Subject: Re: [IPsec] IPSec implementation

From: Nico Williams <[email-masked]>
Date: Wed, 1 Jun 2011 08:44:17 -0500

On Jun 1, 2011 2:23 AM, "Muhammad Nasir Mumtaz Bhutta" <
[email-masked]> wrote:
> i need to change the IPSec functionality, is there any implementation of
IPSec in higher order languages like java, .net (vb, c#, c++) ... it can be
on any platform windows or linux ...
>
> is there any good starting point for linux kernel implementation of
IPSec...

There are IKE (v2) implementations in C++, such as OpenIKEv2.  As for
ESP/AH, those are generally always written to run in kernel mode, thus
rarely in any sort of HLL.

Nico
--

---

From: Paul Koning <[email-masked]>
Date: Wed, 1 Jun 2011 11:22:38 -0400

On Jun 1, 2011, at 9:44 AM, Nico Williams wrote:

> On Jun 1, 2011 2:23 AM, "Muhammad Nasir Mumtaz Bhutta" <[email-masked]> wrote:
> > i need to change the IPSec functionality, is there any implementation of IPSec in higher order languages like java, .net (vb, c#, c++) ... it can be on any platform windows or linux ... 
> >
> > is there any good starting point for linux kernel implementation of IPSec... 
> 
> There are IKE (v2) implementations in C++, such as OpenIKEv2.  As for ESP/AH, those are generally always written to run in kernel mode, thus rarely in any sort of HLL.

I did a kernel ESP implementation for an embedded system (a security gateway router) back around 1999, in C++.  But that was a closed source implementation.

	paul

---

From: Steffen Schulz <[email-masked]>
Date: Thu, 2 Jun 2011 13:06:51 +0200

Hi Muhammad,

> is there any good starting point for linux kernel implementation of

I recently implemented an extension to make IPsec VPNs resilient
against covert channel exploitation(not only TFC by randomization).
We have a paper in submission, but I can send some code snippets to
get you started.

The Linux source code is the best and almost only documentation I found.
Linux implements IPsec in the XFRM subsystem, as a configurable set
of transformation protocols(ESP,AH,IP-Tunnel,...) on packets. The IPsec
SA is then represented as a set of function pointers to these
protocols.

There is some documentation on programming(configuring) XFRM from
userspace but I found no documentation on the actual design on
kernel-side. :-/

However, if you can implement your modification as an IPsec protocol or
a modification of the existing ESP/AH, you are kind of lucky. This is
not very hard to implement and you can use net/ipv4/esp.c as an
example. In struct xfrm_type you can define function pointers for
input and output functions, these are called for each ingress and
egress packet, respectively.

To activate the protocol you have to make it available through the XFRM
configuration layer, but this is mostly copy&paste. I advice to use the
'ip' util from iproute2 as a userspace configuration client.

The packets are held in struct sk_buff, which is complex but reasonably
documented: http://www.skbuff.net/

/steffen