Re: [Hipsec] Using Next Header with IPv6

[Jeff Ahrenholz <[e-mail]>]

Hi Bob,
Adding to Tom’s comments...

>> We provided in 7401 a Next Header field as all good IPv6 payloads are
>> suppose to do.  But we really have not used it in front of 'real' IPv6
>> payloads like ESP, TCP, UDP, or IPnIP.  Or have we and I have just
>> missed it?
>    
>    The HICCUPS RFC describes a use of it.
>    https://tools.ietf.org/html/rfc6078

Yes, we haven’t really been using the Next Header field for payloads.
    
>> I am not a person that has dealt with the insides of the OS(s) to know
>> how this would be done or if it is really practical.
>    
>    The data plane for HIP-supported sessions can be implemented in userspace
>    or kernel (reusing kernel IPsec handling). If purely userspace (all packets
>    are shunted to userspace) it seems like it would not be terribly difficult
>    to do.  If kernel space handling such as Linux XFRM, I'm guessing that a
>    stack modification would be needed.

We’re using a userspace implementation plus UDP encapsulation.

So one UDP socket receives the port 10500 traffic. Both HIP control packets (having SPI=0) and ESP packets are received and demuxed on this socket. So it would be fairly straightforward to pick off an UPDATE and then process the ESP data that follows it.

If we were not using UDP encaps then yes it seems you’d have to write a new frame back to the stack.
    
>> 
>> Oh, and what is the length of the basic HIP UPDATE in 5206-bis?  I can
>> do my best calculation in a bit, but if someone has it...
>    
>    HIP header 40 bytes
>    ESP_INFO 16 bytes
>    LOCATOR_SET (minimal) ~32 bytes
>    SEQ parameter 8 bytes
>    
>    so on the order of 96 bytes; more if more than one locator involved

Here is what we have for an IPv4 re-address event over UDP. Attached is a pcap file (you can open in Wireshark).

The three UPDATE packets are 302, 286, 262 bytes in length. They look like this:
UPDATE(ESP_INFO, LOCATOR, SEQ, HMAC, HIP_SIGNATURE)
UPDATE(ESP_INFO, SEQ, ACK, HMAC, HIP_SIGNATURE, ECHO_REQUEST_UNSIGNED)
UPDATE(ESP_INFO, ACK, HMAC, HIP_SIGNATURE, ECHO_RESPONSE_UNSIGNED)

-Jeff