Re: [Spud] Fwd: New Version Notification for draft-herbert-transports-over-udp-00.txt

[Joe Touch <[e-mail]>]

On 5/21/2016 7:23 AM, Dave Dolson wrote:
> Another way of explaining the need for PLUS is that the internet architecture is deficient because it only provides connectivity between hosts, whereas there is a need to provide connectivity between applications running on hosts. 

Tunnels already provide that.

A tunnel is fundamentally a link layer over which network layer(s)
transit. UDP/IP can provide that capability through a variety of
existing ways.

However, it's nonsensical to expect a transport to use a tunnel
directly, just as TCP doesn't run over Ethernet.

> This is becoming more relevant as processes are jailed (using various approaches) for security.
>
> Raw sockets require root privilege to prevent different apps from reading or forging each others' packets. I think this restriction still makes sense on single-user machines‎, so it would not be right to say the fix is to loosen O/S security.

Again, now you're getting at an OS implementation issue. That is never
usefully fixed by the network architecture.


> So, one role of the PLUS layer is to extend the network-layer address to being able to address the application at IP address + port.
That's what IP in UDP already accomplishes.
> This is why I don't think there is a layering travesty here. It's redefining the network layer to be between applications.

Apps live inside hosts, and are identified by transport ports. Hosts are
identified by IP addresses. If you have a host inside a host, you need
to treat the outer host as a router+host, and the guest OSes as other
hosts on that router. See:
J. Touch, T. Faber, “Dynamic Host Routing for Production Use of
Developmental Networks <http://www.isi.edu/touch/pubs/icnp97/>,” in
/Proc. ICNP ’97/, Atlanta, Oct. 1997, pp. 285-292.

There's no problem solving any of this with a network layer inside UDP.
The problem is assuming that you can virtualize a network using just the
transport layer - a layer that fundamentally depends on addresses at a
network layer you fail to provide.

UDP already is used for tunnels in ways that solve this problem
correctly. Why do we need an incorrect approach?

Joe