redhound 2.0.0.rc1 → 2.0.0.rc2

data/lib/redhound/dissector.rb

@@ -5,7 +5,7 @@ module Redhound
   # Base class and declarative fixed-header DSL for custom protocols.
   class Dissector
     # Unpack formats and byte lengths supported by the header DSL.
-    TYPES = { uint8: ['C', 1], uint16: ['n', 2], uint32: ['N', 4], uint64: ['Q>', 8],
+    TYPES = { int8: ['c', 1], uint8: ['C', 1], uint16: ['n', 2], uint32: ['N', 4], uint64: ['Q>', 8],
               mac: ['a6', 6], ipv4: ['N', 4], ipv6: ['a16', 16] }.freeze
 
     # Build a single unpack template and its field descriptions.
@@ -28,6 +28,9 @@ module Redhound
         @index += 1
       end
       # @rbs (Symbol key, String name, **untyped opts) -> void
+      # Append a signed 8-bit field.
+      def int8(key, name, **opts) = field(:int8, key, name, **opts)
+      # @rbs (Symbol key, String name, **untyped opts) -> void
       # Append an unsigned 8-bit field.
       def uint8(key, name, **opts) = field(:uint8, key, name, **opts)
       # @rbs (Symbol key, String name, **untyped opts) -> void
@@ -112,17 +115,28 @@ module Redhound
     def parse(ctx, cursor)
       header = self.class.compiled_header
       length = header&.length || 0
-      raw = cursor.unpack(self.class.header_template, length)
+      truncated = cursor.remaining < length
+      raw = if truncated
+              cursor.bytes(0, cursor.remaining).unpack(self.class.header_template)
+            else
+              cursor.unpack(self.class.header_template, length)
+            end
       defs = header ? header.definitions.dup : Array.new
+      defs.select! { |d| d.offset + d.length <= cursor.remaining } if truncated
       values = {} #: Hash[Symbol, untyped]
       defs.each do |d|
         val = raw[d.index]
         val = ((val >> d.shift) & d.mask) * d.scale if d.shift
         values[d.key] = val
       end
-      layer = Layer.new(self.class.protocol_id, cursor.start, length, cursor.limit,
+      layer = Layer.new(self.class.protocol_id, cursor.start, truncated ? cursor.remaining : length, cursor.limit,
                         definitions: defs, values: values, embedded: ctx.embedded)
-      dissect(ctx, layer)
+      return layer.diagnose(:note, :truncated, "need #{length} header bytes, have #{cursor.remaining}") if truncated
+      begin
+        dissect(ctx, layer)
+      rescue Cursor::Truncated => e
+        layer.diagnose(:note, :truncated, e.message)
+      end
       layer
     end
     # @rbs (Context ctx, Layer layer) -> void

data/lib/redhound/engine.rb

@@ -29,6 +29,9 @@ module Redhound
         break if layer.error?
         klass = next_klass || Protocols::Data
       end
+      if packet.meta[:possible_truncation]
+        ctx.layers.first.diagnose(:warn, :capture_truncated, 'receive buffer limit reached; original packet length is unknown')
+      end
       ctx.layers
     end
 

data/lib/redhound/field.rb

@@ -30,7 +30,7 @@ module Redhound
     # Decoded value; addresses are returned in human-readable text.
     def value
       case type
-      when :ipv4 then [@raw_value].pack('N').unpack('C4').join('.')
+      when :ipv4 then "#{(@raw_value >> 24) & 255}.#{(@raw_value >> 16) & 255}.#{(@raw_value >> 8) & 255}.#{@raw_value & 255}"
       when :ipv6 then IPAddr.new_ntoh(@raw_value).to_s
       when :mac then @raw_value.unpack('H2' * 6).join(':')
       else @raw_value

data/lib/redhound/file/format.rb

@@ -7,6 +7,9 @@ module Redhound
     # @api private
     module Format
       MAX_RECORD = 16 * 1024 * 1024
+      MAX_INTERFACES = 4096
+      MAX_INTERFACE_METADATA = 16 * 1024 * 1024
+      MAX_OPTIONS = 4096
       PCAP_MAGICS = {
         "\xd4\xc3\xb2\xa1".b => [:little, 1_000], "\xa1\xb2\xc3\xd4".b => [:big, 1_000],
         "\x4d\x3c\xb2\xa1".b => [:little, 1], "\xa1\xb2\x3c\x4d".b => [:big, 1]
@@ -19,7 +22,11 @@ module Redhound
         raise FileFormatError, "invalid record length #{length}" unless length.between?(0, MAX_RECORD)
         return ''.b if length.zero?
 
