Repository navigation
refactor(protocols)!: finish the PCAP-NG and ARP value helpers (#2614) - #2671
Merged
Merged
Conversation
- Signed and sentinel PCAP-NG fields, reviewed one by one against draft-ietf-opsawg-pcapng: if_tsoffset is a 64-bit signed integer with no sentinel, so make() checks it with _make_sint rather than masking. if_tzone gets the same 32-bit check by pcapkit's choice, so it round-trips (#2617): the spec fixes only its length, and it is signed because this schema's Int32Field reads it so (#1340). The IDB snaplen check moves to _make_uint, its sentinel 0 (no limit) in range, and so does the obsolete Packet Block's drop_count over 16 bits: Appendix A reserves 0xFFFF for "not available", which is in range and which the reader returns as 65535, so -1 was only ever a masked spelling. SHB section_length is signed and the spec spells its -1 as 0xFFFFFFFFFFFFFFFF too, so make() takes -2**63 to 2**64 - 1 through _make_sint(allow_unsigned=True) and refuses the rest (#2617): -1 and 0xFFFFFFFFFFFFFFFF write the same octets, the field's own packing the only masking left. A note at each field says so. - _make_sint takes alias=, as _make_uint does, for the PCAP-NG prefix, and allow_unsigned= to accept the unsigned spelling of the same bits. - Padding: the unknown, systemd, DSB, CB, EPB, SPB and PB makers, the SPB original-length warning, the engine's DSB read-ahead and the Scapy engine's option walk use pad_length. - ARP's Ethernet address, and if_EUIaddr with size=8, use the base _read_mac_addr/_make_mac_addr; PAT_MAC_ADDR, PAT_EUI_ADDR, _read_eui_addr and _make_eui_addr go. Their messages are unchanged. - Breaking: an out-of-range or bool if_tzone, an out-of-range, bool or non-int if_tsoffset (None included, which was written as zeros), a bool or non-int snaplen, a bool, non-int, negative (-1 was written as 0xFFFF) or above-0xFFFF (written as its low 16 bits) drop_count, and a bool, non-int or out-of-range section_length (2**64 was written as 0, True as 1, None as -1) raise ProtocolError; the messages read 'PCAP-NG: invalid [IDB] snaplen: <value>', '... [PB] drop_count: <value>' and '... [SHB] section_length: <value>'. Parsed output byte-identical on every sample capture; tests pass.
JarryShaw
added
breaking
Owner
Author
|
GOOD TO GO at |
JarryShaw
removed
the
review: good-to-go
JarryShaw
added a commit
that referenced
this pull request
Nov 2, 2026
…he cut-frame fixes and GRE's bindings into 1.6.0 (#2449) - Breaking: TCP, UDP and SCTP makers (#2670) and PCAP-NG's (#2671) raise on a value a field cannot hold, where 1.5.x wrote it masked; each entry gives the old and new values. The TTL Diff wraps as before. - Changed: __index__ returns the LinkType, EtherType, TransType or AppType value, ports as ints (#2652); only Create Release waits for a deployment approval (#2658). The conventions entry records the index rule. - Fixed: a cut HTTP/2 SETTINGS frame parses and rebuilds; HTTPv2.make takes frame_length (#2666). - Folded into unreleased entries: FRAD at LinkType 107 and GRE at IP protocol 47 (#2667); cut IGMPv3 messages and num_group_records (#2662, #2672); Linux_ARPHRD (#2663); DCCP's range checks (#2670); a cut GRE frame is TRUNCATED, replacing fold-12's INVALID note, and frame_length in pcapkit.utilities.contextvars (#2668). - No entry for _make_sint's private allow_unsigned, ARP's private PAT_MAC_ADDR, or the test- and docs-only d728873, 326a6cf, fc80fb1, a37edf1 and 2766707. - CHANGELOG.md regenerated; util/changelog_md.py --check passes.
1 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
refactor— changes neither behaviour nor performanceDescription of your pull request and other information
The PCAP-NG and ARP group of #2614: these makers take the shared value helpers on
Protocol, and every signed or sentinel PCAP-NG field has a recorded per-field decision.section_lengthfollows the owner's option 2.-1and0xFFFFFFFFFFFFFFFFwrite the same octets, and anything outside-2**63to2**64 - 1, or anybool, raisesProtocolError._make_sintgainsallow_unsignedfor a field spelled both ways.drop_count(obsolete Packet Block) is checked by_make_uint. Its "not available" value0xFFFFis in range and has no signed spelling, so it is grouped withsnaplen, notsection_length.if_tzoneandif_tsoffsetare signed with no sentinel, so they stay signed-only to keep the round trip exact.pad_length.Breaking: these released makers stop writing masked values. For example,
drop_count=-1used to write0xFFFFand now raises, andsection_length=2**64used to write0.A Sonnet cross-review checked the per-field record against draft-ietf-opsawg-pcapng. The
drop_countrecord it asked for, and the owner's latersection_lengthruling, are both in this head.Part of #2614.