Subject: [babel] Babel over DTLS and UDP ports

From: David Schinazi <[email-masked]>
Date: Thu, 30 May 2019 18:11:13 +0200

Hi Babel enthusiasts,

As currently documented
<https://tools.ietf.org/html/draft-ietf-babel-dtls-04>, Babel over DTLS
uses two UDP listening ports:
- 6696 for regular unencrypted Babel packets
- a separate port (number TBD) for Babel-over-DTLS packets

When the authors requested the new port from IANA, we received some
pushback. The position of the IANA port expert was that UDP ports are a
scarce resource and they strongly prefer to not allocate them unless it is
necessary. So the question for the Babel WG is: is the separate port
necessary?

One possible solution could be for us to have unencrypted packets and DTLS
packets share the same port. For that we can leverage the fact that all
Babel packets start with a first byte set to 42, and say that DTLS packets
use the same port, prefixed with 43 instead of 42.

What are people's thoughts? In particular, if you have an implementation of
Babel over DTLS (or if you are considering building one), do you think the
proposal above could be fit into your implementation?

Thanks,
David

---

From: Dave Taht <[email-masked]>
Date: Thu, 30 May 2019 09:17:38 -0700

On Thu, May 30, 2019 at 9:11 AM David Schinazi <[email-masked]> wrote:
>
> Hi Babel enthusiasts,
>
> As currently documented, Babel over DTLS uses two UDP listening ports:
> When the authors requested the new port from IANA, we received some pushback. The position of the IANA port expert was that UDP ports are a scarce resource and they strongly prefer to not allocate them unless it is necessary. So the question for the Babel WG is: is the separate port necessary?
>
> One possible solution could be for us to have unencrypted packets and DTLS packets share the same port. For that we can leverage the fact that all Babel packets start with a first byte set to 42, and say that DTLS packets use the same port, prefixed with 43 instead of 42.

So that is in the clear?

>
> What are people's thoughts? In particular, if you have an implementation of Babel over DTLS (or if you are considering building one), do you think the proposal above could be fit into your implementation?

I rather liked it over udp-lite.

>
> Thanks,
> David
> _______________________________________________
> babel mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/babel

-- 

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-205-9740

---

From: Juliusz Chroboczek <[email-masked]>
Date: Fri, 31 May 2019 15:14:03 +0200

> When the authors requested the new port from IANA, we received some pushback.
> The position of the IANA port expert was that UDP ports are a scarce resource
> and they strongly prefer to not allocate them unless it is necessary.

In a healthy technical organisation, the administration helps the
technical folks get their stuff done.  An organisation is ossified if the
bureaucacy feels they have the right to dictate the technical solutions.

If there are technical reasons to use a single port, we should state them.
Under no circumstances should we agree to change our protocol in order to
make the bureaucrats happy.

> So the question for the Babel WG is: is the separate port necessary?

Antonin's original implementation implementation used a single port:

  https://datatracker.ietf.org/meeting/101/materials/slides-101-babel-babel-over-dtls-00

> packets share the same port. For that we can leverage the fact that all Babel
> packets start with a first byte set to 42, and say that DTLS packets use the
> same port, prefixed with 43 instead of 42.

Yes, that's what I was arguing for back in 2018.  However, I was put in
the minority by a number of wise people:

  - David argued that the whole point of DTLS is to use a standard DTLS
    stack, and some DTLS stacks don't support using a single port for both
    encrypted an cleartext traffic;
  - David pointed out that Apple's DTLS implementation doesn't support
    this mode of operation;
  - Donald added that it is usual for IETF protocols to use separate ports.

If the above points no longer stand, then please explain what has changed
since 2018.

If these points still stand, then it is our duty to make the right
technical decision, IANA's impotence notwithstanding.  We have a number of
options:

  - go speak with IANA again, stating clearly that using distinct ports
    reflects WG consensus;
  - should that fail, we could use an ephemeral port for DTLS, announce it
    as a sub-TLV of multicast Hello (recall that DTLS uses unicast only);
  - should that be considered to fragile, we can publish the draft with no
    port assignment, and have implementations squat an unallocated port.

> What are people's thoughts?

None that can be expressed without profanity.

(Please have a look at the IANA UDP port registry -- thousands of ports
have been allocated to completely undocumented obscure protocols, and
they're refusing to allocate a single port for a standards track document?)

-- Juliusz

---

From: David Schinazi <[email-masked]>
Date: Fri, 31 May 2019 15:25:17 +0200

Hi Juliusz,

Thanks for your passionate response :-)

To clarify my earlier email, the IANA port expert gave their opinion, and
I've been made aware that as expert they provide knowledgeable opinions but
do not hold power over the final outcome.
The powers that be wanted there to be a new conversation on the Babel
mailing list about the pros and cons of using a new port, given the
expert's opinion.
If it is still the consensus of the Babel WG that allocation of a new port
is critical to some implementations and will facilitate deployment of a
secure version of the protocol, and the IESG agrees that this consensus was
reached, then once the IESG moves the document forward the IANA
considerations section will apply and a new port will be allocated.

Now, speaking as implementor of Babel (as opposed to draft author), I
strongly believe that a new port will make a difference in the success of
this protocol. Juliusz phrased the reasons why quite well.

Thanks,
David

On Fri, May 31, 2019 at 3:14 PM Juliusz Chroboczek <[email-masked]> wrote:

> pushback.
> Babel