Skip to content

fix(schema): SMF_DPD option at the end of the header raises TypeError from smf_i_dpd_id_len - #1197

Merged
JarryShaw merged 1 commit into
mainfrom
fix/1195-smf-dpd-truncated-len
Oct 7, 2026
Merged

JarryShaw merged 1 commit into
mainfrom
fix/1195-smf-dpd-truncated-len

Conversation

@JarryShaw

Copy link
Copy Markdown
Owner
  • Searched for similar pull requests
  • Followed the coding style (make pylint, make mypy, make isort) — not run; only the touched lines changed
  • make test passes, and a test case covers the change — the modules listed below only, not the whole suite
  • Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

  • fix — corrects a defect

Closes #1195. Root cause: Schema.unpack rewound a ForwardMatchField by its declared width, not by the octets it actually read. _SMFDPDOption.test forward-matches 3 octets, but only 2 are left at the end of the header. The 3-octet rewind then re-parsed the option from the last PadN padding octet, as Pad1, so len was skipped and set to NO_VALUE. CALIPSO and MPL have no forward match, so they read len=0 and hit their length guards. The fix rewinds by len(byte) (pcapkit/protocols/schema/schema.py). SMF_DPD now reaches the existing smf_i_dpd_id_len guard. hopopt.py and ipv6_opts.py are unchanged.

3b0001020000 + 0800 before after
HOPOPT / IPv6_Opts TypeError: … 'NoValueType' and 'int' FieldValueError: invalid SMF I-DPD option length: 0

Sweep: I placed every option type except RPL 0x23 (#1196) at that position with len 0, in both classes. Before the fix, 0x08 raised a non-library exception in both. After it, none of the 510 cases does.

Tests: the new tests/protocols/internet/test_smf_dpd_truncated_len_unit.py reports 2 passed, 512 subtests passed. With the fix reverted it reports 4 failed (SMF 0x08 in both classes). These all pass: the misc/schema/ipv6-ext/ipv4/mh/smf/mpl/qs/tcp/pcapng/option-roundtrip/option-coverage modules, tests/project (389 passed, 1 skipped), and run_unittest_leg.py protocols/internet (493 test(s), 0 failure(s), 0 error(s)).

… from smf_i_dpd_id_len

Schema.unpack rewound a ForwardMatchField by its declared width rather
than by the octets it actually read. At the end of the stream the read
comes back short, so the rewind landed before the forward match and the
fields after it re-read the preceding octet. An SMF_DPD option in the
last two octets of a HOPOPT/IPv6-Opts header was therefore re-parsed
from the PadN padding as Pad1, leaving len as NO_VALUE.

Rewind by len(byte). The option now reaches the existing SMF I-DPD
length guard and raises FieldValueError, as CALIPSO and MPL do.

Closes #1195
@JarryShaw JarryShaw added fix Pull requests that fix a defect (fix: subject prefix) review: running A cross-review is in flight against the current head - no verdict yet labels Oct 7, 2026
@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Coverage: 88.90% (unit tier, Python 3.14, 75609c255, Unit Tests run success)

Package Statements Missed Branches Partial Cover
pcapkit (top level) 104 4 20 4 93.55%
pcapkit/const 18757 1034 2342 845 90.24%
pcapkit/corekit 1878 91 580 22 94.34%
pcapkit/dumpkit 142 0 42 0 100.00%
pcapkit/foundation 2442 102 852 39 94.38%
pcapkit/interface 112 7 40 5 92.11%
pcapkit/protocols 15755 190 4024 165 98.17%
pcapkit/toolkit 487 65 144 1 85.42%
pcapkit/utilities 429 4 122 4 98.55%
pcapkit/vendor 4409 2359 1006 158 42.84%

Per-file detail: the coverage-html artifact of this run.

@JarryShaw

Copy link
Copy Markdown
Owner Author

Cross-review verdict on 75609c255: GOOD TO GO (Sonnet reviewed; the author ran on Opus).

  • Root cause: on main, 3b00010200000800 raises a bare TypeError. On this branch it raises FieldValueError: invalid SMF I-DPD option length: 0. I re-ran it myself.
  • Scope of the change: 8 schema ForwardMatchField users (HOPOPT, IPv6-Opts, IPv4, MH, TCP, PCAP-NG). The new rewind differs only when the forward read is short.
    • All 23 fixture captures, 1605 frames through extract(), give identical info digests on main and this branch.
    • 22,260 truncated-Ethernet parses, 36,512 random-byte outcomes and 414 truncated PCAP-NG cuts are identical too, except the targeted type 0x08.
  • Option sweep: across all 256 types, 0x08 no longer raises a non-library exception. Only 0x23 remains, which is fix(ipv6-opts): RPL option 0x23 raises AttributeError in _read_opt_unassigned #1196.
  • Tests: the new tests fail on main's schema.py (4 failures).
    • run_unittest_leg.py protocols/internet: 493 tests, 0 failures.
    • run_unittest_leg.py protocols excluding internet: 850 tests, 0 failures.
    • The three tests/corekit/test_fields_misc* modules: 19 passed (my run).
  • Design: fixing the generic rewind in core is right; a guard in smf_i_dpd_id_len would only hide one symptom.
  • UNVERIFIED: the standalone test_pcapng_unit.py run did not finish within the budget. Its tests passed inside the protocols leg.

@JarryShaw JarryShaw added review: good-to-go Cross-review at the current head says ready; CI state is separate and removed review: running A cross-review is in flight against the current head - no verdict yet labels Oct 7, 2026
@JarryShaw
JarryShaw merged commit ace5088 into main Oct 7, 2026
43 checks passed
@JarryShaw
JarryShaw deleted the fix/1195-smf-dpd-truncated-len branch October 7, 2026 16:16
@JarryShaw JarryShaw removed the review: good-to-go Cross-review at the current head says ready; CI state is separate label Oct 7, 2026
JarryShaw added a commit that referenced this pull request Oct 7, 2026
Seven new entries and one extension in docs/source/changelog/1.5.0.rst,
the regenerated CHANGELOG.md, and the process.rst entry-count pin
re-measured (193 -> 200). The opening snapshot now cites 319 issues and
pull requests up to #1195.
@JarryShaw JarryShaw added this to the PyPCAPKit v1.5 milestone Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix Pull requests that fix a defect (fix: subject prefix)

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

fix(schema): SMF_DPD option at the end of the header raises TypeError from smf_i_dpd_id_len

1 participant