redhound 1.0.1 → 2.0.0.rc2

data/lib/redhound/protocols/icmp.rb

@@ -0,0 +1,205 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Icmp < Dissector
+      TYPES = { 0 => 'Echo Reply', 3 => 'Destination Unreachable', 4 => 'Source Quench', 5 => 'Redirect',
+                8 => 'Echo Request', 9 => 'Router Advertisement', 10 => 'Router Solicitation', 11 => 'Time Exceeded',
+                12 => 'Parameter Problem', 13 => 'Timestamp', 14 => 'Timestamp Reply', 17 => 'Address Mask Request', 18 => 'Address Mask Reply' }.freeze
+      CODES = {
+        3 => { 0 => 'Network Unreachable', 1 => 'Host Unreachable', 2 => 'Protocol Unreachable', 3 => 'Port Unreachable',
+               4 => 'Fragmentation Needed', 5 => 'Source Route Failed', 6 => 'Network Unknown', 7 => 'Host Unknown',
+               8 => 'Source Host Isolated', 9 => 'Network Administratively Prohibited', 10 => 'Host Administratively Prohibited',
+               11 => 'Network Unreachable for TOS', 12 => 'Host Unreachable for TOS', 13 => 'Administratively Prohibited',
+               14 => 'Host Precedence Violation', 15 => 'Precedence Cutoff' },
+        5 => { 0 => 'Redirect Network', 1 => 'Redirect Host', 2 => 'Redirect TOS Network', 3 => 'Redirect TOS Host' },
+        11 => { 0 => 'TTL Expired', 1 => 'Reassembly Timeout' },
+        12 => { 0 => 'Invalid Pointer', 1 => 'Missing Option', 2 => 'Invalid Length' }
+      }.freeze
+      protocol :icmp, name: 'Internet Control Message Protocol', short: 'ICMP'
+      dissects_on 'ip.proto', 1
+      header do
+        uint8 :type, 'icmp.type', enum: TYPES
+        uint8 :code, 'icmp.code'
+        uint16 :checksum, 'icmp.checksum', format: :hex
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        layer.definitions[1] = layer.definitions[1].with(enum: CODES[layer[:type]])
+        if [0, 8, 13, 14, 17, 18].include?(layer[:type])
+          layer.add(:ident, 'icmp.ident', ctx.cursor.u16(4), offset: 4, length: 2)
+          layer.add(:seq, 'icmp.seq', ctx.cursor.u16(6), offset: 6, length: 2)
+        else
+          ctx.cursor.check(0, 8)
+          if layer[:type] == 3 && layer[:code] == 4
+            layer.add(:mtu, 'icmp.mtu', ctx.cursor.u16(6), offset: 6, length: 2)
+          end
+        end
+        layer.header_length, layer.payload_offset = 8, layer.offset + 8
+        Checksum.verify(ctx, layer, ctx.cursor.bytes(0, ctx.cursor.remaining))
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer)
+        return nil unless [3, 4, 5, 11, 12].include?(layer[:type])
+        ctx.embedded = true
+        Ipv4
+      end
+      # @rbs (Layer layer) -> String
+      def summary(layer)
+        text = "ICMP type #{layer[:type]}, code #{layer[:code]}"
+        text += ", id #{layer[:ident]}, seq #{layer[:seq]}" if layer[:ident]
+        text += ", mtu #{layer[:mtu]}" if layer[:mtu]
+        text
+      end
+    end
+
+    # @api private
+    class Icmpv6 < Dissector
+      TYPES = { 1 => 'Destination Unreachable', 2 => 'Packet Too Big', 3 => 'Time Exceeded', 4 => 'Parameter Problem',
+                128 => 'Echo Request', 129 => 'Echo Reply', 133 => 'Router Solicitation', 134 => 'Router Advertisement',
+                135 => 'Neighbor Solicitation', 136 => 'Neighbor Advertisement', 137 => 'Redirect' }.freeze
+      CODES = {
+        1 => { 0 => 'No Route', 1 => 'Administratively Prohibited', 2 => 'Beyond Source Scope', 3 => 'Address Unreachable',
+               4 => 'Port Unreachable', 5 => 'Source Policy Failure', 6 => 'Reject Route', 7 => 'Source Routing Error' },
+        3 => { 0 => 'Hop Limit Exceeded', 1 => 'Reassembly Timeout' },
+        4 => { 0 => 'Invalid Header Field', 1 => 'Unknown Next Header', 2 => 'Unknown Option' }
+      }.freeze
+      protocol :icmpv6, name: 'ICMPv6 / Neighbor Discovery', short: 'ICMP6'
+      dissects_on 'ip.proto', 58
+      header do
+        uint8 :type, 'icmpv6.type', enum: TYPES
