redhound 1.0.1 → 2.0.0.rc2

data/lib/redhound/protocols/tls.rb

@@ -0,0 +1,218 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Tls < StreamDissector
+      # @type ivar @ranges: Array[untyped]
+      # @api private
+      class BadLength < StandardError; end
+      CONTENT_TYPES = { 20 => 'Change Cipher Spec', 21 => 'Alert', 22 => 'Handshake', 23 => 'Application Data', 24 => 'Heartbeat' }.freeze
+      HANDSHAKES = { 1 => 'Client Hello', 2 => 'Server Hello', 4 => 'New Session Ticket', 8 => 'Encrypted Extensions',
+                     11 => 'Certificate', 12 => 'Server Key Exchange', 14 => 'Server Hello Done', 15 => 'Certificate Verify',
+                     16 => 'Client Key Exchange', 20 => 'Finished', 24 => 'Key Update' }.freeze
+      protocol :tls, name: 'Transport Layer Security', short: 'TLS'
+      dissects_on 'tcp.port', 443
+
+      # @rbs (Context ctx, Cursor cursor) -> bool
+      def self.heuristic?(ctx, cursor)
+        cursor.remaining >= 5 && CONTENT_TYPES.key?(cursor.u8(0)) && cursor.u16(1).between?(0x0300, 0x0303) && cursor.u16(3) <= 18_432
+      end
+
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        cursor = ctx.cursor
+        pos, encrypted = 0, ctx.packet.meta[:tls_encrypted] == true
+        handshake_data = ''.b
+        @ranges = Array.new
+        while pos < cursor.remaining
+          if pos + 5 > cursor.remaining
+            layer.diagnose(:note, :truncated, 'incomplete TLS record header')
+            break
+          end
+          type, version, length = cursor.unpack('Cnn', 5, pos)
+          put(layer, 'tls.record.content_type', type, :uint, pos, 1)
+          put(layer, 'tls.record.version', version, :uint, pos + 1, 2)
+          put(layer, 'tls.record.length', length, :uint, pos + 3, 2)
+          raise BadLength, 'invalid TLS record version, content type or length' unless CONTENT_TYPES.key?(type) && version.between?(0x0300, 0x0303) && length <= 18_432
+          available = [length, cursor.remaining - pos - 5].min
+          body = cursor.bytes(pos + 5, available)
+          if available < length && type != 22
+            layer.diagnose(:note, :truncated, 'incomplete TLS record')
+            break
+          end
+          if type == 22 && !encrypted
+            @ranges << [handshake_data.bytesize, pos + 5, available] if available.positive?
+            handshake_data << body
+          elsif type == 20
+            raise BadLength, 'invalid ChangeCipherSpec' unless body == "\1"
+            encrypted = true
+          elsif type == 21 && !encrypted
+            raise BadLength, 'invalid TLS alert length' unless length == 2
+            put(layer, 'tls.alert_message.level', cursor.u8(pos + 5), :uint, pos + 5, 1)
+            put(layer, 'tls.alert_message.desc', cursor.u8(pos + 6), :uint, pos + 6, 1)
+          else
+            put(layer, 'tls.app_data', body, :bytes, pos + 5, available)
+          end
+          if available < length
+            layer.diagnose(:note, :truncated, 'incomplete TLS record')
+            break
+          end
+          pos += length + 5
+        end
+        handshakes(layer, Cursor.new(handshake_data)) unless handshake_data.empty?
+      rescue Cursor::Truncated => e
+        layer.diagnose(:note, :truncated, e.message)
+      rescue BadLength => e
+        layer.diagnose(:error, :bad_length, e.message)
+      ensure
+        layer.header_length = cursor.remaining
+        layer.payload_offset = layer.payload_end
+      end
+
+      # @rbs (Layer layer, Cursor cursor) -> void
+      def handshakes(layer, cursor)
+        pos = 0
+        while pos < cursor.remaining
+          cursor.check(pos, 4)
+          type = cursor.u8(pos)
+          length = (cursor.u8(pos + 1) << 16) | cursor.u16(pos + 2)
+          put(layer, 'tls.handshake.type', type, :uint, pos, 1, true)
+          put(layer, 'tls.handshake.length', length, :uint, pos + 1, 3, true)
+          cursor.check(pos + 4, length)
+          body = cursor.sub(cursor.start + pos + 4, cursor.start + pos + 4 + length)
+          hello(layer, body, type) if [1, 2].include?(type)
+          extensions(layer, body, 0, false) if type == 8
+          pos += length + 4
+        end
+      end
+
+      # @rbs (Layer layer, Cursor cursor, Integer type) -> void
+      def hello(layer, cursor, type)
+        cursor.check(0, 35)
+        base = cursor.start
+        put(layer, 'tls.handshake.version', cursor.u16(0), :uint, base, 2, true)
+        put(layer, 'tls.handshake.random', cursor.bytes(2, 32), :bytes, base + 2, 32, true)
+        session_length = cursor.u8(34)
+        raise BadLength, 'TLS session ID exceeds 32 bytes' if session_length > 32
+        cursor.check(35, session_length)
+        put(layer, 'tls.handshake.session_id', cursor.bytes(35, session_length), :bytes, base + 35, session_length, true)
+        pos = 35 + session_length
+        client = type == 1
+        if client
+          cipher_length = cursor.u16(pos)
+          raise BadLength, 'invalid TLS cipher suite vector' if cipher_length.zero? || cipher_length.odd?
+          pos += 2
+          cursor.check(pos, cipher_length)
+          (cipher_length / 2).times { |i| put(layer, 'tls.handshake.ciphersuite', cursor.u16(pos + i * 2), :uint, base + pos + i * 2, 2, true) }
+          pos += cipher_length
+          compression_length = cursor.u8(pos)
+          raise BadLength, 'empty TLS compression vector' if compression_length.zero?
+          cursor.check(pos + 1, compression_length)
+          put(layer, 'tls.handshake.comp_methods', cursor.bytes(pos + 1, compression_length), :bytes, base + pos + 1, compression_length, true)
+          pos += 1 + compression_length
+        else
+          put(layer, 'tls.handshake.ciphersuite', cursor.u16(pos), :uint, base + pos, 2, true)
+          put(layer, 'tls.handshake.comp_method', cursor.u8(pos + 2), :uint, base + pos + 2, 1, true)
+          pos += 3
+        end
+        extensions(layer, cursor, pos, client) if pos < cursor.remaining
+      rescue Cursor::Truncated => e
+        raise BadLength, e.message
+      end
+
+      # @rbs (Layer layer, Cursor cursor, Integer pos, bool client) -> void
+      def extensions(layer, cursor, pos, client)
+        length = cursor.u16(pos)
+        raise BadLength, 'TLS extensions length disagrees with handshake' unless pos + 2 + length == cursor.remaining
+        ending = pos + 2 + length
+        put(layer, 'tls.handshake.extensions_length', length, :uint, cursor.start + pos, 2, true)
+        pos += 2
+        # @type var seen: Hash[Integer, bool]
+        seen = {}
+        while pos < ending
+          raise BadLength, 'short TLS extension header' if pos + 4 > ending
+          type, size = cursor.u16(pos), cursor.u16(pos + 2)
+          raise BadLength, 'duplicate or oversized TLS extension' if seen[type] || pos + 4 + size > ending
+          seen[type] = true
+          put(layer, 'tls.handshake.extension.type', type, :uint, cursor.start + pos, 2, true)
+          put(layer, 'tls.handshake.extension.len', size, :uint, cursor.start + pos + 2, 2, true)
+          extension = cursor.sub(cursor.start + pos + 4, cursor.start + pos + 4 + size)
+          case type
+          when 0 then server_names(layer, extension) unless size.zero? && !client
+          when 16 then alpn(layer, extension)
+          when 43 then versions(layer, extension, client)
+          else put(layer, 'tls.handshake.extension.data', extension.bytes(0, size), :bytes, extension.start, size, true)
+          end
+          pos += size + 4
+        end
+      rescue Cursor::Truncated => e
+        raise BadLength, e.message
+      end
+
+      # @rbs (Layer layer, Cursor cursor) -> void
+      def server_names(layer, cursor)
+        length = cursor.u16(0)
+        raise BadLength, 'invalid TLS server name list length' unless length.positive? && length + 2 == cursor.remaining
+        pos, seen = 2, {}
+        while pos < cursor.remaining
+          raise BadLength, 'short TLS server name entry' if pos + 3 > cursor.remaining
+          type, length = cursor.u8(pos), cursor.u16(pos + 1)
+          raise BadLength, 'duplicate or invalid TLS server name entry' if seen[type] || length.zero? || pos + 3 + length > cursor.remaining
+          seen[type] = true
+          put(layer, 'tls.handshake.extensions_server_name_type', type, :uint, cursor.start + pos, 1, true)
+          put(layer, 'tls.handshake.extensions_server_name', cursor.bytes(pos + 3, length), :string, cursor.start + pos + 3, length, true) if type.zero?
+          pos += length + 3
+        end
+      end
+
+      # @rbs (Layer layer, Cursor cursor) -> void
+      def alpn(layer, cursor)
+        length = cursor.u16(0)
+        raise BadLength, 'invalid TLS ALPN list length' unless length >= 2 && length + 2 == cursor.remaining
+        pos = 2
+        while pos < cursor.remaining
+          length = cursor.u8(pos)
+          raise BadLength, 'invalid TLS ALPN protocol length' if length.zero? || pos + 1 + length > cursor.remaining
+          put(layer, 'tls.handshake.extensions_alpn_str', cursor.bytes(pos + 1, length), :string, cursor.start + pos + 1, length, true)
+          pos += length + 1
+        end
+      end
+
+      # @rbs (Layer layer, Cursor cursor, bool client) -> void
+      def versions(layer, cursor, client)
+        pos = client ? 1 : 0
+        length = client ? cursor.u8(0) : 2
+        raise BadLength, 'invalid TLS supported version vector' unless length.positive? && length.even? && pos + length == cursor.remaining
+        (length / 2).times do |i|
+          put(layer, 'tls.handshake.extensions.supported_version', cursor.u16(pos + i * 2), :uint, cursor.start + pos + i * 2, 2, true)
+        end
+      end
+
+      # @rbs (Integer logical) -> Integer
+      def wire_offset(logical)
+        range = @ranges.bsearch { |entry| entry[0] + entry[2] > logical } || @ranges.last
+        range ? range[1] + logical - range[0] : logical
+      end
+
+      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length, ?bool handshake) -> void
+      def put(layer, name, value, type, offset, length, handshake = false)
+        if handshake
+          ending = length.positive? ? wire_offset(offset + length - 1) + 1 : wire_offset(offset)
+          offset = wire_offset(offset)
+          length = ending - offset
+        end
+        layer.add("#{name}_#{layer.definitions.length}".to_sym, name, value, type: type, offset: offset, length: length)
+      end
+
+      # @rbs (Layer layer) -> String
+      def summary(layer)
+        name = layer.fields.find { |field| field.name == 'tls.handshake.extensions_server_name' }&.display
+        label = HANDSHAKES[layer.field_value('tls.handshake.type')] || CONTENT_TYPES[layer.field_value('tls.record.content_type')]
+        "TLS #{label}#{name ? " #{name}" : ''}"
+      end
+    end
+  end
+end

data/lib/redhound/protocols/tunnel.rb

@@ -0,0 +1,48 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Gre < Dissector
+      protocol :gre, name: 'Generic Routing Encapsulation', short: 'GRE'
+      dissects_on 'ip.proto', 47
+      header do
+        uint16 :flags, 'gre.flags', format: :hex
+        uint16 :type, 'gre.proto', format: :hex
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        flags, len = layer[:flags], 4
+        return layer.diagnose(:error, :malformed, 'unsupported GRE version or routing') unless (flags & 0x4007).zero?
+        len += 4 if flags & 0x8000 != 0
+        if flags & 0x2000 != 0
+          layer.add(:key, 'gre.key', ctx.cursor.u32(len), offset: len, length: 4)
+          len += 4
+        end
+        len += 4 if flags & 0x1000 != 0
+        ctx.cursor.check(0, len)
+        layer.header_length, layer.payload_offset = len, layer.offset + len
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = layer[:type] == 0x6558 ? Ethernet : ctx.registry.lookup('ethertype', layer[:type])
+    end
+    # @api private
+    class Vxlan < Dissector
+      protocol :vxlan, name: 'Virtual eXtensible LAN', short: 'VXLAN'
+      dissects_on 'udp.port', 4789
+      header do
+        uint32 :flags, 'vxlan.flags', format: :hex
+        uint32 :vni_word, 'vxlan.vni_word'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        layer.add(:vni, 'vxlan.vni', layer[:vni_word] >> 8, offset: 4, length: 3)
+        layer.diagnose(:error, :malformed, 'VXLAN I flag is unset') if layer[:flags] & 0x08000000 == 0
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = Ethernet
+    end
+  end
+end

data/lib/redhound/protocols/udp.rb

@@ -0,0 +1,32 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Udp < Dissector
+      protocol :udp, name: 'User Datagram Protocol', short: 'UDP'
+      dissects_on 'ip.proto', 17
+      header do
+        uint16 :srcport, 'udp.srcport'
+        uint16 :dstport, 'udp.dstport'
+        uint16 :length, 'udp.length'
+        uint16 :checksum, 'udp.checksum', format: :hex
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        len = layer[:length]
+        return layer.diagnose(:error, :bad_length, 'UDP length is less than 8') if len < 8
+        layer.payload_end = layer.offset + len
+        return unless len <= ctx.cursor.remaining
+        return if layer[:checksum].zero? && ctx.network&.protocol == :ipv4
+        Checksum.verify(ctx, layer, ctx.cursor.bytes(0, len), 17)
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = ctx.registry.by_port('udp.port', layer[:srcport], layer[:dstport])
+      # @rbs (Layer layer) -> String
+      def summary(layer) = "UDP, length #{layer[:length] - 8}"
+    end
+  end
+end

data/lib/redhound/protocols/vlan.rb

@@ -0,0 +1,23 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Vlan < Dissector
+      protocol :vlan, name: '802.1Q VLAN', short: 'VLAN'
+      dissects_on 'ethertype', 0x8100, 0x88a8, 0x9100
+      header do
+        bits 16 do
+          bit :priority, 'vlan.priority', 3
+          bit :dei, 'vlan.dei', 1
+          bit :id, 'vlan.id', 12
+        end
+        uint16 :type, 'vlan.etype', format: :hex
+      end
+      # @rbs (Context ctx, Layer layer) -> untyped
+      def next_dissector(ctx, layer) = ctx.registry.lookup('ethertype', layer[:type])
+    end
+  end
+end

data/lib/redhound/reader.rb

@@ -0,0 +1,8 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # Enumerable pcap/pcapng reader; inherited capture-source methods include stop and close.
+  class Reader < Capture::FileSource
+  end
+end

data/lib/redhound/registry.rb

@@ -0,0 +1,64 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # Protocol dispatch and per-session decode-as rules.
+  class Registry
+    # @rbs () -> Registry
+    # Shared registry populated by built-in and custom dissectors.
+    def self.default = (@default ||= new)
+    # Registered protocol identities and dispatch tables.
+    attr_reader :protocols
+    # @rbs () -> void
+    # Create empty protocol dispatch tables.
+    def initialize
+      @tables, @protocols, @decode_as = {}, {}, {}
+    end
+    # @rbs (String key, Integer value, untyped klass) -> void
+    # Register a class under a dispatch key and value.
+    def register(key, value, klass) = (@tables[key] ||= Hash.new)[value] = klass
+    # @rbs (untyped klass) -> void
+    # Register a protocol class by its declared identity.
+    def register_protocol(klass) = @protocols[klass.protocol_id] = klass
+    # @rbs (String key, Integer value) -> untyped
+    # Look up a protocol class for a dispatch key and value.
+    def lookup(key, value) = (@tables[key] || {})[value]
+    # @rbs (String key, Integer src, Integer dst) -> untyped
+    # Resolve decode-as rules before registered low/high port dispatch.
+    def by_port(key, src, dst)
+      ports = [src, dst].sort
+      ports.each { |p| return @decode_as[[key, p]] if @decode_as.key?([key, p]) }
+      ports.each { |p| return lookup(key, p) if lookup(key, p) }
+      nil
+    end
+    # @rbs (Symbol parent, Context ctx, Cursor cursor) -> untyped
+    # Run registered transport heuristics on the bounded payload.
+    def heuristic(parent, ctx, cursor)
+      return nil unless parent == :tcp || parent == :udp
+      (@tables["#{parent}.port"] || {}).each_value do |klass|
+        next unless klass.respond_to?(:heuristic?)
+        return klass if klass.heuristic?(ctx, cursor)
+      end
+      nil
+    end
+    # @rbs (String rule) -> void
+    # Apply a transport-port override such as udp.port==8443,dns.
+    def decode_as(rule)
+      match = /\A(tcp\.port|udp\.port)==(\d+),([a-z0-9_]+)\z/.match(rule)
+      raise ConfigurationError, "invalid decode-as rule: #{rule}" unless match
+      klass = @protocols[match[3].to_sym]
+      port = Integer(match[2])
+      raise ConfigurationError, "invalid decode-as protocol or port: #{rule}" unless klass && port.between?(0, 65_535)
+      @decode_as[[match[1], port]] = klass
+    end
+    # @rbs () -> Registry
+    # Copy tables and overrides for an independent analysis session.
+    def copy
+      other = dup
+      other.instance_variable_set(:@decode_as, @decode_as.dup)
+      other.instance_variable_set(:@tables, @tables.transform_values(&:dup))
+      other.instance_variable_set(:@protocols, @protocols.dup)
+      other
+    end
+  end
+end

data/lib/redhound/stream_dissector.rb

@@ -0,0 +1,168 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # A stateful TCP dissector. Instances belong to one bidirectional flow.
+  # Override on_data/on_gap for custom stream protocols; built-in framing is
+  # shared with the packet dissectors so validation has one implementation.
+  class StreamDissector < Dissector
+    # @rbs (?registry: Registry, ?max_bytes: Integer) -> void
+    def initialize(registry: Registry.default, max_bytes: 1 << 20)
+      @registry, @max_bytes = registry, max_bytes
+      @buffers = [''.b, ''.b]
+      @origins = [Array.new, Array.new] #: Array[untyped]
+      @tls_encrypted = [false, false]
+    end
+
+    # @rbs (untyped stream, Integer direction, String data, Integer frame) -> Array[Layer]
+    def on_data(stream, direction, data, frame)
+      @buffers[direction] << data
+      @origins[direction] << [data.bytesize, frame] unless data.empty?
+      if bytesize > @max_bytes
+        on_gap(stream, direction, @buffers[direction].bytesize)
+        return [Layer.new(self.class.protocol_id, 0, 0, 0).diagnose(:warning, :reassembly_gap, 'stream PDU buffer limit exceeded')]
+      end
+      layers = [] #: Array[Layer]
+      loop do
+        buffer = @buffers[direction]
+        head_response = head_response?(stream, direction, buffer)
+        length = pdu_length(buffer, direction, head_response: head_response)
+        break unless length && length.positive?
+        layer = parse_pdu(buffer.byteslice(0, length), tls_encrypted: @tls_encrypted[direction], head_response: head_response)
+        record_http(stream, direction, layer)
+        @tls_encrypted[direction] = true if self.class.protocol_id == :tls && layer.field_values('tls.record.content_type').include?(20)
+        layer.add(:reassembled_from, 'tcp.reassembled_from', consume_origins(direction, length))
+        layers << layer
+        @buffers[direction] = buffer.byteslice(length..) || ''.b
+      end
+      layers
+    end
+
+    # @rbs (untyped stream, Integer direction, Integer length) -> Array[Layer]
+    def on_gap(stream, direction, length)
+      layers = on_close(stream, direction)
+      layers.each { |layer| layer.diagnose(:warning, :reassembly_gap, "#{length} TCP bytes missing") }
+      stream.http_methods.each(&:clear) if self.class.protocol_id == :http
+      layers
+    end
+
+    # @rbs (untyped stream, Integer direction) -> Array[Layer]
+    def on_close(stream, direction)
+      buffer = @buffers[direction]
+      return [] if buffer.empty?
+      layer = parse_pdu(buffer, tls_encrypted: @tls_encrypted[direction], head_response: head_response?(stream, direction, buffer))
+      record_http(stream, direction, layer)
+      layer.add(:reassembled_from, 'tcp.reassembled_from', consume_origins(direction, buffer.bytesize))
+      @buffers[direction] = ''.b
+      [layer]
+    end
+
+    # @rbs () -> Integer
+    def bytesize = @buffers.sum { |buffer| buffer.empty? ? 0 : buffer.bytesize * 2 + 40 } + @origins.sum { |origins| origins.size * 128 }
+
+    # @rbs (Integer direction, Integer length) -> Array[Integer]
+    def consume_origins(direction, length)
+      frames = [] #: Array[Integer]
+      while length.positive? && !@origins[direction].empty?
+        size, frame = @origins[direction].first
+        frames << frame
+        if size > length
+          @origins[direction][0] = [size - length, frame]
+          length = 0
+        else
+          @origins[direction].shift
+          length -= size
+        end
+      end
+      frames.uniq.sort
+    end
+
+    # @rbs (String bytes, ?tls_encrypted: bool, ?head_response: bool) -> Layer
+    def parse_pdu(bytes, tls_encrypted: false, head_response: false)
+      packet = Packet.new(bytes, meta: { tls_encrypted: tls_encrypted, http_head_response: head_response })
+      ctx = Context.new(packet, registry: @registry)
+      ctx.layers << Layer.new(:tcp, 0, 0, bytes.bytesize)
+      Engine.new(registry: @registry).safely(self.class, ctx, ctx.cursor)
+    end
+
+    # @rbs (String buffer, ?Integer direction, ?head_response: bool) -> Integer?
+    def pdu_length(buffer, direction = 0, head_response: false)
+      case self.class.protocol_id
+      when :dns
+        return nil if buffer.bytesize < 2
+        length = buffer.unpack1('n') #: Integer
+        buffer.bytesize >= length + 2 ? length + 2 : nil
+      when :http then http_length(buffer, head_response: head_response)
+      when :tls then tls_length(buffer, direction)
+      else buffer.empty? ? nil : buffer.bytesize
+      end
+    end
+
+    # @rbs (String buffer, ?head_response: bool) -> Integer?
+    def http_length(buffer, head_response: false)
+      ending = buffer.index("\r\n\r\n")
+      return buffer.bytesize if !ending && buffer.bytesize > 65_536
+      return nil unless ending
+      head_end = ending + 4
+      header = buffer.byteslice(0, ending) #: String
+      response = header.start_with?('HTTP/')
+      status = response ? header.split(' ', 3)[1].to_i : 0
+      return head_end if response && (head_response || status.between?(100, 199) || [204, 304].include?(status))
+      lengths = header.scan(/\r\ncontent-length:[ \t]*([^\r\n]*)/in).flatten.flat_map { |value| value.empty? ? [''] : value.split(',', -1).map(&:strip) }
+      transfer = header.scan(/\r\ntransfer-encoding:[ \t]*([^\r\n]*)/in).flatten.join(',').downcase.split(',').map(&:strip)
+      if (!lengths.empty? && !transfer.empty?) || lengths.uniq.size > 1 || lengths.any? { |value| !value.match?(/\A[0-9]+\z/n) }
+        return head_end # The packet parser reports conflicting or invalid framing.
+      end
+      if transfer.last == 'chunked'
+        layer = Layer.new(:http, 0, 0, buffer.bytesize)
+        parser = self #: untyped
+        _body, pos = parser.chunked(layer, buffer, head_end)
+        return nil if layer.diagnostics.any? { |diagnostic| diagnostic.code == :truncated }
+        return pos
+      end
+      return response ? nil : head_end unless transfer.empty?
+      unless lengths.empty?
+        length = head_end + lengths[0].to_i
+        return length <= buffer.bytesize ? length : nil
+      end
+      response ? nil : head_end
+    end
+
+    # @rbs (untyped stream, Integer direction, String buffer) -> bool
+    def head_response?(stream, direction, buffer)
+      self.class.protocol_id == :http && buffer.start_with?('HTTP/') && stream.http_methods[1 - direction].first == true
+    end
+
+    # @rbs (untyped stream, Integer direction, Layer layer) -> void
+    def record_http(stream, direction, layer)
+      return unless self.class.protocol_id == :http
+      method = layer.field_value('http.request.method')
+      if method && !layer.error?
+        methods = stream.http_methods[direction]
+        if methods.size >= [@max_bytes / 16, 1].max
+          methods.clear
+          layer.diagnose(:warning, :reassembly_gap, 'HTTP request context memory limit exceeded')
+        end
+        methods << (method == 'HEAD')
+      elsif (status = layer.field_value('http.response.code')) && (status >= 200 || status == 101)
+        stream.http_methods[1 - direction].shift
+      end
+    end
+
+    # @rbs (String buffer, Integer direction) -> Integer?
+    def tls_length(buffer, direction)
+      pos = 0
+      while pos + 5 <= buffer.bytesize
+        parts = buffer.unpack('Cnn', offset: pos) #: [Integer, Integer, Integer]
+        type, version, length = parts
+        return pos + 5 unless type.between?(20, 24) && version.between?(0x0300, 0x0303) && length <= 18_432
+        break if pos + 5 + length > buffer.bytesize
+        pos += 5 + length
+      end
+      return nil if pos.zero?
+      bytes = buffer.byteslice(0, pos) #: String
+      candidate = parse_pdu(bytes, tls_encrypted: @tls_encrypted[direction])
+      candidate.diagnostics.any? { |diagnostic| diagnostic.code == :truncated } ? nil : pos
+    end
+  end
+end

data/lib/redhound/util/seq.rb

@@ -0,0 +1,21 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Util
+    # @api private
+    module Seq
+      MOD = 4_294_967_296
+      # @rbs (Integer a, Integer b) -> Integer
+      def self.diff(a, b) = (a - b) % MOD
+      # @rbs (Integer a, Integer b) -> bool
+      def self.lt(a, b) = diff(a, b) >= (MOD >> 1)
+      # @rbs (Integer a, Integer b) -> Integer
+      def self.signed_diff(a, b)
+        delta = diff(a, b)
+        delta >= (MOD >> 1) ? delta - MOD : delta
+      end
+    end
+  end
+end

data/lib/redhound/version.rb

@@ -2,5 +2,6 @@
 # frozen_string_literal: true
 
 module Redhound
-  VERSION = '1.0.1'
+  # Published gem version.
+  VERSION = '2.0.0.rc2'
 end