<div dir="ltr"><div><div><div>I'd like to clarify what a "child" is within pluto. Trying to map the V2 spec onto the code is, well, confusing. Here's why:<br><br><br>- ``IKE is a component of IPsec used for performing mutual
authentication and establishing and maintaining Security Associations
(SAs)''<br><br></div><div>lets look for "security association", since it needs to contain lots of crypto stuff it should be easy to find. Ah, there's this thing called "state".<br><br></div><div>So the "state" object is used for the Security Association. Strange name, but lets work with it ....<br></div><div><br><br>- ``The CREATE_CHILD_SA exchange is used to create new Child SAs and to
rekey both IKE SAs and Child SAs.''<br><br></div><div>"child" should be easy to find and yes, there are parent and child SAs/states.<br><br></div><div>So the state object again corresponds to the Security Association. Presumably the "struct connection" in "struct state" is only used for child SAs.<br><br><br>- ``Communication using IKE always begins with IKE_SA_INIT and IKE_AUTH
exchanges (known in IKEv1 as Phase 1).''<br><br>Lets look for a state machine. Can't miss that. Oh, wait, now we know why "state" is called state.<br><br></div><div>So the "state" object is used for BOTH a Security Association and the IKE(parent) state machine.<br></div><div><br><br>- ``All IKE communications consist of pairs of messages: a request and a
response. The pair is called an "exchange", and is sometimes called
a "request/response pair''<br></div><br></div>Ok, lets look for "exchange" in the code, hmm.... Beyond comments and strings, not much luck. Dig further. Oh, look, "child" state objects are being created when ever there is any sort of exchange and not for establishing child SAs.<br><br>WT.?<br><br></div><div>So we've a single object that contains:<br></div><div><br></div><div>- the IKE(parent) state machine<br></div><div>- Security Association keying material<br></div><div>- local state pertaining to any arbitrary message exchange<br></div><div>- the connection for the child SA<br><br></div><div>So, to my question, what exactly does IS_CHILD(state) mean? It seems to be both:<br><br></div><div>- a child exchange<br></div><div>- a child SA<br><br></div><div>?<br></div><div>Andrew<br></div><div><br><br></div></div>