2009/3/24 Rahul Murmuria <rahul.is.a...@gmail.com>: > @ Devon: > About Packet Classification. I read that iptables is not needed on > Plan 9 because its "mount /net over the network" concept achieved > anonymity or transparency -- something along those lines. "There are > no logs about who is sending what, and that is a good thing".
This is a flawed argument. If using Plan 9 as an edge router instead of a bridge, it's imperative to have some sort of filtering. This doesn't just apply to NAT situations (and even then, mounting /net isn't really the same thing as NAT). There is ipmux, but as Eric says, it's not fleshed out enough to implement NAT. Eric also says: ``as long as you restrict your network to plan 9 machines, it is possible to import /net from a gateway machine and avoid sticky things like packet filtering.'' This is a good idea in theory, but in practice most machines are not Plan 9 and there's almost always a need for a heterogeneous environment. Some would solve this by porting the ability to `import /net' to other operating systems. My feeling has always been that some sort of packet filtration system should exist to make Plan 9 useful in routing in such heterogeneous networks. It's easier to do and would facilitate wider adoption (whether that's a good thing or not is always up for debate). > I am not sure where exactly the packet classification idea fits in. I > read in the /proc documents that /proc/net provides useful information > about the network stack. There is this ip_conntrack which is used to > list / track network connections. I wonder what we would need to get > packet information and perform filtering. Is it desirable to get that > filtering to work if it already does not exist? I believe I have a rudimentary and probably non-working (at this point) packet filter in /n/sources/contrib/dho somewhere (it was written at least 4 years ago). I think it's called ``nfil.'' I believe it is desirable. Others disagree. Its usefulness is related directly to its application, and without it, there's no way to test Plan 9 in an environment in which it would be useful. You said earlier ``I qualify for GSoC but I was planning not to apply, as from where I see it, that brings in restrictions to the independence of thought. I am open to applying though, if this is a good enough (and small enough) idea for SoC.'' -- I'm not sure why you think that the idea of the SoC project restricts independence of thought -- I've certainly never seen it as such. While creating an entire routing suite (such as Zebra/Quagga) is probably outside of the scope of a 3 month project, I think a diligent student could probably do something useful with OSPF or BGP. It's entirely possible that a 3 month project could consist of analyzing Plan 9's ability to function in this environment and making changes to facilitate the implementation of routing protocols. Or creating a packet filter. In either case, I'd personally be excited to see this suggested as a SoC project if it was well thought out. I've wanted to work with somebody on Plan 9 as a routing device in networks for some time, at least in the field of packet classification. > Thank you all for replying so far! No problem :) --dho > -- > Rahul Murmuria > >
