Subject: [Hipsec] HIP checksumming and FROM option

From: Andrei Gurtov <[email-masked]>
Date: Tue, 14 Sep 2004 19:55:02 +0300

Hi,

While trying to implement indirection support for HIP, I had some 
challengies related to changing  IP addresses in the I1 packet. With 
current specs it requires adding a FROM option containing the source IP 
address and recomputing the HIP checksum (that covers the pseudoheader 
including IP addresses). Some people have argued that such checksumming 
was a bad design choice in UDP, since it violates a clean layering 
concept and e.g. prevents running UDP over anything but IP. Is there any 
strong reason for including pseudoheader in the HIP checksum? Without 
it, it would be easier to change IP addresses in the network, 
facilitating traversal of NATs and middleboxes. There is a checksum in 
the IP header anyway. Furthemore, how about making the FROM option 
mandatory in handshake packets? It would make middlebox programming easier.

Andrei
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: Julien Laganier <[email-masked]>
Date: Wed, 15 Sep 2004 09:42:59 +0200

Hi,

> challengies related to changing  IP addresses in the I1 packet.
> With current specs it requires adding a FROM option containing the
> source IP address and recomputing the HIP checksum (that covers the
> pseudoheader including IP addresses). Some people have argued that 
> such checksumming was a bad design choice in UDP, since it violates
> a clean layering concept and e.g. prevents running UDP over
> anything but IP. Is there any strong reason for including
> pseudoheader in the HIP checksum? 

I believe the reason for including pseudoheader in the HIP checksum is 
the same as for any upper layer (e.g., UDP, TCP, etc.): avoiding 
packets to end-up to the wrong recipient without they even notice it.  

Perhaps it's not a big deal if a wrong recipient get a HIP I1, because 
there is the HITs anyway, but if one think to opportunistic mode, the 
recipient will answer with an R1... This is useless traffic and 
processing.

> Without it, it would be easier to 
> change IP addresses in the network, facilitating traversal of NATs
> and middleboxes. 

Sure but,

> There is a checksum in the IP header anyway. 

There's no checksum in the IPv6 header, and the IPv6 specs says:

 o  Unlike IPv4, when UDP packets are originated by an IPv6 node,
         the UDP checksum is not optional.  That is, whenever
         originating a UDP packet, an IPv6 node must compute a UDP
         checksum over the packet and the pseudo-header

> Furthemore, how about making the FROM option mandatory in handshake
> packets? It would make middlebox programming easier.

There are several reason why FROM is not mandatory:  You might simply 
rewrite the destination address if there's no egress filtering at the 
RVS's network, so no need for FROM since the source address isn't 
altered. You might also want to omit it intentionnaly (for privacy).

What do others think?

Thanks,

--julien

-- 
Julien Laganier 
SUN Microsystems Laboratories
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 16 Sep 2004 09:42:52 +0300

> packets to end-up to the wrong recipient without they even notice it.

Right.  Furthermore, the location of the checksum in the pseudo-header
is such that it should be possible to use existing hardware accelerators
to verify and compute it.

> altered. You might also want to omit it intentionnaly (for privacy).

Agreed.  Especially in the Hi3 case you may want just to rewrite
the destination address, as most probably you want to route the
reply packet through i3, too.   Optionally, you could also rewrite
the source address to point to an i3 server that is topologically
close to the Recipient.

--Pekka