The Libreswan Project

Mentors: Student: Amrinder Singh

The host to host ipsec transport mode works on Linux but does not work on any of the BSDs. The problem is a lack of IKE socket bypass , transport mode policies actually catch IKE traffic itself, which causes problems in establishing and tearing down connections. I will add a socket bypass for all three BSD also the API is different on each one. I will fix the SA mode labeling in the PFKEYv2 backend, add proper teardown and on demand testing to the existing test suite, and make sure everything works as expected on FreeBSD, NetBSD, and OpenBSD.

Mentors: Student: Vinayak Sandur

When an IPsec-encrypted packet matches a trap policy in the kernel, the kernel notifies IKE daemon (Pluto) via an ACQUIRE Netlink message. Then Pluto identifies that to which connection does this packet belong to by doing a lookup through all the loaded connections. Currently this is done in O(N) time (scanning through all the connections and the connection with highest priority is choosen). This Project aims to reduce this by using a hashtable to find the connection by using a unqiue id which is passed to the kernel while installing the policy. A complication arises with Opportunistic IPsec. Multiple clones of the same template connection would inherit the same reqid, causing collisions both in the hashtable and in the kernel's SA binding. This is addressed by a global counter that assigns a guaranteed unique reqid to each clone of the template connection. The deliverables would be the following , 1.Unique id placed in the policy before sending it to the kernel. 2.ACQUIRE lookup path using the hashtable 3.Guaranteed unique reqid for opportunistic connection clones via a global counter. 4.Display of the reqid in the status as well. 5. New Tests for functional testing and updating the current testsuites.c

Mentors: Student: Osema Fadhel

Currently, during an IKEv2 negotiation in Libreswan, each peer independently selects its authentication method without knowing what the other side supports, which can lead to SA establishment failures when peers are configured with multiple credentials. The goal of this project is to implement RFC 9593, which introduces the SUPPORTED_AUTH_METHODS notification to allow peers to announce their supported authentication methods during SA establishment, enabling Libreswan to adjust its authentication selection to a method both sides support. The deliverables include: New ipsec.conf configuration option. Modifications to emit and parse SUPPORTED_AUTH_METHODS notification across IKE_SA_INIT, IKE_INTERMEDIATE, and IKE_AUTH exchanges. Modifications to select the applicable authentication method based on the peer's announced capabilities. Additions to the test-suite.

Mentors: Student: Rishabh Kumar

<p>The Internet Key Exchange Protocol Version 2 can use arbitrary signature algorithms for authentication as described in RFC-7427. Currently, Libreswan supports RSA, RSA-PSS, and ECDSA. This project aims to add support for EdDSA as per RFC-8420.</p>

Mentors: Student: Ravi Teja CMS

<p>IPSec standards are produced and maintained by <a href="https://ietf.org/" target="_blank">Internet Engineering Task Force</a> which are implemented by many software including <a href="https://libreswan.org/" target="_blank">Libreswan</a>. <a href="https://www.openiked.org/" target="_blank">OpenIKED</a> is one such native implementation of <a href="https://tools.ietf.org/html/rfc7296" target="_blank">IKEv2</a> on OpenBSD. My project’s purpose is to enable Interop tests where one end is Libreswan on Linux and the other is the native IKE daemon on OpenBSD. This helps us test Linux kernel to BSD kernel and understand several issues with Linux when inter-operating with with Non-Linux Operating Systems.</p>