From nobody Wed Oct 4 06:12:11 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CD8813213D; Wed, 4 Oct 2017 06:12:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.089 X-Spam-Level: X-Spam-Status: No, score=-0.089 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=strayalpha.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wII31WGWWiUj; Wed, 4 Oct 2017 06:12:08 -0700 (PDT) Received: from server217-3.web-hosting.com (server217-3.web-hosting.com [198.54.115.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F14A126B6E; Wed, 4 Oct 2017 06:12:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=strayalpha.com; s=default; h=Content-Type:In-Reply-To:MIME-Version:Date: Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=TRhrqgs31pF2Jz9x2O4LAbHFzsk7A8Eux57V5BQK49M=; b=QUb9ftKl/pXIG+MwA5IC6nuMn 5pHmAO88HCndcslt+t9it8ivYI24Vhfblp6r26lMtJDCPZtuVPoVYvJvqO4UdZ0y0is5VWsnLSaLb mAHloXLyYB/egRh2xsmoXhImZWYULjQNzF41Z/4FzFmqDiVz/tW8d7pIyOc64jFr+2jtaw71Snjyk JxX+jd0P07EdPwLayCIkk2SeWZVydHfZcWH83lrcwAPHpeWdr5i8ubbtIMeF+NibnfrBexd0e/6Ne DCJMYIK1SnDryVzhIVKlSUgwS5sXfT1D9zI0o7gZvTuBC2qF/MEpatKK33TJZzrt2PPKUKrIIN1kT 6BHmuCV4A==; Received: from cpe-172-250-240-132.socal.res.rr.com ([172.250.240.132]:51406 helo=[192.168.1.189]) by server217.web-hosting.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.87) (envelope-from ) id 1dzjT4-003JZI-Rz; Wed, 04 Oct 2017 09:12:07 -0400 To: "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" Cc: "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> From: Joe Touch Message-ID: Date: Wed, 4 Oct 2017 06:12:03 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> Content-Type: multipart/alternative; boundary="------------C5F3DDB25C79B6C3CFC7EBD2" Content-Language: en-US X-OutGoing-Spam-Status: No, score=-1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server217.web-hosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - strayalpha.com X-Get-Message-Sender-Via: server217.web-hosting.com: authenticated_id: touch@strayalpha.com X-Authenticated-Sender: server217.web-hosting.com: touch@strayalpha.com X-Source: X-Source-Args: X-Source-Dir: X-From-Rewrite: unmodified, already matched Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Oct 2017 13:12:10 -0000 This is a multi-part message in MIME format. --------------C5F3DDB25C79B6C3CFC7EBD2 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote: > > This is to open a two week WGLC > for https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03. > I do not agree with the claims of this document. It "informationally" advises against support for key IPv6 capabilities and undermines the extensibility of IPv6 by making recommendations about discarding currently unassigned codepoints. This is an overstep for an OPS group, IMO. Additionally, it refers to RFC2119 without taking care to capitalize those keywords where used or to provide specific examples where recommendations contradict existing Internet standards or are not definitive (e.g., SHOULDs). I don't think this document is ready in any way. Joe --------------C5F3DDB25C79B6C3CFC7EBD2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit



On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote:

This is to open a two week WGLC for https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03.


I do not agree with the claims of this document. It "informationally" advises against support for key IPv6 capabilities and undermines the extensibility of IPv6 by making recommendations about discarding currently unassigned codepoints.

This is an overstep for an OPS group, IMO.

Additionally, it refers to RFC2119 without taking care to capitalize those keywords where used or to provide specific examples where recommendations contradict existing Internet standards or are not definitive (e.g., SHOULDs).

I don't think this document is ready in any way.

Joe

--------------C5F3DDB25C79B6C3CFC7EBD2-- From nobody Wed Oct 4 06:36:26 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D7461326DF; Wed, 4 Oct 2017 06:36:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.8 X-Spam-Level: X-Spam-Status: No, score=-2.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mvlNVuabfIgt; Wed, 4 Oct 2017 06:36:22 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0100.outbound.protection.outlook.com [104.47.41.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3DC3F132199; Wed, 4 Oct 2017 06:36:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=X3shxhbRpngIqMIJt9MwUQEuLTnf9fI7tW5h9YjMb5E=; b=FtP1bynJubYc+RNr8CwsOm+E68mAudDeHUnZq6xQ39zztVe0rCF9qbLiG8Yybio49AalrHxDMQJXclNaD8L9xUbCRvE2YRkhcYWScpoKjXJvmwv7MP1LaALWyQDKF8UVjquB+iIDro7cSIyLLRJXXNW3CYP664IQYsP2Wg9VB5U= Received: from BLUPR0501MB2051.namprd05.prod.outlook.com (10.164.23.21) by BLUPR0501MB2051.namprd05.prod.outlook.com (10.164.23.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Wed, 4 Oct 2017 13:36:20 +0000 Received: from BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) by BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) with mapi id 15.20.0077.018; Wed, 4 Oct 2017 13:36:20 +0000 From: Ron Bonica To: Joe Touch , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" CC: "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" Thread-Topic: [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 Thread-Index: AQHTOPqnaanFnY3C/0OsRx2AxtJLKaLTsseAgAAEkNA= Date: Wed, 4 Oct 2017 13:36:20 +0000 Message-ID: References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; x-originating-ip: [66.129.241.11] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BLUPR0501MB2051; 6:lYep+/sSeIFiiHCdVjkWPjYpu0wNERIIX62HvGRpmvkVr3NaRtn6UTw3KNqCBKTR1HGHFShiVzM33Jzqhzu2R/uVywa/YmHhtUgd1M73eDnlYCdM0G52pIoxNv5CrmBopBuL9/pHPLg/udtVlRjGp+DEzsS8Sp+VtfDUTXWRqNKaU9dl4Cgve/TD/e/ubcH0IX1Mt/TPH1ffp0XpcoXh/Ba5IQL0QnZVTYR7hQoDWOO4kM9gcuqVNRtVpZg8Hd0Pyb704j4KY48QFGXw25vRWaR803MQnVmhdzN+uYO1YLJGwhnWebarVqzDHUDptA5NsFBEf3WzcjJW3531cAKwfA==; 5:uUKVv3cw7F+RXfkq9CYQByIx5NVTaB1QiQc1o2f0Eu3FBKOTdvE2hi5f0XJNG8jUBScRiv14GDU6/BOy3UrtwU0bwIg9YGV2Zs0/zchUPq9N6b/PuZNftB476DimcpyjpbxnMYX5nBlq25AUKRFqmQ==; 24:OG/wG29m42N7JxlE1emjs7KPm9kW63Ws9SPHLFisOomW325kB0SI5c6/GLyQqcNQjJVQiiRGsY8WhOi3xe2CTNLYWD/R1Ray4/oqHE/Ib+o=; 7:A6hEg8+v2RxyQCkLI1f5+vBp1/XAq2NPaWAc43ts8+pXyHhmuxa4oqNSprZTPmd5p4uq0miT85TcrCrMd9INBk5EHZOr2zOi74nWiuBtF5g3oJFIVy0ViivbSH8RUmtnpuiXdsKL78o6rj6BNulSNs4OH9fZ7ej2hNPDnCXYz8+j19VevvR6M3IIWfWTS5hlgRnN39njKVhCr1e3NdvPT39FzyNUOjjC7Lsh9WrXOhw= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: e861f8af-3699-444b-1388-08d50b2ce5c0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:BLUPR0501MB2051; x-ms-traffictypediagnostic: BLUPR0501MB2051: x-exchange-antispam-report-test: UriScan:(10436049006162)(82608151540597)(21748063052155); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(93006095)(93001095)(100000703101)(100105400095)(10201501046)(3002001)(6055026)(6041248)(20161123558100)(20161123564025)(20161123562025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BLUPR0501MB2051; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BLUPR0501MB2051; x-forefront-prvs: 0450A714CB x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(189002)(199003)(377454003)(24454002)(50986999)(68736007)(54356999)(189998001)(54906003)(33656002)(2501003)(3660700001)(9686003)(102836003)(3846002)(66066001)(6116002)(790700001)(53546010)(966005)(606006)(101416001)(97736004)(3280700002)(316002)(2950100002)(7696004)(2900100001)(236005)(6436002)(6506006)(14454004)(110136005)(9326002)(76176999)(55016002)(478600001)(25786009)(6246003)(54896002)(77096006)(74316002)(7736002)(5660300001)(99286003)(105586002)(81156014)(106356001)(2906002)(229853002)(8676002)(53936002)(81166006)(86362001)(8936002)(6306002)(4326008)(230783001); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR0501MB2051; H:BLUPR0501MB2051.namprd05.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BLUPR0501MB2051F1C36026DE87D44B1513AE730BLUPR0501MB2051_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Oct 2017 13:36:20.2423 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR0501MB2051 Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Oct 2017 13:36:25 -0000 --_000_BLUPR0501MB2051F1C36026DE87D44B1513AE730BLUPR0501MB2051_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSm9lLA0KDQpHb29kIHRvIGhlYXIgZnJvbSB5b3UgYWdhaW4hIEl04oCZcyBiZWVuIGEgd2hp bGUuDQoNCkkgaGF2ZSB0byBkaXNhZ3JlZSB3aXRoIHlvdXIgZmlyc3Qgc3RhdGVtZW50LiBUaGUg ZG9jdW1lbnQgcmVhbGx5IGlzIGludGVuZGVkIHRvIGJlIG9wZXJhdGlvbmFsIGFkdmljZSBhbmQg bm90aGluZyBtb3JlLiBJIGtub3cgdGhhdCBiZWNhdXNlIHRoYXQgcmVhbGx5IHdhcyBvdXIgaW50 ZW50IHdoZW4gd2Ugd3JvdGUgdGhlIHBhcmFncmFwaC4NCg0KSG93ZXZlciwgSSBzdXNwZWN0IHRo YXQgeW91IG9iamVjdGlvbnMgYXJlIG11Y2ggZGVlcGVyIGFuZCBwcm9iYWJseSByZXF1aXJlIGEg d2lkZXIgYmFuZHdpZHRoIGNvbnZlcnNhdGlvbi4gTGV04oCZcyBjaGF0IGxhdGVyIHRoaXMgd2Vl ay4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgUm9uDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXCBubyBoYXRz DQoNCkZyb206IEpvZSBUb3VjaCBbbWFpbHRvOnRvdWNoQHN0cmF5YWxwaGEuY29tXQ0KU2VudDog V2VkbmVzZGF5LCBPY3RvYmVyIDQsIDIwMTcgOToxMiBBTQ0KVG86IFZhbiBEZSBWZWxkZSwgR3Vu dGVyIChOb2tpYSAtIEJFL0FudHdlcnApIDxndW50ZXIudmFuX2RlX3ZlbGRlQG5va2lhLmNvbT47 IG9wc2VjQGlldGYub3JnDQpDYzogdjZvcHNAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtb3BzZWMtaXB2 Ni1laC1maWx0ZXJpbmdAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbdjZvcHNdIFdHTEMgZm9yIGRy YWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmctMDMNCg0KDQoNCg0KT24gOS8yOS8yMDE3 IDE6MTIgQU0sIFZhbiBEZSBWZWxkZSwgR3VudGVyIChOb2tpYSAtIEJFL0FudHdlcnApIHdyb3Rl Og0KVGhpcyBpcyB0byBvcGVuIGEgdHdvIHdlZWsgV0dMQyBmb3IgaHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL2RyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmctMDM8aHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9y Z19odG1sX2RyYWZ0LTJEaWV0Zi0yRG9wc2VjLTJEaXB2Ni0yRGVoLTJEZmlsdGVyaW5nLTJEMDMm ZD1Ed01EYVEmYz1IQWtZdWg2M3JzdWhyNlNjYmZoMFVqQlhlTUstbmRiM3ZvRFRYY1d6b0NJJnI9 RmNoOUZRODJzaXItQm9MeDg0aEt1S3dsLUFXRjJFZnBIY0F3ckRUaEtQOCZtPXc2ZWhSNnRFV3hX c0FpNlVxS1BhTzItdmxEcjVXcmFaY1J1NGRNdjhvOTAmcz1GYldKbHNsUXN0Z25WbnlOR2RZNTk5 NUtGUndDeDRSRHRJQlFQck9BZGo4JmU9Pi4NCg0KSSBkbyBub3QgYWdyZWUgd2l0aCB0aGUgY2xh aW1zIG9mIHRoaXMgZG9jdW1lbnQuIEl0ICJpbmZvcm1hdGlvbmFsbHkiIGFkdmlzZXMgYWdhaW5z dCBzdXBwb3J0IGZvciBrZXkgSVB2NiBjYXBhYmlsaXRpZXMgYW5kIHVuZGVybWluZXMgdGhlIGV4 dGVuc2liaWxpdHkgb2YgSVB2NiBieSBtYWtpbmcgcmVjb21tZW5kYXRpb25zIGFib3V0IGRpc2Nh cmRpbmcgY3VycmVudGx5IHVuYXNzaWduZWQgY29kZXBvaW50cy4NCg0KVGhpcyBpcyBhbiBvdmVy c3RlcCBmb3IgYW4gT1BTIGdyb3VwLCBJTU8uDQoNCkFkZGl0aW9uYWxseSwgaXQgcmVmZXJzIHRv IFJGQzIxMTkgd2l0aG91dCB0YWtpbmcgY2FyZSB0byBjYXBpdGFsaXplIHRob3NlIGtleXdvcmRz IHdoZXJlIHVzZWQgb3IgdG8gcHJvdmlkZSBzcGVjaWZpYyBleGFtcGxlcyB3aGVyZSByZWNvbW1l bmRhdGlvbnMgY29udHJhZGljdCBleGlzdGluZyBJbnRlcm5ldCBzdGFuZGFyZHMgb3IgYXJlIG5v dCBkZWZpbml0aXZlIChlLmcuLCBTSE9VTERzKS4NCg0KSSBkb24ndCB0aGluayB0aGlzIGRvY3Vt ZW50IGlzIHJlYWR5IGluIGFueSB3YXkuDQoNCkpvZQ0K --_000_BLUPR0501MB2051F1C36026DE87D44B1513AE730BLUPR0501MB2051_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjsN Cgljb2xvcjpibGFjazt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0K YTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0 eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJn aW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0 OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4i LHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2 Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9w LWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6 IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRT ZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4g MS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0 eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRp dCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVk aXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hl YWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5r PSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IaSBKb2UsPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Hb29kIHRvIGhlYXIgZnJvbSB5b3UgYWdhaW4h IEl04oCZcyBiZWVuIGEgd2hpbGUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5JIGhhdmUgdG8gZGlzYWdyZWUgd2l0aCB5b3VyIGZpcnN0IHN0YXRlbWVudC4gVGhl IGRvY3VtZW50IHJlYWxseSBpcyBpbnRlbmRlZCB0byBiZSBvcGVyYXRpb25hbCBhZHZpY2UgYW5k IG5vdGhpbmcgbW9yZS4gSSBrbm93IHRoYXQgYmVjYXVzZSB0aGF0IHJlYWxseSB3YXMgb3VyDQog aW50ZW50IHdoZW4gd2Ugd3JvdGUgdGhlIHBhcmFncmFwaC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhvd2V2ZXIsIEkgc3VzcGVjdCB0aGF0IHlvdSBvYmplY3Rp b25zIGFyZSBtdWNoIGRlZXBlciBhbmQgcHJvYmFibHkgcmVxdWlyZSBhIHdpZGVyIGJhbmR3aWR0 aCBjb252ZXJzYXRpb24uIExldOKAmXMgY2hhdCBsYXRlciB0aGlzIHdlZWsuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgUm9uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBcIG5vIGhhdHM8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQu MHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNF MUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+RnJvbTo8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4gSm9lIFRvdWNoIFttYWlsdG86dG91 Y2hAc3RyYXlhbHBoYS5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBPY3RvYmVy IDQsIDIwMTcgOToxMiBBTTxicj4NCjxiPlRvOjwvYj4gVmFuIERlIFZlbGRlLCBHdW50ZXIgKE5v a2lhIC0gQkUvQW50d2VycCkgJmx0O2d1bnRlci52YW5fZGVfdmVsZGVAbm9raWEuY29tJmd0Ozsg b3BzZWNAaWV0Zi5vcmc8YnI+DQo8Yj5DYzo8L2I+IHY2b3BzQGlldGYub3JnOyBkcmFmdC1pZXRm LW9wc2VjLWlwdjYtZWgtZmlsdGVyaW5nQGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJl OiBbdjZvcHNdIFdHTEMgZm9yIGRyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmctMDM8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk9uIDkvMjkvMjAxNyAxOjEyIEFNLCBWYW4gRGUgVmVsZGUsIEd1bnRlciAoTm9r aWEgLSBCRS9BbnR3ZXJwKSB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGlzIGlzIHRv IG9wZW4gYSB0d28gd2VlayBXR0xDIGZvciZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9k cmFmdC0yRGlldGYtMkRvcHNlYy0yRGlwdjYtMkRlaC0yRGZpbHRlcmluZy0yRDAzJmFtcDtkPUR3 TURhUSZhbXA7Yz1IQWtZdWg2M3JzdWhyNlNjYmZoMFVqQlhlTUstbmRiM3ZvRFRYY1d6b0NJJmFt cDtyPUZjaDlGUTgyc2lyLUJvTHg4NGhLdUt3bC1BV0YyRWZwSGNBd3JEVGhLUDgmYW1wO209dzZl aFI2dEVXeFdzQWk2VXFLUGFPMi12bERyNVdyYVpjUnU0ZE12OG85MCZhbXA7cz1GYldKbHNsUXN0 Z25WbnlOR2RZNTk5NUtGUndDeDRSRHRJQlFQck9BZGo4JmFtcDtlPSI+aHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmctMDM8L2E+Ljwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KSSBkbyBub3QgYWdyZWUgd2l0aCB0 aGUgY2xhaW1zIG9mIHRoaXMgZG9jdW1lbnQuIEl0ICZxdW90O2luZm9ybWF0aW9uYWxseSZxdW90 OyBhZHZpc2VzIGFnYWluc3Qgc3VwcG9ydCBmb3Iga2V5IElQdjYgY2FwYWJpbGl0aWVzIGFuZCB1 bmRlcm1pbmVzIHRoZSBleHRlbnNpYmlsaXR5IG9mIElQdjYgYnkgbWFraW5nIHJlY29tbWVuZGF0 aW9ucyBhYm91dCBkaXNjYXJkaW5nIGN1cnJlbnRseSB1bmFzc2lnbmVkIGNvZGVwb2ludHMuPGJy Pg0KPGJyPg0KVGhpcyBpcyBhbiBvdmVyc3RlcCBmb3IgYW4gT1BTIGdyb3VwLCBJTU8uPGJyPg0K PGJyPg0KQWRkaXRpb25hbGx5LCBpdCByZWZlcnMgdG8gUkZDMjExOSB3aXRob3V0IHRha2luZyBj YXJlIHRvIGNhcGl0YWxpemUgdGhvc2Uga2V5d29yZHMgd2hlcmUgdXNlZCBvciB0byBwcm92aWRl IHNwZWNpZmljIGV4YW1wbGVzIHdoZXJlIHJlY29tbWVuZGF0aW9ucyBjb250cmFkaWN0IGV4aXN0 aW5nIEludGVybmV0IHN0YW5kYXJkcyBvciBhcmUgbm90IGRlZmluaXRpdmUgKGUuZy4sIFNIT1VM RHMpLjxicj4NCjxicj4NCkkgZG9uJ3QgdGhpbmsgdGhpcyBkb2N1bWVudCBpcyByZWFkeSBpbiBh bnkgd2F5Ljxicj4NCjxicj4NCkpvZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_BLUPR0501MB2051F1C36026DE87D44B1513AE730BLUPR0501MB2051_-- From nobody Wed Oct 4 14:38:29 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76EA2133073; Wed, 4 Oct 2017 14:38:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g4TateNDoKyg; Wed, 4 Oct 2017 14:38:25 -0700 (PDT) Received: from mail-pg0-x22b.google.com (mail-pg0-x22b.google.com [IPv6:2607:f8b0:400e:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52F571323B4; Wed, 4 Oct 2017 14:38:25 -0700 (PDT) Received: by mail-pg0-x22b.google.com with SMTP id r25so4804819pgn.4; Wed, 04 Oct 2017 14:38:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=idVfSa0mrUORTczwuJLWYrnAykdo+DRWmEzfQgFBMqs=; b=NijQ97LwEQ1gyFjuVRTBa87IVqr7EboLDW8T1JWBljgKPsaMX4xoUF+mxp4159aefi E6PKqNoNHOS9fpzDfoB7nds4oDXaDwpId5xKttgF/zWS/22pnKJntZ26W7ib0JD86BNc O+eFyCeSOAdmrHNEx5MB7qHil9FjzKR3XFnXKPLImQSwZVVroEDbWo0VZOBK8bt3c5L6 SDBgQnXw/vklHbQQPoXkOwEMSDc7uYn7XVd3sTquUvq2eYD3AWMIzwzq3bRYM/CrxL5s GHcD/rPBX68sd/lkBUyEsbA+PkImwE2U0eEXN9Px5pO4FyiSFIuIvIGHbDd8ehMIg5xe nSfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=idVfSa0mrUORTczwuJLWYrnAykdo+DRWmEzfQgFBMqs=; b=FaWX43J7JYUErIde28yg/hOlGpOGJOktrsFfsh1ueu5lpmyVk+hRZIQvAEM+rwsOWI xg0vKNaVoOQwauvh3+5BEzMYgDwNL0JxxOYQx73jhcfG7EqAOcuwSaqk+ldyAsnu7sI9 vQyGtCqVHxvs8x2mS+PBIUlfHF8vTDAp6zxta9gfn6KulK/bGVoYX9LDMr+fpa6nDvgP pfzCAy/SgZQTdbkNqi8J/7amnHz/L5WqdjQZzpvHNXjGHVF7HK9aYRWtI9+mEYGOvLjE eHfmFeCUPd9sxu0AM5hWV0wNG7eXxLtS/4EncNHQSj7qrpsOqHBatoaNfQsLldmQyL7c L+GQ== X-Gm-Message-State: AHPjjUjJdFsmVctnkepQSMYrgX9q6AVwawsLg1yFxuIp2+QH873C5rwx sXxQ9OUr4f7HGiNXytov/AU= X-Google-Smtp-Source: AOwi7QBnCPMt5HbFYNkPlS72srXHhR4CMYS/nsJh8/tsyZjMwhAqb/MI8ocjQrbrvFHavaIm7oO2TA== X-Received: by 10.101.87.139 with SMTP id b11mr18842299pgr.186.1507153104735; Wed, 04 Oct 2017 14:38:24 -0700 (PDT) Received: from [172.16.224.219] ([209.97.127.34]) by smtp.gmail.com with ESMTPSA id u20sm26363349pfh.171.2017.10.04.14.38.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Oct 2017 14:38:23 -0700 (PDT) From: Bob Hinden Message-Id: <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_1B231D9A-4A46-450A-865B-BDED0483DA8F"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 4 Oct 2017 14:38:22 -0700 In-Reply-To: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> Cc: Bob Hinden , "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" To: "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Oct 2017 21:38:27 -0000 --Apple-Mail=_1B231D9A-4A46-450A-865B-BDED0483DA8F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I also don=E2=80=99t think this is ready for a w.g. last call. It doesn=E2=80=99t reference the new version of the IPv6 specification = RFC8200. There were a number of clarifications in RFC8200 regarding = extension headers that may require changes in the draft. For example, Hop by Hop headers are now a =E2=80=9Cmay=E2=80=9D in = RFC8200, but this draft says: The Hop-by-Hop Options header is used to carry optional information that should be examined by every node along a packet's delivery path. This doesn=E2=80=99t match what is in RFC8200: The Hop-by-Hop Options header is not inserted or deleted, but may be examined or processed by any node along a packet's delivery path,=E2=80= =A6 I didn=E2=80=99t do a through review after I saw it didn=E2=80=99t = reference RFC8200, but I suspect there are other things that need to be = changed to match RFC8200. I think the authors need to do detailed = review and publish a new draft. Regard, Bob > On Sep 29, 2017, at 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) = wrote: >=20 > This is to open a two week WGLC for = https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03. > If you have not read it, please do so now. You may send nits to the = author, but substantive discussion should go to the opsec@ietf.org list. > (While V6OPS WG is in cc because of close alignment with the WG = expertise area, may we ask to send feedback and comments in the OPSEC = WG) >=20 > We will close the call on 13 October 2017 >=20 > Gunter & Eric > OPSEC WG co-chairs >=20 > _______________________________________________ > v6ops mailing list > v6ops@ietf.org > https://www.ietf.org/mailman/listinfo/v6ops --Apple-Mail=_1B231D9A-4A46-450A-865B-BDED0483DA8F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJZ1VTOAAoJEK7rdBF357uorU8H/1LC2bIewYDawTHoosLTHleH 3r8Vjey+DewSoiJ853IiULJg7SE3j4BpLg0EtHx6a8ENVebZ4znwTnjMfSlhpi06 nowTOXVWwWhKCIypfp3rAPW3teLQYj8R77IpzTMoK1vsAkKAp/o2kvHDXgFw5hCY BRo3QEER+ztByqlkPdM2AHq9o7GIYr441PBgUu2imBPfVFTlyDxHRd0DiEh8z8oM dKSUZmcQOFGMbUVDcrmbiI/xokF/0CeorE6IEFLgAv6NtKpkaUnGMDrtVsedchn8 5KZByI321+UzpWlSUd0Ky9BtZ/FJ5m50I+nS4DaFw6SwPvZAGLqBl7oRVViP7UY= =Vtez -----END PGP SIGNATURE----- --Apple-Mail=_1B231D9A-4A46-450A-865B-BDED0483DA8F-- From nobody Wed Oct 4 15:10:18 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 401491320D8; Wed, 4 Oct 2017 15:10:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ri0ZU9KyS82q; Wed, 4 Oct 2017 15:10:04 -0700 (PDT) Received: from mail-pg0-x22b.google.com (mail-pg0-x22b.google.com [IPv6:2607:f8b0:400e:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BE8E132F3F; Wed, 4 Oct 2017 15:10:04 -0700 (PDT) Received: by mail-pg0-x22b.google.com with SMTP id b192so4151502pga.2; Wed, 04 Oct 2017 15:10:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=BXXOL4VZMLdtiyNkwkR/vFzfW9y1nnorTKTHOxDIjMI=; b=BphDhXn25OYaiyivIxuV/6ApxY4N3IKDmIt6XTFvyEtU0BqN4IlWYZBhH+QQtJ9F2l EQilOHaw0JSe8X3xrUhu7xFigtwdb5qyLTXQ2MRrlAChu9359ZDBIQm5ABv3Vn4inNMB q/u479nZ+6SI+xE//WABEJqitRmbLdAKRf4YdvwsgajEEFFwK51xFq40yOVuRiFJEn0O 65vN9ByWsulZO8HCBX09idq1aoj3jDw7nYJvKst6RRuBWRLsXljtI+QdpXPAKaoXeo5c jCmAXHC65cHo/2GyJPmQdJ3Y3s2UiOlmmGsw8ZbUIH0LH+7o84nDLvlVLR2juGwEVdKT ZgVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=BXXOL4VZMLdtiyNkwkR/vFzfW9y1nnorTKTHOxDIjMI=; b=cw/A/fLS0uAhtrUzdwmTdWTOMb0m2pZX5jlsarzzr6NCNrhzEGVH8MicoGgG3e5UKM 6CqJysd9PDDU4Xh8zLseX59uwJ+s32D/QSOD7Jt/r51LhO2XjO3AhtOSjDEJyqiY8lya v/4L2QvE1MRp35/q0y2yzcb9QQsKptoNJqpzVYlVW/Fl0pcMuUBc89j90pnJpyHYtMim gvmJNjcv9yKkQrvTVYXawbiMdz5cIapqN9Px5rdg9BAde2N8YxCr8zaXVvb8N4+dYDY1 /T6WC2LXiFGNNRSotFTI0dsbltaauVT+Z8uQE0abnCEMpjZfFRroegBRczbXF2Y0SN+P RMWg== X-Gm-Message-State: AHPjjUiunXLwiULAZ2zbWAOCHDyONTel0QnNibmYUBnGNeFRRRnBliHe K2OPfGsvvuecaJY3wYmNkdV1vA== X-Google-Smtp-Source: AOwi7QACJdPqu+mRE58utVqQQZQMakfZaS7Xc+3J48JpthweXjh6CjKyFD8Oy8FGJF8YocKJ3g3U+Q== X-Received: by 10.99.184.9 with SMTP id p9mr19032957pge.6.1507155003395; Wed, 04 Oct 2017 15:10:03 -0700 (PDT) Received: from ?IPv6:2406:e007:6d3c:1:28cc:dc4c:9703:6781? ([2406:e007:6d3c:1:28cc:dc4c:9703:6781]) by smtp.gmail.com with ESMTPSA id f22sm10960024pff.147.2017.10.04.15.10.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Oct 2017 15:10:02 -0700 (PDT) To: Joe Touch , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" Cc: "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> From: Brian E Carpenter Organization: University of Auckland Message-ID: <2c8c0d70-4b63-12ba-d83a-192b829159b8@gmail.com> Date: Thu, 5 Oct 2017 11:10:06 +1300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Oct 2017 22:10:12 -0000 On 05/10/2017 02:12, Joe Touch wrote: >=20 >=20 > On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote: >> >> This is to open a two week WGLC >> for=C2=A0https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filterin= g-03. >> >=20 > I do not agree with the claims of this document. It "informationally" > advises against support for key IPv6 capabilities and undermines the > extensibility of IPv6 by making recommendations about discarding > currently unassigned codepoints. Here's the problem, Joe. It's a fact of life that many firewalls discard a lot of stuff that they shouldn't - that's why we wrote RFC 7045 - but in the real world, operators blunder around based on folklore and vendors' defaults. We can't change any of that, but we can try to issue sensible advice that, overall, will limit the resulting breakage. IMHO this document, positioned correctly as Informational, will do that: on balance, it makes the world a better place. I agree with Bob Hinden that a careful review against RFC 8200 is essential. I already pointed out one problem (RH0) at https://mailarchive.ietf.org/arch/msg/opsec/StjbjvCP9PLC3ssnTKYO6jqFgk0 and Bob found a problem with Hop-by-Hop. Brian >=20 > This is an overstep for an OPS group, IMO. >=20 > Additionally, it refers to RFC2119 without taking care to capitalize > those keywords where used or to provide specific examples where > recommendations contradict existing Internet standards or are not > definitive (e.g., SHOULDs). >=20 > I don't think this document is ready in any way. >=20 > Joe >=20 >=20 >=20 >=20 > _______________________________________________ > v6ops mailing list > v6ops@ietf.org > https://www.ietf.org/mailman/listinfo/v6ops >=20 From nobody Wed Oct 4 20:08:16 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58BAB13451E for ; Wed, 4 Oct 2017 20:08:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.199 X-Spam-Level: X-Spam-Status: No, score=-2.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pobox.com; domainkeys=pass (1024-bit key) header.from=heard@pobox.com header.d=pobox.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MmrFv7gjwK2d for ; Wed, 4 Oct 2017 20:08:13 -0700 (PDT) Received: from sasl.smtp.pobox.com (pb-smtp2.pobox.com [64.147.108.71]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC3C713451B for ; Wed, 4 Oct 2017 20:08:12 -0700 (PDT) Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by pb-smtp2.pobox.com (Postfix) with ESMTP id 57D8DB3991 for ; Wed, 4 Oct 2017 23:08:11 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=pobox.com; h=mime-version :from:date:message-id:subject:to:content-type; s=sasl; bh=CqXekX kglinuv8O11O+1p2Lqyek=; b=lqEkGkoBy5eukQhc4ahyawaDKyy16JWkwt3ah+ Z7XjzBwUQPHrDD1EU4Vj86H/kd7dx3blBSgdi4P3+UqSCwaPF5bxcIf897hU/kSB VykAc5O0bovD/kVE+wY9QQaFFmpmBW83p3mKuMSjQYUrIpGOziQ/Xfu1Txwfg/+P e2ljI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=mime-version :from:date:message-id:subject:to:content-type; q=dns; s=sasl; b= DesL1mE7XjBUsNtwWjd3WmZvvxOAW5TcxGGYhJcIvJqiXaKJtXqZ09ExbqVyIcX8 HbqdeXn400auP5IOmpKwDt1REAdzw4utk41lfCOO4dQgeqnwA8XKSuKxMzAHMOdT avXCIrbX5X9+cSkw+Ef3gpYwePIJ/4EOrRV8dEHRx8w= Received: from pb-smtp2.nyi.icgroup.com (unknown [127.0.0.1]) by pb-smtp2.pobox.com (Postfix) with ESMTP id 5026BB3990 for ; Wed, 4 Oct 2017 23:08:11 -0400 (EDT) Received: from mail-qt0-f179.google.com (unknown [209.85.216.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pb-smtp2.pobox.com (Postfix) with ESMTPSA id C82D4B398F for ; Wed, 4 Oct 2017 23:08:10 -0400 (EDT) Received: by mail-qt0-f179.google.com with SMTP id q4so23022083qtq.8 for ; Wed, 04 Oct 2017 20:08:10 -0700 (PDT) X-Gm-Message-State: AMCzsaVRM4nKHk5zTjiPVa7i1zGNBLgXUIwCp9fEyigh4jqiercWriIm Mdv0W10oiAmiVuoVuj3NT65f5/VU+JhZ60xmBdk= X-Google-Smtp-Source: AOwi7QBFwuO2rO/VloKHDYfHMFGRHWHinbsZ7jDaq6n0mFlEqz2rqvzG8g+8SI7xQKdTxkduN3XQwq9PfouJwL2nvZ4= X-Received: by 10.200.26.65 with SMTP id q1mr29985872qtk.186.1507172890202; Wed, 04 Oct 2017 20:08:10 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.18.130 with HTTP; Wed, 4 Oct 2017 20:07:49 -0700 (PDT) From: "C. M. Heard" Date: Wed, 4 Oct 2017 20:07:49 -0700 X-Gmail-Original-Message-ID: Message-ID: To: OPSEC Content-Type: multipart/alternative; boundary="f403045d6da0bc5837055ac40856" X-Pobox-Relay-ID: 6B3D410E-A97A-11E7-B968-575F0C78B957-06080547!pb-smtp2.pobox.com Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Oct 2017 03:08:15 -0000 --f403045d6da0bc5837055ac40856 Content-Type: text/plain; charset="UTF-8" On Thu, 5 Oct 2017 11:10:06 +1300, Brian E Carpenter wrote: > On 05/10/2017 02:12, Joe Touch wrote: > >> On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote: >>> >>> This is to open a two week WGLC >>> for https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03. >>> >> >> I do not agree with the claims of this document. It "informationally" >> advises against support for key IPv6 capabilities and undermines the >> extensibility of IPv6 by making recommendations about discarding >> currently unassigned codepoints. > > Here's the problem, Joe. It's a fact of life that many firewalls > discard a lot of stuff that they shouldn't - that's why we wrote > RFC 7045 - but in the real world, operators blunder around based > on folklore and vendors' defaults. We can't change any of that, but > we can try to issue sensible advice that, overall, will limit the > resulting breakage. IMHO this document, positioned correctly as > Informational, will do that: on balance, it makes the world a better > place. I am afraid that I do not agree that the document, in its present form, will do that. It says: The filtering policy typically depends on where in the network such policy is enforced: when the policy is enforced in a transit network, the policy typically follows a "black-list" approach, where only packets with clear negative implications are dropped. On the other hand, when the policy is enforced closer to the destination systems, the policy typically follows a "white-list" approach, where only traffic that is expected to be received is allowed. *The advice in this document is aimed only at transit routers that may need to enforce a filtering policy based on the EHs and IPv6 options a packet may contain, following a "black-list" approach, and hence is likely to be much more permissive that a filtering policy to be employed e.g. at the edge of an enterprise network.* The advice in this document is meant to improve the current situation of the dropping of packets with IPv6 EHs in the Internet [RFC7872 ]. while at the same time promoting a ***default deny*** policy with respect to unrecognized options and unrecognized extension headers. That is antithetical to the mission of a ***transit router***, which is to get packets transparently from point A to point B. It is especially egregious to dispense this advice for unrecognized extension headers, since they are indistinguishable from unrecognized transport protocols. If these things are blocked by ***transit routers*** it becomes impossible to deploy any new options or transport protocols. But we already know that, don't we? If we want to give constructive advice that really will make the world a better place, we should: 1.) Advise operators of ***transit routers*** to be transparent to everything other than the Hop-by-Hop extensions header, and provide detailed advice on what to do (based on the updates in RFC 8200) about Hop-by-Hop options. The default should be IGNORE unless there is an option you need to process. 2.) Reserve all the detailed filtering advicee for operators of firewalls, enterprise routers, and other systems whose mission it is to protect the end systems behind them (or to prevent misbehavior by said end systems). A default deny for unrecognized stuff is not unreasonable for such systems. 3.) Remind implementors of the following requirement from RFC 7045: Forwarding nodes MUST be configurable to allow packets containing unrecognised extension headers, but the default configuration MAY drop such packets. and add similar advice for options. Thanks and regards, Mike Heard --f403045d6da0bc5837055ac40856 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Thu, 5 Oct 2017 11:10:06 +1300, Brian E Carpenter wrote:

> On 05/10/2017 02:12, Joe Touch wrote:

>

>> On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote:

>>>

>>> This is to open a two week WGLC

>>> for=C2=A0https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03.

