From nobody Mon Mar 2 21:20:48 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6C3D1A007A for ; Mon, 2 Mar 2015 21:20:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.111 X-Spam-Level: X-Spam-Status: No, score=-1.111 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779, T_HDRS_LCASE=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V5Bvk3EMY-UG for ; Mon, 2 Mar 2015 21:20:46 -0800 (PST) Received: from shell4.bayarea.net (shell4.bayarea.net [209.128.82.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EB051A0095 for ; Mon, 2 Mar 2015 21:20:43 -0800 (PST) Received: (qmail 12379 invoked from network); 2 Mar 2015 21:19:48 -0800 Received: from shell4.bayarea.net (209.128.82.1) by shell4.bayarea.net with (DHE-RSA-AES256-SHA encrypted) SMTP; 2 Mar 2015 21:19:48 -0800 Date: Mon, 2 Mar 2015 21:19:48 -0800 (PST) From: "C. M. Heard" X-X-Sender: heard@shell4.bayarea.net To: opsec@ietf.org, draft-ietf-opsec-dhcpv6-shield@ietf.org, draft-ietf-opsec-dhcpv6-shield.ad@ietf.org, draft-ietf-opsec-dhcpv6-shield.shepherd@ietf.org, kk.chittimaneni@gmail.com, opsec-chairs@ietf.org, brian.e.carpenter@gmail.com, joelja@bogus.com, ted.lemon@nominum.com, alissa@cooperw.in Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Archived-At: Cc: presnick@qti.qualcomm.com Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-dhcpv6-shield-06.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Mar 2015 05:20:47 -0000 Greetings, Unless I missed something, it seems that a vital porrtion of the text of Section 5 was dropped in going from -05 to -06. One possible fix would be to reinstate it as follows: OLD: 4. In all other cases, DHCPv6-Shield MUST pass the packet as usual. NEW: 4. When parsing the IPv6 header chain, if the packet is identified to be a DHCPv6 packet meant for a DHCPv6 client, DHCPv6-Shield MUST drop the packet, and ought to log the packet drop event in an implementation-specific manner as a security alert. 5. In all other cases, DHCPv6-Shield MUST pass the packet as usual. END. Thanks, Mike Heard On Wed, 25 Feb 2015, internet-drafts@ietf.org wrote: > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. > > Title : DHCPv6-Shield: Protecting Against Rogue DHCPv6 Servers > Authors : Fernando Gont > Will Liu > Gunter Van de Velde > Filename : draft-ietf-opsec-dhcpv6-shield-06.txt > Pages : 10 > Date : 2015-02-25 > > Abstract: > This document specifies a mechanism for protecting hosts connected to > a switched network against rogue DHCPv6 servers. It is based on > DHCPv6 packet-filtering at the layer-2 device at which the packets > are received. A similar mechanism has been widely deployed in IPv4 > networks ('DHCP snooping'), and hence it is desirable that similar > functionality be provided for IPv6 networks. This document specifies > a Best Current Practice for the implementation of DHCPv6 Shield. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-opsec-dhcpv6-shield/ > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-opsec-dhcpv6-shield-06 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-dhcpv6-shield-06 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > From nobody Sat Mar 7 09:17:05 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C025C1A00E7 for ; Sat, 7 Mar 2015 09:17:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.701 X-Spam-Level: X-Spam-Status: No, score=-0.701 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7KXer1KZEo2K for ; Sat, 7 Mar 2015 09:17:00 -0800 (PST) Received: from st13p11im-asmtp002.me.com (st13p11im-asmtp002.me.com [17.164.40.161]) (using TLSv1.2 with cipher DHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65DAA1A00C5 for ; Sat, 7 Mar 2015 09:17:00 -0800 (PST) Received: from [192.168.1.14] (251.174-131-109.adsl-dyn.isp.belgacom.be [109.131.174.251]) by st13p11im-asmtp002.me.com (Oracle Communications Messaging Server 7.0.5.35.0 64bit (built Dec 4 2014)) with ESMTPSA id <0NKU005U6QLL9X50@st13p11im-asmtp002.me.com> for opsec@ietf.org; Sat, 07 Mar 2015 17:15:24 +0000 (GMT) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.13.68,1.0.33,0.0.0000 definitions=2015-03-07_02:2015-03-06,2015-03-07,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=5 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1412110000 definitions=main-1503070186 From: Gunter Van De Velde Content-type: multipart/alternative; boundary="Apple-Mail=_F80B4BC7-A906-48C3-B642-5ACD6CCBB709" Date: Sat, 07 Mar 2015 18:16:55 +0100 Message-id: To: opsec@ietf.org MIME-version: 1.0 (Mac OS X Mail 8.2 \(2070.6\)) X-Mailer: Apple Mail (2.2070.6) Archived-At: Cc: opsec chairs Subject: [OPSEC] OPSEC IETF 92 - Call for Agenda Items X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Mar 2015 17:17:01 -0000 --Apple-Mail=_F80B4BC7-A906-48C3-B642-5ACD6CCBB709 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Dear All, If you have a draft you would like to discuss during IETF 92, please = send your request for agenda time to the opsec chairs. Please include in = the request, the title and file name of the draft, the speaker's name, = and how much time you would need. We have one hour allocated to our = session. We will prioritize drafts that are WG items, drafts that have been = actively discussed on the list, and other individual submissions in that = order. Regards, Gunter, KK= --Apple-Mail=_F80B4BC7-A906-48C3-B642-5ACD6CCBB709 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Dear = All,

If you = have a draft you would like to discuss during IETF 92, please send your = request for agenda time to the opsec chairs. Please include in the = request, the title and file name of the draft, the speaker's name, and = how much time you would need. We have one hour allocated to our = session.

We will = prioritize drafts that are WG items, drafts that have been actively = discussed on the list, and other individual submissions in that = order.

Regards,
Gunter, = KK= --Apple-Mail=_F80B4BC7-A906-48C3-B642-5ACD6CCBB709-- From nobody Mon Mar 9 04:07:27 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65E561A87AF; Mon, 9 Mar 2015 04:07:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WrkmniaQZxcn; Mon, 9 Mar 2015 04:07:23 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D1191A87EB; Mon, 9 Mar 2015 04:07:22 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 5.12.0.p3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150309110722.2150.57623.idtracker@ietfa.amsl.com> Date: Mon, 09 Mar 2015 04:07:22 -0700 Archived-At: Cc: opsec@ietf.org Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-06.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2015 11:07:25 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Kiran K. Chittimaneni Merike Kaeo Eric Vyncke Filename : draft-ietf-opsec-v6-06.txt Pages : 41 Date : 2015-03-09 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in all places of a network (service providers, enterprises and residential users) and proposes technical and procedural mitigations techniques. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-opsec-v6-06 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sat Mar 14 11:23:56 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C9821A00C8; Sat, 14 Mar 2015 11:23:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.31 X-Spam-Level: X-Spam-Status: No, score=-1.31 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_32=0.6, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EkOsBU0zrtuZ; Sat, 14 Mar 2015 11:23:38 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA73A1A0111; Sat, 14 Mar 2015 11:23:37 -0700 (PDT) Received: from mb-aye.local (c-98-248-47-249.hsd1.ca.comcast.net [98.248.47.249]) (authenticated bits=0) by nagasaki.bogus.com (8.14.9/8.14.9) with ESMTP id t2EINQQ5093762 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Sat, 14 Mar 2015 18:23:27 GMT (envelope-from joelja@bogus.com) Message-ID: <55047C99.9060502@bogus.com> Date: Sat, 14 Mar 2015 11:23:21 -0700 From: joel jaeggli User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0) Gecko/20100101 Thunderbird/36.0 MIME-Version: 1.0 To: "MORTON, ALFRED C (AL)" , "bmwg@ietf.org" , "opsec@ietf.org" References: <4AF73AA205019A4C8A1DDD32C034631D89857D7D@NJFPSRVEXG0.research.att.com> <4AF73AA205019A4C8A1DDD32C034631D8B75A480@NJFPSRVEXG0.research.att.com> <4AF73AA205019A4C8A1DDD32C034631D8B75A5BD@NJFPSRVEXG0.research.att.com> In-Reply-To: <4AF73AA205019A4C8A1DDD32C034631D8B75A5BD@NJFPSRVEXG0.research.att.com> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="xJxW6u74ssq3l2i9wJMwnuxgcqJMcHbLr" Archived-At: Cc: "gunter@vandevelde.cc" Subject: Re: [OPSEC] [bmwg] FW: WG ADOPTION: draft-cerveny-bmwg-ipv6-nd- X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Mar 2015 18:23:39 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --xJxW6u74ssq3l2i9wJMwnuxgcqJMcHbLr Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable As an author on one the the docs that motivated this work I am interested in when and how ND implementations go kaboom. On 3/12/15 8:53 AM, MORTON, ALFRED C (AL) wrote: > Cross-posting to opsec, > Al > bmwg co-chair >=20 >> -----Original Message----- >> From: bmwg [mailto:bmwg-bounces@ietf.org] On Behalf Of MORTON, ALFRED = C >> (AL) >> Sent: Wednesday, March 11, 2015 1:55 PM >> To: bmwg@ietf.org >> Subject: Re: [bmwg] WG ADOPTION: draft-cerveny-bmwg-ipv6-nd- >> >> >> REMINDER: >> >>> -----Original Message----- >>> From: bmwg [mailto:bmwg-bounces@ietf.org] On Behalf Of MORTON, ALFRED= C >>> (AL) >>> Sent: Tuesday, March 03, 2015 3:20 PM >>> To: bmwg@ietf.org >>> Subject: [bmwg] WG ADOPTION: draft-cerveny-bmwg-ipv6-nd- >>> >>> >>> BMWG, >>> >>> We've been discussing a draft for Benchmarking Neighbor Discovery >>> for some time. >>> >>> Our new charter includes IPv6ND, so we ask >>> everyone to take a look (by March 18th) >>> and express comments/support. >>> >>> The latest draft is here: >>> https://tools.ietf.org/html/draft-cerveny-bmwg-ipv6-nd-06 >>> >>> regards, >>> Al >>> bmwg co-chair >>> >>> >>> >>> _______________________________________________ >>> bmwg mailing list >>> bmwg@ietf.org >>> https://www.ietf.org/mailman/listinfo/bmwg >> >> _______________________________________________ >> bmwg mailing list >> bmwg@ietf.org >> https://www.ietf.org/mailman/listinfo/bmwg >=20 > _______________________________________________ > bmwg mailing list > bmwg@ietf.org > https://www.ietf.org/mailman/listinfo/bmwg >=20 --xJxW6u74ssq3l2i9wJMwnuxgcqJMcHbLr Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlUEfJkACgkQ8AA1q7Z/VrLLTQCfRk/IvQma6BrLqoQfBrjbzmt2 gbgAn1PL5mCEebGdJjUHRxjDqhpL+ZZ0 =AebM -----END PGP SIGNATURE----- --xJxW6u74ssq3l2i9wJMwnuxgcqJMcHbLr-- From nobody Sat Mar 14 12:25:24 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A8D71A8787; Thu, 12 Mar 2015 08:53:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.611 X-Spam-Level: X-Spam-Status: No, score=-3.611 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_32=0.6, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lwsVCodm37Bi; Thu, 12 Mar 2015 08:53:53 -0700 (PDT) Received: from mail-pink.research.att.com (mail-pink.research.att.com [204.178.8.22]) by ietfa.amsl.com (Postfix) with ESMTP id 35E4F1A8775; Thu, 12 Mar 2015 08:53:53 -0700 (PDT) Received: from mail-blue.research.att.com (unknown [135.207.178.11]) by mail-pink.research.att.com (Postfix) with ESMTP id BE557120268; Thu, 12 Mar 2015 12:10:25 -0400 (EDT) Received: from exchange.research.att.com (njfpsrvexg0.research.att.com [135.207.240.40]) by mail-blue.research.att.com (Postfix) with ESMTP id F27A9EF6F5; Thu, 12 Mar 2015 11:53:51 -0400 (EDT) Received: from NJFPSRVEXG0.research.att.com ([fe80::c5dd:2310:7197:58ea]) by NJFPSRVEXG0.research.att.com ([fe80::c5dd:2310:7197:58ea%17]) with mapi; Thu, 12 Mar 2015 11:53:51 -0400 From: "MORTON, ALFRED C (AL)" To: "bmwg@ietf.org" , "opsec@ietf.org" Date: Thu, 12 Mar 2015 11:53:50 -0400 Thread-Topic: WG ADOPTION: draft-cerveny-bmwg-ipv6-nd- Thread-Index: AdBV7zgUqLhfy+E7RnWuBeIJ3lDSSwGNSikQAC4H1aA= Message-ID: <4AF73AA205019A4C8A1DDD32C034631D8B75A5BD@NJFPSRVEXG0.research.att.com> References: <4AF73AA205019A4C8A1DDD32C034631D89857D7D@NJFPSRVEXG0.research.att.com> <4AF73AA205019A4C8A1DDD32C034631D8B75A480@NJFPSRVEXG0.research.att.com> In-Reply-To: <4AF73AA205019A4C8A1DDD32C034631D8B75A480@NJFPSRVEXG0.research.att.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: X-Mailman-Approved-At: Sat, 14 Mar 2015 12:25:22 -0700 Cc: "gunter@vandevelde.cc" Subject: [OPSEC] FW: WG ADOPTION: draft-cerveny-bmwg-ipv6-nd- X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Mar 2015 15:53:56 -0000 Cross-posting to opsec, Al bmwg co-chair > -----Original Message----- > From: bmwg [mailto:bmwg-bounces@ietf.org] On Behalf Of MORTON, ALFRED C > (AL) > Sent: Wednesday, March 11, 2015 1:55 PM > To: bmwg@ietf.org > Subject: Re: [bmwg] WG ADOPTION: draft-cerveny-bmwg-ipv6-nd- >=20 >=20 > REMINDER: >=20 > > -----Original Message----- > > From: bmwg [mailto:bmwg-bounces@ietf.org] On Behalf Of MORTON, ALFRED C > > (AL) > > Sent: Tuesday, March 03, 2015 3:20 PM > > To: bmwg@ietf.org > > Subject: [bmwg] WG ADOPTION: draft-cerveny-bmwg-ipv6-nd- > > > > > > BMWG, > > > > We've been discussing a draft for Benchmarking Neighbor Discovery > > for some time. > > > > Our new charter includes IPv6ND, so we ask > > everyone to take a look (by March 18th) > > and express comments/support. > > > > The latest draft is here: > > https://tools.ietf.org/html/draft-cerveny-bmwg-ipv6-nd-06 > > > > regards, > > Al > > bmwg co-chair > > > > > > > > _______________________________________________ > > bmwg mailing list > > bmwg@ietf.org > > https://www.ietf.org/mailman/listinfo/bmwg >=20 > _______________________________________________ > bmwg mailing list > bmwg@ietf.org > https://www.ietf.org/mailman/listinfo/bmwg From nobody Wed Mar 18 10:39:17 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FA581A003B; Wed, 18 Mar 2015 10:39:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jjQm1CXo2rTk; Wed, 18 Mar 2015 10:39:13 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2FA11A87D1; Wed, 18 Mar 2015 10:39:07 -0700 (PDT) Received: from mb-aye.local (64.125.197.170.IPYX-102339-ZYO.zip.zayo.com [64.125.197.170] (may be forged)) (authenticated bits=0) by nagasaki.bogus.com (8.14.9/8.14.9) with ESMTP id t2IHcwpX034413 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Wed, 18 Mar 2015 17:38:59 GMT (envelope-from joelja@bogus.com) Message-ID: <5509B82E.9070108@bogus.com> Date: Wed, 18 Mar 2015 10:38:54 -0700 From: joel jaeggli User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0) Gecko/20100101 Thunderbird/36.0 MIME-Version: 1.0 To: Ted Lemon , Fernando Gont References: <20150207194616.20651.30892.idtracker@ietfa.amsl.com> <97C8D14E-D440-4625-8F26-83AF26917CF2@nominum.com> <54D83E7F.3040207@gmail.com> <54D83FCE.4070804@qti.qualcomm.com> <96CE509D-3B6E-49B8-98F6-CB8581787D7E@nominum.com> <174AA530-3993-4894-BCE7-2AE8818EB35E@nominum.com> <54D8F98D.1030101@si6networks.com> <54D90EE5.2060002@gmail.com> <5C9CF492-A795-4023-BB91-28B1B52706E4@nominum.com> <54D92987.2080505@gmail.com> <54D98F62.4080508@bogus.com> <54DA500C.5070908@si6networks.com> In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="deCWPQXaTIpTDuVGggtBwSBGsDWqJWsJp" Archived-At: Cc: "draft-ietf-opsec-dhcpv6-shield@ietf.org" , "C. M. Heard" , Pete Resnick , "opsec@ietf.org" , "draft-ietf-opsec-dhcpv6-shield.ad@ietf.org" , "draft-ietf-opsec-dhcpv6-shield.shepherd@ietf.org" , The IESG , "opsec-chairs@ietf.org" , Brian E Carpenter Subject: [OPSEC] Revisting Re: Ted Lemon's Discuss on draft-ietf-opsec-dhcpv6-shield-05: (with DISCUSS and COMMENT) (now 06) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Mar 2015 17:39:15 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --deCWPQXaTIpTDuVGggtBwSBGsDWqJWsJp Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 2/10/15 12:49 PM, Ted Lemon wrote: > On Feb 10, 2015, at 1:38 PM, Fernando Gont > wrote: >> Not sure what the "(as opposed to an extension header)" means. >> Could you elaborate/clarify a bit? >=20 > What I'm proposing is that unknown codes can be assumed to be > extension headers. Any known code may be either an extension header > or a protocol header, but then it's a known code, so not a problem. > But rereading the text, that parenthetical does seem unnecessary. >=20 > Anyway, it sounds like we now have some text to argue about that we > might be able to agree on, so I will defer to you on tweaking it--I > just wanted to give you a sense of what I had in mind. The main > thing I want to avoid is a recommendation that the basic shield > algorithm by default drop unknown extension and transport headers, > but I agree that it's good to say what to do if the hardware can't > support that fully. We got a new version of this draft on 2/25 which I kinda of lost track of in the midst of two IESG review calls. http://tools.ietf.org/rfcdiff?difftype=3D--hwdiff&url2=3Ddraft-ietf-opsec= -dhcpv6-shield-06.txt It stops short of my interpretation of Ted's position, with the reordered and clarified test in section 3. the new explanatory text in in the security considerations: The recommendations in this document represent the ideal behavior of a DHCPv6 shield device. However, in order to implement DHCPv6 shield on the fast path, it may be necessary to limit the depth into the packet that can be scanned before giving up. In circumstances where there is such a limitation, it is recommended that implementations drop packets after attempting to find a protocol header up to that limit, whatever it is. Ideally, such devices should be configurable with a list of protocol header identifiers so that if new transport protocols are standardized after the device is released, they can be added to the list of protocol header types that the device recognizes. Since any protocol header that is not a UDP header would be passed by the DHCPv6 shield algorithm, this would allow such devices to avoid blocking the use of new transport protocols. When an implementation must stop searching for recognizable header types in a packet due to such limitations, whether the device passes or drop that packet SHOULD be configurable. --deCWPQXaTIpTDuVGggtBwSBGsDWqJWsJp Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlUJuC4ACgkQ8AA1q7Z/VrKGYwCfSQk/fgewwy501UsS/3AEyVZC JS0AoIDi/x/UvdPYvTHmxT7ZR76gl/Mi =KrYg -----END PGP SIGNATURE----- --deCWPQXaTIpTDuVGggtBwSBGsDWqJWsJp-- From nobody Wed Mar 18 14:31:20 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B3741A90EC for ; Wed, 18 Mar 2015 14:31:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.121 X-Spam-Level: X-Spam-Status: No, score=-1.121 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cDjKNOF8UX2w for ; Wed, 18 Mar 2015 14:31:14 -0700 (PDT) Received: from shell4.bayarea.net (shell4.bayarea.net [209.128.82.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C48781A90E9 for ; Wed, 18 Mar 2015 14:31:14 -0700 (PDT) Received: (qmail 7115 invoked from network); 18 Mar 2015 14:26:38 -0700 Received: from shell4.bayarea.net (209.128.82.1) by shell4.bayarea.net with (DHE-RSA-AES256-SHA encrypted) SMTP; 18 Mar 2015 14:26:38 -0700 Date: Wed, 18 Mar 2015 14:26:38 -0700 (PDT) From: "C. M. Heard" X-X-Sender: heard@shell4.bayarea.net To: joel jaeggli In-Reply-To: <5509B82E.9070108@bogus.com> Message-ID: References: <20150207194616.20651.30892.idtracker@ietfa.amsl.com> <54D83E7F.3040207@gmail.com> <54D83FCE.4070804@qti.qualcomm.com> <96CE509D-3B6E-49B8-98F6-CB8581787D7E@nominum.com> <174AA530-3993-4894-BCE7-2AE8818EB35E@nominum.com> <54D8F98D.1030101@si6networks.com> <54D90EE5.2060002@gmail.com> <5C9CF492-A795-4023-BB91-28B1B52706E4@nominum.com> <54D92987.2080505@gmail.com> <54D98F62.4080508@bogus.com> <54DA500C.5070908@si6networks.com> <5509B82E.9070108@bogus.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Archived-At: Cc: "draft-ietf-opsec-dhcpv6-shield@ietf.org" , Pete Resnick , "opsec@ietf.org" , "draft-ietf-opsec-dhcpv6-shield.ad@ietf.org" , "draft-ietf-opsec-dhcpv6-shield.shepherd@ietf.org" , Ted Lemon , Fernando Gont , "opsec-chairs@ietf.org" , Brian E Carpenter , The IESG Subject: Re: [OPSEC] Revisting Re: Ted Lemon's Discuss on draft-ietf-opsec-dhcpv6-shield-05: (with DISCUSS and COMMENT) (now 06) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Mar 2015 21:31:18 -0000 On Wed, 18 Mar 2015, joel jaeggli wrote: > We got a new version of this draft on 2/25 which I kinda of lost track > of in the midst of two IESG review calls. > > http://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-opsec-dhcpv6-shield-06.txt > > It stops short of my interpretation of Ted's position, with the > reordered and clarified test in section 3. The text in Section 3 seems to have dropped the step saying that if the packet is identified to be a DHCPv6 packet meant for a DHCPv6 client then DHCPv6-Shield MUST drop the packet. The new explanatory text in the security considerations looks good to me. //cmh From nobody Sun Mar 22 08:10:37 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE6081AC3AB; Sun, 22 Mar 2015 08:10:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DYFSduPwaqeg; Sun, 22 Mar 2015 08:10:28 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DFB961A92EC; Sun, 22 Mar 2015 08:10:28 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 5.12.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150322151028.7831.16878.idtracker@ietfa.amsl.com> Date: Sun, 22 Mar 2015 08:10:28 -0700 Archived-At: Cc: opsec@ietf.org Subject: [OPSEC] I-D Action: draft-ietf-opsec-ipv6-eh-filtering-00.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Mar 2015 15:10:34 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Recommendations on Filtering of IPv6 Packets Containing IPv6 Extension Headers Authors : Fernando Gont Will(Shucheng) Liu Ronald P. Bonica Filename : draft-ietf-opsec-ipv6-eh-filtering-00.txt Pages : 31 Date : 2015-03-09 Abstract: It is common operator practice to mitigate security risks by enforcing appropriate packet filtering. This document analyzes both the general security implications of IPv6 Extension Headers and the specific security implications of each Extension Header and Option type, and provides advice on the filtering of IPv6 packets based on the IPv6 Extension Headers and the IPv6 options they contain. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Mar 25 08:29:07 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A8671A887C for ; Wed, 25 Mar 2015 08:29:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OrCEpEbIfEYa for ; Wed, 25 Mar 2015 08:28:57 -0700 (PDT) Received: from st13p11im-asmtp001.me.com (st13p11im-asmtp001.me.com [17.164.40.160]) (using TLSv1.2 with cipher DHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9B481A87D1 for ; Wed, 25 Mar 2015 08:28:57 -0700 (PDT) Received: from dhcp-b67c.meeting.ietf.org (dhcp-b67c.meeting.ietf.org [31.133.182.124]) by st13p11im-asmtp001.me.com (Oracle Communications Messaging Server 7.0.5.35.0 64bit (built Dec 4 2014)) with ESMTPSA id <0NLR004W0XMOOJ40@st13p11im-asmtp001.me.com> for opsec@ietf.org; Wed, 25 Mar 2015 15:28:02 +0000 (GMT) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.13.68,1.0.33,0.0.0000 definitions=2015-03-25_05:2015-03-25,2015-03-25,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=1 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1412110000 definitions=main-1503250146 From: Gunter Van De Velde Content-type: text/plain; charset=us-ascii Content-transfer-encoding: quoted-printable Date: Wed, 25 Mar 2015 16:30:24 +0100 Message-id: <9B0BFCB9-C686-4B22-A1AA-F7992B5AB416@icloud.com> To: opsec@ietf.org MIME-version: 1.0 (Mac OS X Mail 8.2 \(2070.6\)) X-Mailer: Apple Mail (2.2070.6) Archived-At: Cc: "Kiran K. Chittimaneni" Subject: [OPSEC] IETF92 OPSEC WG - Call for volunteers - taking notes or scribe X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Mar 2015 15:29:03 -0000 Dear All, This is a call for volunteers for the OPSEC WG meeting at IETF92. Please let me know if you are willing to volunteer to take notes or to = be scribe. Brgds, G/= From nobody Wed Mar 25 12:26:38 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ACBC1A0379 for ; Wed, 25 Mar 2015 12:26:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S80RjLwlhwkV for ; Wed, 25 Mar 2015 12:26:34 -0700 (PDT) Received: from web01.jbserver.net (web01.jbserver.net [IPv6:2a00:8240:6:a::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08C4D1A6EFB for ; Wed, 25 Mar 2015 12:26:34 -0700 (PDT) Received: from cl-1071.udi-01.br.sixxs.net ([2001:1291:200:42e::2]) by web01.jbserver.net with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.85) (envelope-from ) id 1Yaqwg-0004ur-6V; Wed, 25 Mar 2015 20:26:31 +0100 Message-ID: <55130BD9.4090900@si6networks.com> Date: Wed, 25 Mar 2015 14:26:17 -0500 From: Fernando Gont User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: Gunter Van De Velde , opsec@ietf.org References: <9B0BFCB9-C686-4B22-A1AA-F7992B5AB416@icloud.com> In-Reply-To: <9B0BFCB9-C686-4B22-A1AA-F7992B5AB416@icloud.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Cc: "Kiran K. Chittimaneni" Subject: Re: [OPSEC] IETF92 OPSEC WG - Call for volunteers - taking notes or scribe X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Mar 2015 19:26:36 -0000 Hi, Gunter, I can do minutes off-line (from the audio/meetecho recordings) if that's of help. Thanks! Fernando On 03/25/2015 10:30 AM, Gunter Van De Velde wrote: > Dear All, > > This is a call for volunteers for the OPSEC WG meeting at IETF92. > > Please let me know if you are willing to volunteer to take notes or to be scribe. > > Brgds, > G/ > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492