netdev - Re: [Swan] IPsec PFP support on linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 2 May 2017 10:05:26 -0400
From:   Sowmini Varadhan <sowmini.varadhan@...cle.com>
To:     Paul Wouters <paul@...ats.ca>
Cc:     netdev@...r.kernel.org, herbert@...dor.apana.org.au,
        linux-crypto@...r.kernel.org, swan@...ts.libreswan.org,
        steffen.klassert@...unet.com, borisp@...lanox.com,
        ilant@...lanox.com
Subject: Re: [Swan] IPsec PFP support on linux

On (05/02/17 09:58), Paul Wouters wrote:
>    I think you want to use Opportunistic IPsec, eg see 
>    https://libreswan.org/wiki/HOWTO:_Opportunistic_IPsec

I dont think that what I want is opportunistic ipsec..

taking an extreme example, I can set up the ipsec tunnels with 
esp-null for *.5001 and 5001.* (and that's how I'm able to
trigger quick mode in my experiment).

But I want each 5-tuple to/from 5001 to get its own SPI. That
is not happening in my case. 

If I used OE, I would *never* get a per-5-tuple SPI, right?
(I can give this a try later today but the rfc definition of OE is
not what I have in mind- I really want PFP, not OE).

>    Note that IKEv2 also allows you to define one connection and instantiate
>     a connection based on the trigger packet whose src/dst proto/port are
>    included in the IKEv2 packet as traffic selectors. See RFC7296 and
>    "narrowing".

yes, the rfc's permit this, I'm not sure how to set up my 
SPD for this though.