-        result = ''.b
+        result = io.read(length)
+        return result if result && result.bytesize == length
+        return nil if eof && (!result || result.empty?)
+
+        result ||= ''.b
         while result.bytesize < length
           part = io.read(length - result.bytesize)
           if !part || part.empty?

data/lib/redhound/file/pcap_writer.rb

@@ -24,12 +24,16 @@ module Redhound
         @closed = false
         magic = precision == :nano ? 0xa1b23c4d : 0xa1b2c3d4
         write_bytes([magic, 2, 4, 0, 0, snaplen, @linktype].pack('VvvV4'))
+      rescue StandardError, Interrupt
+        @io.close if @owned && @io && !@io.closed?
+        raise
       end
 
       # @rbs (Packet packet) -> self
       def write(packet)
         raise IOError, 'writer is closed' if @closed
         raise FileFormatError, 'pcap cannot store multiple link types; use pcapng' unless packet.linktype == @linktype
+        raise FileFormatError, 'packet original length exceeds unsigned 32-bit range' unless packet.original_length <= 0xffff_ffff
 
         seconds, nanos = packet.timestamp_ns.divmod(1_000_000_000)
         raise FileFormatError, 'pcap timestamp exceeds unsigned 32-bit seconds' unless seconds.between?(0, 0xffff_ffff)
@@ -56,9 +60,12 @@ module Redhound
       def close
         return if @closed
 
-        @io.flush
-        @io.close if @owned
-        @closed = true
+        begin
+          @io.flush
+        ensure
+          @closed = true
+          @io.close if @owned && !@io.closed?
+        end
       end
 
       private

data/lib/redhound/file/pcapng_reader.rb

@@ -17,6 +17,7 @@ module Redhound
         @packet_counts = {} #: Hash[Integer, Integer]
         @stats = Capture::Stats.new
         @number = 0
+        @interface_metadata = 0
         @magic = magic
         @integer_format = 'V'
         read_block
@@ -88,10 +89,11 @@ module Redhound
       # @rbs (String body) -> void
       def read_interface(body)
         require_size(body, 8)
+        raise FileFormatError, 'pcapng interface limit exceeded' if @interfaces.size >= Format::MAX_INTERFACES
         linktype, _reserved, snaplen = body.unpack(@integer_format == 'V' ? 'vvV' : 'nnN') #: [Integer, Integer, Integer]
         raise FileFormatError, 'invalid pcapng snaplen' if snaplen > Format::MAX_RECORD
 
-        opts = options(body, 8)
+        opts = options(body, 8, [2, 3, 9, 11, 14])
         resolution = opts.fetch(9, ["\x06".b]).fetch(0)
         raise FileFormatError, 'invalid pcapng timestamp resolution' unless resolution.bytesize == 1
 
@@ -105,6 +107,11 @@ module Redhound
         interface = Capture::Interface.new(name: opts.fetch(2, ["interface#{index}"]).fetch(0), index:, linktype:, snaplen:,
                                            description: opts[3]&.first, filter: filter_option && filter_option.getbyte(0) == 0 ? filter_option.byteslice(1..) : nil,
                                            meta: { timestamp_units: units, timestamp_offset: offset.unpack1(@integer_format == 'V' ? 'q<' : 'q>') })
+        metadata_size = 512 + interface.name.bytesize + (interface.description&.bytesize || 0) + (interface.filter&.bytesize || 0)
+        if @interface_metadata + metadata_size > Format::MAX_INTERFACE_METADATA
+          raise FileFormatError, 'pcapng interface metadata limit exceeded'
+        end
+        @interface_metadata += metadata_size
         @section_interfaces << interface
         @interfaces << interface
       end
@@ -116,7 +123,7 @@ module Redhound
         interface = interface_at(index)
         Format.check_lengths(caplen, original_length, interface.snaplen)
         require_size(body, 20 + Format.padded(caplen))
-        opts = options(body, 20 + Format.padded(caplen))
+        opts = options(body, 20 + Format.padded(caplen), [1, 2])
         flags_option = opts[2]&.first
         raise FileFormatError, 'invalid pcapng packet flags' if flags_option && flags_option.bytesize != 4
 
