4

I am using ip xfrm state and ip xfrm policy commands from iproute2 tool to implement IPSec. I have read documentation of iproute2 (PDF) and ip-xfrm man page. The man page states:

LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT

LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS | { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT

LIMIT-LIST sets limits in seconds, bytes, or numbers of packets.

Unfortunately, I couldn't find any documentation which explains the difference between time-soft vs time-hard and time-use-soft vs time-use-hard. Can anyone please explain these LIMIT types or any documentation reference ?

  • What kind of additional information do you need? – ecdsa Jul 9 '15 at 8:13
  • @ecdsa sorry for delayed response, what is need for soft limit? I can have timer in my keying daemon, which can trigger event to rekey according to expire time without having soft limit. – Zaksh Aug 15 '15 at 14:47
  • I've updated my answer. – ecdsa Aug 17 '15 at 8:54
3

The soft limits can be used to implement rekeying. If either limit is reached the kernel will send expire messages to anyone listening for events on XFRM or PF_KEY sockets. But if a hard limit is reached the kernel also removes the state/policy automatically.

A keying daemon that installs SAs will usually set the limits so that there is enough time between the soft and hard limit to rekey the SA and it will use the expire event for the soft limit as trigger the rekeying. This mechanism is defined in RFC 4301 (Security Architecture for the Internet Protocol).

While a keying daemon could implement its own timer to trigger rekeying after a certain time, this isn't possible for packet/byte limits without relatively expensive polling of the usage counters of each SA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.