netprotocols 1.0.0__tar.gz → 1.1.0__tar.gz

{netprotocols-1.0.0 → netprotocols-1.1.0}/.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [master, overhaul]
+    branches: [master]
   pull_request:
     branches: [master]
 

{netprotocols-1.0.0 → netprotocols-1.1.0}/.gitignore

@@ -146,4 +146,4 @@ amass.txt
 amass.log
 
 # Application-specific
-.logs/
+.logs/tests/fixtures/staging/

{netprotocols-1.0.0 → netprotocols-1.1.0}/ARCHITECTURE.md

@@ -115,8 +115,23 @@ flowchart LR
   I6 -->|58| IC6[ICMPv6]
   I6 -->|6| T
   I6 -->|17| U
+  I6 -->|0, 43, 44, 60| X[IPv6 extension headers]
+  X --> X
+  X -->|58| IC6
+  X -->|6| T
+  X -->|17| U
 ```
 
+IPv6 extension headers (Hop-by-Hop Options, Routing, Fragment,
+Destination Options) chain like any other protocol — each names what
+follows via `next_header` — and may stack. Two guardrails: the
+registry hands them out only inside an IPv6 chain (a garbage IPv4
+packet with `protocol=0` cannot conjure a Hop-by-Hop layer), and a
+Fragment header chains onward only when `fragment_offset == 0` — a
+non-first fragment carries a slice from the middle of the original
+payload, so no upper-layer header exists at its start. The same
+offset rule applies to fragmented IPv4.
+
 The numbers on the arrows are the wire values — EtherTypes out of
 Ethernet, IP protocol numbers out of IPv4/IPv6 — and they live in
 [`_enums.py`](src/netprotocols/_enums.py) as `EtherType` and

{netprotocols-1.0.0 → netprotocols-1.1.0}/CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2026-08-29
+
+### Added
+- **IPv6 extension headers** (RFC 8200 §4.3-4.6): `IPv6HopByHopOptions`,
+  `IPv6Routing`, `IPv6Fragment`, `IPv6DestinationOptions`. The decode
+  chain now reaches ICMPv6/TCP/UDP behind them (MLD reports decode
+  fully). Extension headers dispatch only inside an IPv6 chain, and a
+  Fragment header chains onward only from the first fragment.
+- **Checksums** (`netprotocols.checksum`): `internet_checksum()`
+  (RFC 1071), `compute()`/`verify()` covering the IPv4 header checksum,
+  ICMPv4, and TCP/UDP/ICMPv6 with IPv4/IPv6 pseudo-headers, and
+  `Packet.with_checksums()` for filling a whole stack on encode. The
+  UDP-only zero substitution is confined to the UDP arm.
+- **Property-based fuzzing** of the decode path (hypothesis, dev-only):
+  decode() raises nothing outside `ProtocolError` for any input; the
+  chain walk never consumes past the frame; constrained round trips.
+- `IPProtocol` gains `HOPOPT`, `IPV6_ROUTE`, `IPV6_FRAG`,
+  `IPV6_DSTOPTS` with display names.
+
+### Development
+- The real-capture fixture corpus grew to 65 frames across 12
+  scenarios (MLD behind hop-by-hop, IPv6 fragment pairs); checksum
+  tests recompute every verifiable corpus frame to its captured wire
+  value.
+
+## [1.0.1] - 2026-08-29
+
+### Fixed
+- `IPv4.next_protocol()` chained non-first fragments
+  (`fragment_offset > 0`) into garbage upper-layer decodes — a slice
+  from the middle of a fragmented payload has no header at its start.
+  Discovered by the new real-capture fixture corpus on live fragmented
+  traffic; the chain now ends at the IPv4 layer for those frames, as it
+  already did for unknown protocols.
+
+### Added (development)
+- A real-capture fixture corpus under `tests/fixtures/` (56 frames,
+  10 scenarios, every checksum internally verified — see its
+  MANIFEST.md) with corpus-wide invariant tests, plus the capture and
+  validation scripts under `scripts/`.
+
 ## [1.0.0] - 2026-08-21
 
 Complete rewrite. The public API is new; see the README and

{netprotocols-1.0.0 → netprotocols-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: netprotocols
-Version: 1.0.0
+Version: 1.1.0
 Summary: Low-level implementations of common networking protocols
 Project-URL: Homepage, https://github.com/EONRaider/NETProtocols
 Project-URL: Repository, https://github.com/EONRaider/NETProtocols
@@ -67,7 +67,11 @@ Requires Python 3.12+. Fully typed (`py.typed`, mypy strict).
 | 2 | Ethernet II | `Ethernet` | IEEE 802.3 |
 | 2 | ARP | `ARP` | RFC 826, IPv4-over-Ethernet binding |
 | 3 | IPv4 | `IPv4` | RFC 791, IHL/options aware |
-| 3 | IPv6 | `IPv6` | RFC 8200, fixed header |
+| 3 | IPv6 | `IPv6` | RFC 8200 |
+| 3 | IPv6 Hop-by-Hop Options | `IPv6HopByHopOptions` | RFC 8200 §4.3 |
+| 3 | IPv6 Routing | `IPv6Routing` | RFC 8200 §4.4 |
+| 3 | IPv6 Fragment | `IPv6Fragment` | RFC 8200 §4.5, first-fragment chaining |
+| 3 | IPv6 Destination Options | `IPv6DestinationOptions` | RFC 8200 §4.6 |
 | 3 | ICMPv4 | `ICMPv4` | RFC 792, 8-byte header |
 | 3 | ICMPv6 | `ICMPv6` | RFC 4443, 8-byte header |
 | 4 | TCP | `TCP` | RFC 9293, data-offset/options aware |
@@ -127,8 +131,9 @@ frame = Packet(
 raw = bytes(frame)  # ready for a raw socket
 ```
 
-Checksums are carried verbatim in both directions: the library neither
-computes nor verifies them (planned — see the roadmap).
+Checksums are computed and verified on request — never silently:
+`compute()`/`verify()` in `netprotocols.checksum`, and
+`Packet.with_checksums()` to fill a whole stack before sending.
 
 ## Display helpers
 
@@ -150,12 +155,7 @@ network traffic monitor built on it.
 
 ## Roadmap
 
-- IPv6 extension headers (hop-by-hop, routing, fragment, destination
-  options) — today the decode chain ends at `IPv6` for traffic behind
-  them (e.g. MLD).
 - 802.1Q VLAN tags, DNS, DHCP, IGMP, GRE.
-- Checksum computation on encode and verification flags on decode.
-- Fuzzing of the decode path.
 
 ## Contributing
 

{netprotocols-1.0.0 → netprotocols-1.1.0}/README.md

@@ -42,7 +42,11 @@ Requires Python 3.12+. Fully typed (`py.typed`, mypy strict).
 | 2 | Ethernet II | `Ethernet` | IEEE 802.3 |
 | 2 | ARP | `ARP` | RFC 826, IPv4-over-Ethernet binding |
 | 3 | IPv4 | `IPv4` | RFC 791, IHL/options aware |
-| 3 | IPv6 | `IPv6` | RFC 8200, fixed header |
+| 3 | IPv6 | `IPv6` | RFC 8200 |
+| 3 | IPv6 Hop-by-Hop Options | `IPv6HopByHopOptions` | RFC 8200 §4.3 |
+| 3 | IPv6 Routing | `IPv6Routing` | RFC 8200 §4.4 |
+| 3 | IPv6 Fragment | `IPv6Fragment` | RFC 8200 §4.5, first-fragment chaining |
+| 3 | IPv6 Destination Options | `IPv6DestinationOptions` | RFC 8200 §4.6 |
 | 3 | ICMPv4 | `ICMPv4` | RFC 792, 8-byte header |
 | 3 | ICMPv6 | `ICMPv6` | RFC 4443, 8-byte header |
 | 4 | TCP | `TCP` | RFC 9293, data-offset/options aware |
@@ -102,8 +106,9 @@ frame = Packet(
 raw = bytes(frame)  # ready for a raw socket
 ```
 
-Checksums are carried verbatim in both directions: the library neither
-computes nor verifies them (planned — see the roadmap).
+Checksums are computed and verified on request — never silently:
+`compute()`/`verify()` in `netprotocols.checksum`, and
+`Packet.with_checksums()` to fill a whole stack before sending.
 
 ## Display helpers
 
@@ -125,12 +130,7 @@ network traffic monitor built on it.
 
 ## Roadmap
 
-- IPv6 extension headers (hop-by-hop, routing, fragment, destination
-  options) — today the decode chain ends at `IPv6` for traffic behind
-  them (e.g. MLD).
 - 802.1Q VLAN tags, DNS, DHCP, IGMP, GRE.
-- Checksum computation on encode and verification flags on decode.
-- Fuzzing of the decode path.
 
 ## Contributing
 

{netprotocols-1.0.0 → netprotocols-1.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "netprotocols"
-version = "1.0.0"
+version = "1.1.0"
 description = "Low-level implementations of common networking protocols"
 readme = "README.md"
 license = "MIT"
@@ -29,6 +29,7 @@ Changelog = "https://github.com/EONRaider/NETProtocols/blob/master/CHANGELOG.md"
 
 [dependency-groups]
 dev = [
+    "hypothesis>=6.100",
     "mypy>=1.14",
     "pytest>=8.3",
     "pytest-cov>=6.0",

netprotocols-1.1.0/scripts/capture_fixtures.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Capture the real-frame fixture corpus (issue #27, plan item L-0).
+#
+# Run once with sudo from the repository root:
+#
+#     sudo scripts/capture_fixtures.sh
+#
+# Writes per-scenario pcaps into tests/fixtures/staging/ and finishes by
+# running scripts/check_fixtures.py over them. Frames used for checksum
+# ground truth are captured INBOUND only (outbound frames often carry
+# checksums left unfilled for NIC offload). Nothing is committed by this
+# script: review the checker report, then hand the staging directory to
+# the test-writing step.
+
+set -euo pipefail
+
+if [[ $EUID -ne 0 ]]; then
+    echo "This script needs root for tcpdump (or run it via sudo)." >&2
+    exit 1
+fi
+
+command -v tcpdump >/dev/null || { echo "tcpdump is required." >&2; exit 1; }
+
+OUT="tests/fixtures/staging"
+mkdir -p "$OUT"
+
+IFACE=$(ip route show default | awk '/default/ {print $5; exit}')
+GATEWAY=$(ip route show default | awk '/default/ {print $3; exit}')
+[[ -n $IFACE ]] || { echo "No default interface found." >&2; exit 1; }
+echo "[*] Default interface: $IFACE (gateway $GATEWAY)"
+echo "[*] Writing to $OUT/"
+
+# capture NAME IFACE COUNT FILTER -- TRAFFIC_CMD...
+# Starts a bounded tcpdump, runs the traffic generator, waits.
+capture() {
+    local name=$1 iface=$2 count=$3 filter=$4; shift 4; shift # consume --
+    echo "[>] $name"
+    tcpdump -i "$iface" -c "$count" -w "$OUT/$name.pcap" --immediate-mode \
+        -q $filter >/dev/null 2>&1 &
+    local pid=$!
+    sleep 1
+    "$@" >/dev/null 2>&1 || true
+    # Give tcpdump up to 15s to fill its count, then stop it either way.
+    for _ in $(seq 15); do kill -0 $pid 2>/dev/null || break; sleep 1; done
+    kill $pid 2>/dev/null || true
+    wait $pid 2>/dev/null || true
+}
+
+# --- Loopback scenarios (checksum ground truth: lo has no offload issue
+# --- for inbound copies; we still filter inbound where it matters).
+capture icmpv4_echo_lo lo 6 "icmp" -- ping -c 3 -i 0.3 127.0.0.1
+capture icmpv6_echo_lo lo 6 "icmp6" -- ping -c 3 -i 0.3 ::1
+
+# --- Default-interface scenarios, inbound-only where checksums matter.
+capture udp_dns "$IFACE" 4 "inbound and udp and port 53" -- \
+    sh -c 'dig +tries=1 +time=3 example.com @1.1.1.1; dig +tries=1 +time=3 AAAA example.com @1.1.1.1'
+capture tcp_http "$IFACE" 12 "inbound and tcp and port 80" -- \
+    curl -s -m 8 -o /dev/null http://example.com/
+capture tcp_https "$IFACE" 12 "inbound and tcp and port 443" -- \
+    curl -s -m 8 -o /dev/null https://example.com/
+capture icmpv4_external "$IFACE" 4 "inbound and icmp" -- \
+    ping -c 3 -i 0.4 -W 2 1.1.1.1
+# A 2000-byte ping fragments on any 1500-MTU path: inbound echo replies
+# arrive as an IPv4 fragment pair.
+capture ipv4_fragments "$IFACE" 6 "inbound and (icmp or ip[6:2] & 0x3fff != 0)" -- \
+    ping -c 3 -i 0.4 -W 2 -s 2000 1.1.1.1
+# TTL-exceeded errors from intermediate hops.
+capture icmpv4_ttl_exceeded "$IFACE" 4 "inbound and icmp[icmptype] == 11" -- \
+    sh -c 'ping -c 2 -W 2 -t 2 1.1.1.1; ping -c 2 -W 2 -t 3 1.1.1.1'
+
+# --- ARP (no checksums; both directions welcome). Flush the gateway
+# --- neighbor entry to force a fresh exchange.
+arp_traffic() {
+    ip neigh del "$GATEWAY" dev "$IFACE" 2>/dev/null || true
+    ping -c 1 -W 2 "$GATEWAY"
+}
+capture arp_exchange "$IFACE" 4 "arp" -- arp_traffic
+
+# --- IPv6 NDP / MLD, ambient + provoked. MLD reports ride behind a
+# --- hop-by-hop header (the L-1 fixture). Joining a multicast group
+# --- provokes a report; pinging the all-nodes address provokes NDP.
+ipv6_traffic() {
+    ping -6 -c 2 -W 2 "ff02::1%$IFACE" || true
+    python3 - "$IFACE" <<'PY' || true
+import socket, struct, sys, time
+sock = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+ifindex = socket.if_nametoindex(sys.argv[1])
+group = socket.inet_pton(socket.AF_INET6, "ff02::deca:fbad")
+sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP,
+                group + struct.pack("@I", ifindex))
+time.sleep(3)
+PY
+}
+capture ipv6_ndp_mld "$IFACE" 10 "icmp6" -- ipv6_traffic
+
+echo
+echo "[*] Captures done. Validating..."
+CHECKER_PY=$(command -v python3)
+if [[ -n ${SUDO_USER:-} ]]; then
+    chown -R "$SUDO_USER" "$OUT"
+    sudo -u "$SUDO_USER" "$CHECKER_PY" scripts/check_fixtures.py "$OUT"
+else
+    "$CHECKER_PY" scripts/check_fixtures.py "$OUT"
+fi

netprotocols-1.1.0/scripts/capture_fixtures_supplement.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Supplementary corpus capture: the two scenarios the first run missed
+# (see tests/fixtures/MANIFEST.md "Known gaps").
+#
+#     sudo scripts/capture_fixtures_supplement.sh
+#
+# 1. MLD behind hop-by-hop: the original run filtered with BPF `icmp6`,
+#    which matches next_header == 58 directly and therefore *excludes*
+#    MLD (which rides behind a hop-by-hop header, next_header == 0).
+#    This captures `ip6 proto 0` while joining/leaving a multicast
+#    group to provoke reports.
+# 2. IPv6 fragment pair: an oversized ping -6 to an external host
+#    fragments on any 1500-MTU path (ip6 proto 44, inbound).
+
+set -euo pipefail
+
+if [[ $EUID -ne 0 ]]; then
+    echo "This script needs root for tcpdump (or run it via sudo)." >&2
+    exit 1
+fi
+
+OUT="tests/fixtures/staging"
+mkdir -p "$OUT"
+IFACE=$(ip route show default | awk '/default/ {print $5; exit}')
+echo "[*] Default interface: $IFACE"
+
+capture() {
+    local name=$1 iface=$2 count=$3 filter=$4; shift 4; shift
+    echo "[>] $name"
+    tcpdump -i "$iface" -c "$count" -w "$OUT/$name.pcap" --immediate-mode \
+        -q $filter >/dev/null 2>&1 &
+    local pid=$!
+    sleep 1
+    "$@" >/dev/null 2>&1 || true
+    for _ in $(seq 20); do kill -0 $pid 2>/dev/null || break; sleep 1; done
+    kill $pid 2>/dev/null || true
+    wait $pid 2>/dev/null || true
+}
+
+mld_traffic() {
+    python3 - "$IFACE" <<'PY' || true
+import socket, struct, sys, time
+ifindex = socket.if_nametoindex(sys.argv[1])
+group = socket.inet_pton(socket.AF_INET6, "ff02::deca:fbad")
+mreq = group + struct.pack("@I", ifindex)
+for _ in range(3):
+    sock = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq)
+    time.sleep(1.5)
+    sock.close()  # leaving also emits an MLD Done/Report
+    time.sleep(1.5)
+PY
+}
+capture ipv6_mld "$IFACE" 4 "ip6 proto 0" -- mld_traffic
+
+ipv6_frag_traffic() {
+    # An IPv6-reachable anycast resolver; 2000-byte payload fragments
+    # on the way back.
+    ping -6 -c 3 -i 0.5 -W 3 -s 2000 2606:4700:4700::1111
+}
+capture ipv6_fragments "$IFACE" 8 "inbound and ip6 proto 44" -- ipv6_frag_traffic
+
+echo
+echo "[*] Validating supplement..."
+CHECKER_PY=$(command -v python3)
+if [[ -n ${SUDO_USER:-} ]]; then
+    chown -R "$SUDO_USER" "$OUT"
+    sudo -u "$SUDO_USER" "$CHECKER_PY" scripts/check_fixtures.py "$OUT"
+else
+    "$CHECKER_PY" scripts/check_fixtures.py "$OUT"
+fi

netprotocols-1.1.0/scripts/check_fixtures.py

@@ -0,0 +1,228 @@
+#!/usr/bin/env python3
+"""Validate the internal checksum consistency of captured fixture pcaps.
+
+Deliberately standalone (stdlib only, its own RFC 1071 implementation,
+its own minimal parsers): it must be able to disqualify a capture even
+if netprotocols itself has a bug, and later it cross-validates the
+library's checksum module (plan item L-2) with an independent
+implementation.
+
+Usage: python3 scripts/check_fixtures.py tests/fixtures/staging
+"""
+
+from __future__ import annotations
+
+import struct
+import sys
+from collections import Counter
+from pathlib import Path
+
+
+def internet_checksum(data: bytes) -> int:
+    if len(data) % 2:
+        data += b"\x00"
+    total = sum(struct.unpack(f"!{len(data) // 2}H", data))
+    while total >> 16:
+        total = (total & 0xFFFF) + (total >> 16)
+    return ~total & 0xFFFF
+
+
+def read_pcap(path: Path):
+    data = path.read_bytes()
+    if len(data) < 24:
+        raise ValueError("not a pcap: too short")
+    magic = data[:4]
+    if magic in (b"\xa1\xb2\xc3\xd4", b"\xa1\xb2\x3c\x4d"):
+        endian = ">"
+    elif magic in (b"\xd4\xc3\xb2\xa1", b"\x4d\x3c\xb2\xa1"):
+        endian = "<"
+    else:
+        raise ValueError(f"not a pcap: magic {magic.hex()}")
+    (network,) = struct.unpack_from(f"{endian}I", data, 20)
+    if network != 1:
+        raise ValueError(f"linktype {network} is not Ethernet")
+    cursor = 24
+    while cursor + 16 <= len(data):
+        _, _, incl_len, _ = struct.unpack_from(f"{endian}IIII", data, cursor)
+        cursor += 16
+        yield data[cursor : cursor + incl_len]
+        cursor += incl_len
+
+
+def pseudo_v4(src: bytes, dst: bytes, proto: int, length: int) -> bytes:
+    return src + dst + struct.pack("!BBH", 0, proto, length)
+
+
+def pseudo_v6(src: bytes, dst: bytes, proto: int, length: int) -> bytes:
+    return src + dst + struct.pack("!IBBBB", length, 0, 0, 0, proto)
+
+
+def check_frame(frame: bytes, stats: Counter) -> list[str]:
+    """Validate one Ethernet frame; returns a list of failure strings."""
+    failures: list[str] = []
+    if len(frame) < 14:
+        stats["runt"] += 1
+        return failures
+    ethertype = struct.unpack_from("!H", frame, 12)[0]
+    payload = frame[14:]
+
+    if ethertype == 0x0806:
+        stats["arp"] += 1
+        return failures
+
+    if ethertype == 0x0800 and len(payload) >= 20:
+        ihl = (payload[0] & 0x0F) * 4
+        header = payload[:ihl]
+        stats["ipv4"] += 1
+        if (
+            internet_checksum(header[:10] + b"\x00\x00" + header[12:ihl])
+            != struct.unpack_from("!H", header, 10)[0]
+        ):
+            failures.append("ipv4-header-checksum")
+        src, dst = header[12:16], header[16:20]
+        proto = header[9]
+        total_length = struct.unpack_from("!H", header, 2)[0]
+        flags_frag = struct.unpack_from("!H", header, 6)[0]
+        if flags_frag & 0x1FFF:
+            stats["ipv4-fragment"] += 1
+            return failures  # non-first fragment: no upper-layer header
+        if flags_frag & 0x2000 == 0x2000 and flags_frag & 0x1FFF == 0:
+            stats["ipv4-first-fragment"] += 1
+            return failures  # first fragment: upper checksum spans all parts
+        upper = payload[ihl:total_length]
+        upper_len = len(upper)
+        if proto == 1 and upper_len >= 8:
+            stats["icmpv4"] += 1
+            if (
+                internet_checksum(upper[:2] + b"\x00\x00" + upper[4:])
+                != struct.unpack_from("!H", upper, 2)[0]
+            ):
+                failures.append("icmpv4-checksum")
+        elif proto == 6 and upper_len >= 20:
+            stats["tcp"] += 1
+            zeroed = upper[:16] + b"\x00\x00" + upper[18:]
+            if (
+                internet_checksum(pseudo_v4(src, dst, 6, upper_len) + zeroed)
+                != struct.unpack_from("!H", upper, 16)[0]
+            ):
+                failures.append("tcp-checksum")
+        elif proto == 17 and upper_len >= 8:
+            stats["udp"] += 1
+            wire = struct.unpack_from("!H", upper, 6)[0]
+            if wire == 0:
+                stats["udp-no-checksum"] += 1
+            else:
+                zeroed = upper[:6] + b"\x00\x00" + upper[8:]
+                computed = (
+                    internet_checksum(
+                        pseudo_v4(src, dst, 17, upper_len) + zeroed
+                    )
+                    or 0xFFFF
+                )
+                if computed != wire:
+                    failures.append("udp-checksum")
+        return failures
+
+    if ethertype == 0x86DD and len(payload) >= 40:
+        stats["ipv6"] += 1
+        payload_length, next_header = struct.unpack_from("!HB", payload, 4)
+        src, dst = payload[8:24], payload[24:40]
+        upper = payload[40 : 40 + payload_length]
+        # Walk extension headers (hop-by-hop 0, routing 43, dest-opts 60).
+        while next_header in (0, 43, 60) and len(upper) >= 8:
+            stats["ipv6-ext-header"] += 1
+            ext_len = (upper[1] + 1) * 8
+            next_header, upper = upper[0], upper[ext_len:]
+        if next_header == 44 and len(upper) >= 8:
+            if struct.unpack_from("!H", upper, 2)[0] & 0xFFF8:
+                stats["ipv6-fragment"] += 1
+                return failures  # non-first fragment: no upper header
+            stats["ipv6-first-fragment"] += 1
+            # The upper-layer checksum spans the reassembled datagram,
+            # not this fragment's slice: nothing verifiable here.
+            return failures
+        upper_len = len(upper)
+        if next_header == 58 and upper_len >= 4:
+            stats["icmpv6"] += 1
+            zeroed = upper[:2] + b"\x00\x00" + upper[4:]
+            if (
+                internet_checksum(pseudo_v6(src, dst, 58, upper_len) + zeroed)
+                != struct.unpack_from("!H", upper, 2)[0]
+            ):
+                failures.append("icmpv6-checksum")
+        elif next_header == 6 and upper_len >= 20:
+            stats["tcp6"] += 1
+            zeroed = upper[:16] + b"\x00\x00" + upper[18:]
+            if (
+                internet_checksum(pseudo_v6(src, dst, 6, upper_len) + zeroed)
+                != struct.unpack_from("!H", upper, 16)[0]
+            ):
+                failures.append("tcp6-checksum")
+        elif next_header == 17 and upper_len >= 8:
+            stats["udp6"] += 1
+            zeroed = upper[:6] + b"\x00\x00" + upper[8:]
+            computed = (
+                internet_checksum(pseudo_v6(src, dst, 17, upper_len) + zeroed)
+                or 0xFFFF
+            )
+            if computed != struct.unpack_from("!H", upper, 6)[0]:
+                failures.append("udp6-checksum")
+        return failures
+
+    stats[f"other-0x{ethertype:04x}"] += 1
+    return failures
+
+
+def main() -> int:
+    staging = Path(
+        sys.argv[1] if len(sys.argv) > 1 else "tests/fixtures/staging"
+    )
+    pcaps = sorted(staging.glob("*.pcap"))
+    if not pcaps:
+        print(f"No pcaps found in {staging}/")
+        return 1
+
+    corpus_stats: Counter = Counter()
+    bad_files = 0
+    total_frames = 0
+    for pcap in pcaps:
+        stats: Counter = Counter()
+        failures: Counter = Counter()
+        frames = 0
+        try:
+            for frame in read_pcap(pcap):
+                frames += 1
+                for failure in check_frame(frame, stats):
+                    failures[failure] += 1
+        except ValueError as e:
+            print(f"[FAIL] {pcap.name}: {e}")
+            bad_files += 1
+            continue
+        total_frames += frames
+        corpus_stats.update(stats)
+        verdict = "OK  " if not failures else "FAIL"
+        detail = ", ".join(f"{k}x{v}" for k, v in sorted(stats.items()))
+        print(f"[{verdict}] {pcap.name}: {frames} frames ({detail})")
+        for failure, count in sorted(failures.items()):
+            print(f"       !! {failure} x{count}")
+        if failures:
+            bad_files += 1
+
+    print(f"\nCorpus: {total_frames} frames across {len(pcaps)} files")
+    print(
+        "Coverage:",
+        ", ".join(f"{k}={v}" for k, v in sorted(corpus_stats.items())),
+    )
+    if bad_files:
+        print(
+            f"\n{bad_files} file(s) FAILED checksum consistency — "
+            f"do not commit these; re-capture or investigate offload "
+            f"(ethtool -K <iface> tx off rx off)."
+        )
+        return 1
+    print("\nAll files internally consistent.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{netprotocols-1.0.0 → netprotocols-1.1.0}/src/netprotocols/__init__.py

@@ -12,10 +12,17 @@ from netprotocols._enums import (
     EtherType,
     IPProtocol,
 )
+from netprotocols.checksum import compute, internet_checksum, verify
 from netprotocols.layer2.arp import ARP
 from netprotocols.layer2.ethernet import Ethernet
 from netprotocols.layer3.icmp import ICMPv4, ICMPv6
 from netprotocols.layer3.ip import IPv4, IPv6
+from netprotocols.layer3.ipv6_ext import (
+    IPv6DestinationOptions,
+    IPv6Fragment,
+    IPv6HopByHopOptions,
+    IPv6Routing,
+)
 from netprotocols.layer4.tcp import TCP
 from netprotocols.layer4.udp import UDP
 from netprotocols.packet import Packet
@@ -30,7 +37,7 @@ from netprotocols.utils.exceptions import (
 from netprotocols.utils.ipv4 import validate_ipv4_addr
 from netprotocols.utils.mac import random_mac, validate_mac_addr
 
-__version__ = "1.0.0"
+__version__ = "1.1.0"
 
 __all__ = [
     "ARP",
@@ -45,6 +52,10 @@ __all__ = [
     "IPProtocol",
     "IPv4",
     "IPv6",
+    "IPv6DestinationOptions",
+    "IPv6Fragment",
+    "IPv6HopByHopOptions",
+    "IPv6Routing",
     "InvalidFieldError",
     "InvalidIPv4AddressError",
     "InvalidMACAddressError",
@@ -54,7 +65,10 @@ __all__ = [
     "ProtocolError",
     "TruncatedHeaderError",
     "__version__",
+    "compute",
+    "internet_checksum",
     "random_mac",
     "validate_ipv4_addr",
     "validate_mac_addr",
+    "verify",
 ]

{netprotocols-1.0.0 → netprotocols-1.1.0}/src/netprotocols/_enums.py

@@ -36,11 +36,15 @@ class IPProtocol(IntEnum):
     ``next_header``, so a single registry serves both.
     """
 
+    HOPOPT = 0x00
     ICMP = 0x01
     IGMP = 0x02
     TCP = 0x06
     UDP = 0x11
+    IPV6_ROUTE = 0x2B
+    IPV6_FRAG = 0x2C
     IPV6_ICMP = 0x3A
+    IPV6_DSTOPTS = 0x3C
 
     @property
     def display_name(self) -> str:
@@ -48,11 +52,15 @@ class IPProtocol(IntEnum):
 
 
 _IP_PROTOCOL_NAMES = {
+    IPProtocol.HOPOPT: "IPv6 Hop-by-Hop Options",
     IPProtocol.ICMP: "ICMP",
     IPProtocol.IGMP: "IGMP",
     IPProtocol.TCP: "TCP",
     IPProtocol.UDP: "UDP",
+    IPProtocol.IPV6_ROUTE: "IPv6 Routing",
+    IPProtocol.IPV6_FRAG: "IPv6 Fragment",
     IPProtocol.IPV6_ICMP: "IPv6-ICMP",
+    IPProtocol.IPV6_DSTOPTS: "IPv6 Destination Options",
 }