>>>

>>

>> I do not agree with the claims of this document. It "informationally"

>> advises against support for key IPv6 capabilities and undermines the

>> extensibility of IPv6 by making recommendations about discarding

>> currently unassigned codepoints.

>

> Here's the problem, Joe. It's a fact of life that many firewalls

> discard a lot of stuff that they shouldn't - that's why we wrote

> RFC 7045 - but in the real world, operators blunder around based

> on folklore and vendors' defaults. We can't change any of that, but

> we can try to issue sensible advice that, overall, will limit the

> resulting breakage. IMHO this document, positioned correctly as

> Informational, will do that: on balance, it makes the world a better

> place.

=C2=A0

I am afraid that I do not agree that the document, in its present form,

will do that. It says:


   The filteri=
ng policy typically depends on where in the network such
   policy is enforced: when the policy is enforced in a transit network,
   the policy typically follows a "black-list" approach, where on=
ly
   packets with clear negative implications are dropped.  On the other
   hand, when the policy is enforced closer to the destination systems,
   the policy typically follows a "white-list" approach, where on=
ly
   traffic that is expected to be received is allowed.  The advice in
   this document is aimed only at transit routers that may need to
   enforce a filtering policy based on the EHs and IPv6 options a packet
   may contain, following a "black-list" approach, and hence is l=
ikely
   to be much more permissive that a filtering policy to be employed
   e.g. at the edge of an enterprise network.  The advice in=
 this
   document is meant to improve the current situation of the dropping of
   packets with IPv6 EHs in the Internet [RFC7872].

while at the same time promoting a **default deny** po=
licy with
respect to unrecognized options and unrecognized extension head=
ers.
That is antithetical to the mission of a **transit router<=
/i>**, which
is to get packets transparently from point A to point B. It =
is
especially egregious to dispense this advice for unrecognized<=
/span>
extension h=
eaders, since they are indistinguishable from unrecognized<=
/span>
transport protocols. If these things are blocked b=
y=C2=A0**transit routers**
it becomes  impossible to deploy any new options o=
r transport protocols.
But we already know that, don't we?

If we want to give constructive advice that really will make the
world a=
 better place, we should:

1.) Advise operators of **transit routers** to be transparent to
everything other than the Hop-by-Ho=
p extensions header, and provide
detailed advice on what to do (based on the updates in RFC 820=
0)
about Hop-by-Hop =
options. The default should be IGNORE unless there
is an option you need to process.

2.) Reserve all the detailed filtering adv=
icee for operators of
firewalls, enterprise routers, and other systems whose mission it=

is to protect the e=
nd systems behind them (or to prevent misbehavior
by said end systems). A default deny for unre=
cognized stuff is not
unreasonable for such systems.

3.=
) Remind implementors of the following requirement from RFC 7045:

   Forwarding nodes MUST be configurable to allow pac=
kets containing
   unrecognised extension headers, but the default configuration MAY
   drop such packets.
=

and add simila=
r advice for options.

