xrootd client SNI support?

[rptaylor]

Hello,

I don't suppose xrootd clients do support (or potentially could support without much effort) Server Name Indication?

The potential use case is layer 4 TCP load balancing and routing on Kubernetes using an ingress provider.
If xrootd clients use SNI during the TCP handshake to request a specific xrootd server name, then the ingress controller could know which backing server to direct the traffic to (which is otherwise not possible for a TCP router listening on a single (IP:port) combination), without having to know anything about the xrootd protocol.

This question only regards xrootd clients; the server (actually EOS pods) would not need to do anything.

[smithdh]

Hi @rptaylor
SNI is a TLS feature; I suppose that it's useful to Kubernetes if an incoming connection starts directly with a TLS handshake so that kubernetes can route the connection. However usually this isn't the case with xroot services (unless using https protocol), so as far as I can see we can't offer an effective way of using SNI in this way.

[rptaylor]

Thanks @smithdh for the information.
I thought the xrootd protocol does use TLS? Or are you saying the client first connects without TLS, does some negotiation or something, and then switches to TLS?

[abh3]

Yes, that is correct. The first negotiation is without using TLS. You can, however, configure the system to exclusive use LS much like the way HTTP does it (we don't do that by defaul to allow for optimizations that can't happen with HTTP). However, as DS poinst out, the client is not programmed to be able to start with TLS at the starting gate and that owuld need to happen. Hence, for xroot protocol we don't have the capability you are looking for even if the server is capable of doing that.

…

On Mon, 13 Mar 2023, R. P. Taylor wrote: Thanks @smithdh for the information. I thought the xrootd protocol does use TLS? Or are you saying the client first connects without TLS, does some negotiation or something, and then switches to TLS? -- Reply to this email directly or view it on GitHub: #1951 (comment) You are receiving this because you are subscribed to this thread. Message ID: ***@***.***>

[rptaylor]

Thanks for the answer.