Re: [Syslog] Issue 14 - Unreliable Delivery

Jon Callas <jon@callas.org> Mon, 21 June 2010 16:07 UTC

Return-Path: <jon@callas.org>
X-Original-To: syslog@core3.amsl.com
Delivered-To: syslog@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C9FA03A69DD for <syslog@core3.amsl.com>; Mon, 21 Jun 2010 09:07:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TfexutwKudj6 for <syslog@core3.amsl.com>; Mon, 21 Jun 2010 09:07:31 -0700 (PDT)
Received: from merrymeet.com (merrymeet.com [66.93.68.160]) by core3.amsl.com (Postfix) with ESMTP id 067033A6861 for <syslog@ietf.org>; Mon, 21 Jun 2010 09:07:30 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by merrymeet.com (Postfix) with ESMTP id F116E2E067 for <syslog@ietf.org>; Mon, 21 Jun 2010 09:13:07 -0700 (PDT)
Received: from merrymeet.com ([127.0.0.1]) by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 21083-07 for <syslog@ietf.org>; Mon, 21 Jun 2010 09:13:01 -0700 (PDT)
Received: from keys.merrymeet.com (keys.merrymeet.com [66.93.68.161]) (Authenticated sender: jon) by merrymeet.com (Postfix) with ESMTPA id 787A02E03F for <syslog@ietf.org>; Mon, 21 Jun 2010 09:13:01 -0700 (PDT)
Received: from [10.0.23.9] ([66.93.68.163]) by keys.merrymeet.com (PGP Universal service); Mon, 21 Jun 2010 09:00:25 -0700
X-PGP-Universal: processed; by keys.merrymeet.com on Mon, 21 Jun 2010 09:00:25 -0700
Mime-Version: 1.0 (Apple Message framework v1081)
From: Jon Callas <jon@callas.org>
In-Reply-To: <Pine.GSO.4.63.1006181711000.13308@sjc-cde-011.cisco.com>
Date: Mon, 21 Jun 2010 09:07:25 -0700
Message-Id: <C34AB181-C7CB-405C-A4D4-469F88948BDD@callas.org>
References: <Pine.GSO.4.63.1006181711000.13308@sjc-cde-011.cisco.com>
To: Chris Lonvick <clonvick@cisco.com>
X-Mailer: Apple Mail (2.1081)
X-PGP-Encoding-Format: Partitioned
X-PGP-Encoding-Version: 2.0.2
X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: quoted-printable
X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Virus-Scanned: Maia Mailguard
Cc: syslog@ietf.org
Subject: Re: [Syslog] Issue 14 - Unreliable Delivery
X-BeenThere: syslog@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/syslog>
List-Post: <mailto:syslog@ietf.org>
List-Help: <mailto:syslog-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Jun 2010 16:07:31 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> It's discussed in section 5.4 (Unreliable Delivery - in the Security Considerations section) in RFC 5426 and throughout Section 3.1 (Loss-Insensitive Messaging) in RFC 4347.  I'm thinking that it would be good to note this in Section 4 (Using DTLS to Secure Syslog) in the draft.
> 
>   Overall, the community is comfortable with the loss of information as they've been using syslog/udp for many years and know the problems with that.  RFC 5424 also notes that implementers who wish a lossless stream should be using tls/tcp as their transport.  From that, it's probably best to reference RFC 5848 (referenced as draft-ietf-syslog-sign in the draft) which can also provide an indication of loss of messages. "
> ===^^^^===
> 
> ACTION: I'd like to get some discussion going on this.  Do people think that this is good?

I think a note somewhere reminding people that DTLS is unreliable, and that syslog-sign protects both reliable and unreliable transports is reasonable, but I wouldn't spend more than a sentence on each.

	Jon


-----BEGIN PGP SIGNATURE-----
Version: PGP Universal 2.10.0 (Build 554)
Charset: us-ascii

wj8DBQFMH4yZsTedWZOD3gYRApWxAKDSm83JTiS9VAZW2Cu69HE77KOCfgCgrGvc
Z+SgfJhFZU8V3QouAhTMY3Y=
=PW/f
-----END PGP SIGNATURE-----