Skip to content

bluetooth: add missing HCI events, EIR elements, and SMP packet types#4987

Merged
gpotter2 merged 2 commits into
secdev:masterfrom
XenoKovah:missing-bluetooth
May 16, 2026
Merged

bluetooth: add missing HCI events, EIR elements, and SMP packet types#4987
gpotter2 merged 2 commits into
secdev:masterfrom
XenoKovah:missing-bluetooth

Conversation

@XenoKovah
Copy link
Copy Markdown
Contributor

I've been using the following definitions on my fork for a long time, because I didn't know how to make unit tests. So @antoniovazquezblanco just upstreamed some of my stuff when he had time. Well I still don't know how to make unit tests, but Claude does if I just point it at pcaps/HCI logs. So this is now a PR of stuff I've confirmed was working long ago, but now it meets the ask for unit tests. Note: the packet definitions themselves aren't AI generated, I made them. But the unit tests are AI generated based on real pcaps/HCI logs I collected in field.

HCI events

  • HCI_Event_Connection_Request (code=0x04)
  • HCI_Event_Remote_Host_Supported_Features_Notification (code=0x3d)
  • HCI_Event_Vendor (vendor-specific debug) (code=0xff)
  • HCI_LE_Meta_LE_Read_Remote_Features_Complete (LE Meta event=0x04)

EIR/AD elements

  • EIR_RandomTargetAddress (type=0x18)
  • EIR_LERole (type=0x1c)
  • EIR_BroadcastName (type=0x30)
  • EIR_3DInformation (type=0x3d)

SMP

  • SM_Keypress_Notification (sm_command=0x0e)

Each packet has an entry in test/scapy/layers/bluetooth.uts with a sample drawn from a real HCI snoop log (BR/EDR Connection Request, Remote Host Supported Features Notification, LE Read Remote Features Complete, vendor-specific debug event, EIR 3D Information, EIR Broadcast Name) and synthetic round-trip build/parse tests for the remainder (which are rare and weren't present in any of the pcap/HCI logs.)

Checklist :

  • If you are new to Scapy: I have checked CONTRIBUTING.md (esp. section submitting-pull-requests)
  • I squashed commits belonging together
  • I added unit tests or explained why they are not relevant
  • I executed the regression tests (using tox)
  • This PR uses (partially) AI-generated code. If so:
    • I ensured the generated code follows the internal concepts of scapy (No, since I still haven't learned how your unit tests work.)
    • This PR has a test coverage > 90% (No, because I don't know how to do that)
    • I reviewed every generated line (No, since I still haven't learned how your unit tests work.)
    • If this PR contains more than 500 lines of code (excluding unit tests) I considered splitting this PR. (No, since I just want to push my forked stuff upstream.)
    • I considered interoperability tests with existing packages or utilities to ensure conformity of a newly generated protocol. (N/A AFAIK.)

I understand that failing to mention the use of AI may result in a ban. (We do not forbid it, but you must play fair. Be warned !)

Adds missing Bluetooth definitions from the spec.

New packet definitions covering frequently-seen Bluetooth Core 5.4 events
and Generic Access Profile data types that scapy did not yet decode:

  HCI events
  - HCI_Event_Connection_Request                        (code=0x04)
  - HCI_Event_Remote_Host_Supported_Features_Notification (code=0x3d)
  - HCI_Event_Vendor (vendor-specific debug)            (code=0xff)
  - HCI_LE_Meta_LE_Read_Remote_Features_Complete        (LE Meta event=0x04)

  EIR/AD elements
  - EIR_RandomTargetAddress                             (type=0x18)
  - EIR_LERole                                          (type=0x1c)
  - EIR_BroadcastName                                   (type=0x30)
  - EIR_3DInformation                                   (type=0x3d)

  SMP
  - SM_Keypress_Notification                            (sm_command=0x0e)

Each packet has an entry in test/scapy/layers/bluetooth.uts with a
sample drawn from a real HCI snoop log (BR/EDR Connection Request,
Remote Host Supported Features Notification, LE Read Remote Features
Complete, vendor-specific debug event, EIR 3D Information, EIR
Broadcast Name) and synthetic round-trip build/parse tests for the
remainder.
@codecov
Copy link
Copy Markdown

codecov Bot commented May 4, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.29%. Comparing base (8c5a9a8) to head (0e24893).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #4987   +/-   ##
=======================================
  Coverage   80.28%   80.29%           
=======================================
  Files         383      383           
  Lines       94703    94739   +36     
=======================================
+ Hits        76031    76067   +36     
  Misses      18672    18672           
Files with missing lines Coverage Δ
scapy/layers/bluetooth.py 90.59% <100.00%> (+0.29%) ⬆️

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread scapy/layers/bluetooth.py Outdated
Comment thread scapy/layers/bluetooth.py Outdated
Co-authored-by: Gabriel <10530980+gpotter2@users.noreply.github.com>
Copy link
Copy Markdown
Member

@gpotter2 gpotter2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR !

@gpotter2 gpotter2 enabled auto-merge (squash) May 9, 2026 12:04
@gpotter2 gpotter2 merged commit d535501 into secdev:master May 16, 2026
24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants