{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/flannel/issues/290","labels_url":"https://api.github.com/repos/coreos/flannel/issues/290/labels{/name}","comments_url":"https://api.github.com/repos/coreos/flannel/issues/290/comments","events_url":"https://api.github.com/repos/coreos/flannel/issues/290/events","html_url":"https://github.com/coreos/flannel/pull/290","id":101128927,"number":290,"title":"Add the IPSEC support","user":{"login":"MohdAhmad","id":1475849,"avatar_url":"https://avatars.githubusercontent.com/u/1475849?v=3","gravatar_id":"","url":"https://api.github.com/users/MohdAhmad","html_url":"https://github.com/MohdAhmad","followers_url":"https://api.github.com/users/MohdAhmad/followers","following_url":"https://api.github.com/users/MohdAhmad/following{/other_user}","gists_url":"https://api.github.com/users/MohdAhmad/gists{/gist_id}","starred_url":"https://api.github.com/users/MohdAhmad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MohdAhmad/subscriptions","organizations_url":"https://api.github.com/users/MohdAhmad/orgs","repos_url":"https://api.github.com/users/MohdAhmad/repos","events_url":"https://api.github.com/users/MohdAhmad/events{/privacy}","received_events_url":"https://api.github.com/users/MohdAhmad/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":23,"created_at":"2015-08-15T01:16:07Z","updated_at":"2015-09-09T21:05:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/coreos/flannel/pulls/290","html_url":"https://github.com/coreos/flannel/pull/290","diff_url":"https://github.com/coreos/flannel/pull/290.diff","patch_url":"https://github.com/coreos/flannel/pull/290.patch"},"body":"IPSEC mode: Tunnel\r\nThis means that the entire IP packet is encrypted. We encapsulate using\r\nthe host IP addresses therefore we can have a separate IPSEC backend\r\ninstead of integrating it with existing backends. Running in tunnel mode\r\nhas the added advantage of not leaking the container IPs.\r\n\r\nAuthentication Mechanism: Pre-shared key (PSK)\r\nFor authentication, we use a PSK, generated by flannel and distributed\r\nthrough etcd which in turn uses client-side certificates for\r\nauthentication.\r\n\r\nInternet key exchange (IKE): Charon\r\nWe use charon daemon from the strongSwan project to negotiate Security\r\nAssociations (SAs) between the endpoints. SAs define the security\r\nattributes, used to enable secure communication between endpoints [1].\r\nIKE has two phases, the first establishes a secure channel using the\r\nDiffie-Hellman key exchange and the second phase uses this secure\r\nchannel to negotiate the security attributes like, for example the keys\r\nused to encrypt traffic. We use, 4096 bit Diffie-Hellman, AES-256-CBC\r\nfor encryption and SHA-256 for integrity. Note IKEv1 is used and phase 1\r\nis run in Main mode.\r\n\r\nConfiguration\r\nThe only configuration parameter required is whether UDP Encapsulation\r\nshould be enabled."},"comment":{"url":"https://api.github.com/repos/coreos/flannel/issues/comments/139045273","html_url":"https://github.com/coreos/flannel/pull/290#issuecomment-139045273","issue_url":"https://api.github.com/repos/coreos/flannel/issues/290","id":139045273,"user":{"login":"dcbw","id":10926354,"avatar_url":"https://avatars.githubusercontent.com/u/10926354?v=3","gravatar_id":"","url":"https://api.github.com/users/dcbw","html_url":"https://github.com/dcbw","followers_url":"https://api.github.com/users/dcbw/followers","following_url":"https://api.github.com/users/dcbw/following{/other_user}","gists_url":"https://api.github.com/users/dcbw/gists{/gist_id}","starred_url":"https://api.github.com/users/dcbw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcbw/subscriptions","organizations_url":"https://api.github.com/users/dcbw/orgs","repos_url":"https://api.github.com/users/dcbw/repos","events_url":"https://api.github.com/users/dcbw/events{/privacy}","received_events_url":"https://api.github.com/users/dcbw/received_events","type":"User","site_admin":false},"created_at":"2015-09-09T21:05:10Z","updated_at":"2015-09-09T21:05:10Z","body":"@npmccallum @eyakubovich @simo5 @MohdAhmad How about tomorrow (9/10) at 16:00 UTC (12:00 noon US EDT)?"}}