===== Abstract =====

IPv6 nodes use the Neighbor Discovery Protocol (NDP) to discover their neighbors, determine their link-layer addresses, find associated routers, and to maintain reachability information about paths to active neighbors. If not secured, NDP is vulnerable to various attacks described in the IPv6 Neighbor Discovery (ND) Trust Models and Threats specification ([[http://www.rfc-editor.org/rfc/rfc3756.txt|rfc3756]]). The Secure Neighbor Discovery protocol (%%SeND%%) ([[http://www.rfc-editor.org/rfc/rfc3971.txt|rfc3971]]) counters threats to NDP. %%SeND%% uses new NDP options to carry the public key - based signatures for protecting ND messages, Cryptographically Generated Addresses for proving address ownership on individual nodes, and uses X.509 certificates for authorizing nodes to act as routers and to delegate certain prefixes.

None of the contemporary open source operating systems include built-in support for %%SeND%%. A referent open-source (BSD licensed) %%SeND%% implementation [send-0.2], originally developed by %%DoCoMo%% NTT, works only on Linux and %%FreeBSD%%. On %%FreeBSD%%, this implementation uses a Berkley packet filter (BPF) program in a netgraph node (ng_bpf) to divert %%SeND%% traffic from kernel to an userland daemon, and vice versa. This approach has two major drawbacks. First, all network traffic (both %%SeND%% and non-%%SeND%%) has to traverse through a ng_bpf filtering node (and through the netgraph subsystem in general), which introduces significant processing overhead, effectively prohibiting production deployment of %%SeND%% in high-speed networking environments. And second, the current send-0.2 implementation depends on the netgraph subsytem, which is only available in %%FreeBSD%% and %%DragonFlyBSD%%, making  in send-0.2 implementation being unusable on other BSD-derived operating systems, such as %%NetBSD%%, %%OpenBSD%% or OS-X.

The goal of this project is design and implementation of a new userspace-kernel API for %%SeND%%, which will mitigate overhead associated with netgraph and BPF. In order to accomplish the implementation of such API, the userspace-kernel hooks will be added in the existing Neighbor Discovery (ND) code in the kernel.

This work is be under the BSD license.

The implementation was presented at %%AsiaBSDCon%% 2010, Tokyo: [[http://people.freebsd.org/~anchie/SeND_AsiaBSDCon_2010.pdf|paper]], talk ''%%http://www.ustream.tv/recorded/5397759%%'' (removed).

Sources of the kernel API (sys diff) and SEND daemon (sendd) are available [[http://people.freebsd.org/~anchie/|here]].

===== Mentor =====

BjoernZeeb