Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

btle-rf: Define previous RFU flags to create better Wireshark logs #3027

Merged
merged 1 commit into from Dec 25, 2020

Conversation

rugeGerritsen
Copy link
Contributor

These flags are used to provide more context for the current PDU.
Wireshark can use these to determine the direction of the PDU, the location in an advertising chain etc.
The additional context can be used by the Wireshark dissector to improve the expect info and provide easier-to-read logs.

Notes:

  • This PR imports LEBitField and LEBitEnumField defined in the Ethercat layer. This PR has the same use case: There a multibit fields that range over byte boundaries. Those fields where not moved to the common fields.py as a result from a discussion in basic EtherCat layer #569. I'm fine with moving them to fields.py as part of this PR.
  • This PR breaks the API of class BTLE_RF as flags is no longer available. This was necessary as some of the fields are multibit fields. I'm not too familiar with Scapy, so I was not able to find a way to preserve the API. Let me know if you have some suggestion on how to preserve it.

Below is a code snippet creating a Bluetooth LE Wireshark log demonstrating how the logs become easier to read with the additional provided context:

access_addr = 0x11111111
adv_addr    = bytes([0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA])
master_addr = bytes([0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE])

adv_ind = BTLE_RF()/BTLE()/BTLE_ADV()/ \
          BTLE_ADV_IND(AdvA=adv_addr, data=EIR_Hdr(type='complete_local_name')/b'MyAdv')
connect_ind = BTLE_RF()/BTLE()/BTLE_ADV(PDU_type='CONNECT_REQ')/ \
              BTLE_CONNECT_REQ(InitA=master_addr, AdvA=adv_addr, AA=access_addr)
m_to_s = BTLE_RF(type=2, rf_channel=1)/BTLE(access_addr=access_addr)/ \
         BTLE_DATA(SN=0, NESN=0, LLID=1)
s_to_m = BTLE_RF(type=3, rf_channel=1)/BTLE(access_addr=access_addr)/ \
         BTLE_DATA(SN=0, NESN=0, LLID=1)

packets = []
packets += adv_ind
packets += connect_ind
packets += m_to_s
packets += s_to_m

scapy.utils.wrpcap("my_log.pcap", packets)

Before:
image

After:
image

These flags are used to provide more context for the current PDU.
Wireshark can use this to determine the direction of the PDU,
the location in an advertising chain etc.

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
@codecov
Copy link

codecov bot commented Dec 22, 2020

Codecov Report

Merging #3027 (3487f59) into master (2a8733a) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master    #3027   +/-   ##
=======================================
  Coverage   85.37%   85.37%           
=======================================
  Files         255      255           
  Lines       53968    53971    +3     
=======================================
+ Hits        46075    46079    +4     
+ Misses       7893     7892    -1     
Impacted Files Coverage Δ
scapy/layers/bluetooth4LE.py 91.89% <100.00%> (+0.16%) ⬆️
scapy/arch/windows/__init__.py 68.25% <0.00%> (-0.58%) ⬇️
scapy/config.py 81.29% <0.00%> (-0.20%) ⬇️
scapy/sendrecv.py 85.27% <0.00%> (+0.80%) ⬆️

@rugeGerritsen rugeGerritsen marked this pull request as ready for review December 22, 2020 13:37
@rugeGerritsen
Copy link
Contributor Author

I'm not sure why the doc build fails, it looks unrelated to my changes

@guedou
Copy link
Member

guedou commented Dec 23, 2020

It is an issue with Sphink that is fixed in master sphinx-doc/sphinx#8559 and will be part of the next release. You can ignore it for now.

@guedou guedou merged commit 27545d8 into secdev:master Dec 25, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants