Return-Path: X-Original-To: ipv6@ietfa.amsl.com Delivered-To: ipv6@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 584ACC16941F; Fri, 13 Dec 2024 03:06:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.855 X-Spam-Level: X-Spam-Status: No, score=-1.855 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SmviG8poKX5i; Fri, 13 Dec 2024 03:06:00 -0800 (PST) Received: from mail-pl1-x629.google.com (mail-pl1-x629.google.com [IPv6:2607:f8b0:4864:20::629]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66470C1516EB; Fri, 13 Dec 2024 03:06:00 -0800 (PST) Received: by mail-pl1-x629.google.com with SMTP id d9443c01a7336-2166651f752so17107335ad.3; Fri, 13 Dec 2024 03:06:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1734087959; x=1734692759; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=bj1zG2JUtD4cao4U+a5igu8ymtrnDkKuO8nfC2nNVCM=; b=W2lq/O77/Uw9m4gB77ZxIyDFqqgWw2eoreEpOLxDzx1N0Y09/f1I5v3Yds7EI0Almy gXWrhbc1T2Ua44wjYLFryIh+Tw2qMtvpRH7J/RjyzFYwiUvkfR2h1KKHIOeG30bP96dq 5YzDlVDHnm2qJ/ABDcCwJc8r39uKLotAPSSdLit9EcLidioMuOmKaFVcXhQjJ942MfMA kq618+SnC13J935Rla4tirl4wJhhnaCzmlIa1fp3nGpW+fvzRYRzuvGRQq4QMBnlDaaG XM2SkyRYR+A+4czxEyXW/k8Gv7k2PamBOaCdn8dptu+lPbnlSpM47InR9bNgVxdZt8Kg WvvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1734087959; x=1734692759; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=bj1zG2JUtD4cao4U+a5igu8ymtrnDkKuO8nfC2nNVCM=; b=rNUzdFAa5oeSpIwxdIRHdodSuYUmlr5UXrrF+HqO5HOBCyLhsYcae8jMG9YQZxhI5P 65pAVDjcmh0DO81jiVcGeGJueYCeAZY6C07pPducJwxTEEWB9CHV0eh5zVOpRwcl/e4B 2m01nT8QA2EZfWjUlC+Yji2qFqAHprbsHtwQjXVDaqJGhSmuRlDoepw02O1J/ORQDQsQ NJaOwLgiq3WRd241QaqZOkagWGx+u7ZQZPEZoTvVWNY6dwB+1JSB+lK4Ski3STmiNQth e09yvGGdj4FmE2q2VVpNMn+YWBsktN+6Oq8+jfpqBoIT07Jm4t1HTogV+ptQS1mwlMlM ipXg== X-Forwarded-Encrypted: i=1; AJvYcCUNMNWjieLelr+QPL0nSi9vxSokL8NZjaKPANr3Dk/UMBxctvDKVxHdNbB4vt8xRy9PUafLIWzm6qIheQRZcwHp9sq5+KRMMxNf4wjHNZUQZI8VgZI=@ietf.org, AJvYcCUQD1JlcalbGsDduWFHWrVNrvhS9+XI57i+9/ZbkCg+OPYXQ9WsU/N1DXwmnsTqEEHs6iGrDA==@ietf.org, AJvYcCWnvrHtj9P8ogQVxkYmMOwl61TCr5cQg3BGIvljaqw5iM27tfq+X4GQlGvEh3+pcz/OvFTNExsgsW8T0Q==@ietf.org, AJvYcCXdbyOiES3bkb018pYF+1VSPYANevrCDEmzO8zvYVj4PRGcRiGzyeDGePptV8BxpwZbR4qaEg==@ietf.org X-Gm-Message-State: AOJu0Yw024PeIS9wf/Kzvd+M29fGjbjV8Nw7vszS7emfzDZ0OYK5NINJ 8TwIA7uL5zsNEita3pQpCI+6WQIeMUAOo4gUowdVloDs9u9gpedqm1OQB0T5SEsEV4jWz2R9nLN G65Z35ueZ2UJ1/irxyvxH/3edtA== X-Gm-Gg: ASbGncs+P0zFBTH9W7riRxvgMqIdosyVGYcd9Ay8dRnKhmtfXTI2epwu6sw5IZJOw1g RM/gb6bnyHVVnwuUQoAQL7znDfsdM2ZSLfKhK7w== X-Google-Smtp-Source: AGHT+IHzxCB2+4EfY8XvawnUTf/qlNoDhBAhEYhVck7lWseJmI+cletxnwEKSDw4WvZDblkj5kSTk4/bHDsMTbU9iMk= X-Received: by 2002:a17:90b:388f:b0:2ee:f687:6adb with SMTP id 98e67ed59e1d1-2f28fb50333mr3366472a91.3.1734087959467; Fri, 13 Dec 2024 03:05:59 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Deb Cooley Date: Fri, 13 Dec 2024 06:05:44 -0500 Message-ID: To: Ted Lemon Content-Type: multipart/alternative; boundary="000000000000d55c39062924d069" Message-ID-Hash: KFYGOXOCZOUCK7DVWYEVASS2YVEOC6TS X-Message-ID-Hash: KFYGOXOCZOUCK7DVWYEVASS2YVEOC6TS X-MailFrom: debcooley1@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ipv6.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: The IESG , draft-ietf-6man-snac-router-ra-flag@ietf.org, 6man-chairs@ietf.org, ipv6@ietf.org X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BIPv6=5DRe=3A_Deb_Cooley=27s_No_Objection_on_draft-ietf-6man-sna?= =?utf-8?q?c-router-ra-flag-02=3A_=28with_COMMENT=29?= List-Id: "IPv6 Maintenance Working Group (6man)" Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --000000000000d55c39062924d069 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Apologies for the delay. >From the 6man-snac-router-ra draft point of view, the change made to security considerations is fine. >From a snac-simple point of view, having not read the snac-simple draft, I can't say. I can put it on my 'to do' list, if you like. Or we can request an early secdir review (where we can suggest that the same reviewer is assigned). If the attack doesn't exist, then everything is fine. I think it is just difficult to say with only one of the two drafts under review this time around. Deb On Thu, Dec 5, 2024 at 5:15=E2=80=AFAM Ted Lemon wrote: > Deb, thanks for the comments. I'm not the author but one of the > participants in the working group, and also an author of the snac-simple > document. Jonathan has updated the security considerations to take Thomas > and Shivan's comments into account, and I think these comments have been > addressed. > > Regarding the possible DoS, since no host is supposed to pay attention to > this flag, the presence or absence of the flag should not change host > behavior. Similarly, since no normal router pays attention to RAs, the > presence or absence of this flag can't affect a router. > The only devices that can pay attention to this flag are SNAC routers. > Consequently it makes the most sense to discuss such attacks in that > document=E2=80=94as you=E2=80=99ve noted, rightly or wrongly this documen= t doesn=E2=80=99t provide > enough context to motivate such a discussion. > > FWIW I don=E2=80=99t believe such an attack exists. We can conjecture tha= t any bit > can be misused; the problem is coming up with an actual theory as to how. > The review comment advanced no such theory, and I=E2=80=99ve been unable = to come up > with one on my own. > > So if the reviewer actually has a specific theory it would be helpful to > hear what it is. In that case we can add it to the security consideration= s > for draft-IETF-snac-simple or, preferably, fix the issue so the attack is > no longer practical. > > On Wed, Dec 4, 2024 at 1:33=E2=80=AFPM Deb Cooley = wrote: > >> Thanks. It does clarify that part of my comment. >> >> Deb >> >> On Dec 3, 2024, at 8:48=E2=80=AFAM, Eric Vyncke (evyncke) >> wrote: >> >> =EF=BB=BF >> >> About the separation between the 6MAN I-D and the SNAC simple draft, as = I >> wrote in my own YES ballot and as Jen Linkova wrote in her shepherd=E2= =80=99s write >> up, the process of =E2=80=98carving out=E2=80=99 the RA flag out of the = snac-simple was >> agreed between the SNAC/6MAN chairs & ADs (Erik & Eric) during a SNAC WG >> meeting at IETF119: =E2=80=9CInteraction of this draft with >> >> the SNAC was discussed extensively at IETF119 and on the mailing lists= =E2=80=9C >> >> >> >> Hope this clarifies the situation, >> >> >> >> Regards, >> >> >> >> -=C3=A9ric >> >> >> >> *From: *Deb Cooley via Datatracker >> *Date: *Tuesday, 3 December 2024 at 14:30 >> *To: *The IESG >> *Cc: *draft-ietf-6man-snac-router-ra-flag@ietf.org < >> draft-ietf-6man-snac-router-ra-flag@ietf.org>, 6man-chairs@ietf.org < >> 6man-chairs@ietf.org>, ipv6@ietf.org , furry13@gmail.com = < >> furry13@gmail.com> >> *Subject: *Deb Cooley's No Objection on >> draft-ietf-6man-snac-router-ra-flag-02: (with COMMENT) >> >> Deb Cooley has entered the following ballot position for >> draft-ietf-6man-snac-router-ra-flag-02: No Objection >> >> When responding, please keep the subject line intact and reply to all >> email addresses included in the To and CC lines. (Feel free to cut this >> introductory paragraph, however.) >> >> >> Please refer to >> https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positi= ons/ >> for more information about how to handle DISCUSS and COMMENT positions. >> >> >> The document, along with other ballot positions, can be found here: >> https://datatracker.ietf.org/doc/draft-ietf-6man-snac-router-ra-flag/ >> >> >> >> ---------------------------------------------------------------------- >> COMMENT: >> ---------------------------------------------------------------------- >> >> Thanks for both Shivan Kaul Sahib and Tomas Fossati for their reviews. >> Both >> have suggestions that impact Security Considerations, and both suggestio= ns >> should be considered either for this draft or for >> draft-ietf-snac-simple. It >> would be nice to hear whether these suggestions are being considered, in >> addition to which draft is considered appropriate. >> >> I also echo Paul's comment about the separation of this draft and >> draft-ietf-snac-simple. It would seem logical to have put them together= . >> >> >> -------------------------------------------------------------------- >> IETF IPv6 working group mailing list >> ipv6@ietf.org >> List Info: https://mailman3.ietf.org/mailman3/lists/ipv6@ietf.org/ >> -------------------------------------------------------------------- >> > --000000000000d55c39062924d069 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Apologies for the delay.

Fro= m the 6man-snac-router-ra draft point of view, the change made to security = considerations is fine.

From a snac-simple po= int of view, having not read the snac-simple draft, I can't say.=C2=A0 = I can put it on my 'to do' list, if you like.=C2=A0 Or we can reque= st an early secdir review (where we can suggest that the same reviewer is a= ssigned).

If the attack doesn't exist, then ev= erything is fine.=C2=A0 I think it is just difficult to say with only one o= f the two drafts under review this time around.

Deb

<= div dir=3D"ltr" class=3D"gmail_attr">On Thu, Dec 5, 2024 at 5:15=E2=80=AFAM= Ted Lemon <mellon@fugue.com>= wrote:
Deb, thanks for the comments. I'm not the author but one = of the participants in the working group, and also an author of the snac-si= mple document. Jonathan has updated the security considerations to take Tho= mas and Shivan's comments into account, and I think these comments have= been addressed.=C2=A0

Reg= arding the possible DoS, since no host is supposed to pay attention to this= flag, the presence or absence of the flag should not change host behavior.= Similarly, since no normal router pays attention to RAs, the presence or a= bsence of this flag can't affect a router.=C2=A0
= The only devices that can pay attention to this flag are SNAC routers. Cons= equently it makes the most sense to discuss such attacks in that document= =E2=80=94as you=E2=80=99ve noted, rightly or wrongly this document doesn=E2= =80=99t provide enough context to motivate such a discussion.=C2=A0

FWIW I don=E2=80=99t believ= e such an attack exists. We can conjecture that any bit can be misused; the= problem is coming up with an actual theory as to how. The review comment a= dvanced no such theory, and I=E2=80=99ve been unable to come up with one on= my own.=C2=A0

So if the r= eviewer actually has a specific theory it would be helpful to hear what it = is. In that case we can add it to the security considerations for draft-IET= F-snac-simple or, preferably, fix the issue so the attack is no longer prac= tical.=C2=A0

On Wed, Dec 4, 2024 at 1:33=E2=80=AFPM Deb Cooley <debcooley1@gmail.com<= /a>> wrote:
<= div dir=3D"auto">Thanks.=C2=A0 It does clarify that part of my comment.

De= b

On Dec 3, 2024, at 8:= 48=E2=80=AFAM, Eric Vyncke (evyncke) <evyncke@cisco.com> wrote:

<= /div>
=EF=BB=BF

About = the separation between the 6MAN I-D and the SNAC simple draft, as I wrote i= n my own YES ballot and as Jen Linkova wrote in her shepherd=E2=80=99s writ= e up, the process of =E2=80=98carving out=E2=80=99 the RA flag out of the snac-simple was ag= reed between the SNAC/6MAN chairs & ADs (Erik & Eric) during a SNAC= WG meeting at IETF119: =E2=80=9CInte= raction of this draft with

the SNAC was discusse= d extensively at IETF119 and on the mailing lists=E2=80=9C<= u>

=C2=A0

Hope t= his clarifies the situation,

=C2=A0

Regard= s,

=C2=A0

-=C3= =A9ric

=C2=A0

From: Deb Cooley via Datatracker <noreply@ietf.org>
Date: Tuesday, 3 December 2024 at 14:30
To: The IESG <= iesg@ietf.org>
Cc: draft-ietf-6man-snac-router-ra-flag@ietf.org <draft-ietf-6man-snac-router-ra-flag@ietf.org>, 6man-chairs@ietf.org <6man-chairs@ietf.org>, ipv6@ietf.org= <ipv6@ietf.org&g= t;, furry13@gmail.co= m <furry13@gm= ail.com>
Subject: Deb Cooley's No Objection on draft-ietf-6man-snac-route= r-ra-flag-02: (with COMMENT)

Deb Cooley has entered the following ballot = position for
draft-ietf-6man-snac-router-ra-flag-02: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions= /
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-6man-s= nac-router-ra-flag/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for both Shivan Kaul Sahib and Tomas Fossati for their reviews.=C2= =A0 Both
have suggestions that impact Security Considerations, and both suggestions<= br> should be considered either for this draft or for draft-ietf-snac-simple.= =C2=A0 It
would be nice to hear whether these suggestions are being considered, in addition to which draft is considered appropriate.

I also echo Paul's comment about the separation of this draft and
draft-ietf-snac-simple.=C2=A0 It would seem logical to have put them togeth= er.


--------------------------------------------------= ------------------
IETF IPv6 working group mailing list
ipv6@ietf.org
List Info: https://mailman3.ietf.org/mailman3= /lists/ipv6@ietf.org/
--------------------------------------------------------------------
--000000000000d55c39062924d069--