@netkitty/codec 1.0.0

package/dist/headers/Diameter.js

@@ -0,0 +1,229 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Diameter = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Diameter (RFC 6733), the RADIUS successor — TCP/SCTP port 3868. A 20-byte fixed header, all
+ * big-endian: Version (1, always 1) + Message Length (3, the whole message including the header and the
+ * padded AVPs) + Command Flags (1: R/P/E/T in the high nibble) + Command Code (3) + Application-Id (4) +
+ * Hop-by-Hop Id (4) + End-to-End Id (4). It is followed by AVPs until the Message Length is consumed.
+ *
+ * Each AVP is AVP Code(4) + Flags(1: V/M/P) + Length(3, counts the AVP header + data but NOT the trailing
+ * padding) + [Vendor-Id(4) only when the V flag 0x80 is set] + data + padding (zero bytes to the next
+ * 4-byte boundary). Because the AVP Length excludes the padding, the alignment pad is the tricky part of a
+ * byte-perfect round-trip: it is captured verbatim (per AVP, as hex) and re-emitted, so even a malformed
+ * non-zero pad reproduces exactly. AVPs are carried generically (code + flags + verbatim hex value) so
+ * every AVP — including Grouped AVPs whose value nests sub-AVPs — round-trips; per-AVP semantic decoding
+ * is a later enrichment. The walk is bounded by the Message Length (and the captured bytes), so any
+ * trailing/pipelined bytes spill to the raw layer.
+ *
+ * MATCH is a two-signal gate — the well-known port bucket (tcpport:3868) plus a content signature
+ * (Version == 1 and a plausible Message Length >= 20) — so there is deliberately NO heuristicFallback:
+ * unlike a content-signed protocol (TLS/IEC104), Diameter's first byte (a constant 1) and 3-byte length
+ * are far too weak a signature to claim arbitrary off-port TCP traffic, so recognition stays anchored to
+ * the port bucket. Non-Diameter traffic on 3868 (or a Version != 1) falls through to raw.
+ */
+class Diameter extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'diameter';
+        this.name = 'Diameter';
+        this.nickname = 'Diameter';
+        this.matchKeys = ['tcpport:3868'];
+        //A leaf header — AVP values are kept as hex, not demuxed further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Diameter.#schemaCache ??= Diameter.#buildSchema());
+    }
+    /** A 3-octet big-endian unsigned integer at `buffer[0..2]`. */
+    static #readUInt24(buffer) {
+        return ((buffer[0] << 16) | (buffer[1] << 8) | buffer[2]) >>> 0;
+    }
+    /** A 3-octet big-endian buffer for `value` (only the low 24 bits are kept). */
+    static #uint24ToBuffer(value) {
+        const v = value >>> 0;
+        return Buffer.from([(v >> 16) & 0xFF, (v >> 8) & 0xFF, v & 0xFF]);
+    }
+    /** Bytes available for this Diameter message: the frame end, clamped by the Message Length. During
+     *  MATCH the Message Length is unset (0), so this reduces to the captured-frame bound. */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        const messageLength = this.instance.messageLength.getValue(0);
+        if (messageLength >= 20 && messageLength < available)
+            available = messageLength;
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Diameter cmd=${commandCode}',
+            properties: {
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                messageLength: {
+                    type: 'integer',
+                    label: 'Message Length',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () {
+                        this.instance.messageLength.setValue(Diameter.#readUInt24(this.readBytes(1, 3)));
+                    },
+                    encode: function () {
+                        //Honor an explicitly-set Message Length (so a decoded malformed length still
+                        //round-trips byte-for-byte); auto-compute only when the field is absent (crafting).
+                        //The Message Length counts the whole message — the 20-byte header plus every padded
+                        //AVP — which is exactly this header's final length after the AVPs have encoded.
+                        const messageLength = this.instance.messageLength.getValue();
+                        if (messageLength !== undefined && messageLength !== null) {
+                            this.instance.messageLength.setValue(messageLength);
+                            this.writeBytes(1, Diameter.#uint24ToBuffer(messageLength));
+                        }
+                        else {
+                            this.writeBytes(1, Diameter.#uint24ToBuffer(0));
+                            this.addPostSelfEncodeHandler(() => {
+                                this.instance.messageLength.setValue(this.length);
+                                this.writeBytes(1, Diameter.#uint24ToBuffer(this.length));
+                            }, 1);
+                        }
+                    }
+                },
+                commandFlags: this.fieldUInt('commandFlags', 4, 1, 'Command Flags'),
+                commandCode: {
+                    type: 'integer',
+                    label: 'Command Code',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () {
+                        this.instance.commandCode.setValue(Diameter.#readUInt24(this.readBytes(5, 3)));
+                    },
+                    encode: function () {
+                        const node = this.instance.commandCode;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 16777215) {
+                            this.recordError(node.getPath(), 'Maximum value is 16777215');
+                            value = 16777215;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(5, Diameter.#uint24ToBuffer(value));
+                    }
+                },
+                applicationId: this.fieldUInt('applicationId', 8, 4, 'Application-Id'),
+                hopByHopId: this.fieldUInt('hopByHopId', 12, 4, 'Hop-by-Hop Identifier'),
+                endToEndId: this.fieldUInt('endToEndId', 16, 4, 'End-to-End Identifier'),
+                avps: {
+                    type: 'array',
+                    label: 'AVPs',
+                    items: {
+                        type: 'object',
+                        label: 'AVP',
+                        properties: {
+                            code: { type: 'integer', label: 'AVP Code', minimum: 0, maximum: 4294967295 },
+                            flags: { type: 'integer', label: 'AVP Flags', minimum: 0, maximum: 255 },
+                            length: { type: 'integer', label: 'AVP Length', minimum: 0, maximum: 16777215 },
+                            vendorId: { type: 'integer', label: 'Vendor-Id', minimum: 0, maximum: 4294967295 },
+                            data: { type: 'string', label: 'Data', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX },
+                            padding: { type: 'string', label: 'Padding', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        const available = this.#available();
+                        const avps = [];
+                        let offset = 20;
+                        //Each AVP is code(4) flags(1) length(3) [vendorId(4) if V] data padding. A Length
+                        //below its own header size is invalid (and would not advance), and a Length that
+                        //overruns the available bytes is truncated — in both cases stop and leave the
+                        //remaining bytes to the raw layer, keeping the round-trip exact.
+                        while (offset + 8 <= available) {
+                            const code = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset, 4, true));
+                            const flags = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 4, 1, true));
+                            const avpLength = Diameter.#readUInt24(this.readBytes(offset + 5, 3, true));
+                            const hasVendor = (flags & 0x80) !== 0;
+                            const headerSize = hasVendor ? 12 : 8;
+                            if (avpLength < headerSize || offset + avpLength > available)
+                                break;
+                            //Padding to the next 4-byte boundary is NOT counted in avpLength; the Message
+                            //Length includes it, so it is within `available` for a well-formed message
+                            //(clamped defensively for a truncated one).
+                            const padLength = (4 - (avpLength % 4)) % 4;
+                            const padAvailable = Math.min(padLength, available - (offset + avpLength));
+                            const dataLength = avpLength - headerSize;
+                            const dataOffset = offset + headerSize;
+                            const avp = {
+                                code: code,
+                                flags: flags,
+                                length: avpLength,
+                                data: dataLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(dataOffset, dataLength)) : '',
+                                padding: padAvailable > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + avpLength, padAvailable)) : ''
+                            };
+                            if (hasVendor)
+                                avp.vendorId = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset + 8, 4, true));
+                            avps.push(avp);
+                            offset += avpLength + padAvailable;
+                        }
+                        this.instance.avps.setValue(avps);
+                    },
+                    encode: function () {
+                        const avps = this.instance.avps.getValue([]);
+                        if (!avps)
+                            return;
+                        let offset = 20;
+                        for (const avp of avps) {
+                            const flags = avp.flags ? avp.flags : 0;
+                            const hasVendor = (flags & 0x80) !== 0;
+                            const headerSize = hasVendor ? 12 : 8;
+                            const data = (0, HexToBuffer_1.HexToBuffer)(avp.data ? avp.data : '');
+                            //Honor an explicit AVP Length (a crafted AVP may lie / a decoded one carries its
+                            //on-wire value); else derive it from the header size + data. For a decoded AVP
+                            //these agree exactly, so the walk advances identically to decode.
+                            const avpLength = (avp.length !== undefined && avp.length !== null)
+                                ? avp.length
+                                : headerSize + data.length;
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt32ToBuffer)(avp.code ? avp.code : 0));
+                            this.writeBytes(offset + 4, (0, NumberToBuffer_1.UInt8ToBuffer)(flags));
+                            this.writeBytes(offset + 5, Diameter.#uint24ToBuffer(avpLength));
+                            let dataOffset = offset + 8;
+                            if (hasVendor) {
+                                this.writeBytes(offset + 8, (0, NumberToBuffer_1.UInt32ToBuffer)(avp.vendorId ? avp.vendorId : 0));
+                                dataOffset = offset + 12;
+                            }
+                            if (data.length)
+                                this.writeBytes(dataOffset, data);
+                            //Padding is kept verbatim so a non-zero/truncated pad round-trips; when absent
+                            //(crafting) it is derived as zero bytes to the next 4-byte boundary.
+                            const padding = (avp.padding !== undefined && avp.padding !== null)
+                                ? (0, HexToBuffer_1.HexToBuffer)(avp.padding)
+                                : Buffer.alloc((4 - (avpLength % 4)) % 4, 0);
+                            if (padding.length)
+                                this.writeBytes(offset + avpLength, padding);
+                            offset += avpLength + padding.length;
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Diameter rides on TCP port 3868 (the port bucket routes candidates here). Confirm with the
+        //content signature: the full 20-byte fixed header present, Version == 1, and a plausible Message
+        //Length (>= 20). During MATCH the Message Length field is unset, so #available() is the captured
+        //bound only. NO heuristicFallback: this signature is too weak to claim off-port traffic.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#available() < 20)
+            return false;
+        if ((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1, true)) !== 1)
+            return false;
+        return Diameter.#readUInt24(this.readBytes(1, 3, true)) >= 20;
+    }
+}
+exports.Diameter = Diameter;

package/dist/headers/EAPOL.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * EAPOL — EAP over LAN (IEEE 802.1X port-based network access control), carried directly in an Ethernet
+ * II frame with EtherType 0x888E (an Ethernet child — no IP/UDP). Every EAPOL frame begins with a fixed
+ * 4-byte header — Protocol Version (1), Packet Type (1), and Body Length (2, big-endian, the count of
+ * body bytes that follow the header) — then `Body Length` bytes of type-specific body.
+ *
+ * The Packet Type selects the body: 0 = EAP-Packet (an encapsulated EAP message), 1 = EAPOL-Start,
+ * 2 = EAPOL-Logoff, 3 = EAPOL-Key (e.g. the WPA/RSN 4-way-handshake key descriptor), 4 = EAPOL-Encapsulated-
+ * ASF-Alert. Start/Logoff carry an empty body (Body Length 0). The body is kept verbatim as `body` hex so
+ * every frame — including the EAP message and the 802.11 key descriptor, both of which are separate
+ * cross-frame/stateful parsers — round-trips byte-for-byte; per-type semantic decoding is a later
+ * enrichment.
+ *
+ * The body is bounded by Body Length (body ends at offset 4 + bodyLength) and the captured bytes, so any
+ * trailing bytes — Ethernet padding to the 60-byte minimum, or a pipelined frame — are left to the
+ * codec's recursion / RawData rather than swallowed. Body Length is honored verbatim on encode when
+ * supplied (a crafted frame may lie), else derived from the body byte count. A well-formed frame
+ * round-trips byte-for-byte.
+ */
+export declare class EAPOL extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/EAPOL.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EAPOL = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * EAPOL — EAP over LAN (IEEE 802.1X port-based network access control), carried directly in an Ethernet
+ * II frame with EtherType 0x888E (an Ethernet child — no IP/UDP). Every EAPOL frame begins with a fixed
+ * 4-byte header — Protocol Version (1), Packet Type (1), and Body Length (2, big-endian, the count of
+ * body bytes that follow the header) — then `Body Length` bytes of type-specific body.
+ *
+ * The Packet Type selects the body: 0 = EAP-Packet (an encapsulated EAP message), 1 = EAPOL-Start,
+ * 2 = EAPOL-Logoff, 3 = EAPOL-Key (e.g. the WPA/RSN 4-way-handshake key descriptor), 4 = EAPOL-Encapsulated-
+ * ASF-Alert. Start/Logoff carry an empty body (Body Length 0). The body is kept verbatim as `body` hex so
+ * every frame — including the EAP message and the 802.11 key descriptor, both of which are separate
+ * cross-frame/stateful parsers — round-trips byte-for-byte; per-type semantic decoding is a later
+ * enrichment.
