Subject: [Hipsec] HIP ja loopback

From: Miika Komu <[email-masked]>
Date: Wed, 21 Feb 2007 10:52:00 +0200 (EET)

Hi all,

I think the base draft (and neither the mm draft) does not mention the use 
of loopback. By loopback I mean that the host is connecting to itself. The 
state machine simply does not work with loopback:

   * Host sends I1 to itself and goes to I1_SENT
   * With luck the host accepts the I1; the host used different src and dst
     HITs, and the dst HIT of I1 was bigger than the src HIT. It is not
     really defined what to do when the HITs are the same... anyway, let's
     assume that the host sent an R1.
   * Host receives the R1 (still in I1_SENT). Same smaller/bigger than
     issues as earlier. With luck, the host sends I2 and goes to I2-SENT.
   * Receive I2. Same smaller/bigger than issues as before. With luck,
     host sends R2 and goes to R2-SENT.
   * Receive R2: Drop and stay at R2-SENT.
   * Exchange Complete Timeout: Move to ESTABLISHED

Certainly there is room for improvement with loopback. I'd suggest that the 
draft either excludes it explicitly or contains a modified version of the 
state machine.

-- 
Miika Komu                                       http://www.iki.fi/miika/

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: Pekka Nikander <[email-masked]>
Date: Wed, 21 Feb 2007 11:10:09 +0200

> I think the base draft (and neither the mm draft) does not mention  
> the use of loopback.

Simple question: Why would one like to use HIP on a loopback?  For  
testing purposes?  Maybe.  For anything else?  I cannot see a  
reason.  IMHO, if a process connects to the same host through a local  
HIT, it should result in a simple TCP connection / UDP packet,  
without HIP, since I cannot see how HIP would bring there any benefit.

Virtual hosts are an interesting issue, though, but I don't see there  
any fundamental difference; they shouldn't use the loopback anyway.

--Pekka

---

From: Miika Komu <[email-masked]>
Date: Wed, 21 Feb 2007 11:54:17 +0200 (EET)

On Wed, 21 Feb 2007, Pekka Nikander wrote:

>> of loopback.
> Simple question: Why would one like to use HIP on a loopback?

One reason is that sometimes services can be local. Connecting to a local 
vs. remote service should not be any different from the user or 
application viewpoint.

> For testing purposes?  Maybe.  For anything else?  I cannot see a 
> HIT, it should result in a simple TCP connection / UDP packet, without 
> HIP, since I cannot see how HIP would bring there any benefit.

I think using plain TCP or UDP for loopback in production environments 
would be the best choice but I don't see any text about this in the draft. 
Or maybe I just missed it.

---

From: Pekka Nikander <[email-masked]>
Date: Wed, 21 Feb 2007 12:21:52 +0200

>>> I think the base draft (and neither the mm draft) does not  
>>> mention the use of loopback.
>>
> One reason is that sometimes services can be local. Connecting to a  
> local vs. remote service should not be any different from the user  
> or application viewpoint.
>
>> reason.  IMHO, if a process connects to the same host through a  
>> local HIT, it should result in a simple TCP connection / UDP  
>> packet, without HIP, since I cannot see how HIP would bring there  
>> any benefit.
>
> I think using plain TCP or UDP for loopback in production  
> environments would be the best choice but I don't see any text  
> about this in the draft. Or maybe I just missed it.

Right.  But that is an issue which is local to the implementation and  
transparent to the apps.  Hence, I don't see any need to specify it;  
different implementations can do it in different ways.

--Pekka

---

From: Miika Komu <[email-masked]>
Date: Wed, 21 Feb 2007 12:24:20 +0200 (EET)

On Wed, 21 Feb 2007, Pekka Nikander wrote:

>>>> I think the base draft (and neither the mm draft) does not mention the 
>>>> use of loopback.
>>> 
>> vs. remote service should not be any different from the user or application 
>> viewpoint.
>> 
>>> For testing purposes?  Maybe.  For anything else?  I cannot see a reason. 
>>> IMHO, if a process connects to the same host through a local HIT, it 
>>> should result in a simple TCP connection / UDP packet, without HIP, since 
>>> I cannot see how HIP would bring there any benefit.
>> 

Fine.