vanken 0.1.0 → 0.3.0

data/lib/vanken/gateway/stream.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "tempfile"
+require_relative "dissector"
+
+module Vanken
+  module Gateway
+    StreamChunk = Data.define(
+      :direction, #: Integer
+      :bytes, #: String
+      :missing, #: Integer
+      :number, #: Integer
+      :sequence #: Integer
+    )
+    StreamText = Data.define(
+      :direction, #: Integer
+      :text #: String
+    )
+
+    class Stream
+      DISPLAY_LIMIT = 16 << 20 #: Integer
+      SEQUENCE_MOD = 1 << 32 #: Integer
+      attr_reader :nodes #: Array[String]
+      attr_reader :chunks #: Array[StreamChunk]
+      attr_reader :stream_id #: Integer
+
+      # @rbs (untyped document, Integer stream_id, ?cancelled: (^() -> bool)?) -> void
+      def initialize(document, stream_id, cancelled: nil)
+        raise ArgumentError, "invalid stream number" unless stream_id.is_a?(Integer) && stream_id >= 0
+        @stream_id, @nodes, @chunks = stream_id, [], []
+        pieces = [[], []] #: Array[Array[StreamChunk]]
+        starts = [nil, nil] #: Array[Integer?]
+        frontiers = [0, 0]
+        frames = document.stream_frames(stream_id)
+        frames.each do |number|
+          raise Vanken::Error, "operation cancelled" if cancelled&.call || document.closing?
+          packet = document.packet(number)
+          tcp = packet.layers.find { |layer| layer.protocol == :tcp && !layer.embedded }
+          next unless tcp
+          columns = packet.columns
+          endpoints = [endpoint(columns[:source], columns[:src_port]), endpoint(columns[:destination], columns[:dst_port])]
+          @nodes = tcp[:flags] & 0x12 == 0x12 ? endpoints.reverse : endpoints if @nodes.empty?
+          direction = endpoints == @nodes ? 0 : 1
+          sequence = document.annotations[number][:seq_rel]
+          difference = (sequence - frontiers[direction]) % SEQUENCE_MOD
+          difference -= SEQUENCE_MOD if difference >= SEQUENCE_MOD / 2
+          sequence = frontiers[direction] + difference
+          sequence += 1 if tcp[:flags] & 2 != 0
+          starts[direction] ||= sequence if tcp[:flags] & 2 != 0
+          data = packet.bytes.byteslice(tcp.payload_offset, tcp.payload_end - tcp.payload_offset)
+          frontiers[direction] = [frontiers[direction], sequence + data.bytesize].max
+          next if data.empty?
+          insert(pieces[direction], StreamChunk.new(direction: direction, bytes: data, missing: 0, number: number, sequence: sequence))
+        end
+        directions = pieces.each_with_index.map do |segments, direction|
+          cursor = starts[direction]
+          segments.flat_map do |segment|
+            missing = cursor && segment.sequence > cursor ? segment.sequence - cursor : 0
+            cursor = segment.sequence + segment.bytes.bytesize
+            gap = StreamChunk.new(direction: direction, bytes: "".b, missing: missing, number: segment.number, sequence: segment.sequence - missing)
+            missing.positive? ? [gap, segment] : [segment]
+          end
+        end
+        positions = [0, 0]
+        until positions.each_with_index.all? { |index, direction| index == directions[direction].size }
+          direction = [0, 1].reject { |value| positions[value] == directions[value].size }.min_by do |value|
+            directions[value][positions[value]].number
+          end
+          raise Vanken::Error, "invalid stream direction" unless direction
+          @chunks << directions[direction][positions[direction]]
+          positions[direction] += 1
+        end
+        @nodes.freeze
+        @chunks.freeze
+      end
+
+      # @rbs (?direction: Integer?) -> Integer
+      def byte_size(direction: nil) = selected(direction).sum { |chunk| chunk.bytes.bytesize }
+
+      # @rbs (?format: Symbol, ?direction: Integer?, ?limit: Integer) -> Array[StreamText]
+      def preview(format: :ascii, direction: nil, limit: DISPLAY_LIMIT)
+        validate(format, direction)
+        raise ArgumentError, "invalid display limit" unless limit.is_a?(Integer) && limit >= 0
+        remaining = limit
+        result = [] #: Array[StreamText]
+        selected(direction).each do |chunk|
+          break if remaining.zero?
+          bytes = chunk.bytes.byteslice(0, remaining) || "".b
+          remaining -= bytes.bytesize
+          result << StreamText.new(direction: chunk.direction, text: render(chunk, bytes, format))
+        end
+        result
+      end
+
+      # @rbs (String path, ?format: Symbol, ?direction: Integer?, ?cancelled: (^() -> bool)?) -> String
+      def save(path, format: :raw, direction: nil, cancelled: nil)
+        validate(format, direction)
+        file = Tempfile.create([".vanken-stream-", ".tmp"], File.dirname(File.expand_path(path)))
+        begin
+          file.binmode
+          selected(direction).each do |chunk|
+            raise Vanken::Error, "operation cancelled" if cancelled&.call
+            file.write(render(chunk, chunk.bytes, format))
+          end
+          file.flush
+          file.fsync
+          file.close
+          File.rename(file.path, File.expand_path(path))
+        ensure
+          file.close unless file.closed?
+          FileUtils.rm_f(file.path)
+        end
+        path
+      end
+
+      private
+
+      # @rbs (Integer? direction) -> Array[StreamChunk]
+      def selected(direction) = @chunks.select { |chunk| direction.nil? || chunk.direction == direction }
+      def endpoint(address, port) = address.include?(":") ? "[#{address}]:#{port}" : "#{address}:#{port}"
+      def validate(format, direction)
+        raise ArgumentError, "invalid stream format" unless %i[ascii hex raw].include?(format)
+        raise ArgumentError, "invalid stream direction" unless [nil, 0, 1].include?(direction)
+      end
+
+      def render(chunk, bytes, format)
+        return "".b if format == :raw && chunk.missing.positive?
+        return "[#{chunk.missing} bytes missing]" if chunk.missing.positive?
+        return bytes if format == :raw
+        return bytes.gsub(/[^\x20-\x7e\r\n\t]/n) { |byte| Kernel.format("\\x%02x", byte.getbyte(0)) } if format == :ascii
+        bytes.bytes.each_slice(16).with_index.map do |row, index|
+          Kernel.format("%08x  %s\n", chunk.sequence + (index * 16), row.map { |byte| Kernel.format("%02x", byte) }.join(" "))
+        end.join
+      end
+
+      # Keep capture arrival precedence while inserting only previously unseen ranges.
+      def insert(segments, chunk)
+        first, last = chunk.sequence, chunk.sequence + chunk.bytes.bytesize
+        index = segments.bsearch_index { |segment| segment.sequence + segment.bytes.bytesize > first } || segments.size
+        uncovered = [] #: Array[[Integer, Integer]]
+        cursor = first
+        while index < segments.size && segments[index].sequence < last
+          previous = segments[index]
+          uncovered << [cursor, [previous.sequence, last].min] if previous.sequence > cursor
+          cursor = [cursor, previous.sequence + previous.bytes.bytesize].max
+          index += 1
+        end
+        uncovered << [cursor, last] if cursor < last
+        uncovered.each do |start, finish|
+          segment = chunk.with(sequence: start, bytes: chunk.bytes.byteslice(start - first, finish - start))
+          position = segments.bsearch_index { |previous| previous.sequence > start } || segments.size
+          # ponytail: array insertion is O(n) for heavily reordered streams; use an interval tree if measured.
+          segments.insert(position, segment)
+        end
+      end
+    end
+  end
+end

data/lib/vanken/ui/actions.rb

@@ -5,44 +5,70 @@ module Vanken
     module Actions
       def self.install(ui)
         commands = {
-          open: ["開く", "cmd-o", -> { ui.open_dialog }], save: ["名前を付けて保存", "cmd-shift-s", -> { ui.save_dialog }],
-          close_file: ["ファイルを閉じる", "cmd-w", -> { ui.close_document }], reload: ["再読み込み", "cmd-r", -> { ui.reload_file }],
-          quit: ["終了", "cmd-q", -> { ui.quit }], preferences: ["設定", "cmd-,", -> { ui.preferences_dialog }],
-          capture: ["キャプチャ開始／停止", "cmd-e", -> { ui.capture_toggle }], restart: ["キャプチャ再開", nil, -> { ui.restart_capture }],
-          apply_filter: ["フィルタを適用", "enter", -> { ui.apply_filter }], clear_filter: ["フィルタをクリア", nil, -> { ui.clear_filter }],
-          filter_history: ["フィルタ履歴", nil, -> { ui.filter_history }], bookmark: ["フィルタを保存", nil, -> { ui.bookmark_filter }],
-          filter_selected: ["選択した項目でフィルタ", nil, -> { ui.filter_from_selection }],
-          prepare_selected: ["選択した項目のフィルタを準備", nil, -> { ui.filter_from_selection(prepare: true) }],
-          columns: ["表示する列", nil, -> { ui.columns_dialog }], autoscroll: ["末尾追従", nil, -> { ui.toggle_autoscroll }],
-          zoom_in: ["拡大", "cmd-+", -> { ui.zoom(1) }], zoom_out: ["縮小", "cmd--", -> { ui.zoom(-1) }], zoom_reset: ["標準サイズ", "cmd-0", -> { ui.zoom }],
-          previous_packet: ["前のパケット", "alt-up", -> { ui.navigate(-1) }], next_packet: ["次のパケット", "alt-down", -> { ui.navigate(1) }],
-          first_packet: ["最初のパケット", nil, -> { ui.first_packet }], last_packet: ["最後のパケット", nil, -> { ui.last_packet }],
-          go_to_packet: ["パケットへ移動", "cmd-g", -> { ui.go_to_packet }], copy_filter: ["項目をフィルタとしてコピー", nil, -> { ui.copy_text(ui.selected_node.filter) if ui.selected_node&.filter }]
+          open: [ui.t("開く"), "cmd-o", -> { ui.open_dialog }], save: [ui.t("名前を付けて保存"), "cmd-shift-s", -> { ui.save_dialog }],
+          close_file: [ui.t("ファイルを閉じる"), "cmd-w", -> { ui.close_document }], reload: [ui.t("再読み込み"), "cmd-r", -> { ui.reload_file }],
+          quit: [ui.t("終了"), "cmd-q", -> { ui.quit }], preferences: [ui.t("設定"), "cmd-,", -> { ui.preferences_dialog }],
+          capture: [ui.t("キャプチャ開始／停止"), "cmd-e", -> { ui.capture_toggle }], restart: [ui.t("キャプチャ再開"), nil, -> { ui.restart_capture }],
+          apply_filter: [ui.t("フィルタを適用"), "enter", -> { ui.apply_filter }], clear_filter: [ui.t("フィルタをクリア"), nil, -> { ui.clear_filter }],
+          filter_history: [ui.t("フィルタ履歴"), nil, -> { ui.filter_history }], bookmark: [ui.t("フィルタを保存"), nil, -> { ui.bookmark_filter }],
+          filter_selected: [ui.t("選択した項目でフィルタ"), nil, -> { ui.filter_from_selection }],
+          prepare_selected: [ui.t("選択した項目のフィルタを準備"), nil, -> { ui.filter_from_selection(prepare: true) }],
+          columns: [ui.t("表示する列"), nil, -> { ui.columns_dialog }], autoscroll: [ui.t("末尾追従"), nil, -> { ui.toggle_autoscroll }],
+          zoom_in: [ui.t("拡大"), "cmd-+", -> { ui.zoom(1) }], zoom_out: [ui.t("縮小"), "cmd--", -> { ui.zoom(-1) }], zoom_reset: [ui.t("標準サイズ"), "cmd-0", -> { ui.zoom }],
+          previous_packet: [ui.t("前のパケット"), "alt-up", -> { ui.navigate(-1) }], next_packet: [ui.t("次のパケット"), "alt-down", -> { ui.navigate(1) }],
+          first_packet: [ui.t("最初のパケット"), nil, -> { ui.first_packet }], last_packet: [ui.t("最後のパケット"), nil, -> { ui.last_packet }],
+          go_to_packet: [ui.t("パケットへ移動"), "cmd-g", -> { ui.go_to_packet }], copy_filter: [ui.t("項目をフィルタとしてコピー"), nil, -> { ui.copy_text(ui.selected_node.filter) if ui.selected_node&.filter }]
         }
-        %i[selected not and and_not or or_not].zip(["選択項目", "選択項目を除外", "AND", "AND NOT", "OR", "OR NOT"]).each do |mode, label|
-          commands[:"filter_#{mode}"] = ["適用: #{label}", nil, -> { ui.filter_from_selection(mode) }]
-          commands[:"prepare_#{mode}"] = ["準備: #{label}", nil, -> { ui.filter_from_selection(mode, prepare: true) }]
+        commands.merge!(
+          find_packet: [ui.t("パケット検索"), "cmd-f", -> { ui.find_packet }], find_next: [ui.t("次を検索"), "cmd-n", -> { ui.find_next }], find_prev: [ui.t("前を検索"), "cmd-b", -> { ui.find_prev }],
+          mark_packet: [ui.t("マーク／解除"), "cmd-m", -> { ui.mark_packet }], mark_all_displayed: [ui.t("表示中をすべてマーク"), "cmd-shift-m", -> { ui.mark_all_displayed }], unmark_all: [ui.t("すべてのマークを解除"), "cmd-alt-m", -> { ui.unmark_all }],
+          ignore_packet: [ui.t("無視／解除"), "cmd-d", -> { ui.ignore_packet }], time_reference: [ui.t("時刻基準／解除"), "cmd-t", -> { ui.time_reference }],
+          prev_in_conversation: [ui.t("同一会話の前"), "cmd-,", -> { ui.prev_in_conversation }], next_in_conversation: [ui.t("同一会話の次"), "cmd-.", -> { ui.next_in_conversation }],
+          coloring_rules: [ui.t("色付けルール"), nil, -> { ui.coloring_dialog }], toggle_coloring: [ui.t("色付け"), nil, -> { ui.toggle_coloring }],
+          follow_tcp_stream: [ui.t("TCP ストリームを追跡"), "cmd-alt-shift-t", -> { ui.follow_tcp_stream }], decode_as: [ui.t("別プロトコルとして解析"), "cmd-shift-u", -> { ui.decode_as }],
+          expert_info: [ui.t("エキスパート情報"), nil, -> { ui.expert_info }], reload_plugins: [ui.t("プラグイン再読み込み"), "cmd-shift-l", -> { ui.reload_plugins }], plugins: [ui.t("ディセクタプラグイン"), nil, -> { ui.plugins_dialog }],
+          file_properties: [ui.t("キャプチャファイルのプロパティ"), "cmd-alt-shift-c", -> { ui.file_properties }], protocol_hierarchy: [ui.t("プロトコル階層"), nil, -> { ui.protocol_hierarchy }],
+          conversations: [ui.t("会話"), nil, -> { ui.conversations }], endpoints: [ui.t("端点"), nil, -> { ui.endpoints }], io_graph: [ui.t("I/O グラフ"), nil, -> { ui.io_graph }],
+          export_packets: [ui.t("指定パケットのエクスポート"), nil, -> { ui.export_packets }], export_dissections: [ui.t("解析結果のエクスポート"), nil, -> { ui.export_dissections }],
+          command_palette: [ui.t("コマンドパレット"), "cmd-shift-k", -> { ui.command_palette }], profiles: [ui.t("プロファイル"), nil, -> { ui.profiles_dialog }])
+        commands[:preferences][1] = "cmd-shift-p"
+        commands[:restart][1] = "cmd-shift-r"
+        {"relative" => "相対時刻", "absolute" => "絶対時刻", "delta" => "前パケットとの差", "delta_displayed" => "前表示パケットとの差", "epoch" => "エポック時刻"}.each { |name, label| commands[:"time_format_#{name}"] = [ui.t("時刻: %{name}", name: ui.t(label)), nil, -> { ui.time_format(name) }] }
+        {"system" => "システム設定", "dark" => "ダーク", "light" => "ライト", "high_contrast" => "ハイコントラスト"}.each { |name, label| commands[:"theme_#{name}"] = [ui.t("テーマ: %{name}", name: ui.t(label)), nil, -> { ui.change_theme(name) }] }
+        %i[selected not and and_not or or_not].zip([ui.t("選択項目"), ui.t("選択項目を除外"), "AND", "AND NOT", "OR", "OR NOT"]).each do |mode, label|
+          commands[:"filter_#{mode}"] = [ui.t("適用: %{label}", label: label), nil, -> { ui.filter_from_selection(mode) }]
+          commands[:"prepare_#{mode}"] = [ui.t("準備: %{label}", label: label), nil, -> { ui.filter_from_selection(mode, prepare: true) }]
         end
-        {hex: "16 進数", text: "テキスト", dump: "ダンプ", escaped: "エスケープした文字列"}.each do |format, label|
-          commands[:"copy_#{format}"] = ["バイトをコピー: #{label}", nil, -> { ui.copy_bytes(format) }]
+        {hex: ui.t("16 進数"), text: ui.t("テキスト"), dump: ui.t("ダンプ"), escaped: ui.t("エスケープした文字列")}.each do |format, label|
+          commands[:"copy_#{format}"] = [ui.t("バイトをコピー: %{label}", label: label), nil, -> { ui.copy_bytes(format) }]
         end
         commands.each do |name, (title, keys, operation)|
-          ui.app.actions.register(name, title: title) { |_| operation.call }
+          needs_document = %i[find_packet find_next find_prev mark_packet mark_all_displayed unmark_all ignore_packet time_reference prev_in_conversation next_in_conversation follow_tcp_stream expert_info file_properties protocol_hierarchy conversations endpoints io_graph export_packets export_dissections]
+          enabled = ->(*) { !needs_document.include?(name) || !!ui.document }
+          checked = name == :autoscroll ? ->(*) { ui.autoscroll? } : name == :toggle_coloring ? ->(*) { ui.coloring_enabled? } : nil
+          ui.app.actions.register(name, title: title, enabled: enabled, checked: checked) { |_| operation.call }
           next unless keys
-          key = RUBY_PLATFORM.include?("darwin") ? keys : keys.sub("cmd", "ctrl")
+          key = ui.native? && RUBY_PLATFORM.include?("darwin") ? keys : keys.sub("cmd", "ctrl")
           ui.window.dispatcher.keymap.bind(key, name, context: name == :apply_filter ? "in_display_filter && !in_completion" : "")
         end
         ui.app.menu_bar = Zaniah::Menu.build do
-          submenu("ファイル") { %i[open save close_file reload quit].each { |action| item(action) } }
-          submenu("編集") { %i[copy_filter copy_hex copy_text copy_dump copy_escaped preferences].each { |action| item(action) } }
-          submenu("表示") { %i[columns autoscroll zoom_in zoom_out zoom_reset].each { |action| item(action) } }
-          submenu("移動") { %i[previous_packet next_packet first_packet last_packet go_to_packet].each { |action| item(action) } }
-          submenu("キャプチャ") { %i[capture restart].each { |action| item(action) } }
-          submenu("フィルタ") do
+          submenu(ui.t("ファイル")) { %i[open save close_file reload export_packets export_dissections quit].each { |action| item(action) } }
+          submenu(ui.t("編集")) { %i[find_packet find_next find_prev mark_packet mark_all_displayed unmark_all ignore_packet time_reference copy_filter copy_hex copy_text copy_dump copy_escaped preferences profiles].each { |action| item(action) } }
+          submenu(ui.t("表示")) do
+            %i[columns autoscroll coloring_rules toggle_coloring zoom_in zoom_out zoom_reset].each { |action| item(action) }
+            submenu(ui.t("時刻形式")) { %w[relative absolute delta delta_displayed epoch].each { |name| item(:"time_format_#{name}") } }
+            submenu(ui.t("テーマ")) { %w[system dark light high_contrast].each { |name| item(:"theme_#{name}") } }
+          end
+          submenu(ui.t("移動")) { %i[previous_packet next_packet first_packet last_packet go_to_packet prev_in_conversation next_in_conversation].each { |action| item(action) } }
+          submenu(ui.t("キャプチャ")) { %i[capture restart].each { |action| item(action) } }
+          submenu(ui.t("フィルタ")) do
             %i[apply_filter clear_filter filter_history bookmark].each { |action| item(action) }
-            submenu("選択項目を適用") { %i[selected not and and_not or or_not].each { |mode| item(:"filter_#{mode}") } }
-            submenu("選択項目から準備") { %i[selected not and and_not or or_not].each { |mode| item(:"prepare_#{mode}") } }
+            submenu(ui.t("選択項目を適用")) { %i[selected not and and_not or or_not].each { |mode| item(:"filter_#{mode}") } }
+            submenu(ui.t("選択項目から準備")) { %i[selected not and and_not or or_not].each { |mode| item(:"prepare_#{mode}") } }
           end
+          submenu(ui.t("分析")) { %i[follow_tcp_stream decode_as expert_info plugins reload_plugins].each { |action| item(action) } }
+          submenu(ui.t("統計")) { %i[file_properties protocol_hierarchy conversations endpoints io_graph].each { |action| item(action) } }
+          submenu(ui.t("ヘルプ")) { item(:command_palette) }
         end
       end
     end

data/lib/vanken/ui/analysis_dialogs.rb

@@ -0,0 +1,371 @@
+# frozen_string_literal: true
+
+require "digest"
+require_relative "../app/stats_job"
+require_relative "../app/expert_info"
+require_relative "../app/io_graph"
+require_relative "../gateway/stream"
+require_relative "../gateway/exporter"
+
+module Vanken
+  module UI
+    class AnalysisRows
+      def initialize(rows) = (@rows = rows)
+      def count = @rows.size
+      def row_id(index) = index
+      def cell(index, key)
+        value = @rows.fetch(index).to_h[key]
+        value.is_a?(Array) ? value.join(" / ") : value
+      end
+      def sort(key, direction)
+        @rows.sort_by! { |row| row.to_h[key] || "" }
+        @rows.reverse! if direction == :desc
+      end
+      def [](index) = @rows.fetch(index)
+    end
+
+    module AnalysisDialogs
+      ANALYSIS_KINDS = %i[protocol_hierarchy conversations endpoints expert_info io_graph follow_tcp_stream file_properties].freeze
+
+      def close_analysis
+        @analysis_generation = (@analysis_generation || 0) + 1
+        @statistics_job&.cancel
+        @statistics_job = nil
+        # Await actual completion; Task#cancel alone does not join an executing worker.
+        @analysis_task&.await
+      rescue StandardError
+        nil
+      ensure
+        @analysis_task = @analysis_results = @analysis_refresh = nil
+        @follow_stream = @follow_text = nil
+        @analysis_running = false
+      end
+
+      def refresh_analysis
+        return unless @analysis_refresh && ANALYSIS_KINDS.include?(@dialog_kind) && !@analysis_running && !@closing
+        @analysis_refresh.call
+      end
+
+      def protocol_hierarchy = statistics_dialog(:protocol_hierarchy)
+      def conversations = statistics_dialog(:conversations)
+      def endpoints = statistics_dialog(:endpoints)
+
+      def statistics_dialog(kind, displayed_only: false)
+        return unless document
+        types = %w[eth ip ipv6 tcp udp]
+        specs = kind == :protocol_hierarchy ? ["phs"] : types.map { |type| "#{kind == :conversations ? 'conv' : 'endpoints'},#{type}" }
+        controls = Zaniah::UI::Checkbox.new(t("表示中のパケットのみ"), value: displayed_only).test_id("vk.stats.displayed")
+          .on_change { |value, *_| statistics_dialog(kind, displayed_only: value) }
+        analysis_dialog(kind, {protocol_hierarchy: t("プロトコル階層"), conversations: t("会話"), endpoints: t("端点")}.fetch(kind), controls, reopen: -> { statistics_dialog(kind, displayed_only: displayed_only) })
+        @statistics_job = App::StatsJob.new(document, specs: specs, displayed_only: displayed_only)
+        job = @statistics_job
+        @analysis_refresh = lambda do
+          analysis_background(->(*) { job.refresh }) do |tables|
+            if kind == :protocol_hierarchy
+              rows = tables.first.rows
+              total = rows.select { |row| row.path.size == 1 }.sum(&:packets)
+              nodes = rows.to_h do |row|
+                id = row.path.join("/")
+                label = t("%{protocol}   %{packets} パケット   %{bytes} bytes   %{percent}%", protocol: row.path.last, packets: row.packets, bytes: row.bytes, percent: total.zero? ? 0 : (row.packets * 100.0 / total).round(1))
+                [id, Core::DetailNode.new(id: id, label: label, field: nil, offset: nil, length: 0, source: :frame, severity: nil, filter: nil, children: [])]
+              end
+              roots = []
+              rows.each do |row|
+                node = nodes.fetch(row.path.join("/"))
+                parent = nodes[row.path.take(row.path.size - 1).join("/")]
+                parent ? parent.children << node : roots << node
+              end
+              analysis_content(Zaniah::UI::TreeView.new(roots, height: 300, label: t("プロトコル階層")).test_id("vk.stats.hierarchy"))
+            else
+              tabs = tables.map { |table| [table.type.to_s.upcase, statistics_table(table)] }
+              analysis_content(Zaniah::UI::Tabs.new(tabs, selected: @statistics_tab || 0)
+                .on_change { |index, *_| @statistics_tab = index }.test_id("vk.stats.tabs"))
+            end
+          end
+        end
+        refresh_analysis
+      end
+
+      def expert_info(displayed_only: false)
+        return unless document
+        controls = Zaniah::UI::Checkbox.new(t("表示中のパケットのみ"), value: displayed_only)
+          .on_change { |value, *_| expert_info(displayed_only: value) }
+        analysis_dialog(:expert_info, t("エキスパート情報"), controls, reopen: -> { expert_info(displayed_only: displayed_only) })
+        @analysis_refresh = lambda do
+          analysis_background(->(doc, *) { App::ExpertInfo.rows(doc, displayed_only: displayed_only) }) do |rows|
+            table = analysis_table(rows, %i[severity code protocol count message]) do |row, event|
+              select_packet(row.numbers.first) if event&.click_count.to_i >= 2
+            end.test_id("vk.expert.table")
+            analysis_content(table)
+          end
+        end
+        refresh_analysis
+      end
+
+      def io_graph(interval: 1, expressions: [""], displayed_only: false)
+        return unless document
+        interval_control = Zaniah::UI::Select.new(App::IOGraph::INTERVALS.map { |value| [t("%{value}秒", value: value), value] }, value: interval, label: t("間隔"))
+          .test_id("vk.io.interval")
+        filters = Zaniah::UI::TextArea.new(expressions.join("\n"), rows: 2, label: t("系列の表示フィルタ（1行に1系列、空行は全件）")).test_id("vk.io.series")
+        displayed = Zaniah::UI::Checkbox.new(t("表示中のパケットのみ"), value: displayed_only)
+        redraw = lambda { io_graph(interval: interval, expressions: filters.value.split("\n", -1).uniq, displayed_only: displayed.value) }
+        interval_control.on_change { |value, *_| interval = value; redraw.call }
+        displayed.on_change { redraw.call }
+        controls = Zaniah::Div.new.flex_col.gap(6).child(interval_control).child(filters).child(displayed)
+          .child(Zaniah::UI::Button.new(t("系列を適用")).test_id("vk.io.apply").on_click { redraw.call })
+        analysis_dialog(:io_graph, t("I/O グラフ"), controls, reopen: redraw)
+        @analysis_refresh = lambda do
+          analysis_background(->(doc, cancelled) { App::IOGraph.build(doc, interval: interval, series: expressions, displayed_only: displayed_only, cancelled: cancelled) }) do |series|
+            if series.first.points.empty?
+              analysis_content(Zaniah::UI::Label.new(t("表示するパケットがありません。")))
+              next
+            end
+            values = series.each_with_index.to_h { |item, index| [item.expression.empty? ? t("全件 %{index}", index: index + 1) : item.expression, item.points.map(&:packets)] }
+            omitted = series.first&.omitted_intervals || 0
+            content = Zaniah::Div.new.flex_col.gap(4)
+            content.child(Zaniah::UI::Label.new(t("先頭の%{count}区間を省略しています。間隔を広げると全期間を表示できます。", count: omitted), wrap: :word)) if omitted.positive?
+            content.child(Zaniah::UI::LineChart.new(values, width: 660, height: 220, label: t("区間ごとのパケット数")).test_id("vk.io.chart"))
+            analysis_content(content)
+          end
+        end
+        refresh_analysis
+      end
+
+      def follow_tcp_stream(stream_id = nil, format: :ascii, direction: nil)
+        return unless document
+        stream_id ||= selected_number && document.annotations[selected_number][:tcp_stream]
+        return show_error(Vanken::Error.new(t("TCPストリームを持つパケットを選択してください。"))) unless stream_id && stream_id >= 0
+        number = Zaniah::UI::NumberInput.new(stream_id.to_s, min: 0, label: t("ストリーム番号")).test_id("vk.follow.number")
+        formats = Zaniah::UI::Select.new([["ASCII", :ascii], [t("16進ダンプ"), :hex], [t("生データ（保存用）"), :raw]], value: format, label: t("表示形式"))
+        directions = Zaniah::UI::Select.new([[t("両方向"), nil], [t("クライアント → サーバー"), 0], [t("サーバー → クライアント"), 1]], value: direction, label: t("方向"))
+        reload = lambda do
+          value = number.number
+          raise ArgumentError, t("ストリーム番号は0以上の整数で指定してください。") unless value && value >= 0 && value == value.to_i
+          follow_tcp_stream(value.to_i, format: format, direction: direction)
+        rescue ArgumentError => error
+          show_error(error)
+        end
+        formats.on_change { |value, *_| format = value; reload.call }
+        directions.on_change { |value, *_| direction = value; reload.call }
+        search = Zaniah::UI::TextField.new("", label: t("文字列検索")).test_id("vk.follow.search")
+        controls = Zaniah::Div.new.flex_col.gap(6)
+          .child(Zaniah::Div.new.flex_row.gap(6).child(number).child(formats).child(directions)
+            .child(Zaniah::UI::Button.new(t("表示")).on_click { reload.call }))
+          .child(Zaniah::Div.new.flex_row.gap(6).child(search)
+            .child(Zaniah::UI::Button.new(t("次を検索")).on_click { search_stream(search.value) })
+            .child(Zaniah::UI::Button.new(t("保存")).test_id("vk.follow.save").on_click { save_stream_dialog(format: format, direction: direction) })
+            .child(Zaniah::UI::Button.new(t("このストリームを除外")).test_id("vk.follow.exclude").on_click do
+              set_filter("!(tcp.stream == #{stream_id})")
+              apply_filter
+              dismiss_dialog
+            end))
+        analysis_dialog(:follow_tcp_stream, t("TCP ストリームを追跡"), controls, reopen: reload)
+        @analysis_refresh = lambda do
+          analysis_background(->(doc, cancelled) { Gateway::Stream.new(doc, stream_id, cancelled: cancelled) }) do |stream|
+            @follow_stream = stream
+            chunks = stream.preview(format: format == :raw ? :hex : format, direction: direction)
+            runs = chunks.map { |chunk| {text: chunk.text, color: Zaniah::Color.parse(chunk.direction.zero? ? "#ce3e52" : "#277bcc")} }
+            @follow_text = Zaniah::UI::RichText.new(runs).test_id("vk.follow.text")
+            content = Zaniah::Div.new.flex_col.gap(6).child(Zaniah::UI::Label.new(stream.nodes.join(" ↔ "), wrap: :word))
+            if stream.byte_size(direction: direction) > Gateway::Stream::DISPLAY_LIMIT
+              content.child(Zaniah::UI::Label.new(t("表示は16 MiBまでです。保存は全量を含みます。"), wrap: :word))
+            end
+            content.child(Zaniah::ScrollView.new.h(280).child(@follow_text))
+            analysis_content(content)
+          end
+        end
+        refresh_analysis
+      rescue ArgumentError => error
+        show_error(error)
+      end
+
+      def search_stream(value)
+        return if value.empty? || !@follow_text
+        index = @follow_text.text.index(value, @follow_text.selection.head)
+        index ||= @follow_text.text.index(value)
+        return unless index
+        @follow_text.selection = Zaniah::TextSelection.new(index, index + value.bytesize)
+        @window.request_frame
+      end
+
+      def save_stream_dialog(format: :raw, direction: nil)
+        return unless @follow_stream
+        stream = @follow_stream
+        export_path("stream-#{stream.stream_id}.#{format == :raw ? 'bin' : 'txt'}") do |path|
+          analysis_background(->(_doc, cancelled) { stream.save(path, format: format, direction: direction, cancelled: cancelled) }) { dismiss_dialog }
+        end
+      end
+
+      def export_packets = export_dialog(false)
+      def export_dissections = export_dialog(true)
+
+      def export_dialog(dissections = false, scope: :all, format: nil, range_value: "", exclude_ignored: false)
+        return unless document
+        format ||= dissections ? :json : :pcapng
+        range = Zaniah::UI::TextField.new(range_value, label: t("範囲（1-10,20,30-）")).test_id("vk.export.range")
+        ignored = Zaniah::UI::Checkbox.new(t("無視したパケットを除外"), value: exclude_ignored)
+        scope_control = Zaniah::UI::Select.new([[t("全件"), :all], [t("表示中"), :displayed], [t("選択"), :selected], [t("マーク済み"), :marked], [t("最初と最後のマークの間"), :between_marks], [t("範囲指定"), :range]], value: scope, label: t("対象"))
+          .on_change { |value, *_| scope = value }
+        formats = dissections ? %i[json ndjson text csv] : %i[pcapng pcap]
+        content = Zaniah::Div.new.flex_col.gap(8).child(scope_control).child(range).child(ignored)
+          .child(Zaniah::UI::Select.new(formats, value: format, label: t("形式")).on_change { |value, *_| format = value })
+          .child(Zaniah::UI::Button.new(t("エクスポート")).test_id("vk.export.save").on_click do
+            numbers = Gateway::Exporter.new(document).numbers(scope: scope, range: range.value, selected: selected_number, exclude_ignored: ignored.value)
+            columns = @table.columns
+            columns = columns.map { |column| column[:key] == :time ? column.merge(format: @preferences.get("packet_list.time_format").to_sym) : column }
+            export_path("packets.#{format == :text ? 'txt' : format}") do |path|
+              analysis_background(->(doc, cancelled) { Gateway::Exporter.new(doc).write(path, format: format, numbers: numbers, columns: columns, cancelled: cancelled) }) { dismiss_dialog }
+            end
+          rescue StandardError => error
+            show_error(error)
+          end)
+        analysis_dialog(:export, t("%{kind}のエクスポート", kind: t(dissections ? "解析結果" : "パケット")), content, reopen: -> { export_dialog(dissections, scope: scope, format: format, range_value: range.value, exclude_ignored: ignored.value) })
+      end
+
+      def file_properties
+        return unless document
+        controls = Zaniah::UI::Button.new(t("SHA-256を計算")).test_id("vk.properties.sha256").disabled(!document.path || !File.file?(document.path))
+          .on_click do
+            analysis_background(->(doc, *) { Digest::SHA256.file(doc.path).hexdigest }) do |digest|
+              @analysis_results.child(Zaniah::UI::Label.new("SHA-256: #{digest}", wrap: :word))
+              @window.request_frame
+            end
+          end
+        analysis_dialog(:file_properties, t("キャプチャファイルのプロパティ"), controls, reopen: -> { file_properties })
+        @analysis_refresh = lambda do
+          analysis_background(->(doc, cancelled) { capture_properties(doc, cancelled) }) do |properties|
+            analysis_content(Zaniah::Div.new.flex_col.gap(4).children(properties.map { |label, value| Zaniah::UI::Label.new("#{label}: #{value}", wrap: :word) }))
+          end
+        end
+        refresh_analysis
+      end
+
+      private
+
+      def analysis_dialog(kind, title, controls, reopen: nil)
+        dismiss_dialog
+        @analysis_results = Zaniah::Div.new.flex_col.gap(4).child(Zaniah::UI::Label.new(t("集計中…")))
+        @dialog_kind = kind
+        @dialog_reopen = reopen
+        body = Zaniah::Div.new.flex_col.gap(8).child(controls).child(@analysis_results)
+        @dialog = Zaniah::UI::Dialog.new(body, title: title, width: [760, @window.content_size.width - 32].min, close_label: t("閉じる"))
+          .on_close { dismiss_dialog }.test_id("vk.#{kind}")
+        @window.request_frame
+      end
+
+      def analysis_background(operation, &publish)
+        return if @analysis_running || @closing || !document
+        doc, generation = document, @analysis_generation || 0
+        @analysis_running = true
+        @analysis_task = @app.executor.background do
+          cancelled = -> { @closing || generation != (@analysis_generation || 0) || !document.equal?(doc) }
+          next if cancelled.call
+          value = operation.call(doc, cancelled)
+          @app.executor.post do
+            next if cancelled.call
+            @analysis_running = false
+            publish.call(value)
+          end
+        rescue StandardError => error
+          @app.executor.post do
+            next if cancelled.call
+            @analysis_running = false
+            show_error(error)
+          end
+        end
+      end
+
+      def analysis_content(content)
+        @analysis_results.children.clear
+        @analysis_results.child(content)
+        @window.request_frame
+      end
+
+      def analysis_table(rows, keys, &selection)
+        labels = {severity: "重大度", code: "コード", protocol: "プロトコル", count: "件数", message: "メッセージ",
+          addr_a: "アドレス A", port_a: "ポート A", addr_b: "アドレス B", port_b: "ポート B", packets_ab: "パケット A → B", packets_ba: "パケット B → A", bytes_ab: "バイト A → B", bytes_ba: "バイト B → A", duration_ns: "期間（ns）",
