc = -1;
rsp_opcode = BLE_LL_CTRL_UNKNOWN_RSP;
goto ll_ctrl_send_rsp;
}
/* Stop the control procedure */