Re: [tcpm] Updated version of draft-ietf-tcpm-converters-05

[<[e-mail]>]

Hi Yoshi,

Please see inline.

Cheers,
Med

De : Yoshifumi Nishida [mailto:[e-mail]]
Envoyé : mercredi 27 février 2019 10:10
À : BOUCADAIR Mohamed TGI/OLN
Cc : Yoshifumi Nishida; [e-mail]
Objet : Re: [tcpm] Updated version of draft-ietf-tcpm-converters-05

Hi Med,

I put my comments,

On Mon, Feb 25, 2019 at 10:42 PM <[e-mail]<mailto:[e-mail]>> wrote:

De : Yoshifumi Nishida [mailto:[e-mail]<mailto:[e-mail]>]
Envoyé : lundi 25 février 2019 19:35
À : BOUCADAIR Mohamed TGI/OLN
Cc : Yoshifumi Nishida; [e-mail]<mailto:[e-mail]>
Objet : Re: [tcpm] Updated version of draft-ietf-tcpm-converters-05

Hi Med,

Thanks for the updates. I have one question.
When the converter does mptcp conversion and the client wants to use TLS for the connection, how TLS is used?

[Med] TLS is managed e2e between the client and the server. The converter can only read/strip data that is supplied by the client for the conversion service. Unlike data exchanged between the client and the server, the data used for conversion purposes is supplied in clear between the client and the converter.

From a functional standpoint, the establishment of TLS between the client and the server is similar to the establishment of such session when a NAT/NAT6 is on-path.

Yes, when the converter does non-mptcp conversion, I think the above texts are correct.
[Med] If it is OK for simple TCP, then it should be OK for MPTCP:

·         Subflows are externally seen as simple TCP connections.

·         MPTCP glue is at the TCP level.

·         The establishment of TLS between the client/server is done using the initial subflow.

·         The same external IP address is used by the converter for all subflows of a given MPTCP connection.

  Does this means TLS will be used only between the converter and the server, but not used between the client and the converter?
[Med] No. TLS is managed directly between the client and the converter. The scope is as follows:

In my understanding, in case of mptcp + TLS case, I think it should be (A) architecture.
To be precise, it will be like this.

C------Converter-----S
<========><==========>
<========>
<========>
<========>
   TLS        TLS

So, I think it means mptcp + TLS case is out of focus for this draft. (which is fine with me.)

[Med] This is out of scope.

Or, you can make a special exception to break end-to-end principle in this case.
But, I think it would be good if the draft clarifies this point.

[Med] We added this NEW text: ““It is out of scope of this document to elaborate on considerations related to the use of TLS in the Client-Converter connection leg to exchange conversion-supplied data”