[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort). I ran the Makefile's flags on ospf.py/ngap.py only, not make: they report nothing new.
• make test passes, and a test case covers the change. I ran the touched modules one by one, plus tests/project and the protocols --exclude protocols/internet unittest leg.
• Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

• fix — corrects a defect

---

Description

Closes #1249
Closes #1250
Closes #1252
Refs #1251 (OSPF auth_data half only; HTTP/2 PING is another PR)

• OSPF fix(ospf): make recomputes the Packet length from the payload and _make_data drops the parsed one #1249: make() gains packet_length (default 24 + len(payload)) and _make_data passes data.len. It is not called length, because that name collides with Protocol.__init__(file, length).
• OSPF fix(ospf): OSPF(auth_type=2, auth_data=<bytes>) raises AttributeError #1250, fix(httpv2,ospf): make silently pads or truncates fixed-width inputs #1251: with auth_type=2, 8 raw octets are unpacked into CryptographicAuthentication. Any auth_data that is not 8 octets raises ProtocolError.
• NGAP fix(ngap): octets after the APER PDU are silently dropped on rebuild #1252: reject, not keep. SCTP preserves message boundaries: each user message occupies its own DATA chunk (RFC 9260 §1.3), and a chunk with B and E both set is a complete, unfragmented message (§3.3.1). X.691 (02/2021) §11.1.4 pads the outermost ALIGNED encoding only to the next octet, and §11.1.5 makes that the complete encoding, so a whole octet left over is not part of the PDU. NGAP also has no next layer to carry it. Decoding now goes through a Charpy, and leftover octets raise ProtocolError: NGAP: N octet(s) after the NGAP-PDU.
• packet_length: Data_OSPF without len falls back to 24 + len(payload). A non-int, a bool, or a value outside 0–65535 raises ProtocolError.
• Breaking: wrong-width auth_data and NGAP trailing octets now raise. _make_encrypt_auth(bytes) returns a schema rather than bytes. Two existing tests pinned the old behaviour and are updated: test_ospf_unit.py (bytes were passed through _make_encrypt_auth) and test_ngap_unit.py "trailing garbage".

Probe (OSPF.from_data(OSPF(w, len(w)).info) / NGAP): before the fix, the crypto+digest packet rebuilds as Length 003c, and Lengths 0000/001e rebuild as 002c. auth_type=2 with bytes raised AttributeError, b'abc' was padded, and NGAP+ffff came back as 58 octets. After the fix, every OSPF repro rebuilds byte-exactly, and the bad inputs raise ProtocolError.

Tests: new test_ospf_ngap_roundtrip_unit.py gives 8 passed, 21 subtests passed. Every new test fails without its fix; the exact-PDU case is a control. Other runs: test_ospf_unit 3 passed, test_ngap_unit 23 passed, test_ospf_cryptographic_authentication_unit 4 passed, tests/project 389 passed, 1 skipped, and the unittest leg 858 tests, 0 failures.

[JarryShaw]

Cross-review verdict on c777570a8: NEEDS CHANGES (Sonnet reviewed; the author ran on Opus). The behaviour is correct. One citation is not.

• Must fix: the PR body and the ngap.py comment cite TS 38.412 §7 for "one NGAP message per SCTP DATA chunk". §7 (v16.0.0) only fixes PPID 60 and SCTP as the transport; it says nothing about one message per chunk. The rule actually rests on SCTP preserving message boundaries (RFC 4960) and on X.691 11.1.4, which pads the outermost APER encoding only to the next octet.
• Suggested: _make_data now reads data.len directly, so a hand-built Data_OSPF without len raises. That is why test_ospf_unit.py needed len=24. A getattr fallback would avoid this.
• Confirmed:
  • RFC 2328 D.4.3: the digest is not counted in the packet length. Six OSPF probes rebuild byte-exactly.
  • Auth types 0 and 1 produce the same bytes as main.
  • packet_length is the correct name; length really is swallowed by Protocol.__init__.
  • The Charpy decode matches from_aper across 3000 mutations.
  • All 1605 fixture frames are unchanged.
  • Leg: 856 tests, 0 failures.

[github-actions]

Coverage: 88.91% (unit tier, Python 3.14, 17bf03c43, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18757	1034	2342	845	90.24%
pcapkit/corekit	1878	91	580	22	94.34%
pcapkit/dumpkit	142	0	42	0	100.00%
pcapkit/foundation	2442	102	852	39	94.38%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	15792	189	4048	165	98.19%
pcapkit/toolkit	487	65	144	1	85.42%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Round-2 verdict on 17bf03c43: GOOD TO GO. I read the delta against c777570a8 myself; all three round-1 blockers are fixed.

1. Citation. The TS 38.412 §7 claim is gone from both the comment and the PR body. It now cites RFC 9260 §1.3 (each user message occupies its own DATA chunk) and §3.3.1 (an unfragmented message has B and E set), plus X.691 (02/2021) §11.1.4 (zero to seven zero bits of padding) and §11.1.5 (the result is the complete encoding). Those four carry the "a whole octet left over is not part of the NGAP-PDU" conclusion without needing the NGAP spec at all.
2. Missing len. _make_data passes data.get('len'), not getattr(..., None) — right, because the test fixture's __getattr__ raises KeyError rather than AttributeError, which a getattr default would not catch. When len is absent, make() falls back to 24 + len(payload) through the packet_length is None branch.
3. packet_length validation. A non-int, a bool, or a value outside 0..65535 raises ProtocolError: OSPF: invalid packet length. Rejecting bool is the right call even though it is an int subclass.

The round-1 DummyData edit was reverted, so test_ospf_unit.py now differs from main only in the _make_encrypt_auth assertion. Both new tests fail against the previous head — the first outright, the second in all five subtests.

One honesty note rather than a change: the PR body's 389 passed, 1 skipped for tests/project is from round 1 and was not re-run after this amend. The protocols --exclude protocols/internet leg was (858 tests, 0 failures), and this amend touches no file that leg misses.