Merge lp:~stefan.goetz-deactivatedaccount/hipl/msg-bfr into lp:hipl

[Stefan Götz]

Improve robustness in memory management: in the 'struct r1entry' data structure, convert the 'r1' field from a 'struct hip_common' pointer to a 'union hip_msg_bfr' object so it does not need to be allocated dynamically.

[Stefan Götz (stefan.goetz-deactivatedaccount)]

Hi Christoph!

> Review: Approve
> Getting rid of pointers is always nice, go ahead please.

Thanks!

>> -struct hip_r1entry *hip_init_r1(void)
>> -{
>> - struct hip_r1entry *err;
>> -
>> - if (!(err = calloc(HIP_R1TABLESIZE, sizeof(struct hip_r1entry)))) {
>> - return NULL;
>> - }
>> -
>> - return err;
>> -}
>
> The memory was reset to zero by calloc() before, but currently it isn't. Are you sure there's no way uninitialized data can leak onto the wire? As padding, for example.
> OTOH, padding should really be cleared wherever the R1 is constructed, if needed (thus this comment is unrelated to your code).

This question is relevant for the 'r1' field in 'struct hip_r1entry' as all
other fields are assigned during initialization. With the 'r1' field, indeed the
R1 construction takes care of clearing the memory before creating the R1
message. However, the msg-bfr merge proposal turns that field from a pointer
into the struct instance and by dropping the memory allocation also drops the
initialization to 0. That needs to be looked into.

Stefan

[Stefan Götz (stefan.goetz-deactivatedaccount)]

'hip_create_r1' no longer initializes its message object to 0 before constructing the message data. Either, the message buffer should be reset to 0 before constructing the message or it needs to be confirmed that the message construction code itself is sufficient to leave no uninitialized data in the message buffer.

As I'd like to avoid the resetting, I'll check the message construction code as I find the time.

Thanks to Christof Mroz for pointing this out.

Reviews apart from this aspect are still welcome.

review: Needs Information

[lp:~stefan.goetz-deactivatedaccount/hipl/msg-bfr]

5911. By René Hummen on 2011-05-05

fix debug output for received packets

Previously, src was printed instead of dst.

[Diego Biurrun (diego-biurrun)]

 review abstain

On Wed, May 04, 2011 at 09:09:02PM +0000, Stefan Götz wrote:
> Stefan Götz has proposed merging lp:~stefan.goetz/hipl/msg-bfr into lp:hipl.
>
> --- hipd/cookie.h 2011-04-19 16:22:10 +0000
> +++ hipd/cookie.h 2011-05-04 21:08:48 +0000
> @@ -32,11 +32,11 @@
>
> struct hip_r1entry {
> - struct hip_common *r1;
> - uint32_t generation;
> - uint8_t Ci[PUZZLE_LENGTH];
> - uint8_t Ck;
> - uint8_t Copaque[HIP_PUZZLE_OPAQUE_LEN];
> + union hip_msg_bfr bfr;
> + uint32_t generation;
> + uint8_t Ci[PUZZLE_LENGTH];
> + uint8_t Ck;
> + uint8_t Copaque[HIP_PUZZLE_OPAQUE_LEN];
> };
>
> --- lib/core/protodefs.h 2011-05-02 14:17:17 +0000
> +++ lib/core/protodefs.h 2011-05-04 21:08:48 +0000
> @@ -701,6 +701,19 @@
>
> +union hip_msg_bfr {
> + struct hip_common msg;
> + struct hip_common_user usr;
> + unsigned char bfr[HIP_MAX_PACKET];
> +};

You use "bfr" as a shorthand for "buffer", but I think "buf" is way more
common. I suggest using the latter.

Diego

review: Abstain

[Miika Komu (miika-iki)]

The builder assumes that the message buffer has been initialized to zeroes. Uninitialized messages will crash both the network and interprocess communications.

I fail to see the reason for this non-zeroing micro optimization in this, particularly because it would require rewriting the builder and lots of testing. If the goal is to improve processing overhead, I think this micro-optimization won't help much. If it's about DoS protection, I think threading would have a larger impact.

So my recommendation is to zero the message. As an alternative, you can modify the builder and test it properly (doesn't seem worth the trouble).

review: Needs Fixing

[Christof Mroz (christof-mroz)]

> I fail to see the reason for this non-zeroing micro optimization in this,
> particularly because it would require rewriting the builder and lots of
> testing. If the goal is to improve processing overhead, I think this micro-
> optimization won't help much. If it's about DoS protection, I think threading
> would have a larger impact.

Not sure about Stefan, but that's certainly not what I had in mind. The question was essentially: is the builder blown apart by not zeroing the buffer right after allocation, or will it be zeroied before (re-)building the precomputed R1s anyway (which would be the sensible thing to do)?
If that's the case, the branch can be commited without modifications IMO.

[lp:~stefan.goetz-deactivatedaccount/hipl/msg-bfr]

5912. By David Martin on 2011-05-06

Remove pointless debug print from hip_netdev_event().

[Stefan Götz (stefan.goetz-deactivatedaccount)]

I briefly looked into the builder to see whether it is robust against unzeroed message buffers. It is not :-)

> The builder assumes that the message buffer has been initialized to zeroes.
> Uninitialized messages will crash both the network and interprocess
> communications.

It crashes or, in the case of R1s, it aborts early as it might find that, given an uninitialized message length field, the message is already too large to add more parameters.

> I fail to see the reason for this non-zeroing micro optimization in this,
> particularly because it would require rewriting the builder and lots of
> testing. If the goal is to improve processing overhead, I think this micro-
> optimization won't help much.

I agree with you given the current overall processing overhead in HIPL. [Offtopic: However, it might make sense to deliberately tackle this overhead. For example, the pre-created R1 messages are duplicated before they are sent which is probably unnecessary. Also the sending routine moves the complete message contents around in memory twice when using raw sockets. Thus I believe there is quite some potential for performance improvements, especially on slow platforms such as WiFi routers. But, yes, of course, it's a lot of work not relevant for this branch.]

> So my recommendation is to zero the message. As an alternative, you can modify
> the builder and test it properly (doesn't seem worth the trouble).

Yes. I'll update the branch accordingly.

review: Needs Fixing

[Stefan Götz (stefan.goetz-deactivatedaccount)]

> You use "bfr" as a shorthand for "buffer", but I think "buf" is way more
> common. I suggest using the latter.

Done. Is there anything in particular I can do to get an 'approve' from you?

[Stefan Götz (stefan.goetz-deactivatedaccount)]

review: Abstain

[Stefan Götz (stefan.goetz-deactivatedaccount)]

review: Abstain

[Miika Komu (miika-iki)]

Another small comment. This was removed from the R1 deallocation procedure:

43 - hip_r1table = NULL;

While this is strictly speaking not necessary, I have found it easier to debug NULL pointer crashes rather than pointers that are freed.

[Christof Mroz (christof-mroz)]

If it works, I'm fine with it apart from one minor thing:

> === modified file 'hipd/output.c'
> --- hipd/output.c 2011-05-02 14:19:14 +0000
> +++ hipd/output.c 2011-05-07 06:46:29 +0000
> @@ -568,6 +568,8 @@
> /**
> * Construct a new R1 packet payload
> *
> + * @param msg points to a message object backed by HIP_MAX_PACKET bytes
> + * of memory to which the R1 message is written.
> * @param src_hit a pointer to the source host identity tag used in the
> * packet.
> * @param sign a funtion pointer to a signature funtion.
> @@ -576,19 +578,20 @@
>
> * @param cookie_k the difficulty value for the puzzle
> * @return a pointer to the payload on success, NULL on error.
> */

You modified the function to return -1 rather than NULL.

review: Needs Fixing

[lp:~stefan.goetz-deactivatedaccount/hipl/msg-bfr]

5913. By Stefan Götz on 2011-05-10

Merge branch https://code.launchpad.net/~stefan.goetz/hipl/lhi-storage
Merge proposal https://code.launchpad.net/~stefan.goetz/hipl/lhi-storage/+merge/59992

5917. By Stefan Götz on 2011-05-07

Initialize the message buffer as the message builder depends on it.

5918. By Stefan Götz on 2011-05-07

Rename the 'bfr' field in 'struct hip_r1entry' to 'buf' as this name is
more common.

5919. By Stefan Götz on 2011-05-10

Fix incorrect documentation of return value of hip_create_r1()

Fixes https://code.launchpad.net/~stefan.goetz/hipl/msg-bfr/+merge/59993/comments/130604

[Stefan Götz (stefan.goetz-deactivatedaccount)]

Hi Miika!

> Another small comment. This was removed from the R1 deallocation procedure:
>
> 43 - hip_r1table = NULL;
>
> While this is strictly speaking not necessary, I have found it easier to debug
> NULL pointer crashes rather than pointers that are freed.

True. Given that hip_r1table is a local variable and that it is no longer allocated dynamically, it does not apply in this case.

Unless there is anything else, would you give me an 'approve' on the merge proposal?

Stefan

[Stefan Götz (stefan.goetz-deactivatedaccount)]

Hi Christof!

> You modified the function to return -1 rather than NULL.

I updated the documentation accordingly.

Unless there is anything else, would you give me an 'approve' on the merge proposal?

Stefan

[Christof Mroz (christof-mroz)]

> I updated the documentation accordingly.
>
> Unless there is anything else, would you give me an 'approve' on the merge
> proposal?

Yep, looks fine now.

review: Approve

[Miika Komu (miika-iki)]

review: Approve

=== modified file 'hipd/cookie.c'
--- hipd/cookie.c	2011-05-04 16:20:00 +0000
+++ hipd/cookie.c	2011-05-10 18:14:26 +0000
@@ -211,9 +211,9 @@
     HIP_DEBUG("Calculated index: %d\n", idx);
 
     /* Create a copy of the found entry */
-    len = hip_get_msg_total_len(hip_r1table[idx].r1);
+    len = hip_get_msg_total_len(&hip_r1table[idx].buf.msg);
     r1  = hip_msg_alloc();
-    memcpy(r1, hip_r1table[idx].r1, len);
+    memcpy(r1, &hip_r1table[idx].buf.msg, len);
     err = r1;
 
 out_err:
@@ -245,8 +245,9 @@
 
         cookie_k = hip_get_cookie_difficulty();
 
-        r1table[i].r1 = hip_create_r1(hit, sign, privkey, pubkey, cookie_k);
-        if (!r1table[i].r1) {
+        hip_msg_init(&r1table[i].buf.msg);
+
+        if (hip_create_r1(&r1table[i].buf.msg, hit, sign, privkey, pubkey, cookie_k)) {
             HIP_ERROR("Unable to precreate R1s\n");
             return 0;
         }
@@ -258,29 +259,6 @@
 }
 
 /**
- * uninitialize R1 table
- *
- * @param hip_r1table R1 table
- */
-void hip_uninit_r1(struct hip_r1entry *const hip_r1table)
-{
-    int i;
-
-    /* The R1 packet consist of 2 memory blocks. One contains the actual
-     * buffer where the packet is formed, while the other contains
-     * pointers to different TLVs to speed up parsing etc.
-     * The r1->common is the actual buffer, and r1 is the structure
-     * holding only pointers to the TLVs.
-     */
-    if (hip_r1table) {
-        for (i = 0; i < HIP_R1TABLESIZE; i++) {
-            free(hip_r1table[i].r1);
-            hip_r1table[i].r1 = NULL;
-        }
-    }
-}
-
-/**
  * Verifies the solution of a puzzle. First we check that K and I are the same
  * as in the puzzle we sent. If not, then we check the previous ones (since the
  * puzzle might just have been expired).
@@ -314,7 +292,7 @@
              -1, "Requested source HIT not (any more) available.\n");
     result = &hid->r1[hip_calc_cookie_idx(ip_i, ip_r)];
 
-    puzzle = hip_get_param(result->r1, HIP_PARAM_PUZZLE);
+    puzzle = hip_get_param(&result->buf.msg, HIP_PARAM_PUZZLE);
     HIP_IFEL(!puzzle, -1, "Internal error: could not find the cookie\n");
     HIP_IFEL(memcmp(solution->opaque, puzzle->opaque,
                     HIP_PUZZLE_OPAQUE_LEN), -1,
@@ -369,7 +347,6 @@
 {
     int (*signature_func)(void *key, struct hip_common *m);
 
-    hip_uninit_r1(entry->r1);
     switch (hip_get_host_id_algo(&entry->host_id)) {
     case HIP_HI_RSA:
         signature_func = hip_rsa_sign;

=== modified file 'hipd/cookie.h'
--- hipd/cookie.h	2011-05-04 16:10:54 +0000
+++ hipd/cookie.h	2011-05-10 18:14:26 +0000
@@ -34,17 +34,16 @@
 #define HIP_R1TABLESIZE 3 /* precreate only this many R1s */
 
 struct hip_r1entry {
-    struct hip_common *r1;
-    uint32_t           generation;
-    uint8_t            Ci[PUZZLE_LENGTH];
-    uint8_t            Ck;
-    uint8_t            Copaque[HIP_PUZZLE_OPAQUE_LEN];
+    union hip_msg_bfr buf;
+    uint32_t          generation;
+    uint8_t           Ci[PUZZLE_LENGTH];
+    uint8_t           Ck;
+    uint8_t           Copaque[HIP_PUZZLE_OPAQUE_LEN];
 };
 
 struct hip_common *hip_get_r1(struct in6_addr *ip_i,
                               struct in6_addr *ip_r,
                               struct in6_addr *peer_hit);
-void hip_uninit_r1(struct hip_r1entry *const hip_r1table);
 int hip_recreate_all_precreated_r1_packets(void);
 int hip_precreate_r1(struct hip_r1entry *r1table,
                      const struct in6_addr *hit,

=== modified file 'hipd/hidb.c'
--- hipd/hidb.c	2011-05-04 16:20:00 +0000
+++ hipd/hidb.c	2011-05-10 18:14:26 +0000
@@ -245,12 +245,6 @@
         id->remove(id, &id->arg);
     }
 
-    /* free the dynamically reserved memory and
-     * set host_id to null to signal that it is free */
-    if (id->r1) {
-        hip_uninit_r1(id->r1);
-    }
-
     switch (hip_get_host_id_algo(&id->host_id)) {
     case HIP_HI_RSA:
         RSA_free(id->private_key);

=== modified file 'hipd/output.c'
--- hipd/output.c	2011-05-04 16:20:00 +0000
+++ hipd/output.c	2011-05-10 18:14:26 +0000
@@ -568,27 +568,30 @@
 /**
  * Construct a new R1 packet payload
  *
+ * @param msg          points to a message object backed by HIP_MAX_PACKET bytes
+ *                     of memory to which the R1 message is written.
  * @param src_hit      a pointer to the source host identity tag used in the
  *                     packet.
  * @param sign         a funtion pointer to a signature funtion.
  * @param private_key  a pointer to the local host private key
  * @param host_id_pub  a pointer to the public host id of the local host
  * @param cookie_k     the difficulty value for the puzzle
- * @return             a pointer to the payload on success, NULL on error.
+ * @return             0 on success, a non-zero value on error.
  */
-struct hip_common *hip_create_r1(const struct in6_addr *src_hit,
-                                 int (*sign)(void *key, struct hip_common *m),
-                                 void *private_key,
-                                 const struct hip_host_id *host_id_pub,
-                                 int cookie_k)
+int hip_create_r1(struct hip_common *const msg,
+                  const struct in6_addr *src_hit,
+                  int (*sign)(void *key, struct hip_common *m),
+                  void *private_key,
+                  const struct hip_host_id *host_id_pub,
+                  int cookie_k)
 {
-    struct hip_common *err = NULL;
-    struct hip_srv     service_list[HIP_TOTAL_EXISTING_SERVICES];
-    uint8_t           *dh_data1      = NULL, *dh_data2 = NULL;
-    char               order[]       = "000";
-    int                dh_size1      = 0, dh_size2 = 0;
-    int                mask          = 0, i = 0, written1 = 0, written2 = 0;
-    unsigned int       service_count = 0;
+    int            err = 0;
+    struct hip_srv service_list[HIP_TOTAL_EXISTING_SERVICES];
+    uint8_t       *dh_data1      = NULL, *dh_data2 = NULL;
+    char           order[]       = "000";
+    int            dh_size1      = 0, dh_size2 = 0;
+    int            mask          = 0, i = 0, written1 = 0, written2 = 0;
+    unsigned int   service_count = 0;
 
     enum number_dh_keys_t { ONE, TWO };
     enum number_dh_keys_t number_dh_keys = TWO;
@@ -628,83 +631,84 @@
         }
     }
 
-    HIP_IFEL(!(err = hip_msg_alloc()), NULL, "Out of memory\n");
+    /* Initialize the message buffer as the message builder depends on it. */
+    hip_msg_init(msg);
 
