RE: [Syslog] delineated datagrams
Chris Lonvick <clonvick@cisco.com> Fri, 04 August 2006 14:13 UTC
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1G90Qq-0004SY-AV; Fri, 04 Aug 2006 10:13:44 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1G90Qo-0004RI-RN for syslog@ietf.org; Fri, 04 Aug 2006 10:13:42 -0400
Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1G90Qn-00075w-9l for syslog@ietf.org; Fri, 04 Aug 2006 10:13:42 -0400
Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-3.cisco.com with ESMTP; 04 Aug 2006 07:13:40 -0700
X-IronPort-AV: i="4.07,211,1151910000"; d="scan'208"; a="438828223:sNHT27555200"
Received: from sj-core-2.cisco.com (sj-core-2.cisco.com [171.71.177.254]) by sj-dkim-2.cisco.com (8.12.11.20060308/8.12.11) with ESMTP id k74EDeXp021383; Fri, 4 Aug 2006 07:13:40 -0700
Received: from sjc-cde-003.cisco.com (sjc-cde-003.cisco.com [171.71.162.27]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id k74EDcHn002006; Fri, 4 Aug 2006 07:13:38 -0700 (PDT)
Date: Fri, 04 Aug 2006 07:13:38 -0700
From: Chris Lonvick <clonvick@cisco.com>
To: Miao Fuyou <miaofy@huawei.com>
Subject: RE: [Syslog] delineated datagrams
In-Reply-To: <00f801c6af25$a5423c30$8c0c6f0a@china.huawei.com>
Message-ID: <Pine.GSO.4.63.0608040708180.13343@sjc-cde-003.cisco.com>
References: <00f801c6af25$a5423c30$8c0c6f0a@china.huawei.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
DKIM-Signature: a=rsa-sha1; q=dns; l=4903; t=1154700820; x=1155564820; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=clonvick@cisco.com; z=From:Chris=20Lonvick=20<clonvick@cisco.com> |Subject:RE=3A=20[Syslog]=20delineated=20datagrams; X=v=3Dcisco.com=3B=20h=3D5ucYYxzVSkmFpt9MXr2NL3s4WYg=3D; b=DxliEOPPNoMKgHTHxgVnt8fD/Vh5pAMJcvq7K2MdU42vNslIOlCzIW5xkY7rY9FeedAF6wZy ieKydIskAx2eGqgv5ltCD44+7+Kjt1GzIRtip50q+FRnn+U/TojeLXxh;
Authentication-Results: sj-dkim-2.cisco.com; header.From=clonvick@cisco.com; dkim=pass ( sig from cisco.com verified; );
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 3fbd9b434023f8abfcb1532abaec7a21
Cc: syslog@ietf.org, 'Tom Petch' <nwnetworks@dial.pipex.com>
X-BeenThere: syslog@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/syslog>
List-Post: <mailto:syslog@lists.ietf.org>
List-Help: <mailto:syslog-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=subscribe>
Errors-To: syslog-bounces@lists.ietf.org
Hi, I'd like to get this resolved and put into the next version of the draft. Many protocols use byte-counting for framing. Many protocols use a specific character as a delimiter. Do we need both? I think that I've seen notes from Rainer, Tom Petch, and Andrew Ross saying that we should only use a special character for both simplicity of design and for interoperability with current syslog/tls implementations. Are there other opinions on this? Please speak up now. Thanks, Chris On Mon, 24 Jul 2006, Miao Fuyou wrote: > > Hi, Rainer, > > Interop is a compelling reason for protocol design, so I tend to agree with > you that it is a feature nice to have. I am wondering whether we should > define procedures for frame delineating processing in syslog-tls draft > because we have both octect-counter and LF in a record. > > Miao > >> -----Original Message----- >> From: Rainer Gerhards [mailto:rgerhards@hq.adiscon.com] >> Sent: Friday, July 21, 2006 6:16 PM >> To: Miao Fuyou; Tom Petch; syslog@ietf.org >> Subject: RE: [Syslog] delineated >> datagramswasdraft-ietf-syslog-transport-tls-01.txt >> >> Miao, >> >> I agree with your comments. However, using the LF as a record >> delimited would still allow us to interop with existing >> syslog/tls implementations. This is my major point. I think >> it is worth it. >> >> Rainer >> >>> -----Original Message----- >>> From: Miao Fuyou [mailto:miaofy@huawei.com] >>> Sent: Friday, July 21, 2006 12:00 PM >>> To: 'Tom Petch'; syslog@ietf.org >>> Subject: RE: [Syslog] delineated >>> datagramswasdraft-ietf-syslog-transport-tls-01.txt >>> >>> >>> TLS uses SHA-1 or MD5 in ciphersuite for message integrity >>> verification. If bytes lost happens during transferring, >> the message >>> will be dropped by TLS. >>> That is also the cause that we need a security mechanism >> for Syslog. >>> >>> As for error of encoding/decoding, I believe if an application does >>> encoding/decoding in a wrong way, you must not expect it do >> it right >>> with other mechanism, such as LF. >>> >>> Redundancy to improve robustness is good idea, but I don't >> think it >>> applies to this case. >>> >>>> -----Original Message----- >>>> From: Tom Petch [mailto:nwnetworks@dial.pipex.com] >>>> Sent: Tuesday, June 20, 2006 8:43 PM >>>> To: syslog@ietf.org >>>> Subject: Re: [Syslog] delineated datagrams >>>> wasdraft-ietf-syslog-transport-tls-01.txt >>>> >>>> I wonder if others share my concern about the lack of >> robustness in >>>> the way in which datagrams are delineated in the stream >> protocol (a >>>> TCP rather than a TLS issue). >>>> >>>> The system works as long as >>>> - the frame length is encoded perfectly >>>> - the frame length is decoded perfectly >>>> - no bytes are inserted or removed in error which is >> doubtless true >>>> in some networks, but I would prefer not to >>> rely on it. >>>> >>>> So, when an error occurs, can the Collector/Relay detect it? >>>> Can the Collector/Relay recover synch? If not, what does the >>>> Collector/Relay do? >>>> >>>> There is very little redundancy in the definition of >> frame length, >>>> and syslog messages have very little structure to help the >>>> application, so I think that this is an issue we should address. >>>> >>>> Tom Petch >>>> >>>> ----- Original Message ----- >>>> From: "David B Harrington" <dbharrington@comcast.net> >>>> To: <syslog@ietf.org> >>>> Sent: Tuesday, May 09, 2006 4:26 PM >>>> Subject: [Syslog] draft-ietf-syslog-transport-tls-01.txt >>>> >>>> >>>> Hi, >>>> >>>> A new revision of the syslog/TLS draft is available. >>>> >>> >> http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-tls-01 >>>> .txt >>>> >>>> We need reviewers. >>>> Can we get >>>> 1) a person to check the grammar? >>>> 2) a person to check the syslog technical parts? >>>> 3) a person to check compatibility with the other WG documents? >>>> 4) a person to check the TLS technical parts? >>>> >>>> We also need general reviews of the document by multiple people. >>>> >>>> Thanks, >>>> David Harrington >>>> co-chair, Syslog WG >>>> ietfdbh@comcast.net >>>> >>>> >>>> _______________________________________________ >>>> Syslog mailing list >>>> Syslog@lists.ietf.org >>>> https://www1.ietf.org/mailman/listinfo/syslog >>>> >>>> >>>> _______________________________________________ >>>> Syslog mailing list >>>> Syslog@lists.ietf.org >>>> https://www1.ietf.org/mailman/listinfo/syslog >>>> >>> >>> >>> >>> _______________________________________________ >>> Syslog mailing list >>> Syslog@lists.ietf.org >>> https://www1.ietf.org/mailman/listinfo/syslog >>> >> > > > > _______________________________________________ > Syslog mailing list > Syslog@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/syslog > _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
- [Syslog] draft-ietf-syslog-transport-tls-01.txt David B Harrington
- RE: [Syslog] draft-ietf-syslog-transport-tls-01.t… Rainer Gerhards
- Re: [Syslog] stream transport was draft-ietf-sysl… Tom Petch
- Re: [Syslog] ciphersuites was draft-ietf-syslog-t… Tom Petch
- RE: [Syslog] ciphersuites was draft-ietf-syslog-t… Miao Fuyou
- RE: [Syslog] stream transport wasdraft-ietf-syslo… Miao Fuyou
- Re: [Syslog] stream transport wasdraft-ietf-syslo… Darren J Moffat
- RE: [Syslog] stream transportwasdraft-ietf-syslog… Rainer Gerhards
- Re: [Syslog] delineated datagrams was draft-ietf-… Tom Petch
- [Syslog] stream transport David Harrington
- RE: [Syslog] delineated datagrams wasdraft-ietf-s… Miao Fuyou
- RE: [Syslog] delineated datagramswasdraft-ietf-sy… Rainer Gerhards
- RE: [Syslog] delineated datagrams Miao Fuyou
- RE: [Syslog] delineated datagrams Chris Lonvick
- RE: [Syslog] delineated datagrams Rainer Gerhards
- RE: [Syslog] delineated datagrams David Harrington
- RE: [Syslog] delineated datagrams Balazs Scheidler
- RE: [Syslog] delineated datagrams John Calcote
- RE: [Syslog] delineated datagrams Balazs Scheidler
- RE: [Syslog] delineated datagrams John Calcote
- RE: [Syslog] delineated datagrams Rainer Gerhards
- RE: [Syslog] delineated datagrams Balazs Scheidler
- RE: [Syslog] delineated datagrams Rainer Gerhards
- Re: [Syslog] delineated datagrams Chris Lonvick
- RE: [Syslog] delineated datagrams Rainer Gerhards
- RE: [Syslog] delineated datagrams David Harrington