[IPSEC] RFC 4301 PFP Support

[IPSEC] RFC 4301 PFP Support

[Tyler Hicks]

I'm working on adding populate from packet (PFP) support to the kernel,
as specified in RFC 4301.  While testing with openswan (2.4.9), I
noticed that the state selector values in the SAD were empty.  It seems
that when openswan sends a ALLOCSPI message, the kernel finds the larval
xfrm_state with selector fields filled in and passes it to openswan.
Openswan will then respond with an UPDSA message that includes an
xfrm_usersa_info that has empty selector values.  The kernel assumes
that these selector values are valid and deletes the larval SA and
inserts the new SA containing empty selectors.  We need SAs with valid
selectors in the SAD in order to implement PFP support.

Should we just use the larval selectors or should we assume that
openswan will begin to send valid selectors?  I asked for the openswan
dev's opinions and they referred me to Herbert Xu.  It seems as though
the correct solution would be for openswan to pass valid selectors in
UPDSA messages, even if it is the larval selectors we gave them.

On a side note, Joy Latten has reported to see the same behavior while
using ipsec-tools.

Thanks!

Tyler Hicks

Re: [IPSEC] RFC 4301 PFP Support

[Herbert Xu]

On Tue, Dec 11, 2007 at 01:34:45PM -0800, Tyler Hicks wrote:
>
> Should we just use the larval selectors or should we assume that
> openswan will begin to send valid selectors?  I asked for the openswan
> dev's opinions and they referred me to Herbert Xu.  It seems as though
> the correct solution would be for openswan to pass valid selectors in
> UPDSA messages, even if it is the larval selectors we gave them.

Yes we should patch openswan to generate the correct SA selectors.

With the previous standard SA selectors were redundant due to the
presence of policy selectors.  But with RFC 4301 the KM should
start setting them.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt