Short-Read Replay

pcapkit.corekit.schema.shortread carries a header cut short by the end of the capture through to the protocol’s info, by which a protocol rebuilt from that info is cut back to the octets its header had (#1458), for the layer base classes and the PCAP global header alike. It names the protocol and schema classes for type checking only, since those import it. It is one of the pcapkit.corekit.schema helpers shared across the schema layer, not part of the header schema framework in pcapkit.protocols.schema; see Choosing Between utilities and corekit.

Added in version 1.6.0: Moved here from pcapkit.protocols.schema.schema (#2674).

pcapkit.corekit.schema.shortread.keep_short_read(protocol)

Carry a parsed header’s short read into the protocol’s info.

Parameters:

protocol (ProtocolBase) – Protocol instance, just parsed.

Called by the layer base classes, and by the PCAP global Header, once a parse is done. When the data ended inside one of the header’s fields, info gains the __short_read__ record Schema.unpack made, so that Protocol.from_data hands it to the rebuild, whose Protocol.pack cuts the header back to what was captured before it is read (#1458, #2703). The key is listed in Data.__included__, so Info.to_dict carries it and from_data(info.to_dict()) cuts its rebuild back too; it is absent for a header that was captured whole.

Where the capture cut the frame short, as frame_length gives its lengths, a layer whose message runs to the end of the frame records the cut too, on the field it runs to the end in, through Schema._note_short_read, so its rebuild reads as cut, as the layer did inside the frame (#2711). A layer whose own header declares where its message ends records none, whether the cut falls at that end or past it; see Schema._frame_end_field.

pcapkit.corekit.schema.shortread.replay_short_read(protocol, data)

Hold a protocol rebuilt by from_data to the octets its header had.

Parameters:

• protocol (_PB) – Protocol instance, just built by from_data.

• data (Any) – The info it was built from.

Return type:

_PB

Returns:

protocol itself.

The layer base classes and the PCAP global Header call it on what Protocol.from_data returns, which is cut back before it gets here: from_data hands the construction the __short_read__ record that keep_short_read() left in data, Protocol.pack cuts the header it makes back to the octets captured through Schema._cut_short_read, and Protocol.__post_init__ has read() parse those octets at the width the header declares, so the rebuild is read and verified as its capture was (#2703).

The record names the field the capture ended inside and how much of it there was. Everything in the rebuild from that point on is dropped, which on a rebuild cut back as above is nothing, and the header and the info keep the record (#1458). A header cut short has no payload past it, so that point ends the rebuilt data, and what the protocol writes ahead of the header is kept: the HTTP/2 connection preface HTTP.pack writes (#2665). This holds while pack writes nothing after the header schema, as no protocol rebuilt here does; a trailer would keep as many of the cut octets.