@netkitty/codec 1.0.0

package/dist/headers/RGoose.js

@@ -0,0 +1,340 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RGoose = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * IEC 61850-90-5 Session protocol — Routable GOOSE / Routable SV (R-GOOSE / R-SV).
+ *
+ * Carries a GOOSE (goosePdu) or SV (savPdu) APDU over UDP inside an OSI-style Session PDU (SPDU). One
+ * header handles both, branching on the Session Identifier (SI) byte: 0xA1 = non-tunnelled GOOSE,
+ * 0xA2 = non-tunnelled SV, 0xA0 = tunnelled. This is a leaf (Slice 1): each payload item's APDU is kept
+ * as bounded raw hex — structuring it via the shared BER/GOOSE/SV decoders is deferred to Slice 2, so we
+ * deliberately do NOT recurse into Goose.ts / IEC61850SampledValues.ts (that would swallow the trailing
+ * signature and any 2nd payload item). All multi-byte session fields are big-endian.
+ *
+ * ── VERIFIED BYTE LAYOUT (cross-checked against Wireshark 4.6.7 packet-goose.c `dissect_rgoose`, and
+ *    tshark's own R-GOOSE dissection of a crafted frame; offsets are header-relative) ──────────────────
+ *   off  w   field                         source
+ *    0   1   SI (Session Identifier)        packet-goose.c OSI_SPDU_* (0xA0 tunneled, 0xA1 GOOSE, 0xA2 SV, 0xA3 mgmt)
+ *    1   1   LI (session header length)     hf_goose_session_hdr_length (display only; proto_item_set_len=LI+2)
+ *    2   1   Common session header id       hf_goose_content_id (0x80)
+ *    3   1   Header length                  hf_goose_hdr_length
+ *    4   4   SPDU length                    hf_goose_spdu_lenth  (BE)
+ *    8   4   SPDU number                    hf_goose_spdu_num    (BE)
+ *   12   2   Version                        hf_goose_version     (BE, =1)
+ *   ── Security information subtree ──
+ *   14   4   Time of current key            hf_goose_current_key_t (BE)
+ *   18   2   Time to next key               hf_goose_next_key_t    (BE)
+ *   20   4   Key ID                         hf_goose_key_id        (BE)
+ *   24   1   Initialization vector length   hf_goose_init_vec_length  → ivLen
+ *   25  iv   Initialization vector          hf_goose_init_vec (present only if ivLen>0)
+ *   ── Session user information ──
+ *   25+iv  4 Payload length                 hf_goose_payload_length (BE); bounds the payload-item walk
+ *   ── per payload item (APDU_HEADER_SIZE=6, then the APDU) ──
+ *   +0   1   Payload type tag               hf_goose_apdu_tag (0x81 GOOSE, 0x82 SV, 0x83 tunnel, 0x84 mgmt)
+ *   +1   1   Simulation flag                hf_goose_apdu_simulation
+ *   +2   2   APPID                          hf_goose_apdu_appid  (BE)
+ *   +4   2   APDU length                    hf_goose_apdu_length (BE)
+ *   +6   N   APDU (goosePdu 0x61.. / savPdu 0x60.. BER)
+ *   ── trailer (after payload length consumed) ──
+ *        v   Signature / HMAC               optional 0xAF-tagged padding then HMAC; Wireshark lumps the
+ *                                           trailing bytes as hf_goose_hmac (it does not parse a 0x85 tag)
+ *
+ * NOTE (layout uncertainty, resolved in favour of tshark): some 90-5 texts describe the security area as
+ * TimeOfCurrentKey(4)+TimeToNextKey(2)+SecurityAlgorithm(enc 1 + MAC 1)+KeyID(4). Wireshark 4.6.7 instead
+ * models those bytes as KeyID(4)+InitVectorLength(1)+InitVector — the SAME octets, different field names.
+ * tshark is the byte-layout gate here, so we follow Wireshark's interpretation exactly.
+ *
+ * There is NO explicit payload-item count: items are walked accumulating (6 + APDU length) until the
+ * Payload length is consumed (matches Wireshark's `while (apdu_offset < payload_length)` loop).
+ *
+ * TRANSPORT: real R-GOOSE reaches Wireshark's dissector via a CLTP (ISO 8602) UD TPDU heuristic over UDP,
+ * but the common/libiec61850 wire form puts the SPDU directly in the UDP payload (SI as the first byte);
+ * that is the form modelled here (matchKeys udpport:102, SI-signature match), and the form the fixture
+ * ships. The session byte layout itself was validated by wrapping this SPDU in a minimal CLTP UD TPDU and
+ * confirming tshark dissects it as R-GOOSE with the expected SPDU number / APPID / goosePdu / HMAC.
+ *
+ * Length fields (LI / Header length / SPDU length / Payload length / per-item APDU length) are honored
+ * when present and derived only when absent — a well-formed frame's derived values equal the decoded
+ * ones, so it round-trips byte-for-byte. A crafted frame that lies is re-emitted faithfully as long as
+ * its payload is honestly tiled by items (the signature boundary is taken from the actual item bytes on
+ * both decode and encode); a self-contradictory payloadLength that overshoots the item span by a partial
+ * item is best-effort, like a truncated frame.
+ */
+class RGoose extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'r-session';
+        this.name = 'IEC 61850-90-5 Session';
+        this.nickname = 'R-GOOSE/R-SV';
+        this.matchKeys = ['udpport:102'];
+        //A leaf for Slice 1: each payload item's APDU is retained as bounded raw hex rather than recursing
+        //into the GOOSE/SV decoders (structuring the APDU is Slice 2).
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (RGoose.#schemaCache ??= RGoose.#buildSchema());
+    }
+    /** The SPDU bytes available in this UDP datagram (so a retained trailer/padding is not over-read). */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** Initialization-vector length (drives every offset after the fixed 25-byte session header). */
+    #ivLen() {
+        const value = this.instance.security.initVecLength.getValue(0);
+        const n = typeof value === 'number' ? value : parseInt(String(value));
+        return Number.isFinite(n) && n > 0 ? n : 0;
+    }
+    /** Offset of the Payload length field: fixed 25-byte header + the variable IV. */
+    #payloadLengthOffset() {
+        return 25 + this.#ivLen();
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'R-GOOSE/R-SV spdu=${spduNumber} si=${si}',
+            properties: {
+                si: this.fieldUInt('si', 0, 1, 'Session Identifier'),
+                li: {
+                    type: 'integer', label: 'Session Header Length', minimum: 0, maximum: 255,
+                    decode: function () { this.instance.li.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(1, 1))); },
+                    encode: function () {
+                        const value = this.instance.li.getValue();
+                        //Honor when present, else derive: octets from the common header id (offset 2) to the
+                        //end of the security info (= where the payload length begins, minus those 2 bytes).
+                        const li = (value === undefined || value === null) ? this.#payloadLengthOffset() - 2 : value;
+                        this.instance.li.setValue(li);
+                        this.writeBytes(1, Buffer.from([li & 0xff]));
+                    }
+                },
+                commonHeaderId: {
+                    type: 'integer', label: 'Common Session Header Id', minimum: 0, maximum: 255,
+                    decode: function () { this.instance.commonHeaderId.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(2, 1))); },
+                    encode: function () {
+                        const value = this.instance.commonHeaderId.getValue();
+                        const id = (value === undefined || value === null) ? 0x80 : value;
+                        this.instance.commonHeaderId.setValue(id);
+                        this.writeBytes(2, Buffer.from([id & 0xff]));
+                    }
+                },
+                headerLength: {
+                    type: 'integer', label: 'Header Length', minimum: 0, maximum: 255,
+                    decode: function () { this.instance.headerLength.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(3, 1))); },
+                    encode: function () {
+                        const value = this.instance.headerLength.getValue();
+                        //Honor when present, else derive: octets from the SPDU length field (offset 4) to the
+                        //end of the security info.
+                        const hl = (value === undefined || value === null) ? this.#payloadLengthOffset() - 4 : value;
+                        this.instance.headerLength.setValue(hl);
+                        this.writeBytes(3, Buffer.from([hl & 0xff]));
+                    }
+                },
+                spduLength: {
+                    type: 'integer', label: 'SPDU Length', minimum: 0, maximum: 4294967295,
+                    decode: function () { this.instance.spduLength.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(4, 4))); },
+                    encode: function () {
+                        const value = this.instance.spduLength.getValue();
+                        if (value !== undefined && value !== null) {
+                            this.instance.spduLength.setValue(value);
+                            this.writeBytes(4, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                            return;
+                        }
+                        //Derive: octets from the SPDU number field (offset 8) to the end of the SPDU
+                        //(payload + signature). Computed once the whole header has been written.
+                        this.writeBytes(4, (0, NumberToBuffer_1.UInt32ToBuffer)(0));
+                        this.addPostSelfEncodeHandler(() => {
+                            const derived = this.length - 8 < 0 ? 0 : this.length - 8;
+                            this.instance.spduLength.setValue(derived);
+                            this.writeBytes(4, (0, NumberToBuffer_1.UInt32ToBuffer)(derived));
+                        });
+                    }
+                },
+                spduNumber: this.fieldUInt('spduNumber', 8, 4, 'SPDU Number'),
+                version: {
+                    type: 'integer', label: 'Version', minimum: 0, maximum: 65535,
+                    decode: function () { this.instance.version.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(12, 2))); },
+                    encode: function () {
+                        const value = this.instance.version.getValue();
+                        const version = (value === undefined || value === null) ? 1 : value;
+                        this.instance.version.setValue(version);
+                        this.writeBytes(12, (0, NumberToBuffer_1.UInt16ToBuffer)(version));
+                    }
+                },
+                security: {
+                    type: 'object',
+                    label: 'Security Information',
+                    properties: {
+                        timeCurrentKey: {
+                            type: 'integer', label: 'Time of Current Key', minimum: 0, maximum: 4294967295,
+                            decode: function () { this.instance.security.timeCurrentKey.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(14, 4))); },
+                            encode: function () { this.writeBytes(14, (0, NumberToBuffer_1.UInt32ToBuffer)(this.instance.security.timeCurrentKey.getValue(0))); }
+                        },
+                        timeNextKey: {
+                            type: 'integer', label: 'Time to Next Key', minimum: 0, maximum: 65535,
+                            decode: function () { this.instance.security.timeNextKey.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(18, 2))); },
+                            encode: function () { this.writeBytes(18, (0, NumberToBuffer_1.UInt16ToBuffer)(this.instance.security.timeNextKey.getValue(0))); }
+                        },
+                        keyId: {
+                            type: 'integer', label: 'Key ID', minimum: 0, maximum: 4294967295,
+                            decode: function () { this.instance.security.keyId.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(20, 4))); },
+                            encode: function () { this.writeBytes(20, (0, NumberToBuffer_1.UInt32ToBuffer)(this.instance.security.keyId.getValue(0))); }
+                        },
+                        initVecLength: {
+                            type: 'integer', label: 'Init Vector Length', minimum: 0, maximum: 255,
+                            decode: function () { this.instance.security.initVecLength.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(24, 1))); },
+                            encode: function () {
+                                const value = this.instance.security.initVecLength.getValue();
+                                //Honor when present, else derive from the init-vector hex length.
+                                const iv = (0, HexToBuffer_1.HexToBuffer)(this.instance.security.initVec.getValue(''));
+                                const len = (value === undefined || value === null) ? iv.length : value;
+                                this.instance.security.initVecLength.setValue(len);
+                                this.writeBytes(24, Buffer.from([len & 0xff]));
+                            }
+                        },
+                        initVec: {
+                            type: 'string', label: 'Init Vector', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                            decode: function () {
+                                const ivLen = this.#ivLen();
+                                this.instance.security.initVec.setValue(ivLen > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(25, ivLen)) : '');
+                            },
+                            encode: function () {
+                                const iv = (0, HexToBuffer_1.HexToBuffer)(this.instance.security.initVec.getValue(''));
+                                if (iv.length)
+                                    this.writeBytes(25, iv);
+                            }
+                        }
+                    }
+                },
+                payloadLength: {
+                    type: 'integer', label: 'Payload Length', minimum: 0, maximum: 4294967295,
+                    decode: function () {
+                        this.instance.payloadLength.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(this.#payloadLengthOffset(), 4)));
+                    },
+                    encode: function () {
+                        const value = this.instance.payloadLength.getValue();
+                        let length;
+                        if (value !== undefined && value !== null) {
+                            length = value;
+                        }
+                        else {
+                            //Derive: sum of (6-byte APDU header + APDU bytes) over every payload item —
+                            //exactly the span Wireshark walks against the payload length.
+                            const items = this.instance.payloadItems.getValue([]);
+                            length = (Array.isArray(items) ? items : []).reduce((sum, item) => sum + 6 + (0, HexToBuffer_1.HexToBuffer)(item && item.apdu ? item.apdu : '').length, 0);
+                        }
+                        this.instance.payloadLength.setValue(length);
+                        this.writeBytes(this.#payloadLengthOffset(), (0, NumberToBuffer_1.UInt32ToBuffer)(length));
+                    }
+                },
+                payloadItems: {
+                    type: 'array',
+                    label: 'Payload Items',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            payloadType: { type: 'integer', label: 'Payload Type', minimum: 0, maximum: 255 },
+                            simulation: { type: 'integer', label: 'Simulation', minimum: 0, maximum: 255 },
+                            appid: { type: 'integer', label: 'APPID', minimum: 0, maximum: 65535 },
+                            apduLength: { type: 'integer', label: 'APDU Length', minimum: 0, maximum: 65535 },
+                            apdu: { type: 'string', label: 'APDU', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        const available = this.#available();
+                        const start = this.#payloadLengthOffset() + 4;
+                        const payloadLength = this.instance.payloadLength.getValue(0);
+                        //The payload length bounds the item walk; clamp to the datagram so a lying length
+                        //cannot read past the buffer.
+                        const end = Math.min(start + payloadLength, available);
+                        const items = [];
+                        let offset = start;
+                        let guard = 0;
+                        while (offset + 6 <= end && guard++ < 4096) {
+                            const payloadType = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset, 1));
+                            const simulation = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 1, 1));
+                            const appid = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 2, 2));
+                            const apduLength = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 4, 2));
+                            const apduAvail = Math.min(apduLength, end - (offset + 6));
+                            const apdu = apduAvail > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 6, apduAvail)) : '';
+                            items.push({ payloadType: payloadType, simulation: simulation, appid: appid, apduLength: apduLength, apdu: apdu });
+                            offset += 6 + apduLength;
+                        }
+                        this.instance.payloadItems.setValue(items);
+                    },
+                    encode: function () {
+                        const items = this.instance.payloadItems.getValue([]);
+                        let offset = this.#payloadLengthOffset() + 4;
+                        (Array.isArray(items) ? items : []).forEach((item) => {
+                            const apdu = (0, HexToBuffer_1.HexToBuffer)(item && item.apdu ? item.apdu : '');
+                            //Honor the item's APDU length when supplied, else derive from the APDU bytes.
+                            const apduLength = (item && item.apduLength !== undefined && item.apduLength !== null) ? item.apduLength : apdu.length;
+                            this.writeBytes(offset, Buffer.from([(item && item.payloadType ? item.payloadType : 0) & 0xff]));
+                            this.writeBytes(offset + 1, Buffer.from([(item && item.simulation ? item.simulation : 0) & 0xff]));
+                            this.writeBytes(offset + 2, (0, NumberToBuffer_1.UInt16ToBuffer)(item && item.appid ? item.appid : 0));
+                            this.writeBytes(offset + 4, (0, NumberToBuffer_1.UInt16ToBuffer)(apduLength));
+                            if (apdu.length)
+                                this.writeBytes(offset + 6, apdu);
+                            //Advance by the actual bytes written so items stay contiguous.
+                            offset += 6 + apdu.length;
+                        });
+                    }
+                },
+                signature: {
+                    type: 'string',
+                    label: 'Signature',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#available();
+                        //Everything after the decoded payload items is the signature / HMAC trailer (possibly
+                        //0xAF-tagged padding + HMAC), kept verbatim. The start is computed from the ACTUAL
+                        //decoded item bytes — identical to the encode side below — rather than from the
+                        //payloadLength field, so decode and encode are symmetric by construction: no byte is
+                        //dropped even if a crafted payloadLength overshoots the real item span by a partial
+                        //item (a payloadLength honestly tiled by items gives the same offset either way).
+                        const items = this.instance.payloadItems.getValue([]);
+                        let sigStart = this.#payloadLengthOffset() + 4;
+                        (Array.isArray(items) ? items : []).forEach((item) => {
+                            sigStart += 6 + (0, HexToBuffer_1.HexToBuffer)(item && item.apdu ? item.apdu : '').length;
+                        });
+                        this.instance.signature.setValue(sigStart < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(sigStart, available - sigStart)) : '');
+                    },
+                    encode: function () {
+                        const signature = (0, HexToBuffer_1.HexToBuffer)(this.instance.signature.getValue(''));
+                        if (!signature.length)
+                            return;
+                        const items = this.instance.payloadItems.getValue([]);
+                        let sigStart = this.#payloadLengthOffset() + 4;
+                        (Array.isArray(items) ? items : []).forEach((item) => {
+                            sigStart += 6 + (0, HexToBuffer_1.HexToBuffer)(item && item.apdu ? item.apdu : '').length;
+                        });
+                        this.writeBytes(sigStart, signature);
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //A UDP child. Require the minimum session header (Wireshark's heuristic floor is 27 bytes) and a
+        //Session Identifier in the R-GOOSE/R-SV/tunnel set. No heuristicFallback: recognized only on the
+        //well-known UDP port 102, gated by the SI signature.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#available() < 27)
+            return false;
+        const si = this.readBytes(0, 1, true)[0];
+        return si === 0xA0 || si === 0xA1 || si === 0xA2;
+    }
+}
+exports.RGoose = RGoose;

package/dist/headers/RIP.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * RIP v2 — Routing Information Protocol version 2 (RFC 2453). Rides UDP, conventionally source and
+ * destination port 520 (responses are multicast to 224.0.0.9). All multi-byte fields are big-endian.
+ *
+ * A message is a 4-byte header — command (1 = request, 2 = response), version (= 2), and a 2-byte
+ * reserved field (must be zero) — followed by zero or more 20-byte route table entries. Each entry is
+ * addressFamily (2, AF_INET = 2), routeTag (2), ipAddress (4, IPv4), subnetMask (4, IPv4), nextHop
+ * (4, IPv4), and metric (4, 1..16 where 16 = infinity).
+ *
+ * The entry walk is bounded by the bytes actually present in the UDP payload, so a truncated capture can
+ * never over-read; any trailing bytes shorter than a full 20-byte entry fall to the raw layer. Entries
+ * are carried generically (including RIPv2 authentication entries, whose addressFamily is 0xFFFF and
+ * whose 16 bytes of auth data occupy the ipAddress/subnetMask/nextHop/metric slots) so every entry —
+ * route or auth — round-trips byte-for-byte; per-entry auth semantics are a later enrichment. This is a
+ * leaf header — nothing demuxes off RIP.
+ */
+export declare class RIP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/RIP.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RIP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+//The fixed geometry of a RIP message: a 4-byte header (command, version, reserved) then route entries
+//of 20 bytes each, walked to the end of the UDP payload (RFC 2453 caps a packet at 25 entries).
+const HEADER_LENGTH = 4;
+const ENTRY_LENGTH = 20;
+/**
+ * RIP v2 — Routing Information Protocol version 2 (RFC 2453). Rides UDP, conventionally source and
+ * destination port 520 (responses are multicast to 224.0.0.9). All multi-byte fields are big-endian.
+ *
+ * A message is a 4-byte header — command (1 = request, 2 = response), version (= 2), and a 2-byte
+ * reserved field (must be zero) — followed by zero or more 20-byte route table entries. Each entry is
+ * addressFamily (2, AF_INET = 2), routeTag (2), ipAddress (4, IPv4), subnetMask (4, IPv4), nextHop
+ * (4, IPv4), and metric (4, 1..16 where 16 = infinity).
+ *
+ * The entry walk is bounded by the bytes actually present in the UDP payload, so a truncated capture can
+ * never over-read; any trailing bytes shorter than a full 20-byte entry fall to the raw layer. Entries
+ * are carried generically (including RIPv2 authentication entries, whose addressFamily is 0xFFFF and
+ * whose 16 bytes of auth data occupy the ipAddress/subnetMask/nextHop/metric slots) so every entry —
+ * route or auth — round-trips byte-for-byte; per-entry auth semantics are a later enrichment. This is a
+ * leaf header — nothing demuxes off RIP.
+ */
+class RIP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'rip';
+        this.name = 'Routing Information Protocol';
+        this.nickname = 'RIP';
+        //Port-defined (udp:520). The command/version bytes are a weak signature, so this stays a plain
+        //bucket entry (no heuristicFallback): RIP only when it rides udp:520, and only when the header looks
+        //like RIPv2 (version = 2, command request/response). RIPv1 and non-RIP payloads fall to raw.
+        this.matchKeys = ['udpport:520'];
+        //Leaf header: the route entries are terminal data, nothing demuxes off RIP.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (RIP.#schemaCache ??= RIP.#buildSchema());
+    }
+    /** Bytes available for this RIP message: the frame end, clamped by the UDP payload length. */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #entryItemSchema() {
+        return {
+            type: 'object',
+            label: 'Route Entry',
+            properties: {
+                addressFamily: { type: 'integer', label: 'Address Family', minimum: 0, maximum: 65535 },
+                routeTag: { type: 'integer', label: 'Route Tag', minimum: 0, maximum: 65535 },
+                ipAddress: { type: 'string', label: 'IP Address', minLength: 7, maxLength: 15, contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4 },
+                subnetMask: { type: 'string', label: 'Subnet Mask', minLength: 7, maxLength: 15, contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4 },
+                nextHop: { type: 'string', label: 'Next Hop', minLength: 7, maxLength: 15, contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4 },
+                metric: { type: 'integer', label: 'Metric', minimum: 0, maximum: 4294967295 }
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'RIPv2 command ${command}',
+            properties: {
+                command: this.fieldUInt('command', 0, 1, 'Command'),
+                version: this.fieldUInt('version', 1, 1, 'Version'),
+                reserved: this.fieldUInt('reserved', 2, 2, 'Reserved'),
+                entries: {
+                    type: 'array',
+                    label: 'Route Entries',
+                    items: this.#entryItemSchema(),
+                    decode: function () {
+                        //Walk fixed 20-byte entries to the end of the UDP payload. The count is bounded by
+                        //the captured bytes so a truncated frame never over-reads; a trailing partial entry
+                        //(< 20 bytes) is left for the raw layer.
+                        const available = this.#available();
+                        const total = available >= HEADER_LENGTH ? Math.floor((available - HEADER_LENGTH) / ENTRY_LENGTH) : 0;
+                        const entries = [];
+                        for (let i = 0; i < total; i++) {
+                            const base = HEADER_LENGTH + i * ENTRY_LENGTH;
+                            entries.push({
+                                addressFamily: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base, 2)),
+                                routeTag: (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(base + 2, 2)),
+                                ipAddress: (0, BufferToIP_1.BufferToIPv4)(this.readBytes(base + 4, 4)),
+                                subnetMask: (0, BufferToIP_1.BufferToIPv4)(this.readBytes(base + 8, 4)),
+                                nextHop: (0, BufferToIP_1.BufferToIPv4)(this.readBytes(base + 12, 4)),
+                                metric: (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(base + 16, 4))
+                            });
+                        }
+                        this.instance.entries.setValue(entries);
+                    },
+                    encode: function () {
+                        const entries = this.instance.entries.getValue();
+                        if (!Array.isArray(entries))
+                            return;
+                        entries.forEach((entry, index) => {
+                            const base = HEADER_LENGTH + index * ENTRY_LENGTH;
+                            this.writeBytes(base, (0, NumberToBuffer_1.UInt16ToBuffer)(entry.addressFamily ? entry.addressFamily : 0));
+                            this.writeBytes(base + 2, (0, NumberToBuffer_1.UInt16ToBuffer)(entry.routeTag ? entry.routeTag : 0));
+                            this.writeBytes(base + 4, (0, IPToBuffer_1.IPv4ToBuffer)(entry.ipAddress ? entry.ipAddress : '0.0.0.0'));
+                            this.writeBytes(base + 8, (0, IPToBuffer_1.IPv4ToBuffer)(entry.subnetMask ? entry.subnetMask : '0.0.0.0'));
+                            this.writeBytes(base + 12, (0, IPToBuffer_1.IPv4ToBuffer)(entry.nextHop ? entry.nextHop : '0.0.0.0'));
+                            this.writeBytes(base + 16, (0, NumberToBuffer_1.UInt32ToBuffer)(entry.metric ? entry.metric : 0));
+                        });
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        //Require the whole 4-byte header and the RIPv2 signature: version (=2) and a defined command
+        //(1 = request, 2 = response — the only commands RFC 2453 defines).
+        if (this.#available() < HEADER_LENGTH)
+            return false;
+        const command = (0, BufferToNumber_1.BufferToUInt8)(this.packet.subarray(this.startPos, this.startPos + 1));
+        const version = (0, BufferToNumber_1.BufferToUInt8)(this.packet.subarray(this.startPos + 1, this.startPos + 2));
+        return version === 2 && (command === 1 || command === 2);
+    }
+}
+exports.RIP = RIP;

package/dist/headers/RIPng.d.ts

@@ -0,0 +1,26 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * RIPng — RIP for IPv6 (RFC 2080), carried over UDP port 521 (the RIPng process address ff02::9). A
+ * RIPng message is a 4-byte fixed header — Command (1 Request, 2 Response), Version (= 1) and a 2-byte
+ * reserved field (kept verbatim) — followed by zero or more 20-byte Route Table Entries (RTEs). Each
+ * RTE is an IPv6 Prefix (16 bytes), a Route Tag (2 bytes), a Prefix Length (1 byte) and a Metric
+ * (1 byte). An RTE with Metric 255 and Prefix Length 0 is a Next Hop RTE (RFC 2080 §2.1.1) carrying the
+ * next-hop address for the RTEs that follow it; it is carried structurally like any other RTE.
+ *
+ * The message has no length field of its own — the RTE array runs to the end of the UDP payload
+ * (udp.length - 8), which bounds the walk so retained Ethernet padding / trailing bytes are not
+ * absorbed. The IPv6 Prefix is kept verbatim as a lower-case hex string so any prefix (including a
+ * zero prefix, or a next-hop address) round-trips byte-for-byte. RIPng is a leaf — nothing rides on it.
+ */
+export declare class RIPng extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}