Skip to content

fix(protocols): a layer rebuilt by from_data from a cut capture verifies before its short read is replayed #2703

Closed

Description

@JarryShaw

Found while reviewing #2699 and confirmed by a Sonnet cross-review. GRE.from_data on a cut header rebuilds the right octets (data == full[:n]), but it reads its checksum INVALID and warns.

This happens on the shared path. Every layer base (link, internet, transport, application, and the PCAP header) calls replay_short_read(super().from_data(...), data). So the cut record is applied only after the full-width, zero-filled rebuild has already been parsed and verified.

Any layer that verifies something during parse is affected. Apply the record before verification, or skip verification when the rebuilt layer carries a replayed __short_read__, so a rebuild from a cut capture is as quiet as the parse it came from.

Activity

  1. added this to the PyPCAPKit v1.6 milestone on Nov 2, 2026
  2. added
    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)
    on Nov 2, 2026
  3. moved this to Pending in PyPCAPKiton Nov 2, 2026
  4. JarryShaw commented on Nov 3, 2026

    @JarryShaw
    OwnerAuthor

    A worker is on it now. Moved to wip.

  5. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Nov 3, 2026
  6. moved this from Pending to WIP in PyPCAPKiton Nov 3, 2026
  7. JarryShaw commented on Nov 3, 2026

    @JarryShaw
    OwnerAuthor

    The fix is ready at 5abf254b5. It changes Protocol.from_data, pack and __post_init__, so a Sonnet review is running on the local commit before the PR opens. The PR will open once the Actions queue is below 20.

  8. JarryShaw commented on Nov 3, 2026

    @JarryShaw
    OwnerAuthor

    The PR is #2712.

  9. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions