Re: [IPsec] Mirja Kühlewind's Discuss on draft-ietf-ipsecme-tcp-encaps-09: (with DISCUSS)

[Mirja Kühlewind <[e-mail]>]

See below

On 27.04.2017 16:27, Eric Rescorla wrote:
>
>             "This document leaves the selection of TCP ports up to
>                implementations.  It is suggested to use TCP port 4500, which is
>                allocated for IPsec NAT Traversal."
>
>             Which sounds to me like an invitation to squat on any open port
>             regardless what the port is supposed to be used for (hoping that the
>             magic number would avoid any collision). I don't think that a
>         good thing
>             to right in an RFC.
>
>
>         Hmm... Maybe I don't understand your overall theory here. It seems
>         like having
>         reserved ports for protocols but letting people run them on any port
>         they want
>         to is kind of common practice. See, for instance:
>         https://tools.ietf.org/html/rfc7230#section-2.7.1
>         <https://tools.ietf.org/html/rfc7230#section-2.7.1>
>
>         "  If the host identifier is provided as an IP address, the origin
>            server is the listener (if any) on the indicated TCP port at that IP
>            address. If host is a registered name, the registered name is an
>            indirect identifier for use with a name resolution service, such as
>            DNS, to find an address for that origin server. If the port
>            subcomponent is empty or not given, TCP port 80 (the reserved port
>            for WWW services) is the default."
>
>
>     This doesn't say you can/should use any port you want (it says you can
>     use another port than 80) but you should till avoid to use any other port
>     that runs a different TCP service.
>
>
> Well, that may be part of your background assumptions, but the document
> doesn't say that. It just tells you how to use a different port and is silent on
> what port you should use.
>

That's what we have the registry for. The difference is, it's okay to use a 
random port (instead of one specific reserved one) but this draft explicitly 
is intended to use other reserved ports.

Mirja