[multipathtcp] The MPTCP part (was Re: High-level design decisions /architecture

[marcelo bagnulo braun <[e-mail]>]

William Herrin escribió:
> On Mon, Nov 2, 2009 at 6:45 PM, marcelo bagnulo braun
> <[e-mail]> wrote:
>   
>>> I'm concerned about this idea. One of the corner cases where shim6
>>> falls apart is: once the connection migrates away from the original
>>> addresses, how do the endpoints decide whether a new connection
>>> request for the original addresses means the migrated addresses or the
>>> current holder of the addresses? Think: FTP.
>>>
>>>       
>> could you expand on this?
>> I wasn't aware shim6 falls apart in any case neither this particular
>> approach...
>>     
>
> Hi Marcelo,
>
> Consider the following scenario:
>
> Host A comes online with 1.2.3.4.
> Host A requests a new TCP connection to 5.6.7.8.
> Established with host B at 5.6.7.8.
> Host B adds 8.7.6.5
> Host B removes 5.6.7.8
> Host C comes online with 5.6.7.8.
> Host A requests a new TCP connection to 5.6.7.8.
>
>   
i don't see how this applies to MPTCP, since MPTCP as oposed to any L3 
solution works per connection.

So in the MPTCP case, the original connection would still be with host B 
and the new connection would be with host C, which is the same baheviour 
that you would have with normal TCP (only that with normal TCP the first 
connection would have break while with MPTCP is still preserved)

So i don't see this as a problem, but rather as a feature... what am i 
missing?

Regards, marcelo


> Which host does A connect to?
>
> If the answer is C, protocols like FTP which initiate multiple TCP
> connections to the same IP address fail once an endpoint gives up its
> original address. That'll also impact web browsers which employ dns
> pinning.
>
> If the answer is B, I can hijack hotmail's IPs with respect to your
> mail server for the few fractions of a second it takes to establish
> and move a TCP connection over to an IP address I legitimately
> control. You'll then indefinitely send subsequent hotmail-addressed
> email to me. If I diligently pass it on to hotmail, you may never even
> know.
>
> If we identify the connection by the original IP address even after
> that address is gone, effectively lying to the application, we can
> induce it to incorrect behavior. That can have security implications
> that may be hard to get a handle on.
>
> Regards,
> Bill Herrin
>
>