Repository navigation
fix(misc): PCAP-NG secrets blocks rebuilt from a dict lose their captured octets #2698
Description
Found while reviewing the #2688 fix, and confirmed by a Sonnet cross-review. It is independent of that change. Rebuilding a PCAP-NG Decryption Secrets Block from a plain dict, PCAPNG.from_data(parsed.info.to_dict(), …), does not give back the captured block:
- ZigBee NWK/APS keys: the rebuild differs on every count except the exact key width. Through the dict path,
_make_secrets_zigbee_nwk/_apsgetsecrets=None, withdata,nwk_keyandpan_idin**kwargs. They ignoredataand write the zero-padded key. - TLS key log:
from_data(info)is exact, butfrom_data(info.to_dict())onCLIENT_RANDOM 00112233 aabbccdd\ngains a# generated by PyPCAPKitline and trailing octets.
Every round trip must match, so the dict path has to rebuild the octets as captured, as the model path does.
Activity
JarryShaw commentedon Nov 2, 2026
The host load has cleared, so a worker is on it now. Moved to
wip.JarryShaw commentedon Nov 2, 2026
The fix is ready at
b5a4c11f0. Its PR is held while the Actions queue is at 39; new PRs open once it is below 20. A Sonnet review is running on the local commit in the meantime.JarryShaw commentedon Nov 2, 2026
The PR is #2707.