5 ms·

Well technically the only thing those routers and middleboxes need to support is IP, why some of them decide they need to meddle with the payload is something I

Well technically the only thing those routers and middleboxes need to support is IP, why some of them decide they need to meddle with the payload is something I don't understand.

unmole 10y ago
> Well technically the only thing those routers and middleboxes need to support is IP If they are doing NAT, they need to understand the transport layer protocol too.
- zrm 10y ago
  >If they are doing NAT, they need to understand the transport layer protocol too. And this is why we need IPv6.
  - mkj 10y ago
    With ipv6 they still need to understand protocols to do connection tracking.
    - zrm 10y ago
      Routers that don't do NAT don't need to do connection tracking. Firewalls do, but it's possible to put the firewall in the endpoint.
    - aaron_m04 10y ago
      Why is connection tracking necessary?
  - beagle3 10y ago
    Luckily, no three letter agency will abuse this to track anyone if we use IPv6 completely unNATted as it was intended to be used. /s
    - zrm 10y ago
      There are ways to fix that. One of the interesting ones is to have every socket call to bind() without an explicit address allocate a random new IPv6 address. Then there is nothing to correlate the address with because every other socket on that machine has a different address.
      - beagle3 10y ago
        It is indeed interesting, and useful from an privacy perspective (in the sense that it masks the correlation between different connections from the same machine). You do need to define some "trustworthy" machines which get to see a constant (and known) address - or troubleshooting and debugging the network will be horrible. Also, I suspect some protocols (pop-before-smtp, stun) won't like it. They are unneeded in IPv6, but I suspect there exist ones that will fail horribly with this scheme.
        zrm 10y ago
        > You do need to define some "trustworthy" machines which get to see a constant (and known) address - or troubleshooting and debugging the network will be horrible. In enterprise environments you could get the addresses from a DHCPv6 server which would then be able to map them back to machines. Or register them in the internal reverse DNS. > Also, I suspect some protocols (pop-before-smtp, stun) won't like it. They are unneeded in IPv6, but I suspect there exist ones that will fail horribly with this scheme. It would be less trouble to make addresses per-process rather than per-socket, but also somewhat less effective. A good middle ground might be to default to per-process and have a socket option to make it per-socket. That way e.g. Firefox could still have different addresses for connections to different servers. A process could then choose which sockets use the same address as one another by calling getsockname() on an existing socket and then using that address to bind() another one.
bluejekyll 10y ago
Network operators often exploit router configurations to do custom routing or even poor man firewall configurations that work off data in the TCP packets. The device manufacturers love this because it allows for vendor lock-in. I agree with you; though, I do wonder what will start happening at the routingnlayer of the internet to start dealing with these massive DDOS attacks that have been going on.
- nrjdhsbsid 10y ago
  I've been reading a lot into these recent DDoS attacks and countermeasures. Even though syn cookies are a hack they fix the biggest exploitable resource hole in TCP. It's now possible to initialize TCP using no stored state info but hardly anyone is doing it in practice. The biggest reason is that traditional NAT requires a separate conntrack state table. The big players (looking at you google, cloudflare) have solved this by using consistent hashing to load balance traffic but they're not sharing the code. Google made a show of good faith recently by releasing a comprehensive paper on how their load balancer works, hoping the open source movement will pull a mapreduce/hbase and built a replica off of it but this far it isn't happening. I think google gave up considering that they've seen how much money cloudflare makes selling the software as a service and now offer their own servers as DDoS protection. I've been looking deeply into the matter. The truth is that open load balancers relying on the kernel are not going to work. Someone needs to get started on this, and I've considered doing so myself but it's a big undertaking for a single dev
  - hodgesrm 10y ago
    Thanks for the reference on Google's load balancing. Is this the Maglev load balancer paper [1] available on Google Research? [1] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/44824.pdf https://static.googleusercontent.com/media/research.google.c...
    - nrjdhsbsid 10y ago
      Yup that's it. Me and other kernel devs have been toying with the idea for years, but google actually went out and did it, and documented it. They proved it was possible. It's something that absolutely should be picked up and run with
djrogers 10y ago
> Well technically the only thing those routers and middleboxes need to support is IP Generally speaking, security devices need to support a lot more than just raw IP to do their jobs these days. At this point the installed base of firewalls alone would make implementing a new protocol like this across the internet effectively impossible. Add in devices that do NAT, ALGs, load balancers, and other intelligent network devices and you can see why everyone that needs something like this on a real network uses UDP with stuff built on top.
- nrjdhsbsid 10y ago
  Had the OSI network model won out eons ago we would have enough separation between layers to use custom protocols. For better or worse, that battle was long decided by TCP/IP and the two have been tightly intertwined ever since. It's too bad but at the same time running custom protocols on UDP really isn't too bad as far as CPU/Space overhead. It's pretty much become a universal encapsulation protocol for everything else
- slrz 10y ago
  intelligent network devices That's why those should get scrapped and replaced by dumb pipes. They only cause pain. I thought this lesson had been learned decades ago already.
deleted 10y ago
[deleted]

Well technically the only thing those routers and middleboxes need to support is IP, why some of them decide they need to meddle with the payload is something I don't understand.

unmole 10y ago

> Well technically the only thing those routers and middleboxes need to support is IP If they are doing NAT, they need to understand the transport layer protocol too.

zrm 10y ago
>If they are doing NAT, they need to understand the transport layer protocol too. And this is why we need IPv6.
- mkj 10y ago
  With ipv6 they still need to understand protocols to do connection tracking.
  - zrm 10y ago
    Routers that don't do NAT don't need to do connection tracking. Firewalls do, but it's possible to put the firewall in the endpoint.
  - aaron_m04 10y ago
    Why is connection tracking necessary?
- beagle3 10y ago
  Luckily, no three letter agency will abuse this to track anyone if we use IPv6 completely unNATted as it was intended to be used. /s
  - zrm 10y ago
    There are ways to fix that. One of the interesting ones is to have every socket call to bind() without an explicit address allocate a random new IPv6 address. Then there is nothing to correlate the address with because every other socket on that machine has a different address.
    - beagle3 10y ago
      It is indeed interesting, and useful from an privacy perspective (in the sense that it masks the correlation between different connections from the same machine). You do need to define some "trustworthy" machines which get to see a constant (and known) address - or troubleshooting and debugging the network will be horrible. Also, I suspect some protocols (pop-before-smtp, stun) won't like it. They are unneeded in IPv6, but I suspect there exist ones that will fail horribly with this scheme.
      - zrm 10y ago
        > You do need to define some "trustworthy" machines which get to see a constant (and known) address - or troubleshooting and debugging the network will be horrible. In enterprise environments you could get the addresses from a DHCPv6 server which would then be able to map them back to machines. Or register them in the internal reverse DNS. > Also, I suspect some protocols (pop-before-smtp, stun) won't like it. They are unneeded in IPv6, but I suspect there exist ones that will fail horribly with this scheme. It would be less trouble to make addresses per-process rather than per-socket, but also somewhat less effective. A good middle ground might be to default to per-process and have a socket option to make it per-socket. That way e.g. Firefox could still have different addresses for connections to different servers. A process could then choose which sockets use the same address as one another by calling getsockname() on an existing socket and then using that address to bind() another one.

bluejekyll 10y ago

Network operators often exploit router configurations to do custom routing or even poor man firewall configurations that work off data in the TCP packets. The device manufacturers love this because it allows for vendor lock-in. I agree with you; though, I do wonder what will start happening at the routingnlayer of the internet to start dealing with these massive DDOS attacks that have been going on.

nrjdhsbsid 10y ago
I've been reading a lot into these recent DDoS attacks and countermeasures. Even though syn cookies are a hack they fix the biggest exploitable resource hole in TCP. It's now possible to initialize TCP using no stored state info but hardly anyone is doing it in practice. The biggest reason is that traditional NAT requires a separate conntrack state table. The big players (looking at you google, cloudflare) have solved this by using consistent hashing to load balance traffic but they're not sharing the code. Google made a show of good faith recently by releasing a comprehensive paper on how their load balancer works, hoping the open source movement will pull a mapreduce/hbase and built a replica off of it but this far it isn't happening. I think google gave up considering that they've seen how much money cloudflare makes selling the software as a service and now offer their own servers as DDoS protection. I've been looking deeply into the matter. The truth is that open load balancers relying on the kernel are not going to work. Someone needs to get started on this, and I've considered doing so myself but it's a big undertaking for a single dev
- hodgesrm 10y ago
  Thanks for the reference on Google's load balancing. Is this the Maglev load balancer paper [1] available on Google Research? [1] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/44824.pdf https://static.googleusercontent.com/media/research.google.c...
  - nrjdhsbsid 10y ago
    Yup that's it. Me and other kernel devs have been toying with the idea for years, but google actually went out and did it, and documented it. They proved it was possible. It's something that absolutely should be picked up and run with

djrogers 10y ago

> Well technically the only thing those routers and middleboxes need to support is IP Generally speaking, security devices need to support a lot more than just raw IP to do their jobs these days. At this point the installed base of firewalls alone would make implementing a new protocol like this across the internet effectively impossible. Add in devices that do NAT, ALGs, load balancers, and other intelligent network devices and you can see why everyone that needs something like this on a real network uses UDP with stuff built on top.

nrjdhsbsid 10y ago
Had the OSI network model won out eons ago we would have enough separation between layers to use custom protocols. For better or worse, that battle was long decided by TCP/IP and the two have been tightly intertwined ever since. It's too bad but at the same time running custom protocols on UDP really isn't too bad as far as CPU/Space overhead. It's pretty much become a universal encapsulation protocol for everything else
slrz 10y ago
intelligent network devices That's why those should get scrapped and replaced by dumb pipes. They only cause pain. I thought this lesson had been learned decades ago already.

deleted 10y ago

[deleted]