Subject: New draft possibilities

From: Eric Brown <[email-masked]>
Date: Sat, 27 Aug 2005 09:13:37 -0700 (PDT)

I was just wondering if there has ever been any
thought put to making a draft of a UDP tunnel like the
TCP forwarding function.

Also it would be nice to have a draft on process
management.  A client could get a list of processes,
start or stop them, and get detailed properties on
them.

Just some thoughts.

____________________________________________________
Start your day with Yahoo! - make it your home page 
http://www.yahoo.com/r/hs

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 29 Aug 2005 13:46:47 -0400

> thought put to making a draft of a UDP tunnel like the

This has been suggested before several times.  nobody has stepped
forward to write a draft.  Are you volunteering to write one?

> start or stop them, and get detailed properties on

I've not seen this suggestion before.

I'd put higher priority on finding a volunteer to finish the Agent draft
first...

					- Bill

---

From: der Mouse <[email-masked]>
Date: Mon, 29 Aug 2005 15:00:26 -0400 (EDT)

> I'd put higher priority on finding a volunteer to finish the Agent
> draft first...

Has it been orphaned?  I had assumed its authors were still working on
it (albeit apparently not terribly urgently).

I can pick it up and see what I can do with it, if that would be
considered a Good Thing.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 29 Aug 2005 15:52:33 -0400

> I can pick it up and see what I can do with it, if that would be

I certainly think it would be a good idea.

---

From: Joseph Galbraith <[email-masked]>
Date: Mon, 29 Aug 2005 14:15:00 -0600

> I certainly think it would be a good idea.

Ditto.

More power to you.

Thanks,

Joseph

---

From: [email-masked] (Peter Gutmann)
Date: Tue, 30 Aug 2005 16:46:43 +1200

Bill Sommerfeld <[email-masked]> writes:
>This has been suggested before several times.  nobody has stepped forward to
>write a draft.  Are you volunteering to write one?

Doesn't the existence of OpenVPN (which does exactly this) make this more or
less redundant?  That might explain the lack of enthusiasm for it, there's
already something that does this freely available.

(If you're using UDP then you have to provide your own reliability layer, so
OpenVPN uses IPsec's UDP-based transport without all of the other IPsec
baggage.  If you wanted to do this with SSH you'd be more or less reinventing
OpenVPN).

Peter.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 30 Aug 2005 01:24:08 -0400

z

On Tuesday, August 30, 2005 16:46:43 +1200 Peter Gutmann 
<[email-masked]> wrote:

> Doesn't the existence of OpenVPN (which does exactly this) make this more
> or less redundant?  That might explain the lack of enthusiasm for it,
> there's already something that does this freely available.
>
> (If you're using UDP then you have to provide your own reliability layer,
> so OpenVPN uses IPsec's UDP-based transport without all of the other IPsec
> baggage.  If you wanted to do this with SSH you'd be more or less
> reinventing OpenVPN).

I think you might be answering the wrong question.
The proposal wasn't SSH-over-UDP; it was UDP port forwarding.
That does seem like it could be useful.

-- Jeff

---

From: [email-masked] (Peter Gutmann)
Date: Tue, 30 Aug 2005 17:46:50 +1200

Jeffrey Hutzelman <[email-masked]> writes:

>I think you might be answering the wrong question. The proposal wasn't SSH-
>over-UDP; it was UDP port forwarding. That does seem like it could be useful.

Ah, UDP on the inside, not the outside.  Right, that could be useful...

Peter (who's not volunteering to do it, though :-).

---

From: Ben Laurie <[email-masked]>
Date: Tue, 30 Aug 2005 07:40:54 +0100

> baggage.  If you wanted to do this with SSH you'd be more or less reinventing

And there's DTLS.

---

From: Frank Cusack <[email-masked]>
Date: Mon, 29 Aug 2005 23:41:48 -0700

> Ah, UDP on the inside, not the outside.  Right, that could be useful...

A TCP tunnel would change the characteristics of most UDP apps quite
significantly and would not be desirable, I'd think.

retries within retries ...

-frank

---

From: der Mouse <[email-masked]>
Date: Tue, 30 Aug 2005 03:15:47 -0400 (EDT)

>>> [...] a UDP tunnel like the TCP forwarding function.
> Doesn't the existence of OpenVPN (which does exactly this) make this
> more or less redundant?

No, because depending on what "exactly this" is, OpenVPN *doesn't* do
"exactly this".

In particular, OpenVPN cannot (normally) be set up by a nonprivileged
user to "port-forward" UDP traffic `securely' (FWVO "securely"), even
if all the port numbers involved are nonprivileged.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: der Mouse <[email-masked]>
Date: Tue, 30 Aug 2005 03:25:12 -0400 (EDT)

> significantly and would not be desirable, I'd think.

Depends on what you're using UDP for.  It will change the
characteristics of UDP, but whether the change is significant will
depend on the application UDP is being put to.

For example, I would expect it to work fine for DNS traffic (which is
pretty close to the only use I can see for it offhand, though that
could just mean I don't do much with UDP).

I'd expect the hardest part would be handling replies; many UDP-based
protocols expect to send some kind of reply back to a packet's sender,
so to be useful any UDP-forwarding-over-ssh would have to pass replies
back to the sender.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 30 Aug 2005 11:39:56 -0400

On Monday, August 29, 2005 23:41:48 -0700 Frank Cusack 
<[email-masked]> wrote:

>>> I think you might be answering the wrong question. The proposal wasn't
>>> SSH- over-UDP; it was UDP port forwarding. That does seem like it could
>>> be useful.
>>

Perhaps, but especially when the network is fairly reliable, it would be 
better than an app you can't use at all because you have no way to get the 
packets from here to there.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA

---

From: Frank Cusack <[email-masked]>
Date: Tue, 30 Aug 2005 11:47:51 -0700

> could just mean I don't do much with UDP).

But what happens when DNS times out and sends a retry, while TCP has
also queued it's own retry?  You end up drastically increasing the
amount of network traffic.  I fail to see how that's a Good Thing.
So I'm not sure what you mean by "works fine".

What happened or what were the general thoughts on this when X.25 was
prevalent?  TCP over X.25 is even more interesting than UDP over X.25.
Or were IP protocoles not really used over X.25?

-frank

---

From: Ben Harris <[email-masked]>
Date: Tue, 30 Aug 2005 21:01:59 +0100

In article <[email-masked]> you write:
>amount of network traffic.

Not necessarily.  A reasonable implementation of UDP-over-SSH would notice
the TCP congestion (in the Unix world, by write() on the TCP socket
returning EWOULDBLOCK) and drop incoming UDP until it cleared.  I'm not an
expert in congestion control, though, and I think one would need to be
consulted to determine the actual scope of the problem.

>Or were IP protocoles not really used over X.25?

They certainly were.  When I arrived at University in 1994, we had a 2 Mbit
X.25 connection over which we ran IP.

-- 
Ben Harris

---

From: Frank Cusack <[email-masked]>
Date: Tue, 30 Aug 2005 15:34:30 -0700

On August 30, 2005 9:01:59 PM +0100 Ben Harris <[email-masked]> wrote:
> returning EWOULDBLOCK) ...

Only after the receiver's window goes to 0, and even then only if no
packets whatsoever get through.  In congested conditions where packets
make it after a few retrans, you'll never get this error.  You are also
assuming something (a lot) about a specific implementation.  Nothing
requires a TCP stack to notify the application like this.

-frank

---

From: der Mouse <[email-masked]>
Date: Tue, 30 Aug 2005 23:25:21 -0400 (EDT)

>>>> [UDP-over-ssh]
>>> For example, I would expect it to work fine for DNS traffic [...]
>> also queued it's own retry?
> A reasonable implementation of UDP-over-SSH would notice the TCP
> congestion (in the Unix world, by write() on the TCP socket returning
> EWOULDBLOCK) and drop incoming UDP until it cleared.

If that's your idea of TCP congestion pushed back to userland, you need
to get your hands dirty with code more[%]. :-)  Most kernels buffer
some 10-20 K of data before that happens, and that can hold a lot more
than a few DNS retries.

Yes, eventually buffers fill up, but you need either crippling
underlying congestion or a comparative lot of upper-layer traffic to
push it clear back to userland.

[%] Yes, I know you _do_ get your hands dirty with code.  That's why
    the smiley.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 01 Sep 2005 13:56:45 +1200

Ben Harris <[email-masked]> writes:
>They certainly were.  When I arrived at University in 1994, we had a 2 
>Mbit X.25 connection over which we ran IP.

Did you ever manage to achieve more than 50% link utilisation?

Peter.