IETF Logo Mail Archive

Re: [OPSEC] Last Call: <draft-ietf-opsec-ipv6-eh-filtering-06.txt> (Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers) to Informational RFC

"C. M. Heard" <heard@pobox.com> Sat, 24 November 2018 20:38 UTC

Return-Path: <heard@pobox.com>
X-Original-To: opsec@ietfa.amsl.com
Delivered-To: opsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76E01130DE8; Sat, 24 Nov 2018 12:38:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pobox.com; domainkeys=pass (1024-bit key) header.from=heard@pobox.com header.d=pobox.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SEckASQxLbuo; Sat, 24 Nov 2018 12:38:11 -0800 (PST)
Received: from pb-smtp20.pobox.com (pb-smtp20.pobox.com [173.228.157.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE20012DD85; Sat, 24 Nov 2018 12:38:10 -0800 (PST)
Received: from pb-smtp20.pobox.com (unknown [127.0.0.1]) by pb-smtp20.pobox.com (Postfix) with ESMTP id ABB153A702; Sat, 24 Nov 2018 15:38:10 -0500 (EST) (envelope-from heard@pobox.com)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=pobox.com; h=mime-version :references:in-reply-to:from:date:message-id:subject:to:cc :content-type; s=sasl; bh=p0sNXcoO24kZjvZGGEDbJnaa3FQ=; b=fQw+iM LBql0jK0ef9BGx3WfzuZ+2pzoqYp5c1w6kwbKhoGsOK6vqtWXx6wNjIh0/aneW7o lqF2pH+p4IMUkgROx7ElYazlMD3CnPry8ej2EWC/4x3t98unQm8zact1biX8RCxY 5R+yKWs9tRbykmLwoyBPIdweXNmxo5PJ3AVN8=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=mime-version :references:in-reply-to:from:date:message-id:subject:to:cc :content-type; q=dns; s=sasl; b=qM7YNeGg4C0ciQD32qcuqPJwC9dxPF8b WrnK9F/WcLwlVAM5R8Ek1m6zO8zT+L3oqJFA+Vi+Z2/8w2JW6W4/5KZFSNYv9EEq 2hduel0AmKGXI/eF97dyUd51fvDqXqKsPs1Ht1dpHqkn3kQ/VWEp1X9UJkG3PTlU itgaK3LYW0I=
Received: from pb-smtp20.sea.icgroup.com (unknown [127.0.0.1]) by pb-smtp20.pobox.com (Postfix) with ESMTP id A6B7E3A701; Sat, 24 Nov 2018 15:38:10 -0500 (EST) (envelope-from heard@pobox.com)
Received: from mail-io1-f52.google.com (unknown [209.85.166.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pb-smtp20.pobox.com (Postfix) with ESMTPSA id 41F363A6FF; Sat, 24 Nov 2018 15:38:08 -0500 (EST) (envelope-from heard@pobox.com)
Received: by mail-io1-f52.google.com with SMTP id u19so11075563ioc.2; Sat, 24 Nov 2018 12:38:08 -0800 (PST)
X-Gm-Message-State: AA+aEWZIpE2OPOWcgA71qjICuPOEuVcMdlYOYwKjF/AONvTHbwpJ4ZpX g31dWvsZIldd5+uj6iYCyA2xynZcER9hUimCeNw=
X-Google-Smtp-Source: AFSGD/UYgDYEL0G8OwsYWfEaZH4ZjX9HrKJMljyW0DPeBvuOt4WTWLsdHYPgXbyNxjukqyoPF/OG/0CZoC8kRpsixW8=
X-Received: by 2002:a6b:7307:: with SMTP id e7-v6mr9957920ioh.94.1543091887073; Sat, 24 Nov 2018 12:38:07 -0800 (PST)
MIME-Version: 1.0
References: <CACL_3VExxwN6z-WHbp3dcdLNV1JMVf=sgMVzh-k0shNJFeADbQ@mail.gmail.com> <BLUPR0501MB2051A8FFB1DAFDCA9873B9E6AE700@BLUPR0501MB2051.namprd05.prod.outlook.com> <CACL_3VFSHqU-D+NJu=k2-p4tbjZukT7i7WEoX+5kdUtdHB4Rjw@mail.gmail.com> <CACL_3VGk0CsHObEgSwLdCp8agOWrjccB94-aynEz3Bv0w+EU+w@mail.gmail.com> <475fe28a-aafe-d3b0-e665-fe97dd1439b8@foobar.org> <CACL_3VGHWW8fCDo8Q9br2fwXn5zBi+kN_5a1sOTX7m7QaU8iyg@mail.gmail.com> <3dc898de-6a18-4106-52fd-36cb8f60b19b@gmail.com> <f2784abe-d5b5-a556-3cfa-63481a7a8929@foobar.org>
In-Reply-To: <f2784abe-d5b5-a556-3cfa-63481a7a8929@foobar.org>
From: "C. M. Heard" <heard@pobox.com>
Date: Sat, 24 Nov 2018 12:37:55 -0800
X-Gmail-Original-Message-ID: <CACL_3VGqhc-gFhbGJNm9XjZRXHpv9yZ3e4CurmT2P-VpQuVi3w@mail.gmail.com>
Message-ID: <CACL_3VGqhc-gFhbGJNm9XjZRXHpv9yZ3e4CurmT2P-VpQuVi3w@mail.gmail.com>
To: Nick Hilliard <nick@foobar.org>, Brian E Carpenter <brian.e.carpenter@gmail.com>
Cc: OPSEC <opsec@ietf.org>, IETF <ietf@ietf.org>
Content-Type: text/plain; charset="UTF-8"
X-Pobox-Relay-ID: DA12633E-F028-11E8-B1D8-F5C31241B9FE-06080547!pb-smtp20.pobox.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsec/Si0L3SP_i5hgTWoCl5Z55Z8ToZI>
Subject: Re: [OPSEC] Last Call: <draft-ietf-opsec-ipv6-eh-filtering-06.txt> (Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers) to Informational RFC
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsec/>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 24 Nov 2018 20:38:12 -0000

On Sat, Nov 24, 2018 at 12:30 PM Nick Hilliard <nick@foobar.org> wrote:
> Brian E Carpenter wrote on 24/11/2018 20:17:
> > Operators make their own
> > decisions, so I think that is what the draft should say. Something like:
> >
> > 3.5.5.  Advice
> >
> >     Operators should determine according to their own circumstances
> >     whether to discard packets containing unknown IPv6 EHs.
> >
> > And at the same time, delete the 2nd and 3rd sentences of this:
> >
> > 3.5.3.  Specific Security Implications
> >
> >     For obvious reasons, it is impossible to determine specific security
> >     implications of unknown IPv6 EHs.  However, from security standpoint,
> >     a device should discard IPv6 extension headers for which the security
> >     implications cannot be determined.  We note that this policy is
> >     allowed by [RFC7045].
>
> This looks like a sensible approach.

I could live with that.  Similar changes might be considered for Sec. 4.4.5.

Mike Heard

v2.23.0 | Report a Bug | By Email