@netkitty/codec 1.0.0

package/dist/headers/LDAP.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LDAP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * LDAP — Lightweight Directory Access Protocol (RFC 4511), over TCP port 389. Each LDAPMessage is a
+ * BER-encoded ASN.1 SEQUENCE: SEQUENCE { messageID INTEGER, protocolOp CHOICE [, controls] }, where
+ * protocolOp is a context/application-tagged element identifying the operation — 0x60 bindRequest,
+ * 0x61 bindResponse, 0x63 searchRequest, 0x64 searchResultEntry, 0x65 searchResultDone,
+ * 0x42 unbindRequest, and so on.
+ *
+ * Minimal slice (byte-perfect): the outer SEQUENCE and its length are decoded, the messageID INTEGER is
+ * decoded as a signed integer, and the protocolOp is split into its TAG (one byte, e.g. 0x60) plus its
+ * BODY — the protocolOp length/content and any trailing controls — kept verbatim as `protocolOpData`
+ * hex. Re-encode rebuilds the SEQUENCE with minimal-definite lengths, re-emits the messageID with
+ * minimal two's-complement BER, and appends the protocolOp tag + verbatim body. So any operation
+ * round-trips exactly without a per-op encoder. Full BER structuring of each operation (bind DN/auth,
+ * search filter/attributes, result codes …) is a later, separate slice.
+ *
+ * Non-minimal BER lengths (long-form where short-form would do) regularize to minimal form on re-encode,
+ * exactly like SNMP — standard LDAP servers emit minimal lengths, so real traffic is byte-perfect.
+ */
+class LDAP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ldap';
+        this.name = 'LDAP';
+        this.nickname = 'LDAP';
+        //Directory service on TCP port 389. A BER SEQUENCE opening a message has only a weak content
+        //signature (tag 0x30 + a plausible definite length, then an INTEGER messageID), so this is
+        //port-defined: no heuristicFallback — the port + 0x30 signature is not distinctive enough to claim
+        //arbitrary TCP segments, so LDAP is only tried on its well-known port.
+        this.matchKeys = ['tcpport:389'];
+        //A leaf header — nothing demuxes above LDAP in this minimal slice.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (LDAP.#schemaCache ??= LDAP.#buildSchema());
+    }
+    // ===== Minimal BER/DER codec (definite length only) — mirrors SNMP.ts =====
+    /** Read one TLV at `pos`; defensive against truncation (always advances, clamps to buffer). */
+    static #readTLV(buf, pos) {
+        if (pos >= buf.length)
+            return { tag: 0, contentStart: pos, contentLen: 0, next: pos + 1 };
+        const tag = buf[pos];
+        let p = pos + 1;
+        let len = p < buf.length ? buf[p] : 0;
+        p += 1;
+        if (len & 0x80) {
+            const lengthBytes = len & 0x7f;
+            len = 0;
+            for (let i = 0; i < lengthBytes; i++) {
+                len = len * 256 + (p < buf.length ? buf[p] : 0);
+                p += 1;
+            }
+        }
+        const contentStart = p;
+        //Clamp the content to what is actually present so a lying length cannot read out of bounds.
+        const contentLen = Math.min(len, Math.max(0, buf.length - contentStart));
+        return { tag: tag, contentStart: contentStart, contentLen: contentLen, next: contentStart + contentLen };
+    }
+    /** Decode a BER INTEGER content (big-endian two's-complement, signed). */
+    static #berInt(buf) {
+        if (buf.length === 0)
+            return 0;
+        let value = 0;
+        for (const byte of buf)
+            value = value * 256 + byte;
+        if (buf[0] & 0x80)
+            value -= Math.pow(2, 8 * buf.length);
+        return value;
+    }
+    /** Encode a signed integer as minimal BER INTEGER content bytes. */
+    static #intToBer(value) {
+        const bytes = [];
+        let v = Math.trunc(value);
+        if (v >= 0) {
+            do {
+                bytes.unshift(v & 0xff);
+                v = Math.floor(v / 256);
+            } while (v > 0);
+            if (bytes[0] & 0x80)
+                bytes.unshift(0);
+        }
+        else {
+            do {
+                bytes.unshift(v & 0xff);
+                v = Math.floor(v / 256);
+            } while (v < -1);
+            if (!(bytes[0] & 0x80))
+                bytes.unshift(0xff);
+        }
+        return Buffer.from(bytes);
+    }
+    /** Encode a definite length in minimal form (short form < 128, else long form). */
+    static #encodeLength(length) {
+        if (length < 0x80)
+            return Buffer.from([length]);
+        const bytes = [];
+        let v = length;
+        while (v > 0) {
+            bytes.unshift(v & 0xff);
+            v = Math.floor(v / 256);
+        }
+        return Buffer.from([0x80 | bytes.length, ...bytes]);
+    }
+    /** Build a complete TLV: tag + minimal length + content. */
+    static #tlv(tag, content) {
+        return Buffer.concat([Buffer.from([tag]), this.#encodeLength(content.length), content]);
+    }
+    /**
+     * Peek the outer SEQUENCE header from a short prefix and return the whole-message length
+     * (header bytes + declared content). The length field is read UNCLAMPED (the peek is only long
+     * enough for the header, so #readTLV's content clamp would wrongly cap the total). Returns 0 when
+     * the prefix does not open a well-formed SEQUENCE header.
+     */
+    static #outerMessageLength(peek) {
+        if (peek.length < 2 || peek[0] !== 0x30)
+            return 0;
+        let hp = 1;
+        let declaredLength = peek[hp];
+        hp += 1;
+        if (declaredLength & 0x80) {
+            const lengthBytes = declaredLength & 0x7f;
+            if (lengthBytes < 1 || lengthBytes > 4)
+                return 0;
+            declaredLength = 0;
+            for (let i = 0; i < lengthBytes; i++) {
+                declaredLength = declaredLength * 256 + (hp < peek.length ? peek[hp] : 0);
+                hp += 1;
+            }
+        }
+        return hp + declaredLength;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'LDAP op=${protocolOpTag}',
+            properties: {
+                //LDAP is one nested BER blob, so the whole message is parsed here (and emitted in the
+                //matching encode) rather than field-by-field at fixed offsets. The remaining properties
+                //below carry only schema/label/validation metadata; they have no closures of their own.
+                messageID: {
+                    type: 'integer',
+                    //A real LDAP messageID is 0..maxInt, but the on-wire field is a signed BER INTEGER, so a
+                    //malformed frame can carry a negative value. The bounds match the signed 32-bit range the
+                    //#berInt/#intToBer helpers support, so decode of a malformed negative messageID re-encodes
+                    //faithfully instead of tripping the encode-entry Ajv gate (keeping decode→encode total).
+                    minimum: -2147483648,
+                    maximum: 2147483647,
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        if (available <= 0)
+                            return;
+                        //Peek the outer SEQUENCE header to learn the whole-message length, then read the
+                        //whole message (non-dry-run) so headerLength/endPos cover exactly the BER message.
+                        const peek = this.readBytes(0, available < 8 ? available : 8, true);
+                        const declaredTotal = LDAP.#outerMessageLength(peek);
+                        const total = Math.min(declaredTotal > 0 ? declaredTotal : available, available);
+                        const buf = this.readBytes(0, total > 0 ? total : 0);
+                        const message = LDAP.#readTLV(buf, 0);
+                        let p = message.contentStart;
+                        const messageIdTLV = LDAP.#readTLV(buf, p);
+                        this.instance.messageID.setValue(LDAP.#berInt(buf.subarray(messageIdTLV.contentStart, messageIdTLV.next)));
+                        p = messageIdTLV.next;
+                        //protocolOp: its TAG is one byte (e.g. 0x60 bindRequest); its BODY — the op's own
+                        //length/content plus any trailing controls, all the way to the end of the outer
+                        //SEQUENCE — is kept verbatim so any operation round-trips without a per-op encoder.
+                        if (p >= message.next)
+                            return;
+                        this.instance.protocolOpTag.setValue(buf[p]);
+                        this.instance.protocolOpData.setValue(buf.subarray(p + 1, message.next).toString('hex'));
+                    },
+                    encode: function () {
+                        const messageID = this.instance.messageID.getValue(0);
+                        const protocolOpTag = this.instance.protocolOpTag.getValue(0x60);
+                        const protocolOpData = this.instance.protocolOpData.getValue('');
+                        const protocolOp = Buffer.concat([
+                            Buffer.from([protocolOpTag & 0xff]),
+                            Buffer.from(protocolOpData, 'hex')
+                        ]);
+                        const message = LDAP.#tlv(0x30, Buffer.concat([
+                            LDAP.#tlv(0x02, LDAP.#intToBer(messageID)),
+                            protocolOp
+                        ]));
+                        this.writeBytes(0, message);
+                    }
+                },
+                //The protocolOp CHOICE tag: 0x60 bindRequest, 0x61 bindResponse, 0x63 searchRequest,
+                //0x64 searchResultEntry, 0x65 searchResultDone, 0x66 modifyRequest, 0x67 modifyResponse,
+                //0x68 addRequest, 0x69 addResponse, 0x4a delRequest, 0x42 unbindRequest, 0x73 extendedReq …
+                protocolOpTag: { type: 'integer', label: 'Protocol Op Tag', minimum: 0, maximum: 255 },
+                //The protocolOp body (op length/content + any controls) kept verbatim as hex — see decode.
+                protocolOpData: { type: 'string', label: 'Protocol Op Data', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+            }
+        };
+    }
+    match() {
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        const available = this.packet.length - this.startPos;
+        if (available < 2)
+            return false;
+        const peek = this.readBytes(0, available < 8 ? available : 8, true);
+        //Must open with a BER SEQUENCE (0x30) whose definite length is well-formed and plausible.
+        if (peek[0] !== 0x30)
+            return false;
+        const declaredTotal = LDAP.#outerMessageLength(peek);
+        if (declaredTotal <= 0)
+            return false;
+        //Locate the byte after the outer length; for a real LDAPMessage it is the messageID INTEGER
+        //tag (0x02). This strengthens the otherwise-weak port+0x30 signature and rejects non-LDAP
+        //SEQUENCE-like traffic on 389.
+        let hp = 1;
+        const lenByte = peek[1];
+        hp += 1;
+        if (lenByte & 0x80)
+            hp += (lenByte & 0x7f);
+        if (hp < peek.length && peek[hp] !== 0x02)
+            return false;
+        return true;
+    }
+}
+exports.LDAP = LDAP;

package/dist/headers/LDP.d.ts

@@ -0,0 +1,31 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * LDP — Label Distribution Protocol (RFC 5036, MPLS label distribution), UDP + TCP port 646. UDP/646
+ * carries the Hello discovery messages (multicast to 224.0.0.2); TCP/646 carries the session (LSP
+ * establishment, label mappings). Every LDP PDU begins with a fixed 10-byte common header — a 2-byte
+ * Version (== 1), a 2-byte PDU Length, a 4-byte LSR ID (the label switch router's identifier, an IPv4
+ * address), and a 2-byte Label Space id — followed by one or more messages. The PDU Length counts every
+ * octet after the Version and PDU Length fields (i.e. LSR ID + Label Space + the messages).
+ *
+ * Each message is a 1-bit U (unknown) flag + a 15-bit Message Type (0x0100 Hello, 0x0200 Initialization,
+ * 0x0400 Label Mapping, …), a 2-byte Message Length, a 4-byte Message Id, and the message's parameter
+ * TLVs. The per-message and per-TLV layout is type-dependent, so this codec keeps the common header
+ * structured and the messages verbatim as `messages` hex (byte-perfect), bounded by the PDU Length (the
+ * PDU ends at offset 4 + PDU Length) and by the transport payload (UDP length − 8), so a second pipelined
+ * PDU or trailing bytes are left to the codec's recursion / RawData. The PDU Length is auto-computed from
+ * the LSR ID + Label Space + messages on encode when not supplied, else honored verbatim (a crafted PDU
+ * may lie). A well-formed PDU round-trips byte-for-byte; per-message / per-TLV decoding is a later
+ * enrichment.
+ */
+export declare class LDP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/LDP.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LDP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * LDP — Label Distribution Protocol (RFC 5036, MPLS label distribution), UDP + TCP port 646. UDP/646
+ * carries the Hello discovery messages (multicast to 224.0.0.2); TCP/646 carries the session (LSP
+ * establishment, label mappings). Every LDP PDU begins with a fixed 10-byte common header — a 2-byte
+ * Version (== 1), a 2-byte PDU Length, a 4-byte LSR ID (the label switch router's identifier, an IPv4
+ * address), and a 2-byte Label Space id — followed by one or more messages. The PDU Length counts every
+ * octet after the Version and PDU Length fields (i.e. LSR ID + Label Space + the messages).
+ *
+ * Each message is a 1-bit U (unknown) flag + a 15-bit Message Type (0x0100 Hello, 0x0200 Initialization,
+ * 0x0400 Label Mapping, …), a 2-byte Message Length, a 4-byte Message Id, and the message's parameter
+ * TLVs. The per-message and per-TLV layout is type-dependent, so this codec keeps the common header
+ * structured and the messages verbatim as `messages` hex (byte-perfect), bounded by the PDU Length (the
+ * PDU ends at offset 4 + PDU Length) and by the transport payload (UDP length − 8), so a second pipelined
+ * PDU or trailing bytes are left to the codec's recursion / RawData. The PDU Length is auto-computed from
+ * the LSR ID + Label Space + messages on encode when not supplied, else honored verbatim (a crafted PDU
+ * may lie). A well-formed PDU round-trips byte-for-byte; per-message / per-TLV decoding is a later
+ * enrichment.
+ */
+class LDP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ldp';
+        this.name = 'Label Distribution Protocol';
+        this.nickname = 'LDP';
+        //LDP discovery (Hello) over UDP 646, session over TCP 646.
+        this.matchKeys = ['tcpport:646', 'udpport:646'];
+        //A leaf header — per-message / per-TLV parsing is kept verbatim for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (LDP.#schemaCache ??= LDP.#buildSchema());
+    }
+    /**
+     * Header-relative end offset of the bytes this LDP layer may read, bounded by the transport payload so
+     * a lying PDU Length never reads past the real payload into a trailing FCS. Over UDP the bound is
+     * (udp.length − 8); over TCP (a session byte stream with no per-PDU record prefix) it is the captured
+     * remainder. The PDU Length further bounds the consumed span inside this window (see the messages
+     * field), leaving trailing / pipelined PDUs to the codec's recursion.
+     */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < end)
+                end = udpLength - 8;
+        }
+        return end < 0 ? 0 : end;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'LDP lsr=${lsrId}:${labelSpace}',
+            properties: {
+                //Version of the LDP protocol; RFC 5036 defines version 1.
+                version: this.fieldUInt('version', 0, 2, 'Version'),
+                pduLength: {
+                    type: 'integer',
+                    label: 'PDU Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.pduLength.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //PDU Length counts every octet after the Version + PDU Length fields = LSR ID(4) +
+                        //Label Space(2) + messages. Honored when supplied (a crafted PDU may lie); else
+                        //derived from the messages hex (like BGP's Length).
+                        const provided = this.instance.pduLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 6 + (0, HexToBuffer_1.HexToBuffer)(this.instance.messages.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.pduLength.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.pduLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.pduLength.setValue(value);
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //The LSR (Label Switch Router) identifier — a 4-byte value carried as an IPv4 address.
+                lsrId: this.fieldIPv4('lsrId', 4, 'LSR ID'),
+                //The Label Space id: 0 means the platform-wide (per-router) label space; non-zero names a
+                //per-interface label space.
+                labelSpace: this.fieldUInt('labelSpace', 8, 2, 'Label Space'),
+                //The messages after the 10-byte common header, kept verbatim. Bounded by the PDU Length
+                //(the PDU ends at offset 4 + PDU Length) and by the transport payload, so a second pipelined
+                //PDU or trailing bytes are left to the codec's recursion / RawData.
+                messages: {
+                    type: 'string',
+                    label: 'Messages',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const payloadEnd = this.#payloadEnd();
+                        const pduLength = this.instance.pduLength.getValue(0);
+                        let end = 4 + pduLength;
+                        if (end > payloadEnd)
+                            end = payloadEnd;
+                        this.instance.messages.setValue(end > 10 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(10, end - 10)) : '');
+                    },
+                    encode: function () {
+                        const messages = this.instance.messages.getValue('');
+                        if (messages)
+                            this.writeBytes(10, (0, HexToBuffer_1.HexToBuffer)(messages));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //LDP rides UDP/TCP port 646 (selected via the udpport:646 / tcpport:646 buckets). This stays a
+        //port-bucket protocol: matchKeys only, NO heuristicFallback — a 2-byte Version of 1 alone is too
+        //weak to claim LDP off port 646, and non-LDP traffic on 646 must fall through to raw. Require the
+        //full 10-byte common header within the transport payload and Version == 1.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'udp' && this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadEnd() < 10)
+            return false;
+        return (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(0, 2, true)) === 1;
+    }
+}
+exports.LDP = LDP;

package/dist/headers/LISP.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * LISP — Locator/ID Separation Protocol control plane (RFC 6830), UDP port 4342. Every LISP control
+ * message begins with a 4-bit Type in the high nibble of the first octet (1 Map-Request, 2 Map-Reply,
+ * 3 Map-Register, 4 Map-Notify, 8 Encapsulated Control Message), followed by a type-specific body of
+ * flags, a Nonce, and AFI-tagged EID/RLOC records.
+ *
+ * The per-type body layout (Map-Request's Source-EID + ITR-RLOC list + record EID-prefixes,
+ * Map-Reply/Register's locator records, the ECM's inner LISP-encapsulated control packet) is
+ * self-delimited by AFI-tagged, count-driven sub-structures with no single length field, so this
+ * minimal codec keeps the whole message verbatim as `message` hex (byte-perfect) and only surfaces the
+ * Type nibble for display. The message is bounded by the UDP payload (it runs to the end of the
+ * datagram); `message` is authoritative on encode (re-emitting every byte, including the Type nibble),
+ * so a well-formed message round-trips byte-for-byte.
+ *
+ * The data plane (UDP 4341) whose payload is an inner IP packet is intentionally NOT handled here — it
+ * would require the IP headers to match inside a LISP tunnel; left to a later enrichment.
+ */
+export declare class LISP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/LISP.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LISP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * LISP — Locator/ID Separation Protocol control plane (RFC 6830), UDP port 4342. Every LISP control
+ * message begins with a 4-bit Type in the high nibble of the first octet (1 Map-Request, 2 Map-Reply,
+ * 3 Map-Register, 4 Map-Notify, 8 Encapsulated Control Message), followed by a type-specific body of
+ * flags, a Nonce, and AFI-tagged EID/RLOC records.
+ *
+ * The per-type body layout (Map-Request's Source-EID + ITR-RLOC list + record EID-prefixes,
+ * Map-Reply/Register's locator records, the ECM's inner LISP-encapsulated control packet) is
+ * self-delimited by AFI-tagged, count-driven sub-structures with no single length field, so this
+ * minimal codec keeps the whole message verbatim as `message` hex (byte-perfect) and only surfaces the
+ * Type nibble for display. The message is bounded by the UDP payload (it runs to the end of the
+ * datagram); `message` is authoritative on encode (re-emitting every byte, including the Type nibble),
+ * so a well-formed message round-trips byte-for-byte.
+ *
+ * The data plane (UDP 4341) whose payload is an inner IP packet is intentionally NOT handled here — it
+ * would require the IP headers to match inside a LISP tunnel; left to a later enrichment.
+ */
+class LISP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'lisp';
+        this.name = 'Locator/ID Separation Protocol';
+        this.nickname = 'LISP';
+        this.matchKeys = ['udpport:4342'];
+        //A leaf header — the per-type, AFI/count-driven body requires cross-record context to sub-decode.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (LISP.#schemaCache ??= LISP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'LISP type=${type}',
+            properties: {
+                //Type: the high 4 bits of the first octet (RFC 6830 §5.3). 1 Map-Request, 2 Map-Reply,
+                //3 Map-Register, 4 Map-Notify, 8 Encapsulated Control Message — kept as a plain 4-bit
+                //integer (no enum: an unknown/out-of-spec type is still a legal decode and must
+                //re-encode). Display only: `message` re-emits the whole octet, so this write is
+                //overwritten by `message` when present; it lets a Type-only crafted message still emit.
+                type: {
+                    type: 'integer',
+                    label: 'Type',
+                    minimum: 0,
+                    maximum: 15,
+                    decode: function () {
+                        this.instance.type.setValue(this.readBits(0, 1, 0, 4));
+                    },
+                    encode: function () {
+                        const node = this.instance.type;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 15) {
+                            this.recordError(node.getPath(), 'Maximum value is 15');
+                            value = 15;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBits(0, 1, 0, 4, value);
+                    }
+                },
+                //The whole control message kept verbatim (Type nibble included), bounded by the UDP
+                //payload — a LISP control message has no length field and runs to the end of the
+                //datagram. Authoritative on encode (re-emits every byte); UDP delivers exactly one
+                //datagram so there is no trailing/pipelined data to leave for the codec's recursion.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        this.instance.message.setValue(remaining > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(0, remaining)) : '');
+                    },
+                    encode: function () {
+                        const message = this.instance.message.getValue('');
+                        if (message)
+                            this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(message));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //LISP control rides on UDP port 4342. The message carries no strong content magic (the leading
+        //nibble is just a small type number), so the well-known port is the signature. Require a
+        //minimum payload (Type octet + a partial fixed header) so a stray/empty UDP/4342 datagram
+        //falls through to raw rather than being claimed as a 1-byte LISP message.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.packet.length - this.startPos >= 4;
+    }
+}
+exports.LISP = LISP;

package/dist/headers/LLC.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * LLC — IEEE 802.2 Logical Link Control, the header of an IEEE 802.3 (length-encapsulated) Ethernet
+ * frame. In an Ethernet II frame bytes 12–13 are an EtherType (always ≥ 0x0600); in an 802.3 frame they
+ * are instead a *length* (≤ 0x05DC = 1500), and the frame payload begins with this 3-or-4-byte LLC
+ * header: a 1-byte DSAP (Destination Service Access Point), a 1-byte SSAP (Source SAP), and a Control
+ * field that is 1 byte for U-format (its two low bits are 0b11) or 2 bytes for I/S-format.
+ *
+ * LLC is a content-heuristic child of Ethernet (and 802.1Q): it claims a frame only when the parent's
+ * EtherType value is ≤ 0x05DC, which by construction can never be a real EtherType — so the Ethernet II
+ * path is completely untouched. It carries no length of its own; the child it routes to (STP by DSAP
+ * 0x42, IS-IS by 0xFE, or SNAP by 0xAA which re-exposes an EtherType) bounds itself, and any trailing
+ * 802.3 minimum-frame padding falls to the codec's RawData catch-all. The DSAP is exposed as an `llcsap`
+ * demux key. A well-formed frame round-trips byte-for-byte.
+ */
+export declare class LLC extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly demuxProducers: DemuxProducer[];
+    match(): boolean;
+}

package/dist/headers/LLC.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LLC = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * LLC — IEEE 802.2 Logical Link Control, the header of an IEEE 802.3 (length-encapsulated) Ethernet
+ * frame. In an Ethernet II frame bytes 12–13 are an EtherType (always ≥ 0x0600); in an 802.3 frame they
+ * are instead a *length* (≤ 0x05DC = 1500), and the frame payload begins with this 3-or-4-byte LLC
+ * header: a 1-byte DSAP (Destination Service Access Point), a 1-byte SSAP (Source SAP), and a Control
+ * field that is 1 byte for U-format (its two low bits are 0b11) or 2 bytes for I/S-format.
+ *
+ * LLC is a content-heuristic child of Ethernet (and 802.1Q): it claims a frame only when the parent's
+ * EtherType value is ≤ 0x05DC, which by construction can never be a real EtherType — so the Ethernet II
+ * path is completely untouched. It carries no length of its own; the child it routes to (STP by DSAP
+ * 0x42, IS-IS by 0xFE, or SNAP by 0xAA which re-exposes an EtherType) bounds itself, and any trailing
+ * 802.3 minimum-frame padding falls to the codec's RawData catch-all. The DSAP is exposed as an `llcsap`
+ * demux key. A well-formed frame round-trips byte-for-byte.
+ */
+class LLC extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'llc';
+        this.name = 'Logical Link Control';
+        this.nickname = 'LLC';
+        //A content-heuristic child (no matchKeys) — claimed when the Ethernet/VLAN parent's EtherType is a
+        //length (≤ 0x05DC), which cannot be a real EtherType.
+        this.matchKeys = [];
+        this.demuxProducers = [{ field: 'dsap', namespace: 'llcsap', kind: 'uint' }];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (LLC.#schemaCache ??= LLC.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'LLC dsap=${dsap} ssap=${ssap}',
+            properties: {
+                //Destination Service Access Point — the field the `llcsap` demux key is produced from.
+                //Kept as the raw byte (not masked for the I/G bit) so it re-emits exactly and 0x42/0xAA/0xFE
+                //route unambiguously.
+                dsap: this.fieldUInt('dsap', 0, 1, 'DSAP'),
+                ssap: this.fieldUInt('ssap', 1, 1, 'SSAP'),
+                //Control: 1 byte for Unnumbered format (low two bits 0b11), else 2 bytes (Information /
+                //Supervisory). Stored as hex preserving its on-wire length so encode reproduces it exactly;
+                //because the non-dry read grows headerLength, the child layer starts at the correct offset.
+                control: {
+                    type: 'string',
+                    label: 'Control',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const first = this.readBytes(2, 1, true)[0];
+                        const length = (first & 0x03) === 0x03 ? 1 : 2;
+                        this.instance.control.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(2, length)));
+                    },
+                    encode: function () {
+                        //Default to a U-format UI control (0x03) when crafting without a supplied value.
+                        const control = this.instance.control.getValue('03');
+                        this.writeBytes(2, (0, HexToBuffer_1.HexToBuffer)(control && control.length >= 2 ? control : '03'));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        const prev = this.prevCodecModule;
+        if (!prev || (prev.id !== 'eth' && prev.id !== 'vlan'))
+            return false;
+        //IEEE 802.3: bytes 12–13 ≤ 1500 (0x05DC) are a length → an 802.3/LLC frame. Valid EtherTypes are
+        //all ≥ 0x0600, so this gate never claims an Ethernet II frame (the 1501–1535 gap is left to raw,
+        //matching prior behavior). Require at least the 3-byte minimum LLC header.
+        const value = parseInt(prev.instance.etherType.getValue(''), 16);
+        if (!(value >= 0 && value <= 0x05dc))
+            return false;
+        return this.packet.length - this.startPos >= 3;
+    }
+}
+exports.LLC = LLC;