Skip to content

fix(internet): rebuild an IGMPv3 message cut short and parsed on its own (#2660) - #2672

Merged
JarryShaw merged 1 commit into
mainfrom
fix/2660-igmpv3-direct-cut
Nov 2, 2026
Merged

JarryShaw merged 1 commit into
mainfrom
fix/2660-igmpv3-direct-cut

Conversation

@JarryShaw

Copy link
Copy Markdown
Owner

What is the purpose of your pull request?

  • fix — fixes a bug

Description of your pull request and other information

A cut IGMPv3 message parsed directly with IGMPv3(raw, len(raw)) rebuilds as captured. It already did when the message was carried by IPv4.

  • Cause: IGMP has no length field, so in a direct parse the top-level body read is never short. The short read was recorded only on the nested Query, Report or GroupRecord, where keep_short_read never looked.
  • Fix: a local _keep_body_short_read, called from IGMPv3.read, records the body's short read on the header. That is the same record the IPv4 path produces. It stays local because the same lift in the shared keep_short_read would mark complete MPTCP DSS segments as cut.
  • Also pins fix(internet): a truncated IGMPv3 Report falls back to Raw instead of parsing what it carries #2650's num_group_records check: True with one record is now refused.

A Sonnet cross-review returned GOOD TO GO on behaviour. None of 468 complete controls is marked short, every changed rebuild goes from wrong to exact, and IPv4-carried cuts are unchanged. Its cleanup requests are in this head.

Closes #2660

…own (#2660)

IGMPv3(raw, len(raw)) on a cut Query or Report rebuilt at full width through
from_data(info). IGMP has no length field, so IGMPv3.body takes the whole
remaining length and its own read is never short; Schema.unpack records the
short read on the Query, QueryExtension, Report or GroupRecord within it,
which keep_short_read does not look into. Parsing through IPv4 was unaffected.

- _keep_body_short_read, called from IGMPv3.read, records the body as cut
  after the octets it holds when a schema within it read short: the record
  an enclosing IPv4 length already gives, which replay_short_read cuts back.
- Kept local: a record nested in another header need not mean the data
  ended, and hoisting one in keep_short_read changes MH and TCP rebuilds.
- Tests: every cut of a Query and a Report through the direct constructor,
  whole messages as controls, the record matching IPv4's, and direct cases
  in the short-read sweep.
- A bool num_group_records with one record pins #2650's existing refusal,
  ruled on #2617; nothing in this change alters that check.

IGMP, schema, sweep and doc-claim modules pass; captures parse identically.
@JarryShaw JarryShaw added this to the PyPCAPKit v1.6 milestone Nov 2, 2026
@JarryShaw JarryShaw added fix Pull requests that fix a defect (fix: subject prefix) review: good-to-go Cross-review at the current head says ready; CI state is separate labels Nov 2, 2026
@JarryShaw

Copy link
Copy Markdown
Owner Author

GOOD TO GO at e8cadc8a1. A Sonnet cross-review confirmed the root cause. None of 468 complete controls is marked short, and every changed rebuild goes from not-exact to exact. IPv4-carried cuts are unchanged. Its cleanup requests (a trimmed docstring and the citation wording) are in this head.

@JarryShaw
JarryShaw merged commit 61092a5 into main Nov 2, 2026
61 checks passed
@JarryShaw
JarryShaw deleted the fix/2660-igmpv3-direct-cut branch November 2, 2026 18:28
@github-project-automation github-project-automation Bot moved this to Done in PyPCAPKit Nov 2, 2026
@JarryShaw JarryShaw removed the review: good-to-go Cross-review at the current head says ready; CI state is separate label Nov 2, 2026
JarryShaw added a commit that referenced this pull request Nov 2, 2026
…he cut-frame fixes and GRE's bindings into 1.6.0 (#2449)

- Breaking: TCP, UDP and SCTP makers (#2670) and PCAP-NG's (#2671) raise
  on a value a field cannot hold, where 1.5.x wrote it masked; each entry
  gives the old and new values. The TTL Diff wraps as before.
- Changed: __index__ returns the LinkType, EtherType, TransType or AppType
  value, ports as ints (#2652); only Create Release waits for a deployment
  approval (#2658). The conventions entry records the index rule.
- Fixed: a cut HTTP/2 SETTINGS frame parses and rebuilds; HTTPv2.make
  takes frame_length (#2666).
- Folded into unreleased entries: FRAD at LinkType 107 and GRE at IP
  protocol 47 (#2667); cut IGMPv3 messages and num_group_records (#2662,
  #2672); Linux_ARPHRD (#2663); DCCP's range checks (#2670); a cut GRE
  frame is TRUNCATED, replacing fold-12's INVALID note, and frame_length
  in pcapkit.utilities.contextvars (#2668).
- No entry for _make_sint's private allow_unsigned, ARP's private
  PAT_MAC_ADDR, or the test- and docs-only d728873, 326a6cf,
  fc80fb1, a37edf1 and 2766707.
- CHANGELOG.md regenerated; util/changelog_md.py --check passes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix Pull requests that fix a defect (fix: subject prefix)

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

fix(internet): a cut IGMPv3 message parsed directly does not rebuild as captured

1 participant