Slashdot Mirror
Crypto and IPSec Merged into 2.5
Corbet writes "Linus has just merged the new crypto API and IPSec implementation into his 2.5 BitKeeper tree. This is the first time that serious cryptographic code has made an appearance in the mainline kernel, and it will hopefully lead to more secure communications for all Linux users in the future."
I really like the way the 2.5 kernel is progressing, a lot of the patches that I've been applying manually to the 2.4 tree have already been merged into the main tree of the 2.5 kernel.
:)
Can't wait until release, this thing is going to rock.
Why would superior theft abilities become part of kernel-proper?
Oh, you said crypto!
Department of Physics and Atmospheric Science, Dalhousie University, Halifax, N.S., Canada, B3H 3J5
Jon.
What the fuck do you Lunix dorks need to speak securely to each other about? How to pick up chicks? HAHahhaaha....
Did I get it?
how does exportation work with this? i thought people weren't allowed to export code w/ serious type crypto in it.
IPsec has no support for IPv6.. what now?
now theres finally a unix for pc that has ipsec and crypto builtin!!! what i would i do.. whats that? freebsd you say? holyyyyy shit
It isn't secure now?
oh yeah, mod me down for asking a question
One more crippling bombshell hit the already beleaguered Linux community when IDC confirmed that Linux market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that Linux has lost more market share, this news serves to reinforce what we've known all along. Linux is collapsing in complete disarray, as fittingly exemplified by failing dead last [samag.com] [samag.com] in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin [amdest.com] [amdest.com] to predict Linux's future. The hand writing is on the wall: Linux faces a bleak future. In fact there won't be any future at all for Linux because Linux is dying. Things are looking very bad for Linux. As many of us are already aware, Linux continues to lose market share. Red ink flows like a river of blood.
Debian Linux is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time Debian Linux developers Ian and Deb only serve to underscore the point more clearly. There can no longer be any doubt: Debian Linux is dying.
Let's keep to the facts and look at the numbers.
SuSe leader Theo states that there are 7000 users of SuSe. How many users of Slackware are there? Let's see. The number of SuSe versus Slackware posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 Slackware users. GNU/Linux posts on Usenet are about half of the volume of Slackware posts. Therefore there are about 700 users of GNU/Linux. A recent article put Red Hat Linux at about 80 percent of the Linux market. Therefore there are (7000+1400+700)*4 = 36400 Red Hat Linux users. This is consistent with the number of Red Hat Linux Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, Red Hat Linux went out of business and was taken over by Mandrake who sell another troubled OS. Now Mandrake is also dead, its corpse turned over to yet another charnel house.
All major surveys show that Linux has steadily declined in market share. Linux is very sick and its long term survival prospects are very dim. If Linux is to survive at all it will be among OS dilettante dabblers. Linux continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Linux is dead.
Fact: Linux is Dying
Too bad that full ipsec, such as provided by
Freeswan is still not in the kernel. I find it a
bit sad that Dave Miller and John Gilmore can't
figure out a proper way to resolve their problem
(John wants no US hands on the code, Dave wants
no code he can't touch in the kernel)
But at least the beginning is there, and if the
USAGI ipsec gets in, it should learn to talk to the userland tools, such as Freeswan, because Freeswan has extra features that "stock ipsec" doesn't have, such as Opportunistic Encryption.
Cambridge, MA -- At a gathering of top kernel developers for the GNU/Linux set of operating system utilities early yesterday morning, it was unanimously decided that a special task force of graduate students would be appointed to convert the kernel to a more mainstream and powerful language, PHP.
While Eric Raymond and Richard Stallman argued amongst one another for a short several hours, Linus Torvalds and Alan Cox ceremoniously converted the first line of code over to the new, more powerful language.
Department of Physics and Atmospheric Science, Dalhousie University, Halifax, N.S., Canada, B3H 3J5
This is great that these things are comming as standard in the kernel, but so many things are "standard" now its getting pretty large for joe-schmo average user who will get a full kitchen sink kernel with their distro.
This is also great for creating products like VPN gateways et al, but is it time to consider a different structure for kernel builds, with modules being seperately managed with a smarter installation procedure.
An Eye for an Eye will make the whole world blind - Gandhi
- AIX is dying.
- AmigaOS is dying.
- BSD is dying.
- BeOS is dying.
- CPM is dying.
- DOS is dying.
- FreeBSD is dying.
- GNU Hurd is dying.
- HP-UX is dying.
- IRIX is dying.
- Inferno is dying.
- Linux is dying.
- LynxOS is dying.
- MINIX is dying.
- MacOS is dying.
- Mach is dying.
- MicroC/OS is dying.
- NachOS is dying.
- NeXT is dying.
- Nemesis is dying.
- NetBSD is dying.
- NetWare is dying.
- OS-400 is dying.
- OS-9 is dying.
- OS/2 is dying.
- Oberon is dying.
- OpenBSD is dying.
- Palm OS is dying.
- Plan 9 is dying.
- pSOS is dying.
- QNX is dying.
- RTEMS is dying.
- SCO is dying.
- Solaris is dying.
- SunOS is dying.
- TRON is dying.
- ThreadX is dying.
- TinyOS is dying.
- Unix is dying.
- VMS is dying.
- VxWorks is dying.
- Windows 2000 is dying.
- Windows 3.11 is dying.
- Windows 95 is dying.
- Windows 98 is dying.
- Windows CE is dying.
- Windows ME is dying.
- Windows NT is dying.
- Windows XP is dying.
The Free On-Line Dictionary of Computing defines an operating system as: "The low-level software which handles the interface to peripheral hardware, schedules tasks, allocates storage, and presents a default interface to the user when no application program is running. The OS may be split into a kernel which is always present and various system programs which use facilities provided by the kernel to perform higher-level house-keeping tasks, often acting as servers in a client-server relationship. Some would include a graphical user interface and window system as part of the OS, others would not."The operating system loader, BIOS, or other firmware required at boot time or when installing the operating system would generally not be considered part of the operating system, though this distinction is unclear in the case of a rommable operating system such as RISC OS. The facilities an operating system provides and its general design philosophy exert an extremely strong influence on programming style and on the technical cultures that grow up around the machines on which it runs.
The comp.os.research FAQ makes the following distinction between micro- and macrokernels:
"A recurrent topic of discussion in this newsgroup has been the comparison between microkernel (for example Mach and QNX) and `macrokernel' (traditional Unix) operating systems. The basic notion of a microkernel consists of devolving as much functionality as possible into processes rather than the kernel itself; different systems take different approaches to implementing this.
For example, some systems (such as Mach) leave device drivers in the kernel, and place higher-level services (such as file systems) outside; others (such as QNX) move device drivers outside of the kernel.
However, anecdotal evidence [93-03-03-07-56.52] suggests that the distinction between microkernel and monolithic architectures is becoming more blurred as time goes on, as the two advance. For example, most modern monolithic kernels now implement multiple threads of execution and fine-grained parallelism. Architecturally, this approach begins to appear similar to a microkernel with several kernel-space processes working from shared memory.
As an aside, people often complain that the Mach system can't be a `real' microkernel, because it is so large (at least, this is the argument most frequently cited). However, I have been told that automatically-generated code stubs contribute very significantly to the size of the kernel, and that some size reduction would be likely if MIG (the stub generator) produced better code. [Can someone from CMU comment on this?] As mentioned above, the leaving of device drivers in the kernel also contributes to Mach's size.
Debating microkernels versus monolithic kernels on the basis of kernel size misses the central, architectural point. In the same way as the point of a RISC processor is not to minimise the instruction count, but rather to make a different tradeoff between what is implemented in the processor instruction set and what is implemented in other ways, the microkernel architectural issue is to determine which services are implemented in the microkernel, and which services are implemented external to that microkernel. By making appropriate choices here, the goal is to enhance various OS attributes in a manner that might not be addressable with a monolithic kernel OS. System attributes such as performance, flexibility, realtime, etc. are all variables which are taken into account.
I'll stick with FreeBSD thanks. And then there's OpenBSD and NetBSD for fully implemented IPSec and IPv6.
FreeSWAN barely talks to anything but itself, yet I can get FreeBSD's IPSec to talk to Cisco routers and do other things. Other things that are well-documented too, and there are no physical tussles over the code and where it goes.
For FreeBSD, I add IPSEC, IPSEC_DEBUG, and IPSEC_ESP to the kernel, recompile and install the kernel, and I'm ready to go. Adding IPv6 support is equally simple.
Plus, most of the applications that I use (mail, irc, ssh, etc...) already use both tcp4 and tcp6 sockets.
You linux guys are still lagging (IMO) with IPSec.
Whatever.
countries with harsh import/export restrictions on crypto code? What will the impacts on
developers and users in those places be?
If not, can our government do something about it? I remember that during the cold war we successfully prevented our high grade crypto getting into the hands of the warsaw pact. Could we do the same thing now?
I only found this out recently, but the freeswan.org site lags behind the actual development of freeswan quite a lot. A nice friendly guy runs freeswan.ca, and keeps it chockablock with all the latest patches and stuff.
I've mirrored the downloads as they're so useful.
Get your own free personal location tracker
In my experience, Windows 2000's support for IPSec is one reason why it has snared a foothold in many businesses. Having IPSec in mainstream Linux distributions would let us cut Bill off at the pass.
I hope we're not far from seeing adoption of Linux in places like the financial services industry. If the distributors can make IPSec painless to configure, Linux will make inroads in such industries very quickly.
"I am root. Bow before me." To this I say, "You are root, and you bear the sins of the world upon your shoulders."
So other than ease of installation, what advantages are there to building this in the kernel?
I'm sure I'm dense but I don't understand.
and leave the comedy to the experts
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
PHP is moving to Linux!
Oh man...
First ICQ and AIM merge.
Then Crypto and IPSec merge.
Next you're gonna tell me that cats and dogs have merged.
What's the world coming to?
"It's a tarp!" -- Dyslexic Admiral Ackbar
Does this create any export ramifications since Linus ( and i assume the code he reviews/packages )is now located here in the states?
Just curious.. i know how hard of a time everyone else ( like BSD ) has with this garbage.
Information should never be restricted on the basis of governmental boundries. Phfft.
---- Booth was a patriot ----
I can't believe how badly you suck at trolling.
They're arrogant and have a "RTFM, idiot" attitude. Read the mailing lists...
so we can't sell encryption to our enemies, but giving it to them is fine? ;)
This comment was generated by a squadron of trained super elite albino ninja chickens for you.
Imagine if some legislator somewhere decided that this new crypto API (though it's for legitimate reasons) is somehow to be classified as a munitions and thus is a crime to export to other countries. He circulates a letter which his trusting co-legislators sign blindly. A week after its passing Linus gets locked up for anti-American activities. Alan Cox gets shipped to Guantanamo. Somewhere in Redmond a bowl-cut, bespectacled man cackles gleefully.
Exporting Stephen Hawking requires a lot more effort!
Anyone know if this will support VPN's using IPSEC wjhere either peer may be behind 1 or more firewalls? Right now, this has become an issue for a project I'm working on, and we're havin all sorts of issues. Thanks
So, by the time we hit 2.6 this will be a 100M download?
i remember seeing that osx provided IPSEC since 10.1 or 10.2, so they beat linux.
Anyone know how the osx IPSEC compares to whats going into 2.5?
-- -- --
Help my mini cause: My journal
The only reason I can think of why you want this, is when you have a dynamic IP address and you want to use a Preshared key. Get a fixed IP or start using X.509 certs.
Aggressive Mode exposes some information, plus it might make DDoS easier to do.
-------
Warning: Slashdot may contain traces of nuts.
Ive been using Freeswan for the last few months (1.98b) + quite a few patches (found them at www.freeswan.ca ) to get the results I need. How does this factor in to this equation? Is this a stupid-simple implementation that will also need lots of patches to be able to do what I need it to do (ie x509 certs, NAT transversal, DHCP over VPN) ?
The ultimate network admin tool needs HELP!
One man's bloat is another man's features.
Hypothetical: I can't believe OpenOffice is so bloated compared to EDLIN from MS-DOS!
Maybe it's "feature loaded" instead of bloated? While it is true that you can use OpenOffice to duplicate tasks that you might have done in EDLIN, it is capable of so much more.
There is another kind of bloat which is not caused by features. This kind of bloat does not appear to be present in Linux. The kind of bloat I'm talking about is caused by "optimization". I don't mean optimizing for fast code or small code, but optimizing for "release date". Hey Mr. Customer, would take that new spreadsheet upgrade six months sooner if it required 25% more computing resources to run? All consumers I know would answer Yes. So this is a type of optimization. Optimizing for development time instead of optimizing for computer resources. Given the current low and decreasing cost of computer resources, there is some balance of this that makes sense. Just as once upon a time the "bloat" and value of high level programming languages was hugely debated. Now everyone uses high level languages to optimize for development time. The fact that I could spend six extra months doing it smaller and faster in assembler doesn't matter. Well, today it's the same thing. I don't mean that bad code is written on purpose, just that development time is valued above comptuer resources and machine optimizations, profiling, etc. Again, Linux does not appear to "suffer" from this type of "optimization".
Another type of bloat is just from plain bad programming. It was not a purposeful decision to optimize development time, it was just the the program is badly written. Linux does not appear to suffer from this kind of bloat either.
I'll see your senator, and I'll raise you two judges.
Linus has yet to post a message to linux-kernel since his return, but he continues to merge patches at a high rate.
What's cool about this is that people are watching kernel development without having to read the lkml or being on irc or whatever. People can now just watch the patches flow into the bk system. I think that's kind of cool. It's like a Kernel News Network.
www.rdex.net
I run solaris at my office, and i need binaries damn it.
for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
Wouldn't this run afoul of many of the U.S. Cryptography export regulations? U.S. DoD prohibits exporting of any product containing mathematically "strong" cryptography (usually, 128-bit) to a lot of places.
That, and the DMCA which prohibits reversing of any of the encryption that would be found in the new kernel, would create a risk for many of the users downloading the software if they were from anywhere outside the US (and, for US users downloading the software, because it couldn't be explained to them.)
I'm sure the U.S. government is going to have a lot of fun with this...
There are no such things as fundamental rights. nowhere, never. Have a nice day.:{)||
If only the people who got those Perl RSA tattoos could have known...
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
Or the banning of Linux in several countries. Whichever comes first, you know.
Maybe the state's highest function is to grind out insoluble problems. (Zelazny, Hall of Mirrors)
Linus has just merged the new crypto API and IPSec implementation into his 2.5 BitKeeper tree.
Since the new EULA says Linux users can't use the word "BitKeeper" in a public conversation unless they've paid Larry McVoy $19.95 (to pay his employees and to feed his family, you know), I hope you will be prepared to pull this article on demand.. or pay up!
My un-favorite types of Bloat: :{)||
- In Apps, Games, whatever, it would be a lot nicer to be able to add features, rather than have the whole bloated thing copied/downloaded/installed onto your drive. (Cygwin has a nice setup.exe program that actually lets the user *pick* what he wants *before* the download. Very nice.)
- Programs that say "Standby while we figure out what system you are running" and then copy every bloated driver for every type system, and its various peripherals, that ever existed onto your hard drive, anyway. Maybe this is not a problem anymore with the huge disks that exists these days, but it does signify sloppy development work that is usually mirrored in the app.
Something that OpenBSD has had for years!
I am not very knowledgeable about security issues, but I am curious if the inclusion of security modules in the kernel will provide for a single point of failure. In other words, as more programs become dependent on the kernel module for security, if an exploit becomes available, will all these dependent programs become exploitable?
I ask this specifically because of the problem the IE ran into, where it depended on security APIs from Windows, the Windows API had an exploitable bug, and ta-da, IE had an exploitable bug.First Falcon-1 to orbit, then Falcon-9. Then I can die a happy man.
It couldn't be Linus Van Pelt...hmmm..who else might it be?
Oh yeah, that Linus. What, he's like Prince and Madonna now, only needs one name?
It should satisfy most users wanting a static secure VPN, and it is not nearly as bloated as frees/wan. http://ringstrom.mine.nu
Why da heck are not those two included?
The verb form of Exportation is of course Exportationize. This leads to the new java construct:
importationize javax.swing.*;
My amazing wife - Artist, Author, Philosopher - Laurie M
"Microsoft announced that Windows 2000 has passed all required tests for certification under the Common Criteria (CC) at Evaluated Assurance Level 4 (EAL4) to demonstrate their 'commitment to security'... Where was Linux(TM) when Microsoft dropped this bombshell? Linux(TM) was nowhere to be found. There was no one from Red Hat, no one from Mandrakesoft (makers of Mandrake Linux), and no one from SuSE. Linus wasn't there. Not even the self-appointed patron saint of open source, Richard Stallman, bothered to show up.
Oh Linux(TM), oh Linux(TM). Where art thou, Linux(TM)? Why dist thou not showst up?"
I agree. Bush bashing is Bush league. Shrubbery for President; it isn't capable of understanding the issues, either. See the new movie, Bowling for Columbine. Many people think there is no need to try to understand when you live in a country that can bomb people.
Who gives a fat fuck? Linux is dying.
The cryptoAPI is the real kicker here folks.
/dev/random will no longer us its own crypto librtaries (SHA-1). IPSec will not use its own crypto (well, freeswan will because they feel there's value there).
.so's can have their digital signature verified before execution), and other majic stuff.
Once cryptoAPI is in the kernel,
CryptoAPI will also permit people to have encrypted filesystems, swap partitions, even BOOT partitions.
Present applications include: eliminate duplicated code, harmonize/facilitate crypto in the kernel, encrypted file systems, swap paritions, cdroms, etc., "turnkey" ipsec
Later applications include: load-time code-signing (that is all binaries and
JLC
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The two big interoperability problems for FreeS/WAN have been explicit non-support for Aggressive Mode (they don't support it, mainly because there are security problems that affect the general user that don't affect most commercial applications), and lack of support for various proprietary authentication systems (not that I've been thrilled with their Opportunistic Encryption work, since the versions I've seen assume levels of control over reverse DNS space that most people don't have.)
Their concerns for user-friendliness have been legendary ("First recompile your Linux kernel cleanly, then you can start to install the IPSEC stuff...." :-) It's not the same goals as other parts of the IPSEC vendor community ("First find the end of the brown wire with the two little prong-thingies and plug it into the electric socket in the wall. See Figure 37 if this is difficult for you.") Not surprising, because while they really do want everybody in the world to be able to communicate securely, they also had a lot of research to do on how to make things work well, and the world around them that they've had to support has been changing rapidly while they were working - it's been a lot like changing the tires on a moving truck, while your users are rebuilding the truck and other people are rebuilding the road or inventing chemistry for vulcanizing rubber. If it's not always obvious why their work has been so critically important and valuable, well, it has been anyway.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks