Live data from Hacker News

QUIC and the end of TCP sockets

codemia.io

41–50 of 83 posts

Re: QUIC and the end of TCP sockets

#41
post #32

Earlier quoted context omitted.

Fortunately you don't get any say in what my userspace applications do on my own hardware. And if you worry about hostile applications on your own hardware, the OS is an excellent point to limit what they can do – including overwhelming your network interface.

> the OS is an excellent point to limit what they can do – including overwhelming your network interface One might even call this "congestion control"!

No, congestion control in the network sense is about congestion at choke points in packet networks due to higher inflow than outflow rates.

While you're still on your own host, your OS has complete visibility into which applications are currently intending to send data and can schedule them much more directly.

Re: QUIC and the end of TCP sockets

#42
post #39

Earlier quoted context omitted.

Because it's an extra header. Making data transfer that much less efficient and working to make sure that clients can decide it properly

Yeah? It's an eight byte header. The OS needs something to tag IP packets to get them delivered to the correct application. So you're thinking maybe a four byte header for 50% savings here?

Good point on there needing to be some application-level addressing anyway.

On top of that, I believe the UDP checksum can be omitted as well at least on some OSes (and is arguably not necessary for fully encrypted/authenticated payloads) – leaving really just the two bytes for the "length field".

Re: QUIC and the end of TCP sockets

#43
post #25

The obnoxious thing is that overly aggressive firewalls have killed any IP protocols that are not TCP or UDP. Even ICMP is often blocked or partially blocked. In the mean time we could have had nice things: https://en.wikipedia.org/wiki/Stream_Control_Transmission_Pr... SCTP would be a fantastic protocol for HTTP/HTTPS. Pipelining, multi homing, multi streaming, oh my.

If you like SCPT, nobody's stopping you from using it today! Just put it in a minimal UDP wrapper. WebRTC has been doing just that for peer to peer data connections (which need TCP-like semantics while traversing NATs via UDP hole punching).

I get today’s realities of it but I would have preferred a world where IPv6 killed NAT and middleboxes properly supported more protocols than TCP and UDP. The original intent of IP was to have more than two protocols built on top of it. Many were built and deployed but then killed by IPv4 address exhaustion and NAT, as well as poorly configured firewalls and middleboxes that specifically wanted to mess with level 4 traffic.

UDP is a good solution but all it does is provide an 8 byte overhead and nothing that IP itself doesn’t provide for something like SCTP.

Re: QUIC and the end of TCP sockets

#44
post #25

Earlier quoted context omitted.

If you like SCPT, nobody's stopping you from using it today! Just put it in a minimal UDP wrapper. WebRTC has been doing just that for peer to peer data connections (which need TCP-like semantics while traversing NATs via UDP hole punching).

I get today’s realities of it but I would have preferred a world where IPv6 killed NAT and middleboxes properly supported more protocols than TCP and UDP. The original intent of IP was to have more than two protocols built on top of it. Many were built and deployed but then killed by IPv4 address exhaustion and NAT, as well as poorly configured firewalls and middleboxes that specifically wanted to mess with level 4 t…

IPv6 doesn't provide a length header, so that's already 2 bytes arguably necessary for all protocols layered on top of that.

Source and destination port just seem like a reasonable baseline for alternate protocols, that's 4 more – leaving just the checksum. (If you're really desperate for space and have integrity provided by your protocol, you can even cram two more bytes in there!)

Sure, it would be conceptually nice to be able to skip UDP, but I think in terms of performance it absolutely does not matter.

Re: QUIC and the end of TCP sockets

#45

The obnoxious thing is that overly aggressive firewalls have killed any IP protocols that are not TCP or UDP. Even ICMP is often blocked or partially blocked. In the mean time we could have had nice things: https://en.wikipedia.org/wiki/Stream_Control_Transmission_Pr... SCTP would be a fantastic protocol for HTTP/HTTPS. Pipelining, multi homing, multi streaming, oh my.

Not sure I follow. QUIC is just UDP with an extra header in the opaque payload. To a firewall, it looks just like UDP.

Their point is that's a sad design choice, caused by firewalls forcing QUIC to take a first-class TCP-like internet protocol and wrap it with encrypted headers inside UDP for the sole purpose of preventing firewalls from blocking it or making it break in myriad subtle ways. Even QUICs unencrypted header parts are designed to be difficult for intermediate network equipment to track and modify, because of their history of making other protocols over TCP unreliable by doing this.

SCTP is another high-performance protocol that provides many of the same network and performance features as QUIC, but it has been around for ~25 years. It was widely implemented. It was even in Linux 2.4 and available for Windows XP and MacOS. WebRTC in browsers can use SCTP, which makes sense (it predates QUIC) but is actually a bit of a problem if you want wide interoperability with WebRTC.

But despite SCTP being around and widely implemented, and doing many of the good things QUIC does, SCTP was never widely adopted, nor seriously considered for HTTP, mainly because of the problem of firewalls. (And to be fair, some operating system API limitations).

Basically, if TCP were invented today, it could not be deployed succesfully over much of the internet unless it was wrapped in UDP and encrypted.

UDP-with-encryption is now playing the role that the IP protocol is supposed to play, just because too many firewalls block nearly every IP packet that doesn't have type TCP or UDP. If UDP is used but without encryption for a popular protocol, eventually too many firewalls deep-packet-inspect that UDP protocol too, and do the same kinds of blocking, tampering or making protocols break.

This sad problem is called protocol ossification. As Google's AI puts it: "QUIC is the first IETF transport protocol to deliberately minimise its wire image to avoid ossification.". See also https://en.wikipedia.org/wiki/Protocol_ossification and https://http3-explained.haxx.se/en/why-quic/why-ossification

There are some downsides to QUIC's ossification resistance. I did some work for a mobile equipment manufacter who adaptively manage the queues for multiple TCP streams from different users and different applications from the same user, to help ensure a better, fairer and lower-latency experience. QUICs properties made it difficult to measure what's going on at the protocol level, forcing the queue management to use crude statistical estimators instead, which don't work well on bursty protocols.

Re: QUIC and the end of TCP sockets

#46
post #40
post #35

Earlier quoted context omitted.

^^^^ this. I work for a big company (15k engineers). Trying to use anything that is not TCP or UDP simply doesnt work here. For years, even UDP was blocked and the answer we got was always "why are you using UDP, use TCP instead". Yep you read that right. Most of these folks are very short sighted or narrow minded. We tried to use SCTP for one project, major blunder. Zero support from network teams. Sctp is blocked e…

> Trying to use anything that is not TCP or UDP simply doesnt work here. Good news, then: QUIC uses UDP. > As for as QUIC support? Never gonna happen here. So generic UDP is allowed, but QUIC is specifically detected and filtered? That would be bizarre.

I have also had to deal with UDP getting blocked by a middle box before. It is rare now across the internet but you never know what intranet grey beards can do.

And UDP hole punching is a crutch for the fact that we still use IPv4.

Re: QUIC and the end of TCP sockets

#47
I used QUIC extensively to implement https://github.com/connet-dev/connet and while I'm super happy with how it turned out, I think QUIC currently suffers from some immaturity - most implementations are still ongoing/not production ready (for example in java) and in many cases it is only viewed as a way to power on HTTP/3, instead of being self-standing protocol/API that ppl can use (for example, trying to use quic in android).

In any case, I'm optimistic that QUIC has a bright future. I don't expect it to replace TCP, but give us another tool we can use when it is called for.

Re: QUIC and the end of TCP sockets

#48
post #6

Note well: the claims about TCP come with some evidence, in the form of a graph. The claims for QUIC do not. Many of the claims are dubious. TCP has "no notion of multiple steams"? What are two sockets, then? What is poll(2)? The onus is on QUIC to explain why it’s better for the application to multiplex the socket than for the kernel to multiplex the device. AFAICT that question is assumed away in a deluge of words.…

Even the TCP graph is dubious. Cubic being systematically above the link capacity makes me chuckle. Yes bufferbloat can have cubic "hug" a somewhat higher limit, but it still needs to start under the link capacity.

Re: QUIC and the end of TCP sockets

#49

One thing to note is that using HTTP2.0 for anything other than "this is not how to design high throughput protocols" is unfair. At the time HTTP2.0's multiplexing was known to be bad for anything other than perfect, low latency networks. I hope this was because people had faith in better connectivity, rather than ignorance of how mobile and non-lan traffic worked. You should probably at least try QUIC now, but you c…

Even on perfect networks HoL blocking is an issue. If the receiving end of a set of stream blocks on one stream, it ends up blocking the whole connection. One stream stops due to backpressure, all streams stop.

Re: QUIC and the end of TCP sockets

#50
post #44

Earlier quoted context omitted.

I get today’s realities of it but I would have preferred a world where IPv6 killed NAT and middleboxes properly supported more protocols than TCP and UDP. The original intent of IP was to have more than two protocols built on top of it. Many were built and deployed but then killed by IPv4 address exhaustion and NAT, as well as poorly configured firewalls and middleboxes that specifically wanted to mess with level 4 t…

IPv6 doesn't provide a length header, so that's already 2 bytes arguably necessary for all protocols layered on top of that. Source and destination port just seem like a reasonable baseline for alternate protocols, that's 4 more – leaving just the checksum. (If you're really desperate for space and have integrity provided by your protocol, you can even cram two more bytes in there!) Sure, it would be conceptually nic…

QUIC doesn’t use the UDP length header to designate message length, does it?

But my point isn’t even about performance. It is about the fact that NAT and IPv4 address exhaustion and bad firewall practices have killed any innovation of level 4 protocols. Imagine if instead of TCP, SCTP had won the protocol wars in 1980-1990s. Or even better if we had realized that we were going to run out of IPv4 addresses much earlier when the cost of switching was smaller. It would have been so much better to have firewalls that don’t filter anything but protocols 6 and 17. We could have had the opportunity to experiment with different types of transports, baked encryption in at a lower level, etc.

Basically where we are is that we have 6 and 8 dot LEGO bricks to play with and are told that we can build anything with those but aren’t allowed to play with any other shapes.

Post reply on HN