From nobody Wed Jun 2 12:21:41 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FBE93A17DC; Wed, 2 Jun 2021 12:21:39 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Ron Bonica via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.30.0 Auto-Submitted: auto-generated Precedence: bulk Cc: =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com, iesg-secretary@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org Message-ID: <162266169963.16688.9730671073095587387@ietfa.amsl.com> Date: Wed, 02 Jun 2021 12:21:39 -0700 Archived-At: Subject: [OPSEC] Publication has been requested for draft-ietf-opsec-ipv6-eh-filtering-07 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Jun 2021 19:21:40 -0000 Ron Bonica has requested publication of draft-ietf-opsec-ipv6-eh-filtering-07 as Informational on behalf of the OPSEC working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ From nobody Thu Jun 3 23:20:02 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E4D923A2B21; Thu, 3 Jun 2021 23:19:44 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.30.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: opsec@ietf.org Message-ID: <162278758487.22636.2245524143300284361@ietfa.amsl.com> Date: Thu, 03 Jun 2021 23:19:44 -0700 Archived-At: Subject: [OPSEC] I-D Action: draft-ietf-opsec-ipv6-eh-filtering-08.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Jun 2021 06:19:45 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers Authors : Fernando Gont Will (Shucheng) Liu Filename : draft-ietf-opsec-ipv6-eh-filtering-08.txt Pages : 37 Date : 2021-06-03 Abstract: This document analyzes the security implications of IPv6 Extension Headers and associated IPv6 options. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. Finally, it provides advice on the filtering of such IPv6 packets at transit routers for traffic *not* directed to them, for those cases where such filtering is deemed as necessary. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ There is also an htmlized version available at: https://datatracker.ietf.org/doc/html/draft-ietf-opsec-ipv6-eh-filtering-08 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-ipv6-eh-filtering-08 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jun 14 08:03:14 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C56F03A276D for ; Mon, 14 Jun 2021 08:03:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.795 X-Spam-Level: X-Spam-Status: No, score=-2.795 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.698, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=R4FeFwr7; dkim=pass (1024-bit key) header.d=juniper.net header.b=hwOk++lv Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 43JgcwR8RWbc for ; Mon, 14 Jun 2021 08:03:07 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD3733A2846 for ; Mon, 14 Jun 2021 08:02:53 -0700 (PDT) Received: from pps.filterd (m0108163.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 15EEwjKP008566 for ; Mon, 14 Jun 2021 08:02:52 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : subject : date : message-id : content-type : mime-version; s=PPS1017; bh=XYOckQIzsjGzNzl+16tKtvlPvvYK42Jmw4Q1L2kVGJQ=; b=R4FeFwr7d2bRKHbArcFqvtijm0eB+x/MMJkwAeHTGHcY/qIvQsfpGQv0hy5QnKcbgx8e AxX8HHFRoO46uI7MC0q7l04Osbxlm3+d0X1EaWL1+K7Oz6ISSWs/kru32GPON04Eb9wi Y0zkig4ttoPG8Jg/UYbcs2Z2i7yVnC556//iivjHljfqAr/bFmO5yWP/7ftxbM3gsdq+ BUh5muvBXfq99kR25G/aPiPt7Sw0H9VeSBfRtljBZOuXnH1x5ABBhLR6OVSpiKSKKKt+ VcxLrX/duif3sg2rk+wOhH0FdyO9w3tQ+wuuS474kT68pcGmEbqKAb+tID7kSGwdaM8/ RA== Received: from nam02-dm3-obe.outbound.protection.outlook.com (mail-dm3nam07lp2040.outbound.protection.outlook.com [104.47.56.40]) by mx0b-00273201.pphosted.com with ESMTP id 39636yrvbs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 14 Jun 2021 08:02:52 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PcJ/sMyNKHovrLqKIBZDq+V66fYRBSY59oafICGrAsS2JiGZioWOJ8JylhKiYOyRe2Wit0VcpJDZ/IQMOic9PdmxuJ36OnnrOSOG9lGXwSDgNYyWIucIyctaJvSG+anlu58DSdWFGxD7dNsQPIoAmziV97Dez4xRG86up02H62k9Mw4gqhyfDcwK99TLQlPKkD9BGPlHAYihMZ47n8R1ZgaDk4z3//nBK89dEuFBGdKEqJW7iUIY5FZnaukEcKby08VLWXgZdaiPJnGwsGpIN3S9wcarZTH4EJZkF09yXVT4clNYJFHMOXCurhl70MgHYb2L9by3J21HyJiE+4G7EQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XYOckQIzsjGzNzl+16tKtvlPvvYK42Jmw4Q1L2kVGJQ=; b=RHBk8vHgSkKub4g6EtXXtC9eorpZCEZnhPcks6E3nPEsExtbHBpUlSprbO7Nnw+6vwh0g6fTF4iWAubNGc5MqUhob3Q8g+mHjjRn8nMCymJHpQoZa+eHolzBzdWJjhTG7dDL+GoksqE+LYrzqltjHMc6YTDNHwUU9Jqau5tUqeQYqK8CuWjRj96hV9b7jtwC42d0MKX8/kP1t5EETN/KpygmDK/WIy66jctgkftsskWmz0vLEsp+fhjFKcQbbRrBboPlgXYBSIv8Tj+4mfe06WyFdRNIcoZb5EogkmHlZFMifZNxhmax4/zWTBOdlQGGzwvlm2YgtX+fw3xyETk0sQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XYOckQIzsjGzNzl+16tKtvlPvvYK42Jmw4Q1L2kVGJQ=; b=hwOk++lvdZhPyEo7U2jgG5RagVkN5H/QmMB1HieWk71VKXEKA7uPaB5no9f56u9F/Q4YVQY/8F2/Z5IdB1TzZ246sMXGsap3iJR9n3410Lz2EVg6xILNCDENZIfsL0vGcX8eoHElL1k/yl59luWKsLIU3ooA+Ee8LsEbnlIG0Rw= Received: from BL0PR05MB5316.namprd05.prod.outlook.com (2603:10b6:208:2f::25) by MN2PR05MB6830.namprd05.prod.outlook.com (2603:10b6:208:1be::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.9; Mon, 14 Jun 2021 15:02:48 +0000 Received: from BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::657e:bddc:6eef:596f]) by BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::657e:bddc:6eef:596f%7]) with mapi id 15.20.4242.015; Mon, 14 Jun 2021 15:02:48 +0000 From: Ron Bonica To: OPSEC Thread-Topic: IETF 111 Thread-Index: AddhLh7dC07erqReS8iB8lllmUWo9Q== Date: Mon, 14 Jun 2021 15:02:48 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.6.100.41 dlp-reaction: no-action msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=true; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2021-06-14T15:02:47Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Method=Standard; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=0633b888-ae0d-4341-a75f-06e04137d755; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=5129a4a7-abe7-4c55-8ff5-d9ae1b88f13d; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ContentBits=2 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=juniper.net; x-originating-ip: [173.79.138.200] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a14b1fce-a091-45f2-70df-08d92f457939 x-ms-traffictypediagnostic: MN2PR05MB6830: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4125; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Y0E7AMtpDQIGSxp6gQvyESn8T54jtP+KNZEpeF6YCQgsckev1V5rut/SHlmpntmLqrGIWxQjiXc+kMmJLsVyetY7vBvqgG1Zn4oIQC4oZUt/Zya+v3HuT1YA7l3ADB8iYCdGES4w9E8nKbFitY3/N23wPyJAl6ii7eNvlDZ6OklEb4FLm2lGioXNAdh4BwTX1VFSI0QoX3fMWy+ujDUccZgzuq+iJGzm6ikcnPhRF59f9PZ1cFSI50EhwimGAIIGhicToFqYydqaQ6gCGnvs2gWOfnEf36kOFSvREd+T+txTPkAsZZ5HDCbCAjTK3/sCwuxnpEQhCeA/Fvu2GyEU1sWZUXyw8MPVoRT3jmP3kkaF5jaoUM/2QYWCanZfwHmUFDCgY7w2Jt9+kjK3I0nxYCZB442XHQST5ZHiI2ZIiVaLsYBRPrUS8JFmTpOwXZR++zwYO4tVAiuLdXc1MGeKAoeKSPQ48V80VhYsXI08miO49MFauhBdaorIiEs8vI642KnEkRR+RDnEeA+Z+VB2Z0pNFfa19JcfXHFWcYa/IMBUZxDU1Lpyv5A5+3jYdzvvtbLtXC0h+pRVX3ZLK5c8yFrr5Et8fv4hzVIlKkqi/r4= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR05MB5316.