+        uint8 :code, 'icmpv6.code'
+        uint16 :checksum, 'icmpv6.checksum'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        cursor, type = ctx.cursor, layer[:type]
+        layer.definitions[1] = layer.definitions[1].with(enum: CODES[type])
+        length = case type
+                 when 133 then 8
+                 when 134 then 16
+                 when 135, 136 then 24
+                 when 137 then 40
+                 else 8
+                 end
+        cursor.check(0, length)
+        if [128, 129].include?(type)
+          layer.add(:ident, 'icmpv6.echo.identifier', cursor.u16(4), offset: 4, length: 2)
+          layer.add(:seq, 'icmpv6.echo.sequence_number', cursor.u16(6), offset: 6, length: 2)
+        elsif [135, 136, 137].include?(type)
+          family = { 135 => 'ns', 136 => 'na', 137 => 'rd' }.fetch(type)
+          layer.add(:target, "icmpv6.nd.#{family}.target_address", cursor.bytes(8, 16), type: :ipv6, offset: 8, length: 16)
+          layer.add(:destination, 'icmpv6.rd.na.destination_address', cursor.bytes(24, 16), type: :ipv6, offset: 24, length: 16) if type == 137
+          if type == 136
+            flags = cursor.u32(4)
+            layer.add(:flags, 'icmpv6.nd.na.flag', flags, format: :hex, offset: 4, length: 4)
+            { r: 0x80000000, s: 0x40000000, o: 0x20000000 }.each do |name, mask|
+              layer.add(name, "icmpv6.nd.na.flag.#{name}", (flags & mask).positive?, type: :boolean, offset: 4, length: 4)
+            end
+          end
+        end
+        if type == 134
+          layer.add(:hop_limit, 'icmpv6.nd.ra.cur_hop_limit', cursor.u8(4), offset: 4, length: 1)
+          layer.add(:lifetime, 'icmpv6.nd.ra.router_lifetime', cursor.u16(6), offset: 6, length: 2)
+          flags = cursor.u8(5)
+          layer.add(:flags, 'icmpv6.nd.ra.flag', flags, format: :hex, offset: 5, length: 1)
+          layer.add(:managed, 'icmpv6.nd.ra.flag.m', (flags & 0x80).positive?, type: :boolean, offset: 5, length: 1)
+          layer.add(:other, 'icmpv6.nd.ra.flag.o', (flags & 0x40).positive?, type: :boolean, offset: 5, length: 1)
+          layer.add(:reachable, 'icmpv6.nd.ra.reachable_time', cursor.u32(8), offset: 8, length: 4)
+          layer.add(:retrans, 'icmpv6.nd.ra.retrans_timer', cursor.u32(12), offset: 12, length: 4)
+        end
+        if type.between?(133, 137)
+          pos = length
+          while pos < cursor.remaining
+            opt = cursor.u8(pos)
+            len = cursor.u8(pos + 1) * 8
+            return layer.diagnose(:error, :bad_length, 'NDP option has zero length') if len.zero?
+            cursor.check(pos, len)
+            layer.add(:"option_type_#{pos}", 'icmpv6.opt.type', opt, offset: pos, length: 1)
+            layer.add(:"option_length_#{pos}", 'icmpv6.opt.length', len / 8, offset: pos + 1, length: 1)
+            if [1, 2].include?(opt) && len >= 8
+              layer.add(:"link_address_#{pos}", 'icmpv6.opt.linkaddr', cursor.bytes(pos + 2, 6), type: :mac, offset: pos + 2, length: 6)
+            elsif opt == 3 && len == 32
+              layer.add(:"prefix_length_#{pos}", 'icmpv6.opt.prefix.length', cursor.u8(pos + 2), offset: pos + 2, length: 1)
+              flags = cursor.u8(pos + 3)
+              layer.add(:"prefix_flags_#{pos}", 'icmpv6.opt.prefix.flag', flags, format: :hex, offset: pos + 3, length: 1)
+              layer.add(:"prefix_onlink_#{pos}", 'icmpv6.opt.prefix.flag.l', (flags & 0x80).positive?, type: :boolean, offset: pos + 3, length: 1)
+              layer.add(:"prefix_autonomous_#{pos}", 'icmpv6.opt.prefix.flag.a', (flags & 0x40).positive?, type: :boolean, offset: pos + 3, length: 1)
+              layer.add(:"prefix_valid_#{pos}", 'icmpv6.opt.prefix.valid_lifetime', cursor.u32(pos + 4), offset: pos + 4, length: 4)
+              layer.add(:"prefix_preferred_#{pos}", 'icmpv6.opt.prefix.preferred_lifetime', cursor.u32(pos + 8), offset: pos + 8, length: 4)
+              layer.add(:"prefix_#{pos}", 'icmpv6.opt.prefix', cursor.bytes(pos + 16, 16), type: :ipv6, offset: pos + 16, length: 16)
+            elsif opt == 4 && len >= 8
+              layer.add(:"redirected_#{pos}", 'icmpv6.opt.redirected_packet', cursor.bytes(pos + 8, len - 8), type: :bytes, offset: pos + 8, length: len - 8)
+            elsif opt == 5 && len == 8
+              layer.add(:"mtu_#{pos}", 'icmpv6.opt.mtu', cursor.u32(pos + 4), offset: pos + 4, length: 4)
+            else
+              layer.add(:"option_#{pos}", 'icmpv6.opt.data', cursor.bytes(pos + 2, len - 2), type: :bytes, offset: pos + 2, length: len - 2)
+            end
+            pos += len
+          end
+          length = pos
+        end
+        layer.header_length, layer.payload_offset = length, layer.offset + length
+        Checksum.verify(ctx, layer, cursor.bytes(0, cursor.remaining), 58)
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer)
+        return nil unless layer[:type] < 128
+        ctx.embedded = true
+        Ipv6
+      end
+    end
+
+    # @api private
+    class Igmp < Dissector
+      protocol :igmp, name: 'Internet Group Management Protocol', short: 'IGMP'
+      dissects_on 'ip.proto', 2
+      header do
+        uint8 :type, 'igmp.type'
+        uint8 :response, 'igmp.max_resp'
+        uint16 :checksum, 'igmp.checksum'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        cursor, type = ctx.cursor, layer[:type]
+        layer.definitions.reject! { |field| field.key == :response } if [0x12, 0x22].include?(type)
+        cursor.check(0, 8)
+        version = type == 0x22 || (type == 0x11 && cursor.remaining >= 12) ? 3 : (type == 0x12 || (type == 0x11 && layer[:response].zero?) ? 1 : 2)
+        layer.add(:version, 'igmp.version', version)
+        pos = 8
+        if type == 0x22
+          count = cursor.u16(6)
+          layer.add(:records, 'igmp.num_grp_recs', count, offset: 6, length: 2)
+          count.times do |record|
+            cursor.check(pos, 8)
+            sources, auxiliary = cursor.u16(pos + 2), cursor.u8(pos + 1) * 4
+            cursor.check(pos, 8 + sources * 4 + auxiliary)
+            layer.add(:"record_#{record}", 'igmp.record_type', cursor.u8(pos), offset: pos, length: 1)
+            layer.add(:"group_#{record}", 'igmp.maddr', cursor.u32(pos + 4), type: :ipv4, offset: pos + 4, length: 4)
+            layer.add(:"sources_#{record}", 'igmp.num_src', sources, offset: pos + 2, length: 2)
+            sources.times { |i| layer.add(:"source_#{record}_#{i}", 'igmp.saddr', cursor.u32(pos + 8 + i * 4), type: :ipv4, offset: pos + 8 + i * 4, length: 4) }
+            layer.add(:"auxiliary_#{record}", 'igmp.aux_data', cursor.bytes(pos + 8 + sources * 4, auxiliary), type: :bytes, offset: pos + 8 + sources * 4, length: auxiliary) if auxiliary.positive?
+            pos += 8 + sources * 4 + auxiliary
+          end
+        else
+          layer.add(:group, 'igmp.maddr', cursor.u32(4), type: :ipv4, offset: 4, length: 4)
+          if version == 3
+            sources = cursor.u16(10)
+            cursor.check(8, 4 + sources * 4)
+            layer.add(:suppress, 'igmp.s', (cursor.u8(8) & 8).positive?, type: :boolean, offset: 8, length: 1)
+            layer.add(:robustness, 'igmp.qrv', cursor.u8(8) & 7, offset: 8, length: 1)
+            layer.add(:interval, 'igmp.qqic', cursor.u8(9), offset: 9, length: 1)
+            layer.add(:sources, 'igmp.num_src', sources, offset: 10, length: 2)
+            sources.times { |i| layer.add(:"source_#{i}", 'igmp.saddr', cursor.u32(12 + i * 4), type: :ipv4, offset: 12 + i * 4, length: 4) }
+            pos = 12 + sources * 4
+          end
+        end
+        layer.header_length, layer.payload_offset = pos, layer.offset + pos
+        Checksum.verify(ctx, layer, cursor.bytes(0, cursor.remaining))
+      end
+    end
+  end
+end

data/lib/redhound/protocols/ipv4.rb

@@ -0,0 +1,56 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Ipv4 < Dissector
+      protocol :ipv4, name: 'Internet Protocol v4', short: 'IP'
+      dissects_on 'ethertype', 0x0800
+      dissects_on 'ip.proto', 4
+      header do
+        bits 8 do
+          bit :version, 'ip.version', 4
+          bit :hdr_len, 'ip.hdr_len', 4, scale: 4
+        end
+        bits 8 do
+          bit :dscp, 'ip.dsfield.dscp', 6
+          bit :ecn, 'ip.dsfield.ecn', 2
+        end
+        uint16 :len, 'ip.len'
+        uint16 :id, 'ip.id', format: :hex
+        bits 16 do
+          bit :reserved, 'ip.flags.rb', 1
+          bit :df, 'ip.flags.df', 1
+          bit :mf, 'ip.flags.mf', 1
+          bit :frag_offset, 'ip.frag_offset', 13, scale: 8
+        end
+        uint8 :ttl, 'ip.ttl'
+        uint8 :proto, 'ip.proto'
+        uint16 :checksum, 'ip.checksum', format: :hex
+        ipv4 :src, 'ip.src'
+        ipv4 :dst, 'ip.dst'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        hlen = layer[:hdr_len]
+        if layer[:version] != 4 || hlen < 20 || layer[:len] < hlen
+          layer.diagnose(:error, :bad_length, 'invalid IPv4 version or length')
+          return
+        end
+        ctx.cursor.check(0, hlen)
+        layer.header_length = hlen
+        layer.payload_offset = layer.offset + hlen
+        layer.payload_end = layer.offset + layer[:len]
+        layer.add(:options, 'ip.options', ctx.cursor.bytes(20, hlen - 20), type: :bytes, offset: 20, length: hlen - 20) if hlen > 20
+        Checksum.verify(ctx, layer, ctx.cursor.bytes(0, hlen))
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer)
+        return nil unless layer[:frag_offset].zero?
+        ctx.registry.lookup('ip.proto', layer[:proto])
+      end
+    end
+  end
+end

data/lib/redhound/protocols/ipv6.rb

@@ -0,0 +1,68 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Ipv6 < Dissector
+      protocol :ipv6, name: 'Internet Protocol v6', short: 'IP6'
+      dissects_on 'ethertype', 0x86dd
+      dissects_on 'ip.proto', 41
+      header do
+        bits 32 do
+          bit :version, 'ipv6.version', 4
+          bit :tclass, 'ipv6.tclass', 8
+          bit :flow, 'ipv6.flow', 20, format: :hex
+        end
+        uint16 :plen, 'ipv6.plen'
+        uint8 :nxt, 'ipv6.nxt'
+        uint8 :hlim, 'ipv6.hlim'
+        ipv6 :src, 'ipv6.src'
+        ipv6 :dst, 'ipv6.dst'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        ctx.extension_count = 0
+        layer.diagnose(:error, :malformed, 'IPv6 version is not 6') if layer[:version] != 6
+        layer.payload_end = layer.offset + 40 + layer[:plen]
+        layer.payload_offset = layer.payload_end if layer[:nxt] == 59
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = ctx.registry.lookup('ip.proto', layer[:nxt])
+    end
+
+    # @api private
+    class Ipv6Ext < Dissector
+      protocol :ipv6_ext, name: 'IPv6 extension', short: 'IP6 EXT'
+      dissects_on 'ip.proto', 0, 43, 44, 60, 51
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        ctx.extension_count += 1
+        return layer.diagnose(:error, :malformed, 'more than 16 IPv6 extensions') if ctx.extension_count > 16
+        parent = ctx.layers.last
+        type = parent.protocol == :ipv6 ? parent[:nxt] : parent.protocol == :ipv4 ? parent[:proto] : parent[:next]
+        cursor = ctx.cursor
+        nxt = cursor.u8(0)
+        layer.add(:next, 'ipv6.nxt', nxt, length: 1)
+        layer.add(:type, 'ipv6.extension.type', type)
+        length = type == 44 ? 8 : type == 51 ? (cursor.u8(1) + 2) * 4 : (cursor.u8(1) + 1) * 8
+        cursor.check(0, length)
+        if type == 44
+          flags = cursor.u16(2)
+          layer.add(:fragment_offset, 'ipv6.fragment.offset', flags & 0xfff8, offset: 2, length: 2)
+          layer.add(:more, 'ipv6.fragment.more', flags & 1, offset: 2, length: 2)
+          layer.add(:identification, 'ipv6.fragment.id', cursor.u32(4), offset: 4, length: 4)
+        end
+        layer.header_length = length
+        layer.payload_offset += length
+        layer.payload_offset = layer.payload_end if nxt == 59
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer)
+        return nil if layer[:fragment_offset] && layer[:fragment_offset] != 0
+        ctx.registry.lookup('ip.proto', layer[:next])
+      end
+    end
+  end
+end

data/lib/redhound/protocols/link.rb

@@ -0,0 +1,70 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Sll < Dissector
+      protocol :sll, name: 'Linux cooked capture', short: 'SLL'
+      dissects_on 'linktype', 113
+      header do
+        uint16 :pkttype, 'sll.pkttype'
+        uint16 :hatype, 'sll.hatype'
+        uint16 :halen, 'sll.halen'
+        uint64 :address, 'sll.src'
+        uint16 :type, 'sll.etype'
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = ctx.registry.lookup('ethertype', layer[:type])
+    end
+    # @api private
+    class Sll2 < Dissector
+      protocol :sll2, name: 'Linux cooked capture v2', short: 'SLL2'
+      dissects_on 'linktype', 276
+      header do
+        uint16 :type, 'sll.etype'
+        uint16 :reserved, 'sll.reserved'
+        uint32 :ifindex, 'sll.ifindex'
+        uint16 :hatype, 'sll.hatype'
+        uint8 :pkttype, 'sll.pkttype'
+        uint8 :halen, 'sll.halen'
+        uint64 :address, 'sll.src'
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = ctx.registry.lookup('ethertype', layer[:type])
+    end
+    # @api private
+    class Null < Dissector
+      protocol :null, name: 'BSD loopback', short: 'NULL'
+      dissects_on 'linktype', 0, 108
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        bytes = ctx.cursor.bytes(0, 4)
+        family = bytes.unpack1(ctx.packet.linktype == 108 ? 'N' : 'L')
+        family = bytes.unpack1('N') if family > 255
+        layer.add(:family, 'null.family', family, length: 4)
+        layer.header_length = 4
+        layer.payload_offset += 4
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer)
+        return Ipv4 if layer[:family] == 2
+        return Ipv6 if [10, 24, 28, 30].include?(layer[:family])
+        nil
+      end
+    end
+    # @api private
+    class Raw < Dissector
+      protocol :raw, name: 'Raw IP', short: 'RAW'
+      dissects_on 'linktype', 101, 228, 229
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer)
+        case ctx.cursor.u8(0) >> 4
+        when 4 then Ipv4
+        when 6 then Ipv6
+        end
+      end
+    end
+  end
+end

data/lib/redhound/protocols/llc.rb

@@ -0,0 +1,37 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Llc < Dissector
+      protocol :llc, name: 'Logical Link Control', short: 'LLC'
+      header do
+        uint8 :dsap, 'llc.dsap'
+        uint8 :ssap, 'llc.ssap'
+        uint8 :control, 'llc.control'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        if layer[:control] & 3 != 3
+          layer.values[:control] |= ctx.cursor.u8(3) << 8
+          layer.definitions[2] = layer.definitions[2].with(type: :uint16, length: 2)
+          layer.header_length = 4
+          layer.payload_offset = layer.offset + 4
+          return
+        end
+        return unless layer[:dsap] == 0xaa && layer[:ssap] == 0xaa && layer[:control] == 3
+        layer.add(:oui, 'llc.oui', ctx.cursor.bytes(3, 3), type: :bytes, offset: 3, length: 3)
+        layer.add(:type, 'llc.pid', ctx.cursor.u16(6), offset: 6, length: 2, format: :hex)
+        layer.header_length = 8
+        layer.payload_offset = layer.offset + 8
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer)
+        return ctx.registry.lookup('ethertype', layer[:type]) if layer[:oui] == "\0\0\0".b
+        ctx.registry.lookup('llc.dsap', layer[:dsap])
+      end
+    end
+  end
+end

data/lib/redhound/protocols/ntp.rb

@@ -0,0 +1,45 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Ntp < Dissector
+      MODES = { 1 => 'symmetric active', 2 => 'symmetric passive', 3 => 'client', 4 => 'server',
+                5 => 'broadcast', 6 => 'control', 7 => 'private' }.freeze
+      protocol :ntp, name: 'Network Time Protocol', short: 'NTP'
+      dissects_on 'udp.port', 123
+      header do
+        bits 8 do
+          bit :li, 'ntp.flags.li', 2
+          bit :vn, 'ntp.flags.vn', 3
+          bit :mode, 'ntp.flags.mode', 3, enum: MODES
+        end
+        uint8 :stratum, 'ntp.stratum'
+        int8 :poll, 'ntp.ppoll'
+        int8 :precision, 'ntp.precision'
+        uint32 :rootdelay, 'ntp.rootdelay'
+        uint32 :rootdispersion, 'ntp.rootdispersion'
+        uint32 :refid, 'ntp.refid'
+        uint64 :reftime, 'ntp.reftime'
+        uint64 :org, 'ntp.org'
+        uint64 :rec, 'ntp.rec'
+        uint64 :xmt, 'ntp.xmt'
+      end
+
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        layer.diagnose(:error, :malformed, 'invalid NTP version or mode') unless layer[:vn].between?(1, 4) && layer[:mode].between?(1, 7)
+        if ctx.cursor.remaining > 48
+          layer.add(:extension, 'ntp.extension', ctx.cursor.bytes(48, ctx.cursor.remaining - 48),
+                    type: :bytes, offset: 48, length: ctx.cursor.remaining - 48)
+        end
+        layer.payload_offset = layer.payload_end
+      end
+
+      # @rbs (Layer layer) -> String
+      def summary(layer) = "NTP v#{layer[:vn]} #{MODES[layer[:mode]]}, stratum #{layer[:stratum]}"
+    end
+  end
+end

data/lib/redhound/protocols/tcp.rb

@@ -0,0 +1,88 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Tcp < Dissector
+      FLAGS = { 0x80 => 'C', 0x40 => 'E', 0x20 => 'U', 0x10 => '.', 8 => 'P', 4 => 'R', 2 => 'S', 1 => 'F' }.freeze
+      FLAG_FIELDS = %w[fin syn reset push ack urg ecn cwr].each_with_index.map do |name, bit|
+        [FieldDefinition.new(:"flag_#{name}", "tcp.flags.#{name}", :boolean, 13, 1, 0, nil, nil, 1, nil, nil), 1 << bit]
+      end.freeze
+      protocol :tcp, name: 'Transmission Control Protocol', short: 'TCP'
+      dissects_on 'ip.proto', 6
+      header do
+        uint16 :srcport, 'tcp.srcport'
+        uint16 :dstport, 'tcp.dstport'
+        uint32 :seq, 'tcp.seq'
+        uint32 :ack, 'tcp.ack'
+        bits 16 do
+          bit :hdr_len, 'tcp.hdr_len', 4, scale: 4
+          bit :reserved, 'tcp.reserved', 3
+          bit :flags, 'tcp.flags', 9, format: :hex
+        end
+        uint16 :window, 'tcp.window_size_value'
+        uint16 :checksum, 'tcp.checksum', format: :hex
+        uint16 :urgent, 'tcp.urgent_pointer'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        hlen = layer[:hdr_len]
+        return layer.diagnose(:error, :bad_length, 'TCP data offset is less than 20') if hlen < 20
+        ctx.cursor.check(0, hlen)
+        layer.header_length, layer.payload_offset = hlen, layer.offset + hlen
+        FLAG_FIELDS.each do |definition, mask|
+          layer.definitions << definition
+          layer.values[definition.key] = (layer[:flags] & mask) != 0
+        end
+        options(ctx.cursor, layer, hlen)
+        layer.add(:length, 'tcp.len', ctx.cursor.remaining - hlen)
+        Checksum.verify(ctx, layer, ctx.cursor.bytes(0, ctx.cursor.remaining), 6)
+      end
+      # @rbs (Cursor cursor, Layer layer, Integer hlen) -> void
+      def options(cursor, layer, hlen)
+        pos = 20
+        while pos < hlen
+          kind = cursor.u8(pos)
+          break if kind.zero?
+          if kind == 1
+            pos += 1
+            next
+          end
+          return layer.diagnose(:error, :bad_length, 'truncated TCP option') if pos + 2 > hlen
+          len = cursor.u8(pos + 1)
+          return layer.diagnose(:error, :bad_length, 'invalid TCP option length') if len < 2 || pos + len > hlen
+          valid = case kind
+                  when 2 then len == 4
+                  when 3 then len == 3
+                  when 4 then len == 2
+                  when 5 then len >= 10 && (len - 2) % 8 == 0
+                  when 8 then len == 10
+                  when 34 then len == 2 || len.between?(6, 18)
+                  else true
+                  end
+          return layer.diagnose(:error, :bad_length, "invalid TCP option #{kind} length") unless valid
+          case kind
+          when 2 then layer.add(:mss, 'tcp.options.mss_val', cursor.u16(pos + 2), offset: pos + 2, length: 2)
+          when 3 then layer.add(:wscale, 'tcp.options.wscale.shift', cursor.u8(pos + 2), offset: pos + 2, length: 1)
+          when 4 then layer.add(:sack_permitted, 'tcp.options.sack_perm', true, type: :boolean, offset: pos, length: 2)
+          when 5 then layer.add(:sack, 'tcp.options.sack', cursor.bytes(pos + 2, len - 2), type: :bytes, offset: pos + 2, length: len - 2)
+          when 8
+            layer.add(:tsval, 'tcp.options.timestamp.tsval', cursor.u32(pos + 2), offset: pos + 2, length: 4)
+            layer.add(:tsecr, 'tcp.options.timestamp.tsecr', cursor.u32(pos + 6), offset: pos + 6, length: 4)
+          when 34 then layer.add(:tfo, 'tcp.options.tfo.cookie', cursor.bytes(pos + 2, len - 2), type: :bytes, offset: pos + 2, length: len - 2)
+          end
+          pos += len
+        end
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = ctx.registry.by_port('tcp.port', layer[:srcport], layer[:dstport])
+      # @rbs (Layer layer) -> String
+      def summary(layer)
+        flags = FLAGS.filter_map { |bit, name| name if layer[:flags] & bit != 0 }.join
+        "TCP [#{flags}], seq #{layer[:seq]}, ack #{layer[:ack]}, win #{layer[:window]}, length #{layer[:length]}"
+      end
+    end
+  end
+end