From nobody Sat Jun 2 06:37:01 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6708A12D875; Sat, 2 Jun 2018 06:36:54 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152794661436.529.13303090441907505185@ietfa.amsl.com> Date: Sat, 02 Jun 2018 06:36:54 -0700 Archived-At: Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Jun 2018 13:36:55 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operations and Management Area Working Group WG of the IETF. Title : Manufacturer Usage Description Specification Authors : Eliot Lear Ralph Droms Dan Romascanu Filename : draft-ietf-opsawg-mud-23.txt Pages : 61 Date : 2018-06-02 Abstract: This memo specifies a component-based architecture for manufacturer usage descriptions (MUD). The goal of MUD is to provide a means for end devices to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects. This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an LLDP TLV, a URL, an X.509 certificate extension and a means to sign and verify the descriptions. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsawg-mud-23 https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud-23 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-mud-23 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sat Jun 2 06:40:42 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92C6812D875; Sat, 2 Jun 2018 06:40:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.509 X-Spam-Level: X-Spam-Status: No, score=-14.509 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id em-Raf96e38b; Sat, 2 Jun 2018 06:40:38 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8BB8126CD8; Sat, 2 Jun 2018 06:40:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7825; q=dns/txt; s=iport; t=1527946838; x=1529156438; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=JqULkVHtGYDge3HBYEzYTx9j1HU1TJ9AAKm1qqIk/+Y=; b=GJCN0/gkApTKZThlLvmaQpuMk8O/UKCR2GhEZ4fT+dkuV9I1WcNlLLxO gI9YTfPro4aw6R8ute7ZRssYKa6QgagvYcutpBNsBTB5g5uSCdyczaPDA 0pN3D1h0q/xGpYdI45FgY4JTzWTmE2QzGkKWf3W6DvSs08T87YoXh26zX k=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CVAADJnRJb/xbLJq1cGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYQlbRIog3iIBF+NXSmPVYR3gXgIAxgBCoQDRgKCJjQYAQI?= =?us-ascii?q?BAQEBAQECbBwMhSkBAQQBASEERwsQCxIGKgICJyIOBwwGAgEBgx4CgX8PpXO?= =?us-ascii?q?BaTMfiCGBWQ+KU4EzgmmDEQEBAgEBFoRGglQCh1iRFgmDR4FVUIhwBoE8QIM?= =?us-ascii?q?4gkCFI4dcghiHJ4FBOIFSMxoIGxUaIYJDCYsHhUA9MI9xAQE?= X-IronPort-AV: E=Sophos;i="5.49,469,1520899200"; d="asc'?scan'208,217";a="4271641" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Jun 2018 13:40:35 +0000 Received: from [10.61.238.212] ([10.61.238.212]) by aer-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id w52DeYQN027248; Sat, 2 Jun 2018 13:40:35 GMT To: internet-drafts@ietf.org, i-d-announce@ietf.org Cc: opsawg@ietf.org, EKR , Benjamin Kaduk References: <152794661436.529.13303090441907505185@ietfa.amsl.com> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: Date: Sat, 2 Jun 2018 15:40:34 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <152794661436.529.13303090441907505185@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="bK9fTucidl64UMEcEmxqFoVRBTUbLbZgn" Archived-At: Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Jun 2018 13:40:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --bK9fTucidl64UMEcEmxqFoVRBTUbLbZgn Content-Type: multipart/mixed; boundary="1wJmCANwggkxn4z7Aa9AAxKt09i5Ta9Pa"; protected-headers="v1" From: Eliot Lear To: internet-drafts@ietf.org, i-d-announce@ietf.org Cc: opsawg@ietf.org, EKR , Benjamin Kaduk Message-ID: Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt References: <152794661436.529.13303090441907505185@ietfa.amsl.com> In-Reply-To: <152794661436.529.13303090441907505185@ietfa.amsl.com> --1wJmCANwggkxn4z7Aa9AAxKt09i5Ta9Pa Content-Type: multipart/alternative; boundary="------------0E454F17F777759607C026EE" Content-Language: en-US This is a multi-part message in MIME format. --------------0E454F17F777759607C026EE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable This update contains only the following changes: * A correction (signature -> certificate) * Slightly change language to make clear that the certificate subject must be the sameas the id-pe-mudsigner * Updated dates on the YANG files At this point, I really hope we're done.=C2=A0 Eric, Ben? And thanks all (including the Sec ADs) for improving the work. Eliot On 02.06.18 15:36, internet-drafts@ietf.org wrote: > A New Internet-Draft is available from the on-line Internet-Drafts dire= ctories. > This draft is a work item of the Operations and Management Area Working= Group WG of the IETF. > > Title : Manufacturer Usage Description Specification > Authors : Eliot Lear > Ralph Droms > Dan Romascanu > Filename : draft-ietf-opsawg-mud-23.txt > Pages : 61 > Date : 2018-06-02 > > Abstract: > This memo specifies a component-based architecture for manufacturer > usage descriptions (MUD). The goal of MUD is to provide a means for= > end devices to signal to the network what sort of access and network= > functionality they require to properly function. The initial focus > is on access control. Later work can delve into other aspects. > > This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an= > LLDP TLV, a URL, an X.509 certificate extension and a means to sign > and verify the descriptions. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-opsawg-mud-23 > https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud-23 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-mud-23 > > > Please note that it may take a couple of minutes from the time of submi= ssion > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg > --------------0E454F17F777759607C026EE Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

This update contains only the following changes:

  • A correction (signature -> certificate)
  • Slightly change language to make clear that the certificate subject must be the sameas the id-pe-mudsigner
  • Updated dates on the YANG files

At this point, I really hope we're done.=C2=A0 Eric, Ben?

And thanks all (including the Sec ADs) for improving the work.
=

Eliot

On 02.06.18 15:36, internet-drafts@ietf.org wrote:
A New Internet-Draft is available from the on-line Internet-Drafts direct=
ories.
This draft is a work item of the Operations and Management Area Working G=
roup WG of the IETF.

        Title           : Manufacturer Usage Description Specification
        Authors         : Eliot Lear
                          Ralph Droms
                          Dan Romascanu
	Filename        : draft-ietf-opsawg-mud-23.txt
	Pages           : 61
	Date            : 2018-06-02

Abstract:
   This memo specifies a component-based architecture for manufacturer
   usage descriptions (MUD).  The goal of MUD is to provide a means for
   end devices to signal to the network what sort of access and network
   functionality they require to properly function.  The initial focus
   is on access control.  Later work can delve into other aspects.

   This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an
   LLDP TLV, a URL, an X.509 certificate extension and a means to sign
   and verify the descriptions.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-op=
sawg-mud/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-opsawg-mud=
-23
https://datatracker.ietf.org/doc/html/d=
raft-ietf-opsawg-mud-23

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraft=
-ietf-opsawg-mud-23


Please note that it may take a couple of minutes from the time of submiss=
ion
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
OPSAWG mailing list
OPS=
AWG@ietf.org
https://www.ietf.org/mailman/listinfo/opsawg

--------------0E454F17F777759607C026EE-- --1wJmCANwggkxn4z7Aa9AAxKt09i5Ta9Pa-- --bK9fTucidl64UMEcEmxqFoVRBTUbLbZgn Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlsSnlIACgkQh7ZrRtnS ejPUBgf/bLz1JF5iKhBGZDu/PLfAwmZ9iCCMd8x7GMoZlJtANIt00SI2XA3lWNY1 doVf/F8gOVcOrnwuaSGIApBki8MH0ADU/OsAzVFKUL4h1/wi9eF+/s5T1pZtHNYR rHUxVI3KymJ33tuqIQFu9yHkkSG8AWAUUGL76KaCv94yYL90rTKBTu29yP7zmnXX EAcSfYqhIgaX+QJdvrlXMVV8LNGaPgN6blOUzVi20HbZ9JV8kDRpOPwjFed9ssLw GREk0LxukI03YJPrTzkqb071oHPy+Jd37And0+kJ/J5hGX6ndqaPVtHsjmyAWyvS uuY5n3YttrlecSgxqXekNtc/099i6g== =SfBA -----END PGP SIGNATURE----- --bK9fTucidl64UMEcEmxqFoVRBTUbLbZgn-- From nobody Mon Jun 4 08:40:56 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 436E212898C for ; Mon, 4 Jun 2018 08:40:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 95lW-KqO_-gg for ; Mon, 4 Jun 2018 08:40:54 -0700 (PDT) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C46D7128821 for ; Mon, 4 Jun 2018 08:40:53 -0700 (PDT) X-AuditID: 1209190f-297ff70000002b7e-78-5b155d847164 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-4.mit.edu (Symantec Messaging Gateway) with SMTP id EE.8B.11134.48D551B5; Mon, 4 Jun 2018 11:40:52 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id w54FeoA3007390; Mon, 4 Jun 2018 11:40:51 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w54FekaL016166 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 4 Jun 2018 11:40:49 -0400 Date: Mon, 4 Jun 2018 10:40:46 -0500 From: Benjamin Kaduk To: Eliot Lear Cc: opsawg@ietf.org, EKR Message-ID: <20180604154046.GF72167@kduck.kaduk.org> References: <152794661436.529.13303090441907505185@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="n8g4imXOkfNTN/H1" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrJKsWRmVeSWpSXmKPExsUixCmqrdsSKxptsL9fx2LF63PsFl//dbBY rDi5mcmB2WPK742sHkuW/GTymPy4jTmAOYrLJiU1J7MstUjfLoEr4/CEBawF8wwr/v+Pa2Cc od7FyMkhIWAiseTnBzYQW0hgMZPEkY31XYxcQPYGRonZaycyQSSuMElc/C4KYrMIqEjs+/Ad LM4GZDd0X2YGsUUE5CVaz+5nBbGZBdQlHnzfDGYLC9hJnOvoBbN5gZa1HOuDWlYq8b71KVRc UOLkzCcsEL1lEvf3vmfsYuQAsqUllv/jAAlzCthKvF+3AKxEVEBZYm/fIfYJjAKzkHTPQtI9 C6EbIqwjsXPrHTYMYW2JZQtfM0PYthLr1r1nWcDIvopRNiW3Sjc3MTOnODVZtzg5MS8vtUjX RC83s0QvNaV0EyM4JiT5dzDOafA+xCjAwajEw9tgIxotxJpYVlyZe4hRkoNJSZQ3WxEoxJeU n1KZkVicEV9UmpNafIhRBWjXow2rLzBKseTl56UqifCetgCq401JrKxKLcqHKZPmYFES581e xBgtJJCeWJKanZpakFoEk5Xh4FCS4C2JAWoULEpNT61Iy8wpQUgzcXAeYpTg4AEaHgZSw1tc kJhbnJkOkT/FqMsxbVlPD7MQ2AVS4rw8IEUCIEUZpXlwc0ApTiJ7f80rRnGgF4V5bUCqeIDp EW7SK6AlTEBLnlUIgywpSURISTUwFpfrKLHNM43RafrnMVN7quMkEZOCT4sX3gv3W/DRf92z U3HPtz3LynvxPGnPqZo1uw/Ez7n2WHSHuuNPe9O4CWc4JaZozleIfCv6rK6ce8nhx50Bq/0l 5u468t7aYY3ps/CeP1f5v4bIXnfgtWz+GSXovXqW/0LOGfGnK7NmSt+az/00VEfIXYmlOCPR UIu5qDgRAFJJlg9MAwAA Archived-At: Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2018 15:40:55 -0000 --n8g4imXOkfNTN/H1 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Eliot, On Sat, Jun 02, 2018 at 03:40:34PM +0200, Eliot Lear wrote: > This update contains only the following changes: >=20 > * A correction (signature -> certificate) > * Slightly change language to make clear that the certificate subject > must be the sameas the id-pe-mudsigner > * Updated dates on the YANG files >=20 > At this point, I really hope we're done.=A0 Eric, Ben? I think we're basically done -- I have just one quibble which hopefully is not problematic, and also noted a handful of editorial things you can deal with at your leisure. Thanks for going through the multiple rounds of changes addressing our concerns -- the document really is much better for it! At the start of the Security Considerations, we say: Based on how a MUD URL is emitted, a Thing may be able to lie about what it is, thus gaining additional network access. This happens when a device emits a MUD URL using DHCP or LLDP, and is either inappropriately admitted to a class such as "same-manufacturer" or given access to a device such as "my-controller", where such access would otherwise be disallowed. To me, "[t]his happens when" indicates that the subsequent enumeration is an exhaustive list. I don't really think we've got enough experience with this stuff to be able to make such a claim, and the list should instead be treated as illustrative. I think that there was some text emailed around that did this nicely, something like: % Based on how a MUD URL is emitted, a Thing may be able to lie about % what it is, thus gaining additional network access. This can happen % in a number of ways when a device emits a MUD URL using DHCP or % LLDP, such as being inappropriately admitted to a class such as % "same-manufacturer", given access to a device such as % "my-controller", or being permitted access to an Internet resource, % where such access would otherwise be disallowed. And, here's the editorial stuff. Section 1.5 o A DHCP option[RFC2131],[RFC3315] that the DHCP client uses to inform the DHCP server. The DHCP server may take further actions, such as act as the MUD manager or otherwise pass it along to the MUD manager. nit: We lost the immediately previous "URL" that "it" referred to, so we may want to specifically say "pass the MUD URL along". Section 13.2 Prior to processing the rest of a MUD file, the MUD manager MUST retrieve the MUD signature file by retrieving the value of "mud- signature" and validating the signature across the MUD file. The Key Usage Extension in the signing certificate MUST have the bit digitalSignature(0) set. nit: do we need to go with "MUST be present and have the bit digitalsignature(0) set"? The subject of this certificate MUST be equal to that of the value of id-pe-mudsigner when that extension is present in the device certificate. If these conditions are not met, or if it cannot validate the chain of trust to a known trust anchor, the MUD manager MUST cease processing the MUD file until an administrator has given approval. nit-level as well, I guess: I might wordsmith this differently. NEW: When the id-pe-mudsigner extension is present in a device's X.509 certificate, the MUD signature file MUST have been generated by a certificate whose subject matches the contents of that id-pe-mudsigner extension. If these conditions are not met, or if it cannot validate the chain of trust to a known trust anchor, the MUD manager MUST cease processing the MUD file until an administrator has given approval. I might also consider adding something like the following (though hopefully it would be obvious and thus not necessary to say): Before the signature has been validated, both the MUD file and the resource retrived from the "mud-signature" URL are unverified and should be treated as untrusted input. In particular, MUD managers can impose a cap on the number of bytes they retrieve from a "mud-signature" URL, to avoid DoS attacks involving presenting a large (invalid) signature file or similar scenarios. Section 16 Implementations SHOULD be configurable to disallow additive access for devices using MUD-URLs that not emitted in a secure fashion such as in a certificate. nit: "that are not emitted". When certificates are not present, Things claiming to be of a certain manufacturer SHOULD NOT be included in that manufacturer grouping without additional validation of some form. This will be relevant when it makes use of primitives such as "manufacturer" for the purpose of accessing Things of a particular type. What is "it" that makes use of primitives such as "manufacturer"? [...] If the actual MUD file has changed, the MUD manager MAY check the WHOIS database to see if registration ownership of a domain has changed. Do we need a reference for WHOIS? Appendix C In this sample extension we augment the core MUD model to indicate whether the device implements DETNET. If a device claims not to use NETNET, but then later attempts to do so, a notification or exception That's also supposed to be 'D'ETNET, right? -Benjamin --n8g4imXOkfNTN/H1 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQG3BAABCgAdFiEE2WGV4E2ARf9BYP0XKNmm82TrdRIFAlsVXXgACgkQKNmm82Tr dRKXjwwfavF3dWPLjvKHUGg4drQE9kkefTkXSAJ1aG1jhvPRKf8LlRmcVFyNwAuE dIWYNy0h8NVYjyn1PI6q43Gn55Ij3BZ+ohVFrxo5KH16ylEoYl/PccSCq4Z5zaF2 H5YH8adU7j+oOpiHzQykgWcb7CsU2oUgc0+Tp4pDKRX4ZyXBYuQCFrK1HB+7hGk9 601Oy4EcTDgLafH2dtH6vtWe92YQ+ybKPEznXbE7M9W/t1Gpjv9iEjbHhjWSOU7a k4uou9G2ub/AQUjSs6ReBy5CSGpYfvapBRTuUAvhfPGl0Hlqlx8E9RjiX+qClBwt CBZ7y5bRqBJNUGvmoADit20GcFB4aLMwqjMnBZlE2zOb+1A+jvJB1ohCuw8Ye+th 8NfAwpao9Ek0/w/01lwCDW0htFQxE6rPh0iwuHrnntYP5F7FwgEcY8OBlo/hkRYJ UsKMnfgOHK1a/1tRqrDYoAMAmMpvPkwg2UjA1s8kwaqJlnWnoNvgU6SY4WDDlEks SGMBdPqG7jNsGA== =wmU2 -----END PGP SIGNATURE----- --n8g4imXOkfNTN/H1-- From nobody Mon Jun 4 10:57:57 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFB3E130DC0 for ; Mon, 4 Jun 2018 10:57:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JQ1k0ymBlx_4 for ; Mon, 4 Jun 2018 10:57:52 -0700 (PDT) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92027130DBE for ; Mon, 4 Jun 2018 10:57:52 -0700 (PDT) X-AuditID: 1209190f-fafff70000007185-f0-5b157d9d8493 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-4.mit.edu (Symantec Messaging Gateway) with SMTP id 9D.FB.29061.D9D751B5; Mon, 4 Jun 2018 13:57:50 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id w54Hvlrl025872; Mon, 4 Jun 2018 13:57:48 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w54Hvimc031264 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 4 Jun 2018 13:57:46 -0400 Date: Mon, 4 Jun 2018 12:57:44 -0500 From: Benjamin Kaduk To: Eliot Lear Cc: opsawg@ietf.org, EKR Message-ID: <20180604175744.GH72167@kduck.kaduk.org> References: <152794661436.529.13303090441907505185@ietfa.amsl.com> <20180604154046.GF72167@kduck.kaduk.org> <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dc+cDN39EJAMEtIO" Content-Disposition: inline In-Reply-To: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrDKsWRmVeSWpSXmKPExsUixCmqrDuvVjTaYPY/ZosVr8+xW3z918Fi seLkZiYHZo8pvzeyeixZ8pPJY/LjNuYA5igum5TUnMyy1CJ9uwSujPMNG9kLllhVfN4+n62B cbluFyMnh4SAicSfmXdYuxi5OIQEFjNJtB/4yQzhbGCUmPJ8BytIlZDAFSaJa7NFQGwWARWJ Y/fvgsXZgOyG7svMILaIgLxE69n9YHFmAXWJB983g9nCAnYS5zp6wWxeoG2//i9lg1hwmVGi 5dF5FoiEoMTJmU9YIJrLJFZM/8TexcgBZEtLLP/HARLmFLCV+LvyBhuILSqgLLG37xD7BEaB WUi6ZyHpnoXQDRHWkdi59Q4bhrC2xLKFr5khbFuJdevesyxgZF/FKJuSW6Wbm5iZU5yarFuc nJiXl1qka6KXm1mil5pSuokRHBmS/DsY5zR4H2IU4GBU4uFtsBGNFmJNLCuuzD3EKMnBpCTK G58GFOJLyk+pzEgszogvKs1JLT7EqAK069GG1RcYpVjy8vNSlUR4TxcA1fGmJFZWpRblw5RJ c7AoifNmL2KMFhJITyxJzU5NLUgtgsnKcHAoSfC21AA1ChalpqdWpGXmlCCkmTg4DzFKcPAA De8HqeEtLkjMLc5Mh8ifYtTlmLasp4dZCOwCKXHeJSBFAiBFGaV5cHNAiU4ie3/NK0ZxoBeF eXeBVPEAkyTcpFdAS5iAljyrEAZZUpKIkJJqYLQ6ukHc8vtZ8zd8XcHr9z3JSP164cn7u01R dgfuXUztOsD8/vH+Z8de1wptnLUyTzWgLCflyrx5Z7UWvk2S97LrPnE35Mm/rQvD3n25OO+y 98lnp3ecT9AJZBH7yJGQcSzQ95ZjwLQ953iv9z2dV90QmtP64iDDC9fQllNVU4uqXQ389rLK GJoosRRnJBpqMRcVJwIAm/Mo5E8DAAA= Archived-At: Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2018 17:57:55 -0000 --dc+cDN39EJAMEtIO Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jun 04, 2018 at 07:50:47PM +0200, Eliot Lear wrote: > Ben, >=20 > Barring any objections to the below I will issue a new draft with edits > tomorrow.=A0 Now please see below. Okay, thanks. (I'm okay with leaving out the extra text about the file+signature being untrusted input until the signature is verifeid.) -Benjamin > On 04.06.18 17:40, Benjamin Kaduk wrote: > > Hi Eliot, > > > > On Sat, Jun 02, 2018 at 03:40:34PM +0200, Eliot Lear wrote: > >> This update contains only the following changes: > >> > >> * A correction (signature -> certificate) > >> * Slightly change language to make clear that the certificate subject > >> must be the sameas the id-pe-mudsigner > >> * Updated dates on the YANG files > >> > >> At this point, I really hope we're done.=A0 Eric, Ben? > > I think we're basically done -- I have just one quibble which > > hopefully is not problematic, and also noted a handful of editorial > > things you can deal with at your leisure. Thanks for going through > > the multiple rounds of changes addressing our concerns -- the > > document really is much better for it! > > > > At the start of the Security Considerations, we say: > > > > Based on how a MUD URL is emitted, a Thing may be able to lie about > > what it is, thus gaining additional network access. This happens > > when a device emits a MUD URL using DHCP or LLDP, and is either > > inappropriately admitted to a class such as "same-manufacturer" or > > given access to a device such as "my-controller", where such access > > would otherwise be disallowed. > > > > To me, "[t]his happens when" indicates that the subsequent > > enumeration is an exhaustive list. I don't really think we've got > > enough experience with this stuff to be able to make such a claim, > > and the list should instead be treated as illustrative. I think > > that there was some text emailed around that did this nicely, > > something like: > > > > % Based on how a MUD URL is emitted, a Thing may be able to lie about > > % what it is, thus gaining additional network access. This can happen > > % in a number of ways when a device emits a MUD URL using DHCP or > > % LLDP, such as being inappropriately admitted to a class such as > > % "same-manufacturer", given access to a device such as > > % "my-controller", or being permitted access to an Internet resource, > > % where such access would otherwise be disallowed. >=20 > I think that's fine. > > > > > > And, here's the editorial stuff. > > > > Section 1.5 > > > > o A DHCP option[RFC2131],[RFC3315] that the DHCP client uses to > > inform the DHCP server. The DHCP server may take further actions, > > such as act as the MUD manager or otherwise pass it along to the > > MUD manager. > > > > nit: We lost the immediately previous "URL" that "it" referred to, so we > > may want to specifically say "pass the MUD URL along". > > > > Section 13.2 > > > > Prior to processing the rest of a MUD file, the MUD manager MUST > > retrieve the MUD signature file by retrieving the value of "mud- > > signature" and validating the signature across the MUD file. The Key > > Usage Extension in the signing certificate MUST have the bit > > digitalSignature(0) set. > > > > nit: do we need to go with "MUST be present and have the bit > > digitalsignature(0) set"? >=20 > That is fine. > > > > The subject of this certificate MUST be > > equal to that of the value of id-pe-mudsigner when that extension is > > present in the device certificate. If these conditions are not met, > > or if it cannot validate the chain of trust to a known trust anchor, > > the MUD manager MUST cease processing the MUD file until an > > administrator has given approval. > > > > nit-level as well, I guess: I might wordsmith this differently. > > > > NEW: > > > > When the id-pe-mudsigner extension is present in a device's X.509 > > certificate, the MUD signature file MUST have been generated by > > a certificate whose subject matches the contents of that > > id-pe-mudsigner extension. If these conditions are not met, > > or if it cannot validate the chain of trust to a known trust anchor, > > the MUD manager MUST cease processing the MUD file until an > > administrator has given approval. >=20 > Ok. > > > > I might also consider adding something like the following (though > > hopefully it would be obvious and thus not necessary to say): > > > > Before the signature has been validated, both the MUD file and > > the resource retrived from the "mud-signature" URL are unverified > > and should be treated as untrusted input. In particular, MUD > > managers can impose a cap on the number of bytes they retrieve > > from a "mud-signature" URL, to avoid DoS attacks involving > > presenting a large (invalid) signature file or similar scenarios. >=20 > I would rather leave this out for the very reasons you state.=A0 The draft > is already quite wordy. > > > > Section 16 > > > > Implementations SHOULD be configurable to > > disallow additive access for devices using MUD-URLs that not emitted > > in a secure fashion such as in a certificate. > > > > nit: "that are not emitted". >=20 > Ok > > > > When certificates are not present, Things claiming to be of a certain > > manufacturer SHOULD NOT be included in that manufacturer grouping > > without additional validation of some form. This will be relevant > > when it makes use of primitives such as "manufacturer" for the > > purpose of accessing Things of a particular type. > > > > What is "it" that makes use of primitives such as "manufacturer"? >=20 > the MUD manager. > > > > [...] If the actual MUD file has changed, the MUD > > manager MAY check the WHOIS database to see if registration ownership > > of a domain has changed. > > > > Do we need a reference for WHOIS? >=20 > I don't think so.=A0 RFC Editor will sort if so. > > > > Appendix C > > > > In this sample extension we augment the core MUD model to indicate > > whether the device implements DETNET. If a device claims not to use > > NETNET, but then later attempts to do so, a notification or exception > > > > That's also supposed to be 'D'ETNET, right? >=20 > Indeed.=A0 Thanks. >=20 > Eliot >=20 >=20 --dc+cDN39EJAMEtIO Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQG3BAABCgAdFiEE2WGV4E2ARf9BYP0XKNmm82TrdRIFAlsVfZIACgkQKNmm82Tr dRI3EQwfTpwDdoq/jRrVZybjWFLTPWaru79e0YPZl7Ld+BuxA5gyvm41ytCqJSZu 0WyAORodQOY1WrQIJABCB24iGps24mLswBk2fa15hsPNdZp35eE90j2xVl1HTD/l KIg1qSPDnq+fFc2kIr8zAUWQMmeHcnruu2d7ATFhQ85/DX0pEIdnUhG+d7REJ4QV 0yDJhnD52AE6J6NlcVpbNhfXu/7SYftrUGlfV/BP/91Hmd/NduDTHy9XWs9Mg/QU UrKMtZCf3x3KovllxsUsD0OJ9N1ZDaoP2eIDwQoblqbho5OSCHbra0afrVScYY7X iUdpL6NASb1MhfAAg43EH3IvkYzNfr2Xlm4dQcAohieB/h7nGBJAQtGvKc3dKYRT XbvyIDM8+XbqXGlbECDvmJPB0arD7un/Z/Oj/C/vUJNRtjYabcOho+kqwtzGPivG 1cuD9VkFRqvQoyMGbrS/Lp8TItvutvvX+sWQKMhmrxAaf585sIoZoUkhUj3jWw7R rJ7hD4rHNgVUmA== =xbHn -----END PGP SIGNATURE----- --dc+cDN39EJAMEtIO-- From nobody Mon Jun 4 14:49:46 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 807CA130E00 for ; Mon, 4 Jun 2018 14:49:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.25 X-Spam-Level: X-Spam-Status: No, score=-14.25 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oMIYXeirDHxy for ; Mon, 4 Jun 2018 14:49:42 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55EB3130DFE for ; Mon, 4 Jun 2018 14:49:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12987; q=dns/txt; s=iport; t=1528148981; x=1529358581; h=references:subject:to:from:message-id:date:mime-version: in-reply-to; bh=krhoWDNsgjIvpPsHufBA7xYgf6xd3wNkKhE1qPX5Dks=; b=kNYt2XmOm2Cl9dOWsZizQPhpsUsQy+VL6q+ZnEJwPhkb5xleAHjrvZET YRdQP7EF3OgUQjwC0YVZrj134Z3W99TIjZk7+ptjajlporrqwkxNs21GL oXzsLyoqrXh/0y0vAtJm3rGivkIeNbrPzte05Q0sLzttc/D3qyh0sd51o 8=; X-Files: signature.asc, signature.asc : 3005, 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C1BQCSshVb/xbLJq1cGQEBAQECAQE?= =?us-ascii?q?BAQEIAQEBAYMagXkShCCIY41fCCGPVIR3gXgIA4RsAoIxNhYBAgEBAQEBAQJ?= =?us-ascii?q?sHQtXAQGERgoBBSMERQIbDgECEioCAk0KBg0IAQGDHgKBf6ZqgWkzH4gigVk?= =?us-ascii?q?PilWBDyQMgl2ELTCDFoJUAocmMpEWCYNHgVWBQIgBBoE8g3iCQIUmh1+JQIF?= =?us-ascii?q?ICidAgRIzGggbFTuCRIIaAgMXegECjRw9jFYSGw0XB4IaAQE?= X-IronPort-AV: E=Sophos;i="5.49,477,1520899200"; d="asc'?eml'208?scan'208,208,217";a="4259989" Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 04 Jun 2018 21:49:39 +0000 Received: from [10.61.163.162] ([10.61.163.162]) by aer-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id w54LndqK000724 for ; Mon, 4 Jun 2018 21:49:39 GMT References: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> To: "opsawg@ietf.org" From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== X-Forwarded-Message-Id: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> Message-ID: Date: Mon, 4 Jun 2018 23:49:35 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="1qMfu0FGi6A8ZjGeKYP4nfdpb46IOYZ8S" Archived-At: Subject: [OPSAWG] Fwd: I-D Action: draft-ietf-opsawg-mud-23.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2018 21:49:45 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --1qMfu0FGi6A8ZjGeKYP4nfdpb46IOYZ8S Content-Type: multipart/mixed; boundary="DcrTs7YD1FiF8Wuunmq53XgPIZqtKBxod"; protected-headers="v1" From: Eliot Lear To: "opsawg@ietf.org" Message-ID: Subject: Fwd: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt References: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> In-Reply-To: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> --DcrTs7YD1FiF8Wuunmq53XgPIZqtKBxod Content-Type: multipart/mixed; boundary="------------8308E9D6AA8BE799D9544A88" Content-Language: en-US This is a multi-part message in MIME format. --------------8308E9D6AA8BE799D9544A88 Content-Type: multipart/alternative; boundary="------------8A372E8762298A43AB18957F" --------------8A372E8762298A43AB18957F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I've been told to resend this message due to a mailing list glitch.=C2=A0= Please see below. --------------8A372E8762298A43AB18957F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

I've been told to resend this message due to a mailing list glitc<= font size=3D"+1">h.=C2=A0 Please see below.

--------------8A372E8762298A43AB18957F-- --------------8308E9D6AA8BE799D9544A88 Content-Type: message/rfc822; name="Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23_txt.eml" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename*0="Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23_txt.eml" X-Mozilla-Keys: Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt To: Benjamin Kaduk Cc: opsawg@ietf.org, EKR References: <152794661436.529.13303090441907505185@ietfa.amsl.com> <20180604154046.GF72167@kduck.kaduk.org> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> Date: Mon, 4 Jun 2018 19:50:47 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <20180604154046.GF72167@kduck.kaduk.org> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="i6gI2waD2P6S5KbZiBuBKPgNQkjRdWhJ3" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --i6gI2waD2P6S5KbZiBuBKPgNQkjRdWhJ3 Content-Type: multipart/mixed; boundary="LkdwjiRdL7BR4zhvED5QsteaGwbzgjyCm"; protected-headers="v1" From: Eliot Lear To: Benjamin Kaduk Cc: opsawg@ietf.org, EKR Message-ID: <5308aaa9-ef66-dd94-14bb-a7261020c1de@cisco.com> Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-23.txt References: <152794661436.529.13303090441907505185@ietfa.amsl.com> <20180604154046.GF72167@kduck.kaduk.org> In-Reply-To: <20180604154046.GF72167@kduck.kaduk.org> --LkdwjiRdL7BR4zhvED5QsteaGwbzgjyCm Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Ben, Barring any objections to the below I will issue a new draft with edits tomorrow.=C2=A0 Now please see below. On 04.06.18 17:40, Benjamin Kaduk wrote: > Hi Eliot, > > On Sat, Jun 02, 2018 at 03:40:34PM +0200, Eliot Lear wrote: >> This update contains only the following changes: >> >> * A correction (signature -> certificate) >> * Slightly change language to make clear that the certificate subjec= t >> must be the sameas the id-pe-mudsigner >> * Updated dates on the YANG files >> >> At this point, I really hope we're done.=C2=A0 Eric, Ben? > I think we're basically done -- I have just one quibble which > hopefully is not problematic, and also noted a handful of editorial > things you can deal with at your leisure. Thanks for going through > the multiple rounds of changes addressing our concerns -- the > document really is much better for it! > > At the start of the Security Considerations, we say: > > Based on how a MUD URL is emitted, a Thing may be able to lie about > what it is, thus gaining additional network access. This happens > when a device emits a MUD URL using DHCP or LLDP, and is either > inappropriately admitted to a class such as "same-manufacturer" or > given access to a device such as "my-controller", where such access > would otherwise be disallowed. > > To me, "[t]his happens when" indicates that the subsequent > enumeration is an exhaustive list. I don't really think we've got > enough experience with this stuff to be able to make such a claim, > and the list should instead be treated as illustrative. I think > that there was some text emailed around that did this nicely, > something like: > > % Based on how a MUD URL is emitted, a Thing may be able to lie about= > % what it is, thus gaining additional network access. This can happe= n > % in a number of ways when a device emits a MUD URL using DHCP or > % LLDP, such as being inappropriately admitted to a class such as > % "same-manufacturer", given access to a device such as > % "my-controller", or being permitted access to an Internet resource,= > % where such access would otherwise be disallowed. I think that's fine. > > > And, here's the editorial stuff. > > Section 1.5 > > o A DHCP option[RFC2131],[RFC3315] that the DHCP client uses to > inform the DHCP server. The DHCP server may take further actions= , > such as act as the MUD manager or otherwise pass it along to the > MUD manager. > > nit: We lost the immediately previous "URL" that "it" referred to, so w= e > may want to specifically say "pass the MUD URL along". > > Section 13.2 > > Prior to processing the rest of a MUD file, the MUD manager MUST > retrieve the MUD signature file by retrieving the value of "mud- > signature" and validating the signature across the MUD file. The Ke= y > Usage Extension in the signing certificate MUST have the bit > digitalSignature(0) set. > > nit: do we need to go with "MUST be present and have the bit > digitalsignature(0) set"? That is fine. > > The subject of this certificate MUST be > equal to that of the value of id-pe-mudsigner when that extension is= > present in the device certificate. If these conditions are not met,= > or if it cannot validate the chain of trust to a known trust anchor,= > the MUD manager MUST cease processing the MUD file until an > administrator has given approval. > > nit-level as well, I guess: I might wordsmith this differently. > > NEW: > > When the id-pe-mudsigner extension is present in a device's X.509 > certificate, the MUD signature file MUST have been generated by > a certificate whose subject matches the contents of that > id-pe-mudsigner extension. If these conditions are not met, > or if it cannot validate the chain of trust to a known trust anchor,= > the MUD manager MUST cease processing the MUD file until an > administrator has given approval. Ok. > > I might also consider adding something like the following (though > hopefully it would be obvious and thus not necessary to say): > > Before the signature has been validated, both the MUD file and > the resource retrived from the "mud-signature" URL are unverified > and should be treated as untrusted input. In particular, MUD > managers can impose a cap on the number of bytes they retrieve > from a "mud-signature" URL, to avoid DoS attacks involving > presenting a large (invalid) signature file or similar scenarios. I would rather leave this out for the very reasons you state.=C2=A0 The d= raft is already quite wordy. > > Section 16 > > Implementations SHOULD be configurable to > disallow additive access for devices using MUD-URLs that not emitted= > in a secure fashion such as in a certificate. > > nit: "that are not emitted". Ok > > When certificates are not present, Things claiming to be of a certai= n > manufacturer SHOULD NOT be included in that manufacturer grouping > without additional validation of some form. This will be relevant > when it makes use of primitives such as "manufacturer" for the > purpose of accessing Things of a particular type. > > What is "it" that makes use of primitives such as "manufacturer"? the MUD manager. > > [...] If the actual MUD file has changed, the MUD > manager MAY check the WHOIS database to see if registration ownershi= p > of a domain has changed. > > Do we need a reference for WHOIS? I don't think so.=C2=A0 RFC Editor will sort if so. > > Appendix C > > In this sample extension we augment the core MUD model to indicate > whether the device implements DETNET. If a device claims not to use= > NETNET, but then later attempts to do so, a notification or exceptio= n > > That's also supposed to be 'D'ETNET, right? Indeed.=C2=A0 Thanks. Eliot --LkdwjiRdL7BR4zhvED5QsteaGwbzgjyCm-- --i6gI2waD2P6S5KbZiBuBKPgNQkjRdWhJ3 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlsVe/gACgkQh7ZrRtnS ejP+8Qf/Zc5seO3VPo24fPUCIzd42VlXQD68YOwD8AzFrDRr7mr58AGxDHfN90CB GAYLdg/DHynNlCY2dVVtrbMKmnJX+JwztruDYmpOky+3OER64MzAO59VC7ZfyWQ/ iIpI+H50buWxhRHHc1R9koV8nUWkmpOCNy0IwdaJQGBzP5LmmktTVk3aq5tT+Wve OPjZe4H3VTdWh+uqeSIuhK95MvSOcXcv2fx0z4xpirVgQOh0Ojv2ZZm7YXdztXHr VQIqwvHvCdqkmTD4mvJoEuopKtTUIOXN2y+kxuDYvL03+0UqjpFJ9JCmOyjnUzf1 Xz+TjtaRlEp3R0r9b0UCKK3wF00XGw== =aWYw -----END PGP SIGNATURE----- --i6gI2waD2P6S5KbZiBuBKPgNQkjRdWhJ3-- --------------8308E9D6AA8BE799D9544A88-- --DcrTs7YD1FiF8Wuunmq53XgPIZqtKBxod-- --1qMfu0FGi6A8ZjGeKYP4nfdpb46IOYZ8S Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlsVs+8ACgkQh7ZrRtnS ejPzOAf9E6TTLejEJdy6C/7JNRYcHEmhE8RDaet+0233pb2eKlrATOWRIVlljUvO gTrvYxg74Jr7hqSfYqH9jAtly6NFjdLLiGZSKDchEBVyASRqOPHKx3QPdQbEpSXl 1j51rLLSjqomtH0wL25w0Ns5pb18UnWGw0o2QPQNX2mauaGr9KkjZdYyFeQKRD+T +EHYTdgET1+0wWBtfU79VO70Rpw2syxTdVDHHVqPrLX+a0EubEUIJ+L90hBbJloJ pbF1tz9MB1HLi63mGEvm3e9VHiCrq/kbcDkOsNsBqz750t2xk9HMVprfCMSKeavr eEYpN5OqZAHiHTxCFjkko+jcKB7Ulg== =10XO -----END PGP SIGNATURE----- --1qMfu0FGi6A8ZjGeKYP4nfdpb46IOYZ8S-- From nobody Mon Jun 4 23:28:59 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 66226130EBD; Mon, 4 Jun 2018 23:28:52 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152818013236.6949.17625366562826746635@ietfa.amsl.com> Date: Mon, 04 Jun 2018 23:28:52 -0700 Archived-At: Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-24.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jun 2018 06:28:53 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operations and Management Area Working Group WG of the IETF. Title : Manufacturer Usage Description Specification Authors : Eliot Lear Ralph Droms Dan Romascanu Filename : draft-ietf-opsawg-mud-24.txt Pages : 61 Date : 2018-06-04 Abstract: This memo specifies a component-based architecture for manufacturer usage descriptions (MUD). The goal of MUD is to provide a means for end devices to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects. This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an LLDP TLV, a URL, an X.509 certificate extension and a means to sign and verify the descriptions. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsawg-mud-24 https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud-24 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-mud-24 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jun 4 23:29:51 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BBDF130EDE for ; Mon, 4 Jun 2018 23:29:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Evv3R7DF5YRS for ; Mon, 4 Jun 2018 23:29:48 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DCEA130EBD for ; Mon, 4 Jun 2018 23:29:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12217; q=dns/txt; s=iport; t=1528180188; x=1529389788; h=references:subject:to:from:message-id:date:mime-version: in-reply-to; bh=G4gYSlnXF4abtTdxnc9zQL1Xp5x3AoWdA7j4EWvxd5I=; b=QP7oC4Sn1MXKhgsPqKl2/4/sor/OHCclQTZNcICVvFVq0fPSkzsW5tfH OgEHHV5e5Dz87f5Uest4mK+ddc8xUFP3MiIhajLogt7tYfjLDuBRyQp3G 3l/HKfDgHZq9r1Cts7s4vgeF2ErzWRPQCZ261Yo9KxoKFrAInmXwJNzkB w=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CpAAB0LRZb/xbLJq1cDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQGEJX8og3iIBF+NXgiUbIF4CAMjhEkCgjM0GAECAQEBAQE?= =?us-ascii?q?BAmwcDIUpBiNUEh0wAgJJBAoGAQwIAQGDHgKBfw+nC4IciEGBWQ+KVYEzDIJ?= =?us-ascii?q?cgxEBAQIBARaERoJUAodYhFaMQAmDR4FVUIhxBoE8QIM4gkCFJol4hyeBQTi?= =?us-ascii?q?BUjMaCBsVGoJkCYsHhQQ8PTABj0EBAQ?= X-IronPort-AV: E=Sophos;i="5.49,478,1520899200"; d="asc'?eml'208?scan'208,208";a="4321600" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jun 2018 06:29:46 +0000 Received: from [10.61.163.162] ([10.61.163.162]) by aer-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id w556Tj3j023617; Tue, 5 Jun 2018 06:29:45 GMT References: <152818013269.6949.3550756401546069878.idtracker@ietfa.amsl.com> To: "opsawg@ietf.org" , Ignas Bagdonas , EKR , Benjamin Kaduk From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== X-Forwarded-Message-Id: <152818013269.6949.3550756401546069878.idtracker@ietfa.amsl.com> Message-ID: Date: Tue, 5 Jun 2018 08:29:40 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <152818013269.6949.3550756401546069878.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="8wi5z91bcXjomyL5SFUlvbzWFbLgtp9Df" Archived-At: Subject: [OPSAWG] Fwd: New Version Notification for draft-ietf-opsawg-mud-24.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jun 2018 06:29:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --8wi5z91bcXjomyL5SFUlvbzWFbLgtp9Df Content-Type: multipart/mixed; boundary="L0vRbYEgzDUi3HJq7COOzQvszK5uh6GYD"; protected-headers="v1" From: Eliot Lear To: "opsawg@ietf.org" , Ignas Bagdonas , EKR , Benjamin Kaduk Message-ID: Subject: Fwd: New Version Notification for draft-ietf-opsawg-mud-24.txt References: <152818013269.6949.3550756401546069878.idtracker@ietfa.amsl.com> In-Reply-To: <152818013269.6949.3550756401546069878.idtracker@ietfa.amsl.com> --L0vRbYEgzDUi3HJq7COOzQvszK5uh6GYD Content-Type: multipart/mixed; boundary="------------92BECBB33AEDD1C3FBF22BB9" Content-Language: en-US This is a multi-part message in MIME format. --------------92BECBB33AEDD1C3FBF22BB9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable And here is the draft with the agreed edits.=C2=A0 ADs, please review and= clear DISCUSSes. Thanks, Eliot --------------92BECBB33AEDD1C3FBF22BB9 Content-Type: message/rfc822; name="New Version Notification for draft-ietf-opsawg-mud-24_txt.eml" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename*0="New Version Notification for draft-ietf-opsawg-mud-24_txt.em"; filename*1="l" X-Mozilla-Keys: Received: from xch-rcd-003.cisco.com (173.37.102.13) by xch-aln-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1320.4 via Mailbox Transport; Tue, 5 Jun 2018 01:28:55 -0500 Received: from xch-aln-015.cisco.com (173.36.7.25) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Tue, 5 Jun 2018 01:28:54 -0500 Received: from alln-iport-8.cisco.com (173.37.142.95) by mail.cisco.com (173.36.7.25) with Microsoft SMTP Server (TLS) id 15.0.1320.4 via Frontend Transport; Tue, 5 Jun 2018 01:28:54 -0500 Received: from alln-core-2.cisco.com ([173.36.13.135]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jun 2018 06:28:54 +0000 Received: from alln-inbound-e.cisco.com (alln-inbound-e.cisco.com [173.37.147.235]) by alln-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id w556Srob031319 (version=TLSv1/SSLv3 cipher=DHE-RSA-SEED-SHA bits=128 verify=OK) for ; Tue, 5 Jun 2018 06:28:54 GMT Received-SPF: Pass (alln-inbound-e.cisco.com: domain of internet-drafts@ietf.org designates 2001:1900:3001:11::2c as permitted sender) identity=mailfrom; client-ip=2001:1900:3001:11::2c; receiver=alln-inbound-e.cisco.com; envelope-from="internet-drafts@ietf.org"; x-sender="internet-drafts@ietf.org"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:12.22.58.0/24 ip4:64.170.98.0/24 ip4:4.31.198.32/27 ip4:209.208.19.192/27 ip4:72.167.123.204 ip6:2001:1890:123a::/56 ip6:2001:1890:126c::/56 ip6:2001:1900:3001:0011::0/64 ip6:2607:f170:8000:1500::0/64 -all" Received-SPF: None (alln-inbound-e.cisco.com: no sender authenticity information available from domain of postmaster@mail.ietf.org) identity=helo; client-ip=2001:1900:3001:11::2c; receiver=alln-inbound-e.cisco.com; envelope-from="internet-drafts@ietf.org"; x-sender="postmaster@mail.ietf.org"; x-conformance=spf_only Authentication-Results: alln-inbound-e.cisco.com; dkim=none (message not signed) header.i=none; spf=Pass smtp.mailfrom=internet-drafts@ietf.org; spf=None smtp.helo=postmaster@mail.ietf.org; dmarc=pass (p=none dis=none) d=ietf.org X-from-outside-Cisco: 2001:1900:3001:11::2c IronPort-PHdr: =?us-ascii?q?9a23=3AHHvd9xAXD7Jwrhlb03cgUyQJP3N1i/DPJgcQr6?= =?us-ascii?q?AfoPdwSPT6oMbcNUDSrc9gkEXOFd2Cra4c1qyO6+jJYi8p2d65qncMcZhBBV?= =?us-ascii?q?cuqP49uEgeOvODElDxN/XwbiY3T4xoXV5h+GynYwAOQJ6tL1LdrWev4jEMBx?= =?us-ascii?q?7xKRR6JvjvGo7Vks+7y/2+94fcbglUhDexe69+IAmrpgjNq8cahpdvJLwswR?= =?us-ascii?q?XTuHtIfOpWxWJsJV2Nmhv3+9m98p1+/SlOovwt78FPX7n0cKQ+VrxYES8pM3?= =?us-ascii?q?sp683xtBnMVhWA630BWWgLiBVIAgzF7BbnXpfttybxq+Rw1DWGMcDwULs5Qi?= =?us-ascii?q?qp4bt1RxD0iScHLz85/3/Risxsl6JQvRatqwViz4LIfI2ZMfxzdb7fc9wHX2?= =?us-ascii?q?pMRsleWDBODI28cYUBEvIBMP1Er4T/u1cCsQeyCRWuCe7p1zRGhmX23ao/0+?= =?us-ascii?q?k5EAHG2hAgEMwUsHTSstr1KL4eXv2vzKbSwzXDc+hW1Cz86IfWbhAhr+uAXb?= =?us-ascii?q?Vqccrez0QkCg3LjlKVqYP/PjOV0PwAs2mF4Op8W+KjkWknqxt+ojWp28wiiZ?= =?us-ascii?q?HJi5oLxlzY6Sl13YM4KcC8RUJnfdKpFZVduz2GO4drR84uXnxktSM/x7EYpZ?= =?us-ascii?q?G2ejUBxo49yB7FcfOHdpCF4hL9W+aVJjd1nHdld6i+hxa260Sgy/PzVtW60F?= =?us-ascii?q?pQqSpFiNbMumgM1xzV9MeHVuNw8lm91TqTygze7/xILEQomabHLpMszKI8mo?= =?us-ascii?q?YOvUnGAyP6hUD7gaqIeko44uSo7v7oYrTipp+SLY90jQT+P7wvmsy5HeQ3LB?= =?us-ascii?q?IOX26F9uSgzbHs4Ff5T69Ejv0qianUq5HaKtoHpq63GQNV1Zwj6xmnAze8zN?= =?us-ascii?q?sYhWUHLE5CeB+fi4jmJUvBIOrjAPijglSsiytkx/fcMrL9BZXNKyuLrLC0N4?= =?us-ascii?q?x071ZcgCYpytVErdoAEL0bJ/fockD0vd3cSBQ+Nlrwi6zKDNR6yss6VGuVSO?= =?us-ascii?q?fNNK7bq3eD5/kkJK+HY4pD/H63B/Ejr8TpiHYiklYbYOPhiZcNb3WxBf9vC0?= =?us-ascii?q?qcaHvoxNwGFDFZkBA5SbnrjkGPSzheezO+Rasy+ioTCY+6A8HEXI/+0/S6wC?= =?us-ascii?q?6nE8gONSh9AVeWHCKtLt3cBqUgTQuoCZY6zG5cEZSkQpUq7xylsxX2mfJ/e+?= =?us-ascii?q?zT/CBc/YroyI0sv7WX3QoqoHg8Bsie0mTYVSU8l3gQSWosmOhlvEUo+RfM3a?= =?us-ascii?q?1xmfdvHNNcz+1AVgZ8OJvVzug1T5irAl6RI4jXEBfiCpXpDTQ4VNl02dIWZF?= =?us-ascii?q?xhM9Svkh6F2DClTPtdzuTXVMFrrPqd6jz3IMBwkSyU/bQ9j1QgXspEPHGnga?= =?us-ascii?q?g6zQXIGorViB/ByvSjcaAamS/L/mCey2bLsQdTURV7VuPOWnVMLkfVrNGs4E?= =?us-ascii?q?TEQvfuDLk8KQJOxIaELbcCcdzmi1hKBb/jNd3Sbnj3mjK2AhCFlfuXdIS/Q2?= =?us-ascii?q?wGx23GDVQc1QUa/HKILw87Uyanv2/ECjFyUF71ak3w6sF/pW+1CEguwFLCdF?= =?us-ascii?q?Vvgpyy/BNdnvmAU7UT07YD7T8msClxFU2h0sj+DtOBo0xgcblSJ9Qn7wQP2W?= =?us-ascii?q?fQrQcoJpW7NOgingsYdAJ690/vzEBxDYNN0IAm+XIn0AQ0LriXiQkTTT6T0J?= =?us-ascii?q?HuN7GSEVHcokj0OZbfwUqWkN+S/qFK6fIyrEjlsESkUEEj6H5gldJS1inU6p?= =?us-ascii?q?LPBQsUGZX/NyR/vxl8u7zAZCQhoo/O3HNwKoG1vyPMndUzC6Mpxw2hcNFWLK?= =?us-ascii?q?6fXFWqS5RIXpn2cL5xwwDwPEtdbrII/+Y9JKbEP7Oe1bSuPfp8kT7ulmlB7I?= =?us-ascii?q?1nkwqN+yd6Vu/UzsMAyvCc0BGAUmSZ7h/pucT2lIZYIDAKSzDnkXG2Xd8JPv?= =?us-ascii?q?8pJd5SWz73cZ/tzYYb5dalQXNT+V+9CklT0cutf1+TaVb6wAtckElRqn28ki?= =?us-ascii?q?z+xDtxwFRL5uKS2jLDx+P6eV8JIGlOESNji0vhO465k5UWRkGmcxMBlRa56w?= =?us-ascii?q?D93acR98EdZyHDBFxFeST7NTQoU62su6CEbtIK5IkhvzlMeOWxfV7cTaTy6U?= =?us-ascii?q?hSw2boGG1Qwyo+fjeht8DihxJNj2SZPSUWzjKRaYRqyBzY/tCZWe9J029MWn?= =?us-ascii?q?xjkTeOTAv0L5yz8N6TjZuGru2uSzfrSMhIaSeyqOHI/CqjuT8zW1vlxbbuyp?= =?us-ascii?q?u/VlJmmS7ji4s0CWOR8066M9mtj+PgbapmZhU6WBmnsowjS9E4ydF33s51uz?= =?us-ascii?q?BSh43JryBfwCGpaYUdgPO4NStXAmRUi9/NvFq6ggs6cC3PntiiEC/Fnq4DL5?= =?us-ascii?q?G7ej1EgHpltpITWPbMvuUexiIn8B3l80rQeaYvxG9FkKl3uC9C0bhT5gF/nG?= =?us-ascii?q?LAXNVwVQFZJXK+zUzQtoLn/f0PNj33KeHijBInxILzVPbc/kldQCirIMl6Qn?= =?us-ascii?q?1+t5onYgKUiCWhs9y8IIuCNZVN6nj221+FhuxRYstrxMAHjidmJ2/x+EYd5b?= =?us-ascii?q?Vh1U5I2pe39MiOL2FruaO/CBlFMDGwaoUY+yrmiuBVmcPEl4aoVo5sHDkGRv?= =?us-ascii?q?6KBbqhDS4SuPL7Ng2PDCx0q3GVHqDaFBOe70EupmzGEpSiPXWabHcDytAqSB?= =?us-ascii?q?6YLU1ZyAcaOVdy1oY+DRyvzdf9fV1R4zkQ4hj5pwdCjOVyOFi3U2vSohupdi?= =?us-ascii?q?ZhSJWbK0kzjEkK7EPUPMqCq+NrSnsApsTz9V3Vcj7AP1wRXzhQCB7eDAOGXP?= =?us-ascii?q?Hm/9TL/umGC/DrJv/KZ/CPr+ZZSvGEgJ/p2Yp99DHKPcKKbRwAR7U23FROWX?= =?us-ascii?q?dhFoHXgTIKHmYWkT7AdciWuFKw4CR5stuX8fn3VkTo/4TFWN4weZ1/vgu7h6?= =?us-ascii?q?uOLbvanCFiNTNRzY8B31fNwbkbml8fly8ocCOiW+dIpWvGS6TenbVSBhgQZn?= =?us-ascii?q?ZoLMV/6KQ4z1Aca/6escv80/tDttBwDl5EUVL7ncTwPZ4LLn2zclTdCxTSbe?= =?us-ascii?q?nUFXjw28jyJJiEZ/hQgeFT7kDivD+aFwniMyiN0T7zWEL3PA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A8HcAADsLBZblwAZASCDgISAEQAsXBw?= =?us-ascii?q?BAQEEAQEKAQGCcAFPZXAECyiDeIgEX4wOgViUbIF4CyMJAoQ+ghUZBwE0GAE?= =?us-ascii?q?CAQEBAQEBAQEBAQIQAQEBAQEIFgZLDII1JAEOLxwvAQEBAQEBJwEBAQEBASM?= =?us-ascii?q?CRDYgVBEaBAgCJgICA0QCFAEXgx0CggAECqcQghyHfUSBaIELhQuCLIITgT+?= =?us-ascii?q?CXIMRAQECAQEWgWOCY4JUAodYhFZli1sJhWyId4E8QIM4h2aJeIcngUGCC30?= =?us-ascii?q?igmQJgiWIYoVeTwF7jkYBAQ?= X-IPAS-Result: =?us-ascii?q?A8HcAADsLBZblwAZASCDgISAEQAsXBwBAQEEAQEKAQGCc?= =?us-ascii?q?AFPZXAECyiDeIgEX4wOgViUbIF4CyMJAoQ+ghUZBwE0GAECAQEBAQEBAQEBA?= =?us-ascii?q?QIQAQEBAQEIFgZLDII1JAEOLxwvAQEBAQEBJwEBAQEBASMCRDYgVBEaBAgCJ?= =?us-ascii?q?gICA0QCFAEXgx0CggAECqcQghyHfUSBaIELhQuCLIITgT+CXIMRAQECAQEWg?= =?us-ascii?q?WOCY4JUAodYhFZli1sJhWyId4E8QIM4h2aJeIcngUGCC30igmQJgiWIYoVeT?= =?us-ascii?q?wF7jkYBAQ?= X-IronPort-AV: E=Sophos;i="5.49,478,1520899200"; d="scan'208";a="85096459" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from mail.ietf.org ([IPv6:2001:1900:3001:11::2c]) by alln-inbound-e.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jun 2018 06:28:53 +0000 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AA910130EDF; Mon, 4 Jun 2018 23:28:52 -0700 (PDT) Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: To: Ralph Droms , Eliot Lear , Dan Romascanu Subject: New Version Notification for draft-ietf-opsawg-mud-24.txt X-Test-IDTracker: no X-IETF-IDTracker: 6.81.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152818013269.6949.3550756401546069878.idtracker@ietfa.amsl.com> Date: Mon, 4 Jun 2018 23:28:52 -0700 Return-Path: internet-drafts@ietf.org X-MS-Exchange-Organization-AuthSource: XCH-ALN-015.cisco.com X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 10 X-MS-Exchange-Organization-Network-Message-Id: 38ec13b5-a161-4f6e-8898-08d5caad9c81 X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0 MIME-Version: 1.0 A new version of I-D, draft-ietf-opsawg-mud-24.txt has been successfully submitted by Eliot Lear and posted to the IETF repository. Name: draft-ietf-opsawg-mud Revision: 24 Title: Manufacturer Usage Description Specification Document date: 2018-06-05 Group: opsawg Pages: 61 URL: https://www.ietf.org/internet-drafts/draft-ietf-opsawg-mud-24.txt Status: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ Htmlized: https://tools.ietf.org/html/draft-ietf-opsawg-mud-24 Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud Diff: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-mud-24 Abstract: This memo specifies a component-based architecture for manufacturer usage descriptions (MUD). The goal of MUD is to provide a means for end devices to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects. This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an LLDP TLV, a URL, an X.509 certificate extension and a means to sign and verify the descriptions. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------92BECBB33AEDD1C3FBF22BB9-- --L0vRbYEgzDUi3HJq7COOzQvszK5uh6GYD-- --8wi5z91bcXjomyL5SFUlvbzWFbLgtp9Df Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlsWLdQACgkQh7ZrRtnS ejO6ogf/RZ3QExGTe3RNBr3lalD8U+wqRI4b87jScjc0wCBh5Bi7ZvdF/Ohx94EX JscPQhSFm4ycKkFYmrtN1q5VCuuWOh863J+TQHl/NmrtK45IQzeKcccjCi1/DZbp BsYUi15746My2scp5I0dPyWdROCCeWNm0gOKo7OkjgWKizdsj8o4WCKbPaOjcbOA xQ9WT5E54HWbD3R2RONrMJqS6s75JhlRTqoPAzTb6TMV5GXLIYtpEG+8gTM1MUy1 /YVn26I6+jA3CE2JGDt/F3Ez+LUz1+RApL2YMl5LrWMellr4RBoA0coWzxzYgPag VeSLcushZPmplwze5I+poynXzms7gQ== =Xd8Y -----END PGP SIGNATURE----- --8wi5z91bcXjomyL5SFUlvbzWFbLgtp9Df-- From nobody Tue Jun 5 00:46:29 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AA333130F07; Tue, 5 Jun 2018 00:46:21 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Eric Rescorla To: "The IESG" Cc: draft-ietf-opsawg-mud@ietf.org, Joe Clarke , opsawg-chairs@ietf.org, jclarke@cisco.com, opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152818478168.18034.4488898331989905016.idtracker@ietfa.amsl.com> Date: Tue, 05 Jun 2018 00:46:21 -0700 Archived-At: Subject: [OPSAWG] Eric Rescorla's No Objection on draft-ietf-opsawg-mud-24: (with COMMENT) X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jun 2018 07:46:23 -0000 Eric Rescorla has entered the following ballot position for draft-ietf-opsawg-mud-24: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thanks for addressing my DISCUSS. " signature" and validating the signature across the MUD file. The Key Usage Extension in the signing certificate MUST be present and have the bit digitalSignature(0) set. When the id-pe-mudsigner extension is present in a device's X.509 certificate, the MUD signature file MUST have been generated by a certificate whose subject matches the contents of that id-pe-mudsigner extension. " Isn't the extension required to be present. From nobody Sun Jun 10 01:43:10 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B71B7130E21; Sun, 10 Jun 2018 01:43:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -12.612 X-Spam-Level: X-Spam-Status: No, score=-12.612 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Sd3lDi5aSJ4; Sun, 10 Jun 2018 01:43:06 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70E04130E1F; Sun, 10 Jun 2018 01:43:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1278; q=dns/txt; s=iport; t=1528620186; x=1529829786; h=from:to:cc:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=zhkvvYGz39RxRrP19Gbr3505JDlcoyAKAZfQFKQZ04c=; b=mn+mBxvfyk9jhptHOf4dT3qcYuPXnHLASrhMaqvCJ7FgULlnCOD/xeoD r0oM6J7SdJd1+UP5UYsVw50QUFr47XStkkVVv95lg22xnMQG55zGuG1mC 4EtBEC5f/O6beFYKddYclP1Rjvr7wT3OENHWL20/2G0LMdW0lnF8rDnOm Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CgAABv4xxb/5JdJa1cGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYNDgWEyg26IBIxlllEUgWQLhGwZgjYhNBgBAgEBAQEBAQJ?= =?us-ascii?q?tKIVSEUUSAQYcAiYCBDAVEgQBDYMnggGOfptHghyEWYNmgWiBC4c5ghOBM4c?= =?us-ascii?q?jIoMWMYIkAph8CQKObIE+i2kBh2qJIAIREwGBJB04gVJwFWUBghmQTpAVgRo?= =?us-ascii?q?BAQ?= X-IronPort-AV: E=Sophos;i="5.49,497,1520899200"; d="scan'208";a="190194330" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 10 Jun 2018 08:43:05 +0000 Received: from XCH-ALN-014.cisco.com (xch-aln-014.cisco.com [173.36.7.24]) by rcdn-core-10.cisco.com (8.14.5/8.14.5) with ESMTP id w5A8h5BZ023181 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 10 Jun 2018 08:43:05 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-014.cisco.com (173.36.7.24) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Sun, 10 Jun 2018 03:43:04 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1320.000; Sun, 10 Jun 2018 03:43:04 -0500 From: "Douglas Gash (dcmgash)" To: "opsawg@ietf.org" , "internet-drafts@ietf.org" CC: Andrej Ota , Thorsten Dahm Thread-Topic: [OPSAWG] Action Items on TACACS+ informational draft v 10 Thread-Index: AQHUAJcMy4/Za3sG006Dt8v8C0v0pg== Date: Sun, 10 Jun 2018 08:43:04 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.229.133.47] Content-Type: text/plain; charset="utf-8" Content-ID: <6717219A4267A44CB5C4284C453CE69E@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [OPSAWG] Action Items on TACACS+ informational draft v 10 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Jun 2018 08:43:08 -0000 RGVhciBPcHNhd2csDQoNCkEgc3RhdHVzIHVwZGF0ZSBvbiBpbmZvcm1hdGlvbmFsIFQrIERyYWZ0 Og0KDQoxKSBDdXJyZW50IGRpc2N1c3Npb24gYmV0d2VlbiBBbmRyZWogYW5kIChtYWlubHkpIEpv ZSBDbGFya2Ugb24gc29tZSBzZWN0aW9uIDkgKFNlY3VyaXR5KSwgb25nb2luZywgQW5kcmVqL0F1 dGhvcnMgd2lsbCByZXNwb25kIHRvIEpvZeKAmXMgbGF0ZXN0IGNvbW1lbnRzIHNob3J0bHkuDQoy KSBEaWZmcyBiZXR3ZWVuIFZlcnNpb24gNiBhbmQgVmVyc2lvbiAxMCB3aXRoIGJyaWVmIGFubm90 YXRpb25zIG9mIGVhY2ggZGlmZiBzZW50IHRvIE5ld3Nncm91cA0KMykgQXV0aG9ycyBSZWNlbnRs eSByZXZpZXdlZCBzZWN0aW9uIDkgKFNlY3VyaXR5KSwgYW5kIHJlZmxlY3QgdGhhdCBpdCBpbmNs dWRlcyBzb21lIHJlZHVuZGFudCBhbmQgb3ZlcmxhcHBpbmcgY29udGVudCBpbiB0aGUgc2VjdGlv bnM6IA0K4oCcOS41LiAgVEFDQUNTKyBDbGllbnQgSW1wbGVtZW50YXRpb24gUmVjb21tZW5kYXRp b25zIC4gLiAuIC4gLiAuICAzOQ0KOS42LiAgVEFDQUNTKyBTZXJ2ZXIgSW1wbGVtZW50YXRpb24g UmVjb21tZW5kYXRpb25zIC4gLiAuIC4gLiAuICAzOQ0KOS43LiAgVEFDQUNTKyBEZXBsb3ltZW50 IEJlc3QgUHJhY3RpY2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA0MOKAnQ0K4oCmY29uc2Vx dWVudGx5LCB3ZSBhcmUgcGxhbm5pbmcgdG8gcHJvcG9zZSByYXRpb25hbGlzZWQgc2luZ2xlIHNl Y3Rpb24gdG8gY292ZXIgQmVzdCBQcmFjdGljZXMuIFdlIHdpbGwgcHJlc2VudCBhIHByb3Bvc2Fs IHRoaXMgd2VlayBmb3IgaW5pdGlhdGluZyBkaXNjdXNzaW9uLCB0aGUgcmVzdWx0IG9mIHdoaWNo IHdlIHdpbGwgbG9vayB0byBpbmNsdWRlIGluIG5leHQgdmVyc2lvbi4NCg0KVGhhbmtzLCBSZWdh cmRzLCANCmF1dGhvcnMuDQoNCg0K From nobody Thu Jun 14 09:22:15 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A6C50131184; Thu, 14 Jun 2018 09:21:58 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.81.2 Auto-Submitted: auto-generated Precedence: bulk CC: ibagdona@gmail.com, jclarke@cisco.com, draft-ietf-opsawg-nat-yang@ietf.org, opsawg-chairs@ietf.org, Joe Clarke , opsawg@ietf.org Reply-To: ietf@ietf.org Sender: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <152899331862.26581.5213618328752065161.idtracker@ietfa.amsl.com> Date: Thu, 14 Jun 2018 09:21:58 -0700 Archived-At: Subject: [OPSAWG] Last Call: (A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)) to Proposed Standard X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jun 2018 16:22:05 -0000 The IESG has received a request from the Operations and Management Area Working Group WG (opsawg) to consider the following document: - 'A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2018-06-28. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract For the sake of network automation and the need for programming Network Address Translation (NAT) function in particular, a data model for configuring and managing the NAT is essential. This document defines a YANG module for the NAT function. Network Address Translation from IPv4 to IPv4 (NAT44), Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (NAT64), Customer-side transLATor (CLAT), Stateless IP/ICMP Translation (SIIT), Explicit Address Mappings for Stateless IP/ICMP Translation (SIIT EAM), IPv6 Network Prefix Translation (NPTv6), and Destination NAT are covered in this document. Editorial Note (To be removed by RFC Editor) Please update these statements with the RFC number to be assigned to this document: "This version of this YANG module is part of RFC XXXX;" "RFC XXXX: A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)" "reference: RFC XXXX" Please update the "revision" date of the YANG module. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-opsawg-nat-yang/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-opsawg-nat-yang/ballot/ No IPR declarations have been submitted directly on this I-D. The document contains these normative downward references. See RFC 3967 for additional information: rfc6296: IPv6-to-IPv6 Network Prefix Translation (Experimental - IETF stream) rfc6877: 464XLAT: Combination of Stateful and Stateless Translation (Informational - IETF stream) From nobody Thu Jun 14 12:59:59 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4566C130E70 for ; Thu, 14 Jun 2018 12:59:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9rDRZH7KX1ex for ; Thu, 14 Jun 2018 12:59:50 -0700 (PDT) Received: from mail-wr0-x231.google.com (mail-wr0-x231.google.com [IPv6:2a00:1450:400c:c0c::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A685E126CB6 for ; Thu, 14 Jun 2018 12:59:48 -0700 (PDT) Received: by mail-wr0-x231.google.com with SMTP id v13-v6so7647481wrp.13 for ; Thu, 14 Jun 2018 12:59:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=MXQI+ucfFiylU9/4fWv6L2pDMoOqD/w/evwfqUeyyjU=; b=T3nCQ2AysXHU2zAfb2hAWtriIYFlyckvKHDCbGg4FAeMZspG7oAWBV6r//pxcB71Sk DIJJW9tGJ5N/0/HQLqyIwllOve2dtDsqtaMBbyAnHEykF2KDZeyFdXBvKXXLliQ9MqBJ +Ev6zDfCdQp/rx4kIB7nCLTzh8IgYjFYljX9JFka1kUrDYXMa5lUbZAw5Fd9kPJoiWpN qvqIFh3nOzuawqYhH3OAorwW2nICkRqRabWslekCkE7NaSexxqh7gW1RJla7wgyWTSG0 ypwl/R1bfe2+fKiL9hw2tCeUiljMNI8ohcEmjyET1IME/D5MUKtxAEevI3AoQlFSPVDc OiKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=MXQI+ucfFiylU9/4fWv6L2pDMoOqD/w/evwfqUeyyjU=; b=lTJ+MLJU13wExxj/3SZCT2YRrQxJcGSx1OePkwTENOmkuA2N3JPNQTB9Tj0KUIRNtZ 6mbiLkG5tcicqs9fBPVthfe6Yhfcmd5wQncYV3bPbUGIa0woz+NdJZswhyWDUlbVHC3W qN48pa1EAkcDxxqlCUAZYGJYb4OFNTb5YlUNEKyYXPHjGT4LqIGeRZ/qMin+07nPUuYQ 0bgfFYjtMauP9yOeG3j146kYl0JGHWIBaEiIZDYpFmjKZhqcWJgjH9mSg+CRutHiY+71 vJioySNlvyY7PW93m1RLqzCdnuLlEdaiMUdeyhSnKY/Pil18242cjdcTxj/UpNgR1+3j XflA== X-Gm-Message-State: APt69E0Zh0njr3bQvQS8RCzjyqcJ/Xo5Ea8g+RArBH6TjG0jgDnCIFce 3ZEAXoRyJBg6eUvFxJWStLCvLUD2MmveYLhVOwd8Og== X-Google-Smtp-Source: ADUXVKJfmto3HKsjGfd1V85HrtE6HT+KSG8SJxpQw9YdIh4369D7O4Gsr/KfQztuGCX9oBHwnU5OqOaa8+OPRR9CuFQ= X-Received: by 2002:adf:b691:: with SMTP id j17-v6mr3678503wre.10.1529006386912; Thu, 14 Jun 2018 12:59:46 -0700 (PDT) MIME-Version: 1.0 From: Warren Kumari Date: Thu, 14 Jun 2018 15:59:10 -0400 Message-ID: To: IETF Discuss , ops-area@ietf.org, ops-ads@ietf.org, opsawg@ietf.org Content-Type: multipart/alternative; boundary="0000000000008d3533056e9f8a1f" Archived-At: Subject: [OPSAWG] IETF 102 Operations and Management AD Office Hours X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jun 2018 19:59:52 -0000 --0000000000008d3533056e9f8a1f Content-Type: text/plain; charset="UTF-8" Hi all, As always, we will be holding Operations and Management AD Office Hours at IETF 102 in Montreal. It is still early days, and so the time and room are still TBD, but I wanted to mention it early, so people can start preparing. I'll send out a new note once we have a room and slot. Please come to talk to us on any WG or OPS area items, about new proposals, or about any other IETF-related business. An advanced notification would be appreciated, so that we can schedule slots. Regards, Warren (for Ops ADs). -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf --0000000000008d3533056e9f8a1f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

As always, we will be holding Operations and Manag= ement=C2=A0AD Office Hours at IETF 102 in Montreal.

It is still early = days, and so the time and room are still TBD, but I wanted to mention it ea= rly, so people can start preparing. I'll send out a new note once we ha= ve a room and slot.

Please come to talk to us o= n any WG or OPS area items, about new
proposals, or about any other IETF-r= elated business.

An advanced notifi= cation would be appreciated, so that we can schedule=C2=A0slots.

Regards, Warren (for Ops= ADs).


--
I don't think the= execution is relevant when it was obviously a bad idea in the first place.=
This is like putting rabid weasels in your pants, and later expressing = regret at having chosen those particular rabid weasels and that pair of pan= ts.
=C2=A0 =C2=A0---maf
--0000000000008d3533056e9f8a1f-- From nobody Fri Jun 15 09:31:54 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E798130DC0; Fri, 15 Jun 2018 09:31:53 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152908031340.27289.13350275655068488266@ietfa.amsl.com> Date: Fri, 15 Jun 2018 09:31:53 -0700 Archived-At: Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-25.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2018 16:31:54 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operations and Management Area Working Group WG of the IETF. Title : Manufacturer Usage Description Specification Authors : Eliot Lear Ralph Droms Dan Romascanu Filename : draft-ietf-opsawg-mud-25.txt Pages : 61 Date : 2018-06-15 Abstract: This memo specifies a component-based architecture for manufacturer usage descriptions (MUD). The goal of MUD is to provide a means for end devices to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects. This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an LLDP TLV, a URL, an X.509 certificate extension and a means to sign and verify the descriptions. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsawg-mud-25 https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud-25 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-mud-25 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jun 15 09:33:13 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 503A3130DC0 for ; Fri, 15 Jun 2018 09:33:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fsTTGJHQpqBC for ; Fri, 15 Jun 2018 09:33:05 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B162130E37 for ; Fri, 15 Jun 2018 09:33:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12272; q=dns/txt; s=iport; t=1529080385; x=1530289985; h=references:subject:to:from:message-id:date:mime-version: in-reply-to; bh=K2rsMm9YsgdgnaNoBi/jVtQfZTwicsqNH9kBqpGcCgA=; b=E2tPXKK53hWSg/7Kh6n08zzL5uu7DTpJphDWWoK0bRf1L34kIpYxsJ2m EuZl8mhriXrDfT2VzufoRUDHB4MigXS+v4vnk6R1Ff3NUxHrmRw/OVWsl pfVTZ/97YAcbp6woINkY+ls+VLhg7qIW6pQKx+NwiWO5S4rdfuM2807GZ c=; X-Files: signature.asc : 488 X-IronPort-AV: E=Sophos;i="5.51,227,1526342400"; d="asc'?eml'208?scan'208,208";a="129593287" Received: from alln-core-2.cisco.com ([173.36.13.135]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Jun 2018 16:33:04 +0000 Received: from [10.24.4.147] ([10.24.4.147]) by alln-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id w5FGX4YM017723; Fri, 15 Jun 2018 16:33:04 GMT References: <152908031367.27289.4762127717904849616.idtracker@ietfa.amsl.com> To: "opsawg@ietf.org" , Ignas Bagdonas , "Michele Guel (mguel)" , "Joe Clarke (jclarke)" From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== X-Forwarded-Message-Id: <152908031367.27289.4762127717904849616.idtracker@ietfa.amsl.com> Message-ID: Date: Fri, 15 Jun 2018 09:33:03 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <152908031367.27289.4762127717904849616.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="lUUlLUlkwuqjQE6bkQ1P4ImZ79JLwPas6" Archived-At: Subject: [OPSAWG] Fwd: New Version Notification for draft-ietf-opsawg-mud-25.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2018 16:33:07 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --lUUlLUlkwuqjQE6bkQ1P4ImZ79JLwPas6 Content-Type: multipart/mixed; boundary="EvVrpNBsjItiUPpDIAEUmeKmy2B96hgHJ"; protected-headers="v1" From: Eliot Lear To: "opsawg@ietf.org" , Ignas Bagdonas , "Michele Guel (mguel)" , "Joe Clarke (jclarke)" Message-ID: Subject: Fwd: New Version Notification for draft-ietf-opsawg-mud-25.txt References: <152908031367.27289.4762127717904849616.idtracker@ietfa.amsl.com> In-Reply-To: <152908031367.27289.4762127717904849616.idtracker@ietfa.amsl.com> --EvVrpNBsjItiUPpDIAEUmeKmy2B96hgHJ Content-Type: multipart/mixed; boundary="------------26B13C39AE4C22F6645C4C2D" Content-Language: en-US This is a multi-part message in MIME format. --------------26B13C39AE4C22F6645C4C2D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi! The only change in this doc is a glitch in IANA considerations in terms of the name of an OID assignment. Eliot --------------26B13C39AE4C22F6645C4C2D Content-Type: message/rfc822; name="New Version Notification for draft-ietf-opsawg-mud-25_txt.eml" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename*0="New Version Notification for draft-ietf-opsawg-mud-25_txt.em"; filename*1="l" X-Mozilla-Keys: Received: from xch-rcd-004.cisco.com (173.37.102.14) by xch-aln-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1320.4 via Mailbox Transport; Fri, 15 Jun 2018 11:31:55 -0500 Received: from xch-rcd-009.cisco.com (173.37.102.19) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Fri, 15 Jun 2018 11:31:55 -0500 Received: from rcdn-iport-6.cisco.com (173.37.86.77) by mail.cisco.com (173.37.102.19) with Microsoft SMTP Server (TLS) id 15.0.1320.4 via Frontend Transport; Fri, 15 Jun 2018 11:31:55 -0500 Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Jun 2018 16:31:54 +0000 Received: from alln-inbound-e.cisco.com (alln-inbound-e.cisco.com [173.37.147.235]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id w5FGVrPE030852 (version=TLSv1/SSLv3 cipher=DHE-RSA-SEED-SHA bits=128 verify=OK) for ; Fri, 15 Jun 2018 16:31:54 GMT Received-SPF: Pass (alln-inbound-e.cisco.com: domain of internet-drafts@ietf.org designates 2001:1900:3001:11::2c as permitted sender) identity=mailfrom; client-ip=2001:1900:3001:11::2c; receiver=alln-inbound-e.cisco.com; envelope-from="internet-drafts@ietf.org"; x-sender="internet-drafts@ietf.org"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:12.22.58.0/24 ip4:64.170.98.0/24 ip4:4.31.198.32/27 ip4:209.208.19.192/27 ip4:72.167.123.204 ip6:2001:1890:123a::/56 ip6:2001:1890:126c::/56 ip6:2001:1900:3001:0011::0/64 ip6:2607:f170:8000:1500::0/64 -all" Received-SPF: None (alln-inbound-e.cisco.com: no sender authenticity information available from domain of postmaster@mail.ietf.org) identity=helo; client-ip=2001:1900:3001:11::2c; receiver=alln-inbound-e.cisco.com; envelope-from="internet-drafts@ietf.org"; x-sender="postmaster@mail.ietf.org"; x-conformance=spf_only Authentication-Results: alln-inbound-e.cisco.com; dkim=none (message not signed) header.i=none; spf=Pass smtp.mailfrom=internet-drafts@ietf.org; spf=None smtp.helo=postmaster@mail.ietf.org; dmarc=pass (p=none dis=none) d=ietf.org X-from-outside-Cisco: 2001:1900:3001:11::2c IronPort-PHdr: =?us-ascii?q?9a23=3AfDJR0RSmupZxwDWLBd/w2YUow9psv+yvbD5Q0Y?= =?us-ascii?q?Iujvd0So/mwa6yZRON2/xhgRfzUJnB7Loc0qyK6/2mATRIyK3CmUhKSIZLWR?= =?us-ascii?q?4BhJdetC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TW94jEIBx?= =?us-ascii?q?rwKxd+KPjrFY7OlcS30P2594HObwlSizexfbN/IA+qoQnNq8IbnZZsJqEtxx?= =?us-ascii?q?XTv3BGYf5WxWRmJVKSmxbz+MK994N9/ipTpvws6ddOXb31cKokQ7NYCi8mM3?= =?us-ascii?q?0u683wqRbDVwqP6WACXWgQjxFFHhLK7BD+Xpf2ryv6qu9w0zSUMMHqUbw5Xy?= =?us-ascii?q?mp4rx1QxH0ligIKz858HnWisNuiqJbvAmhrAF7z4LNfY2ZKOZycqbbcNgHR2?= =?us-ascii?q?ROQ9xRWjRODYygYIUBD/QPM/tAr4Tmu1sDrweyCRWwCO/zyDJFgGL9060g0+?= =?us-ascii?q?QmFAHLxA0gH9QSsHvKttX1MrkdUfyswKbV1zXMdf1W2Svm6IXTcxAuv+2MXb?= =?us-ascii?q?xqfcrW00kvGAXIhUiep4ziOjOazOUNs26D4uphS+2vl2Anpxt2oji1ycchjJ?= =?us-ascii?q?TCiIENyl3c6yl13Jo5KcC9RUJmZdOoDIdcuiSUOodqXs8uXmRltDsnxrADvJ?= =?us-ascii?q?O3YjQFxZI6zBDFcfOHaZKH4hf7WeaRPzh4gHVldaq6hxmo8EigzvfwVsiq31?= =?us-ascii?q?ZWoCpJiN7MtmoC1xDL68iHTOVy/lu51DqRywzf9vxILEUpmaffN5It3rs9m5?= =?us-ascii?q?QPvUjfAyP7nVj6gLKTe0gh5OSn9/zrYrD8qZ+dM490hBv+MqMrmsGnAOQ4NB?= =?us-ascii?q?QOUHaB+eS6yrLj4VT1T6hQjvIsnKnZrIvaKN8apqGnHw9V3Jwv6xGlDzepyN?= =?us-ascii?q?gYh2UILEpZeBKbiIjkI1XOL+7iAvelmFmjjDZrx+vaMb3mGJnCMn/DkLKyNY?= =?us-ascii?q?p6vgRmwQ4rzZhz/ZVREftJdOj/QEj0r/TXCxY4N0q/xOOxTJ03+4cfXn7HJq?= =?us-ascii?q?KQKuma5VuF7/gHKOiXb4hTszH4fbxtrdLnizcDnloUZqKg24ZdICS0BPNjKl?= =?us-ascii?q?6SaFLjh94AFSEBuQ9oH8Lwj1jXUDhPamy0Ur556isyBp69JYbOWo7rh6aOj3?= =?us-ascii?q?TzJYFfem0TUgPEKnzvbYjRHq5UMH/ADupIqBddDubzE8sN0Bi0vzX3wL19Ir?= =?us-ascii?q?ic4ngespTukJBt7PGGzElqsXRvF5HZm2iBTGBxy3lMDzYtxK4quwg10EqKhJ?= =?us-ascii?q?s4zPBdHMZY0PpGXS8kPJrdieF/AtH2FUaJJ4/VGAv5HI3nRXlxAd40ysUFJl?= =?us-ascii?q?xwA9K4kjjC0jakRbgPmPPPTMVsrvKBgCapZvM5zXHA2fN73XA7XstCM3Gnja?= =?us-ascii?q?dj9g/VQrTEiFidi73wLflO1SrJ8iKCy2CJoUdUFQM2WqTeVndZbUzT/pz15U?= =?us-ascii?q?LHGrmpD7lvcg5M0tWLJaYCbNr1xU5HS/HuNJWWY2+4l2qqQxfdwLSKYdmiYH?= =?us-ascii?q?0TiR3UE1NMiAUP5TCDPAk6CD2mpjffCiBjD1Tifwbg6+BwtGiTT0IowUeNdU?= =?us-ascii?q?Iyn6Gt9EszgvqRA+gWwqpCuColrGBsG02h2tvNF9eajw9ofaEaYN4h7hFAz2?= =?us-ascii?q?2K/wB4N4arerhrnUVWMxwiuUTo2l17C54Vl88soTJiwF9zJL6WllRbeGrCj6?= =?us-ascii?q?r9MbDWNGT+uSuXRfCOgQPm2c2NsucG7PA+7lTltga0EEZn/jNs0sJe1D2X4Z?= =?us-ascii?q?CYRAYVVJvwVA4w+X0Y7/nbZDUw/YXZyThgK6C6riTq2t81Cq0i0Bnoc9pEMa?= =?us-ascii?q?yCHRP/CIVAX5D3erV7wwD7NUpcZbILrfxmZcjufuDjuubjJOt6mTO6kWlLqJ?= =?us-ascii?q?tw1E6B7Ws0S+LF2YoE3+DN2wKGUznmi1Ly16K/0YtAZDwUAi++0X2+XNYINP?= =?us-ascii?q?QjJd5ZUj/2ep/un4cs3ZW+PhwQvESuDF4HxsKzLBOWa1q43Ata0lkRrTmq3y?= =?us-ascii?q?C51Ddz1Touq/n6vmSGzuL8eR4AImMOSnNliAKmII6ogsocUVTtYxIgmge+zU?= =?us-ascii?q?f326Ydo75wZTq2Iw8Ab23tImduX7Hl/LuEf8NV7p409ClNWeqgenibR6Lz5R?= =?us-ascii?q?wA3GmwV3sbzzc9eTawv5z/lBEvk3qTG3F1qGuKHKM4jQea/tHXQuRdmyYXXC?= =?us-ascii?q?QtwyeCHUCyZpP6tcXRjZrItfqyEn6sRoEGOze+1puO7U7ZrSVrGUHtxqr1wI?= =?us-ascii?q?ehTFh8iWihi5FrTXma8kq6O9azkfXqd7ogJBUgBUeguZY8Qdg4y9pgwspKni?= =?us-ascii?q?JF4/fdtXsfzTWpaYQdg/quKiNcA2damZmPv0DkwBExcSjPntymECzHmY07P4?= =?us-ascii?q?XfACte2zpjvZoSUP7GtewVxXks+AGx/1CWPKY1ny9Dm6F2sCdI2rFY4Fh0lH?= =?us-ascii?q?uWUOJVQBc9X2SklgzWvYrm9PwFPTf3KerrjBInz4j5VejQ8FkbBiqxe498T3?= =?us-ascii?q?UutpotPguTiC+jstm8KoCNNYpB5EXTzUul7aAdbZs1krBT33hdNGnwvGMox6?= =?us-ascii?q?sAtTI1h8nomo+BJi0t9aa9BFtZMDfyesUfvzyrhqdFlcHQ1IeqTN1nHX0QUZ?= =?us-ascii?q?3kQOjNcnpavOn7NwuIDDw3q2uKUbvZEwiF7U56rnXJW5m1PnCTLXMdwJ1sXh?= =?us-ascii?q?6YbEBYhQkVWn09kPtbXkiyw9f9dU5i+j0Lzlvxqx8Ky+90OV/4SGie7AakZz?= =?us-ascii?q?EoSYSOeRpb6gYRgiWdecea7+91A2RZ5sj79FTUeDXKP1waVjlRAx7dXgKxZL?= =?us-ascii?q?L9gLuIu/KVDee/MfbUNLyKreobVvGCwo+p3s5ruT2NLc6IeHJlCq5euAILUH?= =?us-ascii?q?ZnFsDegzhKRTYQkneHbsiHqQ269zEyotq2/ujwcAPi+YXJDKFde4YKmVj+ke?= =?us-ascii?q?KYOuiciTwsYy5fzY8JzGTUxaI32VcTj2dveiWjV7MaumSeBLKVkahRARkBbi?= =?us-ascii?q?p1P8Yd9Loy6Q5LPd+C24HFk4Vgh/twMG9rEFnom8Wnf8sPejnvNV7bCgCMLr?= =?us-ascii?q?vUfGSWkfGyWru1TPhrtMsRtxC0vm/GQUrqPzDFljT1WVaoK+4e1Cw=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A8GDAABk6SNblwAZASCDgISAEQAsXBw?= =?us-ascii?q?BAQEEAQEKAQGCdQFPZXAECyiDeYgEX4tzgV6VEIF4CyMJAoQ+glUZBwE0GAE?= =?us-ascii?q?CAQEBAQEBAQEBAQIQAQEBAQEIFgZMDII1JAEOLxwvAQEBAQEBJwEBAQEBASM?= =?us-ascii?q?CRDYgVBEaBAgCJgICA0QCFAEXgx0CggAECqlTghyIBESBaIELhRCCMYITgT+?= =?us-ascii?q?CXIMTAQECAQEWgWOCZIJVAodihFdli3AJhXmJCIE/QYM/h3mKDYc0gUGCC30?= =?us-ascii?q?igmQJgiaIYoVeTwF7j10BAQ?= X-IPAS-Result: =?us-ascii?q?A8GDAABk6SNblwAZASCDgISAEQAsXBwBAQEEAQEKAQGCd?= =?us-ascii?q?QFPZXAECyiDeYgEX4tzgV6VEIF4CyMJAoQ+glUZBwE0GAECAQEBAQEBAQEBA?= =?us-ascii?q?QIQAQEBAQEIFgZMDII1JAEOLxwvAQEBAQEBJwEBAQEBASMCRDYgVBEaBAgCJ?= =?us-ascii?q?gICA0QCFAEXgx0CggAECqlTghyIBESBaIELhRCCMYITgT+CXIMTAQECAQEWg?= =?us-ascii?q?WOCZIJVAodihFdli3AJhXmJCIE/QYM/h3mKDYc0gUGCC30igmQJgiaIYoVeT?= =?us-ascii?q?wF7j10BAQ?= X-IronPort-AV: E=Sophos;i="5.51,227,1526342400"; d="scan'208";a="87669307" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from mail.ietf.org ([IPv6:2001:1900:3001:11::2c]) by alln-inbound-e.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Jun 2018 16:31:54 +0000 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A66CD130E63; Fri, 15 Jun 2018 09:31:53 -0700 (PDT) Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: To: Ralph Droms , Eliot Lear , Dan Romascanu Subject: New Version Notification for draft-ietf-opsawg-mud-25.txt X-Test-IDTracker: no X-IETF-IDTracker: 6.81.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152908031367.27289.4762127717904849616.idtracker@ietfa.amsl.com> Date: Fri, 15 Jun 2018 09:31:53 -0700 Return-Path: internet-drafts@ietf.org X-MS-Exchange-Organization-AuthSource: XCH-RCD-009.cisco.com X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 10 X-MS-Exchange-Organization-Network-Message-Id: e6c29366-f11b-43a5-2f53-08d5d2dd81d4 X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0 MIME-Version: 1.0 A new version of I-D, draft-ietf-opsawg-mud-25.txt has been successfully submitted by Eliot Lear and posted to the IETF repository. Name: draft-ietf-opsawg-mud Revision: 25 Title: Manufacturer Usage Description Specification Document date: 2018-06-15 Group: opsawg Pages: 61 URL: https://www.ietf.org/internet-drafts/draft-ietf-opsawg-mud-25.txt Status: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ Htmlized: https://tools.ietf.org/html/draft-ietf-opsawg-mud-25 Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud Diff: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-mud-25 Abstract: This memo specifies a component-based architecture for manufacturer usage descriptions (MUD). The goal of MUD is to provide a means for end devices to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects. This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an LLDP TLV, a URL, an X.509 certificate extension and a means to sign and verify the descriptions. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------26B13C39AE4C22F6645C4C2D-- --EvVrpNBsjItiUPpDIAEUmeKmy2B96hgHJ-- --lUUlLUlkwuqjQE6bkQ1P4ImZ79JLwPas6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlsj6j8ACgkQh7ZrRtnS ejMB3wgAzLvbkHjGhSabpbg94Vy6YHZQbirkJ5jGbaK3diAfouLdDQThBBUl8Kfq CoYOtQA2nLlByZiny0F8e5r8Rmff9Qchs6vi79DYWkqyVddVdT4kF7gs+uzGNwX1 CU8W0qA/8gvEqkKZs9Xe4TDnAA8yO2gTIiwsJ7Wtqp0UNJit9amEqkL09w0CAS4W 2fASFEDRYzD9m9gANKixqH/EZRkoYLsOl7BAuUQPeEj5fBEBYLnsGi/MvbKwlW4t uXQuCTKechBoDsySGE24PoiSh8pgjW7stW5w75YSoImzZ7/n2ylbdU/YSwkheX0U EtgwXtMsM+Yue7IqiKYs2cyrR4fXFw== =aBao -----END PGP SIGNATURE----- --lUUlLUlkwuqjQE6bkQ1P4ImZ79JLwPas6-- From nobody Sat Jun 16 23:28:11 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 65D96130E7C; Sat, 16 Jun 2018 23:27:57 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Roni Even To: Cc: draft-ietf-opsawg-nat-yang.all@ietf.org, ietf@ietf.org, opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152921687734.2071.3843497811933571200@ietfa.amsl.com> Date: Sat, 16 Jun 2018 23:27:57 -0700 Archived-At: Subject: [OPSAWG] Genart last call review of draft-ietf-opsawg-nat-yang-14 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Jun 2018 06:27:58 -0000 Reviewer: Roni Even Review result: Ready I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at . Document: draft-ietf-opsawg-nat-yang-?? Reviewer: Roni Even Review Date: 2018-06-16 IETF LC End Date: 2018-06-28 IESG Telechat date: Not scheduled for a telechat Summary: The document is ready for publication as a standard track RFC. I was just wondering why it went from version -10 to -14 Major issues: Minor issues: Nits/editorial comments: From nobody Sun Jun 17 13:06:39 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 976D6130E51; Sun, 17 Jun 2018 13:06:32 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Stephen Farrell To: Cc: draft-ietf-opsawg-nat-yang.all@ietf.org, ietf@ietf.org, opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152926599250.2311.15532810595098738604@ietfa.amsl.com> Date: Sun, 17 Jun 2018 13:06:32 -0700 Archived-At: Subject: [OPSAWG] Secdir last call review of draft-ietf-opsawg-nat-yang-14 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Jun 2018 20:06:33 -0000 Reviewer: Stephen Farrell Review result: Has Issues I see one major issue: 2.1: Logging in NATs and esp. CGNs is clearly sensitive in various ways. I think it'd be ok if logging was really out of scope, however, there is a logging-enable feature, I think under-specified, (on page 63) so the statement in 2.1 seems contradictory to me - if logging is out of scope why is logging-enable a flag?. Presumably if logging-enable transitions from F->T then you turn on (some undefined kind of) logging. If this transitions from T->F then what is the implementer supposed to do? I think that illustrates the under-specification here. The simplest thing might be to really make logging out of scope here by deleting the logging-enable thing entirely. (I can imagine that reaching consensus on a logging control interface would be non-trivial, hence the suggestion to really put it out of scope rather than try specify it fully.) Just one nit: The abstract could do with a bit of re-wording as it reads awkwardly. I'd say maybe just delete the 1st sentence. From nobody Mon Jun 18 00:10:37 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E945127598; Mon, 18 Jun 2018 00:10:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.395 X-Spam-Level: X-Spam-Status: No, score=-3.395 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.795, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lm8z6HDo7LiV; Mon, 18 Jun 2018 00:10:21 -0700 (PDT) Received: from orange.com (mta134.mail.business.static.orange.com [80.12.70.34]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8AE63130DEB; Mon, 18 Jun 2018 00:10:21 -0700 (PDT) Received: from opfednr06.francetelecom.fr (unknown [xx.xx.xx.70]) by opfednr21.francetelecom.fr (ESMTP service) with ESMTP id C690DC07D9; Mon, 18 Jun 2018 09:10:19 +0200 (CEST) Received: from Exchangemail-eme2.itn.ftgroup (unknown [xx.xx.31.32]) by opfednr06.francetelecom.fr (ESMTP service) with ESMTP id 98C971A0065; Mon, 18 Jun 2018 09:10:19 +0200 (CEST) Received: from OPEXCLILMA3.corporate.adroot.infra.ftgroup ([fe80::60a9:abc3:86e6:2541]) by OPEXCLILM32.corporate.adroot.infra.ftgroup ([fe80::8924:188:2124:a046%19]) with mapi id 14.03.0399.000; Mon, 18 Jun 2018 09:10:19 +0200 From: To: Stephen Farrell , "secdir@ietf.org" CC: "draft-ietf-opsawg-nat-yang.all@ietf.org" , "ietf@ietf.org" , "opsawg@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-opsawg-nat-yang-14 Thread-Index: AQHUBnaxNi2Gt51rukm5BMZI7aoJ46RllBdw Date: Mon, 18 Jun 2018 07:10:18 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B93302DF4678E@OPEXCLILMA3.corporate.adroot.infra.ftgroup> References: <152926599250.2311.15532810595098738604@ietfa.amsl.com> In-Reply-To: <152926599250.2311.15532810595098738604@ietfa.amsl.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.168.234.6] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-nat-yang-14 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2018 07:10:24 -0000 SGkgU3RlcGhlbiwgDQoNClRoYW5rIHlvdSBmb3IgdGhlIHJldmlldy4gDQoNClBsZWFzZSBzZWUg aW5saW5lLiANCg0KQ2hlZXJzLA0KTWVkDQoNCj4gLS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0t DQo+IERlwqA6IFN0ZXBoZW4gRmFycmVsbCBbbWFpbHRvOnN0ZXBoZW4uZmFycmVsbEBjcy50Y2Qu aWVdDQo+IEVudm95w6nCoDogZGltYW5jaGUgMTcganVpbiAyMDE4IDIyOjA3DQo+IMOAwqA6IHNl Y2RpckBpZXRmLm9yZw0KPiBDY8KgOiBkcmFmdC1pZXRmLW9wc2F3Zy1uYXQteWFuZy5hbGxAaWV0 Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IG9wc2F3Z0BpZXRmLm9yZw0KPiBPYmpldMKgOiBTZWNkaXIg bGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRmLW9wc2F3Zy1uYXQteWFuZy0xNA0KPiANCj4g UmV2aWV3ZXI6IFN0ZXBoZW4gRmFycmVsbA0KPiBSZXZpZXcgcmVzdWx0OiBIYXMgSXNzdWVzDQo+ IA0KPiBJIHNlZSBvbmUgbWFqb3IgaXNzdWU6DQo+IA0KPiAyLjE6IExvZ2dpbmcgaW4gTkFUcyBh bmQgZXNwLiBDR05zIGlzIGNsZWFybHkgc2Vuc2l0aXZlIGluIHZhcmlvdXMgd2F5cy4gSQ0KPiB0 aGluayBpdCdkIGJlIG9rIGlmIGxvZ2dpbmcgd2FzIHJlYWxseSBvdXQgb2Ygc2NvcGUsIGhvd2V2 ZXIsIHRoZXJlIGlzIGENCj4gbG9nZ2luZy1lbmFibGUgZmVhdHVyZSwgSSB0aGluayB1bmRlci1z cGVjaWZpZWQsICAob24gcGFnZSA2Mykgc28gdGhlDQo+IHN0YXRlbWVudA0KPiBpbiAyLjEgc2Vl bXMgY29udHJhZGljdG9yeSB0byBtZSAtIGlmIGxvZ2dpbmcgaXMgb3V0IG9mIHNjb3BlIHdoeSBp cw0KPiBsb2dnaW5nLWVuYWJsZSBhIGZsYWc/LiAgUHJlc3VtYWJseSBpZiBsb2dnaW5nLWVuYWJs ZSB0cmFuc2l0aW9ucyBmcm9tIEYtPlQNCj4gdGhlbiB5b3UgdHVybiBvbiAoc29tZSB1bmRlZmlu ZWQga2luZCBvZikgbG9nZ2luZy4gDQoNCltNZWRdIFRoZSBpbnRlbnQgaXMgbm90IHRvIGRlZmlu ZSB0aGUgZXhhY3Qgc2V0IG9mIGxvZ2dpbmcgaW5mb3JtYXRpb24gKGUuZy4sIFNlY3Rpb24gNCBv ZiBSRkM2ODg4KSwgdGhlIHByb3RvY29sIHRvIHVzZSAoZS5nLiwgUkZDODE1OCBvciBkcmFmdC1p ZXRmLWJlaGF2ZS1zeXNsb2ctbmF0LWxvZ2dpbmcpLCBldGMuLi4gYnV0IHRvIGFsbG93IGZvciBk aXNhYmxpbmcvZW5hYmxpbmcgc3VjaCBmZWF0dXJlICh3aGVuIHN1cHBvcnRlZCBieSBhbiBpbXBs ZW1lbnRhdGlvbikuIA0KDQpJZiB0aGlzIHRyYW5zaXRpb25zIGZyb20NCj4gVC0+RiB0aGVuIHdo YXQgaXMgdGhlIGltcGxlbWVudGVyIHN1cHBvc2VkIHRvIGRvPw0KDQpbTWVkXSBUaGlzIHRyYW5z aXRpb24gd2lsbCBoYXZlIGFuIGVmZmVjdCB0byBkaXNhYmxlIEFOWSBsb2dnaW5nIGZlYXR1cmUg c3VwcG9ydGVkIGJ5IGFuIGltcGxlbWVudGF0aW9uLiBUaGUgdHJhbnNpdGlvbiBmb3IgRiB0byBU IGlzIG1vcmUgcHJvYmxlbWF0aWMgYXMgaXQgcmVxdWlyZXMgYWRkaXRpb25hbCBpbmZvcm1hdGlv biB0byBiZSBhdmFpbGFibGUgKGUuZy4sIGxvZ2dpbmcgc2VydmVyIElQIGFkZHJlc3MgYW5kIHBv cnQsIGNyZWRlbnRpYWxzLCAuLi4pLiBUaGUgZG9jdW1lbnQgYXNzdW1lcyB0aGF0IGRhdGEgaXMg cHJvdmlzaW9uZWQgdXNpbmcgb3RoZXIgc3BlY2lmaWMgbW9kdWxlcyAoc3lzbG9nLCBpcGZpeCwg ZXRjLikuDQoNCiBJIHRoaW5rIHRoYXQgaWxsdXN0cmF0ZXMNCj4gdGhlDQo+IHVuZGVyLXNwZWNp ZmljYXRpb24gaGVyZS4gVGhlIHNpbXBsZXN0IHRoaW5nIG1pZ2h0IGJlIHRvIHJlYWxseSBtYWtl IGxvZ2dpbmcNCj4gb3V0IG9mIHNjb3BlIGhlcmUgYnkgZGVsZXRpbmcgdGhlIGxvZ2dpbmctZW5h YmxlIHRoaW5nIGVudGlyZWx5LiAoSSBjYW4NCj4gaW1hZ2luZQ0KPiB0aGF0IHJlYWNoaW5nIGNv bnNlbnN1cyBvbiBhIGxvZ2dpbmcgY29udHJvbCBpbnRlcmZhY2Ugd291bGQgYmUgbm9uLXRyaXZp YWwsDQoNCltNZWRdIFRoZXJlIGlzIGFscmVhZHkgUkZDIDgxNTguDQoNCj4gaGVuY2UgdGhlIHN1 Z2dlc3Rpb24gdG8gcmVhbGx5IHB1dCBpdCBvdXQgb2Ygc2NvcGUgcmF0aGVyIHRoYW4gdHJ5IHNw ZWNpZnkgaXQNCj4gZnVsbHkuKQ0KPiANCg0KW01lZF0gSWYsIHdpdGggdGhlIGFib3ZlIGNsYXJp ZmljYXRpb24sIHlvdSBtYWludGFpbiB5b3VyIGNvbW1lbnQsIHRoZW4gSSBkb24ndCBoYXZlIGFu eSBvYmplY3Rpb24gdG8gcmVtb3ZlIHRoYXQgb3B0aW9uYWwgZmVhdHVyZSBmcm9tIHRoZSBtb2R1 bGUuIFBsZWFzZSBhZHZpc2UuIA0KDQo+IEp1c3Qgb25lIG5pdDoNCj4gDQo+IFRoZSBhYnN0cmFj dCBjb3VsZCBkbyB3aXRoIGEgYml0IG9mIHJlLXdvcmRpbmcgYXMgaXQgcmVhZHMgYXdrd2FyZGx5 LiAgSSdkDQo+IHNheQ0KPiBtYXliZSBqdXN0IGRlbGV0ZSB0aGUgMXN0IHNlbnRlbmNlLg0KPiAN Cg0KW01lZF0gT0suDQoNCg== From nobody Mon Jun 18 00:52:33 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 134B4130DE6; Mon, 18 Jun 2018 00:52:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YKAgMadlczL5; Mon, 18 Jun 2018 00:52:15 -0700 (PDT) Received: from orange.com (mta135.mail.business.static.orange.com [80.12.70.35]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13C8A130D7A; Mon, 18 Jun 2018 00:52:15 -0700 (PDT) Received: from opfednr06.francetelecom.fr (unknown [xx.xx.xx.70]) by opfednr26.francetelecom.fr (ESMTP service) with ESMTP id B0D3520810; Mon, 18 Jun 2018 09:52:13 +0200 (CEST) Received: from Exchangemail-eme2.itn.ftgroup (unknown [xx.xx.31.66]) by opfednr06.francetelecom.fr (ESMTP service) with ESMTP id 833641A0076; Mon, 18 Jun 2018 09:52:13 +0200 (CEST) Received: from OPEXCLILMA3.corporate.adroot.infra.ftgroup ([fe80::60a9:abc3:86e6:2541]) by OPEXCLILMA1.corporate.adroot.infra.ftgroup ([fe80::95e2:eb4b:3053:fabf%19]) with mapi id 14.03.0399.000; Mon, 18 Jun 2018 09:52:13 +0200 From: To: Roni Even , "gen-art@ietf.org" CC: "draft-ietf-opsawg-nat-yang.all@ietf.org" , "ietf@ietf.org" , "opsawg@ietf.org" Thread-Topic: Genart last call review of draft-ietf-opsawg-nat-yang-14 Thread-Index: AQHUBgRW2tT5fBANDE2lmzZtMBD5SKRlm5gA Date: Mon, 18 Jun 2018 07:52:12 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B93302DF467D9@OPEXCLILMA3.corporate.adroot.infra.ftgroup> References: <152921687734.2071.3843497811933571200@ietfa.amsl.com> In-Reply-To: <152921687734.2071.3843497811933571200@ietfa.amsl.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.168.234.6] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] Genart last call review of draft-ietf-opsawg-nat-yang-14 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2018 07:52:17 -0000 SGkgUm9uaSwgDQoNClRoYW5rIHlvdSBmb3IgZG91YmxlIGNoZWNraW5nLiANCg0KQXMgcGVyIHlv dXIgY29tbWVudDogDQo+IEkgd2FzIGp1c3Qgd29uZGVyaW5nIHdoeSBpdCB3ZW50IGZyb20gIHZl cnNpb24gLTEwIHRvIC0xNA0KDQpJIGNvbmZpcm0gdGhhdCB0aGUgY2hhbmdlcyBzaW5jZSAtMTAg YXJlIHZlcnkgbWlub3IgKG1haW5seSBmaXhpbmcgc29tZSBuaXRzKS4gVGhlIHZlcnNpb24gYnVt cCB3YXMgYSBzaWRlIGVmZmVjdCBvZiBhZGRyZXNzaW5nIHRoZSBPUFMgZGlyZWN0b3JhdGUgcmV2 aWV3IHdoaWNoIHJhaXNlZCBhIHBvaW50IHJlbGF0ZWQgdG8gdGhlIE5QVHY2IHBhcnQgaW4gdGhl IG1vZHVsZSAoTlBUdjYgaXMgZGVmaW5lZCBhcyBFeHBlcmltZW50YWwgd2hpbGUgdGhpcyBkcmFm dCB0YXJnZXRzIFN0YW5kYXJkcyB0cmFja3MpOiBodHRwczovL21haWxhcmNoaXZlLmlldGYub3Jn L2FyY2gvbXNnL29wc2F3Zy8ta1FvSnV3N0o3ZDk3R2FxQW9Od2pKb0tEVzguIE5QVHY2IHdhcyBy ZWludGVncmF0ZWQgYmFzZWQgb24gdGhlIGNvbW1lbnQgbWFkZSBieSBCLiBDbGFpc2U6IGh0dHBz Oi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvb3BzYXdnL2JYWG1ycjlWZVdYdURCWi1l YnlQUlNxQ0hnSSANCg0KQ2hlZXJzLA0KTWVkDQoNCj4gLS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0t LS0tDQo+IERlwqA6IFJvbmkgRXZlbiBbbWFpbHRvOnJvbi5ldmVuLnRsdkBnbWFpbC5jb21dDQo+ IEVudm95w6nCoDogZGltYW5jaGUgMTcganVpbiAyMDE4IDA4OjI4DQo+IMOAwqA6IGdlbi1hcnRA aWV0Zi5vcmcNCj4gQ2PCoDogZHJhZnQtaWV0Zi1vcHNhd2ctbmF0LXlhbmcuYWxsQGlldGYub3Jn OyBpZXRmQGlldGYub3JnOyBvcHNhd2dAaWV0Zi5vcmcNCj4gT2JqZXTCoDogR2VuYXJ0IGxhc3Qg Y2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1vcHNhd2ctbmF0LXlhbmctMTQNCj4gDQo+IFJldmll d2VyOiBSb25pIEV2ZW4NCj4gUmV2aWV3IHJlc3VsdDogUmVhZHkNCj4gDQo+IEkgYW0gdGhlIGFz c2lnbmVkIEdlbi1BUlQgcmV2aWV3ZXIgZm9yIHRoaXMgZHJhZnQuIFRoZSBHZW5lcmFsIEFyZWEN Cj4gUmV2aWV3IFRlYW0gKEdlbi1BUlQpIHJldmlld3MgYWxsIElFVEYgZG9jdW1lbnRzIGJlaW5n IHByb2Nlc3NlZA0KPiBieSB0aGUgSUVTRyBmb3IgdGhlIElFVEYgQ2hhaXIuICBQbGVhc2UgdHJl YXQgdGhlc2UgY29tbWVudHMganVzdA0KPiBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVu dHMuDQo+IA0KPiBGb3IgbW9yZSBpbmZvcm1hdGlvbiwgcGxlYXNlIHNlZSB0aGUgRkFRIGF0DQo+ IA0KPiA8aHR0cHM6Ly90cmFjLmlldGYub3JnL3RyYWMvZ2VuL3dpa2kvR2VuQXJ0ZmFxPi4NCj4g DQo+IERvY3VtZW50OiBkcmFmdC1pZXRmLW9wc2F3Zy1uYXQteWFuZy0/Pw0KPiBSZXZpZXdlcjog Um9uaSBFdmVuDQo+IFJldmlldyBEYXRlOiAyMDE4LTA2LTE2DQo+IElFVEYgTEMgRW5kIERhdGU6 IDIwMTgtMDYtMjgNCj4gSUVTRyBUZWxlY2hhdCBkYXRlOiBOb3Qgc2NoZWR1bGVkIGZvciBhIHRl bGVjaGF0DQo+IA0KPiBTdW1tYXJ5Og0KPiBUaGUgZG9jdW1lbnQgaXMgcmVhZHkgZm9yIHB1Ymxp Y2F0aW9uIGFzIGEgc3RhbmRhcmQgdHJhY2sgUkZDLg0KPiBJIHdhcyBqdXN0IHdvbmRlcmluZyB3 aHkgaXQgd2VudCBmcm9tICB2ZXJzaW9uIC0xMCB0byAtMTQNCj4gDQo+IE1ham9yIGlzc3VlczoN Cj4gDQo+IE1pbm9yIGlzc3VlczoNCj4gDQo+IE5pdHMvZWRpdG9yaWFsIGNvbW1lbnRzOg0KPiAN Cg0K From nobody Mon Jun 18 02:49:00 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71206130DCC; Mon, 18 Jun 2018 02:48:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5jBV8rZa94Ib; Mon, 18 Jun 2018 02:48:47 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7F1E1277C8; Mon, 18 Jun 2018 02:48:46 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 28D5DBE2E; Mon, 18 Jun 2018 10:48:45 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sbVbrxe_nzm2; Mon, 18 Jun 2018 10:48:45 +0100 (IST) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id DF127BE24; Mon, 18 Jun 2018 10:48:44 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1529315324; bh=2IqN8oJBHeSZP1zO8yk8BmWvDpBClQig4RyfA+Z4Sko=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=Z8cCckdjiI9vdHUgwFv9O3tbKKlHtWEfmvo88BJw7E1r/W+zGKEDsiDyWU72njT2S xw/4EbCXgHIDfSxjUOy00KzYSbMWx9ET21Pc8sNoOVaFizJ5dmboCJqO+5kNx7cNL0 oqozcxJ5U2RFy96JTXtSXoK57uoMNixpX1MLYNpc= To: mohamed.boucadair@orange.com, "secdir@ietf.org" Cc: "draft-ietf-opsawg-nat-yang.all@ietf.org" , "ietf@ietf.org" , "opsawg@ietf.org" References: <152926599250.2311.15532810595098738604@ietfa.amsl.com> <787AE7BB302AE849A7480A190F8B93302DF4678E@OPEXCLILMA3.corporate.adroot.infra.ftgroup> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <1c4bf138-afb1-4aef-ddb5-b15262b05af2@cs.tcd.ie> Date: Mon, 18 Jun 2018 10:48:43 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <787AE7BB302AE849A7480A190F8B93302DF4678E@OPEXCLILMA3.corporate.adroot.infra.ftgroup> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dMyLed2VmvreUswV1UzhTlEZptsFSuARy" Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-nat-yang-14 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2018 09:48:51 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dMyLed2VmvreUswV1UzhTlEZptsFSuARy Content-Type: multipart/mixed; boundary="qEzOqJkie2A8ch9pz1ePvlpfHMN72ZYWB"; protected-headers="v1" From: Stephen Farrell To: mohamed.boucadair@orange.com, "secdir@ietf.org" Cc: "draft-ietf-opsawg-nat-yang.all@ietf.org" , "ietf@ietf.org" , "opsawg@ietf.org" Message-ID: <1c4bf138-afb1-4aef-ddb5-b15262b05af2@cs.tcd.ie> Subject: Re: Secdir last call review of draft-ietf-opsawg-nat-yang-14 References: <152926599250.2311.15532810595098738604@ietfa.amsl.com> <787AE7BB302AE849A7480A190F8B93302DF4678E@OPEXCLILMA3.corporate.adroot.infra.ftgroup> In-Reply-To: <787AE7BB302AE849A7480A190F8B93302DF4678E@OPEXCLILMA3.corporate.adroot.infra.ftgroup> --qEzOqJkie2A8ch9pz1ePvlpfHMN72ZYWB Content-Type: multipart/mixed; boundary="------------D644238EA9BC3548F949AFD9" Content-Language: en-GB This is a multi-part message in MIME format. --------------D644238EA9BC3548F949AFD9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Med, On 18/06/18 08:10, mohamed.boucadair@orange.com wrote: > Hi Stephen, >=20 > Thank you for the review. >=20 > Please see inline. >=20 > Cheers, Med >=20 >> -----Message d'origine----- De : Stephen Farrell >> [mailto:stephen.farrell@cs.tcd.ie] Envoy=C3=A9 : dimanche 17 juin 2018= >> 22:07 =C3=80 : secdir@ietf.org Cc : >> draft-ietf-opsawg-nat-yang.all@ietf.org; ietf@ietf.org; >> opsawg@ietf.org Objet : Secdir last call review of >> draft-ietf-opsawg-nat-yang-14 >>=20 >> Reviewer: Stephen Farrell Review result: Has Issues >>=20 >> I see one major issue: >>=20 >> 2.1: Logging in NATs and esp. CGNs is clearly sensitive in various >> ways. I think it'd be ok if logging was really out of scope, >> however, there is a logging-enable feature, I think >> under-specified, (on page 63) so the statement in 2.1 seems >> contradictory to me - if logging is out of scope why is=20 >> logging-enable a flag?. Presumably if logging-enable transitions >> from F->T then you turn on (some undefined kind of) logging. >=20 > [Med] The intent is not to define the exact set of logging > information (e.g., Section 4 of RFC6888), the protocol to use (e.g., > RFC8158 or draft-ietf-behave-syslog-nat-logging), etc... but to allow > for disabling/enabling such feature (when supported by an > implementation). Sure, I get the idea. I guess I'm not sure it's a good idea though, if not more fully specified. >=20 > If this transitions from >> T->F then what is the implementer supposed to do? >=20 > [Med] This transition will have an effect to disable ANY logging > feature supported by an implementation.=20 Really? I'd have thought there was going to be some logging that was always on, e.g. to detect attacks. Or maybe you're not calling that logging? (I think that maybe also illustrates that as-is, this is currently not very well defined.) > The transition for F to T is > more problematic as it requires additional information to be > available (e.g., logging server IP address and port, credentials, > ...). The document assumes that data is provisioned using other > specific modules (syslog, ipfix, etc.). I suspect that there'd also be a need for information about data retention duration and scope, for logging that is local to the NAT box. >=20 >> I think that illustrates >> the under-specification here. The simplest thing might be to really >> make logging out of scope here by deleting the logging-enable thing >> entirely. (I can imagine that reaching consensus on a logging >> control interface would be non-trivial, >=20 > [Med] There is already RFC 8158. >=20 >> hence the suggestion to really put it out of scope rather than try >> specify it fully.) >>=20 >=20 > [Med] If, with the above clarification, you maintain your comment, > then I don't have any objection to remove that optional feature from > the module. Please advise. Well, mine is just a secdir review - you're not forced to do anything at all about it (unless some AD decides that you need to). But FWIW, yes, I do think it'd be better to drop that from this draft, and maybe consider working on some other interface to handle it better. Cheers, S. >=20 >> Just one nit: >>=20 >> The abstract could do with a bit of re-wording as it reads >> awkwardly. I'd say maybe just delete the 1st sentence. >>=20 >=20 > [Med] OK. >=20 --------------D644238EA9BC3548F949AFD9 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------D644238EA9BC3548F949AFD9-- --qEzOqJkie2A8ch9pz1ePvlpfHMN72ZYWB-- --dMyLed2VmvreUswV1UzhTlEZptsFSuARy Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlsnf/sACgkQWrL68XsX K+rojg//a2+vxRrUmdFpFJKA7V/sNzcTREVd/IyC59xSjRd3sW9InXvRqk4rPhq+ H0zpcSxFYpP2SR1oJCHGaPphyXx2nvyzT3asOW0x4NyMqWjzvQC/vb97iwTWfG3S vPkbER79U60kdOC6n7MlRnuhAZGSHaBKeBWcBPo6cALnIUdi8xzjyqRuk7vSV2eM Qn8CnAJcSnO745u2b8XYDBScGK50VkhtTDEuVEawsR6icb97netF/6kPTMrc7F4p yKjpJXorZIKzDB6CSGl9rHE5NovSPnXSTJrSmebd9sewWGcovhSYYCg9LGf+Po5w nXizqIW86gSktrsSYOBhoumnVbOodVVwjc9LiPIZfIEfXh3EC+Xlt2yIvPa84jFG 2ihEN7Ns8lMCpQu6/HXAgn7x7ZzvA7CTEaymD1qpQ6q6Q860Qx0vmeE9R3z3oLn4 1gsxqR/nZB4igkfHN4ZZLNm5Bt+ws/3CDUledtkVwSORQfqd3JnM9lygQHhEXtuh JVB/OjA2gsHySB4guRLk0B2vSDRD/G3r2HmYr4A4LnKSlSiQ8WHhfYUS1KMhdXAX NZCEiE7+fAzfj3EyUcMvu4ednfyH5T4C98/9oP1X2ncuNU3OkYmIiMiJqTTt6TQ3 VEaZHTm+lYtuBOUyDMok9QIxmy1nEzvI1a0zit2gUIzN21kvxTA= =gNj/ -----END PGP SIGNATURE----- --dMyLed2VmvreUswV1UzhTlEZptsFSuARy-- From nobody Mon Jun 18 04:13:58 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFD24130E96; Mon, 18 Jun 2018 04:13:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gsjao4f2dUoO; Mon, 18 Jun 2018 04:13:53 -0700 (PDT) Received: from orange.com (mta240.mail.business.static.orange.com [80.12.66.40]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2A8F130DDF; Mon, 18 Jun 2018 04:13:52 -0700 (PDT) Received: from opfedar01.francetelecom.fr (unknown [xx.xx.xx.2]) by opfedar27.francetelecom.fr (ESMTP service) with ESMTP id 418T4H4dtrz2yl5; Mon, 18 Jun 2018 13:13:51 +0200 (CEST) Received: from Exchangemail-eme2.itn.ftgroup (unknown [xx.xx.31.43]) by opfedar01.francetelecom.fr (ESMTP service) with ESMTP id E2E38160098; Mon, 18 Jun 2018 13:13:38 +0200 (CEST) Received: from OPEXCLILMA3.corporate.adroot.infra.ftgroup ([fe80::60a9:abc3:86e6:2541]) by OPEXCLILM5F.corporate.adroot.infra.ftgroup ([fe80::e172:f13e:8be6:71cc%18]) with mapi id 14.03.0399.000; Mon, 18 Jun 2018 13:13:38 +0200 From: To: Stephen Farrell , "secdir@ietf.org" CC: "draft-ietf-opsawg-nat-yang.all@ietf.org" , "ietf@ietf.org" , "opsawg@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-opsawg-nat-yang-14 Thread-Index: AQHUBumN98KCqFI0Y0G23qLjJqwx/6Rl2k7Q Date: Mon, 18 Jun 2018 11:13:38 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B93302DF469A7@OPEXCLILMA3.corporate.adroot.infra.ftgroup> References: <152926599250.2311.15532810595098738604@ietfa.amsl.com> <787AE7BB302AE849A7480A190F8B93302DF4678E@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <1c4bf138-afb1-4aef-ddb5-b15262b05af2@cs.tcd.ie> In-Reply-To: <1c4bf138-afb1-4aef-ddb5-b15262b05af2@cs.tcd.ie> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.168.234.6] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-nat-yang-14 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2018 11:13:56 -0000 UmUtLA0KDQpQbGVhc2Ugc2VlIGlubGluZS4gDQoNCkNoZWVycywNCk1lZA0KDQo+IC0tLS0tTWVz c2FnZSBkJ29yaWdpbmUtLS0tLQ0KPiBEZcKgOiBTdGVwaGVuIEZhcnJlbGwgW21haWx0bzpzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllXQ0KPiBFbnZvecOpwqA6IGx1bmRpIDE4IGp1aW4gMjAxOCAx MTo0OQ0KPiDDgMKgOiBCT1VDQURBSVIgTW9oYW1lZCBJTVQvT0xOOyBzZWNkaXJAaWV0Zi5vcmcN Cj4gQ2PCoDogZHJhZnQtaWV0Zi1vcHNhd2ctbmF0LXlhbmcuYWxsQGlldGYub3JnOyBpZXRmQGll dGYub3JnOyBvcHNhd2dAaWV0Zi5vcmcNCj4gT2JqZXTCoDogUmU6IFNlY2RpciBsYXN0IGNhbGwg cmV2aWV3IG9mIGRyYWZ0LWlldGYtb3BzYXdnLW5hdC15YW5nLTE0DQo+IA0KPiANCj4gSGkgTWVk LA0KPiANCj4gT24gMTgvMDYvMTggMDg6MTAsIG1vaGFtZWQuYm91Y2FkYWlyQG9yYW5nZS5jb20g d3JvdGU6DQo+ID4gSGkgU3RlcGhlbiwNCj4gPg0KPiA+IFRoYW5rIHlvdSBmb3IgdGhlIHJldmll dy4NCj4gPg0KPiA+IFBsZWFzZSBzZWUgaW5saW5lLg0KPiA+DQo+ID4gQ2hlZXJzLCBNZWQNCj4g Pg0KPiA+PiAtLS0tLU1lc3NhZ2UgZCdvcmlnaW5lLS0tLS0gRGUgOiBTdGVwaGVuIEZhcnJlbGwN Cj4gPj4gW21haWx0bzpzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllXSBFbnZvecOpIDogZGltYW5j aGUgMTcganVpbiAyMDE4DQo+ID4+IDIyOjA3IMOAIDogc2VjZGlyQGlldGYub3JnIENjIDoNCj4g Pj4gZHJhZnQtaWV0Zi1vcHNhd2ctbmF0LXlhbmcuYWxsQGlldGYub3JnOyBpZXRmQGlldGYub3Jn Ow0KPiA+PiBvcHNhd2dAaWV0Zi5vcmcgT2JqZXQgOiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBv Zg0KPiA+PiBkcmFmdC1pZXRmLW9wc2F3Zy1uYXQteWFuZy0xNA0KPiA+Pg0KPiA+PiBSZXZpZXdl cjogU3RlcGhlbiBGYXJyZWxsIFJldmlldyByZXN1bHQ6IEhhcyBJc3N1ZXMNCj4gPj4NCj4gPj4g SSBzZWUgb25lIG1ham9yIGlzc3VlOg0KPiA+Pg0KPiA+PiAyLjE6IExvZ2dpbmcgaW4gTkFUcyBh bmQgZXNwLiBDR05zIGlzIGNsZWFybHkgc2Vuc2l0aXZlIGluIHZhcmlvdXMNCj4gPj4gd2F5cy4g SSB0aGluayBpdCdkIGJlIG9rIGlmIGxvZ2dpbmcgd2FzIHJlYWxseSBvdXQgb2Ygc2NvcGUsDQo+ ID4+IGhvd2V2ZXIsIHRoZXJlIGlzIGEgbG9nZ2luZy1lbmFibGUgZmVhdHVyZSwgSSB0aGluaw0K PiA+PiB1bmRlci1zcGVjaWZpZWQsICAob24gcGFnZSA2Mykgc28gdGhlIHN0YXRlbWVudCBpbiAy LjEgc2VlbXMNCj4gPj4gY29udHJhZGljdG9yeSB0byBtZSAtIGlmIGxvZ2dpbmcgaXMgb3V0IG9m IHNjb3BlIHdoeSBpcw0KPiA+PiBsb2dnaW5nLWVuYWJsZSBhIGZsYWc/LiAgUHJlc3VtYWJseSBp ZiBsb2dnaW5nLWVuYWJsZSB0cmFuc2l0aW9ucw0KPiA+PiBmcm9tIEYtPlQgdGhlbiB5b3UgdHVy biBvbiAoc29tZSB1bmRlZmluZWQga2luZCBvZikgbG9nZ2luZy4NCj4gPg0KPiA+IFtNZWRdIFRo ZSBpbnRlbnQgaXMgbm90IHRvIGRlZmluZSB0aGUgZXhhY3Qgc2V0IG9mIGxvZ2dpbmcNCj4gPiBp bmZvcm1hdGlvbiAoZS5nLiwgU2VjdGlvbiA0IG9mIFJGQzY4ODgpLCB0aGUgcHJvdG9jb2wgdG8g dXNlIChlLmcuLA0KPiA+IFJGQzgxNTggb3IgZHJhZnQtaWV0Zi1iZWhhdmUtc3lzbG9nLW5hdC1s b2dnaW5nKSwgZXRjLi4uIGJ1dCB0byBhbGxvdw0KPiA+IGZvciBkaXNhYmxpbmcvZW5hYmxpbmcg c3VjaCBmZWF0dXJlICh3aGVuIHN1cHBvcnRlZCBieSBhbg0KPiA+IGltcGxlbWVudGF0aW9uKS4N Cj4gDQo+IFN1cmUsIEkgZ2V0IHRoZSBpZGVhLiBJIGd1ZXNzIEknbSBub3Qgc3VyZSBpdCdzIGEg Z29vZCBpZGVhDQo+IHRob3VnaCwgaWYgbm90IG1vcmUgZnVsbHkgc3BlY2lmaWVkLg0KPiANCj4g Pg0KPiA+IElmIHRoaXMgdHJhbnNpdGlvbnMgZnJvbQ0KPiA+PiBULT5GIHRoZW4gd2hhdCBpcyB0 aGUgaW1wbGVtZW50ZXIgc3VwcG9zZWQgdG8gZG8/DQo+ID4NCj4gPiBbTWVkXSBUaGlzIHRyYW5z aXRpb24gd2lsbCBoYXZlIGFuIGVmZmVjdCB0byBkaXNhYmxlIEFOWSBsb2dnaW5nDQo+ID4gZmVh dHVyZSBzdXBwb3J0ZWQgYnkgYW4gaW1wbGVtZW50YXRpb24uDQo+IA0KPiBSZWFsbHk/IEknZCBo YXZlIHRob3VnaHQgdGhlcmUgd2FzIGdvaW5nIHRvIGJlIHNvbWUgbG9nZ2luZw0KPiB0aGF0IHdh cyBhbHdheXMgb24sIGUuZy4gdG8gZGV0ZWN0IGF0dGFja3MuDQoNCltNZWRdIFRoaXMgaXMgZGVw bG95bWVudC1zcGVjaWZpYy4gRm9yIGV4YW1wbGUsIGEgQ0dOIHdoaWNoIGlzIGNvbmZpZ3VyZWQg dG8gYmVoYXZlIGluIHBvcnQgZGV0ZXJtaW5pc3RpYyBiZWhhdmlvciAoUkZDNzQyMikgaW5zdGVh ZCBvZiBhbm90aGVyIHBvcnQgYXNzaWdubWVudCBzY2hlbWUgZG9lcyBub3QgbmVlZCB0byBlbmFi bGUgbG9nZ2luZyBzaW5jZSB0aGUgaW50ZXJuYWwgSVAgYWRkcmVzcy9wb3J0KC1yYW5nZSkgaXMg YSBmdW5jdGlvbiBvZiB0aGUgZXh0ZXJuYWwgSVAgYWRkcmVzcy9wb3J0KC1yYW5nZSkuDQoNCiBP ciBtYXliZSB5b3UncmUNCj4gbm90IGNhbGxpbmcgdGhhdCBsb2dnaW5nPyAoSSB0aGluayB0aGF0 IG1heWJlIGFsc28gaWxsdXN0cmF0ZXMNCj4gdGhhdCBhcy1pcywgdGhpcyBpcyBjdXJyZW50bHkg bm90IHZlcnkgd2VsbCBkZWZpbmVkLikNCj4gDQo+ID4gVGhlIHRyYW5zaXRpb24gZm9yIEYgdG8g VCBpcw0KPiA+IG1vcmUgcHJvYmxlbWF0aWMgYXMgaXQgcmVxdWlyZXMgYWRkaXRpb25hbCBpbmZv cm1hdGlvbiB0byBiZQ0KPiA+IGF2YWlsYWJsZSAoZS5nLiwgbG9nZ2luZyBzZXJ2ZXIgSVAgYWRk cmVzcyBhbmQgcG9ydCwgY3JlZGVudGlhbHMsDQo+ID4gLi4uKS4gVGhlIGRvY3VtZW50IGFzc3Vt ZXMgdGhhdCBkYXRhIGlzIHByb3Zpc2lvbmVkIHVzaW5nIG90aGVyDQo+ID4gc3BlY2lmaWMgbW9k dWxlcyAoc3lzbG9nLCBpcGZpeCwgZXRjLikuDQo+IA0KPiBJIHN1c3BlY3QgdGhhdCB0aGVyZSdk IGFsc28gYmUgYSBuZWVkIGZvciBpbmZvcm1hdGlvbiBhYm91dA0KPiBkYXRhIHJldGVudGlvbiBk dXJhdGlvbiBhbmQgc2NvcGUsIGZvciBsb2dnaW5nIHRoYXQgaXMgbG9jYWwNCj4gdG8gdGhlIE5B VCBib3guDQoNCltNZWRdIFR5cGljYWxseSwgZGF0YSByZXRlbnRpb24gZHVyYXRpb24gaXMgbm90 IGhhbmRsZWQgYXQgdGhlIE5BVCBpdHNlbGYgYnV0IGFzIHBhcnQgb2YgYSAiZGVkaWNhdGVkIiBw bGF0Zm9ybSB0aGF0IGlzIHVzZWQgdG8gZ2F0aGVyIGxvZ2dpbmcgaW5mb3JtYXRpb24gZnJvbSB2 YXJpb3VzIHNvdXJjZXMgaW4gYSBuZXR3b3JrLiAgDQoNCj4gDQo+ID4NCj4gPj4gSSB0aGluayB0 aGF0IGlsbHVzdHJhdGVzDQo+ID4+IHRoZSB1bmRlci1zcGVjaWZpY2F0aW9uIGhlcmUuIFRoZSBz aW1wbGVzdCB0aGluZyBtaWdodCBiZSB0byByZWFsbHkNCj4gPj4gbWFrZSBsb2dnaW5nIG91dCBv ZiBzY29wZSBoZXJlIGJ5IGRlbGV0aW5nIHRoZSBsb2dnaW5nLWVuYWJsZSB0aGluZw0KPiA+PiBl bnRpcmVseS4gKEkgY2FuIGltYWdpbmUgdGhhdCByZWFjaGluZyBjb25zZW5zdXMgb24gYSBsb2dn aW5nDQo+ID4+IGNvbnRyb2wgaW50ZXJmYWNlIHdvdWxkIGJlIG5vbi10cml2aWFsLA0KPiA+DQo+ ID4gW01lZF0gVGhlcmUgaXMgYWxyZWFkeSBSRkMgODE1OC4NCj4gPg0KPiA+PiBoZW5jZSB0aGUg c3VnZ2VzdGlvbiB0byByZWFsbHkgcHV0IGl0IG91dCBvZiBzY29wZSByYXRoZXIgdGhhbiB0cnkN Cj4gPj4gc3BlY2lmeSBpdCBmdWxseS4pDQo+ID4+DQo+ID4NCj4gPiBbTWVkXSBJZiwgd2l0aCB0 aGUgYWJvdmUgY2xhcmlmaWNhdGlvbiwgeW91IG1haW50YWluIHlvdXIgY29tbWVudCwNCj4gPiB0 aGVuIEkgZG9uJ3QgaGF2ZSBhbnkgb2JqZWN0aW9uIHRvIHJlbW92ZSB0aGF0IG9wdGlvbmFsIGZl YXR1cmUgZnJvbQ0KPiA+IHRoZSBtb2R1bGUuIFBsZWFzZSBhZHZpc2UuDQo+IA0KPiBXZWxsLCBt aW5lIGlzIGp1c3QgYSBzZWNkaXIgcmV2aWV3IC0geW91J3JlIG5vdCBmb3JjZWQgdG8gZG8NCj4g YW55dGhpbmcgYXQgYWxsIGFib3V0IGl0ICh1bmxlc3Mgc29tZSBBRCBkZWNpZGVzIHRoYXQgeW91 IG5lZWQNCj4gdG8pLiBCdXQgRldJVywgeWVzLCBJIGRvIHRoaW5rIGl0J2QgYmUgYmV0dGVyIHRv IGRyb3AgdGhhdCBmcm9tDQo+IHRoaXMgZHJhZnQsIGFuZCBtYXliZSBjb25zaWRlciB3b3JraW5n IG9uIHNvbWUgb3RoZXIgaW50ZXJmYWNlDQo+IHRvIGhhbmRsZSBpdCBiZXR0ZXIuDQo+IA0KDQpb TWVkXSBBQ0suICANCg0KPiBDaGVlcnMsDQo+IFMuDQo+IA0KPiANCj4gDQo+ID4NCj4gPj4gSnVz dCBvbmUgbml0Og0KPiA+Pg0KPiA+PiBUaGUgYWJzdHJhY3QgY291bGQgZG8gd2l0aCBhIGJpdCBv ZiByZS13b3JkaW5nIGFzIGl0IHJlYWRzDQo+ID4+IGF3a3dhcmRseS4gIEknZCBzYXkgbWF5YmUg anVzdCBkZWxldGUgdGhlIDFzdCBzZW50ZW5jZS4NCj4gPj4NCj4gPg0KPiA+IFtNZWRdIE9LLg0K PiA+DQo= From nobody Tue Jun 19 06:43:58 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E61E013103A; Tue, 19 Jun 2018 06:43:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vNp5cKS8AmhO; Tue, 19 Jun 2018 06:43:54 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7F7613103B; Tue, 19 Jun 2018 06:43:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=872; q=dns/txt; s=iport; t=1529415834; x=1530625434; h=to:cc:from:subject:message-id:date:mime-version: content-transfer-encoding; bh=jUnzETqJYv/InG41ETqiLAtLuKBK15D2+AiPXrtaTdU=; b=deVf7TU0fipiEgfM6LKuQuVtSpYHm/l/erWzD6pz32FpT7zPuruMySDJ LM+sass5HJVclkkrDWGUjqj5RbQXJHOcLlgcX4yMyrtbQrq+KcVKpvwaM SYfXnMzjYRP7FsPZxnFx6fXo1hA1p86Ik33hGsFwqZbyxrGc1gp/XJE7r s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DhAQBMCClb/4YNJK1cGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYNJYn8og3mUVYFXlxwLI4RJgmshOBQBAgEBAQEBAQJtHAE?= =?us-ascii?q?LhUwGDwFGNQImAkgXDQYCAQGDIQGBfw+rCIIciEaBYwWBC4dJgVQ/gTOEKYF?= =?us-ascii?q?SAgEChF6CVQKMPoUKh1cJhX2JDAaBP4QAgkaFOIoVhz6BWCGBUk0jFYJ+gi2?= =?us-ascii?q?IZIVaIzABkT4BAQ?= X-IronPort-AV: E=Sophos;i="5.51,243,1526342400"; d="scan'208";a="409226002" Received: from alln-core-12.cisco.com ([173.36.13.134]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Jun 2018 13:43:53 +0000 Received: from [10.118.87.86] (rtp-jclarke-nitro5.cisco.com [10.118.87.86]) by alln-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id w5JDhqwV016969; Tue, 19 Jun 2018 13:43:53 GMT To: "opsawg@ietf.org" Cc: "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" From: Joe Clarke Openpgp: preference=signencrypt Autocrypt: addr=jclarke@cisco.com; prefer-encrypt=mutual; keydata= xsDiBDyDmj4RBADa/Icz5Xl+cJUGNxC/tWgXWqcA9VA8GN+PeqKhXS0BnVHntdsQxbpFUUKK 4ld0Zex/Rec1jgC/ikExJHHIee8ZVcHqP+tsWexi83/ZvEdzI95diBp2Is5fYp8P8hdIBNQS Ooc1jVYrTJUaZgJK2uBzbkh/WbipwsQbueRzXqPORwCgsPNrStLzqOpjrA7FdUz/JVQf5+8D /1SiKAOFiW4TxY+fS09lqiLs3mbXjvw23iQwLxje4vBd4+b9iAUWOsSretSKv6OE9ZlD4FYe a8HmMgEkuKfXGc8GvTq4J1uHZ0gcVbrBGmxAUBPPaAENYEJfJf7dcysKVAl14ZQVIvzAGJAZ HGuegD7uekGKnOEA61R3ze4aM2zNA/96I77l0qiMc6J7gXmiD5uxC7FsSCFj5sqTYMgBqzIY EZjU/tTUbth84xcRi4X0WNkaILqq1mOcBfmzQMvzG1n1CydmJU6iF1ewle6cIui9TQYg5CES rJF7xid4vVXRz+xi6hc1+0bSaoJa3sfpNrSSr0lKGdWHZozWdQjOvTMCXc1CSm9lIE1hcmN1 cyBDbGFya2UgKEZyZWVCU0QgY29tbWl0dGVyIGFkZHJlc3MpIDxtYXJjdXNARnJlZUJTRC5v cmc+wl8EExECABcFAjyuLU0FCwcKAwQDFQMCAxYCAQIXgAASCRBvaI+K/hTPhwdlR1BHAAEB 7U0AoICIVoBe9B8bo1lrvHh+UF7GY/WaAJ9C2mCThFrmqxCr2bCtR12UoPCPqs7ATQQ8g5pA EAQAqk1J4LBDLeWs6ZOkPDYYcKCSAu0qlzEf5YP/TcSeZcjJyXILgesFXcayoy1v7ILPQSXj 4p5uzRyn0fuGqiTvajjxMZz1aSkvgGyS+gc+PDmi4SJ2N/tX2isrul8MK+NGeUsLuZaM1JKh gKpq9yuu3D3ELG7ESga7xsOs1V/sSd8AAwUD/20XByIlsUUC/65KG/DQ1WfX2gNuy5If9tSP Q6h1Lno5Hv3ow3ktybIoQSxbcBo28nA/Gzg5NFGVkkqfOkH2xtS6V0K/WjzsrloBHCPFiKp2 yHpXfKubxl8yefQPTMj8hLwlBKrNiN1fz5/629TIkEwDwrUwHxQreE7FAzPMqHORwkYEGBEC AAYFAjyDmkAACgkQb2iPiv4Uz4cnuQCfX1zNrahRTWz/HRpF7ms8qZqzdOIAn1uuu6Jst43p DzanBHUOBzUP6ymA Organization: Cisco Message-ID: <241dc187-32a0-b65c-36e0-55e4f9c95f23@cisco.com> Date: Tue, 19 Jun 2018 09:43:52 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: [OPSAWG] IETF 102 opsawg/ops area : Call for Agenda Items X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Jun 2018 13:43:57 -0000 The proposed schedule is out, and the combined opsawg / ops area meeting will be held Tuesday, July 17 at 15:50 EDT (subject to change until the agenda is finalized). If you have items you would like to present at the opsawg session, please send a request to opsawg-chairs@ietf.org including the name of the draft, the proposed presenter, and the desired amount of time. If you would like to present during the ops area part of the meeting, please do the same as above, but copy ops-ads@ietf.org. The draft cutoff date is July 2. Therefore, if you wish to present new or updated work, please try to have that submitted as soon as possible before that date to give the area / WG time to review it. The full preliminary agenda for IETF 102 can be found at https://datatracker.ietf.org/meeting/102/agenda.html . Thanks. Joe on behalf of co-chairs From nobody Fri Jun 22 08:57:48 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DF54130EA6; Fri, 22 Jun 2018 08:57:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.81.3 Auto-Submitted: auto-generated Precedence: bulk Cc: ibagdona@gmail.com, The IESG , draft-ietf-opsawg-mud@ietf.org, jclarke@cisco.com, opsawg-chairs@ietf.org, Joe Clarke , opsawg@ietf.org, rfc-editor@rfc-editor.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <152968305324.3520.16787344263377387519.idtracker@ietfa.amsl.com> Date: Fri, 22 Jun 2018 08:57:33 -0700 Archived-At: Subject: [OPSAWG] Protocol Action: 'Manufacturer Usage Description Specification' to Proposed Standard (draft-ietf-opsawg-mud-25.txt) X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jun 2018 15:57:34 -0000 The IESG has approved the following document: - 'Manufacturer Usage Description Specification' (draft-ietf-opsawg-mud-25.txt) as Proposed Standard This document is the product of the Operations and Management Area Working Group. The IESG contact persons are Warren Kumari and Ignas Bagdonas. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ Technical Summary This memo specifies a component-based architecture for manufacturer usage descriptions (MUD). The goal of MUD is to provide a means for Things to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects. This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, an LLDP TLV, a URL suffix specification, an X.509 certificate extension and a means to sign and verify the descriptions. Working Group Summary There was excellent discussion and comments throughout. The authors were quick to respond, and incorporate feedback as well as push back on items thought to be out of scope. The discussions led to talks of subsequent work for future drafts. Document Quality There are implementations in the works. Eliot Lear has stood up a tool at https://mudmaker.org/ that builds MUD files as a way to help vendors. There were numerous expert reviews including multiple areas and YANG Doctors. Those reviews led to some tighter security considerations, as well as more explicit mention that MUD files are to be taken under operational advisement as it is not wise to blindly apply others' configurations to your network. The YANG Doctors review, in particular, led to a better structure to the MUD YANG module that will allow it to provide a data definition, as well as be implemented on controllers if need be. Personnel Who is the Document Shepherd? Who is the Responsible Area Director? Joe Clarke is the document shepherd. Ignas Bagdonas is the responsible AD. From nobody Wed Jun 27 06:13:35 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41ABA12D949; Wed, 27 Jun 2018 06:13:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gkvQuv1a_zv0; Wed, 27 Jun 2018 06:13:31 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E436912D7F8; Wed, 27 Jun 2018 06:13:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1327; q=dns/txt; s=iport; t=1530105211; x=1531314811; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to:content-transfer-encoding; bh=+CMNZo2WrBnHN6SFPuPKxRm5u7ijxyxjKSPfAc5IWuI=; b=fZfBJ/a2h86+1EA3/VH0H0GUBysYz/JyGk9RIqDd3Rx9/wCTl9Cn9Aoo Ih7jdB3x6q6T0+ql8jAJUCQzkMfs8LLWAT1+PUhzL+y4Po5Wg03AhjovK H/jbz3CwxLtLiyyspvfrJdlhn3TZFhjbz5WPqT3mgV8oO02e5WawlWmD4 w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BrAgALjTNb/49dJa1cGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYNJgWGEIZQ+ggeVLIFmC4RsAoMXITgUAQIBAQIBAQJtKIU?= =?us-ascii?q?3AQUjDwFGEAsYAgImAgJXBgEMCAEBgyGCAKxFghyITIEcgQuHYoFWP4E2gmi?= =?us-ascii?q?EQgUBEgEJgxeCVQKRVYdcCY8NBoFAhk2FPYd2iX2BWCFhcU0jFYMlkGwjjlS?= =?us-ascii?q?COQEB?= X-IronPort-AV: E=Sophos;i="5.51,279,1526342400"; d="scan'208";a="134929807" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Jun 2018 13:13:16 +0000 Received: from [10.118.87.86] (rtp-jclarke-nitro5.cisco.com [10.118.87.86]) by rcdn-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id w5RDDG3Y013052; Wed, 27 Jun 2018 13:13:16 GMT To: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "internet-drafts@ietf.org" Cc: Andrej Ota , Thorsten Dahm References: From: Joe Clarke Openpgp: preference=signencrypt Autocrypt: addr=jclarke@cisco.com; prefer-encrypt=mutual; keydata= xsDiBDo1cJ0RBADSZSmbmzdRr1CoRWWKmAyu0eaQimaLV1TsZEML/ksLyg6faXrKIA/MWc7M w4FmKkDjaZdFzobzabnKp2QwVadLqi1gYY2WsApKC0rSoqsPx5E847AmwNWXgjXiXORXmnZL mf5PZ2ECOEJC27sji5Nrh9GSw7OPp6c+EE20gMNVrwCgu3iK5vyGQfy0/wX/jcIvP0nHznUD /RvijiKomyaf6F5pibmouFNeuCDHc8lwx2giA/MCZl/nSkI2/UX27sULGNgvKNkVPu/AukXu zW3fIthsJgjQZUoi/BTe9kUP+RL3+RALXXuLv7b3xGRHJ8A1Rpy9H43fkjHZ945YNPrUvJlG LP5PNGBD1xC21X3EGAyywVynDskcA/4qgbJFkVzmPjFJUjq+RW1zw3UIb3bbkskl/wk5qd+M w2EhiSPTbEhJQAQUvqSGFWEGp2ANic7iYLdPXV/O6I1/guRRaY0eK77YkkCjz1snaKYnGSeI GHGwmHb6D+ZHzTqZqr6IssgEIUHjXfgOUTARQbL15nJTVRzDGUiT/65R3c0eSm9lIENsYXJr ZSA8amNsYXJrZUBjaXNjby5jb20+wl8EExECABcFAjyDqGQFCwcKAwQDFQMCAxYCAQIXgAAS CRDN7TXCWm4C3wdlR1BHAAEB5KkAn0kBda/9+uF6RfnDSFS7RExUU9DqAJ4knRckYiSASteC K03QVtEiXblL287ATQQ6NXCeEAQAhIURlK17jmIMdMIuScFU6xK+jkKgVVFrjlRH5vLV2spp jH/uQ57MMGuOcs7PckXCnPjBV8Tm32Tuw+fCyrbc2gt0ouiT/5WWj0EMeAfWew1zBXX2okGf LqS6gucVDS6tcEFN6PmJEmX+tWDcmiqx/xXiSfMVYiLMdlK+YDkMDDsAAwUD/3BWOyfdnBGH Kv28zx+5wq/2vhYnUYCAdVD2ZWCJizQTMbkcxEIKAwtAj6yqKq9ah82nt4VHl5ZejVe47jvR 2nXwJ5VQ9eITuTjTLDw+3qr9lN077VZ32hyb5ULJcW756j9Z3YB2FTANw6KHgChaSVVx9kYJ FlAggraU7mi39/wvwk4EGBECAAYFAjo1cJ4AEgkQze01wlpuAt8HZUdQRwABAQbdAJ9R8SzU Mluu9r93BMv6fAW9j6qTZgCfYcEAqOMJv+3Z+YxLiDtWcCY4Sfo= Organization: Cisco Message-ID: <793bdc91-4d63-84f0-66da-4a918afff368@cisco.com> Date: Wed, 27 Jun 2018 09:13:15 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSAWG] Action Items on TACACS+ informational draft v 10 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jun 2018 13:13:34 -0000 On 6/10/18 04:43, Douglas Gash (dcmgash) wrote: > Dear Opsawg, > > A status update on informational T+ Draft: > > 1) Current discussion between Andrej and (mainly) Joe Clarke on some section 9 (Security), ongoing, Andrej/Authors will respond to Joe’s latest comments shortly. > 2) Diffs between Version 6 and Version 10 with brief annotations of each diff sent to Newsgroup > 3) Authors Recently reviewed section 9 (Security), and reflect that it includes some redundant and overlapping content in the sections: > “9.5. TACACS+ Client Implementation Recommendations . . . . . . 39 > 9.6. TACACS+ Server Implementation Recommendations . . . . . . 39 > 9.7. TACACS+ Deployment Best Practices . . . . . . . . . . . . 40” > …consequently, we are planning to propose rationalised single section to cover Best Practices. We will present a proposal this week for initiating discussion, the result of which we will look to include in next version. Hello, T+ authors. What is the status of this work? It's now been two weeks since you sent this (and a month between this and the previous email). For this work to progress, we need much more frequent engagement. To that end, can one of you present the status of the work and your plan to move towards ratification in Montreal? Thanks. Joe From nobody Wed Jun 27 22:49:46 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E103130E83; Wed, 27 Jun 2018 22:49:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FcZ6C2e_qqBC; Wed, 27 Jun 2018 22:49:42 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B28E31277BB; Wed, 27 Jun 2018 22:49:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2320; q=dns/txt; s=iport; t=1530164982; x=1531374582; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=0ElntQkMC3lL48QvdFN+8xostRGeRw1LsXtQVrnoFSc=; b=QjeOGNuqfEjrQI4izl8Vv7fvDb0Tb6NzFcnv9kOOdoEXe9jWBO3n6/VF e4bIfBc9zSCfl7OOvBwf9jn5Y+96QB7YmBZERCatF0tXEGnZcP1J3BaqV 2SzhV/UGPr5mhVHzV1MQi3ZTr5wmxBgoMZmO10NEMA0Hq5kXULqa8YEIs o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DBAAB6djRb/5tdJa1dGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYNJgWEoCoNviASMPIFlIpUaFIFmC4RsAheDAiE0GAECAQE?= =?us-ascii?q?CAQECbSiFNwEFIxFFEAIBCBgCAiYCAgIwFRACBAENBYMgggCsd4IciE6BHIE?= =?us-ascii?q?Lh2KCFYE2DIJcgxgEgSYFARIBCRYXgmoxgiQCkVeHXQkCjxGBQIwKh3aJVgI?= =?us-ascii?q?REwGBJB04YXFwFTsqAYI+kFFvAY4egR+BGgEB?= X-IronPort-AV: E=Sophos;i="5.51,282,1526342400"; d="scan'208";a="135990348" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Jun 2018 05:49:41 +0000 Received: from XCH-ALN-015.cisco.com (xch-aln-015.cisco.com [173.36.7.25]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id w5S5nfMa027821 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 28 Jun 2018 05:49:41 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-015.cisco.com (173.36.7.25) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Thu, 28 Jun 2018 00:49:41 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1320.000; Thu, 28 Jun 2018 00:49:41 -0500 From: "Douglas Gash (dcmgash)" To: Joe Clarke , "opsawg@ietf.org" , "internet-drafts@ietf.org" CC: Andrej Ota , Thorsten Dahm Thread-Topic: [OPSAWG] Action Items on TACACS+ informational draft v 10 Thread-Index: AQHUAJcMy4/Za3sG006Dt8v8C0v0pqR0g9qAgAEWZIA= Date: Thu, 28 Jun 2018 05:49:41 +0000 Message-ID: <4C5603DE-9985-40CE-B400-2894CC240CA4@cisco.com> References: <793bdc91-4d63-84f0-66da-4a918afff368@cisco.com> In-Reply-To: <793bdc91-4d63-84f0-66da-4a918afff368@cisco.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.229.132.14] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] Action Items on TACACS+ informational draft v 10 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 05:49:45 -0000 SGkgSm9lLA0KDQpXZSB3aWxsIHVwZGF0ZSBvbiAxKSBieSBlbmQgb2YgdGhlIHdlZWsuDQoyKSBX YXMgc2VudCBwcmV2aW91c2x5LCBhbnkgZmVlZGJhY2sgb24gaXQgd2VsY29tZS4NCjMpIEkgd2ls bCBzZW5kIG91dCBpbml0aWFsIHByb3Bvc2FsIHRvZGF5IHRvIHRoZSBsaXN0LiANCg0KVGhhbmtz LA0KDQpEb3VnLg0KDQpPbiAyNy8wNi8yMDE4LCAxNjoxMywgIkpvZSBDbGFya2UiIDxqY2xhcmtl PTQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnPiB3cm90ZToNCg0KICAgIE9uIDYvMTAvMTggMDQ6 NDMsIERvdWdsYXMgR2FzaCAoZGNtZ2FzaCkgd3JvdGU6DQogICAgPiBEZWFyIE9wc2F3ZywNCiAg ICA+IA0KICAgID4gQSBzdGF0dXMgdXBkYXRlIG9uIGluZm9ybWF0aW9uYWwgVCsgRHJhZnQ6DQog ICAgPiANCiAgICA+IDEpIEN1cnJlbnQgZGlzY3Vzc2lvbiBiZXR3ZWVuIEFuZHJlaiBhbmQgKG1h aW5seSkgSm9lIENsYXJrZSBvbiBzb21lIHNlY3Rpb24gOSAoU2VjdXJpdHkpLCBvbmdvaW5nLCBB bmRyZWovQXV0aG9ycyB3aWxsIHJlc3BvbmQgdG8gSm9l4oCZcyBsYXRlc3QgY29tbWVudHMgc2hv cnRseS4NCiAgICA+IDIpIERpZmZzIGJldHdlZW4gVmVyc2lvbiA2IGFuZCBWZXJzaW9uIDEwIHdp dGggYnJpZWYgYW5ub3RhdGlvbnMgb2YgZWFjaCBkaWZmIHNlbnQgdG8gTmV3c2dyb3VwDQogICAg PiAzKSBBdXRob3JzIFJlY2VudGx5IHJldmlld2VkIHNlY3Rpb24gOSAoU2VjdXJpdHkpLCBhbmQg cmVmbGVjdCB0aGF0IGl0IGluY2x1ZGVzIHNvbWUgcmVkdW5kYW50IGFuZCBvdmVybGFwcGluZyBj b250ZW50IGluIHRoZSBzZWN0aW9uczogDQogICAgPiDigJw5LjUuICBUQUNBQ1MrIENsaWVudCBJ bXBsZW1lbnRhdGlvbiBSZWNvbW1lbmRhdGlvbnMgLiAuIC4gLiAuIC4gIDM5DQogICAgPiA5LjYu ICBUQUNBQ1MrIFNlcnZlciBJbXBsZW1lbnRhdGlvbiBSZWNvbW1lbmRhdGlvbnMgLiAuIC4gLiAu IC4gIDM5DQogICAgPiA5LjcuICBUQUNBQ1MrIERlcGxveW1lbnQgQmVzdCBQcmFjdGljZXMgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDQw4oCdDQogICAgPiDigKZjb25zZXF1ZW50bHksIHdlIGFy ZSBwbGFubmluZyB0byBwcm9wb3NlIHJhdGlvbmFsaXNlZCBzaW5nbGUgc2VjdGlvbiB0byBjb3Zl ciBCZXN0IFByYWN0aWNlcy4gV2Ugd2lsbCBwcmVzZW50IGEgcHJvcG9zYWwgdGhpcyB3ZWVrIGZv ciBpbml0aWF0aW5nIGRpc2N1c3Npb24sIHRoZSByZXN1bHQgb2Ygd2hpY2ggd2Ugd2lsbCBsb29r IHRvIGluY2x1ZGUgaW4gbmV4dCB2ZXJzaW9uLg0KICAgIA0KICAgIEhlbGxvLCBUKyBhdXRob3Jz LiAgV2hhdCBpcyB0aGUgc3RhdHVzIG9mIHRoaXMgd29yaz8gIEl0J3Mgbm93IGJlZW4gdHdvDQog ICAgd2Vla3Mgc2luY2UgeW91IHNlbnQgdGhpcyAoYW5kIGEgbW9udGggYmV0d2VlbiB0aGlzIGFu ZCB0aGUgcHJldmlvdXMgZW1haWwpLg0KICAgIA0KICAgIEZvciB0aGlzIHdvcmsgdG8gcHJvZ3Jl c3MsIHdlIG5lZWQgbXVjaCBtb3JlIGZyZXF1ZW50IGVuZ2FnZW1lbnQuICBUbw0KICAgIHRoYXQg ZW5kLCBjYW4gb25lIG9mIHlvdSBwcmVzZW50IHRoZSBzdGF0dXMgb2YgdGhlIHdvcmsgYW5kIHlv dXIgcGxhbiB0bw0KICAgIG1vdmUgdG93YXJkcyByYXRpZmljYXRpb24gaW4gTW9udHJlYWw/DQog ICAgDQogICAgVGhhbmtzLg0KICAgIA0KICAgIEpvZQ0KICAgIA0KDQo= From nobody Wed Jun 27 23:03:34 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98C1C130E06; Wed, 27 Jun 2018 23:03:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DuJOWn1zhc_l; Wed, 27 Jun 2018 23:03:30 -0700 (PDT) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBF53130DE5; Wed, 27 Jun 2018 23:03:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6648; q=dns/txt; s=iport; t=1530165809; x=1531375409; h=from:to:cc:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=9gJt17aPXIt4ijReB8LdPj81mo9vguCMNdZyPWlM6nM=; b=L5cKe2LYXEpd5O4Zu20Ps5/QHJqQRHddxiBfJuUcU3Tw48d1Z6O6CaHf Y8jU4A0bf1xXZ8I3JkIu/7Q0D+kRCntwXV4LF/VGOESokdJcP28HiMOMO r7MTjcKcOio9w7TkYqKRSAD6/VkatmF6p17FMk/2ic8UMPjnLeSssKuvC k=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D1AQDEeTRb/4wNJK1TCRkBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQGDSYFhMoNvlECBZZVQgWYLhGwZgwIhOBQBAgEBAgEBAm0?= =?us-ascii?q?ohWAREzISASICFBICBDAVEgQBDYMlggCsd4IcgyWBNoNzgRyBC4dighWBDyc?= =?us-ascii?q?MhxoEDhRlgjIxgiQChzyKG4ddCQKIYoYvgUCEB4gCAY5+gk4CERMBgSQ0IYF?= =?us-ascii?q?ScBU7KgGCP4IdjjIBjyOBCoEaAQE?= X-IronPort-AV: E=Sophos;i="5.51,282,1526342400"; d="scan'208";a="414380075" Received: from alln-core-7.cisco.com ([173.36.13.140]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Jun 2018 06:03:28 +0000 Received: from XCH-ALN-013.cisco.com (xch-aln-013.cisco.com [173.36.7.23]) by alln-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id w5S63SR1004545 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 28 Jun 2018 06:03:28 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-013.cisco.com (173.36.7.23) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Thu, 28 Jun 2018 01:03:28 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1320.000; Thu, 28 Jun 2018 01:03:28 -0500 From: "Douglas Gash (dcmgash)" To: "opsawg@ietf.org" , "internet-drafts@ietf.org" CC: Andrej Ota , Thorsten Dahm Thread-Topic: TACACS+ information Draft Security Recommendations refactor Thread-Index: AQHUDqW7GIH2T9okJEqD8C9mPTL7NQ== Date: Thu, 28 Jun 2018 06:03:27 +0000 Message-ID: <5B303271-AB9A-4695-AEA8-BB74FF798A45@cisco.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.229.132.14] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [OPSAWG] TACACS+ information Draft Security Recommendations refactor X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 06:03:33 -0000 RGVhciBPcHNhd2csDQoNClRoZSBUQUNBQ1MrIERyYWZ0IFZlcnNpb24gOSBjb250YWlucyBhIHNl Y3VyaXR5IHNlY3Rpb24sIHRoZSBsYXN0IHRocmVlIHN1YnNlY3Rpb25zIG9mIHdoaWNoIGFyZSBy ZWNvbW1lbmRhdGlvbnMuIFRoZXJlIGlzIHNvbWUgb3ZlcmxhcCBhbmQgcmVwZXRpdGlvbiBiZXR3 ZWVuIHNlY3Rpb25zIHdoZXJlIHRoZSBzYW1lIGlzc3VlcyBhcmUgY292ZXJlZCBmcm9tIGRpZmZl cmVudCBhbmdsZXMsIHdoaWNoIHdlIGJlbGlldmUgbWF5IGxlYWQgdG8gYW1iaWd1aXR5Lg0KDQpT byBpbnN0ZWFkIHdlIHByb3Bvc2UgdG8gcmVmYWN0b3IgdGhlIHJlY29tbWVuZGF0aW9ucyBzZWN0 aW9uIHRvIGJyaW5nIHJlY29tbWVuZGF0aW9uIHBvaW50cyBvZiBlYWNoIGFzcGVjdCBpbnRvIHRo ZWlyIG93biBzdWJzZWN0aW9ucywgYXMgYmVsb3cuIA0KDQpQbGVhc2Ugbm90ZSB0aGF0IHRoaXMg c2VjdGlvbiBpcyB3aXRoaW4gdGhlIGNvbnRleHQgb2YgdGhlIHNlY3VyaXR5IHNlY3Rpb24sIHdo ZXJlIHRoZSBzZWN1cml0eSB2dWxuZXJhYmlsaXRpZXMgYXJlIGRpc2N1c3NlZCBpbiBzZWN0aW9u cyA5LjEtOS40Lg0KDQpUaGlzIG5ldyBtb2RlbCBzaG91bGQgcmVwbGFjZSBzZWN0aW9ucyA5LjUt OS43Lg0KDQpNYW55IHRoYW5rcy4NCg0KUHJvcG9zZWQgcmVjb21tZW5kYXRpb25zIHNlY3Rpb24g Zm9sbG93czoNCg0KDQoNCjkuNSBEZXBsb3ltZW50IEJlc3QgUHJhY3RpY2VzDQoNCkluIHZpZXcg b2YgdGhlIG9ic2VydmF0aW9ucyBhYm91dCB0aGUgc2VjdXJpdHkgaXNzdWVzIGRlc2NyaWJlZCBh Ym92ZSwgaXQgaXMgY3JpdGljYWwgdGhhdCBUQUNBQ1MrIE1VU1QgQkUgZGVwbG95ZWQgb3ZlciBz ZWN1cmUgbmV0d29ya3Mgd2hpY2ggZW5zdXJlIGFuIGFwcHJvcHJpYXRlIGxldmVsIG9mIHByaXZh Y3kgYW5kIGludGVncml0eSBvZiB0aGUgY29tbXVuaWNhdGlvbi4gVHdvIG1ldGhvZHMgYXJlIHVz ZWQgaW4gY29tbW9uIHByYWN0aWNlLiBUaGUgcHJlZmVycmVkIG1ldGhvZCwgd2hlcmUgc3VjaCBh IGZhY2lsaXR5IGlzIGF2YWlsYWJsZSBpbiB0aGUgb3JnYW5pemF0aW9uLCBpcyB0byB1c2UgYSBk ZWRpY2F0ZWQgc2VjdXJlIG1hbmFnZW1lbnQgbmV0d29yay4gV2hlcmUgdGhpcyBpcyBub3QgYXZh aWxhYmxlLCBpdCBpcyByZWNvbW1lbmRlZCB0byB1c2UgSVBTZWMuDQoNCkluIHN1bW1hcnk6IEl0 IGlzIHN0cm9uZ2x5IGFkdmlzZWQgdGhhdCBUQUNBQ1MrIE1VU1QgYmUgdXNlZCB3aXRoaW4gYSBz ZWN1cmUgZGVwbG95bWVudC4gIEZhaWx1cmUgdG8gZG8gc28gbWF5IGltcGFjdCBvdmVyYWxsIG5l dHdvcmsgc2VjdXJpdHkuDQoNCjkuNS4xIENsaWVudC1TZXJ2ZXIgQ29ubmVjdGlvbnMNCg0KSW4g b3JkZXIgdG8gaGVscCBhZG1pbmlzdHJhdG9ycyB0byBwcm90ZWN0IGFnYWluc3QgYnJ1dGUtZm9y Y2UgYXR0YWNrcyBmcm9tIHVua25vd24gY2xpZW50cywgVEFDQUNTKyBTZXJ2ZXJzIE1VU1QgYWxs b3cgdGhlIGRlZmluaXRpb24gb2YgaW5kaXZpZHVhbCBjbGllbnRzIGFuZCBNVVNUIGFsbG93IGEg ZGVkaWNhdGVkIHNlY3JldCBrZXkgdG8gYmUgZGVmaW5lZCBmb3IgZWFjaCBjbGllbnQuIFdpdGgg dGhlc2UgbWFuZGF0b3J5IHJlcXVpcmVtZW50cyBpbiBwbGFjZSwgdGhlIGZvbGxvd2luZyByZWNv bW1lbmRhdGlvbnMgc2hvdWxkIGJlIGZvbGxvd2VkOg0KDQpDb25maWd1cmUgU2VydmVycyB0byBh Y2NlcHQgb25seSB0aG9zZSBuZXR3b3JrIGNvbm5lY3Rpb24gYXR0ZW1wdHMgdGhhdCBhcnJpdmUg ZnJvbSBrbm93biBjbGllbnRzLiAgVGhpcyBsaW1pdHMgdGhlIGV4cG9zdXJlIGFuZCBwcmV2ZW50 cyByZW1vdGUgYnJ1dGUgZm9yY2UgYXR0YWNrcyBmcm9tIHVua25vd24gY2xpZW50cy4NCg0KQ29u ZmlndXJlIGEgc2VjcmV0IGtleSBvbiB0aGUgc2VydmVyIGZvciBlYWNoIGNsaWVudC4gSXQgaXMg cmVjb21tZW5kZWQgdGhhdCBTZXJ2ZXJzIFNIT1VMRCB3YXJuIGFkbWluaXN0cmF0b3JzIGlmIHNl Y3JldCBrZXlzIGFyZSBub3QgdW5pcXVlIHBlciBjbGllbnQuDQoNCkNvbmZpZ3VyZSBTZXJ2ZXIg dG8gcmVqZWN0IGNvbm5lY3Rpb25zIHdoaWNoIGhhdmUgdGhlIFRBQ19QTFVTX1VORU5DUllQVEVE X0ZMQUcuIFNlcnZlcnMgU0hPVUxEIGFsbG93IGFkbWluaXN0cmF0b3JzIHRvIHJlamVjdCB0aG9z ZSBwYWNrZXRzIHdpdGggYXBwbGljYWJsZSBFUlJPUiByZXNwb25zZSBmb3IgdHlwZSBvZiBwYWNr ZXQuIENvbnNlcXVlbnRseSwgY2xpZW50cyBzaG91bGQgYXZvaWQgdXNpbmcgVEFDX1BMVVNfVU5F TkNSWVBURURfRkxBRywgZXZlbiBvbiBuZXR3b3JrcyB3aXRoIHNlY3VyZWQgdHJhbnNwb3J0LiBJ biBzdW1tYXJ5OiBkbyBub3QgdXNlIHRoZSBUQUNfUExVU19VTkVOQ1JZUFRFRF9GTEFHIG9wdGlv bi4NCg0KDQo5LjUuMiBTZWNyZXQgS2V5IE1hbmFnZW1lbnQNCg0KSW4gb3JkZXIgdG8gbWF4aW1p emUgdGhlIGVmZmVjdGl2ZW5lc3Mgb2YgdGhlIG9iZnVzY2F0aW9uIG1lY2hhbmlzbSwgaXQgcmVj b21tZW5kZWQgdG8gdXNlIHNlY3JldCBrZXlzIG9mIG1pbmltdW0gMTYgY2hhcmFjdGVycyBsZW5n dGguDQoNClNlY3JldHMgTVVTVCBiZSByZWdhcmRlZCBhcyBzZW5zaXRpdmUgZGF0YSwgYW5kIG1h bmFnZWQgc2VjdXJlbHkgb24gc2VydmVyIGFuZCBjbGllbnQuDQoNClNlY3JldCBrZXlzIHNob3Vs ZCBiZSBjaGFuZ2VkIGF0IHJlZ3VsYXIgaW50ZXJ2YWxzLg0KDQpJZiBhbiBpbnZhbGlkIHNoYXJl ZCBzZWNyZXQgaXMgZGV0ZWN0ZWQsIFNlcnZlcnMgTVVTVCBOT1QgYWNjZXB0IGFueSBuZXcgc2Vz c2lvbnMgb24gYSBjb25uZWN0aW9uLCBhbmQgdGVybWluYXRlIHRoZSBjb25uZWN0aW9uIG9uIGNv bXBsZXRpb24gb2YgYW55IHNlc3Npb25zIHByZXZpb3VzbHkgZXN0YWJsaXNoZWQgd2l0aCBhIHZh bGlkIHNoYXJlZCBzZWNyZXQuDQoNCg0KOS41LjMgQXV0aGVudGljYXRpb24gb3B0aW9ucw0KDQpU aGUgc3Ryb25nZXN0IGF1dGhlbnRpY2F0aW9uIG9wdGlvbnMgaW4gdGhlIFRBQ0FDUysgcHJvdG9j b2wgYXJlIHRoZSBjaGFsbGVuZ2UtcmVzcG9uc2Ugb3B0aW9ucyAoVEFDX1BMVVNfQVVUSEVOX1RZ UEVfQ0hBUCBvciBUQUNfUExVU19BVVRIRU5fVFlQRV9NU0NIQVAgb3IgVEFDX1BMVVNfQVVUSEVO X1RZUEVfTVNDSEFQVjIgZm9yIGF1dGhlbl90eXBlKS4gQ29uc2VxdWVudGx5LCBUaGUgU2VydmVy IGltcGxlbWVudGF0aW9uIE1VU1QgYWxsb3cgdGhlIGFkbWluaXN0cmF0b3IgdG8gbWFuZGF0ZSB0 aGF0IG9ubHkgdGhlc2UgY2hhbGxlbmdlL3Jlc3BvbnNlIG9wdGlvbnMgd2lsbCBiZSBhY2NlcHRl ZCBmb3IgYXV0aGVudGljYXRpb24uIA0KDQpJdCBpcyByZWNvbW1lbmRlZCB0aGF0IGFkbWluaXN0 cmF0b3JzIHVzZSB0aGlzIG9wdGlvbi4gQWRtaW5pc3RyYXRvcnMgc2hvdWxkIGFsbG93IG90aGVy IG9wdGlvbnMgb25seSB3aGVuIHVuYXZvaWRhYmxlIGR1ZSB0byByZXF1aXJlbWVudHMgb2YgaWRl bnRpdHkvcGFzc3dvcmQgc3lzdGVtcy4NCg0KRHVlIHRvIHRoZWlyIHNlY3VyaXR5IGltcGxpY2F0 aW9ucywgdGhlIFRBQ19QTFVTX0FVVEhFTl9TRU5EQVVUSCBhbmQgVEFDX1BMVVNfQVVUSEVOX1NF TkRQQVNTIG9wdGlvbnMgbWVudGlvbmVkIGluIHRoZSBvcmlnaW5hbCBkcmFmdCBzaG91bGQgbm90 IGJlIHVzZWQuIA0KDQo5LjUuNCBBdXRob3JpemF0aW9uIE9wdGlvbnMNCg0KVGhlIGF1dGhvcml6 YXRpb24gYW5kIGFjY291bnRpbmcgZmVhdHVyZXMgYXJlIGludGVuZGVkIHRvIHByb3ZpZGUgZXh0 ZW5zaWJsZSBmbGV4aWJpbGl0eS4gVGhlcmUgaXMgYSBiYXNlIGRpY3Rpb25hcnkgZGVmaW5lZCBp biB0aGlzIGRvY3VtZW50LCBidXQgaXMgbWF5IGJlIGV4dGVuZGVkIGluIGRlcGxveW1lbnRzIGJ5 IHVzaW5nIG5ldyBhdHRyaWJ1dGUgbmFtZXMuIFRoZSBjb3N0IG9mIHRoZSBmbGV4aWJpbGl0eSBp cyB0aGF0IGFkbWluaXN0cmF0b3JzIE1VU1QgZW5zdXJlIHRoYXQgdGhlIGF0dHJpYnV0ZSBhbmQg dmFsdWUgcGFpcnMgc2hhcmVkIGJldHdlZW4gdGhlIGNsaWVudHMgYW5kIHNlcnZlcnMgaGF2ZSBj b25zaXN0ZW50IGludGVycHJldGF0aW9uLiANCg0KSWYgYSBjbGllbnQgcmVjZWl2ZXMgcmVjZWl2 aW5nIGEgbWFuZGF0b3J5IGF1dGhvcml6YXRpb24gYXR0cmlidXRlIHRoYXQgaXRzIGltcGxlbWVu dGF0aW9uIGRvZXMgbm90IGRlZmluZSwgdGhlbiBpdCBzaG91bGQsIGJlaGF2ZSBhcyBpZiBpdCBo YWQgcmVjZWl2ZWQgVEFDX1BMVVNfQVVUSE9SX1NUQVRVU19GQUlMLg0KDQpSZXF1aXJlIFRBQ0FD UysgYXV0aGVudGljYXRpb24gZm9yIGF1dGhvcml6YXRpb24gcmVxdWVzdHMgKGkuZS4gVEFDX1BM VVNfQVVUSEVOX01FVEhfVEFDQUNTUExVUyBpcyB1c2VkKS4NCg0KOS41LjUgVGhlIFJlZGlyZWN0 aW9uIE1lY2hhbmlzbQ0KDQpUaGUgcmVkaXJlY3Rpb24gbWVjaGFuaXNtIChUQUNfUExVU19BVVRI RU5fU1RBVFVTX0ZPTExPVykgdGhhdCB3YXMgZGVmaW5lZCBpbiB0aGUgb3JpZ2luYWwgZHJhZnQg aXMgZGlmZmljdWx0IHRvIHNlY3VyZS4gSXQgaXMgcmVjb21tZW5kZWQgdG8gZGlzYWJsZSB0aGUg ZmVhdHVyZSwgYW5kIHNvIHRvIGF2b2lkIGl0cyB1c2UgYWx0b2dldGhlci4gSXQgaXMgcmVjb21t ZW5kZWQgdGhhdCBjbGllbnRzIHRyZWF0IFRBQ19QTFVTX0FVVEhFTl9TVEFUVVNfRk9MTE9XIGFz IFRBQ19QTFVTX0FVVEhFTl9TVEFUVVNfRkFJTC4gDQoNCklmIHRoZSBvcHRpb24gbXVzdCBiZSB1 c2VkIGZvciBsZWdhY3kgYXBwbGljYXRpb24gcmVhc29ucywgdGhlbiBpdCBpcyByZWNvbW1lbmRl ZCB0byBhdm9pZCB0aGUgb3B0aW9uIHRvIHNlbmQgc2VjcmV0IGtleXMgaW4gdGhlIHNlcnZlciBs aXN0Lg0KIA0KDQo= From nobody Thu Jun 28 01:14:38 2018 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 49B1C130EC5; Thu, 28 Jun 2018 01:14:30 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153017367027.14934.10540096604365459367@ietfa.amsl.com> Date: Thu, 28 Jun 2018 01:14:30 -0700 Archived-At: Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-nat-yang-15.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 08:14:31 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operations and Management Area Working Group WG of the IETF. Title : A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT) Authors : Mohamed Boucadair Senthil Sivakumar Christian Jacquenet Suresh Vinapamula Qin Wu Filename : draft-ietf-opsawg-nat-yang-15.txt Pages : 97 Date : 2018-06-28 Abstract: This document defines a YANG module for the Network Address Translation (NAT) function. Network Address Translation from IPv4 to IPv4 (NAT44), Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (NAT64), Customer-side transLATor (CLAT), Stateless IP/ICMP Translation (SIIT), Explicit Address Mappings for Stateless IP/ICMP Translation (SIIT EAM), IPv6 Network Prefix Translation (NPTv6), and Destination NAT are covered in this document. Editorial Note (To be removed by RFC Editor) Please update these statements within the document with the RFC number to be assigned to this document: "This version of this YANG module is part of RFC XXXX;" "RFC XXXX: A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)" "reference: RFC XXXX" Please update the "revision" date of the YANG module. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-nat-yang/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsawg-nat-yang-15 https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-nat-yang-15 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-nat-yang-15 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jun 28 04:22:09 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C638130E52; Thu, 28 Jun 2018 04:22:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BOJlRLLw9mbQ; Thu, 28 Jun 2018 04:22:06 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id CA32312F1A5; Thu, 28 Jun 2018 04:22:05 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id D8EE52F5; Thu, 28 Jun 2018 11:22:03 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: <5B303271-AB9A-4695-AEA8-BB74FF798A45@cisco.com> Date: Thu, 28 Jun 2018 07:22:02 -0400 Cc: "opsawg@ietf.org" , "internet-drafts@ietf.org" , Andrej Ota , Thorsten Dahm Content-Transfer-Encoding: quoted-printable Message-Id: <73D401AD-C9DF-47A3-BBAF-73B26E6C26AA@deployingradius.com> References: <5B303271-AB9A-4695-AEA8-BB74FF798A45@cisco.com> To: "Douglas Gash (dcmgash)" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 11:22:09 -0000 On Jun 28, 2018, at 2:03 AM, Douglas Gash (dcmgash) = wrote: >=20 > Dear Opsawg, >=20 > The TACACS+ Draft Version 9 contains a security section, the last = three subsections of which are recommendations. There is some overlap = and repetition between sections where the same issues are covered from = different angles, which we believe may lead to ambiguity. >=20 > So instead we propose to refactor the recommendations section to bring = recommendation points of each aspect into their own subsections, as = below.=20 There are common requirements for client-server connections. However, = there are different security requirements for clients and servers. Even = the new text you propose below makes this clear. I think that merging such text into one section makes the requirements = less clear. > Please note that this section is within the context of the security = section, where the security vulnerabilities are discussed in sections = 9.1-9.4. The new text has many long sentences, and a generally "conversational" = feel. i.e. it's not simple, short, and technical. > This new model should replace sections 9.5-9.7. >=20 > Many thanks. >=20 > Proposed recommendations section follows: >=20 >=20 >=20 > 9.5 Deployment Best Practices >=20 > In view of the observations about the security issues described above, = it is critical that TACACS+ MUST BE deployed over secure networks which = ensure an appropriate level of privacy and integrity of the = communication. I'm not sure "appropriate" is the nest word here. It's vague, = non-technical, and entirely unhelpful to the reader. In contrast, the = earlier text was clearer: TACACS+ MUST BE employed over networks which ensure privacy and integrity of the communication.=20 I find that the draft has gone *backwards* here, by removing technical = and descriptive text. > Two methods are used in common practice. The preferred method, where = such a facility is available in the organization, is to use a dedicated = secure management network. Where this is not available, it is = recommended to use IPSec. >=20 > In summary: It is strongly advised that TACACS+ MUST be used within a = secure deployment. Failure to do so may impact overall network = security. "strongly advised that you MUST do something" ? This statement is contradictory and unclear. > 9.5.1 Client-Server Connections >=20 > In order to help administrators to protect against brute-force attacks = from unknown clients, TACACS+ Servers MUST allow the definition of = individual clients and MUST allow a dedicated secret key to be defined = for each client. How does defining individual clients or secrets protect against = "brute-force" attacks? Is this not just listing known clients, and = rejecting connections from unknown clients? The earlier text was clearer: Servers MUST be configured with a list of known clients. Servers MUST be configured to reject requests from clients not on the list. A unique secret key SHOULD be configured for every individual client. > With these mandatory requirements in place, the following = recommendations should be followed: >=20 > Configure Servers to accept only those network connection attempts = that arrive from known clients. This limits the exposure and prevents = remote brute force attacks from unknown clients. Is this "configure" a requirement on implementors or administrators? = And why not use mandatory language here, as was used in draft-06? The = current text is not very prescriptive. > Configure a secret key on the server for each client. It is = recommended that Servers SHOULD warn administrators if secret keys are = not unique per client. "it is recommended" is redundant with "SHOULD" > Configure Server to reject connections which have the = TAC_PLUS_UNENCRYPTED_FLAG. Servers SHOULD allow administrators to reject = those packets with applicable ERROR response for type of packet. = Consequently, clients should avoid using TAC_PLUS_UNENCRYPTED_FLAG, even = on networks with secured transport. In summary: do not use the = TAC_PLUS_UNENCRYPTED_FLAG option. Is this "configure" a requirement on administrators? Do = administrators have to read the RFCs in order to configure the systems = correctly? Or should implementors make the software do this by default? And the redundancy continues: " clients should avoid using " .. "In = summary: do not use " The text is vague, rambling, and redundant. >=20 > The strongest authentication options in the TACACS+ protocol are the = challenge-response options (TAC_PLUS_AUTHEN_TYPE_CHAP or = TAC_PLUS_AUTHEN_TYPE_MSCHAP or TAC_PLUS_AUTHEN_TYPE_MSCHAPV2 for = authen_type). Consequently, The Server implementation MUST allow the = administrator to mandate that only these challenge/response options will = be accepted for authentication.=20 >=20 > It is recommended that administrators use this option. Administrators = should allow other options only when unavoidable due to requirements of = identity/password systems. Is there prescriptive text here instead of "it is recommended"? Maybe = SHOULD ? > Due to their security implications, the TAC_PLUS_AUTHEN_SENDAUTH and = TAC_PLUS_AUTHEN_SENDPASS options mentioned in the original draft should = not be used.=20 Maybe "MUST NOT be used" ? > 9.5.4 Authorization Options >=20 > The authorization and accounting features are intended to provide = extensible flexibility. There is a base dictionary defined in this = document, but is may be extended in deployments by using new attribute = names. The cost of the flexibility is that administrators MUST ensure = that the attribute and value pairs shared between the clients and = servers have consistent interpretation.=20 >=20 > If a client receives receiving a mandatory authorization attribute = that its implementation does not define, then it should, behave as if it = had received TAC_PLUS_AUTHOR_STATUS_FAIL. >=20 > Require TACACS+ authentication for authorization requests (i.e. = TAC_PLUS_AUTHEN_METH_TACACSPLUS is used). That last sentence seems unfinished. > 9.5.5 The Redirection Mechanism >=20 > The redirection mechanism (TAC_PLUS_AUTHEN_STATUS_FOLLOW) that was = defined in the original draft is difficult to secure. It is recommended = to disable the feature, and so to avoid its use altogether. It is = recommended that clients treat TAC_PLUS_AUTHEN_STATUS_FOLLOW as = TAC_PLUS_AUTHEN_STATUS_FAIL.=20 Is there prescriptive text here instead of "it is recommended"? = Earlier text had such prescriptive text. > If the option must be used for legacy application reasons, then it is = recommended to avoid the option to send secret keys in the server list. Again, "it is recommended" The new text is a step backwards from earlier drafts. I've taken a = look at the rest of Section 9, and it's similar. As an implementor, this text gives me only vague guidance as to what = to do. With less clarity and fewer prescriptions than earlier text. I've said before that the text is philosophical and conversational = instead of technical. This style is continuing with new text. Alan DeKok. From nobody Thu Jun 28 07:23:56 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C9CE130DC9; Thu, 28 Jun 2018 07:23:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kjOL-4AWJdeO; Thu, 28 Jun 2018 07:23:52 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C65CB130DC3; Thu, 28 Jun 2018 07:23:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=13474; q=dns/txt; s=iport; t=1530195831; x=1531405431; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=E7hqljUwEVduc7uhZiFL+ndCYQcbdwIxpvJbB1dlS7c=; b=jh5dyxqLQmimfA4lfXtItqjPP918bPaRztcgsDzHVLpoyW5Eg89HG28d Hx4grxztrJGD/An/ejlXhiPTpSsonR2uGZRzWlmDBN4RcvZga8DCdM24n NY40S+pwW+XkcN7cnLOfLaNel0oRB20nlqNAvFP0FEhPc1u6R/DIKFqu0 A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DWAQCe7jRb/5BdJa1TCRkBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQGDSYFhKAqDb5RBggeVMoFmC4F3gnUCF4MCITcVAQIBAQI?= =?us-ascii?q?BAQJtKIU2AQEBAwEjERMyEAIBCBgCAhQSAgICMBUQAgQOBYMggXgIrGeCHIM?= =?us-ascii?q?lhS2BHIELh2KCFYEPJ4JogxgEgSIEDhICLTiCMjGCJAKHPoofh2EJAohkhjC?= =?us-ascii?q?BQIQHgmqFHIZeiCaCTgIREwGBJDMigVJwFTsqAYI+gh4FF44XbwGOM4EKgRo?= =?us-ascii?q?BAQ?= X-IronPort-AV: E=Sophos;i="5.51,283,1526342400"; d="scan'208";a="198555214" Received: from rcdn-core-8.cisco.com ([173.37.93.144]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Jun 2018 14:23:50 +0000 Received: from XCH-ALN-011.cisco.com (xch-aln-011.cisco.com [173.36.7.21]) by rcdn-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id w5SENoAf031038 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 28 Jun 2018 14:23:50 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-011.cisco.com (173.36.7.21) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Thu, 28 Jun 2018 09:23:49 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1320.000; Thu, 28 Jun 2018 09:23:49 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok CC: "opsawg@ietf.org" , "internet-drafts@ietf.org" , Andrej Ota , Thorsten Dahm Thread-Topic: [OPSAWG] TACACS+ information Draft Security Recommendations refactor Thread-Index: AQHUDqW7GIH2T9okJEqD8C9mPTL7NaR12v8AgAAyxgA= Date: Thu, 28 Jun 2018 14:23:49 +0000 Message-ID: References: <5B303271-AB9A-4695-AEA8-BB74FF798A45@cisco.com> <73D401AD-C9DF-47A3-BBAF-73B26E6C26AA@deployingradius.com> In-Reply-To: <73D401AD-C9DF-47A3-BBAF-73B26E6C26AA@deployingradius.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.229.132.14] Content-Type: text/plain; charset="utf-8" Content-ID: <070EFE47C735A84ABDCF62F3611BE022@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 14:23:54 -0000 SGkgQWxhbiwNCg0KVGhhbmsgeW91IGZvciB0aGUgcmVzcG9uc2UuIFBsZWFzZSBzZWUgcmVzcG9u c2VzIGJlbG93Lg0KDQpPbiAyOC8wNi8yMDE4LCAxNDoyMiwgIkFsYW4gRGVLb2siIDxhbGFuZEBk ZXBsb3lpbmdyYWRpdXMuY29tPiB3cm90ZToNCg0KICAgIE9uIEp1biAyOCwgMjAxOCwgYXQgMjow MyBBTSwgRG91Z2xhcyBHYXNoIChkY21nYXNoKSA8ZGNtZ2FzaD00MGNpc2NvLmNvbUBkbWFyYy5p ZXRmLm9yZz4gd3JvdGU6DQogICAgPiANCiAgICA+IERlYXIgT3BzYXdnLA0KICAgID4gDQogICAg PiBUaGUgVEFDQUNTKyBEcmFmdCBWZXJzaW9uIDkgY29udGFpbnMgYSBzZWN1cml0eSBzZWN0aW9u LCB0aGUgbGFzdCB0aHJlZSBzdWJzZWN0aW9ucyBvZiB3aGljaCBhcmUgcmVjb21tZW5kYXRpb25z LiBUaGVyZSBpcyBzb21lIG92ZXJsYXAgYW5kIHJlcGV0aXRpb24gYmV0d2VlbiBzZWN0aW9ucyB3 aGVyZSB0aGUgc2FtZSBpc3N1ZXMgYXJlIGNvdmVyZWQgZnJvbSBkaWZmZXJlbnQgYW5nbGVzLCB3 aGljaCB3ZSBiZWxpZXZlIG1heSBsZWFkIHRvIGFtYmlndWl0eS4NCiAgICA+IA0KICAgID4gU28g aW5zdGVhZCB3ZSBwcm9wb3NlIHRvIHJlZmFjdG9yIHRoZSByZWNvbW1lbmRhdGlvbnMgc2VjdGlv biB0byBicmluZyByZWNvbW1lbmRhdGlvbiBwb2ludHMgb2YgZWFjaCBhc3BlY3QgaW50byB0aGVp ciBvd24gc3Vic2VjdGlvbnMsIGFzIGJlbG93LiANCiAgICANCiAgICAgIFRoZXJlIGFyZSBjb21t b24gcmVxdWlyZW1lbnRzIGZvciBjbGllbnQtc2VydmVyIGNvbm5lY3Rpb25zLiAgSG93ZXZlciwg dGhlcmUgYXJlIGRpZmZlcmVudCBzZWN1cml0eSByZXF1aXJlbWVudHMgZm9yIGNsaWVudHMgYW5k IHNlcnZlcnMuICBFdmVuIHRoZSBuZXcgdGV4dCB5b3UgcHJvcG9zZSBiZWxvdyBtYWtlcyB0aGlz IGNsZWFyLg0KICAgIA0KICAgICAgSSB0aGluayB0aGF0IG1lcmdpbmcgc3VjaCB0ZXh0IGludG8g b25lIHNlY3Rpb24gbWFrZXMgdGhlIHJlcXVpcmVtZW50cyBsZXNzIGNsZWFyLg0KDQpJIGNhbiBz ZWUgd2hhdCB5b3UgbWVhbiwgZXNwZWNpYWxseSBpbiB0aGUgQ2xpZW50LVNlcnZlciBjb25uZWN0 aW9uIHN1YnNlY3Rpb24uIEkgcHJvcG9zZSB0byBzcGxpdCB0aGlzIHN1YnNlY3Rpb24gaW4gdmll dyBvZiB5b3VyIGNvbW1lbnRzLiANCg0KDQoNCiAgICA+IFBsZWFzZSBub3RlIHRoYXQgdGhpcyBz ZWN0aW9uIGlzIHdpdGhpbiB0aGUgY29udGV4dCBvZiB0aGUgc2VjdXJpdHkgc2VjdGlvbiwgd2hl cmUgdGhlIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdGllcyBhcmUgZGlzY3Vzc2VkIGluIHNlY3Rpb25z IDkuMS05LjQuDQogICAgDQogICAgICBUaGUgbmV3IHRleHQgaGFzIG1hbnkgbG9uZyBzZW50ZW5j ZXMsIGFuZCBhIGdlbmVyYWxseSAiY29udmVyc2F0aW9uYWwiIGZlZWwuICBpLmUuIGl0J3Mgbm90 IHNpbXBsZSwgc2hvcnQsIGFuZCB0ZWNobmljYWwuDQoNClRoYXQgaXMgYSBmYWlyIGNvbW1lbnQu IFRoZSBpbnRlbnQgd2FzIHRvIHByb3ZpZGUgYSDigJxCZWNhdXNlIG9mIFgsIHRoZW4gZG8gWeKA nSBwYXR0ZXJuLCBidXQgaXQgZG9lcyByZXN1bHQgaW4gYW4gb3Zlcmx5IGRpYWxlY3RpYyByZXN1 bHQuIFdlIHdpbGwgcmVmYWN0b3IgdG8gcHJvdmlkZSBtb3JlIGZvY3VzIG9uIHRoZSDigJxkbyBZ 4oCdIHBhcnQsIGJ1dCBsb29rIHRvIGVuaGFuY2UgdGhlIGRldGFpbCBvZiB0aGUgWS4NCg0KICAg IA0KICAgID4gVGhpcyBuZXcgbW9kZWwgc2hvdWxkIHJlcGxhY2Ugc2VjdGlvbnMgOS41LTkuNy4N CiAgICA+IA0KICAgID4gTWFueSB0aGFua3MuDQogICAgPiANCiAgICA+IFByb3Bvc2VkIHJlY29t bWVuZGF0aW9ucyBzZWN0aW9uIGZvbGxvd3M6DQogICAgPiANCiAgICA+IA0KICAgID4gDQogICAg PiA5LjUgRGVwbG95bWVudCBCZXN0IFByYWN0aWNlcw0KICAgID4gDQogICAgPiBJbiB2aWV3IG9m IHRoZSBvYnNlcnZhdGlvbnMgYWJvdXQgdGhlIHNlY3VyaXR5IGlzc3VlcyBkZXNjcmliZWQgYWJv dmUsIGl0IGlzIGNyaXRpY2FsIHRoYXQgVEFDQUNTKyBNVVNUIEJFIGRlcGxveWVkIG92ZXIgc2Vj dXJlIG5ldHdvcmtzIHdoaWNoIGVuc3VyZSBhbiBhcHByb3ByaWF0ZSBsZXZlbCBvZiBwcml2YWN5 IGFuZCBpbnRlZ3JpdHkgb2YgdGhlIGNvbW11bmljYXRpb24uDQogICAgDQogICAgICBJJ20gbm90 IHN1cmUgImFwcHJvcHJpYXRlIiBpcyB0aGUgbmVzdCB3b3JkIGhlcmUuICBJdCdzIHZhZ3VlLCBu b24tdGVjaG5pY2FsLCBhbmQgZW50aXJlbHkgdW5oZWxwZnVsIHRvIHRoZSByZWFkZXIuICBJbiBj b250cmFzdCwgdGhlIGVhcmxpZXIgdGV4dCB3YXMgY2xlYXJlcjoNCiAgICANCkFncmVlZC4gSXQg d2lsbCBiZSByZW1vdmVkLg0KDQoNCiAgICAgICAgICBUQUNBQ1MrIE1VU1QgQkUgZW1wbG95ZWQg b3ZlciBuZXR3b3JrcyB3aGljaCBlbnN1cmUgcHJpdmFjeSBhbmQNCiAgICAgICAgICBpbnRlZ3Jp dHkgb2YgdGhlIGNvbW11bmljYXRpb24uIA0KICAgIA0KICAgICAgSSBmaW5kIHRoYXQgdGhlIGRy YWZ0IGhhcyBnb25lICpiYWNrd2FyZHMqIGhlcmUsIGJ5IHJlbW92aW5nIHRlY2huaWNhbCBhbmQg ZGVzY3JpcHRpdmUgdGV4dC4NCiAgICANCiAgICA+IFR3byBtZXRob2RzIGFyZSB1c2VkIGluIGNv bW1vbiBwcmFjdGljZS4gVGhlIHByZWZlcnJlZCBtZXRob2QsIHdoZXJlIHN1Y2ggYSBmYWNpbGl0 eSBpcyBhdmFpbGFibGUgaW4gdGhlIG9yZ2FuaXphdGlvbiwgaXMgdG8gdXNlIGEgZGVkaWNhdGVk IHNlY3VyZSBtYW5hZ2VtZW50IG5ldHdvcmsuIFdoZXJlIHRoaXMgaXMgbm90IGF2YWlsYWJsZSwg aXQgaXMgcmVjb21tZW5kZWQgdG8gdXNlIElQU2VjLg0KICAgID4gDQogICAgPiBJbiBzdW1tYXJ5 OiBJdCBpcyBzdHJvbmdseSBhZHZpc2VkIHRoYXQgVEFDQUNTKyBNVVNUIGJlIHVzZWQgd2l0aGlu IGEgc2VjdXJlIGRlcGxveW1lbnQuICBGYWlsdXJlIHRvIGRvIHNvIG1heSBpbXBhY3Qgb3ZlcmFs bCBuZXR3b3JrIHNlY3VyaXR5Lg0KICAgIA0KICAgICAgInN0cm9uZ2x5IGFkdmlzZWQgdGhhdCB5 b3UgTVVTVCBkbyBzb21ldGhpbmciID8NCiAgICANCiAgICAgIFRoaXMgc3RhdGVtZW50IGlzIGNv bnRyYWRpY3RvcnkgYW5kIHVuY2xlYXIuDQoNCkFncmVlZC4gUHJvcG9zZSB0byBkaXN0aWxsIHRv OiDigJxJbiBzdW1tYXJ5OiBUQUNBQ1MrIE1VU1QgYmUgdXNlZCB3aXRoaW4gYSBzZWN1cmUgZGVw bG95bWVudC4gIEZhaWx1cmUgdG8gZG8gc28gbWF5IGltcGFjdCBvdmVyYWxsIG5ldHdvcmsgc2Vj dXJpdHku4oCdDQogICAgDQogICAgPiA5LjUuMSBDbGllbnQtU2VydmVyIENvbm5lY3Rpb25zDQog ICAgPiANCiAgICA+IEluIG9yZGVyIHRvIGhlbHAgYWRtaW5pc3RyYXRvcnMgdG8gcHJvdGVjdCBh Z2FpbnN0IGJydXRlLWZvcmNlIGF0dGFja3MgZnJvbSB1bmtub3duIGNsaWVudHMsIFRBQ0FDUysg U2VydmVycyBNVVNUIGFsbG93IHRoZSBkZWZpbml0aW9uIG9mIGluZGl2aWR1YWwgY2xpZW50cyBh bmQgTVVTVCBhbGxvdyBhIGRlZGljYXRlZCBzZWNyZXQga2V5IHRvIGJlIGRlZmluZWQgZm9yIGVh Y2ggY2xpZW50Lg0KICAgIA0KICAgICAgSG93IGRvZXMgZGVmaW5pbmcgaW5kaXZpZHVhbCBjbGll bnRzIG9yIHNlY3JldHMgcHJvdGVjdCBhZ2FpbnN0ICJicnV0ZS1mb3JjZSIgYXR0YWNrcz8gIElz IHRoaXMgbm90IGp1c3QgbGlzdGluZyBrbm93biBjbGllbnRzLCBhbmQgcmVqZWN0aW5nIGNvbm5l Y3Rpb25zIGZyb20gdW5rbm93biBjbGllbnRzPw0KICAgIA0KVG8gYmUgZmFpciB0aGUgY2xhaW0g aXMgY2F2ZWF0ZWQgdG8gc2F5ICB0byBwcm90ZWN0IGFnYWluc3QgImJydXRlLWZvcmNlIGF0dGFj a3MgZnJvbSB1bmtub3duIGNsaWVudHMiLCBidXQgSSBkbyBhZ3JlZSB0aGF0IGFzIHlvdSBzYXks IGl0IGRvZXMgbWVhbiBzaW1wbHkgcmVqZWN0aW5nIGZyb20gdW5rbm93biBjbGllbnRzLiBBbm90 aGVyIGV4YW1wbGUgb2Yg4oCcQmVjYXVzZSBvZiBYLCB0aGVuIGRvIFnigJ0uIFdlIHdpbGwgcmVm b2N1cyB0aGlzIHRvIHRoZSDigJxkbyBZ4oCdIHBhcnQsIGJ1dCBpbmNsdWRlIHRoZSBwYXJ0IGFi b3V0IHVua25vd24gY2xpZW50c+KAnS4NCg0KDQogICAgICBUaGUgZWFybGllciB0ZXh0IHdhcyBj bGVhcmVyOg0KICAgIA0KICAgICAgICAgIFNlcnZlcnMgTVVTVCBiZSBjb25maWd1cmVkIHdpdGgg YSBsaXN0IG9mIGtub3duIGNsaWVudHMuICBTZXJ2ZXJzDQogICAgICAgICAgTVVTVCBiZSBjb25m aWd1cmVkIHRvIHJlamVjdCByZXF1ZXN0cyBmcm9tIGNsaWVudHMgbm90IG9uIHRoZQ0KICAgICAg ICAgIGxpc3QuICBBIHVuaXF1ZSBzZWNyZXQga2V5IFNIT1VMRCBiZSBjb25maWd1cmVkIGZvciBl dmVyeQ0KICAgICAgICAgIGluZGl2aWR1YWwgY2xpZW50Lg0KICAgIA0KICAgID4gV2l0aCB0aGVz ZSBtYW5kYXRvcnkgcmVxdWlyZW1lbnRzIGluIHBsYWNlLCB0aGUgZm9sbG93aW5nIHJlY29tbWVu ZGF0aW9ucyBzaG91bGQgYmUgZm9sbG93ZWQ6DQogICAgPiANCiAgICA+IENvbmZpZ3VyZSBTZXJ2 ZXJzIHRvIGFjY2VwdCBvbmx5IHRob3NlIG5ldHdvcmsgY29ubmVjdGlvbiBhdHRlbXB0cyB0aGF0 IGFycml2ZSBmcm9tIGtub3duIGNsaWVudHMuICBUaGlzIGxpbWl0cyB0aGUgZXhwb3N1cmUgYW5k IHByZXZlbnRzIHJlbW90ZSBicnV0ZSBmb3JjZSBhdHRhY2tzIGZyb20gdW5rbm93biBjbGllbnRz Lg0KICAgIA0KICAgICAgSXMgdGhpcyAiY29uZmlndXJlIiBhIHJlcXVpcmVtZW50IG9uIGltcGxl bWVudG9ycyBvciBhZG1pbmlzdHJhdG9ycz8gIEFuZCB3aHkgbm90IHVzZSBtYW5kYXRvcnkgbGFu Z3VhZ2UgaGVyZSwgYXMgd2FzIHVzZWQgaW4gZHJhZnQtMDY/ICBUaGUgY3VycmVudCB0ZXh0IGlz IG5vdCB2ZXJ5IHByZXNjcmlwdGl2ZS4NCg0KVGhlIGludGVudCBvdmVyYWxsIGlzOiBJbXBsZW1l bnQgdGhpcyBzbyB0aGF0IGFkbWluaXN0cmF0b3JzIGNhbiBjb25maWd1cmUgdGhhdC4gQnV0IHRo ZSB3aG9sZSBzZWN0aW9uIG5lZWRzIHRvIGJlIHRha2VuIHRvZ2V0aGVyIHRvIGltcGxpY2l0bHkg ZGVkdWNlIHRoaXMsIEkgdGFrZSB0aGUgcG9pbnQgdGhhdCBhIGxpdHRsZSBleHRyYSB0ZXh0IHdp bGwgbWFrZSBlYWNoIHBhcnQgb2YgdGhlIHNlY3Rpb24gbW9yZSBleHBsaWNpdGx5IGNsZWFyLg0K ICAgIA0KICAgID4gQ29uZmlndXJlIGEgc2VjcmV0IGtleSBvbiB0aGUgc2VydmVyIGZvciBlYWNo IGNsaWVudC4gSXQgaXMgcmVjb21tZW5kZWQgdGhhdCBTZXJ2ZXJzIFNIT1VMRCB3YXJuIGFkbWlu aXN0cmF0b3JzIGlmIHNlY3JldCBrZXlzIGFyZSBub3QgdW5pcXVlIHBlciBjbGllbnQuDQogICAg DQogICAgICAiaXQgaXMgcmVjb21tZW5kZWQiIGlzIHJlZHVuZGFudCB3aXRoICJTSE9VTEQiDQoN CkFncmVlZC4NCg0KICAgIA0KICAgID4gQ29uZmlndXJlIFNlcnZlciB0byByZWplY3QgY29ubmVj dGlvbnMgd2hpY2ggaGF2ZSB0aGUgVEFDX1BMVVNfVU5FTkNSWVBURURfRkxBRy4gU2VydmVycyBT SE9VTEQgYWxsb3cgYWRtaW5pc3RyYXRvcnMgdG8gcmVqZWN0IHRob3NlIHBhY2tldHMgd2l0aCBh cHBsaWNhYmxlIEVSUk9SIHJlc3BvbnNlIGZvciB0eXBlIG9mIHBhY2tldC4gQ29uc2VxdWVudGx5 LCBjbGllbnRzIHNob3VsZCBhdm9pZCB1c2luZyBUQUNfUExVU19VTkVOQ1JZUFRFRF9GTEFHLCBl dmVuIG9uIG5ldHdvcmtzIHdpdGggc2VjdXJlZCB0cmFuc3BvcnQuIEluIHN1bW1hcnk6IGRvIG5v dCB1c2UgdGhlIFRBQ19QTFVTX1VORU5DUllQVEVEX0ZMQUcgb3B0aW9uLg0KICAgIA0KICAgICAg SXMgdGhpcyAiY29uZmlndXJlIiBhIHJlcXVpcmVtZW50IG9uIGFkbWluaXN0cmF0b3JzPyAgRG8g YWRtaW5pc3RyYXRvcnMgaGF2ZSB0byByZWFkIHRoZSBSRkNzIGluIG9yZGVyIHRvIGNvbmZpZ3Vy ZSB0aGUgc3lzdGVtcyBjb3JyZWN0bHk/DQoNCkl0IGlzIGEgdmFsaWQgcG9pbnQuIEkgdGhpbmsg aXQgaXMgZmFpciB0byBzYXkgdGhlIGltcGxlbWVudGF0aW9ucyBTSE9VTEQgaW5kaWNhdGUgdGhh dCBhZG1pbmlzdHJhdG9ycyBTSE9VTEQgbm90IGNvbmZpZ3VyZSB0aGUgdW5lbmNyeXB0ZWQgb3B0 aW9uLiBJIGRvbuKAmXQgdGhpbmsgdGhhdCBlaXRoZXIgb2YgdGhlIHR3byBTSE9VTERzIHNob3Vs ZCBiZSBhIE0gVVNULCBidXQgcG9zc2libHkgdGhlIGZpcnN0IGNvdWxkIGJlLg0KICAgIA0KICAg ICAgT3Igc2hvdWxkIGltcGxlbWVudG9ycyBtYWtlIHRoZSBzb2Z0d2FyZSBkbyB0aGlzIGJ5IGRl ZmF1bHQ/DQoNCknigJltIG5vdCBzdXJlIHdlIGNhbiBkbyB0aGF0LCBiZWNhdXNlIGl0IHdvdWxk IHJlcXVpcmUgYSBkZWZhdWx0IHNlY3JldCwgYW5kIHRoYXQgd291bGQgY29udHJhdmVuZSBtb3N0 IHNlY3VyaXR5IGFuYWx5c2lzIGZvciBhbiBpbXBsZW1lbnRhdGlvbi4gQnV0IHdvdWxkIHdlbGNv bWUgcHJvcG9zYWxzLg0KICAgIA0KICAgICAgQW5kIHRoZSByZWR1bmRhbmN5IGNvbnRpbnVlczog ICIgY2xpZW50cyBzaG91bGQgYXZvaWQgdXNpbmcgIiAuLiAiSW4gc3VtbWFyeTogZG8gbm90IHVz ZSAiDQogICAgDQpBZ3JlZWQuDQoNCiAgICAgIFRoZSB0ZXh0IGlzIHZhZ3VlLCByYW1ibGluZywg YW5kIHJlZHVuZGFudC4NCiAgICA+IA0KDQpXaWxsIHJlbW92ZSB0aGUgcmVkdW5kYW5jeS4NCiAg ICANCiAgICA+IFRoZSBzdHJvbmdlc3QgYXV0aGVudGljYXRpb24gb3B0aW9ucyBpbiB0aGUgVEFD QUNTKyBwcm90b2NvbCBhcmUgdGhlIGNoYWxsZW5nZS1yZXNwb25zZSBvcHRpb25zIChUQUNfUExV U19BVVRIRU5fVFlQRV9DSEFQIG9yIFRBQ19QTFVTX0FVVEhFTl9UWVBFX01TQ0hBUCBvciBUQUNf UExVU19BVVRIRU5fVFlQRV9NU0NIQVBWMiBmb3IgYXV0aGVuX3R5cGUpLiBDb25zZXF1ZW50bHks IFRoZSBTZXJ2ZXIgaW1wbGVtZW50YXRpb24gTVVTVCBhbGxvdyB0aGUgYWRtaW5pc3RyYXRvciB0 byBtYW5kYXRlIHRoYXQgb25seSB0aGVzZSBjaGFsbGVuZ2UvcmVzcG9uc2Ugb3B0aW9ucyB3aWxs IGJlIGFjY2VwdGVkIGZvciBhdXRoZW50aWNhdGlvbi4gDQogICAgPiANCiAgICA+IEl0IGlzIHJl Y29tbWVuZGVkIHRoYXQgYWRtaW5pc3RyYXRvcnMgdXNlIHRoaXMgb3B0aW9uLiBBZG1pbmlzdHJh dG9ycyBzaG91bGQgYWxsb3cgb3RoZXIgb3B0aW9ucyBvbmx5IHdoZW4gdW5hdm9pZGFibGUgZHVl IHRvIHJlcXVpcmVtZW50cyBvZiBpZGVudGl0eS9wYXNzd29yZCBzeXN0ZW1zLg0KICAgIA0KICAg ICAgSXMgdGhlcmUgcHJlc2NyaXB0aXZlIHRleHQgaGVyZSBpbnN0ZWFkIG9mICJpdCBpcyByZWNv bW1lbmRlZCI/ICBNYXliZSBTSE9VTEQgPw0KDQpBZ3JlZWQuDQogICAgDQogICAgPiBEdWUgdG8g dGhlaXIgc2VjdXJpdHkgaW1wbGljYXRpb25zLCB0aGUgVEFDX1BMVVNfQVVUSEVOX1NFTkRBVVRI IGFuZCBUQUNfUExVU19BVVRIRU5fU0VORFBBU1Mgb3B0aW9ucyBtZW50aW9uZWQgaW4gdGhlIG9y aWdpbmFsIGRyYWZ0IHNob3VsZCBub3QgYmUgdXNlZC4gDQogICAgDQogICAgICBNYXliZSAiTVVT VCBOT1QgYmUgdXNlZCIgPw0KDQpJIHdvdWxkIGFncmVlIHRvIGl0LCBidXQgd2UgbWF5IG5lZWQg d2lkZXIgY29uc2Vuc3VzLiBEbyB3ZSBoYXZlIGFueSBvcHRpb25zIGJldHdlZW4gTVVTVCBhbmQg U0hPVUxEIDstKQ0KDQogICAgDQogICAgPiA5LjUuNCBBdXRob3JpemF0aW9uIE9wdGlvbnMNCiAg ICA+IA0KICAgID4gVGhlIGF1dGhvcml6YXRpb24gYW5kIGFjY291bnRpbmcgZmVhdHVyZXMgYXJl IGludGVuZGVkIHRvIHByb3ZpZGUgZXh0ZW5zaWJsZSBmbGV4aWJpbGl0eS4gVGhlcmUgaXMgYSBi YXNlIGRpY3Rpb25hcnkgZGVmaW5lZCBpbiB0aGlzIGRvY3VtZW50LCBidXQgaXMgbWF5IGJlIGV4 dGVuZGVkIGluIGRlcGxveW1lbnRzIGJ5IHVzaW5nIG5ldyBhdHRyaWJ1dGUgbmFtZXMuIFRoZSBj b3N0IG9mIHRoZSBmbGV4aWJpbGl0eSBpcyB0aGF0IGFkbWluaXN0cmF0b3JzIE1VU1QgZW5zdXJl IHRoYXQgdGhlIGF0dHJpYnV0ZSBhbmQgdmFsdWUgcGFpcnMgc2hhcmVkIGJldHdlZW4gdGhlIGNs aWVudHMgYW5kIHNlcnZlcnMgaGF2ZSBjb25zaXN0ZW50IGludGVycHJldGF0aW9uLiANCiAgICA+ IA0KICAgID4gSWYgYSBjbGllbnQgcmVjZWl2ZXMgcmVjZWl2aW5nIGEgbWFuZGF0b3J5IGF1dGhv cml6YXRpb24gYXR0cmlidXRlIHRoYXQgaXRzIGltcGxlbWVudGF0aW9uIGRvZXMgbm90IGRlZmlu ZSwgdGhlbiBpdCBzaG91bGQsIGJlaGF2ZSBhcyBpZiBpdCBoYWQgcmVjZWl2ZWQgVEFDX1BMVVNf QVVUSE9SX1NUQVRVU19GQUlMLg0KICAgID4gDQogICAgPiBSZXF1aXJlIFRBQ0FDUysgYXV0aGVu dGljYXRpb24gZm9yIGF1dGhvcml6YXRpb24gcmVxdWVzdHMgKGkuZS4gVEFDX1BMVVNfQVVUSEVO X01FVEhfVEFDQUNTUExVUyBpcyB1c2VkKS4NCiAgICANCiAgICAgIFRoYXQgbGFzdCBzZW50ZW5j ZSBzZWVtcyB1bmZpbmlzaGVkLg0KDQpBZ3JlZWQuIFRoZSBzZW50ZW5jZSBoYXMgZHJvcHBlZCBh IHN1YmplY3QsIHdpbGwgcmUtaW5zdGFsbCBvbmUuDQogICAgDQogICAgPiA5LjUuNSBUaGUgUmVk aXJlY3Rpb24gTWVjaGFuaXNtDQogICAgPiANCiAgICA+IFRoZSByZWRpcmVjdGlvbiBtZWNoYW5p c20gKFRBQ19QTFVTX0FVVEhFTl9TVEFUVVNfRk9MTE9XKSB0aGF0IHdhcyBkZWZpbmVkIGluIHRo ZSBvcmlnaW5hbCBkcmFmdCBpcyBkaWZmaWN1bHQgdG8gc2VjdXJlLiBJdCBpcyByZWNvbW1lbmRl ZCB0byBkaXNhYmxlIHRoZSBmZWF0dXJlLCBhbmQgc28gdG8gYXZvaWQgaXRzIHVzZSBhbHRvZ2V0 aGVyLiBJdCBpcyByZWNvbW1lbmRlZCB0aGF0IGNsaWVudHMgdHJlYXQgVEFDX1BMVVNfQVVUSEVO X1NUQVRVU19GT0xMT1cgYXMgVEFDX1BMVVNfQVVUSEVOX1NUQVRVU19GQUlMLiANCiAgICANCiAg ICAgIElzIHRoZXJlIHByZXNjcmlwdGl2ZSB0ZXh0IGhlcmUgaW5zdGVhZCBvZiAiaXQgaXMgcmVj b21tZW5kZWQiPyAgRWFybGllciB0ZXh0IGhhZCBzdWNoIHByZXNjcmlwdGl2ZSB0ZXh0Lg0KDQpB Z3JlZWQsIEkgd2lsbCBhZGQgdGhlIHByZXNjcmlwdGl2ZSB0ZXh0IHRvIGJlIGNvbnNpc3RlbnQg d2l0aCB0aGUgYm9keSBvZiB0aGUgZG9jdW1lbnQuDQogICAgDQogICAgPiBJZiB0aGUgb3B0aW9u IG11c3QgYmUgdXNlZCBmb3IgbGVnYWN5IGFwcGxpY2F0aW9uIHJlYXNvbnMsIHRoZW4gaXQgaXMg cmVjb21tZW5kZWQgdG8gYXZvaWQgdGhlIG9wdGlvbiB0byBzZW5kIHNlY3JldCBrZXlzIGluIHRo ZSBzZXJ2ZXIgbGlzdC4NCiAgICANCiAgICAgIEFnYWluLCAiaXQgaXMgcmVjb21tZW5kZWQiDQog ICAgDQogICAgICBUaGUgbmV3IHRleHQgaXMgYSBzdGVwIGJhY2t3YXJkcyBmcm9tIGVhcmxpZXIg ZHJhZnRzLiAgSSd2ZSB0YWtlbiBhIGxvb2sgYXQgdGhlIHJlc3Qgb2YgU2VjdGlvbiA5LCBhbmQg aXQncyBzaW1pbGFyLg0KDQogICAgICBBcyBhbiBpbXBsZW1lbnRvciwgdGhpcyB0ZXh0IGdpdmVz IG1lIG9ubHkgdmFndWUgZ3VpZGFuY2UgYXMgdG8gd2hhdCB0byBkby4gIFdpdGggbGVzcyBjbGFy aXR5IGFuZCBmZXdlciBwcmVzY3JpcHRpb25zIHRoYW4gZWFybGllciB0ZXh0Lg0KICAgIA0KICAg ICAgSSd2ZSBzYWlkIGJlZm9yZSB0aGF0IHRoZSB0ZXh0IGlzIHBoaWxvc29waGljYWwgYW5kIGNv bnZlcnNhdGlvbmFsIGluc3RlYWQgb2YgdGVjaG5pY2FsLiAgVGhpcyBzdHlsZSBpcyBjb250aW51 aW5nIHdpdGggbmV3IHRleHQuDQogICAgDQpUaGUgb3RoZXIgcGFydHMgb2Ygc2VjdGlvbiA5IHdp bGwgYmUgYWRkcmVzc2VkIGluIGFub3RoZXIgdGhyZWFkLCBidXQgYm90aCB0aGV5IGFuZCB0aGlz IHNlY3Rpb24gd2lsbCBiZSBhZGRyZXNzZWQgd2l0aCB5b3VyIGNvbW1lbnRzIGFzIGFib3ZlIEFT QVAuDQoNCg0KICAgICAgQWxhbiBEZUtvay4NCiAgICANCiAgICANCg0K From nobody Thu Jun 28 12:00:57 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 234F4131066; Thu, 28 Jun 2018 12:00:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSS7Mhu_pyUu; Thu, 28 Jun 2018 12:00:36 -0700 (PDT) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86B37131129; Thu, 28 Jun 2018 12:00:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2494; q=dns/txt; s=iport; t=1530212434; x=1531422034; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to:content-transfer-encoding; bh=sEJ0tf464TxTOvVqs2u4ZMDpm8N5Md44NdoS/BNE1FU=; b=i6UJbf5QYQbD3NTdDjPrFaqn1MlHalHXWr8OpU6wRGSOV5RYr5Pg3jHt 6dJTDKSMoc5eTmbfjfqixf9N9NRn5ObLRPbpoSwTDrDUNRyv/33DHYKYF TSKQDM8H866apSiEgeeszobRgLmQCEKfl3u03K0VW1DWyOeEz0v37LG/w Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D8AQCaLzVb/5hdJa1dGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYNJYn8og3mUQoFdKpUygWYLGAuEA0YCgxohOBQBAgEBAgE?= =?us-ascii?q?BAm0cDIU2AQEBAQIBAQEhDwE7CwULCxgCAiYCAicwBgEMBgIBAYMcAYF3CA+?= =?us-ascii?q?uLIIciFOBHwWBC4digVY/gTaCaIMYAQECgSYFARIBCYMXglUCkV2HYQmPEAa?= =?us-ascii?q?BQIZNJIUch3eKAoFYIWFxTSMVO4JpgiMXiFmFWiMwAY4ggjkBAQ?= X-IronPort-AV: E=Sophos;i="5.51,284,1526342400"; d="scan'208";a="136047167" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Jun 2018 19:00:33 +0000 Received: from [10.150.55.64] (dhcp-10-150-55-64.cisco.com [10.150.55.64]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id w5SJ0WtP024034; Thu, 28 Jun 2018 19:00:33 GMT To: "Douglas Gash (dcmgash)" , Joe Clarke , "opsawg@ietf.org" , "internet-drafts@ietf.org" Cc: Andrej Ota , Thorsten Dahm References: <793bdc91-4d63-84f0-66da-4a918afff368@cisco.com> <4C5603DE-9985-40CE-B400-2894CC240CA4@cisco.com> From: Joe Clarke Openpgp: preference=signencrypt Autocrypt: addr=jclarke@cisco.com; prefer-encrypt=mutual; keydata= xsDiBDo1cJ0RBADSZSmbmzdRr1CoRWWKmAyu0eaQimaLV1TsZEML/ksLyg6faXrKIA/MWc7M w4FmKkDjaZdFzobzabnKp2QwVadLqi1gYY2WsApKC0rSoqsPx5E847AmwNWXgjXiXORXmnZL mf5PZ2ECOEJC27sji5Nrh9GSw7OPp6c+EE20gMNVrwCgu3iK5vyGQfy0/wX/jcIvP0nHznUD /RvijiKomyaf6F5pibmouFNeuCDHc8lwx2giA/MCZl/nSkI2/UX27sULGNgvKNkVPu/AukXu zW3fIthsJgjQZUoi/BTe9kUP+RL3+RALXXuLv7b3xGRHJ8A1Rpy9H43fkjHZ945YNPrUvJlG LP5PNGBD1xC21X3EGAyywVynDskcA/4qgbJFkVzmPjFJUjq+RW1zw3UIb3bbkskl/wk5qd+M w2EhiSPTbEhJQAQUvqSGFWEGp2ANic7iYLdPXV/O6I1/guRRaY0eK77YkkCjz1snaKYnGSeI GHGwmHb6D+ZHzTqZqr6IssgEIUHjXfgOUTARQbL15nJTVRzDGUiT/65R3c0eSm9lIENsYXJr ZSA8amNsYXJrZUBjaXNjby5jb20+wl8EExECABcFAjyDqGQFCwcKAwQDFQMCAxYCAQIXgAAS CRDN7TXCWm4C3wdlR1BHAAEB5KkAn0kBda/9+uF6RfnDSFS7RExUU9DqAJ4knRckYiSASteC K03QVtEiXblL287ATQQ6NXCeEAQAhIURlK17jmIMdMIuScFU6xK+jkKgVVFrjlRH5vLV2spp jH/uQ57MMGuOcs7PckXCnPjBV8Tm32Tuw+fCyrbc2gt0ouiT/5WWj0EMeAfWew1zBXX2okGf LqS6gucVDS6tcEFN6PmJEmX+tWDcmiqx/xXiSfMVYiLMdlK+YDkMDDsAAwUD/3BWOyfdnBGH Kv28zx+5wq/2vhYnUYCAdVD2ZWCJizQTMbkcxEIKAwtAj6yqKq9ah82nt4VHl5ZejVe47jvR 2nXwJ5VQ9eITuTjTLDw+3qr9lN077VZ32hyb5ULJcW756j9Z3YB2FTANw6KHgChaSVVx9kYJ FlAggraU7mi39/wvwk4EGBECAAYFAjo1cJ4AEgkQze01wlpuAt8HZUdQRwABAQbdAJ9R8SzU Mluu9r93BMv6fAW9j6qTZgCfYcEAqOMJv+3Z+YxLiDtWcCY4Sfo= Organization: Cisco Message-ID: <680b607e-61a9-81f3-7b8f-52ddbe5996a9@cisco.com> Date: Thu, 28 Jun 2018 15:00:32 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <4C5603DE-9985-40CE-B400-2894CC240CA4@cisco.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSAWG] Action Items on TACACS+ informational draft v 10 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 19:00:54 -0000 On 6/28/18 01:49, Douglas Gash (dcmgash) wrote: > Hi Joe, > > We will update on 1) by end of the week. Thanks. > 2) Was sent previously, any feedback on it welcome. Yes you did! I read through it and had thought I replied at the time. I appreciate the summary effort. Given that this was a look back at changes, trying to thread that into mailing list discussions would be difficult. Some of those discussions were happening before I joined as co-chair. I would ask that people like Alan (that have been very vocal) make sure that any points have been addressed and if specific changes require more thorough explanation. > 3) I will send out initial proposal today to the list. I saw that. I'll read it over. Joe > > Thanks, > > Doug. > > On 27/06/2018, 16:13, "Joe Clarke" wrote: > > On 6/10/18 04:43, Douglas Gash (dcmgash) wrote: > > Dear Opsawg, > > > > A status update on informational T+ Draft: > > > > 1) Current discussion between Andrej and (mainly) Joe Clarke on some section 9 (Security), ongoing, Andrej/Authors will respond to Joe’s latest comments shortly. > > 2) Diffs between Version 6 and Version 10 with brief annotations of each diff sent to Newsgroup > > 3) Authors Recently reviewed section 9 (Security), and reflect that it includes some redundant and overlapping content in the sections: > > “9.5. TACACS+ Client Implementation Recommendations . . . . . . 39 > > 9.6. TACACS+ Server Implementation Recommendations . . . . . . 39 > > 9.7. TACACS+ Deployment Best Practices . . . . . . . . . . . . 40” > > …consequently, we are planning to propose rationalised single section to cover Best Practices. We will present a proposal this week for initiating discussion, the result of which we will look to include in next version. > > Hello, T+ authors. What is the status of this work? It's now been two > weeks since you sent this (and a month between this and the previous email). > > For this work to progress, we need much more frequent engagement. To > that end, can one of you present the status of the work and your plan to > move towards ratification in Montreal? > > Thanks. > > Joe > > > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg > From nobody Thu Jun 28 14:46:46 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8C98130FAC; Thu, 28 Jun 2018 14:46:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PsQSqjO1Cgp0; Thu, 28 Jun 2018 14:46:42 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 109A7130E16; Thu, 28 Jun 2018 14:46:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=657; q=dns/txt; s=iport; t=1530222402; x=1531432002; h=to:cc:from:subject:message-id:date:mime-version: content-transfer-encoding; bh=S24Vgd9SBGf/+KP0dTgPfhVCvexsJlNArOC+96SAfJg=; b=gkntC7kxo0Ob/0QcZfaCkzkgzeZqIxU/4a28HF51wgmyvKwOoZGtn9tA j3YnE9JXKI5rJH+GFQJJfCylsYp+834xNG+t0qyUu5uRsyCoVKydverQv z+qzkJtW08jD3pIShCRx7UjP3n68PnCer/sEB0Ak3fTzkf2sAKQw8hFHP I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CbAgC9VjVb/5FdJa1dGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYNJgWEog3mUQoFdlVyBZguEbIMcITgUAQIBAQIBAQJtHQu?= =?us-ascii?q?FYFY1AiYCXw0GAgEBgxyCAK5TghyIVYEkgQuHYoFWP4E2gmiBQQGDBQESAYM?= =?us-ascii?q?gglUCjEw7jDcJjxAGgUCEB4JGhT8BkXmBWCFhcU0jFYMkgi+OPiMwjjWCOQE?= =?us-ascii?q?B?= X-IronPort-AV: E=Sophos;i="5.51,285,1526342400"; d="scan'208";a="135691429" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Jun 2018 21:46:41 +0000 Received: from [10.118.87.86] (rtp-jclarke-nitro5.cisco.com [10.118.87.86]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id w5SLkeZ3030644; Thu, 28 Jun 2018 21:46:41 GMT To: "opsawg@ietf.org" Cc: "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" From: Joe Clarke Openpgp: preference=signencrypt Autocrypt: addr=jclarke@cisco.com; prefer-encrypt=mutual; keydata= xsDiBDo1cJ0RBADSZSmbmzdRr1CoRWWKmAyu0eaQimaLV1TsZEML/ksLyg6faXrKIA/MWc7M w4FmKkDjaZdFzobzabnKp2QwVadLqi1gYY2WsApKC0rSoqsPx5E847AmwNWXgjXiXORXmnZL mf5PZ2ECOEJC27sji5Nrh9GSw7OPp6c+EE20gMNVrwCgu3iK5vyGQfy0/wX/jcIvP0nHznUD /RvijiKomyaf6F5pibmouFNeuCDHc8lwx2giA/MCZl/nSkI2/UX27sULGNgvKNkVPu/AukXu zW3fIthsJgjQZUoi/BTe9kUP+RL3+RALXXuLv7b3xGRHJ8A1Rpy9H43fkjHZ945YNPrUvJlG LP5PNGBD1xC21X3EGAyywVynDskcA/4qgbJFkVzmPjFJUjq+RW1zw3UIb3bbkskl/wk5qd+M w2EhiSPTbEhJQAQUvqSGFWEGp2ANic7iYLdPXV/O6I1/guRRaY0eK77YkkCjz1snaKYnGSeI GHGwmHb6D+ZHzTqZqr6IssgEIUHjXfgOUTARQbL15nJTVRzDGUiT/65R3c0eSm9lIENsYXJr ZSA8amNsYXJrZUBjaXNjby5jb20+wl8EExECABcFAjyDqGQFCwcKAwQDFQMCAxYCAQIXgAAS CRDN7TXCWm4C3wdlR1BHAAEB5KkAn0kBda/9+uF6RfnDSFS7RExUU9DqAJ4knRckYiSASteC K03QVtEiXblL287ATQQ6NXCeEAQAhIURlK17jmIMdMIuScFU6xK+jkKgVVFrjlRH5vLV2spp jH/uQ57MMGuOcs7PckXCnPjBV8Tm32Tuw+fCyrbc2gt0ouiT/5WWj0EMeAfWew1zBXX2okGf LqS6gucVDS6tcEFN6PmJEmX+tWDcmiqx/xXiSfMVYiLMdlK+YDkMDDsAAwUD/3BWOyfdnBGH Kv28zx+5wq/2vhYnUYCAdVD2ZWCJizQTMbkcxEIKAwtAj6yqKq9ah82nt4VHl5ZejVe47jvR 2nXwJ5VQ9eITuTjTLDw+3qr9lN077VZ32hyb5ULJcW756j9Z3YB2FTANw6KHgChaSVVx9kYJ FlAggraU7mi39/wvwk4EGBECAAYFAjo1cJ4AEgkQze01wlpuAt8HZUdQRwABAQbdAJ9R8SzU Mluu9r93BMv6fAW9j6qTZgCfYcEAqOMJv+3Z+YxLiDtWcCY4Sfo= Organization: Cisco Message-ID: Date: Thu, 28 Jun 2018 17:46:40 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [OPSAWG] REMINDER: [IETF 102] Presentation submissions and draft deadline X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 21:46:45 -0000 The co-chairs would like to remind people to submit any requests for presentations as soon as possible. Opsawg and Ops Area will be meeting on Tuesday, July 17 at 15:50 EDT. If you are interested in presenting to opsawg, please email opsawg-chairs@ietf.org with the name of the draft, proposed presenter, and the desired amount of time. If you would like to present during the ops area part of the meeting, please do the same as above, but copy ops-ads@ietf.org. Also, the deadline for new draft submissions is this Monday (July 2). If you will be presenting new work, please make sure your draft is submitted before this deadline. Joe From nobody Thu Jun 28 15:16:57 2018 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 684101310F8 for ; Thu, 28 Jun 2018 15:16:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UHSWSVwiC0Nj for ; Thu, 28 Jun 2018 15:16:53 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 4D4081310EF for ; Thu, 28 Jun 2018 15:16:53 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 95AB078B; Thu, 28 Jun 2018 22:16:51 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: <680b607e-61a9-81f3-7b8f-52ddbe5996a9@cisco.com> Date: Thu, 28 Jun 2018 18:16:50 -0400 Cc: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , Andrej Ota , Thorsten Dahm Content-Transfer-Encoding: quoted-printable Message-Id: References: <793bdc91-4d63-84f0-66da-4a918afff368@cisco.com> <4C5603DE-9985-40CE-B400-2894CC240CA4@cisco.com> <680b607e-61a9-81f3-7b8f-52ddbe5996a9@cisco.com> To: Joe Clarke X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] Action Items on TACACS+ informational draft v 10 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2018 22:16:56 -0000 > On Jun 28, 2018, at 3:00 PM, Joe Clarke = wrote: >=20 > I would ask that people like Alan (that have been very vocal) make = sure > that any points have been addressed and if specific changes require = more > thorough explanation. I would prefer that the document approach publication quality before = doing significantly more work. Despite many, many, reviews and both editorial and technical feedback, = the new text in the document isn't much better than text from 3 years = ago. It's still vague, not prescriptive, doesn't use normative text, = etc. I've done do a quick check recently, and there are still major issues = with the document. So there isn't much point in doing more detailed = reviews. Having done that lots, I'm disinclined to do it again. Alan DeKok.