Repository navigation
feat(application): dissect every whole SSLv2 record in a TCP segment - #2585
Merged
Merged
Conversation
…2567) - SSLv2._import_next_layer dissects a whole record opening the rest of the segment as a further SSLv2 layer, the previous record's payload, as TLS does; a header cut short or a record the segment ends inside stays Raw. - A later record that fails to decode (RECORD-LENGTH 0) becomes Raw with everything after it, under beholder, carrying read()'s error. - protocol=, layer= and FRAME_LAYER_LIMIT stop the chain; TLS's port-443 SSLv2 fallback chains the same way. - protocol-family-grouping.rst, "Chained Records": SSLv2 chains; DTLS still does not (#2535). sslv2.rst and the module docstring gain a "Records in One Segment" section. - Tests: two and three records, a malformed later record, octets opening no record, the stops, and both round-trip directions.
- TLS._read_sslv2_fallback built its trial from kwargs that Protocol.__init__ had already stripped of layer, protocol and __context__, so on TCP 443 a stop at SSLv2, TLS, SSL or the Application layer still chained the later records (TCP:SSLv2:SSLv2). The trial now gets the context, and the stops: this dispatcher's own layer when it matched one, otherwise its limits. - sslv2.rst and the module docstring drop the "except behind the SSLv2 fallback" clause. - Tests: each stop form through TCP 443, plus a later record that fails to decode and one cut short, all byte-exact on rebuild; and a caller's context registry reaching every record after the first, which fails without the __context__ handoff.
JarryShaw
added
feat
Owner
Author
|
GOOD TO GO at
|
Contributor
|
Coverage: 94.04% (unit tier, Python 3.15,
Per-file detail: the |
JarryShaw
removed
the
review: good-to-go
This was referenced Nov 2, 2026
JarryShaw
added a commit
that referenced
this pull request
Nov 2, 2026
…1.6.0 (#2449) - Added: DCCP, its checksum over the IP pseudo-header, register_dccp and register_dccp_option, and the pcapkit.const.dccp registries (#2593). - Folded into unreleased entries: LinuxSLL's stop on its ARPHRD path (#2587) and ARPHRD's __proto_dest__ (#2598), SSLv2 records chained in a segment (#2585), the checksum's move to pcapkit.corekit.checksum.internet (#2586), and IGMPv2's and IGMPv3's versioned name (#2590). - Breaking: InARP moves to pcapkit.protocols.link.inarp with no re-export, joining the DRARP entry (#2596). - Changed: the conventions' new rulings (#2599), the milestone workflow's next-open-milestone lookup (#2591), the PyPy protocols shards (#2604). Fixed: a handled next-layer refusal is quiet under beholder (#2597); the IPX crawlers restore sys.path (#2601). - CHANGELOG.md regenerated; util/changelog_md.py --check passes.
1 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
feat— adds a featureDescription of your pull request and other information
SSLv2 now dissects every whole record in a TCP segment. Each record after the first is the previous record's payload, the way #2517 chains TLS. A later record that fails to decode is
Rawwith the rest of the segment and the error set. A record cut short staysRawwith no error.TLS's SSLv2 fallback now passes the caller's parse stops (
layer=,protocol=) and__context__to its trial. So a stop at SSLv2, TLS or SSL holds behind TCP 443, and every chained record carries the caller's context registry.Closes #2567