Repository navigation
Conversation
DCP response blocks built with scapy had wrong lengths: LenField counts the payload, so IP, Full IP, DeviceID, DeviceOptions and OEMID blocks got 0 or the length of the blocks stacked after them; the MAC and ManufacturerSpecific blocks raised because their FieldLenField had no length_of; DeviceInitiative left BlockInfo out. Every block also wrote its b"\x00" padding default, also after an even-length block. Fixed-size blocks now default to their constant length, variable-size blocks count their value plus BlockInfo, and padding is one zero byte after an odd-length block only. DCPFullIPBlock defaults to four DNS addresses, the number its dissector reads. AI-Assisted: yes (Claude Opus 5.5, GPT-6 Astra)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Building PROFINET DCP response blocks writes wrong block lengths and stray padding bytes:
DCPIPBlock,DCPFullIPBlock,DCPDeviceIDBlock,DCPDeviceOptionsBlockandDCPOEMIDBlockuseLenField("dcp_block_length", None), which counts the payload. A block alone gets length 0, and a block stacked before other blocks gets their length.DCPMACBlockandDCPManufacturerSpecificBlockuseFieldLenFieldwithoutlength_of, so building raisesField should have either length_of or count_of.DCPDeviceInitiativeBlockleaves BlockInfo out of its length (2 instead of 4).paddingdefaultb"\x00"is written after every block, also when the block length is even.Before, the IP block has length 20 and is followed by a zero byte, and Wireshark decodes the IP block and then reports
[Malformed Packet: PN-DCP]. After, the block lengths are 7, 14, 6 and 4, the only padding byte follows the odd-length NameOfStation block, and Wireshark decodes all four blocks.Fixed-size blocks now default to their constant length, as
DCPDeviceRoleBlockalready does, and variable-size blocks useFieldLenFieldwithlength_of, asDCPNameOfStationBlockdoes.paddingdefaults tob""and is written as one zero byte only after an odd-length block; a value set by hand is cut or zero-filled to that length.DCPFullIPBlocknow defaults to four DNS addresses, the number its dissector reads. Dissection is unchanged.This message was written with the help of AI (Claude Opus 5.5).