Pre-Submission Checklist

Commit message has the format required by CONTRIBUTING guide
Commits are split per component (core, individual modules, libs, utils, ...)
Each component has a single commit (if not, squash them into one commit)
No commits to README files for modules (changes must be done to docbook files
in doc/ subfolder, the README file is autogenerated)

Type Of Change

Small bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds new functionality)
Breaking change (fix or feature that would change existing functionality)

Checklist:

PR should be backported to stable branches
Tested changes locally
Related to issue #XXXX (replace XXXX with an open issue number)

Description

This is an implementation of sec-agree used in IMS with IPSec. It's not a complete sec-agree implementation, only the flows used by IMS. The code is usable, but needs a few improvements, which I plan to push in the near future. My work is based on the implementation in OpenIMSCore.

For IPSec implementation the XFRM framework from the Linux kernel is used. Security association (SA) and Policies creation/removal is performed via netlink messages. For this reason the module depends on libmnl (a minimalistic netlink library).

As XFRM is Linux specific, the code is not portable and can't be used on operating system different from Linux. The code will not compile on *BSDs too. However all platform specific code resides in ipsec.c so support for other OSes/IPSec implementations can be added relatively easy.

The README file, which is commited is generated from docs dir with xsltproc.

Issues I still work on:

Kamailio must be run as root in order to be able to send netlink messages and create XFRM SAs and Policies.
SAs and Policies are not deleted on Kamailio startup and shutdown.
According to the current contact implementation in the PCSCF modules (adn the 3GPP specs) the IPSec tunnel should be created on two steps. Initial parameters should be saved in security_tmp and on confirmation - in security. At the moment everything remains in security.

As this is my first more serious contribution to the project, all kinds of feedback is highly appreciated :)

You can view, comment on, or merge this pull request online at:

https://github.com/kamailio/kamailio/pull/1605

Commit Summary

ims_ipsec_pcscf: sec-agree implementation for IMS

File Changes

A src/modules/ims_ipsec_pcscf/Makefile (20)
A src/modules/ims_ipsec_pcscf/README (244)
A src/modules/ims_ipsec_pcscf/cmd.c (585)
A src/modules/ims_ipsec_pcscf/cmd.h (6)
A src/modules/ims_ipsec_pcscf/doc/Makefile (4)
A src/modules/ims_ipsec_pcscf/doc/ims_ipsec_pcscf.xml (88)
A src/modules/ims_ipsec_pcscf/doc/ims_ipsec_pcscf_admin.xml (231)
A src/modules/ims_ipsec_pcscf/ims_ipsec_pcscf_mod.c (227)
A src/modules/ims_ipsec_pcscf/ipsec.c (386)
A src/modules/ims_ipsec_pcscf/ipsec.h (24)
A src/modules/ims_ipsec_pcscf/run_spi_list_tests.sh (4)
A src/modules/ims_ipsec_pcscf/spi_gen.c (87)
A src/modules/ims_ipsec_pcscf/spi_gen.h (16)
A src/modules/ims_ipsec_pcscf/spi_list.c (123)
A src/modules/ims_ipsec_pcscf/spi_list.h (29)
A src/modules/ims_ipsec_pcscf/spi_list_tests.c (292)

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.