XFRM

XFRM is the Linux kernel's IPsec transformation framework. It provides the internal data structures and processing needed to implement IPsec features such as authentication header (AH) and encapsulating security payload (ESP) for both IPv4 and IPv6. It supports transport and tunnel modes and serves as the integration layer between policy management and security associations in the kernel.

The framework revolves around two core objects: the Security Policy Database (SPD) and the Security Association Database (SAD). The SPD stores rules that determine when IPsec processing should be applied to a packet and which transformation to use. The SAD stores security associations, including parameters such as SPI, cryptographic algorithms, keys, and replay protection. Templates describe potential SAs that can be negotiated for a given policy. Configuration is performed by user-space key managers via PF_KEY, and more recently through netlink-based interfaces exposed by ip xfrm and related tools.

At runtime, the kernel consults the SPD to decide whether to apply IPsec; if applicable, it selects or creates a matching SAD entry and applies the corresponding ESP or AH transform to the packet. The framework cooperates with key management daemons (for example, strongSwan or libreswan) to negotiate SAs and update keys, integrating with broader VPN and secure-tunnel setups.

XFRM is a central component of the Linux IPsec stack and underpins VPN technologies and secure tunnels. It provides the low-level mechanisms that user-space IPsec implementations rely on to enforce confidentiality, integrity, and authenticity of traffic.

See also: IPsec, PF_KEY, NETLINK_XFRM.