Subject: [babel] minor DTLS comment

From: "STARK, BARBARA H" <[email-masked]>
Date: Fri, 4 Jan 2019 13:35:04 +0000

Since the DTLS draft is still open for comments, I do have a small one about how the UDP ports are characterized.
The IANA assigned ports are default values, and need to be portrayed as such. It's allowed (or should be) for deployed instances to use other values. This is pretty much true of all protocols. Certainly the base babel protocol allows other values to be used (which is why the homenet babel profile mandated use of 6696).

Maybe instead of
   All Babel over DTLS nodes MUST act as DTLS servers on the "babel-
   dtls" port (UDP port TBD), and MUST listen for traffic on the
   unencrypted "babel" port (UDP port 6696).

say
   All Babel over DTLS nodes MUST act as DTLS servers on the "babel-
   dtls" port, and MUST listen for traffic on the
   unencrypted "babel" port.
   The IANA-assigned values of 6696 for the "babel" port and 
   TBD for the "babel-dtls" port SHOULD be used.

Barbara

---

From: David Schinazi <[email-masked]>
Date: Fri, 4 Jan 2019 11:40:44 -0800

Thanks for your comment, Barbara. I agree with you, and have added the
following text:
https://github.com/jech/babel-drafts/commit/a5a372a942ebc7951b2847d88123d75ab8169f2f

Please let us know if you feel it addresses your comment.

Thanks,
David

On Fri, Jan 4, 2019 at 5:35 AM STARK, BARBARA H <[email-masked]> wrote:

> Since the DTLS draft is still open for comments, I do have a small one
> about how the UDP ports are characterized.
> The IANA assigned ports are default values, and need to be portrayed as
> such. It's allowed (or should be) for deployed instances to use other
> values. This is pretty much true of all protocols. Certainly the base babel
> protocol allows other values to be used (which is why the homenet babel
> profile mandated use of 6696).
>
> Maybe instead of
> _______________________________________________
> babel mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/babel
>

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Fri, 4 Jan 2019 20:07:11 +0000

Hmm.
" Babel over DTLS operates on a different port than unencrypted Babel.
All Babel over DTLS nodes MUST act as DTLS servers on a configured port, and
MUST listen for unencrypted Babel traffic on a distinct configured port.”

An implementation doesn’t have to allow for configuration of ports. They could just be hard-coded.
I don’t like that I need the context of the first sentence to understand unambiguously what the second port is “distinct” from (i.e., distinct from the unencrypted Babel port).

How about just “ Babel over DTLS MUST operate on a different port than unencrypted Babel.” ?

Barbara

From: David Schinazi <[email-masked]>
Sent: Friday, January 04, 2019 2:41 PM
To: STARK, BARBARA H <[email-masked]>
Cc: Babel at IETF <[email-masked]>
Subject: Re: [babel] minor DTLS comment

Thanks for your comment, Barbara. I agree with you, and have added the following text:
https://github.com/jech/babel-drafts/commit/a5a372a942ebc7951b2847d88123d75ab8169f2f<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_jech_babel-2Ddrafts_commit_a5a372a942ebc7951b2847d88123d75ab8169f2f&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=tF85S5lNHho1vtoAuYqSr4xNAqd3mDoVnWT0tzUcG_4&s=IA1V5LnHgwtrHGj7s01YpYCCbG-6Xz4xDnIq0Komyk8&e=>

Thanks,
David

On Fri, Jan 4, 2019 at 5:35 AM STARK, BARBARA H <[email-masked]<mailto:[email-masked]>> wrote:
Since the DTLS draft is still open for comments, I do have a small one about how the UDP ports are characterized.
The IANA assigned ports are default values, and need to be portrayed as such. It's allowed (or should be) for deployed instances to use other values. This is pretty much true of all protocols. Certainly the base babel protocol allows other values to be used (which is why the homenet babel profile mandated use of 6696).

Maybe instead of

say

Barbara

_______________________________________________
babel mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/babel<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_babel&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=tF85S5lNHho1vtoAuYqSr4xNAqd3mDoVnWT0tzUcG_4&s=0v3cnUWxKUHVYXDxGJMwdKfr19dC1bM7XLF5Y3azRH8&e=>

---

From: Dave Taht <[email-masked]>
Date: Fri, 4 Jan 2019 12:26:10 -0800

> How about just “ Babel over DTLS MUST operate on a different port than unencrypted Babel.” ?

Sure.

(I had proposed at one point that the dtls version operate over
udp_lite or even dccp, on the same port number, but have since
discovered osx doesn't support either)

-- 

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-205-9740

---

From: David Schinazi <[email-masked]>
Date: Mon, 7 Jan 2019 12:56:02 -0800

Thanks Barbara, how about this slightly more pedantic option?

Babel over DTLS operates on a different port than unencrypted Babel.
All Babel over DTLS nodes MUST act as DTLS servers on a DTLS port, and MUST
listen for unencrypted Babel traffic on an unencrypted port, which MUST be
distinct from the DTLS port.  The default port for Babel over DTLS is
registered with IANA as the "babel-dtls" port (UDP port TBD), and the
unencrypted port is registered as the "babel" port (UDP port 6696).
Nodes SHOULD use these default ports.

https://github.com/jech/babel-drafts/commit/c90cc8204691254e7051405acf6a10088d42cdfd

(Dave, running Babel over alternate transport protocols sounds like
interesting future work outside the scope of this draft)

Thanks,
David

On Fri, Jan 4, 2019 at 12:26 PM Dave Taht <[email-masked]> wrote:

> > I don’t like that I need the context of the first sentence to understand
> unambiguously what the second port is “distinct” from (i.e., distinct from
> the unencrypted Babel port).
> >
> >
> >

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Mon, 7 Jan 2019 20:57:48 +0000

WFM
Barbara

From: babel <[email-masked]> On Behalf Of David Schinazi
Sent: Monday, January 07, 2019 3:56 PM
To: Dave Taht <[email-masked]>
Cc: STARK, BARBARA H <[email-masked]>; Babel at IETF <[email-masked]>
Subject: Re: [babel] minor DTLS comment

https://github.com/jech/babel-drafts/commit/c90cc8204691254e7051405acf6a10088d42cdfd<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_jech_babel-2Ddrafts_commit_c90cc8204691254e7051405acf6a10088d42cdfd&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=TpHSwsdW292xnnT9CFhkZFwbPP5Qj8WM3Cp9NZVkyNQ&s=dmB9wDzFnjfwLmkHq-4xmMbD1HyQkbd0vyMJN-R2ap0&e=>

(Dave, running Babel over alternate transport protocols sounds like interesting future work outside the scope of this draft)

Thanks,
David

On Fri, Jan 4, 2019 at 12:26 PM Dave Taht <[email-masked]<mailto:[email-masked]>> wrote:

Sure.

>
> Barbara
>
>
>
> From: David Schinazi <[email-masked]<mailto:[email-masked]>>
> To: STARK, BARBARA H <[email-masked]<mailto:[email-masked]>>
> Cc: Babel at IETF <[email-masked]<mailto:[email-masked]>>
> https://github.com/jech/babel-drafts/commit/a5a372a942ebc7951b2847d88123d75ab8169f2f<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_jech_babel-2Ddrafts_commit_a5a372a942ebc7951b2847d88123d75ab8169f2f&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=TpHSwsdW292xnnT9CFhkZFwbPP5Qj8WM3Cp9NZVkyNQ&s=P1U-tt7OEd-QCmRudu3BDkSA7_fYNDQn8CviLqyMjuA&e=>
>
>
>
> https://www.ietf.org/mailman/listinfo/babel<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_babel&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=TpHSwsdW292xnnT9CFhkZFwbPP5Qj8WM3Cp9NZVkyNQ&s=LF-O3kvWyaujEUCJSiJHAF2H5kM2FhPNxAcf59J74Fw&e=>
>
> https://www.ietf.org/mailman/listinfo/babel<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_babel&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=TpHSwsdW292xnnT9CFhkZFwbPP5Qj8WM3Cp9NZVkyNQ&s=LF-O3kvWyaujEUCJSiJHAF2H5kM2FhPNxAcf59J74Fw&e=>

--

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.teklibre.com&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=TpHSwsdW292xnnT9CFhkZFwbPP5Qj8WM3Cp9NZVkyNQ&s=eDO08A7Z1JXYWbQa77-WahX5yDeV_QOXt3gDUV2bfCQ&e=>
Tel: 1-831-205-9740

---

From: Dave Taht <[email-masked]>
Date: Mon, 7 Jan 2019 13:43:22 -0800

> registered with IANA as the "babel-dtls" port (UDP port TBD), and the

in /etc/services it's:

http and https
smtpd and smtpds

etc.

"s" rather than -dtls?

> (Dave, running Babel over alternate transport protocols sounds like interesting future work outside the scope of this draft)

babeld has worked over udp-lite for me, for nearly a  decade now with
a 2 line patch. Not ever got around to testing osx til last week.
Seemed ideal to replace the crc
with a hmac. :(

but in light of the osx limitation, sadly request that YAUP, (Yet
Another UDP port) be requested from iana.

We still have some major congestion control issues to sort out. tcp/tls anyone?

/me hides

-- 

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-205-9740

---

From: David Schinazi <[email-masked]>
Date: Mon, 7 Jan 2019 13:47:33 -0800

> "s" rather than -dtls?

That implies that there's only one way to secure HTTP and SMTP.
We went with babel-dtls because there are multiple security mechanisms
for Babel. We might even want babel-quic one day, and that would get its
own port.

David