HIP-WG meeting, IETF62 Using HI P with Legacy Applications - PowerPoint PPT Presentation

HIP-WG meeting, IETF62 Using HI P with Legacy Applications (draft-henderson-hip-applications-00.txt) March 9, 2005 Tom Henderson 1 HIP working group

Draft scope • Intended to replace the Appendix A of the base specification • Should not be required for HIP interoperability • Does not cover HIP-aware applications and API – assumes that applications are not recompiled for HIP • Eventually intended to be suitable for an Informational RFC 2 HIP working group

Architecture and terminology Referral: When an application passes what it assumes to be an IP address to another application on another host (e.g., FTP PORT command) HIP daemon Legacy application resolver user space PF_INET PF_KEY PF_RAW kernel transport HIP BEET ESP SPDB DNS IP layer HIP SADB 3 HIP working group

Possibilities How does application or user cause HIP to be invoked? 1. Applications use IP addresses 2. Applications use DNS names 3. Applications use IP address-sized HITs or LSIs 4 HIP working group

1. I P address HIP daemon Legacy application • Manually configure user space address-to-HIT binding PF_INET PF_KEY PF_RAW kernel transport • Opportunistically HIP BEET ESP SPDB (don’t care about peer HIT) IP layer IP address used HIP SADB • Use reverse+forward here, but HIP used DNS lookup by system Pros: Naturally supports application-level referrals Cons: May have weaker security properties than use of HITs (depends on several factors); may be cumbersome (manual configuration) 5 HIP working group

2. DNS hooks LSI/HIT returned HIP daemon Legacy application by resolver resolver user space PF_INET PF_KEY PF_RAW kernel transport HIP BEET ESP System caches SPDB DNS LSI to address IP layer HIP binding SADB Options: 1. Have resolver return LSIs (HITs) instead of IP addresses 2. Use HIP-suffix in FQDN (e.g., www.ietf.org.hip) 6 HIP working group

DNS issues • Should we spoof IP addresses in resolver calls? • Referrals – Non-routable LSIs do not support referrals – Routable LSIs may work, but may require infrastructure support • When should system garbage-collect the LSI to address bindings? 7 HIP working group

3. Connecting to HI Ts directly HIP daemon Legacy application user space PF_INET PF_KEY PF_RAW HIT kernel transport resolution? HIP BEET ESP connect(HIT) SPDB or sendto(HIT) IP layer HIP SADB Pros: Most direct and secure naming semantics Cons: Application-level referrals; HIT-to-address resolution; distinguishing between HIT and IPv6 address 8 HIP working group

Next steps • Pekka provided initial security section • Suggest to move LSI material from base specification to this draft 9 HIP working group