netprotocols 2.3.0__tar.gz → 2.4.0__tar.gz

{netprotocols-2.3.0 → netprotocols-2.4.0}/.github/workflows/mutation.yml

@@ -49,6 +49,19 @@ jobs:
           key: mutmut-nightly-${{ github.run_id }}
           restore-keys: |
             mutmut-nightly-
+      # The restored cache also carries mutants/mutmut-stats.json, the
+      # map from each function to the tests that call it. When that map
+      # exists, mutmut 3.8 re-traces only tests it has never seen, so a
+      # function added since the cached run (a new helper called only
+      # by existing tests) maps to no tests and every one of its
+      # mutants reads "no tests"; so does an existing test edited to
+      # call a function it didn't before. Without the map, mutmut
+      # traces the configured test selection in full, which costs one
+      # traced pytest pass. Nothing else is lost: with the positional
+      # filters below, mutmut re-runs every in-scope mutant regardless
+      # of a cached result.
+      - name: Drop the cached function-to-test map
+        run: rm -f mutants/mutmut-stats.json
       - name: Install the project with dev dependencies
         run: uv sync --group dev --frozen
       # File-level scope (src/netprotocols/checksum.py, _tlv.py,

{netprotocols-2.3.0 → netprotocols-2.4.0}/ARCHITECTURE.md

@@ -151,16 +151,39 @@ the same three rules (spelled out in [`_base.py`](src/netprotocols/_base.py)):
    how many bytes this header consumed — a *property*, so IPv4 answers
    `ihl * 4` and TCP answers `data_offset * 4`.
 
-**Text framing is the one variation.** `HTTP` has no fixed portion to
-unpack: `decode()` scans for the empty line that ends the head, then
-for the end the head's framing gives the body, so rule 1 is a scan
-rather than an unpack and `header_len` covers the whole message, not a
-`_struct` size. Its `decode()` also takes keyword-only context the
-bytes cannot carry — `request_method` (a response to `HEAD`, or a 2xx
-to `CONNECT`, has no body whatever its headers say) and `closed` (the
-buffer ends where the connection did) — and `request_method` is stored,
-but normalized: kept only when it changes the framing, so two messages
-with equal bytes and equal framing compare equal.
+**Two protocols vary this.** The first is text framing. `HTTP` has no
+fixed portion to unpack: `decode()` scans for the empty line that ends
+the head, then for the end the head's framing gives the body, so rule 1
+is a scan rather than an unpack and `header_len` covers the whole
+message, not a `_struct` size. Its `decode()` also takes keyword-only
+context the bytes cannot carry — `request_method` (a response to `HEAD`,
+or a 2xx to `CONNECT`, has no body whatever its headers say) and
+`closed` (the buffer ends where the connection did) — and
+`request_method` is stored, but normalized: kept only when it changes
+the framing, so two messages with equal bytes and equal framing compare
+equal.
+
+The second is `SCTP`. Like ICMPv4, ICMPv6 and IGMP it has no length of
+its own: the packet is the whole IP payload, and the walk does not trim
+a frame to the IP header's declared length. Those three keep the whole
+buffer, Ethernet's zero padding included: ICMPv4's and IGMP's internet
+checksum is unchanged by appended zero bytes, and an IPv6 frame carrying
+ICMPv6 is never short enough to be padded. SCTP's CRC32c does change
+when zero bytes are appended, so `decode()` walks the chunk headers to
+find where the packet ends and leaves a run of zero bytes where the next
+chunk would start undecoded, since that cannot begin a chunk and is what
+an Ethernet sender normally pads a short frame with. Rule 3 holds for
+those zeros; any other trailing bytes become part of the packet. Past
+the 12-byte common header `decode()` never raises, like the three it
+resembles: a remainder the walk cannot parse — a chunk cut by a snap
+length, an IP fragment or an ICMP error's quote, or a nonzero trailer
+such as an Ethernet FCS, which cannot be told from a broken chunk — is
+kept verbatim in `chunks`, the ports and verification tag still decode,
+and `verify()` returns `False`. `parsed_chunks` raises only when the
+remainder does not walk: a trailer that happens to (an FCS whose bytes
+read as a chunk header) parses as a phantom chunk, so `verify()` is the
+reliable signal. See
+[`layer4/sctp.py`](src/netprotocols/layer4/sctp.py)'s module docstring.
 
 Decoding accepts `bytes` or `memoryview`. Views are a decode-time
 transient only: every stored field is a scalar or materialized
@@ -219,8 +242,12 @@ holds unchanged.
 A captured frame is a chain of headers, each one naming what it
 carries. In this library that fact is typed: every decoded header
 answers `next_protocol()` with the *class* that decodes its payload,
-or `None` when the chain ends (nothing encapsulated, or a protocol
-this library doesn't implement yet).
+or `None` when the chain ends (nothing encapsulated, a protocol this
+library doesn't implement yet, or a payload no header names in the
+clear — ESP's Next Header sits in its protected trailer, encrypted
+unless the Security Association uses a confidentiality-free transform
+(e.g. NULL, RFC 2410, or AES-GMAC, RFC 4543), and at an offset only
+the SA determines, so the decoder never reads it).
 
 ```mermaid
 flowchart LR
@@ -235,14 +262,36 @@ flowchart LR
   I4 -->|1| IC4[ICMPv4]
   I4 -->|6| T[TCP]
   I4 -->|17| U[UDP]
+  I4 -->|132| S[SCTP]
   I6 -->|58| IC6[ICMPv6]
   I6 -->|6| T
   I6 -->|17| U
+  I6 -->|132| S
+  I4 -->|4| I4
+  I4 -->|41| I6
+  I6 -->|4| I4
+  I6 -->|41| I6
+  I4 -->|50| ESP[ESP]
+  I6 -->|50| ESP
   I6 -->|0, 43, 44, 60| X[IPv6 extension headers]
   X --> X
   X -->|58| IC6
   X -->|6| T
   X -->|17| U
+  X -->|132| S
+  X -->|50| ESP
+  I4 -->|51| AH[AH]
+  AH -->|6| T
+  AH -->|17| U
+  AH -->|50| ESP
+  I6 -->|51| AH6[AHv6]
+  X -->|51| AH6
+  AH6 -->|0, 43, 44, 60| X
+  AH6 -->|6| T
+  AH6 -->|17| U
+  AH6 -->|50| ESP
+  U -->|4789| VX[VXLAN]
+  VX -->|always| E
 ```
 
 IPv6 extension headers (Hop-by-Hop Options, Routing, Fragment,
@@ -255,6 +304,17 @@ non-first fragment carries a slice from the middle of the original
 payload, so no upper-layer header exists at its start. The same
 offset rule applies to fragmented IPv4.
 
+IPsec's AH chains the same way, through its own `next_header`, onward
+to anything the IP header before it could have carried (the diagram
+draws only the transport, ESP and extension-header edges). It is the
+one header that comes as a pair for that reason: `AH` after IPv4 and
+`AHv6` after IPv6 have one wire format but dispatch through their own
+family's table, so IPv4 → AH → `0` stops rather than conjuring a
+Hop-by-Hop layer, while IPv6 → AH → Destination Options — an order
+RFC 8200 §4.1 permits — keeps decoding. ESP, the other IPsec header,
+ends the walk: what it carries is named only inside its protected
+trailer.
+
 VLAN tags chain the same way: a tag's `next_protocol` dispatches the
 inner EtherType through the same registry Ethernet uses, so a QinQ
 (`0x88A8`) or legacy double-tagged (`0x9100`) frame decodes as one
@@ -269,8 +329,9 @@ The numbers on the arrows are the wire values — EtherTypes out of
 Ethernet, IP protocol numbers out of IPv4/IPv6 — and they live in
 [`_enums.py`](src/netprotocols/_enums.py) as `EtherType` and
 `IPProtocol`. IPv4 and IPv6 share one registry because the number
-space is shared (1 is ICMPv4, 58 is ICMPv6, 6 is TCP, 17 is UDP — no
-collisions).
+space is shared (1 is ICMPv4, 58 is ICMPv6, 6 is TCP, 17 is UDP, 132
+is SCTP — no collisions; 51 is AH in both, decoded by a class of each
+family's own).
 
 A complete frame walk is a five-line loop — which is exactly why it
 ships as [`decode_frame()`](src/netprotocols/walk.py) rather than as
@@ -310,22 +371,41 @@ field they dispatch on:
 | Table | Dispatches on | Read by |
 |---|---|---|
 | `ethertype` | Ethernet II EtherType | `Ethernet`, `VLAN`, `GRE` |
-| `ip.proto` | IPv4 `protocol` | `IPv4` |
-| `ip.proto.v6` | IPv6 `next_header` | `IPv6`, extension headers |
+| `ip.proto` | IPv4 `protocol` | `IPv4`, `AH` |
+| `ip.proto.v6` | IPv6 `next_header` | `IPv6`, extension headers, `AHv6` |
 | `udp.port` | UDP well-known port | `UDP` |
 | `tcp.port` | TCP well-known port | `TCP` |
 
 `ip.proto.v6` **inherits** `ip.proto`: the two share a number space
 but not a table, because the four extension headers must be reachable
-only inside an IPv6 chain. Registering in `ip.proto` reaches both;
-registering in `ip.proto.v6` reaches the v6 chain alone. Inheritance
+only inside an IPv6 chain. Registering in `ip.proto` reaches both,
+except at a key `ip.proto.v6` owns itself (51, below); registering in
+`ip.proto.v6` reaches the v6 chain alone. Inheritance
 is resolved when you register, not when you look up, so the gating
 costs nothing on the hot path — an IPv4 packet with `protocol=0`
 cannot conjure a Hop-by-Hop layer because the table it reads has no
 entry for `0`.
 
+A child's own registration also *shadows* the inherited entry, which
+is how AH's pair is wired: `AHv6` is registered in `ip.proto.v6` first,
+then `AH` in `ip.proto`, and the parent write is not inherited over a
+key the child already owns. That works the other way round too: a
+third party replacing protocol 51 in `ip.proto` (`override=True`)
+changes IPv4 dispatch only, and must register in `ip.proto.v6` as well
+to reach IPv6. `_defaults.FAMILY_SPECIFIC_NUMBERS` names the numbers
+wired this way, and the tests hold the two tables to differing at
+those keys alone.
+
+A row need not name a class of its own. IP-in-IP (protocols 4 and 41)
+has no header between the outer IP header and the inner one, so its
+rows in `ip.proto` point straight at `IPv4` and `IPv6`, and a tunneled
+packet walks `IPv4 → IPv4 → …` with no marker layer, as in scapy and
+dpkt. Anything that needs "the" IP header of a transport layer must
+therefore take the nearest one before it, as `Packet.with_checksums()`
+and `Packet.flow_key()` do, not the first.
+
 **Extending the walk without forking.** The tables are public. A
-protocol this library does not implement — MPLS, VXLAN, a proprietary
+protocol this library does not implement — MPLS, a proprietary
 telemetry header — is one registration away from participating in
 frame walks like any built-in:
 
@@ -355,8 +435,15 @@ registrations live together in
 [`_defaults.py`](src/netprotocols/_defaults.py), whose imports sit
 inside `install()` and run once from `__init__.py` after every
 protocol class exists. Shared enums stay in the dependency-free
-`_enums.py`. The layer modules bind their table at import and never
-import each other's classes at all.
+`_enums.py`. The layer modules bind their table at import, and every
+class a header chooses by a field value (EtherType, IP protocol, port)
+comes out of a table, never from an import. Two modules do import
+another's class, where there is no field to look up. `layer3/icmp.py`
+names `IPv4` and `IPv6` to start the walk of the packet an ICMP error
+quotes, which is not dispatch, and `layer7/vxlan.py` names `Ethernet`
+directly, because a VXLAN payload is always an Ethernet frame. Neither
+can form a cycle: `ip.py` and `ethernet.py` import no other layer
+module.
 
 ## Port-based dispatch is best-effort
 
@@ -372,14 +459,56 @@ fourth layer; on TCP, port 53 names `DNSOverTCP`, a shim that consumes
 the 2-byte length prefix (RFC 1035 §4.2.2) and chains onward, so the
 walk stays uniform.
 
-Because the guess can be wrong, the application class validates
-strictly on decode: a non-DNS datagram that happens to use port 53
-raises a `ProtocolError`, which the ordinary decode-error path absorbs
-(the chain keeps the layers it did decode and records the failure). So
-a mis-dispatch degrades to a diagnosed frame, never to garbage. This
-is why the port tables can be opened to third parties as safely as the
-authoritative ones: a wrong registration costs a diagnosed frame, not
-a wrong answer.
+VXLAN on UDP 4789 (RFC 7348) is the one port entry whose payload is a
+whole Ethernet frame. `VXLAN.next_protocol()` always answers
+`Ethernet`, and the walk carries on from there exactly as it does at
+the start of a frame — the inner frame's VLAN tags, ARP, IPv4 or IPv6
+dispatch through the same `ethertype` table, and the registry a caller
+passed reaches them too. The walker needed no change for this:
+`start=` only chooses the first class, and every later one comes from
+the previous header's `next_protocol()`, whatever its layer. An
+encapsulating endpoint normally sends to 4789, the IANA port (RFC 7348
+§5), from a source port hashed from the inner flow, so the
+destination-first lookup finds VXLAN even when that hash lands on
+another registered port. The same precedence means a DNS reply to a
+client whose ephemeral port happens to be 4789 dispatches to VXLAN,
+never to DNS (and is then rejected at the I flag about half the time).
+Only 4789 is registered, and Linux still gives a vxlan device `dstport`
+8472, the port it used before IANA assigned one, when `ip link add`
+names none, so a capture from such a device needs
+`decode_as={"udp.port": {8472: VXLAN}}`. An ICMP echo tunnelled through
+VXLAN walks seven layers (`Ethernet → IPv4 → UDP → VXLAN → Ethernet →
+IPv4 → ICMPv4`), and a hostile frame nested in itself gains four per
+level until `max_depth` stops it.
+
+Because the guess can be wrong, each application class validates on
+decode, but it can only reject what its format lets it tell apart from
+noise, and for most formats that is little. DNS needs only its 12-byte
+header and DHCP its 236-byte fixed part; past that, almost any bytes
+decode cleanly as either, and even a datagram to port 53 with no
+payload at all, padded to Ethernet's 60-byte minimum, decodes the
+padding as a DNS header. VXLAN can reject more, because its header has
+one bit it requires: the I flag, which random bytes leave clear half the
+time. Over 10,000 random 300-byte UDP payloads per port, decoded with
+`decode_frame(..., lax=True)`, the walk ended with `stopped_by` set for
+50.1% of those sent to 4789 and for none of those sent to 53 or 67.
+With lengths drawn uniformly from 0-600 bytes instead, in frames not
+padded to Ethernet's minimum, the figures are about 52%, 2% and 39%,
+and every DNS and DHCP rejection is a payload too short for the fixed
+header; padded to the minimum, as on the wire, the DNS figure falls to
+0%, since the padding itself decodes as a DNS header. The VXLAN
+header cannot reject more than it does: RFC 7348 says to ignore its
+reserved bits, so rejecting those would refuse real traffic, such as
+the Group Based Policy extension's.
+
+A rejected guess takes the ordinary decode-error path: the chain keeps
+the layers it did decode and records the failure. An accepted one
+yields a layer that decoded cleanly and is wrong, and nothing in the
+`Packet` says so. A caller who needs certainty does not leave it to the
+port: `decode_as` or a derived `Registry` names the class for a port
+the caller knows, overriding the default for that walk. Third-party
+entries in the port tables carry the same risk and no more: a wrong
+registration costs what a wrong guess does.
 
 `HTTP` is deliberately absent from the `tcp.port` table. The unit a
 datagram protocol decodes is the payload; HTTP's is a message, which
@@ -396,10 +525,14 @@ bytes instead.
 ## The encode side, and the round-trip guarantee
 
 Every class also works in reverse. Constructors take the friendly
-forms (string addresses, integer fields), validate them in
-`__post_init__` (address formats; and IHL/data-offset must agree with
-`len(options)` — you cannot construct a self-contradictory header),
-and `bytes()` re-emits the exact on-wire form.
+forms (string addresses, integer fields) and validate some of them in
+`__post_init__`: Ethernet, ARP and IPv4 check address formats (IPv6
+and DHCP do not, so a malformed address there fails only in
+`bytes()`), and IPv4's IHL and TCP's data offset must agree with
+`len(options)`. For a valid header, `bytes()` re-emits the exact
+on-wire form. Constructors do not check everything decode does, so
+some headers can be built that decode would never produce (see
+below).
 
 The test suite enforces the round trip in both directions for every
 protocol:
@@ -409,6 +542,21 @@ Protocol.decode(bytes(header)) == header        # object → wire → object
 bytes(Protocol.decode(raw)) == raw[:header_len] # wire → object → wire
 ```
 
+The first holds for canonical headers, the ones decode itself
+produces, when decode is given the context it produced them with
+(HTTP's `request_method` and `closed`). A constructor accepts more
+than that, and for those headers the first line can fail: spellings
+are normalised on the way back (a MAC written with dashes decodes with
+colons, an IPv6 address decodes compressed); GRE's optional `fields`
+must agree with its flag bits; and VXLAN accepts a clear I flag on
+purpose, so that a test of another stack can send one, though
+`VXLAN.decode()` rejects it as its guard against a wrong port guess
+(see *Port-based dispatch is best-effort*). The round-trip property
+tests generate canonical headers only: addresses spelled as decode
+spells them, GRE fields sized from its flags, VXLAN with the I flag
+set, and HTTP messages that either need no context or are decoded with
+the context they carry.
+
 One deliberate boundary: **decode and encode carry checksums
 verbatim** — exactly what you want when faithfully re-encoding
 captured traffic. Computing and verifying them is explicit, via
@@ -416,7 +564,16 @@ captured traffic. Computing and verifying them is explicit, via
 checksum, ICMPv4, and TCP/UDP/ICMPv6 with their IPv4/IPv6
 pseudo-headers, and `Packet.with_checksums(payload)` fills a whole
 stack before sending. (The RFC 768 subtlety lives where it belongs:
-the `0x0000 → 0xFFFF` substitution applies to UDP alone.)
+the `0x0000 → 0xFFFF` substitution applies to UDP alone.) SCTP is the
+one transport that does not use the internet checksum: its CRC32c
+(`crc32c()`, RFC 9260 Appendix A) covers the whole packet with no
+pseudo-header, and goes on the wire least significant byte first, so
+`compute()` returns it byte-swapped to match the field as decoded.
+
+That is also why `SCTP.decode()` bounds its own extent (see "The decode
+contract" above): otherwise Ethernet's padding would land inside the
+CRC's span, and a packet under 46 bytes from a real NIC would fail to
+verify.
 
 `Packet` is the thin composition layer: it holds an ordered tuple of
 headers and `bytes(packet)` joins them, ready for a raw socket.
@@ -434,18 +591,21 @@ src/netprotocols/
 ├── walk.py         decode_frame(): the shipped chain walker
 ├── _defaults.py    the built-in decoder map, installed at import
 ├── packet.py       Packet composition, with_checksums(), flow_key()
-├── checksum.py     RFC 1071: internet_checksum, compute, verify
+├── checksum.py     RFC 1071 internet_checksum, SCTP's crc32c,
+│                   compute, verify
 ├── flow.py         FlowKey, flow_key(): canonical bidirectional keys
 ├── pcap.py         read_captures()/read_pcap()/read_pcapng(): classic
 │                   pcap and pcapng readers, from bytes not filenames
 ├── layer2/         ethernet.py, arp.py, vlan.py (802.1Q / 802.1ad)
 ├── layer3/         ip.py (IPv4 + IPv6), icmp.py (ICMPv4 + ICMPv6),
-│                   igmp.py, gre.py,
+│                   igmp.py, gre.py, esp.py (IPsec ESP),
+│                   ah.py (IPsec AH: AH + AHv6),
 │                   ipv6_ext.py (Hop-by-Hop, Routing, Fragment,
 │                   Destination Options)
-├── layer4/         tcp.py, udp.py, _ports.py (port-table dispatch)
+├── layer4/         tcp.py, udp.py, sctp.py, _ports.py (port-table
+│                   dispatch)
 ├── layer7/         dns.py, dhcp.py, http.py (the HTTP/1.1 grammar
-│                   and the HTTP codec class)
+│                   and the HTTP codec class), vxlan.py
 └── utils/          validators (mac.py, ipv4.py), exceptions.py
 tests/              one file per protocol + test_contract.py
                     (truncation, lying lengths, chain walks),

{netprotocols-2.3.0 → netprotocols-2.4.0}/CHANGELOG.md

@@ -7,8 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.0] - 2026-10-25
+
+### Added
+
+- **IP-in-IP decodes through (#177).** IP protocol 4 (IPv4 in IPv4, RFC 2003; IPv4 in IPv6, RFC 2473) and 41 (6in4, RFC 4213; IPv6 in IPv6, RFC 2473) now dispatch from the outer IP header straight to the inner `IPv4` or `IPv6`, from either outer family, so `decode_frame` walks a tunneled packet to its inner transport instead of stopping at the outer header. The encapsulation has no header of its own, so there is no new class, only two `ip.proto` rows and two `IPProtocol` members, `IPIP` and `IPV6` ("IPv4 encapsulation", "IPv6 encapsulation"). A hostile run of nested protocol-4 headers is stopped by `max_depth`, like any other long chain.
+- **`ESP`: IPsec Encapsulating Security Payload headers (RFC 4303) (#178).** IP protocol 50 now dispatches from IPv4 and IPv6 to `netprotocols.ESP`, which decodes the cleartext 8-byte prefix, `spi` and `sequence_number` (with `spi_hex_str` for display), and keeps everything after it — payload, IV, padding, Pad Length, Next Header and ICV — as one opaque `ciphertext: bytes`, so `bytes(ESP.decode(x)) == x`; like an ICMP `body`, it runs to the end of the frame, so on a datagram shorter than Ethernet's minimum it ends with the link-layer padding, not the ICV. There is no cryptography: without the Security Association's keys and algorithms nothing in the packet says where the ciphertext ends and the trailer begins, so `ESP.next_protocol()` returns `None` and a frame walk ends at ESP by design. `IPProtocol` gains `ESP` ("ESP").
+- **`AH` and `AHv6`: the IPsec Authentication Header (RFC 4302) (#179).** IP protocol 51 now dispatches to `netprotocols.AH` from IPv4 and to its subclass `AHv6` from IPv6 and its extension headers. Both decode the fixed fields — `next_header`, `payload_len`, `reserved`, `spi`, `sequence_number` — and keep the ICV raw in `icv`, sized by Payload Len (`(payload_len + 2) * 4 - 12` bytes, any alignment padding included) and never verified. `next_protocol()` chains onward through `next_header`, so an AH-wrapped TCP segment keeps decoding into `TCP`; the pair exists because the onward table must be the outer family's: `AH` reads `ip.proto`, so IPv4 → AH → 0 cannot conjure a Hop-by-Hop layer, and `AHv6` reads `ip.proto.v6`, so IPv6 → AH → Destination Options (RFC 8200 §4.1) keeps decoding. `isinstance(layer, AH)`, `packet[AH]` and `case AH(...)` match either. A Payload Len below 1 raises `InvalidFieldError`, one past the buffer `TruncatedHeaderError`, and `AHv6` also rejects a header that is not a multiple of 8 octets (an odd Payload Len), all with `field="payload_len"`. `IPProtocol` gains `AH` ("AH"). Registering over protocol 51 in `ip.proto` now reaches IPv4 only: `AHv6` is `ip.proto.v6`'s own entry, which inheritance does not overwrite; `_defaults.FAMILY_SPECIFIC_NUMBERS` names it.
+- **`VXLAN`: VXLAN tunnels decode through to the inner frame (RFC 7348, #180).** UDP port 4789 dispatches to the new `netprotocols.VXLAN` (also `netprotocols.layer7.VXLAN`), which decodes the 8-byte header into `flags`, `reserved1`, `vni` and `reserved2`, in wire order, with `bytes(VXLAN.decode(x)) == x`. `next_protocol()` always returns `Ethernet`: the payload is a whole Ethernet frame, so `decode_frame` walks on into the inner frame's VLAN tags, ARP, IPv4 or IPv6 through the existing `ethertype` table, and a `registry` or `decode_as` passed to the walk applies inside the tunnel too. The walker needed no change. RFC 7348 §5 requires the I flag (`VXLAN.I_FLAG`, `0x08`), and decoding a header without it raises `InvalidFieldError` (`field="flags"`, `offset=0`); that check is also what diagnoses about half of the non-VXLAN datagrams that happen to use port 4789, instead of decoding them as a tunnel around a garbage inner frame. Construction accepts a clear I flag, so such a header can be built to test how another stack drops it, and `bytes()` of it is the header with the I flag clear; `decode()` rejects it (ARCHITECTURE.md's round-trip guarantee now says it covers canonical headers, the ones decode produces given its context). The cost is on decode: a capture whose I flag is clear raises at the VXLAN header's `frame_offset` (a `lax=True` walk keeps only Ethernet, IP and UDP), and its inner frame, 8 bytes on, decodes with a second `decode_frame(..., start=Ethernet)` walk. The reserved bits are kept verbatim and never rejected, since the RFC says to ignore them on receipt and extensions such as Group Based Policy reuse them. Lookup tries the destination port first, so a datagram to 4789 dispatches to VXLAN whatever source port the sender's flow hash picked, even a registered one (and so does a DNS reply to a client whose ephemeral port is 4789, which dispatches to VXLAN, never to DNS). Only 4789 is registered: a capture from a Linux device created without a `dstport`, which then uses Linux's pre-IANA 8472, needs `decode_as={"udp.port": {8472: VXLAN}}`. A frame that nests VXLAN in itself is stopped by `max_depth`, four layers per level.
+- **SCTP (#176): `netprotocols.SCTP`, layer 4, RFC 9260.** IP protocol 132 (`IPProtocol.SCTP`, "SCTP") now dispatches from IPv4 and IPv6, extension headers included, to `SCTP`, which decodes the 12-byte common header (`src_port`, `dst_port`, `verification_tag`, `checksum`) and keeps the chunks as raw `chunks` bytes, padding included, so `bytes(SCTP.decode(x)) == x[:header_len]` holds by construction. `parsed_chunks` splits them on demand into a flat tuple of `SCTPChunk(type, flags, value)`, which names the RFC 9260 chunk types (DATA, INIT, INIT ACK, SACK, HEARTBEAT, HEARTBEAT ACK, ABORT, SHUTDOWN, SHUTDOWN ACK, ERROR, COOKIE ECHO, COOKIE ACK, ECNE, CWR, SHUTDOWN COMPLETE) and the common extensions (AUTH, I-DATA, ASCONF, ASCONF-ACK, RE-CONFIG, PAD, FORWARD-TSN, I-FORWARD-TSN) via `type_name`, falling back to `"unknown (n)"`; `flags_str` names the DATA/I-DATA I/U/B/E bits and the ABORT/SHUTDOWN COMPLETE T bit, and `unrecognized_action` reads the type's two high bits. `bytes(SCTPChunk(...))` emits the padded wire form, so a packet can be built from a list of chunks. SCTP has no length field, the chain walk does not trim to the IP length, and CRC32c, unlike the internet checksum, changes when zero bytes are appended, so `decode` walks the chunk headers to find where the packet ends: a run of zero bytes where the next chunk would start is left undecoded as link-layer padding (a short Ethernet frame's). Past the 12-byte common header `decode` never raises, like `ICMPv4` and `IGMP`: a remainder the walk cannot parse (a chunk cut by a snap length, an IP fragment or an ICMP error's quote; a nonzero trailer such as an Ethernet FCS) is kept verbatim in `chunks`, so the ports, verification tag and checksum survive in strict and lax walks and in `ICMPv4.embedded_chain` (when the quote holds the whole 12-byte common header), and `verify()` returns `False` for the cut packet. `parsed_chunks` raises on such a remainder when it does not walk (a trailer that happens to walk parses as a phantom chunk, so `verify()` is the reliable signal): `InvalidFieldError` for a chunk length below 4, `TruncatedHeaderError` for a chunk that runs past the bytes, so a hostile length can neither loop nor over-read. A final chunk whose padding the buffer cuts short is accepted as is. `flow_key()` and `Packet.flow_key()` key SCTP on its ports like TCP and UDP. The chain ends at SCTP; payload-protocol dispatch is not implemented.
+- **`netprotocols.crc32c()`, and SCTP checksums in `compute`/`verify`/`Packet.with_checksums()`.** The standard library has no CRC32c (`zlib.crc32` is the IEEE CRC-32), so `checksum.py` gains a table-driven Castagnoli CRC, pinned to RFC 3720 Appendix B.4's vectors. `compute(sctp)` is the CRC32c of the whole packet with the checksum field zeroed and no pseudo-header (`ip` is ignored), returned byte-swapped: the CRC goes on the wire least significant byte first (RFC 9260 Appendix A), and `SCTP.checksum` reads its four bytes big-endian. `with_checksums()` fills SCTP layers like the other transports.
+
+### Fixed
+
+- **`Packet.flow_key()` keys a tunneled flow on the inner IP header.** It used the first IPv4/IPv6 layer in the packet, which in a tunnel is the outer one: the key carried the tunnel endpoints' addresses and the tunnel's protocol number (4, 41, or 47 for GRE, which already reached this) instead of the conversation's. It now uses the IP header nearest before the transport layer, as `Packet.with_checksums()` already did, and returns `None` when no IP header precedes the transport.
+- **`flow_key()` takes the protocol number from the transport layer, not the IP header.** `FlowKey.protocol` was read from `IPv4.protocol` / `IPv6.next_header`, which name whatever directly follows the IP header: an IPv6 flow behind a Hop-by-Hop, Routing or Destination Options header was keyed protocol 0, 43 or 60, and an AH-protected one 51, so neither matched the same conversation's unwrapped key. (A Routing header with segments left still keys on the IPv6 destination, which is the next segment rather than the final destination, so a source-routed flow's two directions can still differ.) It is now 6 for `TCP` and 17 for `UDP` wherever the segment sits, as `FlowKey`'s docstring already promised; `Packet.flow_key()` and `flow_key()` share one transport-to-number table in `netprotocols.flow`.
+
 ### Development
 
+- **Every comparative number the README quotes was re-measured for this release** (Rule 4 of `docs/CLAIMS.md`), on the same machine class as 2.3.0's figures but on the 140-frame corpus Tier 1 grew from 97, against `dpkt 1.9.8` and `scapy 2.8.0`: decode is at parity with dpkt (from 5.3% slower to 3.0% faster over three runs; the README keeps "within 15%") and 4.1× ahead of scapy, encode 4.18× ahead of dpkt, import 55.0 ms against `scapy.all`'s 428.0 ms, and the wheel is 124.4 KiB, 21.7× smaller than scapy 2.8.0's 2.63 MiB. Decode depth against dpkt is 39 of 140 frames deeper, the 12 new ones being the VXLAN frames and one SCTP frame. `docs/CLAIMS.md` records each run and what moved, and corrects the 2.3.0 figures' scapy version: `uv.lock` already pinned 2.8.0 when they were taken, so they most likely name 2.7.0 in error.
+- **The nightly mutation gate no longer reports a new function's mutants as untested.** `mutation.yml` restores `mutants/` from the previous night, and that directory holds `mutmut-stats.json`, mutmut's map from each function to the tests that call it. mutmut 3.8 re-traces only tests it has never seen, so a function added since then and called only by existing tests (here `checksum.py`'s `_gre_checksum` and `_sctp_checksum`) mapped to no tests, and all 49 of their mutants failed the gate as "no tests". The workflow now deletes the map before each run, so mutmut traces its configured test selection in full; a local reproduction went from 49 "no tests" to 49 killed. `tests/test_workflows.py` pins the step.
+- **A real SCTP association joins the corpus: `sctp.pcap`, 16 frames (140 across 22 scenarios).** The capture host's kernel has no SCTP, so `scripts/capture_fixtures_sctp.sh` runs usrsctp's example client and echo server (`libusrsctp-examples`) in two netns over a veth pair, on raw IPv4: INIT through SHUTDOWN COMPLETE, with DATA, SACK and a HEARTBEAT exchange from each end, then one script-built packet with an unknown chunk type (63); the script fails unless the client completes the association and the capture holds those 16 frames, one chunk each. usrsctp builds those packets' IPv4 headers (`IP_HDRINCL`, the kernel filling length and checksum); the kernel builds the script-built packet's. `scripts/check_fixtures.py` verifies every SCTP CRC32c with its own bit-at-a-time implementation, and `tests/test_sctp.py` covers truncation, lying lengths, link-layer padding, nonzero chunk padding and IPv6 carriage with constructed packets. SCTP joins the fuzz suite (`ALL_PROTOCOLS`, a round-trip strategy, a chunk-accessor property), the truncation contract test, the corpus checksum cases and the corpus coverage set. `registry.py`'s two `register("ip.proto", 132, SCTP)` examples, and the registry tests that registered stand-ins at 132, now use 253 (reserved for experimentation, RFC 3692), since 132 is built in and a different class there raises `RegistryConflictError`.
+- **An IPsec AH capture joins the corpus: `ah.pcap`, 6 frames (124 across 21 scenarios).** `scripts/ipsec_fixture_packets.py` now also builds AH with HMAC-SHA-256-128 — transport mode over a TCP SYN, an ICMPv4 echo and UDP, tunnel mode over inner IPv4, and an AH-over-ESP bundle — computing each ICV over the IPv4 header's immutable fields, the AH header and the payload (RFC 4302 §3.3.3). Because the ICV covers the outer header, the script builds that header itself and `scripts/capture_fixtures_ipsec.sh` sends whole datagrams with `IP_HDRINCL`; the post-capture comparison found them byte-identical on the wire. The new keys are published in `tests/fixtures/MANIFEST.md`, and `scripts/check_fixtures.py` verifies every AH ICV with them before the checksums, inner packet or ESP packet behind it, which it then requires to be readable, as it does ESP's; an AH frame on an unpublished SPI fails, as does one whose ICV the checker cannot compute (IPv4 header options, or an IPv6 outer header). `esp.pcap` is unchanged. IPv6-outer AH, with its 4 bytes of ICV padding, is covered by constructed frames in `tests/test_ah.py`, and `with_checksums()` is tested to recompute a transport checksum through AH from either family. `AH` and `AHv6` join the fuzz, round-trip, contract and corpus-coverage suites, and the registry tests now hold `ip.proto` and `ip.proto.v6` to differing only at the IPv6-only numbers and at 51.
+- **An IPsec ESP capture joins the corpus: `esp.pcap`, 6 frames (118 across 20 scenarios).** The capture host's kernel has no xfrm ESP transform, so the new stdlib-only `scripts/ipsec_fixture_packets.py` builds genuine ESP — NULL encryption (RFC 2410), HMAC-SHA-256-128 integrity (RFC 4868), RFC 4303 padding and trailer — in transport mode (ICMPv4, UDP) and tunnel mode (inner IPv4), and `scripts/capture_fixtures_ipsec.sh` sends it through a raw protocol-50 socket over a veth pair, so the kernel builds the outer IPv4 header; the script then checks that every byte it built arrived unchanged. The test keys are published in `tests/fixtures/MANIFEST.md`, and `scripts/check_fixtures.py` verifies every ESP ICV with them, then the padding and the inner packet's checksums. An ESP frame on an SPI with no published key fails the checker rather than being skipped, as does anything an ICV vouched for that it cannot read, at any depth below the ESP header (an unknown protocol or EtherType, a header too short to check, a fragment); and tunnel nesting past its depth bound (8 encapsulations) now fails instead of passing unchecked, whatever the chain ends in, for GRE and IP-in-IP as well as ESP; an IPv4 header with an invalid IHL now fails as `ipv4-ihl` on every path, where it was checked on (or crashed the checker). IPv6-outer ESP is covered by constructed frames in `tests/test_esp.py`, since the capture host has no IPv6. `ESP` joins the fuzz, round-trip, contract and corpus-coverage suites.
+- **A real VXLAN capture joins the corpus: `vxlan.pcap`, 11 frames (112 across 19 scenarios).** `scripts/capture_fixtures_vxlan.sh` builds a kernel VXLAN tunnel on port 4789 between two netns over a veth underlay and captures ARP, ICMP echoes and one UDP datagram across two segments: VNI 1193046 (`0x123456`) with `udpcsum`, so the outer UDP checksum is real, and VNI 100 with `noudpcsum`, so the outer checksum is zero. `scripts/check_fixtures.py` peels VXLAN on destination port 4789 and verifies the inner frame's checksums. `tests/test_checksum.py` now checks every transport in a frame against its nearest enclosing IP header, not just the first, so a VXLAN frame yields both its outer UDP and its inner transport, and holds zero UDP-over-IPv4 checksums apart as "not used" (they must `verify()`; there is nothing to recompute). The corpus's deepest chain is now 7 layers, and `walk.py`, `docs/CLAIMS.md` and ARCHITECTURE.md say so. ARCHITECTURE.md no longer lists VXLAN among protocols this library does not implement.
+- **A real IP-in-IP capture joins the corpus: `ipip.pcap`, 4 frames (101 across 18 scenarios).** `scripts/capture_fixtures_ipip.sh` sends ICMP echoes through raw IP sockets opened for protocols 4 and 41 over a veth pair, so the kernel builds the outer header as a tunnel endpoint would; this works where the `ipip`/`sit` drivers are not built. The capture host had no IPv6, so the corpus holds IPv4 in IPv4 and IPv6 in IPv4; the script also captures the two IPv6-outer combinations on a kernel with IPv6, and `tests/test_ipip.py` covers them with constructed frames. `scripts/check_fixtures.py` peels IP-in-IP and verifies the inner checksums. `tests/test_checksum.py` now pairs each transport with its nearest enclosing IP header rather than the first. The coverage figure in `docs/CLAIMS.md` §5.3 and `pyproject.toml` is re-measured (2,682 statements, 1 missed).
+- **README's Roadmap section now leads with the current roadmap, #170**, instead of describing the completed #107 as if nothing had replaced it and promising that "new planned work will open fresh issues" — #170 had been open since 2026-09-09. It names #170's five tier themes without restating its tiers or target versions, which moved up one minor version when 2.3.0 shipped the HTTP codec outside them; `tests/test_docs.py` now checks the section leads with #170 and links none of the tier epics.
 - **Fixed a concurrency-group deadlock that cancelled the 2.3.0 release run before any job could start.** `ci.yml`'s concurrency group was keyed on `${{ github.workflow }}`, which inside a `workflow_call` resolves to the *caller's* name ("Release"), not "CI" — so release.yml calling ci.yml on a tag push made both the top-level run and the nested `ci` job claim the identical group `Release-refs/tags/<tag>`, and GitHub cancelled the run as a self-deadlock. The group now uses a literal `ci` prefix instead. `tests/test_workflows.py` gains a guard: no workflow declaring `workflow_call` may key its own concurrency group on `github.workflow`.
 
 ## [2.3.0] - 2026-10-23

{netprotocols-2.3.0 → netprotocols-2.4.0}/CONTRIBUTING.md

@@ -39,12 +39,14 @@ is 80; Markdown is excluded from linting.
 src/netprotocols/
   _base.py        the Protocol base class and the decode contract
   _enums.py       EtherType / IPProtocol / ARP* registries + display names
-  checksum.py     RFC 1071 internet checksum, compute()/verify()
+  checksum.py     RFC 1071 internet checksum, SCTP's CRC32c,
+                  compute()/verify()
   packet.py       Packet: an ordered stack of headers, with_checksums()
   layer2/         Ethernet, VLAN, ARP
-  layer3/         IPv4, IPv6, IPv6 extension headers, ICMPv4/v6, IGMP
-  layer4/         TCP, UDP (+ port-based dispatch)
-  layer7/         DNS, DHCP, HTTP
+  layer3/         IPv4, IPv6, IPv6 extension headers, ICMPv4/v6, IGMP,
+                  GRE, IPsec ESP and AH
+  layer4/         TCP, UDP, SCTP (+ port-based dispatch)
+  layer7/         DNS, DHCP, HTTP, VXLAN
   utils/          exceptions, MAC/IPv4 helpers
 tests/            unit tests, corpus invariants, fuzzing, fixtures/
 scripts/          fixture capture + validation
@@ -56,8 +58,11 @@ Every protocol is a frozen, slotted dataclass whose fields mirror the
 on-wire header. `decode(data)` receives the entire remaining buffer and
 must parse its fixed portion, tolerate trailing bytes, and raise a
 subclass of `ProtocolError` (never a bare `struct.error` or
-`ValueError`) on malformed input. The authoritative description lives in
-the module docstring of
+`ValueError`) on malformed input. (SCTP, which has no length field
+and a CRC32c that trailing zeros change, finds its own extent instead:
+it leaves only zero padding after it undecoded, and keeps any other
+trailing or unparseable bytes in its `chunks` rather than raising.)
+The authoritative description lives in the module docstring of
 [`src/netprotocols/_base.py`](src/netprotocols/_base.py) — read it
 before adding a protocol.
 

{netprotocols-2.3.0 → netprotocols-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: netprotocols
-Version: 2.3.0
+Version: 2.4.0
 Summary: Low-level implementations of common networking protocols
 Project-URL: Homepage, https://github.com/EONRaider/NETProtocols
 Project-URL: Repository, https://github.com/EONRaider/NETProtocols
@@ -76,28 +76,31 @@ Requires Python 3.12+. Fully typed (`py.typed`, mypy strict).
 
 ## Why NETProtocols
 
-Measured against `dpkt 1.9.8` and `scapy 2.7.0` on a 97-frame corpus of
-real captured traffic (CPython 3.12.3, x86-64 Linux; re-measured for
-2.3.0 on 2026-10-23 — see [docs/CLAIMS.md](docs/CLAIMS.md) for every
+Measured against `dpkt 1.9.8` and `scapy 2.8.0` on the 140-frame corpus
+of real captured traffic (CPython 3.12.3, x86-64 Linux; re-measured for
+2.4.0 on 2026-10-25 — see [docs/CLAIMS.md](docs/CLAIMS.md) for every
 number below, its reproduction command, and its caveats):
 
-- **Within 15% of dpkt on decode, 4.6× faster than scapy** —
+- **Within 15% of dpkt on decode, 4.1× faster than scapy** —
   `uv run --group bench python scripts/benchmark.py --compare`. dpkt is
-  the faster of the two comparators on this corpus; the gap moves both
-  ways as this library and dpkt each change, and this file's job is to
-  say so honestly rather than only when it's flattering.
-- **Decodes further into the stack than dpkt on 27 of 97 corpus
-  frames** — DNS and DHCP payloads that dpkt leaves as raw bytes,
-  netprotocols continues decoding. A throughput number means little
-  without knowing how much work it bought.
-- **4.5× faster than dpkt at re-encoding** (`bytes(header)`,
+  the faster of the two comparators, and on this corpus it and
+  netprotocols are at parity, the sign of the gap flipping between
+  runs. The gap moves both ways as this library and dpkt each change, and this
+  file's job is to say so honestly rather than only when it's
+  flattering.
+- **Decodes further into the stack than dpkt on 39 of those 140
+  frames** — DNS, DHCP and VXLAN-tunnelled payloads that dpkt leaves as
+  raw bytes, and 802.1Q tags it folds into the Ethernet header,
+  netprotocols decodes as layers of their own. A throughput number
+  means little without knowing how much work it bought.
+- **4.2× faster than dpkt at re-encoding** (`bytes(header)`,
   `scripts/benchmark_encode.py`) — the other half of "codec" that
   nobody else benchmarks.
-- **Imports in 57 ms; `scapy.all` takes 487+ ms** (`scripts/benchmark_import.py`),
+- **Imports in 55 ms; `scapy.all` takes 428+ ms** (`scripts/benchmark_import.py`),
   and never touches the host doing it — importing scapy populates live
   interface and routing tables as a side effect of the import
   statement.
-- **A 106.1 KiB wheel against scapy's 2.47 MiB** — 23.9× smaller.
+- **A 124.4 KiB wheel against scapy's 2.63 MiB** — 21.7× smaller.
 - **Regression-gated in CI, which — as far as we could establish by
   auditing ten comparable Python packet libraries' CI configurations
   (dpkt, scapy, pypacker, construct, pcapkit, dnspython, pyshark,
@@ -144,7 +147,7 @@ both are: a codec that turns bytes into typed objects and back.
 One `mypy --strict` run says more than the bullets above:
 
 ```
-# scapy 2.7.0 — a field name that does not exist
+# scapy 2.8.0 — a field name that does not exist
 p.ThisFieldDoesNotExist   → Any     (no error)
 
 # dpkt 1.9.8 — the whole module
@@ -172,10 +175,15 @@ ip.proto                  → error: "IPv4" has no attribute
 | 3 | ICMPv6 | `ICMPv6` | RFC 4443, 8-byte header |
 | 3 | IGMP | `IGMP` | RFC 1112/2236/3376, IPv4 multicast management; IGMPv3 report group records + query fields |
 | 3 | GRE | `GRE` | RFC 2784/2890, IP protocol 47; payload chains onward by EtherType |
+| 3 | IP-in-IP | `IPv4`, `IPv6` | RFC 2003/4213/2473, IP protocols 4 and 41; no header of its own, so the outer IP header dispatches straight to the inner one |
+| 3 | IPsec ESP | `ESP` | RFC 4303, IP protocol 50; SPI and sequence number decoded, the protected remainder kept as opaque `ciphertext` — the chain ends here by design, since without the Security Association nothing says where the Next Header is |
+| 3 | IPsec AH | `AH`, `AHv6` | RFC 4302, IP protocol 51; fixed fields decoded and the ICV kept raw (never verified), then the payload chains onward by `next_header` through the outer IP family's table — `AHv6`, an `AH` subclass, is what IPv6 dispatches to |
 | 4 | TCP | `TCP` | RFC 9293, data-offset/options aware |
 | 4 | UDP | `UDP` | RFC 768 |
+| 4 | SCTP | `SCTP` | RFC 9260, IP protocol 132; common header + chunk list (`SCTPChunk`) parsed on demand; CRC32c compute/verify |
 | 7 | DNS | `DNS` | RFC 1035, over UDP and TCP (`DNSOverTCP` length shim); on-demand name decompression + resource-record parsing |
 | 7 | DHCP | `DHCP` | RFC 2131/2132, over UDP 67/68; TLV options parsed on demand |
+| 7 | VXLAN | `VXLAN` | RFC 7348, over UDP 4789; the payload is a whole Ethernet frame, which walks on through the EtherType table |
 | 7 | HTTP/1.1 | `HTTP` | RFC 9112/9110; one message per decode from a buffer you reassembled; ambiguities reported as anomalies; not port-dispatched |
 
 ## Decoding a captured frame
@@ -296,8 +304,8 @@ exception in this library belongs to.
 
 `Packet.flow_key()` (or the free function, `netprotocols.flow_key()`,
 for a header pair that never went through `decode_frame`) returns a
-canonical, direction-independent key for a TCP/UDP conversation — both
-directions of one flow produce the same key:
+canonical, direction-independent key for a TCP, UDP or SCTP
+conversation — both directions of one flow produce the same key:
 
 ```python
 request = decode_frame(client_to_server_frame)
@@ -306,7 +314,7 @@ assert request.flow_key() == reply.flow_key()
 ```
 
 It returns `None`, not an error, when there is nothing to key on: no
-enclosing IP layer, no TCP/UDP layer, or a transport layer without
+enclosing IP layer, no TCP/UDP/SCTP layer, or a transport layer without
 ports at all (ICMPv4/ICMPv6 — this library does not invent a port-slot
 convention for message types that have none).
 
@@ -449,7 +457,8 @@ raw = bytes(frame)  # ready for a raw socket
 ```
 
 Checksums are computed and verified on request — never silently:
-`compute()`/`verify()` in `netprotocols.checksum`, and
+`compute()`/`verify()` in `netprotocols.checksum` (the internet
+checksum, and SCTP's CRC32c via `crc32c()`), and
 `Packet.with_checksums()` to fill a whole stack before sending.
 
 ## Display helpers
@@ -472,7 +481,26 @@ monitor built on it (formerly Packet-Sniffer).
 
 ## Roadmap
 
-The post-1.3.0 roadmap,
+The current roadmap,
+[#170](https://github.com/EONRaider/NETProtocols/issues/170), closes the
+protocol gap against dpkt, scapy and pypacker in five tiers: transport
+and tunneling, routing, L2 discovery, AAA and infrastructure services,
+and TLS record framing with SNI. That issue tracks each tier's
+protocols and target version, so they are not restated here. The
+HTTP/1.1 codec
+([#214](https://github.com/EONRaider/NETProtocols/pull/214),
+[#223](https://github.com/EONRaider/NETProtocols/pull/223),
+[#226](https://github.com/EONRaider/NETProtocols/pull/226)) shipped as
+2.3.0 outside those tiers, and the first tier — IP-in-IP, VXLAN, ESP, AH
+and SCTP
+([#230](https://github.com/EONRaider/NETProtocols/pull/230),
+[#231](https://github.com/EONRaider/NETProtocols/pull/231),
+[#232](https://github.com/EONRaider/NETProtocols/pull/232),
+[#233](https://github.com/EONRaider/NETProtocols/pull/233),
+[#234](https://github.com/EONRaider/NETProtocols/pull/234)) — as 2.4.0
+(see [CHANGELOG.md](CHANGELOG.md)).
+
+The roadmap before it, the post-1.3.0
 [#107](https://github.com/EONRaider/NETProtocols/issues/107), is
 complete — five tiers plus a competitor CI audit
 ([#124](https://github.com/EONRaider/NETProtocols/issues/124)) and the
@@ -492,19 +520,12 @@ decode-throughput fix
 CodeFactor tooling cleanup
 ([#156](https://github.com/EONRaider/NETProtocols/issues/156)) are now
 released as
-[2.2.1](https://github.com/EONRaider/NETProtocols/releases/tag/v2.2.1),
-and the HTTP/1.1 codec
-([#214](https://github.com/EONRaider/NETProtocols/pull/214),
-[#223](https://github.com/EONRaider/NETProtocols/pull/223),
-[#226](https://github.com/EONRaider/NETProtocols/pull/226)) as 2.3.0
-(see [CHANGELOG.md](CHANGELOG.md)).
+[2.2.1](https://github.com/EONRaider/NETProtocols/releases/tag/v2.2.1).
 2.1.0's and 1.3.1/1.4.0's work shipped folded into 2.0.0 and 2.2.0
 rather than as their own versions, but the roadmap's original "only at
 a major version bump" release policy wasn't actually held to: 2.0.0,
-2.2.0, 2.2.1 and now 2.3.0 are all on PyPI, and the comparative claims above
-draw on the finished tree. New planned work
-will open fresh issues rather than restating a list here, so this
-section stays accurate without upkeep. The wave before this one — TCP
+2.2.0, 2.2.1, 2.3.0 and now 2.4.0 are all on PyPI, and the comparative claims above
+draw on the finished tree. The wave before that one — TCP
 and IPv4 option parsing, ICMP message bodies, NDP, IPv6
 extension-header TLV options, the GRE checksum arm, a DNS-over-TCP
 corpus fixture and `ipaddress` accessors — shipped in 1.3.0; see
@@ -516,8 +537,9 @@ Development uses [uv](https://docs.astral.sh/uv/): `uv sync`, then
 `uv run pytest`, `uv run mypy`, and `uv run ruff check` — all three are
 enforced by CI; the test suite runs across Python 3.12–3.14, while
 `mypy` and `ruff check` run on 3.12. The test suite is anchored by a
-97-frame corpus of real captured traffic across 17 scenarios
-([tests/fixtures/MANIFEST.md](tests/fixtures/MANIFEST.md)) plus
+140-frame corpus of real captured traffic across 22 scenarios
+([tests/fixtures/MANIFEST.md](tests/fixtures/MANIFEST.md), which says
+which layers a script built rather than the kernel) plus
 property-based fuzzing of the decode path. See
 [CONTRIBUTING.md](CONTRIBUTING.md) for the full workflow and
 [ARCHITECTURE.md](ARCHITECTURE.md) for the design and the