@netkitty/codec 1.0.0

package/dist/headers/KNXnetIP.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNXnetIP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * KNXnet/IP (KNX over IP, ISO/IEC 14543-3, KNX Association 03/03/02), UDP port 3671 — the IP transport
+ * of the KNX building-automation bus (tunnelling KNX telegrams over IP and routing them between KNXnet/IP
+ * routers). Every KNXnet/IP frame begins with a fixed 6-byte header — Header Length (always 0x06 for the
+ * current spec), Protocol Version (0x10 = 1.0), a 2-byte Service Type Identifier and a 2-byte Total Length
+ * (the whole frame octet count INCLUDING this 6-byte header) — followed by the service-specific body.
+ *
+ * Common Service Type Identifiers: 0x0201 SEARCH_REQUEST, 0x0202 SEARCH_RESPONSE, 0x0205 CONNECT_REQUEST,
+ * 0x0420 TUNNELLING_REQUEST, 0x0530 ROUTING_INDICATION.
+ *
+ * The body layout differs per service type (HPAI discovery endpoints, connection headers, cEMI frames)
+ * and several sub-structures need connection/service context, so this single-frame codec keeps the body
+ * verbatim as `body` hex (byte-perfect) and does not sub-decode it. The Total Length is auto-computed from
+ * the body on encode when not supplied, else honored verbatim (a crafted frame may lie); the frame is
+ * bounded by Total Length (and the enclosing UDP payload) so trailing bytes are left to the codec's
+ * recursion / RawData. A well-formed frame round-trips byte-for-byte.
+ */
+class KNXnetIP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'knxnetip';
+        this.name = 'KNXnet/IP';
+        this.nickname = 'KNXnet/IP';
+        this.matchKeys = ['udpport:3671'];
+        //A leaf header — the service-specific body requires per-service, connection-dependent parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (KNXnetIP.#schemaCache ??= KNXnetIP.#buildSchema());
+    }
+    /**
+     * End offset (header-relative) of this KNXnet/IP frame: the Total Length, clamped to the enclosing
+     * UDP payload (udp.length − 8) when present and to the captured bytes. Bounding by the UDP payload as
+     * well as Total Length keeps a lying Total Length from swallowing trailing bytes and keeps a short
+     * capture in range.
+     */
+    static #frameEnd(self) {
+        let end = self.instance.totalLength.getValue(0);
+        const available = self.packet.length - self.startPos;
+        const prev = self.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            const udpPayload = udpLength - 8;
+            if (udpPayload >= 6 && udpPayload < end)
+                end = udpPayload;
+        }
+        if (end > available)
+            end = available;
+        return end < 0 ? 0 : end;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'KNXnet/IP service=${serviceType} len=${totalLength}',
+            properties: {
+                //Header Length — the size of this header in octets, 0x06 for the current KNXnet/IP spec.
+                //Kept as a plain clamped byte (honored verbatim) so a crafted frame still round-trips.
+                headerLength: this.fieldUInt('headerLength', 0, 1, 'Header Length'),
+                //Protocol Version — 0x10 (1.0) for the current spec. Kept verbatim.
+                protocolVersion: this.fieldUInt('protocolVersion', 1, 1, 'Protocol Version'),
+                //Service Type Identifier (e.g. 0x0201 SEARCH_REQUEST, 0x0420 TUNNELLING_REQUEST). Kept as a
+                //plain clamped uint16 (NOT an Ajv enum) so any non-standard / crafted service type decoded
+                //from the wire still re-encodes without being rejected — decode never fails, encode faithful.
+                serviceType: this.fieldUInt('serviceType', 2, 2, 'Service Type'),
+                totalLength: {
+                    type: 'integer',
+                    label: 'Total Length',
+                    //minimum 0 (not 6): a crafted/corrupt frame may carry a Total Length below the 6-byte
+                    //header, and that value must round-trip (honored verbatim) rather than be rejected by
+                    //Ajv at the encode entry — decode never fails, encode is a faithful executor.
