Repository navigation
fix(pcapng)!: keep malformed journal entries and short packet blocks as captured (#1413, #1414) - #1420
Merged
Conversation
…as captured (#1413, #1414) - Journal Export: a line with no terminating newline (e.g. a bare KEY), a binary field with a short length prefix or without its closing newline, and any entry whose parsed fields would not rebuild octet for octet now raise inside the walk, so the whole entry is kept as `entry_raw` and rebuilt verbatim, per the #1406 ruling. Lines are no longer stripped. - SPB: packet data past `original_len` and its padding is kept, with a warning, as #1384 does for the snaplen. - EPB/PB: a Block Total Length below the 32-octet minimum keeps the block body as `block_raw`, which make() writes back at the declared length. - Tests that pinned the old lossy journal parses now assert the entry is kept as captured; new regression module for both issues.
JarryShaw
changed the title
JarryShaw
force-pushed
the
fix/1413-1414-pcapng-kept-as-captured
branch
from
October 8, 2026 13:44
d8b013f to
f0565f7
Compare
JarryShaw
added
fix
Contributor
|
Coverage: 89.44% (unit tier, Python 3.14,
Per-file detail: the |
Owner
Author
|
Verdict: GOOD TO GO at
|
JarryShaw
added
review: good-to-go
This was referenced Oct 8, 2026
JarryShaw
removed
the
review: good-to-go
4 of 5 tasks
JarryShaw
added a commit
that referenced
this pull request
Oct 8, 2026
…tured (#1422) - SHB below 28 octets and IDB below 20 read their fixed fields past the Block Total Length and rebuilt at the full fixed size. The body is now kept as `block_raw`, which make() writes back at the declared length, as #1420 does for EPB/PB; fields the block holds are decoded, the rest read as zero, and options are empty. - The schemas skip the length/length2 comparison for such blocks; the reader compares the real trailing copy itself. - A 12-octet SHB has no room for its Byte-Order Magic, so it takes the byte order in which its Block Total Length reads as 12. A bad magic on any other length still raises ProtocolError. - New regression module for #1422.
JarryShaw
added a commit
that referenced
this pull request
Oct 8, 2026
…tured (#1422) (#1425) - SHB below 28 octets and IDB below 20 read their fixed fields past the Block Total Length and rebuilt at the full fixed size. The body is now kept as `block_raw`, which make() writes back at the declared length, as #1420 does for EPB/PB; fields the block holds are decoded, the rest read as zero, and options are empty. - The schemas skip the length/length2 comparison for such blocks; the reader compares the real trailing copy itself. - A 12-octet SHB has no room for its Byte-Order Magic, so it takes the byte order in which its Block Total Length reads as 12. A bad magic on any other length still raises ProtocolError. - New regression module for #1422.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Searched for similar pull requests
Followed the coding style (
make pylint,make mypy,make isort) — run on the changed files with the Makefile flags; no new findingsmake testpasses, and a test case covers the change — the pcapng modules,tests/projectandrun_unittest_leg.py protocols --exclude protocols/internetonlyAdded a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657
fix— corrects a defectCloses #1413
Closes #1414
Byte-exact rebuild (
PCAPNG.from_data(PCAPNG(raw).info).data), before → after: journal binary field missing its closing\n28→32 ⇒ 28; bareKEY16→12 ⇒ 16; SPBoriginal_len=3+ 8 octets 24→20 ⇒ 24; EPB/PB of length 12–28 → 32 (EPB-12 raisedFormatError) ⇒ unchanged.entry_rawper the question(pcapng): should the Journal Export binary-field clamp go strict like #1325? #1406 ruling. Lines are no longerstrip()ped. Contract change: those malformed entries now parse asdata == ()instead of a lossy decode; tests intest_pcapng_unit.pythat pinned the old decodes were rewritten.original_len(plus padding) is kept, with a warning, as fix(pcapng): a Simple Packet Block longer than the snaplen is silently truncated on parse #1384 does for snaplen.block_raw(fields it holds decoded, the rest zero),make()writes it back.Tests: new
tests/protocols/misc/test_pcapng_kept_as_captured_1413_1414_unit.py(6 tests; 16 subtests fail without the fix). pytest per module, all green;tests/project399 passed, 1 skipped; leg: 1059 tests, 0 failures.