@netkitty/codec 1.0.0

package/dist/headers/GESRTP.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GESRTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * GE-SRTP — GE Fanuc (GE Intelligent Platforms) Service Request Transport Protocol, TCP port 18245.
+ * The proprietary Ethernet protocol spoken by GE Series 90 / PACSystems / VersaMax PLCs. GE publishes
+ * no specification; the on-wire layout used here is the community reverse-engineering (Collin Matthews'
+ * `TheMadHatt3r/ge-ethernet-SRTP`; the New Haven "Leveraging the SRTP protocol …" paper).
+ *
+ * Every message begins with a fixed 56-byte header. Only a subset of those 56 bytes has a confidently
+ * documented meaning — the message Type, sequence numbers, a controller timestamp, the message-type
+ * byte, the mailbox source/destination, packet counters, and the service-request block (Service Request
+ * Code, segment selector / memory type, memory offset, data length). Everything else in the header is
+ * "reserved/unknown" and is kept verbatim as hex so it round-trips untouched. A READ request is exactly
+ * the 56-byte header; a response carries the read data after the header, so any bytes captured past the
+ * 56-byte header are kept verbatim as `payload` hex (bounded by the captured TCP payload).
+ *
+ * ⚠️ The two-octet memory-offset and data-length fields are LITTLE-ENDIAN (segment selector / SNP
+ * addressing convention: LSB first). There is no little-endian helper in this codebase, so those uint16
+ * fields are read/written byte-by-byte in their closures. Every numeric field is a clamped uint (never a
+ * hard enum) so any value that decodes off the wire re-encodes without an Ajv rejection.
+ */
+class GESRTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'gesrtp';
+        this.name = 'GE-SRTP';
+        this.nickname = 'GESRTP';
+        this.matchKeys = ['tcpport:18245'];
+        //A leaf header — the response data body is service-request-code dependent and not sub-decoded.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (GESRTP.#schemaCache ??= GESRTP.#buildSchema());
+    }
+    /** A little-endian unsigned 16-bit field of 2 octets at `offset` (LSB first, then MSB). */
+    static #fieldUInt16LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 65535,
+            decode: function () {
+                const b = this.readBytes(offset, 2);
+                this.instance[name].setValue(b[0] | (b[1] << 8));
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 65535) {
+                    this.recordError(node.getPath(), 'Maximum value is 65535');
+                    value = 65535;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff]));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'GE-SRTP type=${type} svc=${serviceRequestCode}',
+            properties: {
+                //Byte 0: message Type (0x02 transmit/request, 0x03 return; 0x01 seen on responses).
+                type: this.fieldUInt('type', 0, 1, 'Type'),
+                //Byte 1: reserved/unknown, kept verbatim.
+                reserved1: this.fieldHex('reserved1', 1, 1, 'Reserved (1)'),
+                //Byte 2: sequence number.
+                sequenceNumber: this.fieldUInt('sequenceNumber', 2, 1, 'Sequence Number'),
+                //Byte 3: reserved/unknown.
+                reserved3: this.fieldHex('reserved3', 3, 1, 'Reserved (3)'),
+                //Byte 4: text length (documented single byte; the wider framing is unknown).
+                textLength: this.fieldUInt('textLength', 4, 1, 'Text Length'),
+                //Bytes 5..25: reserved/unknown span, kept verbatim (21 octets).
+                reserved5: this.fieldHex('reserved5', 5, 21, 'Reserved (5..25)'),
+                //Bytes 26..28: controller timestamp echoed in the header.
+                timeSeconds: this.fieldUInt('timeSeconds', 26, 1, 'Time Seconds'),
+                timeMinutes: this.fieldUInt('timeMinutes', 27, 1, 'Time Minutes'),
+                timeHours: this.fieldUInt('timeHours', 28, 1, 'Time Hours'),
+                //Byte 29: reserved/unknown.
+                reserved29: this.fieldHex('reserved29', 29, 1, 'Reserved (29)'),
+                //Byte 30: sequence number (repeated).
+                sequenceNumber2: this.fieldUInt('sequenceNumber2', 30, 1, 'Sequence Number (repeated)'),
+                //Byte 31: message-type byte (0xC0 observed on requests).