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.totalLength.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(4, 2)));
+                    },
+                    encode: function () {
+                        //Total Length counts the whole frame = 6-byte header + body. Honored when supplied
+                        //(a crafted frame may lie); else derived from the body.
+                        const provided = this.instance.totalLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 6 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.totalLength.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        this.instance.totalLength.setValue(value);
+                        this.writeBytes(4, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //The service-specific body after the 6-byte header, kept verbatim. Bounded by the Total
+                //Length (frame ends at offset Total Length), the enclosing UDP payload and the captured
+                //bytes, so trailing / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const end = KNXnetIP.#frameEnd(this);
+                        this.instance.body.setValue(end > 6 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(6, end - 6)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(6, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //KNXnet/IP rides on UDP port 3671. The header carries no strong content magic, but the first two
+        //octets are effectively a fixed signature for the current spec: Header Length 0x06 and Protocol
+        //Version 0x10. Require the full 6-byte header plus that signature so non-KNX 3671 traffic falls
+        //through to raw. Selection stays port-bucketed (matchKeys), like the other length-bounded UDP
+        //payload codecs.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.packet.length - this.startPos < 6)
+            return false;
+        const header = this.readBytes(0, 2, true);
+        return header[0] === 0x06 && header[1] === 0x10;
+    }
+}
+exports.KNXnetIP = KNXnetIP;

package/dist/headers/Kafka.d.ts

@@ -0,0 +1,35 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Apache Kafka wire protocol, TCP port 9092. Every Kafka message is length-prefixed: a big-endian uint32
+ * MessageSize counting the number of bytes that FOLLOW it, then the message. A REQUEST message begins with
+ * a request header — apiKey (2, BE) + apiVersion (2, BE) + correlationId (4, BE) + clientId (a nullable
+ * string: a 2-byte BE length, -1 meaning null, then that many UTF-8 bytes) + [tagged fields on flexible
+ * versions] + the request body. A RESPONSE begins with correlationId (4, BE) + body.
+ *
+ * ⚠️ Request vs response is NOT self-describing on the wire: telling them apart needs the paired
+ * connection state (which apiKey/apiVersion a given correlationId was requested with), which is
+ * cross-packet state — out of scope for this single-packet codec. This codec therefore assumes REQUEST
+ * framing: that is what a client sends, it is the more identifiable of the two (a response is just
+ * correlationId + opaque body), and it is the common client-side case. A captured response would be
+ * mis-labeled — a documented limitation of the minimal slice.
+ *
+ * As a REQUEST, this codec structures MessageSize + apiKey + apiVersion + correlationId and keeps the rest
+ * (clientId + optional tagged fields + body) verbatim as `payload` hex (byte-perfect), bounded by
+ * MessageSize (the message ends at offset 4 + MessageSize) and the captured bytes — so a pipelined second
+ * message or trailing bytes are left to the codec's recursion / RawData. The MessageSize is honored when
+ * supplied (a crafted message may lie), else derived as 8 (apiKey + apiVersion + correlationId) + payload
+ * bytes. A well-formed request round-trips byte-for-byte. Structuring clientId / tagged fields / the
+ * per-apiKey body is a later slice.
+ */
+export declare class Kafka extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Kafka.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Kafka = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** Kafka's default socket.request.max.bytes (100 MiB). A MessageSize beyond this is implausible. */
+const KAFKA_MAX_MESSAGE_SIZE = 104857600;
+/**
+ * Apache Kafka wire protocol, TCP port 9092. Every Kafka message is length-prefixed: a big-endian uint32
+ * MessageSize counting the number of bytes that FOLLOW it, then the message. A REQUEST message begins with
+ * a request header — apiKey (2, BE) + apiVersion (2, BE) + correlationId (4, BE) + clientId (a nullable
+ * string: a 2-byte BE length, -1 meaning null, then that many UTF-8 bytes) + [tagged fields on flexible
+ * versions] + the request body. A RESPONSE begins with correlationId (4, BE) + body.
+ *
+ * ⚠️ Request vs response is NOT self-describing on the wire: telling them apart needs the paired
+ * connection state (which apiKey/apiVersion a given correlationId was requested with), which is
+ * cross-packet state — out of scope for this single-packet codec. This codec therefore assumes REQUEST
+ * framing: that is what a client sends, it is the more identifiable of the two (a response is just
+ * correlationId + opaque body), and it is the common client-side case. A captured response would be
+ * mis-labeled — a documented limitation of the minimal slice.
+ *
+ * As a REQUEST, this codec structures MessageSize + apiKey + apiVersion + correlationId and keeps the rest
+ * (clientId + optional tagged fields + body) verbatim as `payload` hex (byte-perfect), bounded by
+ * MessageSize (the message ends at offset 4 + MessageSize) and the captured bytes — so a pipelined second
+ * message or trailing bytes are left to the codec's recursion / RawData. The MessageSize is honored when
+ * supplied (a crafted message may lie), else derived as 8 (apiKey + apiVersion + correlationId) + payload
+ * bytes. A well-formed request round-trips byte-for-byte. Structuring clientId / tagged fields / the
+ * per-apiKey body is a later slice.
+ */
+class Kafka extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'kafka';
+        this.name = 'Kafka';
+        this.nickname = 'Kafka';
+        this.matchKeys = ['tcpport:9092'];
+        //A leaf header — clientId / tagged fields / the per-apiKey body require flexible-version and
+        //cross-message parsing kept verbatim as payload for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Kafka.#schemaCache ??= Kafka.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Kafka apiKey=${apiKey}',
+            properties: {
+                //Big-endian uint32: the count of bytes that FOLLOW this field (apiKey + apiVersion +
+                //correlationId + payload). Honored when supplied (a crafted message may lie); else derived
+                //as 8 (the fixed apiKey + apiVersion + correlationId header) + payload bytes.
+                messageSize: {
+                    type: 'integer',
+                    label: 'Message Size',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.messageSize.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4)));
+                    },
+                    encode: function () {
+                        const provided = this.instance.messageSize.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 8 + (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.messageSize.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.messageSize.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.messageSize.setValue(value);
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                apiKey: this.fieldUInt('apiKey', 4, 2, 'API Key'),
+                apiVersion: this.fieldUInt('apiVersion', 6, 2, 'API Version'),
+                correlationId: this.fieldUInt('correlationId', 8, 4, 'Correlation ID'),
+                //The rest of the request (clientId + optional tagged fields + body) after the 12-byte
+                //MessageSize/apiKey/apiVersion/correlationId prefix, kept verbatim. Bounded by MessageSize
+                //(the message ends at offset 4 + MessageSize) and the captured bytes, so trailing/pipelined
+                //data is left to the codec's recursion / RawData.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const messageSize = this.instance.messageSize.getValue(0);
+                        let end = 4 + messageSize;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.payload.setValue(end > 12 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(12, end - 12)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(12, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Kafka rides on TCP port 9092. The length prefix is a WEAK content signature (any big-endian
+        //uint32 followed by bytes looks like it), so this stays a port-bucket protocol: matchKeys only,
+        //NO heuristicFallback — we never claim Kafka off port 9092 on the strength of a plausible length.
+        //Within the bucket, require the full 12-byte minimal request header (MessageSize + apiKey +
+        //apiVersion + correlationId) and a plausible MessageSize (large enough to cover the 8-byte
+        //apiKey/apiVersion/correlationId that MessageSize counts, and not absurdly large) so non-Kafka
+        //traffic on 9092 falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 12)
+            return false;
+        const messageSize = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4, true));
+        if (messageSize < 8)
+            return false;
+        return messageSize <= KAFKA_MAX_MESSAGE_SIZE;
+    }
+}
+exports.Kafka = Kafka;

package/dist/headers/Kerberos.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Kerberos v5 (RFC 4120), UDP + TCP port 88. A Kerberos message is a single BER-encoded ASN.1
+ * APPLICATION-tagged element: `<appTag> <BER length> <body>`, where the application tag names the
+ * message type — 0x6a AS-REQ(10), 0x6b AS-REP(11), 0x6c TGS-REQ(12), 0x6d TGS-REP(13), 0x6e AP-REQ(14),
+ * 0x6f AP-REP(15), 0x7e KRB-ERROR(30).
