Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

nginx/1.28.0

System:

Linux 6.8.0-90-generic

PHP Version:

8.4.15

User:

alqudsvolunteers

Directory:

/home/alqudsvolunteers/rootlink/proc/self/root/proc/thread-self/root/usr/share/doc/varnish/html/phk

Free Space:

79.46 GB

🔧 Quick Actions

✏️ Editing: quic.html

<!DOCTYPE html>

<title>QUIC visions of OSI &#8212; Varnish version 7.5.0 documentation</title>
    <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
    <link rel="stylesheet" type="text/css" href="../_static/classic.css?v=e2714048" />
    
    <script src="../_static/documentation_options.js?v=8214db13"></script>
    <script src="../_static/doctools.js?v=888ff710"></script>
    <script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
    
    <link rel="index" title="Index" href="../genindex.html" />
    <link rel="search" title="Search" href="../search.html" />
    <link rel="next" title="Here we are again - VSV00003 in perspective" href="VSV00003.html" />
    <link rel="prev" title="Varnish Developer Day 2019Q3" href="vdd19q3.html" /> 
  </head><body>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             accesskey="I">index</a></li>
        <li class="right" >
          <a href="VSV00003.html" title="Here we are again - VSV00003 in perspective"
             accesskey="N">next</a> |</li>
        <li class="right" >
          <a href="vdd19q3.html" title="Varnish Developer Day 2019Q3"
             accesskey="P">previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
          <li class="nav-item nav-item-1"><a href="index.html" accesskey="U">Poul-Hennings random outbursts</a> &#187;</li>
        <li class="nav-item nav-item-this"><a href="">QUIC visions of OSI</a></li> 
      </ul>
    </div>

<div class="document">
      <div class="documentwrapper">
        <div class="bodywrapper">
          <div class="body" role="main">
            
  <section id="quic-visions-of-osi">
<span id="phk-quick-osi"></span><h1>QUIC visions of OSI<a class="headerlink" href="#quic-visions-of-osi" title="Link to this heading">¶</a></h1>
<p>New York Times Style Magazine had an article last week
<a class="reference external" href="https://www.nytimes.com/2019/08/28/t-magazine/olivetti-typewriters-ivrea-italy.html">about the Italian town Ivrea</a>,
which you have probably never heard about.</p>
<p>Neither had I, 30+ years ago, when I got sent there as part of a project
to migrate the European Parliament from OSI protocols to TCP/IP.</p>
<p>What ?  You thought OSI protocols were only a theory ?</p>
<p>Nothing could be further from the truth.</p>
<p>One of the major reasons we are being bothered by Indian “Microsoft
Support” all the time is that the global telephone network runs on
Signalling System Number 7 (“SS7”) which is very much an OSI
protocol.</p>
<p>Your electricity meter very likely talks DLMS(/COSEM), which is also
an OSI protocol.</p>
<p>In both cases, it cost serious money to just get to read the relevant
standards, which is why they could persist in this madness
undisturbed for decades.</p>
<p>ITU-T finally saw the light a few years back, so now you can actually
Read <a class="reference external" href="https://www.itu.int/ITU-T/recommendations/index.aspx?ser=Q">Q.700</a>
if you do not belive me.</p>
<p>Anyway, back in Luxembourg in the tail end of the 1980’ies, the European
parliament ran OSI protocols, and it sucked, and the more I dug into “The
Red/Yellow/Blue Book”<a class="footnote-reference brackets" href="#f1" id="id1" role="doc-noteref"><span class="fn-bracket">[</span>1<span class="fn-bracket">]</span></a>, there more obvious it was that these
protocols were totally unsuitable for use on a local area network.</p>
<p>We proposed to migrate the European Parliament to use TCP/IP, and
we did, which gave me a memorable year in Ivrea, but we could only
do so on the explicit condition, imposed by the European Commission,
that the parliament would migrate back, “…once the issues with the
OSI protocols were sorted out.”</p>
<p>They never sorted them out, because the OSI protocols were designed
and built by people who only considered communication between different
buildings, cities, countries and continents, but not what happened
inside each individual building <a class="footnote-reference brackets" href="#f2" id="id2" role="doc-noteref"><span class="fn-bracket">[</span>2<span class="fn-bracket">]</span></a>.</p>
<p>Having seen the title of this rant, you can probably already see where
I’m going with this, and you will be mostly right.</p>
<p>The good news is that IETF learned their lesson, so QUIC is not
being rammed through and rubber-stamped the way HTTP/2 was,
in fact, one could argue that IETF got their revenge by handing
QUIC over to their arc-nemesis:
<a class="reference external" href="https://tools.ietf.org/area/tsv/">The Transport Area</a>.</p>
<p>I think that was a good thing, because pretty much all of my
predictions about H2 came true, from the lack of benefits to the
DoS exposure designed into it.</p>
<p>All those aliments came by because the people who pushed “H2 the
protocol previously known as SPDY” only considered the world from
the perspective of a huge company with geo-diverse datacenters for
whom packet loss is something that happens to other people and
congestion is solved by sending an email to Bandwidth Procurement.</p>
<p>But those concerns are precisely what the “dinosaurs” in the Transport
Area care about and have studied and worked on for decades, so there
is every reason to expect that QUIC will emerge from the Transport
Area much better than it went in.</p>
<p>While I was pretty certain that H2 would be a fizzle, I have a much
harder time seeing where QUIC will go.</p>
<p>On the positive side, QUIC is a much better protocol, and it looks
like the kind of protocol we need in an increasingly mobile InterNet
where IP numbers are an ephemeral property.  This is the carrot, and
it is a big and juicy one.</p>
<p>In the neutral area QUIC is not a simple protocol, it is a full
transport protocol, which means loss detection, retransmission,
congestion control and all that, but you do not get better than TCP
without solving the problems TCP solved, and those are real and
hard problems.</p>
<p>On the negative side, QUIC goes a long way to break through barriers
of authority, both by putting it on top of UDP to get it through
firewalls, but also by the very strong marriage to TLS1.3 which
dials privacy up to 11:  Everything but the first byte of a QUIC
packet is encrypted.</p>
<p>Authorities are not going to like that, and I can easily see more
autoritarian countries outright ban QUIC, and to make that ban
stick, they may even transition from “allowed if not banned” to
“banned if not allowed” firewalling.</p>
<p>Of couse QUIC would still be a thing if you are big enough to
negotiate with G7-sized governments, and I would not be surprised
if QUIC ends up being a feasible protocol only for companies which
can point at the “job creation” their data-centers provide.</p>
<p>The rest of us will have to wait and see where that leaves us.</p>
<section id="quic-and-varnish">
<h2>QUIC and Varnish<a class="headerlink" href="#quic-and-varnish" title="Link to this heading">¶</a></h2>
<p>I can say with certainty that writing a QUIC implementation
from scratch, including TLS 1.3 is out of the question, that
is simply not happening.</p>
<p>That leaves basically three options:</p>
<ol class="arabic simple">
<li><p>Pick up a TLS library, write our own QUIC</p></li>
<li><p>Pick up a QUIC library and the TLS library it uses.</p></li>
<li><p>Stick with “That belongs in a separate process in front of Varnish.”</p></li>
</ol>
<p>The precondition for linking an TLS library to Varnishd, is that
the private keys/certificates are still isolated in a different
address space, these days known as “KeyLess TLS”.</p>
<p>The good news is that QUIC is designed to do precisely that <a class="footnote-reference brackets" href="#f3" id="id3" role="doc-noteref"><span class="fn-bracket">[</span>3<span class="fn-bracket">]</span></a> .
The bad news is that as far as I can tell, none of the available
QUIC implementations do it, at least not yet.</p>
<p>The actual selection of QUIC implementations we could adopt is very
short, and since I am not very inclined to make Go or Rust a
dependency for Varnish, it rapidly becomes even shorter.</p>
<p>Presently, The H2O projects <a class="reference external" href="https://github.com/h2o/quicly">quicly</a>
would probably be the most obvious candidate for us, but even that
would be a lot of work, and there is a some room between where
they have set their code quality bar, and where we have put ours.</p>
<p>However, opting to write our own QUIC instead of adopting one
is a lot of work, not in the least for the necessary testing,
so all else being equal, adopting sounds more feasible.</p>
<p>With number three we abdicate the ability to be “first line” if
QUIC/H3 does become the new black, and it would be incumbent on us
to make sure we work as well as possible with those “front burner”
boxes using a richer PROXY protocol or maybe a “naked” QUIC,
to maintain functionality.</p>
<p>One argument for staying out of the fray is that our “No TLS in
Varnish” policy looks like it was the right decision.</p>
<p>While it is inconvenient for small sites to have to run two
processes, as soon as sites grow, the feedback changes to
appreciation for the decoupling for TLS from policy/caching,
and once sites get even bigger, or more GDPR exposed, the
ability to use diverse TLS offloaders is seen as a big benefit.</p>
<p>Finally, there is the little detail of testing:  Varnishtest,
which has its own <a class="reference external" href="https://github.com/vtest/VTest">VTest project</a>
now, will need to learn about HTTP3, QUIC and possibly TLS also.</p>
<p>And of course, when we ask the Varnish users, they say <em>“Ohhh…
they all sound delicious, can we have the buffet ?”</em> :-)</p>
<p><em>phk</em></p>
<p class="rubric">Footnotes</p>
<aside class="footnote-list brackets">
<aside class="footnote brackets" id="f1" role="doc-footnote">
<span class="label"><span class="fn-bracket">[</span><a role="doc-backlink" href="#id1">1</a><span class="fn-bracket">]</span></span>
<p>The ITU-U’s standards were meant to come out in updated
printed volumes every four years, each “period” a different
color.</p>
</aside>
<aside class="footnote brackets" id="f2" role="doc-footnote">
<span class="label"><span class="fn-bracket">[</span><a role="doc-backlink" href="#id2">2</a><span class="fn-bracket">]</span></span>
<p>Not, and I want to stress this, because they were stupid
or ignorant, but it simply was not their job.  Many
of them, like AT&amp;T in USA, were legally banned from
the “computing” market.</p>
</aside>
<aside class="footnote brackets" id="f3" role="doc-footnote">
<span class="label"><span class="fn-bracket">[</span><a role="doc-backlink" href="#id3">3</a><span class="fn-bracket">]</span></span>
<p>See around figure 2 in <a class="reference external" href="https://quicwg.org/base-drafts/draft-ietf-quic-tls.html">the QUIC/TLS draft</a>.</p>
</aside>
</aside>
</section>
</section>

