@netkitty/codec 1.0.0

package/dist/headers/NTP.d.ts

@@ -0,0 +1,18 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+/**
+ * NTP — Network Time Protocol (RFC 5905), the 48-byte packet header. Rides UDP port 123. Fields per
+ * RFC 5905 §7.3: a flags byte (LI/VN/Mode), Stratum, Poll and Precision (signed power-of-two seconds),
+ * Root Delay/Dispersion (NTP short 16.16 fixed-point, kept as raw uint32), Reference Identifier, and
+ * four 64-bit NTP timestamps (Reference/Origin/Receive/Transmit). Extension fields and the optional
+ * MAC (authenticated NTP) fall to the following raw layer.
+ */
+export declare class NTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+}

package/dist/headers/NTP.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+/**
+ * NTP — Network Time Protocol (RFC 5905), the 48-byte packet header. Rides UDP port 123. Fields per
+ * RFC 5905 §7.3: a flags byte (LI/VN/Mode), Stratum, Poll and Precision (signed power-of-two seconds),
+ * Root Delay/Dispersion (NTP short 16.16 fixed-point, kept as raw uint32), Reference Identifier, and
+ * four 64-bit NTP timestamps (Reference/Origin/Receive/Transmit). Extension fields and the optional
+ * MAC (authenticated NTP) fall to the following raw layer.
+ */
+class NTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ntp';
+        this.name = 'Network Time Protocol';
+        this.nickname = 'NTP';
+        //Port-defined (udp:123). No reliable content signature, so it is a plain bucket entry (no
+        //heuristicFallback): it is NTP only when it rides udp:123.
+        this.matchKeys = ['udpport:123'];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (NTP.#schemaCache ??= NTP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            properties: {
+                //Byte 0 packs three bit fields (bit 0 = MSB): LI[0..1], VN[2..4], Mode[5..7].
+                li: {
+                    type: 'integer',
+                    label: 'Leap Indicator',
+                    minimum: 0,
+                    maximum: 3,
+                    decode: function () { this.instance.li.setValue(this.readBits(0, 1, 0, 2)); },
+                    encode: function () { this.writeBits(0, 1, 0, 2, this.instance.li.getValue(0)); }
+                },
+                vn: {
+                    type: 'integer',
+                    label: 'Version',
+                    minimum: 0,
+                    maximum: 7,
+                    decode: function () { this.instance.vn.setValue(this.readBits(0, 1, 2, 3)); },
+                    encode: function () { this.writeBits(0, 1, 2, 3, this.instance.vn.getValue(0)); }
+                },
+                mode: {
+                    type: 'integer',
+                    label: 'Mode',
+                    minimum: 0,
+                    maximum: 7,
+                    decode: function () { this.instance.mode.setValue(this.readBits(0, 1, 5, 3)); },
+                    encode: function () { this.writeBits(0, 1, 5, 3, this.instance.mode.getValue(0)); }
+                },
+                stratum: this.fieldUInt('stratum', 1, 1, 'Stratum'),
+                //Poll and Precision are signed power-of-two-second exponents (RFC 5905 §7.3).
+                poll: this.fieldInt8('poll', 2, 'Poll Interval'),
+                precision: this.fieldInt8('precision', 3, 'Precision'),
+                rootDelay: this.fieldUInt('rootDelay', 4, 4, 'Root Delay'),
+                rootDispersion: this.fieldUInt('rootDispersion', 8, 4, 'Root Dispersion'),
+                refId: this.fieldHex('refId', 12, 4, 'Reference ID'),
+                refTimestamp: this.fieldHex('refTimestamp', 16, 8, 'Reference Timestamp'),
+                originTimestamp: this.fieldHex('originTimestamp', 24, 8, 'Origin Timestamp'),
+                receiveTimestamp: this.fieldHex('receiveTimestamp', 32, 8, 'Receive Timestamp'),
+                transmitTimestamp: this.fieldHex('transmitTimestamp', 40, 8, 'Transmit Timestamp')
+            }
+        };
+    }
+    match() {
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'udp';
+    }
+}
+exports.NTP = NTP;

package/dist/headers/NetFlowV5.d.ts

@@ -0,0 +1,28 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * NetFlow v5 — Cisco's fixed-format flow export (there is no formal RFC; the record layout is Cisco's
+ * published v5 format). Rides UDP, conventionally destination port 2055 (also seen on 9995/9996). All
+ * fields are big-endian.
+ *
+ * A packet is a 24-byte header — version(=5), count (number of flow records), sysUptime, unixSecs,
+ * unixNsecs, flowSequence, engineType, engineId, samplingInterval — followed by `count` flow records
+ * of 48 bytes each (srcAddr/dstAddr/nextHop, input/output ifIndex, packet/octet counts, flow start/end
+ * uptimes, ports, TCP flags, protocol, ToS, AS numbers, prefix masks, and two padding fields).
+ *
+ * The record walk is bounded by BOTH `count` and the bytes actually captured, so a lying count in a
+ * truncated capture can never over-read; any trailing bytes beyond 24 + count*48 fall to the raw layer.
+ * `count` is honored when supplied (so a malformed count round-trips byte-for-byte) and derived from
+ * records.length only when absent (crafting). This is a leaf header — nothing demuxes off NetFlow.
+ */
+export declare class NetFlowV5 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/NetFlowV5.js

@@ -0,0 +1,205 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetFlowV5 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+//The fixed geometry of a NetFlow v5 export: a 24-byte header, then `count` flow records of 48 bytes.
+const HEADER_LENGTH = 24;
+const RECORD_LENGTH = 48;
+/**
+ * NetFlow v5 — Cisco's fixed-format flow export (there is no formal RFC; the record layout is Cisco's
+ * published v5 format). Rides UDP, conventionally destination port 2055 (also seen on 9995/9996). All
+ * fields are big-endian.
+ *
+ * A packet is a 24-byte header — version(=5), count (number of flow records), sysUptime, unixSecs,
+ * unixNsecs, flowSequence, engineType, engineId, samplingInterval — followed by `count` flow records
+ * of 48 bytes each (srcAddr/dstAddr/nextHop, input/output ifIndex, packet/octet counts, flow start/end
+ * uptimes, ports, TCP flags, protocol, ToS, AS numbers, prefix masks, and two padding fields).
+ *
+ * The record walk is bounded by BOTH `count` and the bytes actually captured, so a lying count in a
+ * truncated capture can never over-read; any trailing bytes beyond 24 + count*48 fall to the raw layer.
+ * `count` is honored when supplied (so a malformed count round-trips byte-for-byte) and derived from
+ * records.length only when absent (crafting). This is a leaf header — nothing demuxes off NetFlow.
+ */
+class NetFlowV5 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'netflow5';
+        this.name = 'NetFlow v5';
+        this.nickname = 'NetFlow v5';
+        //Port-defined (udp:2055, and the commonly-used 9995/9996). NetFlow v5 does carry a reliable content
+        //signature — the first two bytes are the version (=5) — but that alone is weak, so it stays a plain
+        //bucket entry (no heuristicFallback): NetFlow v5 only when it rides one of its known UDP ports.
+        this.matchKeys = ['udpport:2055', 'udpport:9995', 'udpport:9996'];
+        //Leaf header: the flow records are terminal data, nothing demuxes off NetFlow.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (NetFlowV5.#schemaCache ??= NetFlowV5.#buildSchema());
+    }
+    /** Bytes available for this NetFlow message: the frame end, clamped by the UDP payload length. */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #recordItemSchema() {
+        return {
+            type: 'object',
+            label: 'Flow Record',
+            properties: {
+                srcAddr: { type: 'string', label: 'Source Address', minLength: 7, maxLength: 15, contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4 },
+                dstAddr: { type: 'string', label: 'Destination Address', minLength: 7, maxLength: 15, contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4 },
+                nextHop: { type: 'string', label: 'Next Hop', minLength: 7, maxLength: 15, contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4 },
+                input: { type: 'integer', label: 'Input SNMP ifIndex', minimum: 0, maximum: 65535 },
+                output: { type: 'integer', label: 'Output SNMP ifIndex', minimum: 0, maximum: 65535 },
+                dPkts: { type: 'integer', label: 'Packets', minimum: 0, maximum: 4294967295 },
+                dOctets: { type: 'integer', label: 'Octets', minimum: 0, maximum: 4294967295 },
+                first: { type: 'integer', label: 'Flow Start SysUptime', minimum: 0, maximum: 4294967295 },
+                last: { type: 'integer', label: 'Flow End SysUptime', minimum: 0, maximum: 4294967295 },
+                srcPort: { type: 'integer', label: 'Source Port', minimum: 0, maximum: 65535 },
+                dstPort: { type: 'integer', label: 'Destination Port', minimum: 0, maximum: 65535 },
+                pad1: { type: 'integer', label: 'Pad 1', minimum: 0, maximum: 255 },
+                tcpFlags: { type: 'integer', label: 'TCP Flags', minimum: 0, maximum: 255 },
+                prot: { type: 'integer', label: 'Protocol', minimum: 0, maximum: 255 },
+                tos: { type: 'integer', label: 'Type of Service', minimum: 0, maximum: 255 },
+                srcAs: { type: 'integer', label: 'Source AS', minimum: 0, maximum: 65535 },
+                dstAs: { type: 'integer', label: 'Destination AS', minimum: 0, maximum: 65535 },
+                srcMask: { type: 'integer', label: 'Source Mask', minimum: 0, maximum: 255 },
+                dstMask: { type: 'integer', label: 'Destination Mask', minimum: 0, maximum: 255 },
+                pad2: { type: 'integer', label: 'Pad 2', minimum: 0, maximum: 65535 }
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'NetFlow v5 ${count} flows',
+            properties: {
+                version: this.fieldUInt('version', 0, 2, 'Version'),
+                count: {
+                    type: 'integer',
+                    label: 'Count',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.count.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //Honor an explicitly-set count (even a lying one — so a malformed capture still
+                        //round-trips byte-for-byte); derive from the record array only when absent (crafting).
+                        let count = this.instance.count.getValue();
+                        if (count === undefined || count === null) {
+                            const records = this.instance.records.getValue();
+                            count = Array.isArray(records) ? records.length : 0;
+                        }
+                        if (count > 65535) {
+                            this.recordError(this.instance.count.getPath(), 'Maximum value is 65535');
+                            count = 65535;
+                        }
+                        if (count < 0) {
+                            this.recordError(this.instance.count.getPath(), 'Minimum value is 0');
+                            count = 0;
+                        }
+                        this.instance.count.setValue(count);
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(count));
+                    }
+                },
+                sysUptime: this.fieldUInt('sysUptime', 4, 4, 'System Uptime'),
+                unixSecs: this.fieldUInt('unixSecs', 8, 4, 'Unix Seconds'),
+                unixNsecs: this.fieldUInt('unixNsecs', 12, 4, 'Unix Nanoseconds'),
+                flowSequence: this.fieldUInt('flowSequence', 16, 4, 'Flow Sequence'),
+                engineType: this.fieldUInt('engineType', 20, 1, 'Engine Type'),
+                engineId: this.fieldUInt('engineId', 21, 1, 'Engine ID'),
+                samplingInterval: this.fieldUInt('samplingInterval', 22, 2, 'Sampling Interval'),
+                records: {
+                    type: 'array',
+                    label: 'Flow Records',
+                    items: this.#recordItemSchema(),
+                    decode: function () {
+                        //Bound the walk by BOTH the declared count and the captured bytes: a lying count in
+                        //a truncated frame must never read past the buffer. Each record is a fixed 48 bytes.
+                        const count = this.instance.count.getValue(0);
+                        const available = this.#available();
+                        const maxByBytes = available >= HEADER_LENGTH ? Math.floor((available - HEADER_LENGTH) / RECORD_LENGTH) : 0;
+                        const total = Math.min(count, maxByBytes);
+                        const records = [];
+                        for (let i = 0; i < total; i++) {
+                            const base = HEADER_LENGTH + i * RECORD_LENGTH;
+                            records.push({
+                                srcAddr: (0, BufferToIP_1.BufferToIPv4)(this.readBytes(base, 4)),
+                                dstAddr: (0, BufferToIP_1.BufferToIPv4)(this.readBytes(base + 4, 4)),
+                                nextHop: (0, BufferToIP_1.BufferToIPv4)(this.readBytes(base + 8, 4)),
+                                input: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 12, 2)),
+                                output: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 14, 2)),
+                                dPkts: (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(base + 16, 4)),
+                                dOctets: (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(base + 20, 4)),
+                                first: (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(base + 24, 4)),
+                                last: (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(base + 28, 4)),
+                                srcPort: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 32, 2)),
+                                dstPort: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 34, 2)),
+                                pad1: (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(base + 36, 1)),
+                                tcpFlags: (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(base + 37, 1)),
+                                prot: (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(base + 38, 1)),
+                                tos: (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(base + 39, 1)),
+                                srcAs: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 40, 2)),
+                                dstAs: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 42, 2)),
+                                srcMask: (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(base + 44, 1)),
+                                dstMask: (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(base + 45, 1)),
+                                pad2: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 46, 2))
+                            });
+                        }
+                        this.instance.records.setValue(records);
+                    },
+                    encode: function () {
+                        const records = this.instance.records.getValue();
+                        if (!Array.isArray(records))
+                            return;
+                        records.forEach((record, index) => {
+                            const base = HEADER_LENGTH + index * RECORD_LENGTH;
+                            this.writeBytes(base, (0, IPToBuffer_1.IPv4ToBuffer)(record.srcAddr ? record.srcAddr : '0.0.0.0'));
+                            this.writeBytes(base + 4, (0, IPToBuffer_1.IPv4ToBuffer)(record.dstAddr ? record.dstAddr : '0.0.0.0'));
+                            this.writeBytes(base + 8, (0, IPToBuffer_1.IPv4ToBuffer)(record.nextHop ? record.nextHop : '0.0.0.0'));
+                            this.writeBytes(base + 12, (0, NumberToBuffer_1.UInt16ToBuffer)(record.input ? record.input : 0));
+                            this.writeBytes(base + 14, (0, NumberToBuffer_1.UInt16ToBuffer)(record.output ? record.output : 0));
+                            this.writeBytes(base + 16, (0, NumberToBuffer_1.UInt32ToBuffer)(record.dPkts ? record.dPkts : 0));
+                            this.writeBytes(base + 20, (0, NumberToBuffer_1.UInt32ToBuffer)(record.dOctets ? record.dOctets : 0));
+                            this.writeBytes(base + 24, (0, NumberToBuffer_1.UInt32ToBuffer)(record.first ? record.first : 0));
+                            this.writeBytes(base + 28, (0, NumberToBuffer_1.UInt32ToBuffer)(record.last ? record.last : 0));
+                            this.writeBytes(base + 32, (0, NumberToBuffer_1.UInt16ToBuffer)(record.srcPort ? record.srcPort : 0));
+                            this.writeBytes(base + 34, (0, NumberToBuffer_1.UInt16ToBuffer)(record.dstPort ? record.dstPort : 0));
+                            this.writeBytes(base + 36, (0, NumberToBuffer_1.UInt8ToBuffer)(record.pad1 ? record.pad1 : 0));
+                            this.writeBytes(base + 37, (0, NumberToBuffer_1.UInt8ToBuffer)(record.tcpFlags ? record.tcpFlags : 0));
+                            this.writeBytes(base + 38, (0, NumberToBuffer_1.UInt8ToBuffer)(record.prot ? record.prot : 0));
+                            this.writeBytes(base + 39, (0, NumberToBuffer_1.UInt8ToBuffer)(record.tos ? record.tos : 0));
+                            this.writeBytes(base + 40, (0, NumberToBuffer_1.UInt16ToBuffer)(record.srcAs ? record.srcAs : 0));
+                            this.writeBytes(base + 42, (0, NumberToBuffer_1.UInt16ToBuffer)(record.dstAs ? record.dstAs : 0));
+                            this.writeBytes(base + 44, (0, NumberToBuffer_1.UInt8ToBuffer)(record.srcMask ? record.srcMask : 0));
+                            this.writeBytes(base + 45, (0, NumberToBuffer_1.UInt8ToBuffer)(record.dstMask ? record.dstMask : 0));
+                            this.writeBytes(base + 46, (0, NumberToBuffer_1.UInt16ToBuffer)(record.pad2 ? record.pad2 : 0));
+                        });
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        //Require the whole 24-byte header within the payload and the version signature (=5).
+        if (this.#available() < HEADER_LENGTH)
+            return false;
+        const version = (0, BufferToNumber_1.BufferToUInt16)(this.packet.subarray(this.startPos, this.startPos + 2));
+        return version === 5;
+    }
+}
+exports.NetFlowV5 = NetFlowV5;

package/dist/headers/OLSR.d.ts

@@ -0,0 +1,31 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * OLSR — Optimized Link State Routing (RFC 3626), a MANET proactive routing protocol carried over UDP
+ * port 698. An OLSR packet is a 4-byte packet header — Packet Length (the total packet octet count
+ * including this header) and Packet Sequence Number — followed by one or more messages. Each message is
+ * a 12-byte message header — Message Type (1 HELLO, 2 TC, 3 MID, 4 HNA), Vtime (the validity-time
+ * mantissa/exponent byte), Message Size (the message octet count including this 12-byte header),
+ * Originator Address (the 4-byte IPv4 address of the node that generated the message), Time To Live,
+ * Hop Count and Message Sequence Number — followed by (Message Size - 12) body bytes.
+ *
+ * The message body layout differs per Message Type (HELLO's link/neighbor sets, TC's advertised
+ * neighbors, MID's interface addresses, HNA's network/mask pairs) and several bodies need
+ * cross-message topology context, so this codec keeps each body verbatim as `body` hex (byte-perfect)
+ * and does not sub-decode it. The message array runs from offset 4 to the Packet Length (capped by the
+ * UDP payload), each message bounded by its own Message Size; a message that under/overruns is not
+ * consumed, so trailing / truncated bytes are left to the codec's recursion / RawData. On encode the
+ * Packet Length and each Message Size are honored when supplied (a crafted packet may lie), else derived
+ * from the actual bytes. A well-formed packet round-trips byte-for-byte.
+ */
+export declare class OLSR extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/OLSR.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OLSR = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * OLSR — Optimized Link State Routing (RFC 3626), a MANET proactive routing protocol carried over UDP
+ * port 698. An OLSR packet is a 4-byte packet header — Packet Length (the total packet octet count
+ * including this header) and Packet Sequence Number — followed by one or more messages. Each message is
+ * a 12-byte message header — Message Type (1 HELLO, 2 TC, 3 MID, 4 HNA), Vtime (the validity-time
+ * mantissa/exponent byte), Message Size (the message octet count including this 12-byte header),
+ * Originator Address (the 4-byte IPv4 address of the node that generated the message), Time To Live,
+ * Hop Count and Message Sequence Number — followed by (Message Size - 12) body bytes.
+ *
+ * The message body layout differs per Message Type (HELLO's link/neighbor sets, TC's advertised
+ * neighbors, MID's interface addresses, HNA's network/mask pairs) and several bodies need
+ * cross-message topology context, so this codec keeps each body verbatim as `body` hex (byte-perfect)
+ * and does not sub-decode it. The message array runs from offset 4 to the Packet Length (capped by the
+ * UDP payload), each message bounded by its own Message Size; a message that under/overruns is not
+ * consumed, so trailing / truncated bytes are left to the codec's recursion / RawData. On encode the
+ * Packet Length and each Message Size are honored when supplied (a crafted packet may lie), else derived
+ * from the actual bytes. A well-formed packet round-trips byte-for-byte.
+ */
+class OLSR extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'olsr';
+        this.name = 'Optimized Link State Routing';
+        this.nickname = 'OLSR';
+        this.matchKeys = ['udpport:698'];
+        //A leaf header — each message body needs per-type, topology-dependent parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (OLSR.#schemaCache ??= OLSR.#buildSchema());
+    }
+    /** The payload length bounded by the UDP datagram (so retained padding/FCS is not absorbed). */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** Byte offset the message walk stops at: min(UDP payload, Packet Length). */
+    #consumedEnd() {
+        const payload = this.#payloadLength();
+        const packetLength = this.instance.packetLength.getValue(0);
+        return (packetLength > 0 && packetLength < payload) ? packetLength : payload;
+    }
+    /** Clamp a crafted numeric field to [0, max], recording an error rather than throwing or wrapping. */
+    #clamp(path, value, max) {
+        let v = (value === undefined || value === null) ? 0 : value;
+        if (v > max) {
+            this.recordError(path, `Maximum value is ${max}`);
+            v = max;
+        }
+        if (v < 0) {
+            this.recordError(path, 'Minimum value is 0');
+            v = 0;
+        }
+        return v;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'OLSR seq=${packetSequenceNumber} ${messages.length} msgs',
+            properties: {
+                packetLength: {
+                    type: 'integer',
+                    label: 'Packet Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.packetLength.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(0, 2)));
+                    },
+                    encode: function () {
+                        //Packet Length counts the whole packet = 4-byte header + every message. Honored
+                        //when supplied (a crafted packet may lie); else derived from the actual message
+                        //bytes (12-byte header + body each), matching what the `messages` field writes.
+                        const provided = this.instance.packetLength.getValue();
+                        let value;
+                        if (provided !== undefined && provided !== null) {
+                            value = provided;
+                        }
+                        else {
+                            const messages = this.instance.messages.getValue([]);
+                            let total = 4;
+                            if (messages) {
+                                for (const message of messages) {
+                                    total += 12 + (0, HexToBuffer_1.HexToBuffer)(message.body ? message.body : '').length;
+                                }
+                            }
+                            value = total;
+                        }
+                        if (value > 65535) {
+                            this.recordError(this.instance.packetLength.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.packetLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.packetLength.setValue(value);
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                packetSequenceNumber: this.fieldUInt('packetSequenceNumber', 2, 2, 'Packet Sequence Number'),
+                //The message chain — 12-byte header + body each, running from offset 4 to the Packet
+                //Length (capped by the UDP payload). Owns a single offset walk; each body is bounded by
+                //its own Message Size and kept verbatim so every message round-trips byte-for-byte.
+                messages: {
+                    type: 'array',
+                    label: 'Messages',
+                    items: {
+                        type: 'object',
+                        label: 'Message',
+                        properties: {
+                            //Wire fields are plain integers (no hard enum) so any on-wire value re-encodes.
+                            messageType: { type: 'integer', label: 'Message Type', minimum: 0, maximum: 255 },
+                            vTime: { type: 'integer', label: 'Vtime', minimum: 0, maximum: 255 },
+                            messageSize: { type: 'integer', label: 'Message Size', minimum: 0, maximum: 65535 },
+                            originatorAddress: { type: 'string', label: 'Originator Address', minLength: 7, maxLength: 15, contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4 },
+                            ttl: { type: 'integer', label: 'Time To Live', minimum: 0, maximum: 255 },
+                            hopCount: { type: 'integer', label: 'Hop Count', minimum: 0, maximum: 255 },
+                            messageSeqNo: { type: 'integer', label: 'Message Sequence Number', minimum: 0, maximum: 65535 },
+                            body: { type: 'string', label: 'Body', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        const end = this.#consumedEnd();
+                        const messages = [];
+                        let offset = 4;
+                        while (offset + 12 <= end) {
+                            //Peek the Message Size (dry-run, so it does not extend the consumed header
+                            //length) to decide whether the whole message fits. A message that claims fewer
+                            //than its 12-byte header, or overruns the packet, is truncation/corruption —
+                            //stop and leave the remaining bytes to the codec's recursion / RawData.
+                            const messageSize = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 2, 2, true));
+                            if (messageSize < 12 || offset + messageSize > end)
+                                break;
+                            const messageType = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset, 1));
+                            const vTime = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 1, 1));
+                            const originatorAddress = (0, BufferToIP_1.BufferToIPv4)(this.readBytes(offset + 4, 4));
+                            const ttl = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 8, 1));
+                            const hopCount = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 9, 1));
+                            const messageSeqNo = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 10, 2));
+                            const body = messageSize > 12 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 12, messageSize - 12)) : '';
+                            messages.push({
+                                messageType: messageType,
+                                vTime: vTime,
+                                messageSize: messageSize,
+                                originatorAddress: originatorAddress,
+                                ttl: ttl,
+                                hopCount: hopCount,
+                                messageSeqNo: messageSeqNo,
+                                body: body
+                            });
+                            offset += messageSize;
+                        }
+                        this.instance.messages.setValue(messages);
+                    },
+                    encode: function () {
+                        const messages = this.instance.messages.getValue([]);
+                        if (!messages)
+                            return;
+                        let offset = 4;
+                        for (let i = 0; i < messages.length; i++) {
+                            const message = messages[i];
+                            const bodyBuffer = (0, HexToBuffer_1.HexToBuffer)(message.body ? message.body : '');
+                            //Message Size counts the 12-byte header + body. Honored when supplied (a crafted
+                            //message may lie); else derived from the header + body actually written. The walk
+                            //advances by the bytes actually written so a lying Size cannot shift the next
+                            //message.
+                            const messageSize = (message.messageSize !== undefined && message.messageSize !== null)
+                                ? this.#clamp(`messages[${i}].messageSize`, message.messageSize, 65535)
+                                : 12 + bodyBuffer.length;
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(this.#clamp(`messages[${i}].messageType`, message.messageType, 255)));
+                            this.writeBytes(offset + 1, (0, NumberToBuffer_1.UInt8ToBuffer)(this.#clamp(`messages[${i}].vTime`, message.vTime, 255)));
+                            this.writeBytes(offset + 2, (0, NumberToBuffer_1.UInt16ToBuffer)(messageSize));
+                            this.writeBytes(offset + 4, (0, IPToBuffer_1.IPv4ToBuffer)(message.originatorAddress ? message.originatorAddress : '0.0.0.0'));
+                            this.writeBytes(offset + 8, (0, NumberToBuffer_1.UInt8ToBuffer)(this.#clamp(`messages[${i}].ttl`, message.ttl, 255)));
+                            this.writeBytes(offset + 9, (0, NumberToBuffer_1.UInt8ToBuffer)(this.#clamp(`messages[${i}].hopCount`, message.hopCount, 255)));
+                            this.writeBytes(offset + 10, (0, NumberToBuffer_1.UInt16ToBuffer)(this.#clamp(`messages[${i}].messageSeqNo`, message.messageSeqNo, 65535)));
+                            if (bodyBuffer.length)
+                                this.writeBytes(offset + 12, bodyBuffer);
+                            offset += 12 + bodyBuffer.length;
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //OLSR rides on UDP port 698. Require the full 4-byte packet header within the UDP payload; a
+        //shorter datagram on port 698 is not an OLSR packet and falls through to raw rather than
+        //claiming a layer. Selection stays port-bucketed (matchKeys) — the packet header carries no
+        //distinctive content magic.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.#payloadLength() >= 4;
+    }
+}
+exports.OLSR = OLSR;

package/dist/headers/OPCUA.d.ts

@@ -0,0 +1,33 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * OPC UA Connection Protocol — the OPC UA TCP transport mapping (IEC 62541-6), TCP port 4840. Every OPC
+ * UA TCP message is framed by a fixed 8-byte header: a 3-byte ASCII MessageType (HEL/ACK/ERR/OPN/MSG/
+ * CLO/RHE/RHF), a 1-byte ASCII Chunk/IsFinal indicator (F final, C intermediate chunk, A abort), and a
+ * LITTLE-ENDIAN uint32 MessageSize that counts the WHOLE message including the 8-byte header. The header
+ * is followed by MessageSize − 8 bytes of message body.
+ *
+ * ⚠️ MessageSize is LITTLE-ENDIAN (the only multi-byte field in this header), and there is no
+ * little-endian helper in this codebase, so it is read/written byte-by-byte in its closure. The `| ... <<`
+ * expression yields a signed int32, so `>>> 0` is applied to the whole expression to keep a MessageSize
+ * with the high bit set unsigned. MessageType/Chunk are ASCII text kept as strings.
+ *
+ * The body is message-type-dependent (HEL/ACK carry a protocol version + buffer sizes + endpoint URL;
+ * OPN/MSG/CLO carry a SecureChannelId + security/sequence headers + an encoded body), and much of it is
+ * cross-message / security-context state. So this single-message codec keeps the body verbatim as `body`
+ * hex (byte-perfect), bounded by MessageSize (the body ends at offset MessageSize, clamped to the
+ * captured bytes) so a pipelined/trailing message is left to the codec's recursion / RawData. The
+ * MessageSize is honored when supplied (a crafted message may lie), else derived as 8 + body bytes. A
+ * well-formed message round-trips byte-for-byte. Structuring the per-message-type body is a later slice.
+ */
+export declare class OPCUA extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}