Re: [Spud] SPUD's open/close are unconvincing

[Toerless Eckert <[e-mail]>]

On Wed, Apr 08, 2015 at 08:46:24PM -0700, Tom Herbert wrote:
> I think the kernel/user-land argument is a red herring.

Elaborate please. To me its probably the biggest motivator for 
SPUD. Otherwise we could design all we need into IP and TCP.

> The problem is
> that middleboxes routinely participate in transport layer protocols
> which was never architected-- transport layer protocols are inherently
> end-to-end protocols.

Thats 1970'th IETF katechism. I would call middleboxes a big contributor
to todays success of Internet technologies.

> It's relatively easy to change client and
> server sides to accommodate new transport functionality,

Which is why we have OS-level TCP functions that lag state of the art
on average by a decade.

> but pretty much impossible for us to change all the possible middleboxes
> in a path in a timely fashion.  Just one middlebox in the path that decides
> to drop our packet because it doesn't understand our new option, or
> doesn't like our new flags can spoil everything-- it is really
> difficult to work around interoperabilities like this.

Everybody and their dog concerned about this problem is already
automatically falling back to IP over SSL on port 443. We simply need to
do the best to evolve away from that. Thats why it is important to offer
benefits to those middleboxes.

> So, yes, the
> net effect of this is that we have become very conservative with
> transport layer changes, and when we do make changes at the transport
> layer we often have to masquerade these in something that is
> considered generally palatable to middleboxes. This is why we intend
> to run transport protocols over UDP in the first place, and has even
> motivated brazen attempts to overload TCP protocol number with other
> things (e.g. STT). SPUD is a good opportunity to generalize and
> standardize middlebox/transport protocol interactions, but if the its
> benefits are dependent on middleboxes being updated that not is going
> to go anywhere fast either!

Any firewall can start out processing SPUD just as UDP and once
FW firmware improves it will simply improve from there. Nobody
says firewalls MUST update, we just say that we want to provide
at least the same toolset for relevant inspection firewalls as what TCP gives
them. 

Cheers
    Toerless