netdev - Kernel IPSec Questions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 28 Jul 2011 22:40:15 -0700
From:	T C <tccheung1@...il.com>
To:	netdev@...r.kernel.org
Subject: Kernel IPSec Questions

Hi all,

I have some questions on how IPSec logic works in the kernel.  There might be
a difference between when XFRM was introduced and prior.  If possible,
I like to know both scenarios.  If not, at least from XFRM perspective would
be very helpful.

Specifically, I am interested in knowing how does IPSec obtain the initial keys
from IKE exchange (and likely from XFRM) to set up the SA.   Also what happens
during rekeying?  Does the SA have to be terminated first, or somehow it can be
rekey'ed and continue as the same SA?  I'll be using strongswan for IKE.

Function names and if possible some flow graphs would be greatly appreciated.

Thanks,
Terry
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html