Repository navigation
fix(toolkit): the dpkt and scapy engines accept IPv4 headers the default engine rejects #1607
Description
With engine='dpkt' or engine='scapy', an IPv4 header whose options the default engine rejects still produces TCP input. The same defect was fixed for pypcapfile in #1596 / #1600.
Repro on main (c43e9318c): Ethernet, then IPv4 with IHL 6 and one option word, then TCP carrying data. TCP datagrams reassembled:
| Option | default | dpkt | scapy |
|---|---|---|---|
| Router Alert, valid (control) | 1 | 1 | 1 |
| Timestamp, length 2 | 0 | 1 | 1 |
| Loose Source Route, pointer 0 | 0 | 1 | 1 |
Expected: dpkt and scapy reject the header as the default engine does. #1600 did this for pypcapfile by running the default engine's own IPv4 parser on the header when options are present.
Found by the #1581 worker; I reproduced it. Blocked until #1605 and the #1604 PR merge, because both edit pcapkit/toolkit/dpkt.py and scapy.py.
Activity
JarryShaw commentedon Oct 10, 2026
Blocked until #1605 and the #1604 PR merge: both edit
pcapkit/toolkit/dpkt.pyandscapy.py.JarryShaw commentedon Oct 10, 2026
Widening this: the same gap also covers the IPv4 version field. On
main(c43e9318c), plain Ether/IPv4/TCP with a version nibble of 5 gives TCP datagrams of 0 on default and 1 each on dpkt and scapy (version 4: 1/1/1).It has the same cause and the same fix as the options case: dpkt and scapy accept an IPv4 header without checking it the way the default engine does. Found by the #1605 cross-review.
Now blocked only until #1605 merges, because it rewrites the dpkt and scapy TCP helpers this fix edits. #1608 turned out not to touch either file.
[-]fix(toolkit): the dpkt and scapy engines accept IPv4 headers whose options the default engine rejects[/-][+]fix(toolkit): the dpkt and scapy engines accept IPv4 headers the default engine rejects[/+]JarryShaw commentedon Oct 10, 2026
Unblocked: #1605 merged as
d6f627481. A worker is now fixing this on currentmain.fix(toolkit): dpkt and scapy check IPv4 headers as the default engine…
test(toolkit): drop the DF workarounds #1622 made stale in the #1607 …