Skip to content

Unknown next-layer codes keep their enumeration on SCTP and IP but not on TCP/UDP #418

Description

@JarryShaw

Data_Raw.protocol is documented as "Original enumeration of this protocol", but
whether it is actually populated for an unknown code depends on which layer
asked. Measured on the generated fixtures:

layer unknown code Raw.info.protocol protochain
SCTP PPID 4243 4243 SCTP:Unassigned_4243
IPv4 protocol 253 the enum IPv4:Use_for_experimentation_and_testing_253
TCP port 22, unregistered None Ethernet:IPv4:TCP:Raw
ex = extract(fin='examples/captures/tcp.pcap', nofile=True, store=True)
tcp = ex.frame[5].payload.payload.payload
tcp.info.dstport            # ssh [22 - tcp|udp|sctp]
tcp.payload.info.protocol   # None

Why

Protocol._import_next_layer passes alias=proto to whatever it constructs, and
Raw.read turns that into Data_Raw.protocol. Internet.__proto__ and
SCTP.__proto__ fall through to Raw via that call, so the code survives.

Transport._decode_next_layer resolves ports through cls.__proto__[ports[0]] /
[ports[1]] (pcapkit/protocols/transport/transport.py:112-114) and reaches
Raw by a route that never carries the alias, so TCP and UDP anonymise the port
they could not place.

Why it matters

The value is most useful precisely when the protocol is unknown — it is the only
record of what the payload claimed to be. A consumer walking frames cannot tell
"TCP payload on some port we do not decode" from "TCP payload on port 22" today,
while the equivalent SCTP and IPv4 cases both say so.

Note

Not a regression, and not what #417 changed. #417 makes the failure path
(beholder, i.e. a registered protocol whose parse raised) forward the alias
uniformly, which it previously did not — necessary there because SCTP's
unregistered path does keep the enumeration, so registering NGAP on PPID 60 would
otherwise have made a failed parse less informative than leaving the PPID
unregistered. That leaves the failure path consistent across layers and these
unknown-code paths still inconsistent with each other, which is this issue.

Fixing it means giving Transport._decode_next_layer the same alias forwarding
_import_next_layer does. tests/protocols/transport/test_tcp_runtime.py:85 and
tests/protocols/transport/test_sctp_unit.py:966 pin the two current behaviours
and are where the change would show.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions