vanken 0.1.0 → 0.3.0

data/lib/vanken/gateway/display_capture_filter.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require_relative "capture_filter"
+require_relative "../core/display_filter/parser"
+
+module Vanken
+  module Gateway
+    class DisplayCaptureFilter
+      Packet = Struct.new(:data, :original_length, :linktype, :meta)
+      TUNNEL_PORTS = [4789, 8472, 6081].freeze
+      attr_reader :expression
+
+      def initialize(expression)
+        @expression = convert(Core::DisplayFilter::Parser.new(expression).parse)
+        @program = CaptureFilter.compile(@expression) if @expression
+      rescue CaptureFilter::Error
+        @expression = @program = nil
+      end
+
+      # nil requests the ordinary VDF evaluator; false is a definite non-match.
+      def match(frame)
+        return nil unless @program && eligible?(frame)
+        @program.match?(Packet.new(frame.bytes, frame.original_length, frame.linktype, {}))
+      end
+
+      private
+
+      def convert(node)
+        case node.kind
+        when :and, :or
+          left, right = convert(node.left), convert(node.right)
+          "(#{left}) #{node.kind} (#{right})" if left && right
+        when :not
+          child = convert(node.left)
+          "not (#{child})" if child
+        when :test
+          field, predicate = node.left.value, node.right
+          return {"ip" => "ip", "ipv6" => "ip6", "tcp" => "tcp", "udp" => "udp"}[field] unless predicate
+          return nil unless %i[eq ne in].include?(predicate.operator)
+          members = predicate.values.map { |member| term(field, member) }
+          return nil if members.any?(&:nil?) || members.empty?
+          result = members.map { |member| "(#{member})" }.join(" or ")
+          predicate.operator == :ne ? "not (#{result})" : result
+        end
+      end
+
+      def term(field, member)
+        token = member.first
+        if (port = /\A(tcp|udp)\.(port|srcport|dstport)\z/.match(field))
+          return nil unless token.type == :integer && token.value.between?(0, 65_535)
+          direction = {"srcport" => "src ", "dstport" => "dst "}.fetch(port[2], "")
+          if member.last
+            last = member.last
+            return nil unless last.type == :integer && last.value.between?(token.value, 65_535)
+            "#{port[1]} #{direction}portrange #{token.value}-#{last.value}"
+          else
+            "#{port[1]} #{direction}port #{token.value}"
+          end
+        elsif (address = /\A(ip|ipv6)\.(addr|src|dst)\z/.match(field))
+          return nil unless token.type == :address && !member.last
+          value = IPAddr.new(token.value)
+          return nil unless value.ipv4? == (address[1] == "ip")
+          direction = {"src" => "src ", "dst" => "dst "}.fetch(address[2], "")
+          prefix = token.value.split("/", 2)[1]
+          literal = prefix ? "net #{value}/#{prefix}" : "host #{value}"
+          "#{address[1] == 'ip' ? 'ip' : 'ip6'} #{direction}#{literal}"
+        end
+      end
+
+      def eligible?(frame)
+        bytes = frame.bytes
+        return false unless frame.linktype == 1 && frame.original_length == bytes.bytesize && bytes.bytesize >= 34
+        type = bytes.unpack1("n", offset: 12)
+        if type == 0x0800
+          return false unless bytes.getbyte(14) == 0x45 && (bytes.unpack1("n", offset: 20) & 0x3fff).zero?
+          length = bytes.unpack1("n", offset: 16)
+          return false unless length >= 20 && length + 14 <= bytes.bytesize
+          transport, finish, protocol = 34, length + 14, bytes.getbyte(23)
+        elsif type == 0x86dd
+          return false unless bytes.bytesize >= 54 && bytes.getbyte(14) >> 4 == 6
+          length = bytes.unpack1("n", offset: 18)
+          return false unless length.positive? && length + 54 <= bytes.bytesize
+          transport, finish, protocol = 54, length + 54, bytes.getbyte(20)
+        else
+          return false
+        end
+        if protocol == 6
+          return false unless finish - transport >= 20
+          header = (bytes.getbyte(transport + 12) >> 4) * 4
+          header >= 20 && transport + header <= finish
+        elsif protocol == 17
+          return false unless finish - transport >= 8
+          ports = bytes.unpack("n2", offset: transport)
+          length = bytes.unpack1("n", offset: transport + 4)
+          (ports & TUNNEL_PORTS).empty? && length >= 8 && transport + length <= finish
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/lib/vanken/gateway/dissector.rb

@@ -15,12 +15,36 @@ module Vanken
       def self.rank(value) = {nil => 0, note: 1, warning: 2, warn: 2, error: 3}.fetch(value, 0)
     end
 
+    # The public plugin DSL registers through Registry.default; keep that lookup local.
+    module RegistryScope
+      module Default
+        # @rbs () -> Redhound::Registry
+        def default = Thread.current[:vanken_registry] || super
+      end
+
+      # @rbs [T] (Redhound::Registry registry) { () -> T } -> T
+      def self.with(registry)
+        previous = Thread.current[:vanken_registry]
+        Thread.current[:vanken_registry] = registry
+        yield
+      ensure
+        Thread.current[:vanken_registry] = previous
+      end
+    end
+    Redhound::Registry.singleton_class.prepend(RegistryScope::Default)
+
     class Dissector
       attr_reader :registry #: Redhound::Registry
       # @rbs (?verify_checksums: bool, ?decode_as: Array[String], ?plugins: Array[String]) -> void
       def initialize(verify_checksums: false, decode_as: [], plugins: [])
-        plugins.each { |path| load File.expand_path(path) }
         @registry = Redhound::Registry.default.copy
+        RegistryScope.with(@registry) do
+          plugins.each do |path|
+            load File.expand_path(path), true
+          rescue LoadError, SyntaxError => error
+            raise Vanken::ConfigError, "failed to load plugin #{path}: #{error.message}"
+          end
+        end
         decode_as.each { |rule| @registry.decode_as(rule) }
         @engine = Redhound::Engine.new(registry: @registry, verify_checksums: verify_checksums)
       end
@@ -45,6 +69,7 @@ module Vanken
 
     class PacketView
       attr_reader :raw_packet #: Redhound::Packet
+      attr_reader :registry #: Redhound::Registry
       # @rbs (Redhound::Packet packet, Redhound::Registry registry) -> void
       def initialize(packet, registry) = (@raw_packet = packet; @registry = registry)
       # @rbs (String name) -> Array[untyped]
@@ -86,7 +111,7 @@ module Vanken
       end
       # @rbs () -> String
       def info
-        safe_text(@raw_packet.summary)
+        RegistryScope.with(@registry) { safe_text(@raw_packet.summary) }
       end
       # @rbs () -> Core::annotation_values
       def annotations
@@ -132,12 +157,12 @@ module Vanken
     end
 
     class FieldCatalog
-      # @rbs () -> void
-      def initialize
+      # @rbs (?registry: Redhound::Registry) -> void
+      def initialize(registry: Redhound::Registry.default)
         @mutex = Mutex.new
         @fields = {} #: Hash[String, Hash[Symbol, untyped]]
-        @protocols = Redhound::Registry.default.protocols.keys.map { |id| id == :ipv4 ? "ip" : id.to_s }
-        Redhound::Registry.default.protocols.each do |id, klass|
+        @protocols = registry.protocols.keys.map { |id| id == :ipv4 ? "ip" : id.to_s }
+        registry.protocols.each do |id, klass|
           definitions = Array(klass.compiled_header&.definitions) #: Array[Redhound::FieldDefinition]
           definitions.each do |field|
             @fields[field.name] = {type: field.type, source: :dissect, protocol: id.to_s}.freeze

data/lib/vanken/gateway/exporter.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "csv"
+require "tempfile"
+require_relative "file_writer"
+require_relative "detail_builder"
+
+module Vanken
+  module Gateway
+    class Exporter
+      DEFAULT_COLUMNS = %i[number time source destination protocol length info].map { |key| {key: key, label: key.to_s.capitalize} }.freeze
+
+      def initialize(document) = (@document = document)
+
+      def numbers(scope: :all, range: "", selected: nil, exclude_ignored: false)
+        limit = @document.count
+        empty = [] #: Array[Integer]
+        values = case scope.to_sym
+        when :all then (1..limit).to_a
+        when :displayed then @document.display_numbers
+        when :selected then selected ? [selected] : empty
+        when :marked then @document.marked.to_a
+        when :between_marks
+          marks = @document.marked.to_a.sort
+          marks.empty? ? empty : (marks.first..marks.last).to_a
+        when :range then ranges(range, limit)
+        else raise ArgumentError, "invalid packet scope"
+        end
+        raise ArgumentError, "invalid packet number" unless values.all? { |number| number.is_a?(Integer) && number.between?(1, limit) }
+        values = values.reject { |number| @document.ignored.include?(number) } if exclude_ignored
+        values.sort.uniq
+      end
+
+      def write(path, format:, numbers: nil, columns: DEFAULT_COLUMNS, cancelled: nil)
+        format = format.to_sym
+        raise ArgumentError, "invalid export format" unless %i[pcap pcapng json ndjson text csv].include?(format)
+        numbers = (numbers || self.numbers).to_a.sort.uniq
+        raise IndexError, "invalid packet number" unless numbers.all? { |number| number.is_a?(Integer) && number.between?(1, @document.count) }
+        file = Tempfile.create([".vanken-export-", ".tmp"], File.dirname(File.expand_path(path)))
+        begin
+          file.binmode
+          case format
+          when :pcap, :pcapng
+            linktype = numbers.empty? ? 1 : @document.store.metadata(numbers.first)[:linktype]
+            FileWriter.open(file, format: format, linktype: linktype) do |writer|
+              numbers.each { |number| check_cancelled(cancelled); writer << @document.store.read(number) }
+            end
+          when :json, :ndjson then json(file, numbers, format, cancelled)
+          when :text
+            numbers.each do |number|
+              check_cancelled(cancelled)
+              @document.details(number).each { |node| text_node(file, node, 0) }
+              file.write("\n")
+            end
+          when :csv
+            csv = CSV.new(file)
+            visible = columns.reject { |column| column[:visible] == false }
+            csv << visible.map { |column| column[:label] || column[:key].to_s }
+            numbers.each { |number| check_cancelled(cancelled); csv << visible.map { |column| csv_value(number, column) } }
+          end
+          file.flush
+          file.fsync
+          file.close
+          File.rename(file.path, File.expand_path(path))
+        ensure
+          file.close unless file.closed?
+          FileUtils.rm_f(file.path)
+        end
+        path
+      end
+
+      private
+
+      def ranges(value, limit)
+        raise ArgumentError, "packet range is empty" if value.strip.empty?
+        value.split(",", -1).flat_map do |part|
+          match = /\A\s*(\d+)(?:\s*-\s*(\d*))?\s*\z/.match(part)
+          raise ArgumentError, "invalid packet range: #{part}" unless match
+          first = match[1].to_i
+          last = match[2].nil? ? first : match[2].empty? ? limit : match[2].to_i
+          raise ArgumentError, "packet range is outside capture" unless first.between?(1, limit) && last.between?(first, limit)
+          (first..last).to_a
+        end
+      end
+
+      def check_cancelled(cancelled)
+        raise Vanken::Error, "operation cancelled" if cancelled&.call || @document.closing?
+      end
+
+      def json(file, numbers, format, cancelled)
+        dissector = Dissector.new(**@document.analysis_gateway_options)
+        analysis = Analysis.new(registry: dissector.registry, **@document.analysis_options)
+        selected = numbers.to_set
+        written = false
+        file.write("[") if format == :json
+        # Replay preceding packets so stateful fields and reassembled layers match the document.
+        (1..(numbers.last || 0)).each do |number|
+          check_cancelled(cancelled)
+          packet = dissector.dissect(@document.store.read(number))
+          analysis.update(packet)
+          next unless selected.include?(number)
+          file.write(",") if format == :json && written
+          file.write(JSON.generate(packet.to_h))
+          file.write("\n") if format == :ndjson
+          written = true
+        end
+        file.write("]\n") if format == :json
+      ensure
+        analysis&.close
+      end
+
+      def text_node(file, node, depth)
+        file.write("#{'  ' * depth}#{node.label}\n")
+        node.children.each { |child| text_node(file, child, depth + 1) }
+      end
+
+      def csv_value(number, column)
+        return @document.view(number).values(column[:field]).map(&:to_s).join(", ") if column[:field]
+        return @document.time_value(number, column[:format] || :relative) if column[:key].to_sym == :time
+        @document.row(number)[column[:key].to_sym]
+      end
+    end
+  end
+end

data/lib/vanken/gateway/file_writer.rb

@@ -22,12 +22,34 @@ module Vanken
       def initialize(output, format: :pcapng, **options)
         @format = format.to_sym
         @interfaces = {} #: Hash[Hash[String, untyped], Redhound::Capture::Interface]
-        if output.is_a?(String)
+        rotating = options[:max_bytes] || options[:interval]
+        if rotating
+          raise ArgumentError, "ring output must be a fixed file path" unless output.is_a?(String) && output != "-" && !output.include?("%")
+          count = options.fetch(:file_count, 10)
+          raise ArgumentError, "ring file count must be between 1 and 1000" unless count.is_a?(Integer) && count.between?(1, 1000)
+          %i[max_bytes interval].each do |key|
+            value = options[key]
+            raise ArgumentError, "#{key} must be positive" if value && (!value.is_a?(Numeric) || !value.finite? || !value.positive?)
+          end
+          options = options.merge(file_count: count)
+          # The public Writer cycles slots when max_bytes is present, also for time-based rings.
+          options[:max_bytes] ||= 9_223_372_036_854_775_807
+          extension = File.extname(output)
+          stem = output.delete_suffix(extension)
+          count.times do |index|
+            path = "#{stem}_#{format('%05d', index)}#{extension}"
+            next unless File.exist?(path) || File.symlink?(path)
+            File.open(path, File::RDWR | File::NOFOLLOW) do |file|
+              raise ArgumentError, "ring output must be a regular, unlinked file owned by this user" unless file.stat.file? && file.stat.nlink == 1 && file.stat.uid == Process.uid
+              file.chmod(0o600)
+            end
+          end
+        elsif output.is_a?(String)
           @owned = File.open(output, "wb", 0o600)
           @owned.chmod(0o600)
         end
         @writer = Redhound::Writer.open(@owned || output, format: @format, **options)
-      rescue Redhound::Error, IOError, SystemCallError => error
+      rescue Redhound::Error, ArgumentError, IOError, SystemCallError => error
         @owned&.close
         raise Vanken::FileError, error.message
       end
@@ -45,6 +67,8 @@ module Vanken
       end
       # @rbs () -> void
       def flush = @writer.flush
+      # @rbs () -> Integer
+      def bytes_written = @writer.bytes_written
       # @rbs (Redhound::Capture::Stats | Hash[Symbol | String, Integer] stats, ?interface: Redhound::Capture::Interface?) -> void
       def write_stats(stats, interface: nil)
         if stats.is_a?(Hash)

data/lib/vanken/gateway/interfaces.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "redhound"
+require "open3"
 
 module Vanken
   module Gateway
@@ -25,6 +26,64 @@ module Vanken
       def self.find(name)
         list.find { |interface| interface[:name] == name } || raise(NotFound, "interface #{name.inspect} not found")
       end
+
+      # @rbs () -> Hash[String, Integer]
+      def self.traffic_counters
+        if RUBY_PLATFORM.include?("linux")
+          parse_linux_counters(File.read("/proc/net/dev"))
+        elsif RUBY_PLATFORM.include?("darwin")
+          output, _, status = Open3.capture3("/usr/sbin/netstat", "-ibn")
+          status.success? ? parse_darwin_counters(output) : {}
+        else
+          {}
+        end
+      rescue SystemCallError, IOError
+        {}
+      end
+
+      # @rbs (String text) -> Hash[String, Integer]
+      def self.parse_linux_counters(text)
+        result = {} #: Hash[String, Integer]
+        text.each_line do |line|
+          name, fields = line.split(":", 2)
+          next unless name && fields
+          values = fields.split
+          next unless values.length >= 16 && values[0].match?(/\A\d+\z/) && values[8].match?(/\A\d+\z/)
+          result[name.strip] = values[0].to_i + values[8].to_i
+        end
+        result
+      end
+
+      # @rbs (String text) -> Hash[String, Integer]
+      def self.parse_darwin_counters(text)
+        lines = text.lines
+        header = lines.shift.to_s.split
+        first, received, sent = header.index("Ipkts"), header.index("Ibytes"), header.index("Obytes")
+        return {} unless first && received && sent
+        result = {} #: Hash[String, Integer]
+        lines.each do |line|
+          fields = line.split
+          next unless fields[2]&.start_with?("<Link#")
+          counters = fields.last(header.length - first)
+          incoming, outgoing = counters[received - first], counters[sent - first]
+          next unless incoming&.match?(/\A\d+\z/) && outgoing&.match?(/\A\d+\z/)
+          result[fields.first.delete_suffix("*")] = incoming.to_i + outgoing.to_i
+        end
+        result
+      end
+
+      # @rbs (?previous: Hash[Symbol, untyped]?, ?history: Hash[String, Array[Integer]], ?now: Integer | Float) -> Hash[Symbol, untyped]
+      def self.sample_traffic(previous: nil, history: {}, now: Process.clock_gettime(Process::CLOCK_MONOTONIC))
+        counters = traffic_counters
+        elapsed = previous ? now.to_f - previous[:time].to_f : 0.0
+        rates = counters.to_h do |name, bytes|
+          old = previous && previous[:counters][name]
+          rate = old && elapsed.positive? ? [(bytes - old).fdiv(elapsed), 0].max.to_i : 0
+          [name, rate]
+        end
+        samples = rates.to_h { |name, rate| [name, ((history[name] || []) + [rate]).last(60)] }
+        {previous: {time: now, counters: counters}, rates: rates, history: samples}
+      end
     end
   end
 end

data/lib/vanken/gateway/resolver.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "ipaddr"
+require "resolv"
+require "timeout"
+
+module Vanken
+  module Gateway
+    # Reverse DNS never runs on the requesting thread. Callbacks run on the
+    # worker; UI callers must post their publication to the UI executor.
+    class Resolver
+      NEGATIVE_TTL = 30.0
+
+      # @rbs @timeout: Float
+      # @rbs @limit: Integer
+      # @rbs @resolver: untyped
+      # @rbs @queue: SizedQueue[String?]
+      # @rbs @cache: Hash[String, [String?, Float?]]
+      # @rbs @pending: Hash[String, Array[^(String) -> void]]
+      # @rbs @mutex: Mutex
+      # @rbs @closed: bool
+      # @rbs @worker: Thread
+
+      # @rbs (?timeout: Integer | Float, ?limit: Integer, ?resolver: untyped) -> void
+      def initialize(timeout: 1.0, limit: 256, resolver: nil)
+        unless timeout.is_a?(Numeric) && timeout.to_f.finite? && timeout.positive?
+          raise ArgumentError, "timeout must be finite and positive"
+        end
+        raise ArgumentError, "limit must be a positive integer" unless limit.is_a?(Integer) && limit.positive?
+        @timeout, @limit = timeout.to_f, limit
+        @resolver = resolver || Resolv::DNS.new
+        @resolver.timeouts = [@timeout] if @resolver.respond_to?(:timeouts=)
+        @queue = SizedQueue.new(@limit) #: SizedQueue[String?]
+        @cache = {} #: Hash[String, [String?, Float?]]
+        @pending = {} #: Hash[String, Array[^(String) -> void]]
+        @mutex = Mutex.new
+        @closed = false
+        @worker = Thread.new { work }
+        @worker.report_on_exception = false
+      end
+
+      # @rbs (String address) ?{ (String) -> void } -> String
+      def request(address, &callback)
+        key = numeric_address(address)
+        return address unless key
+        @mutex.synchronize do
+          return address if @closed
+          entry = @cache.delete(key)
+          if entry && (!entry[1] || entry[1] > now)
+            @cache[key] = entry
+            return entry[0] || address
+          end
+          if (waiting = @pending[key])
+            waiting << callback if callback
+          else
+            begin
+              @queue.push(key, true)
+              @pending[key] = callback ? [callback] : []
+            rescue ThreadError
+              # A future viewport request may retry after capacity is available.
+            end
+          end
+          address
+        end
+      end
+
+      # @rbs () -> void
+      def close
+        @mutex.synchronize do
+          return if @closed
+          @closed = true
+          @pending.clear
+          @queue.clear
+          @queue << nil
+        end
+        @worker.join(@timeout + 0.1) unless Thread.current == @worker
+        nil
+      end
+
+      private
+
+      # @rbs (String address) -> String?
+      def numeric_address(address)
+        return nil if address.include?("/")
+        IPAddr.new(address).to_s
+      rescue IPAddr::Error
+        nil
+      end
+
+      # @rbs () -> Float
+      def now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+
+      # @rbs (String address) -> String?
+      def lookup(address)
+        name = Timeout.timeout(@timeout) { @resolver.getname(address) }
+        name.to_s.dup.freeze unless name.nil? || name.to_s.empty?
+      rescue StandardError
+        nil
+      end
+
+      # @rbs () -> void
+      def work
+        while (address = @queue.pop)
+          name = lookup(address)
+          callbacks = @mutex.synchronize do
+            return if @closed
+            @cache[address] = [name, name ? nil : now + NEGATIVE_TTL]
+            @cache.shift while @cache.size > @limit
+            @pending.delete(address) || []
+          end
+          next unless name
+          callbacks.each do |callback|
+            break if @mutex.synchronize { @closed }
+            begin
+              callback.call(name)
+            rescue StandardError
+              # One consumer must not prevent other consumers or DNS requests.
+            end
+          end
+        end
+      ensure
+        begin
+          @resolver.close if @resolver.respond_to?(:close)
+        rescue StandardError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/vanken/gateway/statistics.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require_relative "dissector"
+
+module Vanken
+  module Gateway
+    HierarchyRow = Data.define(
+      :path, #: Array[Symbol]
+      :packets, #: Integer
+      :bytes #: Integer
+    )
+    ConversationRow = Data.define(
+      :addr_a, #: String
+      :port_a, #: Integer
+      :addr_b, #: String
+      :port_b, #: Integer
+      :packets_ab, #: Integer
+      :packets_ba, #: Integer
+      :bytes_ab, #: Integer
+      :bytes_ba, #: Integer
+      :start_ns, #: Integer
+      :end_ns, #: Integer
+      :duration_ns #: Integer
+    )
+    EndpointRow = Data.define(
+      :address, #: String
+      :port, #: Integer
+      :packets_tx, #: Integer
+      :packets_rx, #: Integer
+      :bytes_tx, #: Integer
+      :bytes_rx #: Integer
+    )
+    StatisticsTable = Data.define(
+      :kind, #: Symbol
+      :type, #: Symbol?
+      :rows, #: Array[HierarchyRow | ConversationRow | EndpointRow]
+      :evicted #: Integer
+    )
+
+    # The upstream session and its private table schema stay inside the Gateway.
+    class Statistics
+      # @rbs (?specs: Array[String], ?registry: Redhound::Registry, **untyped options) -> void
+      def initialize(specs: ["phs"], registry: Redhound::Registry.default, **options)
+        @session = Redhound::Analysis::Session.new(stats: specs, registry: registry, **options)
+      end
+
+      # @rbs (PacketView packet) -> void
+      def update(packet) = @session.update(packet.raw_packet)
+
+      # @rbs () -> Array[StatisticsTable]
+      def tables
+        @session.statistics.map do |table|
+          value = table.to_h
+          rows = value[:rows].map do |row|
+            fields = row.dup #: Hash[Symbol, untyped]
+            fields[:path] = fields[:path].dup.freeze if fields[:path]
+            fields.each_value { |item| item.freeze if item.is_a?(String) }
+            case value[:kind]
+            when :phs
+              HierarchyRow.new(path: fields.fetch(:path), packets: fields.fetch(:packets), bytes: fields.fetch(:bytes))
+            when :conv
+              ConversationRow.new(addr_a: fields.fetch(:addr_a), port_a: fields.fetch(:port_a),
+                addr_b: fields.fetch(:addr_b), port_b: fields.fetch(:port_b),
+                packets_ab: fields.fetch(:packets_ab), packets_ba: fields.fetch(:packets_ba),
+                bytes_ab: fields.fetch(:bytes_ab), bytes_ba: fields.fetch(:bytes_ba),
+                start_ns: fields.fetch(:start_ns), end_ns: fields.fetch(:end_ns), duration_ns: fields.fetch(:duration_ns))
+            when :endpoints
+              EndpointRow.new(address: fields.fetch(:address), port: fields.fetch(:port),
+                packets_tx: fields.fetch(:packets_tx), packets_rx: fields.fetch(:packets_rx),
+                bytes_tx: fields.fetch(:bytes_tx), bytes_rx: fields.fetch(:bytes_rx))
+            else raise Vanken::Error, "invalid upstream statistics table"
+            end
+          end
+          StatisticsTable.new(kind: value[:kind], type: value[:type], rows: rows.freeze, evicted: table.evicted)
+        end.freeze
+      end
+
+      # @rbs () -> void
+      def close = @session.finish(StringIO.new, StringIO.new)
+    end
+  end
+end