@@ -150,7 +157,7 @@ module Redhound
         require_size(body, 12)
         index = body.unpack1(@integer_format) #: Integer
         interface = interface_at(index)
-        opts = options(body, 12)
+        opts = options(body, 12, [4, 5, 7, 8])
         values = {} #: Hash[Symbol, Integer]
         { received: 4, dropped: 5, if_dropped: 7, captured: 8 }.each do |name, code|
           option = opts[code]&.first
@@ -181,9 +188,10 @@ module Redhound
         @section_interfaces.fetch(index) { raise FileFormatError, "pcapng references unknown interface #{index}" }
       end
 
-      # @rbs (String body, Integer offset) -> Hash[Integer, Array[String]]
-      def options(body, offset)
+      # @rbs (String body, Integer offset, Array[Integer] allowed) -> Hash[Integer, Array[String]]
+      def options(body, offset, allowed)
         result = {} #: Hash[Integer, Array[String]]
+        count = 0
         while offset < body.bytesize
           require_size(body, offset + 4)
           code, length = body.unpack(@integer_format == 'V' ? 'vv' : 'nn', offset:) #: [Integer, Integer]
@@ -192,9 +200,13 @@ module Redhound
             raise FileFormatError, 'invalid pcapng end of options' unless length.zero?
             break
           end
+          count += 1
+          raise FileFormatError, 'pcapng option count limit exceeded' if count > Format::MAX_OPTIONS
           require_size(body, offset + Format.padded(length))
-          value = body.byteslice(offset, length) #: String
-          (result[code] ||= []) << value
+          if allowed.include?(code)
+            value = body.byteslice(offset, length) #: String
+            (result[code] ||= []) << value
+          end
           offset += Format.padded(length)
         end
         result

data/lib/redhound/file/pcapng_writer.rb

@@ -26,12 +26,16 @@ module Redhound
         opts = { 3 => RUBY_PLATFORM, 4 => "Redhound #{VERSION}" }
         opts[1] = comment if comment
         write_block(0x0a0d0d0a, [0x1a2b3c4d, 1, 0, 0xffff_ffff_ffff_ffff].pack('VvvQ<') + options(opts))
+      rescue StandardError, Interrupt
+        @io.close if @owned && @io && !@io.closed?
+        raise
       end
 
       # @rbs (Packet packet) -> self
       def write(packet)
         raise IOError, 'writer is closed' if @closed
         raise FileFormatError, 'pcapng timestamp must be nonnegative' if packet.timestamp_ns.negative?
+        raise FileFormatError, 'packet original length exceeds unsigned 32-bit range' unless packet.original_length <= 0xffff_ffff
 
         index = ensure_interface(packet)
         data = packet.data.byteslice(0, @snaplen)
@@ -76,20 +80,23 @@ module Redhound
       def close
         return if @closed
 
-        @interfaces.each_value do |index|
-          stats = @statistics[index]
-          start_time, end_time = @start_times.fetch(index, 0), @end_times.fetch(index, 0)
-          opts = { 2 => timestamp_words(start_time), 3 => timestamp_words(end_time),
-                   8 => [@counts.fetch(index, 0)].pack('Q<') }
-          if stats
-            opts[4], opts[5], opts[7] = [stats.received].pack('Q<'), [stats.dropped].pack('Q<'), [stats.if_dropped].pack('Q<')
-            opts[6] = [stats.captured].pack('Q<')
+        begin
+          @interfaces.each_value do |index|
+            stats = @statistics[index]
+            start_time, end_time = @start_times.fetch(index, 0), @end_times.fetch(index, 0)
+            opts = { 2 => timestamp_words(start_time), 3 => timestamp_words(end_time),
+                     8 => [@counts.fetch(index, 0)].pack('Q<') }
+            if stats
+              opts[4], opts[5], opts[7] = [stats.received].pack('Q<'), [stats.dropped].pack('Q<'), [stats.if_dropped].pack('Q<')
+              opts[6] = [stats.captured].pack('Q<')
+            end
+            write_block(5, [index].pack('V') + timestamp_words(end_time) + options(opts))
           end
-          write_block(5, [index].pack('V') + timestamp_words(end_time) + options(opts))
+          @io.flush
+        ensure
+          @closed = true
+          @io.close if @owned && !@io.closed?
         end
-        @io.flush
-        @io.close if @owned
-        @closed = true
       end
 
