[Swan-dev] libipsecconf: promote ah= / esp= as desired keywords over phase2alg=

Paul Wouters paul at nohats.ca
Tue Jun 30 00:49:38 UTC 2020


On Mon, 29 Jun 2020, Andrew Cagney wrote:

>>     libipsecconf: promote ah= / esp= as desired keywords over phase2alg=
>>
>>     This is a reversal of what we tried to do in the past. Since IKEv2
>>     does not really talk about phase2 anymore, this term is no longer
>>     favoured.
>
> Ya!

>>     Ideally, phase2=ah|esp would also get renamed, but what word to use?
>>
>>     (type is already used for tunnel|transport, and mode= would be confused
>>      with transport|tunnel mode. And encapsulation=ah would be weird because
>>      there is no encapsulation. And no one wants ah=yes)
>
> Right, mode is either transport or tunnel.
> Encapsulation, however, refers to UDP / TCP.
> (It's really confusing that the E in ESP is also encapsulate).
> The RFC seems to refer to ESP and AH as child SAs (which does make sense).

Child SA is an IKEv2 only term though. So I wouldn't use it here. We
could perhaps use ipsec=ah|esp|wesp|iptfs

> To clarify one thing, does this mean that:
>      ah=sha1
> implies AH?

Currently it does not, because:

   /* attributes of the phase2 policy */
   { "esp",  kv_conn,  kt_string,  KSCF_ESP, NULL, NULL, },
   { "ah",  kv_conn,  kt_string,  KSCF_ESP, NULL, NULL, },
   { "phase2alg",  kv_conn | kv_alias,  kt_string,  KSCF_ESP, NULL, NULL, },     /* obsolete */

It's all KSCF_ESP. So esp= and ah= are actually the same thing.

We could introduce KSCF_AH and make it so, but that complicates thing
with implied defaults (eg system wide crypto policies via conn
%default). I would actually prefer it the other way, I would want to be
able to say:

 	conn %default
 		esp=aes_gcm256,chacha20_poly1305,aes256-sha2_512+sha1+sha2_256,aes_gcm128,aes128-sha1+sha2_256
 		ah=aes_ccm256+sha2_512+sha1+sha2_256

And have:

 	conn my-esp-tunnel
 		phase2alg=esp
 		[...]

 	conn my-ah-link
 		phase2alg=ah
 		[...]

Currently, on RHEL, we have a system wide crypto policy with conn
%default specifying esp= which means that any phase2alg=ah MUST
specify crypto algorithms via ah= or it will fail to load because
it will include ESP algos.

Paul


More information about the Swan-dev mailing list