Re: [tcpm] TCP Connection ID

Olivier Bonaventure <olivier.bonaventure@tessares.net> Tue, 26 May 2020 06:52 UTC

MIME-Version: 1.0
References: <CAEGSd=DQwj_XbpxCz=7GYTgzjGM=ARqgw3oG58_Y9hbNZpPPrQ@mail.gmail.com> <CAEGSd=BrgqFrZVexkKhvYr2Yeu-B2Gyde7aYevPqTr8MzWQs4A@mail.gmail.com> <86F47ECD-8504-4FAA-8D39-0099C203FA0C@tessares.net> <CAEGSd=Adh2-JNZDp6CksDUbV59jZ5nZkup8gvahjzs=T8BNsmA@mail.gmail.com>
In-Reply-To: <CAEGSd=Adh2-JNZDp6CksDUbV59jZ5nZkup8gvahjzs=T8BNsmA@mail.gmail.com>
From: Olivier Bonaventure <olivier.bonaventure@tessares.net>
Date: Tue, 26 May 2020 08:51:40 +0200
Message-ID: <CAJuVx18w3j6tpWfeHMNYVnF3R2N5Wt=23jBAjJG+5fF8NJX27Q@mail.gmail.com>
To: Alexander Azimov <a.e.azimov@gmail.com>
Cc: "tcpm@ietf.org Extensions" <tcpm@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/tcpm/_GTaM8a1fSlNJ0PA8x4GUNJvmIk>
Subject: Re: [tcpm] TCP Connection ID
Precedence: list

Alexander,

> As far as I understand you are suggesting to use IP LSR/RH which SHOULD be turned off by default (RFC7196). Besides, P and X, in your terms may belong to different address families. It seems that you still have confusion on the purpose of my proposal:
>
> There is a browser, that sends a WEB-request. The request is sent to the virtual IP (VIP). The browser/OS is out of our control.
> There is a load balancer inside the datacenter, which receives an SYN packet and needs to send it to the server with real IP. Normally it is done via tunnel: IPIP or GRE. Both load balancer and server are under the same administrative control.
> The idea is to introduce a connection id, that is generated by the server at the time of SYN/ACK and kept at the client for the time of TCP session, thus removing the need to keep the state at the load balancer. This brings advantages in the case of DDoS attacks, load drain from servers, and traffic rerouting between LB.

Another possibility would be to place the connection id in the network
layer, see doi:10.1109/TNET.2018.2799242

> Oliver:
> Thank you for the link! I was not aware of this paper. The option to advertise VIP looks interesting, but seem to have limitations:
>
> What if real server IP is IPv6 address while the client is working from IPv4 only network?

If your VIP is IPv4 and the server behind the LB only support IPv6,
then you need the packets to pass through the LB anyway

> The attacker may learn the full list of backend servers, which can be used for DDoS attacks. The dynamic IP allocation for connections may work as a partial workaround, have you implemented it in the lab?

We did some tests but did not deploy that on busy servers

> The load balancer still needs to keep states of the connections. But it wasn't the problem that was addressed in the paper.
>

Indeed. The main objective of the paper was to show how to efficiently
support MPTCP on load balancers


Olivier

-- 


Disclaimer: https://www.tessares.net/mail-disclaimer/ 
<https://www.tessares.net/mail-disclaimer/>

[tcpm] TCP Connection ID Alexander Azimov
Re: [tcpm] TCP Connection ID Joseph Touch
Re: [tcpm] TCP Connection ID Alexander Azimov
Re: [tcpm] TCP Connection ID Jonathan Morton
Re: [tcpm] TCP Connection ID Alexander Azimov
Re: [tcpm] TCP Connection ID Scharf, Michael
Re: [tcpm] TCP Connection ID cait
Re: [tcpm] TCP Connection ID Joseph Touch
Re: [tcpm] TCP Connection ID Alexander Azimov
Re: [tcpm] TCP Connection ID Joseph Touch
Re: [tcpm] TCP Connection ID Olivier Bonaventure
Re: [tcpm] TCP Connection ID Alexander Azimov
Re: [tcpm] TCP Connection ID Joseph Touch
Re: [tcpm] TCP Connection ID Alexander Azimov
Re: [tcpm] TCP Connection ID Joseph Touch
Re: [tcpm] TCP Connection ID Olivier Bonaventure
Re: [tcpm] TCP Connection ID Joseph Touch
Re: [tcpm] TCP Connection ID Yoshifumi Nishida
Re: [tcpm] TCP Connection ID Alexander Azimov