Host Identity Protocol
Subsystems (2)
PATCH 1/1 Host Identity Protocol
Hi,
Please have a look at Host Identity Protocol, a better solution for secure mobility and multihoming than Mobile IP.
http://hipl.hiit.fi/hipl/release/kernel-patches/linux-2.6.10-hipl-0.1.patch
Project info: http://infrahip.hiit.fi/
Specs: http://hip.piuha.net/drafts/
Andrei
Quoted 3 lines · Andrei Gurtov
Please have a look at Host Identity Protocol, a better solution for secure mobility and multihoming than Mobile IP.
http://hipl.hiit.fi/hipl/release/kernel-patches/linux-2.6.10-hipl-0.1.patch
Please clean up the patch :). It has tons of changes which have nothing to do with HIP. Maybe it was diffed against the wrong tree?
Signature · 3 lines
Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
Quoted 8 lines · Pekka Savola
Quoted 4 lines · Andrei Gurtov
Please have a look at Host Identity Protocol, a better solution for secure mobility and multihoming than Mobile IP.
http://hipl.hiit.fi/hipl/release/kernel-patches/linux-2.6.10-hipl-0.1.patch
Please clean up the patch :). It has tons of changes which have nothing to do with HIP. Maybe it was diffed against the wrong tree?
My apologies, I'll clean the patch today. It was created against the correct tree, but we have a separate repository that has accumulated some deleted files from older kernel versions.
Signature · 1 line
Miika Komu [email protected] http://www.iki.fi/miika/
Quoted 8 lines · Pekka Savola
Quoted 4 lines · Andrei Gurtov
Please have a look at Host Identity Protocol, a better solution for secure mobility and multihoming than Mobile IP.
http://hipl.hiit.fi/hipl/release/kernel-patches/linux-2.6.10-hipl-0.1.patch
Please clean up the patch :). It has tons of changes which have nothing to do with HIP. Maybe it was diffed against the wrong tree?
Fixed. I replaced the old patch with a clean one.
Signature · 1 line
Miika Komu [email protected] http://www.iki.fi/miika/
Quoted 6 lines · Andrei Gurtov
Please have a look at Host Identity Protocol, a better solution for secure mobility and multihoming than Mobile IP.
http://hipl.hiit.fi/hipl/release/kernel-patches/linux-2.6.10-hipl-0.1.patch
Project info: http://infrahip.hiit.fi/
I made the release directory structure more usable. The latest patch can be found from:
http://infrahip.hiit.fi/hipl/release/0.1.2/linux-2.6.10-hipl-0.1.2.patch
All feedback is welcome.
Signature · 1 line
Miika Komu [email protected] http://www.iki.fi/miika/
In article <[email protected]> (at Sun, 20 Mar 2005 18:08:30 +0200 (EET)), Miika Komu <[email protected]> says:
Quoted 4 lines · Andrei Gurtov
Quoted 3 lines
Please have a look at Host Identity Protocol, a better solution for secure mobility and multihoming than Mobile IP.
:
Quoted 4 lines
I made the release directory structure more usable. The latest patch can be found from:
http://infrahip.hiit.fi/hipl/release/0.1.2/linux-2.6.10-hipl-0.1.2.patch
I think you're doing great work.
However, all signaling should be handled in userspace as we (will) do for MIP6.
Signature · 2 lines
Hideaki YOSHIFUJI @ USAGI Project <[email protected]> GPG FP: 9022 65EB 1ECF 3AD1 0BDF 80D8 4807 F894 E062 0EEA
David S. Miller
maintainerQuoted 1 line · On Mon, 21 Mar 2005 02:42:41 +0900 (JST) YOSHIFUJI Hideaki / $B5HF#1QL@(B…
However, all signaling should be handled in userspace as we (will) do for MIP6.
