From nobody Tue Sep 3 13:57:49 2019 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 933AC12084D; Tue, 3 Sep 2019 13:57:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.100.0 Auto-Submitted: auto-generated Precedence: bulk Cc: The IESG , draft-ietf-opsec-urpf-improvements@ietf.org, opsec-chairs@ietf.org, Sandra Murphy , opsec@ietf.org, sandy@tislabs.com, warren@kumari.net, rfc-editor@rfc-editor.org Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Message-ID: <156754425559.21098.18161411910915701683.idtracker@ietfa.amsl.com> Date: Tue, 03 Sep 2019 13:57:35 -0700 Archived-At: Subject: [OPSEC] Protocol Action: 'Enhanced Feasible-Path Unicast Reverse Path Forwarding' to Best Current Practice (draft-ietf-opsec-urpf-improvements-04.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Sep 2019 20:57:48 -0000 The IESG has approved the following document: - 'Enhanced Feasible-Path Unicast Reverse Path Forwarding' (draft-ietf-opsec-urpf-improvements-04.txt) as Best Current Practice This document is the product of the Operational Security Capabilities for IP Network Infrastructure Working Group. The IESG contact persons are Warren Kumari and Ignas Bagdonas. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-urpf-improvements/ Technical Summary This document identifies a need for improvement of the unicast Reverse Path Filtering techniques (uRPF) (see BCP 84) for detection and mitigation of source address spoofing (see BCP 38). The strict uRPF technique is inflexible about directionality, the loose uRPF technique is oblivious to directionality, and the current feasible-path uRPF technique attempts to strike a balance between the two (see BCP 84). However, as shown in this draft, the existing feasible-path uRPF technique still has shortcomings. This document describes an enhanced feasible-path uRPF technique, which aims to be more flexible (in a meaningful way) about directionality than the feasible-path uRPF technique. It can potentially alleviate ISPs' concerns about the possibility of disrupting service for their customers, and encourage greater deployment of uRPF techniques. Working Group Summary The document was discussed in GROW and in OPSEC, and adopted by OPSEC. Discussions in both working groups were incorporated into the document. Document Quality The shepherd sees no wg mail indicating that there are are current software implementations. However, the draft contains a section “Implementation Considerations” that points to the similarity to current uRPF techniques that query a VRF table, so existing implementation methods could be leveraged for this new technique. One wg comment explicitly said that the document was clear enough to “assist the operators to better implement the recommendations”. AD Note: Nits tool notes: The 'Updates: ' line in the draft header should list only the _numbers_ of the RFCs which will be updated by this document. I decided this is a nit, and not worth asking the authors to spin another copy for this. Other nits seem to be false positives. Personnel Document Shepherd: Sandra Murphy Responsible Area Director: Warren Kumari From nobody Sat Sep 21 00:09:26 2019 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 45EAB12001E; Sat, 21 Sep 2019 00:09:15 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.102.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: opsec@ietf.org Message-ID: <156904975523.23067.17396839114206805258@ietfa.amsl.com> Date: Sat, 21 Sep 2019 00:09:15 -0700 Archived-At: Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Sep 2019 07:09:15 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Eric Vyncke Kiran K. Chittimaneni Merike Kaeo Enno Rey Filename : draft-ietf-opsec-v6-18.txt Pages : 52 Date : 2019-09-21 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in several places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. Some very specific places of a network such as the Internet of Things are not discussed in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-18 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-18 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-18 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sat Sep 21 00:30:28 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1079012006F for ; Sat, 21 Sep 2019 00:30:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=lWzaNAmi; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=MbVPI+dv Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e-LAj7rpYjqu for ; Sat, 21 Sep 2019 00:30:24 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8AA412001E for ; Sat, 21 Sep 2019 00:30:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3832; q=dns/txt; s=iport; t=1569051023; x=1570260623; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=wUNmZeGOuSn0AQEkDmY0P484lYY2HxpE13prRjzvmXc=; b=lWzaNAmiubLow2BX8aJWQkEYSvf+iBAHzF63+zY5zPEWfFbON0fbHiRn HvzZVIDjIzxEbArISs9dMMR+Fysm2jw3GRxnvNGpQdeyEXWbiTxJ74s+b N6orqSxoXV+6m2pgDdYjxtDhtEJVFQU1Lg1F6hPILbcVpSF3cfMht7rtM c=; IronPort-PHdr: =?us-ascii?q?9a23=3AHcUYbBbYjhWnlXa3pnyvvpf/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20gebRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavncT08F8dPfFRk5Hq8d0NSHZW2ag=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CSAAAy0YVd/4kNJK1kHQEBBQEHBQG?= =?us-ascii?q?BUwgBCwGBSlADbVYgBAsqhCKDRwOEUoYkTZoDgS4UgRADVAkBAQEMAQEYCwo?= =?us-ascii?q?CAQGEPwIXgnIjNAkOAgMJAQEEAQEBAgEFBG2FLQELhUsCAQMBARAREQwBASw?= =?us-ascii?q?MDwIBCBoCERUCAgIlCxUQAgQTFA6DAAGBagMdAQIMngsCgTiIYXOBMoJ9AQE?= =?us-ascii?q?FgTcCDkFAgkYYghcJgQwoAYwIGIFAP4E4H4JMPoJhAQECAQEWgQJFFyiCTDK?= =?us-ascii?q?CJo9anTcKgiKHBY4FG4I2coZZjyWOGogTkQQCBAIEBQIOAQEFgVI4gUIOCHA?= =?us-ascii?q?VGiEqAYJBCUcQFIFOg3KFFIU/c4EpjWYBAQ?= X-IronPort-AV: E=Sophos;i="5.64,531,1559520000"; d="scan'208";a="631926774" Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Sep 2019 07:29:55 +0000 Received: from XCH-ALN-003.cisco.com (xch-aln-003.cisco.com [173.36.7.13]) by alln-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x8L7Ttu5024010 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Sat, 21 Sep 2019 07:29:56 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-ALN-003.cisco.com (173.36.7.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sat, 21 Sep 2019 02:29:55 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sat, 21 Sep 2019 02:29:54 -0500 Received: from NAM04-BN3-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Sat, 21 Sep 2019 02:29:55 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Hzynsm1kSE8KDIZT6WvWgxzFIAUI3ITgChFBPqB7DIQVTFGtU/goGH49I3b7HzzNGAAvPRBAAs1tP32vScNa7Zy2+kbN6adkPs60LykUYuKbPaKJVcEHAQVLjN8G8aht7hhIbRUOS5XO1YhXx1v60+8B6P5E15OOnghPvkiTGyRQKV8xQk4+Gv3ssKD4XfsSbuGxjYLBSnaA44gBHqZ9fdj/t+HmNF1FKVrjIy71U/ZWUfFBL+i0X9Pu3/bsgowzQLF4sxF/AOpIrZXxuf5Nzt+5a7PwPRWeSdjHBfDQfvERqlW4bjOQoB5kSkudastlQdEBr1o9ujwJn70jCOSxTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wUNmZeGOuSn0AQEkDmY0P484lYY2HxpE13prRjzvmXc=; b=d2E7heBZb/r3yIRmgFVDvYPd6pboAtQ4KCRPLMZd7Pj/EIUxt+vTQy18qGBgDFys2Lfsf7f3D8P1WBsG40lwbZgOW4qMVvC1eFn2dJDb93+lOvLen1o3oHOOZhD8b2U2mj1ddMqnjUbYIw2KsfdRSdiAC5K9R9rNsIS1vCnkIxQm/vXO0UocM2lu6L68Zs9ZXSUVmo25+TieG3OSXssTaPVkiOvW13ox3rusCKQYnUGRkru+Doss6kBoF5H4pB+sHtPM3S+E0C/tx4O/JMxbf4a5og+hbC6n7FzfWuUbas0s1zGjx7YA0hxJr2AJFFet8Wckhjh1R8YPZnI8aOQOoA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wUNmZeGOuSn0AQEkDmY0P484lYY2HxpE13prRjzvmXc=; b=MbVPI+dv0D3kKcBEvOKek60CCjptq4zj0pJboBEDdPQ5R/VERHCs1/IfqfcOc93367B5B+ed/od5y0ssL65dv4QtmyNAHgc2YL2tT9ArsXwdNdbhOB8aXV/O4f8McXfNrZNenSVInK4u/L/+5PaJsmiMavqx2a+eErqvONynCcc= Received: from MN2PR11MB4144.namprd11.prod.outlook.com (20.179.150.210) by MN2PR11MB4350.namprd11.prod.outlook.com (52.135.39.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2284.23; Sat, 21 Sep 2019 07:29:53 +0000 Received: from MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::a867:28ea:afa3:be5f]) by MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::a867:28ea:afa3:be5f%6]) with mapi id 15.20.2284.023; Sat, 21 Sep 2019 07:29:53 +0000 From: "Eric Vyncke (evyncke)" To: "opsec@ietf.org" Thread-Topic: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt Thread-Index: AQHVcEupDVHP+Q4xIEyFc7NlPKUMQqc13aYA Date: Sat, 21 Sep 2019 07:29:53 +0000 Message-ID: References: <156904975523.23067.17396839114206805258@ietfa.amsl.com> In-Reply-To: <156904975523.23067.17396839114206805258@ietfa.amsl.com> Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1d.0.190908 authentication-results: spf=none (sender IP is ) smtp.mailfrom=evyncke@cisco.com; x-originating-ip: [2001:420:c0c1:36:6c21:e3b9:41f7:9279] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5801b04c-5ae2-4bcf-99e8-08d73e657edb x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600167)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB4350; x-ms-traffictypediagnostic: MN2PR11MB4350: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0167DB5752 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(376002)(396003)(39860400002)(346002)(366004)(189003)(199004)(81166006)(6116002)(6916009)(186003)(1730700003)(81156014)(8676002)(58126008)(6506007)(446003)(11346002)(2616005)(486006)(6246003)(476003)(2351001)(305945005)(99286004)(46003)(102836004)(33656002)(7736002)(76176011)(8936002)(316002)(478600001)(229853002)(14454004)(5640700003)(66946007)(66476007)(6486002)(64756008)(5660300002)(66446008)(966005)(36756003)(76116006)(66556008)(14444005)(256004)(6436002)(91956017)(66574012)(2501003)(71190400001)(86362001)(71200400001)(6512007)(6306002)(25786009)(2906002); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4350; H:MN2PR11MB4144.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: z/hIGk3wpSLBpuebT/5L9AmXTKn69bMr3rcFGQ8qXD12SfLebCMyT3hXxBAT4HHxeik0LyjqpwagGOX+BmMJZAjuNsdmTRAFrJlznmYOwUJbR3890LDN0wd1fhU0FWUd5T3ldSHetQbhCC/Cig/M6jbskQKsNu+5kNZyeB3KME+sMV2rcwybXtS/FOWC2l0wxDWuYh82sIlHYDaJh9Ub+xd0Tw4iALMV1yDd4HCkW4oTQNJ3Cp6NI0jDg+V+lUjbLGkoe7UaQw4Vwd3q1Mz+14GfHLYW7ONtam93ztGcpxWLqdBrWXVQIWYvH9fs0hC9zeymDxIoOBWseJm+FwAakGXjFq5liZZXDu2ISc0rvMITwf+lwp+hwb3+mYUBKCclQUDUivrUH1tYKk3ixjULXigeostTfkAn/9WGw49tCZo= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 5801b04c-5ae2-4bcf-99e8-08d73e657edb X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Sep 2019 07:29:53.4276 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: vtpWxInsOyTLZ0Z4dMNnJ8Fr7KvH2w63I/Hazf7M5tbmFt7pZ4Fs+oM7NSjQgNqplrypcJUIk7F61+M8ipH38Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4350 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.13, xch-aln-003.cisco.com X-Outbound-Node: alln-core-4.cisco.com Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Sep 2019 07:30:26 -0000 V2l0aCB0aGlzIHJldmlzaW9uLCB0aGUgYXV0aG9ycyBoYXZlIHRha2VuIGludG8gYWNjb3VudCB0 aGUgdmVyeSBleHRlbnNpdmUgcmV2aWV3IGJ5IEplbiBMaW5rb3ZhIGFuZCBvdGhlciBwcmV2aW91 cyBjb21tZW50cyBmcm9tIERvbmFsZCBTbWl0aCwgSm9yZGkgUGFsZXQgYW5kIEJlcm5pZSBWb2x6 Lg0KDQpBcyBkaXNjdXNzZWQgYXQgSUVURi0xMDUsIHRoZSBhdXRob3JzIHdvdWxkIGxpa2UgdG8g c3RhcnQgYW5vdGhlciB3b3JraW5nIGdyb3VwIGxhc3QgY2FsbC4NCg0KTGV0J3MgZmluaXNoIHRo aXMgZG9jdW1lbnQgd2l0aCB0aGUgYXNzaXN0YW5jZSBvZiB0aGUgT1BTRUMgY29tbXVuaXR5DQoN ClJlZ2FyZHMNCg0KLcOpcmljIC1tZXJpa2UgLWtrIGFuZCAtZW5ubw0KDQrvu79PbiAyMS8wOS8y MDE5LCAwOToxMCwgIk9QU0VDIG9uIGJlaGFsZiBvZiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmci IDxvcHNlYy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBpbnRlcm5ldC1kcmFmdHNAaWV0 Zi5vcmc+IHdyb3RlOg0KDQogICAgDQogICAgQSBOZXcgSW50ZXJuZXQtRHJhZnQgaXMgYXZhaWxh YmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRpcmVjdG9yaWVzLg0KICAgIFRo aXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIE9wZXJhdGlvbmFsIFNlY3VyaXR5IENhcGFi aWxpdGllcyBmb3IgSVAgTmV0d29yayBJbmZyYXN0cnVjdHVyZSBXRyBvZiB0aGUgSUVURi4NCiAg ICANCiAgICAgICAgICAgIFRpdGxlICAgICAgICAgICA6IE9wZXJhdGlvbmFsIFNlY3VyaXR5IENv bnNpZGVyYXRpb25zIGZvciBJUHY2IE5ldHdvcmtzDQogICAgICAgICAgICBBdXRob3JzICAgICAg ICAgOiBFcmljIFZ5bmNrZQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS2lyYW4gSy4g Q2hpdHRpbWFuZW5pDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNZXJpa2UgS2Flbw0K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW5ubyBSZXkNCiAgICAJRmlsZW5hbWUgICAg ICAgIDogZHJhZnQtaWV0Zi1vcHNlYy12Ni0xOC50eHQNCiAgICAJUGFnZXMgICAgICAgICAgIDog NTINCiAgICAJRGF0ZSAgICAgICAgICAgIDogMjAxOS0wOS0yMQ0KICAgIA0KICAgIEFic3RyYWN0 Og0KICAgICAgIEtub3dsZWRnZSBhbmQgZXhwZXJpZW5jZSBvbiBob3cgdG8gb3BlcmF0ZSBJUHY0 IHNlY3VyZWx5IGlzDQogICAgICAgYXZhaWxhYmxlOiB3aGV0aGVyIGl0IGlzIHRoZSBJbnRlcm5l dCBvciBhbiBlbnRlcnByaXNlIGludGVybmFsDQogICAgICAgbmV0d29yay4gIEhvd2V2ZXIsIElQ djYgcHJlc2VudHMgc29tZSBuZXcgc2VjdXJpdHkgY2hhbGxlbmdlcy4gIFJGQw0KICAgICAgIDQ5 NDIgZGVzY3JpYmVzIHRoZSBzZWN1cml0eSBpc3N1ZXMgaW4gdGhlIHByb3RvY29sIGJ1dCBuZXR3 b3JrDQogICAgICAgbWFuYWdlcnMgYWxzbyBuZWVkIGEgbW9yZSBwcmFjdGljYWwsIG9wZXJhdGlv bnMtbWluZGVkIGRvY3VtZW50IHRvDQogICAgICAgZW51bWVyYXRlIGFkdmFudGFnZXMgYW5kL29y IGRpc2FkdmFudGFnZXMgb2YgY2VydGFpbiBjaG9pY2VzLg0KICAgIA0KICAgICAgIFRoaXMgZG9j dW1lbnQgYW5hbHl6ZXMgdGhlIG9wZXJhdGlvbmFsIHNlY3VyaXR5IGlzc3VlcyBpbiBzZXZlcmFs DQogICAgICAgcGxhY2VzIG9mIGEgbmV0d29yayAoZW50ZXJwcmlzZXMsIHNlcnZpY2UgcHJvdmlk ZXJzIGFuZCByZXNpZGVudGlhbA0KICAgICAgIHVzZXJzKSBhbmQgcHJvcG9zZXMgdGVjaG5pY2Fs IGFuZCBwcm9jZWR1cmFsIG1pdGlnYXRpb25zIHRlY2huaXF1ZXMuDQogICAgICAgU29tZSB2ZXJ5 IHNwZWNpZmljIHBsYWNlcyBvZiBhIG5ldHdvcmsgc3VjaCBhcyB0aGUgSW50ZXJuZXQgb2YgVGhp bmdzDQogICAgICAgYXJlIG5vdCBkaXNjdXNzZWQgaW4gdGhpcyBkb2N1bWVudC4NCiAgICANCiAg ICANCiAgICBUaGUgSUVURiBkYXRhdHJhY2tlciBzdGF0dXMgcGFnZSBmb3IgdGhpcyBkcmFmdCBp czoNCiAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLW9wc2Vj LXY2Lw0KICAgIA0KICAgIFRoZXJlIGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25zIGF2YWlsYWJs ZSBhdDoNCiAgICBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1vcHNlYy12 Ni0xOA0KICAgIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaWV0 Zi1vcHNlYy12Ni0xOA0KICAgIA0KICAgIEEgZGlmZiBmcm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9u IGlzIGF2YWlsYWJsZSBhdDoNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9 ZHJhZnQtaWV0Zi1vcHNlYy12Ni0xOA0KICAgIA0KICAgIA0KICAgIFBsZWFzZSBub3RlIHRoYXQg aXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1pc3Np b24NCiAgICB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxl IGF0IHRvb2xzLmlldGYub3JnLg0KICAgIA0KICAgIEludGVybmV0LURyYWZ0cyBhcmUgYWxzbyBh dmFpbGFibGUgYnkgYW5vbnltb3VzIEZUUCBhdDoNCiAgICBmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50 ZXJuZXQtZHJhZnRzLw0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQogICAgT1BTRUMgbWFpbGluZyBsaXN0DQogICAgT1BTRUNAaWV0Zi5v cmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL29wc2VjDQogICAg DQoNCg== From nobody Sat Sep 21 14:13:35 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30E4F12010F for ; Sat, 21 Sep 2019 14:13:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yfNoMb0pB8eP for ; Sat, 21 Sep 2019 14:13:32 -0700 (PDT) Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A359D1200F8 for ; Sat, 21 Sep 2019 14:13:32 -0700 (PDT) Received: by mail-pg1-x532.google.com with SMTP id w10so5746681pgj.7 for ; Sat, 21 Sep 2019 14:13:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=1BIiTMszu7hsDox3slPFkdH2Gm8554zEPxV8QLhD0jw=; b=XqfsiADEP7KP0qN3n3XUMo/cSqx3QQNUHOY5OekFBxC2oh6kdtwkpMeqsVfSc2dp5h NEmKs/3OHgIqZeh80ns3YQ+AOAG/BBaobOcJks3y38jpDttULwd7Rq3LcX9QZctqDz9H EYtxKQMHtU02+6gMW1GqvRjfRIqeoa1E+ovb9EvK8IHAgo5smbkvTQpRTIPCTlyochQl MyYkkO/staXnpWU3LQkT+r7vOzNRaz37DbkFlftWT2SHjumyrIwC+QI98TV1D2+9Vg9H 9FKhIP4iSF8xXeZOnDPIyoWvXI8jbHMc5QYG3PA+tkd06ZLKKxMZaoSjno3XFBPfZU+p LnjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=1BIiTMszu7hsDox3slPFkdH2Gm8554zEPxV8QLhD0jw=; b=hdO9hHwL1hK3IrifWhtta1EwrjrfkBZHv5dq8i3im0mUlwI1082WPIvOsFL0elmeca KouWgWMXeAZPEx6qKAwcA2+RwzfJWinrhLarX+nkS4oXVaE+Ih/6c0BHJGcnlr7w6nNd stqjzZ80ZHcbUR4+YEt0ScEzLrk93OwGJ73x59ZA9v/+ILhXWMn/dsTDM4qzipDQV1UX DnhPwRh426HsKJIWnYIKHHvSsvOWFaNXxnKIH8SkaNdifE0L/WHLYieyYZM0WhdIqfUO nwFuRZOpclvrxHxFaXiOCuKjJAH8HGFyNtHhSF5yJVx5hfD1RDUy8nHe8ZF2Uvs5cPtk LY3w== X-Gm-Message-State: APjAAAXhNxH091+31RwVql8m2AbjXPjh1U8BdLuL0u+WLkUgN4OvFJTY Pi/3/DBQgKsSCslSopwRQkqsRqTt X-Google-Smtp-Source: APXvYqwBdmEnn8eQwn7PQ4U/l5g10ceCAl3VLOuXe79fZMaEOImtJe6znhgy7+B6t5hQ0wOxP24I/Q== X-Received: by 2002:aa7:8d85:: with SMTP id i5mr19706719pfr.89.1569100411839; Sat, 21 Sep 2019 14:13:31 -0700 (PDT) Received: from [192.168.178.30] (82.206.69.111.dynamic.snap.net.nz. [111.69.206.82]) by smtp.gmail.com with ESMTPSA id 127sm7767339pfc.115.2019.09.21.14.13.29 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 21 Sep 2019 14:13:30 -0700 (PDT) To: opsec@ietf.org References: <156904975523.23067.17396839114206805258@ietfa.amsl.com> From: Brian E Carpenter Message-ID: Date: Sun, 22 Sep 2019 09:13:29 +1200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <156904975523.23067.17396839114206805258@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Sep 2019 21:13:34 -0000 Hi, I think the ULA section is still not quite right. > 2.1.1. Use of ULAs > > Unique Local Addresses (ULAs) [RFC4193] are intended for scenarios > where systems are not globally reachable, despite formally having > global scope. ULA are not similar to [RFC1918] addresses and have > different use cases. One use of ULA is described in [RFC4864] and > some considerations on using ULA is described in the draft document > [I-D.ietf-v6ops-ula-usage-considerations]; this document failed to > have the IETF consensus and is now considered as dead. 1. I think it is worth mentioning that ULAs should be filtered at domain boundaries. 2. Actually they are *similar* to RFC1918 - but they are not the same. 3. I don't think there is any use in referencing a draft that you describe as "dead". So, a possible rewrite: 2.1.1. Use of ULAs Unique Local Addresses (ULAs) [RFC4193] are intended for scenarios where interfaces are not globally reachable, despite being routed within a domain. They formally have global scope, but RFC 4193 sepcifies that they must be filtered out at domain boundaries. ULAs are different from [RFC1918] addresses and have different use cases. One use case is described in [RFC4864]. Regards Brian Carpenter From nobody Sun Sep 22 05:16:32 2019 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C6CE9120026; Sun, 22 Sep 2019 05:16:23 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.102.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: opsec@ietf.org Message-ID: <156915458373.1303.9464019932890678481@ietfa.amsl.com> Date: Sun, 22 Sep 2019 05:16:23 -0700 Archived-At: Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-19.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Sep 2019 12:16:24 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Eric Vyncke Kiran K. Chittimaneni Merike Kaeo Enno Rey Filename : draft-ietf-opsec-v6-19.txt Pages : 52 Date : 2019-09-22 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in several places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. Some very specific places of a network such as the Internet of Things are not discussed in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-19 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-19 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-19 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Sep 22 05:20:33 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEA501200A1 for ; Sun, 22 Sep 2019 05:20:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=FvEzpdop; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=nq8owuWO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OhztHEryJTMA for ; Sun, 22 Sep 2019 05:20:29 -0700 (PDT) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78193120026 for ; Sun, 22 Sep 2019 05:20:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2530; q=dns/txt; s=iport; t=1569154829; x=1570364429; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=R+K2W7wsYsha5KfogfDIi5lhXkkxgPimsttTU6n/vBk=; b=FvEzpdop91ZiKWCik0xbWgdua1jHj+1eUrMGib0jxsehjPkReHI2/4uY ekAx8xdhxtyjVLlLwrtshFEX9wmFXDyqDsgaKqNj0aBLbx0tPGDBRnCPC 9WK5VwBN1vMHEVT0po9pgO/vTIhhmrlYnvBIdTzztSiSzb+NB4j9CkgL9 M=; IronPort-PHdr: =?us-ascii?q?9a23=3AQb/eMxS1OY1sdL0qLP6A6AcOu9psv++ubAcI9p?= =?us-ascii?q?oqja5Pea2//pPkeVbS/uhpkESXBdfA8/wRje3QvuigQmEG7Zub+FE6OJ1XH1?= =?us-ascii?q?5g640NmhA4RsuMCEn1NvnvOiEkDcJJV1JN9HCgOk8TE8H7NBXf?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ArAACtZodd/49dJa1lGwEBAQEDAQE?= =?us-ascii?q?BDAMBAQGBUwYBAQELAYFKUANtViAECyqEIoNHA4RShiRNgg+JZ44NgS6BJAN?= =?us-ascii?q?UCQEBAQwBARgLCgIBAYQ/AheCciM0CQ4CAwkBAQQBAQECAQUEbYUtDIVLAQE?= =?us-ascii?q?BAgEBARAREQwBASwMDwIBCBoCJgICAh8GCxUQAgQBEiKDAAGBagMODwECDJ1?= =?us-ascii?q?6AoE4iGFzgTKCfQEBBYJIgkUNC4IXAwaBDCgBjAgYgUA/gTgfgkw+ghpHAQG?= =?us-ascii?q?BYReCdDKCJoxrgm+HXpUXQQqCIpEJhAEbmSWOGoobjnoCBAIEBQIOAQEFgVI?= =?us-ascii?q?4gVhwFTsqAYJBUBAUgU6DcoUUhT9zAYEojj0BAQ?= X-IronPort-AV: E=Sophos;i="5.64,536,1559520000"; d="scan'208";a="336934710" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 22 Sep 2019 12:20:28 +0000 Received: from XCH-RCD-020.cisco.com (xch-rcd-020.cisco.com [173.37.102.30]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id x8MCKS6L027659 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 22 Sep 2019 12:20:28 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-RCD-020.cisco.com (173.37.102.30) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sun, 22 Sep 2019 07:20:27 -0500 Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sun, 22 Sep 2019 07:05:22 -0500 Received: from NAM04-SN1-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Sun, 22 Sep 2019 07:05:22 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Ac7EDlg+wer0Ay+mA7McPqN3YflJniQ/+NsgUhiI2chyUg7h7kyVsR3mqtJMXea/ngrDJ/QhGGssA+QZb2zaMbbK17Q3GrfpzjFs5MIkIkW1FVDCp398rpm5E+oW96GFnZKKahfAGouw4UCgokknScSo53JHZc/IZna/vM4N++igQ8kuVaQoREWVI0iGiHongSf59Eo21G/TC+9JjW856vwFbrZkTtWr0NL9ZOlaSGafUySJgqkrTKmqcL6faEtoh9HAcof7wzM3ziy9EXXGnXhJoBtCmGuteFAFkvVymarcVA8MrVWcj8ACeQlTWYMQnPETprG4UYyU95QhTAe0WQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=R+K2W7wsYsha5KfogfDIi5lhXkkxgPimsttTU6n/vBk=; b=mO4OgPu6zTofR52uXF5qpcvrpixOaKoaRhyT4KGlRJzKHJJC53VGxfGIARba/FqKuBxZg7Xk3z9KbT407ukkEkARnayGsKNcNBb8394Uvk/yIeZqnxau6+H3Jj1mt1ilqA5DlsXQdwLGvV4NEw0NP6KMbnT4EzwrbD74+KrIgNqCxEM4CbwvPoCvU+r2b9rSKLstJhyvp060D2dmn3okDRhEuO1XL/vj/cS1xa0+p4hER+DZbH8JljbMHI9Mwugu0jAfJnFGXVmJbWf1BJThT8gN5v6lEe3yeanlkwcNf2sc1DUcrCp33aNBLdFPwgyKL7xgdj2FhovUIOuk/77BLQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=R+K2W7wsYsha5KfogfDIi5lhXkkxgPimsttTU6n/vBk=; b=nq8owuWOkJo8bUEGiv1ekZXL1SJPW7EwcMORDJUuxigSgQpDQm7Elq3DBecUfPB3/vwHKgOomD2Nm8EbjZw6grCVh2KPTM66geWFiQOH9aR7etug2+lqii5FpsioqBwi7tBp0wHrdX9l6Q4atnFH4q5LjWoUhdqDzAFKwXGKN+c= Received: from MN2PR11MB4144.namprd11.prod.outlook.com (20.179.150.210) by MN2PR11MB4447.namprd11.prod.outlook.com (52.135.39.217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2284.23; Sun, 22 Sep 2019 12:05:21 +0000 Received: from MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::a867:28ea:afa3:be5f]) by MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::a867:28ea:afa3:be5f%6]) with mapi id 15.20.2284.023; Sun, 22 Sep 2019 12:05:20 +0000 From: "Eric Vyncke (evyncke)" To: Brian E Carpenter , "opsec@ietf.org" Thread-Topic: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt Thread-Index: AQHVcMFqDVHP+Q4xIEyFc7NlPKUMQqc3vAYA Date: Sun, 22 Sep 2019 12:05:20 +0000 Message-ID: <803DA885-0CB1-45E9-B784-EB051EF30158@cisco.com> References: <156904975523.23067.17396839114206805258@ietfa.amsl.com> In-Reply-To: Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1d.0.190908 authentication-results: spf=none (sender IP is ) smtp.mailfrom=evyncke@cisco.com; x-originating-ip: [2001:420:c0c1:36:79a9:7e13:dfc6:a10f] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fdb5ceb3-0c1b-42ba-38bf-08d73f552442 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600167)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB4447; x-ms-traffictypediagnostic: MN2PR11MB4447: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 016885DD9B x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(346002)(376002)(366004)(136003)(189003)(199004)(86362001)(966005)(2616005)(6512007)(6306002)(6246003)(256004)(7736002)(305945005)(66946007)(99286004)(66476007)(71200400001)(46003)(66556008)(6506007)(66446008)(71190400001)(91956017)(64756008)(76116006)(446003)(478600001)(6116002)(11346002)(476003)(186003)(14454004)(102836004)(76176011)(486006)(316002)(2906002)(8676002)(6486002)(2501003)(25786009)(229853002)(36756003)(81156014)(81166006)(58126008)(110136005)(8936002)(33656002)(6436002)(5660300002); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4447; H:MN2PR11MB4144.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: PqXZchlcSb4FcgtYQ+qzai4wzspvB+CFPIeQQgCk9fsbzwrSHZ2u9g6eQ8g3v8U60PNA4p+58N6i9RM5ynXyXZfbmjOhctSkBVtaEuSreepWPsCnWFuLeysTZBmA3Kx1BH2MALp+xKQNe4pNA3L9S2MQvA/LV1GP4AcI82RwibwJlNH6FfshRMtJkdsrU48IX4b6peet465cwCZ9VwxILDNsqnleUHTRE/R+kO51WZpbi1h9dxihyCYw/O59GPJ2jYJjCGagS1pyoZgQ0xzfYwjTXkj4EeD3HmAB0qW34u6NGJ0pk6HOnYEVGjtTIZpOpBxG10Nl8Jp4lyP4V/yHRW7xSfdF1VJdTf+UNoozTQR6PRnSgzLviO6c1NkbHwA7CWIfOUSH17ufUo/MMLm/z+QtBhF+v+biU7DLbxWTFRY= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <787CA0202C24824A9A3C13DF2220834E@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: fdb5ceb3-0c1b-42ba-38bf-08d73f552442 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Sep 2019 12:05:20.7045 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 4I6w9M1wWh2mvDzqEP8l3Dh9yGwiK813UaNrVaAHYBBytrfyU761Ck1nkcQrdGIe4RZ34l+YOfhNRAPX7gVXqA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4447 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.30, xch-rcd-020.cisco.com X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Sep 2019 12:20:32 -0000 QnJpYW4sDQoNClRoYW5rIHlvdSBmb3IgdGhlIGltcHJvdmVkIHRleHQuIA0KDQpFeHBlY3QgYSAt MTkgYW55IHRpbWUgc29vbg0KDQotw6lyaWMNCg0K77u/T24gMjEvMDkvMjAxOSwgMjM6MTQsICJP UFNFQyBvbiBiZWhhbGYgb2YgQnJpYW4gRSBDYXJwZW50ZXIiIDxvcHNlYy1ib3VuY2VzQGlldGYu b3JnIG9uIGJlaGFsZiBvZiBicmlhbi5lLmNhcnBlbnRlckBnbWFpbC5jb20+IHdyb3RlOg0KDQog ICAgSGksDQogICAgDQogICAgSSB0aGluayB0aGUgVUxBIHNlY3Rpb24gaXMgc3RpbGwgbm90IHF1 aXRlIHJpZ2h0Lg0KICAgIA0KICAgID4gMi4xLjEuICBVc2Ugb2YgVUxBcw0KICAgID4gDQogICAg PiAgICBVbmlxdWUgTG9jYWwgQWRkcmVzc2VzIChVTEFzKSBbUkZDNDE5M10gYXJlIGludGVuZGVk IGZvciBzY2VuYXJpb3MNCiAgICA+ICAgIHdoZXJlIHN5c3RlbXMgYXJlIG5vdCBnbG9iYWxseSBy ZWFjaGFibGUsIGRlc3BpdGUgZm9ybWFsbHkgaGF2aW5nDQogICAgPiAgICBnbG9iYWwgc2NvcGUu ICBVTEEgYXJlIG5vdCBzaW1pbGFyIHRvIFtSRkMxOTE4XSBhZGRyZXNzZXMgYW5kIGhhdmUNCiAg ICA+ICAgIGRpZmZlcmVudCB1c2UgY2FzZXMuICBPbmUgdXNlIG9mIFVMQSBpcyBkZXNjcmliZWQg aW4gW1JGQzQ4NjRdIGFuZA0KICAgID4gICAgc29tZSBjb25zaWRlcmF0aW9ucyBvbiB1c2luZyBV TEEgaXMgZGVzY3JpYmVkIGluIHRoZSBkcmFmdCBkb2N1bWVudA0KICAgID4gICAgW0ktRC5pZXRm LXY2b3BzLXVsYS11c2FnZS1jb25zaWRlcmF0aW9uc107IHRoaXMgZG9jdW1lbnQgZmFpbGVkIHRv DQogICAgPiAgICBoYXZlIHRoZSBJRVRGIGNvbnNlbnN1cyBhbmQgaXMgbm93IGNvbnNpZGVyZWQg YXMgZGVhZC4NCiAgICANCiAgICAxLiBJIHRoaW5rIGl0IGlzIHdvcnRoIG1lbnRpb25pbmcgdGhh dCBVTEFzIHNob3VsZCBiZSBmaWx0ZXJlZCBhdCBkb21haW4NCiAgICBib3VuZGFyaWVzLg0KICAg IA0KICAgIDIuIEFjdHVhbGx5IHRoZXkgYXJlICpzaW1pbGFyKiB0byBSRkMxOTE4IC0gYnV0IHRo ZXkgYXJlIG5vdCB0aGUgc2FtZS4NCiAgICANCiAgICAzLiBJIGRvbid0IHRoaW5rIHRoZXJlIGlz IGFueSB1c2UgaW4gcmVmZXJlbmNpbmcgYSBkcmFmdCB0aGF0IHlvdSBkZXNjcmliZQ0KICAgIGFz ICJkZWFkIi4NCiAgICANCiAgICBTbywgYSBwb3NzaWJsZSByZXdyaXRlOg0KICAgIA0KICAgIDIu MS4xLiAgVXNlIG9mIFVMQXMNCiAgICANCiAgICAgICBVbmlxdWUgTG9jYWwgQWRkcmVzc2VzIChV TEFzKSBbUkZDNDE5M10gYXJlIGludGVuZGVkIGZvciBzY2VuYXJpb3MNCiAgICAgICB3aGVyZSBp bnRlcmZhY2VzIGFyZSBub3QgZ2xvYmFsbHkgcmVhY2hhYmxlLCBkZXNwaXRlIGJlaW5nIHJvdXRl ZA0KICAgICAgIHdpdGhpbiBhIGRvbWFpbi4gVGhleSBmb3JtYWxseSBoYXZlIGdsb2JhbCBzY29w ZSwgYnV0IFJGQyA0MTkzDQogICAgICAgc2VwY2lmaWVzIHRoYXQgdGhleSBtdXN0IGJlIGZpbHRl cmVkIG91dCBhdCBkb21haW4gYm91bmRhcmllcy4NCiAgICAgICBVTEFzIGFyZSBkaWZmZXJlbnQg ZnJvbSBbUkZDMTkxOF0gYWRkcmVzc2VzIGFuZCBoYXZlIGRpZmZlcmVudCB1c2UNCiAgICAgICBj YXNlcy4gT25lIHVzZSBjYXNlIGlzIGRlc2NyaWJlZCBpbiBbUkZDNDg2NF0uDQogICAgDQogICAg UmVnYXJkcw0KICAgICAgIEJyaWFuIENhcnBlbnRlcg0KICAgIA0KICAgIF9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgT1BTRUMgbWFpbGluZyBsaXN0 DQogICAgT1BTRUNAaWV0Zi5vcmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL29wc2VjDQogICAgDQoNCg== From nobody Sun Sep 22 08:12:58 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F83C1201AA for ; Sun, 22 Sep 2019 08:12:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T5MgwerUd5p2 for ; Sun, 22 Sep 2019 08:12:54 -0700 (PDT) Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EED1D120112 for ; Sun, 22 Sep 2019 08:12:53 -0700 (PDT) Received: by mail-wr1-x42d.google.com with SMTP id v8so11284215wrt.2 for ; Sun, 22 Sep 2019 08:12:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=/lTACDUbl4lhQDW8LAHM4bz6afBxGLICKd+hE8JDHGI=; b=ZLVIy8Rgacx3mtlPv4TbmSu6mXYFZJvg6hDR3TymPnf2QTQhJHZb0Ahn4C4/5ccJw7 0s9aH4wouPaH1YT70F/tIEa2+zvybv5vhKm8c9/r8bjXQ9dcnK0gY34AxImmfNE99SY0 mm72URSN0/Shfx7DVUMNu8XcZdimuPPnD8qyZP7l4R4Dw/y0W7tPMe7msOqvuGFrJZWq i/ZZd3Uvb7OIrb9C40Er1jhtktK7K2t/EmdjejftUDKIeXUE07P8ocsiZM7IgAZNPRsf Djm1b9O0a3IsRr/I2vfYjXLyFWZ7Yrpx2mBGP0dKbxZuwd52uv5Qnn06114+UWAkJMUE vJfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=/lTACDUbl4lhQDW8LAHM4bz6afBxGLICKd+hE8JDHGI=; b=WX/M8gFl4gO9QF/IbThmgqubx+9uHlUjhbPUrOPWldVmi6gkKMlQO4asuQLHtY4eWC TiNuGHLDGc1SPvHmM90sxKAiw39S2NLyX5rPaADCkXMFqH8ZhfoRSz6i5dbI7Va88y/m bHWZaSwlfjAqT1WEHa/38NizD0McgV5nPWo3CTpRTgmZsWipl+cGNmFjjXzvVuZZngvX CLA4QMdbAc2b5liInv3Os6yE5uizNROeSQVnLl4d/1YXWpCnmSn0Z86F5oT69ZOOXm7c yw+EsurEXTc5e7dYJGqtBJCj87+4TUcdwmmlA/GI1/+nm0gxqUpy8mpYI8NlgonRUYol bilw== X-Gm-Message-State: APjAAAXqOZiw+F/nEYOiMhErISxdZuRq0TIpm4xIqpTOmhhzWF0BJbQ9 5gfgSAtMXw9bGSh5M1hGShc= X-Google-Smtp-Source: APXvYqx09I5BQCNUWl1Vd5Lp6hZUdoN/uzGXyNvIlb+C4FaioYxivhleKRxJ4f1oiRA3ltT9k0rVLw== X-Received: by 2002:a5d:4044:: with SMTP id w4mr19630349wrp.281.1569165172432; Sun, 22 Sep 2019 08:12:52 -0700 (PDT) Received: from ?IPv6:2601:647:5a00:ef0b:e528:d569:df88:7c1b? ([2601:647:5a00:ef0b:e528:d569:df88:7c1b]) by smtp.gmail.com with ESMTPSA id d193sm11093548wmd.0.2019.09.22.08.12.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 22 Sep 2019 08:12:51 -0700 (PDT) From: Bob Hinden Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_0C7AAB03-FE47-4B92-91C6-2EB8F24EA343"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sun, 22 Sep 2019 08:12:48 -0700 In-Reply-To: <803DA885-0CB1-45E9-B784-EB051EF30158@cisco.com> Cc: Bob Hinden , Brian Carpenter , "opsec@ietf.org" To: "Eric Vyncke (evyncke)" References: <156904975523.23067.17396839114206805258@ietfa.amsl.com> <803DA885-0CB1-45E9-B784-EB051EF30158@cisco.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Sep 2019 15:12:57 -0000 --Apple-Mail=_0C7AAB03-FE47-4B92-91C6-2EB8F24EA343 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Eric, I support Brian=E2=80=99s proposed changes. Bob > On Sep 22, 2019, at 5:05 AM, Eric Vyncke (evyncke) = wrote: >=20 > Brian, >=20 > Thank you for the improved text. >=20 > Expect a -19 any time soon >=20 > -=C3=A9ric >=20 > =EF=BB=BFOn 21/09/2019, 23:14, "OPSEC on behalf of Brian E Carpenter" = wrote: >=20 > Hi, >=20 > I think the ULA section is still not quite right. >=20 >> 2.1.1. Use of ULAs >>=20 >> Unique Local Addresses (ULAs) [RFC4193] are intended for scenarios >> where systems are not globally reachable, despite formally having >> global scope. ULA are not similar to [RFC1918] addresses and have >> different use cases. One use of ULA is described in [RFC4864] and >> some considerations on using ULA is described in the draft document >> [I-D.ietf-v6ops-ula-usage-considerations]; this document failed to >> have the IETF consensus and is now considered as dead. >=20 > 1. I think it is worth mentioning that ULAs should be filtered at = domain > boundaries. >=20 > 2. Actually they are *similar* to RFC1918 - but they are not the = same. >=20 > 3. I don't think there is any use in referencing a draft that you = describe > as "dead". >=20 > So, a possible rewrite: >=20 > 2.1.1. Use of ULAs >=20 > Unique Local Addresses (ULAs) [RFC4193] are intended for = scenarios > where interfaces are not globally reachable, despite being = routed > within a domain. They formally have global scope, but RFC 4193 > sepcifies that they must be filtered out at domain boundaries. > ULAs are different from [RFC1918] addresses and have different = use > cases. One use case is described in [RFC4864]. >=20 > Regards > Brian Carpenter >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec >=20 >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec --Apple-Mail=_0C7AAB03-FE47-4B92-91C6-2EB8F24EA343 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEm0rfRsOCoyamPexGrut0EXfnu6gFAl2Hj3AACgkQrut0EXfn u6jkSwf/WG3vSfu9a+RDJha2cDjo34NIaXxrVOQ7lFV54kQqvTuq8rNiy9dotUKZ bxVmMWoodhZzyK2bzalvP+GtUmgGUTUeHIDq4sWMuixmCNbJg19+U7jp1QlXvu+0 5us5QLisM/slQNXJR4FS4CWi5HQUQ7wnEIx9rLZ5IZ2jG46wkiDvVU7x7ar6PC/F uApkzzDHVunyXRnAIQ2xTRu9WUO7l8kKEHLS5Peqtt67pHYlt+BhpSBafBMkFlw6 eNmYMfQuJ45+vQ0weyfCRoFeh7aXPuWoZ82mDvbbXpDZsBctu/cpS6DafTQuv4aE jgWB7zU8w5eorBGrNwBCra4QqoaAAQ== =A7Nj -----END PGP SIGNATURE----- --Apple-Mail=_0C7AAB03-FE47-4B92-91C6-2EB8F24EA343-- From nobody Mon Sep 23 16:55:30 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F114C120089; Mon, 23 Sep 2019 16:55:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OxHfBmiw85jv; Mon, 23 Sep 2019 16:55:26 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF9B6120047; Mon, 23 Sep 2019 16:55:26 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id y189so17418155qkc.3; Mon, 23 Sep 2019 16:55:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=g7jfrdNkOAV51BtTq/9l5LN0uU2IQj2L5klgAaNIeGc=; b=N/MTWQhcgjLkSi2E5uMfCzNKOg8GfEs5Qk/KMHVIqyQJd+xYPBOb1bHNRY7RbIt3Nu PiRNUyQZrJcUGcJ6xp2RSuvghNhv2zCHb2WkBaNsLSWaZN4u1H9gEU78ZZwtdHhs7RHC 76FRgfSY3ms2LCsCYorDxwr0hOH6NmHSiw8ehr8/q85iqUP5hr10w9ngINio3h5d0erX +6g45IrQYOb8RewjOrn1ko5WxdXr6cz5SWaUUfNMHqTlaqcDJOGj7a8Z+EDxgKDyBytE sIHP4ZDAExn+dAge4pPrm6DpU6tRIvjbwsKQB27Swp2zkWUrBr/iXKY2J0KJwZzqG8ZF IMbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=g7jfrdNkOAV51BtTq/9l5LN0uU2IQj2L5klgAaNIeGc=; b=m6vnBs8wqxXaM0nAnsg19CgCAcAwv2DPNVNI0Ay/raDLgcOOoswmMeHbIRHhSh0TdE 4Qmr/n+/GAlq3yh8/gA4ljNgpLqIcniSsSVkteIXXgAc+W90smDMu+Tsim/afEtxu2m6 4bkMRyIkeaHcOOL8ew9vmkE63Q8cLoF4VF8DomAul8e76RIu2fV/KaaxcSz2Eq2NDqPf euM22ZatCIxCYlGprC9/Vh1GgOVWK0cAF/6lqdVEwQKfBtNL3E4MzCT9YnlbdRCHexXk rLGZgKYQadNNZjEZXC47lN6GfPf+UPlkdg/mpUpYGbCt6YF108HPP5F5Sm9tAKCD6U3X Id0w== X-Gm-Message-State: APjAAAUv5HS+yKxliTPLmN//DgiOHXcEddtgNzfwzEpdoeSrCGuknWhS hkW/T0ZgUsQB3pDx6P2rjQ5JPpn4+5LOAqe/sMnr087j X-Google-Smtp-Source: APXvYqxGentP1b+LcP32rl2EFY1gyycpZKvgH+0JSiPDa0wtvAbohR7pBtPqNd1FJpYCFW4m2tdzwUUHcdCZWM7Y67Y= X-Received: by 2002:ae9:ee0d:: with SMTP id i13mr518180qkg.417.1569282925381; Mon, 23 Sep 2019 16:55:25 -0700 (PDT) MIME-Version: 1.0 From: Jen Linkova Date: Tue, 24 Sep 2019 09:55:14 +1000 Message-ID: To: opsec WG Cc: OpSec Chairs , draft-ietf-opsec-v6@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [OPSEC] WGLC for draft-ietf-opsec-v6-19 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Sep 2019 23:55:28 -0000 Hello, This message starts a Working Group Last Call for draft-ietf-opsec-v6-19 (https://tools.ietf.org/html/draft-ietf-opsec-v6-19) Please review the draft respond to this email to support the document and/or send comments by 23:59 UTC on Fri, Oct 11th 2019. Thanks! -- SY, Jen Linkova aka Furry From nobody Mon Sep 23 21:25:29 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF2A91200F4; Mon, 23 Sep 2019 21:25:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iH8r3a4uDaLP; Mon, 23 Sep 2019 21:25:25 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E48E71200F6; Mon, 23 Sep 2019 21:25:24 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id q1so1155604ion.1; Mon, 23 Sep 2019 21:25:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=98uhWg1YByFdrNqBMrlewF7TID6zjOb0KYY/q5qfs+E=; b=ibJBP4VPTIqX36DT3kGTHyJb+oLuCO4KTYmshWz8MERYM8DoimamalJ9FEtILVFm7v n29wb46BBtBhbBSzhzgqRylsH1RgTdzUMUWQnq87c2kXSF78xujCAOb5mDkY3z0TF6S+ NF/20MLypSb6hSWOXh8+G+iDw35I3zy9wwRxLpKg03UnEfJUYeBXP88i+nhu5q/gIg6K KrLFCnWk4HYqNTvU03AQjcln/cM46tnWYo95Akj5KJD6V9CstkIg2lPXXotG61AkRhgi Pw/5Cnvta57+590rYKLJjdWluE87Tdneo5HokTI5jQM0sg7OM/qU0mxAuUdmm+/mn3Bf Ucyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=98uhWg1YByFdrNqBMrlewF7TID6zjOb0KYY/q5qfs+E=; b=nI9aB9tPK/oL4uHIgms//wRk+3bDWlWm3atVElPFlUt6uimYwD2QGBi1DJYVYhc2ey RoNhntw5cgCmdJRgCsjFUlc8+OnnP4aLuunY+2c811ZQZDHXsyDcLSiPue4Cbr/oUVUz hR2zvDcQC/7qn1E9U6mXdIQWn/QIC8ISI4H4a7Hbl18qVJ6tnqgYuOYDml04b9ARJsTQ AvFPUHsd4L3WbVWVTj1cB149O7T8JBNlVKNu+pxQxxA+AayIABTaqqdwbV+YcZeDsOK6 TW90nJFQ4ifJetmdVmwk0jl065tOTqU8hPklpWcaAy6oN8GKpJVi6DZLMqRq1/rYRDs5 fCzQ== X-Gm-Message-State: APjAAAWTVV1yjPkxzmToZcOMTgJq06hp6xDVclLlfDIk0fHYXFV8R+y9 ubp5oQZazcALn3+nBuOCi02P/87mKdca3rUGo9E= X-Google-Smtp-Source: APXvYqxrgBZAalTnqU67kg/hWFOtf5nBVY+hUzocsQQrEOYglnm0rnrMkok51Vcl33GFi3Z8ZgmLEWHebbO8uVKNfGI= X-Received: by 2002:a6b:b213:: with SMTP id b19mr1224483iof.58.1569299123892; Mon, 23 Sep 2019 21:25:23 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Gyan Mishra Date: Tue, 24 Sep 2019 00:25:10 -0400 Message-ID: To: Jen Linkova Cc: opsec WG , draft-ietf-opsec-v6@ietf.org, OpSec Chairs Content-Type: multipart/alternative; boundary="000000000000d37730059344ecc6" Archived-At: Subject: Re: [OPSEC] WGLC for draft-ietf-opsec-v6-19 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Sep 2019 04:25:28 -0000 --000000000000d37730059344ecc6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Jen Comments in-line I just joined the OPSEC workgroup and read through some of the drafts. Right up my alley. =F0=9F=98=83 Regards, Gyan On Mon, Sep 23, 2019 at 7:55 PM Jen Linkova wrote: > Hello, > > This message starts a Working Group Last Call for draft-ietf-opsec-v6-19 > (https://tools.ietf.org/html/draft-ietf-opsec-v6-19) > > Please review the draft respond to this email to support the document > and/or send comments by 23:59 UTC on Fri, Oct 11th 2019. > > Thanks! > -- > SY, Jen Linkova aka Furry > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > [Gyan] In section 2.1.5 below on corporate intranets where you are on a "trusted" network where the hosts are "trusted" the use or need for privacy extensions are not necessary and accountability by far outweighs the privacy extension to maintain anonymity from an IT security. I have deployed within Verizon's internal network as well as other customers a standard of disabling privacy extensions random station id as well as temporary address so that all hosts are accountable and traceable and the addresses remain stable with EUI64 address or dhcpv6 address. With RFC 8064 & RFC 7217 are adopted by windows & other desktop OS's and become the default we can revert our IPv6 deployment standards back to the OS defaults. Section 2.1.4 talks about scanning and static IPv6 addresses however should also take into account enterprises where hosts are "trusted" and that scanning is a requirement for enterprises having a historical database dump of arp cache & nd cache of all hosts addresses both IPv4 & IPv6. 2.1.5. Temporary Addresses - Privacy Extensions for SLAAC - In some extreme use cases where user accountability is more important than user privacy, network operators may consider to disable SLAAC and rely only on DHCPv6; but, not all operating systems support DHCPv6 so some hosts will not get any IPv6 connectivity. Disabling SLAAC and privacy extensions addresses can be done for most OS and for non-hacker users by sending RA messages with a hint to get addresses via DHCPv6 by setting the M-bit but also disabling SLAAC by resetting all A-bits in all prefix information options. However attackers could still find ways to bypass this mechanism if not enforced at the switch/ router level. However, in scenarios where anonymity is a strong desire (protecting user privacy is more important than user attribution), privacy extension addresses should be used. Can we add a section related to IPv6 inherent capability of the host to maintain many IPv6 addresses and security concerns as to which IPv6 address is used for conversation flows and the host OS default address selection rfc 6724 internal mechanism used to determine which IPv6 address is used for conversations. With SLAAC its possible to have a router with many addresses configured and all hosts on the subnet in that hypothetical scenario would get an RA advertisement with no limits as many ipv6 addresses that are configured on the router. In section 2.1.2 Point-to-Point links you mention a use case of infrastructure routed p2p links only require being configured with link local via Cisco "ipv6 enable" for ipv6 packet processing and I believe Juniper & Huawei have a similar command so that the IGP OSPF or ISIS adjacency can form via LL LSA updates however the major security and operational downside is that the traceroute is unable to show the in/out hop by hop routed interface IPv6 addresses along the path to be able to perform a hop by hop ping/trace when troubleshooting network issues related to latency, jitter or drops. So from a security standpoint it is recommended although not required to place IPv6 address on all P2P routed interfaces. >From an addressing perspective and also for security standpoint the ability to craft an ACL allocating all infrastructure /128 loops from a single /64 and /127 form a single /64 is recommended and coming out of the same higher order block bit boundary such as a /56. In implementations that I have deployed we used as a standard addressing schema "0 /56" - 0 /64 Loops, 1 /64 P2P and then instead of going crazy with vlsm we would have a single mask we made it a /120 similar to /24 for IPv4 that covers greater then 2 host nets router infra like router backbone ring or firewall subnet and then last a /64 for all host subnets so simple addressing allowing ability to craft security ACLs as necessary for all infrastructure subnets /128-loops /127-p2p /120- >2 host subnet. Regards, Gyan S. Mishra IT Network Engineering & Technology Verizon Communications Inc. (VZ) 13101 Columbia Pike FDC1 3rd Floor Silver Spring, MD 20904 United States Phone: 301 502-1347 Email: gyan.s.mishra@verizon.com www.linkedin.com/in/GYAN-MISHRA-RS-SP-MPLS-IPV6-EXPERT --000000000000d37730059344ecc6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Jen

Comments in-lin= e

I just joined the OPSEC workgroup and read throu= gh some of the drafts. Right up my alley.=C2=A0=F0=9F=98=83

<= /div>
Regards,

Gyan

On Mon, Sep 23, 2019= at 7:55 PM Jen Linkova <furry13@gm= ail.com> wrote:
Hello,

This message starts a Working Group Last Call for draft-ietf-opsec-v6-19 (https://tools.ietf.org/html/draft-ietf-opsec-v6-1= 9)

Please review the draft respond to this email to support the document
and/or send comments by 23:59 UTC on Fri, Oct 11th 2019.

Thanks!
--
SY, Jen Linkova aka Furry

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec


[Gyan]=C2=A0 In=C2= =A0 section 2.1.5 below=C2=A0 on corporate intranets where you are on a &qu= ot;trusted" network where the hosts are "trusted" the use or= need for privacy extensions are not necessary and accountability by far ou= tweighs=C2=A0the privacy extension to maintain=C2=A0anonymity from an IT se= curity.=C2=A0 I have deployed within Verizon's internal network as well= as other customers a standard of disabling privacy extensions random stati= on id as well as temporary address so that all hosts are accountable=C2=A0a= nd traceable and the addresses remain stable with EUI64 address or dhcpv6 a= ddress.=C2=A0 With RFC 8064=C2=A0 & RFC 7217 are adopted by windows &am= p; other desktop OS's and become the default we can revert our IPv6 dep= loyment standards back to the OS defaults.=C2=A0 Section 2.1.4 talks about = scanning and static IPv6 addresses however should also take into account en= terprises where hosts are "trusted" and that scanning is a requir= ement for enterprises having a historical database dump of arp cache & = nd cache of all hosts addresses both IPv4 & IPv6.

<= div>
=C2=A02.1.5. Temporary Addresses - Privacy Extensions for SLAAC -= =C2=A0

In some extreme use cases where user accountability is more important than user privacy, network operators may consider to disable SLAAC and rely only on DHCPv6; but, not all operating systems support DHCPv6 so some hosts will not get any IPv6 connectivity. Disabling SLAAC and privacy extensions addresses can be done for most OS and for non-hacker users by sending RA messages with a hint to get addresses via DHCPv6 by setting the M-bit but also disabling SLAAC by resetting all A-bits in all prefix information options. However attackers could still find ways to bypass this mechanism if not enforced at the switch/ router level. However, in scenarios where anonymity is a strong desire (protecting user privacy is more important than user attribution), privacy extension addresses should be used.

Can we= add a=C2=A0 section related to IPv6 inherent capability of the host to mai= ntain many IPv6 addresses and security concerns as to which IPv6 address is= used for conversation flows and the host OS default address selection rfc = 6724 internal mechanism used to determine which IPv6 address is used for co= nversations.=C2=A0 With SLAAC its possible to have a router with many addre= sses configured and all hosts on the subnet in that hypothetical scenario w= ould get an RA advertisement with no limits as many ipv6 addresses that are= configured on the router.

In section 2.1.2 Point-= to-Point links you mention a use case of infrastructure routed p2p links on= ly require being configured with link local via Cisco "ipv6 enable&quo= t; for ipv6 packet processing and I believe Juniper & Huawei have a sim= ilar command so that the IGP OSPF or ISIS adjacency can form via LL LSA upd= ates however the major security and operational downside is that the tracer= oute is unable to show the in/out hop by hop routed interface IPv6 addresse= s along the path to be able to perform a hop by hop ping/trace when trouble= shooting network issues related to latency, jitter or drops.=C2=A0 So from = a security standpoint it is recommended although not required to place IPv6= address on all P2P routed interfaces.

From an add= ressing perspective and also for security standpoint the ability=C2=A0 to c= raft an ACL allocating all infrastructure /128 loops from a single /64 and = /127 form a single /64 is recommended and coming out of the same higher ord= er block bit boundary such as a /56.=C2=A0 In implementations that I have d= eployed we used as a standard addressing schema=C2=A0 "0=C2=A0 /56&quo= t; -=C2=A0 0 /64 Loops, 1 /64 P2P and then instead of going crazy with vlsm= we would have a single mask we made it a /120 similar to /24 for IPv4 that= covers greater then 2 host nets router infra like router backbone ring or = firewall subnet and then last a /64 for all host subnets so simple addressi= ng allowing ability to craft security ACLs as necessary for all infrastruct= ure subnets /128-loops /127-p2p /120- >2 host subnet.=C2=A0=C2=A0
<= div>


Regards,

Gyan S. Mishra

IT Network Engineering & Technology=C2=A0

Verizon Communications=C2=A0Inc. (VZ= )

13101 Columbia Pike FDC1 = 3rd Floor

Silver Spring, MD= 20904

United States=

Phone:=C2=A0301 502-1347

Email:=C2=A0gyan.s.mishra@verizon.com

www.linkedin.com/in/GYAN-MISHRA-RS-SP-MPLS-IPV6-EXP= ERT


--000000000000d37730059344ecc6--