Re: [sfc] IETF WG state changed for draft-ietf-sfc-proof-of-transit

[[e-mail]]

Hi Steve,

Thank you for sharing this pointer. Much appreciated.

I'm sure I'm missing something, but I don't quite see how this is related to proof of transit.

Can you please clarify? Thank you.

Cheers,
Med

De : Youell, Stephen [mailto:[e-mail]]
Envoyé : jeudi 25 juin 2020 15:30
À : BOUCADAIR Mohamed TGI/OLN; 'Frank Brockners (fbrockne)'; '[e-mail]'
Cc : 'Joel M. Halpern'; '[e-mail]'; 'Srihari Raghavan (srihari)'
Objet : RE: [sfc] IETF WG state changed for draft-ietf-sfc-proof-of-transit

Hi Med,
Responding on the reference question you had for "regulatory requirements" I would suggest:

[PCI-DSS] "Payment Card Industry (PCI) Data Security Standard",
          <https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf>


More specifically it is requirement 1 which I have taken the pertinent text from below:


Page 20: Build and Maintain a Secure Network and Systems
Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Requirement 1.1.1: A formal process for approving and testing all network connections and changes to the firewall and router configurations
Testing procedure:

-          Examine documented procedures to verify there is a formal process for testing and approval of all: * Network connections and * Changes to firewall and router configurations

-          For a sample of network connections, interview responsible personnel and examine records to verify that network connections were approved and tested.
Guidance: A documented and implemented process for approving and testing all connections and changes to the firewalls and routers will help prevent security problems caused by misconfiguration of the network, router, or firewall. Without formal approval and testing of changes, records of the changes might not be updated, which could lead to inconsistencies between network documentation and the actual configuration.

Regards,
Steve


From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]<mailto:[e-mail]>]
Sent: Wednesday, June 24, 2020 5:19 PM
To: Frank Brockners (fbrockne) <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Cc: Joel M. Halpern <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; Srihari Raghavan (srihari) <[e-mail]<mailto:[e-mail]>>; Youell, Stephen <[e-mail]<mailto:[e-mail]>>
Subject: RE: [sfc] IETF WG state changed for draft-ietf-sfc-proof-of-transit

Hi Franck,

Thanks for the follow-up.

Please see inline.

Cheers,
Med

> -----Message d'origine-----
> De : Frank Brockners (fbrockne) [mailto:[e-mail]<mailto:[e-mail]>]
> Envoyé : mercredi 24 juin 2020 18:12
> À : BOUCADAIR Mohamed TGI/OLN; [e-mail]<mailto:[e-mail]>
> Cc : Joel M. Halpern; [e-mail]<mailto:[e-mail]>; Srihari Raghavan (srihari);
> [e-mail]<mailto:[e-mail]>
> Objet : RE: [sfc] IETF WG state changed for draft-ietf-sfc-proof-of-transit
>
> Hi Med,
>
> Thanks a lot for your comments. Please see inline (...FB)
>
> > -----Original Message-----
> > From: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
> > Sent: Freitag, 19. Juni 2020 08:36
> > To: [e-mail]<mailto:[e-mail]>
> > Cc: Joel M. Halpern <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
> > Subject: RE: [sfc] IETF WG state changed for draft-ietf-sfc-proof-of-
> transit
> >
> > Hi Franck, all,
> >
> > I know that you are working on this since a while. Please find below some
> > comments on the YANG part to hopefully save you some cycles during
> upcoming
> > reviews:
> >
> > (1) Remove "?" from the explanation text in Section 5.2.1
>
> ...FB: Will do.
> >
> > (2)
> >
> > OLD:
> > The meaning of the symbols in these diagrams is
> >    as follows:
> >
> >    o  Brackets "[" and "]" enclose list keys.
> >
> >    o  Abbreviations before data node names: "rw" means configuration
> >       (read-write), and "ro" means state data (read-only).
> >
> >    o  Symbols after data node names: "?" means an optional node, "!"
> >       means a presence container, and "*" denotes a list and leaf-list.
> >
> >    o  Parentheses enclose choice and case nodes, and case nodes are also
> >       marked with a colon (":").
> >
> >    o  Ellipsis ("...") stands for contents of subtrees that are not
> >       shown.
> >
> > NEW:
> >   The meaning of the symbols in YANG tree diagrams is defined in
> [RFC8340].
>
> ...FB: Good point. We can indeed get rid of the legacy text and refer to
> RFC8340.
> >
> > (3) Remove <CODE BEGINS> and <CODE ENDS> from the tree diagram
>
> ...FB: Will do.
> >
> > (4) Instead of:
> >
> >            +--rw active-profile-index?   profile-index-range
> >
> > You can define a status leaf under pot-profile-list to indicate the
> activation
> > status.
>
> ...FB: Very doable - especially since the open source implementation in VPP
> also only uses and active and a standby profile.

[Med] Great. Thanks.

> >
> > (5) Any reason why are you using version 1? If not, please update to
> "1.1"
>
> ...FB: Nothing specific. The model got defined (and implemented as part of
> OpenDaylight) back in 2016.
>

[Med] Then, please update the module to use 1.1.

> >
> > (6) As your groupings are called only once, and unless you want to define
> them
> > as reusable by other modules, you may just define those as part of the
> main
> > container.
>
> ...FB: We could consider doing so. The reason why we kept the model fairly
> stable so far was that there is an existing implementation in open source
> (Opendaylight), hence the preference to not change things unless there is a
> real need. Would you be ok to stay with the current structure?
>

[Med] Fair enough.

> >
> > (7) IANA Section should be updated as follows:
> >
> > OLD:
> >    This document does not require any actions from IANA.
> >
> > NEW:
> >
> >    IANA is requested to register the following URI in the "ns"
> subregistry within
> >    the "IETF XML Registry" [RFC3688]:
> >
> >       URI:  urn:ietf:params:xml:ns:yang:ietf-pot-profile
> >       Registrant Contact:  The IESG.
> >       XML:  N/A; the requested URI is an XML namespace.
> >
> >    IANA is requested to register the following YANG module in the "YANG
> Module
> >    Names" subregistry [RFC7950] within the "YANG Parameters" registry.
> >
> >       Name:  ietf-pot-profile
> >       Maintained by IANA:  N
> >       Namespace:  urn:ietf:params:xml:ns:yang:ietf-pot-profile
> >       Prefix:  ietf-pot-profile
> >       Reference:  RFC XXXX
> >
> > (7) You should update the Security Section as per
> > https://trac.ietf.org/trac/ops/wiki/yang-security-guideline.
>
> ...FB: ACK on both points above.
> >
> > And a more general note:
> >
> > ==
> >    Several deployments use Traffic Engineering, policy routing, Segment
> >    Routing (SR), and Service Function Chaining (SFC) [RFC7665] to steer
> >    packets through a specific set of nodes.  In certain cases,
> >    regulatory obligations or a compliance policy require operators to
> >    ^^^^^^^^^^^^^^^^^^^^^^
> >    prove that all packets that are supposed to follow a specific path
> >    are indeed being forwarded across and exact set of pre-determined
> >    nodes.
> > ==
> >
> > Do you have pointers to such regulatory obligations? It would be good to
> add a
> > pointer if you are aware of any. Thanks.
>
> ...FB: One of the co-authors and initiators of POT, Stephen, might have
> more specific references available.
> From what I know, there are company policies that require path
> verification. In case we don't find a formal reference, we'll change the
> statement in the next revision and avoid mentioning "regulatory
> obligations".
>

[Med] Looks like a good plan.

>
> >
> > Hope this helps.
>
> Very helpful indeed. Thanks again.
>
> Cheers, Frank
> >
> > Cheers,
> > Med
> >
> > > -----Message d'origine-----
> > > De : sfc [mailto:[e-mail]<mailto:[e-mail]>] De la part de Joel M. Halpern
> > > Envoyé : mardi 16 juin 2020 15:42 À : [e-mail]<mailto:[e-mail]> Objet : Re: [sfc]
> > > IETF WG state changed for draft-ietf-sfc-proof-of-transit
> > >
> > > The chairs are starting the WG last call for
> > > draft-ietf-sfc-proof-of-transit.  Please reply explicitly whether you
> > > think this is ready to go to the IETF for publication as a
> > > Experimental RFC.
> > > As noted below, the call runs through June 30.
> > >
> > > Note that silence does not imply consent, so please speak up.
> > >
> > > Yours,
> > > Joel (& Jim)
> > >
> > > On 6/16/2020 9:32 AM, IETF Secretariat wrote:
> > > >
> > > > The IETF WG state of draft-ietf-sfc-proof-of-transit has been
> > > > changed to
> > > "In
> > > > WG Last Call" from "WG Document" by Joel Halpern:
> > > >
> > > > https://datatracker.ietf.org/doc/draft-ietf-sfc-proof-of-transit/
> > > >
> > > > Comment:
> > > > This starts WG last call for this document, ending June 30.
> > > >
> > >
> > > _______________________________________________
> > > sfc mailing list
> > > [e-mail]<mailto:[e-mail]>
> > > https://www.ietf.org/mailman/listinfo/sfc
> >





_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.