vanken 0.1.0

data/lib/vanken/core/display_filter/lexer.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "strscan"
+require "ipaddr"
+require_relative "errors"
+
+module Vanken
+  module Core
+    module DisplayFilter
+      Token = Data.define(
+        :type, #: Symbol
+        :value, #: untyped
+        :position, #: Integer
+        :length, #: Integer
+        :raw #: String
+      )
+
+      class Lexer
+        OPERATORS = {
+          "==" => :eq, "eq" => :eq, "!=" => :ne, "ne" => :ne, "~=" => :any_ne, "any_ne" => :any_ne,
+          ">" => :gt, "gt" => :gt, "<" => :lt, "lt" => :lt, ">=" => :ge, "ge" => :ge,
+          "<=" => :le, "le" => :le, "contains" => :contains, "matches" => :matches, "in" => :in,
+          "&" => :bitmask, "and" => :and, "&&" => :and, "or" => :or, "||" => :or,
+          "not" => :not, "!" => :not
+        }.freeze
+        PUNCTUATION = {"(" => :lparen, ")" => :rparen, "{" => :lbrace, "}" => :rbrace,
+                       "," => :comma, ".." => :range}.freeze
+
+        # @rbs (String expression) -> void
+        def initialize(expression)
+          raise SyntaxError.new("Filter exceeds 8192 bytes", position: 8192) if expression.bytesize > 8192
+          @scanner = StringScanner.new(expression)
+        end
+
+        # @rbs () -> Array[Token]
+        def tokens
+          result = [] #: Array[Token]
+          until @scanner.eos?
+            next if @scanner.scan(/\s+/)
+
+            position = @scanner.pos
+            if @scanner.peek(1) == '"'
+              value = read_string(position)
+              raw = @scanner.string.byteslice(position...@scanner.pos)
+              result << Token.new(:string, value, position, raw.bytesize, raw)
+              next
+            end
+            raw = @scanner.scan(/==|!=|~=|>=|<=|&&|\|\||\.\.|[(){}<>&!,]/) ||
+                  @scanner.scan(/(?:(?!\.\.)[^\s(){}<>=!~&|,"'])+/)
+            fail_at("Unexpected character", position, 1) unless raw
+            type, value = classify(raw, position)
+            result << Token.new(type, value, position, raw.bytesize, raw)
+          end
+          result << Token.new(:eof, nil, @scanner.pos, 0, "")
+        end
+
+        private
+
+        # @rbs (Integer position) -> String
+        def read_string(position)
+          @scanner.getch
+          value = +"".b
+          until @scanner.eos?
+            character = @scanner.getch
+            if character == '"'
+              value.force_encoding(@scanner.string.encoding)
+              return value.valid_encoding? ? value : value.b
+            end
+            if character == "\\"
+              escaped = @scanner.getch
+              if escaped == "x"
+                hex = @scanner.scan(/[0-9a-fA-F]{2}/)
+                fail_at("Expected two hexadecimal escape digits", position, @scanner.pos - position) unless hex
+                value << hex.to_i(16).chr
+              elsif escaped == '"' || escaped == "\\"
+                value << escaped
+              else
+                fail_at("Unknown string escape", position, @scanner.pos - position)
+              end
+            else
+              value << character.b
+            end
+          end
+          fail_at("Unterminated string", position, @scanner.pos - position)
+        end
+
+        # @rbs (String raw, Integer position) -> [Symbol, untyped]
+        def classify(raw, position)
+          return [:operator, OPERATORS.fetch(raw)] if OPERATORS.key?(raw)
+          return [PUNCTUATION.fetch(raw), raw] if PUNCTUATION.key?(raw)
+          return [:boolean, raw == "true"] if %w[true false].include?(raw)
+          if /\A-?(?:0x[\da-f]+|0o[0-7]+|0b[01]+|\d+)\z/i.match?(raw)
+            return [:integer, Integer(raw, raw.match?(/\A-?0[xob]/i) ? 0 : 10)]
+          end
+          if /\A-?(?:\d+\.\d+(?:e[+-]?\d+)?|\d+e[+-]?\d+)\z/i.match?(raw)
+            value = Float(raw)
+            fail_at("Number must be finite", position, raw.bytesize) unless value.finite?