Thanks and rega=
rds,

Mike Heard
--f403045d6da0bc5837055ac40856-- From nobody Thu Oct 5 01:02:44 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54CE5133070 for ; Thu, 5 Oct 2017 01:02:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.32 X-Spam-Level: X-Spam-Status: No, score=-4.32 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=jisc.ac.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cpaG-0rrCi-c for ; Thu, 5 Oct 2017 01:02:39 -0700 (PDT) Received: from eu-smtp-delivery-189.mimecast.com (eu-smtp-delivery-189.mimecast.com [146.101.78.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 537DB1321CB for ; Thu, 5 Oct 2017 01:02:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jisc.ac.uk; s=mimecast20170213; t=1507190557; h=from:subject:date:message-id:to:cc:mime-version:content-type:content-transfer-encoding:in-reply-to:references; bh=Bhuy4zoLOU32SViCmQM84J+w47R3bUdLfM+3Z37WIIk=; b=aLAfWMfFq8T8nn1IzgdLe1FPckTmyhGQVFYlBoFdSvEcH3Dqh6h/130nX1uMZbkK1B6+PM1WT4anTbZMutbbTi129e1ns5kRCTJSrvsyAUYiCCf0EQ+wE+MVEw5JeW/nTRgJ8+Z1KFbCbtHCaZzP7d8NENPgeVOqVA0I9wvYAXk= Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01lp0176.outbound.protection.outlook.com [213.199.154.176]) (Using TLS) by eu-smtp-1.mimecast.com with ESMTP id uk-mta-129-eKZOwXvvPCWGHoDCzlfT4g-1; Thu, 05 Oct 2017 09:02:35 +0100 Received: from AM3PR07MB1140.eurprd07.prod.outlook.com (10.163.188.14) by AM3PR07MB1139.eurprd07.prod.outlook.com (10.163.188.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Thu, 5 Oct 2017 08:02:34 +0000 Received: from AM3PR07MB1140.eurprd07.prod.outlook.com ([fe80::6d:9ebf:900:b590]) by AM3PR07MB1140.eurprd07.prod.outlook.com ([fe80::6d:9ebf:900:b590%14]) with mapi id 15.20.0077.018; Thu, 5 Oct 2017 08:02:34 +0000 From: Tim Chown To: Brian E Carpenter CC: Joe Touch , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" , "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" Thread-Topic: [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 Thread-Index: AQHTOPqnaanFnY3C/0OsRx2AxtJLKaLTsseAgACWVQCAAKWagA== Date: Thu, 5 Oct 2017 08:02:34 +0000 Message-ID: <24A7E567-1CE3-4EF2-AC44-F3C2C9890A4A@jisc.ac.uk> References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> <2c8c0d70-4b63-12ba-d83a-192b829159b8@gmail.com> In-Reply-To: <2c8c0d70-4b63-12ba-d83a-192b829159b8@gmail.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3273) x-originating-ip: [194.82.140.195] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM3PR07MB1139; 20:wRHz+aePrfsD+nvltUjGG4A7BFRNzn+tyFOuSuVyhC1dXRs+U1W2R3qbPVwiVS5EfvZJhR+pMyMoYwT/KszqSq3EF74XmYeS92Nx1JLuq9V66jeXnnTzlyPnVf8zBGZ8pXc/KPt5Vf+Q/tearccoWsm0gv3qCJkduV1mZ7F4p3g= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 07bd036d-d1cd-4b53-8ae0-08d50bc76fb8 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:AM3PR07MB1139; x-ms-traffictypediagnostic: AM3PR07MB1139: x-exchange-antispam-report-test: UriScan:; x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(3002001)(100000703101)(100105400095)(10201501046)(93006095)(93001095)(6041248)(20161123564025)(20161123560025)(201703131423075)(201702281529075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123562025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM3PR07MB1139; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM3PR07MB1139; x-forefront-prvs: 04519BA941 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(346002)(376002)(199003)(377454003)(24454002)(189002)(76176999)(8676002)(50226002)(4326008)(82746002)(99286003)(6506006)(57306001)(66066001)(6246003)(478600001)(3660700001)(3280700002)(2906002)(101416001)(86362001)(53936002)(8936002)(97736004)(81166006)(25786009)(6306002)(53546010)(81156014)(105586002)(6512007)(5250100002)(39060400002)(6436002)(54906003)(6486002)(42882006)(83716003)(7736002)(106356001)(189998001)(2950100002)(786003)(14454004)(5660300001)(50986999)(230783001)(316002)(36756003)(33656002)(6916009)(72206003)(6116002)(305945005)(2900100001)(68736007)(102836003)(3846002)(74482002)(966005)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM3PR07MB1139; H:AM3PR07MB1140.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-ID: <4EAD47E54B20D14EB2EE1FC82FE39286@eurprd07.prod.outlook.com> MIME-Version: 1.0 X-OriginatorOrg: jisc.ac.uk X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Oct 2017 08:02:34.2930 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 48f9394d-8a14-4d27-82a6-f35f12361205 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM3PR07MB1139 X-MC-Unique: eKZOwXvvPCWGHoDCzlfT4g-1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Oct 2017 08:02:42 -0000 SGksDQoNCj4gT24gNCBPY3QgMjAxNywgYXQgMjM6MTAsIEJyaWFuIEUgQ2FycGVudGVyIDxicmlh bi5lLmNhcnBlbnRlckBnbWFpbC5jb20+IHdyb3RlOg0KPiANCj4gT24gMDUvMTAvMjAxNyAwMjox MiwgSm9lIFRvdWNoIHdyb3RlOg0KPj4gDQo+PiANCj4+IE9uIDkvMjkvMjAxNyAxOjEyIEFNLCBW YW4gRGUgVmVsZGUsIEd1bnRlciAoTm9raWEgLSBCRS9BbnR3ZXJwKSB3cm90ZToNCj4+PiANCj4+ PiBUaGlzIGlzIHRvIG9wZW4gYSB0d28gd2VlayBXR0xDDQo+Pj4gZm9yIGh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLW9wc2VjLWlwdjYtZWgtZmlsdGVyaW5nLTAzLg0KPj4+ IA0KPj4gDQo+PiBJIGRvIG5vdCBhZ3JlZSB3aXRoIHRoZSBjbGFpbXMgb2YgdGhpcyBkb2N1bWVu dC4gSXQgImluZm9ybWF0aW9uYWxseSINCj4+IGFkdmlzZXMgYWdhaW5zdCBzdXBwb3J0IGZvciBr ZXkgSVB2NiBjYXBhYmlsaXRpZXMgYW5kIHVuZGVybWluZXMgdGhlDQo+PiBleHRlbnNpYmlsaXR5 IG9mIElQdjYgYnkgbWFraW5nIHJlY29tbWVuZGF0aW9ucyBhYm91dCBkaXNjYXJkaW5nDQo+PiBj dXJyZW50bHkgdW5hc3NpZ25lZCBjb2RlcG9pbnRzLg0KPiANCj4gSGVyZSdzIHRoZSBwcm9ibGVt LCBKb2UuIEl0J3MgYSBmYWN0IG9mIGxpZmUgdGhhdCBtYW55IGZpcmV3YWxscw0KPiBkaXNjYXJk IGEgbG90IG9mIHN0dWZmIHRoYXQgdGhleSBzaG91bGRuJ3QgLSB0aGF0J3Mgd2h5IHdlIHdyb3Rl DQo+IFJGQyA3MDQ1IC0gYnV0IGluIHRoZSByZWFsIHdvcmxkLCBvcGVyYXRvcnMgYmx1bmRlciBh cm91bmQgYmFzZWQNCj4gb24gZm9sa2xvcmUgYW5kIHZlbmRvcnMnIGRlZmF1bHRzLiBXZSBjYW4n dCBjaGFuZ2UgYW55IG9mIHRoYXQsIGJ1dA0KPiB3ZSBjYW4gdHJ5IHRvIGlzc3VlIHNlbnNpYmxl IGFkdmljZSB0aGF0LCBvdmVyYWxsLCB3aWxsIGxpbWl0IHRoZQ0KPiByZXN1bHRpbmcgYnJlYWth Z2UuIElNSE8gdGhpcyBkb2N1bWVudCwgcG9zaXRpb25lZCBjb3JyZWN0bHkgYXMNCj4gSW5mb3Jt YXRpb25hbCwgd2lsbCBkbyB0aGF0OiBvbiBiYWxhbmNlLCBpdCBtYWtlcyB0aGUgd29ybGQgYSBi ZXR0ZXINCj4gcGxhY2UuDQo+IA0KPiBJIGFncmVlIHdpdGggQm9iIEhpbmRlbiB0aGF0IGEgY2Fy ZWZ1bCByZXZpZXcgYWdhaW5zdCBSRkMgODIwMCBpcw0KPiBlc3NlbnRpYWwuIEkgYWxyZWFkeSBw b2ludGVkIG91dCBvbmUgcHJvYmxlbSAoUkgwKSBhdA0KPiBodHRwczovL21haWxhcmNoaXZlLmll dGYub3JnL2FyY2gvbXNnL29wc2VjL1N0amJqdkNQOVBMQzNzc25US1lPNmpxRmdrMA0KPiBhbmQg Qm9iIGZvdW5kIGEgcHJvYmxlbSB3aXRoIEhvcC1ieS1Ib3AuDQoNCkkgdGhpbmsgcHJhZ21hdGlj IEluZm9ybWF0aW9uYWwgKG5vdCBCQ1ApIGFkdmljZSBpcyB1c2VmdWwuDQoNClRoZSBhZHZpY2Ug c2VlbXMgdG8gYm9pbCBkb3duIHRvIGZvdXIgY2F0ZWdvcmllcy4gSSBndWVzcyBpdCB3b3VsZCBi ZSBpbnRlcmVzdGluZyB0byBkaXNjdXNzIHdoaWNoIGNhdGVnb3JpZXMgdGhlIFdHIGZlZWxzIGFy ZSBhY2NlcHRhYmxlIGZvciBwdWJsaWNhdGlvbiBhcyBhbiBJbmZvcm1hdGlvbmFsIGRvY3VtZW50 LCBhbmQgd2hpY2ggYXJlIHByb2JsZW1hdGljLiBDYW4gd2UgbmFpbCBkb3duIHdoZXJlIHRoZSBp c3N1ZXMgYXJlPw0KDQphKSBBZHZpY2Ugb24gZGlmZmVyZW50IEVIIHR5cGVzDQoNCkhlcmUsIHRo ZSBkb2N1bWVudCBhZHZpc2VzIGRyb3BwaW5nIFJIMDsgYWxsIG90aGVyIEVIIHR5cGVzIGV4Y2Vw dCBIQkggYXJlIHBlcm1pdHRlZC4NCkZvciBIQkggb3B0aW9ucywgdGhlIHJlY29tbWVuZGVkIHBv bGljeSBkZXBlbmRzIG9uIHRoZSBzeXN0ZW0gY2FwYWJpbGl0eTsgd2l0aCBoL3cgc3VwcG9ydCwg YWxsb3csIHdpdGggb25seSBzbG93IHBhdGggc3VwcG9ydCBhbmQgbm8gcmF0ZSBsaW1pdGluZyBj YXBhYmlsaXR5LCBjb25zaWRlciBkcm9wcGluZy4NClRoaXMgc2VjdGlvbiBzZWVtcyBwcmFnbWF0 aWMuDQoNCmIpIEFkdmljZSBvbiB1bmtub3duIEVIIHR5cGVzDQoNCjMuNS41ICJJbnRlcm1lZGlh dGUgc3lzdGVtcyBzaG91bGQgZGlzY2FyZCBwYWNrZXRzIGNvbnRhaW5pbmcgdW5rbm93biBJUHY2 IEVIcy7igJ0NClRoaXMgY29uZmxpY3RzIHdpdGggU2VjdGlvbiAyLjEgb2YgUkZDNzA0NS4NCg0K YykgQWR2aWNlIG9uIGRpZmZlcmVudCBJUHY2IG9wdGlvbnMNCg0KVGhlIGFkdmljZSBoZXJlIGlz IGEgbWl4dHVyZSBvZiByZWNvbW1lbmRlZCBkcm9wcywgYW5kIGNvbmRpdGlvbmFsIGRyb3BzLg0K UmVjb21tZW5kZWQgZHJvcHM6IFNNRl9EUEQsIEVuZHBvaW50IElkZW50aWZpY2F0aW9uLCBMaW5l LUlkZW50aWZpY2F0aW9uIE9wdGlvbiwgRGVwcmVjYXRlZA0KQ29uZGl0aW9uYWw6IEp1bWJvIFBh eWxvYWQsIFJQTCwgUm91dGVyIEFsZXJ0LCBDQUxJUFNPLCBJUF9ERkYsIFJGQzM2OTItc3R5bGUg RXhwZXJpbWVudCANCmkuZS4gaWYgeW91ciBuZXR3b3JrIGRvZXNu4oCZdCByZXF1aXJlIHRob3Nl IG9wdGlvbnMgdG8gZnVuY3Rpb24sIGRyb3AgdGhlbS4NClByYWdtYXRpYyBhZ2Fpbi4NCg0KZCkg QWR2aWNlIG9uIHVua25vd24gSVB2NiBvcHRpb25zDQoNCjQuNC41ICJFbnRlcnByaXNlIGludGVy bWVkaWF0ZSBzeXN0ZW1zIHRoYXQgcHJvY2VzcyB0aGUgY29udGVudHMgb2YgSVB2NiBFSHMNCiAg IHNob3VsZCBkaXNjYXJkIHBhY2tldHMgdGhhdCBjb250YWluIHVua25vd24gb3B0aW9ucy4gIE90 aGVyDQogICBpbnRlcm1lZGlhdGUgc3lzdGVtcyB0aGF0IHByb2Nlc3MgdGhlIGNvbnRlbnRzIG9m IElQdjYgRUhzIHNob3VsZA0KICAgcGVybWl0IHBhY2tldHMgdGhhdCBjb250YWluIHVua25vd24g b3B0aW9ucy7igJ0NCg0KSXTigJlzIG5vdCBjbGVhciBoZXJlIHdoeSB0aGUgYWR2aWNlIGlzIGRp ZmZlcmVudCBmb3IgZW50ZXJwcmlzZSB2cyBpbnRlcm1lZGlhdGUuDQpBbmQgd2h5IHRoZSByZWNv bW1lbmRlZCB1bmtub3duIElQdjYgb3B0aW9uIHBvbGljeSBpcyBkaWZmZXJlbnQgdG8gdW5rbm93 biBFSCBwb2xpY3kuDQoNCkEgc3VtbWFyeSB0YWJsZSBmb3IgSVB2NiBvcHRpb25zIHdvdWxkIGJl IHVzZWZ1bCwgYXMgcGVyIHRoZSBFSCB0eXBlcy4NCg0KU2F5aW5nIHRoYXQsIHRoZSBzdW1tYXJ5 IGZvciBSb3V0aW5nIEhlYWRlciB0eXBlcyBpbiB0aGUgdGFibGUgaXMgbm90IGNvbnNpc3RlbnQg d2l0aCB0aGUgYWR2aWNlIGluIHRoZSB0ZXh0Lg0KDQpBcyBwZXIgQm9iIGFuZCBCcmlhbuKAmXMg Y29tbWVudHMsIGFsaWdubWVudCB3aXRoIFJGQyA4MjAwIGlzIGEgbXVzdC4NCg0KU28gaW4gZ2Vu ZXJhbCBJIHN1cHBvcnQgcHJhZ21hdGljIGFkdmljZSwgYnV0IHRoZXJlIGFyZSBzb21lIG9wZW4g cXVlc3Rpb25zIGFuZCBjb25mbGljdHMgaW4gdGhlIHRleHQgYXMgaXQgaXMuDQoNClRpbQ0KDQoN Cg== From nobody Thu Oct 5 07:36:20 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2D42133338; Thu, 5 Oct 2017 07:36:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4aiX5J2L_iz6; Thu, 5 Oct 2017 07:36:11 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0094.outbound.protection.outlook.com [104.47.41.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6D38126DFE; Thu, 5 Oct 2017 07:36:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=eYJzMxIxHf560bvjgoLWMYFLwYyWuSlQfsqkC1QoubE=; b=BifjvHX8SE6w9IEfLgxn47sKbZ+IM2omdpJJ9BBiNCiz/RvNBiVFmaoKlKaWPW3oittyfXfWnNurJJJmZMUfbNhvNKBt3QcYx1YuNl3CFvutENf2F+s6yB7Ucwo1FOACg86fNZhXgOGskUy5C5JWcgvsl0VRfLD6elhcL+nTytE= Received: from BLUPR0501MB2051.namprd05.prod.outlook.com (10.164.23.21) by BLUPR0501MB2050.namprd05.prod.outlook.com (10.164.23.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Thu, 5 Oct 2017 14:36:08 +0000 Received: from BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) by BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) with mapi id 15.20.0077.018; Thu, 5 Oct 2017 14:36:08 +0000 From: Ron Bonica To: Bob Hinden , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" CC: "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" Thread-Topic: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 Thread-Index: AQHTOPqnaanFnY3C/0OsRx2AxtJLKaLUQD4AgAEb28A= Date: Thu, 5 Oct 2017 14:36:08 +0000 Message-ID: References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> In-Reply-To: <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; x-originating-ip: [66.129.241.12] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BLUPR0501MB2050; 6:HTrjf8MnKn3TM/jlLTDcGypvGnFqxM0ylTl52WHw2EKidVeAb0yPqa4ODmlLE2XNTZudCH5Cp096/qfz1gt1lv5GnFjDcI0uH1CL/oclfdLGWzS/+GTudupigw4mvC0kfwG0/J/dcN/BGxVYGrDvxR4yMPV19AzVxbxnjYX1MNIjyHRREUDwZrgoJnS56+YQWAa1i4jRaGqn830EjHkt1ypYc6OKEOzkaXESzuZ2pF5WqvtHfuHlXtFQLQ5CCGxX0dkoZnEUppjaGL+aEkZo738CoyC5p+YX4t/KR1aC5jUCt9Zq7IANOke/Hpx1+qYFm/yVSVru+96Fc3gsYCsmdQ==; 5:crptW2vIBv5r/zY5mSsVNHob8cWexvSa5ZW+ib5OYW4iGLdjWdscFuwBZwIwBQIFLkRgpgJZQEGmNnpZ5FiVBHANz/NCx0WpyioKY0PDBa2JpYlt6Ijq6oMY6bDe3lpPBnVt6LKe3DLvR2emrpPLmQ==; 24:gcOktTV6s2Yky5ep716DKtol2fp3IKUDM8A/24wbkoiT165Up3PehC/pdi2BzkbJ6dbRzsBHCgk5MYNdHVEU4TS3qkXtW/Mio/1ferLanXo=; 7:2/7aVe4+IPtEJD9NeoOKuLx+hwxb1tCtOsjRYM6OFLt9MdY1RD1EmgQui2rlbHJYlCOCJIRm4YHpXRhbE5PDZw/xTgnaiyZAaaRFNcCuuQV4HmhXNy+uZV/OIMNFdUK4W6ghWoP8LLc6r7flXEkl+oHeloPQLtA6vtlw8fV+hCzVpEwJOvoI0iKyAKmt5S8skvgCMjKuQbd6/gBYKdAMeGiYZ4/O5+k6SDCjssqptho= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: ba2caed5-3366-4d73-02e2-08d50bfe6acd x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:BLUPR0501MB2050; x-ms-traffictypediagnostic: BLUPR0501MB2050: x-exchange-antispam-report-test: UriScan:(82608151540597); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3002001)(100000703101)(100105400095)(6055026)(6041248)(20161123564025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123560025)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BLUPR0501MB2050; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BLUPR0501MB2050; x-forefront-prvs: 04519BA941 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(346002)(39860400002)(376002)(24454002)(13464003)(51914003)(199003)(377454003)(189002)(9686003)(54906003)(66066001)(8676002)(99286003)(230783001)(86362001)(229853002)(3280700002)(5660300001)(50986999)(6436002)(2900100001)(2950100002)(3660700001)(106356001)(2906002)(105586002)(77096006)(6506006)(7696004)(33656002)(189998001)(4326008)(76176999)(6246003)(14454004)(25786009)(966005)(101416001)(39060400002)(81166006)(97736004)(54356999)(74316002)(305945005)(55016002)(7736002)(6306002)(53546010)(110136005)(2501003)(81156014)(316002)(6116002)(8936002)(102836003)(53936002)(68736007)(3846002)(478600001); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR0501MB2050; H:BLUPR0501MB2051.namprd05.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:3; LANG:en; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Oct 2017 14:36:08.3118 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR0501MB2050 Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Oct 2017 14:36:13 -0000 Qm9iLA0KDQpUaGFua3MgZm9yIHRoZSByZXZpZXcuIEl0IGlzIHByZXR0eSBjbGVhciB0aGF0IHRo ZSBkcmFmdCB3aWxsIHJlcXVpcmUgcmV3b3JrIGFmdGVyIHRoZSBjb21tZW50IHBlcmlvZC4NCg0K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgUm9uDQoNCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBP UFNFQyBbbWFpbHRvOm9wc2VjLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBCb2IgSGlu ZGVuDQo+IFNlbnQ6IFdlZG5lc2RheSwgT2N0b2JlciA0LCAyMDE3IDU6MzggUE0NCj4gVG86IFZh biBEZSBWZWxkZSwgR3VudGVyIChOb2tpYSAtIEJFL0FudHdlcnApDQo+IDxndW50ZXIudmFuX2Rl X3ZlbGRlQG5va2lhLmNvbT47IG9wc2VjQGlldGYub3JnDQo+IENjOiB2Nm9wc0BpZXRmLm9yZzsg Qm9iIEhpbmRlbiA8Ym9iLmhpbmRlbkBnbWFpbC5jb20+OyBkcmFmdC1pZXRmLW9wc2VjLQ0KPiBp cHY2LWVoLWZpbHRlcmluZ0BpZXRmLm9yZw0KPiBTdWJqZWN0OiBSZTogW09QU0VDXSBbdjZvcHNd IFdHTEMgZm9yIGRyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmctMDMNCj4gDQo+IA0K PiBJIGFsc28gZG9u4oCZdCB0aGluayB0aGlzIGlzIHJlYWR5IGZvciBhIHcuZy4gbGFzdCBjYWxs Lg0KPiANCj4gSXQgZG9lc27igJl0IHJlZmVyZW5jZSB0aGUgbmV3IHZlcnNpb24gb2YgdGhlIElQ djYgc3BlY2lmaWNhdGlvbiBSRkM4MjAwLg0KPiBUaGVyZSB3ZXJlIGEgbnVtYmVyIG9mIGNsYXJp ZmljYXRpb25zIGluIFJGQzgyMDAgcmVnYXJkaW5nIGV4dGVuc2lvbg0KPiBoZWFkZXJzIHRoYXQg bWF5IHJlcXVpcmUgY2hhbmdlcyBpbiB0aGUgZHJhZnQuDQo+IA0KPiBGb3IgZXhhbXBsZSwgSG9w IGJ5IEhvcCBoZWFkZXJzIGFyZSBub3cgYSDigJxtYXnigJ0gaW4gUkZDODIwMCwgYnV0IHRoaXMg ZHJhZnQNCj4gc2F5czoNCj4gDQo+ICAgIFRoZSBIb3AtYnktSG9wIE9wdGlvbnMgaGVhZGVyIGlz IHVzZWQgdG8gY2Fycnkgb3B0aW9uYWwgaW5mb3JtYXRpb24NCj4gICAgdGhhdCBzaG91bGQgYmUg ZXhhbWluZWQgYnkgZXZlcnkgbm9kZSBhbG9uZyBhIHBhY2tldCdzIGRlbGl2ZXJ5IHBhdGguDQo+ IA0KPiBUaGlzIGRvZXNu4oCZdCBtYXRjaCB3aGF0IGlzIGluIFJGQzgyMDA6DQo+IA0KPiAgICBU aGUgSG9wLWJ5LUhvcCBPcHRpb25zIGhlYWRlciBpcyBub3QgaW5zZXJ0ZWQgb3IgZGVsZXRlZCwg YnV0IG1heSBiZQ0KPiAgICBleGFtaW5lZCBvciBwcm9jZXNzZWQgYnkgYW55IG5vZGUgYWxvbmcg YSBwYWNrZXQncyBkZWxpdmVyeSBwYXRoLOKApg0KPiANCj4gSSBkaWRu4oCZdCBkbyBhIHRocm91 Z2ggcmV2aWV3IGFmdGVyIEkgc2F3IGl0IGRpZG7igJl0IHJlZmVyZW5jZSBSRkM4MjAwLCBidXQg SQ0KPiBzdXNwZWN0IHRoZXJlIGFyZSBvdGhlciB0aGluZ3MgdGhhdCBuZWVkIHRvIGJlIGNoYW5n ZWQgdG8gbWF0Y2ggUkZDODIwMC4gIEkNCj4gdGhpbmsgdGhlIGF1dGhvcnMgbmVlZCB0byBkbyBk ZXRhaWxlZCByZXZpZXcgYW5kIHB1Ymxpc2ggYSBuZXcgZHJhZnQuDQo+IA0KPiBSZWdhcmQsDQo+ IEJvYg0KPiANCj4gPiBPbiBTZXAgMjksIDIwMTcsIGF0IDE6MTIgQU0sIFZhbiBEZSBWZWxkZSwg R3VudGVyIChOb2tpYSAtIEJFL0FudHdlcnApDQo+IDxndW50ZXIudmFuX2RlX3ZlbGRlQG5va2lh LmNvbT4gd3JvdGU6DQo+ID4NCj4gPiBUaGlzIGlzIHRvIG9wZW4gYSB0d28gd2VlayBXR0xDIGZv ciBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi0NCj4gb3BzZWMtaXB2Ni1l aC1maWx0ZXJpbmctMDMuDQo+ID4gSWYgeW91IGhhdmUgbm90IHJlYWQgaXQsIHBsZWFzZSBkbyBz byBub3cuIFlvdSBtYXkgc2VuZCBuaXRzIHRvIHRoZSBhdXRob3IsDQo+IGJ1dCBzdWJzdGFudGl2 ZSBkaXNjdXNzaW9uIHNob3VsZCBnbyB0byB0aGUgb3BzZWNAaWV0Zi5vcmcgbGlzdC4NCj4gPiAo V2hpbGUgVjZPUFMgV0cgaXMgaW4gY2MgYmVjYXVzZSBvZiBjbG9zZSBhbGlnbm1lbnQgd2l0aCB0 aGUgV0cNCj4gZXhwZXJ0aXNlIGFyZWEsIG1heSB3ZSBhc2sgdG8gc2VuZCBmZWVkYmFjayBhbmQg Y29tbWVudHMgaW4gdGhlIE9QU0VDDQo+IFdHKQ0KPiA+DQo+ID4gV2Ugd2lsbCBjbG9zZSB0aGUg Y2FsbCBvbiAxMyBPY3RvYmVyIDIwMTcNCj4gPg0KPiA+IEd1bnRlciAmIEVyaWMNCj4gPiBPUFNF QyBXRyBjby1jaGFpcnMNCj4gPg0KPiA+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQo+ID4gdjZvcHMgbWFpbGluZyBsaXN0DQo+ID4gdjZvcHNAaWV0Zi5v cmcNCj4gPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Y2b3BzDQoNCg== From nobody Thu Oct 5 11:04:34 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7A90134310 for ; Thu, 5 Oct 2017 11:04:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.031 X-Spam-Level: X-Spam-Status: No, score=-0.031 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IeNf7hA1-Mia for ; Thu, 5 Oct 2017 11:04:25 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0122.outbound.protection.outlook.com [104.47.41.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DBF8134477 for ; Thu, 5 Oct 2017 11:04:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=sT576XpfPWODYPvjo4lVfY+jNDpKNY+Re1TWNknfJ4w=; b=hNJXUzWWCbHSVPNmp5aC2ALF/d7Q6xwLAvtDneSGosLDqh2XTt8ECq096VRAZgYjLcsB8a5FBN6uWghztNcsuQDYxx/S7lnZ9rfp5jmxUuMh8ond7nHIYhwEdEq946TiJ9S5qOt4Fp6g9MV2U6a1yHgphgNAgKHnI9sjKOmiCv0= Received: from BLUPR0501MB2051.namprd05.prod.outlook.com (10.164.23.21) by BLUPR0501MB2050.namprd05.prod.outlook.com (10.164.23.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Thu, 5 Oct 2017 18:04:19 +0000 Received: from BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) by BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) with mapi id 15.20.0077.018; Thu, 5 Oct 2017 18:04:19 +0000 From: Ron Bonica To: "C. M. Heard" , OPSEC , Joe Touch , Bob Hinden , Brian E Carpenter Thread-Topic: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 Thread-Index: AQHTPYcyy6w36+fdfkOchQ9lkNpRO6LVbANA Date: Thu, 5 Oct 2017 18:04:19 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; x-originating-ip: [66.129.241.12] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BLUPR0501MB2050; 6:/UefqBUNz5xf/s+FJD/4APZpSChp0woh54U+CNOySGuJlC7rL+kZHsYyNNSnDwjScdNE//aqeVEYZ9gTxpIEjBuwRHT1JOKaabbd/KOPZYeqTqwqIgWpgd1LakaP5vPkGPeh4D126ugsdnOL9c8FNhOYVxAQ/0EqPjBlubaIajp2u8zDGlQzFXwsIJAH9KB+ujnrLP7XeOrp/yDWAuqHDWy5pNaHPiorQved19/GIvr+96w9kGL5Djgk7AG9pJ91fEb/ZkMeIgIYu+LVngBcWyw8saIseWPGKTyRrV+2kekQU+bXBfTBL5lhvm8xZRTKdvL5540QKlgChs3Udjl/DQ==; 5:ZQoKJwoYBZ27EDQFgGVIITohzwdL910ig4qnBRG9bVcscY6VEw0iyCBUgNuPJl1espGo0FYTZeBrM+HH+Ru7g4C+Jb2gOlA/pe+Uy8UW8hR5IQS+wA0AEcaivVkSdDRXhKKkqJXQZ9bRejDXMfvouw==; 24:XsK8jp0bNq9+OdIzAIzMVedvNROWe2uQKiiT1R1yA48zaCZNZM4q+kcX5j9Zo0w4i2EQNYPrZsCblc8YwgCYP+gqxFzYNDiniQ71vdLcnzA=; 7:ngYR7jZtoXTMN93G6MVkDMP1bSRmum2/FEIV0Yfk8XD/Bajal8MbE7UuACv4t83lQk5Ce16SmaImsEMC8Zlr67dGGVWRnrQFABMBy5OyEMsyKpm823rHfQc6+TiRNYrqgUVqy/k6L08zjj7dVi9x2kNH8J1NpDlrzjhDzMsmBNFVVKVJSqsOzbMt/AigR2qdImVPliVLuptTE4UfoDouGmkb0Ea9oP1pmpFu/vyZtYo= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 3c79425b-6860-46ae-f9a2-08d50c1b8022 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:BLUPR0501MB2050; x-ms-traffictypediagnostic: BLUPR0501MB2050: x-exchange-antispam-report-test: UriScan:(10436049006162)(21748063052155); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(100000703101)(100105400095)(3002001)(93006095)(93001095)(10201501046)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123560025)(20161123564025)(20161123562025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BLUPR0501MB2050; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BLUPR0501MB2050; x-forefront-prvs: 04519BA941 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(346002)(39860400002)(24454002)(199003)(51444003)(377454003)(189002)(9686003)(66066001)(99286003)(8676002)(86362001)(230783001)(229853002)(3280700002)(2950100002)(6436002)(2900100001)(50986999)(5660300001)(3660700001)(2906002)(106356001)(105586002)(77096006)(6506006)(7696004)(33656002)(189998001)(76176999)(53946003)(6246003)(14454004)(25786009)(236005)(966005)(101416001)(39060400002)(81166006)(97736004)(54356999)(74316002)(55016002)(6306002)(7736002)(6116002)(53546010)(19609705001)(81156014)(110136005)(316002)(606006)(54896002)(8936002)(102836003)(53936002)(8656003)(68736007)(3846002)(478600001)(790700001); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR0501MB2050; H:BLUPR0501MB2051.namprd05.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BLUPR0501MB2051A8FFB1DAFDCA9873B9E6AE700BLUPR0501MB2051_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Oct 2017 18:04:19.5281 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR0501MB2050 Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Oct 2017 18:04:33 -0000 --_000_BLUPR0501MB2051A8FFB1DAFDCA9873B9E6AE700BLUPR0501MB2051_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TWlrZSwNCg0KSSB0aGluayB0aGF0IHlvdSBqdXN0IHN0cnVjayB0aGUgbm90ZSB0aGF0IEZlcm5h bmRvIGFuZCBJIG1pc3NlZC4gVHJhbnNpdCByb3V0ZXJzIGZpbHRlciBleHRlbnNpb24gaGVhZGVy cyBmb3Igb25lIG9mIHRoZSBmb2xsb3dpbmcgcmVhc29uczoNCg0KDQotICAgICAgICAgIFRvIHBy b3RlY3QgdGhlbXNlbHZlcyAoYXMgaW4gUkZDIDYxOTIpDQoNCi0gICAgICAgICAgVG8gcHJvdGVj dCBkb3duc3RyZWFtIGRldmljZXMNCg0KVGhlcmVmb3JlLCB0aGUgZG9jdW1lbnQgc2hvdWxkIGNv bnRhaW4gdHdvIGNsZWFybHkgbWFya2VkIHNlY3Rpb25zLCBvbmUgcmVnYXJkaW5nIEVIIGZpbHRl cmluZyBwb2xpY2llcyB0aGF0IHByb3RlY3QgdGhlIHRyYW5zaXQgcm91dGVyIGFuZCBvbmUgcmVn YXJkaW5nIEVIIGZpbHRlcmluZyBwb2xpY2llcyB0aGF0IHByb3RlY3QgZG93bnN0cmVhbSBkZXZp Y2VzLg0KDQpUaGUgZmlyc3Qgc2VjdGlvbiBjYW46DQoNCg0KLSAgICAgICAgICBCZSB2ZXJ5IHNo b3J0ICgyIHBhZ2VzIG1heCkNCg0KLSAgICAgICAgICBCZSBndWlkZWQgbGFyZ2VseSBieSBSRkMg ODIwMA0KDQotICAgICAgICAgIFNwZWFrIHdpdGggc29tZSBkZWdyZWUgb2YgYXV0aG9yaXR5ICh3 aGlsZSBzdGlsbCBJTkZPUk1BVElPTkFMKQ0KDQpUaGUgc2Vjb25kIHNlY3Rpb24gc2hvdWxkIGJl Z2luIHdpdGggYSBkaXNjdXNzaW9uIG9mIHRoZSByZWxhdGlvbnNoaXAgYmV0d2VlbiB0aGUgdHJh bnNpdCByb3V0ZXIgYW5kIHRoZSBkb3duc3RyZWFtIGRldmljZXMuIExldOKAmXMgYXNzdW1lIHRo YXQgdGhlIHRyYW5zaXQgcm91dGVyIGJlbG9uZ3MgdG8gYW4gSVNQLCB3aGlsZSBkb3duc3RyZWFt IGRldmljZXMgZmFsbCBpbnRvIHRoZSBmb2xsb3dpbmcgdGhyZWUgY2xhc3NlczoNCg0KDQoxKSAg ICAgIEJlbG9uZyB0byB0aGUgSVNQDQoNCjIpICAgICAgQmVsb25nIHRvIHBhcnRpZXMgd2hvIHdh bnQgdG8gYmUgcHJvdGVjdGVkIGJ5IHRoZSBJU1AgKGUuZy4sIGl0cyBjdXN0b21lcnMpDQoNCjMp ICAgICAgQmVsb25nIHRvIG90aGVyIHBhcnRpZXMNCg0KVGhlcmVmb3JlLCB0aGUgdHJhbnNpdCBy b3V0ZXIgTUFZIGRpc2NhcmQgcGFja2V0cyB0aGF0IHBvc2UgYSB0aHJlYXQgdG8gdGhlIGZpcnN0 IHR3byBjbGFzc2VzIG9mIGRvd25zdHJlYW0gZGV2aWNlLCBidXQgTVVTVCBOT1QgZGlzY2FyZCBw YWNrZXRzIHRoYXQgYXJlIHJlcXVpcmVkIGJ5IHRoZSB0aGlyZCBjbGFzcyBvZiBkb3duc3RyZWFt IGRldmljZS4NCg0KRnJvbSB0aGlzIHBvaW50LCB3ZSBmb3JtdWxhdGUgYSBwb2xpY3kgdGhhdCAq bWlnaHQqIHNhdGlzZnkgdGhlIGFib3ZlIG1lbnRpb25lZCByZXF1aXJlbWVudC4gV2UgbWFyayB0 aGlzIHBvbGljeSB3aXRoIHRoZSBmb2xsb3dpbmcgY2F2ZWF0czoNCg0KDQotICAgICAgICAgIEl0 IGlzIGEgYmVzdCBndWVzcw0KDQotICAgICAgICAgIElmIHRoZSBwb2xpY3kgaXMgdG9vIHBlcm1p c3NpdmUsIGRvd25zdHJlYW0gZGV2aWNlcyBiZWxvbmdpbmcgdG8gdGhlIElTUCBhbmQgdGhvc2Ug d2hvIGl0IHByb3RlY3RzIHdpbGwgbm90IHJlY2VpdmUgYWxsIG9mIHRoZSBwcm90ZWN0aW9uIHBv c3NpYmxlDQoNCi0gICAgICAgICAgSWYgdGhlIHBvbGljeSBpcyB0b28gcmVzdHJpY3RpdmUsIGRv d25zdHJlYW0gZGV2aWNlcyBiZWxvbmdpbmcgdG8gb3RoZXIgcGFydGllcyB3aWxsIGV4cGVyaWVu Y2UgY29sbGF0ZXJhbCBkYW1hZ2UNCg0KLSAgICAgICAgICBPbmUgc2l6ZSBkb2VzbuKAmXQgZml0 IGFsbA0KDQpJZiB3ZSB3ZXJlIHRvIHJld29yayB0aGUgZG9jdW1lbnQgaW50byB0aGlzIHNoYXBl LCB3b3VsZCBpdCBhZGRyZXNzIHlvdXIgY29uY2VybnMuDQoNCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFJvbg0KDQoNCg0KRnJv bTogT1BTRUMgW21haWx0bzpvcHNlYy1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQy4g TS4gSGVhcmQNClNlbnQ6IFdlZG5lc2RheSwgT2N0b2JlciA0LCAyMDE3IDExOjA4IFBNDQpUbzog T1BTRUMgPG9wc2VjQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtPUFNFQ10gV0dMQyBmb3IgZHJh ZnQtaWV0Zi1vcHNlYy1pcHY2LWVoLWZpbHRlcmluZy0wMw0KDQpPbiBUaHUsIDUgT2N0IDIwMTcg MTE6MTA6MDYgKzEzMDAsIEJyaWFuIEUgQ2FycGVudGVyIHdyb3RlOg0KPiBPbiAwNS8xMC8yMDE3 IDAyOjEyLCBKb2UgVG91Y2ggd3JvdGU6DQo+DQo+PiBPbiA5LzI5LzIwMTcgMToxMiBBTSwgVmFu IERlIFZlbGRlLCBHdW50ZXIgKE5va2lhIC0gQkUvQW50d2VycCkgd3JvdGU6DQo+Pj4NCj4+PiBU aGlzIGlzIHRvIG9wZW4gYSB0d28gd2VlayBXR0xDDQo+Pj4gZm9yIGh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLW9wc2VjLWlwdjYtZWgtZmlsdGVyaW5nLTAzPGh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5v cmdfaHRtbF9kcmFmdC0yRGlldGYtMkRvcHNlYy0yRGlwdjYtMkRlaC0yRGZpbHRlcmluZy0yRDAz JmQ9RHdNRmFRJmM9SEFrWXVoNjNyc3VocjZTY2JmaDBVakJYZU1LLW5kYjN2b0RUWGNXem9DSSZy PUZjaDlGUTgyc2lyLUJvTHg4NGhLdUt3bC1BV0YyRWZwSGNBd3JEVGhLUDgmbT1wRE1PQUJlZmJ1 OEpIY0RIM3JjSHZ6T0FCbVNMbzhYMEtHYmlQdkxxbnBBJnM9TTd4SG5EdXVKeGhBMjFpTFZYT18t QVpqQWh2WHdnYU5fX25pUVJjb0J3YyZlPT4uDQo+Pj4NCj4+DQo+PiBJIGRvIG5vdCBhZ3JlZSB3 aXRoIHRoZSBjbGFpbXMgb2YgdGhpcyBkb2N1bWVudC4gSXQgImluZm9ybWF0aW9uYWxseSINCj4+ IGFkdmlzZXMgYWdhaW5zdCBzdXBwb3J0IGZvciBrZXkgSVB2NiBjYXBhYmlsaXRpZXMgYW5kIHVu ZGVybWluZXMgdGhlDQo+PiBleHRlbnNpYmlsaXR5IG9mIElQdjYgYnkgbWFraW5nIHJlY29tbWVu ZGF0aW9ucyBhYm91dCBkaXNjYXJkaW5nDQo+PiBjdXJyZW50bHkgdW5hc3NpZ25lZCBjb2RlcG9p bnRzLg0KPg0KPiBIZXJlJ3MgdGhlIHByb2JsZW0sIEpvZS4gSXQncyBhIGZhY3Qgb2YgbGlmZSB0 aGF0IG1hbnkgZmlyZXdhbGxzDQo+IGRpc2NhcmQgYSBsb3Qgb2Ygc3R1ZmYgdGhhdCB0aGV5IHNo b3VsZG4ndCAtIHRoYXQncyB3aHkgd2Ugd3JvdGUNCj4gUkZDIDcwNDUgLSBidXQgaW4gdGhlIHJl YWwgd29ybGQsIG9wZXJhdG9ycyBibHVuZGVyIGFyb3VuZCBiYXNlZA0KPiBvbiBmb2xrbG9yZSBh bmQgdmVuZG9ycycgZGVmYXVsdHMuIFdlIGNhbid0IGNoYW5nZSBhbnkgb2YgdGhhdCwgYnV0DQo+ IHdlIGNhbiB0cnkgdG8gaXNzdWUgc2Vuc2libGUgYWR2aWNlIHRoYXQsIG92ZXJhbGwsIHdpbGwg bGltaXQgdGhlDQo+IHJlc3VsdGluZyBicmVha2FnZS4gSU1ITyB0aGlzIGRvY3VtZW50LCBwb3Np dGlvbmVkIGNvcnJlY3RseSBhcw0KPiBJbmZvcm1hdGlvbmFsLCB3aWxsIGRvIHRoYXQ6IG9uIGJh bGFuY2UsIGl0IG1ha2VzIHRoZSB3b3JsZCBhIGJldHRlcg0KPiBwbGFjZS4NCg0KSSBhbSBhZnJh aWQgdGhhdCBJIGRvIG5vdCBhZ3JlZSB0aGF0IHRoZSBkb2N1bWVudCwgaW4gaXRzIHByZXNlbnQg Zm9ybSwNCndpbGwgZG8gdGhhdC4gSXQgc2F5czoNCg0KDQogICBUaGUgZmlsdGVyaW5nIHBvbGlj eSB0eXBpY2FsbHkgZGVwZW5kcyBvbiB3aGVyZSBpbiB0aGUgbmV0d29yayBzdWNoDQoNCiAgIHBv bGljeSBpcyBlbmZvcmNlZDogd2hlbiB0aGUgcG9saWN5IGlzIGVuZm9yY2VkIGluIGEgdHJhbnNp dCBuZXR3b3JrLA0KDQogICB0aGUgcG9saWN5IHR5cGljYWxseSBmb2xsb3dzIGEgImJsYWNrLWxp c3QiIGFwcHJvYWNoLCB3aGVyZSBvbmx5DQoNCiAgIHBhY2tldHMgd2l0aCBjbGVhciBuZWdhdGl2 ZSBpbXBsaWNhdGlvbnMgYXJlIGRyb3BwZWQuICBPbiB0aGUgb3RoZXINCg0KICAgaGFuZCwgd2hl biB0aGUgcG9saWN5IGlzIGVuZm9yY2VkIGNsb3NlciB0byB0aGUgZGVzdGluYXRpb24gc3lzdGVt cywNCg0KICAgdGhlIHBvbGljeSB0eXBpY2FsbHkgZm9sbG93cyBhICJ3aGl0ZS1saXN0IiBhcHBy b2FjaCwgd2hlcmUgb25seQ0KDQogICB0cmFmZmljIHRoYXQgaXMgZXhwZWN0ZWQgdG8gYmUgcmVj ZWl2ZWQgaXMgYWxsb3dlZC4gIFRoZSBhZHZpY2UgaW4NCg0KICAgdGhpcyBkb2N1bWVudCBpcyBh aW1lZCBvbmx5IGF0IHRyYW5zaXQgcm91dGVycyB0aGF0IG1heSBuZWVkIHRvDQoNCiAgIGVuZm9y Y2UgYSBmaWx0ZXJpbmcgcG9saWN5IGJhc2VkIG9uIHRoZSBFSHMgYW5kIElQdjYgb3B0aW9ucyBh IHBhY2tldA0KDQogICBtYXkgY29udGFpbiwgZm9sbG93aW5nIGEgImJsYWNrLWxpc3QiIGFwcHJv YWNoLCBhbmQgaGVuY2UgaXMgbGlrZWx5DQoNCiAgIHRvIGJlIG11Y2ggbW9yZSBwZXJtaXNzaXZl IHRoYXQgYSBmaWx0ZXJpbmcgcG9saWN5IHRvIGJlIGVtcGxveWVkDQoNCiAgIGUuZy4gYXQgdGhl IGVkZ2Ugb2YgYW4gZW50ZXJwcmlzZSBuZXR3b3JrLiAgVGhlIGFkdmljZSBpbiB0aGlzDQoNCiAg IGRvY3VtZW50IGlzIG1lYW50IHRvIGltcHJvdmUgdGhlIGN1cnJlbnQgc2l0dWF0aW9uIG9mIHRo ZSBkcm9wcGluZyBvZg0KDQogICBwYWNrZXRzIHdpdGggSVB2NiBFSHMgaW4gdGhlIEludGVybmV0 IFtSRkM3ODcyPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3ODcyJmQ9RHdNRmFRJmM9SEFrWXVoNjNyc3Vo cjZTY2JmaDBVakJYZU1LLW5kYjN2b0RUWGNXem9DSSZyPUZjaDlGUTgyc2lyLUJvTHg4NGhLdUt3 bC1BV0YyRWZwSGNBd3JEVGhLUDgmbT1wRE1PQUJlZmJ1OEpIY0RIM3JjSHZ6T0FCbVNMbzhYMEtH YmlQdkxxbnBBJnM9S3FWNVVpSTZJZTUxTnRvY3VUdzl6TUN0SFg4YU1oZWJvR0NQVkN6ZGVwQSZl PT5dLg0KDQp3aGlsZSBhdCB0aGUgc2FtZSB0aW1lIHByb21vdGluZyBhICoqZGVmYXVsdCBkZW55 KiogcG9saWN5IHdpdGgNCnJlc3BlY3QgdG8gdW5yZWNvZ25pemVkIG9wdGlvbnMgYW5kIHVucmVj b2duaXplZCBleHRlbnNpb24gaGVhZGVycy4NClRoYXQgaXMgYW50aXRoZXRpY2FsIHRvIHRoZSBt aXNzaW9uIG9mIGEgKip0cmFuc2l0IHJvdXRlcioqLCB3aGljaA0KaXMgdG8gZ2V0IHBhY2tldHMg dHJhbnNwYXJlbnRseSBmcm9tIHBvaW50IEEgdG8gcG9pbnQgQi4gSXQgaXMNCmVzcGVjaWFsbHkg ZWdyZWdpb3VzIHRvIGRpc3BlbnNlIHRoaXMgYWR2aWNlIGZvciB1bnJlY29nbml6ZWQNCmV4dGVu c2lvbiBoZWFkZXJzLCBzaW5jZSB0aGV5IGFyZSBpbmRpc3Rpbmd1aXNoYWJsZSBmcm9tIHVucmVj b2duaXplZA0KdHJhbnNwb3J0IHByb3RvY29scy4gSWYgdGhlc2UgdGhpbmdzIGFyZSBibG9ja2Vk IGJ5ICoqdHJhbnNpdCByb3V0ZXJzKioNCml0IGJlY29tZXMgIGltcG9zc2libGUgdG8gZGVwbG95 IGFueSBuZXcgb3B0aW9ucyBvciB0cmFuc3BvcnQgcHJvdG9jb2xzLg0KDQpCdXQgd2UgYWxyZWFk eSBrbm93IHRoYXQsIGRvbid0IHdlPw0KDQoNCg0KSWYgd2Ugd2FudCB0byBnaXZlIGNvbnN0cnVj dGl2ZSBhZHZpY2UgdGhhdCByZWFsbHkgd2lsbCBtYWtlIHRoZQ0KDQp3b3JsZCBhIGJldHRlciBw bGFjZSwgd2Ugc2hvdWxkOg0KDQoNCjEuKSBBZHZpc2Ugb3BlcmF0b3JzIG9mICoqdHJhbnNpdCBy b3V0ZXJzKiogdG8gYmUgdHJhbnNwYXJlbnQgdG8NCg0KZXZlcnl0aGluZyBvdGhlciB0aGFuIHRo ZSBIb3AtYnktSG9wIGV4dGVuc2lvbnMgaGVhZGVyLCBhbmQgcHJvdmlkZQ0KDQpkZXRhaWxlZCBh ZHZpY2Ugb24gd2hhdCB0byBkbyAoYmFzZWQgb24gdGhlIHVwZGF0ZXMgaW4gUkZDIDgyMDApDQoN CmFib3V0IEhvcC1ieS1Ib3Agb3B0aW9ucy4gVGhlIGRlZmF1bHQgc2hvdWxkIGJlIElHTk9SRSB1 bmxlc3MgdGhlcmUNCg0KaXMgYW4gb3B0aW9uIHlvdSBuZWVkIHRvIHByb2Nlc3MuDQoNCg0KMi4p IFJlc2VydmUgYWxsIHRoZSBkZXRhaWxlZCBmaWx0ZXJpbmcgYWR2aWNlZSBmb3Igb3BlcmF0b3Jz IG9mDQoNCmZpcmV3YWxscywgZW50ZXJwcmlzZSByb3V0ZXJzLCBhbmQgb3RoZXIgc3lzdGVtcyB3 aG9zZSBtaXNzaW9uIGl0DQoNCmlzIHRvIHByb3RlY3QgdGhlIGVuZCBzeXN0ZW1zIGJlaGluZCB0 aGVtIChvciB0byBwcmV2ZW50IG1pc2JlaGF2aW9yDQoNCmJ5IHNhaWQgZW5kIHN5c3RlbXMpLiBB IGRlZmF1bHQgZGVueSBmb3IgdW5yZWNvZ25pemVkIHN0dWZmIGlzIG5vdA0KDQp1bnJlYXNvbmFi bGUgZm9yIHN1Y2ggc3lzdGVtcy4NCg0KDQozLikgUmVtaW5kIGltcGxlbWVudG9ycyBvZiB0aGUg Zm9sbG93aW5nIHJlcXVpcmVtZW50IGZyb20gUkZDIDcwNDU6DQoNCg0KICAgRm9yd2FyZGluZyBu b2RlcyBNVVNUIGJlIGNvbmZpZ3VyYWJsZSB0byBhbGxvdyBwYWNrZXRzIGNvbnRhaW5pbmcNCg0K ICAgdW5yZWNvZ25pc2VkIGV4dGVuc2lvbiBoZWFkZXJzLCBidXQgdGhlIGRlZmF1bHQgY29uZmln dXJhdGlvbiBNQVkNCg0KICAgZHJvcCBzdWNoIHBhY2tldHMuDQoNCg0KYW5kIGFkZCBzaW1pbGFy IGFkdmljZSBmb3Igb3B0aW9ucy4NCg0KDQpUaGFua3MgYW5kIHJlZ2FyZHMsDQoNCg0KTWlrZSBI ZWFyZA0K --_000_BLUPR0501MB2051A8FFB1DAFDCA9873B9E6AE700BLUPR0501MB2051_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q291cmllcjsNCglwYW5vc2UtMToyIDcgNCA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7 Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQg NSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglw YW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5 OkNvbnNvbGFzOw0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERl ZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJ e21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7 DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1z b0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0 LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xs b3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVj b3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28t c3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291 cmllciBOZXciO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2 Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6 MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxl ZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglm b250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uSFRNTFByZWZvcm1h dHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1z by1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQi Ow0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBp biAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExp c3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjY2NTEyOTcwNzsNCglt c28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTgzNjUyMjQgMTMy NDQ2NzU2IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4 Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6LTsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6 Ljc1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4t bGVmdDoxLjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjEuNzVpbjsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVs NA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgltYXJnaW4tbGVmdDoyLjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjIuNzVpbjsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlz dCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6My4yNWluOw0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdp bi1sZWZ0OjMuNzVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9s O30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6NC4yNWluOw0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgltYXJnaW4tbGVmdDo0Ljc1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDoxMTQ2NDM4NjcyOw0KCW1z by1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMTc1MDkyNzc2IDEw NDgxMTE2NjAgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2 OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDotOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVh c3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3 IFJvbWFuIjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxl dmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7 fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBs Mg0KCXttc28tbGlzdC1pZDoxMjQwMzYyODk2Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1z by1saXN0LXRlbXBsYXRlLWlkczo5MDU5NzU2MTYgNjc2OTg3MTEgNjc2OTg3MTMgNjc2OTg3MTUg Njc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7fQ0K QGxpc3QgbDI6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0K CW1zby1sZXZlbC10ZXh0OiIlMVwpIjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0 IGwyOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwyOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBs MjpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZlbDUNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjt9DQpAbGlzdCBsMjpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4t bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDI6bGV2ZWw3DQoJe21z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDI6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDI6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJ dGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwzDQoJe21zby1saXN0LWlkOjE1OTUyMzcxMDM7 DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjIwMzIwNzM4 MzggNjc2OTg3MDUgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUg Njc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDM6bGV2ZWwxDQoJe21zby1sZXZl bC10ZXh0OiIlMVwpIjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwzOmxldmVs Mg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluO30NCkBsaXN0IGwzOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpy b21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMzpsZXZlbDQN Cgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMzpsZXZlbDUNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpA bGlzdCBsMzpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdo dDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDM6bGV2ZWw3DQoJe21zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47fQ0KQGxpc3QgbDM6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDM6bGV2ZWw5 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRl bnQ6LTkuMHB0O30NCkBsaXN0IGw0DQoJe21zby1saXN0LWlkOjE3MTQ4ODc5MTc7DQoJbXNvLWxp c3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi02MjQ1MjIyMTggNjc2OTg3 MTEgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMg Njc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDQ6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10ZXh0OiIlMVwpIjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGw0OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGw0OmxldmVs Mw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5k ZW50Oi05LjBwdDt9DQpAbGlzdCBsNDpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9 DQpAbGlzdCBsNDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsNDpsZXZlbDYNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0K QGxpc3QgbDQ6bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDQ6bGV2 ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47fQ0KQGxpc3QgbDQ6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGw1DQoJe21z by1saXN0LWlkOjE5NzQ0ODQzNzc7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3Qt dGVtcGxhdGUtaWRzOi0xODY3MzQwMjgwIC0xODA1OTk4OTgwIDY3Njk4NjkxIDY3Njk4NjkzIDY3 Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBs aXN0IGw1OmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ6LTsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNv LWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDU6bGV2ZWwyDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlz dCBsNTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsNTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsNTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGw1OmxldmVsNg0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw1OmxldmVs Nw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGw1OmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDU6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFy Z2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxv OnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtl bmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJl ZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0 PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJs dWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5NaWtlLDxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB0aGluayB0aGF0IHlvdSBqdXN0 IHN0cnVjayB0aGUgbm90ZSB0aGF0IEZlcm5hbmRvIGFuZCBJIG1pc3NlZC4NCjxhIG5hbWU9Il9N YWlsRW5kQ29tcG9zZSI+VHJhbnNpdCByb3V0ZXJzIGZpbHRlciBleHRlbnNpb24gaGVhZGVycyBm b3Igb25lIG9mIHRoZSBmb2xsb3dpbmcgcmVhc29uczo8bzpwPjwvbzpwPjwvYT48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVu ZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0 ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzUiPjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+LTxz cGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+ PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRv IHByb3RlY3QgdGhlbXNlbHZlcyAoYXMgaW4gUkZDIDYxOTIpPG86cD48L286cD48L3NwYW4+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6 LS4yNWluO21zby1saXN0OmwxIGxldmVsMSBsZm81Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsRW5kQ29tcG9zZSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPi08c3BhbiBzdHlsZT0i Zm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3Nw YW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UbyBwcm90ZWN0IGRv d25zdHJlYW0gZGV2aWNlczxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZXJlZm9yZSwg dGhlIGRvY3VtZW50IHNob3VsZCBjb250YWluIHR3byBjbGVhcmx5IG1hcmtlZCBzZWN0aW9ucywg b25lIHJlZ2FyZGluZyBFSCBmaWx0ZXJpbmcgcG9saWNpZXMgdGhhdCBwcm90ZWN0DQogdGhlIHRy YW5zaXQgcm91dGVyIGFuZCBvbmUgcmVnYXJkaW5nIEVIIGZpbHRlcmluZyBwb2xpY2llcyB0aGF0 IHByb3RlY3QgZG93bnN0cmVhbSBkZXZpY2VzLjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5k Q29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PlRoZSBmaXJzdCBzZWN0aW9uIGNhbjo8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBv c2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWlu ZGVudDotLjI1aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzUiPjxzcGFuIHN0eWxlPSJtc28tYm9v a21hcms6X01haWxFbmRDb21wb3NlIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+LTxzcGFuIHN0 eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFu Pjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkJlIHZlcnkg c2hvcnQgKDIgcGFnZXMgbWF4KTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDps MSBsZXZlbDEgbGZvNSI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2Ui PjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48c3Bh biBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4tPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7 VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+QmUgZ3VpZGVkIGxhcmdlbHkgYnkgUkZDIDgyMDA8 bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgi IHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzUiPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48IVtpZiAhc3VwcG9ydExpc3Rz XT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Okln bm9yZSI+LTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90 OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPlNwZWFrIHdpdGggc29tZSBkZWdyZWUgb2YgYXV0aG9yaXR5ICh3aGlsZSBzdGlsbCBJ TkZPUk1BVElPTkFMKTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls RW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZSBzZWNvbmQgc2Vj dGlvbiBzaG91bGQgYmVnaW4gd2l0aCBhIGRpc2N1c3Npb24gb2YgdGhlIHJlbGF0aW9uc2hpcCBi ZXR3ZWVuIHRoZSB0cmFuc2l0IHJvdXRlciBhbmQgdGhlIGRvd25zdHJlYW0NCiBkZXZpY2VzLiBM ZXTigJlzIGFzc3VtZSB0aGF0IHRoZSB0cmFuc2l0IHJvdXRlciBiZWxvbmdzIHRvIGFuIElTUCwg d2hpbGUgZG93bnN0cmVhbSBkZXZpY2VzIGZhbGwgaW50byB0aGUgZm9sbG93aW5nIHRocmVlIGNs YXNzZXM6PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1s aXN0OmwzIGxldmVsMSBsZm82Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29t cG9zZSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjEpPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQg JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+QmVsb25nIHRvIHRoZSBJU1A8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNv LWxpc3Q6bDMgbGV2ZWwxIGxmbzYiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRD b21wb3NlIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+Mik8c3BhbiBzdHlsZT0iZm9udDo3LjBw dCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj5CZWxvbmcgdG8gcGFydGllcyB3aG8gd2FudCB0byBiZSBwcm90ZWN0ZWQgYnkg dGhlIElTUCAoZS5nLiwgaXRzIGN1c3RvbWVycyk8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47 bXNvLWxpc3Q6bDMgbGV2ZWwxIGxmbzYiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxF bmRDb21wb3NlIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+Myk8c3BhbiBzdHlsZT0iZm9udDo3 LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj5CZWxvbmcgdG8gb3RoZXIgcGFydGllczxvOnA+PC9vOnA+PC9zcGFuPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPlRoZXJlZm9yZSwgdGhlIHRyYW5zaXQgcm91dGVyIE1BWSBkaXNjYXJkIHBhY2tl dHMgdGhhdCBwb3NlIGEgdGhyZWF0IHRvIHRoZSBmaXJzdCB0d28gY2xhc3NlcyBvZiBkb3duc3Ry ZWFtIGRldmljZSwNCiBidXQgTVVTVCBOT1QgZGlzY2FyZCBwYWNrZXRzIHRoYXQgYXJlIHJlcXVp cmVkIGJ5IHRoZSB0aGlyZCBjbGFzcyBvZiBkb3duc3RyZWFtIGRldmljZS48bzpwPjwvbzpwPjwv c3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5Gcm9tIHRoaXMgcG9pbnQsIHdlIGZvcm11bGF0ZSBhIHBvbGljeSB0 aGF0ICo8Yj5taWdodDwvYj4qIHNhdGlzZnkgdGhlIGFib3ZlIG1lbnRpb25lZCByZXF1aXJlbWVu dC4gV2UgbWFyayB0aGlzIHBvbGljeQ0KIHdpdGggdGhlIGZvbGxvd2luZyBjYXZlYXRzOjxvOnA+ PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv TGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMSBsZXZl bDEgbGZvNSI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjwhW2lm ICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48c3BhbiBzdHls ZT0ibXNvLWxpc3Q6SWdub3JlIj4tPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMg TmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+SXQgaXMgYSBiZXN0IGd1ZXNzPG86cD48L286cD48L3NwYW4+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRl bnQ6LS4yNWluO21zby1saXN0OmwxIGxldmVsMSBsZm81Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsRW5kQ29tcG9zZSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPi08c3BhbiBzdHls ZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48 L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB0aGUgcG9s aWN5IGlzIHRvbyBwZXJtaXNzaXZlLCBkb3duc3RyZWFtIGRldmljZXMgYmVsb25naW5nIHRvIHRo ZSBJU1AgYW5kIHRob3NlIHdobyBpdCBwcm90ZWN0cyB3aWxsIG5vdCByZWNlaXZlIGFsbCBvZiB0 aGUgcHJvdGVjdGlvbiBwb3NzaWJsZTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlz dDpsMSBsZXZlbDEgbGZvNSI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBv c2UiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4tPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgdGhlIHBvbGljeSBpcyB0b28gcmVzdHJp Y3RpdmUsIGRvd25zdHJlYW0gZGV2aWNlcyBiZWxvbmdpbmcgdG8gb3RoZXIgcGFydGllcyB3aWxs IGV4cGVyaWVuY2UgY29sbGF0ZXJhbCBkYW1hZ2U8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47 bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzUiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxF bmRDb21wb3NlIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+LTxzcGFuIHN0eWxlPSJmb250Ojcu MHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtl bmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPk9uZSBzaXplIGRvZXNu4oCZdCBm aXQgYWxsPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21w b3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgd2Ugd2VyZSB0byByZXdvcmsg dGhlIGRvY3VtZW50IGludG8gdGhpcyBzaGFwZSwgd291bGQgaXQgYWRkcmVzcyB5b3VyIGNvbmNl cm5zLjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9z ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyBSb248bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVu ZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjwvc3Bhbj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUx IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gT1BT RUMgW21haWx0bzpvcHNlYy1ib3VuY2VzQGlldGYub3JnXQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5D LiBNLiBIZWFyZDxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIE9jdG9iZXIgNCwgMjAxNyAx MTowOCBQTTxicj4NCjxiPlRvOjwvYj4gT1BTRUMgJmx0O29wc2VjQGlldGYub3JnJmd0Ozxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW09QU0VDXSBXR0xDIGZvciBkcmFmdC1pZXRmLW9wc2VjLWlw djYtZWgtZmlsdGVyaW5nLTAzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXIiPk9uIFRodSwgNSBPY3QgMjAxNyAxMToxMDowNiAmIzQz OzEzMDAsIEJyaWFuIEUgQ2FycGVudGVyIHdyb3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXIiPiZndDsgT24gMDUvMTAvMjAxNyAwMjoxMiwgSm9l IFRvdWNoIHdyb3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OkNvdXJpZXIiPiZndDs8L3NwYW4+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTpDb3VyaWVyIj4mZ3Q7Jmd0OyBPbiA5LzI5LzIwMTcgMToxMiBBTSwgVmFuIERlIFZl bGRlLCBHdW50ZXIgKE5va2lhIC0gQkUvQW50d2VycCkgd3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291cmllciI+Jmd0OyZndDsmZ3Q7PC9zcGFuPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291cmllciI+Jmd0OyZn dDsmZ3Q7IFRoaXMgaXMgdG8gb3BlbiBhIHR3byB3ZWVrIFdHTEM8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7Jmd0OyZndDsgZm9yJm5ic3A7 PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBz LTNBX190b29scy5pZXRmLm9yZ19odG1sX2RyYWZ0LTJEaWV0Zi0yRG9wc2VjLTJEaXB2Ni0yRGVo LTJEZmlsdGVyaW5nLTJEMDMmYW1wO2Q9RHdNRmFRJmFtcDtjPUhBa1l1aDYzcnN1aHI2U2NiZmgw VWpCWGVNSy1uZGIzdm9EVFhjV3pvQ0kmYW1wO3I9RmNoOUZRODJzaXItQm9MeDg0aEt1S3dsLUFX RjJFZnBIY0F3ckRUaEtQOCZhbXA7bT1wRE1PQUJlZmJ1OEpIY0RIM3JjSHZ6T0FCbVNMbzhYMEtH YmlQdkxxbnBBJmFtcDtzPU03eEhuRHV1SnhoQTIxaUxWWE9fLUFaakFodlh3Z2FOX19uaVFSY29C d2MmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6IzEyMURFMyI+aHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL2RyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmctMDM8L3NwYW4+PC9h Pi48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4m Z3Q7Jmd0OyZndDs8L3NwYW4+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpDb3VyaWVyIj4mZ3Q7Jmd0Ozwvc3Bhbj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXIiPiZndDsmZ3Q7IEkgZG8gbm90IGFncmVlIHdpdGggdGhl IGNsYWltcyBvZiB0aGlzIGRvY3VtZW50LiBJdCAmcXVvdDtpbmZvcm1hdGlvbmFsbHkmcXVvdDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7 Jmd0OyBhZHZpc2VzIGFnYWluc3Qgc3VwcG9ydCBmb3Iga2V5IElQdjYgY2FwYWJpbGl0aWVzIGFu ZCB1bmRlcm1pbmVzIHRoZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkNvdXJpZXIiPiZndDsmZ3Q7IGV4dGVuc2liaWxpdHkgb2YgSVB2NiBieSBtYWtpbmcgcmVj b21tZW5kYXRpb25zIGFib3V0IGRpc2NhcmRpbmc8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7Jmd0OyBjdXJyZW50bHkgdW5hc3NpZ25lZCBj b2RlcG9pbnRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNv dXJpZXIiPiZndDs8L3NwYW4+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpDb3VyaWVyIj4mZ3Q7IEhlcmUncyB0aGUgcHJvYmxlbSwgSm9lLiBJdCdzIGEgZmFjdCBv ZiBsaWZlIHRoYXQgbWFueSBmaXJld2FsbHM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7IGRpc2NhcmQgYSBsb3Qgb2Ygc3R1ZmYgdGhhdCB0 aGV5IHNob3VsZG4ndCAtIHRoYXQncyB3aHkgd2Ugd3JvdGU8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7IFJGQyA3MDQ1IC0gYnV0IGluIHRo ZSByZWFsIHdvcmxkLCBvcGVyYXRvcnMgYmx1bmRlciBhcm91bmQgYmFzZWQ8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7IG9uIGZvbGtsb3Jl IGFuZCB2ZW5kb3JzJyBkZWZhdWx0cy4gV2UgY2FuJ3QgY2hhbmdlIGFueSBvZiB0aGF0LCBidXQ8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7 IHdlIGNhbiB0cnkgdG8gaXNzdWUgc2Vuc2libGUgYWR2aWNlIHRoYXQsIG92ZXJhbGwsIHdpbGwg bGltaXQgdGhlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291 cmllciI+Jmd0OyByZXN1bHRpbmcgYnJlYWthZ2UuIElNSE8gdGhpcyBkb2N1bWVudCwgcG9zaXRp b25lZCBjb3JyZWN0bHkgYXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpDb3VyaWVyIj4mZ3Q7IEluZm9ybWF0aW9uYWwsIHdpbGwgZG8gdGhhdDogb24gYmFsYW5j ZSwgaXQgbWFrZXMgdGhlIHdvcmxkIGEgYmV0dGVyPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6Q291cmllciI+Jmd0OyBwbGFjZS48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFBMUEiPkkgYW0g YWZyYWlkIHRoYXQgSSBkbyBub3QgYWdyZWUgdGhhdCB0aGUgZG9jdW1lbnQsIGluIGl0cyBwcmVz ZW50IGZvcm0sPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291 cmllcjtjb2xvcjojMUExQTFBIj53aWxsIGRvIHRoYXQuIEl0IHNheXM6PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3Jl OmFsd2F5cyI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgVGhlIGZpbHRl cmluZyBwb2xpY3kgdHlwaWNhbGx5IGRlcGVuZHMgb24gd2hlcmUgaW4gdGhlIG5ldHdvcmsgc3Vj aDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6 YWx3YXlzIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBwb2xpY3kgaXMg ZW5mb3JjZWQ6IHdoZW4gdGhlIHBvbGljeSBpcyBlbmZvcmNlZCBpbiBhIHRyYW5zaXQgbmV0d29y ayw8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3Jl OmFsd2F5cyI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgdGhlIHBvbGlj eSB0eXBpY2FsbHkgZm9sbG93cyBhICZxdW90O2JsYWNrLWxpc3QmcXVvdDsgYXBwcm9hY2gsIHdo ZXJlIG9ubHk8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWst YmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgcGFj a2V0cyB3aXRoIGNsZWFyIG5lZ2F0aXZlIGltcGxpY2F0aW9ucyBhcmUgZHJvcHBlZC4mbmJzcDsg T24gdGhlIG90aGVyPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJy ZWFrLWJlZm9yZTphbHdheXMiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7 IGhhbmQsIHdoZW4gdGhlIHBvbGljeSBpcyBlbmZvcmNlZCBjbG9zZXIgdG8gdGhlIGRlc3RpbmF0 aW9uIHN5c3RlbXMsPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJy ZWFrLWJlZm9yZTphbHdheXMiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7 IHRoZSBwb2xpY3kgdHlwaWNhbGx5IGZvbGxvd3MgYSAmcXVvdDt3aGl0ZS1saXN0JnF1b3Q7IGFw cHJvYWNoLCB3aGVyZSBvbmx5PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJw YWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7 Jm5ic3A7IHRyYWZmaWMgdGhhdCBpcyBleHBlY3RlZCB0byBiZSByZWNlaXZlZCBpcyBhbGxvd2Vk LiZuYnNwOyA8aT48dT48c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp5ZWxsb3ciPlRoZSBhZHZpY2Ug aW48bzpwPjwvbzpwPjwvc3Bhbj48L3U+PC9pPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9InBh Z2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PGk+PHU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2Jh Y2tncm91bmQ6eWVsbG93Ij4mbmJzcDsmbmJzcDsgdGhpcyBkb2N1bWVudCBpcyBhaW1lZCBvbmx5 IGF0IHRyYW5zaXQgcm91dGVycyB0aGF0IG1heSBuZWVkIHRvPG86cD48L286cD48L3NwYW4+PC91 PjwvaT48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PGk+PHU+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6eWVsbG93Ij4mbmJzcDsmbmJzcDsg ZW5mb3JjZSBhIGZpbHRlcmluZyBwb2xpY3kgYmFzZWQgb24gdGhlIEVIcyBhbmQgSVB2NiBvcHRp b25zIGEgcGFja2V0PG86cD48L286cD48L3NwYW4+PC91PjwvaT48L3ByZT4NCjxwcmUgc3R5bGU9 InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PGk+PHU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr O2JhY2tncm91bmQ6eWVsbG93Ij4mbmJzcDsmbmJzcDsgbWF5IGNvbnRhaW4sIGZvbGxvd2luZyBh ICZxdW90O2JsYWNrLWxpc3QmcXVvdDsgYXBwcm9hY2gsIGFuZCBoZW5jZSBpcyBsaWtlbHk8bzpw PjwvbzpwPjwvc3Bhbj48L3U+PC9pPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZv cmU6YWx3YXlzIj48aT48dT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZDp5ZWxs b3ciPiZuYnNwOyZuYnNwOyB0byBiZSBtdWNoIG1vcmUgcGVybWlzc2l2ZSB0aGF0IGEgZmlsdGVy aW5nIHBvbGljeSB0byBiZSBlbXBsb3llZDxvOnA+PC9vOnA+PC9zcGFuPjwvdT48L2k+PC9wcmU+ DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxpPjx1PjxzcGFuIHN0eWxl PSJjb2xvcjpibGFjaztiYWNrZ3JvdW5kOnllbGxvdyI+Jm5ic3A7Jm5ic3A7IGUuZy4gYXQgdGhl IGVkZ2Ugb2YgYW4gZW50ZXJwcmlzZSBuZXR3b3JrLjwvc3Bhbj48L3U+PC9pPjxzcGFuIHN0eWxl PSJjb2xvcjpibGFjayI+Jm5ic3A7IFRoZSBhZHZpY2UgaW4gdGhpczxvOnA+PC9vOnA+PC9zcGFu PjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBkb2N1bWVudCBpcyBtZWFudCB0byBpbXByb3Zl IHRoZSBjdXJyZW50IHNpdHVhdGlvbiBvZiB0aGUgZHJvcHBpbmcgb2Y8bzpwPjwvbzpwPjwvc3Bh bj48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5 bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgcGFja2V0cyB3aXRoIElQdjYgRUhzIGluIHRo ZSBJbnRlcm5ldCBbPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3Yy L3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19odG1sX3JmYzc4NzImYW1wO2Q9RHdNRmFR JmFtcDtjPUhBa1l1aDYzcnN1aHI2U2NiZmgwVWpCWGVNSy1uZGIzdm9EVFhjV3pvQ0kmYW1wO3I9 RmNoOUZRODJzaXItQm9MeDg0aEt1S3dsLUFXRjJFZnBIY0F3ckRUaEtQOCZhbXA7bT1wRE1PQUJl ZmJ1OEpIY0RIM3JjSHZ6T0FCbVNMbzhYMEtHYmlQdkxxbnBBJmFtcDtzPUtxVjVVaUk2SWU1MU50 b2N1VHc5ek1DdEhYOGFNaGVib0dDUFZDemRlcEEmYW1wO2U9IiB0aXRsZT0iJnF1b3Q7T2JzZXJ2 YXRpb25zIG9uIHRoZSBEcm9wcGluZyBvZiBQYWNrZXRzIHdpdGggSVB2NiBFeHRlbnNpb24gSGVh ZGVycyBpbiB0aGUgUmVhbCBXb3JsZCZxdW90OyI+UkZDNzg3MjwvYT5dLjxvOnA+PC9vOnA+PC9z cGFuPjwvcHJlPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmO2NvbG9yOmJsYWNrO21zby1mYXJlYXN0LWxh bmd1YWdlOkVOLVVTIj48YnIgY2xlYXI9ImFsbCIgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFs d2F5cyI+DQo8L3NwYW4+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87cGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFBMUEiPndoaWxlIGF0IHRo ZSBzYW1lIHRpbWUgcHJvbW90aW5nIGEgKio8aT48dT5kZWZhdWx0IGRlbnk8L3U+PC9pPioqIHBv bGljeSB3aXRoPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 cGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFBMUEiPnJlc3BlY3QgdG8gdW5yZWNvZ25pemVk IG9wdGlvbnMgYW5kIHVucmVjb2duaXplZCBleHRlbnNpb24gaGVhZGVycy48L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDs7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztwYWdlLWJyZWFrLWJlZm9yZTphbHdh eXMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvdXJpZXI7Y29s b3I6IzFBMUExQSI+VGhhdCBpcyBhbnRpdGhldGljYWwgdG8gdGhlIG1pc3Npb24gb2YgYSAqKjxp Pjx1PnRyYW5zaXQgcm91dGVyPC91PjwvaT4qKiwgd2hpY2g8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6 YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUEx QSI+aXMgdG8gZ2V0IHBhY2tldHMgdHJhbnNwYXJlbnRseSBmcm9tIHBvaW50IEEgdG8gcG9pbnQg Qi4gSXQgaXM8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztw YWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUExQSI+ZXNwZWNpYWxseSBlZ3JlZ2lvdXMgdG8g ZGlzcGVuc2UgdGhpcyBhZHZpY2UgZm9yIHVucmVjb2duaXplZDwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xv cjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO3BhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjojMUEx QTFBIj5leHRlbnNpb24gaGVhZGVycywgc2luY2UgdGhleSBhcmUgaW5kaXN0aW5ndWlzaGFibGUg ZnJvbSB1bnJlY29nbml6ZWQ8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bztwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUExQSI+dHJhbnNwb3J0IHByb3Rv Y29scy4gSWYgdGhlc2UgdGhpbmdzIGFyZSBibG9ja2VkIGJ5Jm5ic3A7Kio8aT48dT50cmFuc2l0 IHJvdXRlcnM8L3U+PC9pPioqPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87cGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFBMUEiPml0IGJlY29tZXMmbmJz cDsgaW1wb3NzaWJsZSB0byBkZXBsb3kgYW55IG5ldyBvcHRpb25zIG9yIHRyYW5zcG9ydCBwcm90 b2NvbHMuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cHJlIHN0eWxl PSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QnV0 IHdlIGFscmVhZHkga25vdyB0aGF0LCBkb24ndCB3ZT88bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4N CjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5bGU9ImNvbG9y OmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2Ut YnJlYWstYmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5JZiB3ZSB3YW50 IHRvIGdpdmUgY29uc3RydWN0aXZlIGFkdmljZSB0aGF0IHJlYWxseSB3aWxsIG1ha2UgdGhlPC9z cGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdh eXMiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+d29ybGQgYSBiZXR0ZXIgcGxhY2UsIHdlIHNo b3VsZDo8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrO21zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48YnIgY2xlYXI9ImFsbCIgc3R5bGU9InBhZ2UtYnJlYWst YmVmb3JlOmFsd2F5cyI+DQo8L3NwYW4+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTph bHdheXMiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+MS4pIEFkdmlzZSBvcGVyYXRvcnMgb2Yg PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFBMUEiPioq PGk+PHU+dHJhbnNpdCByb3V0ZXJzPC91PjwvaT4qKiB0byBiZSB0cmFuc3BhcmVudCB0bzwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlz Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjojMUExQTFBIj5ldmVyeXRo aW5nIG90aGVyIHRoYW4gdGhlIEhvcC1ieS1Ib3AgZXh0ZW5zaW9ucyBoZWFkZXIsIGFuZCBwcm92 aWRlPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9y ZTphbHdheXMiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFBMUEi PmRldGFpbGVkIGFkdmljZSBvbiB3aGF0IHRvIGRvIChiYXNlZCBvbiB0aGUgdXBkYXRlcyBpbiBS RkMgODIwMCk8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWst YmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFB MUExQSI+YWJvdXQgSG9wLWJ5LUhvcCBvcHRpb25zLiBUaGUgZGVmYXVsdCBzaG91bGQgYmUgSUdO T1JFIHVubGVzcyB0aGVyZTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFn ZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291cmllcjtj b2xvcjojMUExQTFBIj5pcyBhbiBvcHRpb24geW91IG5lZWQgdG8gcHJvY2Vzcy48L3NwYW4+PG86 cD48L286cD48L3ByZT4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OkNvdXJpZXI7Y29sb3I6IzFBMUExQTttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PGJyIGNs ZWFyPSJhbGwiIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPg0KPC9zcGFuPg0KPHBy ZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6Q291cmllcjtjb2xvcjojMUExQTFBIj4yLikgUmVzZXJ2ZSBhbGwgdGhlIGRldGFpbGVkIGZp bHRlcmluZyBhZHZpY2VlIGZvciBvcGVyYXRvcnMgb2Y8L3NwYW4+PG86cD48L286cD48L3ByZT4N CjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUExQSI+ZmlyZXdhbGxzLCBlbnRlcnByaXNlIHJvdXRl cnMsIGFuZCBvdGhlciBzeXN0ZW1zIHdob3NlIG1pc3Npb24gaXQ8L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUExQSI+aXMgdG8gcHJvdGVjdCB0aGUgZW5k IHN5c3RlbXMgYmVoaW5kIHRoZW0gKG9yIHRvIHByZXZlbnQgbWlzYmVoYXZpb3I8L3NwYW4+PG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUExQSI+Ynkgc2FpZCBlbmQg c3lzdGVtcykuIEEgZGVmYXVsdCBkZW55IGZvciB1bnJlY29nbml6ZWQgc3R1ZmYgaXMgbm90PC9z cGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdh eXMiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFBMUEiPnVucmVh c29uYWJsZSBmb3Igc3VjaCBzeXN0ZW1zLjwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjojMUExQTFB O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48YnIgY2xlYXI9ImFsbCIgc3R5bGU9InBhZ2Ut YnJlYWstYmVmb3JlOmFsd2F5cyI+DQo8L3NwYW4+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJl Zm9yZTphbHdheXMiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxQTFB MUEiPjMuKSBSZW1pbmQgaW1wbGVtZW50b3JzIG9mIHRoZSBmb2xsb3dpbmcgcmVxdWlyZW1lbnQg ZnJvbSBSRkMgNzA0NTo8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUExQTttc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+PGJyIGNsZWFyPSJhbGwiIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9y ZTphbHdheXMiPg0KPC9zcGFuPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlz Ij48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBGb3J3YXJkaW5nIG5vZGVz IE1VU1QgYmUgY29uZmlndXJhYmxlIHRvIGFsbG93IHBhY2tldHMgY29udGFpbmluZzxvOnA+PC9v OnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyB1bnJlY29nbmlzZWQgZXh0ZW5z aW9uIGhlYWRlcnMsIGJ1dCB0aGUgZGVmYXVsdCBjb25maWd1cmF0aW9uIE1BWTxvOnA+PC9vOnA+ PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBkcm9wIHN1Y2ggcGFja2V0cy48bzpw PjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzFBMUExQTttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ PGJyIGNsZWFyPSJhbGwiIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPg0KPC9zcGFu Pg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6Q291cmllcjtjb2xvcjojMUExQTFBIj5hbmQgYWRkIHNpbWlsYXIgYWR2aWNlIGZv ciBvcHRpb25zLjwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjojMUExQTFBO21zby1mYXJlYXN0LWxh bmd1YWdlOkVOLVVTIj48YnIgY2xlYXI9ImFsbCIgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFs d2F5cyI+DQo8L3NwYW4+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+VGhhbmtzIGFuZCByZWdhcmRzLDwvc3Bhbj48bzpwPjwv bzpwPjwvcHJlPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2s7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPjxiciBjbGVhcj0iYWxsIiBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4NCjwv c3Bhbj4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+PHNwYW4gc3R5bGU9 ImNvbG9yOmJsYWNrIj5NaWtlIEhlYXJkPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_BLUPR0501MB2051A8FFB1DAFDCA9873B9E6AE700BLUPR0501MB2051_-- From nobody Thu Oct 5 11:28:28 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 790D01343C3 for ; Thu, 5 Oct 2017 11:28:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.988 X-Spam-Level: X-Spam-Status: No, score=-1.988 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=strayalpha.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iZ_lynyIG3aK for ; Thu, 5 Oct 2017 11:28:24 -0700 (PDT) Received: from server217-3.web-hosting.com (server217-3.web-hosting.com [198.54.115.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E608513433C for ; Thu, 5 Oct 2017 11:28:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=strayalpha.com; s=default; h=To:References:Message-Id: Content-Transfer-Encoding:Cc:Date:In-Reply-To:From:Subject:Mime-Version: Content-Type:Sender:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=/vQi38jAMHdwCM/gB16pv9iAtk41QFa8lc68ddwCHA4=; b=Eqdjd+W2pxkVfZeCl9UiFyqNK yCWGXlFTkSAOTgGWm/ScX2LtUW6LyP/QvkNnxXNQcp0l9ffiZdq3rYFXJYvoDB29QRpuSglslniK8 eJZithl4YGFPXn57Naq1+SG+cYEySE3+FGn2yR5mL1HNUgx0zP0oBjbHuI1Y5HEHsVL8IE+27zgWk 06SRF4T9ybkR12/TvHjbe2jQyBQGapIKgYXWlOR3ikANzExJTAesZmMkF1IvBQY9KUNXwkL1cPYm6 nfItKVo48cigCbIxTQowivUr4HDM3lATllTvvhrkQmdmH2C+ymp9Hfu0vXZ9ueIEH/igMMXQrZriS 4VdKSO/2A==; Received: from [172.58.23.197] (port=65491 helo=[IPv6:2607:fb90:6643:c811:48f0:7e29:a138:1426]) by server217.web-hosting.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.87) (envelope-from ) id 1e0Asf-003yYq-Ek; Thu, 05 Oct 2017 14:28:23 -0400 Content-Type: multipart/alternative; boundary=Apple-Mail-C8CA20A4-37A1-46D0-86C5-9529D7DCCA69 Mime-Version: 1.0 (1.0) From: Joe Touch X-Mailer: iPhone Mail (15A421) In-Reply-To: Date: Thu, 5 Oct 2017 11:28:15 -0700 Cc: "C. M. Heard" , OPSEC , Bob Hinden , Brian E Carpenter Content-Transfer-Encoding: 7bit Message-Id: <1B0C8F91-89B5-4F53-86DF-D79A3D18A76C@strayalpha.com> References: To: Ron Bonica X-OutGoing-Spam-Status: No, score=-1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server217.web-hosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - strayalpha.com X-Get-Message-Sender-Via: server217.web-hosting.com: authenticated_id: touch@strayalpha.com X-Authenticated-Sender: server217.web-hosting.com: touch@strayalpha.com X-Source: X-Source-Args: X-Source-Dir: X-From-Rewrite: unmodified, already matched Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Oct 2017 18:28:26 -0000 --Apple-Mail-C8CA20A4-37A1-46D0-86C5-9529D7DCCA69 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On Oct 5, 2017, at 11:04 AM, Ron Bonica wrote: >=20 > I think that you just struck the note that Fernando and I missed. Transit r= outers filter extension headers for one of the following reasons: >=20 > =20 >=20 > - To protect themselves (as in RFC 6192) >=20 > - To protect downstream devices >=20 A similar dimension includes the impact to the IPv6 standard, ie is the beha= vior permitted, allowed but discouraged, or in violation.=20 Protecting yourself and other devices might not be valid if you break the pr= otocol. Just because a router can=E2=80=99t do something isn=E2=80=99t a rea= son to say it=E2=80=99s ok not to. =20 IPv6 is a ride with a minimum height requirement.=20 Joe= --Apple-Mail-C8CA20A4-37A1-46D0-86C5-9529D7DCCA69 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable


On Oct 5= , 2017, at 11:04 AM, Ron Bonica <r= bonica@juniper.net> wrote:

I think that you just struck the note= that Fernando and I missed. Transit routers filter extension headers for one= of the following reasons:

 

To protect themselves (as i= n RFC 6192)

To protect downstream devic= es

A similar dimension includes the= impact to the IPv6 standard, ie is the behavior permitted, allowed but disc= ouraged, or in violation. 

Protecting yourself= and other devices might not be valid if you break the protocol. Just becaus= e a router can=E2=80=99t do something isn=E2=80=99t a reason to say it=E2=80= =99s ok not to.  

IPv6 is a ride with a minimu= m height requirement. 

Joe
= --Apple-Mail-C8CA20A4-37A1-46D0-86C5-9529D7DCCA69-- From nobody Thu Oct 5 12:35:51 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB69D132D51 for ; Thu, 5 Oct 2017 12:35:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gD0ywUjsdR-C for ; Thu, 5 Oct 2017 12:35:47 -0700 (PDT) Received: from mail-pf0-x229.google.com (mail-pf0-x229.google.com [IPv6:2607:f8b0:400e:c00::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88A52132D89 for ; Thu, 5 Oct 2017 12:35:47 -0700 (PDT) Received: by mail-pf0-x229.google.com with SMTP id z84so8423539pfi.2 for ; Thu, 05 Oct 2017 12:35:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:organization:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=pXtRlpP2bs0Q0HZqgzU36raiK6TGzY44mlCvZghS25k=; b=Ojm3ixr1o8mhtjimRX3ZuAKblRqCD2NsPyyCK5q+F5iTdm45+w2bm3oX0SV4n0rLFm aQdgOcf5TURoPZdfswiyGwsJ2Bci7s1Zcj6fqHZoj0mCqGLo+3jLStptCnzgfLQKRUUi xywF0wmBWV21vtCuOaeCvketjHb2cVppi0POq+rbIAWsfjZ8JO6R2mEKReibPhkkCS0D PwvW0kffDxYFFosOizkCGs+iSBlbNo17zB2rIuOTpwVneQelxv05DQTGBq1Ufkuxkdqo yHqm1K9/JfBsLrBIO89AGOJSllyeRa3luxQ1o6ftymNg3RDFp8+OVkO/a3/XgguMv2Q6 Fdfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=pXtRlpP2bs0Q0HZqgzU36raiK6TGzY44mlCvZghS25k=; b=ctyCdHecv/2BS/MMr96EdGMyhRVmPgFa6bU9Y95zG4D3KEG0+a1WM0Lt6YgmM0Mg2c KYbvyd23AEL4aixF/dfJ+lrBq4jfsrRaLCI/uu17UB7Pr9mtKacM4wfma4rvx9L8oVjK TH8p9TXwY50rR9C3iJ9jkI6Nq3vHNrlHxdost0CNt+epHSg2l8anbj4lLlegD+rGfWIr beNySgtTYjTgIkuGqoEQgkTzyhXzHuteKFjEhN5ir+AA0A6RTlCiHkcT+AEJkKDZkP/W 3wa65FanqEmVGTV5kyAbQtU0TUkkq9ItURHTnjeTb0GmVc0B5pyt+9qXYfY3k+pJMkos LTwA== X-Gm-Message-State: AHPjjUh2v4iA9an6X/wBAP5Cks3mj33Qo7bCWY6l/3S8sbvLDLWBV+M5 4LlrygUQTqwtso8mCbpkJFn2CA== X-Google-Smtp-Source: AOwi7QBnCXKdmL6hFIhZhvEOHBFgjH+m6D5qku/TLXenagMgbwF7gIBycHsV/Fzx3DW3Lw54NNtabw== X-Received: by 10.84.194.131 with SMTP id h3mr23530147pld.352.1507232147065; Thu, 05 Oct 2017 12:35:47 -0700 (PDT) Received: from ?IPv6:2406:e007:6d3c:1:28cc:dc4c:9703:6781? ([2406:e007:6d3c:1:28cc:dc4c:9703:6781]) by smtp.gmail.com with ESMTPSA id f9sm31441134pfe.150.2017.10.05.12.35.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 Oct 2017 12:35:46 -0700 (PDT) To: Ron Bonica , "C. M. Heard" , OPSEC , Joe Touch , Bob Hinden References: From: Brian E Carpenter Organization: University of Auckland Message-ID: <53ee6e36-9976-317f-5e74-86cfc6a53e71@gmail.com> Date: Fri, 6 Oct 2017 08:35:51 +1300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Oct 2017 19:35:50 -0000 Ron, Mike, Yes. I'd missed that point. Regards Brian On 06/10/2017 07:04, Ron Bonica wrote: > Mike, >=20 > I think that you just struck the note that Fernando and I missed. Trans= it routers filter extension headers for one of the following reasons: >=20 >=20 > - To protect themselves (as in RFC 6192) >=20 > - To protect downstream devices >=20 > Therefore, the document should contain two clearly marked sections, one= regarding EH filtering policies that protect the transit router and one = regarding EH filtering policies that protect downstream devices. >=20 > The first section can: >=20 >=20 > - Be very short (2 pages max) >=20 > - Be guided largely by RFC 8200 >=20 > - Speak with some degree of authority (while still INFORMATION= AL) >=20 > The second section should begin with a discussion of the relationship b= etween the transit router and the downstream devices. Let=E2=80=99s assum= e that the transit router belongs to an ISP, while downstream devices fal= l into the following three classes: >=20 >=20 > 1) Belong to the ISP >=20 > 2) Belong to parties who want to be protected by the ISP (e.g., it= s customers) >=20 > 3) Belong to other parties >=20 > Therefore, the transit router MAY discard packets that pose a threat to= the first two classes of downstream device, but MUST NOT discard packets= that are required by the third class of downstream device. >=20 > From this point, we formulate a policy that *might* satisfy the above m= entioned requirement. We mark this policy with the following caveats: >=20 >=20 > - It is a best guess >=20 > - If the policy is too permissive, downstream devices belongin= g to the ISP and those who it protects will not receive all of the protec= tion possible >=20 > - If the policy is too restrictive, downstream devices belongi= ng to other parties will experience collateral damage >=20 > - One size doesn=E2=80=99t fit all >=20 > If we were to rework the document into this shape, would it address you= r concerns. >=20 > Ron >=20 >=20 >=20 > From: OPSEC [mailto:opsec-bounces@ietf.org] On Behalf Of C. M. Heard > Sent: Wednesday, October 4, 2017 11:08 PM > To: OPSEC > Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 >=20 > On Thu, 5 Oct 2017 11:10:06 +1300, Brian E Carpenter wrote: >> On 05/10/2017 02:12, Joe Touch wrote: >> >>> On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote= : >>>> >>>> This is to open a two week WGLC >>>> for https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-0= 3. >>>> >>> >>> I do not agree with the claims of this document. It "informationally"= >>> advises against support for key IPv6 capabilities and undermines the >>> extensibility of IPv6 by making recommendations about discarding >>> currently unassigned codepoints. >> >> Here's the problem, Joe. It's a fact of life that many firewalls >> discard a lot of stuff that they shouldn't - that's why we wrote >> RFC 7045 - but in the real world, operators blunder around based >> on folklore and vendors' defaults. We can't change any of that, but >> we can try to issue sensible advice that, overall, will limit the >> resulting breakage. IMHO this document, positioned correctly as >> Informational, will do that: on balance, it makes the world a better >> place. >=20 > I am afraid that I do not agree that the document, in its present form,= > will do that. It says: >=20 >=20 > The filtering policy typically depends on where in the network such >=20 > policy is enforced: when the policy is enforced in a transit network= , >=20 > the policy typically follows a "black-list" approach, where only >=20 > packets with clear negative implications are dropped. On the other >=20 > hand, when the policy is enforced closer to the destination systems,= >=20 > the policy typically follows a "white-list" approach, where only >=20 > traffic that is expected to be received is allowed. The advice in >=20 > this document is aimed only at transit routers that may need to >=20 > enforce a filtering policy based on the EHs and IPv6 options a packe= t >=20 > may contain, following a "black-list" approach, and hence is likely >=20 > to be much more permissive that a filtering policy to be employed >=20 > e.g. at the edge of an enterprise network. The advice in this >=20 > document is meant to improve the current situation of the dropping o= f >=20 > packets with IPv6 EHs in the Internet [RFC7872]. >=20 > while at the same time promoting a **default deny** policy with > respect to unrecognized options and unrecognized extension headers. > That is antithetical to the mission of a **transit router**, which > is to get packets transparently from point A to point B. It is > especially egregious to dispense this advice for unrecognized > extension headers, since they are indistinguishable from unrecognized > transport protocols. If these things are blocked by **transit routers**= > it becomes impossible to deploy any new options or transport protocols= =2E >=20 > But we already know that, don't we? >=20 >=20 >=20 > If we want to give constructive advice that really will make the >=20 > world a better place, we should: >=20 >=20 > 1.) Advise operators of **transit routers** to be transparent to >=20 > everything other than the Hop-by-Hop extensions header, and provide >=20 > detailed advice on what to do (based on the updates in RFC 8200) >=20 > about Hop-by-Hop options. The default should be IGNORE unless there >=20 > is an option you need to process. >=20 >=20 > 2.) Reserve all the detailed filtering advicee for operators of >=20 > firewalls, enterprise routers, and other systems whose mission it >=20 > is to protect the end systems behind them (or to prevent misbehavior >=20 > by said end systems). A default deny for unrecognized stuff is not >=20 > unreasonable for such systems. >=20 >=20 > 3.) Remind implementors of the following requirement from RFC 7045: >=20 >=20 > Forwarding nodes MUST be configurable to allow packets containing >=20 > unrecognised extension headers, but the default configuration MAY >=20 > drop such packets. >=20 >=20 > and add similar advice for options. >=20 >=20 > Thanks and regards, >=20 >=20 > Mike Heard >=20 From nobody Thu Oct 5 21:02:25 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7AC513304B for ; Thu, 5 Oct 2017 21:02:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.21 X-Spam-Level: X-Spam-Status: No, score=-0.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pobox.com; domainkeys=pass (1024-bit key) header.from=heard@pobox.com header.d=pobox.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pSXdVWHkVWyX for ; Thu, 5 Oct 2017 21:02:20 -0700 (PDT) Received: from sasl.smtp.pobox.com (pb-smtp2.pobox.com [64.147.108.71]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E501D1331E7 for ; Thu, 5 Oct 2017 21:02:19 -0700 (PDT) Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by pb-smtp2.pobox.com (Postfix) with ESMTP id 7BEC2A91A5 for ; Fri, 6 Oct 2017 00:02:18 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=pobox.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sasl; bh=wbtSTRekh683Z6FZNNotwddDbK0=; b=m9Dw/1 twtp8HhJF5LMYdtqbTkZL6E0kkrvfaIK4Br0uL+5UMRp5QUAB744mivCFL5or9ET KvE+e3/ru0e3aM3snmjjmPZOjjgXHbl91WNJPsth4zPHS4pqKQfczkfEwy/zLOkp 85QALgNX2GFCLqOMclm5G6rNjVP5sVPQbXHgY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; q=dns; s=sasl; b=aSEyClrXujNLzOjOlpJmMGqdUxKOT/nR Se+lm1dONpkGgLD+yotFHfH7KRfSVSJxkcFbc4nidf1SR66na6GconLTx6tA2rYX yWtkwO58Trmjh9Fu6wIoZv4SOYsr9aaoGARNZY0Lmf8Wmrj7DRtlJNULLOxv3S8G bRgdM58wjBo= Received: from pb-smtp2.nyi.icgroup.com (unknown [127.0.0.1]) by pb-smtp2.pobox.com (Postfix) with ESMTP id 74266A91A2 for ; Fri, 6 Oct 2017 00:02:18 -0400 (EDT) Received: from mail-qk0-f180.google.com (unknown [209.85.220.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pb-smtp2.pobox.com (Postfix) with ESMTPSA id C5F0BA919F for ; Fri, 6 Oct 2017 00:02:17 -0400 (EDT) Received: by mail-qk0-f180.google.com with SMTP id x82so6846173qkb.12 for ; Thu, 05 Oct 2017 21:02:17 -0700 (PDT) X-Gm-Message-State: AMCzsaXrtwMatsOcp5711SDRxNVwmN0o3JKILOneACuTHLjl43EeLMT+ SWlwLg7ASjZMHuQmc5K7j5dBGhZaGgvvyCGmQVU= X-Google-Smtp-Source: AOwi7QDTMgpVQbQM/YkPzWeB4DCCuDu1F8J9S50qhKEgALykZhTSAfcw9CTG8ETuIFnqEaKLMYUha4Dv5yI+c2cyGMQ= X-Received: by 10.55.170.15 with SMTP id t15mr24643423qke.232.1507262537205; Thu, 05 Oct 2017 21:02:17 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.18.130 with HTTP; Thu, 5 Oct 2017 21:01:56 -0700 (PDT) In-Reply-To: References: From: "C. M. Heard" Date: Thu, 5 Oct 2017 21:01:56 -0700 X-Gmail-Original-Message-ID: Message-ID: To: Ron Bonica Cc: OPSEC , Joe Touch , Bob Hinden , Brian E Carpenter Content-Type: multipart/alternative; boundary="94eb2c0635661d0f57055ad8e8c9" X-Pobox-Relay-ID: 2501FB72-AA4B-11E7-ABB0-575F0C78B957-06080547!pb-smtp2.pobox.com Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Oct 2017 04:02:23 -0000 --94eb2c0635661d0f57055ad8e8c9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Ron, I think that the direction you propose will make this a much better document. Modulo details it would certainly address my concerns. I do however have come comments to make about router self-protection. RFC 6192 is all about a router filtering traffic addressed to itself, i.e., what it should process in its role as a host. A very restrictive "white list" policy ( as outlined in RC 6192) is quite in order there. If there is no need or use for extension headers for traffic destined to the control plane, a very restrictive policy of dropping all packets addressed to the control place hat have extension headers may indeed be in order. It's a very different story, I think, for what a router does to protect itself in its role as forwarding device. There, if it complies with RFC 8200, the Hop-by-Hop Options header is the only one that can hurt it, if it is able to forward at line rate at all. The choice boils down to whether to process all, some, or no packets with Hop-by-Hop options. I think that we need to loudly broadcast that ignoring all HbH Options headers is a legitimate policy for this purpose, but dropping all packets with HbH Options is not. If we can sell this to the world, it may be possible to actually use the HbH options header, and get rid of abominations such as the CONEX Destination Option. The way you characterize the proposed second section sounds right on the money to me. I support your proposed way forward. Thank you. Mike Heard On Thu, Oct 5, 2017 at 11:04 AM, Ron Bonica wrote: > Mike, > > > > I think that you just struck the note that Fernando and I missed. Transit > routers filter extension headers for one of the following reasons: > > > > - To protect themselves (as in RFC 6192) > > - To protect downstream devices > > > > Therefore, the document should contain two clearly marked sections, one > regarding EH filtering policies that protect the transit router and one > regarding EH filtering policies that protect downstream devices. > > > > The first section can: > > > > - Be very short (2 pages max) > > - Be guided largely by RFC 8200 > > - Speak with some degree of authority (while still INFORMATIONAL= ) > > > > The second section should begin with a discussion of the relationship > between the transit router and the downstream devices. Let=E2=80=99s assu= me that > the transit router belongs to an ISP, while downstream devices fall into > the following three classes: > > > > 1) Belong to the ISP > > 2) Belong to parties who want to be protected by the ISP (e.g., its > customers) > > 3) Belong to other parties > > > > Therefore, the transit router MAY discard packets that pose a threat to > the first two classes of downstream device, but MUST NOT discard packets > that are required by the third class of downstream device. > > > > From this point, we formulate a policy that **might** satisfy the above > mentioned requirement. We mark this policy with the following caveats: > > > > - It is a best guess > > - If the policy is too permissive, downstream devices belonging > to the ISP and those who it protects will not receive all of the protecti= on > possible > > - If the policy is too restrictive, downstream devices belonging > to other parties will experience collateral damage > > - One size doesn=E2=80=99t fit all > > > > If we were to rework the document into this shape, would it address your > concerns. > > > > Ron > > > > > > > > *From:* OPSEC [mailto:opsec-bounces@ietf.org] *On Behalf Of *C. M. Heard > *Sent:* Wednesday, October 4, 2017 11:08 PM > *To:* OPSEC > *Subject:* Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 > > > > On Thu, 5 Oct 2017 11:10:06 +1300, Brian E Carpenter wrote: > > > On 05/10/2017 02:12, Joe Touch wrote: > > > > > >> On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote: > > >>> > > >>> This is to open a two week WGLC > > >>> for https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03 > > . > > >>> > > >> > > >> I do not agree with the claims of this document. It "informationally" > > >> advises against support for key IPv6 capabilities and undermines the > > >> extensibility of IPv6 by making recommendations about discarding > > >> currently unassigned codepoints. > > > > > > Here's the problem, Joe. It's a fact of life that many firewalls > > > discard a lot of stuff that they shouldn't - that's why we wrote > > > RFC 7045 - but in the real world, operators blunder around based > > > on folklore and vendors' defaults. We can't change any of that, but > > > we can try to issue sensible advice that, overall, will limit the > > > resulting breakage. IMHO this document, positioned correctly as > > > Informational, will do that: on balance, it makes the world a better > > > place. > > > > I am afraid that I do not agree that the document, in its present form, > > will do that. It says: > > > > The filtering policy typically depends on where in the network such > > policy is enforced: when the policy is enforced in a transit network, > > the policy typically follows a "black-list" approach, where only > > packets with clear negative implications are dropped. On the other > > hand, when the policy is enforced closer to the destination systems, > > the policy typically follows a "white-list" approach, where only > > traffic that is expected to be received is allowed. *The advice in* > > * this document is aimed only at transit routers that may need to* > > * enforce a filtering policy based on the EHs and IPv6 options a packet= * > > * may contain, following a "black-list" approach, and hence is likely* > > * to be much more permissive that a filtering policy to be employed* > > * e.g. at the edge of an enterprise network.* The advice in this > > document is meant to improve the current situation of the dropping of > > packets with IPv6 EHs in the Internet [RFC7872 ]. > > > while at the same time promoting a ***default deny*** policy with > > respect to unrecognized options and unrecognized extension headers. > > That is antithetical to the mission of a ***transit router***, which > > is to get packets transparently from point A to point B. It is > > especially egregious to dispense this advice for unrecognized > > extension headers, since they are indistinguishable from unrecognized > > transport protocols. If these things are blocked by ***transit routers*** > > it becomes impossible to deploy any new options or transport protocols. > > But we already know that, don't we? > > > > If we want to give constructive advice that really will make the > > world a better place, we should: > > > 1.) Advise operators of ***transit routers*** to be transparent to > > everything other than the Hop-by-Hop extensions header, and provide > > detailed advice on what to do (based on the updates in RFC 8200) > > about Hop-by-Hop options. The default should be IGNORE unless there > > is an option you need to process. > > > 2.) Reserve all the detailed filtering advicee for operators of > > firewalls, enterprise routers, and other systems whose mission it > > is to protect the end systems behind them (or to prevent misbehavior > > by said end systems). A default deny for unrecognized stuff is not > > unreasonable for such systems. > > > 3.) Remind implementors of the following requirement from RFC 7045: > > > Forwarding nodes MUST be configurable to allow packets containing > > unrecognised extension headers, but the default configuration MAY > > drop such packets. > > > and add similar advice for options. > > > Thanks and regards, > > > Mike Heard > > --94eb2c0635661d0f57055ad8e8c9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Ron,

I think that the direction y= ou propose will make this a much better document. Modulo details it would c= ertainly address my concerns.

I do however have co= me comments to make about router self-protection. RFC 6192 is all about a r= outer filtering traffic addressed to itself, i.e., what it should process i= n its role as a host. A very restrictive "white list" policy ( as= outlined in RC 6192) is quite in order there. If there is no need or use f= or extension headers for traffic destined to the control plane, a very rest= rictive policy of dropping all packets addressed to the control place hat h= ave extension headers may indeed be in order.

It&#= 39;s a very different story, I think, for what a router does to protect its= elf in its role as forwarding device.=C2=A0 There, if it complies with RFC = 8200, the Hop-by-Hop Options header is the only one that can hurt it, if it= is able to forward at line rate at all. The choice boils down to whether t= o process all, some, or no packets with Hop-by-Hop options. I think that we= need to loudly broadcast that ignoring all HbH Options headers is a legiti= mate policy for this purpose, but dropping all packets with HbH Options is = not. If we can sell this to the world, it may be possible to actually use t= he HbH options header, and get rid of abominations such as the CONEX Destin= ation Option.

The way you characterize the propose= d second section sounds right on the money to me.

= I support your proposed way forward. Thank you.

Mi= ke Heard

On Thu, Oct 5, 2017 at 11:04 AM, Ron Bonica = <rbonica@junipe= r.net> wrote:

Mike,

=C2=A0

I think that you just struck the note= that Fernando and I missed. Transit routers filter e= xtension headers for one of the following reasons:=

=C2=A0

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 To protect themselves (as in RFC= 6192)

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 To protect downstream devices=

=C2=A0

Therefore, the document should = contain two clearly marked sections, one regarding EH filtering policies th= at protect the transit router and one regarding EH filtering policies that protect do= wnstream devices.

=C2=A0

The first section can:

=C2=A0

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Be very short (2 pages max)

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Be guided largely by RFC 8200=

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Speak with some degree of author= ity (while still INFORMATIONAL)

=C2=A0

The second section should begin= with a discussion of the relationship between the transit router and the d= ownstream devices. Let=E2=80=99s assume that the transit router belongs to an ISP, w= hile downstream devices fall into the following three classes:

=C2=A0

1)=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 Belong to the ISP<= /span>

2)=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 Belong to parties who want to be= protected by the ISP (e.g., its customers)

3)=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 Belong to other parties

=C2=A0

Therefore, the transit router M= AY discard packets that pose a threat to the first two classes of downstrea= m device, but MUST NOT discard packets that are required by the third class of downs= tream device.

=C2=A0

From this point, we formulate a= policy that *might* satisfy the above mentioned requirement. We mar= k this policy with the following caveats:

=C2=A0

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 It is a best guess=

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 If the policy is too permissive,= downstream devices belonging to the ISP and those who it protects will not= receive all of the protection possible

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 If the policy is too restrictive= , downstream devices belonging to other parties will experience collateral = damage

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 One size doesn=E2=80=99t fit all=

=C2=A0

If we were to rework the docume= nt into this shape, would it address your concerns.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Ron

=C2=A0

=C2=A0

=C2=A0

From: OPSEC [mailto:opsec-bounces@ietf.org= ] On Behalf Of C. M. Heard
Sent: Wednesday, October 4, 2017 11:08 PM
To: OPSEC <op= sec@ietf.org>
Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filterin= g-03

=C2=A0

On Thu, 5 Oct 20= 17 11:10:06 +1300, Brian E Carpenter wrote:

> On 05/10/20= 17 02:12, Joe Touch wrote:

>=C2=A0

>> On 9/29= /2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote:

>>>=C2=A0

>>> Thi= s is to open a two week WGLC

>>> for= =C2=A0https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03.<= u>

>>>=C2=A0

>><= u>=C2=A0

>> I do no= t agree with the claims of this document. It "informationally"

>> advises= against support for key IPv6 capabilities and undermines the=

>> extensi= bility of IPv6 by making recommendations about discarding<= /u>

>> current= ly unassigned codepoints.

>=C2=A0

> Here's = the problem, Joe. It's a fact of life that many firewalls=

> discard a l= ot of stuff that they shouldn't - that's why we wrote=

> RFC 7045 - = but in the real world, operators blunder around based<= /p>

> on folklore= and vendors' defaults. We can't change any of that, but<= /u>

> we can try = to issue sensible advice that, overall, will limit the=

> resulting b= reakage. IMHO this document, positioned correctly as

> Information= al, will do that: on balance, it makes the world a better<= /u>

> place.

=C2=A0=

I = am afraid that I do not agree that the document, in its present form,

wi= ll do that. It says:

=C2=A0

=C2=A0=
=C2=A0 The filtering policy typically depends on where in the network such<=
u>
=C2=A0=
=C2=A0 policy is enforced: when the policy is enforced in a transit network=
,
=C2=A0=
=C2=A0 the policy typically follows a "black-list" approach, wher=
e only
=C2=A0=
=C2=A0 packets with clear negative implications are dropped.=C2=A0 On the o=
ther
=C2=A0=
=C2=A0 hand, when the policy is enforced closer to the destination systems,=

=C2=A0=
=C2=A0 the policy typically follows a "white-list" approach, wher=
e only
=C2=A0=
=C2=A0 traffic that is expected to be received is allowed.=C2=A0 The advice in
=C2=A0=C2=A0 this document is aimed only at transit router=
s that may need to
=C2=A0=C2=A0 enforce a filtering policy based on the EHs a=
nd IPv6 options a packet
=C2=A0=C2=A0 may contain, following a "black-list&quo=
t; approach, and hence is likely
=C2=A0=C2=A0 to be much more permissive that a filtering p=
olicy to be employed
=C2=A0=C2=A0 e.g. at the edge of an enterprise network.=C2=A0 The advice in this=

=C2=A0=
=C2=A0 document is meant to improve the current situation of the dropping o=
f
=C2=A0=
=C2=A0 packets with IPv6 EHs in the Internet [RFC7872].

while at the same time pr= omoting a **default deny** policy with=

respect to unrecognized o= ptions and unrecognized extension headers.

That is antithetical to t= he mission of a **transit router**, which

is to get packets transpa= rently from point A to point B. It is

especially egregious to d= ispense this advice for unrecognized

extension headers, since = they are indistinguishable from unrecognized

transport protocols. If t= hese things are blocked by=C2=A0**transit routers**

it becomes=C2=A0 impossib= le to deploy any new options or transport protocols.<= /p> 

But we =
already know that, don't we?
=
=C2=A0
If we w=
ant to give constructive advice that really will make the<=
/u>
world a=
 better place, we should:

 
1.) Adv=
ise operators of *=
*transit routers** to be transparent to<=
/pre>

everything other than the Hop-by-Hop extensions header, and =
provide


detailed advice on what to do (based on the updates in RFC 8=
200)


about Hop-by-Hop options. The default should be IGNORE unles=
s there


is an option you need to process.





2.) Reserve all the detailed filtering advicee for operators=
 of


firewalls, enterprise routers, and other systems whose missi=
on it


is to protect the end systems behind them (or to prevent mis=
behavior


by said end systems). A default deny for unrecognized stuff =
is not


unreasonable for such systems.





3.) Remind implementors of the following requirement from RF=
C 7045:





=C2=A0=
=C2=A0 Forwarding nodes MUST be configurable to allow packets containing=



=C2=A0=
=C2=A0 unrecognised extension headers, but the default configuration MAY=



=C2=A0=
=C2=A0 drop such packets.





and add similar advice for options.




Thanks =
and regards,





Mike He=
ard

--94eb2c0635661d0f57055ad8e8c9-- From nobody Thu Oct 5 22:48:34 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64D3513420F for ; Thu, 5 Oct 2017 22:48:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qf-N71zUui8L for ; Thu, 5 Oct 2017 22:48:29 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6B611270AB for ; Thu, 5 Oct 2017 22:48:28 -0700 (PDT) Received: from mb.local ([IPv6:2601:647:4201:9721:955a:5cff:62f4:a809]) (authenticated bits=0) by nagasaki.bogus.com (8.15.2/8.15.2) with ESMTPSA id v965mP8F018580 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Fri, 6 Oct 2017 05:48:26 GMT (envelope-from joelja@bogus.com) X-Authentication-Warning: nagasaki.bogus.com: Host [IPv6:2601:647:4201:9721:955a:5cff:62f4:a809] claimed to be mb.local To: Ron Bonica , "C. M. Heard" , OPSEC , Joe Touch , Bob Hinden , Brian E Carpenter References: From: joel jaeggli Message-ID: <4fc640bb-4b03-578c-1904-77628d002e73@bogus.com> Date: Thu, 5 Oct 2017 22:48:25 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:56.0) Gecko/20100101 Thunderbird/56.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Oct 2017 05:48:31 -0000 On 10/5/17 11:04, Ron Bonica wrote: > Mike, > >   > > I think that you just struck the note that Fernando and I missed. > Transit routers filter extension headers for one of the following reasons: > >   > > -          To protect themselves (as in RFC 6192) > > -          To protect downstream devices > >   > > Therefore, the document should contain two clearly marked sections, one > regarding EH filtering policies that protect the transit router and one > regarding EH filtering policies that protect downstream devices. > >   > > The first section can: > >   > > -          Be very short (2 pages max) > > -          Be guided largely by RFC 8200 > > -          Speak with some degree of authority (while still INFORMATIONAL) > >   > > The second section should begin with a discussion of the relationship > between the transit router and the downstream devices. Let’s assume that > the transit router belongs to an ISP, while downstream devices fall into > the following three classes: > >   > > 1)      Belong to the ISP > > 2)      Belong to parties who want to be protected by the ISP (e.g., its > customers) > > 3)      Belong to other parties Traffic on a isp either the isp's traffic or a customers (customer is transitive, a customer of a customer is customer traffic). traffic which neither to a customer or the isp is party to unwanted, whether it's there due to malice or intention. what services one offers to a customer seems entirely like a contractual detail. strictly speaking the destination of a packet may not be the destination address in the ip header as when the TTL is lowered or when hop by hop options are employed. >   > > Therefore, the transit router MAY discard packets that pose a threat to > the first two classes of downstream device, but MUST NOT discard packets > that are required by the third class of downstream device. >   > > From this point, we formulate a policy that **might** satisfy the above > mentioned requirement. We mark this policy with the following caveats: > >   > > -          It is a best guess > > -          If the policy is too permissive, downstream devices belonging > to the ISP and those who it protects will not receive all of the > protection possible > > -          If the policy is too restrictive, downstream devices > belonging to other parties will experience collateral damage > > -          One size doesn’t fit all > >   > > If we were to rework the document into this shape, would it address your > concerns. > >   > >                                                                Ron > >   > >   > >   > > *From:*OPSEC [mailto:opsec-bounces@ietf.org] *On Behalf Of *C. M. Heard > *Sent:* Wednesday, October 4, 2017 11:08 PM > *To:* OPSEC > *Subject:* Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 > >   > > On Thu, 5 Oct 2017 11:10:06 +1300, Brian E Carpenter wrote: > >> On 05/10/2017 02:12, Joe Touch wrote: > >>  > >>> On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote: > >>>>  > >>>> This is to open a two week WGLC > >>>> for https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03 > . > >>>>  > >>>  > >>> I do not agree with the claims of this document. It "informationally" > >>> advises against support for key IPv6 capabilities and undermines the > >>> extensibility of IPv6 by making recommendations about discarding > >>> currently unassigned codepoints. > >>  > >> Here's the problem, Joe. It's a fact of life that many firewalls > >> discard a lot of stuff that they shouldn't - that's why we wrote > >> RFC 7045 - but in the real world, operators blunder around based > >> on folklore and vendors' defaults. We can't change any of that, but > >> we can try to issue sensible advice that, overall, will limit the > >> resulting breakage. IMHO this document, positioned correctly as > >> Informational, will do that: on balance, it makes the world a better > >> place. > >   > > I am afraid that I do not agree that the document, in its present form, > > will do that. It says: > >   > >    The filtering policy typically depends on where in the network such > >    policy is enforced: when the policy is enforced in a transit network, > >    the policy typically follows a "black-list" approach, where only > >    packets with clear negative implications are dropped.  On the other > >    hand, when the policy is enforced closer to the destination systems, > >    the policy typically follows a "white-list" approach, where only > >    traffic that is expected to be received is allowed.  /_The advice in_/ > > /_   this document is aimed only at transit routers that may need to_/ > > /_   enforce a filtering policy based on the EHs and IPv6 options a packet_/ > > /_   may contain, following a "black-list" approach, and hence is likely_/ > > /_   to be much more permissive that a filtering policy to be employed_/ > > /_   e.g. at the edge of an enterprise network._/  The advice in this > >    document is meant to improve the current situation of the dropping of > >    packets with IPv6 EHs in the Internet [RFC7872 > ]. > > > while at the same time promoting a **/_default deny_/** policy with > > respect to unrecognized options and unrecognized extension headers. > > That is antithetical to the mission of a **/_transit router_/**, which > > is to get packets transparently from point A to point B. It is > > especially egregious to dispense this advice for unrecognized > > extension headers, since they are indistinguishable from unrecognized > > transport protocols. If these things are blocked by **/_transit routers_/** > > it becomes  impossible to deploy any new options or transport protocols. > > But we already know that, don't we? > >   > > If we want to give constructive advice that really will make the > > world a better place, we should: > > > 1.) Advise operators of **/_transit routers_/** to be transparent to > > everything other than the Hop-by-Hop extensions header, and provide > > detailed advice on what to do (based on the updates in RFC 8200) > > about Hop-by-Hop options. The default should be IGNORE unless there > > is an option you need to process. > > > 2.) Reserve all the detailed filtering advicee for operators of > > firewalls, enterprise routers, and other systems whose mission it > > is to protect the end systems behind them (or to prevent misbehavior > > by said end systems). A default deny for unrecognized stuff is not > > unreasonable for such systems. > > > 3.) Remind implementors of the following requirement from RFC 7045: > > >    Forwarding nodes MUST be configurable to allow packets containing > >    unrecognised extension headers, but the default configuration MAY > >    drop such packets. > > > and add similar advice for options. > > > Thanks and regards, > > > Mike Heard > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > From nobody Fri Oct 6 11:15:42 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4904A1241F3 for ; Fri, 6 Oct 2017 11:15:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ZxnruAzENUC for ; Fri, 6 Oct 2017 11:15:39 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0093.outbound.protection.outlook.com [104.47.36.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27634134B9C for ; Fri, 6 Oct 2017 11:15:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=jgxzARMdk5+nrlksek5SP6Z6uyCL+KKHEl8zYrVCoAM=; b=KBObN76CWRhL7xCcgSWjvdxj72t8KT5jkVzgg+jhMbiGnjeSSCLMD1souvWLOPXYXpWpoU6+/aHy6pSUIFB63IgMBbK5QI0fxILb6s69WiuOh7W8nfKsjdxQ4w+39P4wcGO82h3C3eIiyo7i8q2GsKrvLYu4EoNK9lDudYwigGY= Received: from BLUPR0501MB2051.namprd05.prod.outlook.com (10.164.23.21) by BLUPR0501MB2049.namprd05.prod.outlook.com (10.164.23.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Fri, 6 Oct 2017 18:15:36 +0000 Received: from BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) by BLUPR0501MB2051.namprd05.prod.outlook.com ([10.164.23.21]) with mapi id 15.20.0077.018; Fri, 6 Oct 2017 18:15:36 +0000 From: Ron Bonica To: "EXT - joelja@bogus.com" , "C. M. Heard" , OPSEC , Joe Touch , Bob Hinden , Brian E Carpenter Thread-Topic: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 Thread-Index: AQHTPYcyy6w36+fdfkOchQ9lkNpRO6LVbANAgADmYoCAAM/4YA== Date: Fri, 6 Oct 2017 18:15:36 +0000 Message-ID: References: <4fc640bb-4b03-578c-1904-77628d002e73@bogus.com> In-Reply-To: <4fc640bb-4b03-578c-1904-77628d002e73@bogus.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; x-originating-ip: [66.129.241.12] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BLUPR0501MB2049; 6:SsTi+w924WYLOFqLxt4ZWVurLIXO5fEfqkvqav/yNGhQ5E7TrjSC5BJrTNtO9gySRd3pBP6+XixFtC+mQGQxr/V+mxQy3JEaqN6jA1bPMpFpb58A2RkEdVhEpRQxgX9yMpaJ4/6nOdvewnwTSf8QVJ2QCgJkhk5ku/RSYXSyYPA6tpsoESXpi47c5q619zI360YRQT4jVKlo7z9ziq31KSuh9JftrX2dQhrGYfT+zyMKKkzZEqP3dgRkDXi+dETtvPg368MWR9vxjY0i55GizODROCjpiJ2WrSuhK/MFWXXHCVqxkfEFmbSb3HiuzZoshLWDJzYxrbv7Nse9IJRgKA==; 5:EZ9w4Cq7dUFuKaKAwlVTAyRTcKZ1HoyGeIbdROWAOl2MRMiBEZDkALsXoKYoSeJZegxj6JmMcWu/VDaWuSXRSYOxzHqmNQRN4oFr6tUS2boedGRMf0aiiWG0syfovzEbvQkP7IkBXAmwk8iz9CycZQ==; 24:ddTetqkkhQ7TlPtFsFklYx7WGaO0Sp5inicFPBayEGn4GgWtTvpnEXewHYFJYha+qg5C6LIgUwK5TaRZjoYOZwlIbhlIYvaZF+Vhfjc/ZQw=; 7:ptubRXVnm+26/Sm2UGkDcChNjFu2B43lXt93pguz/bG4P8367+RyyxUDU49k1VbzEJw+Y+JRTgmGvlx9NkGGktriJuyOjkG77GfclhhcJpIQ2Eb2jdyd3YpGplj5G24ImEpDjKPYzY6OpmqQZlx2He1QYJntfxKd5wOBgqP2pPNieTNhCklYn3zAG5TZvR797UeRp1JWQNKQYYB+8c+052BQQu7679KDRN9Qgz0885U= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 6d5055fa-34e8-4076-64e4-08d50ce63e1a x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:BLUPR0501MB2049; x-ms-traffictypediagnostic: BLUPR0501MB2049: x-ld-processed: bea78b3c-4cdb-4130-854a-1d193232e5f4,ExtAddr x-exchange-antispam-report-test: UriScan:; x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(10201501046)(93006095)(93001095)(100000703101)(100105400095)(3002001)(6055026)(6041248)(20161123564025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123562025)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BLUPR0501MB2049; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BLUPR0501MB2049; x-forefront-prvs: 0452022BE1 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(376002)(39860400002)(346002)(199003)(189002)(25786009)(6436002)(97736004)(3660700001)(54356999)(50986999)(3846002)(105586002)(8936002)(6116002)(102836003)(101416001)(55016002)(68736007)(106356001)(76176999)(39060400002)(230783001)(6246003)(3280700002)(66066001)(99286003)(14454004)(53936002)(86362001)(8656003)(7736002)(33656002)(305945005)(110136005)(316002)(2906002)(2900100001)(74316002)(9686003)(229853002)(189998001)(77096006)(8676002)(81156014)(7696004)(2950100002)(81166006)(478600001)(5660300001)(6506006); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR0501MB2049; H:BLUPR0501MB2051.namprd05.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Oct 2017 18:15:36.5471 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR0501MB2049 Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Oct 2017 18:15:40 -0000 SGkgSm9lbCwNCg0KSSB3YXMgdGhpbmtpbmcgYWJvdXQgSVNQcyB3aG8gYXJlIHRyYW5zaXQgcHJv dmlkZXJzLiBTbywgdGhlIHRyYWZmaWMgYWN0dWFsbHkgYmVsb25nIHRvIHlvdXIgY3VzdG9tZXJz JyBjdXN0b21lcnMuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFJvbg0KDQo+IA0KPiBUcmFm ZmljIG9uIGEgaXNwIGVpdGhlciB0aGUgaXNwJ3MgdHJhZmZpYyBvciBhIGN1c3RvbWVycyAoY3Vz dG9tZXIgaXMgdHJhbnNpdGl2ZSwgYQ0KPiBjdXN0b21lciBvZiBhIGN1c3RvbWVyIGlzIGN1c3Rv bWVyIHRyYWZmaWMpLiB0cmFmZmljIHdoaWNoIG5laXRoZXIgdG8gYQ0KPiBjdXN0b21lciBvciB0 aGUgaXNwIGlzIHBhcnR5IHRvIHVud2FudGVkLCB3aGV0aGVyIGl0J3MgdGhlcmUgZHVlIHRvIG1h bGljZSBvcg0KPiBpbnRlbnRpb24uDQo+IA0KPiB3aGF0IHNlcnZpY2VzIG9uZSBvZmZlcnMgdG8g YSBjdXN0b21lciBzZWVtcyBlbnRpcmVseSBsaWtlIGEgY29udHJhY3R1YWwNCj4gZGV0YWlsLg0K PiANCj4gc3RyaWN0bHkgc3BlYWtpbmcgdGhlIGRlc3RpbmF0aW9uIG9mIGEgcGFja2V0IG1heSBu b3QgYmUgdGhlIGRlc3RpbmF0aW9uDQo+IGFkZHJlc3MgaW4gdGhlIGlwIGhlYWRlciBhcyB3aGVu IHRoZSBUVEwgaXMgbG93ZXJlZCBvciB3aGVuIGhvcCBieSBob3ANCj4gb3B0aW9ucyBhcmUgZW1w bG95ZWQuDQo+IA0KDQo= From nobody Mon Oct 9 09:24:49 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B78B134692 for ; Mon, 9 Oct 2017 09:24:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.001 X-Spam-Level: X-Spam-Status: No, score=-5.001 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 453gwa-7kif5 for ; Mon, 9 Oct 2017 09:24:45 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 613FB134691 for ; Mon, 9 Oct 2017 09:24:43 -0700 (PDT) Received: from mbp-4.local ([IPv6:2620:11a:c081:20:d4ec:2179:256:3cdf]) (authenticated bits=0) by nagasaki.bogus.com (8.15.2/8.15.2) with ESMTPSA id v99GOPFP091527 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Mon, 9 Oct 2017 16:24:41 GMT (envelope-from joelja@bogus.com) X-Authentication-Warning: nagasaki.bogus.com: Host [IPv6:2620:11a:c081:20:d4ec:2179:256:3cdf] claimed to be mbp-4.local To: Ron Bonica , "C. M. Heard" , OPSEC , Joe Touch , Bob Hinden , Brian E Carpenter References: <4fc640bb-4b03-578c-1904-77628d002e73@bogus.com> From: joel jaeggli Message-ID: <5fcd0f63-444e-5d3b-ae94-4c7b4d5e0174@bogus.com> Date: Mon, 9 Oct 2017 09:24:56 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="fLAHeqcL68WrGXjhRsdBjFmuq8Jb8gqDW" Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Oct 2017 16:24:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --fLAHeqcL68WrGXjhRsdBjFmuq8Jb8gqDW Content-Type: multipart/mixed; boundary="gpVOC4ABE4WMvHQvAqRGgmKrmCTHFaxaD"; protected-headers="v1" From: joel jaeggli To: Ron Bonica , "C. M. Heard" , OPSEC , Joe Touch , Bob Hinden , Brian E Carpenter Message-ID: <5fcd0f63-444e-5d3b-ae94-4c7b4d5e0174@bogus.com> Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 References: <4fc640bb-4b03-578c-1904-77628d002e73@bogus.com> In-Reply-To: --gpVOC4ABE4WMvHQvAqRGgmKrmCTHFaxaD Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 Content-Language: en-US T24gMTAvNi8xNyAxMToxNSwgUm9uIEJvbmljYSB3cm90ZToKPiBIaSBKb2VsLAo+Cj4gSSB3 YXMgdGhpbmtpbmcgYWJvdXQgSVNQcyB3aG8gYXJlIHRyYW5zaXQgcHJvdmlkZXJzLiBTbywg dGhlIHRyYWZmaWMgYWN0dWFsbHkgYmVsb25nIHRvIHlvdXIgY3VzdG9tZXJzJyBjdXN0b21l cnMuClRyYW5zaXRpdmVseSB0aGF0J3MgeW91ciBjdXN0b21lcnMgdHJhZmZpYy4KCklmIEJv YiBzZWxscyB0cmFuc2l0IHRvIEFsaWNlIGFuZCBJIHNlbGwgdHJhbnNpdCB0byBCb2IsIEFs aWNlJ3MgdHJhZmZpYwppcyBCb2IncyB0cmFmZmljIGZyb20gbXkgdmFudGFnZSBwb2ludC4K CkFzIEJvYidzIHRyYW5zaXQgcHJvdmlkZXIgSSBhY2NlcHQgQWxpY2UncyByb3V0ZXM7IE15 IHJvdXRlIGZpbHRlciBpcwpjb25zdHJ1Y3RlZCBmcm9tIEJvYidzIEFTIHNldCB3aGljaCBp bmNsdWRlcyBBbGljZSdzIEFTLCAoMSkKCkh5cG90aGV0aWNhbGx5IElmIEkgaGF2ZSBzb21l IGtpbmQgb2YgdG9rZW4gYnVja2V0IHJhdGUgbGltaXRlciBvbiBhCnBvcnQgdG8gcHJvdGVj dCBCb2IgZnJvbSBOVFAgcmVmbGVjdGlvbiBhdHRhY2tzIGl0IGFmZmVjdHMgQWxpY2Uncwp0 cmFmZmljIHRvby4KCigxKS0gRXhhbXBsZSBBUyBzZXQgKHBpY2tpbmcgb24gQ2hhcnRlciwg c29ycnkgaXQgY29tZXMgYWZ0ZXIgQiksIElmIEkKYW0gYSB0cmFuc2l0IG9mIENoYXJ0ZXIn cyBJIGJ1aWxkIHRoZSBwcmVmaXggZmlsdGVyIGZyb20gdGhlIHJvdXRlCm9iamVjdHMgZm9y IGVhY2ggb2YgdGhlIGZvbGxvd2luZyBBU05zIHdoaWNoIG1heSB3ZWxsIGluY2x1ZGUgQm9i IGFuZCBBbGljZS4KCkpAbWJwOlN3aXRjaC1Db25maWdzJHdob2lzIC1oIHdob2lzLnJhZGIu bmV0IEFTLUNIVFItQkIKYXMtc2V0OsKgwqDCoMKgIEFTLUNIVFItQkIKZGVzY3I6wqDCoMKg wqDCoCBDaGFydGVyIENvbW11bmljYXRpb25zIGFuZCBDaGFydGVyIEN1c3RvbWVycy4KbWVt YmVyczrCoMKgwqAgQVMxNTcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNDM4LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMTY0NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE2 NzgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNzEwLArCoMKgwqDCoMKgwqDCoMKgwqDC oMKgIEFTMTc5NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE5NDQsCsKgwqDCoMKgwqDC oMKgwqDCoMKgwqAgQVMyNzA1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjcxMSwKwqDC oMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI3MjIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMy ODM0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjk0MSwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzMxMzYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzNTY1LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMzU5OSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM2NjMsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0MTUwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFT NDE5MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQzMDcsCsKgwqDCoMKgwqDCoMKgwqDC oMKgwqAgQVM0OTE3LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDk4NiwKwqDCoMKgwqDC oMKgwqDCoMKgwqDCoCBBUzU2NDIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1NjgzLArC oMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTcxOCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzYxMTIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM2MzE1LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTNjQyOCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzcwNjQsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVM3MjEzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNzM2MSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzczODEsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAg QVM3ODQzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNzkzOCwKwqDCoMKgwqDCoMKgwqDC oMKgwqDCoCBBUzc5NDksCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxMDMyNiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzEwMzU5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTA3 NDcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxMTE3MCwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzExMTkxLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTExMzAsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMxMTE5NCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzExMTkx LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTEyMDYsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMxMTQzNiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzExNTgyLArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMTE1ODYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxMTYyMSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzExNjcyLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMTE2ODcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxMTcyMCwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzExNzQxLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTE3NTQsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxMTkyNSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzExOTg2LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTE5OTksCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMxMjA0NywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzEyMTUyLArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMTMzNDQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMx MzUyNSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzEzNTQ5LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMTM1NTgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxMzU4MiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzEzNjUwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTM2 NTksCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxMzcwMSwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzEzNzQwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTM4MjMsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMxMzg2NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzEzOTMz LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTM5NDEsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMxNDA0MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE0MDU3LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMTQxMDAsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNDEzMCwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE0MTU5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMTQxOTQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNDI3NCwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzE0MzM0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTQzNzQsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNDM4OCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzE0Mzg5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTQ0MDMsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMxNDQwOSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE0NDQwLArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMTQ0NzQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMx NDUyNywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE0NTk5LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMTQ2MTcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNDc1OCwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzE0Nzc1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTQ3 ODcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNDgxMCwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzE0ODcxLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTQ4OTMsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMxNDk0MCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE1MDM3 LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTUwODUsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMxNTA4NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE1MTA4LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMTUxMTEsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNTExNywK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE1MTUzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMTUxNTYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNTE3NiwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzE1MzA0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTY0MTIsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNjQyNCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzE2NDg5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTY0OTUsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMxNjU4NCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE2NjE1LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMTY3MjUsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMx Njc0NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE2NzY3LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMTY3ODcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNjg0MiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzE2ODY1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTcw NjgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxNzEyMiwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzE3MTQ2LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTcxNjQsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMxNzE5NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE3Mjc3 LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTg0NDQsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMxODU3OCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE4NjE0LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMTg2NTEsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxODY3NSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE4NzMzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMTg3NzIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxODc5MywKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzE4ODEyLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTg4MjMsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxODkxNywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzE4OTMwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTkxMTUsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMxOTE1MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE5MTU3LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMTkyMTEsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMx OTIxOSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzE5NDQ0LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMTk0NTgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxOTY0MywKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzE5NjYzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTk3 MTgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMxOTczNSwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzE5ODcyLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMTk5NDUsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMxOTk2NywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIwMDMz LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjAxMTUsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMyMDEzOCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIwMTY0LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMjAxNzgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMDIzOSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIwMjg5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMjAzNzksCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMDk0MCwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzIxNTI3LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjE1ODAsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMTY1NywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzIxNjczLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjE2ODksCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMyMTc4MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIxODAyLArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMjE4MTMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMy MTg5NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIxOTc0LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMjIwNDAsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMjA0NiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzIyMTg5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjIy MjEsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMjIyMywKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzIyMjM3LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjIyNjksCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMyMjI5MSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIyMzE5 LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjIzNTAsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMyMjM3OSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIyNDE1LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMjI4MDksCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMjgyOSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzIyODM3LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMjI5MzIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMzA4MywKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzIzMTM0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjMyMTAsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyMzIyNSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzIzMjYwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjMyOTIsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMyMzMwMSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI1Njg0LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMjU3NzMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMy NTc4NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI1Nzg5LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMjU4NjMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyNTg3OSwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzI1OTc5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjYw ODIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyNjEyOCwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzI2MTM1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjYxMzcsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMyNjE3NCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI2MTkw LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjYyNjEsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMyNjI3MSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI2Mjk2LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMjYzMDUsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyNjM0NSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI2NDI5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMjY0NTMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyNjQ3NywKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzI2NTU0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjY4NTMsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyNjc4MSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzI3MDAwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjcxOTMsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMyNzI0MCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI3MjYxLArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMjcyODcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMy NzM2MCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI3Mzg4LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMjc0MTksCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyNzQ2MiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzI3NTA1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjc1 MTcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMyNzU1NiwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzI3NjMxLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjkzMDAsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMyOTU3OCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzI5NzEw LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMjk3NTgsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMyOTg1MCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMwMDU1LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMzAwODksCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMDExNSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMwMTUwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMzAyMjAsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMDI0MiwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzMwMjQzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzAyNjQsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMDI2OSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzMwMzIwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzAzMzUsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMzMDM3NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMwMzgyLArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMzA1OTEsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMz MDYxOCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMwNjYwLArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMzA3MTcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMTc2MSwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzMxNzgzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzE4 NjIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMTg2MywKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzMxOTM3LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzE5NzMsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMzMjAxMCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMyMTAx LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzIxMDQsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMzMjE0NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMyMTQ5LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMzIxODYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMjIxMiwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMyMzA0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTMzIzNjgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMjQzMiwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzMyNDQyLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzI0OTcsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMjUxMSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzMyNjY0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzI2NzIsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMzMjY4NCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMyNzU1LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMzI3NjgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMz MjgyNCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMyODc5LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMzI5MzMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMzA5MywKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzMzMTEyLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzMx MTQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMzI4NiwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzMzMjk5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzMzNDcsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVMzMzM5MSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMzNDEz LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzM0MTgsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVMzMzQ2OCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMzNDk3LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTMzM1ODMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMzU5NiwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzMzNjM2LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTNTM2NDMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzMzY3MiwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzMzNzUzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzU4NzQsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzNTk2MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzM1OTg4LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTMzYwOTQsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVMzNjEwMSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM2MTY3LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTMzYyNjQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMz NjI4NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM2NDAyLArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTMzY1MjYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVMzNjgyNywKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzQwMTAwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDAx NDIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0MDE2NCwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzQwMTg5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDAyMDAsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVM0MDIzOCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQwMjg1 LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDAzMjQsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVM0MDM3MiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQwMzg2LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTNDA0MjMsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0MDQzMywK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQwNDU4LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTNDA1MzQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0MDU1NCwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzQwNzc5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDA3NzIsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0MDc5MCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzQwODA1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDA4MjUsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVM0MDgzNiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQwODc4LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTNDEyNjQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0 NjA4MSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQ2MTE5LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTNDYxOTcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0NjI2MiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzQ2MjY4LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDYy OTcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0NjMzOCwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzQ2MzQ4LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDY0MTcsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVM0NjQxOSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQ2NDY0 LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDY0NzksCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVM0NjQ5NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQ2NTA1LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTNDY1NjgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0NjU5NCwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQ2NjA0LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTNDY2MzgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0NjY0NSwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzQ2Njc2LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDY2ODgsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0NjcwOSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzQ2NzQ1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDY3NjAsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVM0Njc3NCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQ2Nzc4LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTNDY3OTYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0 NjgwNSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQ2ODI1LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTNDY4MzAsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0NjkyNCwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzQ2OTI1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDY5 MjcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM0Njk2NiwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzQ3MDE1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDcwMTgsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVM0NzAzOCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzQ3MDg2 LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNDc1ODMsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVM1MDM2NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzUzMjg2LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTNTQ2MzgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1MzMxMSwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzUzMzYwLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTNTM1MTUsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1MzQ2MiwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzUzNTY3LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTM1ODYsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1MzU5NywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzUzNjYzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTM2NzQsCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVM1MzY5NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzUzNjk3LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTNTM3MTYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1 MzcyOSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzUzNzM4LArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTNTM5MzQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1Mzk3MiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzU0MDQ3LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTQw NTIsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1NDA2OCwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzU0MTA1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTQxNTUsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVM1NDIyMywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzU0MzUy LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTQzNzYsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVM1NDM4OSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzU0NDQ1LArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTNTQ0NTYsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1NDcwNCwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzU0NzA5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTNTQ3NTUsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1NDc3MSwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzU0ODA5LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTQ4MTQsCsKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1NDgzOSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzU0ODU1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNTQ4NjksCsKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgQVM1NDk2NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzUzNjc0LArCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIEFTNTUwMjQsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1 NTA0MiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzU1MjgwLArCoMKgwqDCoMKgwqDCoMKg wqDCoMKgIEFTNTUyMjgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM1Nzk3MiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzYyNDk2LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNjI1 MDksCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM2MjU2MSwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzYyNjI1LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNjI2MzIsCsKgwqDCoMKg wqDCoMKgwqDCoMKgwqAgQVM2MjY5MSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzYyNzk4 LArCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIEFTNjI4ODIsCsKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgQVM2MzAxNiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzYzMDUwLArCoMKgwqDCoMKg wqDCoMKgwqDCoMKgIEFTNjMxOTgsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM2MzM1NCwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzY0MjQzLArCoMKgwqDCoMKgwqDCoMKgwqDCoMKg IEFTNjMyNjcsCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgQVM2NTAwMSwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzM5MzI3OSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5MzM4NiwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5MzQ5MSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDC oCBBUzM5MzQ4MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5MzU1MCwKwqDCoMKgwqDC oMKgwqDCoMKgwqDCoCBBUzM5MzU4MiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5Mzk2 MCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5MzYyMSwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzM5MzY1NywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5MzY5NiwKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzM5MzcyMywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5 Mzc4MiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5Mzg3OCwKwqDCoMKgwqDCoMKgwqDC oMKgwqDCoCBBUzM5Mzg5NywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5Mzk4MywKwqDC oMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5Mzk5OSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzM5NDA0NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NDExMiwKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzM5NDI4NiwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NDMxNiwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NDM5OCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDC oCBBUzM5NDQ0MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NDcwMiwKwqDCoMKgwqDC oMKgwqDCoMKgwqDCoCBBUzM5NDc2NCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NDc5 NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NDkwOCwKwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCBBUzM5NDk2MCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NTEzNywKwqDCoMKg wqDCoMKgwqDCoMKgwqDCoCBBUzM5NTE0MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5 NTE3NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NTIyMCwKwqDCoMKgwqDCoMKgwqDC oMKgwqDCoCBBUzM5NTIyNywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NTI1MSwKwqDC oMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NTI3NywKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBB UzM5NTMyNCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NTM5MywKwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBBUzM5NTQ5OCwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NTY0MCwK wqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NTY0MywKwqDCoMKgwqDCoMKgwqDCoMKgwqDC oCBBUzM5NjE0NSwKwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBBUzM5NjIwOAphZG1pbi1jOsKg wqDCoCBOU09DIFRpZXJlZCBTdXBwb3J0CnJlbWFya3M6wqDCoMKgIEFkZGVkIEFTNTQ5NjYg LSBIYWxiZXJ0IEhhcmdyb3ZlCm5vdGlmeTrCoMKgwqDCoCBkbG5vY2lwQGNoYXJ0ZXJjb20u Y29tCm5vdGlmeTrCoMKgwqDCoCBETEROVE5CQkBjaGFydGVyLmNvbQptbnQtYnk6wqDCoMKg wqAgTUFJTlQtQ0hUUi1XRApjaGFuZ2VkOsKgwqDCoCBqdWdyYWouc2luZ2hAY2hhcnRlci5j b20gMjAxNzA5MTjCoCAjMjA6NDM6MTJaCnNvdXJjZTrCoMKgwqDCoCBSQURCCgo+PiBUcmFm ZmljIG9uIGEgaXNwIGVpdGhlciB0aGUgaXNwJ3MgdHJhZmZpYyBvciBhIGN1c3RvbWVycyAo Y3VzdG9tZXIgaXMgdHJhbnNpdGl2ZSwgYQo+PiBjdXN0b21lciBvZiBhIGN1c3RvbWVyIGlz IGN1c3RvbWVyIHRyYWZmaWMpLiB0cmFmZmljIHdoaWNoIG5laXRoZXIgdG8gYQo+PiBjdXN0 b21lciBvciB0aGUgaXNwIGlzIHBhcnR5IHRvIHVud2FudGVkLCB3aGV0aGVyIGl0J3MgdGhl cmUgZHVlIHRvIG1hbGljZSBvcgo+PiBpbnRlbnRpb24uCj4+Cj4+IHdoYXQgc2VydmljZXMg b25lIG9mZmVycyB0byBhIGN1c3RvbWVyIHNlZW1zIGVudGlyZWx5IGxpa2UgYSBjb250cmFj dHVhbAo+PiBkZXRhaWwuCj4+Cj4+IHN0cmljdGx5IHNwZWFraW5nIHRoZSBkZXN0aW5hdGlv biBvZiBhIHBhY2tldCBtYXkgbm90IGJlIHRoZSBkZXN0aW5hdGlvbgo+PiBhZGRyZXNzIGlu IHRoZSBpcCBoZWFkZXIgYXMgd2hlbiB0aGUgVFRMIGlzIGxvd2VyZWQgb3Igd2hlbiBob3Ag YnkgaG9wCj4+IG9wdGlvbnMgYXJlIGVtcGxveWVkLgo+Pgo+Cgo= --gpVOC4ABE4WMvHQvAqRGgmKrmCTHFaxaD-- --fLAHeqcL68WrGXjhRsdBjFmuq8Jb8gqDW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlnbotgACgkQ8AA1q7Z/VrLdIQCfZsyLHVPrkkGeTrnsz96gwFbn k0cAn1yLZorjhUbVsxi9SBlA3LhpRiEK =Vwcz -----END PGP SIGNATURE----- --fLAHeqcL68WrGXjhRsdBjFmuq8Jb8gqDW-- From nobody Fri Oct 20 03:01:30 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B34A213219F; Fri, 20 Oct 2017 03:01:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.001 X-Spam-Level: X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YNk4ZyfoQDfw; Fri, 20 Oct 2017 03:01:27 -0700 (PDT) Received: from fgont.go6lab.si (fgont.go6lab.si [91.239.96.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7CD7132F76; Fri, 20 Oct 2017 03:01:26 -0700 (PDT) Received: from [192.168.98.237] (unknown [189.3.90.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by fgont.go6lab.si (Postfix) with ESMTPSA id E9DDC806E2; Fri, 20 Oct 2017 12:01:22 +0200 (CEST) To: Bob Hinden , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" Cc: "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> From: Fernando Gont Message-ID: <91dcdfa8-a4fd-c2b4-9371-defa2b24c551@si6networks.com> Date: Fri, 20 Oct 2017 06:53:00 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Oct 2017 10:01:29 -0000 Hello, Bob, On 10/04/2017 06:38 PM, Bob Hinden wrote: > > I also don’t think this is ready for a w.g. last call. > > It doesn’t reference the new version of the IPv6 specification > RFC8200. There were a number of clarifications in RFC8200 regarding > extension headers that may require changes in the draft. We talked a bit about this. Best option seems to be to keep the current text and add text regarding the changes in RFC8200 -- at the end of th day, an operator will have to deal with both RFC2460 and RFC8200 implementations. Thoughts? Thanks, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 From nobody Fri Oct 20 06:29:37 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60F4D1332E4 for ; Fri, 20 Oct 2017 06:29:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fqe0hISCcRpB for ; Fri, 20 Oct 2017 06:29:33 -0700 (PDT) Received: from fgont.go6lab.si (fgont.go6lab.si [91.239.96.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D24381332D5 for ; Fri, 20 Oct 2017 06:29:32 -0700 (PDT) Received: from [192.168.98.237] (unknown [189.3.90.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by fgont.go6lab.si (Postfix) with ESMTPSA id 6ECF6808CD; Fri, 20 Oct 2017 15:29:22 +0200 (CEST) To: Ron Bonica , "C. M. Heard" , OPSEC , Joe Touch , Bob Hinden , Brian E Carpenter References: From: Fernando Gont Message-ID: <8f5dbed3-304a-0993-0fb4-dff3d36e42df@si6networks.com> Date: Fri, 20 Oct 2017 10:30:06 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Oct 2017 13:29:35 -0000 On 10/05/2017 03:04 PM, Ron Bonica wrote: > Mike, > >   > > I think that you just struck the note that Fernando and I missed. > Transit routers filter extension headers for one of the following reasons: > >   > > -          To protect themselves (as in RFC 6192) > -          To protect downstream devices We're kind of tackling item #2 above, in the hopes of improving the situation described in RFC7872. -- this is expected to be a default permissive approach. For item #1, it would probably boil down to block anything you don't use (i.e., way more aggressive approach)-- but that would be a different project. Thoughts? Thanks, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 From nobody Fri Oct 20 08:56:11 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FB2312895E; Fri, 20 Oct 2017 08:56:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.909 X-Spam-Level: X-Spam-Status: No, score=-2.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qY7-DCNP6gzT; Fri, 20 Oct 2017 08:56:00 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20139.outbound.protection.outlook.com [40.107.2.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9074F1342C0; Fri, 20 Oct 2017 08:55:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=dAziOpXL+J8EYDNNy69dNb5XB6+17nZlm+/vz34VEHo=; b=XMJPXp66e4rnj5WEECrlYtS0w9rurj6OJAN21jpdBGIXc0hBdRZeBmutOrLeUmanNnqEiOxkpKKu7d9UbE5xJr3oD3KdV9q8p7a3J3vrg4nhcFU9E/dWrXhUfVU54LQMw5n5ZxJUvbB33hzHzUkjywCB7rBjFhN0A8irPekqBOk= Received: from AM5PR0701MB2836.eurprd07.prod.outlook.com (10.168.155.139) by AM5PR0701MB2835.eurprd07.prod.outlook.com (10.168.155.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.156.2; Fri, 20 Oct 2017 15:55:57 +0000 Received: from AM5PR0701MB2836.eurprd07.prod.outlook.com ([fe80::f00a:2571:e709:3004]) by AM5PR0701MB2836.eurprd07.prod.outlook.com ([fe80::f00a:2571:e709:3004%14]) with mapi id 15.20.0156.005; Fri, 20 Oct 2017 15:55:57 +0000 From: "Van De Velde, Gunter (Nokia - BE/Antwerp)" To: "opsec@ietf.org" CC: "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" , "v6ops@ietf.org" Thread-Topic: WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 Thread-Index: AQHTOPqnaanFnY3C/0OsRx2AxtJLKaLtBd7g Date: Fri, 20 Oct 2017 15:55:57 +0000 Message-ID: References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> In-Reply-To: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2a02:1810:4d67:a00:e4ff:3754:ef66:2e0a] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM5PR0701MB2835; 6:k2u1CeiQ6voSSwCwmF5JessuNF0IqqUnhxMPsaPdYayiC5HxOiQ/nmqXQXSBQ8hDbHSQgs5T/oMkY2VFLVoNoCx6PHo5Cp7nelmtBpWq/eelyUMvk/bz8lvYlLoOX13nsom2ZloSX2x0Fak0BnmL2W+4psIAftLRYBEh0GNSaxZR2BuI3Ix1lQ3ithBjB6LF7RQ8gcAip9qntJF76SL7xYFpN+RrvL0kchRSC+vDDhVRjoBmzEW9ObkaeOoW+d0+8UVLOxH3msRgMuBMmD7gtNucmnoFrOGxcLdtl1eFXrv4ns+v/mPjmvTJkpzPdsvCvskWVGbbrr8Ead6UzqpHNA==; 5:ESZmsD3/9NEenOXboFzgUcXGzD5H8dsMM2jHd4uyy9G8xCZaVehhfBpV8pySvCYBtH/hj5dZrrI6F+XlfRJJzsMHWKLqhlr2NVF93HHX9d/bWvQzd2heoTA8XA86Fy8ymS0VX7c+0sHCBneznJMjIg==; 24:MLo/PEfOV9ql3zsEHOpMq0LgiitXo1O5KEEv1OsjGFbeyeqde//JL3xwApNaFxy7o8MuDpNVkkfe7fYkq6/TMtUZaa96cYga36uBmW8cnzQ=; 7:jEdoxzqDNcgZoS3Kpq/Yup/UHIIaWTq8v9t1NaV/LI1o2tl/3KkHwCh5M6v/99kMik7rK36Pk5EMWHVhOfzngo143WZCoTsEIdoQgBfkuOS/bKG8OmYMadeHk8DRS8eGtLqie/QK4NFUOBK5kjnNfN8FvqjvJRJmlUVHkWQAgYmEjBX76czWWGdKa7LRWtwK1PyWP+JQDOWeOWwlaFBfKKLHXr7xcTKLJUamuCyKUEY= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: c0736fe6-0770-4580-9671-08d517d30d6f x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:AM5PR0701MB2835; x-ms-traffictypediagnostic: AM5PR0701MB2835: authentication-results: spf=none (sender IP is ) smtp.mailfrom=gunter.van_de_velde@nokia.com; x-exchange-antispam-report-test: UriScan:(21748063052155); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(3231020)(10201501046)(3002001)(100000703101)(100105400095)(93006095)(93001095)(6055026)(6041248)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123558100)(20161123562025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM5PR0701MB2835; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM5PR0701MB2835; x-forefront-prvs: 0466CA5A45 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(199003)(53754006)(189002)(6506006)(5660300001)(54906003)(7736002)(2900100001)(316002)(5630700001)(33656002)(50986999)(76176999)(5640700003)(966005)(7696004)(101416001)(55016002)(3280700002)(54356999)(606006)(99286003)(2906002)(230783001)(74316002)(6436002)(53546010)(97736004)(2501003)(229853002)(54896002)(2950100002)(81166006)(6246003)(8936002)(9686003)(4326008)(478600001)(81156014)(2351001)(1730700003)(105586002)(68736007)(5250100002)(106356001)(86362001)(8676002)(53936002)(14454004)(3660700001)(25786009)(189998001)(102836003)(790700001)(450100002)(6116002)(6306002)(236005)(6916009); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0701MB2835; H:AM5PR0701MB2836.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: nokia.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_AM5PR0701MB283628A864A1456C3B376F05E0430AM5PR0701MB2836_" MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-Network-Message-Id: c0736fe6-0770-4580-9671-08d517d30d6f X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Oct 2017 15:55:57.3123 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0701MB2835 Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Oct 2017 15:56:02 -0000 --_000_AM5PR0701MB283628A864A1456C3B376F05E0430AM5PR0701MB2836_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgYWxsLA0KDQpUaGVyZSBoYXMgYmVlbiBzdWJzdGFudGlhbCBkaXNjdXNzaW9uIG9uIHRoZSBk b2N1bWVudCBkdXJpbmcgV0dMQyBhbmQgdGhlIGRvY3VtZW50IGhhcyByZWNlaXZlZCB2YWx1YWJs ZSBpbnB1dCBmb3IgZW5oYW5jZW1lbnQuIFRoZSBkb2N1bWVudCBpcyBub3QgcmVhZHkgeWV0Lg0K DQpBdXRob3JzLA0KDQpUaGUgZG9jdW1lbnQgaXMgb24gdGhlIHJpZ2h0IHRyYWNrLiBQbGVhc2Ug aW50ZWdyYXRlIHRoZSBzdWdnZXN0aW9ucyBkdXJpbmcgV0dMQyBhbmQgaWYgbmVlZGVkIHdlIGNh biBoYXZlIGEgZGlzY3Vzc2lvbiBkdXJpbmcgSUVURjEwMCB0byBjbG9zZSB0aGUgaGFyZGVyIHN1 Z2dlc3Rpb25zIGludG8gV0cgYWdyZWVtZW50LiBJ4oCZbGwgYmUgbG9va2luZyBmb3J3YXJkIHRv IHNlZSBhbiB1cGRhdGVkIGRvY3VtZW50IHdoaWNoIHJlZmxlY3RzIFdHIGNvbnNlbnN1cy4NCg0K QnJnZHMsDQpHLw0KDQpGcm9tOiBWYW4gRGUgVmVsZGUsIEd1bnRlciAoTm9raWEgLSBCRS9BbnR3 ZXJwKQ0KU2VudDogRnJpZGF5LCBTZXB0ZW1iZXIgMjksIDIwMTcgMTA6MTINClRvOiBvcHNlY0Bp ZXRmLm9yZw0KQ2M6IGRyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmdAaWV0Zi5vcmc7 IHY2b3BzQGlldGYub3JnDQpTdWJqZWN0OiBXR0xDIGZvciBkcmFmdC1pZXRmLW9wc2VjLWlwdjYt ZWgtZmlsdGVyaW5nLTAzDQoNClRoaXMgaXMgdG8gb3BlbiBhIHR3byB3ZWVrIFdHTEMgZm9yIGh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLW9wc2VjLWlwdjYtZWgtZmlsdGVy aW5nLTAzLg0KSWYgeW91IGhhdmUgbm90IHJlYWQgaXQsIHBsZWFzZSBkbyBzbyBub3cuIFlvdSBt YXkgc2VuZCBuaXRzIHRvIHRoZSBhdXRob3IsIGJ1dCBzdWJzdGFudGl2ZSBkaXNjdXNzaW9uIHNo b3VsZCBnbyB0byB0aGUgb3BzZWNAaWV0Zi5vcmc8bWFpbHRvOm9wc2VjQGlldGYub3JnPiBsaXN0 Lg0KKFdoaWxlIFY2T1BTIFdHIGlzIGluIGNjIGJlY2F1c2Ugb2YgY2xvc2UgYWxpZ25tZW50IHdp dGggdGhlIFdHIGV4cGVydGlzZSBhcmVhLCBtYXkgd2UgYXNrIHRvIHNlbmQgZmVlZGJhY2sgYW5k IGNvbW1lbnRzIGluIHRoZSBPUFNFQyBXRykNCg0KV2Ugd2lsbCBjbG9zZSB0aGUgY2FsbCBvbiAx MyBPY3RvYmVyIDIwMTcNCg0KR3VudGVyICYgRXJpYw0KT1BTRUMgV0cgY28tY2hhaXJzDQoNCg== --_000_AM5PR0701MB283628A864A1456C3B376F05E0430AM5PR0701MB2836_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo1OTUuMHB0IDg0Mi4wcHQ7DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30N CmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0t W2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRt YXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRh PSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJv ZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1 NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkhpIGFsbCw8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRoZXJlIGhhcyBiZWVuIHN1YnN0YW50aWFsIGRpc2N1 c3Npb24gb24gdGhlIGRvY3VtZW50IGR1cmluZyBXR0xDIGFuZCB0aGUgZG9jdW1lbnQgaGFzIHJl Y2VpdmVkIHZhbHVhYmxlIGlucHV0IGZvciBlbmhhbmNlbWVudC4gVGhlIGRvY3VtZW50IGlzIG5v dCByZWFkeSB5ZXQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5B dXRob3JzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhlIGRv Y3VtZW50IGlzIG9uIHRoZSByaWdodCB0cmFjay4gUGxlYXNlIGludGVncmF0ZSB0aGUgc3VnZ2Vz dGlvbnMgZHVyaW5nIFdHTEMgYW5kIGlmIG5lZWRlZCB3ZSBjYW4gaGF2ZSBhIGRpc2N1c3Npb24g ZHVyaW5nIElFVEYxMDAgdG8gY2xvc2UgdGhlIGhhcmRlciBzdWdnZXN0aW9ucyBpbnRvIFdHIGFn cmVlbWVudC4gSeKAmWxsIGJlIGxvb2tpbmcgZm9yd2FyZA0KIHRvIHNlZSBhbiB1cGRhdGVkIGRv Y3VtZW50IHdoaWNoIHJlZmxlY3RzIFdHIGNvbnNlbnN1cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkJyZ2RzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5HLzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29t cG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvYT48L3A+DQo8c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+ PC9zcGFuPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Gcm9tOjwvc3Bhbj48L2I+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiBWYW4gRGUgVmVsZGUsIEd1bnRlciAoTm9r aWEgLSBCRS9BbnR3ZXJwKQ0KPGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgU2VwdGVtYmVyIDI5 LCAyMDE3IDEwOjEyPGJyPg0KPGI+VG86PC9iPiBvcHNlY0BpZXRmLm9yZzxicj4NCjxiPkNjOjwv Yj4gZHJhZnQtaWV0Zi1vcHNlYy1pcHY2LWVoLWZpbHRlcmluZ0BpZXRmLm9yZzsgdjZvcHNAaWV0 Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gV0dMQyBmb3IgZHJhZnQtaWV0Zi1vcHNlYy1pcHY2 LWVoLWZpbHRlcmluZy0wMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhpcyBp cyB0byBvcGVuIGEgdHdvIHdlZWsgV0dMQyBmb3ImbmJzcDs8YSBocmVmPSJodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1vcHNlYy1pcHY2LWVoLWZpbHRlcmluZy0wMyI+aHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJp bmctMDM8L2E+LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SWYgeW91IGhhdmUgbm90 IHJlYWQgaXQsIHBsZWFzZSBkbyBzbyBub3cuIFlvdSBtYXkgc2VuZCBuaXRzIHRvIHRoZSBhdXRo b3IsIGJ1dCBzdWJzdGFudGl2ZSBkaXNjdXNzaW9uIHNob3VsZCBnbyB0byB0aGUNCjxhIGhyZWY9 Im1haWx0bzpvcHNlY0BpZXRmLm9yZyI+b3BzZWNAaWV0Zi5vcmc8L2E+IGxpc3QuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij4oV2hpbGUgVjZPUFMgV0cgaXMgaW4gY2MgYmVjYXVzZSBv ZiBjbG9zZSBhbGlnbm1lbnQgd2l0aCB0aGUgV0cgZXhwZXJ0aXNlIGFyZWEsIG1heSB3ZSBhc2sg dG8gc2VuZCBmZWVkYmFjayBhbmQgY29tbWVudHMgaW4gdGhlIE9QU0VDIFdHKTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij5XZSB3aWxsIGNsb3NlIHRoZSBjYWxsIG9uIDEzIE9jdG9iZXIgMjAxNzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5H dW50ZXIgJmFtcDsgRXJpYzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+T1BTRUMgV0cg Y28tY2hhaXJzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_AM5PR0701MB283628A864A1456C3B376F05E0430AM5PR0701MB2836_-- From nobody Fri Oct 20 12:42:24 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51C6013235C; Fri, 20 Oct 2017 12:42:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sjWDHhb7QgT2; Fri, 20 Oct 2017 12:42:15 -0700 (PDT) Received: from mail-pf0-x229.google.com (mail-pf0-x229.google.com [IPv6:2607:f8b0:400e:c00::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A6A2132026; Fri, 20 Oct 2017 12:42:15 -0700 (PDT) Received: by mail-pf0-x229.google.com with SMTP id a8so12439545pfc.0; Fri, 20 Oct 2017 12:42:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=ybVLcBGCC1Rqt3ws4awEqHHzi37OeuuB8f5hw4TF+VU=; b=R6nqBy7ejt4Qq0Z0uySB8/2cT2pkXM6Sanj4UufGVrEFLi0qL3IWc2nmNBEgdfR39r kUd02Xl+x/NhJNwVNH0RGLaFs1eAj0rtWB/CzyeJ5dV/FdkdozMLk5juFeO4TBuHKWbw Fl3wtLp5V5bmuC+Qngj5wP0MMtmrqXcC5kyrt6/WGolnfjQBgJKHMJfpRbciiN2kznUm wZzW+JcTvRZoJfi08RJgQQAWby8AsWj8KBT4blgmi9dCmJSWNy+TI02mtyD9kVOhGbSw YvixQx0Hard85O9SFNkmgabXuJdJqhpnkDomf3f1NgQImtyojRVZqjEtA7xdbqsn1IAJ HDjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=ybVLcBGCC1Rqt3ws4awEqHHzi37OeuuB8f5hw4TF+VU=; b=OFRqK795yFJyRDWAw7Rp7frEvFf5QsQaT+I/hFCqEP4EAzG+dSCgXm+/v93H+klW+t 8MZkZN2OT/91EvZx3UcL+uY5ZdQfHgrNPkKH+A4SYq4Dllj5MQ90tRxvZtdTa+wTi4fZ aVnW6Ab07gGyzovUCK4tWRVlon14ivNpz7uGbO97vdyMtSnQZ8VoTHDHP1hMA3F2SJkY G8e0IcNP0GoxmqI5OWgm7rbpV2qy55EpA6d3Vr8q0/WIHitcpRpwa29fFSX6ZEeVnLpg XBA2Rf7oMM1Dyn9QV+tpVa77Mn4Ddhkcf9oRvnDcPUk5kcxJ+YlAWCRIMm4ShfqSOVP6 NH+w== X-Gm-Message-State: AMCzsaWqe6Oh8ZDOL1o4Jg6oa3qh9Xb0mdDC+a+erK+ZaHq6b0YUBGqV wre8t48SEUuMDLzgyw21sxYUfA== X-Google-Smtp-Source: ABhQp+TEiJiBoIRwFtEzteHJJgSTlE+nB3qlmUPTkqVFX2BdX2klME7s8pZs4wCRor95VzUONMuxjA== X-Received: by 10.98.82.85 with SMTP id g82mr6003128pfb.31.1508528534757; Fri, 20 Oct 2017 12:42:14 -0700 (PDT) Received: from ?IPv6:2406:e007:6d3c:1:28cc:dc4c:9703:6781? ([2406:e007:6d3c:1:28cc:dc4c:9703:6781]) by smtp.gmail.com with ESMTPSA id g5sm2475773pgq.94.2017.10.20.12.42.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 Oct 2017 12:42:13 -0700 (PDT) To: Fernando Gont , Bob Hinden , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , "opsec@ietf.org" Cc: "v6ops@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> <91dcdfa8-a4fd-c2b4-9371-defa2b24c551@si6networks.com> From: Brian E Carpenter Organization: University of Auckland Message-ID: <66b597b7-a6ce-3f1a-5fd2-ccae882ca667@gmail.com> Date: Sat, 21 Oct 2017 08:42:20 +1300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <91dcdfa8-a4fd-c2b4-9371-defa2b24c551@si6networks.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Oct 2017 19:42:17 -0000 On 20/10/2017 22:53, Fernando Gont wrote: > Hello, Bob, >=20 > On 10/04/2017 06:38 PM, Bob Hinden wrote: >> >> I also don=E2=80=99t think this is ready for a w.g. last call. >> >> It doesn=E2=80=99t reference the new version of the IPv6 specification= >> RFC8200. There were a number of clarifications in RFC8200 regarding >> extension headers that may require changes in the draft. >=20 > We talked a bit about this. Best option seems to be to keep the current= > text and add text regarding the changes in RFC8200 -- at the end of th > day, an operator will have to deal with both RFC2460 and RFC8200 > implementations. >=20 > Thoughts? I don't think that is 100% right. Yes, of course add a general note at the front stating that the current standard is 8200 but that many implementations were based on 2460. But then, change all the references to 8200 and add text where there is an actual difference between the two cases. So far I think two have been pointed out: https://mailarchive.ietf.org/arch/msg/opsec/StjbjvCP9PLC3ssnTKYO6jqFgk0 https://mailarchive.ietf.org/arch/msg/opsec/9FigBATRkVHAurXv3aNNR-Z46JU but there may be others. Brian From nobody Fri Oct 20 16:36:54 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9717132A1A; Fri, 20 Oct 2017 16:36:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.398 X-Spam-Level: X-Spam-Status: No, score=-2.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.199, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AgHaUDFV1pNy; Fri, 20 Oct 2017 16:36:51 -0700 (PDT) Received: from mail-vk0-x22f.google.com (mail-vk0-x22f.google.com [IPv6:2607:f8b0:400c:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6ED012ECEC; Fri, 20 Oct 2017 16:36:50 -0700 (PDT) Received: by mail-vk0-x22f.google.com with SMTP id n70so8258539vkf.11; Fri, 20 Oct 2017 16:36:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=OLQkMsRvzv3DeSupQvmhevemnsjWGxmtjCwtJu0VWCg=; b=Vprrp/RrBFZFRjgUXvOvyT42EnG+h8zW4Zz8VnO9EiL6VAZHNYrFCZxckSBqIQd4i5 v5a3CAM1LZIOm+4BmNuuBhx1orUcX2TRRKq5vR9HgXyRkQIFScBwPy6wHP4YnYQ1iiBj HiCZn0naj1X9j7LohXa76VpCH1s0INWuejd0LaZKufvmXXdZID3jiCwME0+3GE8R2Dke RC33r5hcbHupWBal6oXDqKIU9QK4ZT13ctVOjfiXK7+u0f/LXRFENwI+AKXBdxoPsXPA NeuEKeHwPKzPIWIUeSJMyhRsgJoQDwwuvQ8nhbWZjz8aQq77Hct/N4Sshe2Xl/Nsbt82 9Nkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=OLQkMsRvzv3DeSupQvmhevemnsjWGxmtjCwtJu0VWCg=; b=tDDvi4zBLDTKFy0v81ZSbScK2tZZaAdFNyvC4cJa9ljldNbXqcl4u++LsWLS6RqDTS aQPhP8fB7SFWEJ70CcgMGOGMx2Ezeg2IOh4yjkmHDLAHiL/dGxj7BeCF72mRq9tH8UMv 6S/FhoFHcz4dGLVMKU1tj0tFS6K6wD198i9SsAZrMxBZ92Nqt3PIhecz8NXpSwKyW8ps S8hA8b35Hj/zOBodW0jENaCsqtmuwq7QPUeW4DmiySRe2hNP+yhLPWc/PQprhHUBq6yN yyfHo3kG2JKIP/kecQuSrZl5RJ/H/9oS/lxoEdIe0pq9ob2yjtfCpSyj8FOPlfL7qEpJ H/Ow== X-Gm-Message-State: AMCzsaVHyTTphSmI+C4OKX1lpShAd3djqNrLv44i+2TK7pIuQ00pApyt Wmb2vXHUeUl9f6vFhWSFD3lXaobSJvWoO+DIT/w= X-Google-Smtp-Source: ABhQp+TDUn2FJZN6c79XCle3vu47CmSpWdggWwCjvaW31/4nil1xy+jHtj7jJ+6kXqBgRneSJFB3Dl3tT1ROnRDWC+o= X-Received: by 10.31.215.68 with SMTP id o65mr267032vkg.95.1508542609820; Fri, 20 Oct 2017 16:36:49 -0700 (PDT) MIME-Version: 1.0 Sender: fgont.mobile@gmail.com Received: by 10.103.60.216 with HTTP; Fri, 20 Oct 2017 16:36:48 -0700 (PDT) Received: by 10.103.60.216 with HTTP; Fri, 20 Oct 2017 16:36:48 -0700 (PDT) In-Reply-To: <66b597b7-a6ce-3f1a-5fd2-ccae882ca667@gmail.com> References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> <91dcdfa8-a4fd-c2b4-9371-defa2b24c551@si6networks.com> <66b597b7-a6ce-3f1a-5fd2-ccae882ca667@gmail.com> From: Fernando Gont Date: Fri, 20 Oct 2017 20:36:48 -0300 X-Google-Sender-Auth: o9_xmZT1d4AJrFcJeUXZjcaAXO0 Message-ID: To: Brian Carpenter Cc: "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" , "opsec@ietf.org" , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , Bob Hinden , "v6ops@ietf.org" Content-Type: multipart/alternative; boundary="94eb2c07d9646310ec055c02f2fe" Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Oct 2017 23:36:53 -0000 --94eb2c07d9646310ec055c02f2fe Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable (sorry for top-posting) I meant: everywhere there's diverging behaviour between rfc2460 and rfc8200, note both behaviors. We can center discussion on rfc8200, and make refs to rfc2460 look like "notes" (e.g., "rrc2470 used to blah blah...'). Thoughts? Thanks, Fernando El 20 oct. 2017 4:42 p. m., "Brian E Carpenter" escribi=C3=B3: > On 20/10/2017 22:53, Fernando Gont wrote: > > Hello, Bob, > > > > On 10/04/2017 06:38 PM, Bob Hinden wrote: > >> > >> I also don=E2=80=99t think this is ready for a w.g. last call. > >> > >> It doesn=E2=80=99t reference the new version of the IPv6 specification > >> RFC8200. There were a number of clarifications in RFC8200 regarding > >> extension headers that may require changes in the draft. > > > > We talked a bit about this. Best option seems to be to keep the current > > text and add text regarding the changes in RFC8200 -- at the end of th > > day, an operator will have to deal with both RFC2460 and RFC8200 > > implementations. > > > > Thoughts? > > I don't think that is 100% right. Yes, of course add a general note at > the front stating that the current standard is 8200 but that many > implementations were based on 2460. But then, change all the references > to 8200 and add text where there is an actual difference between the > two cases. So far I think two have been pointed out: > https://mailarchive.ietf.org/arch/msg/opsec/StjbjvCP9PLC3ssnTKYO6jqFgk0 > https://mailarchive.ietf.org/arch/msg/opsec/9FigBATRkVHAurXv3aNNR-Z46JU > but there may be others. > > Brian > > --94eb2c07d9646310ec055c02f2fe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
(sorry for top-posting)

