IETF Logo Mail Archive

Re: [OPSEC] Ted Lemon's Discuss on draft-ietf-opsec-dhcpv6-shield-05: (with DISCUSS and COMMENT)

"C. M. Heard" <heard@pobox.com> Mon, 09 February 2015 01:47 UTC

Return-Path: <heard@pobox.com>
X-Original-To: opsec@ietfa.amsl.com
Delivered-To: opsec@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36EBE1A86DE for <opsec@ietfa.amsl.com>; Sun, 8 Feb 2015 17:47:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.576
X-Spam-Level: *
X-Spam-Status: No, score=1.576 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FRT_POSSIBLE=2.697, SPF_NEUTRAL=0.779] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pLCLVvjsFYqD for <opsec@ietfa.amsl.com>; Sun, 8 Feb 2015 17:47:18 -0800 (PST)
Received: from shell4.bayarea.net (shell4.bayarea.net [209.128.82.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12F581A82E2 for <opsec@ietf.org>; Sun, 8 Feb 2015 17:47:17 -0800 (PST)
Received: (qmail 15303 invoked from network); 8 Feb 2015 17:47:08 -0800
Received: from shell4.bayarea.net (209.128.82.1) by shell4.bayarea.net with (DHE-RSA-AES256-SHA encrypted) SMTP; 8 Feb 2015 17:47:08 -0800
Date: Sun, 08 Feb 2015 17:47:08 -0800
From: "C. M. Heard" <heard@pobox.com>
X-X-Sender: heard@shell4.bayarea.net
To: Marc Blanchet <marc.blanchet@viagenie.ca>
In-Reply-To: <7516AD5C-1152-4020-B050-FA0383B58DBA@viagenie.ca>
Message-ID: <Pine.LNX.4.64.1502081734120.24776@shell4.bayarea.net>
References: <20150207194616.20651.30892.idtracker@ietfa.amsl.com> <D5B607FA-9B47-4F1B-A0C1-FB0C94A97CDB@bogus.com> <Pine.LNX.4.64.1502071930100.25761@shell4.bayarea.net> <06B01D8E-981D-4D06-B6CC-3B5CE92782C5@nominum.com> <Pine.LNX.4.64.1502080813060.2950@shell4.bayarea.net> <D97E8BB3-0DB3-4B41-8C91-DBB3121DCEF7@nominum.com> <Pine.LNX.4.64.1502081507150.24776@shell4.bayarea.net> <72C73500-E6C4-4D75-9CFA-8FE4B012AB9E@nominum.com> <7516AD5C-1152-4020-B050-FA0383B58DBA@viagenie.ca>
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="-2133786286-1737874202-1423446428=:24776"
Archived-At: <http://mailarchive.ietf.org/arch/msg/opsec/-eoeQwi9t1PsGO9HMv5qN2BG-UE>
Cc: "draft-ietf-opsec-dhcpv6-shield@ietf.org" <draft-ietf-opsec-dhcpv6-shield@ietf.org>, "opsec@ietf.org" <opsec@ietf.org>, "draft-ietf-opsec-dhcpv6-shield.ad@ietf.org" <draft-ietf-opsec-dhcpv6-shield.ad@ietf.org>, "draft-ietf-opsec-dhcpv6-shield.shepherd@ietf.org" <draft-ietf-opsec-dhcpv6-shield.shepherd@ietf.org>, Ted Lemon <Ted.Lemon@nominum.com>, "opsec-chairs@ietf.org" <opsec-chairs@ietf.org>, "brian.e.carpenter@gmail.com" <brian.e.carpenter@gmail.com>, The IESG <iesg@ietf.org>
Subject: Re: [OPSEC] Ted Lemon's Discuss on draft-ietf-opsec-dhcpv6-shield-05: (with DISCUSS and COMMENT)
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/opsec/>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Feb 2015 01:47:19 -0000

On Mon, 9 Feb 2015, Marc Blanchet wrote:
> > Le 2015-02-09 à 09:30, Ted Lemon <Ted.Lemon@nominum.com> a écrit :
> > 
> > On Feb 8, 2015, at 6:21 PM, C. M. Heard <heard@pobox.com> wrote:
> >> Would your objections be addressed if Section 3 of the draft were 
> >> replaced by something along the lines of the following?
> > 
> > No.  This is not a draft about filtering extension headers.  It 
> > is a draft about filtering DHCP.  The two are unrelated, and 
> > should not be discussed as if they were related.
> 
> I agree with Tedÿÿs point above. The draft is about dhcpv6 not extension headers. 

Yes, but there is a situation in which it is not possibile to make a 
positive identification where a given packet is or is not a DHCPv6 
packet.  This should be pointed out to implementors, and the 
relevant requirements from RFC 7045 should be noted.

I think I've made it amply clear that I disagree with the DISCUSS as 
it is currently written.  I will now shut up and let others speak.

//cmh

v2.23.0 | Report a Bug | By Email