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(346002)(136003)(366004)(39860400002)(376002)(396003)(76116006)(558084003)(26005)(52536014)(71200400001)(5660300002)(186003)(66446008)(66946007)(9686003)(33656002)(8936002)(7116003)(55016002)(316002)(122000001)(6506007)(38100700002)(86362001)(2906002)(7696005)(6916009)(8676002)(478600001)(64756008)(66556008)(66476007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?xUUnXcyDyiuAp4hdcq52D+mBBql7NgphEGtwXR9hd+Uj9OJkVqZuV3UGKJN/?= =?us-ascii?Q?YOt2sVHkC7PeWdtEXLlKRB1SYq4tQoLNpGqGVypePZYf52Ux8B77pJi+fOm1?= =?us-ascii?Q?xKsfsKRs1LKcUZtlCfuq2/PqDMOvC5K5t5eodnFbu8iTamL7L2kbkCXaDxWL?= =?us-ascii?Q?Iv9yoU2DBR7qTLBdaxce2MPdKhdFA64sEqd8Y2hnY/2Mmmp4jSgdQ8U803B2?= =?us-ascii?Q?fNZKnt+8weOMKnZ489hugHcvdLgWswEeJkLfn//x0wNGuXNAZpJ9htJESclM?= =?us-ascii?Q?cpOtSw6wWWIW4x5exmSA94i6cOVaMlfd+sK3Hdo3+PAcA6Q1Inu4DqEPqiKw?= =?us-ascii?Q?WmPcRyUofgOKWBjC0EUf/BjPQDdRvDHFsJBSPrP28tk4ER43HROvHJMLs9Vw?= =?us-ascii?Q?kWroMO46/5DP7RQ6yUuomnppWpjUbmZynV4w/sEC4+5MbaaG/peRsb/ffdGy?= =?us-ascii?Q?e4nwis9vmQjZtfFpAcXX7HKNHYtKJAmehnd/8RuZ2DMGNuhZPUGMr2CW85Xo?= =?us-ascii?Q?KCAVJzg7ykbSt8BhVwD7hSP7Oz+BXexrzoX/dLviPshp4jzTkzhfqdis+TeT?= =?us-ascii?Q?9gegFcdVdpkGUKIoNuCQ8CTQpH0y1/gjmNvgGndrRGLFuRjgMslpgLoB0TPG?= =?us-ascii?Q?Atn1S3d/uB6MTnak6eoFdsLiW6HCToTd1pguPdxeHkLRHfYnYxuFcw0VKVGH?= =?us-ascii?Q?qlkcbp0otz0GL2n0Tjk6sTXFG7NCGyG3Ptag1ywEjqwnI9btSVXoiIopNCJJ?= =?us-ascii?Q?sx4KMKdFk58vY/CdSokmjnQ5I2VlPB0s/Wbv++toYt3uFFerL8iOLcIZ+my9?= =?us-ascii?Q?XMbSl5WUxfx5tOEh5//d4OxhaXpXFNFXbXshwlcSOuiXKAtCQNRCoe7MQh2n?= =?us-ascii?Q?WPw0W96nLWpXVioI41pVKW2oalpBrUIfhTypuVeXEn2CvTbNgDfEhY0NmzT9?= =?us-ascii?Q?S3+hMAyMxzS9ggfSF4JcgqGC9lwNbHu0hs47jO2ywVOO0XMAG60XgSxI+6Y8?= =?us-ascii?Q?m9np7rTWPag+hYGz5tDWPQlekAZ11nxUuC0EL7UAECfgypMGT0udVwPGvCMg?= =?us-ascii?Q?PNQVOk7iHUclzsl91Al/HX1YzZhEfC+ZWb82ZV8tEjewpR7XuDQCQhNjl0xT?= =?us-ascii?Q?nwM4i7xtuKf3VVxsxaSsTZ4VPQX/8E0Rfe7rOIhYWXltM85WmDcYmwoEEpVV?= =?us-ascii?Q?Akfc2rZfqCi7QlvNmQpAiJlxlgBuGfYmxxsBfLzdQ6AASp7HAidWK3b6FI0P?= =?us-ascii?Q?ygMMiAxhsUIQq+MMVdn6JlVMP4US6gFR5Tt2HhxBmS5d+kSTnVyGioxV03UD?= =?us-ascii?Q?WVakbg4jzKsZmuZ24OO7LYaO?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR05MB5316D62AE64BD87BEA6CDD67AE319BL0PR05MB5316namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BL0PR05MB5316.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: a14b1fce-a091-45f2-70df-08d92f457939 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jun 2021 15:02:48.1792 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: MyllfHzP+m5bAWo6VSqF3uVIsx+iaFI66VouKpf2Dd61baZz8oTer1r3NRWkiPwwiEQr8047HxFC+hoH19SsxQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR05MB6830 X-Proofpoint-ORIG-GUID: wpLx7E-xd7gIms7_EJp2z5mL1y_1rRgn X-Proofpoint-GUID: wpLx7E-xd7gIms7_EJp2z5mL1y_1rRgn X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-06-14_09:2021-06-14, 2021-06-14 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 impostorscore=0 lowpriorityscore=0 spamscore=0 mlxscore=0 mlxlogscore=509 priorityscore=1501 adultscore=0 phishscore=0 malwarescore=0 clxscore=1011 bulkscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2106140098 Archived-At: Subject: [OPSEC] IETF 111 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Jun 2021 15:03:13 -0000 --_000_BL0PR05MB5316D62AE64BD87BEA6CDD67AE319BL0PR05MB5316namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Folks, If anyone would like to present anything at IETF 111, send email to opsec-c= hairs@ietf.og. Jen and Ron Juniper Business Use Only --_000_BL0PR05MB5316D62AE64BD87BEA6CDD67AE319BL0PR05MB5316namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Folks,

 

If anyone would like to present anything at IETF 111= , send email to opsec-chairs@ietf.og.

 

        &nbs= p;            &= nbsp;           &nbs= p;     Jen and Ron


Juniper Business= Use Only

--_000_BL0PR05MB5316D62AE64BD87BEA6CDD67AE319BL0PR05MB5316namp_-- From nobody Mon Jun 14 11:49:08 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CE223A2E03; Mon, 14 Jun 2021 11:49:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 7.32.0 Auto-Submitted: auto-generated Precedence: bulk CC: =?utf-8?q?=C3=89ric_Vyncke?= , draft-ietf-opsec-ipv6-eh-filtering@ietf.org, evyncke@cisco.com, opsec-chairs@ietf.org, opsec@ietf.org, warren@kumari.net Reply-To: last-call@ietf.org Sender: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <162369654568.29970.12272130358806833146@ietfa.amsl.com> Date: Mon, 14 Jun 2021 11:49:06 -0700 Archived-At: Subject: [OPSEC] Last Call: (Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers) to Informational RFC X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Jun 2021 18:49:07 -0000 The IESG has received a request from the Operational Security Capabilities for IP Network Infrastructure WG (opsec) to consider the following document: - 'Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers' as Informational RFC The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the last-call@ietf.org mailing lists by 2021-06-28. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Note: The WGLC was sent to OpSec, 6MAN and V6OPS to get wider review: https://mailarchive.ietf.org/arch/msg/v6ops/MvzKKTYCDtWVtlIGxb6OfQlUats In addition, this is the second IETF LC for this document. Abstract This document analyzes the security implications of IPv6 Extension Headers and associated IPv6 options. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. Finally, it provides advice on the filtering of such IPv6 packets at transit routers for traffic *not* directed to them, for those cases where such filtering is deemed as necessary. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ No IPR declarations have been submitted directly on this I-D. From nobody Tue Jun 22 07:37:00 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EB4C3A2764; Tue, 22 Jun 2021 07:36:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.196 X-Spam-Level: X-Spam-Status: No, score=-2.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.198, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=WMKFQwHl; dkim=pass (1024-bit key) header.d=juniper.net header.b=K6nkDdOr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hDMzKgZ5MpDb; Tue, 22 Jun 2021 07:36:54 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47C5F3A2762; Tue, 22 Jun 2021 07:36:54 -0700 (PDT) Received: from pps.filterd (m0108157.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 15MEUrwm024275; Tue, 22 Jun 2021 07:36:53 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=6iuiEpq3/34mpNnvyNSkQI0TcqNdGw3O6T6jw3FxYn8=; b=WMKFQwHlfQQCV1t8w7Qaaxv2I4yBjJ2/ahwl2wvE0vYiL5CdT0b8K/P0WE1poGRhv5WZ I6FhZxw6HmLKS06X7EWGT1UvhufpgQAHD8/RtcBqTA18mj+aKNgzSiXeI6y5yPSKlgBQ dTmzPtJtfNez7CF8PEMbtbpoZT/yxL3gNU65J5S2EPDfkI1pj2Oua+LIAYFyeNrLtfYa wdg7shUaqeYuj0gj0ikaUb3LQ54ljDy4NeC1hWUElB14OY6/QziLm17OiX8J+AsZ/c2w ED1uPPQXf9UNtrz6MC1Jn6VjOvg4FSiOCYdpho5mFLG16Wmk5sxhgEglntGmkX5HNFBG 8g== Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2109.outbound.protection.outlook.com [104.47.58.109]) by mx0a-00273201.pphosted.com with ESMTP id 39b87t10qg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 22 Jun 2021 07:36:53 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fgePPTEk0EhjuYFuF/HNDt8ePhbLbce1LDt/26H4bXJjhstrYt1nUNgsPWoWfhL6eWy66mz9Bgg4CU08pDsyGmS5oESVvc9C1caerVUJL/LzoRA4rvBlYQqsTPPg5cDRR/knYsJGlwiZNdPEik3il7ZNXnA4jm/KVz0lROm/rWk6FPhRVuG0VPztZN1Ese/+B1NVhvWaaiF+qX1bB82C/WSLaXCz4ljN8vhm7f0Spp460Py16EwrlzhfteUPKpM+aXhftNygL0PsHXZ0jvOTDvimUlhCaKmtj9ZhI+fpS4le+hpeOs66R+LBEZSaRO0GmTj/DGxj5+7S3mQxmkJafA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6iuiEpq3/34mpNnvyNSkQI0TcqNdGw3O6T6jw3FxYn8=; b=Ru6JD6Zt8fBOrJSWQJbV9+1NX/sshBxNG5INzeAFCu+q78wm3ug8EoPAL/Ktqq69h6hPt8AtC87erbQcmx/BYPhPlOeOISWKuq31Uxs4a4CAyqM2m7MmpJ4jp+tbdgR8wzlYo7QApxOac/PC/wX5e7IQLvOMw0L9r4oET0znONTIrLO5Ll0dsu+N6NgsXfHlszlhuU7hTwla3GEm0fisbCyaunvgNLmqttqUshMn8j2wMQ591D3ZENtNm9CNNlVFgpExWncRRYLUVQbRj0XoHLCHlq5Ye1+hAP6MnkzpE9zFvZOFgMGu3TIdZYoaKhDH9PpgMnZnvfWuRvSokoS16g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6iuiEpq3/34mpNnvyNSkQI0TcqNdGw3O6T6jw3FxYn8=; b=K6nkDdOrxQVZTv6S9PcDVC+lowpN23NhTYAOY/lbePGGrQqbx9UYAVwOWJNtWyABiKaKLGYF8Dpa8YfnvbuqUVe4xKLRQXhyoXx3n+mpHrlGuJ8TO8IYJ+F+Lx4QyMjW6vNMZCFoUlzOxLmdnS8B6ny7lBo+EdGLewFFzT4yIxc= Received: from BL0PR05MB5316.namprd05.prod.outlook.com (2603:10b6:208:2f::25) by MN2PR05MB6958.namprd05.prod.outlook.com (2603:10b6:208:18f::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4264.7; Tue, 22 Jun 2021 14:36:51 +0000 Received: from BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::657e:bddc:6eef:596f]) by BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::657e:bddc:6eef:596f%7]) with mapi id 15.20.4264.018; Tue, 22 Jun 2021 14:36:51 +0000 From: Ron Bonica To: Ron Bonica , OPSEC Thread-Topic: IETF 111 Thread-Index: AddhLh7dC07erqReS8iB8lllmUWo9QGRb+QA Date: Tue, 22 Jun 2021 14:36:51 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.6.100.41 dlp-reaction: no-action msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=true; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2021-06-22T14:36:49Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Method=Standard; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=0633b888-ae0d-4341-a75f-06e04137d755; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=5129a4a7-abe7-4c55-8ff5-d9ae1b88f13d; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ContentBits=2 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none; dmarc.ietf.org; dmarc=none action=none header.from=juniper.net; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9542ae12-a4a4-4b38-d5da-08d9358b2c6d x-ms-traffictypediagnostic: MN2PR05MB6958: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3173; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: z3laPwM3vNnCjSOIsvvKgdn7CF2BQu8w3sqhTHr7JOUPvJQ+GhtAhotY7/mP2WT4OE6Y2Rz78akCeb2slJ/7T9O40bv6Cy7W2BQgXX2+2RD4QNafE3B+NShIRUFkYcvys2W2NOHWJtntiB4U8JJFqe3kGnpnNggiGd+XdI+RgedbuFs7M9pLh6okK+/2MPbCFxsxX94/WX7GTyrDp1U9zhbH4TKTW5uOiF/7fXyfuu9RSU7IJfWxJgbSLOGjp2yk6Xs7yz9sBM8w3oXBls4rE5a5XfeeabRgZqLT81Q+TL6SnCj9d6jEHyMbki05fNPE/Y6YT5dKpDTikug1rdoXVQGdNEPSurfjI3tFVNFds9nL4antuJpq58w1uTn0RQWXqUy/d35LHqzkb9TWOC4hv2EbYieZLYr2MdKU3FrVpwLnqwiA6Mu1dmlmxGr7bHl+wcXkUC4SeKY9nTq8c0pwhjjcxvUfmZSOa3vHKwpezTs4uvRhSCxJEv/qm4p0GljGErL/6oKksnLG7c0/cRkheHmYTOZ+dBBouiOh1HefbcllgsdixhfdQYsLk7qWUgcTU8B7NUPwTZTl2jiygzDvPTTZRz662nn7I/W2erB9ge3F/dzOLFJqPTJrF9OhjY+SnTydlmyW9d4poyhW4H4ElYt64n9KkW7oVQ2Z9Ls8chQFPSCU7JM4XhZ/A09pxzCgw0BgxZPIiU+84HpZZgDPWQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR05MB5316.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(346002)(376002)(366004)(136003)(39860400002)(396003)(55016002)(26005)(83380400001)(7696005)(8676002)(53546011)(6506007)(66476007)(8936002)(64756008)(186003)(66556008)(316002)(66446008)(9686003)(76116006)(66946007)(5660300002)(2906002)(7116003)(966005)(52536014)(4744005)(110136005)(33656002)(71200400001)(86362001)(38100700002)(122000001)(478600001)(166002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?qjzgUp0T3QayPhDCb7zqZ+x0un3vCtfM9doue22oiXMWyYD/QBGpW1hopTc9?= =?us-ascii?Q?a/5dRhpgDmTPLLNmSxPtrDDUkiuOBsTq3FRMKCgbceqhuH9Z0+LUp5kd+hvJ?= =?us-ascii?Q?YEHWtVaE+1MWZ0ljo+B2kAEtuKc+UOcC30UdOQ7upPK+YmeZLrlhdW/qGQv0?= =?us-ascii?Q?mZz6k4bD1TSd6OzyvAcwQJcup1GhySQDickPtASvhdYT3cIukdVJoUObVoaP?= =?us-ascii?Q?VMAyhkud4uFAygZt86DEILp5+TP9tna7cv7z0ZncVMSS35/Rw4y0djkHtWwt?= =?us-ascii?Q?3e/lDuGdmYacmKuOn1MVugw5iNGCFROCYC2CpxnN1o2hqVypIPmg9zZVOMXF?= =?us-ascii?Q?xgJ0oo/UaINAyh4G7jPd9y6y/j1T5m9UvrmJabs/pDDKdDXrIb5+rm7SK0j6?= =?us-ascii?Q?sjQzoxeYX9WLrRGIM/xl5szaFltSI0EdU2Qg+kMpuwLxzkfP5Zg85IIh6DHQ?= =?us-ascii?Q?QhTC2K5UC85DKYQFopG857rdIJ7SeL3ahi/N9mEWKSiQNDKV+BYzo6W865wH?= =?us-ascii?Q?FEkwW+ufuioC7Pbjt3//VbuKRcb5hW1EsGdrBQW6ww7LjaPc1T++UlOEx2tD?= =?us-ascii?Q?3YprdJA9D6WVHND3O2LDzB/5LHA1n0t99z2UaiFC00exTjmagEqHB11qEIKP?= =?us-ascii?Q?MFE/I662ZVxeA/9PRwIZoZlSXOMAJ/AfEd9NVY8DrfDDouA2/OA1D4teEG46?= =?us-ascii?Q?zMJ1KC/jhd8WGn53KKpirO2S52A/0/twNhj1zqagS8x9acafOrVUlEF0B5dj?= =?us-ascii?Q?CxYwHvDKztqc466GJYcpnnIi8d3rSRv9XxbUoNmVx9XvXAW1Of8/u0linHk8?= =?us-ascii?Q?f8IQwQiWIldiTaATTKnOyYOKJ0MfYuFT1Ocgw3jM/s5AQxttcQY4m7aJgaqX?= =?us-ascii?Q?tVIUvCg7qni86D/A49JUuKnhdgl4B2JM+WFczJH1guPXRuAqxeb2R688H2tg?= =?us-ascii?Q?1/gCEy7ES8rXaeAkPlmdMsE4YX5W0yLlQdgxWbUlReWDvbJ7ws6iM/Vs9REB?= =?us-ascii?Q?zcIlzohoT4Mc1LVoPZpwWWkoXczWnO69esia8C9eqiLlgrl2k3gsPoaPSgn2?= =?us-ascii?Q?EqCZAlXBA/rZdtLqnzKONjCW7d7atLw4soFgWLfql2gdkeUh0cS/GzR/af6a?= =?us-ascii?Q?vOJFia/iyAdF30KFuLGy4t1nGJ5yH8nnJXwsBDrDl1qsy476I1CZ0iAMYQCl?= =?us-ascii?Q?x2bUA7Asq3SD1HiqCkfJYBAjafydyE5lpE/nl61YNoPsBj0LhoGfbnd+VjDA?= =?us-ascii?Q?JvYpXQgHuL/LJaArJuA2wPWUDLVquySV+Esp/Hv1ixiP5ybT/xgehWHSeKGZ?= =?us-ascii?Q?mQulnzCZQcPVCx+V+nmGdIRE?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR05MB53160D5E42E19021442E547BAE099BL0PR05MB5316namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BL0PR05MB5316.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9542ae12-a4a4-4b38-d5da-08d9358b2c6d X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jun 2021 14:36:51.0768 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pnA840d3AlXl/aIiOfwGXjW5tp850olGO4iS4IkY/Y9sVafyG0hYbleOBGvJji0rvREcNgK/vu37NUHps1DJhg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR05MB6958 X-Proofpoint-ORIG-GUID: qkxbO1_AzYhw7Y_AOkHO0nlDniZRYBMN X-Proofpoint-GUID: qkxbO1_AzYhw7Y_AOkHO0nlDniZRYBMN X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.790 definitions=2021-06-22_08:2021-06-21, 2021-06-22 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 suspectscore=0 impostorscore=0 adultscore=0 priorityscore=1501 clxscore=1015 mlxscore=0 mlxlogscore=981 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2106220090 Archived-At: Subject: Re: [OPSEC] IETF 111 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jun 2021 14:36:59 -0000 --_000_BL0PR05MB53160D5E42E19021442E547BAE099BL0PR05MB5316namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Folks, So far, we have one request for an agenda slot for: * https://datatracker.ietf.org/doc/draft-paine-smart-indicators-of-comp= romise/ Does anyone else have anything to present? Jen and Ron Juniper Business Use Only From: OPSEC On Behalf Of Ron Bonica Sent: Monday, June 14, 2021 11:03 AM To: OPSEC Subject: [OPSEC] IETF 111 [External Email. Be cautious of content] Folks, If anyone would like to present anything at IETF 111, send email to opsec-c= hairs@ietf.og. Jen and Ron Juniper Business Use Only --_000_BL0PR05MB53160D5E42E19021442E547BAE099BL0PR05MB5316namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Folks,

 

So far, we have one request for an agenda slot for:<= o:p>

 

  • https:/= /datatracker.ietf.org/doc/draft-paine-smart-indicators-of-compromise/

 

Does anyone else have anything to present?

 

        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p; Jen and Ron

 

 

 

Juniper Business Use Only

From: OPSEC <opsec-bounces@ietf.org> On Behalf Of Ron Bonica
Sent: Monday, June 14, 2021 11:03 AM
To: OPSEC <opsec@ietf.org>
Subject: [OPSEC] IETF 111

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

Folks,

 

If anyone would like to present anything at IETF 111= , send email to opsec-chairs@ietf.og.

 

        &nbs= p;            &= nbsp;           &nbs= p;     Jen and Ron

 

Juniper Business Use Only

--_000_BL0PR05MB53160D5E42E19021442E547BAE099BL0PR05MB5316namp_-- From nobody Wed Jun 30 22:03:54 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F2A553A0D46; Wed, 30 Jun 2021 22:03:48 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Erik Kline via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com X-Test-IDTracker: no X-IETF-IDTracker: 7.33.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Erik Kline Message-ID: <162511582896.10745.1599530578040574909@ietfa.amsl.com> Date: Wed, 30 Jun 2021 22:03:48 -0700 Archived-At: Subject: [OPSEC] Erik Kline's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Jul 2021 05:03:49 -0000 Erik Kline has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- [S1] [nit] * "some of the measured packet drops be the result" -> "some of the measured packet drops are the result", I think [S2.3] [comment] * "o Discard (and log) packets containing" -> "o Drop (and log) packets containing" since the subsequent bullet is about "Reject", and discard is defined to mean either drop or reject...I think it only makes that this bullet be about dropping a packet. * "Ignore this IPv6 EH or option type ... and forward the packet" I think this might want to say "process the packet according rules for the remaining headers" or something, rather than just "forward the packet". Basically, if the packet would, for example, match some other firewall deny rule based on its transport header, that behaviour should be applied in this particular case where the IPv6 EH/option is configured to be ignored (rather than just saying "and forward the packet"). [S4.3.9.4] [comment] * It seems fairly clear from RFC 5570 Security Considerations that a CALIPSO option is best protected with an AH, and in such cases stripping the CALIPSO option would cause the packet to fail validation at the (suitably configured) destination. Similarly, it might be good to note in S4.3.9.5 that if an AH is present presumably the advice from S3.4.5.5 applies.