Repository navigation
fix(misc): rebuild PCAP-NG decryption secrets from their dict as captured (#2698) - #2707
Merged
Merged
Conversation
…ured (#2698) A dict's secrets come back from Info.from_dict as a mapping, which _make_block_dsb spreads into the secrets maker as keywords. The TLS, WireGuard and ZigBee makers read the text or octets held under `data` from a data model only, so from the dict a key log was written from its entries under a generated comment and a ZigBee key from its zero-filled fields. - _make_secrets_tls / _make_secrets_wireguard: take the key log text as `data`, written verbatim as the model's text is. - _make_secrets_zigbee_nwk / _make_secrets_zigbee_aps: take the Secrets Data octets as `data`, rebuilt through zigbee_key_held as the model's octets are. - Every secrets type, whole, cut at every octet, past its fixed width and past the block, rebuilds the captured octets from `info` and from `info.to_dict()`, and both paths report the same. The new tests fail without the fix; the pcapng, engine, round-trip and project guard modules pass, and shipped captures parse identically. Closes #2698
JarryShaw
added
bug
Owner
Author
|
GOOD TO GO at
|
JarryShaw
removed
the
review: good-to-go
JarryShaw
added a commit
that referenced
this pull request
Nov 3, 2026
… helpers, MH options 6 and 27, the cut SCTP and option-area schemas and dict-built secrets into 1.6.0 (#2449) - Breaking: a make() enumeration field takes a member or an int, its X_default/X_namespace/X_reversed keywords removed with no alias, and names, wide codes and wide option codes are refused (#2692); the schema helpers move to pcapkit.corekit.schema and pcapkit.corekit.fields.byteorder is removed (#2704); MobileNetworkPrefixOption gains prefix_length and keeps an IPv6Address prefix, and TimestampOption's timestamp is None past 9999 (#2709). Folded into the MH data-model entry; old values measured against v1.5.1. - Fixed: the SCTP schema cut inside its padding and a header schema cut inside an option area pack back as captured (#2682), into the SCTP entry; a Decryption Secrets Block rebuilds from its dict as captured (#2707), into the DSB entry. - Folded into unreleased entries: FRAD's Q.922 address refusal and quiet cut rebuild (#2719); a from_data rebuild's checksum status (#2712); a failed ListField fill's ledger (#2706); pad_length's path (#2704); TLS's enumeration fields (#2692); the make() and schema-helper rulings, into the conventions entry (#2692, #2704); the GraalPy shards, into the CI-legs entry (#2720). - 1.5.0's corekit.fields.byteorder role points at corekit.schema.byteorder, where #2704 moved it, so the nitpicky build does not warn on it; 1.5.0's text unchanged. - No entry for the test-only 72b2bd8 (#2715), or the docs-and-test-only 0c07940 (#2718). - CHANGELOG.md regenerated; util/changelog_md.py --check passes.
1 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
fix— corrects a defectDescription of your pull request and other information
PCAPNG.from_data(info.to_dict())did not give back the captured Decryption Secrets Block. The dict path hands the secrets to the maker as keywords, with the captured text or octets underdata. The TLS, WireGuard and ZigBee makers readdataonly from a data model, never as a keyword. So a key log was rewritten under a# generated by PyPCAPKitline, and a ZigBee key came back zero-filled._make_secrets_tlsand_make_secrets_wireguardnow takedataand write it verbatim._make_secrets_zigbee_nwkand_make_secrets_zigbee_apstakedataand rebuild it throughzigbee_key_held, so a cut still goes throughSchema's built-in short read.Tests cover every registered secrets type and an unregistered one. Each is checked whole, cut at every octet, with octets past the fixed width, and with a Secrets Length past the block. Each case is rebuilt from both
infoandinfo.to_dict(), and every test fails onmain. Shipped captures parse identically.Closes #2698