frameassembly 1.5.0

A DSL for creating custom .pcap/.pcapng captures and decompiling captures to .fasm for testing firewalls, IDS rules, SNMP traps, and pentesting.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

//! IPsec security suite (RFC 4303 ESP & RFC 4302 AH) Layer 3 PCAP-to-`.fasm` decompiler facade.
//!
//! This module provides the `IPSEC` Layer 3 decompiler entry point ([`dissect_ipsec`]) for the
//! FrameAssembly PCAP and PCAPNG decompiler, delegating IP protocol `50` (`0x32`) Encapsulating
//! Security Payload frames to [`super::esp::dissect_esp`] while maintaining one-to-one structural
//! symmetry with `src/ast/l3/ipsec.rs`, `src/parser/l3/ipsec.rs`, and `src/builders/l3/ipsec.rs`.
//! Encrypted ciphertext payloads are never decrypted, preserving unencrypted header parameters and
//! residual payload bytes for lossless round-trip compilation.

use crate::reverse::ProtocolDissection;

/// Decompiles an RFC 4303 `IPSEC` / `ESP` packet (`ip_proto == 50`) into a [`ProtocolDissection`].
pub(crate) fn dissect_ipsec(b: &[u8]) -> ProtocolDissection {
    super::esp::dissect_esp(b)
}