← 返回日报
精读 预计 4 分钟

We implemented the IPv8 Internet-Draft in the Linux Kernel, Musl Libc, and BGP

摘要

作者团队没有停留在邮件列表争论，而是把 IPv8 互联网草案（draft-thain-ipv8-02）从头实现了一遍：在 Linux 内核 6.6 中实现 AF_INET8 地址族（28 字节头、64 位路由查找），在 Musl Libc 中支持 in8 地址格式，在 iproute2 和 FRRouting 中加入 ip -8 与 BGP8 支持，并用 Go 写了包含 DHCP8、DNS8、SNTP、OAuth8、WHOIS8、ACL8、XLATE8 等 10 个子协议的 Zone Server，还改了 Nginx 和 cURL 以支持 64 位 IPv8 地址。他们在 10 节点 QEMU 多 AS 测试床上验证：沙盒内 curl 能拿到 HTTP 200，DHCP8 客户端 2.27ms 内完成租约与时钟同步，内核 FIB 在 11.2 万条路由下亚毫秒级查找。但真实世界问题重重：28 字节头导致 1500 字节 MTU 下 TCP 包超长且中间盒静默丢包（需全网络强制 MSS 钳制到 1452 字节）；多宿主场景下严格 uRPF 会误杀合法流量；交换机 ASIC 不认识 EtherType 0x88B8，只能上 CPU 慢路径，吞吐从 400Gbps 掉到 10Gbps 以下；单点 Zone Server 成为 DDoS 靶子。更严重的是经济层面：RIR 按地址量收费的模式崩塌（一个 ASN 换 43 亿地址），二级 IPv4 转让市场归零，ASN 注册会被囤积耗尽，DFZ 路由表膨胀到 300–500 万条迫使骨干网换硬件，RINE 强制免费对等互联摧毁 Tier-1 转接收入。文末附完整研究报告与官方草案链接。

荐读理由

这份实测把 IPv8 草案从内核到 BGP 全栈落地，用 10 节点多自治域网络验证了 28 字节头撑爆 MTU、多归属被 uRPF 静默丢包、交换机 TCAM 不认新 EtherType 等硬伤，能直接帮你判断这类激进协议草案的真实可行性

原文

Show HN: We implemented the IPv8 Internet-Draft in the Linux Kernel, Musl Libc, and BGP

The Hook: Why We Built This

A few weeks ago, an Internet-Draft titled Internet Protocol Version 8 (IPv8) — draft-thain-ipv8-02 caught our eye.

The draft makes some extraordinary claims:

  • Zero Address Exhaustion: Every ASN holder automatically receives 4,294,967,296 host addresses ($2^{32}$).

  • 100% Backward Compatibility: "IPv4 is a proper subset of IPv8... There is no flag day and no forced migration."

  • Total Network Management: Every packet is validated against DNS8 and WHOIS8; all elements are authorized via OAuth2 JWT tokens; and all core services (DHCP, DNS, NTP, Syslog, WHOIS, NAT, ACLs) are bundled into a single "Zone Server".

Most network engineers would laugh this off as an April Fools RFC written by an enterprise architect on buzzword overdrive. But instead of just arguing on mailing lists, the team at goonhost.rocks decided to actually build the entire specification from scratch and test what happens when you deploy it across a distributed multi-AS network.

What We Built (Open Source Repositories)

We implemented the complete IPv8 stack from ring-0 kernel code up to user-space applications:

  1. Linux Kernel 6.6 (GitLab Repo):

  • Implemented native AF_INET8 (address family 46) supporting SOCK_STREAM (TCP8), SOCK_DGRAM (UDP8), and SOCK_RAW (RAW8).

  • 28-byte IPv8 header parsing, 64-bit routing table lookups, and sysctl boundary drop rules (filter_internal_zones, filter_rine, filter_interior_links).

  1. Musl Libc (GitLab Repo):
  • Added sockaddr_in8, inet_pton8, inet_ntop8, getaddrinfo(), and getnameinfo() for 64496.10.0.0.1 format addresses.
  1. iproute2 (GitLab Repo):
  • Native ip -8 route and ip -8 addr management commands.
  1. FRRouting (FRR) (GitLab Repo):
  • BGP8 daemon with Multi-Protocol Extensions (AFI/SAFI) for peering and exchanging IPv8 routes.
  1. IPv8 Zone Server Platform in Go (GitLab Repo):
  • Implemented all 10 RFC sub-protocols: DHCP8 (options 224–230), DNS8 (TYPE_A8 88), SNTP Stratum-1, NetLog8 (UDP 514 telemetry), OAuth8 JWT server, WHOIS8 TCP 43/REST, ACL8, and XLATE8 stateful NAT.
  1. Nginx & cURL (Nginx Repo | cURL Repo):
  • Serving and requesting HTTP over 64-bit IPv8 endpoints (http://64497.20.0.0.254:80/).
  1. 10-Node QEMU Multi-AS Testbed:
  • 4 Autonomous Systems (AS 64496, AS 64497, AS 64498, AS 64499) connected across multicast WAN/LAN segments, loaded with 112,000+ active FIB routes and continuous client traffic generation (trafficgen8).

The Results: The Good, The Bad, and The Catastrophic

The Good (In a Lab Environment)

In an isolated sandbox, the protocol works surprisingly smoothly:

  • curl -i http://64497.20.0.0.254/ returns HTTP/1.1 200 OK from Nginx across an inter-AS WAN mesh.

  • dhcp8c boots on an unconfigured interface, receives a dual-gateway lease (.254 Even / .253 Odd), and syncs its clock via NTP8 in 2.27 ms.

  • The Linux kernel fib_trie handled 112,117 active routes with sub-millisecond lookup latency under continuous traffic.

The Bad: Why It Breaks in the Real World

1. Path MTU (PMTUD) & Silent MSS Blackholing

IPv8 addresses add 4 bytes to source and 4 bytes to destination, expanding the IP header from 20 to 28 bytes.

  • On a standard 1500-byte MTU Ethernet link, standard IPv4 TCP packets (1460-byte payload + 20-byte TCP + 28-byte IPv8 = 1508 bytes) exceed the MTU.

  • Because thousands of legacy middleboxes drop oversized packets without sending ICMP Fragmentation Needed messages, TLS handshakes and large file transfers hang indefinitely.

  • Fix: Every router and host on earth must enforce TCP MSS Clamping to 1452 bytes (or 1432 for 8to4 tunnels).

2. Multi-Homing & Asymmetric uRPF (BCP 38) Drops

In IPv8, your IP address is hard-coded to your primary ASN (64496.10.0.1). If you multihome with two upstream transit providers (Provider A and Provider B) and send outbound packets via Provider B:

  • Provider B’s ingress filters (strict uRPF / BCP 38) check if Provider B is the shortest path to AS 64496.

  • Since Provider A is the primary route, Provider B silently drops all your outbound traffic as spoofed packets.

3. Legacy Switch ASICs Punt to CPU Slow-Path

Fixed-function switch chips (Broadcom Tomahawk/Trident, Cisco Silicon One) in modern data centers have TCAM microcode hardwired for 32-bit IPv4 (0x0800) and 128-bit IPv6 (0x86DD). They do not know what EtherType 0x88B8 is.

  • Packets cannot be switched at line rate (400Gbps/800Gbps) in hardware.

  • Switches punt IPv8 frames to the control-plane CPU exception queue, causing massive packet loss and throughput dropping from 400Gbps to <10Gbps.

4. The Monolithic Zone Server DDoS Target

Putting DHCP, DNS, NTP, Syslog, OAuth2 auth, and NAT into one "Zone Server" gateway creates the ultimate single point of failure. A simple UDP reflection attack against port 8080 or port 53 simultaneously knocks out time synchronization, dynamic addressing, token verification, and Internet egress for the entire company.

The Catastrophic: Economic Collapse for RIRs and Tier-1 Upstreams

1. RIRs (ARIN, RIPE, APNIC) Go Financially Bankrupt

  • RIRs are non-profits funded by tiered annual fees based on the volume of IP space held.

  • Under IPv8, registering a single 32-bit ASN ($100–$500/yr) gives you 4.3 billion routable IP addresses.

  • Address volume is decoupled from fees, collapsing RIR operational revenues by 75% to 90%.

  • The multi-billion dollar secondary IPv4 transfer market ($40–$55 per IP) is wiped out overnight.

2. The Speculative "Run on 32-bit ASNs"

Because 1 ASN = 4.3 Billion IPs, domain squatters and spammers will rush to hoard thousands of 32-bit ASNs, depleting the global ASN registry within years.

3. Tier-1 Transit Margin Destruction & Core TCAM Explosion

  • DFZ Route Explosion: Today's global BGP table has ~1.15M routes. In IPv8, with 115,000+ ASNs announcing Tier-1 and Tier-2 subnets, the Default-Free Zone expands to 3,000,000 to 5,000,000+ active routes, forcing billions of dollars in linecard replacements across global backbones.

  • RINE Peering Revenue Loss: IPv8's RINE mandate (100.0.0.0/8) forces zero-cost regional peering, depriving Tier-1 transit providers (Lumen, Arelion, NTT) of their high-margin transit commit revenue that funds transoceanic subsea cables.

Read the Full Whitepaper

We compiled our full data, test methodology, and protocol dissection into a comprehensive research paper:

Let us know what you think in the comments!

— goonhost.rocks Research Team

Lobsters · 2 赞 · 0 评 讨论 → 阅读原文 →

这条对你有帮助吗？