Differences

This shows you the differences between two versions of the page.

--- mywiki:linux:ipsec [2015/12/10 12:44] – [Kernel cryptography] super
+++ mywiki:linux:ipsec [2019/09/15 18:55] (current) – external edit 127.0.0.1
@@ Line 1: / Line 1: @@
 **IPSec Implementation in Linux**
+| Reference | {{:mywiki:linux:chapter10_ipsec.pdf| ipsec_xfrm }} |
 ====== IPSEC Basic ======
@@ Line 36: / Line 38: @@
 | XFRM framework | net/ipv4/xfrm4_policy.c and net/ipv6/xfrm6_policy.c |
 | XFRM initialization | xfrm4_init() and xfrm6_init(). |
+===== Kernel Terms =====
+| aalg | **Authentication** algo pointer |
+| ealg | **Encryption** algo pointer |
+| calg | **Compression** algo pointer |
+| aead | **Authentication Encryption** with Associated Data pointer | Note: if (aead == NULL); then only authentication without any encryption |
+| encap | Data for **encapsulator**, ie, for **special UDP** Encapsulation only | draft-ietf-ipsec-udp-encaps-06 |
 ===== Kernel cryptography =====
 | acrypto | asynchronous crypto |
 | cryptd |
@@ Line 204: / Line 215: @@
 }
+</file>
+===== IPSec kernel  APIs =====
+| Xfrm_lookup() | xfrm lookup(SPD and SAD) method |
+| Xfrm_input() | xfrm processing for an ingress packet |
+| Xfrm_output() | xfrm processing for an egress packet |
+| Xfrm4_rcv() | IPv4 specific Rx method |
+| Xfrm6_rcv() | IPv6 specific Rx method |
+| Esp_input() | ESP processing for an ingress packet |
+| Esp_output() | ESP processing for an egress packet |
+| Ah_input() | AH processing for an ingress packet |
+| Ah_output() | AH processing for an egress packet |
+| xfrm_policy_alloc() | allocates an SPD object |
+| Xfrm_policy_destroy() | frees an SPD object |
+| xfrm_ policy_lookup | SPD lookup |
+| xfrm_policy_byid() | SPD lookup based on id |
+| Xfrm_policy_insert() | Add an entry to SPD |
+| Xfrm_Policy_delete() | remove an entry from SPD |
+| Xfrm_bundle_create() | creates a xfrm bundle |
+| Xfrm_policy_delete() | releases the resources of a policy object |
+| Xfrm_state_add() | add an entry to SAD |
+| Xfrm_state_delete() | free and SAD object |
+| xfrm_state_alloc() | allocate an SAD object |
+| xfrm_state_lookup_byaddr() | src address based SAD lookup |
+| xfrm_state_find() | SAD look up based on dst |
+| xfrm_state_lookup() | SAD lookup based on spi |
+===== IPSec SA initialize =====
+It is initialized by API: **static int esp_init_state(struct xfrm_state *x)**, which is defined in file:
+  * net/ipv4/esp4.c
+  * net/ipv6/esp6.c
+===== IPSec Tx steps =====
+<file>
+For better understanding I have divided the IPSec transmission process in 7 stepes as below
+Step-1: Transport_layer_sendmsg()
+Does TCP/UDP specific jobs are done here before going for route lookup
+Step-2: ip_route_output_slow()
+Xfrm_lookup()
+Step-3: ip_local_output()
+Step-4: ip_local_out()
+ LOCAL_OUT netfilter applies here.
+Calls skb->dst->output(), which is xfrm4_output in case of ipv4 and xfrm6_output in the case of ipv6
+Step-5: xfrm4_output/xfrm6_output
+Step-6: esp_output()/ah_output()
+Step-7: ip_output()
+Step-8: dev_queue_xmit()
+Egress QoS comes here.
+Step-9: dev->ndo_start_xmit()
+</file>
+===== IPSec Rx steps =====
+<file>
+For better understanding I have divided the IPSec reception process in 7 stepes, they are below
+Step-1: netif_receive_skb()
+Step-2: ip_rcv()
+Netfilter PRE_ROUTING applies here.
+Step-3: ip_receive_finish
+Calls ip_route_input_noref(). Which finds the route entry and set dst->output for local delivery, forwarding etc. But IPSec applies on the end systems ONLY. So we bothr if it is set for local delivery
+Step-4: ip_local_deliver
+LOCAL_IN Netfilter part here.
+Step-5: ip_local_deliver_finish()
+Based on the protocol field of  ip header (IPPROTO_AH, IPPROTO_ESP),  packet will be given to xfrm4_rcv() function
+Step-6:  xfrm4_rcv()
+Step-7: xfrm_input()
+Calls xfrm_state_lookup()
+calls esp_input()/ah_input()
+Once again applies the PRE_ROUTING Netfilter, but now  for the decapsulated packet
+Step-8: xfrm4_rcv_encap_finish()
+Will do the route lookup again for the decapsulated packet using ip_route_input_noref(). Again route lookup should decide for local_delivery.
+Step-9: ip_local_delivery()
+again the LOCAL_IN Netfilter for decapsulated packet
+now the protocol field will be TCP/UDP and the packet flows in the native reception methods of TCP/UDP and delivers to the socket
+Step-10: transport_layer_rcvmsg()
+-to userspace
 </file>