Skip to content

fix(toolkit): the pypcapfile engine drops TCP behind an IPv6 extension header carried in IPv4 #1597

Closed

Description

@JarryShaw

With engine='pypcapfile', TCP carried behind an IPv6 extension header placed directly in IPv4 is dropped from TCP reassembly, and no warning is given. This covers protocol 0 (Hop-by-Hop Options) and protocol 60 (Destination Options).

Repro, using Python 3.11 and pypcapfile 0.12.0. Each capture is Ethernet, then IPv4 with protocol 0 or 60, then a single extension header (next header 6, Hdr Ext Len 0, PadN 4), then TCP carrying data. Results are TCP datagrams reassembled, default engine vs pypcapfile:

Tree Protocol 0 Protocol 60 Plain TCP (control)
main e9f3340f7 1 vs 0 1 vs 0 1 vs 1
#1575 head 1de91947b 1 vs 0 1 vs 0 —
the stacked #1590 fix 6dc5d91d9 1 vs 0 1 vs 0 1 vs 1

The default engine dissects the extension header and finds the TCP inside. pypcapfile drops it.

Cause: _transport in pcapkit/toolkit/pypcapfile.py steps over AH only after the #1590 fix, and over nothing before it. No branch handles a Hop-by-Hop, Destination Options or Routing header inside IPv4.

Expected: step over the extension-header chain the way the default engine does, then treat what follows as TCP. Failing that, warn once per capture.

The #1590 worker found this, and I reproduced it on the three trees above. It is being folded into the stacked #1590–#1593/#1596 branch, because the fix uses the same header walk.

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions