IKEv2 Child SA: Difference between revisions

From Libreswan
Jump to navigation Jump to search
No edit summary
No edit summary
Line 1: Line 1:
???? Do we need "STATE_" prefix to every state enum?
Renaming IKEv2 States
Renaming IKEv2 States


Line 10: Line 12:
</pre>
</pre>


New child states if a Child SA is negotiated as part of ISAKMP_v2_SA_INIT, aka with Parent SA. During this process also parent advances its state. The following state name may not have entry in smc/svm table. Still they are states????
 
An alternative:
<pre>
STATE_PARENT_I1 -> STATE_IKE_I1
STATE_PARENT_I2 -> STATE_IKE_I2
STATE_PARENT_I3 -> STATE_IKE_I3
 
STATE_PARENT_R1 -> STATE_IKE_R1
STATE_PARENT_R2 -> STATE_IKE_R2
</pre>
 
 
New child states when a Child SA is negotiated as part of ISAKMP_v2_SA_INIT, aka with Parent SA. During this process also parent advances its state. The following state name may not have entry in smc/svm table. Still they are states????
 
<pre>  
<pre>  
V2_CHILD_I1 (If we are initiating as part of parent SA Negotiation. On initiator we duplicate when we get R1 back)
V2_CHILD_I1 (If we are initiating as part of parent SA Negotiation. On initiator we duplicate when we get R1 back)
Line 26: Line 41:
-- expire the parent. Switch to IKE_V2_I3/IKE_V2_R2
-- expire the parent. Switch to IKE_V2_I3/IKE_V2_R2
</pre>
</pre>
V2_CHILD_XXI1
V2_CHILD_I1
V2_CHILD_XXI2
V2_CHILD_I2
V2_CHILD_XXR1
V2_CHILD_R1
V2_CHILD_XXR2
V2_CHILD_R2


When Parent is Re keying using the old parent.
When Parent is Re keying using the old parent.
I guess we duplicate and send new SPI/COOKIES over the old one to negotiate. Newly duplicated parent need a name too
I guess we duplicate and send new SPI/COOKIES over the old one to negotiate. Newly duplicated parent need a name too
<pre>
V2_REKEY_I1
V2_REKEY_I1
V2_REKEY_I2
V2_REKEY_I2
V2_REKEY_R1
V2_REKEY_R1
V2_REKEY_R1
V2_REKEY_R1
 
</pre>
Rekey Child SA over the existing parents.
Rekey Child SA over the existing parents.
<pre>
V2_CHILD_REKEY_I1
V2_CHILD_REKEY_I1
V2_CHILD_REKEY_I2
V2_CHILD_REKEY_I2
V2_CHILD_REKEY_R1
V2_CHILD_REKEY_R1
V2_CHILD_REKEY_R2
V2_CHILD_REKEY_R2
</pre>


Multiple Child SA. It does seems the code support multiple child SA using st_hashchain_next.
Multiple Child SA. It does seems the code support multiple child SA using st_hashchain_next.

Revision as of 22:12, 12 June 2014

???? Do we need "STATE_" prefix to every state enum?

Renaming IKEv2 States

STATE_PARENT_I1 -> IKE_V2_I1
STATE_PARENT_I2 -> IKE_V2_I2
STATE_PARENT_I3 -> IKE_V2_I3

STATE_PARENT_R1 -> IKE_V2_R1
STATE_PARENT_R2 -> IKE_V2_R2 


An alternative:

STATE_PARENT_I1 -> STATE_IKE_I1
STATE_PARENT_I2 -> STATE_IKE_I2
STATE_PARENT_I3 -> STATE_IKE_I3

STATE_PARENT_R1 -> STATE_IKE_R1
STATE_PARENT_R2 -> STATE_IKE_R2 


New child states when a Child SA is negotiated as part of ISAKMP_v2_SA_INIT, aka with Parent SA. During this process also parent advances its state. The following state name may not have entry in smc/svm table. Still they are states????

 
V2_CHILD_I1 (If we are initiating as part of parent SA Negotiation. On initiator we duplicate when we get R1 back)
V2_CHILD_I2
V2_CHILD_R1 
V2_CHILD_R2    

Child states if we create as part of CREATE_CHILD_SA exchange.

-- The Parent SA just stays in I3/R2. 
-- We create/duplicate a state. 
-- Add new keying material etc. 
-- Complete the negotiate. 
-- Inhert the Children from parent
-- expire the parent. Switch to IKE_V2_I3/IKE_V2_R2

V2_CHILD_I1 V2_CHILD_I2 V2_CHILD_R1 V2_CHILD_R2

When Parent is Re keying using the old parent. I guess we duplicate and send new SPI/COOKIES over the old one to negotiate. Newly duplicated parent need a name too

V2_REKEY_I1
V2_REKEY_I2
V2_REKEY_R1
V2_REKEY_R1

Rekey Child SA over the existing parents.

V2_CHILD_REKEY_I1
V2_CHILD_REKEY_I2
V2_CHILD_REKEY_R1
V2_CHILD_REKEY_R2

Multiple Child SA. It does seems the code support multiple child SA using st_hashchain_next.