Re: [IPsec] Mirja Kühlewind's Discuss on draft-ietf-ipsecme-tcp-encaps-09: (with DISCUSS)

Hi Tommy,

I think we agree. Removing the port examples is one thing but there is also 
wording that suggest using well-known ports which could be phrased more 
carefully. We discussed this today on the telechat and ekr will have another 
look at this.

Mirja

On 27.04.2017 17:07, Tommy Pauly wrote:
>
>
>> On Apr 27, 2017, at 7:32 AM, Mirja Kühlewind <ietf@kuehlewind.net> wrote:
>>
>> See below
>>
>> On 27.04.2017 16:27, Eric Rescorla wrote:
>>>
>>>            "This document leaves the selection of TCP ports up to
>>>               implementations.  It is suggested to use TCP port 4500, which is
>>>               allocated for IPsec NAT Traversal."
>>>
>>>            Which sounds to me like an invitation to squat on any open port
>>>            regardless what the port is supposed to be used for (hoping that the
>>>            magic number would avoid any collision). I don't think that a
>>>        good thing
>>>            to right in an RFC.
>>>
>>>
>>>        Hmm... Maybe I don't understand your overall theory here. It seems
>>>        like having
>>>        reserved ports for protocols but letting people run them on any port
>>>        they want
>>>        to is kind of common practice. See, for instance:
>>>        https://tools.ietf.org/html/rfc7230#section-2.7.1
>>>        <https://tools.ietf.org/html/rfc7230#section-2.7.1>
>>>
>>>        "  If the host identifier is provided as an IP address, the origin
>>>           server is the listener (if any) on the indicated TCP port at that IP
>>>           address. If host is a registered name, the registered name is an
>>>           indirect identifier for use with a name resolution service, such as
>>>           DNS, to find an address for that origin server. If the port
>>>           subcomponent is empty or not given, TCP port 80 (the reserved port
>>>           for WWW services) is the default."
>>>
>>>
>>>    This doesn't say you can/should use any port you want (it says you can
>>>    use another port than 80) but you should till avoid to use any other port
>>>    that runs a different TCP service.
>>>
>>>
>>> Well, that may be part of your background assumptions, but the document
>>> doesn't say that. It just tells you how to use a different port and is silent on
>>> what port you should use.
>>>
>>
>> That's what we have the registry for. The difference is, it's okay to use a random port (instead of one specific reserved one) but this draft explicitly is intended to use other reserved ports.
>
> The only recommended port in the draft is 4500, which is what is reserved in the registry. The use of any other port is by configuration only. As Tero and others have explained, all IKE connections are made to pre-known pre-configured hosts. All the IKE implementations I am aware of allow the useable IKE ports to be customized.
>
> I'm fine removing any mention of other specific ports, even in the appendix. However, the fact that configurations can choose what ports to use is something that needs to be left open. The point of the port registry is to allow devices to expect what service will be offered on a given port when they connect. If two peers mutually decide to share their own configuration, they can do that.
>
> Thanks,
> Tommy
>
>>
>> Mirja
>>
>>
>> _______________________________________________
>> IPsec mailing list
>> IPsec@ietf.org
>> https://www.ietf.org/mailman/listinfo/ipsec
>