<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello,<br>
<br>
I have recently been doing some tests with an Android tablet version
of<br>
strongSwan. It appears that the Android app uses the
kernel-libipsec<br>
charon plugin to avoid limitations imposed by the app running in a
very<br>
restricted user environment in the tablet. My tablet is not rooted.<br>
<br>
What I am seeing on the tablet is that it uses routing table 60,
creates<br>
interface tun0 and some routing policy database rules. My tablet
will<br>
not let me access the iptables or ip xfrm commands. This is why I <br>
suspect the Android strongSwan app, presumably running in a very<br>
tightly constrained userspace environment, uses the charon <br>
kernel-libipsec plugin. Is there a way to access iptables and ip
xfrm<br>
functionality on a non-rooted tablet?<br>
<br>
Given my assumption above, is it correct that the libipsec plugin<br>
also does SNAT on outgoing encrypted packets? The ip rule<br>
command shows 100: from all fwmark 0x3c lookup 60.<br>
<br>
The kernel netfilter packet flow diagram at [1] documents how<br>
IPSec interacts with the xfrm process for IPSec encapsulation<br>
and decapsulation, and iptables for SNAT. Is there a diagram <br>
somewhere that shows how the charon kernel-libipsec plugin<br>
interacts with diagram [1], please? I sort of expect the charon<br>
plugin operates entirely in the application layer, forward path,<br>
local process, part of this diagram and that it also performs SNAT.<br>
<br>
If not, how does a non-rooted Android tablet that cannot use <br>
iptables to do SNAT and the xfrm process for IPSec processing <br>
operate, please?<br>
<br>
I am not a programmer and have not been able to find much on<br>
the inner workings of the charon plugin.<br>
<br>
[1] <a href="http://inai.de/images/nf-packet-flow.png"
data-saferedirecturl="https://www.google.com/url?hl=en-GB&q=http://inai.de/images/nf-packet-flow.png&source=gmail&ust=1470338224034000&usg=AFQjCNED_qhbmL2k80hkHbuA82MOSrRKVQ"
rel="noreferrer" target="_blank">inai.de/images/nf-packet-flow.<wbr>png</a><br>
<br>
Regards,<br>
Brian<br>
<br>
<br>
<br>
<br>
</body>
</html>