redhound 2.0.0.rc1 → 2.0.0.rc2

data/lib/redhound/protocols/icmp.rb

@@ -25,12 +25,20 @@ module Redhound
         uint8 :type, 'icmp.type', enum: TYPES
         uint8 :code, 'icmp.code'
         uint16 :checksum, 'icmp.checksum', format: :hex
-        uint16 :ident, 'icmp.ident'
-        uint16 :seq, 'icmp.seq'
       end
       # @rbs (Context ctx, Layer layer) -> void
       def dissect(ctx, layer)
         layer.definitions[1] = layer.definitions[1].with(enum: CODES[layer[:type]])
+        if [0, 8, 13, 14, 17, 18].include?(layer[:type])
+          layer.add(:ident, 'icmp.ident', ctx.cursor.u16(4), offset: 4, length: 2)
+          layer.add(:seq, 'icmp.seq', ctx.cursor.u16(6), offset: 6, length: 2)
+        else
+          ctx.cursor.check(0, 8)
+          if layer[:type] == 3 && layer[:code] == 4
+            layer.add(:mtu, 'icmp.mtu', ctx.cursor.u16(6), offset: 6, length: 2)
+          end
+        end
+        layer.header_length, layer.payload_offset = 8, layer.offset + 8
         Checksum.verify(ctx, layer, ctx.cursor.bytes(0, ctx.cursor.remaining))
       end
       # @rbs (Context ctx, Layer layer) -> untyped
@@ -40,7 +48,12 @@ module Redhound
         Ipv4
       end
       # @rbs (Layer layer) -> String
-      def summary(layer) = "ICMP type #{layer[:type]}, code #{layer[:code]}, id #{layer[:ident]}, seq #{layer[:seq]}"
+      def summary(layer)
+        text = "ICMP type #{layer[:type]}, code #{layer[:code]}"
+        text += ", id #{layer[:ident]}, seq #{layer[:seq]}" if layer[:ident]
+        text += ", mtu #{layer[:mtu]}" if layer[:mtu]
+        text
+      end
     end
 
     # @api private
@@ -74,29 +87,29 @@ module Redhound
                  end
         cursor.check(0, length)
         if [128, 129].include?(type)
-          layer.add(:ident, 'icmpv6.echo.identifier', cursor.u16(4))
-          layer.add(:seq, 'icmpv6.echo.sequence_number', cursor.u16(6))
+          layer.add(:ident, 'icmpv6.echo.identifier', cursor.u16(4), offset: 4, length: 2)
+          layer.add(:seq, 'icmpv6.echo.sequence_number', cursor.u16(6), offset: 6, length: 2)
         elsif [135, 136, 137].include?(type)
           family = { 135 => 'ns', 136 => 'na', 137 => 'rd' }.fetch(type)
-          layer.add(:target, "icmpv6.nd.#{family}.target_address", cursor.bytes(8, 16), type: :ipv6)
-          layer.add(:destination, 'icmpv6.rd.na.destination_address', cursor.bytes(24, 16), type: :ipv6) if type == 137
+          layer.add(:target, "icmpv6.nd.#{family}.target_address", cursor.bytes(8, 16), type: :ipv6, offset: 8, length: 16)
+          layer.add(:destination, 'icmpv6.rd.na.destination_address', cursor.bytes(24, 16), type: :ipv6, offset: 24, length: 16) if type == 137
           if type == 136
             flags = cursor.u32(4)
-            layer.add(:flags, 'icmpv6.nd.na.flag', flags, format: :hex)
+            layer.add(:flags, 'icmpv6.nd.na.flag', flags, format: :hex, offset: 4, length: 4)
             { r: 0x80000000, s: 0x40000000, o: 0x20000000 }.each do |name, mask|
-              layer.add(name, "icmpv6.nd.na.flag.#{name}", (flags & mask).positive?)
+              layer.add(name, "icmpv6.nd.na.flag.#{name}", (flags & mask).positive?, type: :boolean, offset: 4, length: 4)
             end
           end
         end
         if type == 134
-          layer.add(:hop_limit, 'icmpv6.nd.ra.cur_hop_limit', cursor.u8(4))
-          layer.add(:lifetime, 'icmpv6.nd.ra.router_lifetime', cursor.u16(6))
+          layer.add(:hop_limit, 'icmpv6.nd.ra.cur_hop_limit', cursor.u8(4), offset: 4, length: 1)
+          layer.add(:lifetime, 'icmpv6.nd.ra.router_lifetime', cursor.u16(6), offset: 6, length: 2)
           flags = cursor.u8(5)
-          layer.add(:flags, 'icmpv6.nd.ra.flag', flags, format: :hex)
-          layer.add(:managed, 'icmpv6.nd.ra.flag.m', (flags & 0x80).positive?)
-          layer.add(:other, 'icmpv6.nd.ra.flag.o', (flags & 0x40).positive?)
-          layer.add(:reachable, 'icmpv6.nd.ra.reachable_time', cursor.u32(8))
-          layer.add(:retrans, 'icmpv6.nd.ra.retrans_timer', cursor.u32(12))
+          layer.add(:flags, 'icmpv6.nd.ra.flag', flags, format: :hex, offset: 5, length: 1)
+          layer.add(:managed, 'icmpv6.nd.ra.flag.m', (flags & 0x80).positive?, type: :boolean, offset: 5, length: 1)
+          layer.add(:other, 'icmpv6.nd.ra.flag.o', (flags & 0x40).positive?, type: :boolean, offset: 5, length: 1)
+          layer.add(:reachable, 'icmpv6.nd.ra.reachable_time', cursor.u32(8), offset: 8, length: 4)
+          layer.add(:retrans, 'icmpv6.nd.ra.retrans_timer', cursor.u32(12), offset: 12, length: 4)
         end
         if type.between?(133, 137)
           pos = length
@@ -105,25 +118,25 @@ module Redhound
             len = cursor.u8(pos + 1) * 8
             return layer.diagnose(:error, :bad_length, 'NDP option has zero length') if len.zero?
             cursor.check(pos, len)
-            layer.add(:"option_type_#{pos}", 'icmpv6.opt.type', opt)
-            layer.add(:"option_length_#{pos}", 'icmpv6.opt.length', len / 8)
+            layer.add(:"option_type_#{pos}", 'icmpv6.opt.type', opt, offset: pos, length: 1)
+            layer.add(:"option_length_#{pos}", 'icmpv6.opt.length', len / 8, offset: pos + 1, length: 1)
             if [1, 2].include?(opt) && len >= 8
-              layer.add(:"link_address_#{pos}", 'icmpv6.opt.linkaddr', cursor.bytes(pos + 2, 6), type: :mac)
+              layer.add(:"link_address_#{pos}", 'icmpv6.opt.linkaddr', cursor.bytes(pos + 2, 6), type: :mac, offset: pos + 2, length: 6)
             elsif opt == 3 && len == 32
-              layer.add(:"prefix_length_#{pos}", 'icmpv6.opt.prefix.length', cursor.u8(pos + 2))
+              layer.add(:"prefix_length_#{pos}", 'icmpv6.opt.prefix.length', cursor.u8(pos + 2), offset: pos + 2, length: 1)
               flags = cursor.u8(pos + 3)
-              layer.add(:"prefix_flags_#{pos}", 'icmpv6.opt.prefix.flag', flags, format: :hex)
-              layer.add(:"prefix_onlink_#{pos}", 'icmpv6.opt.prefix.flag.l', (flags & 0x80).positive?)
-              layer.add(:"prefix_autonomous_#{pos}", 'icmpv6.opt.prefix.flag.a', (flags & 0x40).positive?)
-              layer.add(:"prefix_valid_#{pos}", 'icmpv6.opt.prefix.valid_lifetime', cursor.u32(pos + 4))
-              layer.add(:"prefix_preferred_#{pos}", 'icmpv6.opt.prefix.preferred_lifetime', cursor.u32(pos + 8))
-              layer.add(:"prefix_#{pos}", 'icmpv6.opt.prefix', cursor.bytes(pos + 16, 16), type: :ipv6)
+              layer.add(:"prefix_flags_#{pos}", 'icmpv6.opt.prefix.flag', flags, format: :hex, offset: pos + 3, length: 1)
