Re: [Spud] SPUD's open/close are unconvincing

[Daniel Kahn Gillmor <[e-mail]>]

Hi Toerless--

On Wed 2015-04-08 15:39:21 -0400, Toerless Eckert wrote:

> a) I think one hope of SPUDs design is to make UDP look enough like
>    TCP to persuade FWs (and similar middleboxes) to police / permit it
>    as well as TCP flows are policed/permitted.
>
> b) If you don't like how it works, let me generalize the question,
>    would like to hear your (and others) answers:
>
>    What is the best possible design we can do to make UDP flows
>    be equal or better permissible across WELL BEHAVED FW and similar
>    middleboxes ? Please define "WELL BEHAVED"as part of your answer.

As i wrote to Joe, i'm not convinced that this is an answerable question
considering that no one has provided a technical argument yet for why
the enterprise firewall operators can't already do what we're talking
about here.

> c) If i read it correctly, SPUD can 
>
>    a) set up potentially multiple independent pipes across the same 5-tuple.
>    b) A single pipe can go across different 5-tuples (multipath/mobility).
>    
>    These two features should explain why tracking 5-tuple as you
>    suggest alone would not be sufficient.
>
>    Btw: I am a fan of b), i don't think a) should be encouraged given
>    experience with RTCweb. In that sense, the total number of
>    pipes would even be equal or smaller than the number of 5 tuples.

This is an interesting point, thanks.  I'd be curious to hear more
details about the RTCweb experience that have convinced you that (a)
should not be encouraged.

The trouble with (b), of course, is that in the multipath or mobility
case, the tube will continue its flow over different network segments,
which violates the goals people have described for open and close.

As i move to a new path, i'm deliberately not sending a Close message
(because i want to keep the tube open, right?) -- so what do the
middleboxes do?

And after i've moved to a new network and want to continue the same
tube, surely i won't indicate that the flow is opening (it's already
open).  As a result, the equipment on the new path won't see the Open
message -- should they discard it now?

These arrangements seem in conflict to me.

Regards,

        --dkg

> P.S.: Cool domain name. Is that indicative of the role you're planning
> to take in the discussion ? ;-))) (sorry, i can never resists these questions).

:)