pna icon indicating copy to clipboard operation
pna copied to clipboard

Create functionally correct example demonstrating IPsec encryption and decryption

Open jfingerh opened this issue 3 years ago • 0 comments

Prerequisite: Thiss PR or something similar is merged in: https://github.com/p4lang/pna/pull/53

Action: Create an example program that demonstrates all of the pieces of a working demonstration of IPsec encryption, and another for IPsec decryption (or a single program that demonstrates both in the same program is also fine).

It does not need to be "production worthy", i.e. it need not include a bunch of other features such as L2 and L3 forwarding, etc., but it should cover all of these aspects of IPsec:

  • adding/removing IPsec-specific trailers
  • at least one of IPsec transport mode or tunnel mode. Bonus points if the example demonstrates both, but restricting the example to one of those is fine.
  • replay attack detection for IPsec decryption should be included. It should logically be performed in a way that the state is only updated if the packet passes crypto authentication checks, as required by IPsec RFCs (I believe).
  • sequence number insertion for IPsec encryption. Bonus points if it works for both 32-bit and 64-bit sequence numbers, but if it only works for 32-bit case, that is simpler and perfectly fine as an example.

jfingerh avatar Oct 30 '22 23:10 jfingerh