redhound 1.0.0 → 2.0.0.rc1

data/lib/redhound/analysis/flow_key.rb

@@ -0,0 +1,53 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Analysis
+    # @api private
+    module FlowKey
+      # @rbs (Packet packet, ?Symbol? type) -> untyped
+      def self.from(packet, type = nil)
+        layers = packet.layers.reject(&:embedded)
+        if type == :eth
+          layer = layers.find { |item| item.protocol == :eth }
+          return nil unless layer && layer[:src] && layer[:dst]
+          return normalize(:eth, [layer.display(:src), 0], [layer.display(:dst), 0])
+        end
+        transport = layers.reverse.find { |item| %i[tcp udp icmp icmpv6].include?(item.protocol) }
+        if type && %i[tcp udp].include?(type)
+          return nil unless transport && transport.protocol == type
+        end
+        network = if type == :ip || type == :ipv6
+                    layers.find { |item| item.protocol == (type == :ip ? :ipv4 : :ipv6) }
+                  elsif transport
+                    position = layers.index(transport) #: Integer
+                    layers.take(position).reverse.find { |item| %i[ipv4 ipv6].include?(item.protocol) }
+                  else
+                    layers.reverse.find { |item| %i[ipv4 ipv6].include?(item.protocol) }
+                  end
+        return nil unless network && network[:src] && network[:dst]
+        proto = type || (transport ? transport.protocol : network.protocol)
+        if %i[tcp udp].include?(proto)
+          return nil unless transport && transport[:srcport] && transport[:dstport]
+          ports = [transport[:srcport], transport[:dstport]]
+        elsif %i[icmp icmpv6].include?(proto)
+          return nil unless transport
+          # Echo request/reply share a type series and identifier in both directions.
+          series = { 8 => 0, 128 => 129 }.fetch(transport[:type], transport[:type])
+          ports = [[series, transport[:ident] || 0], [series, transport[:ident] || 0]]
+        else
+          ports = [0, 0]
+        end
+        normalize(proto, [network.display(:src), ports[0]], [network.display(:dst), ports[1]])
+      end
+
+      # @rbs (Symbol proto, untyped src, untyped dst) -> untyped
+      def self.normalize(proto, src, dst)
+        reverse = (src <=> dst).positive?
+        a, b = reverse ? [dst, src] : [src, dst]
+        [[proto, *a, *b].freeze, reverse ? 1 : 0]
+      end
+    end
+  end
+end

data/lib/redhound/analysis/flow_table.rb

@@ -0,0 +1,117 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Analysis
+    # @api private
+    class Flow
+      BASE_BYTES = 4096
+      attr_reader :key, :id, :first_ns, :packets, :bytes, :streams, :applications, :acks, :keep_alives, :http_methods
+      attr_accessor :last_ns, :closed_ns, :syn_ns, :syn_direction, :synack_ns, :synack_seq, :initial_rtt, :accounted_bytes
+      # @rbs (untyped key, Integer id, Integer timestamp_ns) -> void
+      def initialize(key, id, timestamp_ns)
+        @key, @id, @first_ns, @last_ns = key, id, timestamp_ns, timestamp_ns
+        @packets, @bytes, @streams, @applications, @acks = [0, 0], [0, 0], [nil, nil], [nil, nil], [nil, nil]
+        @keep_alives = [false, false]
+        @http_methods = [Array.new, Array.new] #: Array[untyped]
+        @closed_ns = @syn_ns = @syn_direction = @synack_ns = @synack_seq = @initial_rtt = nil # @rbs untyped
+        @accounted_bytes = BASE_BYTES
+      end
+      # @rbs () -> bool
+      def closed? = !@closed_ns.nil?
+      # @rbs () -> Integer
+      def bytesize = BASE_BYTES + @streams.compact.sum(&:bytesize) + @applications.compact.sum(&:bytesize) + @http_methods.sum { |methods| methods.size * 16 }
+    end
+
+    # @api private
+    class FlowTable
+      attr_reader :evicted, :expired
+      attr_accessor :on_remove
+      # @rbs (?max_flows: Integer) -> void
+      def initialize(max_flows: 100_000)
+        raise ArgumentError, 'max_flows must be positive' unless max_flows.positive?
+        @max_flows, @next_id, @evicted, @expired, @clock = max_flows, 0, 0, 0, 0
+        @next_sweep, @bytes, @tcp_bytes = 0, 0, 0
+        @on_remove = nil # @rbs untyped
+        @entries = {} #: Hash[untyped, Flow]
+      end
+      # @rbs (Packet packet) -> untyped
+      def update(packet)
+        advance(packet.timestamp_ns)
+        result = FlowKey.from(packet)
+        return nil unless result
+        key, direction = result
+        flow = @entries.delete(key)
+        transport = packet.layers.reverse.find { |layer| layer.protocol == :tcp && !layer.embedded }
+        if flow && transport && transport[:flags] && transport[:flags] & 0x12 == 2
+          previous = flow.streams[direction]
+          if flow.closed? || (previous && previous.base_seq && previous.base_seq != transport[:seq])
+            discard(flow)
+            flow = nil
+          end
+        end
+        unless flow
+          evict if @entries.size >= @max_flows
+          flow = Flow.new(key, key[0] == :tcp ? @next_id : -1, @clock)
+          @next_id += 1 if key[0] == :tcp
+          @bytes += flow.accounted_bytes
+        end
+        flow.last_ns = @clock
+        flow.packets[direction] += 1
+        flow.bytes[direction] += packet.original_length
+        flow.closed_ns = @clock if transport && transport[:flags] && transport[:flags] & 4 != 0
+        @entries[key] = flow
+        [flow, direction]
+      end
+      # @rbs (Integer now_ns) -> void
+      def advance(now_ns)
+        @clock = [@clock, now_ns].max
+        expire(@clock) if @clock >= @next_sweep
+      end
+      # @rbs (Integer now_ns) -> void
+      def expire(now_ns)
+        @next_sweep = now_ns + 1_000_000_000
+        @entries.delete_if do |_key, flow|
+          timeout = flow.closed? ? 10 : flow.key[0] == :tcp ? 120 : 30
+          stale = now_ns - flow.last_ns >= timeout * 1_000_000_000
+          if stale
+            discard(flow)
+            @expired += 1
+          end
+          stale
+        end
+      end
+      # @rbs () -> Flow?
+      def evict
+        pair = @entries.shift
+        return nil unless pair
+        @evicted += 1
+        discard(pair[1])
+        pair[1]
+      end
+      # @rbs (Flow flow) -> void
+      def discard(flow)
+        @bytes -= flow.accounted_bytes
+        @tcp_bytes -= flow.accounted_bytes - Flow::BASE_BYTES if flow.key[0] == :tcp
+        @on_remove&.call(flow)
+      end
+      # @rbs (Flow flow) -> void
+      def account(flow)
+        size = flow.bytesize
+        delta = size - flow.accounted_bytes
+        @bytes += delta
+        @tcp_bytes += delta if flow.key[0] == :tcp
+        flow.accounted_bytes = size
+      end
+      # @rbs () -> Integer
+      def size = @entries.size
+      # @rbs () -> Array[Flow]
+      def values = @entries.values
+      # @rbs () -> Integer
+      def bytesize = @bytes
+      # @rbs () -> Integer
+      def tcp_bytesize = @tcp_bytes
+    end
+  end
+end

data/lib/redhound/analysis/ip_reassembler.rb

@@ -0,0 +1,176 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Analysis
+    # @api private
+    class IpReassembler
+      attr_reader :evicted, :expired
+      # @rbs (?max_bytes: Integer, ?timeout_ns: Integer) -> void
+      def initialize(max_bytes: 16 << 20, timeout_ns: 30_000_000_000)
+        raise ArgumentError, 'fragment limits must be positive' unless max_bytes.positive? && timeout_ns.positive?
+        @max_bytes, @timeout_ns, @clock, @evicted, @expired = max_bytes, timeout_ns, 0, 0, 0
+        @next_sweep = 0
+        @entries, @discarded = {}, {} # @rbs untyped
+      end
+      # @rbs (Packet packet) -> untyped
+      def descriptor(packet)
+        layers = packet.layers.reject(&:embedded)
+        layers.each_with_index do |layer, index|
+          if layer.protocol == :ipv4 && layer[:src] && layer[:dst] && (layer[:mf] == 1 || layer[:frag_offset].to_i.positive?)
+            return [layer, layer, [4, layer[:src], layer[:dst], layer[:proto], layer[:id]], layer[:frag_offset], layer[:mf] == 1]
+          elsif layer.protocol == :ipv6_ext && layer[:type] == 44 && layer[:fragment_offset] && layer[:identification]
+            network = layers.take(index).reverse.find { |item| item.protocol == :ipv6 }
+            return [network, layer, [6, network[:src], network[:dst], layer[:identification]], layer[:fragment_offset], layer[:more] == 1] if network && network[:src] && network[:dst]
+          end
+        end
+        nil
+      end
+      # @rbs (Packet packet) -> Packet?
+      def update(packet)
+        advance(packet.timestamp_ns)
+        info = descriptor(packet)
+        return nil unless info
+        network, fragment, key, offset, more = info
+        return nil if @discarded[key]
+        return nil if network.error? || fragment.error?
+        length = network.payload_end - fragment.payload_offset
+        if offset + length > 65_535 || length.negative? || (more && (length.zero? || length % 8 != 0))
+          fragment.diagnose(:error, :malformed, 'invalid IP fragment size or offset')
+          @entries.delete(key)
+          return nil
+        end
+        if network.diagnostics.any? { |diagnostic| diagnostic.code == :truncated }
+          fragment.diagnose(:note, :reassembly_gap, 'truncated IP fragment cannot be reassembled')
+          return nil
+        end
+        data = packet.data.byteslice(fragment.payload_offset, length) #: String
+        state = @entries.delete(key) || { parts: Array.new, frames: Array.new, header: nil, next_offset: 6, next: fragment[:next], end: nil } #: untyped
+        if key[0] == 6 && state[:next] != fragment[:next]
+          fragment.diagnose(:error, :malformed, 'IPv6 fragments have inconsistent next headers')
+          return nil
+        end
+        state[:time] = @clock
+        old_parts = state[:parts]
+        overlap = old_parts.any? { |pos, bytes| offset < pos + bytes.bytesize && offset + length > pos }
+        if overlap
+          fragment.diagnose(:warning, :fragment_overlap, 'overlapping IP fragments')
+          if key[0] == 6
+            @discarded[key] = @clock
+            while @discarded.size > [4096, @max_bytes / 128].min
+              @discarded.shift
+              @evicted += 1
+            end
+            while bytesize > @max_bytes && @entries.shift
+              @evicted += 1
+            end
+            return nil
+          end
+        end
+        pieces = [[offset, data]]
+        old_parts.each do |pos, bytes|
+          replacement = [] #: Array[untyped]
+          pieces.each do |start, payload|
+            ending, old_end = start + payload.bytesize, pos + bytes.bytesize
+            if start < old_end && ending > pos
+              from, to = [start, pos].max, [ending, old_end].min
+              fragment.diagnose(:warning, :overlap_mismatch) if payload.byteslice(from - start, to - from) != bytes.byteslice(from - pos, to - from)
+              replacement << [start, payload.byteslice(0, pos - start)] if start < pos
+              replacement << [old_end, payload.byteslice(old_end - start..)] if ending > old_end
+            else
+              replacement << [start, payload]
+            end
+          end
+          pieces = replacement
+        end
+        first_final = !more && !state[:end]
+        unless more
+          if state[:end] && state[:end] != offset + length
+            fragment.diagnose(:error, :malformed, 'inconsistent final IP fragment length')
+            return nil
+          end
+          state[:end] = offset + length
+        end
+        state[:frames] << packet.number if !pieces.empty? || first_final
+        state[:parts].concat(pieces).sort_by!(&:first)
+        if offset.zero? && !state[:header]
+          state[:header] = packet.data.byteslice(network.offset, fragment.payload_offset - network.offset - (key[0] == 6 ? 8 : 0))
+          if key[0] == 6
+            position = packet.layers.index(fragment) #: Integer
+            previous = packet.layers.take(position).last #: Layer
+            state[:next_offset] = previous == network ? 6 : previous.offset - network.offset
+          end
+        end
+        @entries[key] = state
+        if complete?(state)
+          @entries.delete(key)
+          return virtual_packet(packet, state, key[0])
+        end
+        while bytesize > @max_bytes
+          removed = @entries.shift
+          break unless removed
+          @evicted += 1
+          fragment.diagnose(:warning, :reassembly_gap, 'IP reassembly memory limit exceeded')
+        end
+        nil
+      end
+      # @rbs (untyped state) -> bool
+      def complete?(state)
+        return false unless state[:header] && state[:end]
+        expected = 0
+        state[:parts].each do |offset, bytes|
+          return false unless offset == expected
+          expected += bytes.bytesize
+        end
+        expected == state[:end]
+      end
+      # @rbs (Packet packet, untyped state, Integer version) -> Packet?
+      def virtual_packet(packet, state, version)
+        payload = state[:parts].map(&:last).join.b
+        header = state[:header].dup
+        if header.bytesize + payload.bytesize > 65_535
+          packet.layers.last.diagnose(:error, :bad_length, 'reassembled IP datagram exceeds 65535 bytes')
+          return nil
+        end
+        if version == 4
+          header[2, 2] = [header.bytesize + payload.bytesize].pack('n')
+          header[6, 2] = [header.unpack1('n', offset: 6) & 0x4000].pack('n')
+          header[10, 2] = "\0\0"
+          header[10, 2] = [Protocols::Checksum.value(header)].pack('n')
+        else
+          header.setbyte(state[:next_offset], state[:next])
+          header[4, 2] = [header.bytesize - 40 + payload.bytesize].pack('n')
+        end
+        result = Packet.new(header + payload, linktype: 101, timestamp_ns: packet.timestamp_ns, number: packet.number,
+                            interface: packet.interface, direction: packet.direction,
+                            meta: packet.meta.merge(reassembled_from: state[:frames].uniq.sort))
+        result.engine = packet.engine
+        result
+      end
+      # @rbs (Integer now_ns) -> void
+      def advance(now_ns)
+        @clock = [@clock, now_ns].max
+        expire(@clock) if @clock >= @next_sweep
+      end
+      # @rbs (Integer now_ns) -> void
+      def expire(now_ns)
+        @next_sweep = now_ns + 1_000_000_000
+        @entries.delete_if do |_key, state|
+          stale = now_ns - state[:time] >= @timeout_ns
+          @expired += 1 if stale
+          stale
+        end
+        @discarded.delete_if { |_key, time| now_ns - time >= @timeout_ns }
+      end
+      # @rbs () -> Integer
+      def bytesize
+        @discarded.size * 128 + @entries.values.sum do |state|
+          512 + (state[:header]&.bytesize || 0) + state[:frames].size * 32 + state[:parts].sum { |_pos, bytes| bytes.bytesize + 128 }
+        end
+      end
+      # @rbs () -> Integer
+      def size = @entries.size
+    end
+  end
+end

data/lib/redhound/analysis/stats.rb

@@ -0,0 +1,138 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Analysis
+    # @api private
+    module Stats
+      # @api private
+      class Table
+        attr_reader :evicted
+        # @rbs (?max_rows: Integer) -> void
+        def initialize(max_rows: 100_000)
+          @max_rows, @evicted = max_rows, 0
+          @rows = {} #: Hash[untyped, untyped]
+        end
+        # @rbs (untyped key) { () -> untyped } -> untyped
+        def row(key)
+          item = @rows.delete(key)
+          unless item
+            if @rows.size >= @max_rows
+              @rows.shift
+              @evicted += 1
+            end
+            item = yield
+          end
+          @rows[key] = item
+          item
+        end
+        # @rbs () -> Integer
+        def bytesize = @rows.size * 1024
+        # @rbs () -> void
+        def evict
+          @evicted += 1 if @rows.shift
+        end
+        # @rbs (untyped io) -> void
+        def format(io)
+          result = to_h
+          io.puts("#{result[:kind]}#{result[:type] ? ",#{result[:type]}" : ''}")
+          result[:rows].each { |item| io.puts(item.map { |name, value| "#{name}=#{value.is_a?(Array) ? value.join(':') : value}" }.join(' ')) }
+          io.puts("#{@evicted} statistics rows evicted") if @evicted.positive?
+        end
+        # @rbs () -> Hash[Symbol, untyped]
+        def to_h = { kind: :stats, rows: @rows.values }
+      end
+
+      # @api private
+      class Io < Table
+        # @rbs ((Integer | Float) seconds, ?max_rows: Integer) -> void
+        def initialize(seconds, max_rows: 100_000)
+          super(max_rows: max_rows)
+          @interval_ns = (seconds * 1_000_000_000).to_i
+          raise ArgumentError, 'statistics interval must be positive' unless @interval_ns.positive?
+          @start_ns = nil # @rbs Integer?
+        end
+        # @rbs (Packet packet) -> void
+        def update(packet)
+          @start_ns ||= packet.timestamp_ns
+          start = @start_ns #: Integer
+          interval = [(packet.timestamp_ns - start) / @interval_ns, 0].max
+          item = row(interval) { { interval: interval, start_ns: start + interval * @interval_ns, end_ns: start + (interval + 1) * @interval_ns, packets: 0, bytes: 0 } }
+          item[:packets] += 1
+          item[:bytes] += packet.original_length
+        end
+        # @rbs () -> Hash[Symbol, untyped]
+        def to_h = { kind: :io, interval_ns: @interval_ns, rows: @rows.values.sort_by { |item| item[:interval] } }
+      end
+
+      # @api private
+      class Conversations < Table
+        # @rbs (Symbol type, ?max_rows: Integer) -> void
+        def initialize(type, max_rows: 100_000)
+          super(max_rows: max_rows)
+          @type = type
+        end
+        # @rbs (Packet packet) -> void
+        def update(packet)
+          result = FlowKey.from(packet, @type)
+          return unless result
+          key, direction = result
+          item = row(key) do
+            { addr_a: key[1], port_a: key[2], addr_b: key[3], port_b: key[4],
+              packets_ab: 0, packets_ba: 0, bytes_ab: 0, bytes_ba: 0,
+              start_ns: packet.timestamp_ns, end_ns: packet.timestamp_ns, duration_ns: 0 }
+          end
+          suffix = direction.zero? ? 'ab' : 'ba'
+          item["packets_#{suffix}".to_sym] += 1
+          item["bytes_#{suffix}".to_sym] += packet.original_length
+          item[:start_ns] = [item[:start_ns], packet.timestamp_ns].min
+          item[:end_ns] = [item[:end_ns], packet.timestamp_ns].max
+          item[:duration_ns] = item[:end_ns] - item[:start_ns]
+        end
+        # @rbs () -> Hash[Symbol, untyped]
+        def to_h = { kind: :conv, type: @type, rows: @rows.values }
+      end
+
+      # @api private
+      class Endpoints < Table
+        # @rbs (Symbol type, ?max_rows: Integer) -> void
+        def initialize(type, max_rows: 100_000)
+          super(max_rows: max_rows)
+          @type = type
+        end
+        # @rbs (Packet packet) -> void
+        def update(packet)
+          result = FlowKey.from(packet, @type)
+          return unless result
+          key, direction = result
+          endpoints = [[key[1], key[2]], [key[3], key[4]]]
+          endpoints.each_with_index do |endpoint, index|
+            item = row(endpoint) { { address: endpoint[0], port: endpoint[1], packets_tx: 0, packets_rx: 0, bytes_tx: 0, bytes_rx: 0 } }
+            suffix = index == direction ? 'tx' : 'rx'
+            item["packets_#{suffix}".to_sym] += 1
+            item["bytes_#{suffix}".to_sym] += packet.original_length
+          end
+        end
+        # @rbs () -> Hash[Symbol, untyped]
+        def to_h = { kind: :endpoints, type: @type, rows: @rows.values }
+      end
+
+      # @api private
+      class Hierarchy < Table
+        # @rbs (Packet packet) -> void
+        def update(packet)
+          path = [] #: Array[Symbol]
+          packet.layers.reject(&:embedded).each do |layer|
+            path << layer.protocol
+            item = row(path.dup) { { path: path.dup, packets: 0, bytes: 0 } }
+            item[:packets] += 1
+            item[:bytes] += packet.original_length
+          end
+        end
+        # @rbs () -> Hash[Symbol, untyped]
+        def to_h = { kind: :phs, rows: @rows.values }
+      end
+    end
+  end
+end

data/lib/redhound/analysis/tcp_analysis.rb

@@ -0,0 +1,43 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Analysis
+    # @api private
+    module TcpAnalysis
+      # @rbs (Flow flow, Integer direction, TcpStream stream, Layer layer, Integer timestamp_ns) -> void
+      def self.update(flow, direction, stream, layer, timestamp_ns)
+        flags, seq, ack, length = layer[:flags], layer[:seq], layer[:ack], layer[:length]
+        layer.add(:stream, 'tcp.stream', flow.id)
+        layer.add(:seq_relative, 'tcp.seq_relative', Util::Seq.diff(seq, stream.base_seq || seq))
+        peer = flow.streams[1 - direction]
+        layer.add(:ack_relative, 'tcp.ack_relative', Util::Seq.diff(ack, peer.base_seq)) if peer && peer.base_seq && flags & 0x10 != 0
+        keep_alive = stream.base_seq && flags & 7 == 0 && length <= 1 && seq == (stream.next_sequence - 1) % Util::Seq::MOD
+        keep_alive_ack = flow.keep_alives[1 - direction] && peer && flags & 0x17 == 0x10 && length.zero? && ack == peer.next_sequence
+        if flags & 0x10 != 0
+          flag(layer, :duplicate_ack) if flags & 7 == 0 && length.zero? && layer[:window].positive? && flow.acks[direction] == [ack, layer[:window], 0] && !keep_alive_ack
+          flow.acks[direction] = [ack, layer[:window], length]
+          flow.keep_alives[1 - direction] = false
+        end
+        flag(layer, :zero_window) if layer[:window].zero? && flags & 6 == 0
+        if keep_alive
+          flag(layer, :keep_alive)
+          flow.keep_alives[direction] = true
+        end
+        if flags & 2 != 0 && flags & 0x10 == 0
+          flow.syn_ns ||= timestamp_ns
+          flow.syn_direction ||= direction
+        elsif flags & 0x12 == 0x12 && flow.syn_ns && flow.syn_direction != direction
+          flow.synack_ns ||= timestamp_ns
+          flow.synack_seq ||= seq
+        elsif flags & 0x10 != 0 && flow.synack_ns && flow.syn_direction == direction && !flow.initial_rtt && ack == (flow.synack_seq + 1) % Util::Seq::MOD
+          flow.initial_rtt = [timestamp_ns - flow.syn_ns, 0].max.fdiv(1_000_000_000)
+        end
+        layer.add(:initial_rtt, 'tcp.analysis.initial_rtt', flow.initial_rtt) if flow.initial_rtt && flags & 0x17 == 0x10
+      end
+      # @rbs (Layer layer, Symbol name) -> void
+      def self.flag(layer, name) = layer.add("analysis_#{name}".to_sym, "tcp.analysis.#{name}", true, type: :boolean)
+    end
+  end
+end

data/lib/redhound/analysis/tcp_reassembler.rb

@@ -0,0 +1,124 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Analysis
+    # @api private
+    class TcpReassembler
+      # @rbs (?registry: Registry, ?max_bytes: Integer, ?stream_bytes: Integer, ?protocol_streams: bool, ?follow: untyped) -> void
+      def initialize(registry: Registry.default, max_bytes: 64 << 20, stream_bytes: 1 << 20, protocol_streams: true, follow: nil)
+        @registry, @max_bytes, @stream_bytes, @protocol_streams, @follow = registry, max_bytes, stream_bytes, protocol_streams, follow
+      end
+      # @rbs (Packet packet, Flow flow, Integer direction) -> void
+      def update(packet, flow, direction)
+        layer = packet.layers.reverse.find { |item| item.protocol == :tcp && !item.embedded }
+        return unless layer && !layer.error? && layer[:seq] && layer[:flags]
+        stream = flow.streams[direction] ||= TcpStream.new(max_bytes: @stream_bytes)
+        application = flow.applications[direction]
+        if !application && @protocol_streams
+          klass = @registry.by_port('tcp.port', layer[:srcport], layer[:dstport])
+          unless klass
+            recognized = packet.layers.find { |item| (candidate = @registry.protocols[item.protocol]) && candidate <= StreamDissector }
+            klass = recognized ? @registry.protocols[recognized.protocol] : flow.applications[1 - direction]&.class
+          end
+          flow.applications[direction] = klass.new(registry: @registry, max_bytes: @stream_bytes) if klass && klass <= StreamDissector
+          application = flow.applications[direction]
+        end
+        TcpAnalysis.update(flow, direction, stream, layer, packet.timestamp_ns)
+        flags = layer[:flags]
+        data = packet.data.byteslice(layer.payload_offset, layer.payload_end - layer.payload_offset) #: String
+        stream.push(layer[:seq], data, syn: flags & 2 != 0, fin: flags & 1 != 0, frame: packet.number)
+        # Packet-local application parsing cannot frame a multi-segment PDU.
+        if application
+          index = packet.layers.index(layer) #: Integer
+          packet.layers.slice!(index + 1, packet.layers.length)
+        end
+        stream.diagnostics.uniq.each do |code|
+          if %i[retransmission out_of_order lost_segment].include?(code)
+            TcpAnalysis.flag(layer, code) unless layer.field_value('tcp.analysis.keep_alive')
+          else
+            layer.diagnose(:warning, code)
+          end
+        end
+        deliver(flow, direction, stream, application, packet)
+        if flags & 4 != 0
+          finish_flow(flow, packet)
+        elsif flow.streams.compact.size == 2 && flow.streams.compact.all?(&:fin_seen?)
+          finish_flow(flow, packet)
+        elsif stream.fin
+          attach(packet, application.on_close(flow, direction)) if application
+          flow.closed_ns ||= packet.timestamp_ns if flow.streams.compact.size == 2 && flow.streams.compact.all?(&:fin)
+        end
+      end
+      # @rbs (Flow flow, Integer direction, TcpStream stream, untyped application, Packet? packet) -> Array[Layer]
+      def deliver(flow, direction, stream, application, packet)
+        completed = [] #: Array[Layer]
+        stream.deliveries.each do |data, origin|
+          unless data
+            gap = Layer.new(:tcp, 0, 0, 0).diagnose(:warning, :reassembly_gap, "#{origin} TCP bytes missing")
+            packet&.[](:tcp)&.diagnose(:warning, :reassembly_gap, gap.diagnostics.first.message)
+            completed << gap unless packet
+            layers = application ? application.on_gap(flow, direction, origin) : Array.new #: Array[Layer]
+            completed.concat(layers)
+            attach(packet, layers) if packet
+            next
+          end
+          @follow&.write(flow, direction, data)
+          layers = if application
+                     begin
+                       application.on_data(flow, direction, data, origin)
+                     rescue StandardError => error
+                       raise if ENV['REDHOUND_STRICT'] == '1'
+                       application.on_gap(flow, direction, data.bytesize)
+                       [Layer.new(application.class.protocol_id, 0, 0, 0).diagnose(:error, :dissector_bug, "#{error.class}: #{error.message}")]
+                     end
+                   else
+                     Array.new
+                   end #: Array[Layer]
+          attach(packet, layers) if packet
+          completed.concat(layers)
+        end
+        completed
+      ensure
+        stream.clear_deliveries
+      end
+      # @rbs (Packet packet, Array[Layer] layers) -> void
+      def attach(packet, layers)
+        layers.each do |layer|
+          layer.add(:reassembled_in, 'tcp.reassembled_in', packet.number)
+          packet.layers << layer
+        end
+      end
+      # @rbs (Flow flow, ?Packet? packet) -> Array[Layer]
+      def finish_flow(flow, packet = nil)
+        completed = [] #: Array[Layer]
+        flow.streams.each_with_index do |stream, direction|
+          next unless stream
+          application = flow.applications[direction]
+          while stream.pending?
+            stream.flush_gap
+            completed.concat(deliver(flow, direction, stream, application, packet))
+          end
+          if application
+            layers = application.on_close(flow, direction)
+            attach(packet, layers) if packet
+            completed.concat(layers)
+          end
+          stream.release
+        end
+        flow.http_methods.each(&:clear)
+        flow.closed_ns ||= packet ? packet.timestamp_ns : flow.last_ns
+        completed
+      end
+      # @rbs (FlowTable flows, Packet packet) -> void
+      def enforce_limit(flows, packet)
+        while flows.tcp_bytesize > @max_bytes
+          flow = flows.evict
+          break unless flow
+          packet.layers.last.diagnose(:warning, :reassembly_gap, 'TCP reassembly memory limit exceeded')
+        end
+      end
+    end
+  end
+end