ANCS example

[bperrin2]

Hi,

I have tried the following example:
infocenter.nordicsemi.com/index.jsp

Everything works fine (I can generate a notification via a calendar event and see it via the nRF serial port) except "Testing with nRF Connect". No one service is discovered and hence I have no means to send '00 18 06 02 01 02 03 04' to characteristic 0x120D.

I'm using nRF Connect 1.8.6, SDK15.0 on a nRF52840-Preview-DK and iOS 11.4.1.

In fact, I would like to check if a hacker application installed on an iOS device can fake notifications (as you propose to do with nRF Connect).

I was surprised that pairing information is shared between applications. Moreover, an existing opened BLE connection to a device can be also shared with another application.

I tried to write my own iOS test application. When I open a connection someone close it just after and I have no idea for which reason. The same happens with LightBlue. However, I noticed that a "Forget this device" in the Preferences and an "Erase bonds" on the nRF followed by a connection (either from my test program or LightBlue) don't do that: the connection stay opened.

So I have the following questions:
- Do I use nrf Connect incorrectly? How can I send '00 18 ...' to 0x120D?
- Is it possible to have fake notifications from a hacked appli?
- What can be the reason of the close after open?

Thanks in advance for helping me.

Bernard

[Mttrinh]

Hi,

Have you modified the ANCS example? Can you give me a step by step procedure on how to reproduce?

[bperrin2]

Hi,

To Mttrinh:
No I haven't modified the ANCS example. But I added in components/ble/ble_advertising.c the following lines:
   // Added to advertize only on channel 37
   p_advertising->adv_params.channel_mask[4] = 0xc0;

This is done to increase the chance to track the connection opening with my TI sniffer USB dongle.

I have followed all the steps described in:
Software Development Kit > nRF5 SDK > nRF5 SDK v15.0.0 > Examples > Bluetooth low energy examples > BLE Peripheral

To Aleksander:
Thank you for your relevant information and your advice concerning Android. I was trying nRF Connect with an Android but wasn't able to discover the ANCS service too (similar to iOS).

Concerning nRF Connect for Desktop, I tried to reflash the applicaton on the board doing "make erase; make flash_softdevice; make flash".

However I got the same error. Isn't it equivalent to restart with button 2 pressed?

Then, I get on the console: "<info> app: Erase bonds!". I also used the "Delete bond information" from the setup menu in Connection Map of nRF Connect.

When I play with an iPad, the ANCS example seems to work well. I'm asked for pairing during the first connection. If I add an event on the Calendar, I get it in the nRF attached console:
<info> app:
Notification
<info> app: Event: Added
<info> app: Category ID: Schedule
<info> app: Category Cnt:1
<info> app: UID: 7
<info> app: Flags:
<info> app: Negative Action
<info> app: App Identifier: com.apple.mobilecal
<info> app: Title: Test meeting
<info> app: Subtitle: (N/A)
<info> app: Message: Today at 14:15
Bruxelles
<info> app: Message Size: 24
<info> app: Date: 20180725T141500
<info> app: Positive Action Label: (N/A)
<info> app: Negative Action Label: Clear
<info> app: Request for com.apple.mobilecal:
<info> app: Display Name: Calendar
<info> app: Performing Negative Action.
<info> app:
Notification
<info> app: Event: Removed
<info> app: Category ID: Schedule
<info> app: Category Cnt:0
<info> app: UID: 7
<info> app: Flags:
<info> app: Negative Action

But "Testing with nRF Connect" still fails as before even after reflashing.

I was also surprised to see when the boards is rebooted, iOS automatically disconnect & reconnect. The connection to the peripheral is always active. This could be bad for the peripheral batteries. What do you suggest: change the BLE connection event period to a longer value?

Thanks for your help.

Bernard

[Aleksander Nowakowski]

Hi, It may be, that ANCS sample (or the profile) only uses ANCS service on the phone. The peripheral may not have any services, that's why you don't see them. I'm guessing here, but nRF Connect on Android should see ANCS service without problems.

You may test it by starting advertising with nRF Connect on iOS and connecting to it using nRF Connect on Android. You should see there ANCS service.

I don't know specs for ANCS. Perhaps it defines the preferred connection interval. I would assume that an ANCS device should always be connected. But Mttrinh may know more.

[bperrin2]

Hi Aleksander,

I think I was wrong concerning who is offering a service: I though it was the peripheral but in fact it is the central (the iPad).

Concerning the demo that I followed step by step as indicated in the Nordic web page of "Apple Notification Center Service (ANCS) Client Application":

The bonding still fails with the following error messages:
16:56:51.5410 Error when calling replySecParams: Error: Error occured when replying sec params. Errorcode: NRF_ERROR_INTERNAL (0x3)
16:56:51.5430 Received status with code 4 Unknown value, message: 'Error sending packet to target. Code #13'

When I compare with the sniffer a trace of an iPad with the nRF Connect on mac after they connected to the peripheral, the only common trace is:
S > M: SM_Security_Req
M > S: SM_Pairing_Req
S > M: SM_Pairing_Rsp

However, it stops with nRF Connect on mac when it continues with the iPad (as soon the pairing dialog box is accepted):
M > S: SM_Pairing_Confirm
S > M: SM_Pairing_Confirm
M > S: SM_Pairing_Random
S > M: SM_Pairing_Random
...

I tried to enable "Auto reply security request", tried to set IO capabilities to "No keyboard, no display", selecting "Perform bonding", using or not "Enable LE Secure Connection pairing", but all failed similarily.

I tried to use nRF connect with Windows 7 but when I try to connect to the device I get:
Error while setting up device 000683103947: Open (SetCommState): File not found

However, Windows 7 is emulated in vmware. Could this be the reason?

I also tried with ubuntu (still emulated under vmware) but got warnings and finally the launching of Bluetooth Low Energy app (official v2.2.0) hangs:
bpe:Downloads$ ./nrfconnect-2.4.0-x86_64.AppImage
installed: X-AppImage-BuildId=8d534b00-72ea-11a8-203c-e9bb3b686776 image: X-AppImage-BuildId=8d534b00-72ea-11a8-203c-e9bb3b686776
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[2945:0802/080616.879957:ERROR:gles2_cmd_decoder.cc(2510)] [GroupMarkerNotSet(crbug.com/242999)!:D02ADDD607340000]GL ERROR :GL_INVALID_VALUE : BackFramebuffer::Create: <- error from previous GL command
[2945:0802/080617.497259:ERROR:gles2_cmd_decoder.cc(2510)] [GroupMarkerNotSet(crbug.com/242999)!:D0B32AD707340000]GL ERROR :GL_INVALID_VALUE : BackFramebuffer::Create: <- error from previous GL command
[2945:0802/080617.504359:ERROR:gles2_cmd_decoder.cc(2510)] [GroupMarkerNotSet(crbug.com/242999)!:D0DC71D707340000]GL ERROR :GL_INVALID_VALUE : BackFramebuffer::Create: <- error from previous GL command
[08:06:19:0745] [info] Checking for update
[08:06:21:0646] [info] Update for version 2.4.0 is not available (latest version: 2.4.0, downgrade is disallowed.
[2945:0802/080628.064196:ERROR:gles2_cmd_decoder.cc(2510)] [GroupMarkerNotSet(crbug.com/242999)!:D01781D707340000]GL ERROR :GL_INVALID_VALUE : BackFramebuffer::Create: <- error from previous GL command
^Cbpe:Downloads$

I really would like to see this ANCS example working.

Best regards,

Bernard

[Mttrinh]

Haven't been able to reproduce the issue, tried it on both windows and a Mac mini. Can you try it with a fresh copy of the example? 

Also, is it possible to upload your whole project so I can test it over here?

[bperrin2]

Hi Mttrinh,

sorry for the delay but I'm still interrested about these questions.

I tried with a fresh copy of the example I downloaded from developer.nordicsemi.com/.../ using nRF5_SDK_15.2.0_9412b96.zip.

Once download I programmed a nRF52840DK board from Segger Embedded Studio loading project at nRF5_SDK_15.2.0_9412b96/examples/ble_peripheral/ble_app_ancs_c/pca10056/s140/ses/ble_app_ancs_c_pca10056_s140.emProject and programmed the board.

I removed the board to do not be confused with a second one, a nRF52832DK used to be a server with nRF Connect (v2.5.0) on a Mac. I programmed the board as proposed by the tool and loaded a Server Setup placed in nRF5_SDK_15.2.0_9412b96/examples/ble_peripheral/ble_app_ancs_c/ANCS_central.ncs and applied it to the device.

I reconnected nRF52840DK and started CoolTerm and saw messages like:
<info> app: Fast advertising
<info> app: Slow advertising

In nRF Connect, I disabled Auto reply security requests to get the opportunity to define the Pairing request parameters. So I was prompted when I tried to connect to the ANCS peripheral and I selected:

• No keyboard, no display
• Enable LE Secure Connection pairing
• Perform bonding

Then, I got an error in a dialog box:
Failed to reply security parameters. (NRF_ERROR_INTERNAL)

with the following trace in the log file:
type: VENDOR_SPECIFIC reliable:yes seq#:7 ack#:3 payload_length:113 data_integrity:1 header_checksum:d2 err_code:0
2018-10-02T11:47:13.922Z WARN Error when calling replySecParams: Error: Error occured when replying sec params. Errorcode: NRF_ERROR_INTERNAL (0x3)

2018-10-02T11:47:13.924Z DEBUG ReplySecParams, secParams: null
2018-10-02T11:47:13.924Z ERROR Received status with code 4 Unknown value, message: 'Error sending packet to target. Code #13'
2018-10-02T11:47:41.851Z DEBUG 1098/ 0 <- [02 19 00 00 00 01 00 00 01 01 00 ]
type: VENDOR_SPECIFIC reliable:yes seq#:3 ack#:7 payload_length:b data_integrity:1 header_checksum:47 err_code:0
2018-10-02T11:47:41.851Z DEBUG 1141 -> []
type: ACK reliable: no seq#:0 ack#:4 payload_length:0 data_integrity:0 err_code:0
2018-10-02T11:47:41.851Z ERROR Failed to decode event, error code is 9.

In CoolTerm, I got:
<info> app: Connected.
<info> peer_manager_handler: Connection security failed: role: Peripheral, conn_handle: 0x0, procedure: Bonding, error: 1

I tried to enable Auto reply security requests and defined the security parameters: the result is similar.

I tried many times, playing with the security parameters, erasing bonds (nRF52840DK restart with button2 pressed) before each attempt, nothing works.

Do you see something wrong here above?

Thanks for your support.

Bernard