Re: [port-srv-reg] "xmp" service type and the unified IANA Service Name and Port Number Registry

[Joe Touch <[e-mail]>]

On 8/25/2011 10:13 PM, Joe Hildebrand wrote:
> On 8/25/11 7:36 PM, "Joe Touch"<[e-mail]>  wrote:
>
>> Many other manufacturers deploy both OS's and network software without
>> Bonjour as well, and yet somehow apps keep running at the same
>> astonishing rate. Is that an indication we don't need SRV records either?
>
> I assume you're being a troll here, since I can't imagine that you don't
> realize that SRV is handy without Bonjour.

Sure, but you need to deploy something like Bonjour. I've been around 
that block a few times, and that's a substantial hurdle outside systems 
for which Bonjour is already installed (unless you want to sign Apple's 
licensing agreement and distribute Bonjour with your code, but that 
hurdle is unacceptable to many too).

To see just how many, take a look at the IANA port assignments, and look 
for UDP services named "-disc". All were asked to use SRV records, and 
all gave detailed reasons why that was not acceptable, most focusing on 
Bonjour licensing and the lack of a suitable alternative.

> In case that wasn't just a rhetorical flourish, look up the XMPP federation
> information for GoogleTalk:
>
> $ dig +short -t SRV _xmpp-server._tcp.gmail.com.
> 5 0 5269 xmpp-server.l.google.com.
> 20 0 5269 alt3.xmpp-server.l.google.com.
> 20 0 5269 alt4.xmpp-server.l.google.com.
> 20 0 5269 alt1.xmpp-server.l.google.com.
> 20 0 5269 alt2.xmpp-server.l.google.com.
>
> It's nice that they're running on a registered port (5269/tcp), so that
> people that want to do XMPP federation can open up a single outbound hole in
> their firewall -- but at no point did we need /etc/services.

Sure - because, *as I said*, you've replaced the /etc/services entries 
with an SRV lookup.

Why is this even in the lookup table, though? By Stuart's argument, 
everyone should be burning 5269 in their code.

>  If we used
> "xmpp-server" instead of 5269,

You just did, above...

> then Google wouldn't be *able* to run their
> servers on a port other than 5269, since 5269 would be set in stone on the
> connecting side, where the admin has no clue about how GoogleTalk needs to
> be deployed.

Services need to be on coordinated port numbers. There are many ways to 
do that coordination - one is SRV records, one is a common 
/etc/services, and one is to burn portions of /etc/services in code. 
However, if /etc/services were used inside an enterprise, the sysadmin 
should be able to move xmpp-services by rewriting that file - that can 
be used inside a common enterprise together with an edge NAT to shift 
services around.

This can be useful when services are shifted to other port numbers due 
to attacks that are based on port number values, FWIW. When it isn't 
defeated by poor coding.

Joe