RE: [Syslog] delineated datagramswasdraft-ietf-syslog-transport-tls-01.txt

"Rainer Gerhards" <rgerhards@hq.adiscon.com> Fri, 21 July 2006 10:20 UTC

Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1G3s7q-00085c-5m; Fri, 21 Jul 2006 06:20:54 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1G3s68-00064L-Kv for syslog@ietf.org; Fri, 21 Jul 2006 06:19:08 -0400
Received: from hetzner.adiscon.com ([85.10.201.79]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1G3s3n-0005Pq-VY for syslog@ietf.org; Fri, 21 Jul 2006 06:16:45 -0400
Received: from localhost (localhost [127.0.0.1]) by hetzner.adiscon.com (Postfix) with ESMTP id 550CE27C065; Fri, 21 Jul 2006 12:11:45 +0200 (CEST)
Received: from hetzner.adiscon.com ([127.0.0.1]) by localhost (hetzner [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29257-07; Fri, 21 Jul 2006 12:11:45 +0200 (CEST)
Received: from fmint2.intern.adiscon.com (pd95b68d5.dip0.t-ipconnect.de [217.91.104.213]) by hetzner.adiscon.com (Postfix) with ESMTP id 0899127C061; Fri, 21 Jul 2006 12:11:44 +0200 (CEST)
Received: from grfint2.intern.adiscon.com ([172.19.0.6]) by fmint2.intern.adiscon.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 21 Jul 2006 12:16:42 +0200
Content-class: urn:content-classes:message
Subject: RE: [Syslog] delineated datagramswasdraft-ietf-syslog-transport-tls-01.txt
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Fri, 21 Jul 2006 12:16:28 +0200
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA174CC2@grfint2.intern.adiscon.com>
In-Reply-To: <00b401c6acac$5e59e5a0$8c0c6f0a@china.huawei.com>
X-MimeOLE: Produced By Microsoft Exchange V6.5
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [Syslog] delineated datagramswasdraft-ietf-syslog-transport-tls-01.txt
thread-index: AcaUjzSUvTEyQOf2ReyXqKuPnkIuJwYGjHEAAAFMJFA=
From: Rainer Gerhards <rgerhards@hq.adiscon.com>
To: Miao Fuyou <miaofy@huawei.com>, Tom Petch <nwnetworks@dial.pipex.com>, syslog@ietf.org
X-OriginalArrivalTime: 21 Jul 2006 10:16:42.0054 (UTC) FILETIME=[C2E25E60:01C6ACAE]
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at adiscon.com
X-Spam-Score: 0.1 (/)
X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f
Cc:
X-BeenThere: syslog@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/syslog>
List-Post: <mailto:syslog@lists.ietf.org>
List-Help: <mailto:syslog-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=subscribe>
Errors-To: syslog-bounces@lists.ietf.org

Miao,

I agree with your comments. However, using the LF as a record delimited
would still allow us to interop with existing syslog/tls
implementations. This is my major point. I think it is worth it.

Rainer 

> -----Original Message-----
> From: Miao Fuyou [mailto:miaofy@huawei.com] 
> Sent: Friday, July 21, 2006 12:00 PM
> To: 'Tom Petch'; syslog@ietf.org
> Subject: RE: [Syslog] delineated 
> datagramswasdraft-ietf-syslog-transport-tls-01.txt
> 
> 
> TLS uses SHA-1 or MD5 in ciphersuite for message integrity 
> verification. If
> bytes lost happens during transferring, the message will be 
> dropped by TLS.
> That is also the cause that we need a security mechanism for Syslog.  
> 
> As for error of encoding/decoding, I believe if an application does
> encoding/decoding in a wrong way, you must not expect it do 
> it right with
> other mechanism, such as LF. 
> 
> Redundancy to improve robustness is  good idea, but I don't 
> think it applies
> to this case.
> 
> > -----Original Message-----
> > From: Tom Petch [mailto:nwnetworks@dial.pipex.com] 
> > Sent: Tuesday, June 20, 2006 8:43 PM
> > To: syslog@ietf.org
> > Subject: Re: [Syslog] delineated datagrams 
> > wasdraft-ietf-syslog-transport-tls-01.txt
> > 
> > I wonder if others share my concern about the lack of 
> > robustness in the way in which datagrams are delineated in 
> > the stream protocol (a TCP rather than a TLS issue).
> > 
> > The system works as long as
> >  - the frame length is encoded perfectly
> >  - the frame length is decoded perfectly
> >  - no bytes are inserted or removed in error which is 
> > doubtless true in some networks, but I would prefer not to 
> rely on it.
> > 
> > So, when an error occurs, can the Collector/Relay detect it?  
> > Can the Collector/Relay recover synch?  If not, what does the 
> > Collector/Relay do?
> > 
> > There is very little redundancy in the definition of frame 
> > length, and syslog messages have very little structure to 
> > help the application, so I think that this is an issue we 
> > should address.
> > 
> > Tom Petch
> > 
> > ----- Original Message -----
> > From: "David B Harrington" <dbharrington@comcast.net>
> > To: <syslog@ietf.org>
> > Sent: Tuesday, May 09, 2006 4:26 PM
> > Subject: [Syslog] draft-ietf-syslog-transport-tls-01.txt
> > 
> > 
> > Hi,
> > 
> > A new revision of the syslog/TLS draft is available.
> > 
> http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-tls-01
> > .txt
> > 
> > We need reviewers.
> > Can we get
> > 1) a person to check the grammar?
> > 2) a person to check the syslog technical parts?
> > 3) a person to check compatibility with the other WG documents?
> > 4) a person to check the TLS technical parts?
> > 
> > We also need general reviews of the document by multiple people.
> > 
> > Thanks,
> > David Harrington
> > co-chair, Syslog WG
> > ietfdbh@comcast.net
> > 
> > 
> > _______________________________________________
> > Syslog mailing list
> > Syslog@lists.ietf.org
> > https://www1.ietf.org/mailman/listinfo/syslog
> > 
> > 
> > _______________________________________________
> > Syslog mailing list
> > Syslog@lists.ietf.org
> > https://www1.ietf.org/mailman/listinfo/syslog
> > 
> 
> 
> 
> _______________________________________________
> Syslog mailing list
> Syslog@lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/syslog
> 

_______________________________________________
Syslog mailing list
Syslog@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog