Subject: [Tsvwg] Fwd: WGLC for Port Randomization starts now (April 1st)

From: Lars Eggert <[email-masked]>
Date: Mon, 11 May 2009 18:43:03 +0300

Forwarded with permission. Discussion is at http://thread.gmane.org/gmane.linux.network/127652/focus=127679

Begin forwarded message:

> From: Stephen Hemminger <[email-masked]>
> Date: May 10, 2009 1:50:40 GMT+03:00
> To: "James M. Polk" <[email-masked]>,         "Eggert Lars (Nokia- 
> NRC/Espoo)" 	<[email-masked]>
> Subject: Re: WGLC for Port Randomization starts now (April 1st)
>
> One issue with port randomization which is not covered in the draft,  
> but
> just showed up as a surprise to a Linux user is that port  
> randomization
> increases the frequency of port reuse (see Birthday Paradox).  For  
> correctly
> behaving endpoints, this no problem. But in this user's case there  
> was some
> old firewall (non-conforming middlebox), that rejected the new  
> connections.
> It is another case of a new protocol change breaks assumptions made  
> by intermediate
> devices.
>
> --

---

From: "Anantha Ramaiah (ananth)" <[email-masked]>
Date: Mon, 11 May 2009 09:03:55 -0700

FWIW, the expired draft ( we were supposed re-submit it after collecting
data, but we haven't done that yet) 

http://ietfreport.isoc.org/all-ids/draft-ananth-tsvwg-timewait-00.txt

does talk about this "birthday paradox" issue. In particular it talks
about the issue which we observed on field after changing the port
allocation to random from sequential. (when the peer TCB was in the
TIMEWAIT state). The non-confirming middle boxes is another thing which
could cause side-effects, we had observed some cases in the past, but
can't re-collect the exact nature and symptoms.

-Anantha

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Lars Eggert
> Sent: Monday, May 11, 2009 8:43 AM
> To: tsvwg
> Cc: Stephen Hemminger
> Subject: [Tsvwg] Fwd: WGLC for Port Randomization starts now 
> (April 1st)
> 
> Forwarded with permission. Discussion is at 
> http://thread.gmane.org/gmane.linux.network/127652/focus=127679
> 
> Begin forwarded message:
> 
> > but just showed up as a surprise to a Linux user is that port 
> > randomization increases the frequency of port reuse (see Birthday 
> > Paradox).  For correctly behaving endpoints, this no 
> problem. But in 
> > this user's case there was some old firewall (non-conforming 
> > middlebox), that rejected the new connections.
> > It is another case of a new protocol change breaks 
> assumptions made by 
> > intermediate devices.
> >
> > --
> 
>

---

From: Fernando Gont <[email-masked]>
Date: Wed, 13 May 2009 17:25:27 -0300

Hello, folks,

>> One issue with port randomization which is not covered in the draft, but
>> just showed up as a surprise to a Linux user is that port randomization
>> behaving endpoints, this no problem. But in this user's case there was
>> some
>> It is another case of a new protocol change breaks assumptions made by
>> intermediate
>> devices.

IIRC, Linux implements the simple hash-based ephemeral port selection
algorithm described in Section 3.3.3 of our I-D.

It is unclear to me why you are encountering the problem you are
encountering, as from the pov of "port reuse", that algorithm has the
same properties as the traditional BSD port selection algorithm (i.e.,
incremental selection).

Could you elaborate this a bit more?

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Mark Allman <[email-masked]>
Date: Wed, 20 May 2009 09:13:37 -0400

> > Paradox).

Yes- but how is that not covered in the draft?  Clearly the draft talks
about this problem and cites a paper that investigates it.  Perhaps you
could be more specific about what you think the draft should say.

allman