Skip to content

docs(pcapng): repoint the generator's stale journal-defect citation #793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JarryShaw merged 1 commit into from
Sep 25, 2026
Merged

docs(pcapng): repoint the generator's stale journal-defect citation #793

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions examples/generators/pcapng.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,8 +342,9 @@ def dsb(self, secrets_type: 'int', secrets: 'bytes',
def journal(self, entry: 'bytes') -> 'bytes':
""":manpage:`systemd(1)` Journal Export Block.

``entry`` is padded out to a 4-octet boundary by the caller rather than
here -- see :func:`_journal_entry` for why that distinction matters.
``entry`` is padded out to a 4-octet boundary by :meth:`_Blocks.block`,
not here -- see :func:`_journal_entry` for why that distinction used to
matter.

"""
return self.block(BLOCK_JOURNAL, entry)
Expand Down Expand Up @@ -402,15 +403,16 @@ def _read_epb_packets(path: 'pathlib.Path') -> 'list[bytes]':
def _journal_entry(message: 'str', realtime_us: 'int') -> 'bytes':
"""Build a :manpage:`systemd(1)` journal export entry of 4-octet length.

The block body is padded to a 4-octet boundary like every other PCAP-NG
block, but pcapkit hands the padding to its journal-entry parser along with
the entry itself, and the parser then reads the NULs as the start of a
binary field and raises ``struct.error: unpack requires a buffer of 8
bytes``. Choosing a message whose entry is already aligned means no padding
is added, which the specification allows and which keeps the fixture
parseable. The underlying defect is
``pcapkit/protocols/schema/misc/pcapng.py:1376`` splitting ``self.entry``
without first stripping the block padding.
The block body is padded to a 4-octet boundary by :meth:`_Blocks.block`,
so a message whose entry is already aligned gets no padding at all. That
used to be load-bearing: an unaligned entry's own NUL padding was read as
a binary field name and raised a bare ``struct.error`` (fixed in `#699
<https://github.com/JarryShaw/PyPCAPKit/pull/699>`__, which made a
NUL-only line end the entry). Measured on ``ef859f776``: a misaligned
entry now parses with no ``SchemaWarning``. The loop stays only because
removing it regenerates ``test.pcapng`` -- an untracked fixture change,
not a prose one; see `#791
<https://github.com/JarryShaw/PyPCAPKit/issues/791>`__.

"""
while True:
Expand Down
Loading