Re: [babel] Babel over DTLS and UDP ports

[David Schinazi <[e-mail]>]

Hi Juliusz,

Thanks for your passionate response :-)

To clarify my earlier email, the IANA port expert gave their opinion, and
I've been made aware that as expert they provide knowledgeable opinions but
do not hold power over the final outcome.
The powers that be wanted there to be a new conversation on the Babel
mailing list about the pros and cons of using a new port, given the
expert's opinion.
If it is still the consensus of the Babel WG that allocation of a new port
is critical to some implementations and will facilitate deployment of a
secure version of the protocol, and the IESG agrees that this consensus was
reached, then once the IESG moves the document forward the IANA
considerations section will apply and a new port will be allocated.

Now, speaking as implementor of Babel (as opposed to draft author), I
strongly believe that a new port will make a difference in the success of
this protocol. Juliusz phrased the reasons why quite well.

Thanks,
David


On Fri, May 31, 2019 at 3:14 PM Juliusz Chroboczek <[e-mail]> wrote:

> > When the authors requested the new port from IANA, we received some
> pushback.
> > The position of the IANA port expert was that UDP ports are a scarce
> resource
> > and they strongly prefer to not allocate them unless it is necessary.
>
> In a healthy technical organisation, the administration helps the
> technical folks get their stuff done.  An organisation is ossified if the
> bureaucacy feels they have the right to dictate the technical solutions.
>
> If there are technical reasons to use a single port, we should state them.
> Under no circumstances should we agree to change our protocol in order to
> make the bureaucrats happy.
>
> > So the question for the Babel WG is: is the separate port necessary?
>
> Antonin's original implementation implementation used a single port:
>
>
> https://datatracker.ietf.org/meeting/101/materials/slides-101-babel-babel-over-dtls-00
>
> > One possible solution could be for us to have unencrypted packets and
> DTLS
> > packets share the same port. For that we can leverage the fact that all
> Babel
> > packets start with a first byte set to 42, and say that DTLS packets use
> the
> > same port, prefixed with 43 instead of 42.
>
> Yes, that's what I was arguing for back in 2018.  However, I was put in
> the minority by a number of wise people:
>
>   - David argued that the whole point of DTLS is to use a standard DTLS
>     stack, and some DTLS stacks don't support using a single port for both
>     encrypted an cleartext traffic;
>   - David pointed out that Apple's DTLS implementation doesn't support
>     this mode of operation;
>   - Donald added that it is usual for IETF protocols to use separate ports.
>
> If the above points no longer stand, then please explain what has changed
> since 2018.
>
> If these points still stand, then it is our duty to make the right
> technical decision, IANA's impotence notwithstanding.  We have a number of
> options:
>
>   - go speak with IANA again, stating clearly that using distinct ports
>     reflects WG consensus;
>   - should that fail, we could use an ephemeral port for DTLS, announce it
>     as a sub-TLV of multicast Hello (recall that DTLS uses unicast only);
>   - should that be considered to fragile, we can publish the draft with no
>     port assignment, and have implementations squat an unallocated port.
>
> > What are people's thoughts?
>
> None that can be expressed without profanity.
>
> (Please have a look at the IANA UDP port registry -- thousands of ports
> have been allocated to completely undocumented obscure protocols, and
> they're refusing to allocate a single port for a standards track document?)
>
> -- Juliusz
>