Merge lp:~midauth-pisa-devs/hipl/midauth-firewall into lp:hipl

[René Hummen]

This branch re-implements the hipfw-related part of http://tools.ietf.org/html/draft-heer-hip-middle-auth-02.

Short intro to HIP middlebox authentication:
1) The firewall intercepts R1, I2, U1 and U2 messages and adds a nonce that needs to be echoed back to the firewall by the respective end-host in the signed part of the reply. This enables the firewall to evaluate the freshness of the exchange.
2) In order to mitigate DoS attacks targeting the signature verification at the firewall, the nonce is additionally used as the input for a puzzle that the end-host needs to solve and send back to the firewall in the reply as well.

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>
> For more details, see:
> https://code.launchpad.net/~midauth-pisa-devs/hipl/midauth-firewall/+merge/79811
>
> This branch re-implements the hipfw-related part of http://tools.ietf.org/html/draft-heer-hip-middle-auth-02.
>
> Short intro to HIP middlebox authentication:
> 1) The firewall intercepts R1, I2, U1 and U2 messages and adds a nonce that needs to be echoed back to the firewall by the respective end-host in the signed part of the reply. This enables the firewall to evaluate the freshness of the exchange.
> 2) In order to mitigate DoS attacks targeting the signature verification at the firewall, the nonce is additionally used as the input for a puzzle that the end-host needs to solve and send back to the firewall in the reply as well.
> --
> https://code.launchpad.net/~midauth-pisa-devs/hipl/midauth-firewall/+merge/79811
> Your team HIPL core team is requested to review the proposed merge of lp:~midauth-pisa-devs/hipl/midauth-firewall into lp:hipl.

> --- Makefile.am 2011-10-17 18:14:10 +0000
> +++ Makefile.am 2011-10-19 13:13:48 +0000
> @@ -253,7 +256,7 @@
>
> -test_check_firewall_LDFLAGS = -ldl
> +test_check_firewall_LDFLAGS = -ldl -z muldefs

We have solved this differently elsewhere by #including the .c file to
unit-test static functions.

> --- firewall/conntrack.c 2011-10-19 09:51:41 +0000
> +++ firewall/conntrack.c 2011-10-19 13:13:48 +0000
> @@ -998,7 +998,7 @@
> *
> * @param common the hip packet to be verified
> * @param tuple the corresponding connection tuple
> - * @return 1 for valid packets, 0 otherwise
> + * @return 0 for valid packets, 1 otherwise
> */
> static int hip_fw_verify_packet(struct hip_common *const common,
> const struct tuple *const tuple)

This looks like a change that could be separated.

> @@ -1526,14 +1565,28 @@
>
> } else if (esp_info && seq && ack) {
> - if (!tuple) {
> + if (tuple && tuple->direction == ORIGINAL_DIR) {
> + other_dir = &tuple->connection->reply;
> + } else if (tuple) {
> + other_dir = &tuple->connection->original;
> + } else {
> HIP_ERROR("Insufficient stored state to process UPDATE\n");
> return 0;
> }

tuple is checked twice.

> - if (!hip_fw_verify_packet(common, tuple)) {
> + if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
> + HIP_ERROR("failed to verify midauth challenge\n");
> + return 0;
> + }

0 is returned in case of error?

> @@ -1543,14 +1596,29 @@
> } else if (ack) {
> - if (!tuple) {
> + if (tuple && tuple->direction == ORIGINAL_DIR) {
> + other_dir = &tuple->connection->reply;
> + } else if (tuple) {
> + other_dir = &tuple->connection->original;
> + } else {
> HIP_ERROR("Insufficient stored state to process UPDATE\n");
> return 0;
> }

another redundant check

Oh, this code seems to be completely duplicated.

> @@ -1842,7 +1910,7 @@
>
> -#ifdef CONFIG_HIP_MIDAUTH
...

review: Needs Fixing

[lp:~midauth-pisa-devs/hipl/midauth-firewall]

6097. By René Hummen on 2011-10-25

address diego's comments of the merge proposal

6098. By René Hummen on 2011-10-25

add missing doxygen comment

6099. By René Hummen on 2011-10-25

remove double check of tuple

[Diego Biurrun (diego-biurrun)]

On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
> On 20.10.2011, at 14:15, Diego Biurrun wrote:
> > On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
> >
> >> --- Makefile.am 2011-10-17 18:14:10 +0000
> >> +++ Makefile.am 2011-10-19 13:13:48 +0000
> >> @@ -253,7 +256,7 @@
> >>
> >> -test_check_firewall_LDFLAGS = -ldl
> >> +test_check_firewall_LDFLAGS = -ldl -z muldefs
> >
> > We have solved this differently elsewhere by #including the .c file to
> > unit-test static functions.
>
> This has been discussed previously on the list:
> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests

But we currently don't favor that solution. If that needs changing,
it's a topic for a separate merge request and would need to be changed
in all places.

> >> @@ -1526,14 +1565,28 @@
> >>
> >> } else if (esp_info && seq && ack) {
> >> - if (!tuple) {
> >> + if (tuple && tuple->direction == ORIGINAL_DIR) {
> >> + other_dir = &tuple->connection->reply;
> >> + } else if (tuple) {
> >> + other_dir = &tuple->connection->original;
> >> + } else {
> >> HIP_ERROR("Insufficient stored state to process UPDATE\n");
> >> return 0;
> >> }
> >
> > tuple is checked twice.
>
> Yes, but I need to be sure that tuple exists when accessing its
> members in the body of the else if.

So? That does not imply you need to check "tuple" twice, just nest the
ifs, witness:

  if (tuple) {
      if (tuple->direction == ORIGINAL_DIR) {
          other_dir = &tuple->connection->reply;
      } else {
          other_dir = &tuple->connection->original;
  } else {
     HIP_ERROR("Insufficient stored state to process UPDATE\n");
     return 0;
 }

> >> - if (!hip_fw_verify_packet(common, tuple)) {
> >> + if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
> >> + HIP_ERROR("failed to verify midauth challenge\n");
> >> + return 0;
> >> + }
> >
> > 0 is returned in case of error?
>
> Yes, firewall/conntrack.c does not use the same semantics for return
> values compared to the rest of the code.

Then fix conntrack.c and don't make the code consistently inconsistent,
cf. the boyscout rule.

> >> @@ -1543,14 +1596,29 @@
> >> } else if (ack) {
> >> - if (!tuple) {
> >> + if (tuple && tuple->direction == ORIGINAL_DIR) {
> >> + other_dir = &tuple->connection->reply;
> >> + } else if (tuple) {
> >> + other_dir = &tuple->connection->original;
> >> + } else {
> >> HIP_ERROR("Insufficient stored state to process UPDATE\n");
> >> return 0;
> >> }
> >
> > another redundant check
> >
> > Oh, this code seems to be completely duplicated.
>
> Yes, but I didn't see the need for a new function as this code is
> specific for updates and only used twice.

There is no such thing as "only" used twice, code duplication
is code duplication is code duplication :)

> >> --- firewall/firewall.c 2011-08-16 07:49:25 +0000
> >> +++ firewall/firewall.c 2011-10-19 13:13:48 +0000
> >> @@ -76,12 +76,13 @@
> >> #include "lib...

[lp:~midauth-pisa-devs/hipl/midauth-firewall]

6100. By René Hummen on 2011-10-25

remove read-only variable 'found'

[René Hummen (rene-hummen)]

On 25.10.2011, at 15:24, Diego Biurrun wrote:
> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>>>
>>>> --- Makefile.am 2011-10-17 18:14:10 +0000
>>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
>>>> @@ -253,7 +256,7 @@
>>>>
>>>> -test_check_firewall_LDFLAGS = -ldl
>>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
>>>
>>> We have solved this differently elsewhere by #including the .c file to
>>> unit-test static functions.
>>
>> This has been discussed previously on the list:
>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
>
> But we currently don't favor that solution. If that needs changing,
> it's a topic for a separate merge request and would need to be changed
> in all places.

The change was necessary in order to comply with our unit-test for new code policy as unit-tests would otherwise not link correctly. The only other option I see right now is to merge the code without unit-tests.

>>>> - if (!hip_fw_verify_packet(common, tuple)) {
>>>> + if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
>>>> + HIP_ERROR("failed to verify midauth challenge\n");
>>>> + return 0;
>>>> + }
>>>
>>> 0 is returned in case of error?
>>
>> Yes, firewall/conntrack.c does not use the same semantics for return
>> values compared to the rest of the code.
>
> Then fix conntrack.c and don't make the code consistently inconsistent,
> cf. the boyscout rule.

This would further increase the (already huge) merge request. It's definitely out of focus of this branch.

>>>> --- firewall/firewall.c 2011-08-16 07:49:25 +0000
>>>> +++ firewall/firewall.c 2011-10-19 13:13:48 +0000
>>>> @@ -76,12 +76,13 @@
>>>> #include "lib/core/prefix.h"
>>>> #include "lib/core/util.h"
>>>> #include "hipd/hipd.h"
>>>> -#include "config.h"
>>>> #include "cache.h"
>>>> #include "common_types.h"
>>>> +#include "config.h"
>>>> #include "conntrack.h"
>>>> #include "esp_prot_api.h"
>>>> #include "esp_prot_conntrack.h"
>>>> +#include "firewall.h"
>>>> #include "firewall_control.h"
>>>> #include "firewall_defines.h"
>>>> #include "helpers.h"
>>>> @@ -90,9 +91,9 @@
>>>> #include "pisa.h"
>>>> #include "port_bindings.h"
>>>> #include "reinject.h"
>>>> +#include "rewrite.h"
>>>> #include "rule_management.h"
>>>> #include "user_ipsec_api.h"
>>>> -#include "firewall.h"
>>>
>>> The ordering is actually done on purpose. config.h is not in the same
>>> directory, same as the other #includes with directory prefixes and
>>> firewall.h directly "belongs" to firewall.c, so it made sense at the
>>> time to put it last and list all dependencies before. I have this
>>> feeling in the back of my head that the latter solved some real issue.
>>
>> 'make alltests' runs successfully. So, what exactly is your suggestion?
>
> My suggestion is not to change the #include ordering.

If the order of the includes is relevant, then there probably is some other problem in the header files. Everything is compiling nicely now. So I don't know what kind of issue you are tal...

[Diego Biurrun (diego-biurrun)]

On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
> On 25.10.2011, at 15:24, Diego Biurrun wrote:
> > On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
> >> On 20.10.2011, at 14:15, Diego Biurrun wrote:
> >>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
> >>>
> >>>> --- Makefile.am 2011-10-17 18:14:10 +0000
> >>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
> >>>> @@ -253,7 +256,7 @@
> >>>>
> >>>> -test_check_firewall_LDFLAGS = -ldl
> >>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
> >>>
> >>> We have solved this differently elsewhere by #including the .c file to
> >>> unit-test static functions.
> >>
> >> This has been discussed previously on the list:
> >> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
> >
> > But we currently don't favor that solution. If that needs changing,
> > it's a topic for a separate merge request and would need to be changed
> > in all places.
>
> The change was necessary in order to comply with our unit-test for new
> code policy as unit-tests would otherwise not link correctly. The only
> other option I see right now is to merge the code without unit-tests.

No, the change is not necessary. As I said before, we have solved this
differently elsewhere by #including the .c file to unit-test static
functions. Changing this is outside the scope of this merge request
and it is not at all clear that a GNU-specific linker flag is the
better solution.

> >>>> - if (!hip_fw_verify_packet(common, tuple)) {
> >>>> + if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
> >>>> + HIP_ERROR("failed to verify midauth challenge\n");
> >>>> + return 0;
> >>>> + }
> >>>
> >>> 0 is returned in case of error?
> >>
> >> Yes, firewall/conntrack.c does not use the same semantics for return
> >> values compared to the rest of the code.
> >
> > Then fix conntrack.c and don't make the code consistently inconsistent,
> > cf. the boyscout rule.
>
> This would further increase the (already huge) merge request. It's
> definitely out of focus of this branch.

Nobody claims it has to be done as part of this merge request; it's
easy enough to fix separately. If you are worried about the size of
this merge request, that's all the more reason not to make unrelated
changes to conntrack.c.

> >>>> --- firewall/firewall.c 2011-08-16 07:49:25 +0000
> >>>> +++ firewall/firewall.c 2011-10-19 13:13:48 +0000
> >>>> @@ -76,12 +76,13 @@
> >>>> #include "lib/core/prefix.h"
> >>>> #include "lib/core/util.h"
> >>>> #include "hipd/hipd.h"
> >>>> -#include "config.h"
> >>>> #include "cache.h"
> >>>> #include "common_types.h"
> >>>> +#include "config.h"
> >>>> #include "conntrack.h"
> >>>> #include "esp_prot_api.h"
> >>>> #include "esp_prot_conntrack.h"
> >>>> +#include "firewall.h"
> >>>> #include "firewall_control.h"
> >>>> #include "firewall_defines.h"
> >>>> #include "helpers.h"
> >>>> @@ -90,9 +91,9 @@
> >>>> #include "pisa.h"
> >>>> #include "port_bindings.h"
> >>>> #include "reinject.h"
> >>>> +#include "rewrite.h"
> >>>> #include "rule_management.h"
> >>>> #include "user_ipsec_api.h"
> >>>> -#i...

[Christof Mroz (christof-mroz)]

On 25.10.2011 16:35, René Hummen wrote:
>>>>> + if (!found) {
>>>>> + HIP_ERROR("CHALLENGE_RESPONSE found, but no matching nonce\n");
>>>>> + return ignore_missing_challenge_response ? 1 : 0;
>>>>> + }
>>>>> +
>>>>> + return found ? 1 : 0;
>>>>
>>>> You just checked found, no need to do it again.
>>>
>>> I guess that this has been done to ensure correct type conversion from
>>> bool to int.
>>
>> Read the code again, it's nonsense, "found" is initialized once and
>> never set again.
>
> You're right. I removed it and changed it to
>
>>>>> return ignore_missing_challenge_response ? 1 : 0;

This doesn't look correct... you signal failure even though the
CHALLENGE_RESPONSE was found? I think Diego meant to simply write

return 1;

Because we know that found is true at this point.

[Christof Mroz (christof-mroz)]

On 25.10.2011 23:02, Diego Biurrun wrote:
> On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
>> On 25.10.2011, at 15:24, Diego Biurrun wrote:
>>> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
>>>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
>>>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>>>>>
>>>>>> --- Makefile.am 2011-10-17 18:14:10 +0000
>>>>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
>>>>>> @@ -253,7 +256,7 @@
>>>>>>
>>>>>> -test_check_firewall_LDFLAGS = -ldl
>>>>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
>>>>>
>>>>> We have solved this differently elsewhere by #including the .c file to
>>>>> unit-test static functions.
>>>>
>>>> This has been discussed previously on the list:
>>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
>>>
>>> But we currently don't favor that solution. If that needs changing,
>>> it's a topic for a separate merge request and would need to be changed
>>> in all places.
>>
>> The change was necessary in order to comply with our unit-test for new
>> code policy as unit-tests would otherwise not link correctly. The only
>> other option I see right now is to merge the code without unit-tests.
>
> No, the change is not necessary. As I said before, we have solved
> this differently elsewhere by #including the .c file to unit-test
> static functions.

Including the .c file allows you to access static identifiers in unit
tests, but the libipq problem (see referenced thread) is a different one.
Apparently, Hendrik already tried to mimic the other (working) tests
already without success.

> Changing this is outside the scope of this merge request and it is not
> at all clear that a GNU-specific linker flag is the better solution.

I'd really appreciate a hint... the best I could come up with was the
LD_PRELOAD solution (see referenced thread), which AFAIK was invented
for cases like these: The need to intercept library calls.

You'd have to build a separate shared object to be linked with the tests
at runtime though, which is no rocket science but would require changes
and debugging in the build system nevertheless.

If anybody is willing to implement it anyway, I'd happily elaborate on
that idea as it would allow us to constrain the mock functions to those
tests actually using them.

[Diego Biurrun (diego-biurrun)]

On Tue, Oct 25, 2011 at 11:43:43PM +0200, Christof Mroz wrote:
> On 25.10.2011 23:02, Diego Biurrun wrote:
> >On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
> >>On 25.10.2011, at 15:24, Diego Biurrun wrote:
> >>>On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
> >>>>On 20.10.2011, at 14:15, Diego Biurrun wrote:
> >>>>>On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
> >>>>>
> >>>>>>--- Makefile.am 2011-10-17 18:14:10 +0000
> >>>>>>+++ Makefile.am 2011-10-19 13:13:48 +0000
> >>>>>>@@ -253,7 +256,7 @@
> >>>>>>
> >>>>>>-test_check_firewall_LDFLAGS = -ldl
> >>>>>>+test_check_firewall_LDFLAGS = -ldl -z muldefs
> >>>>>
> >>>>>We have solved this differently elsewhere by #including the .c file to
> >>>>>unit-test static functions.
> >>>>
> >>>>This has been discussed previously on the list:
> >>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
> >>>
> >>>But we currently don't favor that solution. If that needs changing,
> >>>it's a topic for a separate merge request and would need to be changed
> >>>in all places.
> >>
> >>The change was necessary in order to comply with our unit-test for new
> >>code policy as unit-tests would otherwise not link correctly. The only
> >>other option I see right now is to merge the code without unit-tests.
> >
> >No, the change is not necessary. As I said before, we have solved
> >this differently elsewhere by #including the .c file to unit-test
> >static functions.
>
> Including the .c file allows you to access static identifiers in
> unit tests, but the libipq problem (see referenced thread) is a
> different one.
> Apparently, Hendrik already tried to mimic the other (working) tests
> already without success.

I'd like to know what is failing exactly and how before making
a judgement here.

Diego

[Christof Mroz (christof-mroz)]

Forgot to CC launchpad.

-------- Original Message --------
Subject: [hipl-dev] Re: [Merge]
lp:~midauth-pisa-devs/hipl/midauth-firewall into lp:hipl
Date: Wed, 26 Oct 2011 23:16:18 +0200
From: Christof Mroz <email address hidden>
Reply-To: <email address hidden>
To: <email address hidden>

On 26.10.2011 22:57, Diego Biurrun wrote:
> On Tue, Oct 25, 2011 at 11:43:43PM +0200, Christof Mroz wrote:
>> On 25.10.2011 23:02, Diego Biurrun wrote:
>>> On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
>>>> On 25.10.2011, at 15:24, Diego Biurrun wrote:
>>>>> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
>>>>>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
>>>>>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>>>>>>>
>>>>>>>> --- Makefile.am 2011-10-17 18:14:10 +0000
>>>>>>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
>>>>>>>> @@ -253,7 +256,7 @@
>>>>>>>>
>>>>>>>> -test_check_firewall_LDFLAGS = -ldl
>>>>>>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
>>>>>>>
>>>>>>> We have solved this differently elsewhere by #including the .c file to
>>>>>>> unit-test static functions.
>>>>>>
>>>>>> This has been discussed previously on the list:
>>>>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
>>>>>
>>>>> But we currently don't favor that solution. If that needs changing,
>>>>> it's a topic for a separate merge request and would need to be changed
>>>>> in all places.
>>>>
>>>> The change was necessary in order to comply with our unit-test for new
>>>> code policy as unit-tests would otherwise not link correctly. The only
>>>> other option I see right now is to merge the code without unit-tests.
>>>
>>> No, the change is not necessary. As I said before, we have solved
>>> this differently elsewhere by #including the .c file to unit-test
>>> static functions.
>>
>> Including the .c file allows you to access static identifiers in
>> unit tests, but the libipq problem (see referenced thread) is a
>> different one.
>> Apparently, Hendrik already tried to mimic the other (working) tests
>> already without success.
>
> I'd like to know what is failing exactly and how before making
> a judgement here.

See the referenced thread for details, but essentially we need to mock
ipq_get_packet() which is usually provided by linking -lipq.
Strangely, while our usual approach (simply exporting a function with
exact same signature in an object file) works for libc, it does fail
with a "multiple definition" error for explicitly linked-in libs like
libipq.
Making libipq just as "magic" as libc would solve the problem, if that's
possible.

[Diego Biurrun (diego-biurrun)]

On Sat, Oct 22, 2011 at 02:44:31PM +0200, Christof Mroz wrote:
> On 22.10.2011 13:36, Diego Biurrun wrote:
> >>>>+static void *rebase(const void *const field,
> >>>>+ const void *const old,
> >>>>+ void *const new)
> >>>>+{
> >>>>+ return (char *) new + ((const char *) field - (const char *) old);
> >>>
> >>>pointless parentheses
> >>
> >>(field - old) is usually a low "number", if we treat pointers
> >>numerically, while (new + field) is usually big. Could even be
> >>bigger than the machine pointer size, especially considering the
> >>gamut of devices we support. Are you sure the compiler will do the
> >>right thing here if we drop the parentheses?
> >
> >I do not believe that parentheses work in the way you hope for here.
> >I would assume that the compiler is free to evaluate the operations
> >in arbitrary order. Have you verified that the behavior you seem to
> >be relying on is actually implemented like you expect?
>
> Good question. Admittedly I didn't know about the details so far
> either, so I dug around a bit and Example 6 in section 5.1.2.3 of
> [1] (page 15) seems to answer our question. It states:
> >On a machine in which overflow silently generates some value and where
> >positive and negative overflows cancel, the above expression statement
> >can be rewritten by the implementation in any of the above ways
> >because the same result will occur.
> This is the case on x86 for example, meaning that we could safely
> overflow around as long as we don't care about the bits outside our
> machine word, on this platform. I can show an example if you don't
> believe me.
>
> On the other hand, it is stated that (in reference to an example
> involving addition/subtraction):
> >On a machine in which overflows produce an explicit trap and in which
> >the range of values representable by an int is [32768, +32767], the
> >implementation cannot rewrite this expression as [...]
> So by keeping the parentheses, we can ensure that our code runs on
> this kind of platform too, right?
>
> [1] http://www.open-std.org/JTC1/SC22/WG14/www/docs/n1256.pdf

The standard is quoted - we're taking this to a whole new level :)

I would suggest a comment to explain the parentheses in this case.
Very few people working on HIPL will be aware of why they might be
needed.

> >>>>+ while ((current = hip_get_next_param_readwrite(hip, current))) {
> >>>>+ if (hip_get_param_type(current)>= param_type) {
> >>>>+ uint8_t *const splice = (uint8_t *const) current;
> >>>>+
> >>>>+ memmove(splice + param_len, splice, end - splice);
> >>>>+ out = splice;
> >>>>+ break;
> >>>
> >>>The splice variable looks unnecessary.
> >>
> >>Personally, I found the number of casts distracting.
> >
> >If I did not misread the code, then no casts should be necessary.
>
> It's true that memmove() accepts void*, but current must be
> re-interpreted as a uint8_t buffer for the pointer arithmetic to
> work correctly (since param_len is given as a byte count).

Whatever you prefer then.

Diego

[Diego Biurrun (diego-biurrun)]

On Wed, Oct 26, 2011 at 11:16:18PM +0200, Christof Mroz wrote:
> On 26.10.2011 22:57, Diego Biurrun wrote:
> >On Tue, Oct 25, 2011 at 11:43:43PM +0200, Christof Mroz wrote:
> >>On 25.10.2011 23:02, Diego Biurrun wrote:
> >>>On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
> >>>>On 25.10.2011, at 15:24, Diego Biurrun wrote:
> >>>>>On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
> >>>>>>On 20.10.2011, at 14:15, Diego Biurrun wrote:
> >>>>>>>On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
> >>>>>>>
> >>>>>>>>--- Makefile.am 2011-10-17 18:14:10 +0000
> >>>>>>>>+++ Makefile.am 2011-10-19 13:13:48 +0000
> >>>>>>>>@@ -253,7 +256,7 @@
> >>>>>>>>
> >>>>>>>>-test_check_firewall_LDFLAGS = -ldl
> >>>>>>>>+test_check_firewall_LDFLAGS = -ldl -z muldefs
> >>>>>>>
> >>>>>>>We have solved this differently elsewhere by #including the .c file to
> >>>>>>>unit-test static functions.
> >>>>>>
> >>>>>>This has been discussed previously on the list:
> >>>>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
> >>>>>
> >>>>>But we currently don't favor that solution. If that needs changing,
> >>>>>it's a topic for a separate merge request and would need to be changed
> >>>>>in all places.
> >>>>
> >>>>The change was necessary in order to comply with our unit-test for new
> >>>>code policy as unit-tests would otherwise not link correctly. The only
> >>>>other option I see right now is to merge the code without unit-tests.
> >>>
> >>>No, the change is not necessary. As I said before, we have solved
> >>>this differently elsewhere by #including the .c file to unit-test
> >>>static functions.
> >>
> >>Including the .c file allows you to access static identifiers in
> >>unit tests, but the libipq problem (see referenced thread) is a
> >>different one.
> >>Apparently, Hendrik already tried to mimic the other (working) tests
> >>already without success.
> >
> >I'd like to know what is failing exactly and how before making
> >a judgement here.
>
> See the referenced thread for details, but essentially we need to
> mock ipq_get_packet() which is usually provided by linking -lipq.

What I don't get is the reason why we need to mock that function
in the first place. Probably I am missing something totally
obvious.

Diego

[Christof Mroz (christof-mroz)]

On 27.10.2011 00:20, Diego Biurrun wrote:
>> See the referenced thread for details, but essentially we need to
>> mock ipq_get_packet() which is usually provided by linking -lipq.
>
> What I don't get is the reason why we need to mock that function
> in the first place. Probably I am missing something totally
> obvious.

Looking at the patch and judging from my memory, I think it's called by
hipfw_init_context().
On the one hand, much of the firewall code makes heavy direct use of ipq
structures (they're even part of the context structure itself), but now
that you mention it... maybe hipfw_init_context() could still be split
into two functions such that you can just hand it a fake ipq_packet pointer.
What do you think, René?

This would just postpone a more general problem of course, but maybe I
can look into it more thoroughly when the lectures are over.

[lp:~midauth-pisa-devs/hipl/midauth-firewall]

6101. By René Hummen on 2011-11-02

revert re-ordering of includes

6102. By René Hummen on 2011-11-02

fix cyclic redundancy in midauth.h and firewall_defines.h

[René Hummen (rene-hummen)]

Begin forwarded message:
> From: René Hummen <email address hidden>
> Date: 2. November 2011 17:57:02 MEZ
> To: <email address hidden>
> Subject: Re: [hipl-dev] Re: [Merge] lp:~midauth-pisa-devs/hipl/midauth-firewall into lp:hipl
>
> On 25.10.2011, at 23:15, Christof Mroz wrote:
>> On 25.10.2011 16:35, René Hummen wrote:
>>>>>>> + if (!found) {
>>>>>>> + HIP_ERROR("CHALLENGE_RESPONSE found, but no matching nonce\n");
>>>>>>> + return ignore_missing_challenge_response ? 1 : 0;
>>>>>>> + }
>>>>>>> +
>>>>>>> + return found ? 1 : 0;
>>>>>>
>>>>>> You just checked found, no need to do it again.
>>>>>
>>>>> I guess that this has been done to ensure correct type conversion from
>>>>> bool to int.
>>>>
>>>> Read the code again, it's nonsense, "found" is initialized once and
>>>> never set again.
>>>
>>> You're right. I removed it and changed it to
>>>
>>>>>>> return ignore_missing_challenge_response ? 1 : 0;
>>
>> This doesn't look correct... you signal failure even though the CHALLENGE_RESPONSE was found? I think Diego meant to simply write
>>
>> return 1;
>>
>> Because we know that found is true at this point.
>
> found was always false before I removed the variable. Hence, !found evaluates to true. As this would be the path that the original code would follow, I decided to mimic it. Furthermore, if a correct response is found the while loop returns to the caller.

[René Hummen (rene-hummen)]

Begin forwarded message:
> From: René Hummen <email address hidden>
> Date: 2. November 2011 18:44:49 MEZ
> To: <email address hidden>
> Subject: Re: [hipl-dev] Re: [Merge] lp:~midauth-pisa-devs/hipl/midauth-firewall into lp:hipl
>
> On 27.10.2011, at 00:50, Christof Mroz wrote:
>> On 27.10.2011 00:20, Diego Biurrun wrote:
>>>> See the referenced thread for details, but essentially we need to
>>>> mock ipq_get_packet() which is usually provided by linking -lipq.
>>>
>>> What I don't get is the reason why we need to mock that function
>>> in the first place. Probably I am missing something totally
>>> obvious.
>>
>> Looking at the patch and judging from my memory, I think it's called by hipfw_init_context().
>> On the one hand, much of the firewall code makes heavy direct use of ipq structures (they're even part of the context structure itself), but now that you mention it... maybe hipfw_init_context() could still be split into two functions such that you can just hand it a fake ipq_packet pointer.
>> What do you think, René?
>
> I already thought about splitting up the code when implementing the unit test. But then I realized that mocking of the ipq functionality actually worked and decided to keep hip_fw_init_context() as it is. It's no problem to split up functionality though. Just one thing: Does anybody have a simple way to convert HIP_HEXDUMP output to char values like "\x00\x30\xF9\x16\x00\x88\xFF\xFF\x00". Last time I did that manually and realized that this was a bad idea. It would be perfect if we could specify the line length of the converted output in order to prevent long lines. If we have such a script, it's definitely worth adding it to our repository.
>
>> This would just postpone a more general problem of course, but maybe I can look into it more thoroughly when the lectures are over.
>
> Thanks, that would be great.

[René Hummen (rene-hummen)]

On 25.10.2011, at 23:04, Diego Biurrun wrote:
> On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
>> On 25.10.2011, at 15:24, Diego Biurrun wrote:
>>> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
>>>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
>>>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>
>>>>>> - if (!hip_fw_verify_packet(common, tuple)) {
>>>>>> + if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
>>>>>> + HIP_ERROR("failed to verify midauth challenge\n");
>>>>>> + return 0;
>>>>>> + }
>>>>>
>>>>> 0 is returned in case of error?
>>>>
>>>> Yes, firewall/conntrack.c does not use the same semantics for return
>>>> values compared to the rest of the code.
>>>
>>> Then fix conntrack.c and don't make the code consistently inconsistent,
>>> cf. the boyscout rule.
>>
>> This would further increase the (already huge) merge request. It's
>> definitely out of focus of this branch.
>
> Nobody claims it has to be done as part of this merge request; it's
> easy enough to fix separately. If you are worried about the size of
> this merge request, that's all the more reason not to make unrelated
> changes to conntrack.c.

I still changed the return values of hip_fw_verify_and_store_host_id() because some calling functions actually expect non-zero values in case of an error. So I either need to change the caller or the callee. I'll directly apply this change to trunk though.

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[Christof Mroz (christof-mroz)]

On 02.11.2011 18:44, René Hummen wrote:
> Just one thing: Does anybody have a simple way to convert HIP_HEXDUMP
> output to char values like "\x00\x30\xF9\x16\x00\x88\xFF\xFF\x00".
> Last time I did that manually and realized that this was a bad idea.
> It would be perfect if we could specify the line length of the
> converted output in order to prevent long lines. If we have such a
> script, it's definitely worth adding it to our repository.

It would probably be simpler if HIP_HEXDUMP could read e.g. an
environment variable which specifies the desired output format. Since it
affects the, debug build only it doesn't need to be documented to the
end user and such.

[lp:~midauth-pisa-devs/hipl/midauth-firewall]

6103. By René Hummen on 2011-11-02

do not change return values of hip_fw_verify_packet()

6104. By René Hummen on 2011-11-03

split up hip_fw_init_context() for unit tests

[René Hummen (rene-hummen)]

On 27.10.2011, at 00:53, Diego Biurrun wrote:
> On Wed, Oct 26, 2011 at 11:16:18PM +0200, Christof Mroz wrote:
>> On 26.10.2011 22:57, Diego Biurrun wrote:
>>> On Tue, Oct 25, 2011 at 11:43:43PM +0200, Christof Mroz wrote:
>>>> On 25.10.2011 23:02, Diego Biurrun wrote:
>>>>> On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
>>>>>> On 25.10.2011, at 15:24, Diego Biurrun wrote:
>>>>>>> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
>>>>>>>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
>>>>>>>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>>>>>>>>>
>>>>>>>>>> --- Makefile.am 2011-10-17 18:14:10 +0000
>>>>>>>>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
>>>>>>>>>> @@ -253,7 +256,7 @@
>>>>>>>>>>
>>>>>>>>>> -test_check_firewall_LDFLAGS = -ldl
>>>>>>>>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
>>>>>>>>>
>>>>>>>>> We have solved this differently elsewhere by #including the .c file to
>>>>>>>>> unit-test static functions.
>>>>>>>>
>>>>>>>> This has been discussed previously on the list:
>>>>>>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
>>>>>>>
>>>>>>> But we currently don't favor that solution. If that needs changing,
>>>>>>> it's a topic for a separate merge request and would need to be changed
>>>>>>> in all places.
>>>>>>
>>>>>> The change was necessary in order to comply with our unit-test for new
>>>>>> code policy as unit-tests would otherwise not link correctly. The only
>>>>>> other option I see right now is to merge the code without unit-tests.
>>>>>
>>>>> No, the change is not necessary. As I said before, we have solved
>>>>> this differently elsewhere by #including the .c file to unit-test
>>>>> static functions.
>>>>
>>>> Including the .c file allows you to access static identifiers in
>>>> unit tests, but the libipq problem (see referenced thread) is a
>>>> different one.
>>>> Apparently, Hendrik already tried to mimic the other (working) tests
>>>> already without success.
>>>
>>> I'd like to know what is failing exactly and how before making
>>> a judgement here.
>>
>> See the referenced thread for details, but essentially we need to
>> mock ipq_get_packet() which is usually provided by linking -lipq.
>
> What I don't get is the reason why we need to mock that function
> in the first place. Probably I am missing something totally
> obvious.

We are calling fw_init_context() to derive a firewall context structure of an inbound HIP packet for unit-tests of midauth and rewrite functionality. fw_init_context() in turn calls ipq_get_packet(). The linker will complain about multiple definitions of ipq_get_packet() when compiling the unit tests with mocking of ipq_get_packet(). While this has not been a problem for other library functions so far, libipq behaves differently for some reason.

Anyway, I tried splitting up fw_init_context() into one function that calls ipq_get_packet() and another function that implements the setup of the firewall context struct - fw_setup_context(). This fixes the need for mocking ipq_get_packet(), so there should be no need for -z muldefs in the Makefile any more. However, now I am running ...

[Diego Biurrun (diego-biurrun)]

On Tue, Nov 08, 2011 at 06:49:23PM +0000, René Hummen wrote:
> On 27.10.2011, at 00:53, Diego Biurrun wrote:
> > On Wed, Oct 26, 2011 at 11:16:18PM +0200, Christof Mroz wrote:
> >> On 26.10.2011 22:57, Diego Biurrun wrote:
> >>> On Tue, Oct 25, 2011 at 11:43:43PM +0200, Christof Mroz wrote:
> >>>> On 25.10.2011 23:02, Diego Biurrun wrote:
> >>>>> On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
> >>>>>> On 25.10.2011, at 15:24, Diego Biurrun wrote:
> >>>>>>> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
> >>>>>>>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
> >>>>>>>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
> >>>>>>>>>
> >>>>>>>>>> --- Makefile.am 2011-10-17 18:14:10 +0000
> >>>>>>>>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
> >>>>>>>>>> @@ -253,7 +256,7 @@
> >>>>>>>>>>
> >>>>>>>>>> -test_check_firewall_LDFLAGS = -ldl
> >>>>>>>>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
> >>>>>>>>>
> >>>>>>>>> We have solved this differently elsewhere by #including the .c file to
> >>>>>>>>> unit-test static functions.
> >>>>>>>>
> >>>>>>>> This has been discussed previously on the list:
> >>>>>>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
> >>>>>>>
> >>>>>>> But we currently don't favor that solution. If that needs changing,
> >>>>>>> it's a topic for a separate merge request and would need to be changed
> >>>>>>> in all places.
> >>>>>>
> >>>>>> The change was necessary in order to comply with our unit-test for new
> >>>>>> code policy as unit-tests would otherwise not link correctly. The only
> >>>>>> other option I see right now is to merge the code without unit-tests.
> >>>>>
> >>>>> No, the change is not necessary. As I said before, we have solved
> >>>>> this differently elsewhere by #including the .c file to unit-test
> >>>>> static functions.
> >>>>
> >>>> Including the .c file allows you to access static identifiers in
> >>>> unit tests, but the libipq problem (see referenced thread) is a
> >>>> different one.
> >>>> Apparently, Hendrik already tried to mimic the other (working) tests
> >>>> already without success.
> >>>
> >>> I'd like to know what is failing exactly and how before making
> >>> a judgement here.
> >>
> >> See the referenced thread for details, but essentially we need to
> >> mock ipq_get_packet() which is usually provided by linking -lipq.
> >
> > What I don't get is the reason why we need to mock that function
> > in the first place. Probably I am missing something totally
> > obvious.
>
> We are calling fw_init_context() to derive a firewall context
> structure of an inbound HIP packet for unit-tests of midauth
> and rewrite functionality. fw_init_context() in turn calls
> ipq_get_packet(). The linker will complain about multiple definitions
> of ipq_get_packet() when compiling the unit tests with mocking of
> ipq_get_packet(). While this has not been a problem for other library
> functions so far, libipq behaves differently for some reason.
>
> Anyway, I tried splitting up fw_init_context() into one function that
> calls ipq_get_packet() and another function that implements the setup
> of the firew...

[lp:~midauth-pisa-devs/hipl/midauth-firewall]

6105. By Henrik Ziegeldorf on 2011-11-09

-z muldefs is necessary with mock tests

6106. By Henrik Ziegeldorf on 2011-11-09

Reversed revision 6104. The split is unnecessary if mocking still used.

6107. By Henrik Ziegeldorf on 2011-11-09

Merged trunk.

[Miika Komu (miika-iki)]

Hi,

On 08/11/11 20:49, René Hummen wrote:
> On 27.10.2011, at 00:53, Diego Biurrun wrote:
>> On Wed, Oct 26, 2011 at 11:16:18PM +0200, Christof Mroz wrote:
>>> On 26.10.2011 22:57, Diego Biurrun wrote:
>>>> On Tue, Oct 25, 2011 at 11:43:43PM +0200, Christof Mroz wrote:
>>>>> On 25.10.2011 23:02, Diego Biurrun wrote:
>>>>>> On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
>>>>>>> On 25.10.2011, at 15:24, Diego Biurrun wrote:
>>>>>>>> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
>>>>>>>>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
>>>>>>>>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>>>>>>>>>>
>>>>>>>>>>> --- Makefile.am 2011-10-17 18:14:10 +0000
>>>>>>>>>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
>>>>>>>>>>> @@ -253,7 +256,7 @@
>>>>>>>>>>>
>>>>>>>>>>> -test_check_firewall_LDFLAGS = -ldl
>>>>>>>>>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
>>>>>>>>>>
>>>>>>>>>> We have solved this differently elsewhere by #including the .c file to
>>>>>>>>>> unit-test static functions.
>>>>>>>>>
>>>>>>>>> This has been discussed previously on the list:
>>>>>>>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
>>>>>>>>
>>>>>>>> But we currently don't favor that solution. If that needs changing,
>>>>>>>> it's a topic for a separate merge request and would need to be changed
>>>>>>>> in all places.
>>>>>>>
>>>>>>> The change was necessary in order to comply with our unit-test for new
>>>>>>> code policy as unit-tests would otherwise not link correctly. The only
>>>>>>> other option I see right now is to merge the code without unit-tests.
>>>>>>
>>>>>> No, the change is not necessary. As I said before, we have solved
>>>>>> this differently elsewhere by #including the .c file to unit-test
>>>>>> static functions.
>>>>>
>>>>> Including the .c file allows you to access static identifiers in
>>>>> unit tests, but the libipq problem (see referenced thread) is a
>>>>> different one.
>>>>> Apparently, Hendrik already tried to mimic the other (working) tests
>>>>> already without success.
>>>>
>>>> I'd like to know what is failing exactly and how before making
>>>> a judgement here.
>>>
>>> See the referenced thread for details, but essentially we need to
>>> mock ipq_get_packet() which is usually provided by linking -lipq.
>>
>> What I don't get is the reason why we need to mock that function
>> in the first place. Probably I am missing something totally
>> obvious.
>
> We are calling fw_init_context() to derive a firewall context structure of an inbound HIP packet for unit-tests of midauth and rewrite functionality. fw_init_context() in turn calls ipq_get_packet(). The linker will complain about multiple definitions of ipq_get_packet() when compiling the unit tests with mocking of ipq_get_packet(). While this has not been a problem for other library functions so far, libipq behaves differently for some reason.
>
> Anyway, I tried splitting up fw_init_context() into one function that calls ipq_get_packet() and another function that implements the setup of the firewall context struct - fw_setup_context(). This fixes the need for mocking ipq_get_packet(), so t...

[Miika Komu (miika-iki)]

Hi,

On 12/11/11 00:09, Miika Komu wrote:
> Hi,
>
> On 08/11/11 20:49, René Hummen wrote:
>> On 27.10.2011, at 00:53, Diego Biurrun wrote:
>>> On Wed, Oct 26, 2011 at 11:16:18PM +0200, Christof Mroz wrote:
>>>> On 26.10.2011 22:57, Diego Biurrun wrote:
>>>>> On Tue, Oct 25, 2011 at 11:43:43PM +0200, Christof Mroz wrote:
>>>>>> On 25.10.2011 23:02, Diego Biurrun wrote:
>>>>>>> On Tue, Oct 25, 2011 at 02:35:31PM +0000, René Hummen wrote:
>>>>>>>> On 25.10.2011, at 15:24, Diego Biurrun wrote:
>>>>>>>>> On Tue, Oct 25, 2011 at 02:28:06PM +0200, René Hummen wrote:
>>>>>>>>>> On 20.10.2011, at 14:15, Diego Biurrun wrote:
>>>>>>>>>>> On Wed, Oct 19, 2011 at 01:17:30PM +0000, René Hummen wrote:
>>>>>>>>>>>
>>>>>>>>>>>> --- Makefile.am 2011-10-17 18:14:10 +0000
>>>>>>>>>>>> +++ Makefile.am 2011-10-19 13:13:48 +0000
>>>>>>>>>>>> @@ -253,7 +256,7 @@
>>>>>>>>>>>>
>>>>>>>>>>>> -test_check_firewall_LDFLAGS = -ldl
>>>>>>>>>>>> +test_check_firewall_LDFLAGS = -ldl -z muldefs
>>>>>>>>>>>
>>>>>>>>>>> We have solved this differently elsewhere by #including the
>>>>>>>>>>> .c file to
>>>>>>>>>>> unit-test static functions.
>>>>>>>>>>
>>>>>>>>>> This has been discussed previously on the list:
>>>>>>>>>> http://www.freelists.org/post/hipl-dev/Mock-functions-for-hipl-unit-tests
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> But we currently don't favor that solution. If that needs
>>>>>>>>> changing,
>>>>>>>>> it's a topic for a separate merge request and would need to be
>>>>>>>>> changed
>>>>>>>>> in all places.
>>>>>>>>
>>>>>>>> The change was necessary in order to comply with our unit-test
>>>>>>>> for new
>>>>>>>> code policy as unit-tests would otherwise not link correctly.
>>>>>>>> The only
>>>>>>>> other option I see right now is to merge the code without
>>>>>>>> unit-tests.
>>>>>>>
>>>>>>> No, the change is not necessary. As I said before, we have solved
>>>>>>> this differently elsewhere by #including the .c file to unit-test
>>>>>>> static functions.
>>>>>>
>>>>>> Including the .c file allows you to access static identifiers in
>>>>>> unit tests, but the libipq problem (see referenced thread) is a
>>>>>> different one.
>>>>>> Apparently, Hendrik already tried to mimic the other (working) tests
>>>>>> already without success.
>>>>>
>>>>> I'd like to know what is failing exactly and how before making
>>>>> a judgement here.
>>>>
>>>> See the referenced thread for details, but essentially we need to
>>>> mock ipq_get_packet() which is usually provided by linking -lipq.
>>>
>>> What I don't get is the reason why we need to mock that function
>>> in the first place. Probably I am missing something totally
>>> obvious.
>>
>> We are calling fw_init_context() to derive a firewall context
>> structure of an inbound HIP packet for unit-tests of midauth and
>> rewrite functionality. fw_init_context() in turn calls
>> ipq_get_packet(). The linker will complain about multiple definitions
>> of ipq_get_packet() when compiling the unit tests with mocking of
>> ipq_get_packet(). While this has not been a problem for other library
>> functions so far, libipq behaves differently for some reason.
>>
>> Anyway, I tried splitting up fw_init_context() into one function that
>> calls ipq_get_...

Unmerged revisions

=== modified file 'Makefile.am'
--- Makefile.am	2011-10-17 18:14:10 +0000
+++ Makefile.am	2011-10-25 12:58:23 +0000
@@ -153,6 +153,7 @@
                          firewall/lsi.c                 \
                          firewall/port_bindings.c       \
                          firewall/reinject.c            \
+                         firewall/rewrite.c             \
                          firewall/rule_management.c     \
                          firewall/user_ipsec_api.c      \
                          firewall/user_ipsec_esp.c      \
@@ -161,8 +162,7 @@
                          modules/midauth/lib/midauth_builder.c
 
 if HIP_MIDAUTH
-firewall_hipfw_sources += firewall/midauth.c   \
-                          firewall/pisa.c      \
+firewall_hipfw_sources += firewall/pisa.c      \
                           firewall/pisa_cert.c
 endif
 
@@ -171,6 +171,7 @@
 # Add all files that need to be excluded here.
 firewall_hipfw_SOURCES = $(firewall_hipfw_sources) \
                          firewall/conntrack.c      \
+                         firewall/midauth.c        \
                          firewall/main.c
 
 lib_core_libhipcore_la_SOURCES = lib/core/builder.c         \
@@ -215,7 +216,9 @@
                               test/firewall/file_buffer.c    \
                               test/firewall/helpers.c        \
                               test/firewall/line_parser.c    \
+                              test/firewall/midauth.c        \
                               test/firewall/port_bindings.c  \
+                              test/firewall/rewrite.c        \
                               $(firewall_hipfw_sources)
 
 test_check_lib_core_SOURCES = test/check_lib_core.c          \
@@ -253,7 +256,7 @@
 
 ### dynamic library dependencies ###
 
-test_check_firewall_LDFLAGS              = -ldl
+test_check_firewall_LDFLAGS              = -ldl -z muldefs
 
 dist_sbin_SCRIPTS = tools/hipdnskeyparse/hipdnskeyparse \
                     tools/hipdnsproxy/hipdnsproxy       \
 
=== modified file 'firewall/conntrack.c'
--- firewall/conntrack.c	2011-10-19 09:51:41 +0000
+++ firewall/conntrack.c	2011-10-25 12:58:23 +0000
@@ -998,7 +998,7 @@
  *
  * @param common    the hip packet to be verified
  * @param tuple     the corresponding connection tuple
- * @return 1 for valid packets, 0 otherwise
+ * @return 0 for valid packets, 1 otherwise
  */
 static int hip_fw_verify_packet(struct hip_common *const common,
                                 const struct tuple *const tuple)
@@ -1017,12 +1017,12 @@
                                        common)) {
         HIP_INFO("Signature verification failed\n");
 
-        return 0;
+        return 1;
     }
 
     HIP_INFO("Signature successfully verified\n");
 
-    return 1;
+    return 0;
 }
 
 /** Verify message authenticity for message types without existing security
@@ -1030,7 +1030,9 @@
  *
  * @param common    the hip packet to be verified
  * @param tuple     the corresponding connection tuple
- * @return 1 for valid packets, 0 otherwise
+ * @return 0 for valid packets,
+ *         1 if HOST_ID missing or verification unsuccessful, and
+ *        -1 in case of an error
  */
 static int hip_fw_verify_and_store_host_id(struct hip_common *const common,
                                            struct tuple *const tuple)
@@ -1040,6 +1042,11 @@
     hip_tlv_len                     len = 0;
     int                             err = 0;
 
+    HIP_ASSERT(common != NULL);
+    HIP_ASSERT(tuple != NULL);
+    HIP_ASSERT(tuple->hip_tuple != NULL);
+    HIP_ASSERT(tuple->hip_tuple->data != NULL);
+
     HIP_IFEL(!host_id, -1, "Awaiting HOST_ID in control message, but none found\n");
 
     len = hip_get_param_total_len(host_id);
@@ -1077,7 +1084,7 @@
         goto out_err;
     }
 
-    err = !hip_fw_verify_packet(common, tuple);
+    err = hip_fw_verify_packet(common, tuple);
 
 out_err:
     if (err) {
@@ -1170,7 +1177,7 @@
  */
 static int handle_r1(struct hip_common *const common,
                      struct tuple *const tuple,
-                     UNUSED struct hip_fw_context *const ctx)
+                     struct hip_fw_context *const ctx)
 {
     if (hip_fw_verify_and_store_host_id(common, tuple)) {
         HIP_ERROR("unable to create security state from R1 packet\n");
@@ -1183,6 +1190,11 @@
         return 0;
     }
 
+    if (!hipfw_midauth_add_challenge(ctx, tuple->midauth_nonce)) {
+        HIP_ERROR("failed to add midauth challenge\n");
+        return 0;
+    }
+
     tuple->connection->state = HIP_STATE_R1_SENT;
     return 1;
 }
@@ -1203,7 +1215,19 @@
                      struct tuple *const tuple,
                      struct hip_fw_context *const ctx)
 {
-    const struct hip_esp_info *const esp_info = hip_get_param(common, HIP_PARAM_ESP_INFO);
+    struct tuple                    *other_dir = NULL;
+    const struct hip_esp_info *const esp_info  = hip_get_param(common, HIP_PARAM_ESP_INFO);
+
+    if (tuple->direction == ORIGINAL_DIR) {
+        other_dir = &tuple->connection->reply;
+    } else {
+        other_dir = &tuple->connection->original;
+    }
+
+    if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
+        HIP_ERROR("failed to verify midauth challenge\n");
+        return 0;
+    }
 
     if (hip_fw_verify_and_store_host_id(common, tuple)) {
         HIP_ERROR("unable to create security state from I2 packet\n");
@@ -1221,6 +1245,11 @@
         return 0;
     }
 
+    if (!hipfw_midauth_add_challenge(ctx, tuple->midauth_nonce)) {
+        HIP_ERROR("failed to add midauth challenge\n");
+        return 0;
+    }
+
     tuple->connection->state = HIP_STATE_I2_SENT;
     return 1;
 }
@@ -1242,9 +1271,21 @@
                      struct tuple *const tuple,
                      const struct hip_fw_context *const ctx)
 {
-    const struct hip_esp_info *const esp_info = hip_get_param(common, HIP_PARAM_ESP_INFO);
-
-    if (!hip_fw_verify_packet(common, tuple)) {
+    const struct tuple              *other_dir = NULL;
+    const struct hip_esp_info *const esp_info  = hip_get_param(common, HIP_PARAM_ESP_INFO);
+
+    if (tuple->direction == ORIGINAL_DIR) {
+        other_dir = &tuple->connection->reply;
+    } else {
+        other_dir = &tuple->connection->original;
+    }
+
+    if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
+        HIP_ERROR("failed to verify midauth challenge\n");
+        return 0;
+    }
+
+    if (hip_fw_verify_packet(common, tuple)) {
         HIP_ERROR("failed to verify R2 packet\n");
         return 0;
     }
@@ -1421,9 +1462,6 @@
 
             remove_connection(tuple->connection);
 
-            /** FIXME the firewall should not care about locator for esp tracking
-             *
-             * NOTE: modify this regardingly! */
             if (insert_connection_from_update(common, ctx, esp_info)) {
                 HIP_ERROR("connection insertion failed\n");
 
@@ -1502,11 +1540,12 @@
                          struct tuple *tuple,
                          struct hip_fw_context *const ctx)
 {
-    const struct hip_esp_info *esp_info = NULL;
-    const struct hip_locator  *locator  = NULL;
-    const struct hip_seq      *seq      = NULL;
-    const struct hip_ack      *ack      = NULL;
-    enum hip_state             state    = HIP_STATE_NONE;
+    const struct hip_esp_info *esp_info  = NULL;
+    const struct hip_locator  *locator   = NULL;
+    const struct hip_seq      *seq       = NULL;
+    const struct hip_ack      *ack       = NULL;
+    struct tuple              *other_dir = NULL;
+    enum hip_state             state     = HIP_STATE_NONE;
 
     /* classify UPDATE message */
     esp_info = hip_get_param(common, HIP_PARAM_ESP_INFO);
@@ -1526,14 +1565,26 @@
             tuple = get_tuple_by_hits(&common->hits, &common->hitr);
         }
 
+        if (!tuple || !hipfw_midauth_add_challenge(ctx, tuple->midauth_nonce)) {
+            HIP_ERROR("failed to add midauth challenge\n");
+            return 0;
+        }
+
         state = HIP_STATE_U1_SENT;
     } else if (esp_info && seq && ack) {
         if (!tuple) {
             HIP_ERROR("Insufficient stored state to process UPDATE\n");
             return 0;
         }
-
-        if (!hip_fw_verify_packet(common, tuple)) {
+        other_dir = tuple->direction == ORIGINAL_DIR ? &tuple->connection->reply
+                    : &tuple->connection->original;
+
+        if (!hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
+            HIP_ERROR("failed to verify midauth challenge\n");
+            return 0;
+        }
+
+        if (hip_fw_verify_and_store_host_id(common, tuple)) {
             HIP_ERROR("failed to verify UPDATE packet\n");
             return 0;
         }
@@ -1543,14 +1594,27 @@
             return 0;
         }
 
+        if (!tuple || !hipfw_midauth_add_challenge(ctx, tuple->midauth_nonce)) {
+            HIP_ERROR("failed to add midauth challenge\n");
+            return 0;
+        }
+
         state = HIP_STATE_U2_SENT;
     } else if (ack) {
         if (!tuple) {
             HIP_ERROR("Insufficient stored state to process UPDATE\n");
             return 0;
         }
-
-        if (!hip_fw_verify_packet(common, tuple)) {
+        other_dir = tuple->direction == ORIGINAL_DIR ? &tuple->connection->reply
+                    : &tuple->connection->original;
+
+        if (!other_dir ||
+            !hipfw_midauth_verify_challenge(ctx, other_dir->midauth_nonce)) {
+            HIP_ERROR("failed to verify midauth challenge\n");
+            return 0;
+        }
+
+        if (hip_fw_verify_and_store_host_id(common, tuple)) {
             HIP_ERROR("failed to verify UPDATE packet\n");
             return 0;
         }
@@ -1592,7 +1656,7 @@
 #endif
     HIP_IFEL(!tuple, 1, "no connection state for CLOSE\n");
 
-    HIP_IFEL(!hip_fw_verify_packet(common, tuple), 0,
+    HIP_IFEL(hip_fw_verify_packet(common, tuple), 0,
              "failed to verify CLOSE packet\n");
 
     tuple->connection->state = HIP_STATE_CLOSING;
@@ -1628,7 +1692,7 @@
 #endif
     HIP_IFEL(!tuple, 1, "no connection state for CLOSE_ACK\n");
 
-    HIP_IFEL(!hip_fw_verify_packet(common, tuple), 0,
+    HIP_IFEL(hip_fw_verify_packet(common, tuple), 0,
              "failed to verify CLOSE_ACK packet\n");
 
     remove_connection(tuple->connection);
 
=== modified file 'firewall/firewall.c'
--- firewall/firewall.c	2011-08-16 07:49:25 +0000
+++ firewall/firewall.c	2011-10-25 12:58:23 +0000
@@ -76,12 +76,13 @@
 #include "lib/core/prefix.h"
 #include "lib/core/util.h"
 #include "hipd/hipd.h"
-#include "config.h"
 #include "cache.h"
 #include "common_types.h"
+#include "config.h"
 #include "conntrack.h"
 #include "esp_prot_api.h"
 #include "esp_prot_conntrack.h"
+#include "firewall.h"
 #include "firewall_control.h"
 #include "firewall_defines.h"
 #include "helpers.h"
@@ -90,9 +91,9 @@
 #include "pisa.h"
 #include "port_bindings.h"
 #include "reinject.h"
+#include "rewrite.h"
 #include "rule_management.h"
 #include "user_ipsec_api.h"
-#include "firewall.h"
 
 
 /* location of the lock file */
@@ -134,9 +135,6 @@
 int esp_relay                 = 0;
 int hip_esp_protection        = 0;
 int esp_speedup               = 0; /**< Enable esp speedup via dynamic iptables usage (-u option). */
-#ifdef CONFIG_HIP_MIDAUTH
-int use_midauth = 0;
-#endif
 
 /** Use this to send and receive responses to hipd. Notice that
  * firewall_control.c has a separate socket for receiving asynchronous
@@ -485,9 +483,7 @@
     HIP_IFEL(hip_fw_init_esp_prot(), -1, "failed to load extension\n");
     HIP_IFEL(hip_fw_init_esp_prot_conntrack(), -1, "failed to load extension\n");
 
-#ifdef CONFIG_HIP_MIDAUTH
     midauth_init();
-#endif
 
     // Initializing local port cache database
     hip_port_bindings_init(true);
@@ -1147,13 +1143,6 @@
 {
     HIP_DEBUG("\n");
 
-#ifdef CONFIG_HIP_MIDAUTH
-    if (use_midauth) {
-        if (midauth_filter_hip(ctx) == NF_DROP) {
-            return NF_DROP;
-        }
-    }
-#endif
     // for now forward and output are handled symmetrically
     return hip_fw_handle_hip_output(ctx);
 }
@@ -1530,22 +1519,6 @@
 }
 
 /**
- * Set an accept verdict for a modified packet
- *
- * @param handle    ipqueue file handle
- * @param packet_id ipqueue packet id
- * @param len       length of buf
- * @param buf       the packet to be accepted
- *
- */
-static void allow_modified_packet(struct ipq_handle *handle, unsigned long packet_id,
-                                  size_t len, unsigned char *buf)
-{
-    ipq_set_verdict(handle, packet_id, NF_ACCEPT, len, buf);
-    HIP_DEBUG("Packet accepted with modifications\n\n");
-}
-
-/**
  * Allow a packet to pass
  *
  * @param handle    the handle for the packets.
@@ -1639,9 +1612,7 @@
             allow_packet(hndl, ctx->ipq_packet->packet_id);
         } else {
             HIP_DEBUG("=== Verdict: allow modified packet ===\n");
-            allow_modified_packet(hndl, ctx->ipq_packet->packet_id,
-                                  ctx->ipq_packet->data_len,
-                                  ctx->ipq_packet->payload);
+            allow_modified_packet(hndl, ctx);
         }
     } else {
         HIP_DEBUG("=== Verdict: drop packet ===\n");
@@ -1928,7 +1899,7 @@
             continue;
         }
 
-#ifdef CONFIG_HIP_MIDAUTH
+#ifdef CONFIG_HIP_PISA
         if (use_midauth) {
             pisa_check_for_random_update();
         }
 
=== modified file 'firewall/firewall.h'
--- firewall/firewall.h	2011-04-05 16:44:22 +0000
+++ firewall/firewall.h	2011-10-25 12:58:23 +0000
@@ -43,7 +43,6 @@
 extern int hip_lsi_support;
 extern int esp_relay;
 extern int hip_esp_protection;
-extern int use_midauth;
 extern int hip_fw_sock;
 extern int system_based_opp_mode;
 extern int esp_speedup;
 
=== modified file 'firewall/firewall_defines.h'
--- firewall/firewall_defines.h	2011-09-07 13:33:42 +0000
+++ firewall/firewall_defines.h	2011-10-25 12:58:23 +0000
@@ -50,6 +50,12 @@
     FW_PROTO_NUM
 };
 
+/**
+ * @note When adding new members, check if hip_fw_context_enable_write() needs
+ *       to be updated as well.
+ * @see hip_fw_context_enable_write()
+ * @see hip_fw_context_enable_write_inplace()
+ */
 struct hip_fw_context {
     // queued packet
     ipq_packet_msg_t *ipq_packet;
@@ -74,6 +80,8 @@
     int modified;
 };
 
+#include "midauth.h"
+
 /********** State table structures **************/
 
 struct esp_address {
@@ -137,6 +145,7 @@
     int                esp_relay;
     struct in6_addr    esp_relay_daddr;
     in_port_t          esp_relay_dport;
+    uint8_t            midauth_nonce[MIDAUTH_DEFAULT_NONCE_LENGTH];
 };
 
 struct connection {
@@ -150,9 +159,7 @@
     /* members needed for ESP protection extension */
     int     num_esp_prot_tfms;
     uint8_t esp_prot_tfms[MAX_NUM_TRANSFORMS];
-#ifdef CONFIG_HIP_MIDAUTH
-    int pisa_state;
-#endif
+    int     pisa_state;
 };
 
 #endif /* HIP_FIREWALL_FIREWALL_DEFINES_H */
 
=== modified file 'firewall/main.c'
--- firewall/main.c	2011-06-22 13:25:54 +0000
+++ firewall/main.c	2011-10-25 12:58:23 +0000
@@ -45,6 +45,7 @@
 #include "lib/core/util.h"
 #include "firewall.h"
 #include "conntrack.h"
+#include "midauth.h"
 
 
 /**
@@ -53,10 +54,7 @@
 static void hipfw_usage(void)
 {
     puts("HIP Firewall");
-    puts("Usage: hipfw [-f file_name] [-d|-v] [-A] [-F] [-H] [-b] [-a] [-c] [-k] [-i|-I|-e] [-l] [-o] [-p] [-t <seconds>] [-u] [-h] [-V]");
-#ifdef CONFIG_HIP_MIDAUTH
-    puts(" [-m]");
-#endif
+    puts("Usage: hipfw [-f file_name] [-d|-v] [-A] [-F] [-H] [-b] [-a] [-c] [-k] [-i|-I|-e] [-l] [-m] [-o] [-p] [-t <seconds>] [-u] [-h] [-V]");
     puts("");
     puts("      -f file_name = is a path to a file containing firewall filtering rules");
     puts("      -V = print version information and exit");
@@ -71,14 +69,11 @@
     puts("      -I = as -i, also allow fallback to kernel ipsec when exiting hipfw");
     puts("      -e = use esp protection extension (also sets -i)");
     puts("      -l = activate lsi support");
+    puts("      -m = middlebox authentication");
     puts("      -p = run with lowered privileges. iptables rules will not be flushed on exit");
     puts("      -t <seconds> = set timeout interval to <seconds>. Disable if <seconds> = 0");
     puts("      -u = attempt to speed up esp traffic using iptables rules");
     puts("      -h = print this help");
-#ifdef CONFIG_HIP_MIDAUTH
-    puts("      -m = middlebox authentication");
-    puts("      -w = IP address of web-based authentication server");
-#endif
     puts("");
 }
 
@@ -153,11 +148,9 @@
             hip_lsi_support = 1;
             break;
         case 'm':
-#ifdef CONFIG_HIP_MIDAUTH
             filter_traffic = 1;
             use_midauth    = 1;
             break;
-#endif
         case 'p':
             limit_capabilities = 1;
             break;
 
=== modified file 'firewall/midauth.c'
--- firewall/midauth.c	2011-08-15 14:11:56 +0000
+++ firewall/midauth.c	2011-10-25 12:58:23 +0000
@@ -38,416 +38,245 @@
 
 #define _BSD_SOURCE
 
-#include <stdint.h>
+#include <openssl/rand.h>
+#include <stdbool.h>
 #include <string.h>
-#include <arpa/inet.h>
-#include <netinet/ip.h>
-#include <sys/socket.h>
-#include <sys/types.h>
-#include <linux/netfilter.h>
 
 #include "lib/core/builder.h"
 #include "lib/core/debug.h"
-#include "lib/core/ife.h"
-#include "lib/core/protodefs.h"
 #include "lib/core/solve.h"
-#include "lib/tool/checksum.h"
+#include "modules/midauth/hipd/midauth.h"
+#include "modules/midauth/lib/midauth_builder.h"
 #include "firewall_defines.h"
-#include "pisa.h"
+#include "rewrite.h"
 #include "midauth.h"
 
 
-static struct midauth_handlers handlers;
-
-/**
- * Changes IPv4 header to match new length and updates the checksum.
- *
- * @param ip  a pointer to the IPv4 header
- * @param len new payload length
- */
-static void update_ipv4_header(struct iphdr *ip, int len)
-{
-    unsigned short *w = (unsigned short *) ip;
-    int             hdrlen, checksum = 0;
-
-    ip->tot_len = htons(len);
-    ip->check   = 0;
-
-    for (hdrlen = ip->ihl * 4, checksum = 0; hdrlen > 1; hdrlen -= 2) {
-        checksum += *w++;
-    }
-    if (hdrlen == 1) {
-        unsigned short padding = 0;
-        *(unsigned char *) (&padding) = *(unsigned char *) w;
-        checksum                     += padding;
-    }
-
-    checksum  = (checksum >> 16) + (checksum & 0xffff);
-    checksum +=  checksum >> 16;
-
-    ip->check = ~checksum;
-}
-
-/**
- * Changes IPv6 header to match new length.
- *
- * @param ip a pointer to the IPv6 header
- * @param len new IPv6 packet length
- */
-static void update_ipv6_header(struct ip6_hdr *ip, int len)
-{
-    ip->ip6_ctlun.ip6_un1.ip6_un1_plen = htons(len - sizeof(struct ip6_hdr));
-}
-
-#define CHECKSUM_CARRY(x) \
-    (x = (x >> 16) + (x & 0xffff), (~(x + (x >> 16)) & 0xffff))
-
-/**
- * Changes UDP header for IPv4 to match new content and updates the checksum.
- *
- * @param ip a pointer to the IPv4 header, not the UDP header
- * @param len total length of the IPv4 packet
- */
-static void update_udp_header(struct iphdr *ip, int len)
-{
-    unsigned long  sum;
-    uint16_t      *w        = (uint16_t *) ((unsigned char *) ip + (ip->ihl * 4));
-    uint16_t       protocol = ntohs(IPPROTO_UDP);
-    int            i;
-    struct udphdr *udp = (struct udphdr *) w;
-
-    len -= ip->ihl * 4;
-
-    udp->check = 0;
-    udp->len   = htons(len);
-
-    /* UDP header and data */
-    sum = 0;
-    while (len > 0) {
-        sum += *w++;
-        len -= 2;
-    }
-    if (len == 1) {
-        unsigned short padding = 0;
-        *(unsigned char *) (&padding) = *(unsigned char *) w;
-        sum                          += padding;
-    }
-
-    /* add UDP pseudoheader */
-    w = (uint16_t *) &ip->saddr;
-    for (i = 0; i < 4; w++, i++) {
-        sum += *w;
-    }
-    sum += protocol;
-    sum += udp->len;
-
-    /* set the checksum */
-    udp->check = CHECKSUM_CARRY(sum);
-}
-
-/**
- * Calculate the new checksum for the HIP packet in IPv4. Note that UDP
- * encapsulated HIP packets don't have a checksum. Therefore don't call this
- * function for them.
- *
- * @param ip the modified IP packet
- */
-static void update_hip_checksum_ipv4(struct iphdr *ip)
-{
-    struct sockaddr_in src = { 0 }, dst = { 0 };
-    struct hip_common *msg = (struct hip_common *) ((char *) ip +
-                                                    (ip->ihl * 4));
-
-    src.sin_family = AF_INET;
-    memcpy(&src.sin_addr, &ip->saddr, sizeof(uint32_t));
-
-    dst.sin_family = AF_INET;
-    memcpy(&dst.sin_addr, &ip->daddr, sizeof(uint32_t));
-
-    hip_zero_msg_checksum(msg);
-    msg->checksum = hip_checksum_packet((char *) msg,
-                                        (struct sockaddr *) &src,
-                                        (struct sockaddr *) &dst);
-}
-
-/**
- * Calculate the new checksum for the HIP packet in IPv6.
- *
- * @param ip the modified IP packet
- */
-static void update_hip_checksum_ipv6(struct ip6_hdr *ip)
-{
-    struct sockaddr_in6 src = { 0 }, dst = { 0 };
-    struct hip_common  *msg = (struct hip_common *) ((char *) ip +
-                                                     sizeof(struct ip6_hdr));
-
-    src.sin6_family = AF_INET6;
-    memcpy(&src.sin6_addr, &ip->ip6_src, sizeof(struct in6_addr));
-
-    dst.sin6_family = AF_INET6;
-    memcpy(&dst.sin6_addr, &ip->ip6_dst, sizeof(struct in6_addr));
-
-    hip_zero_msg_checksum(msg);
-    msg->checksum = hip_checksum_packet((char *) msg,
-                                        (struct sockaddr *) &src,
-                                        (struct sockaddr *) &dst);
-}
-
-/**
- * Take care of adapting all headers in front of the HIP payload to the new
- * content.
- *
- * @param ctx context of the modified midauth packet
- */
-static void midauth_update_all_headers(struct hip_fw_context *ctx)
-{
-    struct iphdr   *ipv4 = NULL;
-    struct ip6_hdr *ipv6 = NULL;
-    size_t          len  = 0;
-
-    len = hip_get_msg_total_len(ctx->transport_hdr.hip);
-
-    switch (ctx->ip_version) {
-    case 4:
-        ipv4 = (struct iphdr *) ctx->ipq_packet->payload;
-        len += ipv4->ihl * 4;
-        if (ipv4->protocol == IPPROTO_UDP) {
-            len += sizeof(struct udphdr) + HIP_UDP_ZERO_BYTES_LEN;
-            update_udp_header(ipv4, len);
-        } else {
-            update_hip_checksum_ipv4(ipv4);
-        }
-        update_ipv4_header(ipv4, len);
-        break;
-    case 6:
-        ipv6 = (struct ip6_hdr *) ctx->ipq_packet->payload;
-        len += sizeof(struct ip6_hdr);
-        update_hip_checksum_ipv6(ipv6);
-        update_ipv6_header(ipv6, len);
-        break;
-    default:
-        HIP_ERROR("Unknown IP version. %i, expected 4 or 6.\n",
-                  ctx->ip_version);
-        break;
-    }
-
-    ctx->ipq_packet->data_len = len;
-}
-
-/**
- * Verify that the challenge response in a packet is valid
- *
- * @param solution      challenge response parameter
- * @param initiator_hit HIT of the initiator
- * @param responder_hit HIT of the receiver
- * @return    0 on success, <0 otherwise
- */
-int midauth_verify_challenge_response(const struct hip_challenge_response *const solution,
-                                      const hip_hit_t initiator_hit,
-                                      const hip_hit_t responder_hit)
-{
-    int                      err = 0;
-    struct puzzle_hash_input puzzle_input;
-    uint8_t                  digest[HIP_AH_SHA_LEN];
-
-    HIP_IFEL(hip_build_digest(HIP_DIGEST_SHA1, solution->opaque, 24, digest) < 0,
-             -1, "Building of SHA1 Random seed I failed\n");
-
-    memcpy(puzzle_input.puzzle,
-           &digest[HIP_AH_SHA_LEN - PUZZLE_LENGTH],
-           PUZZLE_LENGTH);
-    puzzle_input.initiator_hit = initiator_hit;
-    puzzle_input.responder_hit = responder_hit;
-    memcpy(puzzle_input.solution, solution->J, PUZZLE_LENGTH);
-
-    HIP_IFEL(hip_verify_puzzle_solution(&puzzle_input, solution->K),
-             -1, "Solution is wrong\n");
-
-out_err:
-    return err;
-}
-
-/**
- * Move the last HIP parameter to the correct position according to its
- * parameter type. Will probably break the packet if something is moved in
- * front of a signature.
- *
- * @param hip the HIP packet
- * @return 0 on success
- */
-static int midauth_relocate_last_hip_parameter(struct hip_common *hip)
-{
-    int                    err = 0, len, total_len, offset;
-    char                   buffer[HIP_MAX_PACKET], *ptr = (char *) hip;
-    struct hip_tlv_common *i = NULL, *last = NULL;
-    hip_tlv                type;
-
-    while ((i = hip_get_next_param_readwrite(hip, i))) {
-        last = i;
-    }
-
-    HIP_IFEL(last == NULL, -1, "Trying to relocate in an empty packet!\n");
-
-    total_len = hip_get_msg_total_len(hip);
-    len       = hip_get_param_total_len(last);
-    type      = hip_get_param_type(last);
-
-    HIP_IFEL(len > (int) sizeof(buffer), -1,
-             "Last parameter's length exceeds HIP_MAX_PACKET\n");
-
-    /* @todo check for signature parameter to avoid broken packets */
-
-    memcpy(buffer, last, len);
-    i = NULL;
-
-    while ((i = hip_get_next_param_readwrite(hip, i))) {
-        if (hip_get_param_type(i) > type) {
-            offset = (char *) i - (char *) hip;
-
-            memmove(ptr + offset + len, ptr + offset,
-                    total_len - offset - len);
-            memcpy(ptr + offset, buffer, len);
-            break;
-        }
-    }
-
-out_err:
-    return err;
-}
-
-/**
- * Creates a challenge request and adds it to a forwarded HIP
- * packet.
- *
- * @param ctx          connection context of the modified packet
- * @param val_K        puzzle difficulty
- * @param ltime        lifetime of the challenge in s
- * @param opaque       contents of the opaque data field
- * @param opaque_len   length of the opaque data field
- * @return 0 on success, <0 otherwise
- */
-int midauth_add_challenge_request(struct hip_fw_context *ctx, uint8_t val_K,
-                                  uint8_t ltime,
-                                  uint8_t *opaque,
-                                  uint8_t opaque_len)
-{
-    struct hip_common *hip = ctx->transport_hdr.hip;
-    int                err = 0;
-
-    ctx->modified = 1;
-
-    HIP_IFEL(hip_build_param_challenge_request(hip, val_K, ltime,
-                                               opaque, opaque_len),
-             -1, "Failed to build challenge_request parameter\n");
-    HIP_IFEL(midauth_relocate_last_hip_parameter(hip), -1,
-             "Failed to relocate new challenge_request parameter\n");
-
-out_err:
-    return err;
-}
-
-int midauth_handler_accept(UNUSED struct hip_fw_context *ctx)
-{
-    return NF_ACCEPT;
-}
-
-/**
- * Drops a packet. Used in midauth_handlers as a default handler.
- *
- * @param ctx context of the packet
- * @return NF_DROP
- */
-static int midauth_handler_drop(UNUSED struct hip_fw_context *ctx)
-{
-    return NF_DROP;
-}
-
-/**
- * Distinguish the different UPDATE packets.
- *
- * @param ctx context of the modified packet
- * @return the verdict, either NF_ACCEPT or NF_DROP
- */
-static midauth_handler filter_midauth_update(const struct hip_fw_context *ctx)
-{
-    if (hip_get_param(ctx->transport_hdr.hip, HIP_PARAM_LOCATOR)) {
-        return handlers.u1;
-    }
-    if (hip_get_param(ctx->transport_hdr.hip, HIP_PARAM_ECHO_REQUEST)) {
-        return handlers.u2;
-    }
-    if (hip_get_param(ctx->transport_hdr.hip, HIP_PARAM_ECHO_RESPONSE)) {
-        return handlers.u3;
-    }
-
-    HIP_ERROR("Unknown UPDATE format, rejecting the request!\n");
-    return midauth_handler_drop;
-}
-
-/**
- * Packet handler dispatcher function. Classifies packets based on
- * their type and calls the appropriate type-specific handler functions.
- *
- * @param ctx HIP connection context
- * @return the verdict, either NF_ACCEPT or NF_DROP
- */
-int midauth_filter_hip(struct hip_fw_context *ctx)
-{
-    int             verdict   = NF_ACCEPT;
-    midauth_handler h         = NULL;
-    midauth_handler h_default = midauth_handler_accept;
-    /* @todo change this default value to midauth_handler_drop to
-     * disallow unknown message types */
-
-    switch (ctx->transport_hdr.hip->type_hdr) {
-    case HIP_I1:
-        h = handlers.i1;
-        break;
-    case HIP_R1:
-        h = handlers.r1;
-        break;
-    case HIP_I2:
-        h = handlers.i2;
-        break;
-    case HIP_R2:
-        h = handlers.r2;
-        break;
-    case HIP_UPDATE:
-        h = filter_midauth_update(ctx);
-        break;
-    case HIP_CLOSE:
-        h = handlers.close;
-        break;
-    case HIP_CLOSE_ACK:
-        h = handlers.close_ack;
-        break;
-    default:
-        HIP_DEBUG("filtering default message type\n");
-        break;
-    }
-
-    if (!h) {
-        h = h_default;
-    }
-    verdict = h(ctx);
-
-    /* do not change packet when it is dropped */
-    if (verdict != NF_ACCEPT) {
-        ctx->modified = 0;
-    }
-
-    /* if packet was modified correct every necessary part */
-    if (ctx->modified != 0) {
-        midauth_update_all_headers(ctx);
-    }
-
-    return verdict;
-}
-
-/**
- * Call the initializer functions
+// static configuration
+static const bool ignore_missing_challenge_request  = false;
+static const bool ignore_missing_challenge_response = false;
+static const bool ignore_wrong_challenge_solution   = false;
+static const bool ignore_malformed_update           = false;
+static const bool notify_failed_challenge           = true;
+
+static const uint8_t DEFAULT_DIFFICULTY = 1;
+
+// runtime configuration
+bool use_midauth = false;
+
+/**
+ * Initialize the midauth extension for the firewall.
  */
 void midauth_init(void)
 {
-    pisa_init(&handlers);
+    HIP_DEBUG("== midauth enabled ==\n");
+}
+
+/**
+ * Get the lifetime of a midauth challenge.
+ *
+ * @param difficulty The difficulty of the puzzle.
+ * @return The lifetime of the challenge.
+ *
+ * @todo Lifetime should depend on difficulty.
+ */
+static inline uint8_t lifetime(UNUSED const uint8_t difficulty)
+{
+    return 2;
+}
+
+/**
+ * Add a CHALLENGE_REQUEST parameter to a HIP packet passing through the
+ * firewall.
+ *
+ * @param ctx The packet context.
+ * @param[out] midauth_nonce The nonce added by the firewall for this handshake.
+ * @return 1 on success, 0 otherwise
+ */
+int hipfw_midauth_add_challenge(struct hip_fw_context *const ctx,
+                                uint8_t midauth_nonce[MIDAUTH_DEFAULT_NONCE_LENGTH])
+{
+    struct hip_challenge_request request;
+    static const size_t          min_length = sizeof(request) -
+                                              sizeof(request.tlv) -
+                                              sizeof(request.opaque);
+
+    if (use_midauth) {
+        HIP_ASSERT(midauth_nonce);
+        HIP_ASSERT(ctx);
+        HIP_ASSERT(ctx->packet_type == HIP_PACKET);
+
+        /* note: the length cannot be calculated with calc_param_len() */
+        hip_set_param_contents_len(&request.tlv,
+                                   min_length + MIDAUTH_DEFAULT_NONCE_LENGTH);
+        hip_set_param_type(&request.tlv, HIP_PARAM_CHALLENGE_REQUEST);
+
+        request.K        = DEFAULT_DIFFICULTY;
+        request.lifetime = lifetime(DEFAULT_DIFFICULTY);
+
+        if (!RAND_bytes(request.opaque, MIDAUTH_DEFAULT_NONCE_LENGTH)) {
+            HIP_ERROR("Failed to generate CHALLENGE_REQUEST nonce\n");
+            return ignore_missing_challenge_request;
+        }
+
+        // IP (and UDP, if needed) frames will be updated upon send
+        // Implicitly calls hip_fw_context_enable_write() if needed
+        if (!hipfw_splice_param(ctx, &request.tlv)) {
+            HIP_ERROR("Failed to splice CHALLENGE_REQUEST into existing packet\n");
+
+            // fatality depends on current settings
+            return ignore_missing_challenge_request;
+        }
+
+        /* store nonce per-connection per-peer */
+        memcpy(midauth_nonce, request.opaque, MIDAUTH_DEFAULT_NONCE_LENGTH);
+    }
+
+    return 1;
+}
+
+/**
+ * Getter for the length of the opaque field in a CHALLENGE_REPSONSE parameter.
+ *
+ * @param response The CHALLENGE_REPSONSE parameter.
+ * @return The length of the opaque value.
+ */
+static uint8_t hip_challenge_response_opaque_len(const struct hip_challenge_response *response)
+{
+    HIP_ASSERT(response);
+    static const size_t min_len = sizeof(*response) -
+                                  sizeof(response->tlv) -
+                                  sizeof(response->opaque);
+
+    return hip_get_param_contents_len(&response->tlv) - min_len;
+}
+
+enum verification_result {
+    ERROR,
+    RESPONSE_CORRECT,
+    RESPONSE_INCORRECT,
+    RESPONSE_NO_MATCH
+};
+
+/**
+ * Helper function for verifying a CHALLENGE_RESPONSE parameter.
+ *
+ * @param ctx The packet context.
+ * @param response The CHALLENGE_RESPONSE parameter.
+ * @param midauth_nonce The stored nonce for this association.
+ * @return ERROR on validation error,
+ *         RESPONSE_CORRECT if validation was successful,
+ *         RESPONSE_INCORRECT if nonces match but solution is incorrect, and
+ *         RESPONSE_NO_MATCH if no matching nonces are stored.
+ */
+static enum verification_result verify_response(const struct hip_fw_context *const ctx,
+                                                const struct hip_challenge_response *const response,
+                                                const uint8_t midauth_nonce[MIDAUTH_DEFAULT_NONCE_LENGTH])
+{
+    HIP_ASSERT(ctx);
+    HIP_ASSERT(response);
+    HIP_ASSERT(midauth_nonce);
+
+    //
+    // TODO: - check lifetime
+    //       - compare with connection state entry (K, nonce)
+    //       - use HITs from packet or from ctx?
+    //
+
+    const uint8_t len   = hip_challenge_response_opaque_len(response);
+    const bool    match = (len == MIDAUTH_DEFAULT_NONCE_LENGTH) &&
+                          (memcmp(response->opaque, midauth_nonce,
+                                  MIDAUTH_DEFAULT_NONCE_LENGTH) == 0);
+
+    if (!match) {
+        return RESPONSE_NO_MATCH;
+    }
+
+    if (response->K < DEFAULT_DIFFICULTY) {
+        return RESPONSE_INCORRECT;
+    }
+
+    const struct hip_common *const hip = ctx->transport_hdr.hip;
+
+    if (response->K > 0) {
+        struct puzzle_hash_input tmp_puzzle;
+
+        if (hip_midauth_puzzle_seed(response->opaque, len, tmp_puzzle.puzzle)) {
+            HIP_ERROR("failed to derive midauth puzzle\n");
+            return ERROR;
+        }
+        tmp_puzzle.initiator_hit = hip->hits;
+        tmp_puzzle.responder_hit = hip->hitr;
+        memcpy(tmp_puzzle.solution, response->J, PUZZLE_LENGTH);
+
+        if (hip_verify_puzzle_solution(&tmp_puzzle, response->K)) {
+            return RESPONSE_INCORRECT;
+        }
+    }
+
+    return RESPONSE_CORRECT;
+}
+
+/**
+ * Verify a puzzle solution in the CHALLENGE_RESPONSE parameter.
+ *
+ * @param ctx The packet context.
+ * @param midauth_nonce The stored nonce for this association.
+ * @return 1 on success, 0 otherwise
+ */
+int hipfw_midauth_verify_challenge(const struct hip_fw_context *const ctx,
+                                   const uint8_t midauth_nonce[MIDAUTH_DEFAULT_NONCE_LENGTH])
+{
+    const struct hip_challenge_response *response;
+
+    HIP_ASSERT(ctx);
+
+    if (use_midauth) {
+        HIP_ASSERT(ctx->packet_type == HIP_PACKET);
+
+        response = hip_get_param(ctx->transport_hdr.hip,
+                                 HIP_PARAM_CHALLENGE_RESPONSE);
+        if (!response) {
+            HIP_ERROR("Challenge response expected but not found\n");
+            return ignore_missing_challenge_response ? 1 : 0;
+        }
+
+        bool found = false;
+        do {
+            switch (verify_response(ctx, response, midauth_nonce)) {
+            case RESPONSE_CORRECT:
+                HIP_DEBUG("Correct CHALLENGE_RESPONSE found\n");
+                return 1;
+            case RESPONSE_INCORRECT:
+                HIP_ERROR("Incorrect CHALLENGE_RESPONSE found\n");
+                if (notify_failed_challenge) {
+                    // TODO: notify peer (ICMP, HIP notify)
+                    HIP_DEBUG("STUB: notify\n");
+                }
+
+                if (!ignore_wrong_challenge_solution) {
+                    return 0;
+                }
+                break;
+            case RESPONSE_NO_MATCH:
+                break;
+            default:
+                HIP_ERROR("Unable to compute challenge verification.\n");
+                break;
+            }
+
+            response = (const struct hip_challenge_response *)
+                       hip_get_next_param(ctx->transport_hdr.hip, &response->tlv);
+        } while (response &&
+                 hip_get_param_type(response) == HIP_PARAM_CHALLENGE_RESPONSE);
+
+        if (!found) {
+            HIP_ERROR("CHALLENGE_RESPONSE found, but no matching nonce\n");
+            return ignore_missing_challenge_response ? 1 : 0;
+        }
+
+        return found ? 1 : 0;
+    }
+
+    return 1;
 }
 
=== modified file 'firewall/midauth.h'
--- firewall/midauth.h	2011-08-15 14:11:56 +0000
+++ firewall/midauth.h	2011-10-25 12:58:23 +0000
@@ -29,58 +29,19 @@
 #define _BSD_SOURCE
 
 #include <stdint.h>
-
-#include "lib/core/protodefs.h"
-#include "modules/midauth/lib/midauth_builder.h"
+#include <stdbool.h>
+
+#define MIDAUTH_DEFAULT_NONCE_LENGTH 18
+
 #include "firewall_defines.h"
 
-typedef int (*midauth_handler)(struct hip_fw_context *ctx);
-
-struct midauth_handlers {
-    midauth_handler i1;
-    midauth_handler r1;
-    midauth_handler i2;
-    midauth_handler r2;
-    midauth_handler u1;
-    midauth_handler u2;
-    midauth_handler u3;
-    midauth_handler close;
-    midauth_handler close_ack;
-};
-
-/**
- * Accepts a packet. Used in midauth_handlers as a default handler.
- *
- * @param ctx context of the packet
- * @return NF_ACCEPT
- */
-int midauth_handler_accept(struct hip_fw_context *ctx);
-
-int midauth_verify_challenge_response(const struct hip_challenge_response *const solution,
-                                      const hip_hit_t initiator_hit,
-                                      const hip_hit_t responder_hit);
-
-
-
-/**
- * Insert a CHALLENGE_REQUEST parameter into a HIP packet.
- *
- * @param ctx context of the packet to be modified
- * @param val_K challenge_request parameter val_K
- * @param ltime challenge_request parameter lifetime
- * @param opaque challenge_request parameter opaque
- * @param opaque_len length of opaque
- * @return 0 on success
- */
-int midauth_add_challenge_request(struct hip_fw_context *ctx,
-                                  uint8_t val_K, uint8_t ltime,
-                                  uint8_t *opaque, uint8_t opaque_len);
-
-/**
- * Initialize midauth infrastructure.
- */
+extern bool use_midauth;
+
 void midauth_init(void);
 
-int midauth_filter_hip(struct hip_fw_context *ctx);
+int hipfw_midauth_add_challenge(struct hip_fw_context *const ctx,
+                                uint8_t *const midauth_nonce);
+int hipfw_midauth_verify_challenge(const struct hip_fw_context *const ctx,
+                                   const uint8_t *const midauth_nonce);
 
 #endif /* HIP_FIREWALL_MIDAUTH_H */
 
=== modified file 'firewall/pisa.h'
--- firewall/pisa.h	2011-08-15 14:11:56 +0000
+++ firewall/pisa.h	2011-10-25 12:58:23 +0000
@@ -31,12 +31,14 @@
 #define PISA_STATE_DISALLOW     0
 #define PISA_STATE_ALLOW        1
 
+#ifdef CONFIG_HIP_PISA
 /**
  * Register PISA handlers with midauth and initialize data structures.
  *
  * @param h pointer to the handlers
  */
 void pisa_init(struct midauth_handlers *h);
+#endif
 
 /**
  * Check if a new random number is necessary.
 
=== added file 'firewall/rewrite.c'
--- firewall/rewrite.c	1970-01-01 00:00:00 +0000
+++ firewall/rewrite.c	2011-10-25 12:58:23 +0000
@@ -0,0 +1,380 @@
+/*
+ * Copyright (c) 2011 Aalto University and RWTH Aachen University.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+/**
+ * @file
+ *
+ * Support and utility functions for packet rewriting, especially for growing
+ * packets.
+ *
+ * Note that the buffer supplied to ipq_get_packet() in the firewall main loop
+ * is not big enough to hold both the ipq_packet header and ::HIP_MAX_PACKET
+ * bytes of payload.
+ * Furthermore, the actual amount of writable data behind the received payload
+ * is not documented by the libipq team. This makes sense if you consider that
+ * netlink is able to push multiple packets into our userspace buffer for
+ * efficiency reasons. Unfortunately, it is not documented whether libipq
+ * actually makes use of this feature either.
+ *
+ * For this reason, all packet rewriting that needs access beyond the boundaries
+ * of the originally received packet should copy it into a big, temporary buffer
+ * first. This is managed by the hip_fw_context_enable_write() function; see its
+ * documentation for more info.
+ *
+ * After growing, the data_len field and the length of the innermost frame
+ * (currently either HIP oder ESP) must be updated: Checksums and outer length
+ * fields are updated only once, right before reinjecting the packet.
+ *
+ * @note Copying the packet incurs a considerable performance hit. Browsing the
+ *       source code of libipq, netfilter_queue and netlink, one can find
+ *       assumptions about the original buffer and its usage to save copying in
+ *       some cases, but unless the internals of these interfaces are documented
+ *       more thoroughly, these optimizations should be considered hacks (and
+ *       are thus not used here).
+ *
+ * @author Christof Mroz <[e-mail]>
+ */
+
+#define _BSD_SOURCE
+
+#include <netinet/in.h>
+#include <linux/netfilter.h>
+#include <libipq.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "lib/core/builder.h"
+#include "lib/core/debug.h"
+#include "lib/tool/checksum.h"
+#include "rewrite.h"
+
+// static configuration
+static const bool assume_ipq_buffer_sufficient = false;
+
+struct scratch_buffer {
+    ipq_packet_msg_t ipq;
+    uint8_t         *payload[HIP_MAX_PACKET];
+} __attribute__((packed)); // no gaps between header and payload
+
+static struct scratch_buffer scratch_buffer;
+
+/**
+ * Given the address @a field of a struct member of @a old, return
+ * the same field's address but offset from @a new.
+ *
+ * As an example use case, say we have a pointer into @a old:
+ * <code>
+ * char old[LEN];
+ * ptr = &old[BLA];
+ * </code>
+ * Now after copying @a old to @a new, we need to update the pointer:
+ * <code>
+ * ptr = rebase(ptr, old, new);
+ * </code>
+ *
+ * @note This is essentially equivalent to
+ *       <code>
+ *       return &new.field
+ *       </code>
+ *       But of course, the above can only be used if we actually know
+ *       the name of @a field, while this function needs just the
+ *       address and base pointer.
+ */
+static void *rebase(const void *const field,
+                    const void *const old,
+                    void *const new)
+{
+    HIP_ASSERT((const char *) field >= (const char *) old);
+    return (char *) new + ((const char *) field - (const char *) old);
+}
+
+/**
+ * Mark packet as modified and indicate that the packet buffer passed by libipq
+ * is overwritten with packet content.
+ *
+ * @param ctx The current packet context.
+ *
+ * @note Only set this flag when sure that the new packet will not exceed the
+ *       buffer length of the packet originally passed by libipq.
+ */
+static void hip_fw_context_enable_write_inplace(struct hip_fw_context *const ctx)
+{
+    ctx->modified = 1;
+}
+
+/**
+ * Mark packet as modified and enable rewritten packet to grow up to
+ * ::HIP_MAX_PACKET bytes.
+ * The buffer will be available via the ipq_packet->payload member of @a ctx, as
+ * usual. That is: To the caller, it should look like nothing happened.
+ *
+ * @param ctx The current packet context. The ipq header may have been modified
+ *            but should be consistent, especially the data_len field.
+ *
+ * @note It is safe to call this function on the same @a ctx multiple times: the
+ *       packet will not needlessly be copied again.
+ */
+static void hip_fw_context_enable_write(struct hip_fw_context *const ctx)
+{
+    HIP_ASSERT(ctx);
+    HIP_ASSERT(ctx->ipq_packet);
+
+    if (assume_ipq_buffer_sufficient) {
+        hip_fw_context_enable_write_inplace(ctx);
+        return;
+    }
+
+    if (ctx->ipq_packet != &scratch_buffer.ipq) {
+        // simply rebase the old pointers
+        if (ctx->ip_version == 4) {
+            ctx->ip_hdr.ipv4 = rebase(ctx->ip_hdr.ipv4, ctx->ipq_packet,
+                                      &scratch_buffer.ipq);
+        } else {
+            HIP_ASSERT(ctx->ip_version == 6);
+            ctx->ip_hdr.ipv6 = rebase(ctx->ip_hdr.ipv6, ctx->ipq_packet,
+                                      &scratch_buffer.ipq);
+        }
+
+        switch (ctx->packet_type) {
+        case ESP_PACKET:
+            ctx->transport_hdr.esp = rebase(ctx->transport_hdr.esp, ctx->ipq_packet,
+                                            &scratch_buffer.ipq);
+            break;
+        case HIP_PACKET:
+            ctx->transport_hdr.hip = rebase(ctx->transport_hdr.hip, ctx->ipq_packet,
+                                            &scratch_buffer.ipq);
+            break;
+        case OTHER_PACKET:
+            break;
+        default:
+            HIP_ASSERT(false);
+        }
+
+        if (ctx->udp_encap_hdr) {
+            ctx->udp_encap_hdr = rebase(ctx->udp_encap_hdr, ctx->ipq_packet,
+                                        &scratch_buffer.ipq);
+        }
+
+        // copy ipq packet plus payload
+        memcpy(&scratch_buffer.ipq, ctx->ipq_packet,
+               sizeof(*ctx->ipq_packet) + ctx->ipq_packet->data_len);
+        ctx->ipq_packet = &scratch_buffer.ipq;
+        ctx->modified   = 1;
+    } else {
+        // second invocation
+        HIP_ASSERT(ctx->modified);
+    }
+}
+
+/**
+ * Add a new parameter to the correct position in the packet. Parameters are
+ * ordered by type number. Hence, some parameters might need to be moved in
+ * order for the new parameter to fit into the right position.
+ *
+ * @param ctx The current packet context.
+ * @param param The parameter to be added to the packet.
+ * @return true on success, false otherwise.
+ */
+bool hipfw_splice_param(struct hip_fw_context *const ctx,
+                        const struct hip_tlv_common *const param)
+{
+    HIP_ASSERT(ctx);
+    HIP_ASSERT(ctx->packet_type == HIP_PACKET);
+    HIP_ASSERT(param);
+
+    const size_t  hip_len      = hip_get_msg_total_len(ctx->transport_hdr.hip); // padded
+    const size_t  param_len    = hip_get_param_total_len(param); // padded
+    const hip_tlv param_type   = hip_get_param_type(param);
+    const size_t  contents_len = hip_get_param_contents_len(param); // not padded
+
+    // RFC 5201: Types 0 - 1023 are signed, so they must not be moved
+    HIP_ASSERT(param_type >= 1024);
+
+    if (ctx->ipq_packet->data_len + param_len > sizeof(scratch_buffer.payload)) {
+        HIP_ERROR("New parameter of type %u, effective size %u, "
+                  "does not fit into packet", param_type, param_len);
+        return false;
+    }
+
+    hip_fw_context_enable_write(ctx);
+
+    // note: this works because param_len is padded!  otherwise, resize the hip
+    // packet and call hip_get_msg_total_len() instead.
+    ctx->ipq_packet->data_len += param_len;
+
+    struct hip_common *const hip     = ctx->transport_hdr.hip;
+    uint8_t *const           end     = ((uint8_t *) hip) + hip_len;
+    struct hip_tlv_common   *current = NULL;
+    uint8_t                 *out     = end; // append by default
+
+    while ((current = hip_get_next_param_readwrite(hip, current))) {
+        if (hip_get_param_type(current) >= param_type) {
+            uint8_t *const splice = (uint8_t *const) current;
+
+            memmove(splice + param_len, splice, end - splice);
+            out = splice;
+            break;
+        }
+    }
+
+    if ((sizeof(struct hip_tlv_common) + contents_len) != param_len) {
+        // padding needed: don't send uninitialized data
+        memset(out, 0, param_len);
+    }
+
+    memcpy(out, param, sizeof(struct hip_tlv_common) + contents_len);
+    hip_set_msg_total_len(hip, hip_len + param_len); // IP length etc. will be inferred
+
+    return true;
+}
+
+/**
+ * Getter for the position of the IP payload in an IPv4 packet. This allows to
+ * handle IP options.
+ *
+ * @param ipv4 The IPv4 packet.
+ */
+inline static void *get_ipv4_payload(struct ip *const ipv4)
+{
+    return ((uint8_t *) ipv4) + 4 * ipv4->ip_hl;
+}
+
+/**
+ * Update the UDP header after modifying the higher layer packet content.
+ *
+ * @param udp The UDP packet.
+ * @param payload_len The length of the UDP payload.
+ * @param src_ip The source IP address (needed for pseudo-header).
+ * @param dst_ip The destination IP address (needed for pseudo-header).
+ */
+static void update_udp_header(struct udphdr *const udp,
+                              const size_t payload_len,
+                              const struct in_addr src_ip,
+                              const struct in_addr dst_ip)
+{
+    const uint16_t tot_len = sizeof(*udp) + payload_len;
+
+    HIP_ASSERT(sizeof(*udp) == 8);
+
+    udp->len   = htons(tot_len);
+    udp->check = htons(0);
+    udp->check = ipv4_checksum(IPPROTO_UDP, &src_ip, &dst_ip, udp, tot_len);
+}
+
+/**
+ * Update the IPv4 header after modifying the higher layer packet content.
+ *
+ * @param ipv4 The IPv4 packet.
+ * @param payload_len The length of the IPv4 payload.
+ */
+static void update_ipv4_header(struct ip *const ipv4,
+                               const size_t payload_len)
+{
+    ipv4->ip_len = htons(ipv4->ip_hl * 4 + payload_len);
+    ipv4->ip_sum = htons(0);
+    ipv4->ip_sum = checksum_ip(ipv4, ipv4->ip_hl);
+}
+
+/**
+ * Update the IPv6 header after modifying the higher layer packet content.
+ *
+ * @param ipv6 The IPv6 packet.
+ * @param payload_len The length of the IPv6 payload.
+ */
+static void update_ipv6_header(struct ip6_hdr *const ipv6,
+                               const size_t payload_len)
+{
+    ipv6->ip6_plen = htons(payload_len);
+}
+
+/**
+ * Set an accept verdict for a modified packet
+ *
+ * @param handle libipq file handle
+ * @param ctx The current packet context.
+ *
+ */
+void allow_modified_packet(struct ipq_handle *const handle,
+                           struct hip_fw_context *const ctx)
+{
+    HIP_ASSERT(ctx->modified);
+
+    //
+    // TODO: send as separate packets if fragmented?
+    //
+
+    if (ctx->packet_type == HIP_PACKET) {
+        struct hip_common *const hip     = ctx->transport_hdr.hip;
+        const size_t             hip_len = hip_get_msg_total_len(hip);
+
+        if (ctx->ip_version == 4) {
+            struct ip *const ipv4 = ctx->ip_hdr.ipv4;
+
+            if (ipv4->ip_p == IPPROTO_UDP) {
+                // UDP Payload: "zero SPI" (0x00000000) + HIP
+                const size_t udp_len = HIP_UDP_ZERO_BYTES_LEN + hip_len;
+
+                update_udp_header(get_ipv4_payload(ipv4), udp_len,
+                                  ipv4->ip_src, ipv4->ip_dst);
+                update_ipv4_header(ipv4, sizeof(struct udphdr) + udp_len);
+                // HIP checksum unused
+            } else {
+                const struct sockaddr_in src = { .sin_family = AF_INET,
+                                                 .sin_addr   = ipv4->ip_src };
+                const struct sockaddr_in dst = { .sin_family = AF_INET,
+                                                 .sin_addr   = ipv4->ip_dst };
+
+                HIP_ASSERT(ipv4->ip_p == IPPROTO_HIP);
+
+                hip_zero_msg_checksum(hip);
+                hip->checksum = hip_checksum_packet((char *) hip,
+                                                    (const struct sockaddr *) &src,
+                                                    (const struct sockaddr *) &dst);
+                update_ipv4_header(ipv4, hip_len);
+            }
+        } else {
+            HIP_ASSERT(ctx->ip_version == 6);
+
+            struct ip6_hdr *const     ipv6 = ctx->ip_hdr.ipv6;
+            const struct sockaddr_in6 src  = { .sin6_family = AF_INET6,
+                                               .sin6_addr   = ipv6->ip6_src };
+            const struct sockaddr_in6 dst = { .sin6_family = AF_INET6,
+                                              .sin6_addr   = ipv6->ip6_dst };
+
+            HIP_ASSERT(ipv6->ip6_nxt == IPPROTO_HIP);
+
+            hip_zero_msg_checksum(hip);
+            hip->checksum = hip_checksum_packet((char *) hip,
+                                                (const struct sockaddr *) &src,
+                                                (const struct sockaddr *) &dst);
+            update_ipv6_header(ipv6, hip_len);
+        }
+    }
+
+    ipq_set_verdict(handle, ctx->ipq_packet->packet_id, NF_ACCEPT,
+                    ctx->ipq_packet->data_len, ctx->ipq_packet->payload);
+    HIP_DEBUG("Packet accepted with modifications\n\n");
+}
 
=== added file 'firewall/rewrite.h'
--- firewall/rewrite.h	1970-01-01 00:00:00 +0000
+++ firewall/rewrite.h	2011-10-25 12:58:23 +0000
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2011 Aalto University and RWTH Aachen University.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef HIP_FIREWALL_REWRITE_H
+#define HIP_FIREWALL_REWRITE_H
+
+#include <stdbool.h>
+
+#include "firewall_defines.h"
+
+
+bool hipfw_splice_param(struct hip_fw_context *const ctx,
+                        const struct hip_tlv_common *const param);
+void allow_modified_packet(struct ipq_handle *const handle,
+                           struct hip_fw_context *const ctx);
+
+#endif /* HIP_FIREWALL_REWRITE_H */
 
=== modified file 'lib/tool/checksum.c'
--- lib/tool/checksum.c	2011-08-15 14:11:56 +0000
+++ lib/tool/checksum.c	2011-10-25 12:58:23 +0000
@@ -57,15 +57,18 @@
  * @param protocol protocol
  * @return the calculated IPv4 header checksum
  */
-uint16_t ipv4_checksum(uint8_t protocol, void *s, void *d, void *c,
-                       uint16_t len)
+uint16_t ipv4_checksum(const uint8_t protocol,
+                       const void *const s,
+                       const void *const d,
+                       const void *const c,
+                       const uint16_t len)
 {
-    uint8_t *src  = s;
-    uint8_t *dst  = d;
-    uint8_t *data = c;
-    uint16_t word16;
-    uint32_t sum;
-    uint16_t i;
+    const uint8_t *src  = s;
+    const uint8_t *dst  = d;
+    const uint8_t *data = c;
+    uint16_t       word16;
+    uint32_t       sum;
+    uint16_t       i;
 
     /* initialize sum to zero */
     sum = 0;
@@ -219,23 +222,23 @@
  * @return     the checksum
  * @note       Checksumming is from Boeing's HIPD.
  */
-uint16_t hip_checksum_packet(char *data, struct sockaddr *src,
-                             struct sockaddr *dst)
+uint16_t hip_checksum_packet(char *data, const struct sockaddr *src,
+                             const struct sockaddr *dst)
 {
-    uint16_t              checksum = 0;
-    unsigned long         sum      = 0;
-    int                   count    = 0, length = 0;
-    unsigned short       *p        = NULL; /* 16-bit */
-    struct pseudo_header  pseudoh;
-    struct pseudo_header6 pseudoh6;
-    uint32_t              src_network, dst_network;
-    struct in6_addr      *src6, *dst6;
-    struct hip_common    *hiph = (struct hip_common *) data;
+    uint16_t               checksum = 0;
+    unsigned long          sum      = 0;
+    int                    count    = 0, length = 0;
+    unsigned short        *p        = NULL; /* 16-bit */
+    struct pseudo_header   pseudoh;
+    struct pseudo_header6  pseudoh6;
+    uint32_t               src_network, dst_network;
+    const struct in6_addr *src6, *dst6;
+    struct hip_common     *hiph = (struct hip_common *) data;
 
     if (src->sa_family == AF_INET) {
         /* IPv4 checksum based on UDP-- Section 6.1.2 */
-        src_network = ((struct sockaddr_in *) src)->sin_addr.s_addr;
-        dst_network = ((struct sockaddr_in *) dst)->sin_addr.s_addr;
+        src_network = ((const struct sockaddr_in *) src)->sin_addr.s_addr;
+        dst_network = ((const struct sockaddr_in *) dst)->sin_addr.s_addr;
 
         memset(&pseudoh, 0, sizeof(struct pseudo_header));
         memcpy(&pseudoh.src_addr, &src_network, 4);
@@ -248,8 +251,8 @@
         p     = (unsigned short *) &pseudoh;
     } else {
         /* IPv6 checksum based on IPv6 pseudo-header */
-        src6 = &((struct sockaddr_in6 *) src)->sin6_addr;
-        dst6 = &((struct sockaddr_in6 *) dst)->sin6_addr;
+        src6 = &((const struct sockaddr_in6 *) src)->sin6_addr;
+        dst6 = &((const struct sockaddr_in6 *) dst)->sin6_addr;
 
         memset(&pseudoh6, 0, sizeof(struct pseudo_header6));
         memcpy(&pseudoh6.src_addr[0], src6, 16);
 
=== modified file 'lib/tool/checksum.h'
--- lib/tool/checksum.h	2010-07-16 17:39:09 +0000
+++ lib/tool/checksum.h	2011-10-25 12:58:23 +0000
@@ -8,13 +8,16 @@
 #include <netinet/ip.h>
 #include <sys/socket.h>
 
-uint16_t ipv4_checksum(uint8_t protocol, void *s, void *d, void *c, uint16_t len);
+uint16_t ipv4_checksum(const uint8_t protocol, const void *const s,
+                       const void *const d, const void *const c,
+                       const uint16_t len);
 uint16_t ipv6_checksum(uint8_t protocol,
                        struct in6_addr *src,
                        struct in6_addr *dst,
                        void *data, uint16_t len);
 uint16_t checksum_ip(struct ip *ip_hdr, const unsigned int ip_hl);
 uint16_t inchksum(const void *data, uint32_t length);
-uint16_t hip_checksum_packet(char *data, struct sockaddr *src, struct sockaddr *dst);
+uint16_t hip_checksum_packet(char *data, const struct sockaddr *src,
+                             const struct sockaddr *dst);
 
 #endif /* HIP_LIB_TOOL_CHECKSUM_H */
 
=== modified file 'packaging/openwrt/hipl/files/hipfw.init'
--- packaging/openwrt/hipl/files/hipfw.init	2011-06-15 12:45:43 +0000
+++ packaging/openwrt/hipl/files/hipfw.init	2011-10-25 12:58:23 +0000
@@ -4,7 +4,7 @@
 START=65
 STOP=65
 
-HIPFW_START='hipfw -kb'
+HIPFW_START='hipfw -kbm'
 PID_FILE="/var/lock/hip_firewall.lock"
 
 # check if daemon is already running
 
=== modified file 'test/check_firewall.c'
--- test/check_firewall.c	2011-04-04 16:36:55 +0000
+++ test/check_firewall.c	2011-10-25 12:58:23 +0000
@@ -36,7 +36,9 @@
     srunner_add_suite(sr, firewall_file_buffer());
     srunner_add_suite(sr, firewall_helpers());
     srunner_add_suite(sr, firewall_line_parser());
+    srunner_add_suite(sr, firewall_midauth());
     srunner_add_suite(sr, firewall_port_bindings());
+    srunner_add_suite(sr, firewall_rewrite());
 
     srunner_run_all(sr, CK_NORMAL);
     number_failed = srunner_ntests_failed(sr);
 
=== added file 'test/firewall/midauth.c'
--- test/firewall/midauth.c	1970-01-01 00:00:00 +0000
+++ test/firewall/midauth.c	2011-10-25 12:58:23 +0000
@@ -0,0 +1,298 @@
+/*
+ * Copyright (c) 2011 Aalto University and RWTH Aachen University.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#define _BSD_SOURCE
+
+#include "config.h"
+#include "firewall/firewall.c"
+#include "firewall/firewall_defines.h"
+#include "firewall/midauth.h"
+#include "firewall/midauth.c"
+#include "modules/midauth/lib/midauth_builder.h"
+#include "test_suites.h"
+#include "test/mocks.h"
+
+START_TEST(test_hipfw_midauth_add_challenge)
+{
+    struct hip_fw_context               ctx;
+    uint8_t                             midauth_nonce[MIDAUTH_DEFAULT_NONCE_LENGTH];
+    const struct hip_challenge_request *challenge = NULL;
+    unsigned char                       buf[]     = "\x00\x30\xF9\x16\x00\x88\xFF\xFF\x00\x00\x00\x00\x00\x00\x00\x00\x23\x14\x49\x4E\x00\x00\x00\x00"
+                                                    "\x93\x28\x06\x00\x00\x00\x00\x00\x02\x00\x00\x00\x65\x74\x68\x32\x00\x00\x00\x00\x00\x00\x00\x00"
+                                                    "\x00\x00\x00\x00\x65\x74\x68\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x01\x00"
+                                                    "\x06\x08\x00\x27\x79\x45\x6B\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x03\x00\x00\x00\x00\x00\x00"
+                                                    "\x45\x00\x03\x18\x00\x00\x40\x00\x3F\x11\x1D\xD3\x0A\x00\x04\x02\x0A\x00\x03\x01\x29\x04\x29\x04"
+                                                    "\x03\x04\x00\x00\x00\x00\x00\x00\x3B\x5E\x02\x11\x00\x00\x00\x00\x20\x01\x00\x10\xD5\x79\x52\xA7"
+                                                    "\xFA\xC2\x99\x64\xC9\x36\xA9\x40\x20\x01\x00\x19\x9C\x8E\x9A\x92\xD5\x68\xD2\x87\x7F\x3F\x6F\x95"
+                                                    "\x01\x01\x00\x0C\x00\x2A\x48\x49\xF3\xAC\x4C\x3F\x25\x09\xCC\x58\x02\x01\x00\xF6\x03\x00\xC0\x33"
+                                                    "\xAE\x3C\x0A\x08\xC3\x47\x2B\x46\xB2\xDD\xE7\xFA\x5E\xC7\x5E\x25\xEE\x8B\x4A\xF4\xF2\xEE\xB8\x25"
+                                                    "\x7C\x74\x6F\x3C\x1C\x4F\x51\x87\xF3\xF4\x0E\x8E\x88\xDA\xFF\x55\x2D\x51\x4E\xEB\x2F\x4B\x8D\x89"
+                                                    "\xE5\xAD\xEA\xD5\x87\x0D\x20\x9C\xF6\x93\x0A\x05\x2A\x29\x52\x05\x91\x84\x70\xF9\xBE\xF2\x87\x04"
+                                                    "\x4D\x5C\x7F\xC9\x20\x8D\x76\x22\xEC\xA5\x0D\x6C\x06\xB5\xB2\x30\x76\x01\x52\x4B\xCD\xD8\x41\xAD"
+                                                    "\x59\x95\x0B\xE2\xEC\xAF\xC3\x95\xFA\xB1\x3B\xE2\x06\x51\xB0\x4B\x3F\x6C\x61\xDB\xF1\x08\x25\x11"
+                                                    "\xBE\xB6\x4B\x39\x6F\x72\x03\x80\x3A\x4A\x86\xFE\xC4\xC0\x9D\x8B\x8E\x88\x99\x06\xF0\x72\x29\xC6"
+                                                    "\x66\xA8\x31\x36\x38\x50\x10\x4F\xD5\xF7\xAE\x39\xDD\xB1\x47\x4B\x14\x59\xA5\x21\x1C\x60\x2D\xF0"
+                                                    "\xB7\x16\x71\xEA\xA8\x7B\xC5\xD1\x7F\x60\xD2\xE5\x36\xEF\xED\xBC\xE3\x9E\x63\x85\x19\xC5\xE1\x01"
+                                                    "\x00\x30\x4E\x9E\x69\x8F\x6E\xFA\xAF\x95\x9F\x55\x78\x25\xE1\x48\x59\x40\x1D\x5A\x14\x5A\xB2\xA3"
+                                                    "\x86\x67\x1C\xE9\x80\x5A\x7A\xC0\xE6\xFE\x6D\x96\x2B\xC5\x8C\x54\x20\xAE\x15\xFA\x7B\xEC\xF9\x1C"
+                                                    "\x35\xAB\x00\x00\x00\x00\x00\x00\x02\x41\x00\x06\x00\x01\x00\x02\x00\x05\x00\x00\x00\x00\x00\x00"
+                                                    "\x02\xC1\x00\xD4\x00\xC8\x10\x08\x02\x02\xFF\x05\x03\x01\x00\x01\xD9\x83\x29\xBE\xF8\x4C\x5A\xCC"
+                                                    "\x9B\x71\x0B\x4E\x26\xCE\x2A\x21\x6C\x29\xC0\x2A\x16\x38\xD1\x92\xE3\x1B\x25\x9D\x65\x24\xF5\x83"
+                                                    "\x18\x0D\x61\xE7\xA9\x09\x09\x9C\x8F\xBF\xC1\x07\x02\xBF\x62\x0D\x82\x62\x4C\x81\xEB\x3A\xE2\x62"
+                                                    "\x19\xEB\x51\x7A\x12\xDF\x24\x37\x5F\x18\xB4\xF1\x28\xD6\x08\xFF\xE0\x6B\x48\x4E\x13\xC1\x61\x1E"
+                                                    "\x72\xF1\xD6\x32\xA1\x43\x42\x37\x66\x45\x6F\x4A\x7A\x92\x51\xE0\x98\x1D\x0F\x92\x18\x37\xB7\xCC"
+                                                    "\xCC\x84\xF9\x61\x6C\xE8\xF6\xD7\x3D\xF3\x1D\x04\x4F\xD1\x4C\xA8\x78\x63\x73\xAD\x9C\x2B\xBE\x4D"
+                                                    "\x25\x1B\xC5\x9C\x5D\x0F\x6C\xC6\x21\x01\xD1\xFA\xAD\x62\x3C\x5E\x17\x46\xF9\x2C\xE8\xC8\xE2\x8A"
+                                                    "\xC0\x04\xD6\x72\xBE\x9E\x25\xB6\x25\x3C\x11\x1F\x8A\x9F\xE7\xAC\x8F\xBC\xD3\x76\x36\xEC\x7E\x41"
+                                                    "\xB9\xBC\x5D\x8F\xC1\xD9\x82\x99\xEA\x9B\x70\x00\xA0\xEB\x08\x2F\x74\x68\x65\x73\x69\x73\x32\x00"
+                                                    "\x0F\xFF\x00\x08\x00\x00\x00\x01\x00\x02\x00\x05\x00\x00\x00\x00\xF0\xC1\x00\xC1\x05\x2D\x6F\xDE"
+                                                    "\xF9\xCE\x0F\x79\x4E\xA3\x21\x73\x0E\x84\x22\x55\x0C\xCC\x43\xBD\x73\xD3\xA3\x8E\xE8\xC1\xA3\xB6"
+                                                    "\x69\x0C\xF7\x12\xA9\x10\x7E\x56\xED\xA2\x83\x23\x19\x6D\x9C\xF1\x65\x22\xFC\xB1\x3A\x96\xC7\xF3"
+                                                    "\x35\x9C\xAF\xC8\x2B\x38\x21\x03\xB7\xAE\x8D\xE3\x2D\x92\x2C\x66\x90\x03\xD9\x44\xC6\xA5\xAF\x4B"
+                                                    "\xBB\x65\x3A\x50\x84\x33\x2C\x0B\x3D\x59\xF8\x57\x27\x9C\xB1\xB6\x73\xC5\xEE\xC2\x68\x52\x35\x9C"
+                                                    "\x41\xD7\x11\x6E\xEC\xF5\x20\x7D\xB8\xB4\x4E\xDD\x20\x94\xA0\x1B\xD8\x60\x8C\x5F\xC1\xB4\x9C\x3C"
+                                                    "\xE8\xA3\x99\x81\x6B\xF9\x0D\xE4\xE6\xD9\x34\xD6\x8A\xB5\xBD\xAA\x66\x43\x13\xE0\x30\x9A\x07\x46"
+                                                    "\xCD\x9D\x6F\x63\xFF\x5E\x05\x54\xDC\xA9\x10\x3C\x2D\xDF\x62\xAD\x18\x13\x74\x61\x92\xD3\xF7\x65"
+                                                    "\xAD\x34\xB1\x4D\xB5\x65\x62\x8A\xD4\x7C\xBC\xF7\xC1\x29\x0F\x92\xB8\xB3\xC9\x05\x4A\x00\x00";
+
+    use_midauth      = 1;
+    mock_ipq         = 1;
+    mock_ipq_pkt_len = ARRAY_SIZE(buf);
+
+    HIP_DEBUG("Testing hipfw_midauth_add_challenge with valid inputs \n");
+
+    fail_unless(hip_fw_init_context(&ctx, buf, 4) == 0, NULL);
+
+    fail_unless(hipfw_midauth_add_challenge(&ctx, midauth_nonce) == 1, NULL);
+    fail_unless((challenge = hip_get_param(ctx.transport_hdr.hip, HIP_PARAM_CHALLENGE_REQUEST)) != NULL, 0);
+    fail_unless(memcmp(challenge->opaque, midauth_nonce, MIDAUTH_DEFAULT_NONCE_LENGTH) == 0, NULL);
+    fail_unless(challenge->K >= DEFAULT_DIFFICULTY, NULL);
+}
+END_TEST
+
+#ifdef HAVE_TCASE_ADD_EXIT_TEST
+START_TEST(test_hipfw_midauth_add_challenge_NULL_ctx)
+{
+    struct hip_fw_context ctx;
+
+    HIP_DEBUG("Testing NULL nonce \n");
+    use_midauth = true;
+    hipfw_midauth_add_challenge(&ctx, NULL);
+}
+END_TEST
+
+START_TEST(test_hipfw_midauth_add_challenge_NULL_nonce)
+{
+    uint8_t nonce[18];
+
+    HIP_DEBUG("Testing NULL ctx \n");
+    use_midauth = true;
+    hipfw_midauth_add_challenge(NULL, nonce);
+}
+END_TEST
+#endif /* HAVE_TCASE_ADD_EXIT_TEST */
+
+START_TEST(test_hip_challenge_response_opaque_len)
+{
+    struct hip_challenge_response response;
+
+    HIP_DEBUG("Testing hip_challenge_response_opaque_len \n");
+
+    hip_set_param_contents_len(&response.tlv, 28);
+    fail_unless(hip_challenge_response_opaque_len(&response) == 18, NULL);
+
+    hip_set_param_contents_len(&response.tlv, 11);
+    fail_unless(hip_challenge_response_opaque_len(&response) == 1, NULL);
+}
+END_TEST
+
+#ifdef HAVE_TCASE_ADD_EXIT_TEST
+START_TEST(test_hip_challenge_response_opaque_len_NULL)
+{
+    HIP_DEBUG("Testing hip_challenge_response_opaque_len on NULL input\n");
+    hip_challenge_response_opaque_len(NULL);
+}
+END_TEST
+
+START_TEST(test_verify_response_NULL_ctx)
+{
+    struct hip_challenge_response response;
+    uint8_t                       midauth_nonce[MIDAUTH_DEFAULT_NONCE_LENGTH];
+
+    verify_response(NULL, &response, midauth_nonce);
+}
+END_TEST
+
+START_TEST(test_verify_response_NULL_response)
+{
+    struct hip_fw_context ctx;
+    uint8_t               midauth_nonce[MIDAUTH_DEFAULT_NONCE_LENGTH];
+
+    verify_response(&ctx, NULL, midauth_nonce);
+}
+END_TEST
+
+START_TEST(test_verify_response_NULL_nonce)
+{
+    struct hip_fw_context         ctx;
+    struct hip_challenge_response response;
+
+    verify_response(&ctx, &response, NULL);
+}
+END_TEST
+#endif /* HAVE_TCASE_ADD_EXIT_TEST */
+
+START_TEST(test_verify_response_no_match)
+{
+    struct hip_fw_context         ctx;
+    struct hip_challenge_response response;
+    uint8_t                       midauth_nonce[] = "\x01\x41\x01\x14\x05\x00\x48\x49\x0b"
+                                                    "\x02\x42\x02\x15\x06\x08\x49\x50\x0d";
+
+    HIP_DEBUG("Testing verify_response on non-matching inputs\n");
+
+    hip_set_param_contents_len(&response.tlv, 28);
+    memcpy(response.opaque, midauth_nonce, MIDAUTH_DEFAULT_NONCE_LENGTH);
+    response.opaque[0]++;
+    fail_unless(verify_response(&ctx, &response, midauth_nonce) == 3, NULL);
+    response.opaque[0]--;
+
+    response.opaque[MIDAUTH_DEFAULT_NONCE_LENGTH - 1]++;
+    fail_unless(verify_response(&ctx, &response, midauth_nonce) == 3, NULL);
+}
+END_TEST
+
+START_TEST(test_verify_response)
+{
+    int                           i;
+    struct hip_common             hip;
+    struct hip_fw_context         ctx;
+    struct hip_challenge_response response;
+    struct puzzle_hash_input      tmp_puzzle;
+    uint8_t                       midauth_nonce[] = "\x01\x41\x01\x14\x05\x00\x48\x49\x0b"
+                                                    "\x02\x42\x02\x15\x06\x08\x49\x50\x0d";
+
+    HIP_DEBUG("Testing verify_response on valid inputs\n");
+
+    // build context
+    ctx.transport_hdr.hip = &hip;
+    hip.hits              = in6addr_any;
+    hip.hitr              = in6addr_any;
+
+    // build response
+    fail_unless(hip_midauth_puzzle_seed(midauth_nonce, MIDAUTH_DEFAULT_NONCE_LENGTH, tmp_puzzle.puzzle) == 0, NULL);
+    tmp_puzzle.initiator_hit = in6addr_any;
+    tmp_puzzle.responder_hit = in6addr_any;
+    hip_set_param_contents_len(&response.tlv, 28);
+    memcpy(response.opaque, midauth_nonce, MIDAUTH_DEFAULT_NONCE_LENGTH);
+    for (i = 1; i <= 20; i++) {
+        HIP_DEBUG("Difficulty: %i \n", i);
+        response.K = i;
+        fail_unless(hip_solve_puzzle(&tmp_puzzle, response.K) == 0, NULL);
+        memcpy(response.J, tmp_puzzle.solution, 8);
+        fail_unless(verify_response(&ctx, &response, midauth_nonce) == 1, NULL);
+    }
+}
+END_TEST
+
+START_TEST(test_hipfw_midauth_verify_challenge_NULL_ctx)
+{
+    uint8_t midauth_nonce[] = "\x01\x41\x01\x14\x05\x00\x48\x49\x0b"
+                              "\x02\x42\x02\x15\x06\x08\x49\x50\x0d";
+    hipfw_midauth_verify_challenge(NULL, midauth_nonce);
+}
+END_TEST
+
+START_TEST(test_hipfw_midauth_verify_challenge_NULL_challenge)
+{
+    struct hip_fw_context ctx;
+    ctx.packet_type = HIP_PACKET;
+    use_midauth     = true;
+    fail_unless(hipfw_midauth_verify_challenge(&ctx, NULL) == 0, NULL);
+}
+END_TEST
+
+START_TEST(test_hipfw_midauth_verify_challenge)
+{
+    struct hip_common           *hip;
+    struct hip_fw_context        ctx;
+    struct hip_challenge_request request;
+    struct puzzle_hash_input     tmp_puzzle;
+    uint8_t                      midauth_nonce[] = "\x01\x41\x01\x14\x05\x00\x48\x49\x0b"
+                                                   "\x02\x42\x02\x15\x06\x08\x49\x50\x0d";
+
+    HIP_DEBUG("Testing verify_response on valid inputs\n");
+
+    // build context
+    hip                   = hip_msg_alloc();
+    hip->hits             = in6addr_any;
+    hip->hitr             = in6addr_any;
+    ctx.transport_hdr.hip = hip;
+
+    // build request
+    request.K        = 1;
+    request.tlv.type = HIP_PARAM_CHALLENGE_REQUEST;
+    hip_set_param_contents_len(&request.tlv, 20);
+    memcpy(request.opaque, midauth_nonce, 18);
+
+    // build solution
+    fail_unless(hip_midauth_puzzle_seed(midauth_nonce, MIDAUTH_DEFAULT_NONCE_LENGTH, tmp_puzzle.puzzle) == 0, NULL);
+    tmp_puzzle.initiator_hit = in6addr_any;
+    tmp_puzzle.responder_hit = in6addr_any;
+    fail_unless(hip_solve_puzzle(&tmp_puzzle, request.K) == 0, NULL);
+
+    // build parameter
+    hip_build_param_challenge_response(hip, &request, tmp_puzzle.solution);
+
+    fail_unless(hipfw_midauth_verify_challenge(&ctx, midauth_nonce) == 1, NULL);
+}
+END_TEST
+
+Suite *firewall_midauth(void)
+{
+    Suite *s          = suite_create("firewall/midauth");
+    TCase *tc_midauth = tcase_create("Midauth");
+
+#ifdef HAVE_TCASE_ADD_EXIT_TEST
+    tcase_add_exit_test(tc_midauth, test_hipfw_midauth_add_challenge_NULL_ctx, 1);
+    tcase_add_exit_test(tc_midauth, test_hipfw_midauth_add_challenge_NULL_nonce, 1);
+    tcase_add_exit_test(tc_midauth, test_hip_challenge_response_opaque_len_NULL, 1);
+    tcase_add_exit_test(tc_midauth, test_verify_response_NULL_ctx, 1);
+    tcase_add_exit_test(tc_midauth, test_verify_response_NULL_response, 1);
+    tcase_add_exit_test(tc_midauth, test_verify_response_NULL_nonce, 1);
+    tcase_add_exit_test(tc_midauth, test_hipfw_midauth_verify_challenge_NULL_ctx, 1);
+#endif
+
+    tcase_add_test(tc_midauth, test_hipfw_midauth_add_challenge);
+    tcase_add_test(tc_midauth, test_hip_challenge_response_opaque_len);
+    tcase_add_test(tc_midauth, test_verify_response_no_match);
+    tcase_add_test(tc_midauth, test_verify_response);
+    tcase_add_test(tc_midauth, test_hipfw_midauth_verify_challenge_NULL_challenge);
+    tcase_add_test(tc_midauth, test_hipfw_midauth_verify_challenge);
+
+    suite_add_tcase(s, tc_midauth);
+
+    return s;
+}
 
=== added file 'test/firewall/rewrite.c'
--- test/firewall/rewrite.c	1970-01-01 00:00:00 +0000
+++ test/firewall/rewrite.c	2011-10-25 12:58:23 +0000
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2011 Aalto University and RWTH Aachen University.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#define _BSD_SOURCE
+
+#include <check.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "firewall/firewall_defines.h"
+#include "lib/core/common.h"
+#include "modules/midauth/hipd/midauth.h"
+#include "modules/midauth/lib/midauth_builder.h"
+#include "test/mocks.h"
+#include "test_suites.h"
+
+#include "firewall/firewall.c"
+
+
+static const unsigned char tmp_ipq_packet[] = "\xA0\x85\x07\x12\x00\x88\xFF\xFF\x00\x00"
+                                              "\x00\x00\x00\x00\x00\x00\xD3\x98\x81\x4E\x00\x00\x00\x00\x27\x21\x0D"
+                                              "\x00\x00\x00\x00\x00\x02\x00\x00\x00\x65\x74\x68\x31\x00\x00\x00\x00"
+                                              "\x00\x00\x00\x00\x00\x00\x00\x00\x65\x74\x68\x32\x00\x00\x00\x00\x00"
+                                              "\x00\x00\x00\x00\x00\x00\x00\x08\x00\x01\x00\x06\x08\x00\x27\x45\x4D"
+                                              "\x26\x00\x00\x00\x00\x00\x00\x00\x00\x00\xA0\x02\x00\x00\x00\x00\x00"
+                                              "\x00\x45\x00\x02\xA0\x00\x00\x40\x00\x3F\x11\xB3\xEF\xC0\xA8\x01\x0A"
+                                              "\xC0\xA8\x03\x03\x29\x04\x29\x04\x02\x8C\x00\x00\x00\x00\x00\x00\x3B"
+                                              "\x4F\x03\x11\x00\x00\x00\x00\x20\x01\x00\x1B\xD8\xB0\x77\xF0\xC6\x17"
+                                              "\x71\x70\xDE\xD7\xF3\x20\x20\x01\x00\x17\x5D\xF8\xC4\x26\x98\xE5\x5F"
+                                              "\xA2\x28\x6D\x28\x47\x00\x41\x00\x0C\x00\x00\x00\x48\x00\x00\x00\x00"
+                                              "\x2D\x4A\x07\x08\x01\x41\x00\x14\x00\x00\x48\x49\x90\x7D\xD8\x95\x84"
+                                              "\xB3\x8D\xDC\x18\x25\xF9\x65\xE3\x31\x3E\xDD\x01\x42\x00\x1C\x01\x02"
+                                              "\x82\xEC\x42\x00\x00\x00\x00\x00\x5A\x3C\x03\x14\x9A\x0E\x9D\xCA\xF0"
+                                              "\x19\xAD\x2B\xBA\x43\x33\x66\xF8\xB2\x02\x01\x00\xC3\x03\x00\xC0\x7C"
+                                              "\xDA\x02\x1F\xB7\xFE\x85\xBB\xD1\x93\xFD\xB2\xFB\xC0\xB1\xAD\x09\x61"
+                                              "\x1F\x8E\xDD\x8F\x1B\xFC\xC3\x97\xA1\xCE\x4C\x55\x85\xB4\x4A\x8B\x66"
+                                              "\x93\x2A\xDF\x85\xC0\x3A\x84\xA2\x22\x4F\xB3\xF9\x6F\xC5\x54\x23\x9D"
+                                              "\xC2\x03\xEB\xB9\x55\xA4\xF0\x19\xC0\x2B\x4C\xD1\xBF\xC9\x04\xF5\x32"
+                                              "\xAB\x39\xEF\x7B\xF9\xA7\xAB\x5A\xC5\x27\x5E\x21\x83\x48\xB0\x8E\x19"
+                                              "\xB4\x51\x2B\xBA\x79\x00\x62\x70\x48\xF3\x44\xAE\x49\xD4\xC9\x20\x74"
+                                              "\x38\x0D\x11\xCA\xB3\x6F\x03\x47\x9A\x39\xA5\xFB\xC0\x70\xD6\xB5\xB6"
+                                              "\x35\x08\xB4\xB0\x33\x19\xF9\x07\x3C\x82\x7D\x3C\x16\x0C\x74\x9A\x1F"
+                                              "\x9B\xB2\xE6\xB3\xC7\xB3\x08\xE2\x10\x66\x23\x95\xF6\x00\xC7\x57\x8B"
+                                              "\x19\x83\x9E\x6F\xB6\x9D\x6A\x44\x25\xF1\xFD\x45\xFB\xD4\xD9\xE8\xA7"
+                                              "\xD5\xF9\xA7\xA5\xFB\xA3\x23\xD2\xDE\x67\x15\x9C\x6C\xFB\x5B\x08\xAC"
+                                              "\x7F\xC9\xF9\xD7\x00\x02\x41\x00\x02\x00\x01\x00\x00\x02\xC1\x00\x92"
+                                              "\x00\x88\x10\x06\x02\x02\xFF\x05\x03\x01\x00\x01\xD6\xBD\x7C\x86\xC3"
+                                              "\x4A\xA3\x93\x7F\xD9\x82\xBD\x22\xF1\xC7\x4F\x72\x76\x4F\x2F\x68\xF7"
+                                              "\x4F\x9D\xCE\xF3\xAE\xD4\x3B\x13\x5D\xC1\xF7\xF8\x09\x4E\xB4\xCD\x82"
+                                              "\x6F\xF8\xD1\x70\x01\x4E\xC0\x64\x82\xF1\x7E\x21\x54\x62\x73\x08\xEA"
+                                              "\x0A\x66\x1B\xA7\x9A\x4A\xAA\x17\x56\x77\x1D\x4D\x0D\xD2\x19\x92\xA0"
+                                              "\xAC\xF7\x23\x62\xE2\xF0\xFB\x1E\x73\x19\x16\x61\x1B\x85\x02\x42\x4B"
+                                              "\x89\x46\x09\x71\x42\x6F\x40\x8E\x62\x31\xA6\x4F\x17\x45\xF2\x7B\xFA"
+                                              "\xF2\xB6\xC8\x87\x37\x3A\xDF\xBB\x10\xE8\xDA\x97\x31\x6C\x38\xDF\xD0"
+                                              "\x97\x45\x84\x39\x61\x6C\x69\x63\x65\x00\x00\x00\x0F\xFF\x00\x04\x00"
+                                              "\x00\x00\x01\xF0\x41\x00\x14\xE7\x35\x6F\x89\x30\x3E\x1E\xA7\xFB\x93"
+                                              "\x8B\xBE\xD1\x34\x1F\x35\xB8\xE0\x82\x0C\xF1\x01\x00\x81\x05\xA6\xA2"
+                                              "\x75\xEF\xA8\xC3\x9C\x64\x9E\x9A\xDA\xFB\x38\xB4\x05\x8C\x6A\x6E\x5B"
+                                              "\x59\x9F\x11\x5B\xA6\xC0\x05\x42\xA6\x0D\x9C\x62\x17\x0E\x23\xB6\x3B"
+                                              "\x15\xB8\xEC\x6F\xE3\xB6\x6E\x80\x76\x97\xBE\x5B\x5B\x1A\x90\x30\xDF"
+                                              "\x1F\x32\x2C\x4E\x22\x20\x0B\xD4\x2B\x5B\x7C\xEF\x27\xEA\xB9\x80\x27"
+                                              "\xEF\xBC\xB4\xAF\x97\x2A\xD5\x86\xDA\xEE\x2C\xF0\x8B\x45\x00\x10\xE1"
+                                              "\x3A\x95\x35\xAC\x7C\xA8\x88\xC1\x60\xB9\x71\xD3\xE2\x29\xF7\x75\xD0"
+                                              "\x7E\x27\x1B\x21\x43\xAE\xBB\x08\xE1\x6B\x9E\x1E\xB9\x55\x89\xE3\x2B"
+                                              "\x29\x06\x4A\xA2\x90\x98\x38\x00\x00\x00";
+static const uint8_t opaque[] = "\x01\x41\x01\x14\x05\x00\x48\x49\x0b"
+                                "\x02\x42\x02\x15\x06\x08\x49\x50\x0c";
+
+START_TEST(hipfw_splice_param_correct)
+{
+    struct hip_fw_context        ctx;
+    struct hip_common           *tmp_msg = NULL;
+    const struct hip_tlv_common *param   = NULL;
+
+    mock_ipq         = true;
+    mock_ipq_pkt_len = ARRAY_SIZE(tmp_ipq_packet);
+
+    fail_unless(hip_fw_init_context(&ctx, tmp_ipq_packet, 4) == 0, NULL);
+
+    tmp_msg = hip_msg_alloc();
+    hip_build_param_challenge_request(tmp_msg, 0, 0, opaque,
+                                      MIDAUTH_DEFAULT_NONCE_LENGTH);
+    param = hip_get_param(tmp_msg, HIP_PARAM_CHALLENGE_REQUEST);
+
+    fail_unless(hipfw_splice_param(&ctx, param) == true, NULL);
+}
+END_TEST
+
+#ifdef HAVE_TCASE_ADD_EXIT_TEST
+START_TEST(hipfw_splice_param_NULL_ctx)
+{
+    struct hip_common           *tmp_msg = NULL;
+    const struct hip_tlv_common *param   = NULL;
+
+    tmp_msg = hip_msg_alloc();
+    hip_build_param_challenge_request(tmp_msg, 0, 0, opaque,
+                                      MIDAUTH_DEFAULT_NONCE_LENGTH);
+    param = hip_get_param(tmp_msg, HIP_PARAM_CHALLENGE_REQUEST);
+
+    fail_unless(hipfw_splice_param(NULL, param) == false, NULL);
+}
+END_TEST
+
+START_TEST(hipfw_splice_param_NULL_param)
+{
+    struct hip_fw_context ctx;
+
+    mock_ipq         = true;
+    mock_ipq_pkt_len = ARRAY_SIZE(tmp_ipq_packet);
+
+    fail_unless(hip_fw_init_context(&ctx, tmp_ipq_packet, 4) == 0, NULL);
+    fail_unless(hipfw_splice_param(&ctx, NULL) == false, NULL);
+}
+END_TEST
+#endif
+
+Suite *firewall_rewrite(void)
+{
+    Suite *s          = suite_create("firewall/rewrite");
+    TCase *tc_rewrite = tcase_create("rewrite");
+    tcase_add_test(tc_rewrite, hipfw_splice_param_correct);
+#ifdef HAVE_TCASE_ADD_EXIT_TEST
+    tcase_add_exit_test(tc_rewrite, hipfw_splice_param_NULL_ctx, 1);
+    tcase_add_exit_test(tc_rewrite, hipfw_splice_param_NULL_param, 1);
+#endif
+    suite_add_tcase(s, tc_rewrite);
+
+    return s;
+}
 
=== modified file 'test/firewall/test_suites.h'
--- test/firewall/test_suites.h	2011-04-04 16:36:55 +0000
+++ test/firewall/test_suites.h	2011-10-25 12:58:23 +0000
@@ -32,6 +32,8 @@
 Suite *firewall_file_buffer(void);
 Suite *firewall_helpers(void);
 Suite *firewall_line_parser(void);
+Suite *firewall_midauth(void);
 Suite *firewall_port_bindings(void);
+Suite *firewall_rewrite(void);
 
 #endif /* HIP_TEST_FIREWALL_TEST_SUITES_H */
 
=== modified file 'test/mocks.c'
--- test/mocks.c	2011-08-15 14:11:56 +0000
+++ test/mocks.c	2011-10-25 12:58:23 +0000
@@ -87,6 +87,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
+#include <libipq.h>
 
 #include "mocks.h"
 
@@ -189,3 +190,28 @@
 
     return EXIT_SUCCESS;
 }
+
+/*** ipq_get_packet(3) ***/
+bool         mock_ipq         = false;
+unsigned int mock_ipq_pkt_len = 0;
+
+/**
+ * ipq_get_packet(3) mock function. Controlled by the ::mock_ipq flag.
+ *
+ * @param buf   contents of the returned ipq_packet_msg_t
+ * @return      a fully filled ipq_packet_msg_t
+ *
+ * @note The buffer length is required for this mock function. You can provide
+ *       it via the ::mock_ipq_pkt_len flag.
+ */
+ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf)
+{
+    if (!mock_ipq) {
+        ipq_packet_msg_t *(*original)(const unsigned char *) = get_original(ipq_get_packet, "ipq_get_packet");
+        return original(buf);
+    } else {
+        char *tmp = malloc(mock_ipq_pkt_len);
+        memcpy(tmp, buf, mock_ipq_pkt_len);
+        return (ipq_packet_msg_t *) tmp;
+    }
+}
 
=== modified file 'test/mocks.h'
--- test/mocks.h	2011-04-06 20:27:16 +0000
+++ test/mocks.h	2011-10-25 12:58:23 +0000
@@ -36,4 +36,7 @@
 extern bool  mock_system;
 extern char *mock_system_last;
 
+extern bool         mock_ipq;
+extern unsigned int mock_ipq_pkt_len;
+
 #endif /* HIP_TEST_MOCKS_H */