@netkitty/codec 1.0.0

package/dist/headers/L2TP.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.L2TP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * L2TP — Layer Two Tunneling Protocol, version 2 (RFC 2661), UDP port 1701. The header begins with a
+ * 2-byte flags/version field: T (0=data / 1=control), L (Length present), S (Ns/Nr present), O (Offset
+ * present), P (Priority), and a 4-bit Version (=2). Depending on the flags the header then carries an
+ * optional Length, the Tunnel ID and Session ID, optional Ns/Nr sequence numbers, and an optional
+ * Offset (size + pad). A control message (T=1) carries a list of AVPs (each: M/H flags + 10-bit length,
+ * Vendor ID, Attribute Type, value); a data message (T=0) carries the tunneled payload, kept as raw hex
+ * (it is a leaf here — the tunneled PPP frame is a stateful conversation for a higher layer).
+ *
+ * A well-formed message round-trips byte-for-byte. The reserved flag bits and AVP reserved bits are
+ * normalized to 0 on re-encode (they MUST be 0 per RFC 2661), and an AVP's length is derived from its
+ * value; both hold for standard-conformant traffic.
+ */
+class L2TP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'l2tp';
+        this.name = 'Layer Two Tunneling Protocol';
+        this.nickname = 'L2TP';
+        this.matchKeys = ['udpport:1701'];
+        //A leaf header — the tunneled PPP payload / control-plane state belongs to a higher layer.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (L2TP.#schemaCache ??= L2TP.#buildSchema());
+    }
+    /** The payload length bounded by the UDP datagram (so a retained FCS/padding is not absorbed). */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** A single flag bit within the 2-byte flags field (bit 0 = MSB of byte 0). */
+    static #flagBit(name, bitOffset, label) {
+        return {
+            type: 'boolean',
+            label: label,
+            decode: function () {
+                this.instance.flags[name].setValue(!!this.readBits(0, 1, bitOffset, 1));
+            },
+            encode: function () {
+                const value = !!this.instance.flags[name].getValue();
+                this.instance.flags[name].setValue(value);
+                this.writeBits(0, 1, bitOffset, 1, value ? 1 : 0);
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'L2TP ${flags.type} tid=${tunnelId} sid=${sessionId}',
+            properties: {
+                //Flags/version field (byte 0-1, MSB first): T(0) L(1) rsvd(2-3) S(4) rsvd(5) O(6) P(7),
+                //then rsvd(8-11) and Version(12-15). Reserved bits are normalized to 0 on encode.
+                flags: {
+                    type: 'object',
+                    label: 'Flags',
+                    properties: {
+                        type: this.#flagBit('type', 0, 'Type (1=control)'),
+                        length: this.#flagBit('length', 1, 'Length Present'),
+                        sequence: this.#flagBit('sequence', 4, 'Sequence Present'),
+                        offset: this.#flagBit('offset', 6, 'Offset Present'),
+                        priority: this.#flagBit('priority', 7, 'Priority'),
+                        version: {
+                            type: 'integer',
+                            label: 'Version',
+                            minimum: 0,
+                            maximum: 15,
+                            decode: function () { this.instance.flags.version.setValue(this.readBits(1, 1, 4, 4)); },
+                            encode: function () { this.writeBits(1, 1, 4, 4, this.instance.flags.version.getValue(2)); }
+                        },
+                        //Reserved bits (byte0 bits 2-3, byte0 bit 5, byte1 bits 8-11). RFC 2661 requires
+                        //them 0, but they are captured verbatim so any frame round-trips byte-for-byte.
+                        reserved1: {
+                            type: 'integer', label: 'Reserved', minimum: 0, maximum: 3, hidden: true,
+                            decode: function () { this.instance.flags.reserved1.setValue(this.readBits(0, 1, 2, 2)); },
+                            encode: function () { this.writeBits(0, 1, 2, 2, this.instance.flags.reserved1.getValue(0)); }
+                        },
+                        reserved2: {
+                            type: 'integer', label: 'Reserved', minimum: 0, maximum: 1, hidden: true,
+                            decode: function () { this.instance.flags.reserved2.setValue(this.readBits(0, 1, 5, 1)); },
+                            encode: function () { this.writeBits(0, 1, 5, 1, this.instance.flags.reserved2.getValue(0)); }
+                        },
+                        reserved3: {
+                            type: 'integer', label: 'Reserved', minimum: 0, maximum: 15, hidden: true,
+                            decode: function () { this.instance.flags.reserved3.setValue(this.readBits(1, 1, 0, 4)); },
+                            encode: function () { this.writeBits(1, 1, 0, 4, this.instance.flags.reserved3.getValue(0)); }
+                        }
+                    }
+                },
+                length: { type: 'integer', label: 'Length', minimum: 0, maximum: 65535 },
+                tunnelId: { type: 'integer', label: 'Tunnel ID', minimum: 0, maximum: 65535 },
+                sessionId: { type: 'integer', label: 'Session ID', minimum: 0, maximum: 65535 },
+                ns: { type: 'integer', label: 'Ns', minimum: 0, maximum: 65535 },
+                nr: { type: 'integer', label: 'Nr', minimum: 0, maximum: 65535 },
+                offsetSize: { type: 'integer', label: 'Offset Size', minimum: 0, maximum: 65535 },
+                offsetPad: { type: 'string', label: 'Offset Pad', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true },
+                avps: {
+                    type: 'array',
+                    label: 'AVPs',
+                    items: {
+                        type: 'object',
+                        label: 'AVP',
+                        properties: {
+                            mandatory: { type: 'boolean', label: 'Mandatory' },
+                            hidden: { type: 'boolean', label: 'Hidden' },
+                            reserved: { type: 'integer', label: 'Reserved', minimum: 0, maximum: 15, hidden: true },
+                            vendorId: { type: 'integer', label: 'Vendor ID', minimum: 0, maximum: 65535 },
+                            attrType: { type: 'integer', label: 'Attribute Type', minimum: 0, maximum: 65535 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    }
+                },
+                payload: { type: 'string', label: 'Payload', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true },
+                //Master field: the header layout is flag-conditional, so the whole message after the flags
+                //is parsed/emitted here into the sibling fields above. Runs after `flags` (property order).
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    hidden: true,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        const hasLength = !!this.instance.flags.length.getValue();
+                        const hasSeq = !!this.instance.flags.sequence.getValue();
+                        const hasOffset = !!this.instance.flags.offset.getValue();
+                        const isControl = !!this.instance.flags.type.getValue();
+                        let offset = 2;
+                        let msgEnd = available;
+                        if (hasLength && offset + 2 <= available) {
+                            const length = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2));
+                            this.instance.length.setValue(length);
+                            offset += 2;
+                            //L2TP Length counts the whole message from the flags byte; bound the AVP walk.
+                            if (length >= 6 && length <= available)
+                                msgEnd = length;
+                        }
+                        if (offset + 2 <= available) {
+                            this.instance.tunnelId.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2)));
+                            offset += 2;
+                        }
+                        if (offset + 2 <= available) {
+                            this.instance.sessionId.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2)));
+                            offset += 2;
+                        }
+                        if (hasSeq) {
+                            if (offset + 2 <= available) {
+                                this.instance.ns.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2)));
+                                offset += 2;
+                            }
+                            if (offset + 2 <= available) {
+                                this.instance.nr.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2)));
+                                offset += 2;
+                            }
+                        }
+                        if (hasOffset && offset + 2 <= available) {
+                            const offsetSize = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2));
+                            this.instance.offsetSize.setValue(offsetSize);
+                            offset += 2;
+                            const padLen = offset + offsetSize <= available ? offsetSize : available - offset;
+                            this.instance.offsetPad.setValue(padLen > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, padLen)) : '');
+                            offset += padLen > 0 ? padLen : 0;
+                        }
+                        if (isControl) {
+                            //Control message: a list of AVPs up to the message end.
+                            const avps = [];
+                            while (offset + 6 <= msgEnd) {
+                                const avpFlags = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2));
+                                const avpLen = avpFlags & 0x03ff;
+                                if (avpLen < 6 || offset + avpLen > msgEnd)
+                                    break;
+                                avps.push({
+                                    mandatory: !!(avpFlags & 0x8000),
+                                    hidden: !!(avpFlags & 0x4000),
+                                    reserved: (avpFlags >> 10) & 0x0f,
+                                    vendorId: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 2, 2)),
+                                    attrType: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 4, 2)),
+                                    value: avpLen > 6 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 6, avpLen - 6)) : ''
+                                });
+                                offset += avpLen;
+                            }
+                            this.instance.avps.setValue(avps);
+                            //Any bytes the AVP walk could not consume (malformed) are kept verbatim.
+                            this.instance.payload.setValue(offset < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, available - offset)) : '');
+                        }
+                        else {
+                            //Data message: the tunneled payload, kept as raw hex.
+                            this.instance.payload.setValue(offset < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, available - offset)) : '');
+                        }
+                    },
+                    encode: function () {
+                        const hasLength = !!this.instance.flags.length.getValue();
+                        const hasSeq = !!this.instance.flags.sequence.getValue();
+                        const hasOffset = !!this.instance.flags.offset.getValue();
+                        const isControl = !!this.instance.flags.type.getValue();
+                        let offset = 2;
+                        let lengthOffset = -1;
+                        if (hasLength) {
+                            lengthOffset = offset;
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.length.getValue(0)));
+                            offset += 2;
+                        }
+                        this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.tunnelId.getValue(0)));
+                        offset += 2;
+                        this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.sessionId.getValue(0)));
+                        offset += 2;
+                        if (hasSeq) {
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.ns.getValue(0)));
+                            offset += 2;
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.nr.getValue(0)));
+                            offset += 2;
+                        }
+                        if (hasOffset) {
+                            const offsetPad = (0, HexToBuffer_1.HexToBuffer)(this.instance.offsetPad.getValue(''));
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.offsetSize.getValue(offsetPad.length)));
+                            offset += 2;
+                            if (offsetPad.length) {
+                                this.writeBytes(offset, offsetPad);
+                                offset += offsetPad.length;
+                            }
+                        }
+                        if (isControl) {
+                            const avps = this.instance.avps.getValue([]);
+                            if (avps)
+                                for (let i = 0; i < avps.length; i++) {
+                                    const avp = avps[i];
+                                    const value = (0, HexToBuffer_1.HexToBuffer)(avp.value ? avp.value : '');
+                                    const avpLen = 6 + value.length;
+                                    //The AVP length is a 10-bit field, so a value > 1017 bytes cannot be
+                                    //represented — record it rather than silently truncating the length.
+                                    if (avpLen > 0x03ff)
+                                        this.recordError(this.instance.avps.getPath() + `[${i}].value`, 'AVP too long for the 10-bit length field');
+                                    const reserved = (avp.reserved ? avp.reserved : 0) & 0x0f;
+                                    const avpFlags = (avp.mandatory ? 0x8000 : 0) | (avp.hidden ? 0x4000 : 0) | (reserved << 10) | (avpLen & 0x03ff);
+                                    this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(avpFlags));
+                                    offset += 2;
+                                    this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(avp.vendorId ? avp.vendorId : 0));
+                                    offset += 2;
+                                    this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(avp.attrType ? avp.attrType : 0));
+                                    offset += 2;
+                                    if (value.length) {
+                                        this.writeBytes(offset, value);
+                                        offset += value.length;
+                                    }
+                                }
+                        }
+                        const payload = (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue(''));
+                        if (payload.length) {
+                            this.writeBytes(offset, payload);
+                            offset += payload.length;
+                        }
+                        //Fill in the L2TP Length (whole message from the flags byte) if it was not set.
+                        if (hasLength && lengthOffset >= 0 && (this.instance.length.getValue() === undefined || this.instance.length.getValue() === null)) {
+                            const lengthPos = lengthOffset;
+                            this.addPostPacketEncodeHandler(() => {
+                                let started = false;
+                                let total = 0;
+                                this.codecModules.forEach((codecModule) => {
+                                    if (codecModule === this)
+                                        started = true;
+                                    if (started)
+                                        total += codecModule.length;
+                                });
+                                this.instance.length.setValue(total);
+                                this.writeBytes(lengthPos, (0, NumberToBuffer_1.UInt16ToBuffer)(total));
+                            }, 1);
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Require the minimum data-message header (flags + tunnel + session = 6 bytes) within the UDP
+        //payload, and version 2 (RFC 2661) — L2TPv3 has a different structure and falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#payloadLength() < 6)
+            return false;
+        return (this.readBytes(1, 1, true)[0] & 0x0f) === 2;
+    }
+}
+exports.L2TP = L2TP;

package/dist/headers/LACP.d.ts

@@ -0,0 +1,31 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * LACP — Link Aggregation Control Protocol (IEEE 802.3ad / 802.1AX), one of the Slow Protocols carried
+ * directly in an Ethernet II frame with EtherType 0x8809 (an Ethernet child — no IP/UDP). Byte 0 is the
+ * Slow-Protocols Subtype (1 = LACP; 2 = Marker, which this header does not claim) and byte 1 is the
+ * Version. What follows is a flat sequence of TLVs — each a 1-byte Type + 1-byte Length (the Length
+ * counts the 2 header octets, so the value is Length-2 bytes) + value bytes: Actor Information (type
+ * 0x01, len 0x14), Partner Information (0x02, 0x14), Collector Information (0x03, 0x10), then the
+ * Terminator (type 0x00, len 0x00). After the Terminator the LACPDU is padded with reserved octets to
+ * fill the fixed 110-byte PDU (the frame's minimum data field). LACP has no length field of its own — it
+ * runs to the end of the frame.
+ *
+ * TLVs are carried generically (type + on-wire length + verbatim hex value) so every TLV round-trips
+ * byte-for-byte; per-TLV semantic decoding (Actor/Partner system, state bits, …) is a later enrichment.
+ * The Length is honored verbatim on encode when supplied (a crafted PDU may lie), else derived from the
+ * value (2 + value bytes; 0 for the Terminator). The walk stops at the Terminator (type 0) or when the
+ * frame is exhausted; any bytes after the Terminator are the reserved padding, kept verbatim in
+ * `reserved` so the frame is reproduced exactly.
+ */
+export declare class LACP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/LACP.js

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LACP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * LACP — Link Aggregation Control Protocol (IEEE 802.3ad / 802.1AX), one of the Slow Protocols carried
+ * directly in an Ethernet II frame with EtherType 0x8809 (an Ethernet child — no IP/UDP). Byte 0 is the
+ * Slow-Protocols Subtype (1 = LACP; 2 = Marker, which this header does not claim) and byte 1 is the
+ * Version. What follows is a flat sequence of TLVs — each a 1-byte Type + 1-byte Length (the Length
+ * counts the 2 header octets, so the value is Length-2 bytes) + value bytes: Actor Information (type
+ * 0x01, len 0x14), Partner Information (0x02, 0x14), Collector Information (0x03, 0x10), then the
+ * Terminator (type 0x00, len 0x00). After the Terminator the LACPDU is padded with reserved octets to
+ * fill the fixed 110-byte PDU (the frame's minimum data field). LACP has no length field of its own — it
+ * runs to the end of the frame.
+ *
+ * TLVs are carried generically (type + on-wire length + verbatim hex value) so every TLV round-trips
+ * byte-for-byte; per-TLV semantic decoding (Actor/Partner system, state bits, …) is a later enrichment.
+ * The Length is honored verbatim on encode when supplied (a crafted PDU may lie), else derived from the
+ * value (2 + value bytes; 0 for the Terminator). The walk stops at the Terminator (type 0) or when the
+ * frame is exhausted; any bytes after the Terminator are the reserved padding, kept verbatim in
+ * `reserved` so the frame is reproduced exactly.
+ */
+class LACP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'lacp';
+        this.name = 'Link Aggregation Control Protocol';
+        this.nickname = 'LACP';
+        this.matchKeys = ['ethertype:8809'];
+        //A leaf header — nothing demuxes above LACP.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (LACP.#schemaCache ??= LACP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'LACP v${version} ${tlvs.length} TLVs',
+            properties: {
+                subtype: this.fieldUInt('subtype', 0, 1, 'Subtype'),
+                version: this.fieldUInt('version', 1, 1, 'Version'),
+                tlvs: {
+                    type: 'array',
+                    label: 'TLVs',
+                    items: {
+                        type: 'object',
+                        label: 'TLV',
+                        properties: {
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 255 },
+                            length: { type: 'integer', label: 'Length', minimum: 0, maximum: 255 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        //LACP runs to the end of the frame — there is no length field. Bound the walk by the
+                        //remaining frame bytes. Each TLV is Type(1) + Length(1) + (Length-2) value bytes; the
+                        //on-wire Length counts the 2 header octets (the Terminator is the exception: Length 0).
+                        const available = this.packet.length - this.startPos;
+                        const tlvs = [];
+                        let offset = 2;
+                        while (offset + 2 <= available) {
+                            const type = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset, 1));
+                            const length = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 1, 1));
+                            //Terminator (type 0): logical end of the PDU — anything after is reserved padding.
+                            if (type === 0) {
+                                tlvs.push({ type: type, length: length, value: '' });
+                                offset += 2;
+                                break;
+                            }
+                            //Value byte count = Length - 2 (Length includes the 2 header octets). A malformed
+                            //Length < 2 yields no value; a value that overruns the frame (truncation) is not
+                            //consumed — stop and leave the remaining bytes to `reserved`, keeping round-trip exact.
+                            const valueLength = length > 2 ? length - 2 : 0;
+                            if (offset + 2 + valueLength > available)
+                                break;
+                            const value = valueLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 2, valueLength)) : '';
+                            tlvs.push({ type: type, length: length, value: value });
+                            offset += 2 + valueLength;
+                        }
+                        this.instance.tlvs.setValue(tlvs);
+                        //Trailing bytes after the Terminator (or after a truncated TLV) are the reserved padding.
+                        this.instance.reserved.setValue(offset < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, available - offset)) : '');
+                    },
+                    encode: function () {
+                        const tlvs = this.instance.tlvs.getValue([]);
+                        let offset = 2;
+                        if (tlvs) {
+                            for (let i = 0; i < tlvs.length; i++) {
+                                const tlv = tlvs[i];
+                                const type = tlv.type ? tlv.type : 0;
+                                const value = (0, HexToBuffer_1.HexToBuffer)(tlv.value ? tlv.value : '');
+                                //Length is honored verbatim when supplied (a crafted PDU may lie), else derived:
+                                //value bytes + the 2 header octets (0 for the Terminator, which carries no value).
+                                let length = (tlv.length !== undefined && tlv.length !== null)
+                                    ? tlv.length
+                                    : (type === 0 ? 0 : value.length + 2);
+                                if (length > 255) {
+                                    this.recordError(`tlvs[${i}].length`, 'Maximum value is 255');
+                                    length = 255;
+                                }
+                                if (length < 0) {
+                                    this.recordError(`tlvs[${i}].length`, 'Minimum value is 0');
+                                    length = 0;
+                                }
+                                this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(type & 0xff));
+                                this.writeBytes(offset + 1, (0, NumberToBuffer_1.UInt8ToBuffer)(length));
+                                offset += 2;
+                                if (value.length) {
+                                    this.writeBytes(offset, value);
+                                    offset += value.length;
+                                }
+                            }
+                        }
+                        const reserved = this.instance.reserved.getValue('');
+                        if (reserved)
+                            this.writeBytes(offset, (0, HexToBuffer_1.HexToBuffer)(reserved));
+                    }
+                },
+                //Reserved padding after the Terminator TLV, kept verbatim. No codec of its own — it is
+                //set/read by the `tlvs` field (which owns the single offset walk); this entry is metadata
+                //so the editor sees the padding bytes.
+                reserved: {
+                    type: 'string',
+                    label: 'Reserved',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    hidden: true
+                }
+            }
+        };
+    }
+    match() {
+        //An Ethernet child selected by EtherType 0x8809 (Slow Protocols, stored as a lowercase 4-hex
+        //string). Only Subtype 1 (LACP) is claimed — Subtype 2 (Marker) and others fall through. Require
+        //at least the 2-byte Subtype + Version so the subtype probe is in-bounds.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'eth')
+            return false;
+        if (this.prevCodecModule.instance.etherType.getValue() !== '8809')
+            return false;
+        if (this.packet.length - this.startPos < 2)
+            return false;
+        return (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1, true)) === 1;
+    }
+}
+exports.LACP = LACP;

package/dist/headers/LDAP.d.ts

@@ -0,0 +1,31 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * LDAP — Lightweight Directory Access Protocol (RFC 4511), over TCP port 389. Each LDAPMessage is a
+ * BER-encoded ASN.1 SEQUENCE: SEQUENCE { messageID INTEGER, protocolOp CHOICE [, controls] }, where
+ * protocolOp is a context/application-tagged element identifying the operation — 0x60 bindRequest,
+ * 0x61 bindResponse, 0x63 searchRequest, 0x64 searchResultEntry, 0x65 searchResultDone,
+ * 0x42 unbindRequest, and so on.
+ *
+ * Minimal slice (byte-perfect): the outer SEQUENCE and its length are decoded, the messageID INTEGER is
+ * decoded as a signed integer, and the protocolOp is split into its TAG (one byte, e.g. 0x60) plus its
+ * BODY — the protocolOp length/content and any trailing controls — kept verbatim as `protocolOpData`
+ * hex. Re-encode rebuilds the SEQUENCE with minimal-definite lengths, re-emits the messageID with
+ * minimal two's-complement BER, and appends the protocolOp tag + verbatim body. So any operation
+ * round-trips exactly without a per-op encoder. Full BER structuring of each operation (bind DN/auth,
+ * search filter/attributes, result codes …) is a later, separate slice.
+ *
+ * Non-minimal BER lengths (long-form where short-form would do) regularize to minimal form on re-encode,
+ * exactly like SNMP — standard LDAP servers emit minimal lengths, so real traffic is byte-perfect.
+ */
+export declare class LDAP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}