fix(toolkit): dpkt cuts the IPv4 reassembly input at Total Length, truncating the header when it is below the IHL #1616
Description
With engine='dpkt', the IPv4 reassembly input is cut at Total Length. When Total Length is below the IHL, that cuts the header itself.
Repro on main (d6f627481), measuring what is handed to IPv4 reassembly:
| Case | default | dpkt | scapy |
|---|---|---|---|
| IHL 6, Total Length 10, MF set: header / payload octets | 24 / 16 | 10 / 0 | 24 / 16 |
| Last fragment padded to the Ethernet minimum: payload octets | 26 | 8 | 26 |
The padded case reassembles to the same complete datagram on all three engines, so only the input differs there. The short-Total-Length case leaves dpkt with a header shorter than its own IHL.
Cause: pcapkit/toolkit/dpkt.py:599-600 does if captured and ipv4.len: wire = wire[:ipv4.len]. The default engine hands over the captured frame, and the reassembler applies the Total Length bound itself.
Expected: dpkt hands over wire[:ihl] and wire[ihl:], as the default engine does.
Found by the #1614 cross-review; I reproduced it. Blocked until #1614 merges, because it edits pcapkit/toolkit/dpkt.py.
Activity
JarryShaw commentedon Oct 10, 2026
Blocked until #1614 merges, because it edits
pcapkit/toolkit/dpkt.py.JarryShaw commentedon Oct 10, 2026
Unblocked: #1614 merged. A worker is on it together with #1615, since both are in dpkt's
ipv4_reassembly.fix(toolkit): dpkt hands IPv4 reassembly what the default engine does (…
test(toolkit): drop the DF workarounds #1622 made stale in the #1607 …
refactor(toolkit): revert dpkt's agreement-only code (#1708)
refactor(toolkit): revert dpkt's agreement-only code (#1708) (#1727)