Repository navigation
fix(protocols): malformed MH messages and MPTCP DSS options do not rebuild as captured #2669
Description
Some complete but malformed MH messages and TCP MPTCP DSS options do not rebuild as captured. One example is an MH Home_Test whose length field is too small: it rebuilds as 16 of its 24 octets. The owner ruled that every parse→rebuild round trip must match byte for byte. The #2660 worker found this through a one-octet mutation search over complete packets. It has not been reproduced independently, and #2660 did not change it.
To do:
- Reproduce on
mainwith one-octet mutations of complete MH messages and of TCP options carrying MPTCP DSS. - Find why a length field shorter than the octets present loses the remainder.
- Fix it so the rebuild writes the octets as captured, with the extra octets kept where the schema keeps trailing data.
Blocked on #2614's transport and internet PRs, which own tcp.py and mh.py. Unblocks when both merge.
Activity
JarryShaw commentedon Nov 2, 2026
#2677 and #2679 have merged, so this is unblocked. A worker is on it now. Moved from
blockedtowip.JarryShaw commentedon Nov 2, 2026
The PR is #2683. A Sonnet review is running, and it is also checking the mobility-option and cut-MH side findings before I file them.
fix(protocols)!: refuse an MH message or MPTCP DSS option whose lengt…
fix(protocols)!: refuse an MH message or MPTCP DSS option whose lengt…