ATT server incorrectly handles authorization during Write Long procedure
- Dominant language
- C
- Stars
- 893
- Forks
- 512
- Avg merge
- 13d 31m
- Merged PRs (30d)
- 7
Description
When operating in the server role, Nimble incorrectly handles authorization checks during a Write Long Procedure. Instead of rejecting an unauthorized ATT_PREPARE_WRITE_REQ, it accepts it and only returns an error during the Execute Write phase.
Current behavior:
1. Client sends an ATT_Prepare_Write_Request.
2. Nimble responds with ATT_Prepare_Write_Response packet
3. Client sends an ATT_Execute_Write_Request
4. Nimble responds with an ATT_Error_Response (Insufficient Authorization)
Expected behavior:
Based on Core Specification 6.3, Vol 3, Part G, Section 4.9.4 (Write Long Characteristic Value), the server shall send an ATT_ERROR_RSP in response to an ATT_PREPARE_WRITE_REQ if the client has insufficient authorization.
1. Client sends an ATT_Prepare_Write_request
2. Nimble responds with ATT_Error_Response (Insufficient Authorization)
This affects GATT/SR/GAW/BI-11-C qualification test case
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running or locating the GATT/SR/GAW/BI-11-C qualification test and trace the server's handling of ATT_Prepare_Write_Request authorization. Compare the prepare and execute phases described in the issue; done means an unauthorized prepare request receives ATT_Error_Response with Insufficient Authorization immediately.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100