Re: [tsvwg] signaling packet importance [was Re: New Version Notification for draft-herbert-fast]

[Sebastian Moeller <[e-mail]>]

Hi John,


> On Aug 13, 2023, at 17:47, Kaippallimalil John <[e-mail]> wrote:
> 
>> My concern is that endorsing use of UDP options to signal in-network devices could cause the same reaction as IP HBH options - that they could be seen as unsafe to routers and could cause an over-reaction that causes >  deliberate blocking or stripping.
>> 
>> As the discussion noted, that’s not currently the case, or at least as best can be determined. I
>> 
>> It’d be useful to avoid creating new reasons that routers would want to interfere. I.e., the question isn’t whether IP options are an alternative - they clearly are the appropriate place for draft-kaippallimalil-tsvwg-media->  hdr-wireless and draft-reddy-tsvwg-explcit-signal - it’s whether using UDP options for those purposes could jeapordize them for everyone else.
> 
> The procedures in draft-kaippallimalil-tsvwg-media- hdr-wireless can in theory be realized by encoding it in IPv6 HBH options (IPv4 is another questions) but I share Mike's concern about the timeline. 
> (-- " Those might bear fruit someday, though the timeline is at best uncertain").
> The authors (of tsvwg-media- hdr-wireless) are primarily looking to providing a viable solution for 3GPP in the short term (end of 2024 or so) even if it is an Experimental or Informational one.
> 
> And I acknowledge the issue that Joe has pointed to - of whether UDP options will be seen as unsafe, and a corresponding over-reaction.
> Our attempt in draft-kaippallimalil-tsvwg-media- hdr-wireless to avoid this has been that:
> -  the MED option is to be used only within a limited domain that spans an application network and wireless network with pre-established trust (RFC 8799)
> -  if the MED option crosses an "untrusted network" (e.g. , a transport network in between), the entire flow should be encrypted such that MED is not visible.
> -  if a MED option is visible outside the limited domain with trust (set of application, wireless networks), the draft recommends that MED be dropped.

	[SM] Could you clarify what exactly "drop MED" means here:
a) the packet is dropped (by whom)?
b) the MED option is ignored by the scheduling node, and excised
c) the MED option is ignored by the scheduling node, and left alone
d) the sender stops emitting MED options

How will the sender/scheduling node actually know that the option was visible outside the limited trust-domain? I guess the sending network needs to have clear egress policies about which "exits" can be taken by MED adorned packets, but that means all exist nodes need to peek deep into the UDP headers...

At that point I would argue that having the sender simply encrypt the option with a key the intended scheduler node(s) has/have makes a ton of sense (the scheduling node might even replace the encrypted MED option with its decrypted representation of the MED option for the benefit of the end-node (which then does not also need the key, and can recognize whether the MED option was evaluated)).

Side-note: I am still puzzled at how a scheduler would look like that is supposed to act on such rich information essentially in real-time.... and how to secure such a scheduler against abuse.

Regards
	Sebastian


> 
> BR,
> John
> 
> 
> 
> From: tsvwg <[e-mail]> On Behalf Of [e-mail]
> Sent: Sunday, August 13, 2023 10:07 AM
> To: C. M. Heard <[e-mail]>
> Cc: TSVWG <[e-mail]>; Sri Gundavelli <[e-mail]>
> Subject: Re: [tsvwg] signaling packet importance [was Re: New Version Notification for draft-herbert-fast]
> 
> My concern is that endorsing use of UDP options to signal in-network devices could cause the same reaction as IP HBH options - that they could be seen as unsafe to routers and could cause an over-reaction that causes deliberate blocking or stripping.
> 
> As the discussion noted, that’s not currently the case, or at least as best can be determined. I
> 
> It’d be useful to avoid creating new reasons that routers would want to interfere. I.e., the question isn’t whether IP options are an alternative - they clearly are the appropriate place for draft-kaippallimalil-tsvwg-media-hdr-wireless and draft-reddy-tsvwg-explcit-signal - it’s whether using UDP options for those purposes could jeapordize them for everyone else.
> 
> draft-daiya-tsvwg-udp-options-protocol-number is of a completely different nature; it aims to be part of the transport protocol in chaining the meaning of protocol layers, rather than encoding them all in the destination port of the first exchange. In that regard, it’s more like draft-touch-tcpm-sno (service number option), except that it would require similar ’next protocol’ identifiers at all protocol layers, which is (sadly) not the way current services and protocol stacks work.
> 
> Joe
> 
> 
> —
> Dr. Joe Touch, temporal epistemologist
> http://www.strayalpha.com
> 
> 
> On Aug 12, 2023, at 6:14 PM, C. M. Heard <mailto:[e-mail]> wrote:
> 
> On Fri, Aug 11, 2023 at 7:47 PM Joe Touch wrote:
> Just to be clear:
> On Aug 11, 2023, at 2:42 PM, C. M. Heard <mailto:[e-mail]> wrote:
> I've been pushing the idea to co-opt the per-fragment UDP options used for host-to-network signaling, and I'd like to make some comments about that.
> 
> This confuses transport options with network options.
> 
> Not confusion, but rather an explicit proposal to use the per-fragment options as network options instead of transport options. It is put forward to provide potentially workable solutions to the problems that draft-kaippallimalil-tsvwg-media-hdr-wireless and draft-reddy-tsvwg-explcit-signal are intended to solve.
> 
> Granted, an architecturally preferable way to accomplish these objectives would be to use IPv4 Options or IPv6 Hop-by-Hop Options. Indeed, I myself would prefer for IPv4/IPv6 Options to be used if the issues of high discard rates of packets with these options could be solved. There are efforts underway to mitigate the problems for IPv6 Hop-by-Hop Options. Those might bear fruit someday, though the timeline is at best uncertain. But as far as I know, the discard rates for IPv4 Options are equally dismal, and there are no efforts underway to fix that problem. Correction by parties with better knowledge of the facts than mine are invited.
> 
> My take is that the problems that draft-kaippallimalil-tsvwg-media-hdr-wireless and draft-reddy-tsvwg-explcit-signal (and possibly draft-daiya-tsvwg-udp-options-protocol-number as well) could, in principle, be solved by what I see as a modest change of direction to the UDP Options spec. Whether that would work out in practice is much less certain, for the reasons that Tom Herbert has pointed out. IMO it is a judgement call whether the chances are better to get IP Options (in any version) to work within our professional lifetimes. Given that, I don't think it would be right to turn draft-kaippallimalil-tsvwg-media-hdr-wireless and draft-reddy-tsvwg-explcit-signal away without a proper discussion.
> 
> Thanks,
> 
> Mike
>