     /* Allocate memory for writing the first Diffie-Hellman shared secret */
     HIP_IFEL((dh_size1 = hip_get_dh_size(HIP_FIRST_DH_GROUP_ID)) == 0,
-             NULL, "Could not get dh_size1\n");
+             -1, "Could not get dh_size1\n");
     HIP_IFEL(!(dh_data1 = calloc(1, dh_size1)),
-             NULL, "Failed to alloc memory for dh_data1\n");
+             -1, "Failed to alloc memory for dh_data1\n");
 
     /* Allocate memory for writing the second Diffie-Hellman shared secret */
     HIP_IFEL((dh_size2 = hip_get_dh_size(HIP_SECOND_DH_GROUP_ID)) == 0,
-             NULL, "Could not get dh_size2\n");
+             -1, "Could not get dh_size2\n");
     HIP_IFEL(!(dh_data2 = calloc(1, dh_size2)),
-             NULL, "Failed to alloc memory for dh_data2\n");
+             -1, "Failed to alloc memory for dh_data2\n");
 
     /* Ready to begin building of the R1 packet */
 
     /** @todo TH: hip_build_network_hdr has to be replaced with an
      *  appropriate function pointer */
     HIP_DEBUG_HIT("src_hit used to build r1 network header", src_hit);
-    hip_build_network_hdr(err, HIP_R1, mask, src_hit, NULL);
+    hip_build_network_hdr(msg, HIP_R1, mask, src_hit, NULL);
 
     /********** R1_COUNTER (OPTIONAL) *********/
 
     /********** PUZZLE ************/
     const uint8_t zero_i[PUZZLE_LENGTH] = { 0 };
 
-    HIP_IFEL(hip_build_param_puzzle(err, cookie_k,
-                                    42 /* 2^(42-32) sec lifetime */, 0, zero_i),
-             NULL, "Cookies were burned. Bummer!\n");
+    HIP_IFEL((err = hip_build_param_puzzle(msg, cookie_k,
+                                           42 /* 2^(42-32) sec lifetime */, 0, zero_i)),
+             err, "Cookies were burned. Bummer!\n");
 
     /* Parameter Diffie-Hellman */
     HIP_IFEL((written1 = hip_insert_dh(dh_data1, dh_size1,
                                        HIP_FIRST_DH_GROUP_ID)) < 0,
-             NULL, "Could not extract the first DH public key\n");
+             written1, "Could not extract the first DH public key\n");
 
     if (number_dh_keys == TWO) {
         HIP_IFEL((written2 = hip_insert_dh(dh_data2, dh_size2,
                                            HIP_SECOND_DH_GROUP_ID)) < 0,
-                 NULL, "Could not extract the second DH public key\n");
+                 written2, "Could not extract the second DH public key\n");
 
-        HIP_IFEL(hip_build_param_diffie_hellman_contents(err,
-                                                         HIP_FIRST_DH_GROUP_ID, dh_data1, written1,
-                                                         HIP_SECOND_DH_GROUP_ID, dh_data2, written2),
-                 NULL, "Building of DH failed.\n");
+        HIP_IFEL((err = hip_build_param_diffie_hellman_contents(msg,
+                                                                HIP_FIRST_DH_GROUP_ID, dh_data1, written1,
+                                                                HIP_SECOND_DH_GROUP_ID, dh_data2, written2)),
+                 err, "Building of DH failed.\n");
     } else {
-        HIP_IFEL(hip_build_param_diffie_hellman_contents(err,
-                                                         HIP_FIRST_DH_GROUP_ID, dh_data1, written1,
-                                                         HIP_MAX_DH_GROUP_ID, dh_data2, 0),
-                 NULL, "Building of DH failed.\n");
+        HIP_IFEL((err = hip_build_param_diffie_hellman_contents(msg,
+                                                                HIP_FIRST_DH_GROUP_ID, dh_data1, written1,
+                                                                HIP_MAX_DH_GROUP_ID, dh_data2, 0)),
+                 err, "Building of DH failed.\n");
     }
 
     /* Parameter HIP transform. */
-    HIP_IFEL(hip_build_param_hip_transform(err,
-                                           transform_hip_suite,
-                                           sizeof(transform_hip_suite) /
-                                           sizeof(hip_transform_suite)),
-             NULL, "Building of HIP transform failed\n");
+    HIP_IFEL((err = hip_build_param_hip_transform(msg,
+                                                  transform_hip_suite,
+                                                  sizeof(transform_hip_suite) /
+                                                  sizeof(hip_transform_suite))),
+             err, "Building of HIP transform failed\n");
 
     /* Parameter HOST_ID */
-    HIP_IFEL(hip_build_param_host_id(err, host_id_pub),
-             NULL, "Building of host id failed\n");
+    HIP_IFEL((err = hip_build_param_host_id(msg, host_id_pub)),
+             err, "Building of host id failed\n");
 
     /* Parameter REG_INFO */
     hip_get_active_services(service_list, &service_count);
     HIP_DEBUG("Found %d active service(s) \n", service_count);
-    hip_build_param_reg_info(err, service_list, service_count);
+    hip_build_param_reg_info(msg, service_list, service_count);
 
     /* Parameter ESP-ENC transform. */
-    HIP_IFEL(hip_build_param_esp_transform(err,
-                                           transform_esp_suite,
-                                           sizeof(transform_esp_suite) /
-                                           sizeof(hip_transform_suite)),
-             NULL, "Building of ESP transform failed\n");
+    HIP_IFEL((err = hip_build_param_esp_transform(msg,
+                                                  transform_esp_suite,
+                                                  sizeof(transform_esp_suite) /
+                                                  sizeof(hip_transform_suite))),
+             err, "Building of ESP transform failed\n");
 
     /********** ESP-PROT transform (OPTIONAL) **********/
 
-    HIP_IFEL(esp_prot_r1_add_transforms(err), NULL,
+    HIP_IFEL((err = esp_prot_r1_add_transforms(msg)), err,
              "failed to add optional esp transform parameter\n");
 
     /********** ECHO_REQUEST_SIGN (OPTIONAL) *********/
@@ -713,7 +717,7 @@
 
     /* Parameter Signature 2 */
 
-    HIP_IFEL(sign(private_key, err), NULL, "Signing of R1 failed.\n");
+    HIP_IFEL((err = sign(private_key, msg)), err, "Signing of R1 failed.\n");
 
     /* Parameter ECHO_REQUEST (OPTIONAL) */
 
@@ -721,7 +725,7 @@
     {
         struct hip_puzzle *pz;
 
-        HIP_IFEL(!(pz = hip_get_param_readwrite(err, HIP_PARAM_PUZZLE)), NULL,
+        HIP_IFEL(!(pz = hip_get_param_readwrite(msg, HIP_PARAM_PUZZLE)), -1,
                  "Internal error\n");
 
         /* hardcode kludge */
@@ -733,15 +737,10 @@
 
     /* Packet ready */
 
-    free(dh_data1);
-    free(dh_data2);
-
-    return err;
-
 out_err:
-    free(err);
     free(dh_data1);
     free(dh_data2);
+
     return err;
 }
 

=== modified file 'hipd/output.h'
--- hipd/output.h	2011-04-11 12:56:12 +0000
+++ hipd/output.h	2011-05-10 18:14:26 +0000
@@ -45,11 +45,12 @@
 extern int hip_raw_sock_v4;
 
 
-struct hip_common *hip_create_r1(const struct in6_addr *src_hit,
-                                 int (*sign)(void *key, struct hip_common *m),
-                                 void *private_key,
-                                 const struct hip_host_id *host_id_pub,
-                                 int cookie_k);
+int hip_create_r1(struct hip_common *const msg,
+                  const struct in6_addr *src_hit,
+                  int (*sign)(void *key, struct hip_common *m),
+                  void *private_key,
+                  const struct hip_host_id *host_id_pub,
+                  int cookie_k);
 
 int hip_send_r1(const uint8_t packet_type,
                 const uint32_t ha_state,

=== modified file 'lib/core/protodefs.h'
--- lib/core/protodefs.h	2011-05-02 14:17:17 +0000
+++ lib/core/protodefs.h	2011-05-10 18:14:26 +0000
@@ -701,6 +701,19 @@
 } __attribute__ ((packed));
 
 /**
+ * A memory buffer for a HIP message.
+ * Instances of this type occupy HIP_MAX_PACKET bytes of memory.
+ * This type is useful where HIP messages are constructed and to express that
+ * the message needs to be backed by memory for that.
+ * It is also useful where dynamic allocation of message buffers is unwanted.
+ */
+union hip_msg_bfr {
+    struct hip_common      msg;
+    struct hip_common_user usr;
+    unsigned char          bfr[HIP_MAX_PACKET];
+};
+
+/**
  * Use accessor functions defined in hip_build.h, do not access members
  * directly to avoid hassle with byte ordering and length conversion.
  */