Subject: [Hipsec] Yet Anoher Question about how to test the HIP implementation in FreeBSD-5.1

From: "Marcio Augusto de Lima e Silva" <[email-masked]>
Date: Tue, 11 Jan 2005 14:19:22 -0200

Hi all,
 
I've read some old posts (January 2004) on the above subject and I'm still
have some questions. After I bind the HITs to a network interface (on each
of the two hosts), and place the HITs in /etc/hosts in the form <HIT>
<HOSTNAME>, how can I associate the IPv4 (or even the IPv6) address to a HIT
? Also, is the mutual copy o the public keys (from /etc/hip) from each peer
host required (it seems to be the case for the linux implementation) ? 
 
Thanks !
 
Marcio

No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.6.10 - Release Date: 10/1/2005

---

From: Salvatore Loreto <[email-masked]>
Date: Tue, 11 Jan 2005 17:38:54 +0100 (CET)

Hi all,
 
I'd like to know if there is a HIP linux implementation.
 
Thanks in advance
Sal

---------------------------------
Nuovo Yahoo! Messenger E' molto più divertente: Audibles, Avatar, Webcam, Giochi, Rubrica… Scaricalo ora!

---

From: Jan Mikael Melen <[email-masked]>
Date: Wed, 12 Jan 2005 11:07:22 +0200

Hi Marcio

On Tuesday 11 January 2005 18:19, Marcio Augusto de Lima e Silva wrote:
> <HOSTNAME>, how can I associate the IPv4 (or even the IPv6) address to a
> HIT ? 

Your /etc/hosts should look like this:
<HIT> <HOSTNAME>
<IPv4> <HOSTNAME>
<IPv6> <HOSTNAME>

This way when the hostname is resolved the resolver gets the appropriate HIT 
and IP addresses.

> Also, is the mutual copy o the public keys (from /etc/hip) from each 
> peer host required (it seems to be the case for the linux implementation) ?

Mutual copies of public keys are NOT required.

   Regards,
	Jan
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: "Marcio Augusto de Lima e Silva" <[email-masked]>
Date: Tue, 18 Jan 2005 03:03:32 -0200

Thanks for the previous answer

Since I'm still facing a problem during the test, I would like to ask for
further explanation of the configuration.

Is a IPSEC Policy like "spdadd <HIT_source> <HIT_dest> any -P out ipsec
esp/hip//require;" on each host enough to trigger the HIP negotiation ? It
seems so, but I would like to double check (the IPSEC SA's will be handled
by the HIP right ?).

Is the editing of the hipconf.xml required ? The hipconf.xml on each host
has the HIT 69dc:c983:bc39:c7eb:a25d:4b38:220e:23cd (which comes from the
kernel patch file hip.patch) and does not change with the generation of the
new HI (by removing /etc/hip entries)

The (reproducible) behavior that I'm seeing (in a HIP patched ethereal
0.10.7) is:

- one or two I1 HIP
- one or two R1 HIP
- one or two I2 HIP 
- one or two R2 HIP 
- approx 8 seconds delay
- unencrypted regular TCP/IP connection (with ssh or ftp), no ESP ipsec
traffic.

Running hipd -n -d4 shows some errors in the source side:

Errno  : No such file or directory
Errno  : Unknown error: 0
Errno  : No such file or directory
Errno  : Unknown error: 0
N
Trace:   [hipd_pfhip_write]: hipd_pfhip.c(194): ENTER
Hex:     [hipd_pfhip_write]: HIP packet outgoing
Hex:      03000000 5865ef5f 18d87f17 01000000
          00000000 00000000 00000000 00000000
Error:   [hipd_io_write]: [FAIL] Write to fd8, errno 2
Error:   [hipd_pfhip_write]: Write to PFHIP failed

Running hipd -n -t10 shows only warnings like:

Warning: [hipd_states_default_handle_r1]: Received an unexpected R1 in
state=I2 sent!!! (which should be caused by the double I1,I2,R1,R2 packets)

Well.....that's all......any clarifications or even a example config would
be greatly appreciated.

Thanks again,

Marcio  

-----Mensagem original-----
De: [email-masked]
[mailto:[email-masked]] Em nome de Jan Mikael Melen
Enviada em: quarta-feira, 12 de janeiro de 2005 07:07
Para: [email-masked]
Cc: Marcio Augusto de Lima e Silva
Assunto: Re: [Hipsec] Yet Anoher Question about how to test the HIP
implementation in FreeBSD-5.1

Hi Marcio

On Tuesday 11 January 2005 18:19, Marcio Augusto de Lima e Silva wrote:
> Hi all,
>
> I've read some old posts (January 2004) on the above subject and I'm 
> still have some questions. After I bind the HITs to a network 
> interface (on each of the two hosts), and place the HITs in /etc/hosts 
> in the form <HIT> <HOSTNAME>, how can I associate the IPv4 (or even 
> the IPv6) address to a HIT ?

   Regards,
	Jan

--
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.6.10 - Release Date: 10/1/2005

-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.6.13 - Release Date: 16/1/2005