8 releases (breaking)

0.7.0 Sep 13, 2021
0.6.0 Nov 30, 2020
0.5.0 Aug 5, 2019
0.4.1 Jan 30, 2019
0.1.0 Feb 1, 2018

#2556 in Parser implementations

Download history 3335/week @ 2023-11-27 3368/week @ 2023-12-04 2690/week @ 2023-12-11 1539/week @ 2023-12-18 1012/week @ 2023-12-25 1673/week @ 2024-01-01 1942/week @ 2024-01-08 3027/week @ 2024-01-15 2506/week @ 2024-01-22 2544/week @ 2024-01-29 3339/week @ 2024-02-05 3595/week @ 2024-02-12 2837/week @ 2024-02-19 3431/week @ 2024-02-26 2284/week @ 2024-03-04 1025/week @ 2024-03-11

9,647 downloads per month
Used in suricata

MIT/Apache

68KB
1K SLoC

ipsec-parser

License: MIT Apache License 2.0 Build Status

IPsec parsers

This crate contains several parsers using for IPsec: IKEv2, and reading the envelope of ESP encapsulated messages. This parser provides the base functions to read and analyze messages, but does not handle the interpretation of messages.

ESP is supported, but only to read the envelope of the payload.

Encapsulated ESP is supported, to differentiate between IKE and ESP headers.

IKEv2 parser

An IKEv2 (RFC7296) parser, implemented with the nom parser combinator framework.

The code is available on Github and is part of the Rusticata project.

To parse an IKE packet, first read the header using parse_ikev2_header, then use the type from the header to parse the remaining part:

use ipsec_parser::*;
use nom::IResult;

static IKEV2_INIT_RESP: &'static [u8] = include_bytes!("../assets/ike-sa-init-resp.bin");

fn test_ikev2_init_resp() {
    let bytes = IKEV2_INIT_RESP;
    match parse_ikev2_header(&bytes) {
        Ok( (rem, ref hdr) ) => {
            match parse_ikev2_payload_list(rem,hdr.next_payload) {
                Ok( (_, Ok(ref p)) ) => {
                    // p is a list of payloads
                    // first one is always dummy
                    assert!(p.len() > 0);
                    assert_eq!(p[0].content, IkeV2PayloadContent::Dummy);
                    for payload in p {
                        match payload.content {
                            IkeV2PayloadContent::SA(ref sa) => { /* .. */ },
                            _ => ()
                        }
                    }
                },
                e => { eprintln!("Parsing payload failed: {:?}", e); },
            }
        },
        _ => { eprintln!("Parsing header failed"); },
    }
}

Changelog

0.7.0

  • Upgrade to nom 7
  • Set MSRV to 1.46

0.6.0

  • Upgrade to nom 6
  • Convert all macro-based parsers to functions

0.5.0

  • Upgrade to nom 5

0.4.1

  • o not use glob imports in use groups (compatibility with rust 1.24)

0.4.0

  • Upgrade to nom 4

0.3.0

  • Add function parse_ikev2_message to read header and payload list
  • init_spi and resp_spi fields have been changed from &[u8] to u64

Rusticata

This parser is part of the rusticata project. The goal of this project is to provide safe parsers, that can be used in other projects.

Testing of the parser is done manually, and also using unit tests and cargo-fuzz. Please fill a bugreport if you find any issue.

Feel free to contribute: tests, feedback, doc, suggestions (or code) of new parsers etc. are welcome.

License

Licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

Dependencies

~1MB
~18K SLoC