Subject: [Hipsec] Issue 16: Details of LSI handling

From: [email-masked] (Henderson, Thomas R)
Date: Fri Sep 26 10:32:01 2003

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]]
> Sent: Friday, September 26, 2003 12:06 AM
> To: [email-masked]
> Subject: [Hipsec] Issue 16: Details of LSI handling
>=20
> Any opinions?  Any nice schemes that would allow us to
> solve this problem?
>=20

Pekka,
I still believe that this may be a non-issue.  See the discussion at
http://lists.freeswan.org/archives/hipsec/2003-March/000495.html

Our current implementation only uses LSIs for 32 bit values in the
pseudoheader for HIP-using sockets.  They do not even need to be
exchanged, although we do exchange them for compliance with the
draft spec.  Now that the draft-08-pre has migrated to use of the=20
IPv6 pseudoheader, we won't even need the LSIs for the pseudoheader
anymore.

Of course, this issue is tied to how people envision the HIP-enabled
sockets API for IPv4.  We have taken the stance that LSIs are not=20
used in the sockaddr_in.sin_addr in socket calls-- if HIP is to be=20
used on a connection, it is flagged as such in the IPsec policy table
(which is based on IP addresses), and the kernel manages to do the right =

thing. =20

So I would like to again propose that we delete the LSIs from the=20
protocol on the wire, and leave the LSI concept as an implementation=20
issue.

Counter-arguments?

Tom

---

From: [email-masked] (Pekka Nikander)
Date: Mon Sep 29 07:00:01 2003

Henderson, Thomas R wrote:
> I still believe that this may be a non-issue. 

It may be.

> sockets API for IPv4. 

Indeed.

> We have taken the stance that LSIs are not 
> used in the sockaddr_in.sin_addr in socket calls-- if HIP is to be 
> (which is based on IP addresses), and the kernel manages to do the right 
> thing.  

A clarifying question:  How do you make sure that the two
communicating hosts have the same idea of their IP addresses?
That is, if you use IP addresses (instead of LSIs) in the IPv4
API, how do you make e.g. FTP or SIP to work?

I am not saying that it is impossible, I am just stating that
I don't understand how you do it.

There are a number of current protocols that carry IP(v4)
addresses in the payload.  One of the reasons for using LSIs
is to make these work.

I don't personally care much about the v4 API, aspecially
now that -08-per uses always HITs in the pseudo-header, and
thereby allows v6 API apps to talk v4 API apps and vice versa.
However, I have understood that some people do care, and
quite a lot.  Maybe it would be time for them to speak up again.

--Pekka Nikander