Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/scapy/layers/bluetooth4LE.py: 83%

1# SPDX-License-Identifier: GPL-2.0-only 

2# This file is part of Scapy 

3# See https://scapy.net/ for more information 

4# Copyright (C) Philippe Biondi <phil@secdev.org> 

5# Copyright (C) Airbus DS CyberSecurity 

6# Authors: Jean-Michel Picod, Arnaud Lebrun, Jonathan Christofer Demay 

7 

8"""Bluetooth 4LE layer""" 

9 

10import struct 

11 

12from scapy.compat import chb 

13from scapy.config import conf 

14from scapy.data import ( 

15 DLT_BLUETOOTH_LE_LL, 

16 DLT_BLUETOOTH_LE_LL_WITH_PHDR, 

17 PPI_BTLE, 

18) 

19from scapy.packet import Packet, bind_layers 

20from scapy.fields import ( 

21 BitEnumField, 

22 BitField, 

23 ByteEnumField, 

24 ByteField, 

25 Field, 

26 FlagsField, 

27 LEIntField, 

28 LEShortEnumField, 

29 LEShortField, 

30 MACField, 

31 PacketListField, 

32 SignedByteField, 

33 X3BytesField, 

34 XByteField, 

35 XLE3BytesField, 

36 XLEIntField, 

37 XLELongField, 

38 XLEShortField, 

39) 

40from scapy.contrib.ethercat import LEBitEnumField, LEBitField 

41 

42from scapy.layers.bluetooth import EIR_Hdr, L2CAP_Hdr 

43from scapy.layers.ppi import PPI_Element, PPI_Hdr 

44 

45from scapy.utils import mac2str, str2mac 

46 

47#################### 

48# Transport Layers # 

49#################### 

50 

51 

52class BTLE_PPI(PPI_Element): 

53 """Cooked BTLE PPI header 

54 

55 See ``ppi_btle_t`` in 

56 https://github.com/greatscottgadgets/libbtbb/blob/master/lib/src/pcap.c 

57 """ 

58 name = "BTLE PPI header" 

59 fields_desc = [ 

60 ByteField("btle_version", 0), 

61 # btle_channel is a frequency in MHz. Named for consistency with 

62 # other users. 

63 LEShortField("btle_channel", None), 

64 ByteField("btle_clkn_high", None), 

65 LEIntField("btle_clk_100ns", None), 

66 SignedByteField("rssi_max", None), 

67 SignedByteField("rssi_min", None), 

68 SignedByteField("rssi_avg", None), 

69 ByteField("rssi_count", None) 

70 ] 

71 

72 

73class BTLE_RF(Packet): 

74 """Cooked BTLE link-layer pseudoheader. 

75 

76 https://www.tcpdump.org/linktypes/LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR.html 

77 """ 

78 name = "BTLE RF info header" 

79 

80 _TYPES = { 

81 0: "ADV_OR_DATA_UNKNOWN_DIR", 

82 1: "AUX_ADV", 

83 2: "DATA_M_TO_S", 

84 3: "DATA_S_TO_M", 

85 4: "CONN_ISO_M_TO_S", 

86 5: "CONN_ISO_S_TO_M", 

87 6: "BROADCAST_ISO", 

88 7: "RFU", 

89 } 

90 

91 _PHY = { 

92 0: "1M", 

93 1: "2M", 

94 2: "Coded", 

95 3: "RFU", 

96 } 

97 

98 fields_desc = [ 

99 ByteField("rf_channel", 0), 

100 SignedByteField("signal", -128), 

101 SignedByteField("noise", -128), 

102 ByteField("access_address_offenses", 0), 

103 XLEIntField("reference_access_address", 0), 

104 LEBitField("dewhitened", 0, 1), 

105 LEBitField("sig_power_valid", 0, 1), 

106 LEBitField("noise_power_valid", 0, 1), 

107 LEBitField("decrypted", 0, 1), 

108 LEBitField("reference_access_address_valid", 0, 1), 

109 LEBitField("access_address_offenses_valid", 0, 1), 

110 LEBitField("channel_aliased", 0, 1), 

111 LEBitEnumField("type", 0, 3, _TYPES), 

112 LEBitField("crc_checked", 0, 1), 

113 LEBitField("crc_valid", 0, 1), 

114 LEBitField("mic_checked", 0, 1), 

115 LEBitField("mic_valid", 0, 1), 

116 LEBitEnumField("phy", 0, 2, _PHY), 

117 ] 

118 

119 

120########## 

121# Fields # 

122########## 

123 

124class BDAddrField(MACField): 

125 def __init__(self, name, default, resolve=False): 

126 MACField.__init__(self, name, default) 

127 if resolve: 

128 conf.resolve.add(self) 

129 

130 def i2m(self, pkt, x): 

131 if x is None: 

132 return b"\0\0\0\0\0\0" 

133 return mac2str(':'.join(x.split(':')[::-1])) 

134 

135 def m2i(self, pkt, x): 

136 return str2mac(x[::-1]) 

137 

138 

139class BTLEChanMapField(XByteField): 

140 def __init__(self, name, default): 

141 Field.__init__(self, name, default, "<Q") 

142 

143 def addfield(self, pkt, s, val): 

144 return s + struct.pack(self.fmt, self.i2m(pkt, val))[:5] 

145 

146 def getfield(self, pkt, s): 

147 return s[5:], self.m2i(pkt, struct.unpack(self.fmt, s[:5] + b"\x00\x00\x00")[0]) # noqa: E501 

148 

149 

150class BTLEFeatureField(FlagsField): 

151 def __init__(self, name, default): 

152 super(BTLEFeatureField, self).__init__( 

153 name, default, -64, 

154 ['le_encryption', 

155 'conn_par_req_proc', 

156 'ext_reject_ind', 

157 'slave_init_feat_exch', 

158 'le_ping', 

159 'le_data_len_ext', 

160 'll_privacy', 

161 'ext_scan_filter', 

162 'le_2m_phy', 

163 'tx_mod_idx', 

164 'rx_mod_idx', 

165 'le_coded_phy', 

166 'le_ext_adv', 

167 'le_periodic_adv', 

168 'ch_sel_alg', 

169 'le_pwr_class' 

170 'min_used_channels', 

171 'conn_cte_req', 

172 'conn_cte_rsp', 

173 'connless_cte_tx', 

174 'connless_cte_rx', 

175 'antenna_switching_cte_aod_tx', 

176 'antenna_switching_cte_aoa_rx', 

177 'cte_rx', 

178 'periodic_adv_sync_transfer_tx', 

179 'periodic_adv_sync_transfer_rx', 

180 'sleep_clock_accuracy_updates', 

181 'remote_public_key_validation', 

182 'cis_central', 

183 'cis_peripheral', 

184 'iso_broadcaster', 

185 'synchronized_receiver', 

186 'connected_iso_host_support', 

187 'le_power_control_request', 

188 'le_power_control_request', 

189 'le_path_loss_monitoring', 

190 'periodic_adv_adi_support', 

191 'connection_subrating', 

192 'connection_subrating_host_support', 

193 'channel_classification'] 

194 ) 

195 

196 

197class BTLEPhysField(FlagsField): 

198 def __init__(self, name, default): 

199 super(BTLEPhysField, self).__init__( 

200 name, default, -8, 

201 ['phy_1m', 'phy_2m', 'phy_coded'] 

202 ) 

203 

204 

205########## 

206# Layers # 

207########## 

208 

209class BTLE(Packet): 

210 name = "BT4LE" 

211 fields_desc = [ 

212 XLEIntField("access_addr", 0x8E89BED6), 

213 X3BytesField("crc", None) 

214 ] 

215 

216 @staticmethod 

217 def compute_crc(pdu, init=0x555555): 

218 def swapbits(a): 

219 v = 0 

220 if a & 0x80 != 0: 

221 v |= 0x01 

222 if a & 0x40 != 0: 

223 v |= 0x02 

224 if a & 0x20 != 0: 

225 v |= 0x04 

226 if a & 0x10 != 0: 

227 v |= 0x08 

228 if a & 0x08 != 0: 

229 v |= 0x10 

230 if a & 0x04 != 0: 

231 v |= 0x20 

232 if a & 0x02 != 0: 

233 v |= 0x40 

234 if a & 0x01 != 0: 

235 v |= 0x80 

236 return v 

237 

238 state = swapbits(init & 0xff) + (swapbits((init >> 8) & 0xff) << 8) + (swapbits((init >> 16) & 0xff) << 16) # noqa: E501 

239 lfsr_mask = 0x5a6000 

240 for i in pdu: 

241 for j in range(8): 

242 next_bit = (state ^ i) & 1 

243 i >>= 1 

244 state >>= 1 

245 if next_bit: 

246 state |= 1 << 23 

247 state ^= lfsr_mask 

248 return struct.pack("<L", state)[:-1] 

249 

250 def post_build(self, p, pay): 

251 # Switch payload and CRC 

252 crc = p[-3:] 

253 p = p[:-3] + pay 

254 p += crc if self.crc is not None else self.compute_crc(p[4:]) 

255 return p 

256 

257 def post_dissect(self, s): 

258 self.raw_packet_cache = None # Reset packet to allow post_build 

259 return s 

260 

261 def pre_dissect(self, s): 

262 # move crc 

263 return s[:4] + s[-3:] + s[4:-3] 

264 

265 def hashret(self): 

266 return struct.pack("!L", self.access_addr) 

267 

268 

269class BTLE_ADV(Packet): 

270 # BT Core 5.2 - 2.3 ADVERTISING PHYSICAL CHANNEL PDU 

271 name = "BTLE advertising header" 

272 fields_desc = [ 

273 BitEnumField("RxAdd", 0, 1, {0: "public", 

274 1: "random"}), 

275 BitEnumField("TxAdd", 0, 1, {0: "public", 

276 1: "random"}), 

277 # 4.5.8.3.1 - LE Channel Selection Algorithm #2 

278 BitEnumField("ChSel", 0, 1, {1: "#2"}), 

279 BitField("RFU", 0, 1), # Unused 

280 BitEnumField("PDU_type", 0, 4, {0: "ADV_IND", 

281 1: "ADV_DIRECT_IND", 

282 2: "ADV_NONCONN_IND", 

283 3: "SCAN_REQ", 

284 4: "SCAN_RSP", 

285 5: "CONNECT_IND", 

286 6: "ADV_SCAN_IND"}), 

287 XByteField("Length", None), 

288 ] 

289 

290 def post_build(self, p, pay): 

291 p += pay 

292 if self.Length is None: 

293 if len(pay) > 2: 

294 l_pay = len(pay) 

295 else: 

296 l_pay = 0 

297 p = p[:1] + chb(l_pay & 0xff) + p[2:] 

298 if not isinstance(self.underlayer, BTLE): 

299 self.add_underlayer(BTLE) 

300 return p 

301 

302 

303class BTLE_DATA(Packet): 

304 name = "BTLE data header" 

305 fields_desc = [ 

306 BitField("RFU", 0, 3), # Unused 

307 BitField("MD", 0, 1), 

308 BitField("SN", 0, 1), 

309 BitField("NESN", 0, 1), 

310 BitEnumField("LLID", 0, 2, {1: "continue", 2: "start", 3: "control"}), 

311 ByteField("len", None), 

312 ] 

313 

314 def post_build(self, p, pay): 

315 if self.len is None: 

316 p = p[:-1] + chb(len(pay)) 

317 return p + pay 

318 

319 

320class BTLE_ADV_IND(Packet): 

321 name = "BTLE ADV_IND" 

322 fields_desc = [ 

323 BDAddrField("AdvA", None), 

324 PacketListField("data", None, EIR_Hdr) 

325 ] 

326 

327 

328class BTLE_ADV_DIRECT_IND(Packet): 

329 name = "BTLE ADV_DIRECT_IND" 

330 fields_desc = [ 

331 BDAddrField("AdvA", None), 

332 BDAddrField("InitA", None) 

333 ] 

334 

335 

336class BTLE_ADV_NONCONN_IND(BTLE_ADV_IND): 

337 name = "BTLE ADV_NONCONN_IND" 

338 

339 

340class BTLE_ADV_SCAN_IND(BTLE_ADV_IND): 

341 name = "BTLE ADV_SCAN_IND" 

342 

343 

344class BTLE_SCAN_REQ(Packet): 

345 name = "BTLE scan request" 

346 fields_desc = [ 

347 BDAddrField("ScanA", None), 

348 BDAddrField("AdvA", None) 

349 ] 

350 

351 def answers(self, other): 

352 return BTLE_SCAN_RSP in other and self.AdvA == other.AdvA 

353 

354 

355class BTLE_SCAN_RSP(Packet): 

356 name = "BTLE scan response" 

357 fields_desc = [ 

358 BDAddrField("AdvA", None), 

359 PacketListField("data", None, EIR_Hdr) 

360 ] 

361 

362 def answers(self, other): 

363 return BTLE_SCAN_REQ in other and self.AdvA == other.AdvA 

364 

365 

366class BTLE_CONNECT_REQ(Packet): 

367 name = "BTLE connect request" 

368 fields_desc = [ 

369 BDAddrField("InitA", None), 

370 BDAddrField("AdvA", None), 

371 # LLDATA 

372 XLEIntField("AA", 0x00), 

373 XLE3BytesField("crc_init", 0x0), 

374 XByteField("win_size", 0x0), 

375 XLEShortField("win_offset", 0x0), 

376 XLEShortField("interval", 0x0), 

377 XLEShortField("latency", 0x0), 

378 XLEShortField("timeout", 0x0), 

379 BTLEChanMapField("chM", 0), 

380 BitField("SCA", 0, 3), 

381 BitField("hop", 0, 5), 

382 ] 

383 

384 

385BTLE_Versions = { 

386 6: '4.0', 

387 7: '4.1', 

388 8: '4.2', 

389 9: '5.0', 

390 10: '5.1', 

391 11: '5.2', 

392} 

393 

394 

395BTLE_Corp_IDs = { 

396 0xf: 'Broadcom Corporation', 

397 0x59: 'Nordic Semiconductor ASA' 

398} 

399 

400 

401BTLE_BTLE_CTRL_opcode = { 

402 0x00: 'LL_CONNECTION_UPDATE_REQ', 

403 0x01: 'LL_CHANNEL_MAP_REQ', 

404 0x02: 'LL_TERMINATE_IND', 

405 0x03: 'LL_ENC_REQ', 

406 0x04: 'LL_ENC_RSP', 

407 0x05: 'LL_START_ENC_REQ', 

408 0x06: 'LL_START_ENC_RSP', 

409 0x07: 'LL_UNKNOWN_RSP', 

410 0x08: 'LL_FEATURE_REQ', 

411 0x09: 'LL_FEATURE_RSP', 

412 0x0A: 'LL_PAUSE_ENC_REQ', 

413 0x0B: 'LL_PAUSE_ENC_RSP', 

414 0x0C: 'LL_VERSION_IND', 

415 0x0D: 'LL_REJECT_IND', 

416 0x0E: 'LL_SLAVE_FEATURE_REQ', 

417 0x0F: 'LL_CONNECTION_PARAM_REQ', 

418 0x10: 'LL_CONNECTION_PARAM_RSP', 

419 0x14: 'LL_LENGTH_REQ', 

420 0x15: 'LL_LENGTH_RSP', 

421 0x16: 'LL_PHY_REQ', 

422 0x17: 'LL_PHY_RSP', 

423 0x18: 'LL_PHY_UPDATE_IND', 

424 0x19: 'LL_MIN_USED_CHANNELS', 

425 0x1A: 'LL_CTE_REQ', 

426 0x1B: 'LL_CTE_RSP', 

427 0x1C: 'LL_PERIODIC_SYNC_IND', 

428 0x1D: 'LL_CLOCK_ACCURACY_REQ', 

429 0x1E: 'LL_CLOCK_ACCURACY_RSP', 

430 0x1F: 'LL_CIS_REQ', 

431 0x20: 'LL_CIS_RSP', 

432 0x21: 'LL_CIS_IND', 

433 0x22: 'LL_CIS_TERMINATE_IND', 

434 0x23: 'LL_POWER_CONTROL_REQ', 

435 0x24: 'LL_POWER_CONTROL_RSP', 

436 0x25: 'LL_POWER_CHANGE_IND', 

437 0x26: 'LL_SUBRATE_REQ', 

438 0x27: 'LL_SUBRATE_IND', 

439 0x28: 'LL_CHANNEL_REPORTING_IND', 

440 0x29: 'LL_CHANNEL_STATUS_IND', 

441} 

442 

443 

444class BTLE_EMPTY_PDU(Packet): 

445 name = "Empty data PDU" 

446 

447 

448class BTLE_CTRL(Packet): 

449 name = "BTLE_CTRL" 

450 fields_desc = [ 

451 ByteEnumField("opcode", 0, BTLE_BTLE_CTRL_opcode) 

452 ] 

453 

454 

455class LL_CONNECTION_UPDATE_IND(Packet): 

456 name = 'LL_CONNECTION_UPDATE_IND' 

457 fields_desc = [ 

458 XByteField("win_size", 0), 

459 XLEShortField("win_offset", 0), 

460 XLEShortField("interval", 6), 

461 XLEShortField("latency", 0), 

462 XLEShortField("timeout", 50), 

463 XLEShortField("instant", 6), 

464 ] 

465 

466 

467class LL_CHANNEL_MAP_IND(Packet): 

468 name = 'LL_CHANNEL_MAP_IND' 

469 fields_desc = [ 

470 BTLEChanMapField("chM", 0xFFFFFFFFFE), 

471 XLEShortField("instant", 0), 

472 ] 

473 

474 

475class LL_TERMINATE_IND(Packet): 

476 name = 'LL_TERMINATE_IND' 

477 fields_desc = [ 

478 XByteField("code", 0x0), 

479 ] 

480 

481 

482class LL_ENC_REQ(Packet): 

483 name = 'LL_ENC_REQ' 

484 fields_desc = [ 

485 XLELongField("rand", 0), 

486 XLEShortField("ediv", 0), 

487 XLELongField("skdm", 0), 

488 XLEIntField("ivm", 0), 

489 ] 

490 

491 

492class LL_ENC_RSP(Packet): 

493 name = 'LL_ENC_RSP' 

494 fields_desc = [ 

495 XLELongField("skds", 0), 

496 XLEIntField("ivs", 0), 

497 ] 

498 

499 

500class LL_START_ENC_REQ(Packet): 

501 name = 'LL_START_ENC_REQ' 

502 fields_desc = [] 

503 

504 

505class LL_START_ENC_RSP(Packet): 

506 name = 'LL_START_ENC_RSP' 

507 

508 

509class LL_UNKNOWN_RSP(Packet): 

510 name = 'LL_UNKNOWN_RSP' 

511 fields_desc = [ 

512 XByteField("code", 0x0), 

513 ] 

514 

515 

516class LL_FEATURE_REQ(Packet): 

517 name = "LL_FEATURE_REQ" 

518 fields_desc = [ 

519 BTLEFeatureField("feature_set", 0) 

520 ] 

521 

522 

523class LL_FEATURE_RSP(Packet): 

524 name = "LL_FEATURE_RSP" 

525 fields_desc = [ 

526 BTLEFeatureField("feature_set", 0) 

527 ] 

528 

529 

530class LL_PAUSE_ENC_REQ(Packet): 

531 name = "LL_PAUSE_ENC_REQ" 

532 

533 

534class LL_PAUSE_ENC_RSP(Packet): 

535 name = "LL_PAUSE_ENC_RSP" 

536 

537 

538class LL_VERSION_IND(Packet): 

539 name = "LL_VERSION_IND" 

540 fields_desc = [ 

541 ByteEnumField("version", 8, BTLE_Versions), 

542 LEShortEnumField("company", 0, BTLE_Corp_IDs), 

543 XLEShortField("subversion", 0) 

544 ] 

545 

546 

547class LL_REJECT_IND(Packet): 

548 name = "LL_REJECT_IND" 

549 fields_desc = [ 

550 XByteField("code", 0x0), 

551 ] 

552 

553 

554class LL_SLAVE_FEATURE_REQ(Packet): 

555 name = "LL_SLAVE_FEATURE_REQ" 

556 fields_desc = [ 

557 BTLEFeatureField("feature_set", 0) 

558 ] 

559 

560 

561class LL_CONNECTION_PARAM_REQ(Packet): 

562 name = "LL_CONNECTION_PARAM_REQ" 

563 fields_desc = [ 

564 XLEShortField("interval_min", 0x6), 

565 XLEShortField("interval_max", 0x6), 

566 XLEShortField("latency", 0x0), 

567 XLEShortField("timeout", 0x0), 

568 XByteField("preferred_periodicity", 0x0), 

569 XLEShortField("reference_conn_evt_count", 0x0), 

570 XLEShortField("offset0", 0x0), 

571 XLEShortField("offset1", 0x0), 

572 XLEShortField("offset2", 0x0), 

573 XLEShortField("offset3", 0x0), 

574 XLEShortField("offset4", 0x0), 

575 XLEShortField("offset5", 0x0), 

576 ] 

577 

578 

579class LL_CONNECTION_PARAM_RSP(Packet): 

580 name = "LL_CONNECTION_PARAM_RSP" 

581 fields_desc = [ 

582 XLEShortField("interval_min", 0x6), 

583 XLEShortField("interval_max", 0x6), 

584 XLEShortField("latency", 0x0), 

585 XLEShortField("timeout", 0x0), 

586 XByteField("preferred_periodicity", 0x0), 

587 XLEShortField("reference_conn_evt_count", 0x0), 

588 XLEShortField("offset0", 0x0), 

589 XLEShortField("offset1", 0x0), 

590 XLEShortField("offset2", 0x0), 

591 XLEShortField("offset3", 0x0), 

592 XLEShortField("offset4", 0x0), 

593 XLEShortField("offset5", 0x0), 

594 ] 

595 

596 

597class LL_REJECT_EXT_IND(Packet): 

598 name = "LL_REJECT_EXT_IND" 

599 fields_desc = [ 

600 XByteField("reject_opcode", 0x0), 

601 XByteField("error_code", 0x0), 

602 ] 

603 

604 

605class LL_PING_REQ(Packet): 

606 name = "LL_PING_REQ" 

607 

608 

609class LL_PING_RSP(Packet): 

610 name = "LL_PING_RSP" 

611 

612 

613class LL_LENGTH_REQ(Packet): 

614 name = ' LL_LENGTH_REQ' 

615 fields_desc = [ 

616 XLEShortField("max_rx_bytes", 251), 

617 XLEShortField("max_rx_time", 2120), 

618 XLEShortField("max_tx_bytes", 251), 

619 XLEShortField("max_tx_time", 2120), 

620 ] 

621 

622 

623class LL_LENGTH_RSP(Packet): 

624 name = ' LL_LENGTH_RSP' 

625 fields_desc = [ 

626 XLEShortField("max_rx_bytes", 251), 

627 XLEShortField("max_rx_time", 2120), 

628 XLEShortField("max_tx_bytes", 251), 

629 XLEShortField("max_tx_time", 2120), 

630 ] 

631 

632 

633class LL_PHY_REQ(Packet): 

634 name = "LL_PHY_REQ" 

635 fields_desc = [ 

636 BTLEPhysField('tx_phys', 0), 

637 BTLEPhysField('rx_phys', 0), 

638 ] 

639 

640 

641class LL_PHY_RSP(Packet): 

642 name = "LL_PHY_RSP" 

643 fields_desc = [ 

644 BTLEPhysField('tx_phys', 0), 

645 BTLEPhysField('rx_phys', 0), 

646 ] 

647 

648 

649class LL_PHY_UPDATE_IND(Packet): 

650 name = "LL_PHY_UPDATE_IND" 

651 fields_desc = [ 

652 BTLEPhysField('tx_phy', 0), 

653 BTLEPhysField('rx_phy', 0), 

654 XLEShortField("instant", 0x0), 

655 ] 

656 

657 

658class LL_MIN_USED_CHANNELS_IND(Packet): 

659 name = "LL_MIN_USED_CHANNELS_IND" 

660 fields_desc = [ 

661 BTLEPhysField('phys', 0), 

662 ByteField("min_used_channels", 2), 

663 ] 

664 

665 

666class LL_CTE_REQ(Packet): 

667 name = "LL_CTE_REQ" 

668 fields_desc = [ 

669 LEBitField('min_cte_len_req', 0, 5), 

670 LEBitField('rfu', 0, 1), 

671 LEBitField("cte_type_req", 0, 2) 

672 ] 

673 

674 

675class LL_CTE_RSP(Packet): 

676 name = "LL_CTE_RSP" 

677 fields_desc = [] 

678 

679 

680class LL_PERIODIC_SYNC_IND(Packet): 

681 name = "LL_PERIODIC_SYNC_IND" 

682 fields_desc = [ 

683 XLEShortField("id", 251), 

684 LEBitField("sync_info", 0, 18 * 8), 

685 XLEShortField("conn_event_count", 0), 

686 XLEShortField("last_pa_event_counter", 0), 

687 LEBitField('sid', 0, 4), 

688 LEBitField('a_type', 0, 1), 

689 LEBitField('sca', 0, 3), 

690 BTLEPhysField('phy', 0), 

691 BDAddrField("AdvA", None), 

692 XLEShortField("sync_conn_event_count", 0), 

693 ] 

694 

695 

696class LL_CLOCK_ACCURACY_REQ(Packet): 

697 name = "LL_CLOCK_ACCURACY_REQ" 

698 fields_desc = [ 

699 XByteField("sca", 0), 

700 ] 

701 

702 

703class LL_CLOCK_ACCURACY_RSP(Packet): 

704 name = "LL_CLOCK_ACCURACY_RSP" 

705 fields_desc = [ 

706 XByteField("sca", 0), 

707 ] 

708 

709 

710class LL_CIS_REQ(Packet): 

711 name = 'LL_CIS_REQ' 

712 fields_desc = [ 

713 XByteField("cig_id", 0), 

714 XByteField("cis_id", 0), 

715 BTLEPhysField('phy_c_to_p', 0), 

716 BTLEPhysField('phy_p_to_c', 0), 

717 LEBitField('max_sdu_c_to_p', 0, 12), 

718 LEBitField('rfu1', 0, 3), 

719 LEBitField('framed', 0, 1), 

720 LEBitField('max_sdu_p_to_c', 0, 12), 

721 LEBitField('rfu2', 0, 4), 

722 LEBitField('sdu_interval_c_to_p', 0, 20), 

723 LEBitField('rfu3', 0, 4), 

724 LEBitField('sdu_interval_p_to_c', 0, 20), 

725 LEBitField('rfu4', 0, 4), 

726 XLEShortField("max_pdu_c_to_p", 0), 

727 XLEShortField("max_pdu_p_to_c", 0), 

728 XByteField("nse", 0), 

729 XLE3BytesField("subinterval", 0x0), 

730 LEBitField('bn_c_to_p', 0, 4), 

731 LEBitField('bn_p_to_c', 0, 4), 

732 ByteField("ft_c_to_p", 0), 

733 ByteField("ft_p_to_c", 0), 

734 XLEShortField("iso_interval", 0), 

735 XLE3BytesField("cis_offset_min", 0x0), 

736 XLE3BytesField("cis_offset_max", 0x0), 

737 XLEShortField("conn_event_count", 0), 

738 ] 

739 

740 

741class LL_CIS_RSP(Packet): 

742 name = 'LL_CIS_RSP' 

743 fields_desc = [ 

744 XLE3BytesField("cis_offset_min", 0x0), 

745 XLE3BytesField("cis_offset_max", 0x0), 

746 XLEShortField("conn_event_count", 0), 

747 ] 

748 

749 

750class LL_CIS_IND(Packet): 

751 name = 'LL_CIS_IND' 

752 fields_desc = [ 

753 XLEIntField("AA", 0x00), 

754 XLE3BytesField("cis_offset", 0x0), 

755 XLE3BytesField("cig_sync_delay", 0x0), 

756 XLE3BytesField("cis_sync_delay", 0x0), 

757 XLEShortField("conn_event_count", 0), 

758 ] 

759 

760 

761class LL_CIS_TERMINATE_IND(Packet): 

762 name = 'LL_CIS_TERMINATE_IND' 

763 fields_desc = [ 

764 ByteField("cig_id", 0x0), 

765 ByteField("cis_id", 0x0), 

766 ByteField("error_code", 0x0), 

767 ] 

768 

769 

770class LL_POWER_CONTROL_REQ(Packet): 

771 name = 'LL_POWER_CONTROL_REQ' 

772 fields_desc = [ 

773 ByteField("phy", 0x0), 

774 SignedByteField("delta", 0x0), 

775 SignedByteField("tx_power", 0x0), 

776 ] 

777 

778 

779class LL_POWER_CONTROL_RSP(Packet): 

780 name = 'LL_POWER_CONTROL_RSP' 

781 fields_desc = [ 

782 LEBitField("min", 0, 1), 

783 LEBitField("max", 0, 1), 

784 LEBitField("rfu", 0, 6), 

785 SignedByteField("delta", 0), 

786 SignedByteField("tx_power", 0x0), 

787 ByteField("apr", 0x0), 

788 ] 

789 

790 

791class LL_POWER_CHANGE_IND(Packet): 

792 name = 'LL_POWER_CHANGE_IND' 

793 fields_desc = [ 

794 ByteField("phy", 0x0), 

795 LEBitField("min", 0, 1), 

796 LEBitField("max", 0, 1), 

797 LEBitField("rfu", 0, 6), 

798 SignedByteField("delta", 0), 

799 ByteField("tx_power", 0x0), 

800 ] 

801 

802 

803class LL_SUBRATE_REQ(Packet): 

804 name = 'LL_SUBRATE_REQ' 

805 fields_desc = [ 

806 LEShortField("subrate_factor_min", 0x0), 

807 LEShortField("subrate_factor_max", 0x0), 

808 LEShortField("max_latency", 0x0), 

809 LEShortField("continuation_number", 0x0), 

810 LEShortField("timeout", 0x0), 

811 ] 

812 

813 

814class LL_SUBRATE_IND(Packet): 

815 name = 'LL_SUBRATE_IND' 

816 fields_desc = [ 

817 LEShortField("subrate_factor", 0x0), 

818 LEShortField("subrate_base_event", 0x0), 

819 LEShortField("latency", 0x0), 

820 LEShortField("continuation_number", 0x0), 

821 LEShortField("timeout", 0x0), 

822 ] 

823 

824 

825class LL_CHANNEL_REPORTING_IND(Packet): 

826 name = 'LL_SUBRATE_IND' 

827 fields_desc = [ 

828 ByteField("enable", 0x0), 

829 ByteField("min_spacing", 0x0), 

830 ByteField("max_delay", 0x0), 

831 ] 

832 

833 

834class LL_CHANNEL_STATUS_IND(Packet): 

835 name = 'LL_CHANNEL_STATUS_IND' 

836 fields_desc = [ 

837 LEBitField("channel_classification", 0, 10 * 8), 

838 ] 

839 

840 

841# Advertisement (37-39) channel PDUs 

842bind_layers(BTLE, BTLE_ADV, access_addr=0x8E89BED6) 

843bind_layers(BTLE, BTLE_DATA) 

844bind_layers(BTLE_ADV, BTLE_ADV_IND, PDU_type=0) 

845bind_layers(BTLE_ADV, BTLE_ADV_DIRECT_IND, PDU_type=1) 

846bind_layers(BTLE_ADV, BTLE_ADV_NONCONN_IND, PDU_type=2) 

847bind_layers(BTLE_ADV, BTLE_SCAN_REQ, PDU_type=3) 

848bind_layers(BTLE_ADV, BTLE_SCAN_RSP, PDU_type=4) 

849bind_layers(BTLE_ADV, BTLE_CONNECT_REQ, PDU_type=5) 

850bind_layers(BTLE_ADV, BTLE_ADV_SCAN_IND, PDU_type=6) 

851 

852# Data channel (0-36) PDUs 

853# LLID=1 -> Continue 

854bind_layers(BTLE_DATA, L2CAP_Hdr, LLID=2) 

855bind_layers(BTLE_DATA, BTLE_CTRL, LLID=3) 

856bind_layers(BTLE_DATA, BTLE_EMPTY_PDU, {'len': 0, 'LLID': 1}) 

857bind_layers(BTLE_CTRL, LL_CONNECTION_UPDATE_IND, opcode=0x00) 

858bind_layers(BTLE_CTRL, LL_CHANNEL_MAP_IND, opcode=0x01) 

859bind_layers(BTLE_CTRL, LL_TERMINATE_IND, opcode=0x02)