secdev / secdev/scapy

Allowing multiple Bluetooth VSC contrib layers to coexist (OGF 0x3F opcode collisions)

Open
#5,173 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
12.6k
Forks
2.2k
Avg merge
1d 4h
Merged PRs (30d)
56

Description

Context

Bluetooth HCI vendor-specific commands (VSCs) all live under OGF 0x3F, and each vendor numbers its own OCFs independently. Those numbers overlap across vendors, and a VSC frame on the wire carries no vendor identifier only the opcode.

This means that two contrib VSC layers can legitimately bind different packet classes to the same (ogf, ocf) / command‑complete opcode.

This was noted while adding Espressif and Zephyr VSCs:

Opcode bluetooth_vsc_zephyr bluetooth_vsc_espressif
0xFC01 Read Version Info Read Memory
0xFC02 Read Supported Commands Write Memory

This makes some tests fail, that has been mitigated by explicitly parsing the packets in the tests instead of relaying on auto-dissection. It seemed like good enough to have the tests, both vendor definitions and allowing the user to work with a single vendor loaded.

Question / Options / Ideas

While developing tools, it may be interesting to load different VSCs and to have them correctly auto-dissected.

I am unsure if the complexity would be worth it and/or what solution you may find better suited. I am also possibly missing something and you may be able to point me in the right direction!

Here are some ideas:

  1. Leave as is: The user will have to work with only one vendor and that is the end of it, Tests will need partial manual parsing...
  2. Isolate test campaigns: Fix the tests loading contrib layers to run in separate process/binding/reset registry between campaing. Only fixes the manual parsing in tests, The user still will only be able to use a single vendor per scapy session...
  3. Use dispatch_hook: I can modify the Bluetooth layer to use a dispatch hook in this case. That is far from ideal because although right now we may be able to distinguish between the existing cases, the payloads are too short and to fuzzy to really pull it off in the long term, I think.
  4. Conf/context based: Each socket is expected to only handle one vendor. If there is a socket context memory, we may use that context to know wich vendor corresponds to that socket. If an user sends vendor A packets via a socket, it is expected to decode responses as vendor A.

Any ideas guys?
Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the Bluetooth layer, the bluetooth_vsc_zephyr and bluetooth_vsc_espressif contrib definitions, and the tests that explicitly parse these packets. Compare the proposed dispatch_hook and socket-context approaches, then clarify the desired behavior for concurrent vendor layers. Done means an agreed design and corresponding implementation that supports the selected coexistence behavior without relying on ambiguous packet payloads.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.