Module ipsec 

IPSec/IKEv2 parse-and-log honeypot

What this actually is

A read-only IKE honeypot. It binds a UDP socket, parses the 28-byte IKE header and walks the payload chain of every datagram it receives, then reports what it saw. It performs no cryptography, establishes no Security Associations, creates no tunnel interface, and never transmits a single byte back to the peer. Nothing here is a VPN; use WireGuard (src/server/wireguard/) when a working tunnel is required.

Staying silent is deliberate: it avoids accidentally negotiating anything and avoids fingerprinting the honeypot by its responses.

What the LLM controls

Each IKE_SA_INIT / IKE_AUTH (or IKEv1 Identity Protection / Aggressive Mode) datagram raises an ipsec_handshake event through crate::llm::action_helper::call_llm, which runs any configured script/static event handler first and falls back to a real LLM call only when none is configured. The resulting actions are classification and logging decisions only - accept_connection, reject_connection, log_handshake and send_notify all record intent without changing what goes on the wire.

Status

DevelopmentState::Experimental. Turning this into a real IKEv2 responder means implementing SA negotiation, Diffie-Hellman, authentication, ESP and kernel XFRM/SAD/SPD programming - a multi-month project, not a patch. It is deliberately out of scope.

Modules

actions

IPSec/IKEv2 protocol actions implementation

Structs

IpsecServer

IPSec/IKEv2 enhanced honeypot server

Constants

MAX_PACKET_SIZE

Maximum IKE packet size