+              layer.add(:"prefix_onlink_#{pos}", 'icmpv6.opt.prefix.flag.l', (flags & 0x80).positive?, type: :boolean, offset: pos + 3, length: 1)
+              layer.add(:"prefix_autonomous_#{pos}", 'icmpv6.opt.prefix.flag.a', (flags & 0x40).positive?, type: :boolean, offset: pos + 3, length: 1)
+              layer.add(:"prefix_valid_#{pos}", 'icmpv6.opt.prefix.valid_lifetime', cursor.u32(pos + 4), offset: pos + 4, length: 4)
+              layer.add(:"prefix_preferred_#{pos}", 'icmpv6.opt.prefix.preferred_lifetime', cursor.u32(pos + 8), offset: pos + 8, length: 4)
+              layer.add(:"prefix_#{pos}", 'icmpv6.opt.prefix', cursor.bytes(pos + 16, 16), type: :ipv6, offset: pos + 16, length: 16)
             elsif opt == 4 && len >= 8
-              layer.add(:"redirected_#{pos}", 'icmpv6.opt.redirected_packet', cursor.bytes(pos + 8, len - 8), type: :bytes)
+              layer.add(:"redirected_#{pos}", 'icmpv6.opt.redirected_packet', cursor.bytes(pos + 8, len - 8), type: :bytes, offset: pos + 8, length: len - 8)
             elsif opt == 5 && len == 8
-              layer.add(:"mtu_#{pos}", 'icmpv6.opt.mtu', cursor.u32(pos + 4))
+              layer.add(:"mtu_#{pos}", 'icmpv6.opt.mtu', cursor.u32(pos + 4), offset: pos + 4, length: 4)
             else
-              layer.add(:"option_#{pos}", 'icmpv6.opt.data', cursor.bytes(pos + 2, len - 2), type: :bytes)
+              layer.add(:"option_#{pos}", 'icmpv6.opt.data', cursor.bytes(pos + 2, len - 2), type: :bytes, offset: pos + 2, length: len - 2)
             end
             pos += len
           end
@@ -152,34 +165,35 @@ module Redhound
       # @rbs (Context ctx, Layer layer) -> void
       def dissect(ctx, layer)
         cursor, type = ctx.cursor, layer[:type]
+        layer.definitions.reject! { |field| field.key == :response } if [0x12, 0x22].include?(type)
         cursor.check(0, 8)
         version = type == 0x22 || (type == 0x11 && cursor.remaining >= 12) ? 3 : (type == 0x12 || (type == 0x11 && layer[:response].zero?) ? 1 : 2)
         layer.add(:version, 'igmp.version', version)
         pos = 8
         if type == 0x22
           count = cursor.u16(6)
-          layer.add(:records, 'igmp.num_grp_recs', count)
+          layer.add(:records, 'igmp.num_grp_recs', count, offset: 6, length: 2)
           count.times do |record|
             cursor.check(pos, 8)
             sources, auxiliary = cursor.u16(pos + 2), cursor.u8(pos + 1) * 4
             cursor.check(pos, 8 + sources * 4 + auxiliary)
-            layer.add(:"record_#{record}", 'igmp.record_type', cursor.u8(pos))
-            layer.add(:"group_#{record}", 'igmp.maddr', cursor.u32(pos + 4), type: :ipv4)
-            layer.add(:"sources_#{record}", 'igmp.num_src', sources)
-            sources.times { |i| layer.add(:"source_#{record}_#{i}", 'igmp.saddr', cursor.u32(pos + 8 + i * 4), type: :ipv4) }
-            layer.add(:"auxiliary_#{record}", 'igmp.aux_data', cursor.bytes(pos + 8 + sources * 4, auxiliary), type: :bytes) if auxiliary.positive?
+            layer.add(:"record_#{record}", 'igmp.record_type', cursor.u8(pos), offset: pos, length: 1)
+            layer.add(:"group_#{record}", 'igmp.maddr', cursor.u32(pos + 4), type: :ipv4, offset: pos + 4, length: 4)
+            layer.add(:"sources_#{record}", 'igmp.num_src', sources, offset: pos + 2, length: 2)
+            sources.times { |i| layer.add(:"source_#{record}_#{i}", 'igmp.saddr', cursor.u32(pos + 8 + i * 4), type: :ipv4, offset: pos + 8 + i * 4, length: 4) }
+            layer.add(:"auxiliary_#{record}", 'igmp.aux_data', cursor.bytes(pos + 8 + sources * 4, auxiliary), type: :bytes, offset: pos + 8 + sources * 4, length: auxiliary) if auxiliary.positive?
             pos += 8 + sources * 4 + auxiliary
           end
         else
-          layer.add(:group, 'igmp.maddr', cursor.u32(4), type: :ipv4)
+          layer.add(:group, 'igmp.maddr', cursor.u32(4), type: :ipv4, offset: 4, length: 4)
           if version == 3
             sources = cursor.u16(10)
             cursor.check(8, 4 + sources * 4)
-            layer.add(:suppress, 'igmp.s', (cursor.u8(8) & 8).positive?)
-            layer.add(:robustness, 'igmp.qrv', cursor.u8(8) & 7)
-            layer.add(:interval, 'igmp.qqic', cursor.u8(9))
-            layer.add(:sources, 'igmp.num_src', sources)
-            sources.times { |i| layer.add(:"source_#{i}", 'igmp.saddr', cursor.u32(12 + i * 4), type: :ipv4) }
+            layer.add(:suppress, 'igmp.s', (cursor.u8(8) & 8).positive?, type: :boolean, offset: 8, length: 1)
+            layer.add(:robustness, 'igmp.qrv', cursor.u8(8) & 7, offset: 8, length: 1)
+            layer.add(:interval, 'igmp.qqic', cursor.u8(9), offset: 9, length: 1)
+            layer.add(:sources, 'igmp.num_src', sources, offset: 10, length: 2)
+            sources.times { |i| layer.add(:"source_#{i}", 'igmp.saddr', cursor.u32(12 + i * 4), type: :ipv4, offset: 12 + i * 4, length: 4) }
             pos = 12 + sources * 4
           end
         end

