Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-21.txt

Bob Hinden <bob.hinden@gmail.com> Sat, 09 November 2019 21:34 UTC

Return-Path: <bob.hinden@gmail.com>
X-Original-To: opsec@ietfa.amsl.com
Delivered-To: opsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAF9B1200EF for <opsec@ietfa.amsl.com>; Sat, 9 Nov 2019 13:34:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mwISUIXyhbaO for <opsec@ietfa.amsl.com>; Sat, 9 Nov 2019 13:34:53 -0800 (PST)
Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CB321200E3 for <opsec@ietf.org>; Sat, 9 Nov 2019 13:34:53 -0800 (PST)
Received: by mail-wr1-x431.google.com with SMTP id z10so5417280wrs.12 for <opsec@ietf.org>; Sat, 09 Nov 2019 13:34:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ucoDdXU1cgYlKghK7oe6gK8Vlmxv3bLrxWgW5ZV3C0w=; b=hSCkChuXeFuL4gQj41AfCwOa6W4TbRmIB7f/CaX+TFxm8jjyh6mUo/LpMUe1TMmwtQ p+W1NvGpzjS1mFXYVK9hDpEdDzJxJXyxqk5ZQUWKzbXxFxzfEj0amvPo5u5IEdPqNuOP oDVU0tuKlw/vuED/QQwhvh4ghz8yaEqx9aQsT9eN5HHJ3zd5yFVBp1LgmDF0GMb3t7Sv 0C5+brHF66vN86E0L02J/Z+9q/QOZcLFhoZmSolRQCfz1zQ6YLO76JY5RBS19Agm05Rt GU3TgUfEKzgrktrKuvCj0Y0Yi5yK8RWun5nJ2k3oxDsJ5FM02juzK3d4b2rD/lmMCcYd KmOg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ucoDdXU1cgYlKghK7oe6gK8Vlmxv3bLrxWgW5ZV3C0w=; b=UrFQ7530c5kmFOWZwWZZOAa1m8XPtJ9XvjVZoAYbqfwrY6j/tvGxW9bV/C5l8ZbvrD 0KRPwMsJhh13OnetcoFB+dTHZ6PToviebQLHLfxDbdP5GzvQX/Lkx8oK/1KILaz4yczi liIOD5a6ltUyLMke3YwX59+DaT4uWsqFHpmv1KTzi+g/9q8UEZQSydFgi+SydOsBduM9 GezzV1/XM+2AAgcvS3w7CqA77ONtfb6h5hd8DTf8GJMXoelDqSUndsyDV/w1l6Munnqu KMhNKJqTaLhVq96EmLAuNId0oH82kMOpdE7Mri63GX81XVqI7yUwAuoLnBn2/tgyOr9k HvMw==
X-Gm-Message-State: APjAAAUVBLyLlAR6gV45AumrM5W1JTyDSczwHsYhTfUdtCtPWicfg64r cZ8wDNffpSHf6gQdDjm+c8I=
X-Google-Smtp-Source: APXvYqzwUJY56wxZCrf3+aoRD6rCsRHeS3CEMqlHbVAcXkUzRVZ3PhJGYNBfg3ykaLXbuozcukOPXA==
X-Received: by 2002:a5d:6a43:: with SMTP id t3mr13877454wrw.268.1573335291836; Sat, 09 Nov 2019 13:34:51 -0800 (PST)
Received: from ?IPv6:2601:647:5a00:ef0b:5c31:9c68:be8f:6bac? ([2601:647:5a00:ef0b:5c31:9c68:be8f:6bac]) by smtp.gmail.com with ESMTPSA id v128sm17475845wmb.14.2019.11.09.13.34.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 09 Nov 2019 13:34:50 -0800 (PST)
From: Bob Hinden <bob.hinden@gmail.com>
Message-Id: <DB5FA864-FE44-4B3E-87A1-DFF72623AC8C@gmail.com>
Content-Type: multipart/signed; boundary="Apple-Mail=_1E72827D-1798-41C3-A15C-E507AB2A6527"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Sat, 09 Nov 2019 13:34:45 -0800
In-Reply-To: <BDFA3F63-6B71-4C98-BD9F-25088147DAD3@gmail.com>
Cc: Bob Hinden <bob.hinden@gmail.com>, "Eric Vyncke (evyncke)" <evyncke@cisco.com>, "opsec@ietf.org" <opsec@ietf.org>
To: Gyan Mishra <hayabusagsm@gmail.com>
References: <157281820483.13177.8617036261217670675@ietfa.amsl.com> <82AA0F9C-7836-464F-8F19-69FEDB197D53@gmail.com> <1AAA80C6-080B-492D-ABC9-645B9CEFDC99@cisco.com> <CABNhwV3AjvdExSin+etj8tF9Tzt-0VB45Nmb3hwV_REVPmiO8g@mail.gmail.com> <3BB16B9C-9065-466B-9A9A-51C5D314E126@cisco.com> <E52D2FF2-A02D-4DCC-B82F-21A0BFD8607D@gmail.com> <CF33CA18-6076-483C-AFBC-88011435E989@gmail.com> <F65BB304-2D93-42F3-A4E5-67C8E95D2D28@gmail.com> <BDFA3F63-6B71-4C98-BD9F-25088147DAD3@gmail.com>
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsec/AYnmNoGMojJ7H3sL_AbX9tJQXJM>
Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-21.txt
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsec/>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 09 Nov 2019 21:34:57 -0000

Gyan,

> On Nov 9, 2019, at 1:08 PM, Gyan Mishra <hayabusagsm@gmail.com> wrote:
> 
> 
> 
>> On Nov 9, 2019, at 3:54 PM, Bob Hinden <bob.hinden@gmail.com> wrote:
>> 
>> Gyan,
>> 
>>> On Nov 9, 2019, at 12:09 PM, Gyan Mishra <hayabusagsm@gmail.com> wrote:
>>> 
>>> 
>>> 
>>> 
>>>> On Nov 9, 2019, at 11:46 AM, Bob Hinden <bob.hinden@gmail.com> wrote:
>>>> 
>>>> Eric,
>>>> 
>>>>> On Nov 8, 2019, at 11:57 PM, Eric Vyncke (evyncke) <evyncke@cisco.com> wrote:
>>>>> 
>>>>> Gyan
>>>>> 
>>>>> Thank you very much for your shepherd write-up, very much appreciated by the authors.
>>>>> 
>>>>> The list of the ‘obsoleted’ references is intentional indeed to ensure that readers understand that ‘old’ documents have been replaced. The text in the document is clear about the obsolete and current document. So, we do prefer to leave the references like they are as we believe that they make the document more valuable for the reader.
>>>> 
>>>> I went back and reread this.  The text:
>>>> 
>>>> 2.2.2.  Hop-by-Hop Options Header
>>>> 
>>>> The hop-by-hop options header, when present in an IPv6 packet, forces
>>>> all nodes in the path to inspect this header in the original IPv6
>>>> specification [RFC2460].  This enables denial of service attacks as
>>>> most, if not all, routers cannot process this kind of packets in
>>>> hardware but have to 'punt' this packet for software processing.
>>>> Section 4.3 of the current Internet Standard for IPv6, [RFC8200], has
>>>> taken this attack vector into account and made the processing of hop-
>>>> by-hop options header by intermediate routers optional.
>>>> 
>>>> I don’t understand why this is talking about RFC2460 at all.  Seems like it would less confusing to only describe what is in RFC8200.  Nor is “punt” correct way to describe this.   Way too colloquial.
>>>> 
>>>> Describing RFC8200 behavior as “optional" is quite right, RFC8200 says:
>>>> 
>>>> ...now expected that nodes along a packet's delivery path only examine and process the
>>>>   Hop-by-Hop Options header if explicitly configured to do so
>>>> 
>>>> It’s not optional if configured to do so.  It would be better to use the RFC8200 words.
>>>> 
>>>> Lastly the “Original" IPv6 Specification was RFC1883.
>>>> 
>>>> Bob
>>>> 
>>>> p.s. I agree about the references to RFC 3068 and RFC 3627.
>>>> 
>>>> [Gyan] I agree with Bob about RFC 8200 as it’s a major update to the original IPv6 specification written in 1998 by Bob as well.  The other two are minor and agree to the historical deprecated informational references.
>>> 
>>> The term “punt to cpu” is commonly used by router vendors when switching from the slow software switched path which hits the RP CPU versus the hardware switched fast path which remains on the line card NP processor.
>> 
>> I understand what it means, but as I said its colloquial and may not be clear to some readers.  Not appropriate for a document like this, IMHO.
>> 
>> Bob
>> 
> Understood. How about “forward” or “redirect”.

That’s better.

