Skip to content

fix(corekit): zero-fill a cut list of schema items to its length (#2686) - #2701

Merged
JarryShaw merged 1 commit into
mainfrom
fix/2686-schema-list-cuts
Nov 2, 2026
Merged

JarryShaw merged 1 commit into
mainfrom
fix/2686-schema-list-cuts

Conversation

@JarryShaw

Copy link
Copy Markdown
Owner

What is the purpose of your pull request?

  • fix — corrects a defect

Description of your pull request and other information

Regression from #2666, unreleased: from_data(info.to_dict()) on an edited whole HTTP/2 frame now recomputes the Length again, where it wrote a stale one or raised.

A cut list of schema items now zero-fills in core. ListField.unpack pads a short buffer to the declared length once, through _zero_fill_items. Like every other field, the fill counts against the zero-pad budget, and it is refused past MAX_ZERO_PAD_LENGTH. A cut list then reads the way DATA's zero-filled bytes do: settings past the data read as (Reserved_0x0000, 0), records as zero records. Both shapes are pinned. This removes SettingPairListField, GroupRecordListField, HTTPv2.make(frame_length=) and the _made_length side channel; none of them shipped.

IGMPv3 (#2687): Report.post_process trims the parsed record list and moves the built-in short-read record to payload when the cut is past the kept records. A schema-level rebuild therefore keeps the Additional Data octets.

The cut sweeps, the edited-frame round trips and the schema-level IGMPv3 tests all fail on main. Every test module passes, and sample captures parse identically.

Closes #2686
Closes #2687

A list of schema items the capture cut short now reads its items zero-filled
to the declared length, as FieldBase.unpack reads any other field, so the
per-protocol pieces built around it go.

- ListField.unpack zero-fills a short buffer of schema items through
  _zero_fill_items: refused past MAX_ZERO_PAD_LENGTH, charged to the running
  budget with no free band or one-off allowance, and the zeros earn none.
- Removed SettingPairListField, GroupRecordListField, HTTPv2.make's
  frame_length, its _make_data pass-through and _made_length, so from_data on
  an edited HTTP/2 frame recomputes its Length again.
- Report.post_process keeps the records it trims from the parsed list and
  moves a short read past them onto payload, so an IGMPv3 schema cut inside
  its Additional Data packs back as captured.
- A cut SACK option is now refused by OptionField's run-past-the-data check.

Every tests/ module passes; sample captures parse identically to main.

Closes #2686
Closes #2687
@JarryShaw JarryShaw added this to the PyPCAPKit v1.6 milestone Nov 2, 2026
@JarryShaw JarryShaw added bug Issues reporting a defect (set by the bug report template; a default, not an assessment) review: running A cross-review is in flight against the current head - no verdict yet labels Nov 2, 2026
@JarryShaw JarryShaw moved this to In review in PyPCAPKit Nov 2, 2026
@JarryShaw JarryShaw added review: good-to-go Cross-review at the current head says ready; CI state is separate and removed review: running A cross-review is in flight against the current head - no verdict yet labels Nov 2, 2026
@JarryShaw

Copy link
Copy Markdown
Owner Author

GOOD TO GO at 3891eda89, from a Sonnet cross-review.

  • The regression is fixed: all 43 edited whole-frame cases across the 11 HTTP/2 frame types recompute the Length. The base fails 39 of them.
  • The ledger cannot be gamed on the normal path: a 3000-list random sequence never exceeds the cap. The cold-context refusal starts at a SETTINGS Length near 6000, far past real frames.
  • fix(internet): an IGMPv3 Report cut in its Additional Data loses the octets on a schema rebuild #2687 rebuilds exactly at all 1040 cuts inside the additional data. The base fails 1005 of them.
  • Every one of 13 mutations is caught, and the merged tree passes 206 modules.

Two small follow-ups go into this PR, and I'll verify the amend: restore the up-front ledger debit if an item fails after the fill, and shorten the HTTPv2._make_data NOTE to two lines.

@JarryShaw
JarryShaw merged commit 02d6dce into main Nov 2, 2026
62 checks passed
@JarryShaw
JarryShaw deleted the fix/2686-schema-list-cuts branch November 2, 2026 22:45
@github-project-automation github-project-automation Bot moved this from In review to Done in PyPCAPKit Nov 2, 2026
@JarryShaw JarryShaw removed the review: good-to-go Cross-review at the current head says ready; CI state is separate label Nov 2, 2026
JarryShaw added a commit that referenced this pull request Nov 2, 2026
…s, the cut schema lists, the TSO checksum cut and short ZigBee keys into 1.6.0 (#2449)

- Breaking: MH (#2700) refuses a mobility option, or a sub-option, QoS
  attribute or CGA extension of one, whose fields do not take its length,
  where 1.5.x rebuilt another; QualityOfServiceOption gains a required
  tc_reserved. Prefix lengths are held to their field's width, the NAI and
  service identifier makers count octets, and a long-form DER CGA key
  parses. Folded into the MH/DSS and makers' range-check entries, with a
  QoS entry of its own; old and new values measured against v1.5.1.
- Fixed: ListField zero-fills a cut list of schema items, bounded by
  ZERO_PAD_BUDGET_RATIO with no free band, and a SACK past the data raises
  ProtocolError where it raised FieldValueError (#2701); a Decryption
  Secrets Block made from a short parsed ZigBee key is written as captured,
  and zigbee_key_held's schema holds the octets given (#2697).
- Folded into unreleased entries: radiotap's mixed bitmaps, their
  known-bits registries and BitmapField (#2696), into the Radiotap entry;
  the TSO and AH checksum cut (#2699), into the checksum and contextvars
  entries; the zero-filled SETTINGS and IGMPv3 records and the IGMPv3
  Additional Data rebuild (#2701), into the HTTP/2 SETTINGS and IGMP
  entries, dropping HTTPv2.make's unreleased frame_length.
- No entry for the docstring-and-test-only be83061 (#2695).
- CHANGELOG.md regenerated; util/changelog_md.py --check passes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Issues reporting a defect (set by the bug report template; a default, not an assessment)

Projects

Status: Done

1 participant