+          address: "アドレス", port: "ポート", packets_tx: "送信パケット", packets_rx: "受信パケット", bytes_tx: "送信バイト", bytes_rx: "受信バイト"}
+        label = t({expert_info: "エキスパート情報", conversations: "会話", endpoints: "端点"}.fetch(@dialog_kind, "統計"))
+        source = AnalysisRows.new(rows.dup)
+        table = Zaniah::UI::VirtualTable.new(source, columns: keys.map { |key| {key: key, label: t(labels.fetch(key, key.to_s)), width: key == :message ? 400 : 130} }, height: 300, label: label)
+          .on_sort { |key, direction, _| source.sort(key, direction); table.invalidate }
+        table.on_select { |index, event, *_| selection.call(source[index], event) } if selection
+        table
+      end
+
+      def statistics_table(statistics)
+        rows = statistics.rows
+        columns = statistics.kind == :conv ? %i[addr_a port_a addr_b port_b packets_ab packets_ba bytes_ab bytes_ba duration_ns] : %i[address port packets_tx packets_rx bytes_tx bytes_rx]
+        selected = nil
+        table = analysis_table(rows, columns) { |row, _| selected = row }
+        content = Zaniah::Div.new.flex_col.gap(6)
+          .child(Zaniah::ScrollView.new(axis: :horizontal).h(300).child(table.w(columns.size * 130)))
+        content.child(Zaniah::UI::Label.new(t("メモリ上限により%{count}行が省略されました。", count: statistics.evicted), wrap: :word)) if statistics.evicted.positive?
+        content.child(Zaniah::Div.new.flex_row.gap(6)
+          .child(Zaniah::UI::Button.new(t("フィルタとして適用")).on_click do
+            next unless selected
+            set_filter(statistics_filter(statistics, selected))
+            apply_filter
+            dismiss_dialog
+          end)
+          .child(Zaniah::UI::Button.new(t("TCP ストリームを追跡")).disabled(statistics.type != :tcp).on_click do
+            next unless selected && statistics.type == :tcp
+            expression = statistics_filter(statistics, selected)
+            doc = document
+            program = Core::DisplayFilter.compile(expression, catalog: doc.catalog)
+            analysis_background(->(*) { (1..doc.count).find { |number| program.match?(doc.view(number)) } }) do |number|
+              follow_tcp_stream(doc.annotations[number][:tcp_stream]) if number
+            end
+          end))
+        content
+      end
+
+      def statistics_filter(table, row)
+        protocol = table.type.to_s
+        if table.kind == :endpoints
+          address = %i[tcp udp].include?(table.type) ? (row.address.include?(":") ? "ipv6" : "ip") : protocol
+          expression = "#{address}.addr == #{row.address}"
+          return %i[tcp udp].include?(table.type) ? "#{expression} && #{protocol}.port == #{row.port}" : expression
+        end
+        address = %i[tcp udp].include?(table.type) ? (row.addr_a.include?(":") ? "ipv6" : "ip") : protocol
+        forward = "#{address}.src == #{row.addr_a} && #{address}.dst == #{row.addr_b}"
+        backward = "#{address}.src == #{row.addr_b} && #{address}.dst == #{row.addr_a}"
+        if %i[tcp udp].include?(table.type)
+          forward += " && #{protocol}.srcport == #{row.port_a} && #{protocol}.dstport == #{row.port_b}"
+          backward += " && #{protocol}.srcport == #{row.port_b} && #{protocol}.dstport == #{row.port_a}"
+        end
+        "(#{forward}) || (#{backward})"
+      end
+
+      def export_path(default_name, &operation)
+        return path_dialog(t("エクスポート先"), &operation) if @backend == :tui
+        path = @window.prompt_for_paths(save: true, default_name: default_name)&.first
+        operation.call(path) if path
+      rescue StandardError => error
+        show_error(error)
+      end
+
+      def capture_properties(doc, cancelled)
+        count, bytes, captured, first, last = doc.count, 0, 0, nil, nil
+        interfaces = Hash.new(0)
+        (1..count).each do |number|
+          raise Vanken::Error, "operation cancelled" if cancelled.call
+          metadata = doc.store.metadata(number)
+          bytes += metadata[:original_length]
+          captured += metadata[:caplen]
+          first = [first || metadata[:timestamp_ns], metadata[:timestamp_ns]].min
+          last = [last || metadata[:timestamp_ns], metadata[:timestamp_ns]].max
+          interfaces[metadata[:interface]&.fetch("name", nil) || t("未記録")] += 1
+        end
+        duration = first && last ? (last - first) / 1e9 : 0
+        values = {t("ファイル") => doc.path || t("未保存"), t("パケット") => count, t("期間（秒）") => duration,
+          t("合計（bytes）") => bytes, t("保存済み（bytes）") => captured,
+          t("平均pps") => duration.positive? ? (count / duration).round(3) : 0,
+          t("平均bps") => duration.positive? ? (bytes * 8 / duration).round(3) : 0}
+        interfaces.each { |name, packets| values[t("インタフェース %{name}", name: name)] = t("%{count} パケット", count: packets) }
+        doc.capture_stats.each { |key, value| values[t("取得統計 %{key}", key: key)] = value }
+        values
+      end
+    end
+  end
+end