Re: [babel] Opinions wanted: Babel over DTLS ports

[David Schinazi <[e-mail]>]

> On Jul 11, 2018, at 15:35, Juliusz Chroboczek <[e-mail]> wrote:
> 
>> One of the Babel over DTLS questions we haven't answered yet is UDP port
>> numbers.
>> https://tools.ietf.org/html/draft-decimo-babel-dtls-01#section-3
> 
> I think that implementation complexity is about the same.  Using different
> ports requires opening an extra socket, but that's a small cost (just
> a slight complication to your main event loop, and slightly more complex
> error handling in case one of the binds fails).  It might be slightly
> easier to hook your DTLS library if you use a different port, but we
> haven't found that to be a significant problem.
> 
> Using different ports might cause packet reordering (since you're using
> different sockets).  That is not likely to be a big deal, since we only
> send Hellos and IHUs on the unencrypted socket, and since Babel is fairly
> resistant to packet reordering.  It might cause trouble with extensions
> that are sensitive to packet reordering -- for now, HMAC is the only such
> extension.

If I understand you correctly, this would only cause packet reordering
between multicast and unicast (as in all unicast is ordered, and all
multicast is ordered, but multicast 1 might arrive after unicast 2).

For HMAC specifically, this could be solved by using a different index
for unicast and multicast - but that would require receivers to keep
track of multiple indices. And that complexity's probably not worth it
because you don't need HMAC over DTLS.

I agree that this is a valid concern though - but it doesn't tip the scales for me.

> I have a slight preference for using a single port.  David prefers the two
> port solution, I believe, since he wants to hook as high up as possible
> into his DTLS library.  Antonin would appear to agree with David, but he's
> afraid to tell me clearly ;-)
> 
> I think the policy of listening to people with an implementation more than
> people without one has served us well.  David, what's the state of your
> implementation?

Our DTLS stack [1] only lets you handle DTLS above the abstraction of
a connection - you don't want to be messing with sockets. In order to
get the same port variant to work, I had to write 400 lines of Obj-C that
create UDP sockets over loopback so I can pull the encrypted packets
out from under the DTLS stack. Needless to say that's not an ideal solution.

And on the topic of implementation, have you modified the DTLS stack
you use to support multiple concurrent connections on the same port yet?
Last time we talked your implementation was trivially DoSable by sending
bad DTLS client hellos.

[1] https://developer.apple.com/documentation/network <https://developer.apple.com/documentation/network>

David