Skip to content

sessions: drop the reassembly minimum when the buffer start moves - #5182

Open
KernelClint wants to merge 1 commit into
secdev:masterfrom
KernelClint:fix/sessions-stale-reassembly-minimum
Open

KernelClint wants to merge 1 commit into
secdev:masterfrom
KernelClint:fix/sessions-stale-reassembly-minimum

Conversation

@KernelClint

Copy link
Copy Markdown
Contributor

A complete LDAP bind is dropped if its first segment arrives last. No error, no Raw layer — it
never reaches the caller.

#5101 records the declared message length (scapy/layers/ldap.py:1111) so TCPSession skips
re-parsing until the buffer is that long (scapy/sessions.py:392). The count starts at the
buffer's beginning. A segment belonging before everything received so far makes StringBuffer
prepend and move that beginning (scapy/sessions.py:144), so the count points nowhere. Nothing
clears it, and the session waits for a length it can never reach.

noff already tracks the start, so no new state is needed:

+            noff = data.noff
             data.append(new_data, seq)
+            if data.noff != noff:
+                metadata.pop("tcp_min_len", None)

Clearing the count unconditionally would restore the quadratic cost #5101 removed, so we clear it
only when the start actually moved. In-order traffic is unaffected. The buffer at
scapy/sessions.py:312 appends without a sequence number, so its start moves once, before any
count exists.

Test in ldap.uts: a bind whose first four bytes arrive last.

Fixes a regression introduced in secdev#5101.

AI-Assisted: yes (gpt-5.6-sol)
@codecov

codecov Bot commented Sep 17, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.33%. Comparing base (b38b2e3) to head (a78e07a).
⚠️ Report is 2 commits behind head on master.

Files with missing lines Patch % Lines
scapy/sessions.py 0.00% 3 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (b38b2e3) and HEAD (a78e07a). Click for more details.

HEAD has 9 uploads less than BASE
Flag BASE (b38b2e3) HEAD (a78e07a)
11 2
Additional details and impacted files
@@             Coverage Diff             @@
##           master    #5182       +/-   ##
===========================================
- Coverage   80.35%   47.33%   -33.03%     
===========================================
  Files         374      375        +1     
  Lines       97578    97609       +31     
===========================================
- Hits        78411    46204    -32207     
- Misses      19167    51405    +32238     
Files with missing lines Coverage Δ
scapy/sessions.py 17.89% <0.00%> (-69.61%) ⬇️

... and 279 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant