Subject: Re: Reminder: WGLC Announcement for draft-ietf-tsvwg-iana-ports-08 - 26th November 2010

From: Magnus Westerlund <[email-masked]>
Date: Wed, 1 Dec 2010 10:01:56 +0100

WG, Paul and Eliot,

I will respond in detail. However, I do need to do a bit of history
digging and and go review the fairly big discussion that was held on the
[email-masked] list back in 2006 that was started by Eliot Lear.

The threads of relevance appears to be:
https://www.ietf.org/ibin/c5i?mid=6&rid=49&gid=0&k1=933&k2=30752&tid=1291193700

https://www.ietf.org/ibin/c5i?mid=6&rid=49&gid=0&k1=933&k2=31742&tid=1291193820

Elliot's individual draft:
http://tools.ietf.org/html/draft-lear-iana-no-more-well-known-ports-02

Maybe Eliot can summarize what was the reason his effort failed to gain
sufficient traction to be published?

Cheers

Magnus

Paul Hoffman skrev 2010-11-24 17:27:
> At 5:17 PM +0100 11/24/10, Magnus Westerlund wrote:
>> Paul Hoffman skrev 2010-11-22 23:14:
>>> In general, this document seems fairly worthwhile. I have a two reservations, however:
>>>
>>> - There is no justification for retaining the differentiation between System Ports and User Ports. Given the wide disparity in assignment rates, I would have thought that this would be a good time to say "there is no longer a difference". The text in 8.1 doesn't explain the difference in a way I could discern. At a minimum, this needs to be covered in much more detail in sections 7.1 and 7.2.
>>
>> My personal view is that I agree that there really are no significant
>> difference between the two ranges. There has traditionally been a
>> perceived difference between the two ranges.
> 
> That is only because *we* said there was a difference.
> 
>> Also, isn't there still
>> some difference in what rights are needed on a number of unix systems to
>> install a listener?
> 
> Not in any sane system, no.
> 
>> So I think the difference is in peoples heads. The
>> registration rules do require you to clearly motivate why you should be
>> given a port in the system range.
>>
>> In chapter 6, there is the following text:
>>
>>    Such confirmation of intended use is
>>    especially important when these ports are associated with privileged
>>    (e.g., system or administrator) processes.
>>
>>
>> For the difference in allocation rates there is a reason why there such
>> a low rate for "System" ports, and that is due to the high bar that
>> already is set by the port expert reviewers.
>>
>> We are trying to focus on getting the new registry and its structure in
>> place. Rather than changing all details, like if the system port range
>> should be removed. There was previous discussion on this in IETF without
>> any consensus so we haven't been interested in driving this.
> 
> If not now, while the registry is open, when?
> 
>> I think removing the system ports range is beyond our intentions with
>> this document. Secondly, we can try to clarify the difference between
>> system and registered range.
> 
> In the IETF, tomorrow's tomorrow is never.

-- 

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: [email-masked]
----------------------------------------------------------------------

---

From: Lars Eggert <[email-masked]>
Date: Wed, 1 Dec 2010 11:21:19 +0200

Hi,

> [email-masked] list back in 2006 that was started by Eliot Lear.

what I remember is that the proposal to eliminate the difference between the ports ranges didn't get traction then. Consequently, they remained in iana-ports, but the bar for system ports is higher.

Frankly, I don't want to delay iana-ports for yet another attempt to get consensus for this change. We should publish it now.

*If* at some point in the future there is consensus to eliminate the difference, I hereby volunteer to do a bis version to iana-ports that will document this change.

Lars (wearing an "author" hat)

---

From: Gorry Fairhurst <[email-masked]>
Date: Wed, 01 Dec 2010 09:30:52 +0000

To me (this time wearing a Chair hat) this sounds very attractive.

I'd be keen to see the work we set out to do published soon - I do not 
see problems in the WG returning to work on more things to do with ports.

Gorry

---

From: Eliot Lear <[email-masked]>
Date: Wed, 01 Dec 2010 11:36:26 +0100

Magnus,

There were only two issues with that draft:

1.  I mangled a few issues together (like how to keep port assignments
current, and the value of SRV records);
2.  I ran out of time to do the work at that time.

I would be happy to revive a simpler draft but I think it's better that
you just deal with the matter now, so that we don't have to go through
multiple iterations of this.

As I recall, though, nobody really had a problem with dropping the
distinction.  It's only there in some UNIX flavors; and the only real
issue is on multi-user systems where the port could conceivably be
grabbed by someone.  Realistically, that's not a concern because if it's
important, there is something listening from start-up.

Eliot

---

From: Lars Eggert <[email-masked]>
Date: Wed, 1 Dec 2010 13:05:51 +0200

Hi,

> important, there is something listening from start-up.

"only some Unix flavors" is severely understating the issue. I just tried MacOS, FreeBSD and Ubuntu Linux, and none of them let user process bind to ports below 1024.

I agree with you that the reasons for having separate port ranges are bogus, but the *reality* is that it *matters* whether your port is above or below 1024 on many deployed systems. And hence it matters for applicants what number they get.

Lars

---

From: Eliot Lear <[email-masked]>
Date: Wed, 01 Dec 2010 13:50:18 +0100

> "only some Unix flavors" is severely understating the issue. I just tried MacOS, FreeBSD and Ubuntu Linux, and none of them let user process bind to ports below 1024.

There are other varients that have either done away with the distinction
or provided a richer port interface.
> I agree with you that the reasons for having separate port ranges are bogus, but the *reality* is that it *matters* whether your port is above or below 1024 on many deployed systems. And hence it m…

No it doesn't.  The nature of computing today is such that the
distinction is lost because most so-called privileged processes are
running either on single user machines where the user is the
administrator, or on servers where this sort of thing is coordinated.

The rule dates back to the days where one could expect 40 - 60 users on
a system.

Eliot

---

From: Lars Eggert <[email-masked]>
Date: Wed, 1 Dec 2010 15:18:46 +0200

Hi,

> administrator, or on servers where this sort of thing is coordinated.

On the platforms that require admin rights to bind to ports less then 1024, it certainly matters. A user running such an app somehow needs to know to run it with root privileges. These platforms are not rare.

So even if we removed the boundary and said that the registered ports go from 1-49151, we would *still* need to treat the 1-1024 range differently. Handing out ports < 1024 to arbitrary requests will cause issues, when such apps gets deployed on platforms that require admin rights to bind to them. 

I agree that the distinction didn't make sense and doesn't make sense, but enough platforms act differently depending on what range your port falls into that we can't simply pretend the ranges are identical. They're not. Even if we don't like it.

So the iana-ports document does what at least the authors considered to be the practical way forward: the 0-1023 range requires "IETF Review" or "IESG Approval". Effectively, this means that you cannot get those ports anymore without the IETF OK'ing it. Essentially, this means we're moving everyone into the 1024-49151 range.

Do I believe that the IETF should make a statement that implementations should stop requiring admin rights for the 0-1023 range? Sure. But the iana-ports document is not the place for that statement.

Lars

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 1 Dec 2010 07:07:29 -0800

>"only some Unix flavors" is severely understating the issue. I just tried MacOS, FreeBSD and Ubuntu Linux, and none of them let user process bind to ports below 1024.

<sigh> Good enough for me. Drop the issue, and let's bring it up separately, if at all.

--Paul Hoffman, Director
--VPN Consortium

---

From: "t.petch" <[email-masked]>
Date: Fri, 3 Dec 2010 15:44:09 +0100

----- Original Message -----
From: "Eliot Lear" <[email-masked]>
To: "Lars Eggert" <[email-masked]>
Cc: "Magnus Westerlund" <[email-masked]>; "Paul Hoffman"
<[email-masked]>; "tsvwg WG" <[email-masked]>
Sent: Wednesday, December 01, 2010 1:50 PM
> > "only some Unix flavors" is severely understating the issue. I just tried
MacOS, FreeBSD and Ubuntu Linux, and none of them let user process bind to ports
below 1024.
> > I agree with you that the reasons for having separate port ranges are bogus,
but the *reality* is that it *matters* whether your port is above or below 1024
on many deployed systems. And hence it matters for applicants what number they
get.

Eliot

I think that this is a misunderstanding of how single user machines are used.

I have used many such, but am rarely, if ever, logged on with administrator
privileges; yes such a user exists, but its use is tightly controlled, as for
example when using a privileged port to download software updates.  What I can
do, as the average user, is strictly limited and does not include privileged
ports (of course, most such usage is Windows, and Windows has far more
sophisticated access control, so port usage is not something that is directly
visible).

Tom Petch

---

From: Randy Stewart <[email-masked]>
Date: Fri, 3 Dec 2010 09:04:19 -0800

> MacOS, FreeBSD and Ubuntu Linux, and none of them let user process bind to ports

Well you can, if you are root.. go to super-user and you will find at
least FreeBSD and Linux will allow it.. I think MacOS will to but you
have to do

sudo bash

and then run your program since MocOS generally does not let
you do su itself...

R
-----
Randall Stewart
[email-masked]

---

From: [email-masked]
Date: Wed, 1 Dec 2010 07:05:58 -0500

> I agree with you that the reasons for having separate port ranges are bogus, but the *reality* is that it *matters* whether your port is above or below 1024 on many deployed systems. And hence it m…

I would argue that at this point the 1024 boundary is now a de facto standard.  I could
not find a compelling reason in the draft for changing it. If there is one it would be great if someone could point it out to me.

Best,
George