+ *
+ * The body is bounded by Body Length (body ends at offset 4 + bodyLength) and the captured bytes, so any
+ * trailing bytes — Ethernet padding to the 60-byte minimum, or a pipelined frame — are left to the
+ * codec's recursion / RawData rather than swallowed. Body Length is honored verbatim on encode when
+ * supplied (a crafted frame may lie), else derived from the body byte count. A well-formed frame
+ * round-trips byte-for-byte.
+ */
+class EAPOL extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'eapol';
+        this.name = 'EAP over LAN';
+        this.nickname = 'EAPOL';
+        this.matchKeys = ['ethertype:888e'];
+        //A leaf header — the EAP message / EAPOL-Key descriptor requires separate, stateful parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (EAPOL.#schemaCache ??= EAPOL.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'EAPOL type=${packetType} len=${bodyLength}',
+            properties: {
+                //Protocol Version — 1 (802.1X-2001), 2 (802.1X-2004), 3 (802.1X-2010).
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                //Packet Type selects the body kind. Constrained to the defined types for the editor; an
+                //unknown type still decodes best-effort (decode never validates) but is out of enum on encode.
+                packetType: {
+                    type: 'integer',
+                    label: 'Packet Type',
+                    minimum: 0,
+                    maximum: 255,
+                    enum: [0, 1, 2, 3, 4],
+                    decode: function () {
+                        this.instance.packetType.setValue(this.readBytes(1, 1)[0]);
+                    },
+                    encode: function () {
+                        let value = this.instance.packetType.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(this.instance.packetType.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.packetType.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.packetType.setValue(value);
+                        this.writeBytes(1, Buffer.from([value & 0xff]));
+                    }
+                },
+                bodyLength: {
+                    type: 'integer',
+                    label: 'Body Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        const b = this.readBytes(2, 2);
+                        this.instance.bodyLength.setValue((b[0] << 8) | b[1]);
+                    },
+                    encode: function () {
+                        //Body Length counts only the body that follows the 4-byte header. Honored when
+                        //supplied (a crafted frame may lie); else derived from the body byte count.
+                        const provided = this.instance.bodyLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.bodyLength.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.bodyLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.bodyLength.setValue(value);
+                        this.writeBytes(2, Buffer.from([(value >> 8) & 0xff, value & 0xff]));
+                    }
+                },
+                //The type-specific body (EAP message / EAPOL-Key descriptor / …), kept verbatim. Bounded
+                //by Body Length (body ends at offset 4 + bodyLength) and the captured bytes, so trailing
+                //padding / a pipelined frame is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const bodyLength = this.instance.bodyLength.getValue(0);
+                        let end = 4 + bodyLength;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 4 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(4, end - 4)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(4, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //An Ethernet child selected by EtherType 0x888E (stored as a lowercase 4-hex string). Require the
+        //full 4-byte fixed header to be present.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'eth')
+            return false;
+        if (this.prevCodecModule.instance.etherType.getValue() !== '888e')
+            return false;
+        return this.packet.length - this.startPos >= 4;
+    }
+}
+exports.EAPOL = EAPOL;

package/dist/headers/EIGRP.d.ts

@@ -0,0 +1,28 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * EIGRP — Enhanced Interior Gateway Routing Protocol (Cisco), carried directly over IP as protocol 88.
+ * Every EIGRP packet begins with a fixed 20-byte header — Version (1), Opcode (1: 1 Update, 3 Query,
+ * 4 Reply, 5 Hello, 10 SIA-Query, 11 SIA-Reply), Checksum (2, the IP-style ones-complement checksum
+ * over the whole EIGRP packet), Flags (4), Sequence (4), Acknowledge (4), Virtual Router ID (2) and
+ * Autonomous System number (2) — followed by a chain of TLVs. Each TLV is a 2-byte Type, a 2-byte
+ * Length (the total TLV octet count including the 4-byte TLV header) and Length-4 value bytes.
+ *
+ * The TLV chain has no terminator/count, so the walk is bounded by the enclosing IP payload (like GRE /
+ * OSPF #available) — a lying Length near the end never reads into a trailing FCS/padding. TLV values are
+ * kept verbatim as hex (per-TLV route/parameter bodies are opaque here), so every TLV round-trips
+ * byte-for-byte; the Length is honored when supplied (a crafted TLV may lie) else derived from the value
+ * byte count. The Checksum is honored verbatim, never recomputed (encode is a faithful executor). A
+ * well-formed packet round-trips byte-for-byte. Leaf header — TLV sub-structures are not sub-decoded.
+ */
+export declare class EIGRP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/EIGRP.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EIGRP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * EIGRP — Enhanced Interior Gateway Routing Protocol (Cisco), carried directly over IP as protocol 88.
+ * Every EIGRP packet begins with a fixed 20-byte header — Version (1), Opcode (1: 1 Update, 3 Query,
+ * 4 Reply, 5 Hello, 10 SIA-Query, 11 SIA-Reply), Checksum (2, the IP-style ones-complement checksum
+ * over the whole EIGRP packet), Flags (4), Sequence (4), Acknowledge (4), Virtual Router ID (2) and
+ * Autonomous System number (2) — followed by a chain of TLVs. Each TLV is a 2-byte Type, a 2-byte
+ * Length (the total TLV octet count including the 4-byte TLV header) and Length-4 value bytes.
+ *
+ * The TLV chain has no terminator/count, so the walk is bounded by the enclosing IP payload (like GRE /
+ * OSPF #available) — a lying Length near the end never reads into a trailing FCS/padding. TLV values are
+ * kept verbatim as hex (per-TLV route/parameter bodies are opaque here), so every TLV round-trips
+ * byte-for-byte; the Length is honored when supplied (a crafted TLV may lie) else derived from the value
+ * byte count. The Checksum is honored verbatim, never recomputed (encode is a faithful executor). A
+ * well-formed packet round-trips byte-for-byte. Leaf header — TLV sub-structures are not sub-decoded.
+ */
+class EIGRP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'eigrp';
+        this.name = 'Enhanced Interior Gateway Routing Protocol';
+        this.nickname = 'EIGRP';
+        this.matchKeys = ['ipproto:88'];
+        //A leaf header — EIGRP TLV bodies are kept as verbatim hex, nothing demuxes above it.
+        this.demuxProducers = [];
+    }
+    /**
+     * Bytes of EIGRP the IP layer below says are available. IPv4 carries a total-length field, so the
+     * EIGRP payload is (total length - IP header length); IPv6 carries the payload length directly
+     * (plen). Mirrors the GRE / OSPF #available() pattern so the TLV walk is bounded by the real on-wire
+     * length rather than the captured frame (which may include Ethernet padding after the IP payload).
+     * @private
+     */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'ipv4') {
+            const ipPayload = prev.instance.length.getValue(0) - prev.length;
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        else if (prev && prev.id === 'ipv6') {
+            const ipPayload = prev.instance.plen.getValue(0);
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (EIGRP.#schemaCache ??= EIGRP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'EIGRP opcode=${opcode} as=${autonomousSystem}',
+            properties: {
+                //==== Fixed 20-byte header ====
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                opcode: this.fieldUInt('opcode', 1, 1, 'Opcode'),
+                //Honored verbatim: the EIGRP checksum (ones-complement over the whole packet with the
+                //checksum field zeroed) is never recomputed, so a captured packet round-trips byte-for-byte.
+                checksum: this.fieldUInt('checksum', 2, 2, 'Checksum'),
+                flags: this.fieldUInt('flags', 4, 4, 'Flags'),
+                sequence: this.fieldUInt('sequence', 8, 4, 'Sequence'),
+                ack: this.fieldUInt('ack', 12, 4, 'Acknowledge'),
+                virtualRouterId: this.fieldUInt('virtualRouterId', 16, 2, 'Virtual Router ID'),
+                autonomousSystem: this.fieldUInt('autonomousSystem', 18, 2, 'Autonomous System'),
+                //==== TLV chain (type + length-incl-header + verbatim value) ====
+                tlvs: {
+                    type: 'array',
+                    label: 'TLVs',
+                    items: {
+                        type: 'object',
+                        label: 'TLV',
+                        properties: {
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 65535 },
+                            length: { type: 'integer', label: 'Length', minimum: 0, maximum: 65535 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        //The TLV chain has no terminator/count — bound the walk by the IP payload so a
+                        //corrupt Length can't read past the datagram into an FCS/padding. Each TLV is a
+                        //2-byte Type + 2-byte Length (whole-TLV octet count incl. the 4-byte header).
+                        const available = this.#available();
+                        const tlvs = [];
+                        let offset = 20;
+                        while (offset + 4 <= available) {
+                            const type = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2));
+                            const length = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 2, 2));
+                            //Value byte count = Length - 4; clamp to the bytes actually available (a lying
+                            //Length is stored verbatim but never over-reads). The step is always >= 4, so
+                            //the walk cannot stall even on a zero/undersized Length.
+                            let valueLen = length - 4;
+                            if (valueLen < 0)
+                                valueLen = 0;
+                            if (offset + 4 + valueLen > available)
+                                valueLen = available - offset - 4;
+                            const value = valueLen > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 4, valueLen)) : '';
+                            tlvs.push({ type: type, length: length, value: value });
+                            offset += 4 + valueLen;
+                        }
+                        this.instance.tlvs.setValue(tlvs);
+                    },
+                    encode: function () {
+                        const tlvs = this.instance.tlvs.getValue([]);
+                        let offset = 20;
+                        if (tlvs) {
+                            for (let i = 0; i < tlvs.length; i++) {
+                                const tlv = tlvs[i];
+                                const value = (0, HexToBuffer_1.HexToBuffer)(tlv.value ? tlv.value : '');
+                                let type = tlv.type ? tlv.type : 0;
+                                if (type > 65535) {
+                                    this.recordError(`tlvs[${i}].type`, 'Maximum value is 65535');
+                                    type = 65535;
+                                }
+                                if (type < 0)
+                                    type = 0;
+                                //Length is honored when supplied (a crafted TLV may lie about its size),
+                                //else derived from the 4-byte header + the actual value byte count.
+                                let length = (tlv.length !== undefined && tlv.length !== null)
+                                    ? tlv.length
+                                    : 4 + value.length;
+                                if (length > 65535) {
+                                    this.recordError(`tlvs[${i}].length`, 'Maximum value is 65535');
+                                    length = 65535;
+                                }
+                                if (length < 0)
+                                    length = 0;
+                                this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(type));
+                                this.writeBytes(offset + 2, (0, NumberToBuffer_1.UInt16ToBuffer)(length));
+                                offset += 4;
+                                if (value.length) {
+                                    this.writeBytes(offset, value);
+                                    offset += value.length;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //EIGRP sits directly on IP (protocol 88). Accept the demux value from either the IPv4 protocol
+        //field or the IPv6 next-header field, and require at least the fixed 20-byte header of IP payload.
+        if (!this.prevCodecModule)
+            return false;
+        const protocol = this.prevCodecModule.instance.protocol.getValue(0);
+        const nextHeader = this.prevCodecModule.instance.nxt.getValue(0);
+        if (protocol !== 88 && nextHeader !== 88)
+            return false;
+        return this.#available() >= 20;
+    }
+}
+exports.EIGRP = EIGRP;

package/dist/headers/ENIP.d.ts

@@ -0,0 +1,31 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * EtherNet/IP encapsulation (ODVA / IEC 61158, IEC 61784), TCP & UDP port 44818. Every EtherNet/IP
+ * message begins with a fixed 24-byte encapsulation header — Command, Length (the count of bytes that
+ * follow the header), Session Handle, Status, an 8-byte Sender Context echoed back by the target, and an
+ * Options field — followed by `Length` bytes of command-specific data (the CIP Common Packet Format /
+ * encapsulated CIP request or reply).
+ *
+ * ⚠️ Unlike most of the codec's protocols, every multi-byte field in this header is LITTLE-ENDIAN (ODVA
+ * inherits the CIP on-wire byte order). There is no little-endian helper in this codebase, so the uint16
+ * / uint32 fields are read and written byte-by-byte in their closures.
+ *
+ * The command-specific data is the CIP/CPF payload; decoding it (item counts, address/data items, the
+ * embedded CIP service request) is cross-message and command-dependent state, so this single-message
+ * codec keeps it verbatim as `data` hex (byte-perfect). The Length is auto-computed from the data on
+ * encode when not supplied, else honored verbatim (a crafted message may carry any Length); the data is
+ * bounded by the Length field so a pipelined/trailing message is left to the codec's recursion / RawData.
+ * A well-formed message round-trips byte-for-byte.
+ */
+export declare class ENIP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}