mirage
mirage copied to clipboard
Fix BLE ACL fragmented packet reassembly
I believe there was a bug in BLE packet reassembly. Current code assumed L2CAP_Hdr will be after HCI_ACL_Hdr in incoming packet fragments, but this is not true. In the next fragments there can be any data which only sometimes will be interpreted by scapy as L2CAP. According to Wireshark's dissector actual fragment data starts after HCI_ACL_Hdr which I extracted using HCI_ACL_Hdr:][1:].
Also both reassembly if statements can be pulled into the conditional immediately after them.
I just stumbled on the same problem, and got to the same conclusion. Then I found your PR. Thanks for this. This should be integrated in master.