Repository navigation
fix(pcapng): a malformed TLS key-log line in a Decryption Secrets Block aborts extraction #1985
Description
In a well-sized Decryption Secrets Block whose TLS key log has a malformed line that is not the last line, the whole extract aborts.
- Repro (on
main): build SHB + IDB + EPB, then a TLS DSB whose secrets areb'NOT_A_LABEL aa bb\n'followed by one validCLIENT_RANDOM <64 hex> <96 hex>line, then an EPB. - Result:
FieldValueError: invalid TLS key log format: 'NOT_A_LABEL aa bb', raised fromTLSKeyLog.post_processviaSchema.unpack.CLIENT_RANDOM zz yy, or a garbage line in the middle of the log, fails the same way. - Contrast: after fix(pcapng): cap a Decryption Secrets Block's secrets at its block (#1980) #1983, a key log cut short by its block drops the partial last line and keeps the rest.
Fix: warn about a malformed key-log line and keep it as captured, rather than aborting. The complete entries and every frame should survive. The rebuilt block must stay byte-exact.
Activity
JarryShaw commentedon Oct 20, 2026
Blocked until #1983 merges. The key-log parsing it changes sits next to #1983's DSB secrets cap.
JarryShaw commentedon Oct 20, 2026
A related case: a TLS key log whose cut last line still fits within the pad (declared 186 over 185 held) is not an overrun. The partial line then raises
FieldValueErrorat parse. The fix here should cover it, so a malformed or cut line anywhere warns and is kept.JarryShaw commentedon Oct 20, 2026
#1983 has merged, so this is unblocked. A worker has started.
fix(pcapng): keep a malformed key-log line out of entries entirely (#…
fix(pcapng): elide key-log values from the malformed-line warning (#1985
fix(pcapng): warn on a malformed TLS key-log line instead of aborting (…