Re: [Acme] Server on >= 1024 port

Phillip Hallam-Baker <phill@hallambaker.com> Thu, 03 December 2015 00:12 UTC

MIME-Version: 1.0
Sender: hallam@gmail.com
In-Reply-To: <20151202221153.GC18430@eff.org>
References: <565589E4.2030107@desy.de> <565EBF56.3070502@desy.de> <D836A378-DA88-4AAF-B1E4-F34A80319DC1@gmail.com> <e9092589f3204a449af8b6f900be1303@usma1ex-dag1mb1.msg.corp.akamai.com> <CAL02cgQPZrx5d1xO-xKEQrV+pZKLkhYW_XDSm=QM8THs__s5qQ@mail.gmail.com> <CAMm+LwiqfYH-Vt7L2OSyLTNWzPSYBO-qxhjHege2jFqOnPtxjQ@mail.gmail.com> <20151202220603.GB18430@eff.org> <20151202221153.GC18430@eff.org>
Date: Wed, 02 Dec 2015 19:11:57 -0500
Message-ID: <CAMm+Lwi+8Gk5yeRatAZOEuAQRBhZ2tt5S5Okp3BadbCVGy1r3g@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
To: Peter Eckersley <pde@eff.org>
Content-Type: multipart/alternative; boundary="001a11c3732035f7b00525f33d06"
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/oiuECjq_wi0jKRw58FFWUBFn_5Q>
Cc: Richard Barnes <rlb@ipv.sx>, Paul Millar <paul.millar@desy.de>, "acme@ietf.org" <acme@ietf.org>, Yoav Nir <ynir.ietf@gmail.com>, "Salz, Rich" <rsalz@akamai.com>
Subject: Re: [Acme] Server on >= 1024 port
Precedence: list

On Wed, Dec 2, 2015 at 5:11 PM, Peter Eckersley <pde@eff.org> wrote:

> On Wed, Dec 02, 2015 at 02:06:03PM -0800, Peter Eckersley wrote:
> > On Wed, Dec 02, 2015 at 12:01:04PM -0500, Phillip Hallam-Baker wrote:
> > >
> > > Again, I think you are missing the real problem here. Let us say we
> have a
> > > new protocol to run over port 666 that is actually a Web service under
> the
> > > covers.
> > >
> > > Hosting provider has a host that supports the following Web Sites that
> > > belong to different parties:
> > >
> > > example.com
> > > malicious.com
> > >
> > > The hosting provider allows any form of executable to run on the host
> > > (10.6.6.6) that does not interfere with apache which has 80 & 443
> reserved.
> > > [This is typical]
> >
> > Are there any typical hosting environments in which such executables can
> > bind to port 666, while being unable to tear down and replace the
> > service that's bound of 443?  What are they?
>
> (And perhaps you were arguing elsewhere in this thread that .Net Core +
> Raspberry Pi devices might be an example of this, but it would be an
> interesting and surprising fact if ASP could bind :666 on such devices,
> but not bind or reconfigure the server on :443)


The issue is that in a multi hosting environment, port 443 is managed by
the system and a hosted  Web service can only bind to a specific
port/hostname combination as a result. The hosted service gets a *share* of
port 443 while on any other port it gets the raw TCP/IP stream.

[Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Roland Zink
Re: [Acme] Server on >= 1024 port Martin Thomson
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Stephen Farrell
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Eric Mill
Re: [Acme] Server on >= 1024 port Darren J Moffat
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Ángel González
Re: [Acme] Server on >= 1024 port Vincent Lynch