Subject: [tsvwg] draft-ietf-tsvwg-port-use-03.txt

From: Gorry Fairhurst <[email-masked]>
Date: Thu, 27 Feb 2014 20:47:26 +0000

I have a few comments/questions on draft-ietf-tsvwg-port-use-03.txt, 
please see below.

Gorry

----

7.1:
-Is there a possibility to mention SIP in this section on using dynamic 
ports?

7.1:
- The bullet starting:
"Is this service independently useful"
the draft then talks immediately about an "entire group", maybe it 
requires a mention that the requested assignment may refer to one of a 
gout of related services?

7.2 bullet 2:
Second bullet does not have an example. Would the NPN mechanism in http 
serve as a suitable example of negotiating within a protocol or can 
something better be suggested?

7.4 para 1, 1st sentence:
The first introductory sentence is very broad and I can't quite work out 
what this means. Could you expand/rephrase?

7.4 last but one para:
/as we discussed/As discussed/
- this could be more consistent language?

7.5 para 1, 1st sentence:
/to support versioning/for services that support versioning/
- wording unclear?

7.6
/UDP services should be bandwith-limited/UDP services should be 
rate-limited [RFC5405]/

/UDP services should include congestion detection  ... /
Can we refer to [RFC5405]?

/UDP services should not be used ... /
Can we refer to [RFC5405]?

... I suspect all these protocol-related issues need to be related back 
to the BCP that defines how to use UDP or its successor in the BCP series.

References

- Reading this again, I suspect that the associated IANA guidance may 
actually be normative?
e.g. RFC2780 is BCP and RFC6335 may also be normative?

---

From: Joe Touch <[email-masked]>
Date: Thu, 27 Feb 2014 22:35:29 -0800

Hi, Gorry,

> -Is there a possibility to mention SIP in this section on using dynamic

Sure.

> gout of related services?

Yes; it was implied in the way the bullet is worded, but it'd be better 
to say that. However, it might be part of a group request or it might be 
a supplement to an existing service. Either way, the bullet point is 
relevant. I'll clarify that.

> something better be suggested?

It might be; I'm open to other suggestions. I do think it would be 
useful to include suggestions, though.

> what this means. Could you expand/rephrase?

The current is:

    Services represent a potential system vulnerability. Given the
    current state of cybersecurity in the Internet, we recommend that:

But it's really that:

    Just as a service is a way to obtain information or processing from
    a host over a network, an service can also be the opening through
    which to attack that host. ...

> /as we discussed/As discussed/

OK.

> - this could be more consistent language?

Not sure what you mean - a scrub of the document to avoid first-person 
is certainly needed. Was there anything else?

> /to support versioning/for services that support versioning/

Current text:

    Current IANA assignments are expected to support versioning
    [RFC6335].

Is this more clear?

     Current IANA assignments are expected to support the use of
     multiple versions on the same assigned port, typically through
     in-band indication of the service version [RFC6335].

> /UDP services should be bandwith-limited/UDP services should be

Yes.

> Can we refer to [RFC5405]?

Yes.

> Can we refer to [RFC5405]?

Yes.

> to the BCP that defines how to use UDP or its successor in the BCP series.

I think the ones you found are the only ones that relate back to how to 
use UDP. If you think there are others, please let me know.

> e.g. RFC2780 is BCP and RFC6335 may also be normative?

Yeah - I need to scrub the norm/inform list and correct a bunch of those.

I'll wait until after the IETF to do these updates, to see if anyone 
else has additional input or additional clarification.

Let me know if the above works.

Joe

---

From: [email-masked]
Date: Fri, 28 Feb 2014 08:11:55 -0000

This all seems good to me - thanks for the quick answer.

Gorry

> relevant. I'll clarify that.
OK

>     which to attack that host. ...
Aha, OK

> is certainly needed. Was there anything else?
No

>      in-band indication of the service version [RFC6335].
Works for me.

> use UDP. If you think there are others, please let me know.
I don't know of others

> Let me know if the above works.
Thanks,

Gorry