Repository navigation
fix(link): keep a captured FRAD pad octet through a whole-frame rebuild (#2716) - #2721
Merged
Merged
Conversation
…ld (#2716) RFC 2427 section 3 allows the one zero pad octet ahead of any NLPID, and FRAD reads one wherever it is, but the data model did not record it, so make() wrote the pad ahead of a SNAP header alone. A pad ahead of a direct NLPID (0c21 03 00 cc) was lost on a rebuild, and one was invented ahead of a SNAP header captured without it (0c21 03 80 ...). - The FRAD data model records pad, and _make_data passes it on. - make() takes pad. When it is None, the pad goes ahead of a SNAP header alone, as RFC 2427 section 4.1 writes it, and ahead of an NLPID of 0, which reads as the pad, so a direct build is unchanged. pad=False with an NLPID of 0 raises ProtocolError. - The FRAD prose stops calling the pad SNAP's alone. test_frad_pad_rebuild_2716_unit fails without the pcapkit/ change, but for the control that a direct build is unchanged. Shipped captures parse identically. The link, internet, project and root protocols modules, both schema round trips, and the #2710 and short-read sweeps pass. Closes #2716
JarryShaw
added
bug
Owner
Author
|
GOOD TO GO at
|
JarryShaw
removed
the
review: good-to-go
1 of 5 tasks
JarryShaw
added a commit
that referenced
this pull request
Nov 3, 2026
…s.pickle, FRAD's pad and the TCP and HIP maker fixes into 1.6.0 (#2449) - Breaking: a fixed-size octet field given any other width raises, where 1.5.x padded or cut it, and IPv4's Timestamp option refuses a slot count past what it holds, where 1.5.x cut it (#2691); folded into the IPv4 to HIP makers' range-check entry, with the ZigBee keys into the PCAP-NG entry. Old values measured against v1.5.1. - Added: pcapkit.utilities.pickle, whose ReduceAsProtocol2 lets Info, Schema and the reassembly engines pickle under protocols 0 and 1 on GraalPy, and numbers._reduce_unregistered_member's removal (#2722). - Fixed: TCP's raw-octet options, HIP's default version, HIP's ENCRYPTED IV and its cipher on parse (#2724). - Folded into unreleased entries: FRAD's pad field and make(pad=) (#2721). - No entry for the docstring-only 596dcfa, the test-only 149cced, or #2724's MH annotation. - CHANGELOG.md regenerated; util/changelog_md.py --check passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
fix— corrects a defectA whole FRAD frame lost or gained a pad octet when rebuilt.
0c21 03 00 cc+ IPv4 rebuilt without its pad, and0c21 03 80 000000 0806+ ARP rebuilt with one. RFC 2427 §3 allows the single zero pad "when required", before any NLPID, but the data model did not record whether a pad was captured.pad: boolfield.read()sets it when the first NLPID octet is zero.make(pad=None): by default the pad goes before SNAP (0x80) and before an NLPID of 0, so a direct build is unchanged. A differential over six NLPIDs gives identical octets.TrueandFalseoverride the default, andpad=Falsewith an NLPID of 0 raisesProtocolError. This follows the presence-flag pattern of GREchecksum_presentand L2TPv2length_flag.Both frames now rebuild exactly through
from_data(info)andfrom_data(info.to_dict()), whole and at every cut, and behind LinuxSLL1 and LinuxSLL2. Nothing is logged. The new tests fail onmain. FRAD has not shipped, so the new required field breaks no release.Closes #2716