Repository navigation
fix(link): a GRE frame cut short by the capture reads TRUNCATED (#2653) - #2668
Merged
Merged
Conversation
- pcapkit.utilities.contextvars: frame_length holds the captured and the original length of the frame being dissected; Frame and PCAPNG set it, Internet clears it and GRE reads it, so it is shared under #2616 - Frame.read, and PCAPNG._read_block_epb, _read_block_spb and _read_block_packet, set it around the parse of their payload - Internet._decode_next_layer clears it around its payload's parse, as the length an IP layer hands on bounds that payload - GRE.read hands verify_message its length plus what the capture cut off the frame, since behind LinuxSLL the message runs to the frame's end - ICMPv4 and IGMP keep the length their IP layer declares, which gives TRUNCATED for a cut message; the frame's would misread a cut in padding - Docs: the contextvars page lists frame_length Tests: test_gre_snaplen_cut_2653_unit fails without the fix, and its cases behind IP fail without the Internet reset; the guard, GRE, IP, frame and PCAP-NG modules pass.
JarryShaw
added
fix
Owner
Author
|
GOOD TO GO at
|
JarryShaw
removed
the
review: good-to-go
JarryShaw
added a commit
that referenced
this pull request
Nov 2, 2026
…he cut-frame fixes and GRE's bindings into 1.6.0 (#2449) - Breaking: TCP, UDP and SCTP makers (#2670) and PCAP-NG's (#2671) raise on a value a field cannot hold, where 1.5.x wrote it masked; each entry gives the old and new values. The TTL Diff wraps as before. - Changed: __index__ returns the LinkType, EtherType, TransType or AppType value, ports as ints (#2652); only Create Release waits for a deployment approval (#2658). The conventions entry records the index rule. - Fixed: a cut HTTP/2 SETTINGS frame parses and rebuilds; HTTPv2.make takes frame_length (#2666). - Folded into unreleased entries: FRAD at LinkType 107 and GRE at IP protocol 47 (#2667); cut IGMPv3 messages and num_group_records (#2662, #2672); Linux_ARPHRD (#2663); DCCP's range checks (#2670); a cut GRE frame is TRUNCATED, replacing fold-12's INVALID note, and frame_length in pcapkit.utilities.contextvars (#2668). - No entry for _make_sint's private allow_unsigned, ARP's private PAT_MAC_ADDR, or the test- and docs-only d728873, 326a6cf, fc80fb1, a37edf1 and 2766707. - CHANGELOG.md regenerated; util/changelog_md.py --check passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
fix— fixes a bugDescription of your pull request and other information
With checksum verification on, a GRE frame cut short by the capture's snaplen reads
TRUNCATED. Before this change it readINVALIDand raised aChecksumWarning.pcapkit.utilities.contextvars.frame_lengthholds the record's captured and original lengths.Frame.readand the PCAP-NG EPB, SPB and PB readers set it around the payload parse, and reset it in afinally.GRE.read: counts the octets the capture cut off when verifying. Neither GRE nor Linux cooked capture carries a length, so the frame's is the only one there is.None:Internet._decode_next_layerclears it around its payload, because IP declares the length. GRE behind IP, which feat(protocols): bind FRAD's and GRE's standard registry values (#2649) #2667 binds, verifies over IP's length as onmain.TRUNCATED, and the frame's lengths would mislabel Ethernet padding as a cut.A Sonnet cross-review returned GOOD TO GO over two rounds, the second checking the
Internetreset over every IP path and nested tunnels. Only cut LinuxSLL GRE frames change, and only with verification on, with or without GRE bound under IP.Closes #2653