redhound 1.0.1 → 2.0.0.rc2

data/lib/redhound/protocols/dhcp.rb

@@ -0,0 +1,140 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Dhcp < Dissector
+      MESSAGE_TYPES = { 1 => 'Discover', 2 => 'Offer', 3 => 'Request', 4 => 'Decline', 5 => 'ACK',
+                        6 => 'NAK', 7 => 'Release', 8 => 'Inform' }.freeze
+      ADDRESS_OPTIONS = { 1 => 'subnet_mask', 3 => 'router', 6 => 'domain_name_server',
+                          50 => 'requested_ip_address', 54 => 'dhcp_server_id' }.freeze
+      protocol :dhcp, name: 'Dynamic Host Configuration Protocol', short: 'DHCP'
+      dissects_on 'udp.port', 67, 68
+      header do
+        uint8 :type, 'dhcp.type'
+        uint8 :hw_type, 'dhcp.hw.type'
+        uint8 :hw_len, 'dhcp.hw.len'
+        uint8 :hops, 'dhcp.hops'
+        uint32 :xid, 'dhcp.id', format: :hex
+        uint16 :secs, 'dhcp.secs'
+        uint16 :flags, 'dhcp.flags', format: :hex
+        ipv4 :client, 'dhcp.ip.client'
+        ipv4 :your, 'dhcp.ip.your'
+        ipv4 :server, 'dhcp.ip.server'
+        ipv4 :relay, 'dhcp.ip.relay'
+      end
+
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        cursor = ctx.cursor
+        cursor.check(0, 236)
+        return layer.diagnose(:error, :bad_length, 'hardware address is longer than 16 bytes') if layer[:hw_len] > 16
+        put(layer, 'dhcp.hw.mac_addr', cursor.bytes(28, layer[:hw_len]),
+            layer[:hw_type] == 1 && layer[:hw_len] == 6 ? :mac : :bytes, 28, layer[:hw_len])
+        put(layer, 'dhcp.server', cursor.bytes(44, 64).split("\0", 2).first || '', :string, 44, 64)
+        put(layer, 'dhcp.file', cursor.bytes(108, 128).split("\0", 2).first || '', :string, 108, 128)
+        return if cursor.remaining == 236
+        cursor.check(236, 4)
+        unless cursor.u32(236) == 0x63825363
+          put(layer, 'dhcp.vendor', cursor.bytes(236, cursor.remaining - 236), :bytes, 236, cursor.remaining - 236)
+          return
+        end
+        put(layer, 'dhcp.cookie', 0x63825363, :uint, 236, 4)
+        # @type var options: Hash[Integer, untyped]
+        options = Hash.new
+        read_options(cursor, layer, 240, cursor.remaining, options)
+        overload = options[52]&.map { |entry| entry[0] }&.join
+        if overload
+          return layer.diagnose(:error, :bad_length, 'invalid DHCP overload option') unless overload.bytesize == 1 && overload.getbyte(0).between?(1, 3)
+          read_options(cursor, layer, 108, 236, options) if overload.getbyte(0) & 1 != 0
+          read_options(cursor, layer, 44, 108, options) if overload.getbyte(0) & 2 != 0
+        end
+        options.each do |code, entries|
+          value = entries.map { |entry| entry[0] }.join
+          decode_option(layer, code, value, entries)
+        end
+      rescue Cursor::Truncated => e
+        layer.diagnose(:note, :truncated, e.message)
+      ensure
+        layer.header_length = cursor.remaining
+        layer.payload_offset = layer.payload_end
+      end
+
+      # @rbs (Cursor cursor, Layer layer, Integer pos, Integer ending, untyped options) -> void
+      def read_options(cursor, layer, pos, ending, options)
+        while pos < ending
+          code = cursor.u8(pos)
+          pos += 1
+          next if code.zero?
+          break if code == 255
+          raise Cursor::Truncated, 'truncated DHCP option length' if pos >= ending
+          len = cursor.u8(pos)
+          pos += 1
+          raise Cursor::Truncated, 'DHCP option exceeds available bytes' if pos + len > ending
+          value = cursor.bytes(pos, len)
+          put(layer, 'dhcp.option.type', code, :uint, pos - 2, 1)
+          put(layer, 'dhcp.option.length', len, :uint, pos - 1, 1)
+          put(layer, 'dhcp.option.value', value, :bytes, pos, len)
+          options[code] = Array.new unless options.key?(code)
+          options[code] << [value, pos]
+          pos += len
+        end
+      end
+
+      # @rbs (Layer layer, Integer code, String value, untyped entries) -> void
+      def decode_option(layer, code, value, entries)
+        offset = entries.first[1]
+        length = value.bytesize
+        if ADDRESS_OPTIONS.key?(code)
+          valid = length.positive? && length % 4 == 0 && (![1, 50, 54].include?(code) || length == 4)
+          return layer.diagnose(:error, :bad_length, "invalid DHCP option #{code} length") unless valid
+          (length / 4).times do |i|
+            put(layer, "dhcp.option.#{ADDRESS_OPTIONS[code]}", value.unpack1('N', offset: i * 4), :ipv4, offset + i * 4, 4, entries)
+          end
+        else
+          case code
+          when 53, 52
+            return layer.diagnose(:error, :bad_length, "invalid DHCP option #{code} length") unless length == 1
+            put(layer, code == 53 ? 'dhcp.option.dhcp' : 'dhcp.option.overload', value.getbyte(0), :uint, offset, 1, entries)
+          when 51
+            return layer.diagnose(:error, :bad_length, 'invalid DHCP lease length') unless length == 4
+            put(layer, 'dhcp.option.ip_address_lease_time', value.unpack1('N'), :uint, offset, 4, entries)
+          when 55
+            length.times { |i| put(layer, 'dhcp.option.request_list_item', value.getbyte(i), :uint, offset + i, 1, entries) }
+          when 61
+            return layer.diagnose(:error, :bad_length, 'DHCP client ID must include type and identifier') if length < 2
+            put(layer, 'dhcp.option.client_id', value, :bytes, offset, length, entries)
+            put(layer, 'dhcp.option.client_id.type', value.getbyte(0), :uint, offset, 1, entries)
+            put(layer, 'dhcp.option.client_id.hw_mac_addr', value.byteslice(1, 6), :mac, offset + 1, 6, entries) if length == 7 && value.getbyte(0) == 1
+          when 12 then put(layer, 'dhcp.option.hostname', value, :string, offset, length, entries)
+          end
+        end
+      end
+
+      # @rbs (untyped entries, Integer logical) -> Integer
+      def wire_offset(entries, logical)
+        entries.each do |bytes, pos|
+          return pos + logical if logical < bytes.bytesize
+          logical -= bytes.bytesize
+        end
+        entries.last[1] + entries.last[0].bytesize
+      end
+
+      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length, ?untyped entries) -> void
+      def put(layer, name, value, type, offset, length, entries = nil)
+        if entries
+          logical = offset - entries.first[1]
+          first = wire_offset(entries, logical)
+          ending = length.zero? ? first : wire_offset(entries, logical + length - 1) + 1
+          offset, length = first, ending - first
+        end
+        layer.add("#{name}_#{layer.definitions.length}".to_sym, name, value, type: type, offset: offset, length: length)
+      end
+
+      # @rbs (Layer layer) -> String
+      def summary(layer) = "DHCP #{MESSAGE_TYPES[layer.field_value('dhcp.option.dhcp')] || 'BOOTP'}, xid #{format('0x%x', layer[:xid] || 0)}"
+    end
+  end
+end

data/lib/redhound/protocols/dns.rb

@@ -0,0 +1,268 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Dns < StreamDissector
+      # @api private
+      class Malformed < StandardError; end
+      TYPES = { 1 => 'A', 2 => 'NS', 5 => 'CNAME', 6 => 'SOA', 12 => 'PTR', 15 => 'MX',
+                16 => 'TXT', 28 => 'AAAA', 33 => 'SRV', 41 => 'OPT', 64 => 'SVCB', 65 => 'HTTPS' }.freeze
+      protocol :dns, name: 'Domain Name System', short: 'DNS'
+      dissects_on 'udp.port', 53, 5353, 5355
+      dissects_on 'tcp.port', 53, 5353, 5355
+
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        cursor = ctx.cursor
+        pos = 0
+        transport = ctx.layers.last