+                messageType: this.fieldUInt('messageType', 31, 1, 'Message Type'),
+                //Bytes 32..35: mailbox source, kept verbatim.
+                mailboxSource: this.fieldHex('mailboxSource', 32, 4, 'Mailbox Source'),
+                //Bytes 36..39: mailbox destination, kept verbatim.
+                mailboxDestination: this.fieldHex('mailboxDestination', 36, 4, 'Mailbox Destination'),
+                //Byte 40: packet number.
+                packetNumber: this.fieldUInt('packetNumber', 40, 1, 'Packet Number'),
+                //Byte 41: total packet count.
+                totalPacketNumber: this.fieldUInt('totalPacketNumber', 41, 1, 'Total Packet Number'),
+                //Byte 42: Service Request Code (0x04 read sys memory, 0x07 write sys memory, 0x00 status …).
+                serviceRequestCode: this.fieldUInt('serviceRequestCode', 42, 1, 'Service Request Code'),
+                //Byte 43: segment selector / memory type (0x08 %R, 0x0A %AI, 0x10 %I …), request-dependent.
+                segmentSelector: this.fieldUInt('segmentSelector', 43, 1, 'Segment Selector'),
+                //Bytes 44..45: memory offset (LITTLE-ENDIAN; zero-based, i.e. address − 1).
+                memoryOffset: this.#fieldUInt16LE('memoryOffset', 44, 'Memory Offset'),
+                //Bytes 46..47: data length (LITTLE-ENDIAN; count of the addressed units).
+                dataLength: this.#fieldUInt16LE('dataLength', 46, 'Data Length'),
+                //Bytes 48..55: remaining request-dependent / reserved header octets, kept verbatim.
+                reserved48: this.fieldHex('reserved48', 48, 8, 'Reserved (48..55)'),
+                //Anything captured after the fixed 56-byte header (e.g. a read response's data), kept
+                //verbatim and bounded by the captured TCP payload so it never reads past the buffer.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        this.instance.payload.setValue(remaining > 56 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(56, remaining - 56)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(56, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //GE-SRTP rides on TCP port 18245. The header carries no strong content magic (byte 0 is only
+        //0x00..0x03), so the well-known port is the signature: require the full fixed 56-byte header to
+        //be present before claiming the payload.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.packet.length - this.startPos >= 56;
+    }
+}
+exports.GESRTP = GESRTP;

package/dist/headers/GLBP.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * GLBP — Gateway Load Balancing Protocol (Cisco), carried over UDP port 3222 to the multicast group
+ * 224.0.0.102. Each message begins with a fixed 12-byte header — Version, Unknown1, Group (the GLBP
+ * group number), a 2-byte Unknown2 and a 6-byte Owner ID (a MAC address) — followed by a flat sequence
+ * of TLVs. Each TLV is a 1-byte Type + 1-byte Length (the length of the WHOLE TLV including this 2-byte
+ * header) + Length−2 value bytes (Hello = 1, Request/Response = 2, Auth = 3).
+ *
+ * GLBP is undocumented; the field names follow Wireshark's dissector, which treats byte 0 (labelled
+ * "Version?") as a discriminator that must equal 1 and Unknown1 (bytes must be ≤ 4) — real captures
+ * carry Version 1. It is kept as a plain uint8 here (no enum) so encode stays a faithful executor able
+ * to craft any value. The TLV value is kept verbatim as hex so every TLV — Hello, Request/Response,
+ * Auth, or unknown — round-trips byte-for-byte; per-TLV semantic decoding is a later enrichment. The
+ * TLV walk is bounded by the UDP datagram (so retained ethernet padding/FCS is not absorbed); any bytes
+ * after the last complete TLV are kept verbatim in `trailing` so the frame is reproduced exactly. GLBP
+ * is a leaf — nothing rides on top of it.
+ */
+export declare class GLBP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/GLBP.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLBP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * GLBP — Gateway Load Balancing Protocol (Cisco), carried over UDP port 3222 to the multicast group
+ * 224.0.0.102. Each message begins with a fixed 12-byte header — Version, Unknown1, Group (the GLBP
+ * group number), a 2-byte Unknown2 and a 6-byte Owner ID (a MAC address) — followed by a flat sequence
+ * of TLVs. Each TLV is a 1-byte Type + 1-byte Length (the length of the WHOLE TLV including this 2-byte
+ * header) + Length−2 value bytes (Hello = 1, Request/Response = 2, Auth = 3).
+ *
+ * GLBP is undocumented; the field names follow Wireshark's dissector, which treats byte 0 (labelled
+ * "Version?") as a discriminator that must equal 1 and Unknown1 (bytes must be ≤ 4) — real captures
+ * carry Version 1. It is kept as a plain uint8 here (no enum) so encode stays a faithful executor able
+ * to craft any value. The TLV value is kept verbatim as hex so every TLV — Hello, Request/Response,
+ * Auth, or unknown — round-trips byte-for-byte; per-TLV semantic decoding is a later enrichment. The
+ * TLV walk is bounded by the UDP datagram (so retained ethernet padding/FCS is not absorbed); any bytes
+ * after the last complete TLV are kept verbatim in `trailing` so the frame is reproduced exactly. GLBP
+ * is a leaf — nothing rides on top of it.
+ */
+class GLBP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'glbp';
+        this.name = 'Gateway Load Balancing Protocol';
+        this.nickname = 'GLBP';
+        this.matchKeys = ['udpport:3222'];
+        //A leaf header — nothing is carried on top of a GLBP message.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (GLBP.#schemaCache ??= GLBP.#buildSchema());
+    }
+    /** The payload length bounded by the UDP datagram (so retained ethernet padding/FCS is not absorbed). */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'GLBP group=${group} v=${version}',
+            properties: {
+                //Byte 0 — Wireshark labels this "Version?" and its heuristic requires it to equal 1 (real
+                //captures carry 1). Kept as a plain uint8 (no enum) so encode can craft any value.
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                //Byte 1 — Wireshark's "Unknown1" (its heuristic bounds it to ≤ 4). Kept verbatim.
+                unknown1: this.fieldUInt('unknown1', 1, 1, 'Unknown1'),
+                //Group number (big-endian).
+                group: this.fieldUInt('group', 2, 2, 'Group'),
+                //A 2-byte opaque field, kept verbatim so a non-canonical frame stays byte-perfect.
+                unknown2: this.fieldHex('unknown2', 4, 2, 'Unknown2'),
+                //Owner ID — a 6-byte MAC address, kept verbatim as hex (byte-perfect; MAC formatting is
+                //UI enrichment for later).
+                ownerId: this.fieldHex('ownerId', 6, 6, 'Owner ID'),
+                tlvs: {
+                    type: 'array',
+                    label: 'TLVs',
+                    items: {
+                        type: 'object',
+                        label: 'TLV',
+                        properties: {
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 255 },
+                            length: { type: 'integer', label: 'Length', minimum: 0, maximum: 255 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        //TLVs run from the end of the 12-byte header to the end of the UDP payload — GLBP
+                        //has no length field of its own. The on-wire Length is the WHOLE TLV size (incl.
+                        //the 2-byte header), so the value is Length−2 bytes.
+                        const available = this.#payloadLength();
+                        const tlvs = [];
+                        let offset = 12;
+                        while (offset + 2 <= available) {
+                            const type = this.readBytes(offset, 1)[0];
+                            const length = this.readBytes(offset + 1, 1)[0];
+                            //A Length < 2 cannot even cover its own 2-byte header — stop rather than loop
+                            //forever, leaving the remaining bytes to `trailing` so the round-trip is exact.
+                            if (length < 2)
+                                break;
+                            //A TLV that overruns the payload (truncation) is not consumed — stop and leave
+                            //the remaining bytes to `trailing`, keeping the round-trip exact.
+                            if (offset + length > available)
+                                break;
+                            const valueLength = length - 2;
+                            const value = valueLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 2, valueLength)) : '';
+                            tlvs.push({ type: type, length: length, value: value });
+                            offset += length;
+                        }
+                        this.instance.tlvs.setValue(tlvs);
+                        //Bytes after the last complete TLV (truncation / trailing) are kept verbatim.
+                        this.instance.trailing.setValue(offset < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, available - offset)) : '');
+                    },
+                    encode: function () {
+                        const tlvs = this.instance.tlvs.getValue([]);
+                        let offset = 12;
+                        if (tlvs) {
+                            for (let i = 0; i < tlvs.length; i++) {
+                                const tlv = tlvs[i];
+                                const value = (0, HexToBuffer_1.HexToBuffer)(tlv.value ? tlv.value : '');
+                                //Length is honored when supplied (a crafted TLV may carry any Length),
+                                //else derived as the whole TLV size = 2-byte header + value bytes. It is a
+                                //1-byte field, so clamp to [0, 255] (recording an error, never throwing).
+                                const providedLength = tlv.length;
+                                let length = (providedLength !== undefined && providedLength !== null)
+                                    ? providedLength
+                                    : value.length + 2;
+                                if (length > 255) {
+                                    this.recordError(`tlvs[${i}].length`, 'Maximum value is 255');
+                                    length = 255;
+                                }
+                                if (length < 0) {
+                                    this.recordError(`tlvs[${i}].length`, 'Minimum value is 0');
+                                    length = 0;
+                                }
+                                this.writeBytes(offset, Buffer.from([tlv.type ? tlv.type & 0xff : 0, length]));
+                                offset += 2;
+                                if (value.length) {
+                                    this.writeBytes(offset, value);
+                                    offset += value.length;
+                                }
+                            }
+                        }
+                        const trailing = this.instance.trailing.getValue('');
+                        if (trailing)
+                            this.writeBytes(offset, (0, HexToBuffer_1.HexToBuffer)(trailing));
+                    }
+                },
+                //Bytes after the last complete TLV, kept verbatim. No codec of its own — it is set/read by
+                //the `tlvs` field (which owns the single offset walk); this entry is metadata so the editor
+                //sees the trailing bytes.
+                trailing: {
+                    type: 'string',
+                    label: 'Trailing',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX
+                }
+            }
+        };
+    }
+    match() {
+        //GLBP rides on UDP port 3222. Require the full 12-byte fixed header within the UDP payload
+        //(bounded by the datagram length, not the frame, so ethernet padding is not miscounted); a
+        //shorter datagram is not a GLBP message and falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.#payloadLength() >= 12;
+    }
+}
+exports.GLBP = GLBP;

package/dist/headers/GRE.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * GRE — Generic Routing Encapsulation (RFC 2784 + key/sequence extensions RFC 2890), carried directly
+ * over IP as protocol 47. The 4-byte base header is a flags/version field — C (Checksum Present), the
+ * legacy R (Routing) bit, K (Key Present), S (Sequence Number Present), the legacy s/Recur bits, a
+ * reserved field, and a 3-bit Version (0 for GRE) — followed by a 16-bit Protocol Type (the EtherType
+ * of the payload). Optional trailing fields follow in order: a Checksum + Reserved1 (4 bytes, if C), a
+ * Key (4 bytes, if K), and a Sequence Number (4 bytes, if S). The inner frame follows.
+ *
+ * Like GENEVE, the inner frame is dispatched by Protocol Type: an ethertype demux producer routes an
+ * inner IPv4/IPv6 packet (0x0800/0x86dd) to IPv4/IPv6 (which accept a 'gre' parent), while a Transparent
+ * Ethernet Bridging payload (0x6558) falls through to EthernetII (guarded to that type). The GRE
+ * checksum is honored verbatim, not recomputed (encode is a faithful executor); a well-formed GRE
+ * message round-trips byte-for-byte. The legacy Routing (R=1, RFC 1701) fields are not parsed.
+ */
+export declare class GRE extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/GRE.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GRE = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * GRE — Generic Routing Encapsulation (RFC 2784 + key/sequence extensions RFC 2890), carried directly
+ * over IP as protocol 47. The 4-byte base header is a flags/version field — C (Checksum Present), the
+ * legacy R (Routing) bit, K (Key Present), S (Sequence Number Present), the legacy s/Recur bits, a
+ * reserved field, and a 3-bit Version (0 for GRE) — followed by a 16-bit Protocol Type (the EtherType
+ * of the payload). Optional trailing fields follow in order: a Checksum + Reserved1 (4 bytes, if C), a
+ * Key (4 bytes, if K), and a Sequence Number (4 bytes, if S). The inner frame follows.
+ *
+ * Like GENEVE, the inner frame is dispatched by Protocol Type: an ethertype demux producer routes an
+ * inner IPv4/IPv6 packet (0x0800/0x86dd) to IPv4/IPv6 (which accept a 'gre' parent), while a Transparent
+ * Ethernet Bridging payload (0x6558) falls through to EthernetII (guarded to that type). The GRE
+ * checksum is honored verbatim, not recomputed (encode is a faithful executor); a well-formed GRE
+ * message round-trips byte-for-byte. The legacy Routing (R=1, RFC 1701) fields are not parsed.
+ */
+class GRE extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'gre';
+        this.name = 'Generic Routing Encapsulation';
+        this.nickname = 'GRE';
+        this.matchKeys = ['ipproto:47'];
+        //Protocol Type is an EtherType; declaring it in the 'ethertype' namespace dispatches an inner IPv4/
+        //IPv6 packet to the O(1) bucket (which accepts a 'gre' parent), while a 0x6558 Ethernet payload
+        //falls through to EthernetII's tunnel-aware match.
+        this.demuxProducers = [{ field: 'protocolType', namespace: 'ethertype', kind: 'string' }];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (GRE.#schemaCache ??= GRE.#buildSchema());
+    }
+    /**
+     * The length available to GRE's own header (base + optional fields), bounded by the enclosing IP
+     * datagram — so a lying flag near the end of the IP payload does not read into a trailing FCS. This
+     * bounds GRE's field reads and the match gate; the inner frame is left to the codec's recursion
+     * (which, like the other tunnels, reads to the end of the captured packet).
+     */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'ipv4') {
+            const ipPayload = prev.instance.length.getValue(0) - prev.length;
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        else if (prev && prev.id === 'ipv6') {
+            const ipPayload = prev.instance.plen.getValue(0);
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** A single flag bit within the 2-byte flags/version field (bit 0 = MSB of byte 0). */
+    static #flagBit(name, bitOffset, label) {
+        return {
+            type: 'boolean',
+            label: label,
+            decode: function () {
+                this.instance.flags[name].setValue(!!this.readBits(0, 1, bitOffset, 1));
+            },
+            encode: function () {
+                const value = !!this.instance.flags[name].getValue();
+                this.instance.flags[name].setValue(value);
+                this.writeBits(0, 1, bitOffset, 1, value ? 1 : 0);
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'GRE proto=${protocolType}',
+            properties: {
+                //Flags/version (byte 0-1, MSB first): C(0) R(1) K(2) S(3) s(4) Recur(5-7) | reserved0(8-12)
+                //Version(13-15). The legacy R/s/Recur/reserved bits are kept verbatim for byte-perfect.
+                flags: {
+                    type: 'object',
+                    label: 'Flags',
+                    properties: {
+                        checksum: this.#flagBit('checksum', 0, 'Checksum Present'),
+                        routing: this.#flagBit('routing', 1, 'Routing Present'),
+                        key: this.#flagBit('key', 2, 'Key Present'),
+                        sequence: this.#flagBit('sequence', 3, 'Sequence Number Present'),
+                        strictRoute: this.#flagBit('strictRoute', 4, 'Strict Source Route'),
+                        recur: {
+                            type: 'integer', label: 'Recursion Control', minimum: 0, maximum: 7, hidden: true,
+                            decode: function () { this.instance.flags.recur.setValue(this.readBits(0, 1, 5, 3)); },
+                            encode: function () { this.writeBits(0, 1, 5, 3, this.instance.flags.recur.getValue(0)); }
+                        },
+                        reserved0: {
+                            type: 'integer', label: 'Reserved', minimum: 0, maximum: 31, hidden: true,
+                            decode: function () { this.instance.flags.reserved0.setValue(this.readBits(1, 1, 0, 5)); },
+                            encode: function () { this.writeBits(1, 1, 0, 5, this.instance.flags.reserved0.getValue(0)); }
+                        },
+                        version: {
+                            type: 'integer', label: 'Version', minimum: 0, maximum: 7,
+                            decode: function () { this.instance.flags.version.setValue(this.readBits(1, 1, 5, 3)); },
+                            encode: function () { this.writeBits(1, 1, 5, 3, this.instance.flags.version.getValue(0)); }
+                        }
+                    }
+                },
+                //Protocol Type is the EtherType of the inner frame — stored as a lowercase hex string
+                //(like eth.etherType) so it can drive the `ethertype` demux dimension to the inner codec.
+                protocolType: {
+                    type: 'string', label: 'Protocol Type', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () { this.instance.protocolType.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(2, 2))); },
+                    encode: function () {
+                        const hex = this.instance.protocolType.getValue('0800');
+                        this.writeBytes(2, (0, HexToBuffer_1.HexToBuffer)(hex.padStart(4, '0').slice(-4)));
+                    }
+                },
+                checksum: { type: 'integer', label: 'Checksum', minimum: 0, maximum: 65535 },
+                reserved1: { type: 'string', label: 'Reserved', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true },
+                keyValue: { type: 'string', label: 'Key', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX },
+                sequenceNumber: { type: 'integer', label: 'Sequence Number', minimum: 0, maximum: 4294967295 },
+                //Master field: the optional trailing fields are flag-conditional, so they are parsed/
+                //emitted here (runs after the fixed flags/protocolType fields — property order).
+                body: {
+                    type: 'string', label: 'Body', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true,
+                    decode: function () {
+                        const available = this.#available();
+                        const hasChecksum = !!this.instance.flags.checksum.getValue();
+                        const hasKey = !!this.instance.flags.key.getValue();
+                        const hasSeq = !!this.instance.flags.sequence.getValue();
+                        let offset = 4;
+                        if (hasChecksum && offset + 4 <= available) {
+                            this.instance.checksum.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2)));
+                            this.instance.reserved1.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 2, 2)));
+                            offset += 4;
+                        }
+                        if (hasKey && offset + 4 <= available) {
+                            this.instance.keyValue.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(offset, 4)));
+                            offset += 4;
+                        }
+                        if (hasSeq && offset + 4 <= available) {
+                            this.instance.sequenceNumber.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset, 4)));
+                            offset += 4;
+                        }
+                    },
+                    encode: function () {
+                        const hasChecksum = !!this.instance.flags.checksum.getValue();
+                        const hasKey = !!this.instance.flags.key.getValue();
+                        const hasSeq = !!this.instance.flags.sequence.getValue();
+                        let offset = 4;
+                        if (hasChecksum) {
+                            //Honored verbatim, not recomputed — a crafted GRE may carry any checksum.
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.checksum.getValue(0)));
+                            this.writeBytes(offset + 2, (0, HexToBuffer_1.HexToBuffer)(this.instance.reserved1.getValue('0000')));
+                            offset += 4;
+                        }
+                        if (hasKey) {
+                            this.writeBytes(offset, (0, HexToBuffer_1.HexToBuffer)(this.instance.keyValue.getValue('00000000')));
+                            offset += 4;
+                        }
+                        if (hasSeq) {
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt32ToBuffer)(this.instance.sequenceNumber.getValue(0)));
+                            offset += 4;
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //GRE sits directly above IPv4 (protocol field) or IPv6 (next-header field) with protocol 47, and
+        //needs at least its 4-byte base header within the IP payload.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.instance.protocol.getValue() !== 0x2f && this.prevCodecModule.instance.nxt.getValue() !== 0x2f)
+            return false;
+        return this.#available() >= 4;
+    }
+}
+exports.GRE = GRE;

package/dist/headers/GTPU.d.ts

@@ -0,0 +1,25 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * GTP-U — GPRS Tunnelling Protocol, User plane (3GPP TS 29.281), UDP port 2152. The mandatory 8-byte
+ * header is a Flags byte (Version[3] / Protocol-Type / reserved / E / S / PN), a Message Type
+ * (0xFF = G-PDU carries a user IP packet), a 2-byte Length (everything after the 8-byte header), and a
+ * 4-byte TEID (Tunnel Endpoint Identifier). If any of E/S/PN is set, a 4-byte optional field
+ * (Sequence Number + N-PDU Number + Next-Extension-Header-Type) follows, then a chain of extension
+ * headers. For a G-PDU the payload after the header is a raw inner IP packet.
+ *
+ * The optional field + extension-header chain is kept verbatim (optionalHeader hex) so any GTP-U
+ * variant round-trips byte-for-byte; the inner IP packet is left to the codec's recursion (IPv4/IPv6
+ * accept a GTP-U tunnel parent, matching by IP version), decoding a fresh ip/… stack after the tunnel.
+ */
+export declare class GTPU extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}