Yes, I've been telling them similarly in a private email discussion. I'm very glad someone else says this too, so I don't appear as the only person who feels this way :-)
Quoted 10 lines · David S. Miller
Quoted 2 lines · On Mon, 21 Mar 2005 02:42:41 +0900 (JST) YOSHIFUJI Hideaki / µÈÆ£±ÑÌÀ…
However, all signaling should be handled in userspace as we (will) do for MIP6.
Yes, I've been telling them similarly in a private email discussion. I'm very glad someone else says this too, so I don't appear as the only person who feels this way :-)
Thank you, David and Yoshifugi, for your feedback. Please accept my apologies for my late response.
I am having difficulties in digesting the counterarguments against the kernel based approach because of the lack of detailed reasoning and ambiguities. Yes, MIP6 and IKE signalling is handled in the userspace, but the same is not true for SCTP (lksctp). At the same time, Linux is a monolithic kernel instead of microkernel architecture. Finally, good engineering practise is to put everything in the userspace, unless there is good reason for putting it in to the kernelspace.
We don't currently have concrete measurements (comparing userspace and kernelspace approaches) to justify our kernel oriented approach, so we will have to get back to you later with some figures. If the results show that an userspace implementation is superior to a kernel based approach in terms of security or performance, we may have rewrite the code to the userspace. In the mean time, do you happen to know any good references where any userspace network protocol implementation has been compared and measured against a kernelspace implementation? It would be a good starting point for us.
I would like to mention that lksctp was implemented in the 2.6 kernel because of better performance and tighter integration to the socket API. We are dealing with similar issues with HIPL but seems like we need to justify the reasons by analyzing and measuring. In addition, security issues (DoS protection, user supplied public keys, etc) are taken pretty seriously in HIP and may benefit from a kernel oriented approach.
Signature · 1 line
Miika Komu [email protected] http://www.iki.fi/miika/
David S. Miller
maintainerQuoted 2 lines · On Tue, 22 Mar 2005 16:08:31 +0200 (EET) Miika Komu <[email protected]> wrote:
Yes, MIP6 and IKE signalling is handled in the userspace, but the same is not true for SCTP (lksctp).
SCTP is a network protocol used for data transfer.
HIP is a signalling mechanism used to setup configuration.
Quoted 22 lines
engineering practise is to put everything in the userspace, unless there is good reason for putting it in to the kernelspace.
We don't currently have concrete measurements (comparing userspace and kernelspace approaches) to justify our kernel oriented approach, so we will have to get back to you later with some figures. If the results show that an userspace implementation is superior to a kernel based approach in terms of security or performance, we may have rewrite the code to the userspace. In the mean time, do you happen to know any good references where any userspace network protocol implementation has been compared and measured against a kernelspace implementation? It would be a good starting point for us.
I would like to mention that lksctp was implemented in the 2.6 kernel because of better performance and tighter integration to the socket API. We are dealing with similar issues with HIPL but seems like we need to justify the reasons by analyzing and measuring. In addition, security issues (DoS protection, user supplied public keys, etc) are taken pretty seriously in HIP and may benefit from a kernel oriented approach.
Signature · 1 line
Miika Komu [email protected] http://www.iki.fi/miika/
In article <[email protected]> (at Tue, 22 Mar 2005 16:08:31 +0200 (EET)), Miika Komu <[email protected]> says:
Quoted 3 lines
will have to get back to you later with some figures. If the results show that an userspace implementation is superior to a kernel based approach in terms of security or performance, we may have rewrite the code to the
And, IMHO, the most important argument is, probably, in terms of simplicity and universality of kernel part.
e.g. MIP6 uses XFRM / stackable destination architecture as its fundamental infrastructure.
They (simplicity and universality) are unlikely measurable, though.
Quoted 3 lines
justify the reasons by analyzing and measuring. In addition, security issues (DoS protection, user supplied public keys, etc) are taken pretty seriously in HIP and may benefit from a kernel oriented approach.
I belive that we can find solutions to solve these issues (if any).
--yoshfuji