Repository navigation
Conversation
…s the record (#2525) An SSLv2 CLIENT-HELLO advertising 0x0300, 0x0301 or 0x0303 on TCP 443 parsed as SSLv2, but TLS's record-header read had already warned `packet length < 0`, and under an `error` filter the hello became Raw. - `TLS.unpack` runs the TLS trial (header read and `read`) inside `hold_warnings`, then the SSLv2 fallback in a block of its own. - A successful fallback drops the TLS trial's warnings; a failed one drops its own. When both fail, TLS's are dropped under `beholder` and reported as the error leaves outside it, as #2308 rules. - `read` reads the TLS record alone; the fallback moves to `unpack`. Tests: new test_tls_sslv2_fallback_warnings_2525_unit.py, under both `always` and `error`; 17 of its cases fail without the fix.
…2517) TLS dissected only a segment's first record and left every later one as Raw, e.g. the Alert after a ChangeCipherSpec. - `TLS._import_next_layer` dissects the remainder as a further TLS layer when a whole record opens it, so each record is its own layer and carries the next as its payload; anything else stays Raw. - `_opens_whole_record` reads only the header (content type, 0x03xx version, fragment inside the segment), so a trailing partial record stays Raw with no trial parse; `beholder` keeps a whole record that fails to decode as Raw. - FRAME_LAYER_LIMIT bounds the records, as for any other layer. Tests: segment cases in the TLS round-trip module (parse->rebuild and make->parse byte-exact) and SegmentRecordTests; 16 fail without the fix.
…rial (#2517) Owner rulings on #2517: Q2 (A), a record after the first in a segment that fails to decode becomes Raw directly, while the first keeps its SSLv2 fallback; Q1 (a), chained layers, goes onto the conventions. - `TLS.unpack` takes `chained`, which `_import_next_record` passes, and skips `_read_sslv2_fallback` for such a record. - `_RECORD_HEADER_LENGTH` names the record header's length for `_opens_whole_record`, `length` and `__length_hint__`. - tls.rst and the module docstring name the exceptions to dissecting each record: one that fails to decode, a parse told to stop at TLS, and FRAME_LAYER_LIMIT. Application's docstring qualifies the -1 sentinel. - protocol-family-grouping.rst records the chained-layer ruling. - `TLS.unpack`'s Note keeps only what the code needs. Tests: test_only_the_first_record_gets_the_sslv2_trial counts the fallback calls on CCS + malformed ClientHello; it fails without the fix.
Review round on #2537. - protocol-family-grouping.rst: the ruling moves to its own section, scoped to TLS; DTLS (#2535) and SSLv2 do not chain, and the intro lists #2517 among the rulings. - tls.rst and the tls.py module docstring add octets that open no record to the exceptions: they stay Raw with no error. - test_tls_declares_chained_on_unpack_and_not_on_make pins `chained` as a declared keyword of `TLS.unpack`, as HIP's `extension` is pinned; it fails against the tls.py that predates `chained`.
JarryShaw
added
feat
Owner
Author
|
Fix round at
The rendered Sphinx output is unverified locally, because the venv's sphinx-autodoc-typehints is behind the pin. |
JarryShaw
added
review: good-to-go
1 of 5 tasks
Owner
Author
|
Cross-review (Sonnet) at
|
JarryShaw
added
review: needs-changes
This was referenced Nov 1, 2026
Contributor
|
Coverage: 93.95% (unit tier, Python 3.15,
Per-file detail: the |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
fix— corrects a defectfeat— adds a featureperf— changes performance, not behaviourrefactor— changes neither behaviour nor performancetest— tests onlydocs— documentation onlyci— workflows or build toolingrelease— bumps the version or rolls up a distributionchore— anything elseconst— regenerates constant or registry tables, members keeping their numeric valuesDescription of your pull request and other information
Closes #2517, closes #2525.
TCP:TLS 1.3:TLS 1.2). Rule Q1 (a) is recorded in protocol-family-grouping.rst.Rawalong with the rest of the segment (ruling A).protocol='TLS',layer='Application'andFRAME_LAYER_LIMITstill stop the chain. tls.rst lists these exceptions.