inet: choose the payload class from reassembled fragments - #5143
Open
KernelClint wants to merge 1 commit into
Open
inet: choose the payload class from reassembled fragments#5143KernelClint wants to merge 1 commit into
KernelClint wants to merge 1 commit into
Conversation
AI-Assisted: yes (GPT-5.6-Cyber)
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #5143 +/- ##
=======================================
Coverage 80.63% 80.64%
=======================================
Files 390 390
Lines 96936 96936
=======================================
+ Hits 78168 78174 +6
+ Misses 18768 18762 -6
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_defrag_ip_pkt()puts a fragmented IPv4 datagram back together and then has to decide what thereassembled bytes are. At
scapy/layers/inet.py:1467-1505it reuses the class Scapy guessed for the first fragment's payload:
The first fragment is often too short to classify correctly — with a small enough first fragment
Scapy has not seen a complete TCP header, so the guess is whatever it managed from those bytes. The
complete datagram is then forced into that class regardless of what the assembled bytes actually
are. Through
TCPSession, an HTTP response that arrived in valid ordered fragments comes backwithout its application layer, while the byte-identical unfragmented response comes back correctly.
The change asks the reassembled IP layer to classify the complete bytes, the same way ordinary
dissection does:
Every valid fragment layout is still reassembled; what changes is that the result is classified from
what was actually received.
The added regression reassembles the same HTTP response at two fragment sizes, including one whose
first fragment is too small to classify, and asserts the response body is delivered in both. Without
the source change it fails.
Performance was measured on one computer, before and after the fix: reassembling a valid ordered
datagram took 232.0 µs before and 176.3 µs after — 24% faster. Repeat runs moved by less than
that, so it is a real difference. Dispatching normally avoids the work the old path spent forcing
bytes into a class that could not parse them.