Bug 345581

You filed the bug against bluez-gnome, but gave the version numbers for
gnome-bluetooth...

I believe this is already fixed in bluez-gnome 0.14-8 (which would mean it's a
dupe of bug #326231)

Sorry,  I'll change it go bluez-gnome.  My bluez-gnome version is 0.14-8,
obexftp 1.3-8, gnome-vfs2-obexftp 0.4-2.

I don't think it is a dupe since that bug talks about missing
gnome-vfs2-obexftp, but I have those packages already.

(In reply to comment #0)
> Description of problem:
> I select "Browse Device..." on the bluetooth applet and select a device to
> browse.  I always get a message "Couldn't display "obex://[00:0e:a1:32:fe:e6]".
> <cr> check if service is available".  I get this type of message when trying to
> browse a phone or a fc7 machine.  There is no error in the /var/log/messages and
> no selinux warning so I can't tell if this is a bug in the browse function or if
> I'm really missing the "service".  I have "gnome-obex-server" running on the fc7
> machine but the message is the same.

gnome-obex-server doesn't do ObexFTP (so you can't browse it), only ObexPush
(meaning you can push files to it from your phone, or using
nautilus-sendto/gnome-obex-send).

What phone are you using? Do you see any errors on the command-line running
"gnomevfs-ls obex://[00:0e:a1:32:fe:e6]"?

I have a LG CU500.  When I do the command you suggested I get "Error opening: 
Service not availabile" or "Error opening: Internal error".  No messages in
/var/log/messages.

sdptool tells gives me the output below.

[bikehead@mimzy ~]$ sdptool browse 00:12:56:E0:C1:79

Browsing 00:12:56:E0:C1:79 ...

Service Name: OBEX Object Push

Service RecHandle: 0x10000

Service Class ID List:

  "OBEX Object Push" (0x1105)

Protocol Descriptor List:

  "L2CAP" (0x0100)

  "RFCOMM" (0x0003)

    Channel: 6

  "OBEX" (0x0008)

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "OBEX Object Push" (0x1105)

    Version: 0x0100



Service Name: OBEX File Transfer

Service RecHandle: 0x10001

Service Class ID List:

  "OBEX File Transfer" (0x1106)

Protocol Descriptor List:

  "L2CAP" (0x0100)

  "RFCOMM" (0x0003)

    Channel: 7

  "OBEX" (0x0008)

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "OBEX File Transfer" (0x1106)

    Version: 0x0100



Service Name: LG Sync SPP

Service RecHandle: 0x10002

Service Class ID List:

  "Serial Port" (0x1101)

Protocol Descriptor List:

  "L2CAP" (0x0100)

  "RFCOMM" (0x0003)

    Channel: 16

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "Serial Port" (0x1101)

    Version: 0x0100



Service Name: AV Audio Source

Service RecHandle: 0x10003

Service Class ID List:

  "Audio Source" (0x110a)

Protocol Descriptor List:

  "L2CAP" (0x0100)

    PSM: 25

  "AVDTP" (0x0019)

    uint16: 0x100

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "Advanced Audio" (0x110d)

    Version: 0x0100



Service Name: AV Remote Control Target

Service RecHandle: 0x10004

Service Class ID List:

  "AV Remote Target" (0x110c)

Protocol Descriptor List:

  "L2CAP" (0x0100)

    PSM: 23

  "AVCTP" (0x0017)

    uint16: 0x100

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "AV Remote" (0x110e)

    Version: 0x0100



Service Name: Audio Gateway

Service RecHandle: 0x10005

Service Class ID List:

  "Headset Audio Gateway" (0x1112)

  "Generic Audio" (0x1203)

Protocol Descriptor List:

  "L2CAP" (0x0100)

  "RFCOMM" (0x0003)

    Channel: 3

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "Headset" (0x1108)

    Version: 0x0100



Service Name: Audio Gateway

Service RecHandle: 0x10006

Service Class ID List:

  "Handfree Audio Gateway" (0x111f)

  "Generic Audio" (0x1203)

Protocol Descriptor List:

  "L2CAP" (0x0100)

  "RFCOMM" (0x0003)

    Channel: 4

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "Handsfree" (0x111e)

    Version: 0x0101



Service Name: QC Dial-up Networking

Service RecHandle: 0x10007

Service Class ID List:

  "Dialup Networking" (0x1103)

Protocol Descriptor List:

  "L2CAP" (0x0100)

  "RFCOMM" (0x0003)

    Channel: 8

Language Base Attr List:

  code_ISO639: 0x656e

  encoding:    0x6a

  base_offset: 0x100

Profile Descriptor List:

  "Dialup Networking" (0x1103)

    Version: 0x0100

I have the same problem:

[evad@dell640m ~]$ gnomevfs-ls obex://[00:17:83:36:f7:4e]/
Error opening: Service not available

(same error while trying browsing through UI)

Device is HTC TyTN II - Windows Mobile powered PDA/phone. Browsing device
actually works if I manually install obexftp, and use command line - I am even
able to mount it using obexfs to local directory and browse remote files easily.
Basically it proves that service IS avaiable on mobile phone, and problem
probably lies in gnome-bluetooth/bluez-gnome packages. I have bluez-gnome
0.14-8.fc8 and gnome-bluetooth 0.9.1-3.fc8 packages installed.

Browsing phones like Sony Ericsson K850i or Nokia E61 works fine through 'Browse
device...' menu, tough.

"Service not available" usually happens when we can't find the right channel on
the remote device.

You can check for errors by:
- starting a minimal environment (failsafe from GDM)
- start gnome-vfs-daemon by hand in a terminal (or kill it if it already exists)
- launch "gnomevfs-ls obex://[XXXXX]/" in another terminal
- attach the output of gnome-vfs-daemon (and thus of the obex method) to this bug.

I'm not sure how to enter minimal/failsafe environment. Also when I killall
gnome-vfs-daemon, it seems to restart itself automatically. And gnomevfs-ls
obex:.., as mentioned before - returns service unavailable message...

Actually, bad channel was my first though on this problem, but I didn't know how
to get some detailed debug information. If you please could give me further
explanation how to get it, I'd be greatly appreciated. Thanks.

(In reply to comment #7)
> I'm not sure how to enter minimal/failsafe environment. Also when I killall
> gnome-vfs-daemon, it seems to restart itself automatically. And gnomevfs-ls
> obex:.., as mentioned before - returns service unavailable message...

Which is why you need to be in a failsafe/minimal environment. Select "Failsafe"
as the session type in GDM to be able to log in with just a terminal available.
Make sure that gnome-vfs-daemon isn't running, and kill it if it's still running
from a previous session.

> Actually, bad channel was my first though on this problem, but I didn't know how
> to get some detailed debug information. If you please could give me further
> explanation how to get it, I'd be greatly appreciated. Thanks.

As above.

I'm afraid I can't see any 'failsafe' option on my login screen. :-o Is there
any other way to enter it, ie. through command line?

Sorry about that... :(

(In reply to comment #9)
> I'm afraid I can't see any 'failsafe' option on my login screen. :-o Is there
> any other way to enter it, ie. through command line?

You should be able to see the "Session" button, to select which desktop you want
to log into in GDM. That's the button you need to click.

Or you can disable running the obex theme in the daemon by removing "[daemon]"
from /etc/gnome-vfs-2.0/modules/obex-module.conf, so it reads:
obex: libobex

(In reply to comment #10)
> You should be able to see the "Session" button, to select which desktop you want
> to log into in GDM. That's the button you need to click.

I've tried 'Session' button at login screen at first try, but point is I don't
have 'failsafe' option there. I only have:
Last session
Default System Session
GNOME
Online Desktop Demo

And that's it... :(

> Or you can disable running the obex theme in the daemon by removing "[daemon]"
> from /etc/gnome-vfs-2.0/modules/obex-module.conf, so it reads:
> obex: libobex

I did that, and I have something new now:

[evad@dell640m ~]$ gnomevfs-ls obex://[00:17:83:36:f7:4e]/
find_obexftp_channel: Could not browse servicesobex: om_connection_free calls
disconnect
Error opening: Service not available

(In reply to comment #11)
<snip>
> [evad@dell640m ~]$ gnomevfs-ls obex://[00:17:83:36:f7:4e]/
> find_obexftp_channel: Could not browse services
> obex: om_connection_free calls
> disconnect
> Error opening: Service not available

This means the local SDP server isn't running, or your phone is very broken.
Make sure that the bluetooth service is running properly.

(In reply to comment #12)
> This means the local SDP server isn't running, or your phone is very broken.
> Make sure that the bluetooth service is running properly.

What do you mean by local SDP server? Is that on phone's or PC's side? From
phone's side, I've checked literally everything - all settings are set properly,
I event set up pairing and automatic trust - still no luck. Btw, I am able to
push files to/from that phone without any problems - just FTP browsing doesn't work.

Other thing - if you suggest my phone is 'very broken', please explain why I am
able to browse my phone via BT using obexftp and command line, and I am not able
to do it via Gnome's Bluetooth applet? Maybe I'm not Gnome application
developer, but it pretty clearly seems like some kind of bug for me...

(In reply to comment #13)
> (In reply to comment #12)
> > This means the local SDP server isn't running, or your phone is very broken.
> > Make sure that the bluetooth service is running properly.
> 
> What do you mean by local SDP server? Is that on phone's or PC's side? From
> phone's side, I've checked literally everything - all settings are set properly,
> I event set up pairing and automatic trust - still no luck. Btw, I am able to
> push files to/from that phone without any problems - just FTP browsing doesn't
work.

I'm still pretty sure it's a problem with SDP discovery.

> Other thing - if you suggest my phone is 'very broken', please explain why I am
> able to browse my phone via BT using obexftp and command line, and I am not able
> to do it via Gnome's Bluetooth applet? Maybe I'm not Gnome application
> developer, but it pretty clearly seems like some kind of bug for me...

Which exact obexftp line did you use to connect to the phone?

In the meanwhile, you can also edit /etc/gnome-vfs-2.0/modules/obex-module.conf
and replace:
obex: [daemon] libobex
by:
obex: libobex

And then using gnomevfs-ls, you'll see the debug messages. If you could paste
those here...

(In reply to comment #14)
> Which exact obexftp line did you use to connect to the phone?

Simple as that:

[root@dell640m ~]# obexftp -b 00:17:83:36:f7:4e -l
Browsing 00:17:83:36:f7:4e ...
Connecting...done
Receiving "(null)"... <?xml version="1.0"?>
<!DOCTYPE folder-listing SYSTEM "obex-folder-listing.dtd">
<folder-listing version="1.0">
  <parent-folder name="" />
  <folder name="dcim" created="20070911T112146Z"/>
  <folder name="iGO2006" created="20070911T112250Z"/>
  <folder name="Music" created="20071025T212056Z"/>
  <folder name="My Documents" created="20070915T151332Z"/>
  <folder name="Reinstall CABs" created="20071108T203247Z"/>
  <folder name="voices" created="20070911T112524Z"/>
  <file name="ttnavigator.bif" created="20070911T112531Z" size="333"/>
  <folder name=".Trash-evad" created="20070927T193315Z"/>
  <folder name="temp" created="20070928T083434Z"/>
  <folder name="Movies" created="20070913T104816Z"/>
  <folder name="voices" created="20071020T071726Z"/>
</folder-listing>
done
Disconnecting...done
 
> In the meanwhile, you can also edit /etc/gnome-vfs-2.0/modules/obex-module.conf
> and replace:
> obex: [daemon] libobex
> by:
> obex: libobex
> 
> And then using gnomevfs-ls, you'll see the debug messages. If you could paste
> those here...

I did that already. See comment #11

(In reply to comment #14)
> Which exact obexftp line did you use to connect to the phone?

I forgot mention in previous comment, that using obexfs I am able to mount
phone's shared directory and browse it easily with ie. Nautilus or whatever.

(In reply to comment #15)
> (In reply to comment #14)
> > Which exact obexftp line did you use to connect to the phone?
> 
> Simple as that:
> 
> [root@dell640m ~]# obexftp -b 00:17:83:36:f7:4e -l
<snip>

So sdp browsing seems to work. So we have a problem with the way we do the
lookup for the Obex channel for your device.

> > In the meanwhile, you can also edit /etc/gnome-vfs-2.0/modules/obex-module.conf
<snip>
> I did that already. See comment #11

My mistake.

Could you please attach the output of "sdptool browse 00:17:83:36:f7:4e"?
Could you attach the output of "hcidump" when reproducing the problem? It should
show us why the SDP query has failed.

(In reply to comment #17)
> Could you please attach the output of "sdptool browse 00:17:83:36:f7:4e"?

Unfortunately it returns nothing:

[root@dell640m ~]# sdptool browse 00:17:83:36:f7:4e
Browsing 00:17:83:36:F7:4E ...
[root@dell640m ~]#

:(

> Could you attach the output of "hcidump" when reproducing the problem? It should
> show us why the SDP query has failed.

Ok, I've ran hcidump, and then selected 'Browse device' through GUI. Result is:

[root@dell640m ~]# hcidump 
HCI sniffer - Bluetooth packet analyzer ver 1.40
device: hci0 snap_len: 1028 filter: 0xffffffff
< HCI Command: Inquiry (0x01|0x0001) plen 5
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Inquiry Result with RSSI (0x22) plen 15
< HCI Command: Inquiry Cancel (0x01|0x0002) plen 0
> HCI Event: Command Complete (0x0e) plen 4
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Connect Complete (0x03) plen 11
< ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Connect req: psm 1 scid 0x0040
< HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
> HCI Event: Command Status (0x0f) plen 4
< HCI Command: Write Link Policy Settings (0x02|0x000d) plen 4
> HCI Event: Read Remote Supported Features (0x0b) plen 11
> HCI Event: Command Complete (0x0e) plen 6
< HCI Command: Remote Name Request (0x01|0x0019) plen 10
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Max Slots Change (0x1b) plen 3
> ACL data: handle 12 flags 0x02 dlen 16
    L2CAP(s): Connect rsp: dcid 0x0049 scid 0x0040 result 0 status 0
      Connection successful
< ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Config req: dcid 0x0049 flags 0x00 clen 0
> ACL data: handle 12 flags 0x02 dlen 16
    L2CAP(s): Config req: dcid 0x0040 flags 0x00 clen 4
      MTU 4096 
< ACL data: handle 12 flags 0x02 dlen 18
    L2CAP(s): Config rsp: scid 0x0049 flags 0x00 result 0 clen 4
      Success
      MTU 4096 
> ACL data: handle 12 flags 0x02 dlen 14
    L2CAP(s): Config rsp: scid 0x0040 flags 0x00 result 0 clen 0
      Success
< ACL data: handle 12 flags 0x02 dlen 31
    L2CAP(d): cid 0x0049 len 27 [psm 1]
        SDP SSA Req: tid 0x0 len 0x16
          pat uuid-16 0x1002 (PubBrwsGrp) uuid-16 0x0003 (RFCOMM) uuid-16 0x0008
(OBEX)
          max 65535
          aid(s) 0x0004 (ProtocolDescList) 0x0001 (SrvClassIDList)
          cont 00
> HCI Event: Remote Name Req Complete (0x07) plen 255
> HCI Event: Number of Completed Packets (0x13) plen 5
> ACL data: handle 12 flags 0x02 dlen 11
    L2CAP(d): cid 0x0040 len 7 [psm 1]
        SDP Error Rsp: tid 0x0 len 0x2
          code 0x3 info none
< ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Disconn req: dcid 0x0049 scid 0x0040
> ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Disconn rsp: dcid 0x0049 scid 0x0040
> HCI Event: Number of Completed Packets (0x13) plen 5
< HCI Command: Disconnect (0x01|0x0006) plen 3
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Disconn Complete (0x05) plen 4

(In reply to comment #17)
> Could you please attach the output of "sdptool browse 00:17:83:36:f7:4e"?

That works:

[root@dell640m ~]# sdptool search FTP
Inquiring ...
Searching for FTP on 00:17:31:F9:B2:7E ...
Searching for FTP on 00:17:83:36:F7:4E ... <-- my phone
Service Name: FTP
Service RecHandle: 0x10009
Service Class ID List:
  "OBEX File Transfer" (0x1106)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 3
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x656e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "OBEX File Transfer" (0x1106)
    Version: 0x0100

(In reply to comment #19)
> (In reply to comment #17)
> > Could you please attach the output of "sdptool browse 00:17:83:36:f7:4e"?
> 
> That works:
> 
> [root@dell640m ~]# sdptool search FTP
> Inquiring ...
> Searching for FTP on 00:17:31:F9:B2:7E ...
> Searching for FTP on 00:17:83:36:F7:4E ... <-- my phone

Gah. I was right about the phone being broken, I'll see how we can work around
the problem...

(In reply to comment #20)
> Gah. I was right about the phone being broken,

In which means 'broken', can you explain closer?

> I'll see how we can work around the problem...

Thanks a lot. I'll wait patiently... :)

(In reply to comment #21)
> (In reply to comment #20)
> > Gah. I was right about the phone being broken,
> 
> In which means 'broken', can you explain closer?

There are some devices that don't follow the Bluetooth specs and will not return
any services when browsing for them, unless you specify a service. That's broken
implementation, and a very poor way of reducing security problems.

> > I'll see how we can work around the problem...
> 
> Thanks a lot. I'll wait patiently... :)

Test version is building at:
http://koji.fedoraproject.org/koji/taskinfo?taskID=257683

Let me know if it fixes your problem (make sure to change the config file so I
can see the debug output, but revert it to the default if you want to use
nautilus, otherwise you'll be creating a new Bluetooth connection for each
operation).

Make that:
http://koji.fedoraproject.org/koji/taskinfo?taskID=257690

(In reply to comment #23)
> Make that:
> http://koji.fedoraproject.org/koji/taskinfo?taskID=257690

Installed, restarted the machine, removed [daemon] from obex-module.conf, and...

[root@d620 ~]# gnomevfs-ls obex://[00:17:83:36:f7:4e]/
find_obexftp_channel: Could not browse services, trying direct
searchfind_obexftp_channel: no suitable channels foundobex: om_connection_free
calls disconnect
Error opening: Usługa nie jest dostępna

:(

Another go at it, my search wasn't looking for any attributes (so the search was
succeeding, but the search results didn't have anything interesting in them):
http://koji.fedoraproject.org/koji/taskinfo?taskID=258321

I've also been told that not having browse support in the SDP server was
optional in the spec, so your phone isn't broken, but written by lazy people ;)

(In reply to comment #25)
> Another go at it, my search wasn't looking for any attributes (so the search was
> succeeding, but the search results didn't have anything interesting in them):
> http://koji.fedoraproject.org/koji/taskinfo?taskID=258321

This time - when I try via GUI, I have response:

Nautilus cannot display "obex://[00:17:83:36:f7:4e]".
Please select another viewer and try again.

And I've noticed that a drive which I've had mounted, have jumped up in Nautilus
from the bottom to the second place after Home Dir, over some other network
drives I have visible there. :-o Seems like something was going on underneath.

Then, after removing [daemon], command line did that:

[root@dell640m ~]# gnomevfs-ls obex://[00:17:83:36:f7:4e]
find_obexftp_channel: Could not browse services, trying direct
searchSegmentation fault

:(

> I've also been told that not having browse support in the SDP server was
> optional in the spec, so your phone isn't broken, but written by lazy people ;)

Did I mention this is Windows Mobile powered phone? ;)

(In reply to comment #26)
> (In reply to comment #25)
> > Another go at it, my search wasn't looking for any attributes (so the search was
> > succeeding, but the search results didn't have anything interesting in them):
> > http://koji.fedoraproject.org/koji/taskinfo?taskID=258321
<snip>
> And I've noticed that a drive which I've had mounted, have jumped up in Nautilus
> from the bottom to the second place after Home Dir, over some other network
> drives I have visible there. :-o Seems like something was going on underneath.

I have no idea what might be the cause...

> Then, after removing [daemon], command line did that:
> 
> [root@dell640m ~]# gnomevfs-ls obex://[00:17:83:36:f7:4e]
> find_obexftp_channel: Could not browse services, trying direct
> searchSegmentation fault

Could you please get a backtrace of the crash?
gdb /usr/bin/gnomevfs-ls
run obex://[00:17:83:36:f7:4e]
thread apply all bt

Make sure to install the -debuginfo package from the page.

> > I've also been told that not having browse support in the SDP server was
> > optional in the spec, so your phone isn't broken, but written by lazy people ;)
> 
> Did I mention this is Windows Mobile powered phone? ;)

Yeah, doesn't surprise me one bit :)

Created attachment 268891 [details]
(gdb) run obex://[00:17:83:36:f7:4e]

Created attachment 268901 [details]
(gdb) thread apply all bt

(In reply to comment #27)
> Could you please get a backtrace of the crash?
> gdb /usr/bin/gnomevfs-ls
> run obex://[00:17:83:36:f7:4e]
> thread apply all bt
> 
> Make sure to install the -debuginfo package from the page.

OK, I've got some outputs from gdb, which I've attached. Btw, thanks for your
help on email!

That should have fixed my stupidness:
http://koji.fedoraproject.org/koji/taskinfo?taskID=258600

I've tested that one by making the first lookup fail, and tested it on a Nokia
and a Motorola phone.

(In reply to comment #31)
> That should have fixed my stupidness:
> http://koji.fedoraproject.org/koji/taskinfo?taskID=258600
> 
> I've tested that one by making the first lookup fail, and tested it on a Nokia
> and a Motorola phone.

Installed, crossed my fingers, and...

[root@dell640m ~]# gnomevfs-ls obex://[00:17:83:36:f7:4e]
find_obexftp_channel: Could not browse services, trying direct
searchfind_obexftp_channel: Could not browse services, finding obexobex:
om_connection_free calls disconnect
Error opening: Service not available

:(

Here's the thought - if the problem lies in finding correct BT channel for
ObexFTP, so how about giving ability to define channel manually, through config
file or as a command line parameter? Not very convenient, probably, but might be
worth to try if it works at all...

I've recently retried using the "browse device" functionality and I still get
the same problem which is no surprise.  However,  I did notice some odd things
that may or may not yield some insight.

After converting to FC8 the following command "obexftp -b XX:XX:XX:XX:XX -l"
doesn't work with my phone anymore.  After playing around I found that I now
have to do "obexftp -b XX:XX:XX:XX:XX -B 7 -l".  This seems to echo the
observation that the FTP channel isn't being determined properly.

Is there a way to specify which channel to use in the
"obex://[XX:XX:XX:XX:XX:XX]" syntax?

(In reply to comment #34)
> I've recently retried using the "browse device" functionality and I still get
> the same problem which is no surprise.  However,  I did notice some odd things
> that may or may not yield some insight.
> 
> After converting to FC8 the following command "obexftp -b XX:XX:XX:XX:XX -l"
> doesn't work with my phone anymore.  After playing around I found that I now
> have to do "obexftp -b XX:XX:XX:XX:XX -B 7 -l".  This seems to echo the
> observation that the FTP channel isn't being determined properly.

This means that something changed/broke, and we can't determine the channel for
ObexFTP on your device. I'm pretty happy to see that it's not just
gnome-vfs-obexftp that's broken...

If neither sdptool nor obexftp can figure out the channel for the device, please
send an e-mail to the bluez-users mailing-list with the output from "hcidump -X"
while reproducing the problem.

> Is there a way to specify which channel to use in the
> "obex://[XX:XX:XX:XX:XX:XX]" syntax?

No, there isn't. Feel free to file a bug upstream at:
https://bugs.launchpad.net/gnome-vfs-obexftp/

gnome-vfs2-obexftp isn't used on rawhide anymore, the ObexFTP support is in gvfs.

Please file a bug against gvfs if you still see the problem with a current rawhide.