Steps for building HIP for Windows
3/15/2005

Files you will need
===================
cygwin 1.5.12-1 or later (step 1 below)
cygwin IPv6 extensions (step 2 below)
TAP-Win32 driver (step 3 below)
ipsec-tools-0.3.3.tar.gz (step 7 below)
ipsec-tools-0.3.3.hip.patch (step 7 below)
ipsec-tools-0.3.3.hip.win32.patch (step 7 below)
WinPcap_3_0.exe (Optional, step 15 below)
Ethereal (Optional, step 15 below)
winstatus.exe (Optional, Usage section below)

Installation
=============

1. Download and install Cygwin from http://cygwin.com. Run cygwin-setup.exe. 
   Choose "install from Internet" to get the latest packages.
   This software was tested using Cygwin version 1.5.12-1 released 11/11/2004.
   Make sure the following packages are installed:
       Base > diffutils
          Devel > autoconf, automake, binutils, bison, byacc, flex, gcc,
                  libiconv, libtool, libxml2, make, openssl-devel, patchutils
                  openssl, libxml2, libiconv
       Interpreters > Perl 
       Libs > w32api, crypt
       Utils > patch

2. Download and install Cygwin IPv6 extension from http://win6.jp/Cygwin/ 
   The IPv6 extension must exactly match the version of Cygwin that you
   installed in the previous step. This software was tested with
   cygwin-1.5.12-1-ipv6-0.2.1.zip from 11/13/2004. Unzip the file and a new
   folder will be created. Open the folder and select the "bin", "lib",
   and "usr" subfolders using the shift or control keys while clicking.
   Open the C:\cygwin folder using My Computer or Explorer. 
   Drag the three subfolders into C:\cygwin, and when prompted about 
   replacing files, click "yes to all". Open C:\cygwin\bin, and rename 
   cygwin1.dll to cygwin1.dll.orig. Rename new-cygwin1.dll to cygwin1.dll.

3. Get the TAP-Win32 driver. Download OpenVPN 2.0_rc16 (or newer) from 
   http://openvpn.sourceforge.net/ 
   When running the setup program, you can choose to install only the 
   TAP-Win32 driver.
   Version 2.0_rc16 (2/20/05) of OpenVPN can be used to install TAP-Win32
   driver version 8.0.0.1 (5/15/04) which appears as "TAP-Win32 Adapter V8". 

4. Setup the TAP-Win32 driver.
   (This will later be accomplished via registry manipulation in hip.exe, 
    but its currently #ifdef'd out) 
   (XP) Start > Control Panel > Network Connections
   (2000) Start > Settings > Network and Dial-up Connections
   Right-click on TAP-Win32 (choose View > Details and look under device name)
   and choose properties; 
   click on "Internet Protocol (TCP/IP)" and click Properties.
   Select "Use the following IP address:" and enter 1.0.0.1 with a 
   subnet mask of 255.0.0.0; default gateway and DNS should be blank.
   Click OK and close to apply these IP address changes. Now open the
   TAP-Win32 properties sheet again, click on the "Configure" button and
   select the "Advanced" tab. Click on "MTU" and enter 1400 for the value.

5. Add the IPv6 protocol. In the same TAP-Win32 properties sheet as the previous
   step, click the "Install" button, then "Protocol", select "Microsoft" 
   from the vendor list, and locate "Microsoft IPv6 Developer Edition"
   or "Microsoft TCP/IP version 6" for Windows XP SP2. 
   Note that this is not available in Windows 2000, as the 
   "Microsoft IPv6 Technology Preview" for Windows 2000 is not supported.

6. Under Windows XP, make sure that the "IPSEC Services" service is disabled.
   Look in Start > Control Panel > Administrative Tools > Services.
   Also, the Windows XP firewall or any other firewall software you may have
   installed need to allow traffic from the program hip.exe (built later), or
   specifically allow protocol 99 and 50 (ESP) traffic.

7. Download ipsec-tools-0.3.3 from http://ipsec-tools.sourceforge.net/.
   Extract the HIP tar file to access these patches found in hipd/ipsec.
   Apply ipsec-tools-0.3.3-hip.patch from within ipsec-tools-0.3.3 directory: 
       patch -p1 < ../hipd/ipsec/ipsec-tools-0.3.3-hip.patch
   Apply ipsec-tools-0.3.3-hip.win32.patch
       patch -p1 < ../hipd/ipsec/ipsec-tools-0.3.3-hip.win32.patch
   Remove src/racoon: 
       rm -rf src/racoon
   Run aclocal, autoconf.
   Run ./configure --prefix=/usr --with-kernel-headers=kernel-header
   Run make, then make install

8. From hipd/src, run "make hitgen" Should now have hipd/src/hitgen.exe 
   for building HIP config (hitgen -conf, hitgen, hitgen -publish)

9. Generate the HIP configuration files.  
   - run hitgen.exe -conf  (this will deposit a hip.conf file)
   - run hitgen.exe (this will populate the file "my_host_identities.xml")
   - run hitgen.exe -publish (this will create a known_host_identities.xml file)
   
10. move hip.conf, my_host_identities.xml, and known_host_identities.xml to the
    directory ../win32/.

11. From hipd/src, run "make clean" and then "make win".
   This produces object (.o) files but no hipd executable, see next step.

12. From hipd/win32, run "make".

13. Test the binary:  Under hipd/win32/ there should be a file named hip.exe.
    You may now run HIP for Windows with normal hipd options: 
    "./hip.exe -hipd [options]"
    With the -v option, you should get something that looks like the below:

$ ./hip.exe -hipd -v
init_hip()
adding arg: -v
init_tun()
Initialized tunnel device.
tunreader() thread started...
hip_esp_output() thread started...
hip_esp_input() thread started...
hip_pfkey() thread started...
hip_netlink() thread started...
Status thread started...
Tue Mar 15 12:51:59 2005  hipd (4020) started.
Setting options: daemon = no  debug level = 1  permissive = no
                 no_retransmit = no  opportunistic no
Loading Host Identity...(DSA 512-bit) E435008-512
Loading Host Identity...(DSA 1024-bit) E435008-1024
Loading Host Identity...(DSA 2048-bit) E435008-2048
Loading Host Identity Tag...(DSA 512-bit) 1.46.164.107 E435008 = [ 2002:822a:226
0::822a:2260 130.42.34.96 ]
Loading Host Identity Tag...(DSA 1024-bit) 1.9.105.67 E435008 = [ 2002:822a:2260
::822a:2260 130.42.34.96 ]
Loading Host Identity Tag...(DSA 2048-bit) 1.21.78.55 E435008 = [ 2002:822a:2260
::822a:2260 130.42.34.96 ]
Initializing R1 cache for E435008-512, slot: [ 0 1 2 3 4 5 6 7 ]
Initializing R1 cache for E435008-1024, slot: [ 0 1 2 3 4 5 6 7 ]
Initializing R1 cache for E435008-2048, slot: [ 0 1 2 3 4 5 6 7 ]
Local addresses: (65542)1.0.0.1 (3)130.42.34.96 (1)127.0.0.1
130.42.34.96 selected as the preferred address.
Tue Mar 15 12:51:59 2005  Registered PF_KEY ESP handler with Windows service.
Tue Mar 15 12:51:59 2005  Listening on HIP and PF_KEY sockets...

  You can control-C out of this if it is successful.

14. (Optional and Recommended) To install HIP as a Windows service, 
    use "./hip.exe -i".

    Next, append C:\cygwin\bin to your path in the Environment Variables
    (right click on My Computer > Properties > Advanced tab > Environment Variables)

    Because HIP uses Cygwin it is not able to run as a service with the normal
    "Local System" account. Go to Start > Control Panel > Administrative Tools
    > Services. Double-click the HIP service and choose the "Log On" tab.
    Instead of "Local System account", choose "This account" and supply a
    valid username and password (your current login name should be fine).

    Now you can start and stop the HIP Windows service using this Services
    list from the Control Panel.

15.  (Optional) Install WinPcap_3.0.exe and the patched version of Ethereal.
    This will help in debugging in case anything goes wrong.  

Configuration:
==============

  The next steps are to actually try to use HIP.  This is a bit different than
  in Linux because this implementation performs a (static) mapping between 
  Local Scope Identifiers (LSIs) and IP addresses.  

  That is, locally, an application that wants to connect or bind to a host
  identity uses the LSI corresponding to that host identity.  These are
  distinguished from IP addresses via the known_host_identities.xml file.

  There are two main cases to consider:
  i) Initiating a connection
  ii) Responding to a HIP I1

i)  Initiating.  If you want to connect to a specific peer host identity,
    you must first obtain that peer's IP address and HIT, and add it
    into the known_host_identities.xml file, as follows (for example):

  <host_identity alg="DSA" alg_id="3" length="128">
    <name>theseus</name>
    <address>192.76.227.16</address>
    <HIT>749BBDF99FA95BC8EDF002B166031742</HIT>
  </host_identity>

  (NOTE:  You should also add the pair "192.76.227.16  theseus" to 
   your /etc/hosts file, in this example)

   The LSI is formed by concatenating "1" with the last 24 bits of the HIT;
   in this case, 1.3.23.66.  Rather than due hex2dec conversion of the HIT,
   you can also start up the hip daemon to see what the verbose output
   displays (e.g.,
Loading Host Identity Tag...(DSA 1024-bit) 1.3.23.66 theseus = [192.76.227.16])

   Then, in your application, if you do a connect(1.3.23.66), the HIP
   service will initiate a new HIP session to the address listed, or
   else place the packets into an existing SA if one already exists.

ii) Responding.   This case is not much different from Linux, but is 
    likely not as common of a case unless the local Windows machine is
    offering a service.  If the daemon runs in opportunistic mode (-o),
    then HIP should accept any incoming connection request, and use 
    the default host identity as configured.  If the daemon does not
    accept opportunistic requests (in which the I1 has a responder HIT
    value of all zeros), or if the initiator knows which HIT it wants
    to connect to, then this works the same as in Linux.

Usage:
======

Let's assume that you start hipd as a service, as described in step 14 above.
We will use the host "theseus" (192.76.227.16) as a
target example.  Make sure that you have the following info in your
known_host_identities.xml file:

  <host_identity alg="DSA" alg_id="3" length="128">
    <name>theseus</name>
    <address>192.76.227.16</address>
    <HIT>749BBDF99FA95BC8EDF002B166031742</HIT>
  </host_identity>

1.  (Optional) try the winstatus.exe program.  This should show you
    information about your Local Host Identities, Configured Peers,
    and Active Connections (there will be no active connections)
    "theseus" should show up as a Configured Peer.  If you click on it,
    you will see information about the HIT, LSI, and address.

2.  (Optional) try running Ethereal on your output connection.  You can
    filter for protocol 99 (HIP), or the particular host to which you intend
    to use HIP with (such as "host 192.76.227.16).

3.  Try pinging to the LSI 1.3.23.66 from a cygwin or DOS shell.  This should
    trigger a HIP exchange, followed by all packets 

4.  Set your HTTP proxy on your browser manually to the following address/port:
    1.3.23.66/31060.  Now, you should be web surfing via HIP!  You should be
    able to see these ESP packets in Ethereal.




Known issues:
=============
- On two machines running slightly different XP builds (Dell Latitude D600
and an IBM Thinkpad T40), I have noticed very occasional segfaults in the
svchost.exe file when I power down my machine.

