Repository navigation
fix(pcapng): a short ZigBee key in a Decryption Secrets Block rebuilds at full width #1986
Description
A Decryption Secrets Block (DSB) holding a ZigBee NWK or APS key shorter than its fixed width parses fine, but rebuilds at full width. The rebuilt bytes differ from the original. Under the rule that every round trip must match, this is a defect.
- Repro (on
main): build a DSB of type0x5A4E574B(ZigBee NWK) withsecrets_length=10and 10 key octets, parse it, then callPCAPNG.from_data(parsed.info, ...). - Result: a 40-octet block in place of the original 32, with
secrets_length=18and the key zero-padded. - Cause: the ZigBee key schema has a fixed width. The make path pads to that width and does not keep the declared length.
Fix: a short key must rebuild byte-exact. Either keep the declared length and the held octets on make, or reject the short key on parse with a warning, consistently in both directions.
Activity
JarryShaw commentedon Oct 20, 2026
Blocked until #1983 merges, because the fix touches the same DSB build and schema code.
JarryShaw commentedon Oct 20, 2026
#1983 has merged. This now waits on #1985's fix, which edits the same DSB data models and
_make_block_dsb. It stays blocked until that PR merges.JarryShaw commentedon Oct 20, 2026
#1989 has merged, so this is unblocked. A worker has started: a short ZigBee key will rebuild byte-exact, in both the parse and make directions.
fix(pcapng): rebuild a ZigBee key off its fixed width as captured (#1986