[JarryShaw]

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort): ran all three on the six touched files only; nothing new beyond the existing stub-signature and router_id warnings

• make test passes, and a test case covers the change: ran the modules listed below

• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

• fix: corrects a defect

---

Closes #1455

This is the same fix as #1431/#1435. The payload now stops at the declared length. A length-less trailer field follows it and is kept as info.trailer when it is non-empty. make(trailer=) writes it outside the length. Breaking: the payload no longer includes these octets, and that covers the OSPF crypto digest (RFC 2328 D.4.3).

case	before	after
L2TPv2 Length 8 + pp	10 → 8	10 → 10
OSPF Packet Length 24 + zz	26 → 24	26 → 26

Checked: ARP, RARP, Ethernet, VLAN, HTTP/2, FTP and NGAP are already exact. UDP (transport, so not mine) drops octets the same way. The two other edge cases are both short reads and belong to #1458: an L2TPv2 Offset Size that points past the data, and an unpadded final SCTP chunk.

Tests: the new module passes 8 tests and 12 subtests. Without the fix, 11 fail. Also passing: the protocols --exclude protocols/internet leg (1134 tests, OK), test_capture_roundtrip_runtime.py and tests/project (419 passed, 1 skipped). Per-frame info for examples/captures/ is identical.

[github-actions]

Coverage: 89.51% (unit tier, Python 3.14, 325c6715b, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18795	968	2356	869	90.90%
pcapkit/corekit	2043	89	636	25	94.77%
pcapkit/dumpkit	242	2	88	2	98.79%
pcapkit/foundation	2648	98	930	48	94.80%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16887	225	4560	189	98.03%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Verdict: GOOD TO GO at 325c6715b (Sonnet cross-review; the author ran on Opus).

• L2TPv2: all 64 L/S/O × Offset Size × payload × trailer cases rebuild byte-exact, through both from_data(info) and the dict form. make()→parse→make is also exact. I re-ran the issue repro myself: 10 of 10, with trailer=b'pp'. The header size is 6 + 2·(1 + 2·S + O) + Offset Size, which matches make.
• OSPF: 180 cases, v2/v3, types 1–5, auth 0/1/2, are exact in object form. Packet Length 0, 10, 23 and 100 against a 30-byte packet all rebuild to 30.
• The digest really is outside Packet Length. RFC 2328 D.4.3(d) says so, and nothing decoded the digest before this change, so no field was lost.
• Upper layers stay exact. IPv4/UDP-1701/L2TPv2/PPP rebuilds exactly in both forms.
• Tests. The new module has 11 failures without the fix. The rest leg runs 1134 OK, tests/project passes, and the test: capture-driven parse→rebuild and dumper round trips (#1202) #1445 capture modules give 22226 subtests passed.

Two pre-existing defects, not caused by this PR:

• An L2TPv2 Offset Size that points past the data still rebuilds longer than captured. That is the fix(corekit): a header cut inside a fixed-width field is zero-filled on parse and rebuilt at full width #1458 short-read case.
• OSPF AuType 2 raises in dict form, on main too. Filed as fix(ospf): from_data(info.to_dict()) raises for cryptographic authentication #1464, in the same family as fix(protocols): from_data(info.to_dict()) drops the payload because to_dict omits __next_type__/__next_name__ #1447.

Nit: with the L flag clear, make(trailer=…) folds the trailer into the payload when the packet is parsed again. The schema comment says so, but the make docstring does not.

Merge note: #1454's Gap(1455) goes stale when this lands. Whichever of the two merges second removes it.