apache / apache/mynewt-nimble

NimBLE GATT server violates Write Request response ordering

Open
#2,163 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
893
Forks
512
Avg merge
13d 31m
Merged PRs (30d)
7

Description

**Summary**
When a client writes to a control point characteristic using ATT_WriteRequest, NimBLE allows the application to start sending notifications/indications (data streaming) before the stack sends the corresponding ATT_WriteResponse for that write request.
This results in out-of-order ATT/GATT procedure behavior: the server processes the command and transmits follow-up data prior to acknowledging the write request.

**Expected Behavior**
For a Write Request:
Server should send ATT_WriteResponse first (acknowledge write request).
Only then should the application begin sending any related Notifications/Indications (e.g., historical data stream) triggered by that write.

**Actual Behavior**
Application callback for the write is invoked.
Inside the callback, application calls ble_gattc_notify_*() / ble_gatts_indicate_*() (or service helper does so).
These notifications/indications are transmitted before the stack sends ATT_WriteResponse.
The ATT_WriteResponse is only sent after the access callback returns.

**Impact**
Some clients may treat notifications/indications received before the write response as protocol/procedure violation or unexpected sequencing.
Can break interoperability for control point / procedure-style characteristics (e.g., RACP-like flows).

**Evidence / Reference in NimBLE Example**
A similar ordering exists in the Alert Notification Service example:
File: ble_svc_ans.c
Function: ble_svc_ans_access()
Case: Write Request to BLE_SVC_ANS_CHR_UUID16_ALERT_NOT_CTRL_PT
Behavior: ble_svc_ans_new_alert_notify() is called inside the access callback before the stack sends the ATT_WriteResponse, because the response is sent only after ble_svc_ans_access() exits.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading ble_svc_ans.c and tracing ble_svc_ans_access(), especially the write-request case for BLE_SVC_ANS_CHR_UUID16_ALERT_NOT_CTRL_PT and its call to ble_svc_ans_new_alert_notify(). Confirm where the ATT_WriteResponse is emitted relative to the callback; done means related notifications or indications are sent only after that response.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
embedded-iot, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.