From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 In-Reply-To: <9511f83e0903241600v21f4681bj846bbb6e8f69cc31@mail.gmail.com> References: <9511f83e0903241211j711f29c7y8085d9a8744d9a87@mail.gmail.com> <9ab217670903241245o1893f818vb01ae7e30ab4d8cf@mail.gmail.com> <9511f83e0903241305p6ea4a0c5k582582e87443577d@mail.gmail.com> <20090324213537.268005B05@mail.bitblocks.com> <9511f83e0903241600v21f4681bj846bbb6e8f69cc31@mail.gmail.com> Date: Wed, 25 Mar 2009 09:00:58 -0400 Message-ID: <9ab217670903250600h48d64c13t9276e42c07a9a222@mail.gmail.com> From: "Devon H. O'Dell" To: Fans of the OS Plan 9 from Bell Labs <9fans@9fans.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [9fans] Plan 9 on Routers? Topicbox-Message-UUID: c42e4eb4-ead4-11e9-9d60-3106f5b1d025 2009/3/24 Rahul Murmuria : > @ Devon: > About Packet Classification. I read that iptables is not needed on > Plan 9 because its "mount /net over the network" concept achieved > anonymity or transparency -- something along those lines. "There are > no logs about who is sending what, and that is a good thing". This is a flawed argument. If using Plan 9 as an edge router instead of a bridge, it's imperative to have some sort of filtering. This doesn't just apply to NAT situations (and even then, mounting /net isn't really the same thing as NAT). There is ipmux, but as Eric says, it's not fleshed out enough to implement NAT. Eric also says: ``as long as you restrict your network to plan 9 machines, it is possible to import /net from a gateway machine and avoid sticky things like packet filtering.'' This is a good idea in theory, but in practice most machines are not Plan 9 and there's almost always a need for a heterogeneous environment. Some would solve this by porting the ability to `import /net' to other operating systems. My feeling has always been that some sort of packet filtration system should exist to make Plan 9 useful in routing in such heterogeneous networks. It's easier to do and would facilitate wider adoption (whether that's a good thing or not is always up for debate). > I am not sure where exactly the packet classification idea fits in. I > read in the /proc documents that /proc/net provides useful information > about the network stack. There is this ip_conntrack which is used to > list / track network connections. I wonder what we would need to get > packet information and perform filtering. Is it desirable to get that > filtering to work if it already does not exist? I believe I have a rudimentary and probably non-working (at this point) packet filter in /n/sources/contrib/dho somewhere (it was written at least 4 years ago). I think it's called ``nfil.'' I believe it is desirable. Others disagree. Its usefulness is related directly to its application, and without it, there's no way to test Plan 9 in an environment in which it would be useful. You said earlier ``I qualify for GSoC but I was planning not to apply, as from where I see it, that brings in restrictions to the independence of thought. I am open to applying though, if this is a good enough (and small enough) idea for SoC.'' -- I'm not sure why you think that the idea of the SoC project restricts independence of thought -- I've certainly never seen it as such. While creating an entire routing suite (such as Zebra/Quagga) is probably outside of the scope of a 3 month project, I think a diligent student could probably do something useful with OSPF or BGP. It's entirely possible that a 3 month project could consist of analyzing Plan 9's ability to function in this environment and making changes to facilitate the implementation of routing protocols. Or creating a packet filter. In either case, I'd personally be excited to see this suggested as a SoC project if it was well thought out. I've wanted to work with somebody on Plan 9 as a routing device in networks for some time, at least in the field of packet classification. > Thank you all for replying so far! No problem :) --dho > -- > Rahul Murmuria > >