IPSec IKEv2 Internals

Compare AH and ESP modes in IPsec, outlining how AH provides authenticity and integrity without encryption, while ESP offers encryption plus authentication in transport and tunnel modes.

Master how security associations and a security policy database govern IPsec packet flow, selecting encryption and authentication per source and destination, with SA and SPD databases determining parameters and processing.

Develop a simple finite state machine that processes events from a prism-like state-event queue in a separate thread, driving an IPSec IKEv2 negotiation through a physical routine.

Learn to create and bind a data socket, use promiscuous mode, and validate self and peer IP addresses while preparing the receiver routine.

Learn how pf_packet raw sockets bypass the kernel ip stack to deliver ethernet frames directly to user space, enabling simulation of many IPsec peers and MAC address handling.

Implement a complete receive function that collects data packets in a loop, assembling buffers into IKEv2 packets by parsing lengths, skipping IP/UDP headers, and driving a finite state machine.

Run the IPsec ikev2 internals sim by wiring three files, defining a state machine, and using a data socket and receiver to capture udp packets and begin v2 parsing.

Describe the four-message IKEv2 phase 1 exchange, where the first pair negotiates cryptographic algorithms and derives a secret key, and the second pair authenticates with a secret or certificate.

Define and assemble the IKE header for SA INIT by building the IKEv2 header, payload header, and transforms, while managing the buffer, message I.D., and initiator flags.

Completes the SA init for IKEv2 by assembling the initial identity, building the proposal with encryption and integrity transforms, and executing the key-exchange payload, buffering and signing data for transmission.

Learn to configure strongSwan for ipsec, defining left and right, traffic selectors, and ipsec.conf setup, using pre-shared keys and ipsec secrets, with proposals for encryption and integrity.

Prepare to receive ike sa init response from strongSwan, parse the data event, verify message id and exchange type, and move toward sending the auth in the next ikev2 phase.

Parse the IKEv2 SA init response, save payload pointers for the SA, key exchange, and ID payloads, and prepare key derivation after processing.

Learn how to build and send IKEv2 SA authentication messages by crafting headers, protecting payloads with keys, signing data, and exchanging IKE SA and child SA payloads.

Test the SA authentication with strongSwan and confirm a SA between the simulator and strongSwan, then debug child SA formation using status and ESP parameters.

Verify an IKEv2 SA authentication with the strongSwan simulator, confirming receipt of the init, auth response, and a four-packet handshake that establishes the SA, including authentication and lifetime payloads.