From patchwork Sat Jan 18 04:22:31 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Inga Stotland X-Patchwork-Id: 197438 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6075C32771 for ; Sat, 18 Jan 2020 04:22:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9812F2467C for ; Sat, 18 Jan 2020 04:22:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727504AbgAREWh (ORCPT ); Fri, 17 Jan 2020 23:22:37 -0500 Received: from mga11.intel.com ([192.55.52.93]:11361 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726896AbgAREWg (ORCPT ); Fri, 17 Jan 2020 23:22:36 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Jan 2020 20:22:36 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,332,1574150400"; d="scan'208";a="220926447" Received: from ingas-nuc1.sea.intel.com ([10.251.138.89]) by fmsmga008.fm.intel.com with ESMTP; 17 Jan 2020 20:22:35 -0800 From: Inga Stotland To: linux-bluetooth@vger.kernel.org Cc: brian.gix@intel.com, Inga Stotland Subject: [PATCH BlueZ 2/4] tools/mesh: Add length checks for rxed messages Date: Fri, 17 Jan 2020 20:22:31 -0800 Message-Id: <20200118042233.15338-3-inga.stotland@intel.com> X-Mailer: git-send-email 2.21.1 In-Reply-To: <20200118042233.15338-1-inga.stotland@intel.com> References: <20200118042233.15338-1-inga.stotland@intel.com> MIME-Version: 1.0 Sender: linux-bluetooth-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org This adds missing validation of received responses. If the length of a received message does not pass the validation, it's not processed. --- tools/mesh/cfgcli.c | 40 +++++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/tools/mesh/cfgcli.c b/tools/mesh/cfgcli.c index 23fca4df6..934205f0b 100644 --- a/tools/mesh/cfgcli.c +++ b/tools/mesh/cfgcli.c @@ -73,9 +73,9 @@ static uint32_t parms[8]; static struct cfg_cmd cmds[] = { { OP_APPKEY_ADD, OP_APPKEY_STATUS, "AppKeyAdd" }, { OP_APPKEY_DELETE, OP_APPKEY_STATUS, "AppKeyDelete" }, - { OP_APPKEY_GET, OP_APPKEY_LIST, "AppKeyGet"}, - { OP_APPKEY_LIST, NO_RESPONSE, "AppKeyList"}, - { OP_APPKEY_STATUS, NO_RESPONSE, "AppKeyStatus"}, + { OP_APPKEY_GET, OP_APPKEY_LIST, "AppKeyGet" }, + { OP_APPKEY_LIST, NO_RESPONSE, "AppKeyList" }, + { OP_APPKEY_STATUS, NO_RESPONSE, "AppKeyStatus" }, { OP_APPKEY_UPDATE, OP_APPKEY_STATUS, "AppKeyUpdate" }, { OP_DEV_COMP_GET, OP_DEV_COMP_STATUS, "DeviceCompositionGet" }, { OP_DEV_COMP_STATUS, NO_RESPONSE, "DeviceCompositionStatus" }, @@ -356,7 +356,7 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, } else return false; - bt_shell_printf("Received %s\n", opcode_str(opcode)); + bt_shell_printf("Received %s (len %u)\n", opcode_str(opcode), len); req = get_req_by_rsp(src, (opcode & ~OP_UNRELIABLE)); if (req) { @@ -581,12 +581,12 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, /* Per Mesh Profile 4.3.2.19 */ case OP_CONFIG_MODEL_SUB_STATUS: + if (len != 7 && len != 9) + return true; + bt_shell_printf("\nNode %4.4x Subscription status %s\n", src, mesh_status_str(data[0])); - if (data[0] != MESH_STATUS_SUCCESS) - return true; - ele_addr = get_le16(data + 1); addr = get_le16(data + 3); bt_shell_printf("Element Addr\t%4.4x\n", ele_addr); @@ -599,13 +599,12 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, /* Per Mesh Profile 4.3.2.27 */ case OP_CONFIG_MODEL_SUB_LIST: + if (len < 5) + return true; bt_shell_printf("\nNode %4.4x Subscription List status %s\n", src, mesh_status_str(data[0])); - if (data[0] != MESH_STATUS_SUCCESS) - return true; - bt_shell_printf("Element Addr\t%4.4x\n", get_le16(data + 1)); bt_shell_printf("Model ID\t%4.4x\n", get_le16(data + 3)); @@ -616,12 +615,12 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, /* Per Mesh Profile 4.3.2.50 */ case OP_MODEL_APP_LIST: + if (len < 5) + return true; + bt_shell_printf("\nNode %4.4x Model AppIdx status %s\n", src, mesh_status_str(data[0])); - if (data[0] != MESH_STATUS_SUCCESS) - return true; - bt_shell_printf("Element Addr\t%4.4x\n", get_le16(data + 1)); bt_shell_printf("Model ID\t%4.4x\n", get_le16(data + 3)); @@ -632,12 +631,12 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, /* Per Mesh Profile 4.3.2.63 */ case OP_CONFIG_HEARTBEAT_PUB_STATUS: + if (len != 10) + return true; + bt_shell_printf("\nNode %4.4x Heartbeat publish status %s\n", src, mesh_status_str(data[0])); - if (data[0] != MESH_STATUS_SUCCESS) - return true; - bt_shell_printf("Destination\t%4.4x\n", get_le16(data + 1)); bt_shell_printf("Count\t\t%2.2x\n", data[3]); bt_shell_printf("Period\t\t%2.2x\n", data[4]); @@ -648,12 +647,12 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, /* Per Mesh Profile 4.3.2.66 */ case OP_CONFIG_HEARTBEAT_SUB_STATUS: + if (len != 9) + return true; + bt_shell_printf("\nNode %4.4x Heartbeat subscribe status %s\n", src, mesh_status_str(data[0])); - if (data[0] != MESH_STATUS_SUCCESS) - return true; - bt_shell_printf("Source\t\t%4.4x\n", get_le16(data + 1)); bt_shell_printf("Destination\t%4.4x\n", get_le16(data + 3)); bt_shell_printf("Period\t\t%2.2x\n", data[5]); @@ -673,6 +672,9 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, /* Per Mesh Profile 4.3.2.54 */ case OP_NODE_RESET_STATUS: + if (len != 1) + return true; + bt_shell_printf("Node %4.4x reset status %s\n", src, mesh_status_str(data[0])); From patchwork Sat Jan 18 04:22:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Inga Stotland X-Patchwork-Id: 197437 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3499CC33CB7 for ; Sat, 18 Jan 2020 04:22:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1719E24656 for ; Sat, 18 Jan 2020 04:22:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728665AbgAREWi (ORCPT ); Fri, 17 Jan 2020 23:22:38 -0500 Received: from mga11.intel.com ([192.55.52.93]:11361 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726973AbgAREWi (ORCPT ); Fri, 17 Jan 2020 23:22:38 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Jan 2020 20:22:38 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,332,1574150400"; d="scan'208";a="220926461" Received: from ingas-nuc1.sea.intel.com ([10.251.138.89]) by fmsmga008.fm.intel.com with ESMTP; 17 Jan 2020 20:22:37 -0800 From: Inga Stotland To: linux-bluetooth@vger.kernel.org Cc: brian.gix@intel.com, Inga Stotland Subject: [PATCH BlueZ 4/4] tools/mesh: Implement model group subscription commands Date: Fri, 17 Jan 2020 20:22:33 -0800 Message-Id: <20200118042233.15338-5-inga.stotland@intel.com> X-Mailer: git-send-email 2.21.1 In-Reply-To: <20200118042233.15338-1-inga.stotland@intel.com> References: <20200118042233.15338-1-inga.stotland@intel.com> MIME-Version: 1.0 Sender: linux-bluetooth-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org This adds implementation for: Config Model Subscription Delete Config Model Subscription Delete All Config Model Subscription Overwrite and adds handling vendor model IDs for Config Model Subscription Add Config Model Subscription Get --- tools/mesh/cfgcli.c | 105 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 86 insertions(+), 19 deletions(-) diff --git a/tools/mesh/cfgcli.c b/tools/mesh/cfgcli.c index f9aaf137d..cfa573de3 100644 --- a/tools/mesh/cfgcli.c +++ b/tools/mesh/cfgcli.c @@ -246,14 +246,15 @@ static uint32_t print_mod_id(uint8_t *data, bool vendor, const char *offset) if (!vendor) { mod_id = get_le16(data); - bt_shell_printf("%sModel Id\t%4.4x\n", offset, mod_id); + bt_shell_printf("%sModel ID\t%4.4x\n", offset, mod_id); mod_id = VENDOR_ID_MASK | mod_id; } else { mod_id = get_le16(data + 2); - bt_shell_printf("%sModel Id\t%4.4x %4.4x\n", offset, + bt_shell_printf("%sModel ID\t%4.4x %4.4x\n", offset, get_le16(data), mod_id); mod_id = get_le16(data) << 16 | mod_id; } + return mod_id; } @@ -606,13 +607,29 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data, src, mesh_status_str(data[0])); bt_shell_printf("Element Addr\t%4.4x\n", get_le16(data + 1)); - bt_shell_printf("Model ID\t%4.4x\n", get_le16(data + 3)); + print_mod_id(data + 3, false, ""); for (i = 5; i < len; i += 2) bt_shell_printf("Subscr Addr\t%4.4x\n", get_le16(data + i)); break; + case OP_CONFIG_VEND_MODEL_SUB_LIST: + if (len < 7) + return true; + + bt_shell_printf("\nNode %4.4x Subscription List status %s\n", + src, mesh_status_str(data[0])); + + bt_shell_printf("Element Addr\t%4.4x\n", get_le16(data + 1)); + print_mod_id(data + 3, true, ""); + + for (i = 7; i < len; i += 2) + bt_shell_printf("Subscr Addr\t%4.4x\n", + get_le16(data + i)); + break; + + /* Per Mesh Profile 4.3.2.50 */ case OP_MODEL_APP_LIST: if (len < 5) @@ -1241,60 +1258,104 @@ static void cmd_pub_get(int argc, char *argv[]) return bt_shell_noninteractive_quit(EXIT_SUCCESS); } -static void cmd_sub_add(int argc, char *argv[]) +static void subscription_cmd(int argc, char *argv[], uint32_t opcode) { uint16_t n; uint8_t msg[32]; int parm_cnt; - n = mesh_opcode_set(OP_CONFIG_MODEL_SUB_ADD, msg); + n = mesh_opcode_set(opcode, msg); parm_cnt = read_input_parameters(argc, argv); - if (parm_cnt != 3) { + if (parm_cnt != 3 && parm_cnt != 4) { bt_shell_printf("Bad arguments: %s\n", argv[1]); return bt_shell_noninteractive_quit(EXIT_FAILURE); } - /* Per Mesh Profile 4.3.2.19 */ /* Element Address */ put_le16(parms[0], msg + n); n += 2; /* Subscription Address */ put_le16(parms[1], msg + n); n += 2; - /* SIG Model ID */ - put_le16(parms[2], msg + n); - n += 2; - if (!config_send(msg, n, OP_CONFIG_MODEL_SUB_ADD)) + /* Model ID */ + n += put_model_id(msg + n, &parms[2], parm_cnt == 4); + + if (!config_send(msg, n, opcode)) return bt_shell_noninteractive_quit(EXIT_FAILURE); return bt_shell_noninteractive_quit(EXIT_SUCCESS); } -static void cmd_sub_get(int argc, char *argv[]) +static void cmd_sub_add(int argc, char *argv[]) +{ + subscription_cmd(argc, argv, OP_CONFIG_MODEL_SUB_ADD); +} + +static void cmd_sub_del(int argc, char *argv[]) +{ + subscription_cmd(argc, argv, OP_CONFIG_MODEL_SUB_DELETE); +} + +static void cmd_sub_ovwrt(int argc, char *argv[]) +{ + subscription_cmd(argc, argv, OP_CONFIG_MODEL_SUB_OVERWRITE); +} + +static void cmd_sub_del_all(int argc, char *argv[]) { uint16_t n; uint8_t msg[32]; int parm_cnt; - n = mesh_opcode_set(OP_CONFIG_MODEL_SUB_GET, msg); + n = mesh_opcode_set(OP_CONFIG_MODEL_SUB_DELETE_ALL, msg); parm_cnt = read_input_parameters(argc, argv); - if (parm_cnt != 2) { + if (parm_cnt != 2 && parm_cnt != 3) { bt_shell_printf("Bad arguments: %s\n", argv[1]); return bt_shell_noninteractive_quit(EXIT_FAILURE); } - /* Per Mesh Profile 4.3.2.27 */ /* Element Address */ put_le16(parms[0], msg + n); n += 2; + /* Model ID */ - put_le16(parms[1], msg + n); + n += put_model_id(msg + n, &parms[1], parm_cnt == 3); + + if (!config_send(msg, n, OP_CONFIG_MODEL_SUB_DELETE_ALL)) + return bt_shell_noninteractive_quit(EXIT_FAILURE); + + return bt_shell_noninteractive_quit(EXIT_SUCCESS); +} + +static void cmd_sub_get(int argc, char *argv[]) +{ + uint16_t n; + uint8_t msg[32]; + int parm_cnt; + bool vendor; + uint32_t opcode; + + parm_cnt = read_input_parameters(argc, argv); + if (parm_cnt != 2 && parm_cnt != 3) { + bt_shell_printf("Bad arguments: %s\n", argv[1]); + return bt_shell_noninteractive_quit(EXIT_FAILURE); + } + + vendor = (parm_cnt == 3); + opcode = !vendor ? OP_CONFIG_MODEL_SUB_GET : + OP_CONFIG_VEND_MODEL_SUB_GET; + n = mesh_opcode_set(opcode, msg); + + /* Element Address */ + put_le16(parms[0], msg + n); n += 2; + /* Model ID */ + n += put_model_id(msg + n, &parms[1], vendor); - if (!config_send(msg, n, OP_CONFIG_MODEL_SUB_GET)) + if (!config_send(msg, n, opcode)) return bt_shell_noninteractive_quit(EXIT_FAILURE); return bt_shell_noninteractive_quit(EXIT_SUCCESS); @@ -1564,9 +1625,15 @@ static const struct bt_shell_menu cfg_menu = { "Set heartbeat subscribe"}, {"hb-sub-get", NULL, cmd_hb_sub_get, "Get heartbeat subscribe"}, - {"sub-add", " ", cmd_sub_add, + {"sub-add", " [vendor]", cmd_sub_add, "Add subscription"}, - {"sub-get", " ", cmd_sub_get, + {"sub-del", " [vendor]", cmd_sub_del, + "Delete subscription"}, + {"sub-wrt", " [vendor]", cmd_sub_ovwrt, + "Overwrite subscription"}, + {"sub-del-all", " [vendor]", cmd_sub_del_all, + "Delete subscription"}, + {"sub-get", " [vendor]", cmd_sub_get, "Get subscription"}, {"node-reset", NULL, cmd_node_reset, "Reset a node and remove it from network"},