Skip to content

fix(protocols): cut a rebuilt short read back before it is read and verified (#2703) - #2712

Merged
JarryShaw merged 1 commit into
mainfrom
fix/2703-replay-before-verify
Nov 3, 2026
Merged

JarryShaw merged 1 commit into
mainfrom
fix/2703-replay-before-verify

Conversation

@JarryShaw

Copy link
Copy Markdown
Owner

What is the purpose of your pull request?

  • fix — corrects a defect

Description of your pull request and other information

A layer rebuilt by from_data from a cut capture rebuilt the right octets, but verified before its short read was replayed. GRE, ICMP, IGMP and OSPF therefore read INVALID and raised a false ChecksumWarning. The cause was on the shared path: each layer base replays the record only after the full-width, zero-filled rebuild has been parsed.

The fix is in Protocol, one level below the layer bases:

  • from_data hands the data's __short_read__ record to the construction for that call, as it does __reconstructing__.
  • pack cuts the header it makes back with Schema._cut_short_read.
  • __post_init__ gives read the captured octets at the declared width, as a parse inside a capture already does.

Each verifier then reads TRUNCATED through its existing check, with no per-protocol code. replay_short_read and the layer bases are unchanged.

For every cut that leaves a record, from_data(info) and from_data(info.to_dict()) give back the captured octets and checksum status and log nothing. This holds for directly built GRE, IGMPv1/v2/v3 and OSPF, and for ICMP and IGMPv3 read from a cut savefile. The tests fail on main, with whole and wrong-checksum messages as controls.

Closes #2703

…erified (#2703)

Every layer base rebuilt a header the capture cut short at full width, the
missing octets as zeros, parsed and verified that, and only then let
replay_short_read cut it back. A layer verifying during its parse read the
zero-filled checksum INVALID and warned, where its capture read TRUNCATED.

- Protocol.from_data hands the data model's __short_read__ to the
  construction, as it does __reconstructing__.
- Protocol.pack cuts the header it makes back through the schema's own
  record and Schema._cut_short_read, and __post_init__ reads the octets
  captured at the width the header declares, as a capture is read at its
  parent's. GRE, ICMP, IGMPv1/v2/v3 and OSPF then read TRUNCATED from the
  same checks their capture used, with no verifier changed;
  replay_short_read finds the rebuild already cut.

test_short_read_rebuild_quiet_2703_unit fails without the fix, and pins that
the instance keeps no __short_read__ once from_data returns or raises. The internet,
link, transport, application, misc, schema and root protocols modules, both
schema round trips and the project guards pass.

Closes #2703
@JarryShaw JarryShaw added this to the PyPCAPKit v1.6 milestone Nov 3, 2026
@JarryShaw JarryShaw added bug Issues reporting a defect (set by the bug report template; a default, not an assessment) review: good-to-go Cross-review at the current head says ready; CI state is separate labels Nov 3, 2026
@JarryShaw

Copy link
Copy Markdown
Owner Author

GOOD TO GO at 987711d1f, from a Sonnet cross-review.

  • The record cannot leak: it is instance state, set by from_data and deleted in finally, so nested and failed rebuilds keep none. A test pins this on success and on two kinds of failure.
  • No regressions: all 13 legs pass. A 126,672-row differential across the example captures gives identical octets and no new messages.
  • The fix works: GRE, ICMP, IGMPv1/v2/v3 and OSPF rebuilt from a cut capture read TRUNCATED and stay quiet.

@JarryShaw JarryShaw moved this to In review in PyPCAPKit Nov 3, 2026
@JarryShaw
JarryShaw merged commit 37355fe into main Nov 3, 2026
63 checks passed
@JarryShaw
JarryShaw deleted the fix/2703-replay-before-verify branch November 3, 2026 02:11
@github-project-automation github-project-automation Bot moved this from In review to Done in PyPCAPKit Nov 3, 2026
@JarryShaw JarryShaw removed the review: good-to-go Cross-review at the current head says ready; CI state is separate label Nov 3, 2026
JarryShaw added a commit that referenced this pull request Nov 3, 2026
… helpers, MH options 6 and 27, the cut SCTP and option-area schemas and dict-built secrets into 1.6.0 (#2449)

- Breaking: a make() enumeration field takes a member or an int, its
  X_default/X_namespace/X_reversed keywords removed with no alias, and names,
  wide codes and wide option codes are refused (#2692); the schema helpers
  move to pcapkit.corekit.schema and pcapkit.corekit.fields.byteorder is
  removed (#2704); MobileNetworkPrefixOption gains prefix_length and keeps an
  IPv6Address prefix, and TimestampOption's timestamp is None past 9999
  (#2709). Folded into the MH data-model entry; old values measured against
  v1.5.1.
- Fixed: the SCTP schema cut inside its padding and a header schema cut
  inside an option area pack back as captured (#2682), into the SCTP entry;
  a Decryption Secrets Block rebuilds from its dict as captured (#2707), into
  the DSB entry.
- Folded into unreleased entries: FRAD's Q.922 address refusal and quiet cut
  rebuild (#2719); a from_data rebuild's checksum status (#2712); a failed
  ListField fill's ledger (#2706); pad_length's path (#2704); TLS's enumeration
  fields (#2692); the make() and schema-helper rulings, into the conventions
  entry (#2692, #2704); the GraalPy shards, into the CI-legs entry (#2720).
- 1.5.0's corekit.fields.byteorder role points at corekit.schema.byteorder,
  where #2704 moved it, so the nitpicky build does not warn on it; 1.5.0's
  text unchanged.
- No entry for the test-only 72b2bd8 (#2715), or the docs-and-test-only
  0c07940 (#2718).
- CHANGELOG.md regenerated; util/changelog_md.py --check passes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Issues reporting a defect (set by the bug report template; a default, not an assessment)

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

fix(protocols): a layer rebuilt by from_data from a cut capture verifies before its short read is replayed

1 participant