Repository navigation
fix(ipv6): a cut upper layer after an extension header falls back to Raw that duplicates the header #1471
Description
Bug. An IPv6 packet whose extension header is followed by a truncated upper layer duplicates the extension header when rebuilt.
Repro on main (94ae9664c), with Destination Options → TCP and the packet cut at 57 octets:
dst = bytes([6,0,1,4,0,0,0,0]) # next header = TCP
tcp = struct.pack('!HHIIBBHHH',1,2,0,0,0x50,2,0,0,0) + b'x'
body = dst + tcp
full = bytes([0x60,0,0,0]) + struct.pack('!HBB', len(body), 60, 64) + b'\x00'*32 + body
p = IPv6(full[:57], 57)
p.data == full[:57] # True
len(IPv6.from_data(p.info).data) # 65, not 57The upper layer falls back to Raw, and that Raw includes the extension header, so the rebuild writes the header twice.
The #1465 cross-review reports 51 of 69 cuts failing this way for each of DST→TCP, HBH→TCP, HBH→DST and DST→AH. #1465's own sweep missed it because its chains end in No Next Header (59).
The review also found that the dict-form rebuild raises AttributeError: 'HIP' object has no attribute 'type' for Ethernet/IPv6/HIP cut at 56. That happens on main too, but I have not reproduced it.
Activity
JarryShaw commentedon Oct 9, 2026
Blocked until #1466 merges. #1466 changes
pcapkit/protocols/internet/ipv6.py(_lookup_exthdr), which is where this fix goes. A worker starts frommainonce #1466 is in.JarryShaw commentedon Oct 9, 2026
Unblocked: #1466 merged (
8328fd3bb). #1471 and #1473 both touchpcapkit/protocols/internet/ipv6.py, so one worker is taking both, rebased on currentmain.fix(ipv6): rebuild a cut extension header chain byte-exact (#1471, #1473
fix(ipv6)!: rebuild a cut extension header chain byte-exact (#1471, #…