Thanks,
Bob


> 
>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>>> 
>>>>> Regards
>>>>> 
>>>>> -éric
>>>>> 
>>>>> From: Gyan Mishra <hayabusagsm@gmail.com>
>>>>> Date: Saturday, 9 November 2019 at 08:28
>>>>> To: Eric Vyncke <evyncke@cisco.com>
>>>>> Cc: "opsec@ietf.org" <opsec@ietf.org>, "i-d-announce@ietf.org" <i-d-announce@ietf.org>
>>>>> Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-21.txt
>>>>> 
>>>>> Eric
>>>>> 
>>>>> I submitted the shepherd write-up.
>>>>> 
>>>>> I ran the idnits and it found the following obsolete references.  We should clear that up before we publish it.  I can update my comments on that once the draft is updated.
>>>>> Checking references for intended status: Informational
>>>>> ----------------------------------------------------------------------------
>>>>> 
>>>>> -- Obsolete informational reference (is this intentional?): RFC 2460
>>>>>  (Obsoleted by RFC 8200)
>>>>> 
>>>>> -- Obsolete informational reference (is this intentional?): RFC 3068
>>>>>  (Obsoleted by RFC 7526)
>>>>> 
>>>>> -- Obsolete informational reference (is this intentional?): RFC 3627
>>>>>  (Obsoleted by RFC 6547)
>>>>> 
>>>>> Thank you
>>>>> 
>>>>> Gyan
>>>>> 
>>>>>> On Mon, Nov 4, 2019 at 9:38 AM Eric Vyncke (evyncke) <evyncke@cisco.com> wrote:
>>>>>> Hello Gyan,
>>>>>> 
>>>>>> Thank you for reminding the author to post the 'gist' of the changes with version -21.
>>>>>> 
>>>>>> Our OPS AD, Warren "Ace" Kumari,  has kindly reviewed our document and has identified more than 70 areas where the text was ambiguous or using bad English... No wonder, none of the 4 authors are English-speaking native: it is a mix of Estonian (Merike who also speaks German and Russian[1]), one of the 22 (?) language of India (KK), German (Enno who also speaks French and Spanish) and French (myself also speaking Dutch) __ __ IETF community is really diverse !
>>>>>> 
>>>>>> Thank you very much in advance for finalizing the shepherd write-up
>>>>>> 
>>>>>> -éric
>>>>>> 
>>>>>> [1] I can be wrong for Merike BTW but she is quadri-lingual
>>>>>> 
>>>>>> On 04/11/2019, 15:26, "Gyan Mishra" <hayabusagsm@gmail.com> wrote:
>>>>>> 
>>>>>> Hi Eric
>>>>>> 
>>>>>> Just checking what the updates are that went in v21 since this document is now ready to be published just pending my Shepard writeup which I plan to finish this week.
>>>>>> 
>>>>>> Thank you
>>>>>> 
>>>>>> Gyan
>>>>>> 
>>>>>> Sent from my iPhone
>>>>>> 
>>>>>>> On Nov 3, 2019, at 4:56 PM, internet-drafts@ietf.org wrote:
>>>>>>> 
>>>>>>> 
>>>>>>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>>>>>>> This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF.
>>>>>>> 
>>>>>>>    Title           : Operational Security Considerations for IPv6 Networks
>>>>>>>    Authors         : Eric Vyncke
>>>>>>>                      Kiran Kumar Chittimaneni
>>>>>>>                      Merike Kaeo
>>>>>>>                      Enno Rey
>>>>>>> Filename        : draft-ietf-opsec-v6-21.txt
>>>>>>> Pages           : 52
>>>>>>> Date            : 2019-11-03
>>>>>>> 
>>>>>>> Abstract:
>>>>>>> Knowledge and experience on how to operate IPv4 securely is
>>>>>>> available: whether it is the Internet or an enterprise internal
>>>>>>> network.  However, IPv6 presents some new security challenges.  RFC
>>>>>>> 4942 describes the security issues in the protocol but network
>>>>>>> managers also need a more practical, operations-minded document to
>>>>>>> enumerate advantages and/or disadvantages of certain choices.
>>>>>>> 
>>>>>>> This document analyzes the operational security issues in several
>>>>>>> places of a network (enterprises, service providers and residential
>>>>>>> users) and proposes technical and procedural mitigations techniques.
>>>>>>> Some very specific places of a network such as the Internet of Things
>>>>>>> are not discussed in this document.
>>>>>>> 
>>>>>>> 
>>>>>>> The IETF datatracker status page for this draft is:
>>>>>>> https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/
>>>>>>> 
>>>>>>> There are also htmlized versions available at:
>>>>>>> https://tools.ietf.org/html/draft-ietf-opsec-v6-21
>>>>>>> https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-21
>>>>>>> 
>>>>>>> A diff from the previous version is available at:
>>>>>>> https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-21
>>>>>>> 
>>>>>>> 
>>>>>>> Please note that it may take a couple of minutes from the time of submission
>>>>>>> until the htmlized version and diff are available at tools.ietf.org.
>>>>>>> 
>>>>>>> Internet-Drafts are also available by anonymous FTP at:
>>>>>>> ftp://ftp.ietf.org/internet-drafts/
>>>>>>> 
>>>>>>> _______________________________________________
>>>>>>> OPSEC mailing list
>>>>>>> OPSEC@ietf.org
>>>>>>> https://www.ietf.org/mailman/listinfo/opsec
>>>>>> 
>>>>>> 
>>>>> 
>>>>> 
>>>>> --
>>>>> Gyan S. Mishra
>>>>> IT Network Engineering & Technology
>>>>> Verizon Communications Inc. (VZ)
>>>>> 13101 Columbia Pike FDC1 3rd Floor
>>>>> Silver Spring, MD 20904
>>>>> United States
>>>>> Phone: 301 502-1347
>>>>> Email: gyan.s.mishra@verizon.com
>>>>> www.linkedin.com/in/networking-technologies-consultant
>>>>> 
>>>>> _______________________________________________
>>>>> OPSEC mailing list
>>>>> OPSEC@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/opsec
>>>> 
>>