Subject: [Hipsec] Question about how to test the HIP implementation in FreeBSD-5.1

From: [email-masked] (Juan Rodriguez Hervella)
Date: Fri Jan 23 11:41:01 2004

(Sorry if you received multiple copies of this mail)

Hello,

I've followed the README guide to set up the HIP protocol, but
I don't know how to test it.=20

=46rom the README:

"After the script has completed a key pair has been generated to /etc/hip. =
The
files have been named according to HITs. Now one should add this HIT to the
network interface using ifconfig e.g.
ifconfig xl0 inet6 7a18:361c:e42b:e4d3:e847:19c8:d432:3c62 prefixlen 2 alia=
s"

Question: why do you need to assign the HIT to a specific interface ?
If I understand it correctly, HITs are global identifiers, so all the possi=
ble
HITs should belong to all possible interfaces.... =BFis it possible to assi=
gn
the same HIT to more than one interface ?=20

"Now just use applications as normally you would and if the peer's host name
resolves to a HIT-IP-pair then a HIP negotiation will be triggered by the
IPSec policy."

How can I make this resolution happen ? Would you mind explaining this
with a little more precision ? An example would be great (^--^)

Thanks!

=2D-=20
******
JFRH
******

Law of Probable Dispersal:
	Whatever it is that hits the fan will not be evenly
distributed.

---

From: [email-masked] (Pekka Nikander)
Date: Fri Jan 23 12:50:00 2004

Hi Juan,

> I don't know how to test it.

I'm not sure which implementation you are speaking about, but
assuming that it is ours (the FreeBSD one), some replies.

> =46rom the README:
>
> "After the script has completed a key pair has been generated to=20
> /etc/hip. The
> files have been named according to HITs. Now one should add this HIT=20=

> to the
> ifconfig xl0 inet6 7a18:361c:e42b:e4d3:e847:19c8:d432:3c62 prefixlen 2=20=

> alias"

Currently the FreeBSD implementation requires that the HITs are
routed out from the machine through some interface.  That allows
packets with HITs in them to be passed normally up to IPsec, which
will then intercept them.  This is basically an implementation hack,
and will probably disappear at some point of time.

> If I understand it correctly, HITs are global identifiers, so all the=20=

> possible
> HITs should belong to all possible interfaces.... =BFis it possible to=20=

> assign
> the same HIT to more than one interface ?

It doesn't matter which interface you assign the HIT to, as long as
it is a network interface.  (Well, maybe loopback works, too, but
at least I haven't tested that.)  Hence, it is still global even though
it looks like an interface specific thing due to the implementation
hack.

> "Now just use applications as normally you would and if the peer's=20
> host name
> resolves to a HIT-IP-pair then a HIP negotiation will be triggered by=20=

> the

The easiest way is to add peer HITs to /etc/hosts on each
machine.  Just like they were IPv6 addresses.

--Pekka Nikander

---

From: [email-masked] (Juan Rodriguez Hervella)
Date: Fri Jan 23 13:38:00 2004

> machine.  Just like they were IPv6 addresses.

I'm trying to test it on the same machine.

I've set up an anonymous FTP server, I've got the following on
my interface and "hipd" is running:

sis0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        inet 163.117.139.95 netmask 0xffffff00 broadcast 163.117.139.255
        inet6 fe80::20d:9dff:fe46:f2c9%sis0 prefixlen 64 scopeid 0x2
        inet6 71e1:1a89:9035:770f:2191:d10b:2a64:e369 prefixlen 2
        inet6 2001:720:410:100f:20d:9dff:fe46:f2c9 prefixlen 64 autoconf
        ether 00:0d:9d:46:f2:c9
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active

You can see that I've added the HIT public key on the interface.

This is what I've put on the /etc/hosts:
71e1:1a89:9035:770f:2191:d10b:2a64:e369         hiphurra 

But when I try:

root@cimborrio:~# ftp hiphurra

it doesn't work, what else do I have to do ?
Besides... even if I were doing it between 2 machines,
it wouldn't be enough putting the HIT on /etc/hosts, because
it would be necessary to set the destination IP address as well,
right ? How can I do it ? something like this on /etc/hosts ?

<HIT>    	machine
<IP>		machine

Thanks alot !

---

From: [email-masked] (Pekka Nikander)
Date: Fri Jan 23 13:49:00 2004

> I'm trying to test it on the same machine.

If I remember correctly, it doesn't quite work.  But I
don't remember the details.  Currently you need two
machines.

That's a bug, and should be fixed.  But there are worse
bugs.  Like getting occasional core dumps in some corner
cases, not supporting resynching etc.

--Pekka