Skip to content

bfd: fix ConditionalField condition for optional_auth always being True#4965

Merged
gpotter2 merged 1 commit intosecdev:masterfrom
T3pp31:fix/bfd-optional-auth-condition
Apr 12, 2026
Merged

bfd: fix ConditionalField condition for optional_auth always being True#4965
gpotter2 merged 1 commit intosecdev:masterfrom
T3pp31:fix/bfd-optional-auth-condition

Conversation

@T3pp31
Copy link
Copy Markdown
Contributor

@T3pp31 T3pp31 commented Apr 12, 2026

Summary

Fixes #4937

  • The ConditionalField guarding optional_auth in BFD used pkt.flags.names[2] == "A", which always evaluates to True because FlagValue.names returns the flag definition string "MDACFP", not the set of currently active flags
  • Replaced with pkt.flags.A to properly check the Authentication Present bit, consistent with the pattern used elsewhere in Scapy (e.g., vxlan.py)
  • Added 4 regression tests covering: no-auth dissection, non-auth flags, round-trip serialization, and auth-present dissection

Test plan

  • All 12 BFD tests pass (8 existing + 4 new)
  • No regression in existing auth dissection and build tests
  • CI passes

…ue (secdev#4937)

The condition `pkt.flags.names[2] == "A"` always evaluated to True because
FlagValue.names returns the flag definition string "MDACFP", not the set of
currently active flags. Replace with `pkt.flags.A` to properly check the
Authentication Present bit.
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 12, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.31%. Comparing base (9ae49f8) to head (0d8a85a).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #4965   +/-   ##
=======================================
  Coverage   80.30%   80.31%           
=======================================
  Files         379      379           
  Lines       93164    93181   +17     
=======================================
+ Hits        74820    74840   +20     
+ Misses      18344    18341    -3     
Files with missing lines Coverage Δ
scapy/contrib/bfd.py 94.73% <ø> (ø)

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2 gpotter2 merged commit 66ef96a into secdev:master Apr 12, 2026
24 checks passed
@gpotter2
Copy link
Copy Markdown
Member

Thanks for the PR !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BFD optional_auth ConditionalField condition is always True — phantom auth injected on every parsed packet

3 participants