+        tcp = transport&.protocol == :tcp
+        port = [transport&.[](:srcport), transport&.[](:dstport)].compact.sort.find { |value| [53, 5353, 5355].include?(value) }
+        variant = { 5353 => :mdns, 5355 => :llmnr }.fetch(port, :dns)
+        layer.values[:variant] = variant
+        loop do
+          if tcp
+            len = cursor.u16(pos)
+            put(layer, 'dns.length', len, :uint, pos, 2)
+            raise Malformed, 'DNS message shorter than header' if len < 12
+            pos += 2
+            ending = pos + len
+            layer.diagnose(:note, :truncated) if ending > cursor.remaining
+            message(cursor.sub(cursor.start + pos, cursor.start + ending), layer, variant)
+            pos = ending
+          else
+            message(cursor, layer, variant)
+            pos = cursor.remaining
+          end
+          break unless tcp && pos < cursor.remaining
+        end
+      rescue Cursor::Truncated => e
+        layer.diagnose(:note, :truncated, e.message)
+      rescue Malformed => e
+        layer.diagnose(:error, :malformed, e.message)
+      ensure
+        layer.header_length = cursor.remaining
+        layer.payload_offset = layer.payload_end
+      end
+
+      # @rbs (Cursor cursor, Layer layer, Symbol variant) -> void
+      def message(cursor, layer, variant)
+        cursor.check(0, 12)
+        base = cursor.start - layer.offset
+        put(layer, 'dns.id', cursor.u16(0), :uint, base, 2)
+        flags = cursor.u16(2)
+        put(layer, 'dns.flags', flags, :uint, base + 2, 2)
+        flag_bits = { response: [15, 1], opcode: [11, 15], authoritative: [10, 1], truncated: [9, 1],
+                      recdesired: [8, 1], recavail: [7, 1], authenticated: [5, 1], checkdisable: [4, 1], rcode: [0, 15] }
+        if variant == :llmnr
+          %i[authoritative recdesired recavail authenticated checkdisable].each { |key| flag_bits.delete(key) }
+          flag_bits.merge!(conflict: [10, 1], tentative: [8, 1])
+        end
+        flag_bits.each do |key, pair|
+          next if key == :rcode && flags & 0x8000 == 0
+          shift, mask = pair.fetch(0), pair.fetch(1)
+          value = (flags >> shift) & mask
+          put(layer, "dns.flags.#{key}", mask == 1 ? value == 1 : value, mask == 1 ? :boolean : :uint, base + 2, 2)
+        end
+        counts = cursor.unpack('n4', 8, 4)
+        %w[queries answers auth_rr additional_rr].each_with_index do |name, i|
+          put(layer, "dns.count.#{name}", counts[i], :uint, base + 4 + i * 2, 2)
+        end
+        pos = 12
+        counts[0].times do
+          name, after = read_name(cursor, pos)
+          put(layer, 'dns.qry.name', name, :string, base + pos, after - pos)
+          cursor.check(after, 4)
+          put(layer, 'dns.qry.type', cursor.u16(after), :uint, base + after, 2)
+          klass = cursor.u16(after + 2)
+          put(layer, 'dns.qry.class', variant == :mdns ? klass & 0x7fff : klass, :uint, base + after + 2, 2)
+          put(layer, 'dns.qry.qu', klass & 0x8000 != 0, :boolean, base + after + 2, 2) if variant == :mdns
+          pos = after + 4
+        end
+        counts.drop(1).sum.times { pos = record(cursor, layer, pos, base, variant) }
+      end
+
+      # @rbs (Cursor cursor, Integer pos, ?Integer? limit, ?bool compression) -> [String, Integer]
+      def read_name(cursor, pos, limit = nil, compression = true)
+        limit ||= cursor.remaining
+        labels, seen, wire_length, jumps, ending = [], {}, 1, 0, nil
+        loop do
+          raise Malformed, 'DNS name compression loop' if seen[pos]
+          seen[pos] = true
+          len = cursor.u8(pos)
+          raise Malformed, 'DNS name exceeds record length' if ending.nil? && pos >= limit
+          if len & 0xc0 == 0xc0
+            raise Malformed, 'compressed target name is forbidden' unless compression
+            raise Malformed, 'DNS pointer exceeds record length' if ending.nil? && pos + 2 > limit
+            target = cursor.u16(pos) & 0x3fff
+            raise Malformed, 'DNS pointer is not backward' unless target < pos
+            jumps += 1
+            raise Malformed, 'DNS compression exceeds 128 jumps' if jumps > 128
+            ending ||= pos + 2
+            pos = target
+          else
+            raise Malformed, 'invalid DNS label type' unless len & 0xc0 == 0
+            pos += 1
+            break if len.zero?
+            wire_length += len + 1
+            raise Malformed, 'DNS name exceeds 255 bytes' if wire_length > 255
+            cursor.check(pos, len)
+            raise Malformed, 'DNS label exceeds record length' if ending.nil? && pos + len > limit
+            labels << cursor.bytes(pos, len)
+            pos += len
+          end
+        end
+        [labels.join('.'), ending || pos]
+      end
+
+      # @rbs (Cursor cursor, Layer layer, Integer pos, Integer base, Symbol variant) -> Integer
+      def record(cursor, layer, pos, base, variant)
+        name, after = read_name(cursor, pos)
+        cursor.check(after, 10)
+        type, klass, ttl, length = cursor.unpack('nnNn', 10, after)
+        first, ending = after + 10, after + 10 + length
+        cursor.check(first, length)
+        if type == 33
+          service, protocol, domain = name.split('.', 3)
+          put(layer, 'dns.srv.service', service || '', :string, base + pos, after - pos)
+          put(layer, 'dns.srv.proto', protocol || '', :string, base + pos, after - pos)
+          put(layer, 'dns.srv.name', domain, :string, base + pos, after - pos) if domain
+        else
+          put(layer, 'dns.resp.name', name.empty? ? '<Root>' : name, :string, base + pos, after - pos)
+        end
+        put(layer, 'dns.resp.type', type, :uint, base + after, 2)
+        put(layer, 'dns.resp.len', length, :uint, base + after + 8, 2)
+        if type == 41
+          put(layer, 'dns.rr.udp_payload_size', klass, :uint, base + after + 2, 2)
+          put(layer, 'dns.resp.ext_rcode', ttl >> 24, :uint, base + after + 4, 1)
+          put(layer, 'dns.resp.edns0_version', (ttl >> 16) & 255, :uint, base + after + 5, 1)
+          put(layer, 'dns.resp.z', ttl & 0xffff, :uint, base + after + 6, 2)
+          put(layer, 'dns.resp.z.do', ttl & 0x8000 != 0, :boolean, base + after + 6, 2)
+          edns(cursor, layer, first, ending, base)
+        else
+          put(layer, 'dns.resp.class', variant == :mdns ? klass & 0x7fff : klass, :uint, base + after + 2, 2)
+          put(layer, 'dns.resp.ttl', ttl, :uint, base + after + 4, 4)
+          put(layer, 'dns.resp.cache_flush', klass & 0x8000 != 0, :boolean, base + after + 2, 2) if variant == :mdns
+          rdata(cursor, layer, type, first, ending, base)
+        end
+        ending
+      end
+
+      # @rbs (Cursor cursor, Layer layer, Integer type, Integer pos, Integer ending, Integer base) -> void
+      def rdata(cursor, layer, type, pos, ending, base)
+        length = ending - pos
+        case type
+        when 1, 28
+          expected = type == 1 ? 4 : 16
+          return layer.diagnose(:error, :bad_length, 'invalid DNS address length') unless length == expected
+          value = type == 1 ? cursor.u32(pos) : cursor.bytes(pos, 16)
+          put(layer, type == 1 ? 'dns.a' : 'dns.aaaa', value, type == 1 ? :ipv4 : :ipv6, base + pos, length)
+        when 2, 5, 12
+          name, after = read_name(cursor, pos, ending)
+          put(layer, { 2 => 'dns.ns', 5 => 'dns.cname', 12 => 'dns.ptr.domain_name' }.fetch(type), name, :string, base + pos, after - pos)
+          raise Malformed, 'DNS name has trailing record bytes' unless after == ending
+        when 15, 33
+          width = type == 15 ? 2 : 6
+          raise Malformed, 'DNS service record is too short' if length < width + 1
+          names = type == 15 ? ['dns.mx.preference'] : %w[dns.srv.priority dns.srv.weight dns.srv.port]
+          names.each_with_index { |name, i| put(layer, name, cursor.u16(pos + i * 2), :uint, base + pos + i * 2, 2) }
+          name, after = read_name(cursor, pos + width, ending)
+          put(layer, type == 15 ? 'dns.mx.mail_exchange' : 'dns.srv.target', name, :string, base + pos + width, after - pos - width)
+          raise Malformed, 'DNS service record has trailing bytes' unless after == ending
+        when 16
+          while pos < ending
+            len = cursor.u8(pos)
+            raise Malformed, 'DNS TXT string exceeds record' if pos + 1 + len > ending
+            put(layer, 'dns.txt', cursor.bytes(pos + 1, len), :string, base + pos + 1, len)
+            pos += len + 1
+          end
+        when 6
+          %w[mname rname].each do |key|
+            name, after = read_name(cursor, pos, ending)
+            put(layer, "dns.soa.#{key}", name, :string, base + pos, after - pos)
+            pos = after
+          end
+          raise Malformed, 'invalid SOA integer section' unless ending - pos == 20
+          %w[serial_number refresh_interval retry_interval expire_limit minimum_ttl].each_with_index do |key, i|
+            put(layer, "dns.soa.#{key}", cursor.u32(pos + i * 4), :uint, base + pos + i * 4, 4)
+          end
+        when 64, 65 then service_binding(cursor, layer, pos, ending, base)
+        else put(layer, 'dns.data', cursor.bytes(pos, length), :bytes, base + pos, length)
+        end
+      end
+
+      # @rbs (Cursor cursor, Layer layer, Integer pos, Integer ending, Integer base) -> void
+      def service_binding(cursor, layer, pos, ending, base)
+        raise Malformed, 'short SVCB record' if ending - pos < 3
+        priority = cursor.u16(pos)
+        put(layer, 'dns.svcb.svcpriority', priority, :uint, base + pos, 2)
+        name, after = read_name(cursor, pos + 2, ending, false)
+        put(layer, 'dns.svcb.targetname', name, :string, base + pos + 2, after - pos - 2)
+        pos, previous = after, -1
+        while pos < ending
+          raise Malformed, 'short SVCB parameter header' if ending - pos < 4
+          key, len = cursor.u16(pos), cursor.u16(pos + 2)
+          raise Malformed, 'invalid SVCB parameter order or length' if key <= previous || pos + 4 + len > ending
+          previous = key
+          put(layer, 'dns.svcb.svcparam.key', key, :uint, base + pos, 2)
+          put(layer, 'dns.svcb.svcparam.value.length', len, :uint, base + pos + 2, 2)
+          first = pos + 4
+          case key
+          when 0, 3, 4, 6
+            size = { 0 => 2, 3 => 2, 4 => 4, 6 => 16 }.fetch(key)
+            raise Malformed, 'invalid SVCB parameter size' if len.zero? || len % size != 0 || (key == 3 && len != 2)
+            (len / size).times do |i|
+              value = size == 16 ? cursor.bytes(first + i * size, size) : (size == 4 ? cursor.u32(first + i * size) : cursor.u16(first + i * size))
+              name = { 0 => 'mandatory.key', 3 => 'port', 4 => 'ipv4hint.ip', 6 => 'ipv6hint.ip' }.fetch(key)
+              put(layer, "dns.svcb.svcparam.#{name}", value, { 4 => :ipv4, 6 => :ipv6 }.fetch(key, :uint), base + first + i * size, size)
+            end
+          when 1
+            while first < pos + 4 + len
+              size = cursor.u8(first)
+              raise Malformed, 'invalid SVCB ALPN size' if size.zero? || first + size + 1 > pos + 4 + len
+              put(layer, 'dns.svcb.svcparam.alpn', cursor.bytes(first + 1, size), :string, base + first + 1, size)
+              first += size + 1
+            end
+          when 2 then raise Malformed, 'no-default-alpn must be empty' unless len.zero?
+          else put(layer, key == 7 ? 'dns.svcb.svcparam.dohpath' : 'dns.svcb.svcparam.value', cursor.bytes(first, len), key == 7 ? :string : :bytes, base + first, len)
+          end
+          pos += len + 4
+        end
+      end
+
+      # @rbs (Cursor cursor, Layer layer, Integer pos, Integer ending, Integer base) -> void
+      def edns(cursor, layer, pos, ending, base)
+        while pos < ending
+          raise Malformed, 'short EDNS option header' if ending - pos < 4
+          code, len = cursor.u16(pos), cursor.u16(pos + 2)
+          raise Malformed, 'EDNS option exceeds record' if pos + 4 + len > ending
+          put(layer, 'dns.opt.code', code, :uint, base + pos, 2)
+          put(layer, 'dns.opt.len', len, :uint, base + pos + 2, 2)
+          put(layer, 'dns.opt.data', cursor.bytes(pos + 4, len), :bytes, base + pos + 4, len)
+          if code == 10
+            raise Malformed, 'invalid EDNS cookie length' unless len == 8 || len.between?(16, 40)
+            put(layer, 'dns.opt.cookie.client', cursor.bytes(pos + 4, 8), :bytes, base + pos + 4, 8)
+            put(layer, 'dns.opt.cookie.server', cursor.bytes(pos + 12, len - 8), :bytes, base + pos + 12, len - 8) if len > 8
+          end
+          pos += len + 4
+        end
+      end
+
+      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length) -> void
+      def put(layer, name, value, type, offset, length)
+        layer.add("#{name}_#{layer.definitions.length}".to_sym, name, value, type: type, offset: offset, length: length)
+      end
+
+      # @rbs (Layer layer) -> String
+      def summary(layer)
+        name = layer.fields.find { |field| field.name == 'dns.qry.name' }&.display || ''
+        type = TYPES[layer.field_value('dns.qry.type')] || layer.field_value('dns.qry.type')
+        label = { mdns: 'mDNS', llmnr: 'LLMNR' }.fetch(layer[:variant], 'DNS')
+        "#{label} #{layer.field_value('dns.flags.response') ? 'response' : 'query'} #{type} #{name}"
+      end
+    end
+  end
+end

data/lib/redhound/protocols/ethernet.rb

@@ -0,0 +1,24 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Ethernet < Dissector
+      protocol :eth, name: 'Ethernet', short: 'ETH'
+      dissects_on 'linktype', 1
+      header do
+        mac :dst, 'eth.dst'
+        mac :src, 'eth.src'
+        uint16 :type, 'eth.type', format: :hex
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        layer.payload_end = layer.payload_offset + layer[:type] if layer[:type] <= 1500
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = layer[:type] <= 1500 ? Llc : ctx.registry.lookup('ethertype', layer[:type])
+    end
+  end
+end

data/lib/redhound/protocols/http.rb

@@ -0,0 +1,185 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Http < StreamDissector
+      HEADER_LIMIT = 65_536
+      TOKEN = /\A[!#$%&'*+\-.^_`|~0-9A-Za-z]+\z/n
+      HEADERS = %w[host user_agent accept content_type content_length transfer_encoding connection
+                   server location referer cookie set_cookie authorization cache_control].freeze
+      protocol :http, name: 'Hypertext Transfer Protocol', short: 'HTTP'
+      dissects_on 'tcp.port', 80, 8080, 8000
+
+      # @rbs (Context ctx, Cursor cursor) -> bool
+      def self.heuristic?(ctx, cursor)
+        sample = cursor.bytes(0, [cursor.remaining, 128].min)
+        sample.match?(/\A(?:HTTP\/1\.[01] |[A-Z]{3,20} \S+ HTTP\/1\.[01](?:\r\n|\z))/n)
+      end
+
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        bytes = ctx.cursor.bytes(0, ctx.cursor.remaining)
+        pos = 0
+        while pos < bytes.bytesize
+          first = bytes.index("\r\n", pos)
+          return layer.diagnose(:note, :truncated, 'incomplete HTTP start line') unless first
+          return layer.diagnose(:error, :malformed, 'HTTP start line is too long') if first - pos > HEADER_LIMIT
+          line = bytes.byteslice(pos, first - pos)
+          response = line.start_with?('HTTP/')
+          status = start_line(layer, line, pos, response)
+          return if layer.error?
+          ending = bytes.index("\r\n\r\n", pos)
+          return layer.diagnose(:note, :truncated, 'incomplete HTTP headers') unless ending
+          return layer.diagnose(:error, :malformed, 'HTTP headers exceed 64 KiB') if ending - pos > HEADER_LIMIT
+          headers = parse_headers(layer, bytes, first + 2, ending + 2)
+          return if layer.error?
+          body_start = ending + 4
+          length_values = headers.fetch('content-length', []).flat_map { |value| value.empty? ? [''] : value.split(',', -1).map(&:strip) }
+          unless length_values.all? { |value| value.match?(/\A[0-9]+\z/n) } && length_values.uniq.length <= 1
+            return layer.diagnose(:error, :malformed, 'conflicting or invalid Content-Length')
+          end
+          content_length = length_values.first&.to_i
+          transfer = headers.fetch('transfer-encoding', []).join(',').downcase.split(',').map(&:strip)
+          if !transfer.empty? && content_length
+            return layer.diagnose(:error, :malformed, 'Transfer-Encoding and Content-Length conflict')
+          end
+          no_body = response && (ctx.packet.meta[:http_head_response] == true || status.between?(100, 199) || [204, 304].include?(status))
+          if no_body
+            pos = body_start
+          elsif transfer.last == 'chunked'
+            body, pos = chunked(layer, bytes, body_start)
+            put(layer, 'http.file_data', body, :bytes, body_start, pos - body_start) unless body.empty?
+          elsif !transfer.empty?
+            return layer.diagnose(:error, :malformed, 'request transfer coding must end in chunked') unless response
+            put(layer, 'http.file_data', bytes.byteslice(body_start..), :bytes, body_start, bytes.bytesize - body_start)
+            pos = bytes.bytesize
+          elsif content_length
+            available = [content_length, bytes.bytesize - body_start].min
+            put(layer, 'http.file_data', bytes.byteslice(body_start, available), :bytes, body_start, available) if available.positive?
+            pos = body_start + available
+            layer.diagnose(:note, :truncated, 'incomplete HTTP body') if available < content_length
+          elsif response
+            put(layer, 'http.file_data', bytes.byteslice(body_start..), :bytes, body_start, bytes.bytesize - body_start) if body_start < bytes.bytesize
+            pos = bytes.bytesize
+          else
+            pos = body_start
+          end
+          break if layer.error?
+        end
+      ensure
+        layer.header_length = ctx.cursor.remaining
+        layer.payload_offset = layer.payload_end
+      end
+
+      # @rbs (Layer layer, String line, Integer offset, bool response) -> Integer
+      def start_line(layer, line, offset, response)
+        if response
+          match = /\A(HTTP\/1\.[01]) ([0-9]{3})(?: (.*))?\z/n.match(line)
+          return layer.diagnose(:error, :malformed, 'invalid HTTP status line') && 0 unless match
+          put(layer, 'http.response.version', match[1], :string, offset, match[1].bytesize)
+          put(layer, 'http.response.code', match[2].to_i, :uint, offset + match[1].bytesize + 1, 3)
+          put(layer, 'http.response.phrase', match[3] || '', :string, offset + match[1].bytesize + 5, (match[3] || '').bytesize)
+          match[2].to_i
+        else
+          match = /\A([^ ]+) ([^ ]+) (HTTP\/1\.[01])\z/n.match(line)
+          return layer.diagnose(:error, :malformed, 'invalid HTTP request line') && 0 unless match && match[1].match?(TOKEN)
+          put(layer, 'http.request.method', match[1], :string, offset, match[1].bytesize)
+          put(layer, 'http.request.uri', match[2], :string, offset + match[1].bytesize + 1, match[2].bytesize)
+          put(layer, 'http.request.version', match[3], :string, offset + line.bytesize - match[3].bytesize, match[3].bytesize)
+          0
+        end
+      end
+
+      # @rbs (Layer layer, String bytes, Integer pos, Integer ending) -> Hash[String, Array[String]]
+      def parse_headers(layer, bytes, pos, ending)
+        # @type var headers: Hash[String, Array[String]]
+        headers = {}
+        while pos < ending - 2
+          after = bytes.index("\r\n", pos) #: Integer
+          line = bytes.byteslice(pos, after - pos) #: String
+          colon = line.index(':')
+          name = colon ? line.byteslice(0, colon) : '' #: String
+          unless colon && name.match?(TOKEN)
+            layer.diagnose(:error, :malformed, 'invalid HTTP header name')
+            return headers
+          end
+          name = name.downcase
+          value = line.byteslice(colon + 1..) #: String
+          leading = (value[/\A[ \t]*/n] || '').bytesize
+          trailing = value.rindex(/[^ \t]/n)
+          value = value.byteslice(leading, trailing ? trailing + 1 - leading : 0) #: String
+          (headers[name] ||= []) << value
+          key = name.tr('-', '_')
+          if HEADERS.include?(key)
+            numeric = key == 'content_length' && value.match?(/\A[0-9]+\z/n)
+            put(layer, "http.#{key}", numeric ? value.to_i : value, numeric ? :uint : :string,
+                pos + colon + 1 + leading, value.bytesize)
+          else
+            put(layer, 'http.request.line', line, :string, pos, line.bytesize)
+          end
+          layer.diagnose(:error, :malformed, 'control byte in HTTP header') if value.match?(/[\x00-\x08\x0a-\x1f\x7f]/n)
+          pos = after + 2
+        end
+        headers
+      end
+
+      # @rbs (Layer layer, String bytes, Integer pos) -> [String, Integer]
+      def chunked(layer, bytes, pos)
+        body = ''.b
+        loop do
+          ending = bytes.index("\r\n", pos)
+          unless ending
+            layer.diagnose(:note, :truncated, 'incomplete HTTP chunk size')
+            return [body, bytes.bytesize]
+          end
+          line = bytes.byteslice(pos, ending - pos) #: String
+          size = line.split(';', 2).first || ''
+          unless size.match?(/\A[0-9a-fA-F]{1,16}\z/n)
+            layer.diagnose(:error, :malformed, 'invalid HTTP chunk size')
+            return [body, ending + 2]
+          end
+          length = size.to_i(16)
+          pos = ending + 2
+          if length.zero?
+            loop do
+              ending = bytes.index("\r\n", pos)
+              unless ending
+                layer.diagnose(:note, :truncated, 'incomplete HTTP trailers')
+                return [body, bytes.bytesize]
+              end
+              return [body, ending + 2] if ending == pos
+              put(layer, 'http.chunked.trailer', bytes.byteslice(pos, ending - pos), :string, pos, ending - pos)
+              pos = ending + 2
+            end
+          end
+          available = [length, bytes.bytesize - pos].min
+          fragment = bytes.byteslice(pos, available) #: String
+          body << fragment
+          if available < length || pos + length + 2 > bytes.bytesize
+            layer.diagnose(:note, :truncated, 'incomplete HTTP chunk')
+            return [body, bytes.bytesize]
+          end
+          unless bytes.byteslice(pos + length, 2) == "\r\n"
+            layer.diagnose(:error, :malformed, 'HTTP chunk lacks CRLF')
+            return [body, pos + length]
+          end
+          pos += length + 2
+        end
+      end
+
+      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length) -> void
+      def put(layer, name, value, type, offset, length)
+        layer.add("#{name}_#{layer.definitions.length}".to_sym, name, value, type: type, offset: offset, length: length)
+      end
+
+      # @rbs (Layer layer) -> String
+      def summary(layer)
+        names = layer.field_value('http.request.method') ? %w[http.request.method http.request.uri] : %w[http.response.code http.response.phrase]
+        'HTTP ' + names.filter_map { |name| layer.fields.find { |field| field.name == name }&.display }.join(' ')
+      end
+    end
+  end
+end