vanken 0.1.0

data/lib/vanken/app/document.rb

@@ -0,0 +1,305 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "tempfile"
+require "json"
+require_relative "../core/frame_view"
+require_relative "../core/display_filter/compiler"
+require_relative "../capture/receiver"
+require_relative "../capture/analyzer"
+require_relative "../capture/analyzer_process"
+require_relative "document_jobs"
+
+module Vanken
+  module App
+    class Document
+      include DocumentJobs
+      attr_reader :store, :columns, :annotations, :error, :path, :source, :progress, :filter,
+                  :marked, :ignored, :time_references, :catalog, :analysis_options
+      attr_accessor :frame_latency, :scanner
+
+      def initialize(on_update: nil, preferences: nil, store: nil, scanner: nil, process_analysis: true)
+        @store = store || Core::FrameStore.new
+        @columns = Core::ColumnStore.new
+        @annotations = Core::AnnotationStore.new(@store.directory)
+        @cache = Core::RowCache.new(limit: preferences&.get("packet_list.row_cache_rows") || 20_000)
+        @verify_checksums = preferences&.get("analysis.verify_checksums") || false
+        @dissector = Gateway::Dissector.new(verify_checksums: @verify_checksums)
+        @process_analysis = process_analysis
+        @analysis_options = {max_state_bytes: (preferences&.get("analysis.max_state_mib") || 256) << 20,
+                             max_flows: preferences&.get("analysis.max_flows") || 100_000}.freeze
+        @catalog = Gateway::FieldCatalog.new
+        @mutex, @condition = Mutex.new, ConditionVariable.new
+        @jobs, @count, @generation = [], 0, 0
+        @display = nil
+        @marked, @ignored, @time_references = Set.new, Set.new, Set.new
+        @received, @analyzed, @cancelled, @dirty = false, false, false, false
+        @on_update, @last_notify = on_update, 0.0
+        @scanner = scanner
+        @scan_concurrency = preferences&.get("analysis.workers") || 4
+        @filter_tasks = []
+        @details = File.open(File.join(@store.directory, "details.jsonl"), "w+b", 0o600)
+        @detail_reader = File.open(File.join(@store.directory, "details.jsonl"), "rb")
+        @detail_index = File.open(File.join(@store.directory, "reassembled.idx"), "w+b", 0o600)
+        @detail_offsets = {}
+        @summaries = File.open(File.join(@store.directory, "summaries.bin"), "w+b", 0o600)
+        @summary_index = File.open(File.join(@store.directory, "summaries.idx"), "w+b", 0o600)
+        @summary_reader = File.open(File.join(@store.directory, "summaries.bin"), "rb")
+        @summary_index_reader = File.open(File.join(@store.directory, "summaries.idx"), "rb")
+        @summary_count = 0
+        @frame_latency = 0.0
+      end
+
+      def open(path)
+        @path, @source = File.expand_path(path), :file
+        ingest(Gateway::FileReader.new(@path))
+      rescue Vanken::FileError => error
+        fail(error)
+        self
+      end
+
+      def ingest(source, live: false)
+        @source ||= live ? :live : :file
+        @dirty = live
+        @reader = source
+        @analyzer = if @process_analysis
+          Capture::AnalyzerProcess.new(self, verify_checksums: @verify_checksums)
+        else
+          Capture::Analyzer.new(self, @dissector)
+        end
+        @jobs << thread { @analyzer.run }
+        @jobs << thread { Capture::Receiver.new(self, source).run }
+        self
+      end
+      def count = @mutex.synchronize { @count }
+      def displayed_count = @mutex.synchronize { @display ? @display.size : @count }
+      def number_at(index) = @mutex.synchronize { @display ? @display.fetch(index) : (index + 1).tap { |number| raise IndexError unless number.between?(1, @count) } }
+      def display_numbers = @mutex.synchronize { @display ? @display.dup : (1..@count).to_a }
+      def dirty? = @dirty
+      def loading? = !@analyzed && !@cancelled
+      def cancelled? = @cancelled
+      def received? = @received
+      def complete? = @analyzed
+      def closing? = !!@closing
+      def stream_frames(stream) = @mutex.synchronize { @annotations.streams[stream].dup }
+      def packet(number) = @dissector.dissect(@store.read(number))
+      # @rbs (Integer number) -> Gateway::PacketSnapshot?
+      def packet_snapshot(number)
+        saved = persisted_details(number)
+        saved && Gateway::PacketSnapshot.from_h(saved.fetch("packet"))
+      end
+      def view(number, packet: nil, snapshot: nil) = Core::FrameView.new(self, number, packet: packet, snapshot: snapshot)
+      def row(number)
+        base = @mutex.synchronize { @columns[number] }
+        frame = @store.metadata(number)
+        info = @cache.fetch(number) { persisted_summary(number) || persisted_details(number)&.fetch("info", nil) || packet(number).info }
+        base.merge(no: number, number: number, timestamp_ns: frame[:timestamp_ns], length: frame[:original_length], info: info)
+      end
+      def details(number)
+        saved = persisted_details(number)
+        return restore_nodes(saved.fetch("nodes")) if saved
+
+        Gateway::DetailBuilder.new.build(packet(number), annotations: @annotations[number])
+      end
+      def publish(number, packet)
+        committing = false
+        begin
+          columns, annotation = packet.columns, packet.annotations
+          @catalog.observe(packet)
+          saved = JSON.generate("nodes" => Gateway::DetailBuilder.new.build(packet).map(&:to_h), "info" => packet.info,
+            "packet" => Gateway::PacketSnapshot.from_packet(packet).to_h) + "\n" if packet.reassembled?
+          loop do
+            program, generation, snapshot = @mutex.synchronize { [@filter, @generation, @filter_context] }
+            matched = !program || program.match?(view(number, packet: packet, snapshot: snapshot))
+            committed = @mutex.synchronize do
+              next false if generation != @generation
+              committing = true
+              @columns.append(columns)
+              @annotations.append(number, annotation)
+              if saved
+                @detail_offsets[number] = @details.pos
+                @details.write(saved)
+                @details.flush
+                @detail_index.write([number, @detail_offsets[number]].pack("Q<Q<"))
+                @detail_index.flush
+              end
+              @count = number
+              @dirty = true if @source == :live
+              @display << number if @display && matched
+              true
+            end
+            break if committed
+          end
+        rescue StandardError => error
+          # Storage errors must abort, rather than appending another record.
+          raise if committing
+          return publish_failure(number, error)
+        end
+        notify
+      end
+      def publish_failure(number, error)
+        @mutex.synchronize do
+          @columns.append(source: "", destination: "", protocol: "Malformed", src_port: -1, dst_port: -1, ip_proto: -1, layers: [])
+          @annotations.append(number, tcp_stream: -1, seq_rel: -1, ack_rel: -1, analysis_flags: [], expert_max: 3,
+            expert_items: [{severity: :error, code: "vanken.internal_error", protocol: "vanken", message: error.message}], extra: {})
+          @count = number
+          @display << number if @display && !@filter
+        end
+        notify
+      end
+      # Only immutable context for this unpublished range crosses the worker pipe.
+      def analysis_configuration(first, last)
+        @mutex.synchronize do
+          historical = !!@filter_context
+          current = @filter_context || {marked: @marked, ignored: @ignored, references: @time_references,
+            predecessors: nil, limit: @count, last_displayed: @display ? @display.last : @count}
+          snapshot = current.merge(marked: current[:marked].select { |n| n.between?(first, last) }.to_set,
+            ignored: current[:ignored].select { |n| n.between?(first, last) }.to_set,
+            references: current[:references].dup, predecessors: nil,
+            unfiltered_predecessor: historical && current[:predecessors].nil?)
+          {expression: @filter&.expression || "", generation: @generation, snapshot: snapshot,
+           historical_context: historical, context_token: @filter_context&.object_id}
+        end
+      end
+      def publish_analysis_batch(batch, analyzer, generation, context_token: nil)
+        first, last = batch.values_at(:first, :last)
+        length = last - first + 1
+        raise Vanken::Error, "invalid analysis batch" unless length.between?(1, 256) &&
+          batch[:columns][:data].bytesize == length * Core::ColumnStore::SIZE &&
+          batch[:annotations][:data].bytesize == length * Core::AnnotationStore::SIZE && batch[:summary_index].bytesize == length * 8
+        loop do
+          committed = @mutex.synchronize do
+            raise Vanken::Error, "nonsequential analysis publication" unless first == @count + 1
+            next false if generation != @generation || context_token != @filter_context&.object_id
+            raise Vanken::Error, "invalid filter matches" unless batch[:matches].all? { |number| number.between?(first, last) } && batch[:matches] == batch[:matches].sort.uniq
+            @columns.import(batch[:columns])
+            @annotations.import(batch[:annotations])
+            batch[:details].each do |number, saved|
+              @detail_offsets[number] = @details.pos
+              @details.write(saved)
+              @detail_index.write([number, @detail_offsets[number]].pack("Q<Q<"))
+            end
+            base = @summaries.pos
+            offsets = batch[:summary_index].unpack("Q<*").map { |offset| base + offset }.pack("Q<*")
+            @summaries.write(batch[:summaries])
+            @summary_index.write(offsets)
+            [@annotations, @details, @detail_index, @summaries, @summary_index].each(&:flush)
+            @catalog.merge(batch[:fields])
+            @summary_count = @count = last
+            @dirty = true if @source == :live
+            @display.concat(batch[:matches]) if @display
+            true
+          end
+          break if committed
+          configuration = analysis_configuration(first, last)
+          batch[:matches] = analyzer.request(configuration.merge(command: :match)).fetch(:matches)
+          generation = configuration[:generation]
+          context_token = configuration[:context_token]
+        end
+        notify
+      end
+      def receiving_done = (@received = true; signal)
+      def analyzing_done = (@annotations.flush; @analyzed = true; notify(force: true))
+      def signal = @mutex.synchronize { @condition.broadcast }
+      def wait_for_frames = @mutex.synchronize { @condition.wait(@mutex, 0.05) }
+      def fail(error) = (@error = error; notify(force: true))
+
+      def time_value(number, format = :relative, references: nil)
+        current = @store.metadata(number)[:timestamp_ns]
+        base = case format.to_sym
+        when :epoch, :absolute then 0
+        when :delta then number == 1 ? current : @store.metadata(number - 1)[:timestamp_ns]
+        when :delta_displayed
+          displayed = display_numbers
+          index = displayed.index(number)
+          previous = index && index.positive? ? displayed[index - 1] : (number > count ? displayed.last : nil)
+          previous ? @store.metadata(previous)[:timestamp_ns] : current
+        else
+          reference = (references || @time_references).select { |value| value <= number }.max || 1
+          @store.metadata(reference)[:timestamp_ns]
+        end
+        (current - base) / 1e9
+      end
+
+      def cancel
+        @cancelled = true
+        @reader.stop if @reader.respond_to?(:stop)
+        signal
+        self
+      end
+      def wait(timeout = nil)
+        deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
+        @jobs.each do |job|
+          remaining = deadline && (deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC))
+          raise Vanken::Error, "background operation did not stop" if remaining && remaining <= 0 && job.alive?
+          raise Vanken::Error, "background operation did not stop" unless job.join(remaining && [remaining, 0].max)
+        end
+        self
+      end
+      def close
+        return self if @closed
+        @closing = true
+        cancel
+        cancel_scan
+        wait(3)
+        @annotations.close
+        @details.close
+        @detail_reader.close
+        @detail_index.close
+        @summaries.close
+        @summary_index.close
+        @summary_reader.close
+        @summary_index_reader.close
+        @store.close
+        @closed = true
+        self
+      end
+
+      private
+      def persisted_summary(number)
+        return nil if number > @summary_count
+        if @summary_index_reader.respond_to?(:pread)
+          offset = @summary_index_reader.pread(8, (number - 1) * 8).unpack1("Q<")
+          length = @summary_reader.pread(4, offset).unpack1("L<")
+          length.zero? ? "" : @summary_reader.pread(length, offset + 4)
+        else
+          @mutex.synchronize do
+            @summary_index_reader.seek((number - 1) * 8)
+            offset = @summary_index_reader.read(8).unpack1("Q<")
+            @summary_reader.seek(offset)
+            length = @summary_reader.read(4).unpack1("L<")
+            length.zero? ? "" : @summary_reader.read(length)
+          end
+        end
+      end
+      def persisted_details(number)
+        @mutex.synchronize do
+          offset = @detail_offsets[number]
+          next nil unless offset
+          @detail_reader.seek(offset)
+          JSON.parse(@detail_reader.gets)
+        end
+      end
+      def thread(&block)
+        Thread.new do
+          Thread.current.report_on_exception = false
+          block.call
+        rescue StandardError => error
+          fail(error)
+        end
+      end
+      def notify(force: false)
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        return unless force || now - @last_notify >= 0.1
+        @last_notify = now
+        @on_update&.call(self)
+      end
+      def restore_nodes(nodes)
+        nodes.map do |value|
+          node = value.transform_keys(&:to_sym)
+          Core::DetailNode.new(**node.merge(source: node[:source].to_sym, severity: node[:severity]&.to_sym, children: restore_nodes(node[:children])))
+        end
+      end
+    end
+  end
+end

data/lib/vanken/app/document_jobs.rb

@@ -0,0 +1,199 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Vanken
+  module App
+    module DocumentJobs
+      def apply_filter(expression)
+        program = Core::DisplayFilter.compile(expression, catalog: @catalog)
+        cancel_scan
+        if expression.empty?
+          @mutex.synchronize do
+            @filter = @filter_context = @display = @progress = @filter_job = nil
+          end
+          notify(force: true)
+          return self
+        end
+        generation, limit, snapshot = @mutex.synchronize do
+          context = filter_snapshot(displayed_delta: program.fields.include?("frame.time_delta_displayed"))
+          @filter = program
+          @filter_context = context
+          # Reserve the history's capacity before publishing matches without placeholder rows.
+          @display = Array.new(@count)
+          @display[0, @count] = []
+          @progress = 0.0
+          [@generation, @count, context]
+        end
+        @filter_job = thread do
+          if @scanner && !program.fast?
+            path = @mutex.synchronize { @annotations.snapshot(File.join(@store.directory, "annotations-#{generation}.json")) }
+            snapshot = snapshot.merge(annotations_json: path).freeze
+          end
+          historical_cursor = 0
+          ranges = (1..limit).step(10_000).map { |first| [first, [first + 10_000, limit + 1].min] }
+          ranges.each_slice(@scanner && !program.fast? ? @scan_concurrency : 1) do |window|
+            break if stale_job?(generation)
+            pending = window.map do |first, last|
+              if @scanner && !program.fast?
+                task = @scanner.call(filter_payload(first, last, expression: expression, snapshot: snapshot))
+                stale = @mutex.synchronize do
+                  @filter_tasks << task if generation == @generation && task.respond_to?(:cancel)
+                  generation != @generation
+                end
+                task.cancel if stale && task.respond_to?(:cancel)
+                [last, task]
+              else
+                [last, {"matches" => (first...last).select { |number| !stale_job?(generation) && program.match?(view(number, snapshot: snapshot)) }}]
+              end
+            end
+            pending.each do |last, task|
+              break if stale_job?(generation)
+              value = task.respond_to?(:await) ? task.await : task
+              break if stale_job?(generation)
+              matches = value.fetch("matches")
+              @mutex.synchronize do
+                next if generation != @generation
+                @display[historical_cursor, 0] = matches
+                historical_cursor += matches.length
+                @progress = (last - 1).fdiv([limit, 1].max)
+              end
+              notify
+            end
+          end
+          @mutex.synchronize do
+            next if generation != @generation
+            @filter_context = nil
+            @progress = nil
+            @filter_tasks.clear
+          end
+          notify(force: true) unless stale_job?(generation)
+        rescue StandardError => error
+          fail(error) unless stale_job?(generation)
+        ensure
+          tasks = @mutex.synchronize do
+            if generation == @generation
+              @progress = nil
+              @filter_context = nil
+              remaining, @filter_tasks = @filter_tasks, []
+              remaining
+            else
+              []
+            end
+          end
+          tasks.each(&:cancel)
+          File.unlink(path) if path && File.exist?(path)
+        end
+        @jobs << @filter_job
+        self
+      end
+
+      def cancel_scan
+        tasks = @mutex.synchronize do
+          @generation += 1
+          @progress = nil
+          @filter_context = nil
+          saved, @filter_tasks = @filter_tasks, []
+          saved
+        end
+        tasks.each(&:cancel)
+        self
+      end
+
+      def filter_payload(first, last, expression: @filter&.expression || "", snapshot: nil)
+        unless snapshot
+          displayed_delta = Core::DisplayFilter.compile(expression, catalog: @catalog).fields.include?("frame.time_delta_displayed")
+          snapshot = @mutex.synchronize do
+            @snapshot_sequence = (@snapshot_sequence || 0) + 1
+            filter_snapshot(displayed_delta: displayed_delta).merge(annotations_json: @annotations.snapshot(File.join(@store.directory, "annotations-#{@generation}-#{@snapshot_sequence}.json")))
+          end
+        end
+        predecessors = (first...last).to_h { |number| [number.to_s, displayed_predecessor(number, snapshot)] }
+        {"spool" => @store.directory, "expr" => expression, "from" => first, "to" => last,
+         "decode_as" => [], "plugins" => [], "annotations_json" => snapshot[:annotations_json],
+         "marked" => snapshot[:marked].select { |number| number >= first && number < last },
+         "ignored" => snapshot[:ignored].select { |number| number >= first && number < last },
+         "time_references_ns" => snapshot[:references].to_h { |number| [number.to_s, @store.metadata(number)[:timestamp_ns]] },
+         "time_reference_ns" => snapshot[:limit].zero? ? 0 : @store.metadata(1)[:timestamp_ns],
+         "displayed_predecessors" => predecessors}
+      end
+
+      def displayed_predecessor(number, snapshot)
+        return number - 1 unless snapshot[:predecessors]
+        return snapshot[:last_displayed] || 0 if number > snapshot[:limit]
+        snapshot[:predecessors].fetch(number, 0)
+      end
+
+      def sort(key, direction = :asc)
+        raise ArgumentError, "invalid sort direction" unless %i[asc desc].include?(direction)
+        generation, sort_generation, filter_job = @mutex.synchronize do
+          @sort_generation = (@sort_generation || 0) + 1
+          [@generation, @sort_generation, @filter_job]
+        end
+        @jobs << thread do
+          filter_job&.join
+          next if generation != @generation || sort_generation != @sort_generation || @closing
+          numbers = display_numbers
+          values = numbers.to_h do |number|
+            value = case key.to_sym
+            when :no, :number then number
+            when :time then @store.metadata(number)[:timestamp_ns]
+            when :length then @store.metadata(number)[:original_length]
+            else row(number).fetch(key.to_sym)
+            end
+            [number, value]
+          end
+          numbers.sort! { |a, b| comparison = values[a] <=> values[b]; comparison = -comparison if direction == :desc; comparison.zero? ? a <=> b : comparison }
+          @mutex.synchronize do
+            next if generation != @generation || sort_generation != @sort_generation || @closing
+            @display = numbers + (@display ? @display - numbers : ((1..@count).to_a - numbers))
+          end
+          notify(force: true)
+        end
+        self
+      end
+
+      def save(path, format: nil, numbers: nil)
+        @error = nil
+        format ||= File.extname(path) == ".pcap" ? :pcap : :pcapng
+        limit = count
+        @save_job = thread do
+          temporary = Tempfile.create([".vanken-", ".tmp"], File.dirname(File.expand_path(path)))
+          begin
+            linktype = limit.zero? ? 1 : @store.metadata(1)[:linktype]
+            Gateway::FileWriter.open(temporary, format: format, linktype: linktype) do |writer|
+              (numbers || (1..limit)).each { |number| writer << @store.read(number) }
+            end
+            temporary.flush
+            temporary.fsync
+            temporary.close
+            File.rename(temporary.path, File.expand_path(path))
+            @mutex.synchronize do
+              @dirty = false if !numbers && @count == limit && @store.count == limit
+              @path = File.expand_path(path) unless numbers
+            end
+            notify(force: true)
+          ensure
+            temporary.close unless temporary.closed?
+            FileUtils.rm_f(temporary.path)
+          end
+        end
+        @jobs << @save_job
+        self
+      end
+
+      def wait_for_save(timeout = nil)
+        raise Vanken::Error, "save operation did not stop" if @save_job && !@save_job.join(timeout)
+        self
+      end
+
+      private
+      def stale_job?(generation) = @closing || generation != @generation
+      def filter_snapshot(displayed_delta: true)
+        predecessors = @display.each_with_index.to_h { |number, index| [number, index.zero? ? 0 : @display[index - 1]] }.freeze if displayed_delta && @display
+        {marked: @marked.dup.freeze, ignored: @ignored.dup.freeze, references: @time_references.dup.freeze,
+         predecessors: predecessors,
+         limit: @count, last_displayed: @display ? @display.last : @count}.freeze
+      end
+    end
+  end
+end

data/lib/vanken/capture/analyzer.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Vanken
+  module Capture
+    class Analyzer
+      def initialize(document, dissector)
+        @document, @dissector = document, dissector
+        @analysis = Gateway::Analysis.new(registry: dissector.registry, **document.analysis_options)
+      end
+      def run
+        number = 1
+        loop do
+          break if @document.respond_to?(:closing?) && @document.closing?
+          if number > @document.store.durable_count
+            break if @document.received? && number > @document.store.durable_count
+            @document.wait_for_frames
+            next
+          end
+          frame = @document.store.read(number)
+          begin
+            packet = @dissector.dissect(frame)
+            @analysis.update(packet)
+          rescue StandardError => error
+            @document.publish_failure(number, error)
+            packet = nil
+          end
+          @document.publish(number, packet) if packet
+          number += 1
+          if number % 256 == 0
+            Thread.pass
+            sleep(0.002) if @document.frame_latency > 0.033
+          end
+        end
+      ensure
+        begin
+          @analysis.close
+        ensure
+          @document.analyzing_done
+        end
+      end
+    end
+  end
+end

data/lib/vanken/capture/analyzer_process.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+require_relative "analyzer_wire"
+
+module Vanken
+  module Capture
+    class AnalyzerProcess
+      attr_reader :pid
+      def initialize(document, verify_checksums: false)
+        @document, @verify_checksums = document, verify_checksums
+      end
+      def run
+        unless Gem.win_platform?
+          raise Vanken::Error, "packet analysis must run without root privileges" if Process.uid.zero? || Process.euid.zero?
+        end
+        child_in, @input = IO.pipe
+        @output, child_out = IO.pipe
+        [child_in, @input, @output, child_out].each(&:binmode)
+        arguments = [RbConfig.ruby]
+        arguments << "--yjit" if defined?(RubyVM::YJIT) && RubyVM::YJIT.enabled?
+        arguments << File.expand_path("analyzer_worker.rb", __dir__)
+        @pid = Process.spawn(*arguments, in: child_in, out: child_out, close_others: true)
+        child_in.close
+        child_out.close
+        request(command: :start, spool: @document.store.directory, verify_checksums: @verify_checksums, analysis_options: @document.analysis_options)
+        number = 1
+        loop do
+          break if @document.closing?