data/lib/redhound/protocols/ipv6.rb

@@ -23,8 +23,10 @@ module Redhound
       end
       # @rbs (Context ctx, Layer layer) -> void
       def dissect(ctx, layer)
+        ctx.extension_count = 0
         layer.diagnose(:error, :malformed, 'IPv6 version is not 6') if layer[:version] != 6
         layer.payload_end = layer.offset + 40 + layer[:plen]
+        layer.payload_offset = layer.payload_end if layer[:nxt] == 59
       end
       # @rbs (Context ctx, Layer layer) -> untyped
       def next_dissector(ctx, layer) = ctx.registry.lookup('ip.proto', layer[:nxt])
@@ -39,7 +41,7 @@ module Redhound
         ctx.extension_count += 1
         return layer.diagnose(:error, :malformed, 'more than 16 IPv6 extensions') if ctx.extension_count > 16
         parent = ctx.layers.last
-        type = parent.protocol == :ipv6 ? parent[:nxt] : parent[:next]
+        type = parent.protocol == :ipv6 ? parent[:nxt] : parent.protocol == :ipv4 ? parent[:proto] : parent[:next]
         cursor = ctx.cursor
         nxt = cursor.u8(0)
         layer.add(:next, 'ipv6.nxt', nxt, length: 1)
@@ -49,11 +51,12 @@ module Redhound
         if type == 44
           flags = cursor.u16(2)
           layer.add(:fragment_offset, 'ipv6.fragment.offset', flags & 0xfff8, offset: 2, length: 2)
-          layer.add(:more, 'ipv6.fragment.more', flags & 1)
+          layer.add(:more, 'ipv6.fragment.more', flags & 1, offset: 2, length: 2)
           layer.add(:identification, 'ipv6.fragment.id', cursor.u32(4), offset: 4, length: 4)
         end
         layer.header_length = length
         layer.payload_offset += length
+        layer.payload_offset = layer.payload_end if nxt == 59
       end
       # @rbs (Context ctx, Layer layer) -> untyped
       def next_dissector(ctx, layer)

data/lib/redhound/protocols/ntp.rb

@@ -17,8 +17,8 @@ module Redhound
           bit :mode, 'ntp.flags.mode', 3, enum: MODES
         end
         uint8 :stratum, 'ntp.stratum'
-        uint8 :poll, 'ntp.ppoll'
-        uint8 :precision, 'ntp.precision'
+        int8 :poll, 'ntp.ppoll'
+        int8 :precision, 'ntp.precision'
         uint32 :rootdelay, 'ntp.rootdelay'
         uint32 :rootdispersion, 'ntp.rootdispersion'
         uint32 :refid, 'ntp.refid'
@@ -30,8 +30,6 @@ module Redhound
 
       # @rbs (Context ctx, Layer layer) -> void
       def dissect(ctx, layer)
-        layer.values[:poll] -= 256 if layer[:poll] >= 128
-        layer.values[:precision] -= 256 if layer[:precision] >= 128
         layer.diagnose(:error, :malformed, 'invalid NTP version or mode') unless layer[:vn].between?(1, 4) && layer[:mode].between?(1, 7)
         if ctx.cursor.remaining > 48
           layer.add(:extension, 'ntp.extension', ctx.cursor.bytes(48, ctx.cursor.remaining - 48),

data/lib/redhound/protocols/tcp.rb

@@ -53,17 +53,25 @@ module Redhound
           return layer.diagnose(:error, :bad_length, 'truncated TCP option') if pos + 2 > hlen
           len = cursor.u8(pos + 1)
           return layer.diagnose(:error, :bad_length, 'invalid TCP option length') if len < 2 || pos + len > hlen
+          valid = case kind
+                  when 2 then len == 4
+                  when 3 then len == 3
+                  when 4 then len == 2
+                  when 5 then len >= 10 && (len - 2) % 8 == 0
+                  when 8 then len == 10
+                  when 34 then len == 2 || len.between?(6, 18)
+                  else true
+                  end
+          return layer.diagnose(:error, :bad_length, "invalid TCP option #{kind} length") unless valid
           case kind
-          when 2 then layer.add(:mss, 'tcp.options.mss_val', cursor.u16(pos + 2)) if len == 4
-          when 3 then layer.add(:wscale, 'tcp.options.wscale.shift', cursor.u8(pos + 2)) if len == 3
-          when 4 then layer.add(:sack_permitted, 'tcp.options.sack_perm', true, type: :boolean) if len == 2
-          when 5 then layer.add(:sack, 'tcp.options.sack', cursor.bytes(pos + 2, len - 2), type: :bytes)
+          when 2 then layer.add(:mss, 'tcp.options.mss_val', cursor.u16(pos + 2), offset: pos + 2, length: 2)
+          when 3 then layer.add(:wscale, 'tcp.options.wscale.shift', cursor.u8(pos + 2), offset: pos + 2, length: 1)
+          when 4 then layer.add(:sack_permitted, 'tcp.options.sack_perm', true, type: :boolean, offset: pos, length: 2)
+          when 5 then layer.add(:sack, 'tcp.options.sack', cursor.bytes(pos + 2, len - 2), type: :bytes, offset: pos + 2, length: len - 2)
           when 8
-            if len == 10
-              layer.add(:tsval, 'tcp.options.timestamp.tsval', cursor.u32(pos + 2))
-              layer.add(:tsecr, 'tcp.options.timestamp.tsecr', cursor.u32(pos + 6))
-            end
-          when 34 then layer.add(:tfo, 'tcp.options.tfo.cookie', cursor.bytes(pos + 2, len - 2), type: :bytes)
+            layer.add(:tsval, 'tcp.options.timestamp.tsval', cursor.u32(pos + 2), offset: pos + 2, length: 4)
+            layer.add(:tsecr, 'tcp.options.timestamp.tsecr', cursor.u32(pos + 6), offset: pos + 6, length: 4)
+          when 34 then layer.add(:tfo, 'tcp.options.tfo.cookie', cursor.bytes(pos + 2, len - 2), type: :bytes, offset: pos + 2, length: len - 2)
           end
           pos += len
         end

data/lib/redhound/protocols/tunnel.rb

@@ -18,7 +18,7 @@ module Redhound
         return layer.diagnose(:error, :malformed, 'unsupported GRE version or routing') unless (flags & 0x4007).zero?
         len += 4 if flags & 0x8000 != 0
         if flags & 0x2000 != 0
-          layer.add(:key, 'gre.key', ctx.cursor.u32(len))
+          layer.add(:key, 'gre.key', ctx.cursor.u32(len), offset: len, length: 4)
           len += 4
         end
         len += 4 if flags & 0x1000 != 0
@@ -38,7 +38,7 @@ module Redhound
       end
       # @rbs (Context ctx, Layer layer) -> void
       def dissect(ctx, layer)
-        layer.add(:vni, 'vxlan.vni', layer[:vni_word] >> 8)
+        layer.add(:vni, 'vxlan.vni', layer[:vni_word] >> 8, offset: 4, length: 3)
         layer.diagnose(:error, :malformed, 'VXLAN I flag is unset') if layer[:flags] & 0x08000000 == 0
       end
       # @rbs (Context ctx, Layer layer) -> untyped

data/lib/redhound/stream_dissector.rb

@@ -58,7 +58,7 @@ module Redhound
     end
 
     # @rbs () -> Integer
-    def bytesize = @buffers.sum(&:bytesize) + @origins.sum { |origins| origins.size * 64 }
+    def bytesize = @buffers.sum { |buffer| buffer.empty? ? 0 : buffer.bytesize * 2 + 40 } + @origins.sum { |origins| origins.size * 128 }
 
     # @rbs (Integer direction, Integer length) -> Array[Integer]
     def consume_origins(direction, length)
@@ -108,7 +108,7 @@ module Redhound
       response = header.start_with?('HTTP/')
       status = response ? header.split(' ', 3)[1].to_i : 0
       return head_end if response && (head_response || status.between?(100, 199) || [204, 304].include?(status))
-      lengths = header.scan(/\r\ncontent-length:[ \t]*([^\r\n]*)/in).flatten.flat_map { |value| value.split(',').map(&:strip) }
+      lengths = header.scan(/\r\ncontent-length:[ \t]*([^\r\n]*)/in).flatten.flat_map { |value| value.empty? ? [''] : value.split(',', -1).map(&:strip) }
       transfer = header.scan(/\r\ntransfer-encoding:[ \t]*([^\r\n]*)/in).flatten.join(',').downcase.split(',').map(&:strip)
       if (!lengths.empty? && !transfer.empty?) || lengths.uniq.size > 1 || lengths.any? { |value| !value.match?(/\A[0-9]+\z/n) }
         return head_end # The packet parser reports conflicting or invalid framing.

data/lib/redhound/version.rb

@@ -3,5 +3,5 @@
 
 module Redhound
   # Published gem version.
-  VERSION = '2.0.0.rc1'
+  VERSION = '2.0.0.rc2'
 end

data/sig/generated/redhound/analysis/flow_table.rbs

@@ -27,6 +27,10 @@ module Redhound
 
       attr_reader http_methods: untyped
 
+      attr_reader probes: untyped
+
+      attr_reader probe_disabled: untyped
+
       attr_accessor last_ns: untyped
 
       attr_accessor closed_ns: untyped
@@ -73,8 +77,8 @@ module Redhound
       # @rbs (Integer now_ns) -> void
       def expire: (Integer now_ns) -> void
 
-      # @rbs () -> Flow?
-      def evict: () -> Flow?
+      # @rbs (?Symbol? type) -> Flow?
+      def evict: (?Symbol? type) -> Flow?
 
       # @rbs (Flow flow) -> void
       def discard: (Flow flow) -> void

data/sig/generated/redhound/analysis/ip_reassembler.rbs

@@ -33,6 +33,18 @@ module Redhound
       # @rbs () -> Integer
       def bytesize: () -> Integer
 
+      # @rbs (untyped state) -> Integer
+      def state_bytesize: (untyped state) -> Integer
+
+      # @rbs (untyped key) -> untyped
+      def remove: (untyped key) -> untyped
+
+      # @rbs () -> untyped
+      def remove_oldest: () -> untyped
+
+      # @rbs () -> Integer
+      def finish: () -> Integer
+
       # @rbs () -> Integer
       def size: () -> Integer
     end

data/sig/generated/redhound/analysis/stats.rbs

@@ -38,6 +38,9 @@ module Redhound
 
         # @rbs () -> Hash[Symbol, untyped]
         def to_h: () -> Hash[Symbol, untyped]
+
+        # @rbs (Integer interval) -> Hash[Symbol, Integer]
+        def interval_row: (Integer interval) -> Hash[Symbol, Integer]
       end
 
       # @api private

data/sig/generated/redhound/analysis/tcp_reassembler.rbs

@@ -14,6 +14,18 @@ module Redhound
       # @rbs (Flow flow, Integer direction, TcpStream stream, untyped application, Packet? packet) -> Array[Layer]
       def deliver: (Flow flow, Integer direction, TcpStream stream, untyped application, Packet? packet) -> Array[Layer]
 
+      # @rbs (Flow flow, Integer direction, String data, Integer origin, Packet? packet) -> Array[Layer]
+      def application_data: (Flow flow, Integer direction, String data, Integer origin, Packet? packet) -> Array[Layer]
+
+      # @rbs (untyped klass, Flow flow, Integer direction, Layer layer) -> untyped
+      def create_application: (untyped klass, Flow flow, Integer direction, Layer layer) -> untyped
+
+      # @rbs (Flow flow, Integer direction, untyped application, Symbol method, *untyped arguments) -> Array[Layer]
+      def invoke: (Flow flow, Integer direction, untyped application, Symbol method, *untyped arguments) -> Array[Layer]
+
+      # @rbs (Flow flow, Integer direction, Symbol protocol, StandardError error) -> Layer
+      def application_error: (Flow flow, Integer direction, Symbol protocol, StandardError error) -> Layer
+
       # @rbs (Packet packet, Array[Layer] layers) -> void
       def attach: (Packet packet, Array[Layer] layers) -> void
 

data/sig/generated/redhound/capture/bsd/ifreq.rbs

@@ -0,0 +1,15 @@
+# Generated from lib/redhound/capture/bsd/ifreq.rb with RBS::Inline
+
+module Redhound
+  module Capture
+    module Bsd
+      # macOS interface metadata can be queried without opening a BPF device.
+      module Ifreq
+        SIOCGIFMTU: ::Integer
+
+        # @rbs (String name, index: Integer, flags: Integer, link_address: String?) -> Interface
+        def self.interface: (String name, index: Integer, flags: Integer, link_address: String?) -> Interface
+      end
+    end
+  end
+end

data/sig/generated/redhound/capture/file_source.rbs

@@ -5,6 +5,27 @@ module Redhound
   module Capture
     # @api private
     class FileSource < Source
+      class ReadStopped < StandardError
+      end
+
+      # @api private
+      class FileInput
+        # @rbs (::File io) -> void
+        def initialize: (::File io) -> void
+
+        # @rbs (Integer length) -> String?
+        def read: (Integer length) -> String?
+      end
+
+      # Nonregular inputs need bounded polling so Source#stop can interrupt an idle pipe.
+      class StreamInput
+        # @rbs (IO io, Source source) -> void
+        def initialize: (IO io, Source source) -> void
+
+        # @rbs (Integer length) -> String?
+        def read: (Integer length) -> String?
+      end
+
       attr_reader reader: untyped
 
       # @rbs (untyped input, ?filter: String?) -> void
@@ -18,6 +39,9 @@ module Redhound
       # @rbs (?timeout: Numeric?) -> Packet?
       def next_packet: (?timeout: Numeric?) -> Packet?
 
+      # @rbs (Filter::Program? program) -> void
+      def attach_filter: (Filter::Program? program) -> void
+
       # @rbs () -> Integer
       def linktype: () -> Integer
 
@@ -27,8 +51,17 @@ module Redhound
       # @rbs () -> Stats
       def stats: () -> Stats
 
+      # @rbs () -> void
+      def stop: () -> void
+
       # @rbs () -> void
       def close: () -> void
+
+      private
+
+      # A single bounded worker preserves partial records across caller timeouts.
+      # @rbs (Numeric? timeout) -> (Packet | nil | :wait_readable)
+      def read_packet: (Numeric? timeout) -> (Packet | nil | :wait_readable)
     end
   end
 end

data/sig/generated/redhound/capture/linux/packet_socket.rbs

@@ -28,6 +28,13 @@ module Redhound
         # @rbs () -> void
         def close: () -> void
 
+        # Positive filter returns select packets; the source applies its configured snaplen.
+        # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> Array[[Integer, Integer, Integer, Integer]]
+        def receive_filter: (Array[[ Integer, Integer, Integer, Integer ]] instructions) -> Array[[ Integer, Integer, Integer, Integer ]]
+
+        # @rbs () -> void
+        def warn_vlan_offload: () -> void
+
         # @rbs () -> void
         def close_resources: () -> void
 

data/sig/generated/redhound/dissector.rbs

@@ -25,6 +25,10 @@ module Redhound
       # Append a typed fixed-width field with optional format/enum metadata.
       def field: (Symbol type, Symbol key, String name, **untyped opts) -> void
 
+      # @rbs (Symbol key, String name, **untyped opts) -> void
+      # Append a signed 8-bit field.
+      def int8: (Symbol key, String name, **untyped opts) -> void
+
       # @rbs (Symbol key, String name, **untyped opts) -> void
       # Append an unsigned 8-bit field.
       def uint8: (Symbol key, String name, **untyped opts) -> void

data/sig/generated/redhound/file/format.rbs

@@ -7,6 +7,12 @@ module Redhound
     module Format
       MAX_RECORD: untyped
 
+      MAX_INTERFACES: ::Integer
+
+      MAX_INTERFACE_METADATA: untyped
+
+      MAX_OPTIONS: ::Integer
+
       PCAP_MAGICS: untyped
 
       PCAPNG_MAGIC: untyped

data/sig/generated/redhound/file/pcapng_reader.rbs

@@ -44,8 +44,8 @@ module Redhound
       # @rbs (Integer index) -> Capture::Interface
       def interface_at: (Integer index) -> Capture::Interface
 
-      # @rbs (String body, Integer offset) -> Hash[Integer, Array[String]]
-      def options: (String body, Integer offset) -> Hash[Integer, Array[String]]
+      # @rbs (String body, Integer offset, Array[Integer] allowed) -> Hash[Integer, Array[String]]
+      def options: (String body, Integer offset, Array[Integer] allowed) -> Hash[Integer, Array[String]]
 
       # @rbs (String body, Integer size) -> void
       def require_size: (String body, Integer size) -> void

data/sig/generated/redhound/filter/bpf/vm.rbs

@@ -7,6 +7,8 @@ module Redhound
     module BPF
       # @api private
       class VM
+        LOAD_FORMATS: untyped
+
         # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> void
         def initialize: (Array[[ Integer, Integer, Integer, Integer ]] instructions) -> void
 

data/sig/generated/redhound/packet.rbs

@@ -73,5 +73,10 @@ module Redhound
     # @rbs () -> Hash[Symbol, untyped]
     # Return a JSON-compatible packet matching docs/json-schema.json.
     def to_h: () -> Hash[Symbol, untyped]
+
+    private
+
+    # @rbs (String? text) -> String?
+    def json_text: (String? text) -> String?
   end
 end

data/sig/generated/redhound/protocols/data.rbs

@@ -5,6 +5,8 @@ module Redhound
   module Protocols
     # @api private
     class Data < Dissector
+      LENGTH_FIELD: untyped
+
       # @rbs (Context ctx, Layer layer) -> void
       def dissect: (Context ctx, Layer layer) -> void
 

data/sig/generated/redhound/protocols/dhcp.rbs

@@ -15,11 +15,14 @@ module Redhound
       # @rbs (Cursor cursor, Layer layer, Integer pos, Integer ending, untyped options) -> void
       def read_options: (Cursor cursor, Layer layer, Integer pos, Integer ending, untyped options) -> void
 
-      # @rbs (Layer layer, Integer code, String value, Integer offset) -> void
-      def decode_option: (Layer layer, Integer code, String value, Integer offset) -> void
+      # @rbs (Layer layer, Integer code, String value, untyped entries) -> void
+      def decode_option: (Layer layer, Integer code, String value, untyped entries) -> void
 
-      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length) -> void
-      def put: (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length) -> void
+      # @rbs (untyped entries, Integer logical) -> Integer
+      def wire_offset: (untyped entries, Integer logical) -> Integer
+
+      # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length, ?untyped entries) -> void
+      def put: (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length, ?untyped entries) -> void
 
       # @rbs (Layer layer) -> String
       def summary: (Layer layer) -> String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: redhound
 version: !ruby/object:Gem::Version
-  version: 2.0.0.rc1
+  version: 2.0.0.rc2
 platform: ruby
 authors:
 - Yudai Takada
@@ -41,6 +41,7 @@ files:
 - lib/redhound/capture.rb
 - lib/redhound/capture/bsd/bpf_device.rb
 - lib/redhound/capture/bsd/constants.rb
+- lib/redhound/capture/bsd/ifreq.rb
 - lib/redhound/capture/file_source.rb
 - lib/redhound/capture/interface.rb
 - lib/redhound/capture/linktype.rb
@@ -124,6 +125,7 @@ files:
 - sig/generated/redhound/capture.rbs
 - sig/generated/redhound/capture/bsd/bpf_device.rbs
 - sig/generated/redhound/capture/bsd/constants.rbs
+- sig/generated/redhound/capture/bsd/ifreq.rbs
 - sig/generated/redhound/capture/file_source.rbs
 - sig/generated/redhound/capture/interface.rbs
 - sig/generated/redhound/capture/linktype.rbs