From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <users-bounces@dpdk.org>
Received: from dpdk.org (dpdk.org [92.243.14.124])
	by dpdk.space (Postfix) with ESMTP id 5BF18A0679
	for <public@inbox.dpdk.org>; Tue, 30 Apr 2019 21:26:45 +0200 (CEST)
Received: from [92.243.14.124] (localhost [127.0.0.1])
	by dpdk.org (Postfix) with ESMTP id AEA7D4C77;
	Tue, 30 Apr 2019 21:26:44 +0200 (CEST)
Received: from duman1.cc.itu.edu.tr (duman1.cc.itu.edu.tr [160.75.25.118])
 by dpdk.org (Postfix) with ESMTP id C53783772
 for <users@dpdk.org>; Tue, 30 Apr 2019 21:26:43 +0200 (CEST)
Received: from itu.edu.tr
 (authenticated aid=ITUec8aa06da52a8f1ebd017cfae50385f2  bits=0)
 by duman1.cc.itu.edu.tr with ESMTP id x3UJQgZe030195
 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO)
 for <users@dpdk.org>; Tue, 30 Apr 2019 22:26:42 +0300
DKIM-Filter: OpenDKIM Filter v2.11.0 duman1.cc.itu.edu.tr x3UJQgZe030195
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=itu.edu.tr; s=itu;
 t=1556652402; bh=1E7KylDCQ8omj3AWvSSIOirnYvt6c1hnJDYsXvXJVPs=;
 h=Date:From:To:Subject:From;
 b=0Lwzrf8r4p0S1YpX5q4pC6lAcNecM9qJLcviS76bN8XTX50HKWCOATyYrdeMxdV7b
 9jqGQL8XGvIOBE6mth2mzVY3WNcKqgyV1+EBvQq2o6ibl9gFXWQldWWHhAteR5pa7T
 OvmvVSTcJRctLTGvamn/6v04qalmhQ0D425QkvbQ=
Received: from host-176-40-253-120.reverse.superonline.net
 (host-176-40-253-120.reverse.superonline.net [176.40.253.120]) by
 webmail.itu.edu.tr (Horde Framework) with HTTPS; Tue, 30 Apr 2019 22:26:42
 +0300
Date: Tue, 30 Apr 2019 22:26:42 +0300
Message-ID: <20190430222642.Horde.5DSa5Kgck_RnEPkn8trJiMa@webmail.itu.edu.tr>
From: avatli@itu.edu.tr
To: users@dpdk.org
User-Agent: Horde Application Framework 5
Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes
MIME-Version: 1.0
Content-Disposition: inline
X-Virus-Scanned: clamav-milter 0.101.1 at duman1.cc.itu.edu.tr
X-Virus-Status: Clean
Subject: [dpdk-users] pfsense ipsec traffic decryption
X-BeenThere: users@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK usage discussions <users.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/users>,
 <mailto:users-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/users/>
List-Post: <mailto:users@dpdk.org>
List-Help: <mailto:users-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/users>,
 <mailto:users-request@dpdk.org?subject=subscribe>
Errors-To: users-bounces@dpdk.org
Sender: "users" <users-bounces@dpdk.org>



Hello

Briefly, a host connects to a pfsense gateway and the traffic from
the host is encrypted with IPSec Tunnel mode, so I just need to know
how to decrypt the ESP traffic using DPDK. Is it possible?

If it makes any sense, I copied the pfsense configuration below

<phase1>
     <ikeid>1</ikeid>
     <iketype>ikev1</iketype>
     <mode>main</mode>
     <interface>wan</interface>
     <remote-gateway>172.10.10.30</remote-gateway>
     <protocol>inet</protocol>
     <myid_type>myaddress</myid_type>
     <myid_data></myid_data>
     <peerid_type>peeraddress</peerid_type>
     <peerid_data></peerid_data>
     <encryption-algorithm>
          <name>aes</name>
          <keylen>256</keylen>
     </encryption-algorithm>
     <hash-algorithm>sha1</hash-algorithm>
     <dhgroup>2</dhgroup>
     <lifetime>28800</lifetime>
     <pre-shared-key>test123</pre-shared-key>
     <private-key></private-key>
     <certref></certref>
     <caref></caref>
     <authentication_method>pre_shared_key</authentication_method>
     <descr></descr>
     <nat_traversal>on</nat_traversal>
     <mobike>off</mobike>
     <rekey_enable></rekey_enable>
     <dpd_delay>10</dpd_delay>
     <dpd_maxfail>5</dpd_maxfail>
</phase1>
<phase2>
     <ikeid>1</ikeid>
     <uniqid>5cc05cd15ce0c</uniqid>
     <mode>tunnel</mode>
     <reqid>1</reqid>
     <localid>
          <type>network</type>
          <address>0.0.0.0</address>
          <netbits>0</netbits>
     </localid>
     <remoteid>
          <type>network</type>
          <address>10.30.30.0</address>
          <netbits>24</netbits>
     </remoteid>
     <protocol>esp</protocol>
     <encryption-algorithm-option>
          <name>aes</name>
          <keylen>auto</keylen>
     </encryption-algorithm-option>
     <hash-algorithm-option>hmac_sha1</hash-algorithm-option>
     <pfsgroup>0</pfsgroup>
     <lifetime>3600</lifetime>
     <pinghost></pinghost>
     <descr></descr>
</phase2>


Thanks in advance

- Volkan