Networking from the Bottom Up: IPv6 George Neville-Neil - - PowerPoint PPT Presentation

▶

Feb 11, 2024 323 likes •958 views

Networking from the Bottom Up: IPv6 George Neville-Neil gnn@neville-neil.com May 8, 2010 George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 1 / 62 Overview What We Will Cover A bit of the History

SLIDE 1

Networking from the Bottom Up: IPv6

George Neville-Neil

gnn@neville-neil.com

May 8, 2010

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 1 / 62

SLIDE 2

Overview

What We Will Cover

◮ A bit of the History and Goals of IPv6 ◮ IPv6 Protocol Code ◮ Neighbor Discovery ◮ Router Discovery ◮ ICMPv6 ◮ IPSec

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 2 / 62

SLIDE 3

Overview

What We Will Not Cover

◮ Routing ◮ TCPv6 ◮ UDPv6 ◮ SCTP (See Randall Stewart’s excellent tutorial.)

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 3 / 62

SLIDE 4

Overview

What Problem Are You Trying To Solve?

◮ Running out of addresses ◮ Efficiency ◮ Manageability ◮ Security

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 4 / 62

SLIDE 5

Overview

Protocol Historical Context

◮ Early 90s move to classless inter domain routing (CIDR) ◮ 1990: RFC 1287 Future Internet Architecture ◮ 1992: RFC 1335 Discusses exhaustion issue ◮ 1995: First IPv6 RFCs ◮ 1998: First acceptable IPv6 RFCs (2460 et al)

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 5 / 62

SLIDE 6

Overview

Code History

◮ Originally three open source implementations of IPv6

◮ Naval Research Lab (US) ◮ INRIA (France) ◮ Kame (Japan)

◮ Kame Project Wins out over the other two ◮ All work originally done in the BSD community ◮ Largest and riskiest kernel sub system developed outside of the

BSD projects

◮ Kame Project ends active development in 2007 ◮ Code fully taken over by the relevant OS projects

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 6 / 62

SLIDE 7

IPv6 Differences

◮ Addresses ◮ MTU ◮ Header Processing ◮ Scoping ◮ Multicast ◮ Autoconfiguration

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 7 / 62

SLIDE 8

IPv6 Differences

Addresses

◮ The most obvious and talked about change ◮ 128 bits for the host address ◮ IPv4 didn’t have enough for everyone alive ◮ IPv6 has enough for every atom in the universe

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 8 / 62

SLIDE 9

IPv6 Differences

MTU

◮ Maximum Transfer Unit ◮ IP is a hop by hop, packet switched protocol ◮ Fragmentation was seen as a problem ◮ Having an end to end MTU improves performance

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 9 / 62

SLIDE 10

IPv6 Differences

Header Processing

◮ The IPv4 header is messy

◮ Two 4 bit fields ◮ One 3 bit field ◮ One 13 bit field ◮ Options

◮ Make the header as simple as possible ◮ Have the packet look like a linked list

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 10 / 62

SLIDE 11

IPv6 Differences

Scoping

◮ A novel way of asking the local/remote question ◮ An attempt to replace subnetting within organizations ◮ Too complicated for many uses

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 11 / 62

SLIDE 12

IPv6 Differences

Multicast

◮ More efficient than broadcast ◮ Available in most common data-link protocols ◮ Used heaving in auto configuration

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 12 / 62

SLIDE 13

IPv6 Differences

Autoconfiguration

◮ Trying to solve the Dentist’s Office ◮ Does anyone still create isolated networks? ◮ Introduces new problems

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 13 / 62

SLIDE 14

IPv6 Differences

Neighbor Discovery

◮ Replacement for ARP ◮ Partial replacement for DHCP ◮ Removal of a layering violation

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 14 / 62

SLIDE 15

IPv6 Differences

Router Discovery

◮ Lessens the burden of administrators ◮ Partial replacement for DHCP

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 15 / 62

SLIDE 16

IPv6 Differences

Sockets API

◮ A by-product of some of the changes ◮ Overcome problems with socket addressing

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 16 / 62

SLIDE 17

Code Overview

Directories and Files

◮ Majority of the code resides in sys/netinet6 ◮ Two files present in sys/netinet

◮ icmp6.h ◮ ip6.h George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 17 / 62

SLIDE 18

Code Overview

Memory for Packets

◮ Packets need to be stored for reception and transmission ◮ The basic packet memory stuctures are the mbuf and cluster ◮ mbuf structures have several types and purposes ◮ Clusters hold only data ◮ History dictates that mbufs are named m ◮ In the kernel we will see many pointers to mbufs

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 18 / 62

SLIDE 19

Code Overview

Types of mbufs

◮ Wholly contained ◮ Packet Header ◮ Using a cluster

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 19 / 62

SLIDE 20

Code Overview

Welcome to SMP

◮ FreeBSD is a multi-threaded, re-entrant kernel ◮ Only way to scale on multicore and multi-processor systems ◮ Kernel is full of cooperating tasks ◮ Inter process synchronization is required

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 20 / 62

SLIDE 21

Code Overview

Kernel Synchronization Primitives

◮ Spin Locks ◮ Mutexes ◮ Reader/Writer Locks ◮ Shared/Exclusive Locks ◮ Drivers use mostly spin locks or mutexes

◮ See locking(9) for more information George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 21 / 62

SLIDE 22

Code Overview

IPv6 Specific Data Structures

◮ Addresses ◮ Packet Header ◮ Extension Headers

◮ Examined at the endpoint.

◮ Hop by Hop Options

◮ Examined at each intermediate hop George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 22 / 62

SLIDE 23

Code Overview

Address Structures

123 struct sockaddr_in6 { 124 u i n t8 _ t sin6_len ; /∗ length

t h i s s t r u c t ∗/ 125 sa_family_t sin6_family ; /∗ AF_INET6 ∗/ 126 i n _ p o r t _ t sin6_port ; /∗ Transport layer port # ∗/ 127 uint32_t sin6_flowinfo ; /∗ IP6 flow information ∗/ 128 struct in6_addr sin6_addr ; /∗ IP6 address ∗/ 129 uint32_t sin6_scope_id ; /∗ scope zone index ∗/ 130 } ; 95 struct in6_addr { 96 union { 97 ui n t 8_ t __u6_addr8 [ 1 6 ] ; 98 uint16_t __u6_addr16 [ 8 ] ; 99 uint32_t __u6_addr32 [ 4 ] ; 100 } __u6_addr ; /∗ 128−b i t IP6 address ∗/ 101 } ; George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 23 / 62

SLIDE 24

Code Overview

IPv4 Header

49 struct ip { 50 # i f BYTE_ORDER == LITTLE_ENDIAN 51 u_int ip_hl :4 , /∗ header length ∗/ 52 ip_v : 4 ; /∗ version ∗/ 53 #endif 54 # i f BYTE_ORDER == BIG_ENDIAN 55 u_int ip_v :4 , /∗ version ∗/ 56 ip_hl : 4 ; /∗ header length ∗/ 57 #endif 58 u_char ip_tos ; /∗ type

service ∗/ 59 u_short ip_len ; /∗ t o t a l length ∗/ 60 u_short ip_id ; /∗ i d e n t i f i c a t i o n ∗/ 61 u_short i p _ o f f ; /∗ fragment

f f s e t

f i e l d ∗/ 62 #define IP_RF 0x8000 /∗ reserved fragment f l a g ∗/ 63 #define IP_DF 0x4000 /∗ dont fragment f l a g ∗/ 64 #define IP_MF 0x2000 /∗ more fragments f l a g ∗/ 65 #define IP_OFFMASK 0 x 1 f f f /∗ mask f o r fragmenting b i t s ∗/ 66 u_char i p _ t t l ; /∗ time to l i v e ∗/ 67 u_char ip_p ; /∗ protocol ∗/ 68 u_short ip_sum ; /∗ checksum ∗/ 69 struct in_addr ip_src , ip_dst ; /∗ source and dest address ∗/ 70 } __packed __aligned ( 4 ) ; George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 24 / 62

SLIDE 25

Code Overview

IPv6 Header

72 struct ip6_hdr { 73 union { 74 struct i p 6 _ h d r c t l { 75 u_int32_t ip6_un1_flow ; /∗ 20 b i t s

flow−ID ∗/ 76 u_int16_t ip6_un1_plen ; /∗ payload length ∗/ 77 u_int8_t ip6_un1_nxt ; /∗ next header ∗/ 78 u_int8_t ip6_un1_hlim ; /∗ hop l i m i t ∗/ 79 } ip6_un1 ; 80 u_int8_t ip6_un2_vfc ; /∗ 4 b i t s version , top 4 b i t s class ∗/ 81 } ip6_ctlun ; 82 struct in6_addr ip6_src ; /∗ source address ∗/ 83 struct in6_addr ip6_dst ; /∗ destination address ∗/ 84 } __packed ; George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 25 / 62

SLIDE 26

Code Overview

Extension Header Structure

115 struct ip6_ext { 116 u_int8_t ip6e_nxt ; 117 u_int8_t ip6e_len ; 118 } __packed ; 232 /∗ Fragment header ∗/ 233 struct ip6_frag { 234 u_int8_t ip6f_nxt ; /∗ next header ∗/ 235 u_int8_t ip6f_reserved ; /∗ reserved f i e l d ∗/ 236 u_int16_t i p 6 f _ o f f l g ; /∗

ffset ,

reserved , and f l a g ∗/ 237 u_int32_t i p 6 f _ i d e n t ; /∗ i d e n t i f i c a t i o n ∗/ 238 } __packed ; George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 26 / 62

SLIDE 27

Code Overview

Hop by Hop Options

Next: 0 Next: 51 Length: 1 Next: 50 Length: 4 Next: 6 Length: 6

IPv6 Hop by Hop AH ESP TCP

Data

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 27 / 62

SLIDE 28

Code Overview

Hop by Hop Options Structure

122 struct ip6_hbh { 123 u_int8_t ip6h_nxt ; /∗ next header ∗/ 124 u_int8_t ip6h_len ; /∗ length in units

f 8 octets

∗/ 125 /∗ followed by options ∗/ 126 } __packed ; 169 /∗ Jumbo Payload Option ∗/ 170 struct ip6_opt_jumbo { 171 u_int8_t ip6oj_type ; 172 u_int8_t ip6oj_len ; 173 u_int8_t ip6oj_jumbo_len [ 4 ] ; 174 } __packed ; George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 28 / 62

SLIDE 29

IPv6 Packet Reception and Transmission

The Four Paths

◮ Packets traverse four possible paths in the network code ◮ Inbound (for this host) ◮ Outbound (from this host) ◮ Forwarding (between two interfaces on this host) ◮ Error

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 29 / 62

SLIDE 30

IPv6 Packet Reception and Transmission

Four Paths Through The Stack

IPv4, IPv6, ... igb0 inbound

utbound

igb1 error forwarding Netwo Interf

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 30 / 62

SLIDE 31

IPv6 Packet Reception and Transmission

Packet Reception (Outline)

◮ Initial Reception ◮ Handle Scoping ◮ Hop by Hop Options ◮ Forwarding Decision ◮ More Packet Unwrapping

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 31 / 62

SLIDE 32

IPv6 Packet Reception and Transmission

IPv6 Routing and Forwarding

IPv6 Neighbor Discovery Router Discovery ICMPv6 RIB FIB

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 32 / 62

SLIDE 33

IPv6 Packet Reception and Transmission

Packet Transmission

◮ Extension Headers ◮ IPSec Handling ◮ Length Calculation ◮ Jumbo Payload ◮ Pick a Source Address ◮ Routing Lookup

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 33 / 62

SLIDE 34

IPv6 Packet Reception and Transmission

Packet Transmission (Con’t)

◮ Traffic Class ◮ Hop Limit ◮ IPSec Re-injection ◮ Select a Route ◮ Outbound Scope Check ◮ Multicast Handling ◮ Path MTU

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 34 / 62

SLIDE 35

IPv6 Packet Reception and Transmission

Packet Transmission (Con’t)

◮ Hop by Hop ◮ Checksumming ◮ Fragmentation ◮ Transmit ◮ Cleanup

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 35 / 62

SLIDE 36

IPv6 Packet Reception and Transmission

ICMPv6

◮ Now used for more than errors ◮ An integral part of auto-configuration ◮ Handles Neighbor and Router Discovery (see next slides)

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 36 / 62

SLIDE 37

IPv6 Packet Reception and Transmission

ICMPv6 Packet Reception

◮ icmp6_input ◮ Preamble ◮ Get a usable structure ◮ Calculate the Checksum ◮ The Massive Switch ◮ Echo Request (ping) ◮ Neighbor and Router

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 37 / 62

SLIDE 38

Autoconfiguration

The ARP Replacement

◮ Translate an IPv6 address into a hardware address ◮ Piggy backed on top of ICMPv6 ◮ Can take the place of DHCP

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 38 / 62

SLIDE 39

Autoconfiguration

IPv6 Module Relationships

IPv6 ICMPv6 ND6 Network Interface ip6_input() icmp6_input ip6_output() nd6_output() nd6_ra_input() nd6_rs_input() if_output()

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 39 / 62

SLIDE 40

Autoconfiguration

Neighbor Lookup

◮ nd6_output ◮ Initial error checks ◮ Find a cached entry ◮ Create a new entry ◮ Send a neighbor solicitation ◮ Queue the packet ◮ Transmit the packet

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 40 / 62

SLIDE 41

Autoconfiguration

Neighbor Solicitation Transmission

◮ nd6_ns_output ◮ Preamble ◮ Multicast Check ◮ Fill in the solicitation packet ◮ Duplicate Address Detection ◮ Call ip6_output (again)

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 41 / 62

SLIDE 42

Autoconfiguration

Solicitation Input

◮ nd6_ns_input ◮ On link check ◮ Option Processing ◮ Proxy check ◮ Tentative

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 42 / 62

SLIDE 43

Autoconfiguration

Advertisement Output

◮ nd6_na_output ◮ Setup ◮ Create Packet ◮ Scope Selection ◮ Target Link Layer Address ◮ Checksums ◮ Call ip6_output

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 43 / 62

SLIDE 44

Autoconfiguration

Advertisement Input

◮ nd6_na_input ◮ Preamble ◮ Flag extraction ◮ Multicast checks ◮ Options processing ◮ Cache lookup ◮ Entry update ◮ Address change ◮ Transmit held packets

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 44 / 62

SLIDE 45

Autoconfiguration

Discovering Routers

◮ Separate from Neighbor Discovery ◮ Replaces manual configuration as well as DHCP ◮ Supposed to ease large deployments ◮ Has security and other implications

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 45 / 62

SLIDE 46

Autoconfiguration

Router Advertisement

◮ nd6_ra_input ◮ Security Check ◮ Options processing ◮ Setup default router structure ◮ Handle prefix information ◮ MTU advertisement ◮ Source Link Layer Address

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 46 / 62

SLIDE 47

Autoconfiguration

Router Solicitation

◮ Accepted by only by routers ◮ Used by hosts to find routers ◮ Handled in user-space by rtsold(8) ◮ Uses ICMPv6 messages to find nearby routers

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 47 / 62

SLIDE 48

Autoconfiguration

Autoconfiguration Wrap Up

◮ Neighbor Discovery replaces ARP ◮ Router Discovery replaces configuration files ◮ ICMPv6 Used Throughout ◮ Most messages are multicast to known groups

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 48 / 62

SLIDE 49

Security Protocols

IPSec

◮ The collection of protocols for IP Security ◮ Exist for IPv6 and IPv4 ◮ Tunnel Architecture ◮ Authenticate and Encrypt Packets ◮ Keyeing is non-trivial ◮ Can be computationally expensive ◮ Code is in sys/netipsec

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 49 / 62

SLIDE 50

Security Protocols

The Protocol Switch

◮ A table of protoocols and functions ◮ One for each protocol ◮ Not specific to IPv6 ◮ inet6sw

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 50 / 62

SLIDE 51

Security Protocols

Initial Reception

◮ ipsec6_common_input ◮ Pull up the whole packet ◮ Check the packet ◮ ipsec_common_input

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 51 / 62

SLIDE 52

Security Protocols

Transformations

◮ Another set of structures with functions ◮ One per protocol

◮ xform_ah.[ch], xform_esp.[ch]

◮ Implement a callback API ◮ Can easily offload to specialized hardware

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 52 / 62

SLIDE 53

Security Protocols

Transformation Structures

82 struct xformsw { 83 u_short xf_type ; /∗ xform ID ∗/ 84 #define XF_IP4 1 /∗ IP inside IP ∗/ 85 #define XF_AH 2 /∗ AH ∗/ 86 #define XF_ESP 3 /∗ ESP ∗/ 87 #define XF_TCPSIGNATURE 5 /∗ TCP MD5 Signature

ption , RFC 2358 ∗/

88 #define XF_IPCOMP 6 /∗ IPCOMP ∗/ 89 u_short x f _ f l a g s ; 90 #define XFT_AUTH 0x0001 91 #define XFT_CONF 0x0100 92 #define XFT_COMP 0x1000 93 char ∗xf_name ; /∗ human −readable name ∗/ 94 int (∗ x f _ i n i t ) ( struct secasvar ∗, struct xformsw ∗); /∗ setup ∗/ 95 int (∗ xf_zeroize ) ( struct secasvar ∗); /∗ cleanup ∗/ 96 int (∗ xf_input ) ( struct mbuf∗, struct secasvar ∗, /∗ input ∗/ 97 int , int ) ; 98 int (∗ xf_output ) ( struct mbuf∗, /∗

utput

∗/ 99 struct ipsecrequest ∗, struct mbuf ∗∗, int , int ) ; 100 struct xformsw ∗xf_next ; /∗ l i s t

registered xforms ∗/ 101 } ; 1205 static struct xformsw ah_xformsw = { 1206 XF_AH, XFT_AUTH, " IPsec AH" , 1207 ah_init , ah_zeroize , ah_input , ah_output , 1208 } ; George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 53 / 62

SLIDE 54

Security Protocols

Authentication

◮ Verifies that the sender is who they say they are ◮ Required before adding or using Encryption

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 54 / 62

SLIDE 55

Security Protocols

AH Reception

◮ ah_input ◮ Packet Verification ◮ Allocate Cryptographic Structures ◮ Check the mtag ◮ Setup the cryptographic structure ◮ Callback

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 55 / 62

SLIDE 56

Security Protocols

AH Callback

◮ ah_input_cb ◮ Cleanup after the crypto operation ◮ Preamble ◮ Re-acquire embedded state ◮ Error checks ◮ Authenitcation approved ◮ Send to correct upper layer

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 56 / 62

SLIDE 57

Security Protocols

IPv6 IPSec Procesing Continued

◮ ipsec6_common_input_cb ◮ Called once all IPsec work is done ◮ Preamble ◮ Various Sanity Checks ◮ Header Fixup ◮ enc0 processing ◮ Protocol Handoff

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 57 / 62

SLIDE 58

Security Protocols

Encryption

◮ Hides the contents of the packet from all but the key holder ◮ Required for a secure tunnel ◮ Should always be used with authenticatoin ◮ Shares much boiler plate with AH

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 58 / 62

SLIDE 59

Security Protocols

ESP Reception

◮ esp_input ◮ Preamble ◮ Pull the packet up ◮ Sequence check ◮ Crypto Check ◮ Get Cryptographic Descriptor ◮ Fill in descriptors ◮ Dispatch the operation

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 59 / 62

SLIDE 60

Security Protocols

ESP Callback

◮ esp_input_cb ◮ Preamble ◮ Retrieving data from the descriptor ◮ Error checks ◮ Flag mbuf and update the replay sequence ◮ Strip the header ◮ See IPv6 IPSec Processing Continued (above)

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 60 / 62

SLIDE 61

Security Protocols

Security Section Wrap Up

◮ IPSec works with both IPv4 and IPv6 ◮ AH for Authentication ◮ ESP for Encryption ◮ Heavy use of mtags ◮ Callbacks used to interact with hardware ◮ Transformations contain the protocol functions

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 61 / 62

SLIDE 62

Security Protocols

Questions?

George Neville-Neil (gnn@neville-neil.com) Networking from the Bottom Up: IPv6 May 8, 2010 62 / 62