+          limit = @document.store.durable_count
+          if number > limit
+            break if @document.received? && number > @document.store.durable_count
+            @document.wait_for_frames
+            next
+          end
+          last = [number + 255, limit].min
+          configuration = @document.analysis_configuration(number, last)
+          batch = request(configuration.merge(command: :analyze, first: number, last: last, interfaces: @document.store.interfaces))
+          raise Vanken::Error, "analysis response range mismatch" unless batch[:first] == number && batch[:last] == last
+          @document.publish_analysis_batch(batch, self, configuration[:generation], context_token: configuration[:context_token])
+          number = last + 1
+        end
+      rescue StandardError
+        @document.cancel
+        raise unless @document.closing?
+      ensure
+        child_in&.close unless child_in&.closed?
+        child_out&.close unless child_out&.closed?
+        begin
+          shutdown
+        ensure
+          @document.analyzing_done
+        end
+      end
+      def request(value)
+        AnalyzerWire.write(@input, value)
+        response = AnalyzerWire.read(@output, cancelled: -> { @document.closing? })
+        raise Vanken::Error, response[:error] if response[:error]
+        response
+      end
+      def shutdown
+        begin
+          AnalyzerWire.write(@input, {command: :stop}) if @pid && @input && !@input.closed?
+        rescue IOError, SystemCallError
+          nil
+        ensure
+          @input&.close unless @input&.closed?
+          @output&.close unless @output&.closed?
+        end
+        return unless @pid
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 1
+        status = nil
+        loop do
+          if (result = Process.waitpid2(@pid, Process::WNOHANG))
+            status = result.last
+            break
+          end
+          if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            Process.kill("KILL", @pid)
+            status = Process.waitpid2(@pid).last
+            break
+          end
+          sleep(0.005)
+        end
+        raise Vanken::Error, "analysis worker failed while stopping" unless status.success? || @document.closing? || $!
+      rescue Errno::ECHILD, Errno::ESRCH
+        nil
+      end
+    end
+  end
+end

data/lib/vanken/capture/analyzer_wire.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require "io/wait"
+
+module Vanken
+  module Capture
+    # These pipes are private to the same-user worker. Marshal.load only receives
+    # protocol messages serialized by our child, never an external serialized object.
+    module AnalyzerWire
+      VERSION = 1
+      MAX_BYTES = 64 << 20
+      def self.write(io, value)
+        bytes = Marshal.dump(value.merge(version: VERSION))
+        raise Vanken::Error, "analysis message exceeds limit" if bytes.bytesize > MAX_BYTES
+        io.write([bytes.bytesize].pack("L>"))
+        io.write(bytes)
+        io.flush
+      end
+      def self.read(io, cancelled: nil)
+        header = exact(io, 4, cancelled)
+        length = header.unpack1("L>")
+        raise Vanken::Error, "invalid analysis message size" unless length.between?(1, MAX_BYTES)
+        value = Marshal.load(exact(io, length, cancelled))
+        raise Vanken::Error, "invalid analysis protocol" unless value.is_a?(Hash) && value[:version] == VERSION
+        value
+      end
+      def self.exact(io, length, cancelled)
+        bytes = String.new(capacity: length, encoding: Encoding::BINARY)
+        fragment = String.new(capacity: [length, 64 << 10].min, encoding: Encoding::BINARY)
+        until bytes.bytesize == length
+          raise Vanken::Error, "analysis stopped" if cancelled&.call
+          next unless io.wait_readable(0.05)
+          part = io.read_nonblock([length - bytes.bytesize, 64 << 10].min, fragment, exception: false)
+          next if part == :wait_readable
+          raise Vanken::Error, "analysis worker closed its pipe" unless part
+          bytes << part
+        end
+        bytes
+      end
+    end
+  end
+end