Subject: [hiprg] HIP experiment report comment on opportunistic mode

From: "Henderson, Thomas R" <[email-masked]>
Date: Tue, 6 Dec 2011 00:01:24 -0800

I would like to respond to one of Stephen Farrell's comment on the HIP experiment report:

http://datatracker.ietf.org/doc/draft-irtf-hip-experiment/ballot/

The comment is:

" - I wondered what were the "controversial experiences" on p10. Seems
a shame to tease the reader like that."

The relevant section of text is:

   In the context of the HIPL project, the opportunistic mode has been
   successfully applied at the HIP layer for service registration
   [RFC5203].  However, there are controversial experiences on applying
   opportunistic mode at the application layer for legacy software.
   HIP4BSD implemented opportunistic mode successfully with small
   modifications to the FreeBSD socket layer to support opportunistic
   mode.

Could someone elaborate on the controversial experience (and perhaps provide a reference)?  Note that elsewhere in the report (section 2.3.2), the disadvantages and "leap of faith" aspects of opportunistic mode are elaborated on, so I'm wondering whether the reference to controversial experiences goes beyond the disadvantages already listed in section 2.3.2 (or whether we could instead strike those words from the draft and refer back to that section).

- Tom

---

From: Tobias Heer <[email-masked]>
Date: Tue, 06 Dec 2011 09:21:17 +0100

Hi,

> Could someone elaborate on the controversial experience (and perhaps provide a reference)?  Note that elsewhere in the report (section 2.3.2), the disadvantages and "leap of faith" aspects of oppor…
As far as I can tell, we in Aachen have not used the opportunistic mode extensively. Miika seemed to have used it/struggled with it quite a bit. Maybe he has some comments on this.

BR, Tobias

> - Tom
> 
> _______________________________________________
> hiprg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hiprg

-- 
Dipl.-Inform. Tobias Heer, Ph.D. Student
Chair of Communication and Distributed Systems - comsys
RWTH Aachen University, Germany
tel: +49 241 80 207 76
web: http://www.comsys.rwth-aachen.de/team/tobias-heer/
blog: http://dtobi.wordpress.com/
card: http://card.ly/dtobi
pgp id: AEECA5BF

---

From: Miika Komu <[email-masked]>
Date: Tue, 06 Dec 2011 17:08:41 +0200

Hi,

On 12/06/2011 10:21 AM, Tobias Heer wrote:
>> " - I wondered what were the "controversial experiences" on p10.
>> Seems a shame to tease the reader like that."
>>
>> In the context of the HIPL project, the opportunistic mode has
>> been successfully applied at the HIP layer for service
>> registration [RFC5203].  However, there are controversial
>> experiences on applying opportunistic mode at the application layer
>> for legacy software. HIP4BSD implemented opportunistic mode
>> successfully with small modifications to the FreeBSD socket layer
>> to support opportunistic mode.
>>
>> Could someone elaborate on the controversial experience (and
>> perhaps provide a reference)?  Note that elsewhere in the report
>> (section 2.3.2), the disadvantages and "leap of faith" aspects of
>> opportunistic mode are elaborated on, so I'm wondering whether the
>> reference to controversial experiences goes beyond the
>> disadvantages already listed in section 2.3.2 (or whether we could
>> instead strike those words from the draft and refer back to that
>> section).
>>
> As far as I can tell, we in Aachen have not used the opportunistic
> mode extensively. Miika seemed to have used it/struggled with it
> quite a bit. Maybe he has some comments on this.

we implemented opportunistic HIP mode at two different levels in Linux:

i. As an intercepting SHIM library between the application and the libc 
socket calls implementations using LD_PRELOAD
ii. As an intercepting SHIM layer between transport and network layers 
using iptables

While the implementation was a success, it was not far from ready for 
production use and we decided to remove the data plane part from the 
implementation. However, the control planet part (opportunistic base 
exchange) is still left and can be used e.g. for registering for rendezvous.

So I guess the "controversial" means perhaps that the data plane 
processing was more difficult to implement on Linux than on BSD, I 
suggest rewriting something along these lines or just referencing the 
paper for details (you have the reference already in the draft).

Btw, I would appreciate if you could reference also the following paper 
in the report:

Kristiina Karvonen, Miika Komu and Andrei Gurtov, Usable Security 
Management with Host Identity Protocol, published in The 7th ACS/IEEE 
International Conference on Computer Systems and Applications (AICCSA-2009)

It supplements opportunistic and normal HIP experiments with usability 
test results. We also report experiences from using a graphical end-host 
firewall. I would kindly ask a reference, e.g., to section 2.3.2:

"...or by prompting the user using a graphical interface to explicitly 
accept the connection [REF]."

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Thu, 8 Dec 2011 21:35:22 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Miika Komu
> Sent: Tuesday, December 06, 2011 7:09 AM
> To: [email-masked]
> Subject: Re: [hiprg] HIP experiment report comment on opportunistic
> mode
> 
> Hi,
> 

OK, I will delete the sentence mentioning controversy, and add a sentence at the end of the paragraph that states:  "However, the Linux implementation was more challenging as described below."  The following two paragraphs already go into the details.

> accept the connection [REF]."

Thanks, I was not aware of this interesting paper.  Will be added to the -15 draft.

- Tom