@netkitty/codec 1.0.0

package/dist/headers/SunRPC.js

@@ -0,0 +1,268 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SunRPC = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * ONC RPC / SunRPC (RFC 5531), the portmapper transport on TCP + UDP port 111. Every RPC message is a
+ * 4-byte XID followed by a 4-byte Message Type (0 CALL, 1 REPLY). A CALL body continues with the RPC
+ * version (== 2), the program number, the program version, the procedure, then the credential and
+ * verifier auth structures (each a 4-byte flavor + 4-byte length + body) and the procedure arguments.
+ * The portmapper program is 100000.
+ *
+ * Transport framing differs by L4 (RFC 5531 §11): over UDP the RPC message is the whole datagram; over
+ * TCP a 4-byte Record Marking prefix precedes it — the high bit is the last-fragment flag and the low 31
+ * bits are the fragment length. This header detects the transport via prevCodecModule.id and structures
+ * accordingly: TCP → recordMark (lastFragment + fragmentLength) then the message at offset 4; UDP → the
+ * message directly at offset 0.
+ *
+ * Byte-perfect strategy (minimal slice): structure the XID and Message Type, and for a CALL the four
+ * fixed program-identity words (rpcVersion / program / programVersion / procedure); the remainder — the
+ * credential, verifier and procedure arguments for a CALL, or the whole REPLY body — is kept verbatim as
+ * `body` hex, bounded by the transport payload (UDP length − 8, or the TCP Record Marking fragment
+ * length). The TCP fragmentLength is honored when supplied (a crafted frame may lie) else derived as the
+ * encoded message length; a well-formed message round-trips byte-for-byte. Trailing / pipelined bytes are
+ * left to the codec's recursion / RawData.
+ */
+class SunRPC extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'sunrpc';
+        this.name = 'ONC RPC';
+        this.nickname = 'SunRPC';
+        //Portmapper ports 111 on both TCP and UDP.
+        this.matchKeys = ['tcpport:111', 'udpport:111'];
+        //A leaf header — the credential / verifier / arguments / REPLY body are kept verbatim for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SunRPC.#schemaCache ??= SunRPC.#buildSchema());
+    }
+    /** True when this RPC message rides on TCP (a 4-byte Record Marking prefix precedes the message). */
+    #isTcp() {
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'tcp';
+    }
+    /** Offset of the RPC message within this header: 4 bytes past startPos for TCP, 0 for UDP. */
+    #messageOffset() {
+        return this.#isTcp() ? 4 : 0;
+    }
+    /**
+     * Header-relative end offset of the bytes this SunRPC layer consumes, so a lying length never reads
+     * past the real transport payload and trailing / pipelined data is left to the codec. Over UDP the
+     * bound is (udp.length − 8); over TCP it is 4 (Record Marking) + the fragment length carried in that
+     * prefix; both clamped to the captured bytes.
+     */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < end)
+                end = udpLength - 8;
+        }
+        else if (prev && prev.id === 'tcp') {
+            const word = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4, true));
+            const fragmentLength = (word & 0x7fffffff) >>> 0;
+            const total = 4 + fragmentLength;
+            if (total < end)
+                end = total;
+        }
+        return end < 0 ? 0 : end;
+    }
+    /** A 4-byte big-endian unsigned integer at the RPC-message offset + `wordOffset`, only for a CALL. */
+    static #callWord(name, wordOffset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 4294967295,
+            decode: function () {
+                if (this.instance.msgType.getValue(0) !== 0)
+                    return;
+                const offset = this.#messageOffset() + wordOffset;
+                if (this.#payloadEnd() < offset + 4)
+                    return;
+                this.instance[name].setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset, 4)));
+            },
+            encode: function () {
+                if (this.instance.msgType.getValue(0) !== 0)
+                    return;
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 4294967295) {
+                    this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                    value = 4294967295;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(this.#messageOffset() + wordOffset, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SunRPC xid=${xid} type=${msgType}',
+            properties: {
+                //==== TCP-only Record Marking prefix (RFC 5531 §11) ====
+                //The 4-byte word's high bit is the last-fragment flag; the low 31 bits are the fragment
+                //length (message bytes that follow). Absent over UDP. The 4-byte word is written together
+                //by fragmentLength (colocated) so the flag and length stay a single field on the wire.
+                lastFragment: {
+                    type: 'boolean',
+                    label: 'Last Fragment',
+                    decode: function () {
+                        if (!this.#isTcp())
+                            return;
+                        this.instance.lastFragment.setValue(!!this.readBits(0, 1, 0, 1));
+                    },
+                    encode: function () {
+                        //Display only; the combined 4-byte word is emitted by fragmentLength below.
+                        if (!this.#isTcp())
+                            return;
+                        this.instance.lastFragment.setValue(!!this.instance.lastFragment.getValue(true));
+                    }
+                },
+                fragmentLength: {
+                    type: 'integer',
+                    label: 'Fragment Length',
+                    minimum: 0,
+                    maximum: 2147483647,
+                    decode: function () {
+                        if (!this.#isTcp())
+                            return;
+                        const word = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4));
+                        this.instance.fragmentLength.setValue((word & 0x7fffffff) >>> 0);
+                    },
+                    encode: function () {
+                        if (!this.#isTcp())
+                            return;
+                        const last = !!this.instance.lastFragment.getValue(true);
+                        const provided = this.instance.fragmentLength.getValue();
+                        if (provided !== undefined && provided !== null) {
+                            //Honored verbatim (a crafted frame may lie about the fragment length).
+                            let value = provided;
+                            if (value > 2147483647) {
+                                this.recordError(this.instance.fragmentLength.getPath(), 'Maximum value is 2147483647');
+                                value = 2147483647;
+                            }
+                            if (value < 0) {
+                                this.recordError(this.instance.fragmentLength.getPath(), 'Minimum value is 0');
+                                value = 0;
+                            }
+                            this.instance.fragmentLength.setValue(value);
+                            this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(((last ? 0x80000000 : 0) + value) >>> 0));
+                        }
+                        else {
+                            //Derive after the message bytes are written: the fragment length counts exactly
+                            //the RPC message (everything after this 4-byte prefix).
+                            this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(last ? 0x80000000 : 0));
+                            this.addPostSelfEncodeHandler(() => {
+                                const messageLength = this.headerLength - 4;
+                                const value = messageLength > 0 ? messageLength : 0;
+                                this.instance.fragmentLength.setValue(value);
+                                this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(((last ? 0x80000000 : 0) + value) >>> 0));
+                            }, 0);
+                        }
+                    }
+                },
+                //==== RPC message (RFC 5531 §9) ====
+                //The transaction id — an opaque 4-byte value a caller matches its REPLY to, kept as hex.
+                xid: {
+                    type: 'string',
+                    label: 'XID',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const offset = this.#messageOffset();
+                        if (this.#payloadEnd() < offset + 4)
+                            return;
+                        this.instance.xid.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(offset, 4)));
+                    },
+                    encode: function () {
+                        this.writeBytes(this.#messageOffset(), (0, HexToBuffer_1.HexToBuffer)(this.instance.xid.getValue('00000000')));
+                    }
+                },
+                //0 = CALL, 1 = REPLY. Drives whether the fixed CALL identity words are structured below.
+                msgType: {
+                    type: 'integer',
+                    label: 'Message Type',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        const offset = this.#messageOffset() + 4;
+                        if (this.#payloadEnd() < offset + 4)
+                            return;
+                        this.instance.msgType.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset, 4)));
+                    },
+                    encode: function () {
+                        const node = this.instance.msgType;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 4294967295) {
+                            this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(this.#messageOffset() + 4, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //==== CALL identity (RFC 5531 §9, decoded only for msgType == 0) ====
+                rpcVersion: this.#callWord('rpcVersion', 8, 'RPC Version'),
+                program: this.#callWord('program', 12, 'Program'),
+                programVersion: this.#callWord('programVersion', 16, 'Program Version'),
+                procedure: this.#callWord('procedure', 20, 'Procedure'),
+                //The remainder kept verbatim: for a CALL the credential + verifier + procedure arguments
+                //(from message offset 24); for a REPLY / other the whole body (from message offset 8).
+                //Bounded by #payloadEnd so a lying length can't read past the transport payload.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const isCall = this.instance.msgType.getValue(0) === 0;
+                        const start = this.#messageOffset() + (isCall ? 24 : 8);
+                        const end = this.#payloadEnd();
+                        this.instance.body.setValue(end > start ? (0, BufferToHex_1.BufferToHex)(this.readBytes(start, end - start)) : '');
+                    },
+                    encode: function () {
+                        const isCall = this.instance.msgType.getValue(0) === 0;
+                        const start = this.#messageOffset() + (isCall ? 24 : 8);
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(start, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //SunRPC rides UDP/TCP port 111 (selected via the udpport:111 / tcpport:111 buckets). This stays a
+        //port-bucket protocol: matchKeys only, NO heuristicFallback — the signature (XID + a Message Type
+        //of 0 or 1) is too weak to claim RPC off port 111, and non-RPC traffic on 111 must fall through to
+        //raw. Over TCP the message sits after the 4-byte Record Marking prefix; over UDP it is the first
+        //byte. Require the fixed XID + Message Type within the transport payload and a valid Message Type.
+        if (!this.prevCodecModule)
+            return false;
+        const isTcp = this.prevCodecModule.id === 'tcp';
+        const isUdp = this.prevCodecModule.id === 'udp';
+        if (!isTcp && !isUdp)
+            return false;
+        const offset = isTcp ? 4 : 0;
+        if (this.#payloadEnd() < offset + 8)
+            return false;
+        const msgType = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset + 4, 4, true));
+        return msgType === 0 || msgType === 1;
+    }
+}
+exports.SunRPC = SunRPC;

package/dist/headers/Syslog.d.ts

@@ -0,0 +1,21 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Syslog — the BSD/IETF system logging protocol (RFC 3164 / RFC 5424) carried over UDP port 514. A
+ * message is text: an optional priority value `<PRI>` (a decimal number in angle brackets, where
+ * PRI = facility*8 + severity) followed by the message body. The body's internal structure differs
+ * between RFC 3164 (loose: timestamp + host + tag + text) and RFC 5424 (version + timestamp + host +
+ * app + procid + msgid + structured-data + msg), so it is kept verbatim as `message` — byte-perfect
+ * for either format — with only the PRI split into the facility/severity it encodes (for display).
+ */
+export declare class Syslog extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Syslog.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Syslog = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+/**
+ * Syslog — the BSD/IETF system logging protocol (RFC 3164 / RFC 5424) carried over UDP port 514. A
+ * message is text: an optional priority value `<PRI>` (a decimal number in angle brackets, where
+ * PRI = facility*8 + severity) followed by the message body. The body's internal structure differs
+ * between RFC 3164 (loose: timestamp + host + tag + text) and RFC 5424 (version + timestamp + host +
+ * app + procid + msgid + structured-data + msg), so it is kept verbatim as `message` — byte-perfect
+ * for either format — with only the PRI split into the facility/severity it encodes (for display).
+ */
+class Syslog extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'syslog';
+        this.name = 'Syslog';
+        this.nickname = 'Syslog';
+        this.matchKeys = ['udpport:514'];
+        //A leaf header — nothing demuxes above Syslog.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Syslog.#schemaCache ??= Syslog.#buildSchema());
+    }
+    /** The payload text bounded by the UDP datagram length (so a retained FCS/padding is not absorbed). */
+    #payloadText() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        if (available <= 0)
+            return '';
+        return this.readBytes(0, available).toString('latin1');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Syslog <${pri}> ${message}',
+            properties: {
+                //The whole text message is parsed/emitted here; the fields below carry schema metadata.
+                //`pri` is present only when the message begins with a well-formed <PRI>.
+                pri: {
+                    type: 'integer',
+                    label: 'Priority',
+                    minimum: 0,
+                    maximum: 191,
+                    decode: function () {
+                        const text = this.#payloadText();
+                        const match = text.match(/^<(\d{1,3})>([\s\S]*)$/);
+                        //A well-formed PRI is 0..191 with no leading zeros (RFC 5424 §6.2.1). Only split
+                        //it off when it is in range AND its digits re-emit identically (String(n)===text)
+                        //— an out-of-range value ("<999>") or a leading-zero form ("<013>") is not a valid
+                        //PRI, so the whole payload stays the message. That keeps facility/severity within
+                        //their schema bounds and round-trips the exact text verbatim (encode re-emits the
+                        //parsed number, which would otherwise drop leading zeros).
+                        if (match && Number(match[1]) <= 191 && String(Number(match[1])) === match[1]) {
+                            const pri = Number(match[1]);
+                            this.instance.pri.setValue(pri);
+                            this.instance.facility.setValue(pri >> 3);
+                            this.instance.severity.setValue(pri & 0x07);
+                            this.instance.message.setValue(match[2]);
+                        }
+                        else {
+                            //No (valid) priority prefix — keep the whole payload as the message.
+                            this.instance.message.setValue(text);
+                        }
+                    },
+                    encode: function () {
+                        const pri = this.instance.pri.getValue();
+                        const message = this.instance.message.getValue('');
+                        const text = (pri === undefined || pri === null) ? message : `<${pri}>${message}`;
+                        this.writeBytes(0, Buffer.from(text, 'latin1'));
+                    }
+                },
+                //Derived from PRI (display only; encode reconstructs PRI, not these): facility = PRI>>3,
+                //severity = PRI&7.
+                facility: { type: 'integer', label: 'Facility', minimum: 0, maximum: 23 },
+                severity: { type: 'integer', label: 'Severity', minimum: 0, maximum: 7 },
+                message: { type: 'string', label: 'Message' }
+            }
+        };
+    }
+    match() {
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'udp';
+    }
+}
+exports.Syslog = Syslog;

package/dist/headers/TCP.d.ts

@@ -0,0 +1,19 @@
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { DemuxProducer } from '../types/DemuxProducer';
+export declare class TCP extends BaseHeader {
+    #private;
+    /**
+     * Calculate TCP Checksum
+     * @param tcpHeaderBuffer
+     * @protected
+     */
+    protected calculateTCPChecksum(tcpHeaderBuffer: Buffer): number;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly matchKeys: string[];
+    readonly demuxProducers: DemuxProducer[];
+    readonly name: string;
+    readonly nickname: string;
+    match(): boolean;
+}