From Internet-Drafts@ietf.org Sun Dec 12 09:15:02 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A62143A6DE5; Sun, 12 Dec 2010 09:15:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U8qIL21OIH0y; Sun, 12 Dec 2010 09:15:01 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E168C3A6CB2; Sun, 12 Dec 2010 09:15:01 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.10 Message-ID: <20101212171501.11558.17759.idtracker@localhost> Date: Sun, 12 Dec 2010 09:15:01 -0800 Cc: opsec@ietf.org Subject: [OPSEC] I-D Action:draft-ietf-opsec-protect-control-plane-05.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Dec 2010 17:15:02 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Protecting The Router Control Plane Author(s) : D. Dugal, et al. Filename : draft-ietf-opsec-protect-control-plane-05.txt Pages : 24 Date : 2010-12-12 This memo provides a method for protecting a router's control plane from undesired or malicious traffic. In this approach, all legitimate router control plane traffic is identified. Once legitimate traffic has been identified, a filter is deployed in the router's forwarding plane. That filter prevents traffic not specifically identified as legitimate from reaching the router's control plane, or rate limits such traffic to an acceptable level. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-opsec-protect-control-plane-05.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-opsec-protect-control-plane-05.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-12091158.I-D@ietf.org> --NextPart-- From Internet-Drafts@ietf.org Wed Dec 15 12:45:02 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 857C728C0FF; Wed, 15 Dec 2010 12:45:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.5 X-Spam-Level: X-Spam-Status: No, score=-102.5 tagged_above=-999 required=5 tests=[AWL=0.099, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fzdQt4wjbSve; Wed, 15 Dec 2010 12:45:01 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8F98D28C0DC; Wed, 15 Dec 2010 12:45:01 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.10 Message-ID: <20101215204501.30897.45672.idtracker@localhost> Date: Wed, 15 Dec 2010 12:45:01 -0800 Cc: opsec@ietf.org Subject: [OPSEC] I-D Action:draft-ietf-opsec-protect-control-plane-06.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Dec 2010 20:45:02 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Protecting The Router Control Plane Author(s) : D. Dugal, et al. Filename : draft-ietf-opsec-protect-control-plane-06.txt Pages : 24 Date : 2010-12-15 This memo provides a method for protecting a router's control plane from undesired or malicious traffic. In this approach, all legitimate router control plane traffic is identified. Once legitimate traffic has been identified, a filter is deployed in the router's forwarding plane. That filter prevents traffic not specifically identified as legitimate from reaching the router's control plane, or rate limits such traffic to an acceptable level. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-opsec-protect-control-plane-06.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-opsec-protect-control-plane-06.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-15123325.I-D@ietf.org> --NextPart-- From Internet-Drafts@ietf.org Thu Dec 16 07:45:03 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C64713A68F3; Thu, 16 Dec 2010 07:45:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.526 X-Spam-Level: X-Spam-Status: No, score=-102.526 tagged_above=-999 required=5 tests=[AWL=0.073, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3PXZCWXqXonf; Thu, 16 Dec 2010 07:45:02 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4C3A13A68DF; Thu, 16 Dec 2010 07:45:02 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.10 Message-ID: <20101216154502.19663.79021.idtracker@localhost> Date: Thu, 16 Dec 2010 07:45:02 -0800 Cc: opsec@ietf.org Subject: [OPSEC] I-D Action:draft-ietf-opsec-ip-security-05.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 15:45:03 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Security Assessment of the Internet Protocol version 4 Author(s) : F. Gont Filename : draft-ietf-opsec-ip-security-05.txt Pages : 77 Date : 2010-12-16 This document contains a security assessment of the IETF specifications of the Internet Protocol version 4, and of a number of mechanisms and policies in use by popular IPv4 implementations. It is based on the results of a project carried out by the UK's Centre for the Protection of National Infrastructure (CPNI). A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-opsec-ip-security-05.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-opsec-ip-security-05.