Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: manual: Remove wrong TCP-over-TCP info; minor copy editing #106

Closed

Conversation

mfwitten
Copy link
Contributor

@mfwitten mfwitten commented May 13, 2018

This commit is intended to apply cleanly as a fast‑forward merge. The reason for this is that a future pull request will merge this commit's changes into branch-netatalk-3-1, so as to record the nature of the development and to avoid the duplication of cherry-picking.

Of course, if this is not possible, that future pull request can be re-configured.


The main reason for this commit is to remove this text:

Tunneling TCP over TCP (as SSH does) is not the best idea. There exist better solutions like VPNs based on the IP layer.

It's true that TCP-over-TCP is a bad idea, because it can lead to TCP "meltdown"; however, it is not true that tunneling via SSH implies TCP‑over‑TCP. Indeed, because a VPN is a much more general solution to tunneling, it is likely to perform worse than SSH for the simple case of connecting to a single, specific AFP Server.

Consider the following port forwarding (using OpenSSH):

  ssh -N -L localhost:1234:localhost:548 example.com

When an AFP Client communicates with an AFP Server through this tunnel, the data they exchange is encapsulated in TCP and decapsulated from TCP such that TCP is never encapsulated by TCP; that is, TCP‑over‑TCP never occurs (view the following diagram with a monospace font and with at least 93 coloumns of text):

                   localhost:1234           example.com:22           localhost:548
                         |                        |                        |
                         |                        |                        |
                         V   encrypt(AFP)--+      V                        V
                                           |
+--------------+         +--------------+  V      +--------------+         +--------------+
|          AFP | AFP/TCP |     AFP      | ???/TCP |     AFP      | AFP/TCP | AFP          |
|   data <=====o=========o==============o=========o==============o=========o=====> data   |
|              |         |              |         |              |         |              |
|  AFP Client  |         |  SSH Client  |         |  SSH Server  |         |  AFP Server  |
+--------------+         +--------------+         +--------------+         +--------------+

Anyway, while I was in the source rummaging around, I took the opportunity to perform some copy editing, including a few mild additions and clarifications.

The main reason for this commit is to remove this text:

  Tunneling TCP over TCP (as SSH does) is not the best idea.
  There exist better solutions like VPNs based on the IP
  layer.

It's true that TCP-over-TCP is a bad idea, because it can lead
to TCP "meltdown"; however, it is *not* true that tunneling via
SSH implies TCP-over-TCP. Indeed, because a VPN is a much more
general solution to tunneling, it is likely to perform worse
than SSH for the simple case of connecting to a single, specific
AFP Server.

Consider the following port forwarding (using OpenSSH):

  ssh -N -L localhost:1234:localhost:548 example.com

When an AFP Client communicates with an AFP Server through this
tunnel, the data they exchange is encapsulated in TCP and decap-
sulated from TCP such that TCP is never encapsulated by TCP;
that is, TCP-over-TCP *never* occurs (view the following diagram
with a monospace font and with at least 93 coloumns of text):

                     localhost:1234           example.com:22           localhost:548
                           |                        |                        |
                           |                        |                        |
                           V   encrypt(AFP)--+      V                        V
                                             |
  +--------------+         +--------------+  V      +--------------+         +--------------+
  |          AFP | AFP/TCP |     AFP      | ???/TCP |     AFP      | AFP/TCP | AFP          |
  |   data <=====o=========o==============o=========o==============o=========o=====> data   |
  |              |         |              |         |              |         |              |
  |  AFP Client  |         |  SSH Client  |         |  SSH Server  |         |  AFP Server  |
  +--------------+         +--------------+         +--------------+         +--------------+

Anyway, while I was in the source rummaging around, I took the
opportunity to perform some copy editing, including a few mild
additions and clarifications.
@slowfranklin
Copy link
Member

Pushed to master. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants