Re: [tcpinc] TCP's treatment of data in SYN packets

[David Mazieres <[e-mail]>]

Joe Touch <[e-mail]> writes:

>> On Jul 30, 2016, at 10:20 AM, David Mazieres <[e-mail]> wrote:
>> 
>> And mandating no
>> buffering of discarded SYN data is a good way to do that...
>
> You can do that for ENO, but you cannot assert requirements for legacy
> stacks.
>
> The problem is that you keep saying you "know" when the other end
> supports ENO based on previous state, but if that were really true you
> wouldn't need to negotiate ENO in the 3WHS.

No, I'm saying *if* the application knows the other end of a connection
supports ENO, and in particular *if* the application intends to abort an
unencrypted connection anyway, *then* it probably makes sense for the
application to send data in a SYN segment.

You are right that if we could have an internet flag day, we wouldn't
need TCP-ENO at all.  But getting from the status quo to our goal of
~100% encrypted TCP traffic requires multiple stages--first
opportunistic encryption, then shimming in some sort of endpoint
authentication, finally having applications or middleware drop
unauthenticated connections.  If TCPINC succeeds, people may, for
example, configure NFS servers not to talk to workstations over
unencrypted TCP.  By that point it makes to discuss TEPs supporting SYN
data, but not now.  Now the question before the working group is how ENO
should avoid preempting/complicating those future discussions.

So far I haven't heard any objections to anything before the last
paragraph of section 4.7, which means the discussion needs to focus on
that last paragraph, namely:

   Using data in SYN segments deviates from TCP semantics and can cause
   problems with middleboxes or non-compliant TCP hosts.  Hence, all
   TEPs SHOULD support a normal mode of operation that does not make use
   of data in SYN segments.  Moreover, implementations SHOULD employ SYN
   data only if explicitly requested by the application or in cases
   where such use is highly unlikely to pose problems.

I think you've objected to the word "using" as too vague, and maybe
would prefer "standard TCP semantics" to make clear we aren't talking
about TFO.  You did not answer my question about whether the word
"consuming" is better than "using".  You also did not answer my question
about whether you would support a sentence saying active openers SHOULD
abort non-ENO connections if they have sent SYN data (though at this
point I think such a sentence would be good).  Your arguments seem
primarily directed at some hypothetical future straw-man TEP sending
encrypted SYN data to non-ENO aware hosts, but no existing TEP proposal
does that and more importantly that is not the question at hand.

So on the topic of TCP-ENO, do you have specific suggestions for
improving the last paragraph of section 4.7 of the draft?

David