Skip to content

refactor(toolkit): revert dpkt's agreement-only code (#1708) #1727

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JarryShaw merged 1 commit into from
Oct 14, 2026
Merged

refactor(toolkit): revert dpkt's agreement-only code (#1708) #1727

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/source/ext.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,7 +422,9 @@ The available engines and the file formats they read:
matters is that the gap is *announced* -- each engine warns, or raises, for the
capability it cannot provide, rather than silently producing an empty result,
save that `PyPCAPFile`_ leaves TCP behind a VLAN tag, in a tunnel or behind an
extension header (an IPv6 one, or AH in IPv4) out without a warning, and the
extension header (an IPv6 one, or AH in IPv4) out without a warning; that
`DPKT`_ leaves TCP in an IP-in-IP tunnel or behind an AH or IPv6 extension
header in IPv4, and IPv4 in IPv6 or IPv6 in IPv4, out without one; and the
`Scapy`_ engine reads IPv6 only as far as `Scapy`_ dissects it, which leaves
IPv6 behind some BSD loopback headers, and TCP and IPv6 fragments behind some
IPv6 extension headers, out without one. See
Expand Down
11 changes: 7 additions & 4 deletions docs/source/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,10 +150,13 @@ so IPv6 reassembly is unavailable. Each gap is announced with a warning or an
exception rather than silently returning nothing, save that
:class:`~pcapkit.foundation.engines.pypcapfile.PyPCAPFile` leaves TCP behind a
VLAN tag, in a tunnel or behind an extension header (an IPv6 one, or AH in IPv4)
out without one, and :class:`~pcapkit.foundation.engines.scapy.Scapy` reads IPv6
only as far as `Scapy`_ dissects it, which leaves IPv6 behind some BSD loopback
headers, and TCP and IPv6 fragments behind some IPv6 extension headers, out
without one; :doc:`pcapkit/foundation/engines/index` tabulates them.
out without one; that :class:`~pcapkit.foundation.engines.dpkt.DPKT` leaves
TCP in an IP-in-IP tunnel or behind an AH or IPv6 extension header in IPv4, and
IPv4 in IPv6 or IPv6 in IPv4, out without one; and
:class:`~pcapkit.foundation.engines.scapy.Scapy` reads IPv6 only as far as
`Scapy`_ dissects it, which leaves IPv6 behind some BSD loopback headers, and
TCP and IPv6 fragments behind some IPv6 extension headers, out without one.
:doc:`pcapkit/foundation/engines/index` tabulates them.

Every engine also answers a preflight check --
:meth:`~pcapkit.foundation.engines.engine.EngineBase.unsupported_reason`, which
Expand Down
8 changes: 8 additions & 0 deletions docs/source/pcapkit/foundation/engines/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,14 @@ their row says otherwise:
| | PCAP savefiles only, otherwise |
| | :exc:`~pcapkit.utilities.exceptions.FormatError` |
+-----------------------------------------------------------------+---------------------------------------------------------------+
| :class:`~pcapkit.foundation.engines.dpkt.DPKT` | TCP in an IP-in-IP tunnel, or behind an AH or IPv6 extension |
| | header carried in IPv4, is left out of TCP reassembly and |
| | flow tracing, and IPv4 carried in IPv6, or IPv6 in IPv4, out |
| | of IP reassembly, all without a warning; a frame `DPKT`_ |
| | cannot decode is kept raw, with a |
| | :class:`~pcapkit.utilities.warnings.DPKTWarning`, and is |
| | neither reassembled nor traced |
+-----------------------------------------------------------------+---------------------------------------------------------------+
| :class:`~pcapkit.foundation.engines.scapy.Scapy` | reads IPv6 only as far as `Scapy`_ dissects it, without a |
| | warning: behind a BSD loopback header only at the family |
| | Scapy binds it to on the host it runs on, and no TCP or |
Expand Down
13 changes: 7 additions & 6 deletions docs/source/pcapkit/protocols/internet/internet.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,11 +37,12 @@ A chain of IPv6 extension headers is dissected to at most
a row, whether it follows IPv6 or another layer such as IPv4. What follows is
kept as :class:`~pcapkit.protocols.misc.raw.Raw`, with one
:exc:`~pcapkit.utilities.warnings.ProtocolWarning` (:issue:`1604`). The
``dpkt`` toolkit stops at the same depth. The ``pyshark`` engine leaves the walk
to its own parser, which does not stop there, so it may still find the upper
layer past it (:issue:`1609`). So does the ``scapy`` engine behind IPv6, where
Scapy dissects each extension header itself; behind IPv4, its toolkit steps over
them in the octets to find TCP, and stops at the same depth. The ``pypcapfile``
toolkit walks no extension header chain, so it finds no upper layer behind one.
``pyshark`` engine leaves the walk to its own parser, which does not stop there,
so it may still find the upper layer past it (:issue:`1609`). So may the
``dpkt`` toolkit, which reads the chain as :mod:`dpkt` decodes it. So does the
``scapy`` engine behind IPv6, where Scapy dissects each extension header itself;
behind IPv4, its toolkit steps over them in the octets to find TCP, and stops at
the same depth. The ``pypcapfile`` toolkit walks no extension header chain, so
it finds no upper layer behind one.

.. autodata:: pcapkit.protocols.internet.internet.EXTENSION_HEADER_LIMIT
3 changes: 1 addition & 2 deletions docs/source/pcapkit/protocols/protocol.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,8 +118,7 @@ starts at the first layer it dissects. One chain of extension headers is also bo
its own, by :data:`~pcapkit.protocols.internet.internet.EXTENSION_HEADER_LIMIT`.
The ``pyshark``, ``scapy`` and ``pypcapfile`` engines dissect with their own
parsers, which do not apply the frame's layer bound (:issue:`1609`). The
``dpkt`` toolkit counts the layers it walks as the default engine does, and
stops at it.
``dpkt`` toolkit reads what :mod:`dpkt` decodes, which applies neither bound.

.. autodata:: pcapkit.protocols.protocol.FRAME_LAYER_LIMIT

Expand Down
9 changes: 3 additions & 6 deletions pcapkit/foundation/engines/dpkt.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,9 +479,9 @@ def read_frame(self) -> 'DPKTPacket':
for more operational information.

"""
from pcapkit.toolkit.dpkt import (attach_buffer, attach_linktype, attach_timestamp,
ipv4_reassembly, ipv6_reassembly, packet2dict,
tcp_reassembly, tcp_traceflow)
from pcapkit.toolkit.dpkt import (attach_buffer, attach_timestamp, ipv4_reassembly,
ipv6_reassembly, packet2dict, tcp_reassembly,
tcp_traceflow)
ext = self._extractor

reader = self._extmp
Expand Down Expand Up @@ -517,9 +517,6 @@ def read_frame(self) -> 'DPKTPacket':
# it again recomputes zeroed checksums and lengths into it, so keep those
# too for the adapters to slice the wire octets out of.
attach_buffer(packet, pkt)
# And a frame kept as raw data does not say what link layer its octets
# start with, which the adapters read them by (#1626).
attach_linktype(packet, linktype)

# verbose output
ext._frnum += 1
Expand Down
Loading
Loading