<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1467224459899_27555"><span>There is work in progress on this . </span></div><div id="yui_3_16_0_ym19_1_1467224459899_27553"><span>We have an ipsec module which handles points 1. and 2. </span></div><div id="yui_3_16_0_ym19_1_1467224459899_27556"><span>We have a daemon that talks with the kamailio module which handles point 3 and is managing SAs via XFRM . </span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27448">Last point is a little bit harder without NAT, but possible, and likely we'll have that too.</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27432">When the ipsec module is ready we plan to release it but the manager which handles ipsec states and policies might be </div><div class="qtdSeparateBR" dir="ltr" id="yui_3_16_0_ym19_1_1467224459899_27430">closed source. The protocol to communicate with the ipsec manger will be open and based on simple json queries . </div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27450"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27450">One of the problems we ran into is that we don't have any good UE to reference to and to test our implementation with, both the iPhone and the Android are full of bugs and don't respect the specs . </div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27450"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27428">Regards,</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27423">Dragos</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27422"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467224459899_27422"><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1467224459899_27250" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1467224459899_27249"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1467224459899_27248"> <div dir="ltr" id="yui_3_16_0_ym19_1_1467224459899_27350"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1467224459899_27426"> <hr size="1" id="yui_3_16_0_ym19_1_1467224459899_27425"> <b><span style="font-weight:bold;">From:</span></b> Vikram Chhibber <vikram.chhibber@gmail.com><br> <b><span style="font-weight: bold;">To:</span></b> sr-dev@lists.sip-router.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, June 29, 2016 11:33 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> [sr-dev] Gm interface ipsec support<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1467224459899_27247"><br><div id="yiv0360193874"><div dir="ltr" id="yui_3_16_0_ym19_1_1467224459899_27246">Hi All,<div id="yui_3_16_0_ym19_1_1467224459899_27587"><br></div><div id="yui_3_16_0_ym19_1_1467224459899_27245">I recently asked question on whether the pcscf module supports transport mode ipsec with UE along with AKAv1/v2-MD5 authentication and the answer came no.</div><div id="yui_3_16_0_ym19_1_1467224459899_27589"><br></div><div id="yui_3_16_0_ym19_1_1467224459899_27591">I just want to open a discussion on how much effort would be neede to support this or whether this work is already in progress or in roadmap.</div><div>Basically, at PCSCF end, we need to support following:</div><div>1. RFC 3329 - "Security Mechanism Agreement for SIP" that includes processing of Security-Client, Security-Server and Security-Verify headers.</div><div>2. Support for processing of WWW-Authenticate header to extract CK and IK keys for ipsec.</div><div>3. Support for creating, updating and deleting ipsec security-associations using setkey or something else.</div><div>3. Management of secure sockets for ipsec communication.</div><div><br></div><div>and on SCSCF side, support for AKAv1/v2-MD5.<br></div><div><br></div><div>Please let me know the your thoughts.</div><div><br></div><div>Thanks</div><div><br></div></div></div><br>_______________________________________________<br>sr-dev mailing list<br><a ymailto="mailto:sr-dev@lists.sip-router.org" href="mailto:sr-dev@lists.sip-router.org">sr-dev@lists.sip-router.org</a><br><a href="http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev" target="_blank">http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev</a><br><br><br></div> </div> </div> </div></div></body></html>