@netkitty/codec 1.0.0

package/dist/headers/IPFIX.js

@@ -0,0 +1,156 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IPFIX = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * IPFIX — IP Flow Information Export (RFC 7011, also known as NetFlow v10), UDP port 4739. Every IPFIX
+ * Message begins with a fixed 16-byte Message Header (all big-endian) — Version (always 10), Length (the
+ * total message octet count including this header), Export Time, Sequence Number and Observation Domain
+ * ID — followed by one or more Sets. Each Set is a 4-byte header — Set ID (2 = Template Set, 3 = Options
+ * Template Set, >= 256 = a Data Set keyed by the Template ID) plus Set Length (the octet count of the
+ * whole Set including its 4-byte header) — followed by the Set records.
+ *
+ * The record layout of a Set is template-driven: a Data Set can only be parsed against the Template Set
+ * that defined its Template ID, which is cross-message, session-scoped state. So this single-message
+ * codec keeps each Set structured only down to {Set ID, Set Length, verbatim hex body} — byte-perfect —
+ * and does not sub-decode the records. The message Length is auto-computed on encode when not supplied,
+ * else honored verbatim (a crafted message may lie); each Set Length is honored verbatim, and the Sets
+ * walk is bounded by BOTH the message Length and the captured UDP payload, so trailing bytes are left to
+ * the codec's recursion / RawData. A well-formed message round-trips byte-for-byte.
+ */
+class IPFIX extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ipfix';
+        this.name = 'IP Flow Information Export';
+        this.nickname = 'IPFIX';
+        this.matchKeys = ['udpport:4739'];
+        //A leaf header — Set records are template-driven and require cross-message, session-scoped state.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (IPFIX.#schemaCache ??= IPFIX.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'IPFIX v${version} len=${length} domain=${observationDomainId}',
+            properties: {
+                //Version Number (RFC 7011 §3.1): always 10 for IPFIX. Kept as a plain uint16 (clamped in
+                //the closure, no hard enum) so a crafted non-10 value still round-trips byte-for-byte.
+                version: this.fieldUInt('version', 0, 2, 'Version'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //Length counts the whole message = 16-byte header + all Sets. A supplied value is
+                        //honored (a crafted message may lie); otherwise a placeholder is written now and
+                        //the real total is filled in after every Set has encoded (post-self-encode).
+                        const messageLength = this.instance.length.getValue(0);
+                        if (messageLength) {
+                            this.instance.length.setValue(messageLength);
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(messageLength));
+                        }
+                        else {
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(0));
+                            this.instance.length.setValue(0);
+                            this.addPostSelfEncodeHandler(() => {
+                                const total = this.length < 16 ? 16 : this.length;
+                                const clamped = total > 65535 ? 65535 : total;
+                                this.instance.length.setValue(clamped);
+                                this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(clamped));
+                            }, 1);
+                        }
+                    }
+                },
+                exportTime: this.fieldUInt('exportTime', 4, 4, 'Export Time'),
+                sequenceNumber: this.fieldUInt('sequenceNumber', 8, 4, 'Sequence Number'),
+                observationDomainId: this.fieldUInt('observationDomainId', 12, 4, 'Observation Domain ID'),
+                sets: {
+                    type: 'array',
+                    label: 'Sets',
+                    items: {
+                        type: 'object',
+                        label: 'Set',
+                        properties: {
+                            setId: { type: 'integer', label: 'Set ID', minimum: 0, maximum: 65535 },
+                            setLength: { type: 'integer', label: 'Set Length', minimum: 0, maximum: 65535 },
+                            body: { type: 'string', label: 'Body', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        //Bound by BOTH the declared message Length AND the bytes actually present, so a
+                        //lying Length cannot spawn phantom Sets past the end of the buffer. readBytes clamps
+                        //at the buffer end; each Set consumes at least its 4-byte header so the loop always
+                        //advances and cannot run forever.
+                        const messageLength = this.instance.length.getValue(0);
+                        const available = this.packet.length - this.startPos;
+                        const end = Math.min(messageLength, available);
+                        const sets = [];
+                        let offset = 16;
+                        while (offset + 4 <= end) {
+                            const setId = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2));
+                            const setLength = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 2, 2));
+                            offset += 4;
+                            //Body = Set Length minus the 4-byte Set header, clamped to the remaining bytes
+                            //so a lying/short Set Length never reads out of bounds.
+                            let bodyLength = setLength - 4;
+                            if (bodyLength < 0)
+                                bodyLength = 0;
+                            if (offset + bodyLength > end)
+                                bodyLength = end - offset;
+                            const body = bodyLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, bodyLength)) : '';
+                            offset += bodyLength;
+                            sets.push({ setId: setId, setLength: setLength, body: body });
+                        }
+                        this.instance.sets.setValue(sets);
+                    },
+                    encode: function () {
+                        const sets = this.instance.sets.getValue();
+                        if (!sets)
+                            return;
+                        let offset = 16;
+                        sets.forEach((set) => {
+                            const setId = set.setId ? set.setId : 0;
+                            const body = (0, HexToBuffer_1.HexToBuffer)(set.body ? set.body : '');
+                            //Set Length counts the 4-byte Set header + body. Honored when supplied (a
+                            //crafted Set may lie); else derived from the body.
+                            const setLength = (set.setLength !== undefined && set.setLength !== null)
+                                ? set.setLength
+                                : 4 + body.length;
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(setId > 65535 ? 65535 : setId));
+                            this.writeBytes(offset + 2, (0, NumberToBuffer_1.UInt16ToBuffer)(setLength > 65535 ? 65535 : setLength));
+                            offset += 4;
+                            if (body.length) {
+                                this.writeBytes(offset, body);
+                                offset += body.length;
+                            }
+                        });
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //IPFIX rides on UDP port 4739. The header carries no strong content magic beyond the Version
+        //field, so selection stays port-bucketed (matchKeys) and additionally requires the full 16-byte
+        //Message Header and Version == 10 so non-IPFIX 4739 traffic falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.packet.length - this.startPos < 16)
+            return false;
+        return (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(0, 2, true)) === 10;
+    }
+}
+exports.IPFIX = IPFIX;

package/dist/headers/IPv4.d.ts

@@ -0,0 +1,20 @@
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { DemuxProducer } from '../types/DemuxProducer';
+export declare class IPv4 extends BaseHeader {
+    #private;
+    /**
+     * Calculate IPv4 header checksum
+     * @param headerBuffer
+     * @protected
+     */
+    protected calculateIPv4Checksum(headerBuffer: Buffer): number;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    readonly demuxProducers: DemuxProducer[];
+    readonly name: string;
+    readonly nickname: string;
+    match(): boolean;
+}

package/dist/headers/IPv4.js

@@ -0,0 +1,370 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IPv4 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const NumberToHex_1 = require("../helper/NumberToHex");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+class IPv4 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ipv4';
+        this.matchKeys = ['ethertype:0800'];
+        //Also in the heuristic chain so IPv4 can be recognized as the inner payload of a bare-IP tunnel
+        //(GTP-U G-PDU), which carries no inner-protocol field. The etherType path below still handles the
+        //normal ethertype:0800 bucket, so ethernet-parented IPv4 is byte-identical to before.
+        this.heuristicFallback = true;
+        this.demuxProducers = [{ field: 'protocol', namespace: 'ipproto', kind: 'uint' }];
+        this.name = 'Internet Protocol Version 4';
+        this.nickname = 'IPv4';
+    }
+    /**
+     * Calculate IPv4 header checksum
+     * @param headerBuffer
+     * @protected
+     */
+    calculateIPv4Checksum(headerBuffer) {
+        const header = Uint8Array.from(headerBuffer);
+        let sum = 0;
+        for (let i = 0; i < header.length; i += 2) {
+            const word = (header[i] << 8) + (header[i + 1] || 0);
+            sum += word;
+        }
+        while (sum >>> 16) {
+            sum = (sum & 0xFFFF) + (sum >>> 16);
+        }
+        return (~sum) & 0xFFFF;
+    }
+    static #schemaCache;
+    //SCHEMA is built once per class and cached (④ prototype). Its field closures are plain functions
+    //that take `this` dynamically — BaseHeader invokes each via .call(this) — so they capture no
+    //instance and the whole structure is shareable, avoiding a full per-packet rebuild. Inner callbacks
+    //(post-handlers, getValue callbacks) are arrows created when the function runs, capturing that
+    //call's `this`, so caching does not cross-wire instances. Unmigrated headers still initialise
+    //SCHEMA as an instance field.
+    get SCHEMA() {
+        return (IPv4.#schemaCache ??= IPv4.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: '${sip} → ${dip}',
+            properties: {
+                version: {
+                    type: 'integer',
+                    label: 'Version',
+                    minimum: 0,
+                    maximum: 15,
+                    decode: function () {
+                        this.instance.version.setValue(this.readBits(0, 1, 0, 4));
+                        if (this.instance.version.getValue() !== 4)
+                            this.recordError(this.instance.version.getPath(), 'IPv4 version should be 4');
+                    },
+                    encode: function () {
+                        let version = this.instance.version.getValue(4);
+                        version = version > 15 ? 15 : version;
+                        version = version < 0 ? 0 : version;
+                        if (version !== 4)
+                            this.recordError(this.instance.version.getPath(), 'IPv4 version should be 4');
+                        this.instance.version.setValue(version);
+                        this.writeBits(0, 1, 0, 4, version);
+                    }
+                },
+                hdrLen: {
+                    type: 'integer',
+                    label: 'Header Length',
+                    minimum: 20,
+                    maximum: 60,
+                    decode: function () {
+                        this.instance.hdrLen.setValue(this.readBits(0, 1, 4, 4) * 4);
+                    },
+                    encode: function () {
+                        let headerLength = this.instance.hdrLen.getValue(0);
+                        if (headerLength)
+                            headerLength = headerLength ? Math.floor(headerLength / 4) : 0;
+                        this.writeBits(0, 1, 4, 4, headerLength);
+                        if (!headerLength)
+                            this.addPostSelfEncodeHandler(() => {
+                                this.instance.hdrLen.setValue(this.length);
+                                this.writeBits(0, 1, 4, 4, Math.floor(this.length / 4));
+                            }, 10);
+                    }
+                },
+                dsfield: {
+                    type: 'object',
+                    label: 'Differentiated Services Field',
+                    properties: {
+                        dscp: {
+                            type: 'integer',
+                            minimum: 0,
+                            maximum: 63,
+                            label: 'Differentiated Services Codepoint',
+                            decode: function () {
+                                this.instance.dsfield.dscp.setValue(this.readBits(1, 1, 0, 6));
+                            },
+                            encode: function () {
+                                const dscp = this.instance.dsfield.dscp.getValue(0);
+                                this.instance.dsfield.dscp.setValue(dscp);
+                                this.writeBits(1, 1, 0, 6, dscp);
+                            }
+                        },
+                        ecn: {
+                            type: 'integer',
+                            label: 'Explicit Congestion Notification',
+                            decode: function () {
+                                this.instance.dsfield.ecn.setValue(this.readBits(1, 1, 6, 2));
+                            },
+                            encode: function () {
+                                const ecn = this.instance.dsfield.ecn.getValue(0);
+                                this.instance.dsfield.ecn.setValue(ecn);
+                                this.writeBits(1, 1, 6, 2, ecn);
+                            }
+                        }
+                    }
+                },
+                length: {
+                    type: 'integer',
+                    label: 'Total Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //This field's real value needs down stream codec invoke recode to fill
+                        const length = this.instance.length.getValue(0);
+                        if (length) {
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(length));
+                        }
+                        else {
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(length));
+                            this.addPostPacketEncodeHandler(() => {
+                                let startCount = false;
+                                let totalLength = 0;
+                                this.codecModules.forEach((codecModule) => {
+                                    if (codecModule === this)
+                                        startCount = true;
+                                    if (startCount)
+                                        totalLength += codecModule.length;
+                                });
+                                this.instance.length.setValue(totalLength);
+                                this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(totalLength));
+                            }, 1);
+                        }
+                    }
+                },
+                id: {
+                    type: 'integer',
+                    label: 'Identification',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.id.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(4, 2)));
+                    },
+                    encode: function () {
+                        const id = this.instance.id.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.id.setValue(id);
+                        this.writeBytes(4, (0, NumberToBuffer_1.UInt16ToBuffer)(id));
+                    }
+                },
+                flags: {
+                    type: 'object',
+                    label: 'Flags',
+                    properties: {
+                        rb: {
+                            type: 'integer',
+                            enum: [0, 1],
+                            label: 'Reserved bit',
+                            decode: function () {
+                                this.instance.flags.rb.setValue(this.readBits(6, 1, 0, 1));
+                            },
+                            encode: function () {
+                                const rb = this.instance.flags.rb.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                                this.instance.flags.rb.setValue(rb);
+                                this.writeBits(6, 1, 0, 1, rb);
+                            }
+                        },
+                        df: {
+                            type: 'integer',
+                            enum: [0, 1],
+                            label: 'Don\'t fragment',
+                            decode: function () {
+                                this.instance.flags.df.setValue(this.readBits(6, 1, 1, 1));
+                            },
+                            encode: function () {
+                                const df = this.instance.flags.df.getValue(1, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                                this.instance.flags.df.setValue(df);
+                                this.writeBits(6, 1, 1, 1, df);
+                            }
+                        },
+                        mf: {
+                            type: 'integer',
+                            enum: [0, 1],
+                            label: 'More fragments',
+                            decode: function () {
+                                this.instance.flags.mf.setValue(this.readBits(6, 1, 2, 1));
+                            },
+                            encode: function () {
+                                const mf = this.instance.flags.mf.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                                this.instance.flags.mf.setValue(mf);
+                                this.writeBits(6, 1, 2, 1, mf);
+                            }
+                        }
+                    }
+                },
+                fragOffset: {
+                    type: 'integer',
+                    minimum: 0,
+                    maximum: 8191,
+                    label: 'Fragment Offset',
+                    decode: function () {
+                        this.instance.fragOffset.setValue(this.readBits(6, 2, 3, 13));
+                    },
+                    encode: function () {
+                        const fragOffset = this.instance.fragOffset.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.fragOffset.setValue(fragOffset);
+                        this.writeBits(6, 2, 3, 13, fragOffset);
+                    }
+                },
+                ttl: {
+                    type: 'integer',
+                    minimum: 0,
+                    maximum: 255,
+                    label: 'Time to Live',
+                    decode: function () {
+                        this.instance.ttl.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(8, 1)));
+                    },
+                    encode: function () {
+                        const ttl = this.instance.ttl.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.ttl.setValue(ttl);
+                        this.writeBytes(8, (0, NumberToBuffer_1.UInt8ToBuffer)(ttl));
+                    }
+                },
+                protocol: {
+                    type: 'integer',
+                    label: 'Protocol',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        this.instance.protocol.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(9, 1)));
+                    },
+                    encode: function () {
+                        const protocol = this.instance.protocol.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.protocol.setValue(protocol);
+                        this.writeBytes(9, (0, NumberToBuffer_1.UInt8ToBuffer)(protocol));
+                    }
+                },
+                checksum: {
+                    type: 'integer',
+                    label: 'Header Checksum',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.checksum.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(10, 2)));
+                    },
+                    encode: function () {
+                        let checksum = this.instance.checksum.getValue(0);
+                        checksum = checksum > 65535 ? 65535 : checksum;
+                        checksum = checksum < 0 ? 0 : checksum;
+                        if (checksum) {
+                            this.instance.checksum.setValue(checksum);
+                            this.writeBytes(10, (0, NumberToBuffer_1.UInt16ToBuffer)(checksum));
+                        }
+                        else {
+                            this.instance.checksum.setValue(checksum);
+                            this.writeBytes(10, (0, NumberToBuffer_1.UInt16ToBuffer)(checksum));
+                            this.addPostPacketEncodeHandler(() => {
+                                const calcChecksum = this.calculateIPv4Checksum(this.packet.subarray(this.startPos, this.endPos));
+                                this.instance.checksum.setValue(calcChecksum);
+                                this.writeBytes(10, (0, NumberToBuffer_1.UInt16ToBuffer)(calcChecksum));
+                            }, 2);
+                        }
+                    }
+                },
+                sip: {
+                    type: 'string',
+                    label: 'Source Address',
+                    minLength: 7,
+                    maxLength: 15,
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4,
+                    decode: function () {
+                        const sipBuffer = this.readBytes(12, 4);
+                        this.instance.sip.setValue((0, BufferToIP_1.BufferToIPv4)(sipBuffer));
+                    },
+                    encode: function () {
+                        const sipStr = this.instance.sip.getValue('0.0.0.0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.sip.setValue(sipStr);
+                        this.writeBytes(12, (0, IPToBuffer_1.IPv4ToBuffer)(sipStr));
+                    }
+                },
+                dip: {
+                    type: 'string',
+                    minLength: 7,
+                    maxLength: 15,
+                    label: 'Destination Address',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4,
+                    decode: function () {
+                        const dipBuffer = this.readBytes(16, 4);
+                        this.instance.dip.setValue((0, BufferToIP_1.BufferToIPv4)(dipBuffer));
+                    },
+                    encode: function () {
+                        const dipStr = this.instance.dip.getValue('0.0.0.0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.dip.setValue(dipStr);
+                        this.writeBytes(16, (0, IPToBuffer_1.IPv4ToBuffer)(dipStr));
+                    }
+                },
+                options: {
+                    type: 'string',
+                    label: 'Options',
+                    minLength: 0,
+                    maxLength: 40 * 2,
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.length < (this.instance.hdrLen.getValue())) {
+                            this.instance.options.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(this.length, (this.instance.hdrLen.getValue()) - this.length)));
+                        }
+                    },
+                    encode: function () {
+                        if (!this.instance.options.isUndefined()) {
+                            let optionsBuffer = (0, HexToBuffer_1.HexToBuffer)(this.instance.options.getValue(''));
+                            if (optionsBuffer.length > 40)
+                                optionsBuffer = optionsBuffer.subarray(0, 40);
+                            const estimateHdrLen = this.length + optionsBuffer.length;
+                            if (estimateHdrLen % 4) {
+                                /**
+                                 * IPv4 Header should have a length that a multiple of 32 bits
+                                 * @see https://learningnetwork.cisco.com/s/question/0D53i00000Kt6hHCAR/padding-field-on-ipv4-header
+                                 */
+                                optionsBuffer = Buffer.concat([optionsBuffer, Buffer.alloc((4 - estimateHdrLen % 4) % 4, 0)]);
+                            }
+                            this.writeBytes(this.length, optionsBuffer);
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        if (!this.prevCodecModule)
+            return false;
+        //Normal path (unchanged): a parent that demuxed to IPv4 via its etherType field.
+        if (this.prevCodecModule.instance.etherType.getValue() === (0, NumberToHex_1.UInt16ToHex)(0x0800))
+            return true;
+        //Bare-IP tunnel path: GTP-U (and future discriminator-less IP tunnels) carry no inner-protocol
+        //field, so match by the IPv4 version nibble. The tunnel-parent id gate MUST come first — a 4-bit
+        //nibble alone is too weak a signature (many TCP/TLS payloads begin 0x4x).
+        if (['gtp'].includes(this.prevCodecModule.id) && (this.readBytes(0, 1, true)[0] >> 4) === 4)
+            return true;
+        //Typed-tunnel path: GENEVE/GRE carry a Protocol Type (an EtherType), so trust that self-describing
+        //field rather than the weak version nibble — the ethertype demux already routed us here.
+        if ((this.prevCodecModule.id === 'geneve' || this.prevCodecModule.id === 'gre') && this.prevCodecModule.instance.protocolType.getValue() === (0, NumberToHex_1.UInt16ToHex)(0x0800))
+            return true;
+        return false;
+    }
+}
+exports.IPv4 = IPv4;

package/dist/headers/IPv6.d.ts

@@ -0,0 +1,29 @@
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * IPv6 — Internet Protocol version 6 (RFC 8200), carried on Ethernet with EtherType 0x86dd. This codec
+ * decodes the 40-octet fixed header: a 4-bit Version (`version`, offset 0), an 8-bit Traffic Class split
+ * into a 6-bit DSCP (`tclass.dscp`) and 2-bit ECN (`tclass.ecn`), a 20-bit Flow Label (`flow`), a 16-bit
+ * Payload Length (`plen`, offset 4), an 8-bit Next Header (`nxt`, offset 6), an 8-bit Hop Limit (`hllm`,
+ * offset 7), and the 16-octet Source (`sip`, offset 8) and Destination (`dip`, offset 24) addresses. It
+ * stops at the fixed header: `nxt` is published as an `ipproto` demux key, so extension headers and the
+ * upper-layer protocol (TCP/UDP/ICMPv6/OSPF…) are decoded by the next module.
+ *
+ * Payload Length is honor-else-derive: a supplied value is written as-is, but when it is 0 on encode a
+ * post-packet-encode handler sums the byte length of this header and everything after it, subtracts the
+ * 40-octet header, and writes the result (falling back to 0 when it exceeds 65535, as a Hop-by-Hop Jumbo
+ * Payload would). match() accepts the normal `ethertype:86dd` path, and — being in the heuristic chain —
+ * also an IPv6 payload inside a bare-IP GTP-U tunnel (parent id `gtp` with a version nibble of 6) or a
+ * GENEVE/GRE tunnel whose Protocol Type is 0x86dd.
+ */
+export declare class IPv6 extends BaseHeader {
+    SCHEMA: ProtocolJSONSchema;
+    id: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    readonly demuxProducers: DemuxProducer[];
+    name: string;
+    nickname: string;
+    match(): boolean;
+}