Module ip_fragment 

flowscope::ip_fragment — IP fragment reassembly (issue #138).

Fragmented IP datagrams are an evasion surface: an attack split across fragments bypasses any L4/L7 parser that only sees the first fragment (the classic Ptacek–Newsham insertion/evasion and the teardrop overlap attacks). IpFragmentReassembler reassembles the original datagram from its fragments, keyed by the RFC 791 reassembly tuple (src, dst, protocol, id), so the reassembled payload can be re-fed to the L4/L7 path.

Structurally this mirrors SegmentBufferReassembler (the TCP out-of-order hole-filler): a per-datagram offset-ordered buffer, a completion check, a reassembly timeout, and byte/entry caps.

Overlap policy — drop, don’t reassemble

Overlapping fragments have no legitimate use; they exist to desync a reassembler from the endpoint (different OSes favour first- vs last-writer). Per RFC 5722 this implementation drops the entire datagram on any overlap and counts it (overlaps) — a fragmentation-evasion IOC.

IPv4 today; IPv6 follow-up

push_ipv4 (with the extractors feature) extracts the reassembly key + offset from an Ipv4Slice. The transport-agnostic push works for any address family with no feature required; an IPv6 convenience awaits Fragment-header (next-header 44) body decode in layers.

Example

use flowscope::ip_fragment::{FragmentKey, IpFragmentReassembler};
use flowscope::Timestamp;

let mut r = IpFragmentReassembler::new();
let key = FragmentKey {
    src: "10.0.0.1".parse().unwrap(),
    dst: "10.0.0.2".parse().unwrap(),
    protocol: 17, // UDP
    id: 42,
};
let now = Timestamp::new(0, 0);

// Fragment 1 (offset 0, More-Fragments set) — incomplete.
assert!(r.push(key, 0, true, b"AAAAAAAA", now).is_none());
// Fragment 2 (offset 8, last) — completes the datagram.
let datagram = r.push(key, 8, false, b"BBBB", now).unwrap();
assert_eq!(datagram, b"AAAAAAAABBBB");

Structs

FragmentConfig

Tuning for IpFragmentReassembler.

FragmentKey

RFC 791 §3.2 reassembly key: fragments of one datagram share (source, destination, protocol, identification).

IpFragmentReassembler

Reassembles IP datagrams from their fragments. See the module docs for the overlap policy and bounds.