vanken 0.1.0 → 0.3.0

data/lib/vanken/app/document.rb

@@ -9,27 +9,36 @@ require_relative "../capture/receiver"
 require_relative "../capture/analyzer"
 require_relative "../capture/analyzer_process"
 require_relative "document_jobs"
+require_relative "../config/analysis_settings"
+require_relative "document_analysis"
+require_relative "navigation"
+require_relative "../config/columns"
 
 module Vanken
   module App
     class Document
       include DocumentJobs
+      include DocumentAnalysis
+      include Navigation
       attr_reader :store, :columns, :annotations, :error, :path, :source, :progress, :filter,
-                  :marked, :ignored, :time_references, :catalog, :analysis_options
+                  :marked, :ignored, :time_references, :catalog, :analysis_options, :analysis_gateway_options
       attr_accessor :frame_latency, :scanner
 
-      def initialize(on_update: nil, preferences: nil, store: nil, scanner: nil, process_analysis: true)
+      def initialize(on_update: nil, preferences: nil, store: nil, scanner: nil, process_analysis: true, decode_as: nil, plugins: nil)
+        @verify_checksums = preferences&.get("analysis.verify_checksums") || false
+        settings = preferences && Config::AnalysisSettings.new(directory: preferences.directory)
+        @analysis_gateway_options = {verify_checksums: @verify_checksums, decode_as: decode_as || settings&.decode_as || [], plugins: plugins || settings&.plugins || []}.freeze
+        @dissector = Gateway::Dissector.new(**@analysis_gateway_options)
         @store = store || Core::FrameStore.new
         @columns = Core::ColumnStore.new
         @annotations = Core::AnnotationStore.new(@store.directory)
         @cache = Core::RowCache.new(limit: preferences&.get("packet_list.row_cache_rows") || 20_000)
-        @verify_checksums = preferences&.get("analysis.verify_checksums") || false
-        @dissector = Gateway::Dissector.new(verify_checksums: @verify_checksums)
         @process_analysis = process_analysis
         @analysis_options = {max_state_bytes: (preferences&.get("analysis.max_state_mib") || 256) << 20,
                              max_flows: preferences&.get("analysis.max_flows") || 100_000}.freeze
-        @catalog = Gateway::FieldCatalog.new
+        @catalog = Gateway::FieldCatalog.new(registry: @dissector.registry)
         @mutex, @condition = Mutex.new, ConditionVariable.new
+        @close_mutex = Mutex.new
         @jobs, @count, @generation = [], 0, 0
         @display = nil
         @marked, @ignored, @time_references = Set.new, Set.new, Set.new
@@ -38,15 +47,7 @@ module Vanken
         @scanner = scanner
         @scan_concurrency = preferences&.get("analysis.workers") || 4
         @filter_tasks = []
-        @details = File.open(File.join(@store.directory, "details.jsonl"), "w+b", 0o600)
-        @detail_reader = File.open(File.join(@store.directory, "details.jsonl"), "rb")
-        @detail_index = File.open(File.join(@store.directory, "reassembled.idx"), "w+b", 0o600)
-        @detail_offsets = {}
-        @summaries = File.open(File.join(@store.directory, "summaries.bin"), "w+b", 0o600)
-        @summary_index = File.open(File.join(@store.directory, "summaries.idx"), "w+b", 0o600)
-        @summary_reader = File.open(File.join(@store.directory, "summaries.bin"), "rb")
-        @summary_index_reader = File.open(File.join(@store.directory, "summaries.idx"), "rb")
-        @summary_count = 0
+        open_analysis_files
         @frame_latency = 0.0
       end
 
@@ -75,12 +76,18 @@ module Vanken
       def displayed_count = @mutex.synchronize { @display ? @display.size : @count }
       def number_at(index) = @mutex.synchronize { @display ? @display.fetch(index) : (index + 1).tap { |number| raise IndexError unless number.between?(1, @count) } }
       def display_numbers = @mutex.synchronize { @display ? @display.dup : (1..@count).to_a }
-      def dirty? = @dirty
+      def dirty? = @dirty || (@source == :live && @store.count > (@saved_count || 0))
       def loading? = !@analyzed && !@cancelled
       def cancelled? = @cancelled
       def received? = @received
       def complete? = @analyzed
       def closing? = !!@closing
+      def analysis_stopped? = closing? || !!@reanalysis_cancelled
+      def capture_stats
+        value = @reader.respond_to?(:stats) && @reader.stats
+        value.respond_to?(:to_h) ? value.to_h : {}
+      end
+      def expert_summary = @mutex.synchronize { {count: @annotations.expert_count, severity: @annotations.expert_max} }
       def stream_frames(stream) = @mutex.synchronize { @annotations.streams[stream].dup }
       def packet(number) = @dissector.dissect(@store.read(number))
       # @rbs (Integer number) -> Gateway::PacketSnapshot?
@@ -93,7 +100,33 @@ module Vanken
         base = @mutex.synchronize { @columns[number] }
         frame = @store.metadata(number)
         info = @cache.fetch(number) { persisted_summary(number) || persisted_details(number)&.fetch("info", nil) || packet(number).info }
-        base.merge(no: number, number: number, timestamp_ns: frame[:timestamp_ns], length: frame[:original_length], info: info)
+        base.merge(no: number, number: number, timestamp_ns: frame[:timestamp_ns], length: frame[:original_length], info: info).merge(custom_row(number))
+      end
+      def custom_columns = @custom_columns || []
+      def custom_columns=(columns)
+        raise Vanken::ConfigError, "invalid custom columns" unless columns.is_a?(Array) && columns.size <= 64 && columns.all? do |item|
+          item.is_a?(Hash) && Config::Columns.valid_field?(item["field"]) && item["key"] == "field:#{item['field']}" && [true, false].include?(item["visible"])
+        end
+        saved = columns.map { |item| item.slice("key", "field", "visible").transform_values { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze }.freeze
+        @mutex.synchronize do
+          unless saved == @custom_columns
+            @custom_columns = saved
+            @sort_generation = (@sort_generation || 0) + 1
+          end
+        end
+      end
+      def custom_row(number)
+        fields = custom_columns.select { |item| item["visible"] }
+        return {} if fields.empty?
+        packet = view(number)
+        resolver = Core::DisplayFilter::FieldResolver.new(@catalog)
+        fields.to_h do |item|
+          field = item.fetch("field")
+          [item.fetch("key").to_sym, Config::Columns.display(packet.values(field), type: resolver.resolve(field).type)]
+        end
+      end
+      def custom_sort_value(number, field)
+        Config::Columns.sort_value(view(number).values(field).first, type: Core::DisplayFilter::FieldResolver.new(@catalog).resolve(field).type)
       end
       def details(number)
         saved = persisted_details(number)
@@ -112,7 +145,7 @@ module Vanken
             program, generation, snapshot = @mutex.synchronize { [@filter, @generation, @filter_context] }
             matched = !program || program.match?(view(number, packet: packet, snapshot: snapshot))
             committed = @mutex.synchronize do
-              next false if generation != @generation
+              next false if generation != @generation || !snapshot.equal?(@filter_context)
               committing = true
               @columns.append(columns)
               @annotations.append(number, annotation)
@@ -123,8 +156,8 @@ module Vanken
                 @detail_index.write([number, @detail_offsets[number]].pack("Q<Q<"))
                 @detail_index.flush
               end
+              record_live_predecessors(number, number, matched ? [number] : [], context: snapshot)
               @count = number
-              @dirty = true if @source == :live
               @display << number if @display && matched
               true
             end
@@ -142,6 +175,7 @@ module Vanken
           @columns.append(source: "", destination: "", protocol: "Malformed", src_port: -1, dst_port: -1, ip_proto: -1, layers: [])
           @annotations.append(number, tcp_stream: -1, seq_rel: -1, ack_rel: -1, analysis_flags: [], expert_max: 3,
             expert_items: [{severity: :error, code: "vanken.internal_error", protocol: "vanken", message: error.message}], extra: {})
+          record_live_predecessors(number, number, [])
           @count = number
           @display << number if @display && !@filter
         end
@@ -149,14 +183,20 @@ module Vanken
       end
       # Only immutable context for this unpublished range crosses the worker pipe.
       def analysis_configuration(first, last)
+        raise Vanken::Error, "invalid analysis range" unless first.is_a?(Integer) && last.is_a?(Integer) && first.positive? && (last - first + 1).between?(1, 256)
         @mutex.synchronize do
           historical = !!@filter_context
           current = @filter_context || {marked: @marked, ignored: @ignored, references: @time_references,
             predecessors: nil, limit: @count, last_displayed: @display ? @display.last : @count}
-          snapshot = current.merge(marked: current[:marked].select { |n| n.between?(first, last) }.to_set,
+          predecessors = if current[:live_predecessors]
+            (first..last).to_h { |number| [number, displayed_predecessor(number, current)] }
+          else
+            current[:predecessors]&.slice(*(first..last).to_a)
+          end
+          snapshot = current.except(:live_predecessors, :live_predecessor_start).merge(marked: current[:marked].select { |n| n.between?(first, last) }.to_set,
             ignored: current[:ignored].select { |n| n.between?(first, last) }.to_set,
-            references: current[:references].dup, predecessors: nil,
-            unfiltered_predecessor: historical && current[:predecessors].nil?)
+            references: current[:references].dup, predecessors: predecessors,
+            unfiltered_predecessor: historical && current[:predecessors].nil? && !current[:live_predecessors])
           {expression: @filter&.expression || "", generation: @generation, snapshot: snapshot,
            historical_context: historical, context_token: @filter_context&.object_id}
         end
@@ -185,8 +225,8 @@ module Vanken
             @summary_index.write(offsets)
             [@annotations, @details, @detail_index, @summaries, @summary_index].each(&:flush)
             @catalog.merge(batch[:fields])
+            record_live_predecessors(first, last, batch[:matches])
             @summary_count = @count = last
-            @dirty = true if @source == :live
             @display.concat(batch[:matches]) if @display
             true
           end
@@ -199,7 +239,18 @@ module Vanken
         notify
       end
       def receiving_done = (@received = true; signal)
-      def analyzing_done = (@annotations.flush; @analyzed = true; notify(force: true))
+      def analyzing_done
+        @annotations.flush
+        @mutex.synchronize do
+          @filter_context = nil if @reanalysis_context && @filter_context.equal?(@reanalysis_context)
+          @reanalysis_context = nil
+          @rebuilding_filter_basis = nil
+          @rebuilding = false
+          @reanalysis_cancelled = false
+          @analyzed = true
+        end
+        notify(force: true)
+      end
       def signal = @mutex.synchronize { @condition.broadcast }
       def wait_for_frames = @mutex.synchronize { @condition.wait(@mutex, 0.05) }
       def fail(error) = (@error = error; notify(force: true))
@@ -227,6 +278,15 @@ module Vanken
         signal
         self
       end
+      def cancel_reanalysis
+        @mutex.synchronize do
+          if @rebuilding
+            @reanalysis_cancelled = true
+            @condition.broadcast
+          end
+        end
+        self
+      end
       def wait(timeout = nil)
         deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
         @jobs.each do |job|
@@ -237,22 +297,25 @@ module Vanken
         self
       end
       def close
-        return self if @closed
-        @closing = true
-        cancel
-        cancel_scan
-        wait(3)
-        @annotations.close
-        @details.close
-        @detail_reader.close
-        @detail_index.close
-        @summaries.close
-        @summary_index.close
-        @summary_reader.close
-        @summary_index_reader.close
-        @store.close
-        @closed = true
-        self
+        @close_mutex.synchronize do
+          return self if @closed
+          @closing = true
+          cancel_search
+          cancel
+          cancel_scan
+          wait(3)
+          @annotations.close
+          @details.close
+          @detail_reader.close
+          @detail_index.close
+          @summaries.close
+          @summary_index.close
+          @summary_reader.close
+          @summary_index_reader.close
+          @store.close
+          @closed = true
+          self
+        end
       end
 
       private

data/lib/vanken/app/document_analysis.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Vanken
+  module App
+    module DocumentAnalysis
+      def self.included(base) = base.extend(ClassMethods)
+
+      module ClassMethods
+        def recover(directory, **options)
+          store = Core::FrameStore.recover(directory)
+          new(store: store, **options).analyze_store
+        rescue StandardError
+          store&.close(remove: false)
+          raise
+        end
+      end
+
+      def analyze_store
+        @source ||= :live
+        @dirty = @source == :live unless @rebuilding
+        @received, @analyzed, @cancelled = true, false, false
+        @analyzer = @process_analysis ? Capture::AnalyzerProcess.new(self, verify_checksums: @verify_checksums) : Capture::Analyzer.new(self, @dissector)
+        @jobs << thread { @analyzer.run }
+        self
+      end
+
+      def reanalyze(decode_as: @analysis_gateway_options[:decode_as], plugins: @analysis_gateway_options[:plugins], preferences: nil)
+        raise Vanken::Error, "stop capture or finish loading before changing analysis" if loading? || closing?
+        options = @analysis_gateway_options.merge(decode_as: decode_as, plugins: plugins).freeze
+        options = options.merge(verify_checksums: preferences.get("analysis.verify_checksums")).freeze if preferences
+        dissector = Gateway::Dissector.new(**options)
+        snapshot = @mutex.synchronize { reanalysis_snapshot }
+        cancel_search if respond_to?(:cancel_search)
+        cancel_scan
+        wait(3)
+        @mutex.synchronize do
+          @analysis_gateway_options, @dissector = options, dissector
+          @verify_checksums = options[:verify_checksums]
+          if preferences
+            @analysis_options = {max_state_bytes: preferences.get("analysis.max_state_mib") << 20, max_flows: preferences.get("analysis.max_flows")}.freeze
+            @scan_concurrency = preferences.get("analysis.workers")
+            @cache = Core::RowCache.new(limit: preferences.get("packet_list.row_cache_rows"))
+          end
+          @columns = Core::ColumnStore.new
+          @annotations.close
+          @annotations = Core::AnnotationStore.new(@store.directory)
+          @cache.clear
+          @catalog = Gateway::FieldCatalog.new(registry: @dissector.registry)
+          @count, @display, @error = 0, (@filter ? [] : nil), nil
+          @rebuilding = true
+          @reanalysis_cancelled = false
+          @rebuilding_filter_basis = @filter_basis
+          @filter_context = @reanalysis_context = snapshot
+          [@details, @detail_reader, @detail_index, @summaries, @summary_index, @summary_reader, @summary_index_reader].each(&:close)
+          open_analysis_files
+        end
+        analyze_store
+      end
+
+      private
+
+      def open_analysis_files
+        @details = File.open(File.join(@store.directory, "details.jsonl"), "w+b", 0o600)
+        @detail_reader = File.open(File.join(@store.directory, "details.jsonl"), "rb")
+        @detail_index = File.open(File.join(@store.directory, "reassembled.idx"), "w+b", 0o600)
+        @detail_offsets = {}
+        @summaries = File.open(File.join(@store.directory, "summaries.bin"), "w+b", 0o600)
+        @summary_index = File.open(File.join(@store.directory, "summaries.idx"), "w+b", 0o600)
+        @summary_reader = File.open(File.join(@store.directory, "summaries.bin"), "rb")
+        @summary_index_reader = File.open(File.join(@store.directory, "summaries.idx"), "rb")
+        @summary_count = 0
+      end
+    end
+  end
+end

data/lib/vanken/app/document_jobs.rb

@@ -9,7 +9,8 @@ module Vanken
         cancel_scan
         if expression.empty?
           @mutex.synchronize do
-            @filter = @filter_context = @display = @progress = @filter_job = nil
+            @filter = @filter_context = @filter_basis = @display = @progress = @filter_job = nil
+            @filter_live_predecessors = @filter_live_predecessor_start = nil
           end
           notify(force: true)
           return self
@@ -18,6 +19,9 @@ module Vanken
           context = filter_snapshot(displayed_delta: program.fields.include?("frame.time_delta_displayed"))
           @filter = program
           @filter_context = context
+          @filter_basis = context
+          @filter_live_predecessors = program.fields.include?("frame.time_delta_displayed") ? "".b : nil
+          @filter_live_predecessor_start = @filter_live_predecessors ? @count + 1 : nil
           # Reserve the history's capacity before publishing matches without placeholder rows.
           @display = Array.new(@count)
           @display[0, @count] = []
@@ -88,6 +92,7 @@ module Vanken
       end
 
       def cancel_scan
+        cancel_search
         tasks = @mutex.synchronize do
           @generation += 1
           @progress = nil
@@ -109,7 +114,7 @@ module Vanken
         end
         predecessors = (first...last).to_h { |number| [number.to_s, displayed_predecessor(number, snapshot)] }
         {"spool" => @store.directory, "expr" => expression, "from" => first, "to" => last,
-         "decode_as" => [], "plugins" => [], "annotations_json" => snapshot[:annotations_json],
+         "decode_as" => @analysis_gateway_options[:decode_as], "plugins" => @analysis_gateway_options[:plugins], "annotations_json" => snapshot[:annotations_json],
          "marked" => snapshot[:marked].select { |number| number >= first && number < last },
          "ignored" => snapshot[:ignored].select { |number| number >= first && number < last },
          "time_references_ns" => snapshot[:references].to_h { |number| [number.to_s, @store.metadata(number)[:timestamp_ns]] },
@@ -118,13 +123,19 @@ module Vanken
       end
 
       def displayed_predecessor(number, snapshot)
+        if (packed = snapshot[:live_predecessors]) && number >= snapshot[:live_predecessor_start]
+          offset = (number - snapshot[:live_predecessor_start]) * 8
+          return packed.unpack1("Q<", offset: offset) if offset < packed.bytesize
+        end
         return number - 1 unless snapshot[:predecessors]
         return snapshot[:last_displayed] || 0 if number > snapshot[:limit]
         snapshot[:predecessors].fetch(number, 0)
       end
 
       def sort(key, direction = :asc)
+        cancel_search
         raise ArgumentError, "invalid sort direction" unless %i[asc desc].include?(direction)
+        custom_field = custom_columns.find { |item| item["key"] == key.to_s }&.fetch("field")
         generation, sort_generation, filter_job = @mutex.synchronize do
           @sort_generation = (@sort_generation || 0) + 1
           [@generation, @sort_generation, @filter_job]
@@ -134,11 +145,15 @@ module Vanken
           next if generation != @generation || sort_generation != @sort_generation || @closing
           numbers = display_numbers
           values = numbers.to_h do |number|
-            value = case key.to_sym
-            when :no, :number then number
-            when :time then @store.metadata(number)[:timestamp_ns]
-            when :length then @store.metadata(number)[:original_length]
-            else row(number).fetch(key.to_sym)
+            value = if custom_field
+              custom_sort_value(number, custom_field)
+            else
+              case key.to_sym
+              when :no, :number then number
+              when :time then @store.metadata(number)[:timestamp_ns]
+              when :length then @store.metadata(number)[:original_length]
+              else row(number).fetch(key.to_sym)
+              end
             end
             [number, value]
           end
@@ -155,7 +170,7 @@ module Vanken
       def save(path, format: nil, numbers: nil)
         @error = nil
         format ||= File.extname(path) == ".pcap" ? :pcap : :pcapng
-        limit = count
+        limit = @store.durable_count
         @save_job = thread do
           temporary = Tempfile.create([".vanken-", ".tmp"], File.dirname(File.expand_path(path)))
           begin
@@ -168,7 +183,8 @@ module Vanken
             temporary.close
             File.rename(temporary.path, File.expand_path(path))
             @mutex.synchronize do
-              @dirty = false if !numbers && @count == limit && @store.count == limit
+              @saved_count = limit unless numbers
+              @dirty = false if !numbers && @store.count == limit
               @path = File.expand_path(path) unless numbers
             end
             notify(force: true)
@@ -188,6 +204,33 @@ module Vanken
 
       private
       def stale_job?(generation) = @closing || generation != @generation
+      # Retain only post-filter arrivals, at eight bytes per packet, and only for
+      # displayed-delta filters. Rebuilds read this basis without replacing it.
+      def record_live_predecessors(first, last, matches, context: @filter_context)
+        return unless @filter_live_predecessors
+        return if @rebuilding && @filter_basis.equal?(@rebuilding_filter_basis)
+        previous = (@display ? @display.last : @count) || 0
+        cursor = 0
+        (first..last).each do |number|
+          if number >= @filter_live_predecessor_start
+            raise Vanken::Error, "nonsequential displayed-delta history" unless number == @filter_live_predecessor_start + (@filter_live_predecessors.bytesize / 8)
+            predecessor = context ? displayed_predecessor(number, context) : previous
+            @filter_live_predecessors << [predecessor].pack("Q<")
+          end
+          if matches[cursor] == number
+            previous = number
+            cursor += 1
+          end
+        end
+      end
+
+      def reanalysis_snapshot
+        basis = @filter_basis || filter_snapshot(displayed_delta: !!@filter&.fields&.include?("frame.time_delta_displayed"))
+        return basis unless @filter_live_predecessors
+        basis.merge(live_predecessors: @filter_live_predecessors.dup.freeze,
+          live_predecessor_start: @filter_live_predecessor_start, limit: @count).freeze
+      end
+
       def filter_snapshot(displayed_delta: true)
         predecessors = @display.each_with_index.to_h { |number, index| [number, index.zero? ? 0 : @display[index - 1]] }.freeze if displayed_delta && @display
         {marked: @marked.dup.freeze, ignored: @ignored.dup.freeze, references: @time_references.dup.freeze,

data/lib/vanken/app/expert_info.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Vanken
+  module App
+    ExpertRow = Data.define(:severity, :code, :protocol, :message, :count, :numbers)
+
+    module ExpertInfo
+      def self.rows(document, displayed_only: false)
+        displayed = document.display_numbers.to_set if displayed_only
+        groups = {}
+        document.annotations.experts.dup.each do |number, items|
+          next if displayed && !displayed.include?(number)
+          items.each do |item|
+            key = [Gateway::Severity.normalize(item[:severity]), item[:code], item[:protocol]]
+            group = (groups[key] ||= {message: item[:message], count: 0, numbers: []})
+            group[:count] += 1
+            group[:numbers] << number unless group[:numbers].last == number
+          end
+        end
+        groups.map do |(severity, code, protocol), value|
+          ExpertRow.new(severity: severity, code: code, protocol: protocol, **value.merge(numbers: value[:numbers].freeze))
+        end.sort_by { |row| [-Gateway::Severity.rank(row.severity), row.protocol, row.code] }
+      end
+    end
+  end
+end

data/lib/vanken/app/io_graph.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "../core/display_filter/compiler"
+
+module Vanken
+  module App
+    IOPoint = Data.define(:interval, :start_ns, :packets, :bytes)
+    IOSeries = Data.define(:expression, :interval_ns, :points, :omitted_intervals)
+
+    module IOGraph
+      INTERVALS = [0.01, 0.1, 1, 10, 60].freeze
+
+      def self.build(document, interval: 1, series: [""], displayed_only: false, cancelled: nil)
+        raise ArgumentError, "invalid I/O interval" unless INTERVALS.include?(interval)
+        raise ArgumentError, "I/O graph needs 1-64 series" unless series.size.between?(1, 64) && series.all? { |expression| expression.is_a?(String) }
+        interval_ns = (interval * 1_000_000_000).to_i
+        programs = series.map { |expression| Core::DisplayFilter.compile(expression, catalog: document.catalog) }
+        numbers = displayed_only ? document.display_numbers : (1..document.count)
+        start = document.count.zero? ? 0 : document.store.metadata(1)[:timestamp_ns]
+        bins = series.map { {} }
+        last = 0
+        numbers.each do |number|
+          raise Vanken::Error, "operation cancelled" if document.closing? || cancelled&.call
+          metadata = document.store.metadata(number)
+          index = [(metadata[:timestamp_ns] - start) / interval_ns, 0].max
+          last = [last, index].max
+          view = nil
+          programs.each_with_index do |program, position|
+            next unless series[position].empty? || program.match?(view ||= document.view(number))
+            row = (bins[position][index] ||= [0, 0])
+            row[0] += 1
+            row[1] += metadata[:original_length]
+          end
+        end
+        # ponytail: retain at most 100,000 intervals; coarsen the selected interval for longer captures.
+        first = [last - 99_999, 0].max
+        series.each_with_index.map do |expression, position|
+          points = (document.count.zero? ? [] : (first..last)).map do |index|
+            packets, bytes = bins[position].fetch(index, [0, 0])
+            IOPoint.new(interval: index, start_ns: start + (index * interval_ns), packets: packets, bytes: bytes)
+          end
+          IOSeries.new(expression: expression, interval_ns: interval_ns, points: points.freeze, omitted_intervals: first)
+        end
+      end
+    end
+  end
+end

data/lib/vanken/app/navigation.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require_relative "search_job"
+
+module Vanken
+  module App
+    module Navigation
+      def displayed_index(number)
+        @mutex.synchronize { @display ? @display.index(number) : (number.is_a?(Integer) && number.between?(1, @count) ? number - 1 : nil) }
+      end
+
+      def toggle_mark(number) = toggle_packet_state(@marked, number, "frame.marked")
+      def toggle_ignore(number) = toggle_packet_state(@ignored, number, "frame.ignored")
+      def toggle_time_reference(number) = toggle_packet_state(@time_references, number, "frame.time_relative")
+      def mark_all_displayed
+        @mutex.synchronize { @marked.merge(@display || (1..@count)) }
+        packet_states_changed("frame.marked")
+        self
+      end
+      def unmark_all
+        @mutex.synchronize { @marked.clear }
+        packet_states_changed("frame.marked")
+        self
+      end
+
+      def conversation_neighbor(number, direction)
+        return nil unless number.is_a?(Integer) && [1, -1].include?(direction)
+        @mutex.synchronize do
+          return nil unless number.between?(1, @count)
+          stream = @annotations[number][:tcp_stream]
+          return nil if stream.negative?
+          numbers = @annotations.streams.fetch(stream, [])
+          index = numbers.bsearch_index { |item| item >= number } || numbers.size
+          index += direction
+          while index.between?(0, numbers.size - 1)
+            candidate = numbers[index]
+            return candidate unless @display && !@display.include?(candidate)
+            index += direction
+          end
+          nil
+        end
+      end
+
+      def search(query, **options, &finished)
+        cancel_search
+        job = SearchJob.new(self, query, **options)
+        @search_job = job
+        snapshot = @mutex.synchronize { filter_snapshot(displayed_delta: !!job.program&.fields&.include?("frame.time_delta_displayed")) }
+        @jobs << thread do
+          hit = job.run(snapshot: snapshot)
+          finished&.call(hit, nil) unless job.cancelled?
+        rescue StandardError => error
+          finished&.call(nil, error) unless job.cancelled?
+        end
+        job
+      end
+      def cancel_search
+        @search_job&.cancel
+        @search_job = nil
+        self
+      end
+
+      private
+      def toggle_packet_state(values, number, field)
+        @mutex.synchronize do
+          raise Vanken::Error, "invalid packet number" unless number.is_a?(Integer) && number.between?(1, @count)
+          values.include?(number) ? values.delete(number) : values.add(number)
+        end
+        packet_states_changed(field)
+        self
+      end
+      def packet_states_changed(field)
+        @filter && @filter.fields.include?(field) ? apply_filter(@filter.expression) : notify(force: true)
+      end
+    end
+  end
+end

data/lib/vanken/app/search_job.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require_relative "../core/display_filter/compiler"
+
+module Vanken
+  module App
+    class SearchJob
+      attr_reader :program
+      def initialize(document, query, mode: :filter, target: :bytes, from: nil, direction: 1)
+        @document, @mode, @target, @from = document, mode.to_sym, target.to_sym, from
+        raise Vanken::Error, "invalid search mode or target" unless %i[filter hex string regex].include?(@mode) && %i[list details bytes].include?(@target)
+        raise Vanken::Error, "search query is empty" if query.empty?
+        raise Vanken::Error, "invalid search direction" unless [1, -1].include?(direction)
+        @direction = direction
+        @program = Core::DisplayFilter.compile(query, catalog: document.catalog) if @mode == :filter
+        @query = if @mode == :hex
+          hex = query.delete(" \t\r\n:")
+          raise Vanken::Error, "16 進数は 2 桁ずつ入力してください" unless /\A(?:[\da-fA-F]{2})+\z/.match?(hex)
+          [hex].pack("H*")
+        elsif @mode == :regex
+          Regexp.new(@target == :bytes ? query.b : query, timeout: 0.1)
+        else
+          query.dup
+        end
+      rescue RegexpError => error
+        raise Vanken::Error, "invalid search pattern: #{error.message}"
+      end
+
+      def cancel = @cancelled = true
+      def cancelled? = @cancelled || @document.closing?
+      def run(snapshot: nil)
+        limit = @document.displayed_count
+        return nil if limit.zero?
+        origin = @document.displayed_index(@from) || (@direction.positive? ? -1 : limit)
+        1.upto(limit) do |step|
+          return nil if cancelled?
+          number = @document.number_at((origin + (step * @direction)) % limit)
+          matched = if @mode == :filter
+            @program.match?(@document.view(number, snapshot: snapshot))
+          else
+            text = search_text(number)
+            @mode == :regex ? @query.match?(text) : text.b.include?(@query.b)
+          end
+          return number if matched && !cancelled?
+          Thread.pass if step % 256 == 0
+        end
+        nil
+      rescue Regexp::TimeoutError
+        raise Vanken::Error, "検索の正規表現が時間制限を超えました"
+      end
+
+      private
+      def search_text(number)
+        case @target
+        when :bytes then @document.store.read(number).bytes
+        when :list then @document.row(number).values.join("\t")
+        when :details then @document.details(number).flat_map(&:descendants).map(&:label).join("\n")
+        end
+      end
+    end
+  end
+end