Re: [tcpm] Faster application handshakes with SYN/ACK payloads

On Sunday 21 September 2008, Adam Langley wrote:
> On Sun, Sep 21, 2008 at 2:44 AM, Stefanos Harhalakis <v13@v13.gr> wrote:
> > Also, this is not exactly "data" as there is space for a very small
> > amount of information (some bits). Considering the possibilities of this,
> > it can be used in many situations such as:
> > * HTTP or other protocols that use a well-known-port, to negotiate
> > different behavior without introducing a new port number (SSL over port
> > 80?). * Cryptographic applications
> > * Anything that someone out there can think of. 8 bits (or a little more)
> > of information can be used for many things.
>
> Firstly, one counterargument that several have used in the past is
> that a round-trip-time is unimportant and any such scheme can be
> achieved without TCP changes by burning an RTT. I disagree with this,
> but I can't release any data to back up that assertion, so it's still
> a reasonable counterargument.

I don't believe that this is always possible when trying to keep backwards 
compatibility. Some (stupid ?) examples that just passed from my mind:
* (generic) Early protocol selection
* SSL over port 80, 25, etc
* Early virtualhost selection (with cooperation from the DNS)
* Hidden backdoors :P
* A kind of tunneling
* Anything that someone out there can imagine

> I also wonder how much of an advantage 8 bits, as opposed to a single
> bit, gives you. Although, once you have defined an option, 8 bits is
> almost as cheap as a single bit, so 'why not' is a reasonable
> position.

That's a good question that I don't have an answer for :-)
Indeed, everything that 8 bits can do can also be done with 1 bit and 
everything else in the data part. The only exception I can think of that of 
an intermediate firewall/NAT-box that may make a decision based on that 
field.

> Just from a personal point of view. I'm now using information from DNS
> and from previous connections to the same host to achieve this "early"
> information entirely within userspace. However, I still needed a new
> port because "transparent" proxies aren't very transparent when you
> stop speaking HTTP over port 80.

I don't see how transparent proxies will be affected by this. If they don't 
(want to) support the USER_DATA option then they will not reply to it and 
there will be no harm at all.
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm