frameassembly 1.5.1

A DSL for creating custom .pcap/.pcapng captures and decompiling captures to .fasm for testing firewalls, IDS rules, SNMP traps, and pentesting.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107

//! Layer 3 network-layer, routing, tunneling, and control-plane field parsers for FrameAssembly.
//!
//! This module coordinates syntactic combinators for Layer 3 network headers (`DSCP`, `ECN`,
//! `TTL`, `FLOWLABEL`, `IPID`, `DF`, `MF`, `FRAGOFFSET`, `NEXT_HEADER`) and 19 network-layer,
//! tunneling, security, and routing protocols: `ICMP`, `NDP`, `IGMP`, `MLD`, `GRE`, `VXLAN`,
//! `GENEVE`, `IPSEC`, `ESP`, `AH`, `IKEV2`, `WIREGUARD`, `OSPF`, `BGP`, `RIP`, `VRRP`, `HSRP`,
//! `PIM`, `BFD`, and `OPENFLOW`.

use winnow::ModalResult as PResult;
use winnow::combinator::{alt, cut_err};
use winnow::prelude::*;

use crate::lexer::Token;
use crate::parser::{ParsedField, Stream, parse_u8, parse_u16, parse_u32, tag};

pub(crate) mod ah;
pub(crate) mod bfd;
pub(crate) mod bgp;
pub(crate) mod esp;
pub(crate) mod geneve;
pub(crate) mod gre;
pub(crate) mod hsrp;
pub(crate) mod icmp;
pub(crate) mod igmp;
pub(crate) mod ikev2;
pub(crate) mod ipsec;
pub(crate) mod mld;
pub(crate) mod ndp;
pub(crate) mod openflow;
pub(crate) mod ospf;
pub(crate) mod pim;
pub(crate) mod rip;
pub(crate) mod vrrp;
pub(crate) mod vxlan;
pub(crate) mod wireguard;

pub(crate) use ah::*;
pub(crate) use bfd::*;
pub(crate) use bgp::*;
pub(crate) use esp::*;
pub(crate) use geneve::*;
pub(crate) use gre::*;
pub(crate) use hsrp::*;
pub(crate) use icmp::*;
pub(crate) use igmp::*;
pub(crate) use ikev2::*;
pub(crate) use ipsec::*;
pub(crate) use mld::*;
pub(crate) use ndp::*;
pub(crate) use openflow::*;
pub(crate) use ospf::*;
pub(crate) use pim::*;
pub(crate) use rip::*;
pub(crate) use vrrp::*;
pub(crate) use vxlan::*;
pub(crate) use wireguard::*;

/// Parses a Layer 3 protocol or modifier field from a token stream.
pub(crate) fn parse_l3_field<'i, 'a>(input: &mut Stream<'i, 'a>) -> PResult<ParsedField<'a>> {
    alt((
        alt((
            parse_icmp_field,
            parse_ndp_field,
            parse_igmp_field,
            parse_mld_field,
            parse_gre_field,
            parse_vxlan_field,
            parse_geneve_field,
            parse_ipsec_field,
        )),
        alt((
            parse_esp_field,
            parse_ah_field,
            parse_ikev2_field,
            parse_wireguard_field,
            parse_ospf_field,
            parse_bgp_field,
            parse_rip_field,
            parse_vrrp_field,
        )),
        alt((
            parse_hsrp_field,
            parse_pim_field,
            parse_bfd_field,
            parse_openflow_field,
        )),
        alt((
            (tag(Token::Dscp), cut_err(parse_u32))
                .map(|((_, s), v)| ParsedField::Dscp(v, (s.start, s.end - s.start))),
            (tag(Token::Ecn), cut_err(parse_u32))
                .map(|((_, s), v)| ParsedField::Ecn(v, (s.start, s.end - s.start))),
            (tag(Token::Ttl), cut_err(parse_u32))
                .map(|((_, s), v)| ParsedField::Ttl(v, (s.start, s.end - s.start))),
            (tag(Token::FlowLabel), cut_err(parse_u32))
                .map(|((_, s), v)| ParsedField::FlowLabel(v, (s.start, s.end - s.start))),
            (tag(Token::IpId), cut_err(parse_u16))
                .map(|((_, s), v)| ParsedField::IpId(v, (s.start, s.end - s.start))),
            tag(Token::Df).map(|(_, s)| ParsedField::Df((s.start, s.len()))),
            tag(Token::Mf).map(|(_, s)| ParsedField::Mf((s.start, s.len()))),
            (tag(Token::FragOffset), cut_err(parse_u16))
                .map(|((_, s), v)| ParsedField::FragOffset(v, (s.start, s.end - s.start))),
        )),
        (tag(Token::NextHeader), cut_err(parse_u8))
            .map(|((_, s), v)| ParsedField::NextHeader(v, (s.start, s.end - s.start))),
    ))
    .parse_next(input)
}