I meant: everywhere there's diverging behaviour between rfc= 2460 and rfc8200, note both behaviors.

We can center discussion on rfc8200, and make refs to rfc246= 0 look like "notes" (e.g., "rrc2470 used to blah blah...'= ;).

Thoughts?

Thanks,
Fer= nando





El 20 oct. 2017 4:42 p. m., "Bria= n E Carpenter" <bria= n.e.carpenter@gmail.com> escribi=C3=B3:
On 20/10/2017 22:53, Fernando Gont wrote:
> Hello, Bob,
>
> On 10/04/2017 06:38 PM, Bob Hinden wrote:
>>
>> I also don=E2=80=99t think this is ready for a w.g. last call.
>>
>> It doesn=E2=80=99t reference the new version of the IPv6 specifica= tion
>> RFC8200.=C2=A0 There were a number of clarifications in RFC8200 re= garding
>> extension headers that may require changes in the draft.
>
> We talked a bit about this. Best option seems to be to keep the curren= t
> text and add text regarding the changes in RFC8200 -- at the end of th=
> day, an operator will have to deal with both RFC2460 and RFC8200
> implementations.
>
> Thoughts?

I don't think that is 100% right. Yes, of course add a general note at<= br> the front stating that the current standard is 8200 but that many
implementations were based on 2460. But then, change all the references
to 8200 and add text where there is an actual difference between the
two cases. So far I think two have been pointed out:
https://mailarchive.ietf.org/= arch/msg/opsec/StjbjvCP9PLC3ssnTKYO6jqFgk0
https://mailarchive.ietf.org/= arch/msg/opsec/9FigBATRkVHAurXv3aNNR-Z46JU
but there may be others.

=C2=A0 =C2=A0 Brian

--94eb2c07d9646310ec055c02f2fe-- From nobody Fri Oct 20 17:25:02 2017 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4830F13446C; Fri, 20 Oct 2017 17:24:13 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: opsec@ietf.org, warren@kumari.net X-Test-IDTracker: no X-IETF-IDTracker: 6.63.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150854545329.20809.3026202792019410166.idtracker@ietfa.amsl.com> Date: Fri, 20 Oct 2017 17:24:13 -0700 Archived-At: Subject: [OPSEC] opsec - Requested session has been scheduled for IETF 100 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Oct 2017 00:24:13 -0000 Dear Gunter Van de Velde, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. opsec Session 1 (1:30:00) Monday, Afternoon Session II 1550-1720 Room Name: Olivia size: 150 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Operational Security Capabilities for IP Network Infrastructure Area Name: Operations and Management Area Session Requester: Gunter Van de Velde Number of Sessions: 1 Length of Session(s): 1.5 Hours Number of Attendees: 75 Conflicts to Avoid: First Priority: v6ops opsawg opsarea grow 6man intarea Second Priority: spring saag oauth dots dmarc Third Priority: acme netconf quic sidrops sunset4 tls People who must be present: Eric Vyncke Gunter Van de Velde Warren Kumari Resources Requested: Special Requests: --------------------------------------------------------- From nobody Fri Oct 20 17:33:45 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06E841342F4; Fri, 20 Oct 2017 17:30:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JFwERtK0qqCp; Fri, 20 Oct 2017 17:30:13 -0700 (PDT) Received: from mail-pf0-x236.google.com (mail-pf0-x236.google.com [IPv6:2607:f8b0:400e:c00::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44A5B134457; Fri, 20 Oct 2017 17:30:07 -0700 (PDT) Received: by mail-pf0-x236.google.com with SMTP id b6so13233005pfh.7; Fri, 20 Oct 2017 17:30:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Ym5D5Vok3apSahYvolDO7Q358Z9n2+MQ244FU09LyiA=; b=GMHP3JPCTIoOE3js9QT8igefaxDzMydi7agf8nUprc6U5XkMSzfvBfnm1nbCmbetvi 6W4h40MsXd28sK3JEgrIip4GwPnjEzBlx4J5wqpNRxfYitFtM7rJpxqVCk5+lm84YzVM FnB+Fa5jfZ9sDrbzf3Aia6WkwlV+hbUqMnJO+6+r8/qUMuuqWKySbPvaJ/OmgxJb5xTU OOFO0lFUjRdd4SbYCqOjM/gahkkCzh624SF5FQNYKAkLIP1cdhQuQTLfy8DUI0fthbYy po/ljyY1WzSA0SEtKncsTcdeNvKZ8ztXcjGHXOCzROV0qYZfNaUxFyqCLVHTwmrO8hJX wftw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=Ym5D5Vok3apSahYvolDO7Q358Z9n2+MQ244FU09LyiA=; b=mJ3fJ6VTe3kDq2NUt/OqmRBa2Za5WLKaXOQOgFXYWhHfZ8THeBk60c7QMMknEVbonL UUr/2wOpg/HQHciC1P6avZUqWCexX9QQSnBc169FEOKzERVhEgj6OZ1GoTDELm54jKh0 n5j2stHxkomfhU71z0UsO4G4NGtaLZzbmk1/V2HUaHVu5BtLsENnudhAXzeVycFLdNnd CFkbLvT+ljA5nvNUvHwfRXEJEqHZt6UQI3x2UFWXZkDrmGmGhPSSWmVH4WeSAYzRlvCH GvZtRnCAZwTGwLmsmqm5nW8yjlFChofq0BRFpwfarjM+FO9gELbDeGzOgXKW+JElVxnS P/uQ== X-Gm-Message-State: AMCzsaV6AS8TyvVciM1LBlf2GoHWBhhyUFexSQVA//Mk16CfKCWMqyS4 KBHGV81tx0V1vZTg0P0N9NLU6A== X-Google-Smtp-Source: ABhQp+QwuVp+E1FUpFySD2bdLXykfYrQTfvOW8ERB58VrTqoJK20g+C2rws0cz5Z+yzUSKr8SqkSYg== X-Received: by 10.84.217.30 with SMTP id o30mr5254736pli.351.1508545806287; Fri, 20 Oct 2017 17:30:06 -0700 (PDT) Received: from ?IPv6:2406:e007:6d3c:1:28cc:dc4c:9703:6781? ([2406:e007:6d3c:1:28cc:dc4c:9703:6781]) by smtp.gmail.com with ESMTPSA id f10sm2879448pgr.8.2017.10.20.17.30.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 Oct 2017 17:30:05 -0700 (PDT) To: Fernando Gont Cc: "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" , "opsec@ietf.org" , "Van De Velde, Gunter (Nokia - BE/Antwerp)" , Bob Hinden , "v6ops@ietf.org" References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> <2C2BE7A7-C885-4B38-ADA4-B29EADEED387@gmail.com> <91dcdfa8-a4fd-c2b4-9371-defa2b24c551@si6networks.com> <66b597b7-a6ce-3f1a-5fd2-ccae882ca667@gmail.com> From: Brian E Carpenter Organization: University of Auckland Message-ID: <10b05f36-23e1-10f9-c602-c62ec287ac3b@gmail.com> Date: Sat, 21 Oct 2017 13:30:12 +1300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [OPSEC] [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Oct 2017 00:30:16 -0000 On 21/10/2017 12:36, Fernando Gont wrote: > (sorry for top-posting) >=20 > I meant: everywhere there's diverging behaviour between rfc2460 and > rfc8200, note both behaviors. >=20 > We can center discussion on rfc8200, and make refs to rfc2460 look like= > "notes" (e.g., "rrc2470 used to blah blah...'). Exactly right. I think that I already proposed text in that spirit for the RH0 case. Brian > Thoughts? >=20 > Thanks, > Fernando >=20 >=20 >=20 >=20 >=20 > El 20 oct. 2017 4:42 p. m., "Brian E Carpenter" > escribi=C3=B3: >=20 >> On 20/10/2017 22:53, Fernando Gont wrote: >>> Hello, Bob, >>> >>> On 10/04/2017 06:38 PM, Bob Hinden wrote: >>>> >>>> I also don=E2=80=99t think this is ready for a w.g. last call. >>>> >>>> It doesn=E2=80=99t reference the new version of the IPv6 specificati= on >>>> RFC8200. There were a number of clarifications in RFC8200 regarding= >>>> extension headers that may require changes in the draft. >>> >>> We talked a bit about this. Best option seems to be to keep the curre= nt >>> text and add text regarding the changes in RFC8200 -- at the end of t= h >>> day, an operator will have to deal with both RFC2460 and RFC8200 >>> implementations. >>> >>> Thoughts? >> >> I don't think that is 100% right. Yes, of course add a general note at= >> the front stating that the current standard is 8200 but that many >> implementations were based on 2460. But then, change all the reference= s >> to 8200 and add text where there is an actual difference between the >> two cases. So far I think two have been pointed out: >> https://mailarchive.ietf.org/arch/msg/opsec/StjbjvCP9PLC3ssnTKYO6jqFgk= 0 >> https://mailarchive.ietf.org/arch/msg/opsec/9FigBATRkVHAurXv3aNNR-Z46J= U >> but there may be others. >> >> Brian >> >> >=20 From nobody Mon Oct 23 00:25:44 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 046BD13EA5F for ; Mon, 23 Oct 2017 00:25:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.92 X-Spam-Level: X-Spam-Status: No, score=-1.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ML4lrmcpFZr9 for ; Mon, 23 Oct 2017 00:25:41 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0138.outbound.protection.outlook.com [104.47.2.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5F0013EA5C for ; Mon, 23 Oct 2017 00:25:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=jcgoulYFsnjZXn3shcIvGq6ZwjgkiCcp24Na0VvvT0U=; b=NnQbrAtjm0ivdCwi2O5KUPXa/JQaEcHg7AVAN6bxhOfG5eFOKazGaFyKCHWUH40qnYbvCqiv7jgRy2oSVU08diRrucCCQwpua87iiIR+XXgeY8KnqzyEK6gQo6oa35ChCFH2yTL4bYHzkCK5iEkyHqAKpEg5ZQ4Ymm7bZvya9xg= Received: from AM5PR0701MB2836.eurprd07.prod.outlook.com (10.168.155.139) by AM5PR0701MB2833.eurprd07.prod.outlook.com (10.168.155.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.178.3; Mon, 23 Oct 2017 07:25:38 +0000 Received: from AM5PR0701MB2836.eurprd07.prod.outlook.com ([fe80::f00a:2571:e709:3004]) by AM5PR0701MB2836.eurprd07.prod.outlook.com ([fe80::f00a:2571:e709:3004%14]) with mapi id 15.20.0178.003; Mon, 23 Oct 2017 07:25:38 +0000 From: "Van De Velde, Gunter (Nokia - BE/Antwerp)" To: "opsec@ietf.org" Thread-Topic: Call for agenda items for OPSEC Thread-Index: AdNL0AEIpLma0WXjR22ehtQv3pvcFg== Date: Mon, 23 Oct 2017 07:25:38 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.245.212.8] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM5PR0701MB2833; 6:qQE+6VdxyqMMGTpUlh5+rie8A/oBogLe6MHC94sE9J71CghrWeQptDopQixtqhfnyJi1JZLXlyOqUMGcVbBDEpr8T/wD2+BbFL9ZvgTz533gM6W8xm3lCB4AAm9nF6BkEYr3bDXcsSsZfnFruCO4Rx3oWmnL56YiLeGh0PThvpSp0jPmvDmfvAyIlpWsKhILyC4eACwhyTfkGY8F6348Xr0reFEYCpqQJr195ExXEzaIS03yrAjAVPygmj+UeMI2Y+MRnUIwCC34zKvlq6rquzVFdZ7QmrSkhyo1joEdAFO1v6aX2HYv1gv4cMcVPb/iiMcUlC78Zuk2KivSXb5UCRyDpqik9P95tKj+vLrqvD0=; 5:UXLqb/LbLLDTDpOPytjnJWRrEh3xi7+sw4xxjMZrXGgX8Fs3/bYeWRFDPaUV4Y0gHVUnCUAYwCylHIahCL6YWc7KDsmBlqXeKhNbwPeIKYAe7m74ZnL6aYv7KjeWiESp6q0CZsjpkwbP63DgtfDt5C+uSsN4cjUnB7Yj69cssds=; 24:XI0deoFD0mSHMIZ+I1esWu6WMSqD94011cMAiIvmmmUEhguHOQjjbfB/6bN3G3BhhoTMdIZMuROg8XP+3NSDWOcypp7uatgSclVAqXef4LA=; 7:MxCjuw7n0JlB0MFCIt3PWQr2YhxXPHOhldLG82VAEGY0KQwE805CZfYTvNWzAzDVQ0mNdY2gAnTpYp9SRQNKCbzUkFAoLVzwl08617b9b8ga1xwjzvPg2pgYGORpHUG8uDaICEx1jWGA7K5JC/zj6a1PCAKJrgYMwRF92QyaUjMjzfAB9/hBt6YKfQJfNuF+ZKRaHtdtj7meVRlNPQd5IfDeli5xeknfrBSwVHZ1KmzBOQgk9kPlusQ1sM6dxP3+ x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 1c365203-32df-4aa4-8823-08d519e74288 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:AM5PR0701MB2833; x-ms-traffictypediagnostic: AM5PR0701MB2833: authentication-results: spf=none (sender IP is ) smtp.mailfrom=gunter.van_de_velde@nokia.com; x-exchange-antispam-report-test: UriScan:(21748063052155); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(100000703101)(100105400095)(3231020)(10201501046)(6055026)(6041248)(20161123564025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123560025)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM5PR0701MB2833; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM5PR0701MB2833; x-forefront-prvs: 046985391D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(346002)(39860400002)(376002)(199003)(189002)(8676002)(102836003)(33656002)(81166006)(81156014)(101416001)(50986999)(7736002)(54356999)(97736004)(2900100001)(74316002)(3846002)(2351001)(25786009)(1730700003)(106356001)(105586002)(6916009)(7696004)(5660300001)(6116002)(8936002)(790700001)(478600001)(9686003)(189998001)(2501003)(55016002)(54896002)(99286003)(6306002)(316002)(5250100002)(3660700001)(2906002)(66066001)(14454004)(5630700001)(4326008)(68736007)(6506006)(6436002)(5640700003)(558084003)(53936002)(9326002)(3280700002)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0701MB2833; H:AM5PR0701MB2836.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: nokia.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_AM5PR0701MB283604782BC56B35D4CDAACCE0460AM5PR0701MB2836_" MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1c365203-32df-4aa4-8823-08d519e74288 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Oct 2017 07:25:38.6395 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0701MB2833 Archived-At: Subject: [OPSEC] Call for agenda items for OPSEC X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 07:25:43 -0000 --_000_AM5PR0701MB283604782BC56B35D4CDAACCE0460AM5PR0701MB2836_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, If you have a topic to be discussed/presented during our IETF100 OPSEC WG m= eeting in Singapore, please let the chairs know. See you in Prague -gunter & -=E9ric --_000_AM5PR0701MB283604782BC56B35D4CDAACCE0460AM5PR0701MB2836_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

= Hello,

=  

= If you have a topic to be discussed/presented during our IETF100 OPSEC WG m= eeting in Singapore, please let the chairs know.

=  

= See you in Prague

=  

-gunter & -=E9ric

--_000_AM5PR0701MB283604782BC56B35D4CDAACCE0460AM5PR0701MB2836_-- From nobody Mon Oct 23 00:28:06 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FE2713EA9B for ; Mon, 23 Oct 2017 00:28:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.7 X-Spam-Level: X-Spam-Status: No, score=-4.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gj6-6RUVzyvW for ; Mon, 23 Oct 2017 00:28:03 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0131.outbound.protection.outlook.com [104.47.1.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FDF713EA97 for ; Mon, 23 Oct 2017 00:28:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=qxzgpOJz9t/jA++1qpPqMzaRrV0fM1BM9M97ED9Jad8=; b=efWfBM+HElFrmLRcSPrTKyyC9yYa5hqAGbm4Vj8TZWGemIzwoY5FCcKNB966Wr7a+BXgyrttnVMr1opvWXD9bWzdSXZscnLSEpPjOKSQk3ph5jltFT+65UTsTAZ1T+9X7AUTFZIymyAeRl1CMmr+vG/0Uy8L4zgR0qaE6h+m8nc= Received: from AM5PR0701MB2836.eurprd07.prod.outlook.com (10.168.155.139) by AM5PR0701MB2834.eurprd07.prod.outlook.com (10.168.155.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.178.3; Mon, 23 Oct 2017 07:28:00 +0000 Received: from AM5PR0701MB2836.eurprd07.prod.outlook.com ([fe80::f00a:2571:e709:3004]) by AM5PR0701MB2836.eurprd07.prod.outlook.com ([fe80::f00a:2571:e709:3004%14]) with mapi id 15.20.0178.003; Mon, 23 Oct 2017 07:28:00 +0000 From: "Van De Velde, Gunter (Nokia - BE/Antwerp)" To: "opsec@ietf.org" Thread-Topic: Call for agenda items for OPSEC [fixed typo] Thread-Index: AdNL0Gx5EbKEfpgXSbi2gXU1JY2mWQ== Date: Mon, 23 Oct 2017 07:28:00 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=gunter.van_de_velde@nokia.com; x-originating-ip: [135.245.212.8] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM5PR0701MB2834; 6:RlMcBpYaY/vt9yIGZ81x7EEfaspueWFCAXZFarRJvFeNZzb/XiDRLOqxTiQifMOEkWqCqsYeAet/VqZ9sWReRLBEigwARaIvjrSe3LCoxMShp1Jy2LW23T7MO5WOK6RMj2CIYGPB4rsZUn9duBf8nqZNGwZs1oRl9TckolvVbiD3RXjbWIGik/0mpjH2kqDebJOxWuFkOsGl2GBPYpMKmN2/nL09cJ/MqmGIvqC0mMaEzzHbszH3Py0Ed79HEV5rcUZofyNvWPKyfOapB+n+76G5o8JO3X7QcOCNuyON66I2/mKjcamSTlmP3WQQNHT5QaMaA8TZW2El20VQQtIWCrvOPkcbhqcgfED6uj69Rfc=; 5:Yv6CnN7vYuLKITwgoebp2VkSS97zv3Vhd3iDb0uxCHDmeGUne8+SY+HqyKsXez0LEgoATUEsitNdC2SXzjYVXmDbt/jEfZ3i88q83PtLohf7pr9uHXUOLcYYTDVyffXhxq86ej30qbkOeUdLWfndMd6urbi+P3/zSbwizSyTRgM=; 24:OmZoVo5wo1INDuRurzb99MA/C6BMVM774w6g60PTs0WoSvkvCov4amPFU3xF4VcYDseAXxiNES8UJXeT2Lot2L5KEynERJYjUDwwhujLYJU=; 7:JsY96aPbWYMRS8EUBJdUiEXhRByWlUrVu230xbBQn92cO9qW7WCBifg8DNIHvfFLK4knup3CDhlVH9RWC/8QYT7yjB5Olj72GG8OMuQgI5hG6sj6I8G5YnB9+kaKuq79MDXv/wbRXKXLHN2jjhTWsjjD/HP9JGgUt909a613o2R+DlrnYXq4JS2G+o+VOymChl72FmAtkfJ3ZJ/wtp7EjEgRO10TXeaxecPFBgVv51V1H9lHnzViMkrbEj+N23da x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 79231d8a-168d-4d5f-4b48-08d519e7974b x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603199); SRVR:AM5PR0701MB2834; x-ms-traffictypediagnostic: AM5PR0701MB2834: x-exchange-antispam-report-test: UriScan:(21748063052155); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(100000703101)(100105400095)(10201501046)(3231020)(3002001)(6055026)(6041248)(20161123558100)(20161123560025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM5PR0701MB2834; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM5PR0701MB2834; x-forefront-prvs: 046985391D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(346002)(39860400002)(376002)(189002)(199003)(6306002)(9686003)(66066001)(99286003)(7736002)(2900100001)(5640700003)(2351001)(106356001)(14454004)(105586002)(5250100002)(4326008)(101416001)(74316002)(50986999)(54356999)(53936002)(558084003)(54896002)(33656002)(97736004)(6506006)(189998001)(55016002)(316002)(6436002)(478600001)(25786009)(2906002)(3280700002)(68736007)(5630700001)(81156014)(9326002)(6916009)(3660700001)(790700001)(81166006)(2501003)(8676002)(1730700003)(3846002)(6116002)(102836003)(8936002)(5660300001)(86362001)(7696004); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0701MB2834; H:AM5PR0701MB2836.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: nokia.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_AM5PR0701MB28360ECA33B47F7635EC189DE0460AM5PR0701MB2836_" MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 79231d8a-168d-4d5f-4b48-08d519e7974b X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Oct 2017 07:28:00.7977 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0701MB2834 Archived-At: Subject: [OPSEC] Call for agenda items for OPSEC [fixed typo] X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 07:28:05 -0000 --_000_AM5PR0701MB28360ECA33B47F7635EC189DE0460AM5PR0701MB2836_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, If you have a topic to be discussed/presented during our IETF100 OPSEC WG m= eeting in Singapore, please let the chairs know. See you in Singapore -gunter & -=E9ric --_000_AM5PR0701MB28360ECA33B47F7635EC189DE0460AM5PR0701MB2836_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

 

= Hello,

=  

= If you have a topic to be discussed/presented during our IETF100 OPSEC WG m= eeting in Singapore, please let the chairs know.

=  

= See you in Si= ngapore

=  

-gunter & -=E9ric

--_000_AM5PR0701MB28360ECA33B47F7635EC189DE0460AM5PR0701MB2836_-- From nobody Mon Oct 30 00:17:03 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAB2713FEAB for ; Mon, 30 Oct 2017 00:17:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YhKtvaMawVUx for ; Mon, 30 Oct 2017 00:16:59 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EAAB13FEC1 for ; Mon, 30 Oct 2017 00:16:52 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 083DFB8010F; Mon, 30 Oct 2017 00:16:45 -0700 (PDT) To: fgont@si6networks.com, tim.chown@jisc.ac.uk, bclaise@cisco.com, warren@kumari.net, evyncke@cisco.com, gunter@vandevelde.cc X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: ktyers@gmail.com, opsec@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20171030071645.083DFB8010F@rfc-editor.org> Date: Mon, 30 Oct 2017 00:16:45 -0700 (PDT) Archived-At: Subject: [OPSEC] [Technical Errata Reported] RFC7707 (5175) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 07:17:02 -0000 The following errata report has been submitted for RFC7707, "Network Reconnaissance in IPv6 Networks". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5175 -------------------------------------- Type: Technical Reported by: Kevin Tyers Section: 5.1.4. Original Text ------------- the response would contain an RCODE of 0 (no error). Otherwise, the response would contain an RCODE of 4 (NXDOMAIN). Corrected Text -------------- the response would contain an RCODE of 0 (no error). Otherwise, the response would contain an RCODE of 3 (NXDOMAIN). Notes ----- In RFC1035 section 4.1.1. it states that an RCODE of 3 is 'Name Error' aka NXDOMAIN. RCODE 4 is "Not Implemented". RFC 7707 incorrectly refers to NXDOMAIN as RCODE 4 instead of RCODE 3. Here is the output of testing this in Wireshark: .... .... .... 0011 = Reply code: No such name (3) Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC7707 (draft-ietf-opsec-ipv6-host-scanning-08) -------------------------------------- Title : Network Reconnaissance in IPv6 Networks Publication Date : March 2016 Author(s) : F. Gont, T. Chown Category : INFORMATIONAL Source : Operational Security Capabilities for IP Network Infrastructure Area : Operations and Management Stream : IETF Verifying Party : IESG From nobody Mon Oct 30 14:32:39 2017 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BB6E13F7B0; Mon, 30 Oct 2017 14:32:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.63.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150939915107.7814.12431141772022433801@ietfa.amsl.com> Date: Mon, 30 Oct 2017 14:32:31 -0700 Archived-At: Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-12.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:32:31 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Eric Vyncke Kiran K. Chittimaneni Merike Kaeo Filename : draft-ietf-opsec-v6-12.txt Pages : 48 Date : 2017-10-30 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in all places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-12 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-12 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-12 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Oct 30 15:09:58 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EDB213AB2F for ; Mon, 30 Oct 2017 15:09:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.52 X-Spam-Level: X-Spam-Status: No, score=-14.52 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5rDCX4FjKk0W for ; Mon, 30 Oct 2017 15:09:55 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5242513FBE4 for ; Mon, 30 Oct 2017 15:09:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3342; q=dns/txt; s=iport; t=1509401395; x=1510610995; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=lvgLk6/DTOPOddAzVztUrFj4pzAoTSXU4U21ThKEdUM=; b=e6k+GWHjZpJAGI9Sov0dP5NSQTJMKZr+5ehdhsx1RqTpjXtRSblNYPBj pqOtH2wNf7yEwy3dJoXnPerVy8K+sVbMkGkSO2eDR7pZZ8KPyxXJHVUO0 BqksAvV4ZP3SvPqEcjfEjRvVqrwUmmrr+Fc8REiUJOrIyO540OFbmrCwm Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CjAAC+ovdZ/4oNJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg19kbicHg3WKH48TmD4QggEKGAuFGAIahEU/GAECAQEBAQEBAWs?= =?us-ascii?q?dC4UeAgQBASEROhsCAQgaAhEVAgICJQsVEAIEE4ojEKhLgieLBwEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAR2BD4IfggeBU4ISgwGDPoEORRcoglYvgjIFogMCh2SNFoI?= =?us-ascii?q?VXoUiixiKLIIziQQCERkBgTgBHziBaHoVHyotAYI2CYRWd4s7gREBAQE?= X-IronPort-AV: E=Sophos;i="5.44,321,1505779200"; d="scan'208";a="317309076" Received: from alln-core-5.cisco.com ([173.36.13.138]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 30 Oct 2017 22:09:54 +0000 Received: from XCH-RTP-011.cisco.com (xch-rtp-011.cisco.com [64.101.220.151]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id v9UM9rX2005788 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Mon, 30 Oct 2017 22:09:54 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-011.cisco.com (64.101.220.151) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Mon, 30 Oct 2017 18:09:53 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1320.000; Mon, 30 Oct 2017 18:09:52 -0400 From: "Eric Vyncke (evyncke)" To: "opsec@ietf.org" Thread-Topic: [OPSEC] I-D Action: draft-ietf-opsec-v6-12.txt Thread-Index: AQHTUcamHuJaSOBRy02X31sRb5ED0qL9R+IA Date: Mon, 30 Oct 2017 22:09:52 +0000 Message-ID: <05F0E97C-CA5E-465B-A0A6-39134AF55FDB@cisco.com> References: <150939915107.7814.12431141772022433801@ietfa.amsl.com> In-Reply-To: <150939915107.7814.12431141772022433801@ietfa.amsl.com> Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1e.0.170107 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.56.13] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-12.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 22:09:57 -0000 SXQgaXMgYW4gdXBkYXRlIHRvIHRha2UgaW50byBhY2NvdW50IHRoZSByZXZpZXcgb2YgTWlrYWVs IEFicmFoYW1zc29uIGFuZCBUb2JpYXMgRmllYmlnLg0KDQpTZWUgeW91IGluIFNpbmdhcG9yZSBp ZiB5b3UgcGFydGljaXBhdGUgaW4gdGhlIE9QU0VDIFdHIG1lZXRpbmcgb24gTW9uZGF5IChhZ2Vu ZGEgcHVibGlzaGVkIEJUVykNCg0KLcOpcmljDQoNCk9uIDMwLzEwLzE3IDIyOjMyLCAiT1BTRUMg b24gYmVoYWxmIG9mIGludGVybmV0LWRyYWZ0c0BpZXRmLm9yZyIgPG9wc2VjLWJvdW5jZXNAaWV0 Zi5vcmcgb24gYmVoYWxmIG9mIGludGVybmV0LWRyYWZ0c0BpZXRmLm9yZz4gd3JvdGU6DQoNCiAg ICANCiAgICBBIE5ldyBJbnRlcm5ldC1EcmFmdCBpcyBhdmFpbGFibGUgZnJvbSB0aGUgb24tbGlu ZSBJbnRlcm5ldC1EcmFmdHMgZGlyZWN0b3JpZXMuDQogICAgVGhpcyBkcmFmdCBpcyBhIHdvcmsg aXRlbSBvZiB0aGUgT3BlcmF0aW9uYWwgU2VjdXJpdHkgQ2FwYWJpbGl0aWVzIGZvciBJUCBOZXR3 b3JrIEluZnJhc3RydWN0dXJlIFdHIG9mIHRoZSBJRVRGLg0KICAgIA0KICAgICAgICAgICAgVGl0 bGUgICAgICAgICAgIDogT3BlcmF0aW9uYWwgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgZm9yIElQ djYgTmV0d29ya3MNCiAgICAgICAgICAgIEF1dGhvcnMgICAgICAgICA6IEVyaWMgVnluY2tlDQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLaXJhbiBLLiBDaGl0dGltYW5lbmkNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIE1lcmlrZSBLYWVvDQogICAgCUZpbGVuYW1lICAgICAg ICA6IGRyYWZ0LWlldGYtb3BzZWMtdjYtMTIudHh0DQogICAgCVBhZ2VzICAgICAgICAgICA6IDQ4 DQogICAgCURhdGUgICAgICAgICAgICA6IDIwMTctMTAtMzANCiAgICANCiAgICBBYnN0cmFjdDoN CiAgICAgICBLbm93bGVkZ2UgYW5kIGV4cGVyaWVuY2Ugb24gaG93IHRvIG9wZXJhdGUgSVB2NCBz ZWN1cmVseSBpcw0KICAgICAgIGF2YWlsYWJsZTogd2hldGhlciBpdCBpcyB0aGUgSW50ZXJuZXQg b3IgYW4gZW50ZXJwcmlzZSBpbnRlcm5hbA0KICAgICAgIG5ldHdvcmsuICBIb3dldmVyLCBJUHY2 IHByZXNlbnRzIHNvbWUgbmV3IHNlY3VyaXR5IGNoYWxsZW5nZXMuICBSRkMNCiAgICAgICA0OTQy IGRlc2NyaWJlcyB0aGUgc2VjdXJpdHkgaXNzdWVzIGluIHRoZSBwcm90b2NvbCBidXQgbmV0d29y aw0KICAgICAgIG1hbmFnZXJzIGFsc28gbmVlZCBhIG1vcmUgcHJhY3RpY2FsLCBvcGVyYXRpb25z LW1pbmRlZCBkb2N1bWVudCB0bw0KICAgICAgIGVudW1lcmF0ZSBhZHZhbnRhZ2VzIGFuZC9vciBk aXNhZHZhbnRhZ2VzIG9mIGNlcnRhaW4gY2hvaWNlcy4NCiAgICANCiAgICAgICBUaGlzIGRvY3Vt ZW50IGFuYWx5emVzIHRoZSBvcGVyYXRpb25hbCBzZWN1cml0eSBpc3N1ZXMgaW4gYWxsIHBsYWNl cw0KICAgICAgIG9mIGEgbmV0d29yayAoZW50ZXJwcmlzZXMsIHNlcnZpY2UgcHJvdmlkZXJzIGFu ZCByZXNpZGVudGlhbCB1c2VycykNCiAgICAgICBhbmQgcHJvcG9zZXMgdGVjaG5pY2FsIGFuZCBw cm9jZWR1cmFsIG1pdGlnYXRpb25zIHRlY2huaXF1ZXMuDQogICAgDQogICAgDQogICAgVGhlIElF VEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQogICAgaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1vcHNlYy12Ni8NCiAgICANCiAg ICBUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9ucyBhdmFpbGFibGUgYXQ6DQogICAgaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtb3BzZWMtdjYtMTINCiAgICBodHRw czovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWlldGYtb3BzZWMtdjYtMTIN CiAgICANCiAgICBBIGRpZmYgZnJvbSB0aGUgcHJldmlvdXMgdmVyc2lvbiBpcyBhdmFpbGFibGUg YXQ6DQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0LWlldGYtb3Bz ZWMtdjYtMTINCiAgICANCiAgICANCiAgICBQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEg Y291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQogICAgdW50aWwg dGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRm Lm9yZy4NCiAgICANCiAgICBJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFu b255bW91cyBGVFAgYXQ6DQogICAgZnRwOi8vZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8N CiAgICANCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KICAgIE9QU0VDIG1haWxpbmcgbGlzdA0KICAgIE9QU0VDQGlldGYub3JnDQogICAgaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9vcHNlYw0KICAgIA0KDQo= From nobody Mon Oct 30 16:48:49 2017 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 55904C290; Mon, 30 Oct 2017 16:48:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.63.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150940731533.28230.8278290912975953945@ietfa.amsl.com> Date: Mon, 30 Oct 2017 16:48:35 -0700 Archived-At: Subject: [OPSEC] I-D Action: draft-ietf-opsec-ipv6-eh-filtering-04.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 23:48:35 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers Authors : Fernando Gont Will(Shucheng) Liu Ronald P. Bonica Filename : draft-ietf-opsec-ipv6-eh-filtering-04.txt Pages : 35 Date : 2017-10-30 Abstract: It is common operator practice to mitigate security risks by enforcing appropriate packet filtering. This document analyzes both the general security implications of IPv6 Extension Headers and the specific security implications of each Extension Header and Option type. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. Finally, it provides advice on the filtering of such IPv6 packets at transit routers for traffic *not* directed to them, for those cases in which such filtering is deemed as necessary. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-04 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-ipv6-eh-filtering-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-ipv6-eh-filtering-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Oct 31 04:28:25 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9413513942F for ; Tue, 31 Oct 2017 04:28:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m-mUxI4KsFOE for ; Tue, 31 Oct 2017 04:28:17 -0700 (PDT) Received: from mail-yw0-x22e.google.com (mail-yw0-x22e.google.com [IPv6:2607:f8b0:4002:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C940713F6BC for ; Tue, 31 Oct 2017 04:28:13 -0700 (PDT) Received: by mail-yw0-x22e.google.com with SMTP id z195so14385123ywz.6 for ; Tue, 31 Oct 2017 04:28:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=1o6hokFg8k519jO2eCEhbOn5Wd2RXiEaXbHtyaVXQqA=; b=W4xg0k1gegGXlcGX8kJ3OKHdRbgJeI/2HUTEUSUqHXBhB318OMzyplG50gfGO+YU0T Xk72KIFv0y/rrxpwlYwHJJLgPKUBWMB9tKh764NYxXxkp07I4omN6yT17vVdHoTZIznI xSmzm9KvVn1oAebotivBeREtnDq6Ycd8EPnLRGp5Wv8Ss40dUdbUW2FpiaMIM/rs5Tvr BHhrdTf0koKrVptlD5EgSmNDj3t8S1sQd4tDnJvFhSqLWWWC+v9R2H6D4mrpGHv+UuJG IzGe8HMGAwomzmRHldMVpFY7AeQINReNRyhXSyr4dxXqTZ6YBEl2mnnyRFVV7I+PjyHG r+FQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=1o6hokFg8k519jO2eCEhbOn5Wd2RXiEaXbHtyaVXQqA=; b=a/WKCl4tRsaEx2F0IopoQvs1y8Nejy34N1qcLq/xwEH+B2rERDTB3Sn+/ZVntXY1jh 3O9QxA9kQWmSSM+mO0gxOkmAW+Kkqco3Y63JGSZMfIclfDrWU0rt//40Ec1r4Q22wiwl Ep+3FfsNzHBpJs28f2qERpfCUHlN8fdrDAHaHGTEDQhNMJ5jwqyaiep5jCerLG33Rec7 S+3BnCJP+P2mDgG9K5mmaCjwQuPGhTA0jQwbf8Oe73KTcrql9w1EI76kIGEw7ESSdRaI Bls3kojTQlXQ1oW/QitvXTR0HxOhh0qLf6iTDF11fGpt3XMq5N3YZ4mYC3m76K2P9Cke TzxQ== X-Gm-Message-State: AMCzsaWqMr4yPud+anneDxopBlj5KMSSmDeOKrOUugkZsdzC09PoHj6S H9oD4kL6286s7gQMWbifM4v7DpYn10lMlKVX9uGEOg== X-Google-Smtp-Source: ABhQp+T+tL32d2+LMRSlbY5qw+y4ETUB9juiUZHqXjIw5Haov45W/kQvpHACz+PeJ8vfQ5CFdhts44gXyfu0jBlg8U8= X-Received: by 10.37.63.4 with SMTP id m4mr969740yba.15.1509449292650; Tue, 31 Oct 2017 04:28:12 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.14.196 with HTTP; Tue, 31 Oct 2017 04:27:52 -0700 (PDT) In-Reply-To: <05F0E97C-CA5E-465B-A0A6-39134AF55FDB@cisco.com> References: <150939915107.7814.12431141772022433801@ietfa.amsl.com> <05F0E97C-CA5E-465B-A0A6-39134AF55FDB@cisco.com> From: Erik Kline Date: Tue, 31 Oct 2017 20:27:52 +0900 Message-ID: To: "Eric Vyncke (evyncke)" Cc: "opsec@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="001a114bdabaef06cf055cd60c18" Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-12.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Oct 2017 11:28:23 -0000 --001a114bdabaef06cf055cd60c18 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I still have objections to section 2.1.2. Let's take just this one paragraph to start with: """ ULAs are intended for scenarios where IP addresses will not have global scope so they should not appear in the global BGP routing table. The implicit expectation from the RFC is that all ULAs will be randomly created as /48s. Any use of ULAs that are not created as a /48 violates RFC4193 [RFC4193]. """ The most obvious problems include: [1] ULA addresses have global scope but are not guaranteed to be globally routable. The first sentence as written does not clearly convey this subtlety. [2] The second sentence is not correct. Pseudo-random assignment is a MUST for locally-assigned global IDs, for one. [3] The last sentence misses the point: it's the probabilistic guarantee of uniqueness that's critical, not just the "/48-ness". One thing that could be called out later in this section is the potential accidental ULA address leakage via ICMPv6 responses. The rest of the section still reads to me like an oblique recommendation for ULAs with NPTv6, frankly. I guess I should expect to discuss this more in Singapore. On 31 October 2017 at 07:09, Eric Vyncke (evyncke) wrot= e: > It is an update to take into account the review of Mikael Abrahamsson and= Tobias Fiebig. > > See you in Singapore if you participate in the OPSEC WG meeting on Monday= (agenda published BTW) > > -=C3=A9ric > > On 30/10/17 22:32, "OPSEC on behalf of internet-drafts@ietf.org" wrote: > > > A New Internet-Draft is available from the on-line Internet-Drafts di= rectories. > This draft is a work item of the Operational Security Capabilities fo= r IP Network Infrastructure WG of the IETF. > > Title : Operational Security Considerations for IPv= 6 Networks > Authors : Eric Vyncke > Kiran K. Chittimaneni > Merike Kaeo > Filename : draft-ietf-opsec-v6-12.txt > Pages : 48 > Date : 2017-10-30 > > Abstract: > Knowledge and experience on how to operate IPv4 securely is > available: whether it is the Internet or an enterprise internal > network. However, IPv6 presents some new security challenges. RF= C > 4942 describes the security issues in the protocol but network > managers also need a more practical, operations-minded document to > enumerate advantages and/or disadvantages of certain choices. > > This document analyzes the operational security issues in all plac= es > of a network (enterprises, service providers and residential users= ) > and proposes technical and procedural mitigations techniques. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-opsec-v6-12 > https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-12 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsec-v6-12 > > > Please note that it may take a couple of minutes from the time of sub= mission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec --001a114bdabaef06cf055cd60c18 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS3wYJKoZIhvcNAQcCoIIS0DCCEswCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBFMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEXDCCA0SgAwIBAgIMKdwhX41Y35wFUjGFMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE3MDkxODA2MzcwOVoXDTE4MDMx NzA2MzcwOVowHjEcMBoGCSqGSIb3DQEJAQwNZWtAZ29vZ2xlLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAJy2TTLrLwR7RcglT55abZwzTLAQuVmbauaGZ7ISDwVYV8cPqfsX3aXc 919y4IdiY46RCm9gCcadSC5BIXHema75b6Go1xUnPOqqEItlA9D5h/5wnNhuYPL+oENW+qzlPIJn YuaY9+dkw9H89qAB72Ym3bCx3Uf3xMDsAxSZ1Ry9SZxZnjtlfN9kkKWXPeMLmb5PAaLfpL2Uy1P8 txlZzqpzH1sXjHlW1iuP76DxS7/9p+W3yTZTRW1f2q1UpvIGwb8M6rVwdZ4xGT7xsNtuq3piCwe/ zw8Vl36a+fiMl42R+DvRfmTKQ3fM9r8Kn7Ea7XtDPJxi7NObD5R+WNGOC5ECAwEAAaOCAWowggFm MBgGA1UdEQQRMA+BDWVrQGdvb2dsZS5jb20wUAYIKwYBBQUHAQEERDBCMEAGCCsGAQUFBzAChjRo dHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2h2c21pbWVjYTEuY3J0MB0GA1Ud DgQWBBTmP2l2sEQr/BnAyZ6R5p7YEJL/7TAfBgNVHSMEGDAWgBTLOBKwx5nAeJKMsyGV5vQmYsDg PzBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9i YWxzaWduLmNvbS9yZXBvc2l0b3J5LzA7BgNVHR8ENDAyMDCgLqAshipodHRwOi8vY3JsLmdsb2Jh bHNpZ24uY29tL2dzaHZzbWltZWNhMS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG AQUFBwMCBggrBgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAQEADid0ytXB29OM7HLEeo9Ogp3a1JkP J1V8J82GEmP3ADxjwMJe2gPJ6jKRcpv/wS8s7/e2llbFIJlMrDIP6IEcDYnUfHLBINVCcl9D8AiB T7kNEz6O637UG/RdFCP9/C+Vh1kB1NfYNclTKlHj8Hzn7VlhUktCL3hbJkLA5+L5lOLMibTieryO trFBU3qzQo4G/2LtdmRJIp3B9bcL0KE/XQ2MJQIAAFN0YFkG8qs8gie1LbygrV5csjAjpH+KY4O/ f66H+gc3e+bG1vQtoq9Iu/IpM1Zy0F+P9/zOu8REfB7FrH6WT+sBUy7SUdN1FakV/clOL426MxnS kkWJA9H3tTGCAl4wggJaAgEBMFwwTDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExIjAgBgNVBAMTGUdsb2JhbFNpZ24gSFYgUy9NSU1FIENBIDECDCncIV+NWN+cBVIxhTAN BglghkgBZQMEAgEFAKCB1DAvBgkqhkiG9w0BCQQxIgQgHlDEOHRWMAxosfMCUb8vNhPFrIZAoICl bBZjOLCxJ/AwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcxMDMx MTEyODEzWjBpBgkqhkiG9w0BCQ8xXDBaMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJYIZI AWUDBAECMAoGCCqGSIb3DQMHMAsGCSqGSIb3DQEBCjALBgkqhkiG9w0BAQcwCwYJYIZIAWUDBAIB MA0GCSqGSIb3DQEBAQUABIIBACxPkI94eQ6mV3AXJUZCmSEDy7VOg3c2jZDA0XWpLZrwJHySB9Ef AMQvFG5kqMVGAxCnQyT52gfB9mXgI2jVsV/rj+OOcJK4y0Qcz2eTdGjVg6fkzdGekcnmYxmGSpUO W4uSpnOMDJ1IBAI001ekkGi2QJ36JFojLqz4NYI8urIvu8oCz9+awzHpOsKPIhQmqD+Qgx5um93k eYllIDDSQFEyfjPn8k3D3EtOipgU/nI0NwFh9v9E3+WLNDlMgnqbAgCpvGu6OaN2bTNnjMjbGTeo PIXLuWs93NHNXX8OPLAaanKfs3qLUO4ImYQ0qtqTFKnevUzHMKy+kVoMDuMhE54= --001a114bdabaef06cf055cd60c18-- From nobody Tue Oct 31 10:29:31 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCE2313FA14; Tue, 31 Oct 2017 10:29:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wihQFi8lzHsd; Tue, 31 Oct 2017 10:29:27 -0700 (PDT) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0105.outbound.protection.outlook.com [23.103.200.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2EBD13FA0D; Tue, 31 Oct 2017 10:29:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=DBTL4w/NqGaqW2UURAMsG7SF8ZSJUtDdxO6kpLJdsK8=; b=vtTItrlB09lmOMX7Cb4Mw5OYei0bhrQrjj3iA2o30cBMLf+aJD0PdkzzAYia2Qog1SxwNf02FhfbKG3VJ3CcOfNEoFhEguqO5yrg859LogoAFdx+Nx5b9Teqj05Sv2vKOk0Rl1bryPdHcmh0eecN3vsmRW1uI9Jtor8SlEaP2XY= Received: from SN4PR0901MB2176.namprd09.prod.outlook.com (10.167.151.140) by SN4PR0901MB2174.namprd09.prod.outlook.com (10.167.151.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7; Tue, 31 Oct 2017 17:29:04 +0000 Received: from SN4PR0901MB2176.namprd09.prod.outlook.com ([fe80::2d21:3ea1:3904:77db]) by SN4PR0901MB2176.namprd09.prod.outlook.com ([fe80::2d21:3ea1:3904:77db%13]) with mapi id 15.20.0077.022; Tue, 31 Oct 2017 17:29:04 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "opsec@ietf.org" CC: "opsec-chairs@ietf.org" , "draft-sriram-opsec-urpf-improvements@ietf.org" , Job Snijders Thread-Topic: New Version Notification for draft-sriram-opsec-urpf-improvements-02.txt Thread-Index: AQHTUcdU3uYXweLKUECpVZ7r+vEPZKL+MfHA Date: Tue, 31 Oct 2017 17:29:04 +0000 Message-ID: References: <150939944897.7765.772862235683181250.idtracker@ietfa.amsl.com> In-Reply-To: <150939944897.7765.772862235683181250.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.140.122] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; SN4PR0901MB2174; 6:W1MYA80XGrpXgaDdgGqgDZ+QG19Xh39Qs0EkI9LgMZN2RUt4uct2OnF6icSvA5tY6OoQM5RIrRC2/g9eW53sS4be2KDurb5yb19fwpW0GNxHi0jerq4hJmfUToyoxql9nOVWAoGUZifscxs8Zz6lBHLjKK9dm3aY8mGOSjjrYs3ta5Mo0w0N0T+uUcJIaqzYm3wL+MKVMVjNHpILw2wqfjfkcLfqvaikpsp+qvinyJNtuI72LpC2nxhgcs+lBTnoMMPXJZn29VAZMcSIPBMwpjCzKCPOJ9+Mdg54zOiJL5snlpirlzWrt2LGEsJsVb7m3PR64PFcMBebo6Upe1z2nw==; 5:jD5b3tfdkeRHOXCOFirDG4UV7F42KprPNFAdA26rKIpwP5e6RKNnBu/pjXRNMCjv3AOhmr950BwV030+RV6lpsmcFktz5muIYtCo5v07+2RSBDSe6X6tsuK3Tmq9kjTxh/Ui28qa3XVtQQRsyTm23Q==; 24:80cZiJpTOGuItXgd2TDoXX5RBJtI30pNm7+MFMy9D6cQ/erbDeJ2JHSd5cak8jhgk0AOx82iX7T7k+htbGdfdLYdb31MdlpUCUqT3UeWMRw=; 7:RMV2hSXt2NJ8xd4fJdKj+i5fSNc3LilXSZ3maf69v8kLw8PuwB/27kQjK02XMHYuLm5mh6CKP3iXf0NAqhdkF1Xa0IGcqafMkIKKSFoO/9+g2LEzL0kTZo7NIdVVeYHhqRP9iJPJZ4hA1klJTCabWix2TwiWg0HCVh4ZTWNvvJKDsiDFIHF/M7kjK4g0oAnnDH9fe8u42H8yv/71cF5X2e6cEau0sz4F/St7mFBre3M= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 1de15e24-cf4d-4b99-d30f-08d52084e225 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(2017052603199); SRVR:SN4PR0901MB2174; x-ms-traffictypediagnostic: SN4PR0901MB2174: x-exchange-antispam-report-test: UriScan:(65766998875637)(138986009662008); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231020)(3002001)(100000703101)(100105400095)(10201501046)(6055026)(6041248)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123558100)(20161123560025)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:SN4PR0901MB2174; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:SN4PR0901MB2174; x-forefront-prvs: 04772EA191 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(346002)(376002)(39860400002)(189002)(377424004)(199003)(13464003)(189998001)(68736007)(4001150100001)(25786009)(5660300001)(106356001)(81156014)(2900100001)(305945005)(7736002)(81166006)(1730700003)(33656002)(3846002)(74316002)(8676002)(8936002)(6116002)(54906003)(316002)(102836003)(4326008)(7696004)(5250100002)(229853002)(39060400002)(2501003)(66066001)(15650500001)(6916009)(86362001)(561944003)(478600001)(97736004)(2950100002)(230783001)(50986999)(2906002)(6306002)(101416001)(55016002)(14454004)(6436002)(5640700003)(76176999)(9686003)(966005)(53546010)(54356999)(99286003)(3280700002)(105586002)(2473003)(2351001)(3660700001)(53936002)(6506006); DIR:OUT; SFP:1102; SCL:1; SRVR:SN4PR0901MB2174; H:SN4PR0901MB2176.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Oct 2017 17:29:04.2663 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR0901MB2174 Archived-At: Subject: [OPSEC] FW: New Version Notification for draft-sriram-opsec-urpf-improvements-02.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Oct 2017 17:29:30 -0000 SW4gdGhpcyBmcmVzaGx5IHVwbG9hZGVkIG5ldyB2ZXJzaW9uLA0KDQpodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtc3JpcmFtLW9wc2VjLXVycGYtaW1wcm92ZW1lbnRzLTAyICANCmh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0LXNyaXJhbS1vcHNlYy11cnBm LWltcHJvdmVtZW50cy0wMi50eHQgDQoNCnRoZSBmb2xsb3dpbmcgY2hhbmdlcyBhcmUgd29ydGgg bm90aW5nOg0KDQoxLiBKZWZmIEhhYXMgaGFzIGJlZW4gYWRkZWQgYXMgYSBjby1hdXRob3IuIA0K KFRoZSBvcmlnaW5hbCBhdXRob3JzIGhhZCBzZXZlcmFsIHZlcnkgaGVscGZ1bCBkaXNjdXNzaW9u IHdpdGggSmVmZiBhbmQgDQpyZWNlaXZlZCB2ZXJ5IHVzZWZ1bCBpbnB1dHMgZnJvbSBoaW0sIHBh cnRpY3VsYXJseSByZWdhcmRpbmcgaW1wbGVtZW50YXRpb24gY29uc2lkZXJhdGlvbnMuKQ0KDQoy LiBBdCB0aGUgT1BTRUMgV0cgbWVldGluZyBpbiBKdWx5IGluIFByYWd1ZSwgdGhlIHdlIGhhZCBh IGxpdmVseSBkaXNjdXNzaW9uIHJlZ2FyZGluZw0KYSBjaGFsbGVuZ2luZyBzY2VuYXJpbyBpbiB3 aGljaCB0aGUgb3JpZ2luYWwgcHJvcG9zYWwgd291bGQgbm90IHdvcmsuDQpUaGlzIHNjZW5hcmlv IGlzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDMuMy4NCg0KMy4gQWRkaW5nIGZ1cnRoZXIgZmxleGli aWxpdHkgdG8gdGhlIHByb3Bvc2VkIG1ldGhvZCBoYXMgdGhlIHBvdGVudGlhbCANCnRvIG92ZXJj b21lIHRoaXMgY2hhbGxlbmdlLiBTZWN0aW9uIDMuNCBkZXNjcmliZXMgdGhpcyBhZGRlZCBmbGV4 aWJpbGl0eSANCmFuZCB0aGUgbmV3IHJldmlzZWQgYWxnb3JpdGhtLiAgICANCg0KNC4gSW1wbGVt ZW50YXRpb24gY29uc2lkZXJhdGlvbnMsIGluY2x1ZGluZyBhbiBhbmFseXNpcyBvZiB0aGUgDQpG SUIgbWVtb3J5IHNpemUgcmVxdWlyZW1lbnRzLCBhcmUgcHJlc2VudGVkIGluIG1vcmUgZGV0YWls IGluIFNlY3Rpb24gMy41Lg0KDQpUaGFua3MgdG8gbWFueSBpbiB0aGUgT1BTRUMgYW5kIEdST1cg V0dzIGZvciBkaXNjdXNzaW9ucyBhbmQgY29uc3RydWN0aXZlIGNyaXRpY2lzbS4NCg0KU3JpcmFt IA0KICAgIA0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IGludGVybmV0LWRyYWZ0 c0BpZXRmLm9yZyBbbWFpbHRvOmludGVybmV0LWRyYWZ0c0BpZXRmLm9yZ10gDQpTZW50OiBNb25k YXksIE9jdG9iZXIgMzAsIDIwMTcgNTozNyBQTQ0KVG86IFNyaXJhbSwgS290aWthbGFwdWRpIChG ZWQpIDxrb3Rpa2FsYXB1ZGkuc3JpcmFtQG5pc3QuZ292PjsgTW9udGdvbWVyeSwgRG91Z2xhcyAo RmVkKSA8ZG91Z21AbmlzdC5nb3Y+OyBKZWZmcmV5IEhhYXMgPGpoYWFzQGp1bmlwZXIubmV0Pg0K U3ViamVjdDogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFmdC1zcmlyYW0tb3BzZWMt dXJwZi1pbXByb3ZlbWVudHMtMDIudHh0DQoNCg0KQSBuZXcgdmVyc2lvbiBvZiBJLUQsIGRyYWZ0 LXNyaXJhbS1vcHNlYy11cnBmLWltcHJvdmVtZW50cy0wMi50eHQNCmhhcyBiZWVuIHN1Y2Nlc3Nm dWxseSBzdWJtaXR0ZWQgYnkgS290aWthbGFwdWRpIFNyaXJhbSBhbmQgcG9zdGVkIHRvIHRoZSBJ RVRGIHJlcG9zaXRvcnkuDQoNCk5hbWU6CQlkcmFmdC1zcmlyYW0tb3BzZWMtdXJwZi1pbXByb3Zl bWVudHMNClJldmlzaW9uOgkwMg0KVGl0bGU6CQlFbmhhbmNlZCBGZWFzaWJsZS1QYXRoIFVuaWNh c3QgUmV2ZXJzZSBQYXRoIEZpbHRlcmluZw0KRG9jdW1lbnQgZGF0ZToJMjAxNy0xMC0zMA0KR3Jv dXA6CQlJbmRpdmlkdWFsIFN1Ym1pc3Npb24NClBhZ2VzOgkJMTQNCg0KaHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL2RyYWZ0LXNyaXJhbS1vcHNlYy11cnBmLWltcHJvdmVtZW50cy0wMiANCmh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0LXNyaXJhbS1vcHNlYy11cnBm LWltcHJvdmVtZW50cy0wMi50eHQgDQoNCkFic3RyYWN0Og0KICAgVGhpcyBkb2N1bWVudCBpZGVu dGlmaWVzIGEgbmVlZCBmb3IgaW1wcm92ZW1lbnQgb2YgdGhlIHVuaWNhc3QNCiAgIFJldmVyc2Ug UGF0aCBGaWx0ZXJpbmcgdGVjaG5pcXVlcyAodVJQRikgW0JDUDg0XSBmb3Igc291cmNlIGFkZHJl c3MNCiAgIHZhbGlkYXRpb24gKFNBVikgW0JDUDM4XS4gIFRoZSBzdHJpY3QgdVJQRiBpcyBpbmZs ZXhpYmxlIGFib3V0DQogICBkaXJlY3Rpb25hbGl0eSwgdGhlIGxvb3NlIHVSUEYgaXMgb2JsaXZp b3VzIHRvIGRpcmVjdGlvbmFsaXR5LCBhbmQNCiAgIHRoZSBjdXJyZW50IGZlYXNpYmxlLXBhdGgg dVJQRiBhdHRlbXB0cyB0byBzdHJpa2UgYSBiYWxhbmNlIGJldHdlZW4NCiAgIHRoZSB0d28gW0JD UDg0XS4gIEhvd2V2ZXIsIGFzIHNob3duIGluIHRoaXMgZHJhZnQsIHRoZSBleGlzdGluZw0KICAg ZmVhc2libGUtcGF0aCB1UlBGIHN0aWxsIGhhcyBzaG9ydCBjb21pbmdzLiAgVGhpcyBkb2N1bWVu dCBwcm9wb3Nlcw0KICAgYW4gZW5oYW5jZWQgZmVhc2libGUtcGF0aCB1UlBGIHRlY2huaXF1ZSwg d2hpY2ggYWltcyB0byBiZSBtb3JlDQogICBmbGV4aWJsZSAoaW4gYSBtZWFuaW5nZnVsIHdheSkg YWJvdXQgZGlyZWN0aW9uYWxpdHkgdGhhbiB0aGUNCiAgIGZlYXNpYmxlLXBhdGggdVJQRi4gIEl0 IGNhbiBwb3RlbnRpYWxseSBhbGxldmlhdGUgSVNQcycgY29uY2VybnMNCiAgIGFib3V0IHRoZSBw b3NzaWJpbGl0eSBvZiBkaXNydXB0aW5nIHNlcnZpY2UgZm9yIHRoZWlyIGN1c3RvbWVycywgYW5k DQogICBlbmNvdXJhZ2UgZ3JlYXRlciBkZXBsb3ltZW50IG9mIHVSUEYgdGVjaG5pcXVlcy4NCg0K From nobody Tue Oct 31 12:56:41 2017 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5D5713F61B; Tue, 31 Oct 2017 12:56:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G50amDqn9fUW; Tue, 31 Oct 2017 12:56:32 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 656DD13F5F3; Tue, 31 Oct 2017 12:56:32 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 0535CB80E50; Tue, 31 Oct 2017 12:56:24 -0700 (PDT) To: ktyers@gmail.com, fgont@si6networks.com, tim.chown@jisc.ac.uk X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: warren@kumari.net, iesg@ietf.org, opsec@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20171031195624.0535CB80E50@rfc-editor.org> Date: Tue, 31 Oct 2017 12:56:24 -0700 (PDT) Archived-At: Subject: [OPSEC] [Errata Verified] RFC7707 (5175) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Oct 2017 19:56:34 -0000 The following errata report has been verified for RFC7707, "Network Reconnaissance in IPv6 Networks". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5175 -------------------------------------- Status: Verified Type: Technical Reported by: Kevin Tyers Date Reported: 2017-10-30 Verified by: Warren Kumari (Ops AD) (IESG) Section: 5.1.4. Original Text ------------- the response would contain an RCODE of 0 (no error). Otherwise, the response would contain an RCODE of 4 (NXDOMAIN). Corrected Text -------------- the response would contain an RCODE of 0 (no error). Otherwise, the response would contain an RCODE of 3 (NXDOMAIN). Notes ----- In RFC1035 section 4.1.1. it states that an RCODE of 3 is 'Name Error' aka NXDOMAIN. RCODE 4 is "Not Implemented". RFC 7707 incorrectly refers to NXDOMAIN as RCODE 4 instead of RCODE 3. Here is the output of testing this in Wireshark: .... .... .... 0011 = Reply code: No such name (3) -------------------------------------- RFC7707 (draft-ietf-opsec-ipv6-host-scanning-08) -------------------------------------- Title : Network Reconnaissance in IPv6 Networks Publication Date : March 2016 Author(s) : F. Gont, T. Chown Category : INFORMATIONAL Source : Operational Security Capabilities for IP Network Infrastructure Area : Operations and Management Stream : IETF Verifying Party : IESG