Docs/Features/Integrity Repair

Integrity Repair

Length, checksum, and framing repair before send.

After mutation, Nexsiz repairs length, checksum, and framing so test cases remain wire-plausible enough to exercise deep protocol state. Repair is protocol-aware, plugin-selectable, and can auto-follow the active model name.

Order of operations

Mutate → integrity prepare_for_send → optional encryptor → send. Documented in src/input/readme.txt and implemented in src/input/integrity.rs + src/plugin/integrity.rs.

CLI / config

nexsiz -m http -i http -h 127.0.0.1 -p 80 -v
nexsiz -m ftp -i null ...          # disable repair (raw byte path)
# config
integrity=default

Flags: -i / --int / --integrity. Config keys: integrity, integrity_plugin.

Plugins

NameBehaviour
defaultSemantic Length / Checksum fields; generic prepare
null / noneNo-op — pure mutated bytes
http / httpsContent-Length rewrite, header/body split, CRLF normalization; respects chunked TE
ftpCRLF line normalization
smtpCRLF + DATA terminator (\r\n.\r\n) awareness
binaryLength-prefix + CRC32, big-endian (aliases: bin, binary-lp, dns, mqtt, smb)
binary-leSame, little-endian (bin-le, binary-lp-le, lp-le)

Unknown names fall back to default. When integrity is unset or default, resolve_integrity_for_protocol selects from the protocol model name (e.g. dns/mqtt/smb → binary).

Semantic field repair

  1. Length fields — rewritten to the size of subsequent payload fields.
  2. Checksum fields — recomputed over all other fields. Algorithms: additive, XOR, CRC-16/CCITT-FALSE, CRC-32/ISO-HDLC, one's-complement. Default path auto-picks by field width (1→XOR, 2→CRC16, 4→CRC32).

Endianness: BE by default; binary-le path uses LE for 2/4-byte fields.

Protocol raw heuristics

  • HTTP — fix or insert Content-Length; normalize header CRLFs; leave chunked bodies alone when Transfer-Encoding: chunked.
  • FTP — rejoin logical lines with CRLF.
  • SMTP — CRLF termination; append DATA end marker when missing on large buffers containing DATA.
  • Binary / generic — heuristic 1/2/4-byte length-prefix rewrite when the first bytes look like a plausible payload length.
When to use null

Use -i null for intentional framing-break campaigns (parser rejection paths). For state-machine depth, keep model-matched repair enabled.