Skip to content

fix(ipv6): reserved bits not named in a BitField are written back as zero (Frag, RPL routing, MPL, IP_DFF, Quick-Start) #1235

Closed
Closed
fix(ipv6): reserved bits not named in a BitField are written back as zero (Frag, RPL routing, MPL, IP_DFF, Quick-Start)#1235
Labels
fixPull requests that fix a defect (fix: subject prefix)

Description

@JarryShaw
JarryShaw
opened on Oct 7, 2026

Describe the bug
The BitField namespaces name only some bits, so the rest are zeroed on rebuild: schema/internet/ipv6_frag.py:38-41 (2 bits after the offset), schema/internet/ipv6_route.py:206-208 (20 reserved bits of the RPL header, RFC 6554), schema/internet/hopopt.py:706-710 (MPL rsv), :791-795 (IP_DFF), :653,:669 (Quick-Start nonce R bits). #1199 fixed only the RPL option; #1211 and #1212 are the TCP counterparts.

To Reproduce
Parse then rebuild: Frag 3b00000712345678 -> 3b00000112345678; RPL route 3b020301000abcde + 16x00 -> reserved 20 bits zero; MPL 3b006d044f05abcd -> 3b006d044005abcd; IP_DFF 3b00ee024f123400 -> 3b00ee0240123400; Quick-Start nonce 12345679 -> 12345678.

Expected behavior
Reserved bits are kept in info and re-emitted.

Found by the internet-v6 round-trip audit (#1202); reproduced on main at 11ae68ebf (repro check D8).

Found by the internet-v6 round-trip audit (#1202). The repro was re-checked by an independent verifier, and I re-ran it on main at 11ae68ebf.

Activity

  1. JarryShaw
    added
    fixPull requests that fix a defect (fix: subject prefix)
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 7, 2026
  2. JarryShaw
    added this to PyPCAPKiton Oct 7, 2026

  3. JarryShaw commented on Oct 7, 2026

    @JarryShaw
    JarryShaw
    on Oct 7, 2026
    OwnerAuthor

    A worker is on it now.

  4. JarryShaw
    added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 7, 2026
  5. JarryShaw
    added 2 commits that reference this issue on Oct 7, 2026

    fix(ipv6): IPv6 core headers rebuild byte-exactly (#1230, #1231, #1236,

    e57884f

    fix(ipv6-opts): rebuild HOPOPT and IPv6-Opts option areas byte-exactly (

    87fc86f

  6. JarryShaw commented on Oct 8, 2026

    @JarryShaw
    JarryShaw
    on Oct 8, 2026
    OwnerAuthor

    Every remaining site already round-trips on main (ec2ba13a4). #1307 fixed Frag and RPL routing; #1310 named reserved sub-fields for MPL, IP_DFF and the Quick-Start nonce R bits (schema/internet/hopopt.py, mirrored in ipv6_opts.py).

    Measured with parse → from_data(...).data through both HOPOPT and IPv6_Opts. All of these are byte-exact:

    • MPL rsv=0xf: 3b006d044f05abcd
    • IP_DFF reserved=0xf: 3b00ee034f123400
    • Quick-Start request, nonce R=1 and R=2
    • Quick-Start report, nonce R=1

    tests/protocols/internet/test_ipv6_options_roundtrip_unit.py already pins these cases.

    The IP_DFF repro in the body declares Opt Data Len 2; IP_DFF needs 3, and the reader correctly rejects it. Closing.

  7. JarryShaw
    closed this as completedon Oct 8, 2026
  8. JarryShaw
    removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 8, 2026
  9. JarryShaw
    added a commit that references this issue on Oct 15, 2026

    docs(protocols): second pass over the IPv6 extension headers (#1103) (#…

    ccd169e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions