Subject: [Hipsec] (Half joke): Masquarading HIP as UDP/TCP

From: [email-masked] (Pekka Nikander)
Date: Mon Sep 8 07:18:01 2003

The beginning of a UDP packet looks like the following:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         Source port           |       Destination port        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Length              |             CRC               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The beginning of a TCP packet looks like the following:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |          Source Port          |       Destination Port        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                        Sequence Number                        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The beginning of a HIP payload looks like the following:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | Next Header   |  Payload Len  |     Type      |  VER. |  RES. |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |          Controls             |             CRC               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The NAT boxes only touch the source port, and leave the destination
port untouched.  They also rewrite the checksum.

According to the current spec, in an I1,

    Next Header = 59
    Payload Len =  4
    Type        =  1
    Ver         =  1
    Res         =  0

If we take that, and just inject a MIP header in a place of an
UDP or TCP packet, we get a packet with

    Source port =      (256*59) +  4 = 15108
    Destination port = (256*1)  + 16 =   272

Now, 272 is a reserved port which happens to be unassigned....

(What comes to resetting the checksum in a TCP frame, that
should be doable since the original "source port" is known
and the untouched HIP CRC can be used to look for for the
right original source IP address...  Or otherwise we could
just include the source IP address in the payload...)

--Pekka