<div class="clearer"></div>
          </div>
        </div>
      </div>
      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
        <div class="sphinxsidebarwrapper">
  <div>
    <h3><a href="../index.html">Table of Contents</a></h3>
    <ul>
<li><a class="reference internal" href="#">QUIC visions of OSI</a><ul>
<li><a class="reference internal" href="#quic-and-varnish">QUIC and Varnish</a></li>
</ul>
</li>
</ul>

</div>
  <div>
    <h4>Previous topic</h4>
    <p class="topless"><a href="vdd19q3.html"
                          title="previous chapter">Varnish Developer Day 2019Q3</a></p>
  </div>
  <div>
    <h4>Next topic</h4>
    <p class="topless"><a href="VSV00003.html"
                          title="next chapter">Here we are again - VSV00003 in perspective</a></p>
  </div>
  <div role="note" aria-label="source link">
    <h3>This Page</h3>
    <ul class="this-page-menu">
      <li><a href="../_sources/phk/quic.rst.txt"
            rel="nofollow">Show Source</a></li>
    </ul>
   </div>
<div id="searchbox" style="display: none" role="search">
  <h3 id="searchlabel">Quick search</h3>
    <div class="searchformwrapper">
    <form class="search" action="../search.html" method="get">
      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
      <input type="submit" value="Go" />
    </form>
    </div>
</div>
<script>document.getElementById('searchbox').style.display = "block"</script>
        </div>
      </div>
      <div class="clearer"></div>
    </div>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             >index</a></li>
        <li class="right" >
          <a href="VSV00003.html" title="Here we are again - VSV00003 in perspective"
             >next</a> |</li>
        <li class="right" >
          <a href="vdd19q3.html" title="Varnish Developer Day 2019Q3"
             >previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
          <li class="nav-item nav-item-1"><a href="index.html" >Poul-Hennings random outbursts</a> &#187;</li>
        <li class="nav-item nav-item-this"><a href="">QUIC visions of OSI</a></li> 
      </ul>
    </div>
    <div class="footer" role="contentinfo">
    &#169; Copyright 2010-2014, Varnish Software AS.
      Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.2.6.
    </div>
  </body>
</html>

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: quic.html

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation