@netkitty/codec 1.0.0

package/dist/headers/TLS_Heartbeat.d.ts

@@ -0,0 +1,27 @@
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { BaseHeader } from '../abstracts/BaseHeader';
+/**
+ * TLS Heartbeat protocol (RFC 6520) — a TLS/SSL record carrying a heartbeat, over TCP (heuristically, port
+ * 443). This codec decodes the 5-octet TLS record header plus the HeartbeatMessage: an 8-bit Content Type
+ * (`contentType`, offset 0, = 24 / 0x18 for Heartbeat), a 16-bit legacy Version (`version`, offset 1,
+ * mapped to the labels SSL3.0 / TLS1.0 / TLS1.1 / TLS1.2 / TLS1.3 for 0x0300-0x0304, else 0), a 16-bit
+ * record Length (`length`, offset 3), then the HeartbeatMessageType (`heartbeatType`, offset 5; 1
+ * HeartbeatRequest, 2 HeartbeatResponse, else the numeric value), a 16-bit Payload Length (`payloadLength`,
+ * offset 6), the payload (`payloadMessage`, offset 8, `payloadLength` octets, kept verbatim as hex) and
+ * the trailing random Padding (`padding`, hex).
+ *
+ * Per RFC 6520 §4 the padding is at least 16 octets and fills the record after the type and payload, so its
+ * length is derived as recordLength - 3 - payloadLength and preserved for a byte-exact re-encode. The
+ * payload and padding are kept verbatim and lengths are honored as given, so a well-formed record
+ * round-trips byte-for-byte. In the heuristic chain (`heuristicFallback`), match() requires a Content Type
+ * of 0x18 and a recognized legacy Version (0x0300-0x0304).
+ */
+export declare class TLS_Heartbeat extends BaseHeader {
+    SCHEMA: ProtocolJSONSchema;
+    id: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    name: string;
+    nickname: string;
+    match(): boolean;
+}

package/dist/headers/TLS_Heartbeat.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TLS_Heartbeat = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+var TLSver;
+(function (TLSver) {
+    TLSver["SSL_3_0"] = "SSL3.0";
+    TLSver["TLS_1_0"] = "TLS1.0";
+    TLSver["TLS_1_1"] = "TLS1.1";
+    TLSver["TLS_1_2"] = "TLS1.2";
+    TLSver["TLS_1_3"] = "TLS1.3";
+})(TLSver || (TLSver = {}));
+/**
+ * TLS Heartbeat protocol (RFC 6520) — a TLS/SSL record carrying a heartbeat, over TCP (heuristically, port
+ * 443). This codec decodes the 5-octet TLS record header plus the HeartbeatMessage: an 8-bit Content Type
+ * (`contentType`, offset 0, = 24 / 0x18 for Heartbeat), a 16-bit legacy Version (`version`, offset 1,
+ * mapped to the labels SSL3.0 / TLS1.0 / TLS1.1 / TLS1.2 / TLS1.3 for 0x0300-0x0304, else 0), a 16-bit
+ * record Length (`length`, offset 3), then the HeartbeatMessageType (`heartbeatType`, offset 5; 1
+ * HeartbeatRequest, 2 HeartbeatResponse, else the numeric value), a 16-bit Payload Length (`payloadLength`,
+ * offset 6), the payload (`payloadMessage`, offset 8, `payloadLength` octets, kept verbatim as hex) and
+ * the trailing random Padding (`padding`, hex).
+ *
+ * Per RFC 6520 §4 the padding is at least 16 octets and fills the record after the type and payload, so its
+ * length is derived as recordLength - 3 - payloadLength and preserved for a byte-exact re-encode. The
+ * payload and padding are kept verbatim and lengths are honored as given, so a well-formed record
+ * round-trips byte-for-byte. In the heuristic chain (`heuristicFallback`), match() requires a Content Type
+ * of 0x18 and a recognized legacy Version (0x0300-0x0304).
+ */
+class TLS_Heartbeat extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.SCHEMA = {
+            type: 'object',
+            properties: {
+                contentType: {
+                    type: 'integer',
+                    label: 'Content Type',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: () => {
+                        this.instance.contentType.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1)));
+                    },
+                    encode: () => {
+                        const contentType = this.instance.contentType.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt8ToBuffer)(contentType));
+                    }
+                },
+                version: {
+                    type: 'string',
+                    label: 'Version',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: () => {
+                        const version = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(1, 2));
+                        switch (version) {
+                            case 768:
+                                {
+                                    this.instance.version.setValue(TLSver.SSL_3_0);
+                                }
+                                break;
+                            case 769:
+                                {
+                                    this.instance.version.setValue(TLSver.TLS_1_0);
+                                }
+                                break;
+                            case 770:
+                                {
+                                    this.instance.version.setValue(TLSver.TLS_1_1);
+                                }
+                                break;
+                            case 771:
+                                {
+                                    this.instance.version.setValue(TLSver.TLS_1_2);
+                                }
+                                break;
+                            case 772:
+                                {
+                                    this.instance.version.setValue(TLSver.TLS_1_3);
+                                }
+                                break;
+                            default: {
+                                this.instance.version.setValue(0);
+                            }
+                        }
+                    },
+                    encode: () => {
+                        const version = this.instance.version.getValue('0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        switch (version) {
+                            case TLSver.SSL_3_0:
+                                {
+                                    this.writeBytes(1, (0, NumberToBuffer_1.UInt16ToBuffer)(768));
+                                }
+                                break;
+                            case TLSver.TLS_1_0:
+                                {
+                                    this.writeBytes(1, (0, NumberToBuffer_1.UInt16ToBuffer)(769));
+                                }
+                                break;
+                            case TLSver.TLS_1_1:
+                                {
+                                    this.writeBytes(1, (0, NumberToBuffer_1.UInt16ToBuffer)(770));
+                                }
+                                break;
+                            case TLSver.TLS_1_2:
+                                {
+                                    this.writeBytes(1, (0, NumberToBuffer_1.UInt16ToBuffer)(771));
+                                }
+                                break;
+                            case TLSver.TLS_1_3:
+                                {
+                                    this.writeBytes(1, (0, NumberToBuffer_1.UInt16ToBuffer)(772));
+                                }
+                                break;
+                            default: {
+                                this.writeBytes(1, (0, NumberToBuffer_1.UInt16ToBuffer)(0));
+                            }
+                        }
+                    }
+                },
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: () => {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(3, 2)));
+                    },
+                    encode: () => {
+                        const length = this.instance.length.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.writeBytes(3, (0, NumberToBuffer_1.UInt16ToBuffer)(length));
+                    }
+                },
+                heartbeatType: {
+                    type: 'string',
+                    label: 'Heartbeat Type',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: () => {
+                        const heartbeatType = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(5, 1));
+                        switch (heartbeatType) {
+                            case 1:
+                                {
+                                    this.instance.heartbeatType.setValue('HeartbeatRequest');
+                                }
+                                break;
+                            case 2:
+                                {
+                                    this.instance.heartbeatType.setValue('HeartbeatResponse');
+                                }
+                                break;
+                            default: {
+                                this.instance.heartbeatType.setValue(heartbeatType);
+                            }
+                        }
+                    },
+                    encode: () => {
+                        const heartbeatType = this.instance.heartbeatType.getValue('0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        switch (heartbeatType) {
+                            case 'HeartbeatRequest':
+                                {
+                                    this.writeBytes(5, (0, NumberToBuffer_1.UInt8ToBuffer)(1));
+                                }
+                                break;
+                            case 'HeartbeatResponse':
+                                {
+                                    this.writeBytes(5, (0, NumberToBuffer_1.UInt8ToBuffer)(2));
+                                }
+                                break;
+                            default: {
+                                const heartbeatType1 = parseInt(heartbeatType);
+                                this.writeBytes(5, (0, NumberToBuffer_1.UInt8ToBuffer)(heartbeatType1));
+                            }
+                        }
+                    }
+                },
+                payloadLength: {
+                    type: 'integer',
+                    label: 'Payload Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: () => {
+                        this.instance.payloadLength.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(6, 2)));
+                    },
+                    encode: () => {
+                        const payloadLength = this.instance.payloadLength.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.writeBytes(6, (0, NumberToBuffer_1.UInt16ToBuffer)(payloadLength));
+                    }
+                },
+                payloadMessage: {
+                    type: 'string',
+                    label: 'Payload Message',
+                    decode: () => {
+                        const payloadLength = this.instance.payloadLength.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        const payloadMessage = (0, BufferToHex_1.BufferToHex)(this.readBytes(8, payloadLength));
+                        this.instance.payloadMessage.setValue(payloadMessage);
+                    },
+                    encode: () => {
+                        const payloadMessage = this.instance.payloadMessage.getValue('0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(payloadMessage));
+                    }
+                },
+                padding: {
+                    type: 'string',
+                    contentEncoding: 'hex',
+                    label: 'Padding',
+                    //RFC 6520 §4: HeartbeatMessage ends with random padding of at least 16 octets.
+                    //It fills the record after type(1)+payload_length(2)+payload, i.e.
+                    //paddingLength = recordLength - 3 - payloadLength. Preserving it is required both
+                    //for a faithful decode view and for a byte-exact re-encode.
+                    decode: () => {
+                        const recordLength = this.instance.length.getValue(0);
+                        const payloadLength = this.instance.payloadLength.getValue(0);
+                        const paddingLength = recordLength - 3 - payloadLength;
+                        if (paddingLength <= 0)
+                            return;
+                        this.instance.padding.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(8 + payloadLength, paddingLength)));
+                    },
+                    encode: () => {
+                        if (this.instance.padding.isUndefined())
+                            return;
+                        const payloadLength = this.instance.payloadLength.getValue(0);
+                        this.writeBytes(8 + payloadLength, (0, HexToBuffer_1.HexToBuffer)(this.instance.padding.getValue('')));
+                    }
+                }
+            }
+        };
+        this.id = 'tls-heartbeat';
+        this.matchKeys = ['tcpport:443'];
+        this.heuristicFallback = true;
+        this.name = 'Transport Layer Security(Heartbeat Protocol)';
+        this.nickname = 'TLS-Heartbeat';
+    }
+    match() {
+        if (!this.prevCodecModule)
+            return false;
+        if ((0, BufferToHex_1.BufferToHex)(this.readBytes(0, 1)) != '18')
+            return false;
+        const version = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(1, 2));
+        const validVersions = [768, 769, 770, 771, 772];
+        return validVersions.includes(version);
+    }
+}
+exports.TLS_Heartbeat = TLS_Heartbeat;

package/dist/headers/TPKT.d.ts

@@ -0,0 +1,26 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * TPKT — the RFC 1006 "ISO Transport Service on top of TCP" packetization layer, TCP port 102. It is the
+ * bottom of the IEC 61850 MMS / substation ISO stack: a fixed 4-byte header — Version (always 3), a
+ * Reserved byte (usually 0), and a 2-byte big-endian Length — precedes the COTP TPDU (and above it the
+ * ISO Session / Presentation / ACSE / MMS layers). The Length counts the WHOLE TPKT PDU, the 4-byte header
+ * included, so `Length − 4` bytes of COTP-and-above follow.
+ *
+ * TPKT is not a leaf: it decodes only its 4 bytes (headerLength = 4) and the codec dispatches COTP next
+ * (COTP is an unkeyed content-heuristic child gated on prev.id === 'tpkt'). The Length is honoured verbatim
+ * when supplied — a crafted packet may carry any Length, which we reproduce faithfully — otherwise it is
+ * derived at packet-post-encode time from this layer plus everything stacked above it (COTP + session/MMS),
+ * mirroring how UDP derives its own Length. A well-formed frame round-trips byte-for-byte.
+ */
+export declare class TPKT extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/TPKT.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TPKT = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+/**
+ * TPKT — the RFC 1006 "ISO Transport Service on top of TCP" packetization layer, TCP port 102. It is the
+ * bottom of the IEC 61850 MMS / substation ISO stack: a fixed 4-byte header — Version (always 3), a
+ * Reserved byte (usually 0), and a 2-byte big-endian Length — precedes the COTP TPDU (and above it the
+ * ISO Session / Presentation / ACSE / MMS layers). The Length counts the WHOLE TPKT PDU, the 4-byte header
+ * included, so `Length − 4` bytes of COTP-and-above follow.
+ *
+ * TPKT is not a leaf: it decodes only its 4 bytes (headerLength = 4) and the codec dispatches COTP next
+ * (COTP is an unkeyed content-heuristic child gated on prev.id === 'tpkt'). The Length is honoured verbatim
+ * when supplied — a crafted packet may carry any Length, which we reproduce faithfully — otherwise it is
+ * derived at packet-post-encode time from this layer plus everything stacked above it (COTP + session/MMS),
+ * mirroring how UDP derives its own Length. A well-formed frame round-trips byte-for-byte.
+ */
+class TPKT extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'tpkt';
+        this.name = 'TPKT';
+        this.nickname = 'TPKT';
+        //TPKT rides on TCP port 102 (ISO-on-TCP / MMS / S7) and 3389 (RDP, which layers X.224 over TPKT).
+        this.matchKeys = ['tcpport:102', 'tcpport:3389'];
+        //Not a leaf, but it exposes no demux value: the codec routes COTP as an unkeyed content-heuristic
+        //child that matches on prev.id === 'tpkt'.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (TPKT.#schemaCache ??= TPKT.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'TPKT v${version} len=${length}',
+            properties: {
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                reserved: this.fieldUInt('reserved', 1, 1, 'Reserved'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //The Length counts the entire TPKT PDU (the 4-byte header + the COTP-and-above
+                        //bytes). Honour it verbatim when supplied (a crafted frame may lie); otherwise
+                        //derive it after every layer has encoded, summing this header plus all layers
+                        //stacked on top of it — the same approach UDP uses for its length.
+                        const length = this.instance.length.getValue(0);
+                        if (length) {
+                            this.instance.length.setValue(length);
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(length));
+                        }
+                        else {
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(0));
+                            this.addPostPacketEncodeHandler(() => {
+                                let startCount = false;
+                                let total = 0;
+                                this.codecModules.forEach((codecModule) => {
+                                    if (codecModule === this)
+                                        startCount = true;
+                                    if (startCount)
+                                        total += codecModule.length;
+                                });
+                                //The Length is a 16-bit field; a total beyond 65535 cannot be represented.
+                                //Clamp and record rather than silently wrapping (mirrors the Ajv guard on
+                                //the honored path). A real TPKT PDU physically cannot exceed 65535, so this
+                                //only guards crafted over-length stacks.
+                                if (total > 65535) {
+                                    this.recordError(this.instance.length.getPath(), 'Maximum value is 65535');
+                                    total = 65535;
+                                }
+                                this.instance.length.setValue(total);
+                                this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(total));
+                            }, 1);
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Selected via the tcpport:102 / tcpport:3389 buckets. Require the full 4-byte header and the
+        //Version == 3 content signature so non-TPKT traffic on those ports falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 4)
+            return false;
+        return this.readBytes(0, 1, true)[0] === 3;
+    }
+}
+exports.TPKT = TPKT;

package/dist/headers/TacacsPlus.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * TACACS+ — Terminal Access Controller Access-Control System Plus (RFC 8907), a Cisco AAA protocol on
+ * TCP port 49. Every packet begins with a 12-byte big-endian header: a Version octet split into a
+ * major (high nibble, 0xc for TACACS+) and minor (low nibble) version, a Type (1 Authentication,
+ * 2 Authorization, 3 Accounting), a Sequence Number, a Flags octet (bit0 UNENCRYPTED_FLAG,
+ * bit2 SINGLE_CONNECT_FLAG), a 32-bit Session Id, and a 32-bit Length counting the body that follows.
+ *
+ * The body is almost always obfuscated (XOR-encrypted with the shared secret and a hash of the header
+ * fields), and recovering it is cross-packet, key-dependent state — so this single-packet codec keeps
+ * the body verbatim as `body` hex and does not sub-decode it. The Length is auto-computed from the body
+ * on encode when not supplied, else honored verbatim (a crafted packet may lie); the body is bounded by
+ * the Length-derived extent and the captured bytes, so a pipelined/trailing packet is left to RawData.
+ * A well-formed packet round-trips byte-for-byte.
+ */
+export declare class TacacsPlus extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/TacacsPlus.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TacacsPlus = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * TACACS+ — Terminal Access Controller Access-Control System Plus (RFC 8907), a Cisco AAA protocol on
+ * TCP port 49. Every packet begins with a 12-byte big-endian header: a Version octet split into a
+ * major (high nibble, 0xc for TACACS+) and minor (low nibble) version, a Type (1 Authentication,
+ * 2 Authorization, 3 Accounting), a Sequence Number, a Flags octet (bit0 UNENCRYPTED_FLAG,
+ * bit2 SINGLE_CONNECT_FLAG), a 32-bit Session Id, and a 32-bit Length counting the body that follows.
+ *
+ * The body is almost always obfuscated (XOR-encrypted with the shared secret and a hash of the header
+ * fields), and recovering it is cross-packet, key-dependent state — so this single-packet codec keeps
+ * the body verbatim as `body` hex and does not sub-decode it. The Length is auto-computed from the body
+ * on encode when not supplied, else honored verbatim (a crafted packet may lie); the body is bounded by
+ * the Length-derived extent and the captured bytes, so a pipelined/trailing packet is left to RawData.
+ * A well-formed packet round-trips byte-for-byte.
+ */
+class TacacsPlus extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'tacacs';
+        this.name = 'TACACS+';
+        this.nickname = 'TACACS+';
+        this.matchKeys = ['tcpport:49'];
+        //A leaf header — the body is usually encrypted and is kept as hex, not demuxed further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (TacacsPlus.#schemaCache ??= TacacsPlus.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'TACACS+ type=${type} session=${sessionId}',
+            properties: {
+                //Version octet (byte 0, MSB first): major version (high nibble) + minor version (low nibble).
+                version: {
+                    type: 'object',
+                    label: 'Version',
+                    properties: {
+                        major: {
+                            type: 'integer',
+                            label: 'Major Version',
+                            minimum: 0,
+                            maximum: 15,
+                            decode: function () { this.instance.version.major.setValue(this.readBits(0, 1, 0, 4)); },
+                            encode: function () { this.writeBits(0, 1, 0, 4, this.instance.version.major.getValue(0)); }
+                        },
+                        minor: {
+                            type: 'integer',
+                            label: 'Minor Version',
+                            minimum: 0,
+                            maximum: 15,
+                            decode: function () { this.instance.version.minor.setValue(this.readBits(0, 1, 4, 4)); },
+                            encode: function () { this.writeBits(0, 1, 4, 4, this.instance.version.minor.getValue(0)); }
+                        }
+                    }
+                },
+                type: this.fieldUInt('type', 1, 1, 'Type'),
+                seqNo: this.fieldUInt('seqNo', 2, 1, 'Sequence Number'),
+                flags: this.fieldUInt('flags', 3, 1, 'Flags'),
+                sessionId: this.fieldUInt('sessionId', 4, 4, 'Session Id'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(8, 4)));
+                    },
+                    encode: function () {
+                        //Length counts only the body that follows the 12-byte header. Honored when supplied
+                        //(a crafted packet may lie); else derived from the body. TACACS+ is big-endian, so
+                        //UInt32ToBuffer (BE) is used directly — no hand little-endian assembly.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(8, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //The body after the 12-byte header, kept verbatim (usually encrypted). Bounded by the
+                //Length field (the packet ends at offset 12 + Length) and the captured bytes, so trailing
+                //or pipelined data is not absorbed.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = 12 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 12 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(12, end - 12)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(12, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //TACACS+ rides on TCP port 49. Require the 12-byte header and the 0xc major-version nibble (the
+        //TACACS+ signature) so non-TACACS+ port-49 traffic falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 12)
+            return false;
+        const byte0 = this.readBytes(0, 1, true)[0];
+        return (byte0 >> 4) === 0xc;
+    }
+}
+exports.TacacsPlus = TacacsPlus;

package/dist/headers/Telnet.d.ts

@@ -0,0 +1,40 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Telnet — the Telnet Protocol (RFC 854), carried over TCP well-known port 23. Telnet is a raw byte
+ * stream that interleaves user data with in-band control commands. A command is introduced by the IAC
+ * (Interpret As Command) escape 0xFF and is followed by a command byte:
+ *
+ *   241 NOP · 242 DM · 243 BRK · 244 IP · 245 AO · 246 AYT · 247 EC · 248 EL · 249 GA   (2-byte commands)
+ *   251 WILL · 252 WONT · 253 DO · 254 DONT                                             (3-byte: FF <cmd> <option>)
+ *   250 SB … 240 SE                                                                     (subnegotiation, ends at FF F0)
+ *   255                                                                                 (escaped IAC — a literal 0xFF DATA byte)
+ *
+ * MINIMAL slice (mirrors the SSH/RFB verbatim-message pattern): the connection is a stream with no
+ * per-message framing, so the ENTIRE payload is the single source of truth — decoded verbatim to hex in
+ * the authoritative `message` field and re-emitted byte-for-byte on encode. On top of that, the leading
+ * run of IAC command sequences is parsed into DISPLAY-ONLY metadata: `commands` (an array of
+ * {command, option?}) and `isNegotiation` (true when the payload opens with an IAC byte). Those carry no
+ * codec of their own and never reconstruct the bytes — the message owns them. So any Telnet payload
+ * (option negotiation, subnegotiation, plain data, or a truncated fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Telnet is claimed ONLY on the tcp:23 bucket. Telnet has NO
+ * distinctive off-port content signature — it is an arbitrary byte stream (a leading IAC is common but
+ * optional, and in binary mode the data can be anything), so recognizing it relies entirely on the
+ * well-known port. Joining the global content-heuristic chain would therefore let Telnet mislabel
+ * arbitrary TCP payloads on any port. Confining Telnet to tcp:23 keeps that impossible; alt-port Telnet
+ * is rare and falls losslessly to raw. For the same reason match() deliberately does NOT gate on a
+ * leading IAC or printable text: on the port-23 bucket every payload IS Telnet (including binary-mode
+ * data), so any non-empty payload is kept verbatim rather than dropped to raw.
+ */
+export declare class Telnet extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}