<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"> <font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2552" style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Hi ,</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2551" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2550" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2549" face="Calibri">I modified
the strongswan (5.0.4) code to bypass the strongSwan's IPsec Linux kernel
interface. I <span style="mso-spacerun: yes;"> </span>implemented so that, the IPsec
SAs can be inserted and deleted on the active tunnels can be retrieved from the
data plane (NPU) which does the actual ESP encryption and decryption work.</font></span></div><font face="Times New Roman">
</font><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Each IPsec
SA in the Linux kernel has a lifetime configuration consisting of both a soft
and a hard limit for the time. Each time one of the soft or hard limits is
reached, the Linux kernel generates an XFRM_MSG_EXPIRE message to which the Charon
daemon processes as follows</font></span></div><font face="Times New Roman">
</font><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri"> </font></span></div><font face="Times New Roman">
</font><span id="yui_3_16_0_1_1422440215762_2572" style="line-height: 115%; font-size: 12pt;">1. If a soft limit was reached then a
CHILD_SA rekeying job is scheduled</span><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2535" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2548" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2547" face="Calibri"><span style="mso-spacerun: yes;"> </span>job =
(job_t*)rekey_child_sa_job_create(reqid, proto, spi);</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2536" style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri"> </font></span></div><span id="yui_3_16_0_1_1422440215762_2537" style="line-height: 115%; font-size: 12pt;">2. If a hard limit is reached , then the
CHILD_SA is deleted</span><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2543" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2542" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2541" face="Calibri"><span style="mso-spacerun: yes;"> </span>job = (job_t*)delete_child_sa_job_create(reqid,
proto, spi);</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2534" style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri"> </font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2575" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2574" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2573" face="Calibri">Since I have
bypassed the kernel , Can I do the followings in install function (defined in
child_sa.c) for rekeying of Child SA ? </font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2546" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2545" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2544" face="Calibri">u_int64_t
soft_add_expires_seconds = 0;</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2576" style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">job_t *job;</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2579" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2578" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2577" face="Calibri">soft_add_expires_seconds
= lifetime->time.rekey;</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2582" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2581" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2580" face="Calibri">if (soft_add_expires_seconds
> 0)</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2583" style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">{<span style="mso-tab-count: 1;"> </span></font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2586" style="margin: 0in 0in 10pt 0.5in;"><span id="yui_3_16_0_1_1422440215762_2585" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2584" face="Calibri">job =
(job_t*)rekey_child_sa_job_create(this->reqid,proto_ike2ip(this->protocol),
spi);<span style="mso-spacerun: yes;">
</span>lib->scheduler->schedule_job(lib->scheduler,
job,soft_add_expires_seconds * 1000);lib->processor->queue_job(lib->processor,
job);</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2587" style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">}</font></span></div><font face="Times New Roman">
</font><div id="yui_3_16_0_1_1422440215762_2590" style="margin: 0in 0in 10pt;"><span id="yui_3_16_0_1_1422440215762_2589" style="line-height: 115%; font-size: 12pt;"><font id="yui_3_16_0_1_1422440215762_2588" face="Calibri">I think, the
IPsec peer will start the Child SA re-key, when the lifetime hits the value set
in soft_add_expires_seconds. Through the Scheduler it is possible to schedule
jobs for an execution in the future. The Scheduler has internally a heap in
which he stores the scheduled jobs ordered by the time when they have to be
executed. Similarly when if a hard limit is reached, then the CHILD_SA should
be deleted via delete_child_sa_job_create job. </font></span></div><font face="Times New Roman">
</font><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Please feel
free to correct me if I am wrong.</font></span></div><font face="Times New Roman">
</font><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Regards,</font></span></div><font face="Times New Roman">
</font><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Chinmaya</font></span></div><font face="Times New Roman">
</font></div></body></html>