2

I was exploring the IKEv2 StrongSwan client implementation for Android. What I fail to understand is that Android and Java do not support raw sockets, whilst the IKEv2/IPSec works below the transport layer, which seems counter-intuitive. How exactly does the communication happen after the CHILD_SA aka IPSec SA is established?

References:

  1. The official documentation for IKE Charon keying daemon does mention the use of 'socket' in the architecture diagram, but I was unable to find any further reference to it.
  2. I'm aware of the fact that StrongSwan's Android client uses a user-space implementation of libipsec, but again how does libipsec communicate without raw sockets?

Any help to fill the gap in my understanding is much appreciated!

6

The client only supports UDP-encapsulated ESP. These packets are sent/received over the same UDP sockets that are already used for IKEv2. This limitation is mentioned on the app's wiki page.

| improve this answer | |
  • Probably a correct answer, but would be even better with some references. – Esa Jokinen Jun 19 at 8:39
  • 5
    Since I'm the app's dev, I can tell you with authority it is :) But I've added a link to the wiki page where I added a note about it (basically the same information, but maybe easier to find for others). – ecdsa Jun 19 at 12:47
  • 1
    I am a developer of the OpenConnect VPN client, which also supports several ESP-based VPNs, and I concur that only ESP-over-UDP is supported in Android. Basically all modern client/server VPNs use it anyway, since "plain" ESP-over-IP isn't reliably enough transmitted by middleboxes on the internet. – Dan Lenski Jun 20 at 1:57
  • 1
    I'm not exactly sure what you mean, but there is no relation between socket and IKE or Child SA (e.g. strongSwan uses the same socket, no matter how many IKE SAs there are). But if you want to send ESP packets over a different socket, you could modify send_esp() in android_service.c (ESP packets may also be queued to libipsec from other sockets). – ecdsa Jun 22 at 7:41
  • 1
    Again, you don't need separate sockets to have multiple IKE SAs with different servers. UDP sockets allow sending packets to arbitrary IP addresses. But note that the Android client currently only supports a single IKE and Child SA. – ecdsa Jun 22 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.