inet: choose the payload class from reassembled fragments

scapy/layers/inet.py

@@ -1493,13 +1493,13 @@ def _defrag_ip_pkt(pkt, frags):
                 raise BadFragments(frags=badfrags)
             # re-build initial packet without fragmentation
             p = curfrags[0][0].copy()
-            pay_class = p[IP].payload.__class__
+            pay_class = p[IP].guess_payload_class(data)
             p[IP].flags.MF = False
             p[IP].remove_payload()
             p[IP].len = None
             p[IP].chksum = None
             # append defragmented payload
-            p /= pay_class(data)
+            p[IP].add_payload(pay_class(data))
             # cleanup
             del frags[uid]
             return True, p

test/scapy/layers/inet.uts

@@ -604,6 +604,28 @@ with no_debug_dissector(reverse=True):
 
 split_layers(TCP, CustomPacket, sport=12345)
 
+= TCPSession parses application data after IPv4 defragmentation
+~ http
+
+load_layer("http")
+
+def fragmented_http_response(fragsize):
+    payload = b"HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\nBODY"
+    packet = (
+        IP(src="192.0.2.1", dst="192.0.2.2", id=1234) /
+        TCP(sport=80, dport=2345, seq=1, flags="PA") /
+        Raw(payload)
+    )
+    fragments = [IP(raw(pkt)) for pkt in fragment(packet, fragsize)]
+    return sniff(offline=fragments, session=TCPSession)
+
+with no_debug_dissector():
+    for fragsize in (8, 24):
+        packets = fragmented_http_response(fragsize)
+        assert len(packets) == 1
+        assert HTTPResponse in packets[0]
+        assert packets[0][Raw].load == b"BODY"
+
 
 = Layer binding