Subject: [Hipsec] HIs per process/port

From: Robert Moskowitz <[email-masked]>
Date: Wed, 09 Dec 2009 08:38:48 -0500

Is there any push-back in adding support for specifically supporting HIs 
associated with a process and/or port?

This is kind of denied currently, but there is wording in various places 
that hints you can.  I believe at the Stockholm meeting that the 
Ericsson crew said they do support this now.

I don't want to go through the work to add the text and then have people 
coming at me with guns a'blazing.  I mean I DO wear my Kevlar suit, 
but....  ;)

Oh, I did not envision HIP having per process/port policy, but there 
appears to be an interest in this and it is NOT too hard to do, but it 
DOES change the DNS model from a MX-style to a SRV format.

---

From: Miika Komu <[email-masked]>
Date: Wed, 09 Dec 2009 16:08:39 +0200

Robert Moskowitz wrote:

Hi,

I am not sure, but there may be some (semantical?) problems in 
supporting SRV records with the native HIP API. Namely, getaddrinfo() 
does not support SRV records? This does not mean that it's not 
implementable though, it's more like that AF_HIP would just require a 
SRV look up instead of HI RR. This is not a problem for DNS proxies (for 
legacy apps) at all.

> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec

---

From: "Laganier, Julien" <[email-masked]>
Date: Fri, 11 Dec 2009 13:03:36 -0800

Hi Robert -

To me service location based on DNS seems to be orthogonal to the HIP layer. Assuming the DNS service location is in place, e.g., Domain-Based Application Service Location Using SRV RRs and the Dynamic Delegation Discovery Service (DDDS) [RFC3958], it seems we do not need to change anything at the HIP layer. The serving application would only bind() to the service specific HI.

Am I missing something?

--julien 
 
Robert Moskowitz wrote:
> 
> Is there any push-back in adding support for specifically supporting
> HIs associated with a process and/or port?
> 
> This is kind of denied currently, but there is wording in various
> places that hints you can.  I believe at the Stockholm meeting that the

---

From: Miika Komu <[email-masked]>
Date: Sat, 12 Dec 2009 10:10:20 +0200

Laganier, Julien wrote:

Hi,

should this be mentioned in the revised DNS RFC?

---

From: Jan Melen <[email-masked]>
Date: Mon, 14 Dec 2009 10:56:35 +0200

Hi Julien,

This is how it works in our implementation for example but this also means that you have to assign different domain name for each service. To get around this problem I think you need the SRV RR records in order to support HIs per port basis on a single DNS domain name. 

   Regards,
     Jan

---

From: Robert Moskowitz <[email-masked]>
Date: Mon, 14 Dec 2009 16:17:07 -0500

> To me service location based on DNS seems to be orthogonal to the HIP layer. Assuming the DNS service location is in place, e.g., Domain-Based Application Service Location Using SRV RRs and the Dyn…

Somewhere in either 4423 or 5201 are rather 'strong' words that a HI is 
associated with the stack and NOT with processes. I had tagged needing 
to change that, but I CAN'T FIND THE TEXT NOW!!!!! HELP!!! :)

Originally I had no intention of having per process/port HIs, but others 
brought forward the value of it and how it could be done as a local 
policy thing. OK it fits, do it. But it DOES push us from an MX DNS 
model to a SRV DNS model.

DNS is orthogonal to HIP, but we DO present DNS as a mechinism to 
actuate HIP and if you are connecting to a CLOUD resource, you probably 
DO want the process, not the host.

As Jan indicated you CAN do this with different FQDNs for the host. That 
works. But SRV works 'better'?

---

From: "Laganier, Julien" <[email-masked]>
Date: Mon, 14 Dec 2009 13:24:04 -0800

Hi Jan,

Then I see no difference with using different IPs per process/port. You gotta use different domain names unless you rely on SRV and/or NAPTR. Situation is similar with HIP.

--julien

Jan Melen wrote:
> 
> Hi Julien,
> 
> This is how it works in our implementation for example but this also
> means that you have to assign different domain name for each service.
> To get around this problem I think you need the SRV RR records in order
> to support HIs per port basis on a single DNS domain name.
> 
>    Regards,
>      Jan
> 
> > To me service location based on DNS seems to be orthogonal to the HIP
> layer. Assuming the DNS service location is in place, e.g., Domain-
> Based Application Service Location Using SRV RRs and the Dynamic
> Delegation Discovery Service (DDDS) [RFC3958], it seems we do not need
> to change anything at the HIP layer. The serving application would only
> bind() to the service specific HI.
> >
> > Am I missing something?
> >
> > --julien
> >
> > Robert Moskowitz wrote:
> >>