<div dir="ltr">Dear Noel,<div><br><div> Thank you for your reply. I went through the plugin code. </div><div> I see that file kernel_libipsec_router.c is handling the user space plain text packets being written to the tunneling interface.</div><div> line 176 of the above file, would queue the plain text packets for further ESP encryption.</div><div><br></div><div> Any input at what point, the packet is removed from the 'queue_outbound' and processed would be really appreciated.</div><div> <br></div><div> So from what I see, all the ESP encryption/decryption is done on the user space with your implementation of 'src/libipsec' encryption libraries. </div><div>Also kernel-libipsec plugin implementation is from strongswan source and not provided by standard linux kernel on android. Kindly confirm if this understanding is correct..</div><div><br></div><div>Also, is there any option available to disable this.kernel-libipsec in androdi and start using 'ip xfrm'. ?? In my case, I was planning to run charon daemon as a system daemon. </div><div><br></div><div>Thanks,</div><div>Ravikanth</div><div><br></div><div>-------------------------</div><div class="gmail_extra"><span style="font-size:13.5135135650635px">From: </span><b class="gmail_sendername" style="font-size:13.5135135650635px">Noel Kuntze</b><span style="font-size:13.5135135650635px"> </span><span dir="ltr" style="font-size:13.5135135650635px"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">Date: Fri, Dec 12, 2014 at 4:15 PM</span><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">Subject: Re: [strongSwan] data path in strongswan android</span><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">To: </span><a href="mailto:users@lists.strongswan.org" target="_blank" style="font-size:13.5135135650635px">users@lists.strongswan.org</a><br style="font-size:13.5135135650635px"><br style="font-size:13.5135135650635px"><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">-----BEGIN PGP SIGNED MESSAGE-----</span><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">Hash: SHA256</span><br style="font-size:13.5135135650635px"><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">Hello Ravi,</span><br style="font-size:13.5135135650635px"><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">StrongSwan on Android uses a tun device and libipsec to make the tunnel usable and do the en- and decryption</span><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">of esp and espinudp packets. Look at the libipsec code to find out how it does it.</span><br style="font-size:13.5135135650635px"><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">Mit freundlichen Grüßen/Regards,</span><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">Noel Kuntze</span><br style="font-size:13.5135135650635px"><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">GPG Key ID: 0x63EC6658</span><br style="font-size:13.5135135650635px"><span style="font-size:13.5135135650635px">Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658</span><br style="font-size:13.5135135650635px"></div><div class="gmail_extra"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 12, 2014 at 4:10 PM, Ravi Kanth Vanapalli <span dir="ltr"><<a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Dear all,<div><br><div> How is the data path handled by charon daemon in android. Strongswan VPN android can also be installed on the user binary. </div><div><br></div><div>i) How would a user space application without root access, have access to installing kernel rules for doing ESP encryption or decryption. I am assuming strongswan android uses linux 'ip xfrm' for doing encryption/decryption . </div><div><br></div><div>ii) I have a samsung phone. Using Basic VPN I connected to my corporate network. </div><div><br></div><div> I ran the commands 'ip -s xfrm state' and 'ip -s xfrm policy' from adb shell. I see no rules in place.</div><div> Which portion of code handles ESP encryption/decrytpion in android. </div><div> When i capture the pcap traces on all interfaces, I see ESP packets being sent/received. ?</div><div><br></div><div> Does charon perform the ESP encryption/decryption. I see a tunneling interface 'ipsec0' being created in this case.</div><span class=""><font color="#888888"><div> <br></div><div><div><br></div>-- <br><div><div dir="ltr"><div><font color="#666666">Regards,</font></div>
<div><font color="#666666">RaviKanth</font></div><div><br></div></div></div>
</div></font></span></div></div>
</blockquote></div><br clear="all"><div><br></div><div class="gmail_signature"><div dir="ltr"></div></div>
</div></div></div>