Repository navigation
Pseudo-protocol class for the IP pseudo-header (checksum/integrity groundwork) #2471
Description
Pseudo-protocol class for the IP pseudo-header (checksum/integrity groundwork)
Summary
docs/source/contributing/pep.rst, "Checksum and Integrity Verification" and "Deterministic Construction Arguments" sections: the one's-complement Internet checksum (IPv4's header, TCP, UDP, ICMP/ICMPv6, OSPF) is sixteen-bit addition with end-around carry — not hard arithmetic. What blocks every one of those protocols is that TCP/UDP/ICMPv6's checksum is computed over the enclosing IP layer's source/destination addresses, protocol number and payload length, which a parsed protocol has no way to reach today.
The owner settled the design (pep.rst, and reaffirmed 2026-10-30 on #2470): a pseudo-protocol class for the IP pseudo-header, defined once for the IP family, serving both the parsing and the constructing path — not a back-reference from a parsed protocol to its parent. A back-reference only helps verification; the construction side needs the pseudo-header to emit a correct checksum too, and a shared class means both paths agree by definition rather than by coincidence.
Scope
- Define the pseudo-protocol class following the existing
Protocolclass conventions, covering the fields the one's-complement checksum needs (source/destination address, protocol number, payload length) for both IPv4 and IPv6 enclosing layers. - No cryptography, no existing design question open — this is the bounded first step every per-protocol checksum issue below depends on.
Not in scope
Per-protocol checksum verification/computation — see #2470 and its siblings. The cryptographic half (HIP's HIP_MAC/RVS_HMAC/RELAY_HMAC) is unblocked by this and already has precedent in ESP; it does not depend on this class.
Activity
JarryShaw commentedon Oct 30, 2026
Accepted and unstarted. Not dispatching a worker this sweep: the Actions queue is at 39, and
mainis frozen for the 1.5.1 release while its Unit Tests run waits to start. Dispatching once that run starts, and saying so here.JarryShaw commentedon Oct 30, 2026
Still held this sweep. The 1.5.1 release chain restarted on
main's new tip058ef5b31(the #2463 merge), and that Unit Tests run is queued behind the previous one. A worker's pushes would queue more runs ahead of the release. Dispatching once the release reaches its approval gate.JarryShaw commentedon Oct 30, 2026
Still held this sweep. The 1.5.1 release's Unit Tests run on
058ef5b31has 24 of 32 jobs still queued (Actions queue at 30). Dispatching once GitHub Release reaches its approval gate.JarryShaw commentedon Oct 30, 2026
Still held on Actions queue depth (30) while the 1.5.1 release runs.
JarryShaw commentedon Oct 30, 2026
Still held: Actions queue at 41 while the 1.5.1 release Unit Tests runs (14/32 jobs done).
JarryShaw commentedon Oct 30, 2026
Still held: Actions queue at 36 while the 1.5.1 release Unit Tests finishes (18/32 jobs done).
JarryShaw commentedon Oct 30, 2026
Still held: Actions queue at 29 while the 1.5.1 release Unit Tests finishes (31/46 jobs done).
JarryShaw commentedon Oct 30, 2026
Still held: Actions queue at 37;
main's release Unit Tests is waiting on runners for its ordering legs. No new pushes from me until it completes.JarryShaw commentedon Oct 30, 2026
Still held:
main's release Unit Tests has 14 jobs waiting for runners (Actions queue at 31).JarryShaw commentedon Oct 30, 2026
Still held: the 1.5.1 release Unit Tests re-run is in progress; no pushes until it completes.
27 remaining items
JarryShaw commentedon Oct 31, 2026
(a), with a per-call override only where a caller needs it.
JarryShaw commentedon Oct 31, 2026
Reconciled: toggle mechanism, and the open question is closed. Your ruling, paraphrased: the toggle is an environment variable, and where possible also a parameter on the Extractor and Protocol classes for per-instance control. That is option (c) from my list, with the per-call override only where a caller needs it. Combined with the default-state ruling (read path off, make path on), both questions are answered. Clearing
needs: decision. Applies to #2470, #2472 to #2475 and #2489.feat(protocols): move IP_Pseudo to misc.checksum (#2471)
feat(protocols): add the IP_Pseudo pseudo-protocol for the IP pseudo-…
fix(protocols): reject values IP_Pseudo cannot derive from the IP lay…
fix(protocols): derive IP_Pseudo's upper-layer values from the wire (#…
feat(protocols): move IP_Pseudo to misc.checksum (#2471)
fix(protocols): fix isort and a dead except branch in IP_Pseudo (#2471)
feat(protocols): add the IP_Pseudo pseudo-protocol for the IP pseudo-…
docs(pep): cite the #2470 checksum rulings (#2470)