+            return [:float, value]
+          end
+          return [:mac, raw] if /\A(?:[\da-f]{2}:){5}[\da-f]{2}\z/i.match?(raw) ||
+                               /\A(?:[\da-f]{2}-){5}[\da-f]{2}\z/i.match?(raw) ||
+                               /\A[\da-f]{4}\.[\da-f]{4}\.[\da-f]{4}\z/i.match?(raw)
+          return [:bytes, raw] if /\A(?:[\da-f]{2}:)+[\da-f]{2}\z/i.match?(raw) && raw.count(":") != 7
+          if raw.include?(":") || /\A\d+\./.match?(raw)
+            begin
+              IPAddr.new(raw)
+              return [:address, raw]
+            rescue IPAddr::Error
+              fail_at("Invalid address", position, raw.bytesize)
+            end
+          end
+          return [:identifier, raw] if /\A[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*\z/.match?(raw)
+
+          fail_at("Invalid token #{raw.inspect}", position, raw.bytesize)
+        end
+
+        # @rbs (String message, Integer position, Integer length) -> bot
+        def fail_at(message, position, length)
+          raise SyntaxError.new(message, position: position, length: length)
+        end
+      end
+    end
+  end
+end

data/lib/vanken/core/display_filter/parser.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require_relative "lexer"
+
+module Vanken
+  module Core
+    module DisplayFilter
+      Node = Data.define(
+        :kind, #: Symbol
+        :left, #: untyped
+        :right #: untyped
+      )
+      Predicate = Data.define(
+        :operator, #: Symbol
+        :values, #: Array[Member]
+        :token #: Token
+      )
+      Member = Data.define(
+        :first, #: Token
+        :last #: Token?
+      )
+
+      class Parser
+        PRECEDENCE = {or: 10, and: 20}.freeze
+        VALUES = %i[integer float string address mac bytes boolean identifier].freeze
+        RELATIONS = %i[eq ne any_ne gt lt ge le contains].freeze
+        attr_reader :warnings #: Array[String]
+
+        # @rbs (String expression) -> void
+        def initialize(expression)
+          @tokens = Lexer.new(expression).tokens
+          raise SyntaxError.new("Filter has too many tokens", position: @tokens[512].position) if @tokens.size > 512
+          @index = 0
+          @warnings = []
+          @scopes = [[]] #: Array[Array[Symbol]]
+          @scope = 0
+          @depth = 0
+        end
+
+        # @rbs () -> Node
+        def parse
+          return Node.new(:true, nil, nil) if current.type == :eof
+
+          ast = expression(0)
+          expect_token(:eof)
+          if @scopes.any? { |operators| operators.uniq.size > 1 }
+            @warnings << "Use parentheses when mixing and with or"
+          end
+          ast
+        end
+
+        private
+
+        # @rbs (Integer minimum) -> Node
+        def expression(minimum)
+          left = primary
+          while current.type == :operator && (precedence = PRECEDENCE[current.value]) && precedence >= minimum
+            operator = advance.value
+            @scopes[@scope] << operator
+            left = Node.new(operator, left, expression(precedence + 1))
+          end
+          left
+        end
+
+        # @rbs () -> Node
+        def primary
+          @depth += 1
+          fail_at("Filter nesting exceeds 64 levels", current) if @depth > 64
+          if current.type == :operator && current.value == :not
+            advance
+            return Node.new(:not, primary, nil)
+          end
+          if current.type == :lparen
+            advance
+            parent_scope = @scope
+            @scope = @scopes.length
+            scope = [] #: Array[Symbol]
+            @scopes << scope
+            node = expression(0)
+            expect_token(:rparen)
+            @scope = parent_scope
+            return node
+          end
+          field = expect_token(:identifier)
+          Node.new(:test, field, predicate)
+        ensure
+          @depth -= 1
+        end
+
+        # @rbs () -> Predicate?
+        def predicate
+          return nil unless current.type == :operator
+          return nil if PRECEDENCE.key?(current.value)
+
+          operator = advance
+          if RELATIONS.include?(operator.value)
+            members = [Member.new(value, nil)]
+          elsif operator.value == :matches
+            members = [Member.new(expect_token(:string), nil)]
+          elsif operator.value == :bitmask
+            members = [Member.new(expect_token(:integer), nil)]
+          elsif operator.value == :in
+            members = set_members
+          else
+            fail_at("Unexpected operator", operator)
+          end
+          Predicate.new(operator.value, members, operator)
+        end
+
+        # @rbs () -> Array[Member]
+        def set_members
+          expect_token(:lbrace)
+          members = [] #: Array[Member]
+          loop do
+            first = value
+            last = current.type == :range ? (advance; value) : nil
+            members << Member.new(first, last)
+            break if current.type == :rbrace
+
+            advance if current.type == :comma
+          end
+          expect_token(:rbrace)
+          members
+        end
+
+        # @rbs () -> Token
+        def value
+          return advance if VALUES.include?(current.type)
+
+          fail_at("Expected a value", current)
+        end
+
+        # @rbs (Symbol type) -> Token
+        def expect_token(type)
+          return advance if current.type == type
+
+          fail_at("Expected #{type}", current)
+        end
+
+        # @rbs () -> Token
+        def current = @tokens.fetch(@index)
+
+        # @rbs () -> Token
+        def advance
+          token = current
+          @index += 1
+          token
+        end
+
+        # @rbs (String message, Token token) -> bot
+        def fail_at(message, token)
+          raise SyntaxError.new(message, position: token.position, length: token.length)
+        end
+      end
+    end
+  end
+end

data/lib/vanken/core/display_filter/types.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Vanken
+  module Core
+    module DisplayFilter
+      module Types
+        NUMERIC = %i[integer float].freeze
+        ORDERED = %i[integer float severity].freeze
+        SEVERITIES = {"note" => 0, "warning" => 1, "warn" => 1, "error" => 2}.freeze
+        module_function
+
+        # @rbs (Predicate predicate, field_type? type) -> ^(untyped, field_type?) -> bool
+        def predicate(predicate, type)
+          operator = predicate.operator
+          validate_operator(operator, type, predicate.token)
+          regex = regular_expression(predicate.values.first.first) if operator == :matches
+          members = prepare_members(predicate.values, type) if type
+          lambda do |actual, runtime_type|
+            value_type = type || runtime_type || infer_type(actual, predicate.values.first.first)
+            validate_operator(operator, value_type, predicate.token) unless type
+            prepared = members || prepare_members(predicate.values, value_type)
+            value = actual_value(actual, value_type)
+            compare(value, operator, prepared, regex, value_type)
+          rescue ArgumentError, TypeError, Regexp::TimeoutError, SyntaxError
+            false
+          end
+        end
+
+        # @rbs (Symbol operator, field_type? type, Token token) -> void
+        def validate_operator(operator, type, token)
+          return unless type
+
+          allowed = case operator
+          when :bitmask then type == :integer
+          when :contains then %i[string bytes].include?(type)
+          when :matches then type == :string
+          when :gt, :lt, :ge, :le then ORDERED.include?(type)
+          else true
+          end
+          fail_at("#{operator} is not supported for #{type}", token) unless allowed
+        end
+
+        # @rbs (Array[Member] members, field_type? type) -> Array[prepared_member]
+        def prepare_members(members, type)
+          members.map do |member|
+            first = literal(member.first, type)
+            last = literal(member.last, type) if member.last
+            if member.last && (!ORDERED.include?(type) || first > last)
+              fail_at("Invalid range", member.last)
+            end
+            [first, last]
+          end
+        end
+
+        # @rbs (Token token, field_type? type) -> untyped
+        def literal(token, type)
+          case type
+          when :integer, :float
+            fail_at("Expected a numeric value", token) unless NUMERIC.include?(token.type)
+            token.value
+          when :boolean
+            return token.value if token.type == :boolean
+            return token.value == 1 if token.type == :integer && [0, 1].include?(token.value)
+
+            fail_at("Expected true, false, 1, or 0", token)
+          when :address
+            IPAddr.new(token.value.to_s)
+          when :mac
+            normalized_mac(token.value)
+          when :bytes
+            return [token.raw.delete_prefix("0x").delete_prefix("0X")].pack("H*") if token.type == :integer && token.raw.match?(/\A0x(?:[\da-f]{2})+\z/i)
+            return [token.value.delete(".:-")].pack("H*") if %i[bytes mac].include?(token.type) ||
+              (token.type == :address && /\A(?:[\da-f]{2}:)+[\da-f]{2}\z/i.match?(token.raw))
+            return token.value.b if token.type == :string
+
+            fail_at("Expected bytes or a string", token)
+          when :severity
+            SEVERITIES.fetch(token.value.to_s) { fail_at("Expected note, warning, or error", token) }
+          when :string
+            fail_at("Expected a string", token) unless %i[string identifier].include?(token.type)
+            token.value
+          else
+            token.type == :address ? IPAddr.new(token.value) : token.value
+          end
+        rescue ArgumentError
+          fail_at("Invalid #{type} value", token)
+        end
+
+        # @rbs (untyped value, field_type? type) -> untyped
+        def actual_value(value, type)
+          case type
+          when :address then value.is_a?(IPAddr) ? value : IPAddr.new(value.to_s)
+          when :mac then normalized_mac(value)
+          when :bytes then value.b
+          when :severity then SEVERITIES.fetch(value.to_s)
+          when :string then value.to_s
+          when :boolean
+            return value if value == true || value == false
+            return value == 1 if value == 0 || value == 1
+
+            raise TypeError, "Invalid boolean value"
+          when :integer, :float
+            raise TypeError, "Invalid numeric value" unless value.is_a?(Numeric)
+            value
+          else value
+          end
+        end
+
+        # @rbs (untyped actual, Token token) -> field_type
+        def infer_type(actual, token)
+          return :boolean if actual == true || actual == false
+          return :integer if actual.is_a?(Integer)
+          return :float if actual.is_a?(Numeric)
+          return :address if actual.is_a?(IPAddr) || token.type == :address
+          return :mac if token.type == :mac
+          return :bytes if token.type == :bytes || (actual.is_a?(String) && actual.encoding == Encoding::BINARY)
+
+          :string
+        end
+
+        # @rbs (untyped value, Symbol operator, Array[prepared_member] members, Regexp? regex, field_type? type) -> bool
+        def compare(value, operator, members, regex, type)
+          expected = members.first.first
+          case operator
+          when :eq, :ne, :any_ne
+            equal = type == :address ? expected.include?(value) : value == expected
+            operator == :eq ? equal : !equal
+          when :gt then value > expected
+          when :lt then value < expected
+          when :ge then value >= expected
+          when :le then value <= expected
+          when :contains then value.include?(expected)
+          when :matches then !!regex&.match?(value)
+          when :bitmask then (value & expected) != 0
+          when :in
+            members.any? do |first, last|
+              if last
+                value >= first && value <= last
+              elsif type == :address
+                first.include?(value)
+              else
+                value == first
+              end
+            end
+          else raise ArgumentError, "Unknown filter operator: #{operator}"
+          end
+        end
+
+        # @rbs (untyped value) -> String
+        def normalized_mac(value)
+          string = value.to_s
+          valid = /\A(?:[\da-f]{2}:){5}[\da-f]{2}\z/i.match?(string) ||
+                  /\A(?:[\da-f]{2}-){5}[\da-f]{2}\z/i.match?(string) ||
+                  /\A[\da-f]{4}\.[\da-f]{4}\.[\da-f]{4}\z/i.match?(string)
+          raise ArgumentError, "Invalid MAC address" unless valid
+
+          string.delete(".:-").downcase
+        end
+
+        # @rbs (Token token) -> Regexp
+        def regular_expression(token)
+          Regexp.new(token.value, timeout: 0.1)
+        rescue RegexpError
+          fail_at("Invalid regular expression", token)
+        end
+
+        # @rbs (String message, Token token) -> bot
+        def fail_at(message, token)
+          raise SyntaxError.new(message, position: token.position, length: token.length)
+        end
+      end
+    end
+  end
+end

data/lib/vanken/core/frame.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Vanken
+  module Core
+    Frame = Data.define(
+      :bytes, #: String
+      :timestamp_ns, #: Integer
+      :original_length, #: Integer
+      :linktype, #: Integer
+      :interface, #: Hash[String, untyped]?
+      :direction, #: (:in | :out)?
+      :number #: Integer
+    )
+    DetailNode = Data.define(
+      :id, #: String
+      :label, #: String
+      :field, #: String?
+      :offset, #: Integer?
+      :length, #: Integer
+      :source, #: Symbol
+      :severity, #: Symbol?
+      :filter, #: String?
+      :children #: Array[DetailNode]
+    )
+    class DetailNode
+      # @rbs () -> Array[DetailNode]
+      def descendants = [self, *children.flat_map(&:descendants)]
+      # @rbs () -> Hash[Symbol, untyped]
+      def to_h = super.merge(children: children.map(&:to_h))
+    end
+  end
+end

data/lib/vanken/core/frame_store.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "tmpdir"
+require "json"
+require "fileutils"
+require_relative "frame"
+
+module Vanken
+  module Core
+    class FrameStore
+      RECORD = "Q<L<L<q<S<S<Cx3"
+      RECORD_SIZE = 32
+      DIRECTION_IDS = {nil => 0, in: 1, out: 2}.freeze #: Hash[Symbol?, Integer]
+      MIN_TIMESTAMP = -(1 << 63) #: Integer
+      MAX_TIMESTAMP = (1 << 63) - 1 #: Integer
+      attr_reader :directory #: String
+
+      # @rbs! @interfaces: Array[Hash[String, untyped]]
+
+      # @rbs (?parent: String?, ?directory: String?, ?recover: bool) -> void
+      def initialize(parent: nil, directory: nil, recover: false)
+        @directory = directory || Dir.mktmpdir("vanken-", parent)
+        validate_directory
+        File.chmod(0o700, @directory)
+        @mutex = Mutex.new
+        @count = 0
+        @interfaces = []
+        @durable_count = 0
+        @closed = false
+        restore if recover
+        @data = private_file("frames.bin", recover ? "r+b" : "w+b")
+        @records = private_file("frames.idx", recover ? "r+b" : "w+b")
+        @data.seek(0, IO::SEEK_END)
+        @records.seek(0, IO::SEEK_END)
+        @reader = File.open(File.join(@directory, "frames.bin"), "rb")
+        @index_reader = File.open(File.join(@directory, "frames.idx"), "rb")
+        persist("session.json", {"schema_version" => 1, "created_at" => Time.now.utc.iso8601, "pid" => Process.pid})
+      end
+
+      # @rbs (String directory) -> FrameStore
+      def self.recover(directory) = new(directory: directory, recover: true)
+      # @rbs () -> Integer
+      def count = @mutex.synchronize { @count }
+      # @rbs () -> Integer
+      # Published only after both files flush; reading the immutable count must not wait for writer IO.
+      def durable_count = @durable_count
+
+      # @rbs (Frame frame) -> Integer
+      def append(frame)
+        raise ArgumentError, "invalid frame lengths" unless frame.bytes.is_a?(String) && frame.original_length.is_a?(Integer) && frame.original_length.between?(frame.bytes.bytesize, 0xffff_ffff) && frame.bytes.bytesize <= 16 << 20
+        raise ArgumentError, "invalid frame metadata" unless frame.linktype.is_a?(Integer) && frame.linktype.between?(0, 0xffff) && frame.timestamp_ns.is_a?(Integer) && frame.timestamp_ns.between?(MIN_TIMESTAMP, MAX_TIMESTAMP)
+        @mutex.synchronize do
+          raise IOError, "store closed" if @closed
+          interface = frame.interface ? intern_interface(frame.interface) : 0xffff
+          direction = DIRECTION_IDS.fetch(frame.direction)
+          record = [@data.pos, frame.bytes.bytesize, frame.original_length, frame.timestamp_ns,
+                    frame.linktype, interface, direction].pack(RECORD)
+          @data.write(frame.bytes)
+          @records.write(record)
+          @count += 1
+        end
+      end
+
+      # @rbs () -> self
+      def flush
+        @mutex.synchronize do
+          @data.flush
+          @records.flush
+          @durable_count = @count
+        end
+        self
+      end
+
+      # @rbs (Integer number) -> frame_metadata
+      def metadata(number)
+        @mutex.synchronize do
+          raise IndexError, "frame is not durable" unless number.is_a?(Integer) && number.between?(1, @durable_count)
+          offset = (number - 1) * RECORD_SIZE
+          record = if @index_reader.respond_to?(:pread)
+            @index_reader.pread(RECORD_SIZE, offset)
+          else
+            @index_reader.seek(offset)
+            @index_reader.read(RECORD_SIZE)
+          end
+          raise IOError, "truncated frame index" unless record && record.bytesize == RECORD_SIZE
+          values = record.unpack(RECORD)
+          {offset: values[0], caplen: values[1], original_length: values[2], timestamp_ns: values[3],
+           linktype: values[4], interface: values[5] == 0xffff ? nil : @interfaces.fetch(values[5]),
+           direction: [nil, :in, :out].fetch(values[6]), number: number}
+        end
+      end
+
+      # @rbs (Integer number) -> Frame
+      def read(number)
+        meta = metadata(number)
+        bytes = if @reader.respond_to?(:pread)
+          meta[:caplen].zero? ? "".b : @reader.pread(meta[:caplen], meta[:offset])
+        else
+          @mutex.synchronize { @reader.seek(meta[:offset]); @reader.read(meta[:caplen]) }
+        end
+        raise IOError, "truncated frame spool" unless bytes && bytes.bytesize == meta[:caplen]
+        Frame.new(bytes: bytes, timestamp_ns: meta[:timestamp_ns], original_length: meta[:original_length],
+                  linktype: meta[:linktype], interface: meta[:interface], direction: meta[:direction], number: number)
+      end
+
+      # @rbs () -> Array[Hash[String, untyped]]
+      def interfaces = @mutex.synchronize { @interfaces.dup }
+
+      # @rbs (?remove: bool) -> void
+      def close(remove: true)
+        @mutex.synchronize do
+          unless @closed
+            [@data, @records, @reader, @index_reader].compact.each(&:close)
+            @closed = true
+          end
+        end
+        FileUtils.remove_entry_secure(@directory) if remove && File.directory?(@directory)
+      end
+
+      private
+
+      # @rbs (String name, String mode) -> File
+      def private_file(name, mode)
+        path = File.join(@directory, name)
+        io = File.open(path, mode, 0o600)
+        io.chmod(0o600)
+        io
+      end
+
+      def validate_directory
+        raise Vanken::FileError, "unsafe session directory" unless File.directory?(@directory) && !File.symlink?(@directory) && File.stat(@directory).uid == Process.uid
+        %w[frames.idx frames.bin interfaces.json session.json].each do |name|
+          path = File.join(@directory, name)
+          next unless File.exist?(path) || File.symlink?(path)
+          stat = File.lstat(path)
+          raise Vanken::FileError, "unsafe session file" unless stat.file? && stat.uid == Process.uid && stat.nlink == 1
+        end
+      end
+
+      def persist(name, value)
+        File.open(File.join(@directory, name), "w", 0o600) { |io| io.write(JSON.generate(value)) }
+        File.chmod(0o600, File.join(@directory, name))
+      end
+
+      def intern_interface(value)
+        value = value.transform_keys(&:to_s)
+        found = @interfaces.index(value)
+        return found if found
+        raise ArgumentError, "too many interfaces" if @interfaces.length >= 0xffff
+        @interfaces << value.freeze
+        persist("interfaces.json", @interfaces)
+        @interfaces.length - 1
+      end
+
+      def restore
+        raise Vanken::FileError, "unsafe session directory" unless File.directory?(@directory) && !File.symlink?(@directory) && File.stat(@directory).uid == Process.uid
+        %w[frames.idx frames.bin interfaces.json].each do |name|
+          raise Vanken::FileError, "unsafe session file" if File.symlink?(File.join(@directory, name))
+        end
+        path = File.join(@directory, "frames.idx")
+        limit = File.size(File.join(@directory, "frames.bin"))
+        @interfaces = JSON.parse(File.read(File.join(@directory, "interfaces.json"))) if File.exist?(File.join(@directory, "interfaces.json"))
+        expected_offset = 0
+        File.open(path, "rb") do |io|
+          while (record = io.read(RECORD_SIZE)) && record.bytesize == RECORD_SIZE
+            offset, caplen, original, _time, _link, interface, direction = record.unpack(RECORD)
+            break unless offset == expected_offset && caplen <= 16 << 20 && offset + caplen <= limit && original >= caplen && (interface == 0xffff || interface < @interfaces.size) && direction <= 2
+            @count += 1
+            expected_offset = offset + caplen
+          end
+        end
+        @durable_count = @count
+        File.truncate(path, @count * RECORD_SIZE)
+        File.truncate(File.join(@directory, "frames.bin"), expected_offset)
+      end
+    end
+  end
+end