       private
@@ -99,14 +106,15 @@ module Redhound
         interface = packet.interface
         key = [interface&.object_id || 0, packet.linktype]
         return @interfaces[key] if @interfaces.key?(key)
+        raise FileFormatError, 'pcapng interface limit exceeded' if @interfaces.size >= Format::MAX_INTERFACES
 
         index = @interfaces.size
-        @interfaces[key] = index
         opts = { 2 => interface&.name || "interface#{index}", 9 => "\x09".b, 12 => RUBY_PLATFORM }
         opts[3] = interface.description if interface&.description
-        expression = interface&.filter || @filter
+        expression = @filter || interface&.filter
         opts[11] = "\0" + expression if expression
         write_block(1, [packet.linktype, 0, @snaplen].pack('vvV') + options(opts))
+        @interfaces[key] = index
         index
       end
 

data/lib/redhound/filter/bpf/vm.rb

@@ -8,6 +8,7 @@ module Redhound
     module BPF
       # @api private
       class VM
+        LOAD_FORMATS = { 0x00 => 'N', 0x08 => 'n', 0x10 => 'C' }.freeze
         # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> void
         def initialize(instructions)
           Validator.validate!(instructions)
@@ -34,9 +35,9 @@ module Redhound
                         if k >= 0xfffff000 && (code & 0xe0) == 0x20
                           ancillary(k, packet.meta)
                         else
-                          size = { 0x00 => 4, 0x08 => 2, 0x10 => 1 }.fetch(code & 0x18)
+                          size = 4 >> ((code & 0x18) >> 3)
                           return 0 if offset.negative? || offset + size > packet.data.bytesize
-                          packet.data.unpack1({ 4 => 'N', 2 => 'n', 1 => 'C' }.fetch(size), offset: offset)
+                          packet.data.unpack1(LOAD_FORMATS.fetch(code & 0x18), offset: offset)
                         end
                       end
               if code == 0xb1

data/lib/redhound/output/follow.rb

@@ -50,7 +50,12 @@ module Redhound
           end
         end
       ensure
-        close
+        original_error = $!
+        begin
+          close
+        rescue StandardError
+          raise unless original_error
+        end
       end
       # @rbs () -> void
       def close = @file.close!

data/lib/redhound/output/summary.rb

@@ -15,18 +15,33 @@ module Redhound
       # @rbs (Packet packet) -> String
       def line(packet)
         parts = [@timestamp.format(packet)]
+        if packet.interface
+          parts << [packet.interface.name, packet.direction&.to_s&.capitalize].compact.join(' ')
+        end
         if @link_layer && (eth = packet[:eth])
           parts << "#{eth.display(:src)} > #{eth.display(:dst)}, ethertype #{eth.display(:type)}, length #{packet.original_length}:"
         end
-        network = packet.layers.find { |l| %i[ipv4 ipv6].include?(l.protocol) && !l.embedded }
-        transport = packet.layers.find { |l| %i[tcp udp].include?(l.protocol) && !l.embedded }
+        network = nil #: Layer?
+        transport = nil #: Layer?
+        layer = nil #: Layer?
+        packet.layers.each do |current|
+          next if current.embedded
+          case current.protocol
+          when :ipv4, :ipv6
+            network, transport, layer = current, nil, nil
+          when :tcp, :udp
+            transport = layer = current
+          when :data, :raw, :eth, :vlan, :ipv6_ext, :sll, :sll2, :null
+          else layer = current
+          end
+        end
         if network
           src, dst = address(network.display(:src)), address(network.display(:dst))
           src += ".#{transport[:srcport]}" if transport
           dst += ".#{transport[:dstport]}" if transport
           parts << "#{network.protocol == :ipv4 ? 'IP' : 'IP6'} #{src} > #{dst}:"
         end
-        layer = packet.layers.reverse.find { |l| !%i[data raw eth vlan ipv4 ipv6 ipv6_ext sll sll2 null].include?(l.protocol) && !l.embedded } || packet.layers.last
+        layer ||= packet.layers.last
         klass = layer && Registry.default.protocols[layer.protocol]
         parts << if @quick && transport
                    "#{transport.protocol.to_s.upcase}, length #{[transport.payload_end - transport.payload_offset, 0].max}"
@@ -37,11 +52,21 @@ module Redhound
                  end
         if @verbosity.positive? && network
           parts << "ttl #{network[:ttl] || network[:hlim]}"
+          parts << "id #{network.display(:id)}, length #{network[:len]}" if network.protocol == :ipv4
+          parts << "checksum #{network.display(:checksum)}" if network[:checksum]
+          if transport
+            parts << "#{transport.protocol} checksum #{transport.display(:checksum)}"
+            options = transport.fields.select { |field| field.name.start_with?('tcp.options.') }
+            unless options.empty?
+              parts << 'options [' + options.map { |field| "#{field.name.delete_prefix('tcp.options.')} #{field.display}" }.join(', ') + ']'
+            end
+          end
         end
         diagnostics = packet.layers.flat_map(&:diagnostics)
         parts << diagnostics.map { |d| "[#{d.code}]" }.join(' ') unless diagnostics.empty?
         # All protocol summaries and interface names pass this terminal boundary.
-        parts.reject(&:empty?).join(' ').b.gsub(/[^\x20-\x7e]/n) { |c| Kernel.format('\\x%02x', c.getbyte(0)) }
+        text = parts.reject(&:empty?).join(' ').b
+        text.match?(/[^\x20-\x7e]/n) ? text.gsub(/[^\x20-\x7e]/n) { |c| Kernel.format('\\x%02x', c.getbyte(0)) } : text
       end
       # @rbs (Packet packet, untyped io) -> void
       def format(packet, io) = io.write(line(packet) + "\n")

data/lib/redhound/output/timestamp.rb

@@ -26,9 +26,9 @@ module Redhound
         value
       end
       # @rbs (Integer ns) -> String
-      def fraction(ns) = Kernel.format(@precision == :nano ? '%09d' : '%06d', @precision == :nano ? ns.abs % 1_000_000_000 : (ns.abs % 1_000_000_000) / 1000)
+      def fraction(ns) = Kernel.format(@precision == :nano ? '%09d' : '%06d', @precision == :nano ? ns % 1_000_000_000 : (ns % 1_000_000_000) / 1000)
       # @rbs (Integer ns) -> String
-      def seconds(ns) = "#{ns.negative? ? '-' : ''}#{ns.abs / 1_000_000_000}.#{fraction(ns)}"
+      def seconds(ns) = "#{ns.negative? ? '-' : ''}#{ns.abs / 1_000_000_000}.#{fraction(ns.abs)}"
     end
   end
 end

data/lib/redhound/output/tree.rb

@@ -8,7 +8,8 @@ module Redhound
     class Tree
       # @rbs (Packet packet, untyped io) -> void
       def format(packet, io)
-        io.write("Frame #{packet.number}: #{packet.original_length} bytes on wire, #{packet.caplen} captured, #{packet.time.utc.strftime('%Y-%m-%d %H:%M:%S')}.#{Kernel.format('%09d', packet.time.nsec)}\n")
+        interface = packet.interface ? safe([packet.interface.name, packet.direction&.to_s&.capitalize].compact.join(' ')) + ', ' : ''
+        io.write("Frame #{packet.number}: #{packet.original_length} bytes on wire, #{packet.caplen} captured, #{interface}#{packet.time.utc.strftime('%Y-%m-%d %H:%M:%S')}.#{Kernel.format('%09d', packet.time.nsec)}\n")
         packet.layers.each_with_index do |layer, depth|
           klass = Registry.default.protocols[layer.protocol]
           indent = '   ' * depth

data/lib/redhound/packet.rb

@@ -12,9 +12,13 @@ module Redhound
     # Copy binary data and preserve capture metadata; reject impossible original lengths.
     def initialize(data, timestamp_ns: 0, original_length: nil, linktype: 1, interface: nil, direction: nil, number: 1, meta: {})
       @data = data.b.freeze
-      @timestamp_ns, @original_length = timestamp_ns, original_length || data.bytesize
+      raise ArgumentError, 'timestamp_ns must be an Integer' unless timestamp_ns.is_a?(Integer)
+      raise ArgumentError, 'number must be a positive Integer' unless number.is_a?(Integer) && number.positive?
+      raise ArgumentError, 'direction must be in, out or nil' unless direction.nil? || direction == :in || direction == :out
+      @timestamp_ns, @original_length = timestamp_ns, original_length.nil? ? data.bytesize : original_length
+      raise ArgumentError, 'original length must be an Integer' unless @original_length.is_a?(Integer)
       raise ArgumentError, 'original length is shorter than captured length' if @original_length < data.bytesize
-      @linktype = linktype.is_a?(Integer) ? linktype : Capture::Linktype.resolve(linktype)
+      @linktype = Capture::Linktype.resolve(linktype)
       @interface, @direction, @number, @meta = interface, direction, number, meta.dup
       @engine = nil # @rbs Engine?
     end
@@ -56,8 +60,18 @@ module Redhound
     # Return a JSON-compatible packet matching docs/json-schema.json.
     def to_h
       { frame: { number: @number, time_epoch_ns: @timestamp_ns, time: time.utc.strftime('%Y-%m-%dT%H:%M:%S.') + format('%09dZ', time.nsec),
-                 caplen: caplen, len: @original_length, interface: @interface&.name&.dup&.force_encoding(Encoding::UTF_8)&.scrub, direction: @direction, linktype: @linktype },
-        layers: layers.map(&:to_h), diagnostics: layers.flat_map { |l| l.diagnostics.map { |d| { layer: l.protocol, severity: d.severity, code: d.code, message: d.message, field: d.field } } } }
+                 caplen: caplen, len: @original_length, interface: json_text(@interface&.name), direction: @direction, linktype: @linktype },
+        layers: layers.map(&:to_h), diagnostics: layers.flat_map { |l| l.diagnostics.map { |d| { layer: l.protocol, severity: d.severity, code: d.code, message: json_text(d.message), field: json_text(d.field) } } } }
+    end
+
+    private
+
+    # @rbs (String? text) -> String?
+    def json_text(text)
+      return nil unless text
+      utf8 = text.dup.force_encoding(Encoding::UTF_8)
+      return utf8 if utf8.valid_encoding?
+      text.unpack1('H*') #: String
     end
   end
 end

data/lib/redhound/protocols/data.rb

@@ -6,11 +6,13 @@ module Redhound
   module Protocols
     # @api private
     class Data < Dissector
+      LENGTH_FIELD = FieldDefinition.new(:length, 'data.len', :uint, 0, 0, 0, nil, nil, 1, nil, nil)
       protocol :data, name: 'Data', short: 'DATA'
       # @rbs (Context ctx, Layer layer) -> void
       def dissect(ctx, layer)
         length = ctx.cursor.remaining
-        layer.add(:length, 'data.len', length)
+        layer.definitions << LENGTH_FIELD
+        layer.values[:length] = length
         layer.add(:data, 'data.data', ctx.cursor.bytes(0, length), type: :bytes, length: length)
         layer.payload_offset = layer.payload_end
       end

data/lib/redhound/protocols/dhcp.rb

@@ -53,7 +53,7 @@ module Redhound
         end
         options.each do |code, entries|
           value = entries.map { |entry| entry[0] }.join
-          decode_option(layer, code, value, entries.first[1])
+          decode_option(layer, code, value, entries)
         end
       rescue Cursor::Truncated => e
         layer.diagnose(:note, :truncated, e.message)
@@ -83,37 +83,53 @@ module Redhound
         end
       end
 
-      # @rbs (Layer layer, Integer code, String value, Integer offset) -> void
-      def decode_option(layer, code, value, offset)
+      # @rbs (Layer layer, Integer code, String value, untyped entries) -> void
+      def decode_option(layer, code, value, entries)
+        offset = entries.first[1]
         length = value.bytesize
         if ADDRESS_OPTIONS.key?(code)
           valid = length.positive? && length % 4 == 0 && (![1, 50, 54].include?(code) || length == 4)
           return layer.diagnose(:error, :bad_length, "invalid DHCP option #{code} length") unless valid
           (length / 4).times do |i|
-            put(layer, "dhcp.option.#{ADDRESS_OPTIONS[code]}", value.unpack1('N', offset: i * 4), :ipv4, offset + i * 4, 4)
+            put(layer, "dhcp.option.#{ADDRESS_OPTIONS[code]}", value.unpack1('N', offset: i * 4), :ipv4, offset + i * 4, 4, entries)
           end
         else
           case code
           when 53, 52
             return layer.diagnose(:error, :bad_length, "invalid DHCP option #{code} length") unless length == 1
-            put(layer, code == 53 ? 'dhcp.option.dhcp' : 'dhcp.option.overload', value.getbyte(0), :uint, offset, 1)
+            put(layer, code == 53 ? 'dhcp.option.dhcp' : 'dhcp.option.overload', value.getbyte(0), :uint, offset, 1, entries)
           when 51
             return layer.diagnose(:error, :bad_length, 'invalid DHCP lease length') unless length == 4
-            put(layer, 'dhcp.option.ip_address_lease_time', value.unpack1('N'), :uint, offset, 4)
+            put(layer, 'dhcp.option.ip_address_lease_time', value.unpack1('N'), :uint, offset, 4, entries)
           when 55
-            length.times { |i| put(layer, 'dhcp.option.request_list_item', value.getbyte(i), :uint, offset + i, 1) }
+            length.times { |i| put(layer, 'dhcp.option.request_list_item', value.getbyte(i), :uint, offset + i, 1, entries) }
           when 61
             return layer.diagnose(:error, :bad_length, 'DHCP client ID must include type and identifier') if length < 2
-            put(layer, 'dhcp.option.client_id', value, :bytes, offset, length)
-            put(layer, 'dhcp.option.client_id.type', value.getbyte(0), :uint, offset, 1)
-            put(layer, 'dhcp.option.client_id.hw_mac_addr', value.byteslice(1, 6), :mac, offset + 1, 6) if length == 7 && value.getbyte(0) == 1
-          when 12 then put(layer, 'dhcp.option.hostname', value, :string, offset, length)
+            put(layer, 'dhcp.option.client_id', value, :bytes, offset, length, entries)
+            put(layer, 'dhcp.option.client_id.type', value.getbyte(0), :uint, offset, 1, entries)
+            put(layer, 'dhcp.option.client_id.hw_mac_addr', value.byteslice(1, 6), :mac, offset + 1, 6, entries) if length == 7 && value.getbyte(0) == 1
+          when 12 then put(layer, 'dhcp.option.hostname', value, :string, offset, length, entries)
           end
         end
       end
 
-      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length) -> void
-      def put(layer, name, value, type, offset, length)
+      # @rbs (untyped entries, Integer logical) -> Integer
+      def wire_offset(entries, logical)
+        entries.each do |bytes, pos|
+          return pos + logical if logical < bytes.bytesize
+          logical -= bytes.bytesize
+        end
+        entries.last[1] + entries.last[0].bytesize
+      end
+
+      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length, ?untyped entries) -> void
+      def put(layer, name, value, type, offset, length, entries = nil)
+        if entries
+          logical = offset - entries.first[1]
+          first = wire_offset(entries, logical)
+          ending = length.zero? ? first : wire_offset(entries, logical + length - 1) + 1
+          offset, length = first, ending - first
+        end
         layer.add("#{name}_#{layer.definitions.length}".to_sym, name, value, type: type, offset: offset, length: length)
       end
 

data/lib/redhound/protocols/http.rb

@@ -37,7 +37,7 @@ module Redhound
           headers = parse_headers(layer, bytes, first + 2, ending + 2)
           return if layer.error?
           body_start = ending + 4
-          length_values = headers.fetch('content-length', []).flat_map { |value| value.split(',').map(&:strip) }
+          length_values = headers.fetch('content-length', []).flat_map { |value| value.empty? ? [''] : value.split(',', -1).map(&:strip) }
           unless length_values.all? { |value| value.match?(/\A[0-9]+\z/n) } && length_values.uniq.length <= 1
             return layer.diagnose(:error, :malformed, 'conflicting or invalid Content-Length')
           end
@@ -108,13 +108,15 @@ module Redhound
           end
           name = name.downcase
           value = line.byteslice(colon + 1..) #: String
-          value = value.sub(/\A[ \t]*/n, '').sub(/[ \t]*\z/n, '')
+          leading = (value[/\A[ \t]*/n] || '').bytesize
+          trailing = value.rindex(/[^ \t]/n)
+          value = value.byteslice(leading, trailing ? trailing + 1 - leading : 0) #: String
           (headers[name] ||= []) << value
           key = name.tr('-', '_')
           if HEADERS.include?(key)
             numeric = key == 'content_length' && value.match?(/\A[0-9]+\z/n)
             put(layer, "http.#{key}", numeric ? value.to_i : value, numeric ? :uint : :string,
-                pos + colon + 1, line.bytesize - colon - 1)
+                pos + colon + 1 + leading, value.bytesize)
           else
             put(layer, 'http.request.line', line, :string, pos, line.bytesize)
           end