From nobody Tue Apr 13 02:09:06 2021 Return-Path: X-Original-To: ipv6@ietfa.amsl.com Delivered-To: ipv6@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDFDF3A0924; Tue, 13 Apr 2021 02:09:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 14SYeaXvY75a; Tue, 13 Apr 2021 02:08:59 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60067.outbound.protection.outlook.com [40.107.6.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F147E3A091F; Tue, 13 Apr 2021 02:08:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QxPLG3i2RHYnJSwWUz3IwONbkcmtBs5SnRBFCDUI5gGxGkrRLZeHiYMY0nzvikuusw3uKko6It1AgJFWZF+usg5YuRQ5Asng670ETaTduoEFW5B3rngkk10zX79wNoKazTHYFlKYruDVFZEWKo5HpEkzwHsIaWN7Q8wsbAbx74N59/7uFJJ3RbxE4uBvYIl4OPIbRmriF8lUmc9Um21PWif3hbnA+BMwLnCKTPD/ZkcKU3LUy22HXQUCnBdnVGISKNOoQuEZ4Sfr8S02VVHb4gixwRE7T8yePm68/qkUwddHw+wmjRmcByXaJVogV1FHSDRUlLPRHAKWqxWwtlfPtw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4tyiYzr5y5iNzT3tkg1tegbEdBqcjGjDpcfw2A+t1qM=; b=E70L8IDTe/aCKkoNE1rZocsZUU9I3S975w880XqwRR6Uw7i2rWVRl/KtpYmPIIed847KpORvtJ3Fw+5FHJLZfeBHNxxUks5FfCFRAZeqtc6Lmn8M98RsUDIlD4HaHKO1gTwEwdKTYXvAOHENXmMyAsLga0q9bVeXilFhF1rrL7JW8Xp1Xb5NT6rWd7u1VKyuZYayUHge6P/EZa1GX3nEQSIcuL/og/9b8PLjCFIEZp9hVTa0lN0/X59gcBwZsX+9WtnEmlwHF6pP4MP7V2D+Qf+4rjZKxTBOJz5XWdmAxzDfraHjfAyyfnoqMjLZm+hQrCHgjPjz4JY1iWb0Sd5ZpA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4tyiYzr5y5iNzT3tkg1tegbEdBqcjGjDpcfw2A+t1qM=; b=GMjaAEyy8bWb54OYqs5cMN56sX684D+tdMikC7MbZSsCj6YDgk3xTUrbuj5Wy9rhkZHLku/lRNqbaH3EvIIdJcgPFM2rt6qdAACyG72P6iwvzLShCfzcAm9v4ZCSXBnfJodyykLQ/TVGHUAZohLVbFfH8F7psbgXsfADKRLhh28= Received: from HE1PR0702MB3772.eurprd07.prod.outlook.com (2603:10a6:7:8e::14) by HE1PR0702MB3817.eurprd07.prod.outlook.com (2603:10a6:7:86::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4042.13; Tue, 13 Apr 2021 09:08:55 +0000 Received: from HE1PR0702MB3772.eurprd07.prod.outlook.com ([fe80::b08d:f37:b77b:2c8]) by HE1PR0702MB3772.eurprd07.prod.outlook.com ([fe80::b08d:f37:b77b:2c8%6]) with mapi id 15.20.4042.015; Tue, 13 Apr 2021 09:08:55 +0000 From: Magnus Westerlund To: "last-call@ietf.org" , "zali@cisco.com" CC: "ipv6@ietf.org" , "draft-ietf-6man-spring-srv6-oam@ietf.org" , "ot@cisco.com" , "tsv-art@ietf.org" , "6man-chairs@ietf.org" <6man-chairs@ietf.org> Subject: Re: Last Call: (Operations, Administration, and Maintenance (OAM) in Segment Routing Networks with IPv6 Data plane (SRv6)) to Proposed Standard Thread-Topic: Last Call: (Operations, Administration, and Maintenance (OAM) in Segment Routing Networks with IPv6 Data plane (SRv6)) to Proposed Standard Thread-Index: AQHXMEShutUealhv+USWTRFWaHT/Lg== Date: Tue, 13 Apr 2021 09:08:55 +0000 Message-ID: <64891067484420644656d3477887629399670c74.camel@ericsson.com> References: <161520275637.3336.12802912189924676386@ietfa.amsl.com> <6BA86039-B1F7-4F33-80BD-8073169B11E3@cisco.com> In-Reply-To: <6BA86039-B1F7-4F33-80BD-8073169B11E3@cisco.com> Accept-Language: sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Evolution 3.28.5-0ubuntu0.18.04.2 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [158.174.116.149] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 78dd85d9-7404-46f0-5a94-08d8fe5bc40f x-ms-traffictypediagnostic: HE1PR0702MB3817: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: GNuV/Rs8ynBdTt0tfxFVyYRIxaP4HNuv3GS7xMBA6yqEGdE+BbxZLbgBOkQlI3yH57K7GndGDOQImyDITyRUvTQx+McMFN+DnGUW1t5fuvis5rTEhXUJ62zhLYTtosNbTsY+q6HMcxjbrFmYtagVca4O74LkVwYiZeU0Jxcr3IgbGU3+vbNxCuVnNzzEl0uJI88kYzZkw1N+RJklXFJtVtQnxCdeF63ZobwrD/ZlfdnwttJFkkwCNHUjtXK09Y07ZWxG+Pz6FO4H/GYbAdARh+/FlXEbc1mD9CUxEiyKwkTrmvrMkGRiIdABS+vKQ6XTtjvP4Zn3rUhOwMNlqSd3Y5BTTVhs2zvhEGW7T4Wd1eBV1LZ9WjMXcHwqZL/oCMHm6GyPTAzKaVHj2fhIUs5mtfDzobZtt6M/bQd09xGaZJotU8AuZSlINCo5GlV04fJvIVSSsgbBQ8fTNq1ZMW+DKLC9Y3Cr2+RnwYOZ/69qcZXu84YH92uhgubfcSj9YPkj5qSA0Ai9HAnCTf9p9AFdCYE8zgHIsFDpcedjqB3Tnhj0a+T+7XyWFl4b7MWPbgmAvQIFXX+9RHVwNiHYT3gjiXzj1U7qHo2RQhQADOGS5qR4x1ep2Is8H0KNaP1mIdWs2widPdcCItl6Nad+n99vfaN4mSc4SYWYo3vTPvRnFDSW8/oV+7WT7xApD8L2sxlptCOu314vjDRp6+5qoPmbspBGc/gv8JNxRJnQt43Ny/bZKOZkDe1K48ca2V7HNl8Q x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR0702MB3772.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(366004)(346002)(376002)(396003)(136003)(5660300002)(2906002)(38100700002)(110136005)(6486002)(54906003)(53546011)(6506007)(8676002)(8936002)(26005)(122000001)(316002)(186003)(4326008)(76116006)(66446008)(966005)(6512007)(66574015)(478600001)(99936003)(66616009)(66946007)(66556008)(86362001)(66476007)(64756008)(2616005)(36756003)(83380400001)(44832011)(71200400001)(99106002)(554374003); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?RjR3ZUlGWHM0UkVZcm53Y2VaV1Joak1tcFpTbmFnTFZCcTVUQjB5dE5kS3N3?= =?utf-8?B?RlhNRzk3WnhvSlZMaVduVFZsMzUxcXlZZUthdnI1VHZqTFB5cTIzeS81YjBs?= =?utf-8?B?a01IWEpvaHFwemFyQW5mUFdOSDY3MENsMkhJREE1WjhPcDJUdE4rakNJVC9V?= =?utf-8?B?RGIrSzBESWRTME5yNlVmWk4wT0lHeXpOdTBOS3BlcHI5VitpQXdFZ0c4emFB?= =?utf-8?B?M05GV0pjVVdYamd3TjNSb1g0Y0JxK1FMZ1NiTzZZa1dlZjBxbG5seGQxb3BH?= =?utf-8?B?NDVxOEk1cXVaZVQ3eVdmTzdtZmtBSzNmLzUyRFlKUDFrc0YwNEo1Zkx4NURV?= =?utf-8?B?TkJrQ0VpdkN0bytEdXFtalIzVkRJM1BwZFVJbGxSVThHRTYvMU56RE1VdGdT?= =?utf-8?B?bFA4VjBSQkRlLzg1NmRZY0x3QnVSNDFoNXJncDNwZE1jVnF0NTZBNWlEekN6?= =?utf-8?B?VVdXbVZFR0lCS2hTZkp6MnZUSFhOUlV0eVErL0oyUXBPQ1dmOStOSW5kY2tH?= =?utf-8?B?cjlzQ3JsM0NNeUdwTTZsME5pd2FtN1hnV3luRzlVQkhLVkx1eDF2TnBMUVBR?= =?utf-8?B?b2dOVG95bVBsaGVoTk15dE9BUkliam9XWjJRMWJOcnNUczB3VjZsTCtRTnRm?= =?utf-8?B?am85Ums2aVFxT1dzVjRFQnVhR3ZvRXNSc1M0NTBKT1pBV3Bvd3M4VXp1R0FF?= =?utf-8?B?Sm0rbXJHWGVoRGl1d2F6aFhGUmpQR2w5S2NUMnNUVjViN3UrbFFGUGgzbWRN?= =?utf-8?B?UjZ2SkxCWlFqWGlydC9SazlWNXlEOERKTlluOUxLTDVYUTVUNHFWcmlpdkpt?= =?utf-8?B?MjBia25EVFpWOXpKZjVEL1hXREFkRjZPb2pSaEd5ZzA3WXNGbW1HYmhwd0VM?= =?utf-8?B?cHR0OHkwWFFraGQ5MW1kdG1KZnI1VVQzVHM0WkE5K3BlaWtTZmpTUkROeWlu?= =?utf-8?B?UXVqSHBaeXB5aFo4anc0OURFaGZjL28rSDZkakErVFM3S1Y1MFV3NVZOcFMz?= =?utf-8?B?VXQ0QnZUQm1RZnlUeG5jU3kyT0hhdTlHVGY0TXFSbFBGMDlzSTFkaWpqOEtn?= =?utf-8?B?ZnNhemhKNEVpajN6Y24rT3dmUjgzczl3T1hRbTJNaUlrWnhYQ293aDhVck5p?= =?utf-8?B?QjQxWnBodHgrSS9SYjV1MUFucHNBeEJQY2lhRlRJaTFBdDFMMVNNV3JoeVY3?= =?utf-8?B?bzhLV1VDY2pkTFNoNjE0ekt6R0ZlSXZ3ZmdnVmY1QmhvaFEwWWpkSmZDbld3?= =?utf-8?B?c2pqR1JNNVJqNFRtT3diYm05TDJtMDVHLzR1Q2VFWEt1NjBsNGwwVzJ2b0t1?= =?utf-8?B?clVmOFlBall4SkFxRmlITngxdUxXVEFlamRKT1g5WHIvWUY4SXA4T2dPWUJ5?= =?utf-8?B?cUZVdW50RDE2OTJPbkJxVUJnbnBKdHJ2RVZiUUo2MVlNbXRVVjljZGdVbllK?= =?utf-8?B?NzlpS3hQKzJieTVHOEpLMlB6Q2FpOGc2L3VkVWRaWFhmLzk0THRzK1RpRVA1?= =?utf-8?B?MElqTmcrZHp5QzhrdDJNT3Nsb1krQk5ESEZnR1FiVUZFQUZxeVR6bDF3SzBR?= =?utf-8?B?cE4rbWFIaWxtdkF3d0E1Z0doc2ExT0hRL3JHSXg5R1lib0tzY1ZEaXhRZmpP?= =?utf-8?B?aVZNa09KdkU0UjBVQUxSTGd3dThyVEtlbDYrcVFzNzFMZWNZR3lUVVNtYnFr?= =?utf-8?B?dy9GUDQvT2o2cDlnV1R0NG02VHFZbkR0T3JHMXNMcW1SbHFQdTBUcW5PYXZW?= =?utf-8?Q?UGyNGDBRTT/al9iXdaT0IdZgy+tHsaoqspntM9X?= x-ms-exchange-transport-forked: True Content-Type: multipart/signed; micalg="sha-256"; protocol="application/x-pkcs7-signature"; boundary="=-ZA1a6Gyv9p1MNwAKYiX7" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR0702MB3772.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 78dd85d9-7404-46f0-5a94-08d8fe5bc40f X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Apr 2021 09:08:55.6115 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: INycasSG7w3t34P2GF3nOHOQx/ZWkl5JM1n1q024NsjKTMv5Lt04yrW+jYA+T/NKtOldcCEIklHdw2gQE4W3Gw1k91R2T4XvYJNYNv0WlVA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3817 Archived-At: X-BeenThere: ipv6@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "IPv6 Maintenance Working Group \(6man\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Apr 2021 09:09:05 -0000 --=-ZA1a6Gyv9p1MNwAKYiX7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I have looked at the changes. I think they adress the issues I saw when reviewing.=20 Thanks Magnus On Fri, 2021-04-09 at 06:22 +0000, Zafar Ali (zali) wrote: > Hi Magnus, > =20 > Many thanks for your comments and detailed review. > =20 > We just posted version 10 to address your comments. > https://datatracker.ietf.org/doc/html/draft-ietf-6man-spring-srv6-oam-10 > =20 > Please see [ZA] in-line on how your comments are addressed. > =20 > Thanks > =20 > Regards =E2=80=A6 Zafar > =20 > From: Magnus Westerlund > Date: Tuesday, March 16, 2021 at 6:42 AM > To: "last-call@ietf.org" > Cc: "draft-ietf-6man-spring-srv6-oam@ietf.org" < > draft-ietf-6man-spring-srv6-oam@ietf.org>, "ot@cisco.com" ,= " > ipv6@ietf.org" , "6man-chairs@ietf.org" <6man-chairs@ietf.= org>, > "tsv-art@ietf.org" > Subject: RE: Last Call: (Operati= ons, > Administration, and Maintenance (OAM) in Segment Routing Networks with IP= v6 > Data plane (SRv6)) to Proposed Standard > Resent-From: > Resent-To: , , < > satoru.matsushima@g.softbank.co.jp>, , < > mach.chen@huawei.com> > Resent-Date: Tue, 16 Mar 2021 03:42:05 -0700 > =20 > This document has been reviewed as part of the transport area review team= 's > ongoing effort to review key IETF documents. These comments were written > primarily for the transport area directors, but are copied to the documen= t's > authors and WG to allow them to address any issues raised and also to the > IETF > discussion list for information. > =20 > When done at the time of IETF Last Call, the authors should consider this > review as part of the last-call comments they receive. Please always CC > tsv-art@ietf.org if you reply to or forward this review. > =20 > =20 > A) Section 2.1: > =20 > I first missed that "SRH.Flags" is intended as reference to the flags fie= ld > in the Segment Router Header. As this notation is prevalent through out t= he > document, could you be more explicit about this notation and also maybe b= e > clear on what a particular label represents. > =20 > [ZA] Updated text in the Section 2.1 to make it clear that the draft defi= nes a > flag in the Flags field of SRH [RFC8754]. > =20 > B) Section 2.1.1: > =20 > When N receives a packet whose IPv6 DA is S and S is a local SID, the > line S01 of the pseudo-code associated with the SID S, as defined in > section 4.3.1.1 of [RFC8754], is modified as follows for the O-flag > processing. > S01.1. IF SRH.Flags.O-flag is set and local configuration permits > O-flag processing THEN > a. Make a copy of the packet. > b. Send the copied packet, along with a timestamp > to the OAM process for telemetry data collection > and export. ;; Ref1 > =20 > I would note that this results in the following psudo code as it states > that it modifies line S01. > Did you intended an insert so that S01.1 would be between S01 and SO2? > =20 > [ZA] Yes, the S01.1 is inserted after between S01 and S02. Specific text > stating the same is added to the Section 2.1.1. > =20 > This > Psudeo code just lost its scoping to SRH. I would also note that it doesn= 't > match the style of what is in RFC 8754. For example a { } the steps a an= d b > should be present. Also with the modification in place you also have a > spurious } at the end. > =20 > [ZA] Added the RFC8754 style bracket { }. The added text has its own bloc= k of > brackets { }. With the comment that the line S01.1 is inserted after betw= een > S01 and S02, the modified pseudo-code is now well contained in its own bl= ock, > as follows:=20 > =20 > S01. When an SRH is processed { > S01.1. If O-flag is set and local configuration permits O-flag processi= ng { > a. Make a copy of the packet. > b. Send the copied packet, along with a timestamp > to the OAM process for telemetry data collection > and export. ;; Ref1 > } /* Matches S01.1 */ > S02. If Segments Left is equal to zero { =E2=80=A6 } > =E2=80=A6 > S26. } /* Matches S01 */ > =20 > S01.1. IF SRH.Flags.O-flag is set and local configuration permits > O-flag processing THEN > a. Make a copy of the packet. > b. Send the copied packet, along with a timestamp > to the OAM process for telemetry data collection > and export. ;; Ref1 > S02. If Segments Left is equal to zero { > S03. Proceed to process the next header in the packet, > whose type is identified by the Next Header field in > the routing header. > S04. } > S05. Else { > S06. If local configuration requires TLV processing { > S07. Perform TLV processing (see TLV Processing) > S08. } > S09. max_last_entry =3D ( Hdr Ext Len / 2 ) - 1 > S10. If ((Last Entry > max_last_entry) or > S11. (Segments Left is greater than (Last Entry+1)) { > S12. Send an ICMP Parameter Problem, Code 0, message to > the Source Address, pointing to the Segments Left > field, and discard the packet. > S13. } > S14. Else { > S15. Decrement Segments Left by 1. > S16. Copy Segment List[Segments Left] from the SRH to the > destination address of the IPv6 header. > S17. If the IPv6 Hop Limit is less than or equal to 1 { > S18. Send an ICMP Time Exceeded -- Hop Limit Exceeded in > Transit message to the Source Address and discard > the packet. > S19. } > S20. Else { > S21. Decrement the Hop Limit by 1 > S22. Resubmit the packet to the IPv6 module for transmission > to the new destination. > S23. } > S24. } > S25. } > S26. } > =20 > I would also note that if you wanted more generality you could replace a = and > b with > =20 > Execute the configured OAM process. E.g. if using IPFix that would be . > =20 > C) Section 2.1.1 > =20 > The processing node SHOULD rate-limit the number of packets punted to > the OAM process to avoid hitting any performance impact. > =20 > So this is protection against misconfiguration or an actual security brea= ch > isn't it. Because no entity outside of the domain should be able to set t= his > on packets. > =20 > [ZA] Indeed this is the case. We have updated the security section of the > draft addressing your comment. > =20 > So should this limit be configured by the management system or > baked into the implementation. > =20 > [ZA] The rate limit should be configured by the management system. Text h= as > been added to mandate the configurable rate limiting. > =20 > And in the later case, isn't the nodes > capability to handle marked packets dependent on the total load across al= l > packets processed at least in one processing pipe? > =20 > [ZA] An implementation may implement rate limit for O-flag independent of= any > other rate limits applied at the box for any other purposes. The packets = are > throttled before they reached the telemetry subsystem (or OAM process). > Section 2.1.1 text is updated to indicate the rate limit also needed to > protect the telemetry subsystem. > =20 > And to me it appears that > the limit will be dependent on what OAM Process that has been configured = to > be executed. Thus, how can this be robustly implemented so that it doesn'= t > interfere with the telemetry? Because if there are a mismatch between the= O > flag marking entity and the rate limiting, then the telemetry usefulness > could be compromised. Can you clarify the thoughts here? > =20 > [ZA] As these are sampled packets anyway (like in the case of IPFIX), the > controller is able to work with the subset of the packets reaching it (wh= en > the rate limit is effective). > =20 > D) Section 3.1 and 3.2: I have the impression that quite a lot hides behi= nd > the "The echo reply message is IP routed." or corresponding. First of all > there need to exist a return route for the source of the PING or Trace > route. > Secondly, as this is routed without SRV the packet can take a > different return route, and in case any firewall or other filtering is in > place the reply may not make it. Is this correctly interpret here? If > correctly understood I am uncertain if any changes are needed. > =20 > [ZA] The underlying assumption for ping/ tracing in IP network is that > responder has IP reachability back to the initiator. The drafts is relyin= g on > the IPv6 ping and traceroute capability. Also, [RFC8754] defines the noti= on of > an SR domain and use of SRH within the SR domain. [RFC8754] security sect= ion > provides security mechanisms to secure the SR domain. The use of ping/ > traceroute defined in this document is restricted to an SR domain. The > firewall or other filtering are typically performed outside the trusted S= R > domain. > =20 > Cheers > =20 > Magnus > =20 --=-ZA1a6Gyv9p1MNwAKYiX7 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCErYw ggX0MIID3KADAgECAg8BdlE9InYZOYLl1zGep4IwDQYJKoZIhvcNAQELBQAwRzELMAkGA1UEBhMC U0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmljc3NvbiBOTCBJbmRpdmlkdWFsIENB IHYzMB4XDTIwMTIxMTA5NTg0OVoXDTIzMTIxMjA5NTg0OVowXjERMA8GA1UECgwIRXJpY3Nzb24x GjAYBgNVBAMMEU1hZ251cyBXZXN0ZXJsdW5kMS0wKwYJKoZIhvcNAQkBFh5tYWdudXMud2VzdGVy bHVuZEBlcmljc3Nvbi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCIT6U9ddUp UCEryIA27xtF8WsRAIfc5jBavfu0OGDmwITYYRD2PaMEdEK+I4dqz0f6xcCrDnBk2Xj+JxjhaRkq TAifJZima9WE2JoI/uq8UsS2HJWlhspAwKx1osARgtRiMjRZZyyfiRZLbgXHWYpnTt3i9QsuX/uo 9oZFWpDCbZee4Il9uldsUcuBLZx2PyZvBvC8KCUaBXsZX6bwV7hssRVn+BgFCuEievJMx0khTRVh i9goObxu5Jl44RtwbZNYB1UE1IzRWEZw+b3cEvXiQjPl2e3ytMZSmhy+IaKmjxES6ODiuh51KAcm PZfZIaX2djmD76YGi+ETmnb8Xm3dAgMBAAGjggHEMIIBwDAfBgNVHSMEGDAWgBQcexmel5x2rCA9 2NzjkWrj2y2mUzAdBgNVHQ4EFgQUICO/88T0EQvEUm5+HVt/d9Mm+Z8wDgYDVR0PAQH/BAQDAgWg MFUGA1UdIAROMEwwSgYMKwYBBAGCDwIDAQESMDowOAYIKwYBBQUHAgEWLGh0dHBzOi8vcmVwb3Np dG9yeS50cnVzdC50ZWxpYXNvbmVyYS5jb20vQ1BTMCkGA1UdEQQiMCCBHm1hZ251cy53ZXN0ZXJs dW5kQGVyaWNzc29uLmNvbTBIBgNVHR8EQTA/MD2gO6A5hjdodHRwOi8vY3JsLnRydXN0LnRlbGlh LmNvbS9lcmljc3Nvbm5saW5kaXZpZHVhbGNhdjMuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggr BgEFBQcDAjCBggYIKwYBBQUHAQEEdjB0MCgGCCsGAQUFBzABhhxodHRwOi8vb2NzcDIudHJ1c3Qu dGVsaWEuY29tMEgGCCsGAQUFBzAChjxodHRwOi8vY2EudHJ1c3QudGVsaWFzb25lcmEuY29tL2Vy aWNzc29ubmxpbmRpdmlkdWFsY2F2My5jZXIwDQYJKoZIhvcNAQELBQADggIBANRZXQy+lUW97uaL uApOixnDKLpUoz+N/5Owd/9illmbxQDEY1/pPs4KJSvw88p+F3bmOzb+fLUNa6Mi/2Tw83FzEVmO 3RqzKtca+I9GDpRQ8oWL7hrUPJoNacidSZLmAP4L4kwHIhvGNX4f1c/oB4fAkP/xZsAAxYi7nKxd XA2n/KMWNkezyB9BSsD8ZOS4pWU8UaZjd5r0fzqM5zQbU4EPqHa8jFMSMz1UrYXPKKxl6E4WA3TE w1oLjcli0NWGQHyQ+3Kh7fe6zPoXfLd/2EQjr2o76ssgoqd2V1Mx5TRHdUyxjIMPEOVYpvcerNUB hEBkaOQ9FugYcMhMc8BF7nQZq+hsL/T7idg4gE2sEfNdK9RBf/EVH10GMrmbadqTycztD1gUL3dV Qxik4TCMxIctt9XqtTGHaMewZLQAXp/sHWlU/vmz9brcuzYQ9YVd5hTendGMUyGhWPV/KvxouKPK zdrGeEqUQCeBwWgQASQNOrpTzMJwZAV/Ww3ExQCjHvflvUQzVuU0sC6AEVkgqMATIXS6h6rjLL31 pjt2JV84XRjF5afYkcRIHTsrtcoWeFtOu/GpZNhtq+tde0QvnkSsjczMWU0gKk0hXBmXwEGUimuD Vq/Wvr0mr18d9mKA6xPNQOfn/VL5CWXa11OtOjj8WsTy3XUpyJ6dc9Z72TmKMIIF9DCCA9ygAwIB AgIPAXZRPSJ2GTmC5dcxnqeCMA0GCSqGSIb3DQEBCwUAMEcxCzAJBgNVBAYTAlNFMREwDwYDVQQK DAhFcmljc3NvbjElMCMGA1UEAwwcRXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBDQSB2MzAeFw0yMDEy MTEwOTU4NDlaFw0yMzEyMTIwOTU4NDlaMF4xETAPBgNVBAoMCEVyaWNzc29uMRowGAYDVQQDDBFN YWdudXMgV2VzdGVybHVuZDEtMCsGCSqGSIb3DQEJARYebWFnbnVzLndlc3Rlcmx1bmRAZXJpY3Nz b24uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiE+lPXXVKVAhK8iANu8bRfFr EQCH3OYwWr37tDhg5sCE2GEQ9j2jBHRCviOHas9H+sXAqw5wZNl4/icY4WkZKkwInyWYpmvVhNia CP7qvFLEthyVpYbKQMCsdaLAEYLUYjI0WWcsn4kWS24Fx1mKZ07d4vULLl/7qPaGRVqQwm2XnuCJ fbpXbFHLgS2cdj8mbwbwvCglGgV7GV+m8Fe4bLEVZ/gYBQrhInryTMdJIU0VYYvYKDm8buSZeOEb cG2TWAdVBNSM0VhGcPm93BL14kIz5dnt8rTGUpocviGipo8REujg4roedSgHJj2X2SGl9nY5g++m BovhE5p2/F5t3QIDAQABo4IBxDCCAcAwHwYDVR0jBBgwFoAUHHsZnpecdqwgPdjc45Fq49stplMw HQYDVR0OBBYEFCAjv/PE9BELxFJufh1bf3fTJvmfMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBM MEoGDCsGAQQBgg8CAwEBEjA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3Qu dGVsaWFzb25lcmEuY29tL0NQUzApBgNVHREEIjAggR5tYWdudXMud2VzdGVybHVuZEBlcmljc3Nv bi5jb20wSAYDVR0fBEEwPzA9oDugOYY3aHR0cDovL2NybC50cnVzdC50ZWxpYS5jb20vZXJpY3Nz b25ubGluZGl2aWR1YWxjYXYzLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwgYIG CCsGAQUFBwEBBHYwdDAoBggrBgEFBQcwAYYcaHR0cDovL29jc3AyLnRydXN0LnRlbGlhLmNvbTBI BggrBgEFBQcwAoY8aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS9lcmljc3Nvbm5saW5k aXZpZHVhbGNhdjMuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQDUWV0MvpVFve7mi7gKTosZwyi6VKM/ jf+TsHf/YpZZm8UAxGNf6T7OCiUr8PPKfhd25js2/ny1DWujIv9k8PNxcxFZjt0asyrXGviPRg6U UPKFi+4a1DyaDWnInUmS5gD+C+JMByIbxjV+H9XP6AeHwJD/8WbAAMWIu5ysXVwNp/yjFjZHs8gf QUrA/GTkuKVlPFGmY3ea9H86jOc0G1OBD6h2vIxTEjM9VK2FzyisZehOFgN0xMNaC43JYtDVhkB8 kPtyoe33usz6F3y3f9hEI69qO+rLIKKndldTMeU0R3VMsYyDDxDlWKb3HqzVAYRAZGjkPRboGHDI THPARe50GavobC/0+4nYOIBNrBHzXSvUQX/xFR9dBjK5m2nak8nM7Q9YFC93VUMYpOEwjMSHLbfV 6rUxh2jHsGS0AF6f7B1pVP75s/W63Ls2EPWFXeYU3p3RjFMhoVj1fyr8aLijys3axnhKlEAngcFo EAEkDTq6U8zCcGQFf1sNxMUAox735b1EM1blNLAugBFZIKjAEyF0uoeq4yy99aY7diVfOF0YxeWn 2JHESB07K7XKFnhbTrvxqWTYbavrXXtEL55ErI3MzFlNICpNIVwZl8BBlIprg1av1r69Jq9fHfZi gOsTzUDn5/1S+Qll2tdTrTo4/FrE8t11KcienXPWe9k5ijCCBsIwggSqoAMCAQICEFO4foPhnJko k7CbSRzsuOswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UECgwLVGVsaWFTb25lcmExHzAdBgNVBAMM FlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTUxMDI3MTIxNjQ2WhcNMjUxMDI3MTIxNjQ2WjBH MQswCQYDVQQGEwJTRTERMA8GA1UECgwIRXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNzc29uIE5MIElu ZGl2aWR1YWwgQ0EgdjMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDs8t8AALhQ8qe7 2FS3xpP348GqO9TDRjS0s85eQ7Y0LTLZdmSz2cl+lYqs0zfSTm+7meisbhkqUXkL7fFzoe4iIZCh /VuYUaW407CZlDCXes4n4TqTSuoklN6uOPhY7EC9ZVbXILlLhRummTdDdxhVW4Leo0awEhfLf98M vWxzwCHzMj8m6YOmNjx+f9TcJE3qaA0piuvSxlfpVdiCulPTlmsmV2RSBSAwqBshZYRcQBIDfqmd vkaoP9EzNKAh7yjthC0hpgHZyZMIs0eNo4v2PUmE0rhu+Zs0nujnwhljPA2/8b8v9tGixD1zbtT7 zoM2Ot1menJpFp4zJVSfdKVgtoWqg5t2H/E0XY1LwJez89W07nscEocyBmpC+zJAmKxKhzEWqIyP 1UrZaEIFu+hO+s0Nm8sOUMa4TlG4rAUikc5U5TmUIGBRQGxulYhfAzqSYf8oLUMLky1DOa9eRu3s p0FdQDEzQlnF/h1L4AK1MOkX1vS+fLgOvBo5LRU1fLPUZQ7FKrDXC6nl2ldvEtljHWstGBmqv25a EvAA+yrrplCh/kYvSBjvZibz9Obbwx4yqS77/NHN1iyZyVP2s52B2BLdvo4yhzk6nRk8S/8zHaUU kBUrrvijPDaGK5FNVSaioGvkC7IKioITKffYLtT9XuirKrHlh3VzkazG46pAVwIDAQABo4IBuDCC AbQwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1c3QudGVsaWFz b25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVzdC50ZWxpYXNvbmVy YS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgwBgEB/wIBADBVBgNVHSAE TjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1 c3QudGVsaWFzb25lcmEuY29tL0NQUzBLBgNVHR8ERDBCMECgPqA8hjpodHRwOi8vY3JsLTMudHJ1 c3QudGVsaWFzb25lcmEuY29tL3RlbGlhc29uZXJhcm9vdGNhdjEuY3JsMB0GA1UdJQQWMBQGCCsG AQUFBwMCBggrBgEFBQcDBDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFBx7GZ6XnHasID3Y3OOR auPbLaZTMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0GCSqGSIb3DQEBCwUAA4IC AQBQWGvx1Yw7tC6rV0PIjKfDyxaanIX+NZLEGOkdQLKGW2gVLtDUJQEPRs5QtaZiObNHCZ7mmSNM Vek4lkt/0dqfVIFutVw/QkyFGwC99ZmNwXSX9z+OoMyoEBHGvw5RY6vRlZrj0uKvdASzYL4KMaB7 m3NwurNDmmNbG52suRIZ76wBOEOddRZcZiTy50ZkBqYnnl2t3D3oBX2NZCQysshUcqRdUbkS13HT CIChMuTV9W0tzPXUOJoJlJlU9nd91IikhGEOrPwfixWms+C8sF0r9qN1uJGx6ELPOiFrLfNtcMNM MbAqRHwpSLxe3wcNkJGxv9T8LswLi1UrRIQ85AKjqzBnLSsjRGgbMgJ+xKtngmvEA155JmoKfUD7 DRbP6Kp14/Y9XFbR/WuDj84bYNKXe4HdDc1P+UMYm16m2L6LkIIoRlx0A5mi+K7jewuGqzFKkaPN mJ0RLCi+4d4/47Zs3DC3PUNOxdOEEHf4kkdWOaSIuj3TQYhNv+LsgF0uijiBmaz2zUFDa2bcIkKa kDZfAFM4HoHz8K2BZRaHKWhd3dZua/tlSiqokUFX2DxmHmZ1n5HM9OiaAIXP/Zo2x10j/Yb1mM3i 0bqGahxlHYzl/QyEG/dujp3lewuVjCI0mPDkZGphvxyqp4Jo8qS94EnOqBvxOgftYug7OY9EKY+W kDGCAsowggLGAgEBMFowRzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQD DBxFcmljc3NvbiBOTCBJbmRpdmlkdWFsIENBIHYzAg8BdlE9InYZOYLl1zGep4IwDQYJYIZIAWUD BAIBBQCgggFBMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIxMDQx MzA5MDg1MVowLwYJKoZIhvcNAQkEMSIEIEgFhz0Ienl2dBKxz360DzDjwT31KPU9CHvtmpjK/40H MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYD VQQDDBxFcmljc3NvbiBOTCBJbmRpdmlkdWFsIENBIHYzAg8BdlE9InYZOYLl1zGep4IwawYLKoZI hvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMREwDwYDVQQKDAhFcmljc3NvbjElMCMGA1UEAwwc RXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBDQSB2MwIPAXZRPSJ2GTmC5dcxnqeCMA0GCSqGSIb3DQEB AQUABIIBAARjh5qIqYFIL80iYb5ve3DiOReRObLnTLW3rFIw2Q9BEOkNajgqxfoRbYcMVpsfdiAQ +83sv72LzoFbn/OsIezCd3bREiKkHQkKVpIOjXlg2nUVRGpyhnJxYneuAvO7sYCcwL5D5kaTQXmf +YIoP9XdxT+08FsecKrkrMbaPRn/Ue4T8ZjdktDjkBCga/GdnlkT8reIZ+tkHPOcd3xg7hovDK9m /RUq2jNLua3PoWiJRXn2cN5DWH7LpD5QwxSSertUeD1oLW1Mb4XVBP/M4pwybLj6QjfcwTrBJwfO WAOaBsI2oEtzoLahIXSlXwUpBheRM6z1lj153fnS/6aAouUAAAAAAAA= --=-ZA1a6Gyv9p1MNwAKYiX7--