Subject: [multipathtcp] Two proxy scenario (network proxy off path)

From: <[email-masked]>
Date: Wed, 29 Mar 2017 01:24:00 +0000

Hi, 

I'm now thinking about the scenario where there are two proxies, one in the home gateway or Customer Premises Equipment and one in the network, both under the control of the operator. And looking at the 'explicit mode' scenario, which - if I get it right - means that the network proxy is not on the default path. (It's safe to assume that the home gateway proxy is on the default path)

Thinking about the use of SOCKS in this context.

Earlier Olivier said (in the context of the smartphone scenario -  sorry if your comments don't apply to this scenario and I'm just creating confusion) that there are different variants of SOCKS that can be used, which mainly depend on the number of messages that are used to authenticate.
In the two proxy scenario, it's probably reasonable to assume that the home gateway and network proxy are already authenticated. So a non-chatty version would be ok.

Is that right?

Thanks
phil

---

From: <[email-masked]>
Date: Wed, 29 Mar 2017 11:30:25 +0000

Hi Phil, 

Can you please clarify what you mean by a "non-chatty version"? version of what?

You can refer to Section 3 of RFC1928 to have an idea about the number of messages that are required before sending actual traffic when SOCKSv5 is used. 

Below an excerpt of signaling messages observed to create an initial subflow using SOCKSv5:

==============
(MP Client) ->    TCP SYN    ->  (MCP)
                   <- TCP SYN/ACK <- 
                   ->    TCP ACK    ->
                   -> SOCKS Method Request (1)(a) ->
                   <-    TCP ACK (b)   <-
                    <- SOCKS Method Response (2)(c) <-
                    ->   TCP ACK (d)   ->
                    -> SOCKS Authentication Request (3)(e) ->
                    <-    TCP ACK (f)    <-
                    <- SOCKS Auth. Response (4)(g) <-
                    ->   TCP ACK (h)   ->
                    -> SOCKS Connection Request (5)(i) -> (MCP)
                    <-   TCP ACK (j)                   <- (MCP)
                                                          (MCP)  -> TCP SYN (k) -> (Server)
                                                          (MCP)  <- SYN/ACK (l) <- (Server)
                    <- SOCKS Connection Response (n) (6) <-(MCP) -> TCP ACK (m) -> (Server)
                    ->   TCP ACK (o)  ->
=================

I let you compare it with the 0-RTT and 0-extra signaling approach with MP_CONVERT IE. 

Cheers,
Med

> -----Message d'origine-----
> De : multipathtcp [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : mardi 28 mars 2017 20:24
> À : [email-masked]
> Objet : [multipathtcp] Two proxy scenario (network proxy off path)
> 
> Hi,
> 
> I'm now thinking about the scenario where there are two proxies, one in
> the home gateway or Customer Premises Equipment and one in the network,
> both under the control of the operator. And looking at the 'explicit mode'
> scenario, which - if I get it right - means that the network proxy is not
> on the default path. (It's safe to assume that the home gateway proxy is
> on the default path)
> 
> Earlier Olivier said (in the context of the smartphone scenario -  sorry
> if your comments don't apply to this scenario and I'm just creating
> confusion) that there are different variants of SOCKS that can be used,
> which mainly depend on the number of messages that are used to
> authenticate.
> In the two proxy scenario, it's probably reasonable to assume that the
> home gateway and network proxy are already authenticated. So a non-chatty
> version would be ok.
> 
> Is that right?
> 
> Thanks
> phil
> 
> _______________________________________________
> multipathtcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/multipathtcp

---

From: <[email-masked]>
Date: Wed, 29 Mar 2017 15:12:41 +0000

By non-chatty, I meant a version that didn't do all the authentication messages. After all, the home gateway and network proxy can be expected to know about each other already - at least don't need to do for every new TCP connection from devices behind home gateway

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 29 March 2017 06:30
To: Eardley,PL,Philip,TUB8 R <[email-masked]>; [email-masked]
Subject: RE: Two proxy scenario (network proxy off path)

Hi Phil, 

==============

Cheers,
Med

> [email-masked] Envoyé : mardi 28 mars 2017 20:24 À : 
> [email-masked] Objet : [multipathtcp] Two proxy scenario 
> (network proxy off path)
> 
> Hi,
> 
> I'm now thinking about the scenario where there are two proxies, one 
> in the home gateway or Customer Premises Equipment and one in the 
> network, both under the control of the operator. And looking at the 'explicit mode'
> scenario, which - if I get it right - means that the network proxy is 
> not on the default path. (It's safe to assume that the home gateway 
> proxy is on the default path)
> 
> Earlier Olivier said (in the context of the smartphone scenario -  
> sorry if your comments don't apply to this scenario and I'm just 
> creating
> confusion) that there are different variants of SOCKS that can be 
> used, which mainly depend on the number of messages that are used to 
> authenticate.
> home gateway and network proxy are already authenticated. So a 
> non-chatty version would be ok.
> 
> Is that right?
> 
> Thanks
> phil
>

---

From: <[email-masked]>
Date: Wed, 29 Mar 2017 15:31:58 +0000

Re-,

Thank you for the clarification. There is no such standard non-chatty SOCKS specifications. 

You are completely right that authorization is not needed for every connection coming from the same CPE. But SOCKSv5 does not allow for relaxing that. 

As discussed in the nam-deployment draft, there are alternate approaches to achieve authorization without even implying an explicit exchange between the CPE and the MCP. 

Cheers,
Med

> De : [email-masked] [mailto:[email-masked]]
> Envoyé : mercredi 29 mars 2017 10:13
> À : BOUCADAIR Mohamed IMT/OLN; [email-masked]
> Objet : RE: Two proxy scenario (network proxy off path)
> 
> By non-chatty, I meant a version that didn't do all the authentication
> messages. After all, the home gateway and network proxy can be expected to
> know about each other already - at least don't need to do for every new
> TCP connection from devices behind home gateway
> 
> You can refer to Section 3 of RFC1928 to have an idea about the number of
> messages that are required before sending actual traffic when SOCKSv5 is
> used.
>