You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mynewt.apache.org by cc...@apache.org on 2016/08/08 01:14:30 UTC

[1/4] incubator-mynewt-core git commit: BLE Host - prep/exec tests: better mbuf leak check

Repository: incubator-mynewt-core
Updated Branches:
  refs/heads/develop 36de005b3 -> 51294d51a


BLE Host - prep/exec tests: better mbuf leak check

When ensuring no mbuf leaks at the end of the att_svr_test suite, also
ensure that each connection's prep list is empty.


Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/commit/a9e00919
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/tree/a9e00919
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/diff/a9e00919

Branch: refs/heads/develop
Commit: a9e009199a33c2d4edf94c9c608fea6d8a2879ec
Parents: f409079
Author: Christopher Collins <cc...@apache.org>
Authored: Sun Aug 7 17:59:02 2016 -0700
Committer: Christopher Collins <cc...@apache.org>
Committed: Sun Aug 7 18:11:00 2016 -0700

----------------------------------------------------------------------
 net/nimble/host/src/test/ble_att_svr_test.c |  9 ++++-
 net/nimble/host/src/test/ble_hs_test_util.c | 46 ++++++++++++++++--------
 net/nimble/host/src/test/ble_hs_test_util.h | 12 +++++--
 3 files changed, 50 insertions(+), 17 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/a9e00919/net/nimble/host/src/test/ble_att_svr_test.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/test/ble_att_svr_test.c b/net/nimble/host/src/test/ble_att_svr_test.c
index 86565e3..1509b41 100644
--- a/net/nimble/host/src/test/ble_att_svr_test.c
+++ b/net/nimble/host/src/test/ble_att_svr_test.c
@@ -2282,7 +2282,14 @@ TEST_CASE(ble_att_svr_test_indicate)
 
 TEST_SUITE(ble_att_svr_suite)
 {
-    tu_suite_set_post_test_cb(ble_hs_test_util_post_test, NULL);
+    /* When checking for mbuf leaks, ensure no stale prep entries. */
+    static struct ble_hs_test_util_mbuf_params mbuf_params = {
+        .prev_tx = 1,
+        .rx_queue = 1,
+        .prep_list = 0,
+    };
+
+    tu_suite_set_post_test_cb(ble_hs_test_util_post_test, &mbuf_params);
 
     ble_att_svr_test_mtu();
     ble_att_svr_test_read();

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/a9e00919/net/nimble/host/src/test/ble_hs_test_util.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/test/ble_hs_test_util.c b/net/nimble/host/src/test/ble_hs_test_util.c
index 54a3527..460642e 100644
--- a/net/nimble/host/src/test/ble_hs_test_util.c
+++ b/net/nimble/host/src/test/ble_hs_test_util.c
@@ -1286,7 +1286,7 @@ ble_hs_test_util_mbuf_chain_len(const struct os_mbuf *om)
 }
 
 int
-ble_hs_test_util_mbuf_count(void)
+ble_hs_test_util_mbuf_count(const struct ble_hs_test_util_mbuf_params *params)
 {
     const struct ble_att_prep_entry *prep;
     const struct os_mbuf_pkthdr *omp;
@@ -1296,14 +1296,17 @@ ble_hs_test_util_mbuf_count(void)
     int count;
     int i;
 
-    count = ble_hs_test_util_mbuf_mpool.mp_num_free;
-    count += ble_hs_test_util_mbuf_chain_len(ble_hs_test_util_prev_tx_cur);
-
     ble_hs_process_tx_data_queue();
     ble_hs_process_rx_data_queue();
-    STAILQ_FOREACH(omp, &ble_hs_test_util_prev_tx_queue, omp_next) {
-        om = OS_MBUF_PKTHDR_TO_MBUF(omp);
-        count += ble_hs_test_util_mbuf_chain_len(om);
+
+    count = ble_hs_test_util_mbuf_mpool.mp_num_free;
+
+    if (params->prev_tx) {
+        count += ble_hs_test_util_mbuf_chain_len(ble_hs_test_util_prev_tx_cur);
+        STAILQ_FOREACH(omp, &ble_hs_test_util_prev_tx_queue, omp_next) {
+            om = OS_MBUF_PKTHDR_TO_MBUF(omp);
+            count += ble_hs_test_util_mbuf_chain_len(om);
+        }
     }
 
     ble_hs_lock();
@@ -1313,12 +1316,16 @@ ble_hs_test_util_mbuf_count(void)
             break;
         }
 
-        SLIST_FOREACH(chan, &conn->bhc_channels, blc_next) {
-            count += ble_hs_test_util_mbuf_chain_len(chan->blc_rx_buf);
+        if (params->rx_queue) {
+            SLIST_FOREACH(chan, &conn->bhc_channels, blc_next) {
+                count += ble_hs_test_util_mbuf_chain_len(chan->blc_rx_buf);
+            }
         }
 
-        SLIST_FOREACH(prep, &conn->bhc_att_svr.basc_prep_list, bape_next) {
-            count += ble_hs_test_util_mbuf_chain_len(prep->bape_value);
+        if (params->prep_list) {
+            SLIST_FOREACH(prep, &conn->bhc_att_svr.basc_prep_list, bape_next) {
+                count += ble_hs_test_util_mbuf_chain_len(prep->bape_value);
+            }
         }
     }
     ble_hs_unlock();
@@ -1327,18 +1334,29 @@ ble_hs_test_util_mbuf_count(void)
 }
 
 void
-ble_hs_test_util_assert_mbufs_freed(void)
+ble_hs_test_util_assert_mbufs_freed(
+    const struct ble_hs_test_util_mbuf_params *params)
 {
+    static const struct ble_hs_test_util_mbuf_params dflt = {
+        .prev_tx = 1,
+        .rx_queue = 1,
+        .prep_list = 1,
+    };
+
     int count;
 
-    count = ble_hs_test_util_mbuf_count();
+    if (params == NULL) {
+        params = &dflt;
+    }
+
+    count = ble_hs_test_util_mbuf_count(params);
     TEST_ASSERT(count == ble_hs_test_util_mbuf_mpool.mp_num_blocks);
 }
 
 void
 ble_hs_test_util_post_test(void *arg)
 {
-    ble_hs_test_util_assert_mbufs_freed();
+    ble_hs_test_util_assert_mbufs_freed(arg);
 }
 
 static int

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/a9e00919/net/nimble/host/src/test/ble_hs_test_util.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/test/ble_hs_test_util.h b/net/nimble/host/src/test/ble_hs_test_util.h
index 0ae6cf5..3320e9b 100644
--- a/net/nimble/host/src/test/ble_hs_test_util.h
+++ b/net/nimble/host/src/test/ble_hs_test_util.h
@@ -44,6 +44,12 @@ struct ble_hs_test_util_flat_attr {
     uint16_t value_len;
 };
 
+struct ble_hs_test_util_mbuf_params {
+    unsigned prev_tx:1;
+    unsigned rx_queue:1;
+    unsigned prep_list:1;
+};
+
 void ble_hs_test_util_prev_tx_enqueue(struct os_mbuf *om);
 struct os_mbuf *ble_hs_test_util_prev_tx_dequeue(void);
 struct os_mbuf *ble_hs_test_util_prev_tx_dequeue_pullup(void);
@@ -160,8 +166,10 @@ int ble_hs_test_util_gatt_write_long_flat(uint16_t conn_handle,
                                           uint16_t attr_handle,
                                           const void *data, uint16_t data_len,
                                           ble_gatt_attr_fn *cb, void *cb_arg);
-int ble_hs_test_util_mbuf_count(void);
-void ble_hs_test_util_assert_mbufs_freed(void);
+int ble_hs_test_util_mbuf_count(
+    const struct ble_hs_test_util_mbuf_params *params);
+void ble_hs_test_util_assert_mbufs_freed(
+    const struct ble_hs_test_util_mbuf_params *params);
 void ble_hs_test_util_post_test(void *arg);
 void ble_hs_test_util_init(void);
 


[2/4] incubator-mynewt-core git commit: BLE Host - gap test needs to hb when checking tmo.

Posted by cc...@apache.org.
BLE Host - gap test needs to hb when checking tmo.

When ensuring that the passage of time causes no effects, the test node
needs to call ble_hs_heartbeat() to let the host know that time has
passed.  This is only necessary because the OS is not running during
this test.


Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/commit/f409079f
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/tree/f409079f
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/diff/f409079f

Branch: refs/heads/develop
Commit: f409079f316848f4121fed80311bb9f8289a9a54
Parents: ee510c0
Author: Christopher Collins <cc...@apache.org>
Authored: Sun Aug 7 17:58:16 2016 -0700
Committer: Christopher Collins <cc...@apache.org>
Committed: Sun Aug 7 18:11:00 2016 -0700

----------------------------------------------------------------------
 net/nimble/host/src/test/ble_gap_test.c | 1 +
 1 file changed, 1 insertion(+)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/f409079f/net/nimble/host/src/test/ble_gap_test.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/test/ble_gap_test.c b/net/nimble/host/src/test/ble_gap_test.c
index 2d4c551..1943d01 100644
--- a/net/nimble/host/src/test/ble_gap_test.c
+++ b/net/nimble/host/src/test/ble_gap_test.c
@@ -2324,6 +2324,7 @@ ble_gap_test_util_conn_forever(void)
 
     /* Advance 100 seconds; ensure no timeout reported. */
     os_time_advance(100 * OS_TICKS_PER_SEC);
+    ble_gap_heartbeat();
     TEST_ASSERT(ble_gap_test_conn_event_type == -1);
     TEST_ASSERT(ble_gap_conn_active());
 }


[4/4] incubator-mynewt-core git commit: BLE Host - Fix unit test SIGSEGV.

Posted by cc...@apache.org.
BLE Host - Fix unit test SIGSEGV.

An array was missing a '0' terminator.


Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/commit/51294d51
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/tree/51294d51
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/diff/51294d51

Branch: refs/heads/develop
Commit: 51294d51a469c9d193611833313eb61a9a5839dc
Parents: a9e0091
Author: Christopher Collins <cc...@apache.org>
Authored: Sun Aug 7 18:13:26 2016 -0700
Committer: Christopher Collins <cc...@apache.org>
Committed: Sun Aug 7 18:13:26 2016 -0700

----------------------------------------------------------------------
 net/nimble/host/src/test/ble_hs_test_util.c | 3 +++
 1 file changed, 3 insertions(+)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/51294d51/net/nimble/host/src/test/ble_hs_test_util.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/test/ble_hs_test_util.c b/net/nimble/host/src/test/ble_hs_test_util.c
index 460642e..30926b6 100644
--- a/net/nimble/host/src/test/ble_hs_test_util.c
+++ b/net/nimble/host/src/test/ble_hs_test_util.c
@@ -802,6 +802,9 @@ ble_hs_test_util_set_our_irk(const uint8_t *irk, int fail_idx,
             BLE_HS_TEST_UTIL_LE_OPCODE(BLE_HCI_OCF_LE_ADD_RESOLV_LIST),
             ble_hs_test_util_exp_hci_status(3, fail_idx, hci_status),
         },
+        {
+            0
+        }
     }));
 
     rc = ble_hs_pvcy_set_our_irk(irk);


[3/4] incubator-mynewt-core git commit: BLE Host - validate write upon rx of prep write

Posted by cc...@apache.org.
BLE Host - validate write upon rx of prep write

Before, upon receiving a prepare write request, the code was only
verifying that the specified attribute existed.  There are a number of
checks that need to be performed in addition to that one:

1. Insufficient authorization.
2. Insufficient authentication.
3. Insufficient encryption key size.
4. Insufficient encryption (check if persisted bond exists for
   unencrypted peer).
5. Invalid handle.
6. Write not permitted.

The host does not properly handle 3 and 4 yet (for any writes).

Now the host rejects a prepare write request if any of the above issues
are detected (except for 3 and 4).


Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/commit/ee510c02
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/tree/ee510c02
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/diff/ee510c02

Branch: refs/heads/develop
Commit: ee510c02dff3daba9808317b33f7442375bc6f55
Parents: 36de005
Author: Christopher Collins <cc...@apache.org>
Authored: Sun Aug 7 17:48:44 2016 -0700
Committer: Christopher Collins <cc...@apache.org>
Committed: Sun Aug 7 18:11:00 2016 -0700

----------------------------------------------------------------------
 net/nimble/host/src/ble_att_svr.c           | 69 ++++++++++++++----------
 net/nimble/host/src/test/ble_att_svr_test.c | 62 +++++++++++++++++----
 2 files changed, 95 insertions(+), 36 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ee510c02/net/nimble/host/src/ble_att_svr.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/ble_att_svr.c b/net/nimble/host/src/ble_att_svr.c
index 1b420b5..f282093 100644
--- a/net/nimble/host/src/ble_att_svr.c
+++ b/net/nimble/host/src/ble_att_svr.c
@@ -237,9 +237,9 @@ ble_att_svr_get_sec_state(uint16_t conn_handle,
 }
 
 static int
-ble_att_svr_check_security(uint16_t conn_handle, int is_read,
-                           struct ble_att_svr_entry *entry,
-                           uint8_t *out_att_err)
+ble_att_svr_check_perms(uint16_t conn_handle, int is_read,
+                        struct ble_att_svr_entry *entry,
+                        uint8_t *out_att_err)
 {
     struct ble_gap_sec_state sec_state;
     int author;
@@ -248,10 +248,20 @@ ble_att_svr_check_security(uint16_t conn_handle, int is_read,
     int rc;
 
     if (is_read) {
+        if (!(entry->ha_flags & BLE_ATT_F_READ)) {
+            *out_att_err = BLE_ATT_ERR_READ_NOT_PERMITTED;
+            return BLE_HS_ENOTSUP;
+        }
+
         enc = entry->ha_flags & BLE_ATT_F_READ_ENC;
         authen = entry->ha_flags & BLE_ATT_F_READ_AUTHEN;
         author = entry->ha_flags & BLE_ATT_F_READ_AUTHOR;
     } else {
+        if (!(entry->ha_flags & BLE_ATT_F_WRITE)) {
+            *out_att_err = BLE_ATT_ERR_WRITE_NOT_PERMITTED;
+            return BLE_HS_ENOTSUP;
+        }
+
         enc = entry->ha_flags & BLE_ATT_F_WRITE_ENC;
         authen = entry->ha_flags & BLE_ATT_F_WRITE_AUTHEN;
         author = entry->ha_flags & BLE_ATT_F_WRITE_AUTHOR;
@@ -264,6 +274,8 @@ ble_att_svr_check_security(uint16_t conn_handle, int is_read,
 
     rc = ble_att_svr_get_sec_state(conn_handle, &sec_state);
     if (rc != 0) {
+        /* Peer no longer connected. */
+        *out_att_err = 0;
         return rc;
     }
 
@@ -300,13 +312,7 @@ ble_att_svr_read(uint16_t conn_handle,
     att_err = 0;    /* Silence gcc warning. */
 
     if (conn_handle != BLE_HS_CONN_HANDLE_NONE) {
-        if (!(entry->ha_flags & BLE_ATT_F_READ)) {
-            att_err = BLE_ATT_ERR_READ_NOT_PERMITTED;
-            rc = BLE_HS_ENOTSUP;
-            goto err;
-        }
-
-        rc = ble_att_svr_check_security(conn_handle, 1, entry, &att_err);
+        rc = ble_att_svr_check_perms(conn_handle, 1, entry, &att_err);
         if (rc != 0) {
             goto err;
         }
@@ -448,13 +454,7 @@ ble_att_svr_write(uint16_t conn_handle, struct ble_att_svr_entry *entry,
     BLE_HS_DBG_ASSERT(!ble_hs_locked_by_cur_task());
 
     if (conn_handle != BLE_HS_CONN_HANDLE_NONE) {
-        if (!(entry->ha_flags & BLE_ATT_F_WRITE)) {
-            att_err = BLE_ATT_ERR_WRITE_NOT_PERMITTED;
-            rc = BLE_HS_ENOTSUP;
-            goto done;
-        }
-
-        rc = ble_att_svr_check_security(conn_handle, 0, entry, &att_err);
+        rc = ble_att_svr_check_perms(conn_handle, 0, entry, &att_err);
         if (rc != 0) {
             goto done;
         }
@@ -2341,19 +2341,17 @@ ble_att_svr_prep_write(uint16_t conn_handle,
     while (!SLIST_EMPTY(prep_list)) {
         ble_att_svr_prep_extract(prep_list, &attr_handle, &om);
 
+        /* Attribute existence was verified during prepare-write request
+         * processing.
+         */
         attr = ble_att_svr_find_by_handle(attr_handle);
-        *err_handle = attr_handle;
-        if (attr == NULL) {
-            rc = BLE_ATT_ERR_INVALID_HANDLE;
-        } else {
-            rc = ble_att_svr_write(conn_handle, attr, 0, &om, &att_err);
-            if (rc != 0) {
-                rc = att_err;
-            }
-        }
+        BLE_HS_DBG_ASSERT(attr != NULL);
+
+        rc = ble_att_svr_write(conn_handle, attr, 0, &om, &att_err);
         os_mbuf_free_chain(om);
         if (rc != 0) {
-            return rc;
+            *err_handle = attr_handle;
+            return att_err;
         }
     }
 
@@ -2400,12 +2398,29 @@ ble_att_svr_rx_prep_write(uint16_t conn_handle, struct os_mbuf **rxom)
     os_mbuf_adj(*rxom, BLE_ATT_PREP_WRITE_CMD_BASE_SZ);
 
     attr_entry = ble_att_svr_find_by_handle(req.bapc_handle);
+
+    /* A prepare write request gets rejected for the following reasons:
+     * 1. Insufficient authorization.
+     * 2. Insufficient authentication.
+     * 3. Insufficient encryption key size (XXX: Not checked).
+     * 4. Insufficient encryption.
+     * 5. Invalid handle.
+     * 6. Write not permitted.
+     */
+
+    /* <5> */
     if (attr_entry == NULL) {
         rc = BLE_HS_ENOENT;
         att_err = BLE_ATT_ERR_INVALID_HANDLE;
         goto done;
     }
 
+    /* <1>, <2>, <4>, <6> */
+    rc = ble_att_svr_check_perms(conn_handle, 0, attr_entry, &att_err);
+    if (rc != 0) {
+        goto done;
+    }
+
     prep_entry = ble_att_svr_prep_alloc();
     if (prep_entry == NULL) {
         att_err = BLE_ATT_ERR_PREPARE_QUEUE_FULL;

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ee510c02/net/nimble/host/src/test/ble_att_svr_test.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/test/ble_att_svr_test.c b/net/nimble/host/src/test/ble_att_svr_test.c
index 09e7bf9..86565e3 100644
--- a/net/nimble/host/src/test/ble_att_svr_test.c
+++ b/net/nimble/host/src/test/ble_att_svr_test.c
@@ -319,6 +319,15 @@ ble_att_svr_test_misc_attr_fn_w_2(uint16_t conn_handle, uint16_t attr_handle,
     }
 }
 
+static int
+ble_att_svr_test_misc_attr_fn_w_fail(uint16_t conn_handle,
+                                     uint16_t attr_handle,
+                                     uint8_t op, uint16_t offset,
+                                     struct os_mbuf **om, void *arg)
+{
+    return BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN;
+}
+
 static void
 ble_att_svr_test_misc_verify_w_1(void *data, int data_len)
 {
@@ -2071,6 +2080,7 @@ TEST_CASE(ble_att_svr_test_read_group_type)
 
 TEST_CASE(ble_att_svr_test_prep_write)
 {
+    struct ble_hs_conn *conn;
     uint16_t conn_handle;
     int i;
 
@@ -2089,9 +2099,22 @@ TEST_CASE(ble_att_svr_test_prep_write)
     ble_att_svr_test_misc_register_uuid16(0x8989, HA_FLAG_PERM_RW, 2,
                                           ble_att_svr_test_misc_attr_fn_w_2);
 
-    /* Register a third attribute that is not writable. */
+    /* 3: not writable. */
     ble_att_svr_test_misc_register_uuid16(0xabab, BLE_ATT_F_READ, 3,
                                           ble_att_svr_test_misc_attr_fn_r_1);
+    /* 4: Encryption required. */
+    ble_att_svr_test_misc_register_uuid16(
+        0xabac, BLE_ATT_F_WRITE | BLE_ATT_F_WRITE_ENC, 4,
+        ble_att_svr_test_misc_attr_fn_w_1);
+
+    /* 5: Encryption+authentication required. */
+    ble_att_svr_test_misc_register_uuid16(
+        0xabad, BLE_ATT_F_WRITE | BLE_ATT_F_WRITE_ENC | BLE_ATT_F_WRITE_AUTHEN,
+        5, ble_att_svr_test_misc_attr_fn_w_1);
+
+    /* 6: Write callback always fails. */
+    ble_att_svr_test_misc_register_uuid16(
+        0xabae, BLE_ATT_F_WRITE, 6, ble_att_svr_test_misc_attr_fn_w_fail);
 
     /*** Empty write succeeds. */
     ble_att_svr_test_misc_exec_write(conn_handle, BLE_ATT_EXEC_WRITE_F_CONFIRM,
@@ -2104,6 +2127,28 @@ TEST_CASE(ble_att_svr_test_prep_write)
     ble_att_svr_test_misc_prep_write(conn_handle, 53525, 0, data, 10,
                                      BLE_ATT_ERR_INVALID_HANDLE);
 
+    /*** Failure due to write-not-permitted. */
+    ble_att_svr_test_misc_prep_write(conn_handle, 3, 0, data, 35,
+                                     BLE_ATT_ERR_WRITE_NOT_PERMITTED);
+
+    /*** Failure due to insufficient authentication (encryption required). */
+    ble_att_svr_test_misc_prep_write(conn_handle, 4, 0, data, 1,
+                                     BLE_ATT_ERR_INSUFFICIENT_AUTHEN);
+
+    /*** Encrypt connection; ensure previous prep write now succeeds. */
+    ble_hs_lock();
+    conn = ble_hs_conn_find(2);
+    TEST_ASSERT_FATAL(conn != NULL);
+    conn->bhc_sec_state.encrypted = 1;
+    ble_hs_unlock();
+
+    ble_att_svr_test_misc_prep_write(conn_handle, 4, 0, data, 1, 0);
+    ble_att_svr_test_misc_exec_write(conn_handle, 0, 0, 0);
+
+    /*** Failure due to insufficient authentication (not authenticated). */
+    ble_att_svr_test_misc_prep_write(conn_handle, 5, 0, data, 35,
+                                     BLE_ATT_ERR_INSUFFICIENT_AUTHEN);
+
     /*** Failure for write starting at nonzero offset. */
     ble_att_svr_test_misc_prep_write(conn_handle, 1, 1, data, 10, 0);
     ble_att_svr_test_misc_exec_write(conn_handle, BLE_ATT_EXEC_WRITE_F_CONFIRM,
@@ -2136,14 +2181,6 @@ TEST_CASE(ble_att_svr_test_prep_write)
                                      BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN, 1);
     ble_att_svr_test_misc_verify_w_1(NULL, 0);
 
-    /*** Failure due to attribute callback. */
-    ble_att_svr_test_misc_prep_write(conn_handle, 3, 0, data, 35, 0);
-    ble_att_svr_test_misc_prep_write(conn_handle, 3, 35, data + 35, 43, 0);
-    ble_att_svr_test_misc_prep_write(conn_handle, 3, 78, data + 78, 1, 0);
-    ble_att_svr_test_misc_exec_write(conn_handle, BLE_ATT_EXEC_WRITE_F_CONFIRM,
-                                     BLE_ATT_ERR_WRITE_NOT_PERMITTED, 0);
-    ble_att_svr_test_misc_verify_w_1(NULL, 0);
-
     /*** Successful two part write. */
     ble_att_svr_test_misc_prep_write(conn_handle, 1, 0, data, 20, 0);
     ble_att_svr_test_misc_prep_write(conn_handle, 1, 20, data + 20, 20, 0);
@@ -2188,6 +2225,13 @@ TEST_CASE(ble_att_svr_test_prep_write)
                                      0, 0);
     ble_att_svr_test_misc_verify_w_1(data, 12);
     ble_att_svr_test_misc_verify_w_2(data, 61);
+
+    /*** Fail due to attribute callback error. */
+    ble_att_svr_test_misc_prep_write(conn_handle, 6, 0, data, 35, 0);
+    ble_att_svr_test_misc_prep_write(conn_handle, 6, 35, data + 35, 43, 0);
+    ble_att_svr_test_misc_prep_write(conn_handle, 6, 78, data + 78, 1, 0);
+    ble_att_svr_test_misc_exec_write(conn_handle, BLE_ATT_EXEC_WRITE_F_CONFIRM,
+                                     BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN, 6);
 }
 
 TEST_CASE(ble_att_svr_test_notify)