+ *
+ * Transport framing differs by L4: over UDP the message is the whole datagram (no prefix); over TCP a
+ * 4-byte big-endian length prefix (the number of message bytes that follow) precedes it (RFC 4120 §7.2.2).
+ * This header detects the transport via prevCodecModule.id and structures accordingly: TCP → recordLength
+ * (uint32 BE) then the app-tagged message; UDP → the message directly (recordLength absent).
+ *
+ * Byte-perfect strategy (minimal slice): structure the application tag (msgType) + the message's BER
+ * length, and keep the body verbatim as `body` hex, bounded by the decoded BER length. The BER length is
+ * re-derived in minimal definite form on encode (matching what KDCs emit), and the TCP recordLength is
+ * honored when supplied else derived as the encoded message length. Parsing the KDC-REQ / KDC-REP /
+ * KRB-ERROR body (pvno, padata, req-body, etc.) is a later enrichment.
+ */
+export declare class Kerberos extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Kerberos.js

@@ -0,0 +1,217 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Kerberos = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * The set of Kerberos v5 application tags (RFC 4120 §5.4/5.5/5.9): AS-REQ [APPLICATION 10] = 0x6a,
+ * AS-REP 0x6b, TGS-REQ 0x6c, TGS-REP 0x6d, AP-REQ 0x6e, AP-REP 0x6f, KRB-ERROR [APPLICATION 30] = 0x7e.
+ * (0x6a = 0x60 | 10, 0x7e = 0x60 | 30 — application-class, constructed BER tags.)
+ */
+const KERBEROS_APP_TAGS = new Set([0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x7e]);
+/**
+ * Kerberos v5 (RFC 4120), UDP + TCP port 88. A Kerberos message is a single BER-encoded ASN.1
+ * APPLICATION-tagged element: `<appTag> <BER length> <body>`, where the application tag names the
+ * message type — 0x6a AS-REQ(10), 0x6b AS-REP(11), 0x6c TGS-REQ(12), 0x6d TGS-REP(13), 0x6e AP-REQ(14),
+ * 0x6f AP-REP(15), 0x7e KRB-ERROR(30).
+ *
+ * Transport framing differs by L4: over UDP the message is the whole datagram (no prefix); over TCP a
+ * 4-byte big-endian length prefix (the number of message bytes that follow) precedes it (RFC 4120 §7.2.2).
+ * This header detects the transport via prevCodecModule.id and structures accordingly: TCP → recordLength
+ * (uint32 BE) then the app-tagged message; UDP → the message directly (recordLength absent).
+ *
+ * Byte-perfect strategy (minimal slice): structure the application tag (msgType) + the message's BER
+ * length, and keep the body verbatim as `body` hex, bounded by the decoded BER length. The BER length is
+ * re-derived in minimal definite form on encode (matching what KDCs emit), and the TCP recordLength is
+ * honored when supplied else derived as the encoded message length. Parsing the KDC-REQ / KDC-REP /
+ * KRB-ERROR body (pvno, padata, req-body, etc.) is a later enrichment.
+ */
+class Kerberos extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'kerberos';
+        this.name = 'Kerberos';
+        this.nickname = 'Kerberos';
+        //KDC ports 88 on both UDP and TCP.
+        this.matchKeys = ['tcpport:88', 'udpport:88'];
+        //A leaf header — the KDC-REQ / KDC-REP / KRB-ERROR body is kept verbatim for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Kerberos.#schemaCache ??= Kerberos.#buildSchema());
+    }
+    // ===== Minimal BER length codec (definite length only) =====
+    /** Read one TLV at `pos`; defensive against truncation (always advances, clamps to buffer). */
+    static #readTLV(buf, pos) {
+        if (pos >= buf.length)
+            return { tag: 0, contentStart: pos, contentLen: 0, next: pos + 1 };
+        const tag = buf[pos];
+        let p = pos + 1;
+        let len = p < buf.length ? buf[p] : 0;
+        p += 1;
+        if (len & 0x80) {
+            const lengthBytes = len & 0x7f;
+            len = 0;
+            for (let i = 0; i < lengthBytes; i++) {
+                len = len * 256 + (p < buf.length ? buf[p] : 0);
+                p += 1;
+            }
+        }
+        const contentStart = p;
+        //Clamp the content to what is actually present so a lying length cannot read out of bounds.
+        const contentLen = Math.min(len, Math.max(0, buf.length - contentStart));
+        return { tag: tag, contentStart: contentStart, contentLen: contentLen, next: contentStart + contentLen };
+    }
+    /** Encode a definite length in minimal form (short form < 128, else long form). */
+    static #encodeLength(length) {
+        if (length < 0x80)
+            return Buffer.from([length]);
+        const bytes = [];
+        let v = length;
+        while (v > 0) {
+            bytes.unshift(v & 0xff);
+            v = Math.floor(v / 256);
+        }
+        return Buffer.from([0x80 | bytes.length, ...bytes]);
+    }
+    /** Offset of the app-tagged message within this header: 4 bytes past startPos for TCP, 0 for UDP. */
+    #messageOffset() {
+        return this.prevCodecModule && this.prevCodecModule.id === 'tcp' ? 4 : 0;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Kerberos msgType=${msgType}',
+            properties: {
+                //TCP-only 4-byte big-endian length prefix (RFC 4120 §7.2.2): the number of message bytes
+                //that follow. Over UDP there is no prefix, so this field decodes/encodes nothing (the
+                //transport is detected via prevCodecModule.id). Honored when supplied (a crafted frame may
+                //lie); else derived at self-post-encode time as the encoded message length.
+                recordLength: {
+                    type: 'integer',
+                    label: 'Record Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        if (!(this.prevCodecModule && this.prevCodecModule.id === 'tcp'))
+                            return;
+                        this.instance.recordLength.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4)));
+                    },
+                    encode: function () {
+                        if (!(this.prevCodecModule && this.prevCodecModule.id === 'tcp'))
+                            return;
+                        const provided = this.instance.recordLength.getValue();
+                        if (provided !== undefined && provided !== null) {
+                            let value = provided;
+                            if (value > 4294967295) {
+                                this.recordError(this.instance.recordLength.getPath(), 'Maximum value is 4294967295');
+                                value = 4294967295;
+                            }
+                            if (value < 0) {
+                                this.recordError(this.instance.recordLength.getPath(), 'Minimum value is 0');
+                                value = 0;
+                            }
+                            this.instance.recordLength.setValue(value);
+                            this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                        }
+                        else {
+                            //Derive after the message bytes have been written: the record length counts
+                            //exactly the app-tagged message (everything after this 4-byte prefix).
+                            this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(0));
+                            this.addPostSelfEncodeHandler(() => {
+                                const messageLength = this.headerLength - 4;
+                                const value = messageLength > 0 ? messageLength : 0;
+                                this.instance.recordLength.setValue(value);
+                                this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                            }, 0);
+                        }
+                    }
+                },
+                //The message-type application tag (0x6a AS-REQ … 0x7e KRB-ERROR). It is the outer BER tag
+                //of the message, so it is decoded/re-emitted together with the BER length and body below.
+                msgType: {
+                    type: 'integer',
+                    label: 'Message Type',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        const messageOffset = this.#messageOffset();
+                        const available = this.packet.length - this.startPos - messageOffset;
+                        if (available <= 0)
+                            return;
+                        //Read enough to cover the tag + BER length header, then the whole message so
+                        //headerLength/endPos span exactly this Kerberos message (the TCP prefix included).
+                        const headerPeek = available < 6 ? available : 6;
+                        const peek = this.readBytes(messageOffset, headerPeek, true);
+                        this.instance.msgType.setValue(peek.length > 0 ? peek[0] : 0);
+                        //Parse the BER length from the peek (unclamped — the peek is only the header, so
+                        //#readTLV's content clamp would wrongly cap the total message length).
+                        let lp = 1;
+                        let declaredLength = lp < peek.length ? peek[lp] : 0;
+                        lp += 1;
+                        if (declaredLength & 0x80) {
+                            const lengthBytes = declaredLength & 0x7f;
+                            declaredLength = 0;
+                            for (let i = 0; i < lengthBytes; i++) {
+                                declaredLength = declaredLength * 256 + (lp < peek.length ? peek[lp] : 0);
+                                lp += 1;
+                            }
+                        }
+                        const total = Math.min(lp + declaredLength, available);
+                        //Read the full message (non-dry-run) to set headerLength; then split off the body.
+                        const message = this.readBytes(messageOffset, total > 0 ? total : 0);
+                        const tlv = Kerberos.#readTLV(message, 0);
+                        this.instance.body.setValue((0, BufferToHex_1.BufferToHex)(message.subarray(tlv.contentStart, tlv.next)));
+                    },
+                    encode: function () {
+                        const messageOffset = this.#messageOffset();
+                        let msgType = this.instance.msgType.getValue(0x6a);
+                        if (msgType > 255) {
+                            this.recordError(this.instance.msgType.getPath(), 'Maximum value is 255');
+                            msgType = 255;
+                        }
+                        if (msgType < 0) {
+                            this.recordError(this.instance.msgType.getPath(), 'Minimum value is 0');
+                            msgType = 0;
+                        }
+                        this.instance.msgType.setValue(msgType);
+                        const body = (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue(''));
+                        const message = Buffer.concat([
+                            Buffer.from([msgType]),
+                            Kerberos.#encodeLength(body.length),
+                            body
+                        ]);
+                        this.writeBytes(messageOffset, message);
+                    }
+                },
+                //The message body: everything inside the application tag's BER length, kept verbatim.
+                //Emitted by the msgType closure (colocated so the tag + length + body stay symmetric).
+                body: { type: 'string', label: 'Body', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+            }
+        };
+    }
+    match() {
+        //Kerberos rides UDP/TCP port 88 (selected via the udpport:88 / tcpport:88 buckets). The signature
+        //is port + a Kerberos application tag at the message start, so this stays a port-bucket protocol:
+        //matchKeys only, NO heuristicFallback — an application-class BER tag alone is too weak to claim
+        //Kerberos off port 88, and non-Kerberos traffic on 88 must fall through to raw. Over TCP the tag
+        //sits after the 4-byte record-length prefix; over UDP it is the first byte.
+        if (!this.prevCodecModule)
+            return false;
+        const isTcp = this.prevCodecModule.id === 'tcp';
+        const isUdp = this.prevCodecModule.id === 'udp';
+        if (!isTcp && !isUdp)
+            return false;
+        const messageOffset = isTcp ? 4 : 0;
+        if (this.packet.length - this.startPos < messageOffset + 2)
+            return false;
+        const tag = this.readBytes(messageOffset, 1, true)[0];
+        return KERBEROS_APP_TAGS.has(tag);
+    }
+}
+exports.Kerberos = Kerberos;

package/dist/headers/L2TP.d.ts

@@ -0,0 +1,26 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * L2TP — Layer Two Tunneling Protocol, version 2 (RFC 2661), UDP port 1701. The header begins with a
+ * 2-byte flags/version field: T (0=data / 1=control), L (Length present), S (Ns/Nr present), O (Offset
+ * present), P (Priority), and a 4-bit Version (=2). Depending on the flags the header then carries an
+ * optional Length, the Tunnel ID and Session ID, optional Ns/Nr sequence numbers, and an optional
+ * Offset (size + pad). A control message (T=1) carries a list of AVPs (each: M/H flags + 10-bit length,
+ * Vendor ID, Attribute Type, value); a data message (T=0) carries the tunneled payload, kept as raw hex
+ * (it is a leaf here — the tunneled PPP frame is a stateful conversation for a higher layer).
+ *
+ * A well-formed message round-trips byte-for-byte. The reserved flag bits and AVP reserved bits are
+ * normalized to 0 on re-encode (they MUST be 0 per RFC 2661), and an AVP's length is derived from its
+ * value; both hold for standard-conformant traffic.
+ */
+export declare class L2TP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}