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-16074342.I-D@ietf.org> --NextPart-- From iesg-secretary@ietf.org Thu Dec 23 09:03:00 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7AEBB3A6837; Thu, 23 Dec 2010 09:03:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.565 X-Spam-Level: X-Spam-Status: No, score=-102.565 tagged_above=-999 required=5 tests=[AWL=0.034, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dGaS9g5sQkai; Thu, 23 Dec 2010 09:02:59 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 275B53A683A; Thu, 23 Dec 2010 09:02:59 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IETF-Announce X-Test-IDTracker: no X-IETF-IDTracker: 3.10 Message-ID: <20101223170259.25765.34607.idtracker@localhost> Date: Thu, 23 Dec 2010 09:02:59 -0800 Cc: opsec mailing list , Internet Architecture Board , opsec chair , RFC Editor Subject: [OPSEC] Document Action: 'Protecting The Router Control Plane' to Informational RFC (draft-ietf-opsec-protect-control-plane-06.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Dec 2010 17:03:00 -0000 The IESG has approved the following document: - 'Protecting The Router Control Plane' (draft-ietf-opsec-protect-control-plane-06.txt) as an Informational RFC This document is the product of the Operational Security Capabilities for IP Network Infrastructure Working Group. The IESG contact persons are Ron Bonica and Dan Romascanu. A URL of this Internet Draft is: http://datatracker.ietf.org/doc/draft-ietf-opsec-protect-control-plane/ Technical Summary This memo provides a method for protecting a router's control plane from undesired or malicious traffic. In this approach, all legitimate router control plane traffic is identified and then a filter is deployed in the router's forwarding plane. This filter prevents traffic not specifically identified as legitimate from reaching the router's control plane or rate limiting it to an acceptable level. Working Group Summary The document was accepted as a working group item on the mailing list on 4/30/2010. Working Group last call was performed for two weeks, ending on 9/15/2010, with no objections. Document Quality This document covers well understood and widely deployed methods for protecting the control plane of network devices from attack. It contains example configuration snippets for two vendors implementations. It is part of a set of work undertaken by the WG to provide guidelines to operators on how to secure their infrastructure from attack. Personnel Warren Kumari is document shepherd. RFC Editor Note OLD TEXT: This memo provides a method for protecting a router's control plane from undesired or malicious traffic. In this approach, all legitimate router control plane traffic is identified. Once legitimate traffic has been identified, a filter is deployed in the router's forwarding plane. That filter prevents traffic not specifically identified as legitimate from reaching the router's control plane, or rate limits such traffic to an acceptable level. NEW TEXT: This memo provides a method for protecting a router's control plane from undesired or malicious traffic. In this approach, all legitimate router control plane traffic is identified. Once legitimate traffic has been identified, a filter is deployed in the router's forwarding plane. That filter prevents traffic not specifically identified as legitimate from reaching the router's control plane, or rate limits such traffic to an acceptable level. Note that the filters described in this memo are applied only to traffic that is destined for the router, and not to all traffic that is passing through the router. OLD TEXT> It is advisable to protect the router control plane by implementing mechanisms to filter completely or rate limit traffic not required at the control plane level (i.e., unwanted traffic). Router Control Plane Protection is the concept of filtering or rate limiting unwanted traffic which would be diverted from the forwarding plane up to the router control plane. The closer to the forwarding plane and line-rate hardware the filters and rate-limiters are, the more effective the protection is and the more resistant the system is to DoS attacks. This memo demonstrates one example of how to deploy a policy filter that satisfies a set of sample traffic matching, filtering and rate limiting criteria. New Text> It is advisable to protect the router control plane by implementing mechanisms to filter completely or rate limit traffic not required at the control plane level (i.e., unwanted traffic). Router Control Plane Protection is the concept of filtering or rate limiting unwanted traffic which would be diverted from the forwarding plane up to the router control plane. The closer to the forwarding plane and line-rate hardware the filters and rate-limiters are, the more effective the protection is and the more resistant the system is to DoS attacks. This memo demonstrates one example of how to deploy a policy filter that satisfies a set of sample traffic matching, filtering and rate limiting criteria. Note that the filters described in this memo are applied only to traffic that is destined for the router, and not to all traffic that is passing through the router. Old Text> For network deployments where the protocols used do not rely on IP options New Text> For network deployments where the protocols do not use IP options From warren@kumari.net Thu Dec 23 12:20:24 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F3C9F3A6887 for ; Thu, 23 Dec 2010 12:20:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5q5a+401pUzR for ; Thu, 23 Dec 2010 12:20:23 -0800 (PST) Received: from smtp.kumari.net (smtp.kumari.net [216.177.58.220]) by core3.amsl.com (Postfix) with ESMTP id 261023A6886 for ; Thu, 23 Dec 2010 12:20:23 -0800 (PST) Received: by smtp.kumari.net (Postfix, from userid 5001) id AE492DEE318; Thu, 23 Dec 2010 15:19:00 -0500 (EST) Received: from dot.her.corp.google.com (unknown [74.202.225.33]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by smtp.kumari.net (Postfix) with ESMTPSA id D769CDEE317 for ; Thu, 23 Dec 2010 15:18:59 -0500 (EST) Message-Id: <64E1A73D-2221-4035-8E77-79A6515A0DC3@kumari.net> From: Warren Kumari To: "opsec@ietf.org mailing list" Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Thu, 23 Dec 2010 15:22:22 -0500 References: <20101223193418.26547.34582.idtracker@localhost> X-Mailer: Apple Mail (2.936) Subject: [OPSEC] Fwd: ID Tracker State Update Notice: X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Dec 2010 20:20:24 -0000 Yet another congratulations (and thanks) is in order... So, our active queue is beginning to look very sparse... I have a draft that I started writing a while ago that Chris Morrow and Danny McPherson have agreed to fix / update (poke...), does anyone have anything else that they are working on? Please? W Begin forwarded message: > From: IETF Secretariat > Date: December 23, 2010 2:34:18 PM EST > To: opsec-chairs@tools.ietf.org, draft-ietf-opsec-protect-control-plane@tools.ietf.org > Subject: ID Tracker State Update Notice: control-plane-06.txt> > > State changed to RFC Ed Queue from Approved-announcement sent. > ID Tracker URL: http://datatracker.ietf.org/doc/draft-ietf-opsec-protect-control-plane/ -- "Real children don't go hoppity-skip unless they are on drugs." -- Susan, the ultimate sensible governess (Terry Pratchett, Hogfather) From joelja@bogus.com Thu Dec 23 15:08:40 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 66DBD3A68B5 for ; Thu, 23 Dec 2010 15:08:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.293 X-Spam-Level: X-Spam-Status: No, score=-102.293 tagged_above=-999 required=5 tests=[AWL=0.306, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mwcY8+0gV796 for ; Thu, 23 Dec 2010 15:08:39 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 68DA83A68B2 for ; Thu, 23 Dec 2010 15:08:39 -0800 (PST) Received: from joelja-mac.local (c-76-115-175-145.hsd1.wa.comcast.net [76.115.175.145]) (authenticated bits=0) by nagasaki.bogus.com (8.14.4/8.14.4) with ESMTP id oBNNAcDn000630 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 23 Dec 2010 23:10:39 GMT (envelope-from joelja@bogus.com) Message-ID: <4D13D69F.5080203@bogus.com> Date: Thu, 23 Dec 2010 15:09:19 -0800 From: Joel Jaeggli User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7 MIME-Version: 1.0 To: Warren Kumari References: <20101223193418.26547.34582.idtracker@localhost> <64E1A73D-2221-4035-8E77-79A6515A0DC3@kumari.net> In-Reply-To: <64E1A73D-2221-4035-8E77-79A6515A0DC3@kumari.net> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "opsec@ietf.org mailing list" Subject: Re: [OPSEC] Fwd: ID Tracker State Update Notice: X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Dec 2010 23:08:40 -0000 On 12/23/10 12:22 PM, Warren Kumari wrote: > Yet another congratulations (and thanks) is in order... > > So, our active queue is beginning to look very sparse... I have a draft > that I started writing a while ago that Chris Morrow and Danny McPherson > have agreed to fix / update (poke...), does anyone have anything else > that they are working on? The was productive discussion in the last few months on well know communities. There is intersting work that could be done there and some interested authors, I'd like to be able to go to privders myself and say what rfc foo cmmunities do you support and what's the mapping? joel > Please? > W > > Begin forwarded message: > >> From: IETF Secretariat >> Date: December 23, 2010 2:34:18 PM EST >> To: opsec-chairs@tools.ietf.org, >> draft-ietf-opsec-protect-control-plane@tools.ietf.org >> Subject: ID Tracker State Update Notice: >> >> >> State changed to RFC Ed Queue from Approved-announcement sent. >> ID Tracker URL: >> http://datatracker.ietf.org/doc/draft-ietf-opsec-protect-control-plane/ > > -- > "Real children don't go hoppity-skip unless they are on drugs." > > -- Susan, the ultimate sensible governess (Terry Pratchett, Hogfather) > > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec >