Re: [9fans] Plan 9 on Routers?

["Devon H. O'Dell" <devon.odell@gmail.com>]

2009/3/24 Rahul Murmuria <rahul.is.also@gmail.com>:
> @ Devon:
> About Packet Classification. I read that iptables is not needed on
> Plan 9 because its "mount /net over the network" concept achieved
> anonymity or transparency -- something along those lines. "There are
> no logs about who is sending what, and that is a good thing".

This is a flawed argument. If using Plan 9 as an edge router instead
of a bridge, it's imperative to have some sort of filtering. This
doesn't just apply to NAT situations (and even then, mounting /net
isn't really the same thing as NAT). There is ipmux, but as Eric says,
it's not fleshed out enough to implement NAT.

Eric also says: ``as long as you restrict your network to plan 9
machines, it is possible to import /net from a gateway machine and
avoid sticky things like packet filtering.'' This is a good idea in
theory, but in practice most machines are not Plan 9 and there's
almost always a need for a heterogeneous environment. Some would solve
this by porting the ability to `import /net' to other operating
systems. My feeling has always been that some sort of packet
filtration system should exist to make Plan 9 useful in routing in
such heterogeneous networks. It's easier to do and would facilitate
wider adoption (whether that's a good thing or not is always up for
debate).

> I am not sure where exactly the packet classification idea fits in. I
> read in the /proc documents that /proc/net provides useful information
> about the network stack. There is this ip_conntrack which is used to
> list / track network connections. I wonder what we would need to get
> packet information and perform filtering. Is it desirable to get that
> filtering to work if it already does not exist?

I believe I have a rudimentary and probably non-working (at this
point) packet filter in /n/sources/contrib/dho somewhere (it was
written at least 4 years ago). I think it's called ``nfil.''  I
believe it is desirable. Others disagree. Its usefulness is related
directly to its application, and without it, there's no way to test
Plan 9 in an environment in which it would be useful.

You said earlier ``I qualify for GSoC but I was planning not to apply,
as from where I see it, that brings in restrictions to the
independence of thought. I am open to applying though, if this is a
good enough (and small enough) idea for SoC.'' -- I'm not sure why you
think that the idea of the SoC project restricts independence of
thought -- I've certainly never seen it as such. While creating an
entire routing suite (such as Zebra/Quagga) is probably outside of the
scope of a 3 month project, I think a diligent student could probably
do something useful with OSPF or BGP. It's entirely possible that a 3
month project could consist of analyzing Plan 9's ability to function
in this environment and making changes to facilitate the
implementation of routing protocols. Or creating a packet filter. In
either case, I'd personally be excited to see this suggested as a SoC
project if it was well thought out. I've wanted to work with somebody
on Plan 9 as a routing device in networks for some time, at least in
the field of packet classification.

> Thank you all for replying so far!

No problem :)

--dho

> --
> Rahul Murmuria
>
>