Subject: Re: [OPSEC] Fwd: ID Tracker State Update Notice: <draft-ietf-opsec-protect-control-plane-06.txt>

From: George Jones <[email-masked]>
Date: Tue, 4 Jan 2011 05:26:10 -0500

There were a couple of things banging around under the previous charter that
you
might want to revisit:   the capabilities (filtering, etc.) and testing.
The grand vision
(where RFC3871 came from) was the desire to be able to take gear into the
lab,
beat on it and say "yup, it can do FOO [logging, filtering,
authentication...]" or not.
I had some discussions with the benchmark working group about overlap.
They have a pretty well refined testing methodology.

---George Jones

On Thu, Dec 23, 2010 at 3:22 PM, Warren Kumari <[email-masked]> wrote:

> Yet another congratulations (and thanks) is in order...
>
> So, our active queue is beginning to look very sparse... I have a draft
> that I started writing a while ago that Chris Morrow and Danny McPherson
> have agreed to fix / update (poke...), does anyone have anything else that
> they are working on?
>
> Please?
> W
>
> Begin forwarded message:
>
>  From: IETF Secretariat <[email-masked]>
>> Date: December 23, 2010 2:34:18 PM EST
>> To: [email-masked],
>> [email-masked]
>> Subject: ID Tracker State Update Notice:
>> <draft-ietf-opsec-protect-control-plane-06.txt>
>>
>> State changed to RFC Ed Queue from Approved-announcement sent.
>> ID Tracker URL:
>> http://datatracker.ietf.org/doc/draft-ietf-opsec-protect-control-plane/
>>
>
> --
> "Real children don't go hoppity-skip unless they are on drugs."
>
>    -- Susan, the ultimate sensible governess (Terry Pratchett, Hogfather)
>
>
>
>
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
>

---

From: John Kristoff <[email-masked]>
Date: Tue, 4 Jan 2011 09:22:57 -0600

On Thu, 23 Dec 2010 15:22:22 -0500
Warren Kumari <[email-masked]> wrote:

> So, our active queue is beginning to look very sparse... I have a  
> draft that I started writing a while ago that Chris Morrow and Danny  
> McPherson have agreed to fix / update (poke...), does anyone have  
> anything else that they are working on?

I had started a port filtering draft.  A second revision has been
started, but we haven't spent much time on it lately.  I can endeavor
to get this work going again this week.

  <http://tools.ietf.org/html/draft-kristoff-opsec-port-filtering-00>

John

---

From: "Smith, Donald" <[email-masked]>
Date: Tue, 4 Jan 2011 09:04:59 -0700

I was thinking it might be worth while to write an rfc about testing cpp. It could be part of the control plane draft but I was considering it an additional draft.

(coffee != sleep) & (!coffee == sleep)
 [email-masked]<mailto:[email-masked]>

________________________________
From: [email-masked] [[email-masked]] On Behalf Of George Jones [[email-masked]]
Sent: Tuesday, January 04, 2011 3:26 AM
To: Warren Kumari
Cc: [email-masked] mailing list
Subject: Re: [OPSEC] Fwd: ID Tracker State Update Notice: <draft-ietf-opsec-protect-control-plane-06.txt>

There were a couple of things banging around under the previous charter that you
might want to revisit:   the capabilities (filtering, etc.) and testing.  The grand vision
(where RFC3871 came from) was the desire to be able to take gear into the lab,
beat on it and say "yup, it can do FOO [logging, filtering, authentication...]" or not.
I had some discussions with the benchmark working group about overlap.
They have a pretty well refined testing methodology.

---George Jones

On Thu, Dec 23, 2010 at 3:22 PM, Warren Kumari <[email-masked]<mailto:[email-masked]>> wrote:
Yet another congratulations (and thanks) is in order...

So, our active queue is beginning to look very sparse... I have a draft that I started writing a while ago that Chris Morrow and Danny McPherson have agreed to fix / update (poke...), does anyone have anything else that they are working on?

Please?
W

Begin forwarded message:

From: IETF Secretariat <[email-masked]<mailto:[email-masked]>>
Date: December 23, 2010 2:34:18 PM EST
To: [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>
Subject: ID Tracker State Update Notice: <draft-ietf-opsec-protect-control-plane-06.txt>

State changed to RFC Ed Queue from Approved-announcement sent.
ID Tracker URL: http://datatracker.ietf.org/doc/draft-ietf-opsec-protect-control-plane/

_______________________________________________
OPSEC mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/opsec

________________________________
This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful. If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.

---

From: George Jones <[email-masked]>
Date: Tue, 4 Jan 2011 18:33:47 -0500

>  <http://tools.ietf.org/html/draft-kristoff-opsec-port-filtering-00>

Looks like you were tackling the "what to filter and why" + gotchas.
Noble.  Useful.
But if the device just can't do it, not sufficient.

Again, what I had in mind was as series of docs that provide testable
security features,
possibly paired with a test methodology.

Before diving into any serious work, though, it would be worth asking the
question,
would anybody care/be positively impacted if the docs were finished.   Does
anybody
do this sort of testing?  Would they?   Would a list in the form of RFCs
help ?

----George Jones

---

From: Joel Jaeggli <[email-masked]>
Date: Tue, 04 Jan 2011 16:12:51 -0800

On 1/4/11 3:33 PM, George Jones wrote:
> 
> 
> On Tue, Jan 4, 2011 at 10:22 AM, John Kristoff <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>     Warren Kumari <[email-masked] <mailto:[email-masked]>> wrote:
> 

So another thought has to do with how port filtering is done, and
essentially this is a control plane policy exercise. If filtering a port
in an acl is less expensive than passing a packet up to the control
plane (where it ends up being discarded because there's no listening
service) do you win?

> Before diving into any serious work, though, it would be worth asking
> the question,
> would anybody care/be positively impacted if the docs were finished.  
> Does anybody

---

From: Fernando Gont <[email-masked]>
Date: Wed, 05 Jan 2011 19:17:33 -0300

Hi, Warren,

On 23/12/2010 05:22 p.m., Warren Kumari wrote:

> have agreed to fix / update (poke...), does anyone have anything else
> that they are working on?

I'm currently working on:

* a revision of draft-ietf-opsec-icmp-filtering (together with Carlos
Pignataro, Guillermo Gont, and Andrew Yourtchenko)
* a revision of draft-gont-opsec-ip-options-filtering (this one was
generated upong request from Ron at the Hiroshima IETF)
* a revision of draft-kristoff-opsec-port-filtering (as already
indicated by John)

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Christopher Morrow <[email-masked]>
Date: Wed, 5 Jan 2011 20:48:46 -0500

>  <http://tools.ietf.org/html/draft-kristoff-opsec-port-filtering-00>

I hate to a) sign up for work, b) beat a horsey carcass, but... there
is/was a filtering capabilities draft that made it to IESG review,
then the author(s) (me mostly) ran out of time to work on it. I can
dust that off, re-submit it and get the comments addressed if it'd
help?

-Chris
(I happen to believe in the purpose/need for the draft, but a job
change and work took away ietf time from me)

---

From: Jared Mauch <[email-masked]>
Date: Wed, 5 Jan 2011 21:37:35 -0500

> change and work took away ietf time from me)

Not that I want more work either, but John, Warren and Chris, you can always count on me to read/comment with unicast mail.

- Jared

---

From: Ronald Bonica <[email-masked]>
Date: Thu, 6 Jan 2011 15:41:12 -0500

Response inline......

From: [email-masked] [mailto:[email-masked]] On Behalf Of George Jones
Sent: Tuesday, January 04, 2011 6:34 PM
To: John Kristoff
Cc: [email-masked] mailing list; Warren Kumari
Subject: Re: [OPSEC] Fwd: ID Tracker State Update Notice: <draft-ietf-opsec-protect-control-plane-06.txt>

On Tue, Jan 4, 2011 at 10:22 AM, John Kristoff <[email-masked]<mailto:[email-masked]>> wrote:
On Thu, 23 Dec 2010 15:22:22 -0500

This is very important work! Please continue.

Looks like you were tackling the "what to filter and why" + gotchas.   Noble.  Useful.
But if the device just can't do it, not sufficient.

I recommend that you continue on these lines. If the device can't fulfill you requirements, maybe the RFC will motivate the vendors to enhance the device's filtering capabilities.

Again, what I had in mind was as series of docs that provide testable security features,
possibly paired with a test methodology.

Before diving into any serious work, though, it would be worth asking the question,
would anybody care/be positively impacted if the docs were finished.

I believe that this would be helpful both to the operator and vendor communities, New operators would learn what to filter. Application and protocol developers would learn what is likely to be filtered.

                           Ron

Does anybody
do this sort of testing?  Would they?   Would a list in the form of RFCs help ?

----George Jones

---

From: "Smith, Donald" <[email-masked]>
Date: Thu, 6 Jan 2011 22:43:23 -0700

We do that kind of testing:)
Testing methods and practices are nearly forgotten amongst many shops today but we still find enough to do fairly through testing (and reap the benefits of it:)

________________________________
From: [email-masked] [[email-masked]] On Behalf Of Ronald Bonica [[email-masked]]
Sent: Thursday, January 06, 2011 1:41 PM
To: George Jones; John Kristoff
Cc: [email-masked] mailing list; Warren Kumari
Subject: Re: [OPSEC] Fwd: ID Tracker State Update Notice: <draft-ietf-opsec-protect-control-plane-06.txt>

Response inline……

I recommend that you continue on these lines. If the device can’t fulfill you requirements, maybe the RFC will motivate the vendors to enhance the device’s filtering capabilities.

                           Ron

Does anybody

----George Jones

---

From: George Jones <[email-masked]>
Date: Fri, 7 Jan 2011 08:40:33 -0500

On Fri, Jan 7, 2011 at 12:43 AM, Smith, Donald <[email-masked]>
 wrote:

> Testing methods and practices are nearly forgotten amongst many shops today
> but we still find enough to do fairly through testing (and reap the benefits
> of it:)
>

Then do you care to comment on what forms of docs would be helpful?

Does anyone else on the list (or that people on the list know) do testing ?

---George

---

From: George Jones <[email-masked]>
Date: Fri, 7 Jan 2011 08:47:09 -0500

On Thu, Jan 6, 2011 at 3:41 PM, Ronald Bonica <[email-masked]> wrote:

>  has been
> I believe that this would be helpful both to the operator and vendor
> communities, New operators would learn what to filter. Application and
> protocol developers would learn what is likely to be filtered.
>
>
>

I'm just thinking that if we spin up capability drafts ("the device
is capable of ....") it would be useful
to have a common rational/list of motivators ("help in testing", etc.) and
possibly a common format.

Before we run off an write/finish a bunch of drafts I think we (the WG
Chairs/ADs/WG members)
should at least have that discussion so that we can say why we're writing
drafts and how
we anticipate them being useful.

---George Jones

---

From: "Smith, Donald" <[email-masked]>
Date: Fri, 7 Jan 2011 06:59:13 -0700

I have always thought a set of test cases that could be reformatted/used by others but with standard test elements.
Pre condition, post conditions/expectations, tool,  parameters,  requirement your testing against,, rfc or other bcp that your testing towards etc...

You could take 3871 as the base requirement and give examples/samples of how to test each element of that bcp.

We have a set of these for our mgmt plane testing using opensource tools which is loosely based on rfc3871.

________________________________
From: George Jones [[email-masked]]
Sent: Friday, January 07, 2011 6:40 AM
To: Smith, Donald
Cc: Ronald Bonica; John Kristoff; [email-masked] mailing list; Warren Kumari
Subject: Re: [OPSEC] Fwd: ID Tracker State Update Notice: <draft-ietf-opsec-protect-control-plane-06.txt>

On Fri, Jan 7, 2011 at 12:43 AM, Smith, Donald <[email-masked]<mailto:[email-masked]>> wrote:
We do that kind of testing:)
Testing methods and practices are nearly forgotten amongst many shops today but we still find enough to do fairly through testing (and reap the benefits of it:)

---George

---

From: Warren Kumari <[email-masked]>
Date: Sat, 8 Jan 2011 20:53:11 -0500

On Jan 5, 2011, at 8:48 PM, Christopher Morrow wrote:

>>> McPherson have agreed to fix / update (poke...),

Poke again :-P

>>> does anyone have

Yah, I remember this doc, and think that it would be great if you  
could resurrect it. AFAIR there was not much that needed doing to make  
it happy...

> change and work took away ietf time from me)

Make you a deal -- I'll bring you an espresso for each rev of a draft  
you submit... And try harder to keep my headphones on....

---

From: Joel Jaeggli <[email-masked]>
Date: Sat, 08 Jan 2011 20:04:39 -0800

> dust that off, re-submit it and get the comments addressed if it'd

speaking as the guy who removed the caps documents from the charter. I
think there was a lack of stomach for the work that would have taken a
completed capabiliteis document and matched it with a product
development cycle and produced the router/firewall etc...

That said operational recomendations on port filtering sounds like a
worthwhile activity.