pna
pna copied to clipboard
Create functionally correct example demonstrating IPsec encryption and decryption
Prerequisite: Thiss PR or something similar is merged in: https://github.com/p4lang/pna/pull/53
Action: Create an example program that demonstrates all of the pieces of a working demonstration of IPsec encryption, and another for IPsec decryption (or a single program that demonstrates both in the same program is also fine).
It does not need to be "production worthy", i.e. it need not include a bunch of other features such as L2 and L3 forwarding, etc., but it should cover all of these aspects of IPsec:
- adding/removing IPsec-specific trailers
- at least one of IPsec transport mode or tunnel mode. Bonus points if the example demonstrates both, but restricting the example to one of those is fine.
- replay attack detection for IPsec decryption should be included. It should logically be performed in a way that the state is only updated if the packet passes crypto authentication checks, as required by IPsec RFCs (I believe).
- sequence number insertion for IPsec encryption. Bonus points if it works for both 32-bit and 64-bit sequence numbers, but if it only works for 32-bit case, that is simpler and perfectly fine as an example.