Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Write out of pcap is incorrect when altering the length of an IE (dot11.py) #4501

Open
rkinder2023 opened this issue Aug 14, 2024 · 0 comments

Comments

@rkinder2023
Copy link
Contributor

Brief description

I am not sure if this is expected behaviour or not, but writing back PCAP files gives an erroneous PCAP file when some part of the packet changes in length. In this case it's dot11.py and changing an IE length.

Full details provided below.

Scapy version

86f034b

Python version

3.12.2

Operating system

MacOS Sonoma 14.4

Additional environment information

No response

How to reproduce

Sample script:

from scapy.all import *

x = PcapReader("single-beacon.pcap")
nbcn = x.read_packet()
nbcn[Dot11Elt::{"ID":0}].info = b'some long SSID to change length'
nbcn[Dot11Elt::{"ID":0}].len = None

wrpcap("modified-beacon.pcap", nbcn)

Input pcap:
single-beacon.pcap.gz

Output pcap:
modified-beacon.pcap.gz

Error from Wireshark:
Screenshot 2024-08-14 at 10 36 08 AM

Expected beacon:
modified-beacon-correct.pcap.gz

No error in Wireshark:
Screenshot 2024-08-14 at 10 41 53 AM

Diff which seems to fix this:

diff --git a/scapy/packet.py b/scapy/packet.py
index 0e096b2c..e0b93bdf 100644
--- a/scapy/packet.py
+++ b/scapy/packet.py
@@ -497,6 +497,7 @@ class Packet(
             self.raw_packet_cache = None
             self.raw_packet_cache_fields = None
             self.wirelen = None
+            self.firstlayer().wirelen = None
         elif attr == "payload":
             self.remove_payload()
             self.add_payload(val)

Actual result

No response

Expected result

No response

Related resources

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant