From nobody Fri Jul 2 15:03:12 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EBF683A08F9; Fri, 2 Jul 2021 15:02:49 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: opsec@ietf.org, warren@kumari.net X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <162526336994.26814.12626919608342369367@ietfa.amsl.com> Date: Fri, 02 Jul 2021 15:02:49 -0700 Archived-At: Subject: [OPSEC] opsec - Requested session has been scheduled for IETF 111 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Jul 2021 22:02:50 -0000 Dear Ron Bonica, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. opsec Session 1 (1:00 requested) Friday, 30 July 2021, Session II 1430-1530 Room Name: Room 3 size: 503 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/111/sessions/opsec.ics Request Information: --------------------------------------------------------- Working Group Name: Operational Security Capabilities for IP Network Infrastructure Area Name: Operations and Management Area Session Requester: Ron Bonica Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 50 Conflicts to Avoid: People who must be present: Jen Linkova Ron Bonica Warren "Ace" Kumari Resources Requested: Special Requests: --------------------------------------------------------- From nobody Wed Jul 7 19:00:39 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25ED43A22B8; Wed, 7 Jul 2021 19:00:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vh6x6Rso4BAP; Wed, 7 Jul 2021 19:00:31 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0D053A22B9; Wed, 7 Jul 2021 19:00:30 -0700 (PDT) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 16820KLS021641 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 7 Jul 2021 22:00:25 -0400 Date: Wed, 7 Jul 2021 19:00:20 -0700 From: Benjamin Kaduk To: Erik Kline Cc: The IESG , opsec@ietf.org, opsec-chairs@ietf.org, evyncke@cisco.com, draft-ietf-opsec-ipv6-eh-filtering@ietf.org Message-ID: <20210708020020.GA17170@mit.edu> References: <162511582896.10745.1599530578040574909@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <162511582896.10745.1599530578040574909@ietfa.amsl.com> Archived-At: Subject: Re: [OPSEC] Erik Kline's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Jul 2021 02:00:37 -0000 On Wed, Jun 30, 2021 at 10:03:48PM -0700, Erik Kline via Datatracker wrote: > [S4.3.9.4] [comment] > > * It seems fairly clear from RFC 5570 Security Considerations that a > CALIPSO option is best protected with an AH, and in such cases stripping > the CALIPSO option would cause the packet to fail validation at the > (suitably configured) destination. > > Similarly, it might be good to note in S4.3.9.5 that if an AH is present > presumably the advice from S3.4.5.5 applies. Probably not very relevant here, but the current IPSECME advice is to use ESP with null encryption rather than AH. -Ben From nobody Wed Jul 7 20:48:12 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 497D93A112A; Wed, 7 Jul 2021 20:48:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=edgeuno.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id br5JSQgAi2Ae; Wed, 7 Jul 2021 20:48:08 -0700 (PDT) Received: from NAM11-CO1-obe.outbound.protection.outlook.com (mail-co1nam11on2095.outbound.protection.outlook.com [40.107.220.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAE6B3A1121; Wed, 7 Jul 2021 20:48:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hnFcYyc8eUR0Z5omGK2f8T0xV6JbaTmGcCgny0CIdwTrsk2ar8Gx4DNIdEWKXJ2y4Xi9qivvFmVC4VXAyG1fCiyvi6bBTQOVJp/+2/Emfaf0bvrZYynI4r534bYjR9KagIbMlAl+Jiy+MbigoMrTNTQo/fkfziJyrqRszbV1xC6oNNVa35Z+cZyTQPEl6xdVIBDK0FUPSS5FWMoyw266QlsqYvGhuGbu/Jc5kiv8oYXw8B+gJhmZkNqvpQTqN1tFH3E2jQHItvRCxw7kGHk3uLQbWjEQIaqk2UOOlwYYNyYbHYi+05M7y6uytRwFgvGjKECJCCM9ezVfxu75QG0G5w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=au69JQyRNVuZ6JMbECaD4q2CU78egi0dVWjaDftivmc=; b=AKXjJutxy1yD88uws/XC1tDn3IzxcBntcsBpPuuQfQBtFMZti3qmn3MZyccC4jUSocLrkg4IqiaDfVW/nFq3ZljHSdZhjGWBXaxZVkWBdfKKVLMnFPNNgb7PBEN636YNJk9HAdbA0DP4S/rd0JYYeP6QgT/9SEGb+0fOe+CXfdhYJCliaJKZo3PI4EHOj0OEJzA70YNS45SFy48apqdD7Jk74rdHx0wW/rZJBQgQhROLEOENY4h3ZnFkMLQB7gm7f5NImOPu4O79PIATmmTJf12Rh6DCSFr6UIBngNjLn3gC51t/yJMqXk5ajPpuOFlGeWtlre1HC9WMNobC3T9HQA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=edgeuno.com; dmarc=pass action=none header.from=edgeuno.com; dkim=pass header.d=edgeuno.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=edgeuno.onmicrosoft.com; s=selector1-edgeuno-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=au69JQyRNVuZ6JMbECaD4q2CU78egi0dVWjaDftivmc=; b=aHQAQ8N7pVX/b/hBt+FMREU8BniUlcdH8yRo+nFnXQFN4Plemu3Gejqc5daEKmu1QAJvo2IH7Eow4pQ1S8C260isfO8CqA3kcyivGpnbQc/LybjboWgACD7PdJit3PjTkmvOnE1ZXawGEHJZ7HBc+MjNgxpTEkubLpoXxOOYkSU= Received: from BY3PR05MB8578.namprd05.prod.outlook.com (2603:10b6:a03:3cd::10) by SJ0PR05MB8648.namprd05.prod.outlook.com (2603:10b6:a03:394::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.11; Thu, 8 Jul 2021 03:48:05 +0000 Received: from BY3PR05MB8578.namprd05.prod.outlook.com ([fe80::752d:7e2f:853f:f91a]) by BY3PR05MB8578.namprd05.prod.outlook.com ([fe80::752d:7e2f:853f:f91a%4]) with mapi id 15.20.4308.022; Thu, 8 Jul 2021 03:48:05 +0000 From: Fernando Gont To: "ek.ietf@gmail.com" , "kaduk@mit.edu" CC: "opsec@ietf.org" , "opsec-chairs@ietf.org" , "iesg@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" Thread-Topic: [OPSEC] Erik Kline's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) Thread-Index: AQHXbjaAH1s+R0OlU0yyQo0PagDT+Ks4XZUAgAAeEwA= Date: Thu, 8 Jul 2021 03:48:05 +0000 Message-ID: <33b1186c2b8283be587e4a7011836d4e653bcde4.camel@edgeuno.com> References: <162511582896.10745.1599530578040574909@ietfa.amsl.com> <20210708020020.GA17170@mit.edu> In-Reply-To: <20210708020020.GA17170@mit.edu> Accept-Language: es-AR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Evolution 3.36.5-0ubuntu1 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=edgeuno.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: dc00632d-0d3c-4128-6061-08d941c3319f x-ms-traffictypediagnostic: SJ0PR05MB8648: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fQiTZayZKmQuZv87y00QH3Yf187JqH5//Ukv3Rxx9JBpgxugXcswjwFKKKNMbeZ1f706cfyQoS78Q4MlIt/BciL00EIoqdd7jncGqmnc7hVYORe7Dbtw54iYj7NseSdP8CER+eAmKG32e+SYAgpn3C5yc8hyPYButA2i9GFxBfm8G1uxWLPGDNtbMQHdJI+pg/jg3wtOQWtVOpHL8sn+aUHJFHdxfGumz1d0ohuWMesIFKwwzbEyFD7t82mKlrQUWkIgITfK3xCco1mInrunDc8TKyfDQaOWQbKFK9eMNWg1/zyiFr7oP9vt0INvO3goKW4glQ6HRXzagUzl0w/7PxjNGkPkpYRXTSC73FIfscW95dVXL+4M0RPZ/XvZ6ROfmeEvBOOQn/x6XCMoAOTaO0QZhKJ77C92SDL3ocRC0u3+oC/AXa7n8nk5gWkY+GpJVszsJd+3D1YAl5R7qU/mqqdlJu5a+QPcm816yvgrMTXp8i58AhtAVpxLDgg8XDZzCxqz8iJNtVX6uOyWEpQGNp+zzOfgLnah8ry/HLRhb+hkDkyW/+6ksQ8cDtj9hjAuQ8EYxtwEttKVU3x5k41eMp7EZN6+o6a9HyACBRZ0BlAFfSAQitBIFIwQB2UgbdC7AGmDo4ott0Gep/1s7Gj7EQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY3PR05MB8578.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFS:(376002)(396003)(39840400004)(366004)(136003)(346002)(66946007)(4326008)(8936002)(71200400001)(2616005)(2906002)(66446008)(91956017)(44832011)(36756003)(66476007)(66556008)(186003)(110136005)(6506007)(64756008)(76116006)(38100700002)(478600001)(122000001)(54906003)(86362001)(316002)(5660300002)(4744005)(83380400001)(6486002)(8676002)(6512007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?eXpuV3dBdDhmSkVJZE5yNzgxamZyWkxqOVNhdWtTb21JMHJxWU56d1RCa2Fm?= =?utf-8?B?cThqcDBUaTg1QW9iSlZMUzlaQVdHbWQ1dEdlOGVGbElyUDF5K09PV3dnN2dy?= =?utf-8?B?VUF1cGIvempsQ0YzTzU3clE0eFdqS3FpWk1tNDFlSmFVZmFpUk9aUlJ4OWFx?= =?utf-8?B?cHk3YjFrbm9LZnlvQnQwWHcrRTg5aUNxdXZvc0JNbUFuY2NVY0hLWTJNK2Fw?= =?utf-8?B?RGlUNG0yUUZXVklCK3lkSXlnVnpaTStsSkI0NXhNd3p3SDA5VXhUbllDUUwz?= =?utf-8?B?REJ3YjNtZUhlWVYxUlRUZ29tcENwREg4cEhhTDBUbis3REN0R1FIcGloT0pU?= =?utf-8?B?elZIdWxSS09ERnNYUDhSRlF2eFlDcys3dlF1cEJSVmpYV2JrL0dLaVlIWnVv?= =?utf-8?B?SU1yTG04cVFWNFVJRnNaaWpiNDFPanpNL1RXWjVQZndsUzNMUk85WC9Wenhy?= =?utf-8?B?Y3NGTnhpb1Azc3dQNUdReXZFdEhGbG5zWW8yNFVhN3d6U01GUXFPTXRxWW8v?= =?utf-8?B?MlF1N2t1V1ZjaEkyWUxOQ0ovYTRUZkUzeWNUZGJLdWdWaFI5cnBXQkQ0cTd4?= =?utf-8?B?bitXQjBxYkRLcGEwK25FaVJVRnZmWjJSZEh3cUZQUHVZWVF5eXpROUpBTnFB?= =?utf-8?B?NHN0SGF4SmxzYTBUK3hpcExyQTJKR09zNFJZdFlUWm9CYm10SXpPTFpvN2tV?= =?utf-8?B?akNQWFdQemtuZDcrdHFzbjBqRXhkclFHMFZOcDVmNUNFRUF5dUdjZ2MyZTkx?= =?utf-8?B?WW9uZE9YU0RvQVVuT0hpNHM1UWhERTJla2NScnpkYzdUK0VUQ2dXQUZGclZu?= =?utf-8?B?MmdYU2FmcW1zbERCUzNXUUkzVFZMU0FTOWErQy9Td3lBd0dOd09IVWtrNnZO?= =?utf-8?B?QjJicGJDRUowK2VRQ011ZzkxR1ZpMWVhbjRoMTlGSGFMdlQ4MUgzRVJlVUlW?= =?utf-8?B?N1lTclYzSW1lZG1NbEljdjhReUVjSisvaXp4MkZOV3JXK05FRjIzMTY2MFRE?= =?utf-8?B?eEhFTFdVKzUzUk9SY3BZMW9WcStYdDJuai9iWk9VY1pWemtjUEh2dmI3Wm1m?= =?utf-8?B?ejFXL3M0R3l6ODZaOGg3ekhoR0JWR1FBN29GMXpTWnk4MTZ0bGl3b3M0YTA0?= =?utf-8?B?OVhoNEFRNVgyb2psZzgwdG82VW5qcE5hZ1BkZHpyOFV3RnM5clRRUmZLd29C?= =?utf-8?B?OWJBODRLUFhocDc5TnZJdzZ3eUUvVGxWcVUxTkxSSnAvYXJhSlRMMWt1dHdU?= =?utf-8?B?ZURCYjQxSFM5K2JkSkt6VTd1dVRTOXNYL1pSQ1Bib0dJZWRCTUdCdDlUbFhy?= =?utf-8?B?NVNCV2Q5ZC9mMDdnNWh1bm56cWxMUzdqbEJFd0V4TGIxQkhlOGE5dFR4d1lN?= =?utf-8?B?OGxOUUJGQXNOOU1ZTkVDUks1SWk2T0I3MlpBcEluK0NMcmlOTGU4cVpNbURk?= =?utf-8?B?SHBGOXIvRFJRVytTdW1CQ21QcFZoQXorL0ppUmVuckhZUXhaV1BxdTdPTUow?= =?utf-8?B?aStHS3lRUVlQcW1ScWZtNFp6UGZ2SVIwTVVMbW55ZWYrZmFsZlVWNi9wbjZm?= =?utf-8?B?UG5YYUtPaWo1NHJ5Y1U1bENmZk8rYXlsS3hvdW5LaG1DVHJYc21Iekd1Sk5R?= =?utf-8?B?UGJSZUNQMkFjRXJEWUQrcXphV0hpSk9qSFFMYlhudE0wc1VYVSsxOEh5Zmxr?= =?utf-8?B?ZVhmTldNR1c5azJScnROMExQRU05azF6SkJLUGpocVVaaHRzVzhjSzI2dkVS?= =?utf-8?B?YnhQSzRqU2FnNDdqQUVmbi90SFZEU3VjeWhoK0VIdU5yWU8xRTlsRURYaGFp?= =?utf-8?B?M1h1bFlpMzhwOGIxdmNxbjB5bVJGajlTdHplMW02V29UcTVsWmx5OElqaVRo?= =?utf-8?Q?QKFhiW0voQWtD?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <4044FFB14C7107409F71A0CC0DE5C666@namprd05.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: edgeuno.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY3PR05MB8578.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: dc00632d-0d3c-4128-6061-08d941c3319f X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Jul 2021 03:48:05.4023 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 20879dba-fabf-45da-8300-60b8ce560217 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: O7GEAV0oKTMTZeDesq5/rJ0EaCWmnoyUfOA76Iopl8nIp7SBCVLkvrljg9mkv7HtHxzSXuDMJi3oBd7WHmCyJxGeJpNHnF6NSwFsx4Bi/FM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR05MB8648 Archived-At: Subject: Re: [OPSEC] Erik Kline's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Jul 2021 03:48:11 -0000 SGVsbG8sIEJlbiwNCg0KT24gV2VkLCAyMDIxLTA3LTA3IGF0IDE5OjAwIC0wNzAwLCBCZW5qYW1p biBLYWR1ayB3cm90ZToNCj4gT24gV2VkLCBKdW4gMzAsIDIwMjEgYXQgMTA6MDM6NDhQTSAtMDcw MCwgRXJpayBLbGluZSB2aWEgRGF0YXRyYWNrZXINCj4gd3JvdGU6DQo+ID4gW1M0LjMuOS40XSBb Y29tbWVudF0NCj4gPiANCj4gPiAqIEl0IHNlZW1zIGZhaXJseSBjbGVhciBmcm9tIFJGQyA1NTcw IFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHRoYXQNCj4gPiBhDQo+ID4gICBDQUxJUFNPIG9wdGlv biBpcyBiZXN0IHByb3RlY3RlZCB3aXRoIGFuIEFILCBhbmQgaW4gc3VjaCBjYXNlcw0KPiA+IHN0 cmlwcGluZw0KPiA+ICAgdGhlIENBTElQU08gb3B0aW9uIHdvdWxkIGNhdXNlIHRoZSBwYWNrZXQg dG8gZmFpbCB2YWxpZGF0aW9uIGF0DQo+ID4gdGhlDQo+ID4gICAoc3VpdGFibHkgY29uZmlndXJl ZCkgZGVzdGluYXRpb24uDQo+ID4gDQo+ID4gICBTaW1pbGFybHksIGl0IG1pZ2h0IGJlIGdvb2Qg dG8gbm90ZSBpbiBTNC4zLjkuNSB0aGF0IGlmIGFuIEFIIGlzDQo+ID4gcHJlc2VudA0KPiA+ICAg cHJlc3VtYWJseSB0aGUgYWR2aWNlIGZyb20gUzMuNC41LjUgYXBwbGllcy4NCj4gDQo+IFByb2Jh Ymx5IG5vdCB2ZXJ5IHJlbGV2YW50IGhlcmUsIGJ1dCB0aGUgY3VycmVudCBJUFNFQ01FIGFkdmlj ZSBpcyB0bw0KPiB1c2UNCj4gRVNQIHdpdGggbnVsbCBlbmNyeXB0aW9uIHJhdGhlciB0aGFuIEFI Lg0KDQpBIHBvaW50ZXIgbWlnaHQgYmUgd29ydGggaW5jbHVkaW5nLiBXaGF0IGRvY3VtZW50IGFu ZCBzZWN0aW9uIHNob3VsZCB3ZQ0KYmUgcmVmZXJlbmNpbmcgaGVyZT8NCg0KVGhhbmtzIQ0KDQpS ZWdhcmRzLA0KLS0gDQpGZXJuYW5kbyBHb250DQpEaXJlY3RvciBvZiBJbmZvcm1hdGlvbiBTZWN1 cml0eQ0KRWRnZVVubywgSW5jLg0KUEdQIEZpbmdlcnByaW50OiBERkJEIDYzRTMgQjI0OCBBRTc5 IEM1OTggQUYyMyBFQkFFIERBMDMgMDY0NCAxNTMxDQoNCg0KDQoNCg== From nobody Wed Jul 7 21:00:54 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40FC73A1251; Wed, 7 Jul 2021 21:00:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x9b7RGGvKi7E; Wed, 7 Jul 2021 21:00:46 -0700 (PDT) Received: from mail-oo1-xc31.google.com (mail-oo1-xc31.google.com [IPv6:2607:f8b0:4864:20::c31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF8533A127A; Wed, 7 Jul 2021 21:00:45 -0700 (PDT) Received: by mail-oo1-xc31.google.com with SMTP id p22-20020a4a3c560000b0290256475d95fbso1060971oof.12; Wed, 07 Jul 2021 21:00:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MqIvBNjh2vD2ep3WncXzzMnaWY/QVdMSK1hHyAVxNe4=; b=Kp0C8ops3UyR9i9POKaxMizzOYAK0q8ll3HJWPsmmjAmMUhULP+jGPCOvLKk/6TINR hM9bcCs+gXmdOZS7XjKaC6qUjMHuUmHB80iRQMzFS5NpfS3L2wbs9oXBlYaUoS54IO2F k/2xlk75qyoP/ynpbjbYE8dmdJ5pd2NZO2EUrTRYSaSG04U60B6RfAPX97VAMIIvdjKE X/TchK3rVGvJLBrHx8qYGmfSmja7S3myjT5FNb18SKqzjAJSz2awbxroCNLCSYNtbyaH y2XAg0jT625OxvNVoSO7giptsPRez94qXmLM7ldiJx/nVNv+3v2xVS624C6rUYIVCScU QkIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MqIvBNjh2vD2ep3WncXzzMnaWY/QVdMSK1hHyAVxNe4=; b=b47mEt4eboCMIe7iCXd/IOP6EIVK9tRVidW1y1ehhc6F/pVqC9MyTpYsSkr5lm6cSa HqyaHkXHb5lCvJb4qFSfHIMwL3LlzUZamjA7wgg0uHBR9nmAjfILHzWu4qBIpLEtmYGH CkK2rrrHwN/Wmto5CcFxh0ODburQaUyz+yFP1MMWMGhBLQjjbwvEDOvAUtbeFp0uU3jr jlEtipK/PLVp7MR9VJMt/nizO3EsAGKkwKFqapNa9jxX8CanPf4NPRLhqebc/GQ8h9Dp 5eS6c1Xkw/wn4RmiK6LGNK3eHh9/rbnjnIxmbgkRB/ty8IGLuGzYu4gKda7pAXazehpL Y60Q== X-Gm-Message-State: AOAM532UefXFlwBm93b2RcaL/8nkzy4jRHB5FUwJ6P+df1b3ov7xbaZq /hgrhjHpQSZpIj3J/IlmYoUerA1QfrO6CzBN3dZO1mRU X-Google-Smtp-Source: ABdhPJzmB9anPvU3knG8gY81k716RSv+wXJ/yR9Lx8DOuhyAF+lEWE3V8Tf+gfeQ5XWZw3lvqVAakRbjYCMAbxQnCPI= X-Received: by 2002:a4a:8901:: with SMTP id f1mr21082706ooi.66.1625716843853; Wed, 07 Jul 2021 21:00:43 -0700 (PDT) MIME-Version: 1.0 References: <162511582896.10745.1599530578040574909@ietfa.amsl.com> <20210708020020.GA17170@mit.edu> In-Reply-To: <20210708020020.GA17170@mit.edu> From: Erik Kline Date: Wed, 7 Jul 2021 21:00:33 -0700 Message-ID: To: Benjamin Kaduk Cc: The IESG , opsec@ietf.org, opsec-chairs@ietf.org, "Eric Vyncke (evyncke)" , draft-ietf-opsec-ipv6-eh-filtering@ietf.org Content-Type: multipart/alternative; boundary="000000000000fbbab305c694b2db" Archived-At: Subject: Re: [OPSEC] Erik Kline's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Jul 2021 04:00:49 -0000 --000000000000fbbab305c694b2db Content-Type: text/plain; charset="UTF-8" On Wed, Jul 7, 2021 at 7:00 PM Benjamin Kaduk wrote: > On Wed, Jun 30, 2021 at 10:03:48PM -0700, Erik Kline via Datatracker wrote: > > [S4.3.9.4] [comment] > > > > * It seems fairly clear from RFC 5570 Security Considerations that a > > CALIPSO option is best protected with an AH, and in such cases > stripping > > the CALIPSO option would cause the packet to fail validation at the > > (suitably configured) destination. > > > > Similarly, it might be good to note in S4.3.9.5 that if an AH is > present > > presumably the advice from S3.4.5.5 applies. > > Probably not very relevant here, but the current IPSECME advice is to use > ESP with null encryption rather than AH. > My (mis)understanding was that this was mostly because of NAT/NAPT. Is there some benefit of this recommendation that applies when NAT/NAPT doesn't apply (/me looks at IPv6). --000000000000fbbab305c694b2db Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 7, 2021 at 7:00 PM Benjamin K= aduk <kaduk@mit.edu> wrote:
<= /div>
On Wed, Jun 30, 2021 at 10:03:48PM -0700, Erik Kline via Datatracker= wrote:
> [S4.3.9.4] [comment]
>
> * It seems fairly clear from RFC 5570 Security Considerations that a >=C2=A0 =C2=A0CALIPSO option is best protected with an AH, and in such c= ases stripping
>=C2=A0 =C2=A0the CALIPSO option would cause the packet to fail validati= on at the
>=C2=A0 =C2=A0(suitably configured) destination.
>
>=C2=A0 =C2=A0Similarly, it might be good to note in S4.3.9.5 that if an= AH is present
>=C2=A0 =C2=A0presumably the advice from S3.4.5.5 applies.

Probably not very relevant here, but the current IPSECME advice is to use ESP with null encryption rather than AH.

My (mis)understanding was that this was mostly because of NAT/NAPT.=C2=A0= Is there some benefit of this recommendation that applies when NAT/NAPT do= esn't apply (/me looks at IPv6).
--000000000000fbbab305c694b2db-- From nobody Tue Jul 13 03:55:32 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CFB03A135F; Tue, 13 Jul 2021 03:55:26 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Alvaro Retana via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, evyncke@cisco.com X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Alvaro Retana Message-ID: <162617372562.1517.9358558617176628464@ietfa.amsl.com> Date: Tue, 13 Jul 2021 03:55:26 -0700 Archived-At: Subject: [OPSEC] Alvaro Retana's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2021 10:55:26 -0000 Alvaro Retana has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- (1) §2.3: Using normative language in listing the requirements from rfc7045 is not appropriate without quotes, to make it clear where the rfc2119 keywords come from. Also, the text is not exactly what rfc7045 says; for example, the last bullet uses "should" while the original text says "SHOULD". (2) [nit] §3.4.1.2: The list of currently-defined options seems unnecessary given that no type-specific recommendation is made. [Similar comments apply to other lists.] (3) §3.4.1.5: "...for obvious reasons, RPL...[RFC6550] routers must not discard packets based on the presence of an IPv6 Hop-by-Hop Options EH." The reason may not be obvious to everyone -- also, rfc6553 may be a better reference in this case. (4) §3.4.2.3/§3.4.2.4: Not all routing headers receive the same treatment. For example, RHT4 is mentioned when talking about both the implications and impact, while RHT3 is not mentioned at all. Consistent treatment would be nice. (5) [nit] §4.3.3.5: Intermediate systems should discard packets that contain this option. An operator should permit this option only in specific scenarios in which support for IPv6 jumbograms is desired. The advice in this case would be complete if only the second sentence is included. (6) §4.3.4.4: s/(e.g. at an ISP)/outside the RPL instance (7) §4.3.5.4: "This option is meant to survive outside of an RPL instance." The option can survive outside the LLN, but as rfc9008 says, the "intention was and remains that the Hop-by-Hop Options header with a RPL Option should be confined within the RPL domain". Suggestion> This option can survive outside of an RPL instance. From nobody Tue Jul 13 05:46:44 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 402B23A0927; Tue, 13 Jul 2021 05:46:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Lars Eggert via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Lars Eggert Message-ID: <162618040324.12999.8725328522603048781@ietfa.amsl.com> Date: Tue, 13 Jul 2021 05:46:43 -0700 Archived-At: Subject: [OPSEC] Lars Eggert's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2021 12:46:43 -0000 Lars Eggert has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- This is mostly a personal style issue, but I find large parts of the document hard to read, because of a myriad of very short (1-2 line) subsections, each with their own repetitive section heading. Section 2.3. , paragraph 7, comment: > We recommend that configuration options are made available to govern > the processing of each IPv6 EH type and each IPv6 option type. Such > configuration options should include the following possible settings: Out of curiosity, is there a reason a "strip option and forward packet" isn't one of the options below? Section 3.2. , paragraph 2, comment: > In some device architectures, IPv6 packets that contain IPv6 EHs can > cause the corresponding packets to be processed on the slow path, and > hence may be leveraged for the purpose of Denial of Service (DoS) > attacks [I-D.ietf-v6ops-ipv6-ehs-packet-drops] [Cisco-EH] > [FW-Benchmark]. Do such device architectures really still exist in 2021? The [Cisco-EH] reference is from 2006, and the URL in [FW-Benchmark] does not seem to return content. ([I-D.ietf-v6ops-ipv6-ehs-packet-drops] seemed to only refer to those two references as well.) Section 3.4.1.2. , paragraph 2, comment: > This EH is specified in [RFC8200]. At the time of this writing, the > following options have been specified for the Hop-by-Hop Options EH: Wouldn't a pointer to the respective IANA registry suffice here, rather than a list that is going to be inaccurate with time? (And reading on, I see that other subsections contain similar "at the time of this writing" lists; I would suggest replacing them all with pointers to the respective registries.) Document has Informational status, but uses RFC2119 keywords. Found terminology that should be reviewed for inclusivity; see https://www.rfc-editor.org/part2/#inclusive_language for background and more guidance: * Term "his"; alternatives might be "they", "them", "their". * Term "traditional"; alternatives might be "classic", "classical", "common", "conventional", "customary", "fixed", "habitual", "historic", "long-established", "popular", "prescribed", "regular", "rooted", "time-honored", "universal", "widely used", "widespread". ------------------------------------------------------------------------------- All comments below are about very minor potential issues that you may choose to address in some way - or ignore - as you see fit. Some were flagged by automated tools (via https://github.com/larseggert/ietf-reviewtool), so there will likely be some false positives. There is no need to let me know what you did with these suggestions. Section 4.3.3.1. , paragraph 2, nit: > This option is meant to survive outside of an RPL instance. As a result, di > ^^^^^^^^^^ This phrase is redundant. Consider using "outside". Section 4.3.8.4. , paragraph 2, nit: > n intermediate system can know whether or not that particular intermediate s > ^^^^^^^^^^^^^^ Consider shortening this phrase to just "whether". It is correct though if you mean "regardless of whether". Document references draft-ietf-v6ops-ipv6-ehs-packet-drops-06, but -08 is the latest available revision. Obsolete reference to RFC2460, obsoleted by RFC8200 (this may be on purpose). These URLs in the document did not return content: * http://www.ipv6hackers.org/meetings/ipv6-hackers-1/zack-ipv6hackers1-firewall-security-assessment-and-benchmarking.pdf These URLs in the document can probably be converted to HTTPS: * http://www.cisco.com/en/US/technologies/tk648/tk872/technologies_white_paper0900aecd8054d37d.pdf * http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml * http://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml From nobody Tue Jul 13 06:23:44 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7528F3A0DDE; Tue, 13 Jul 2021 06:23:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Roman Danyliw via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Roman Danyliw Message-ID: <162618261483.23262.1123677167769417679@ietfa.amsl.com> Date: Tue, 13 Jul 2021 06:23:35 -0700 Archived-At: Subject: [OPSEC] Roman Danyliw's Discuss on draft-ietf-opsec-ipv6-eh-filtering-08: (with DISCUSS and COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2021 13:23:43 -0000 Roman Danyliw has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- DISCUSS: ---------------------------------------------------------------------- Can the principled approach to making these recommendations be more clearly explained and documented? Section 3 primarily establishes a two-option filtering regime (drop vs. permit), but Section 4 seems to provide more nuance with a three-option filtering regime which considers the needs of the network (drop vs. drop if functionality not needed vs. permit). As an aside, a fourth filtering action of removing the options is presented in Section 4.3.9.4. Additionally, see the comment below which has a summary table for recommendations in Section 4 analogous to Table 1 of Section 3 to allow side-by-side comparisons. Was the three-option filtering regime considered for all recommendations? For example, Section 4.3.7.5 , Router Alert (Type=0x05) recommends permitting this option “in environments where support for RSVP, multicast routing, or similar protocols is desired.” (i.e., “drop if functionality is not needed”). However, Section 3.4.8, HIP (Protocol Number=139) recommend categorically permitted these packets. If an operator knows that HIP is not a technology they have a desire to use in an environment, why shouldn’t they block it (just like was suggested for Router Alerts)? Consideration for conditional discard based on local needs seems appropriate for Shim6, Mobility Header, HIP, ILNP Nonce, Tunnel Encapsulation, and all RPL options if the goal is to minimize traffic which has to go on the slow path. I read in the shepherd’s write-up that trade-offs were made to minimize ossification. However, that rationale is not apparent in the text. ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- ** Section 1. Per “Recent studies (see e.g. [RFC7872) …”, is there an updated study to reference to support the thesis that widespread dropping of IPv6 packets with extension headers is happening? RFC7872 is based on data sets from 2014 and 2015. ** Section 1. While some operators "officially" drop packets that contain IPv6 EHs, it is possible that some of the measured packet drops be the result of improper configuration defaults, or inappropriate advice in this area. -- What does the word officially in quotes mean? -- Is there any reference that supports the assertion of improper configuration defaults? -- who is providing inappropriate advice? ** Section 1. The text calls out the use of “deny-lists” by transit networks and “accept-lists” that are “enforced closer to the destination systems”. Is there any indication that the networks which originate the traffic are doing filtering of outbound traffic? ** Section 2.1 Per “… and irrespective of whether the specific filtering action is logged”, no issues with making this distinction. However, it seems out of place since none of the previous text said anything about logging as a discriminator among the permit, drop or reject actions. ** Section 2.3. This section seems mistitled as “Conventions”. The text appears to be describing assumptions for nodes and how the guidance will be used. ** Section 3.2. Per the cited references: -- [FW-Benchmark]. This associated URL returned a 404 error for me (http://www.ipv6hackers.org/meetings/ipv6-hackers-1/zack-ipv6hackers1-firewall-security-assessment-and-benchmarking.pdf) -- [Cisco-EH]. This document was last updated in 2006. Are the design descriptions it captures still accurate? ** Section 4. Table 1 summarized the recommendations of Section 3. A similar table would be helpful for the recommendations of this section. For example: +----------------------------+--------------------------+-----------+ | Option | Filtering policy | Reference | +----------------------------+--------------------------+-----------+ | Pad1 | Permit | Section | | (Type=0x00) | | 4.3.1 | +----------------------------+--------------------------+-----------+ | PadN | Permit | Section | | (Type=0x01) | | 4.3.2 | +----------------------------+--------------------------+-----------+ | Jumbo Payload | Permit based on | Section | | (Type=0xC2) | needed functionality | 4.3.3 | +----------------------------+--------------------------+-----------+ | RPL Option | Router-specific filter | Section | | (Type=0x63) | | 4.3.4 | +----------------------------+--------------------------+-----------+ | RPL Option | Permit | Section | | (Type=0x23) | | 4.3.5 | +----------------------------+--------------------------+-----------+ | Tunnel Encapsulation Limit | Permit | Section | | (Type=0x04) | | 4.3.6 | +----------------------------+--------------------------+-----------+ | Router Alert | Permit based on | Section | | (Type=0x05) | needed functionality | 4.3.7 | +----------------------------+--------------------------+-----------+ | Quick Start | Permit | Section | | (Type=0x26) | | 4.3.8 | +----------------------------+--------------------------+-----------+ | CALIPSO | Permit based on | Section | | (Type=0x07) | needed functionality | 4.3.9 | +----------------------------+--------------------------+-----------+ | Home Address | Permit | Section | | (Type=0xC9) | | 4.3.11 | +----------------------------+--------------------------+-----------+ | Endpoint Identification | Drop | Section | | (Type=0x8A) | | 4.3.12 | +----------------------------+--------------------------+-----------+ | ILNP Nonce | Permit | Section | | (Type=0x8B) | | 4.3.13 | +----------------------------+--------------------------+-----------+ | Line-Identification | Drop | Section | | (Type=0x8C) | | 4.3.14 | +----------------------------+--------------------------+-----------+ | Deprecated | Drop | Section | | (Type=0x4D) | | 4.3.15 | +----------------------------+--------------------------+-----------+ ... ** Section 7. The text doesn’t seem to make a statement about security beyond reiterating the intent of the document. Does adopting the practices in this document improve the security posture of the network? Are there any new security considerations to consider if these practices are adopted? ** Editorial -- Section 2.3. Editorial. Per the paragraph that starts with “Finally, we note that …”, this guidance seems very similar (repetitive) to the explanation already provided in Section 2.1. -- Section 3.2. Editorial. s/decisions in future/decisions in the future/ -- Section 4.3.9.5. Editorial. Recommend removing the unique “RFC-5570” style notation. From nobody Wed Jul 14 07:21:13 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 60E553A1A38; Wed, 14 Jul 2021 07:21:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Robert Wilton via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Robert Wilton Message-ID: <162627246688.2550.633739475665083091@ietfa.amsl.com> Date: Wed, 14 Jul 2021 07:21:07 -0700 Archived-At: Subject: [OPSEC] Robert Wilton's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jul 2021 14:21:08 -0000 Robert Wilton has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Hi, Thanks for this document, it is useful to try and tame how SPs are filtering IPv6 extension headers. However, I did find some of this document somewhat surprising in the context of RFC 8200, and this is perhaps just my naivety on how it is actually deployed: My reading on RFC 8200 extension headers can be summarized as: - Hop by hop options default to being off unless you enable them. - Other extension headers only have relevance once the packet reaches the destination node, and hence I would have thought that all transit nodes should by default just ignore them. Given that this document is specifically only for transit nodes where the packets are not destined to them, I was expecting a summary along the lines of: - Ignore hop by hop options unless they protocols in the transmit domain are making use of them. - Allow, and ignore, all other extension headers. Maybe filter RH types 0 and 1 because they should not be used, but even this processing could be left until the destination node. My slight fear with the current draft is that it makes this all seem very complicated and protocol specific which possibly might encourage ISPs to just drop all packets using EHs. Regards, Rob From nobody Wed Jul 14 07:30:34 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72E7F3A1AE6; Wed, 14 Jul 2021 07:30:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.596 X-Spam-Level: X-Spam-Status: No, score=-9.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=h0Xt8MGD; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=luCaSI/x Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id df1SySqucZeY; Wed, 14 Jul 2021 07:30:28 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2E9B3A1AE3; Wed, 14 Jul 2021 07:30:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4086; q=dns/txt; s=iport; t=1626273028; x=1627482628; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=2b9UAmNTLrz9gaepaW52QjcFKEPD1LhcRDXRKhGlxCw=; b=h0Xt8MGDKUtMAoxzlbTv7csqXd2DJ2q2z9rfeChZbq88wJQT41ZHemCy K6a8zVhngsK6J/YL8UrissdUvHrrRfKU5FJqgqV6lqCX5KtLscAtl2le/ /hsyotp/vy/ZAUBacDXoHn6eIr8ribrZJ1Tuy2YQEg7mc7rgfOBhJqkPx U=; X-IPAS-Result: =?us-ascii?q?A0BcAwCR9O5gl5hdJa1aHgEBCxIMQIMsIy5+WjcxhEiDS?= =?us-ascii?q?AOFOYhbA5otgUKBEQNUCwEBAQ0BATUMBAEBhFQCF4JiAiU4EwIEAQEBAQMCA?= =?us-ascii?q?wEBAQEFAQEFAQEBAgEGBBQBAQEBAQEBAWiFaA2GRQEBAQQSEREMAQExBgELB?= =?us-ascii?q?AIBCBEDAQIDAiYCAgIwFQgIAgQBDQUigk8BglUDLwEOmz4BgToCih96gTKBA?= =?us-ascii?q?YIHAQEGBASBSUGDSRiCMgMGgRAqgnuEDoJog3onHIFJRIEVJxyCYj6CYgIBA?= =?us-ascii?q?oEoARIBIYMXNoIug1cmBCIZFgIEexIHUxeSIoNCp3wKgySKNI4lhV0FJoNji?= =?us-ascii?q?1yXHJYHjDCTVh6EYQIEAgQFAg4BAQaBciJrWBEHcBVlAYI+UBkOjh8MDQkVg?= =?us-ascii?q?zmFFIVKcwI2AgYBCQEBAwmLfgEB?= IronPort-PHdr: A9a23:5ly4GBeZNm98H7dPncF4KlU+lGM/r4qcDmcuAtIPgLNVeaPl9JPnb wTT5vRo2VnOW4iTq/dJkPHfvK2oX2scqY2Av3YPfN0pNVcFhMwakhZmDJuDDkv2f/XrdCc9W s9FUQwt83SyK0MAHsH4ahXbqWGz6jhHHBL5OEJ1K+35F5SUgd6w0rW5+obYZENDgz/uCY4= IronPort-HdrOrdr: A9a23:8MZo2a7KLABk7iaRQAPXwZ6CI+orL9Y04lQ7vn2ZFiY1TiXIra 6TdaoguiMc0AxhJ03Jmbi7Sc69qeu1z+833WBjB8bdYOCAghrrEGgC1/qj/9SEIU3DH4FmpN xdmsRFebjN5B1B/LrHCWqDYpMdKbu8gdqVbI7lph8HJ2wHGsIQjTuRSDzrb3GeLzM2Y6bRYa Dsnvav0ADQAEj/AP7LYkUtbqzmnZnmhZjmaRkJC1oM8w+Vlw6l77b8Dlyxwgoeeykn+8ZnzU H11yjCoomzufCyzRHRk0XJ6Y5NpdfnwtxfQOSRl8kuLCn2gArAXvUnZ1TChkFynAic0idzrD D+mWZ6Ay210QKKQoiBm2q15+An6kdy15at8y7FvZKpm72JeNtzMbswuWseSGqH16Ll1+sMgZ 6iGAmixsRq5Fr77VbAD5KjbWAYqmOk5XUliuIdlHpZTM8Xb6JQt5UW+AdPHI4HBz+S0vFpLA BCNrCQ2B9tSyLXU5kZhBgn/PW8GnAoWhuWSEkLvcKYlzBQgXBi1kMdgMgShG0J+p4xQ4RNo7 2sCNUoqJheCssNKa5tDuYIRsW6TmTLXBLXKWqXZVDqDrsONX7Bo4P+pL81+OapcpoVy4Zaou WObHpI8WopP07+A8yH25NGthjLXWWmRDzojtpT4pBo04eMDoYD8RfzA2zGtvHQ1cn3LverL8 pbCagmS8MLd1GebLqh9zeOLKVvFQ== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.84,239,1620691200"; d="scan'208";a="744221074" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 14 Jul 2021 14:30:26 +0000 Received: from mail.cisco.com (xbe-rcd-007.cisco.com [173.37.102.22]) by rcdn-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id 16EEUQJh011892 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Wed, 14 Jul 2021 14:30:26 GMT Received: from xfe-rcd-005.cisco.com (173.37.227.253) by xbe-rcd-007.cisco.com (173.37.102.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Wed, 14 Jul 2021 09:30:26 -0500 Received: from xfe-rcd-001.cisco.com (173.37.227.249) by xfe-rcd-005.cisco.com (173.37.227.253) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Wed, 14 Jul 2021 09:30:25 -0500 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (72.163.14.9) by xfe-rcd-001.cisco.com (173.37.227.249) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15 via Frontend Transport; Wed, 14 Jul 2021 09:30:25 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oAA+Cgnk1O4nn2d+WVKOevOv5/89x+Xe65QKN9sfLfjuLckEwxm6LMmege9pXw2LNvVKK4ncLufN7R2xqy/nNZ53ACPtJqo762k3f2x8MqBIX2EnxWpds0G8WPys4wTxJZnfULLbUgmrgWIXsz7Hqqrl7wDjqsCFfJjD6P0ZGf0UhuubRdYKzbSdABAae0zC1nQdM0wRuiBAKMg2kC2k2UwHZ99m16z/gLZx9VxWmLhuyaRBMB906ElDzUjunXLrGi1bufr6nFKZp7fGhAWCHGc3xrbh31P1O8Wrjl1WdNuOkrGF4sc+z/06FsgljYpIqGwfacstbo36/DhyRCoOKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2b9UAmNTLrz9gaepaW52QjcFKEPD1LhcRDXRKhGlxCw=; b=gtrm957VgpHh9LYeYAw1x7Hrbz/ptHVOToEBEHaKpJb6jyWnptLj6ho+A/es5P5CEYAjRTCLEVf++L+nxEX9reP+Fe9ia+ZycVwoN5Yo1xYlrH1wqYNBfqkpyJnJ9Hqr6qK5BUWGjy/ZhRx+T/P6x5hAYXQL/6T4EK3SXssdx0Zicuhnf2nD7pKduCEL+LCkCi8VQh3R8N++Z8AS+G2aXS7Zd+Bn1kdxrIuQ1bKQxMF+pVdPKHbOHxUX7/es5Os7Zv1K10CeN5RXWOiVPhdm2MklHNzQ8iB2yusfStG1z2VncIYYNIGfEtL3TMjwS99cdn4cMJwG9ZgnFlb/ApG3mw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2b9UAmNTLrz9gaepaW52QjcFKEPD1LhcRDXRKhGlxCw=; b=luCaSI/xg5cL4NNIpVmsWZMYD7/2RcyCw9sxlI8OqXR1O6qUHfdSKceQAAtmscChRV6Bw0O1Jg+VW6NgTO5tZVg5ksUVNaI9/n8R9qJEdDKorZvESqQJ9uywm/CHaA4y2j1lXJY9U5QMOy1z5OaUGEayApC2YawJzujw4g1+034= Received: from PH0PR11MB4966.namprd11.prod.outlook.com (2603:10b6:510:42::21) by PH0PR11MB5174.namprd11.prod.outlook.com (2603:10b6:510:3b::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.22; Wed, 14 Jul 2021 14:30:24 +0000 Received: from PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::6d61:c160:def1:bc64]) by PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::6d61:c160:def1:bc64%4]) with mapi id 15.20.4308.027; Wed, 14 Jul 2021 14:30:24 +0000 From: "Eric Vyncke (evyncke)" To: "Rob Wilton (rwilton)" , The IESG CC: "opsec@ietf.org" , "opsec-chairs@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" Thread-Topic: Robert Wilton's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) Thread-Index: AQHXeLuEanAzO6/lLEWypFJRzI/zNatCqZ+A Date: Wed, 14 Jul 2021 14:30:24 +0000 Message-ID: <636E8217-CE5C-4EFE-936A-8557BD06BBA9@cisco.com> References: <162627246688.2550.633739475665083091@ietfa.amsl.com> In-Reply-To: <162627246688.2550.633739475665083091@ietfa.amsl.com> Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.51.21071101 authentication-results: cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 17a68e08-ebcb-4516-f79f-08d946d3eaf2 x-ms-traffictypediagnostic: PH0PR11MB5174: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: P7O1Y3iIKIOZjw1QTHrqhEZ37KId7rHUBSd0wXMZy18SSFAcKiczARxw4Kdv4c3rDndHbiMkOBzBMUkCjvgyC675SIHVwuQReVduKMhUUHWQDMPRQLt34QQgKEh9d+iI+y7JuDKPaly4IHrOLb/yhdRLU8oL9iPQL9uu73QYa/xI7+Sj3nGuDsFGWZD/lOoWlQkFDUhCuhv2BIhWxEshpcQ8KBDfAcLWsz5c2eaOfMPBOR+k0wopuR8LvZNwxElKeW+5kJ7pEEZQ0Chs9HLPZz3IFIg5tvYdtald6uJJl14pDmSDcTW/2pAbnZy+hAPSZG5BCZxSCGlikY1iNGfqDKcde3kuJ218s+NknS/3Fvvb2IPexuVn5NLtkfjri/za+lHt4Zb2KT9mAOIbFmOlI6JBaNyvrTVMTLpdkocIQz/y1RRTDEX+WIz/GfpsMSvxh7ty0psJweTJyBE97oPnmdVcGVm7Cpmwp8bl7qI21wgf5mDXH6iWVI3aWlSvcLaXlhPMrN53bJ6xX/+eHBM25XxRh69lWC9D09YMAOiDGWKH3eEVWFzI47U9s02tTUh55oaiATYSye36uhsihGKKn1oyQaoby/3GRUr+hQ/BlH1Xhcm8lsEwKx3U+1F+Q/7V2WjCcc0gyzSr7f1OUwsoeGM4TJuX1j5GfHExcrU0QZA3W/v9VQzPWSddUUQZKAQju/WQTwLh//dJ84vZAI6gBFUlxwPAUVKy47RwiOiWD/v7Lmm+RdtJM8gU5hdXcuoQPxzTg/FxEsLbjC4UAguJEjp83QcDDFKszNebLI79jVn1GMy3HUbNXvvtYBWPlPEwWIvpaIofjrkbGS4Husaaqvs/JgSN/UL/0GXlTOGNVgs= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PH0PR11MB4966.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(376002)(396003)(39860400002)(366004)(346002)(136003)(316002)(2616005)(4326008)(33656002)(6486002)(6512007)(122000001)(2906002)(186003)(5660300002)(66574015)(86362001)(450100002)(66476007)(64756008)(966005)(53546011)(6506007)(66946007)(110136005)(76116006)(66446008)(478600001)(83380400001)(8676002)(66556008)(71200400001)(8936002)(54906003)(38100700002)(91956017)(36756003)(38070700004)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?bHJTZnBvSzRFQjFmTy9OS3JhYnJhaWxqYVZKZXVNZW5PTFRnWnEwNUFCYzNB?= =?utf-8?B?QUgvbmdtNG40MFNubVlyS0VqZG9WZlRtaVJ2SkpZMDFoWXVyUEpYaHJqdkQr?= =?utf-8?B?aHg5Z08rNVY5bTZkTGRwSGdPRng1QUtFTFlWa2N2V1JWNUpiTFVONU1nQVh2?= =?utf-8?B?Vm12NkJoZSs4SVlvV09kS0pQczYwYitSWXJpS2M0aTFUZmdTVy8zY3JtSEhh?= =?utf-8?B?aEZFb3E4em82OU12YVlEY1lSbXRUZUhlTHBmNlFGQTJSMVB6Ym5tNUg1dEEw?= =?utf-8?B?QlZFVTRBc0F0QktDVDRTZVl0R2hSYzZaVW15NllTT3QwQXdMN0R1dXVrV3lV?= =?utf-8?B?TkY4Skg5VHVNdXFtcFdCVDZTczNTbTJwZ3NtRmFlTmdUV3hpb20zeTFRNnpo?= =?utf-8?B?MjVhejNONFBiL1V4RnRmNGZKQ3IrTFZjcmlldVJuZEMyUWdldm5DRWZOOTFU?= =?utf-8?B?WUJZV1FVL1A3dGd1Um5mMkRkWlVoT2tmUWpHRURFOXlKWk1ZYmRibThtRkZB?= =?utf-8?B?ZW1MaXFlSkxGNE0rWFVaZXk3VS94Vm9jQ0ljeXlpSVBBZHJLbmpnTENOcitY?= =?utf-8?B?eXVPdDZvay9ReWRNZk5mdDVVbno2blNPWCtrV2hZWFpoS0dQK0RScFBTdUVw?= =?utf-8?B?UzVXT1dYb25lcjE2SmxUdUF4TFlNZGJGSXpMUktMOHhpVWhTdnVpNU5IajU4?= =?utf-8?B?ZFBreHFYbUxOanhGZ1A3dkEySW9nSUtQQjdsMzBtV1E0ajZKT0VoMGNzZUhF?= =?utf-8?B?cittUEJ3TEx6cEMvOXNRcXdjbEplRGZjRXNPK01kWXVOb0NqZS8vTFJjbDV2?= =?utf-8?B?RjZXaUpkRGJRS3FkWFA2SjdEVHNpYUJEOVBlM0dQbHRWcVZ3ZkJUSDdBRURL?= =?utf-8?B?TnV2RFVIdjkzVHo0QjVUSTA5TDRIUXI4akNHcmRLK2NnSDhtTVhWaXdPbmpU?= =?utf-8?B?cGp1ZlFCU0NJZU5pUCtKdGxqWEY2VjZKaVRvakM0NkNwRFhoNXlhREl6ZFdU?= =?utf-8?B?SXh1ejl0L1o1TElXbFBlRFdTdCtnSjNKOElOY1ZST1IzUnQwZzJNNnJ4WXNK?= =?utf-8?B?MHpPR1Q4SnIwVEs3MmZxUjNTcDRHc1ZvV3l2aVgxekdPYWlsbVo3b256ZnJF?= =?utf-8?B?RjU4a0YrNi8wUjBwcE92NWtBVEZFcyt0UGtFZGVyOVd4WFFaT1lvNHZZM1Ba?= =?utf-8?B?UnQ3Q3RGRTBPM1B2SjU3YWdmbDdpaWRYNFpYYWZmdkpiSjJlV3hMb3BOMjB0?= =?utf-8?B?cGxrNThJNnFDOG5LaTBBd1BHWHNPRUpXSkRkby90NVIwTVp6dk1sVC9lYTJF?= =?utf-8?B?cFY4UkUra2JGOTNXNDJZQXgxVTczc2pNa2dXdWpDYU9ZUGJuUUo5cStHMSth?= =?utf-8?B?VGpUY0djQndrSG1DMFBQc1UzN3d6eVhlQVAzdWJvRGhHeWhoQkdrL1RVemov?= =?utf-8?B?Nk8yaVdsR01XREoyNFFhM0MzMEhUVFRZdUhvbTJ3SnphRWhJaWJ4MTVjOFV4?= =?utf-8?B?dmFYZDBzdmthYmZTYnMyQ2RNaEdPbi9lVXJQNEdzRUtwa0tIM2pwWWlSeC9N?= =?utf-8?B?VXdPZmZqdkZCRTBJamlTaFhSN3NGa0RCS1ZubUQ2Rmg3eWdiMEx3TjNXL3ZU?= =?utf-8?B?UnBQRGNSQmdmOVYvZEN4dmdQOU1QUXE0RDRGMmZFdXVzdW9STm1iVW5ZZnFx?= =?utf-8?B?L3BXNE9LTGQ1akptREk1ZEtEcVdxZ3djSnA5ZW1jODd4REhMZFd3NlV3c01x?= =?utf-8?B?bS9CWitUSFVWOWg4TEdvZmc4THUvd0d5aHBvSjAybUp4dUpkL005RWd4N1By?= =?utf-8?B?NzlqS2ZZUXhBdnVzOFN0ZDFHQkFLaGMrN2FEN240MFpwbjQ2cE1JT1R3M2FO?= =?utf-8?B?NmlTc1FkV0xuUGtIY3RFV2pwQ3dCMDNkREMvaDNNak9CalE9PQ==?= Content-Type: text/plain; charset="utf-8" Content-ID: <3E92E3FDF51FCC48BD4DC3DD3355801E@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4966.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 17a68e08-ebcb-4516-f79f-08d946d3eaf2 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2021 14:30:24.1868 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: OfMxBLiGWCBpC8d8Vnd6pp3N8+Kovsds1FxcieukQFXak9UXfJzK0jVG4VkjrYlp/CMPG1XtgeKnJbQZ1z2kcg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5174 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.22, xbe-rcd-007.cisco.com X-Outbound-Node: rcdn-core-1.cisco.com Archived-At: Subject: Re: [OPSEC] Robert Wilton's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jul 2021 14:30:34 -0000 UmVwbHlpbmcgd2l0aCBteSBJUHY2ICArIHNoZXBoZXJkIGhhdHMNCg0KSW5kZWVkLCBJIGZhaWwg dG8gdW5kZXJzdGFuZCB3aHkgKnRyYW5zaXQqIFNQIGFyZSBkcm9wcGluZyBFSCAoYXMgb3Bwb3Nl ZCB0byBmaW5hbCBkZXN0aW5hdGlvbiByb3V0ZXIvZmlyZXdhbGwsIHdoaWNoIHNob3VsZCBkcm9w IHNvbWUgRUgpDQoNCkkgc2luY2VyZWx5IGhvcGUgdGhhdCB0aGlzIGRvY3VtZW50IHdpbGwgcmF0 aGVyICdvcGVuIHRoZSBnYXRlJyBhcyBzb21lIEVIIGFyZSByZWNvbW1lbmRlZCB0byBnbyB0aHJv dWdoDQoNCi3DqXJpYw0K77u/LS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IGllc2cg PGllc2ctYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFJvYmVydCBXaWx0b24gdmlhIERh dGF0cmFja2VyIDxub3JlcGx5QGlldGYub3JnPg0KUmVwbHktVG86ICJSb2IgV2lsdG9uIChyd2ls dG9uKSIgPHJ3aWx0b25AY2lzY28uY29tPg0KRGF0ZTogV2VkbmVzZGF5LCAxNCBKdWx5IDIwMjEg YXQgMTY6MjENClRvOiBUaGUgSUVTRyA8aWVzZ0BpZXRmLm9yZz4NCkNjOiAib3BzZWNAaWV0Zi5v cmciIDxvcHNlY0BpZXRmLm9yZz4sICJvcHNlYy1jaGFpcnNAaWV0Zi5vcmciIDxvcHNlYy1jaGFp cnNAaWV0Zi5vcmc+LCBFcmljIFZ5bmNrZSA8ZXZ5bmNrZUBjaXNjby5jb20+LCAiZHJhZnQtaWV0 Zi1vcHNlYy1pcHY2LWVoLWZpbHRlcmluZ0BpZXRmLm9yZyIgPGRyYWZ0LWlldGYtb3BzZWMtaXB2 Ni1laC1maWx0ZXJpbmdAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSb2JlcnQgV2lsdG9uJ3MgTm8gT2Jq ZWN0aW9uIG9uIGRyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmctMDg6ICh3aXRoIENP TU1FTlQpDQoNCiAgICBSb2JlcnQgV2lsdG9uIGhhcyBlbnRlcmVkIHRoZSBmb2xsb3dpbmcgYmFs bG90IHBvc2l0aW9uIGZvcg0KICAgIGRyYWZ0LWlldGYtb3BzZWMtaXB2Ni1laC1maWx0ZXJpbmct MDg6IE5vIE9iamVjdGlvbg0KDQogICAgV2hlbiByZXNwb25kaW5nLCBwbGVhc2Uga2VlcCB0aGUg c3ViamVjdCBsaW5lIGludGFjdCBhbmQgcmVwbHkgdG8gYWxsDQogICAgZW1haWwgYWRkcmVzc2Vz IGluY2x1ZGVkIGluIHRoZSBUbyBhbmQgQ0MgbGluZXMuIChGZWVsIGZyZWUgdG8gY3V0IHRoaXMN CiAgICBpbnRyb2R1Y3RvcnkgcGFyYWdyYXBoLCBob3dldmVyLikNCg0KDQogICAgUGxlYXNlIHJl ZmVyIHRvIGh0dHBzOi8vd3d3LmlldGYub3JnL2llc2cvc3RhdGVtZW50L2Rpc2N1c3MtY3JpdGVy aWEuaHRtbA0KICAgIGZvciBtb3JlIGluZm9ybWF0aW9uIGFib3V0IERJU0NVU1MgYW5kIENPTU1F TlQgcG9zaXRpb25zLg0KDQoNCiAgICBUaGUgZG9jdW1lbnQsIGFsb25nIHdpdGggb3RoZXIgYmFs bG90IHBvc2l0aW9ucywgY2FuIGJlIGZvdW5kIGhlcmU6DQogICAgaHR0cHM6Ly9kYXRhdHJhY2tl ci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1vcHNlYy1pcHY2LWVoLWZpbHRlcmluZy8NCg0KDQoN CiAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tDQogICAgQ09NTUVOVDoNCiAgICAtLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCiAg ICBIaSwNCg0KICAgIFRoYW5rcyBmb3IgdGhpcyBkb2N1bWVudCwgaXQgaXMgdXNlZnVsIHRvIHRy eSBhbmQgdGFtZSBob3cgU1BzIGFyZSBmaWx0ZXJpbmcNCiAgICBJUHY2IGV4dGVuc2lvbiBoZWFk ZXJzLg0KDQogICAgSG93ZXZlciwgSSBkaWQgZmluZCBzb21lIG9mIHRoaXMgZG9jdW1lbnQgc29t ZXdoYXQgc3VycHJpc2luZyBpbiB0aGUgY29udGV4dCBvZg0KICAgIFJGQyA4MjAwLCBhbmQgdGhp cyBpcyBwZXJoYXBzIGp1c3QgbXkgbmFpdmV0eSBvbiBob3cgaXQgaXMgYWN0dWFsbHkgZGVwbG95 ZWQ6DQoNCiAgICBNeSByZWFkaW5nIG9uIFJGQyA4MjAwIGV4dGVuc2lvbiBoZWFkZXJzIGNhbiBi ZSBzdW1tYXJpemVkIGFzOg0KICAgICAtIEhvcCBieSBob3Agb3B0aW9ucyBkZWZhdWx0IHRvIGJl aW5nIG9mZiB1bmxlc3MgeW91IGVuYWJsZSB0aGVtLg0KICAgICAtIE90aGVyIGV4dGVuc2lvbiBo ZWFkZXJzIG9ubHkgaGF2ZSByZWxldmFuY2Ugb25jZSB0aGUgcGFja2V0IHJlYWNoZXMgdGhlDQog ICAgIGRlc3RpbmF0aW9uIG5vZGUsIGFuZCBoZW5jZSBJIHdvdWxkIGhhdmUgdGhvdWdodCB0aGF0 IGFsbCB0cmFuc2l0IG5vZGVzIHNob3VsZA0KICAgICBieSBkZWZhdWx0IGp1c3QgaWdub3JlIHRo ZW0uDQoNCiAgICBHaXZlbiB0aGF0IHRoaXMgZG9jdW1lbnQgaXMgc3BlY2lmaWNhbGx5IG9ubHkg Zm9yIHRyYW5zaXQgbm9kZXMgd2hlcmUgdGhlDQogICAgcGFja2V0cyBhcmUgbm90IGRlc3RpbmVk IHRvIHRoZW0sIEkgd2FzIGV4cGVjdGluZyBhIHN1bW1hcnkgYWxvbmcgdGhlIGxpbmVzIG9mOg0K ICAgICAtIElnbm9yZSBob3AgYnkgaG9wIG9wdGlvbnMgdW5sZXNzIHRoZXkgcHJvdG9jb2xzIGlu IHRoZSB0cmFuc21pdCBkb21haW4gYXJlDQogICAgIG1ha2luZyB1c2Ugb2YgdGhlbS4gLSBBbGxv dywgYW5kIGlnbm9yZSwgYWxsIG90aGVyIGV4dGVuc2lvbiBoZWFkZXJzLiAgTWF5YmUNCiAgICAg ZmlsdGVyIFJIIHR5cGVzIDAgYW5kIDEgYmVjYXVzZSB0aGV5IHNob3VsZCBub3QgYmUgdXNlZCwg YnV0IGV2ZW4gdGhpcw0KICAgICBwcm9jZXNzaW5nIGNvdWxkIGJlIGxlZnQgdW50aWwgdGhlIGRl c3RpbmF0aW9uIG5vZGUuDQoNCiAgICBNeSBzbGlnaHQgZmVhciB3aXRoIHRoZSBjdXJyZW50IGRy YWZ0IGlzIHRoYXQgaXQgbWFrZXMgdGhpcyBhbGwgc2VlbSB2ZXJ5DQogICAgY29tcGxpY2F0ZWQg YW5kIHByb3RvY29sIHNwZWNpZmljIHdoaWNoIHBvc3NpYmx5IG1pZ2h0IGVuY291cmFnZSBJU1Bz IHRvIGp1c3QNCiAgICBkcm9wIGFsbCBwYWNrZXRzIHVzaW5nIEVIcy4NCg0KICAgIFJlZ2FyZHMs DQogICAgUm9iDQoNCg0KDQoNCg== From nobody Wed Jul 14 08:24:43 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D3FB3A1EBF; Wed, 14 Jul 2021 08:24:34 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Tim Chown via Datatracker To: Cc: draft-ietf-opsec-ipv6-eh-filtering.all@ietf.org, last-call@ietf.org, opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <162627627419.7903.7002704723951798048@ietfa.amsl.com> Reply-To: Tim Chown Date: Wed, 14 Jul 2021 08:24:34 -0700 Archived-At: Subject: [OPSEC] Intdir last call review of draft-ietf-opsec-ipv6-eh-filtering-08 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jul 2021 15:24:35 -0000 Reviewer: Tim Chown Review result: Ready with Nits Hi, This draft provides an analysis of IPv6 Extension Headers and Options, discusses the implications of discarding packets containing them, and makes recommendations on configurable filtering policy for each EH and Option for transit routers. I have followed the development of this draft, though not in great detail, and was a co-author of RFC7872 on “Observations on the Dropping of Packets with IPv6 Extension Headers in the Real World”, two other authors of which are the authors of this document. So I have familiarity with this strand of work. Overall I consider this document is Ready with Nits. General comments: The publication of IETF guidance in the area of IPv6 EH and Option handling/filtering, and speculation on the reasons behind the drops observed in RFC7872, has been somewhat controversial in the 6man and v6ops WGs. However, having had the observations published some time ago (separate to any recommendations), I would agree that it is now timely to publish this Informational document as it provides what I’d consider good guidance. The summary of existing EHs and Options presented in this draft is useful in itself. The style and format of the document is really nice, easy to follow, and well-written. I notice RFC6564 isn’t mentioned, should it be? Specific comments: P.3 “Since various protocols may use IPv6 EHs” It would be really nice to have a list of such protocols included in the document, so those choosing to set and implement policy can more clearly understand the impact of that policy. This comment also applies to 3.4.1.4 (p.9) P.4 “All standard IPv6 EHs” Do you mean the list in Table 1 here? “With respect to operational configurations” Perhaps say “policy” here as it is policy that provides the rationale for not just passing the packet as per 7045, and it MUST be configured policy that dictates a different handling. P.9 I assume you can also say that rate limiting will break protocols too? Should we say “Discarding or rate-limiting” in 3.4.1.4? p.17 Could we add a summary table for Options like we have for EHs? (There are some here that I’d forgotten existed and at least one I was unaware of…) Nits: P.7 and elsewhere Is it RHT0 etc or RTH0 ? All this time I’d thought RouTing Header :) p.8 Put the Types in order by code? Same on p.13 — Tim From nobody Wed Jul 14 20:32:02 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 506C53A1919; Wed, 14 Jul 2021 20:31:56 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Benjamin Kaduk via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Benjamin Kaduk Message-ID: <162631991585.27321.13333251204123967428@ietfa.amsl.com> Date: Wed, 14 Jul 2021 20:31:56 -0700 Archived-At: Subject: [OPSEC] Benjamin Kaduk's Discuss on draft-ietf-opsec-ipv6-eh-filtering-08: (with DISCUSS and COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 03:31:57 -0000 Benjamin Kaduk has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- DISCUSS: ---------------------------------------------------------------------- It seems that we accumulated some factual errors by letting this draft sit mostly idle since 2018, as the world evolved around us. Hopefully these are easy to remedy... Section 3.4.1.2 claims to have a list of options that have been specified as Hop-by-Hop options, and Section 3.4.6.2 a list of options that have been specified as Destination Options, each respectively "at the time of this writing". IANA has a single registry for both Destination and Hop-by-Hop options, and assessing which ones are defined as Hop-by-Hop vs Destinationmay require following each reference, but it seems that the PDM option from RFC 8250 has been allocated and is in neither list, and the early allocations for IOAM and Path MTU Record may need to be considered as well. I suppose that we do attempt to go into the individual optiosn in detail in Section 4.3, so perhaps this is not quite so simple to remedy after all. (Note: while it is not the preferred outcome, merely changing the statement from "time of this writing" and "so far been specified" to "as of 2018" ought to be sufficient to resolve the discuss, as would Lars' suggestion of just referring to the IANA registry without incorporating the registry contents.) Section 3.4.8.1 refers to HIP as an "experimental protocol", but as of RFC 7401, HIP is on the standards track. Also, there seems to be some skew between Table 1 and Section 3.4.10.5 regarding the recommended filtering policy for the experimental/testing EH types (drop vs [no recommendation]) ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Section 1 Recent studies (see e.g. [RFC7872]) suggest that there is widespread dropping of IPv6 packets that contain IPv6 Extension Headers (EHs). In some cases, such packet drops occur at transit routers. While some operators "officially" drop packets that contain IPv6 EHs, it is possible that some of the measured packet drops be the result of improper configuration defaults, or inappropriate advice in this area. The "it is possible that some" is not very confidence-inspiring; do we have much reason to think that there is any significant proportion of the packet drops that are due to these reasons? This document is similar in nature to [RFC7126], which addresses the same problem for the IPv4 case. [...] It is interesting to note that RFC 7126 has BCP status, while this document targets only Informational status. This document completes and complements the considerations for protecting the control plane from packets containing IP options that can be found in [RFC6192]. I see that RFC 6192 claims to provide "a method for protecting a router's control plane from undesired or malicious traffic" and in particular only claims applicability to traffic destined for the router itself (as opposed to traffic that is passing through the router). Is the claim here that fully protecting the router's control plane also requires filtering traffic that is not destined for the router itself? I'm not sure in what other sense this document would be "complet[ing] and complement[ing]" RFC 6192. In particular, protecting the network as a whole seems like a different goal than just protecting the router control plane. Section 2.3 The advice provided in this document is only meant to guide an operator in configuring forwarding devices, and is *not* to be interpreted as advice regarding default configuration settings for network devices. That is, this document provides advice with respect to operational configurations, but does not change the implementation defaults required by [RFC7045]. In light of the rtgdir reviewer's remarks (to which I cannot find a response in the mailarchive), I wonder if we might include a statement in here somewhere along the lines of "the network operator will need to make pragmatic engineering and business decisions about how to configure their routers, as constrained by the configuration options that the router vendor has made available and the nature of the traffic they are receiving. This document does not prescribe any specific configuration or course of action, but rather provides information and analysis regarding potential configuration options and the consequences thereof". o Discard (and log) packets containing this IPv6 EH or option type. Should this be "drop" to more properly contrast with the subsequent bullet that explicitly "reject"s (recalling that "discard" is claimed to be used for "either drop or reject without specification of which"? Section 3.3 I can't tell whether or not it's intentional that Table 1 has no entry for unregistered EH types (which do get discussion in the body of the document). Section 3.4.2.3 Would this be an appropriate place to include the discussion suggested by the rtgdir reviewer, that security issues with RHTs have been discovered in the past that required urgent action to disable them globally, and thus that devices should offer the ability to configure the discard of packets bearing RH on a per-RHT basis? Also, RFCs 6275 and 6554 seem to (respectively) have discussion of the security implications of their routing header types, and it's not clear why those references are not included in addition to the references for RHT0 and RHT4. Section 3.4.8.3 The security implications of the HIP header are discussed in detail in Section 8 of [RFC6275]. RFC 6725 is "Mobility Support in IPv6" and does not specifically mention HIP. While Mobile IPv6 and HIP are similar in some regards, it's not entirely clear to me that this is the correct reference. (Section 8 of RFC 7410 is its security considerations, so maybe that's the only change that's needed.) Section 3.4.10.5 I'm a bit surprised that the advice does not include a recommendation to allow the experimental-use/testing EHs with a rate limit, to give small experiments some chance of working across the Internet. Section 4.3.3.5 The previous subsections do not give much indication of harm caused by jumbograms so as to justify a recommendation to discard packets containing them. Section 4.3.4.5 As for jumbograms, the evidence of harm presented is sparse. Mention (in both places?) that their presence is indicative of unexpected traffic escaping from a controlled domain and that such unexpected traffic would potentially have harmful consequences when delivered might be helpful (if appropriate). Section 4.3.6.5 Intermediate systems should not discard packets based on the presence of this option. Is that synonymous with "ignore"? (I'll mention this just once, and skip the other places that use this phrasing.) Section 4.3.9.5 For Intermediate systems that DO NOT implement RFC-5570, there should be a configuration option to EITHER (a) drop packets containing the CALIPSO option OR (b) to ignore the presence of the CALIPSO option and forward the packets normally. In non-MLS environments, such intermediate systems should have this configuration option set to (a) above. In MLS environments, such intermediate systems should have this option set to (b) above. The default setting for this configuration option should be set to (a) above, because MLS environments are much less common than non-MLS environments. This is getting a fair bit closer to prescribing default behavior than the introductory material of the document had led me to expect. (Similarly for the following paragraph.) Section 4.3.14.3 Those described in [RFC6788]. The security considerations of RFC 6788 are pretty slim ... though I don't really expect us to have to document things more thoroughly in this document. Section 4.4.5 Operators should determine according to their own circumstances whether to discard packets containing unknown IPv6 options. Is there any guidance to give on whether to offer configuration on a per-option-type basis? Section 7 As the rtgdir reviewer notes, situations where a packet is rejected (with notification) result in traffic directed at the "sender"; in at least the case of spoofed source addresses this can be an attack in its own right. Routers that reject packets should probably rate-limit such notifications. Section 9.1 Some of these references may not actually need to be normative, e.g., when we're just referring to protocols that might be broken if an EH and/or option is blocked, such as RFC 2205. Section 9.2 Is [NIMROD-DOC] or RFC 1992 the better reference? We also have [draft-ietf-nimdor-eid] listed, but AIUI that's sufficiently different to be separate. NITS Section 2.3 o If a forwarding node discards a packet containing a standard IPv6 EH, it MUST be the result of a configurable policy and not just the result of a failure to recognize such a header. o The discard policy for each standard type of EH MUST be individually configurable. o The default configuration should allow all standard IPv6 EHs. If we're endeavoring to retain the normative language as used in RFC 7045, the last "SHOULD" should be capitalized. is of use for trouble-shooting purposes. However, throughout this document (when recommending that packets be discarded) we generically refer to the action as "discard" without specifying whether the sender is signaled of the packet drop. This bit is arguably redundant with the definition in §2.1 and thus a candidate for removal. Section 3.4.1.2 o Type 0x63: RPL Option [RFC6553] IANA has this as "RPL Option (DEPRECATED)" and also citing RFC 9008. From nobody Wed Jul 14 20:50:38 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 952033A19B5; Wed, 14 Jul 2021 20:50:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=edgeuno.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HE0_8guUenff; Wed, 14 Jul 2021 20:50:31 -0700 (PDT) Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2093.outbound.protection.outlook.com [40.107.92.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8489E3A19B4; Wed, 14 Jul 2021 20:50:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=J0vFSaoObmjrqkuj2GiBsNMQea3aMmzs7U+Dlhj8zJsunYOCk8uUM1DFNcvpkqL7B2xNrXtRQTfCQPeEK8K8VfrLUJslFRcAXoW5GgjhsUi/JgkA9jAdzQGxXZjWR1xD12JfaLgVVw8ZBPQB5CBOKkzo/NtoxoLpI7Gcq25ms0UTJF+Cjj2tG12PIwar4+4smt4xwYh8xW2KXXYFu414BIY2Cmz4+AT5ReUVuZQJmhwoyE9evcY16NHPcBcR7EK31EYC1XKd4tlEccWcIuQBTzZQ03oFrz/i4rSilchuhXLuJ6TkaVOVURj93sehL+ZnpvtZYGhWYX46ZtWYC4+mXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YDWfP+023MUWdHy26IC7M5u1UlJyJHJIqrhWPvpavb0=; b=lkwO1116Mor4nFhs+dderNW4Los7jmNVWIjQYYiumGCnKwSaEDcdms4F8ELBSQhBi8fpliPPKUCj1FVn7GxJdoJTZk+0BIWP36fPy2xZpy2L+qmVhNVZTgWAaQVM7JbluJ4DQP/r/8ouahQKp3YbYMnUiQ5F9UDJK37huxJLcC5xPFVf/Qaw33wxv4ZJPYx4nmcD/nLb99E4D9qYIilwKUEikEGBIdABKCS8JffccDW75vBQ7f1fbgw6FhGeaPBNSLAbKnUPwvybGyV1A0Ezj8nH7w7ls56sXzobO3UhLBBmdLBnpt7GJ1WYl4q0D6fK9Omo23D/QuQXEgihLUAKnw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=edgeuno.com; dmarc=pass action=none header.from=edgeuno.com; dkim=pass header.d=edgeuno.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=edgeuno.onmicrosoft.com; s=selector1-edgeuno-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YDWfP+023MUWdHy26IC7M5u1UlJyJHJIqrhWPvpavb0=; b=SrXafIStnb3WcqVQ69FsF92eIrJh9gUZmN4+HBnPzdEIwg5XSQiWSg8as/shkKokxWPO+bzmu08U9/Aqab7fHJO6KoeAXY73P9d9iJ4nqqcQ3h2gB2cC+CegVQv1xYy4PmF3dFltx8y24cC+UYLAl62Y/d1WzQSuGaaijyM1juc= Received: from BY3PR05MB8578.namprd05.prod.outlook.com (2603:10b6:a03:3cd::10) by SJ0PR05MB7837.namprd05.prod.outlook.com (2603:10b6:a03:2aa::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.10; Thu, 15 Jul 2021 03:50:27 +0000 Received: from BY3PR05MB8578.namprd05.prod.outlook.com ([fe80::752d:7e2f:853f:f91a]) by BY3PR05MB8578.namprd05.prod.outlook.com ([fe80::752d:7e2f:853f:f91a%5]) with mapi id 15.20.4331.022; Thu, 15 Jul 2021 03:50:27 +0000 From: Fernando Gont To: Roman Danyliw , The IESG CC: "opsec@ietf.org" , "opsec-chairs@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" Thread-Topic: [OPSEC] Roman Danyliw's Discuss on draft-ietf-opsec-ipv6-eh-filtering-08: (with DISCUSS and COMMENT) Thread-Index: AQHXd+pZPMppHgiHUUuSiVwihoyFVqtDaUGA Date: Thu, 15 Jul 2021 03:50:27 +0000 Message-ID: References: <162618261483.23262.1123677167769417679@ietfa.amsl.com> In-Reply-To: <162618261483.23262.1123677167769417679@ietfa.amsl.com> Accept-Language: es-AR, en-US Content-Language: es-AR X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 authentication-results: cert.org; dkim=none (message not signed) header.d=none;cert.org; dmarc=none action=none header.from=edgeuno.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 690fa523-9b8f-4613-4c27-08d94743af0e x-ms-traffictypediagnostic: SJ0PR05MB7837: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 3xdvYGUlkbczp2m4iXYejX0CAhbmjUQdIgUORKc8FD6Ai+gmeh/1eGPZB7AIIZv6ceJCBlFYrIBVM+cy3CMjntw7TXOjhblN2DxRIIZowq4l7mQGfp2POzingdL533TVr1XyZZimxCWk9beW/q0ebInwsBsVCff/s8TB61cPfz8Nym36PXt0t84QcAm5N/c/N8FQ5nSeAN3ufJi3GyKaawXJYf+JvtPuJCJVTEkh2hPkXEWZgoUdWaT814u/QsHA+BE9hcJxpMAXRbhlkNiNpT9UPtsq6sHKSQWS6LbHYiX1mmUHY6hFjePzz2WuiTygKy7rfXsJ572xv5CkZBspcVuP4Uu2+lLSgdiQz+jwjN7IblzL29rrw+wReAdnp66KfL5KBiEYP8eRgd5CXoNuB7t2SSiG8QZmD/NlbXcx0GVicDnDcukTdN4FGoyYxcngRrwEfaeGoE09kFdXnsfeLHKSI43Fr+n+72VzcSBsMYwOsM0pDmKIMjBmBC2G2XRBAVGo8C0qpUbFc3FX1+0PePvBJgo3ep/d432MUbzommvzQ23La13NZvMRiUAewbxxkxpm3DGCvzwEzoVRS5agAGaYYmBbvvfId4bvvv/a41L5B/bPBZuDSr+9PdSFLrAIFmY+I+HlAXy2necLj7OFgu0AxrLsTK2YFnwoIBArk2al+7AsPEeQFGnnhVfWw5f6d0rKeZ8EEs0LkzQM9yGZwnNP9cGLyhe0AkrgAxim4t8AsPj/dSdVzezyq4ry55bfsjF5mT5zVNzPsLWGqnCyJQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY3PR05MB8578.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(346002)(376002)(39840400004)(396003)(136003)(66946007)(66574015)(91956017)(76116006)(8936002)(186003)(31696002)(66476007)(66556008)(64756008)(66446008)(54906003)(71200400001)(110136005)(31686004)(8676002)(5660300002)(86362001)(44832011)(6486002)(316002)(36756003)(30864003)(53546011)(2616005)(6512007)(6506007)(83380400001)(26005)(2906002)(478600001)(38100700002)(4326008)(122000001)(38070700004)(43740500002)(45980500001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?NXdHSzhJK2JvT2hBZ2ROOExxZFlCcjRIRlhhUUlZRFBKYU9EL2pvQ0xOZmZY?= =?utf-8?B?YzFuSy9veWYyMVdOOC83Mjk2Nk5OWUJYRjhuWlpvZ0l3MWNtVVpzTUR3SWtE?= =?utf-8?B?YTExT1lGOWJIMzIzekJERUpZejE5bDhmdStZelhxMW5EdURkQXF6YUJUUmpy?= =?utf-8?B?dk5maEMwbExiMGw5dGJHYjMvQ2xBcU5JaGZhU3pCQ200UjhYdHpodWFSaFFp?= =?utf-8?B?VlMvS3ZEbk5CbllOcm02L3VvZmtiekwvenNvL0hyalJrUWd1K0hNUE1JOGhY?= =?utf-8?B?NTlmZnJwMEdIQWNBYUltbGxQL3BycDcrWVpxTXArMDVtR2t1UFc4QzBsVnhZ?= =?utf-8?B?ekF2U2E5c05IMEwxeW5JeWFYNUlmNVlPK0NnSGVHbVRuOEFGV25tQ2wrZTU0?= =?utf-8?B?eENpaUhjRmMxQnY5M0svWmdBM3FqV09DcTIzMkpwZ3p1bzg5KzR2bndWTCs1?= =?utf-8?B?YklxUkxBcFFJTVZkTUoxUyt0bFc4cDVQOVFndXBLc0ZZV2FtV0RYWE4zYmZk?= =?utf-8?B?OGVJWitjODBweWdyTm5ScExyL3gyVnVIOUhMZytmYjBwcm5QYllZTlFDN2NL?= =?utf-8?B?LzJ2M0Q1dUFwWVRuOVhueHdwWGJpQ002cWFJN0NlOTg0aitUMGlISnVvWnVl?= =?utf-8?B?RC9ZeWYwNS9VdWhGNHlXRklLdElGNG51K0xRQk1ib2xMRkk5Yk43d2dTdVdJ?= =?utf-8?B?Q1ZwYmZ0Y2lmL0tiZ3VHaVBBRGlUVHdZWGN0M0lrUCtCemJSS09zQkhmTDF2?= =?utf-8?B?ZWM1OERlQUF6ZUU4eXM4ZVUwTVNHaVhhMWY0N2htdG5DNXZLZXB2UWdEWllw?= =?utf-8?B?YVQyRFR4Zzc2L0hMQndzVnBGcnhFMjFaeUIrSU9hUjVRTXU0bXY1SWxBRFNu?= =?utf-8?B?NDlRN2I4YjdTa2pTUXJab0VXWGhnNHM2UlgxcnBxNTl4b2M5RWdXdE9CMFdG?= =?utf-8?B?YTBKVmUzT3BtQXNUNGFyYWt2RmExZXdPVVBacXhSeG9scTAwZ3MraTRHSDZN?= =?utf-8?B?dGZkSEQzcEEwdVRydkhjWVhyZ0M5ZkVJT29xTkluZXRtRUFjeFIvYUs4YUxn?= =?utf-8?B?N3N4dDRONGp0WXNQdUhORXJ5MndvM2NlSk9yNy8wZzBNR3A2NUVxRCswaGIx?= =?utf-8?B?enZlZTBTWjRYakhxd2F3K0pRSkcyWkovNXhlaUkrVXFUcUZVeTJrZHpwMUdK?= =?utf-8?B?SkZYamY5cGVxMFRweEpFWVhYcms2L01xQWZsOXdzNDRSbVRtTEp3OUF1V2Yz?= =?utf-8?B?Yk1Hamg5Zlg3dXhyMnNWMG5vaTRXak92N1RGM3lhVXBHWHcvYzE2Q1Joellh?= =?utf-8?B?MC9GRHo0TkhaaFlKVUZZNzBHcklOeUV1TnhzOE1HRVZQUXR5WHNzWkU2SkJY?= =?utf-8?B?L2kxcDNRWW1WUnBzUHM3MjN4S2RLS2tpb0d3eU1LZTJKRkRyQXZvZjFIc1lW?= =?utf-8?B?T2tsOUlpT2xkV3QrSlNFWjNsaEZmUHA5dERwQlRoaHowT01DUU5hZXFZS3NH?= =?utf-8?B?VVZ4Nm4xUlNhNlVNd2ZMVFFOZkVldlRGVnBnS1RCdVUyN0ZOUlF2eEJmNkI5?= =?utf-8?B?N013Z3FOUXoyZnJMa0QrMEJaYUlxais3b01tSnlUcU8xWDlMaDZYRDdSY1hB?= =?utf-8?B?elQwNGlWaWdJU3BuRC9PcFNWcGptMjVGcTEwWXMyc2NDSmdjanZVYmVzenI3?= =?utf-8?B?SHJsWFFMQThUODA0cy81UGIxQWErYndyWEdDTDZadHBGeW54Lzc2QS9NbGVY?= =?utf-8?Q?zUdZeKegCQFhcGJ7lM=3D?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <142D18B30D9C3C4AB3C1B68E179F4774@namprd05.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: edgeuno.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY3PR05MB8578.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 690fa523-9b8f-4613-4c27-08d94743af0e X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2021 03:50:27.4229 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 20879dba-fabf-45da-8300-60b8ce560217 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: cG5uT+N76tj/OqnlI+yzB/uTRCts1+E64/q/X8C3LW9eQTMbam0zmbWOoRSSKtVj51JaHrBRFY061SUZ5J+FOfUrVi09092ZLP4wqr+J4sU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR05MB7837 Archived-At: Subject: Re: [OPSEC] Roman Danyliw's Discuss on draft-ietf-opsec-ipv6-eh-filtering-08: (with DISCUSS and COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 03:50:37 -0000 SGksIFJvbWFuLA0KDQpUaGFua3MgYSBsb3QgZm9yIHlvdXIgY29tbWVudHMhIEluLWxpbmUuLi4N Cg0KT24gMTMvNy8yMSAxMDoyMywgUm9tYW4gRGFueWxpdyB2aWEgRGF0YXRyYWNrZXIgd3JvdGU6 DQpbLi4uLl0NCj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KPiBESVNDVVNTOg0KPiAtLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+ IA0KPiBDYW4gdGhlIHByaW5jaXBsZWQgYXBwcm9hY2ggdG8gbWFraW5nIHRoZXNlIHJlY29tbWVu ZGF0aW9ucyBiZSBtb3JlIGNsZWFybHkNCj4gZXhwbGFpbmVkIGFuZCBkb2N1bWVudGVkPyAgU2Vj dGlvbiAzIHByaW1hcmlseSBlc3RhYmxpc2hlcyBhIHR3by1vcHRpb24NCj4gZmlsdGVyaW5nIHJl Z2ltZSAoZHJvcCB2cy4gcGVybWl0KSwgYnV0IFNlY3Rpb24gNCBzZWVtcyB0byBwcm92aWRlIG1v cmUgbnVhbmNlDQo+IHdpdGggYSB0aHJlZS1vcHRpb24gZmlsdGVyaW5nIHJlZ2ltZSB3aGljaCBj b25zaWRlcnMgdGhlIG5lZWRzIG9mIHRoZSBuZXR3b3JrDQo+IChkcm9wIHZzLiBkcm9wIGlmIGZ1 bmN0aW9uYWxpdHkgbm90IG5lZWRlZCB2cy4gcGVybWl0KS4gDQoNClRoYXQncyBub3QgaG93IEkg cmVhZCB0aGUgZG9jdW1lbnQgbXlzZWxmLiBFc3NlbnRpYWxseSwNCg0KKiBUaGUgZG9jdW1lbnQg dGFrZXMgdGhlIGFwcHJvYWNoIG9mIG9ubHkgcmVjb21tZW5kaW5nIHRvIGRyb3AgdGhpbmdzIGlm DQogIHRoZXkgYXJlIGtub3duIHRvIGJlIGhhcm1mdWwuIC0tIGFzIG9wcG9zZWQgdG8gd2hldGhl ciB0aGUgZmVhdHVyZSAiaXMNCiAgbmVlZGVkIiwgd2hpY2ggbWF5IGJlIGhhcmQgdG8gdGVsbCBz aW5jZSB0aGUgYWR2aWNlIGlzIGRpcmVjdGVkIGF0DQogIHRyYW5zaXQgcm91dGVycy4NCg0KKiBU aGF0IHNhaWQsIHRoZSBkb2N1bWVudCBub3RlcyB3aGF0IHdvdWxkIGJyZWFrIHdoZW4gc3VjaCBw YWNrZXRzIGFyZQ0KICBkcm9wcGVkLCBzdWNoIHRoYXQgZm9sa3MgZGVjaWRpbmcgdG8gZHJvcCB0 aGVtIGNhbiBtYWtlIGEgbW9yZQ0KICBpbmZvcm1lZCBkZWNpc2lvbi4NCg0KDQoNCj4gQXMgYW4g YXNpZGUsIGEgZm91cnRoDQo+IGZpbHRlcmluZyBhY3Rpb24gb2YgcmVtb3ZpbmcgdGhlIG9wdGlv bnMgaXMgcHJlc2VudGVkIGluIFNlY3Rpb24gNC4zLjkuNC4gDQoNCkdvb2QgZ3JpZWYgYWJvdXQg dGhpcyBvbmUhIC0tIExvb2tzIGxpa2UgdGhlcmUncyBzb21lIHRleHQgdGhhdCB3ZSBoYXZlDQpz b21laG93IGRyYWdnZWQgZnJvbSBlYXJsaWVyIHZlcnNpb25zIG9mIHRoaXMgZG9jdW1lbnQuDQoN CkhvdyBhYm91dCByZXBocmFzaW5nIFNlY3Rpb24gNC4zLjkuNCBhczoNCg0KICAgRHJvcHBpbmcg cGFja2V0cyB0aGF0IGNvbnRhaW4gYSBDQUxJUFNPIG9wdGlvbiB3b3VsZCBwcmV2ZW50DQogICBj b21tdW5pY2F0aW9uIGFtb25nIHN5c3RlbXMgZW1wbG95aW5nIENBTElQU08gZm9yIGNvbnZleWlu Zw0KICAgc2Vuc2l0aXZpdHkgbGFiZWxzIGluIE11bHRpLUxldmVsIFNlY3VyZSAoTUxTKSBuZXR3 b3JraW5nDQogICBlbnZpcm9ubWVudHMuDQoNCj8NCg0KDQoNCj4gQWRkaXRpb25hbGx5LCBzZWUg dGhlIGNvbW1lbnQgYmVsb3cgd2hpY2ggaGFzIGEgc3VtbWFyeSB0YWJsZSBmb3INCj4gcmVjb21t ZW5kYXRpb25zIGluIFNlY3Rpb24gNCBhbmFsb2dvdXMgdG8gVGFibGUgMSBvZiBTZWN0aW9uIDMg dG8gYWxsb3cNCj4gc2lkZS1ieS1zaWRlIGNvbXBhcmlzb25zLg0KPiANCj4gV2FzIHRoZSB0aHJl ZS1vcHRpb24gZmlsdGVyaW5nIHJlZ2ltZSBjb25zaWRlcmVkIGZvciBhbGwgcmVjb21tZW5kYXRp b25zPyAgRm9yDQo+IGV4YW1wbGUsIFNlY3Rpb24gNC4zLjcuNSAsIFJvdXRlciBBbGVydCAoVHlw ZT0weDA1KSByZWNvbW1lbmRzIHBlcm1pdHRpbmcgdGhpcw0KPiBvcHRpb24g4oCcaW4gZW52aXJv bm1lbnRzIHdoZXJlIHN1cHBvcnQgZm9yIFJTVlAsIG11bHRpY2FzdCByb3V0aW5nLCBvciBzaW1p bGFyDQo+IHByb3RvY29scyBpcyBkZXNpcmVkLuKAnSAoaS5lLiwg4oCcZHJvcCBpZiBmdW5jdGlv bmFsaXR5IGlzIG5vdCBuZWVkZWTigJ0pLiAgSG93ZXZlciwNCj4gU2VjdGlvbiAzLjQuOCwgSElQ IChQcm90b2NvbCBOdW1iZXI9MTM5KSByZWNvbW1lbmQgY2F0ZWdvcmljYWxseSBwZXJtaXR0ZWQN Cj4gdGhlc2UgcGFja2V0cy4gSWYgYW4gb3BlcmF0b3Iga25vd3MgdGhhdCBISVAgaXMgbm90IGEg dGVjaG5vbG9neSB0aGV5IGhhdmUgYQ0KPiBkZXNpcmUgdG8gdXNlIGluIGFuIGVudmlyb25tZW50 LCB3aHkgc2hvdWxkbuKAmXQgdGhleSBibG9jayBpdCAoanVzdCBsaWtlIHdhcw0KPiBzdWdnZXN0 ZWQgZm9yIFJvdXRlciBBbGVydHMpPw0KDQpSb3V0ZXIgQWxlcnRzIGhhdmUga25vd24gbmVnYXRp dmUgaW1wbGljYXRpb25zIGZvciBpbnRlcnZlbmluZyBzeXN0ZW1zLA0Kd2hlcmVhcyBISVAgb3B0 aW9ucyBkbyBub3QuDQoNCg0KDQo+IENvbnNpZGVyYXRpb24gZm9yIGNvbmRpdGlvbmFsIGRpc2Nh cmQgYmFzZWQgb24gbG9jYWwgbmVlZHMgc2VlbXMgYXBwcm9wcmlhdGUNCj4gZm9yIFNoaW02LCBN b2JpbGl0eSBIZWFkZXIsIEhJUCwgSUxOUCBOb25jZSwgVHVubmVsIEVuY2Fwc3VsYXRpb24sIGFu ZCBhbGwgUlBMDQo+IG9wdGlvbnMgaWYgdGhlIGdvYWwgaXMgdG8gbWluaW1pemUgdHJhZmZpYyB3 aGljaCBoYXMgdG8gZ28gb24gdGhlIHNsb3cgcGF0aC4NCj4gDQo+IEkgcmVhZCBpbiB0aGUgc2hl cGhlcmTigJlzIHdyaXRlLXVwIHRoYXQgdHJhZGUtb2ZmcyB3ZXJlIG1hZGUgdG8gbWluaW1pemUN Cj4gb3NzaWZpY2F0aW9uLiAgSG93ZXZlciwgdGhhdCByYXRpb25hbGUgaXMgbm90IGFwcGFyZW50 IGluIHRoZSB0ZXh0Lg0KDQpQbGVhc2UgbGV0IG1lIHByb3ZpZGUgc29tZSBiYWNrZ3JvdW5kOg0K DQoqIE9yaWdpbmFsbHksIHRoZSBkb2N1bWVudCBwcm92aWRlZCBhZHZpY2UgZm9yIHJvdXRlcnMg aW4gZ2VuZXJhbCwgYW5kDQogIHdhcyBtb3JlIGFncmVzc2l2ZSBvbiB0aGUgZmlsdGVyaW5nIGFk dmljZSAoa2luZCBvZiAib25seSBhbGxvdyB3aGF0J3MNCiAgbmVlZGVkIikuDQoNCiogVGhhdCBp ZGVhIHdhc24ndCB3ZWxjb21lLCBzbyB3aGF0IHdlIGVzc2VudGlhbGx5IGRpZCB3YXMgdGhpczoN Cg0KICAxKSBOb3RlIHRoYXQgWW91ciBkZXZpY2VzIG1pZ2h0IHN1ZmZlciBmcm9tIEVIcywgaW4g d2hpY2ggY2FzZSB5b3UNCiAgICAgbWlnaHQgbmVlZCB0byBjb25zaWRlciBkcm9wcGluZyBzdWNo IHBhY2tldHMgKHNlZQ0KICAgICBkcmFmdC1pZXRmLXY2b3BzLWlwdjYtZWhzLXBhY2tldC1kcm9w cykuIEluIHN1Y2ggY2FzZXMsIHRoaXMNCiAgICAgZG9jdW1lbnQgY2FuIGJlIG9mIGhlbHAgdG8g ZmlndXJlIG91dCB3aGF0IHN1Y2ggcG9saWN5IG1pZ2h0IGJyZWFrLg0KDQogIDIpIEluIG90aGVy IGNhc2VzLCBvbmx5IHJlY29tbWVuZCB0byBkcm9wIHBhY2tldHMgd2l0aCBFSHMgd2l0aCB3ZWxs DQogICAgLWtub3duIHNlY3VyaXR5IGltcGxpY2F0aW9ucyAobm90YWJseSBSb3V0ZXIgQWxlcnQp LCBvciB0aGF0LCBieQ0KICAgICBkZWZpbml0aW9uLCBzaG91bGRuJ3QgYmUgZm91bmQgaW4gdHJh bnNpdCBuZXR3b3Jrcy4NCg0KVGhhdCdzIHdoYXQgd2UgdHJpZWQgdG8gY29kaWZ5IGluIHRoZSBk b2N1bWVudC4NCg0KSXMgdGhlcmUgYW55dGhpbmcgdGhhdCB5b3UgY29uc2lkZXIgdGhhdCBkb2Vz bid0IGZvbGxvdyB0aGlzICJwaGlsb3NvcGh5Ij8NCg0KDQoNCg0KDQo+ICoqIFNlY3Rpb24gMS4g IFBlciDigJxSZWNlbnQgc3R1ZGllcyAoc2VlIGUuZy4gW1JGQzc4NzIpIOKApuKAnSwgaXMgdGhl cmUgYW4gdXBkYXRlZA0KPiBzdHVkeSB0byByZWZlcmVuY2UgdG8gc3VwcG9ydCB0aGUgdGhlc2lz IHRoYXQgd2lkZXNwcmVhZCBkcm9wcGluZyBvZiBJUHY2DQo+IHBhY2tldHMgd2l0aCBleHRlbnNp b24gaGVhZGVycyBpcyBoYXBwZW5pbmc/ICBSRkM3ODcyIGlzIGJhc2VkIG9uIGRhdGEgc2V0cw0K PiBmcm9tIDIwMTQgYW5kIDIwMTUuDQoNCkFuZWNkb3RhbCBhbmQgZW1weXJpY2FsIGV2aWRlbmNl IHN1Z2dlc3RzIHRoYXQgdGhhdDtzIHN0aWxsIHRoZSBjYXNlLiAtLQ0KYnV0IG5vLCBJIGRvbid0 IGtub3cgb2YgYSBtb3JlIHJlY2VudCBzdHVkeS4NCg0KDQoNCj4gKiogU2VjdGlvbiAxLg0KPiAg ICBXaGlsZQ0KPiAgICBzb21lIG9wZXJhdG9ycyAib2ZmaWNpYWxseSIgZHJvcCBwYWNrZXRzIHRo YXQgY29udGFpbiBJUHY2IEVIcywgaXQgaXMNCj4gICAgcG9zc2libGUgdGhhdCBzb21lIG9mIHRo ZSBtZWFzdXJlZCBwYWNrZXQgZHJvcHMgYmUgdGhlIHJlc3VsdCBvZg0KPiAgICBpbXByb3BlciBj b25maWd1cmF0aW9uIGRlZmF1bHRzLCBvciBpbmFwcHJvcHJpYXRlIGFkdmljZSBpbiB0aGlzDQo+ ICAgIGFyZWEuDQo+IA0KPiAtLSBXaGF0IGRvZXMgdGhlIHdvcmQgb2ZmaWNpYWxseSBpbiBxdW90 ZXMgbWVhbj8NCg0KTWF5YmUgImV4cGxpY2l0bHkiIHdvdWxkIGJlIGEgYmV0dGVyIHRlcm0/ICAo aS5lLiwgdGhleSBvcGVubHkgc2F5IHRoZXkgZG8pLg0KDQoNCg0KPiAtLSBJcyB0aGVyZSBhbnkg cmVmZXJlbmNlIHRoYXQgc3VwcG9ydHMgdGhlIGFzc2VydGlvbiBvZiBpbXByb3BlciBjb25maWd1 cmF0aW9uDQo+IGRlZmF1bHRzPw0KDQptYXliZSAiaW1wcm9wZXIgY29uZmlndXJhdGlvbiB0ZW1w bGF0ZXMiIHdvdWxkIGJlIGEgYmV0dGVyIHBocmFzaW5nPw0KDQoNCg0KPiAtLSB3aG8gaXMgcHJv dmlkaW5nIGluYXBwcm9wcmlhdGUgYWR2aWNlPw0KDQpWaXJ0dWFsbHkgZXZlcnlvbmUgaW4gYW55 IHNlY3VyaXR5IGNvbmZlcmVuY2Ugd2hlcmUgdGhlIHRvcGljIGlzIGRpc2N1c3NlZC4NCg0KDQoo SSByZWFsaXplIHdlIG1pZ2h0IGFsc28gcGhyYXNlIGl0IGFzICJpdCBpcyBhbHNvIG1wb3NzaWJs ZSB0aGF0Li4iKQ0KDQoNCg0KDQo+ICoqIFNlY3Rpb24gMS4gIFRoZSB0ZXh0IGNhbGxzIG91dCB0 aGUgdXNlIG9mIOKAnGRlbnktbGlzdHPigJ0gYnkgdHJhbnNpdCBuZXR3b3Jrcw0KPiBhbmQg4oCc YWNjZXB0LWxpc3Rz4oCdIHRoYXQgYXJlIOKAnGVuZm9yY2VkIGNsb3NlciB0byB0aGUgZGVzdGlu YXRpb24gc3lzdGVtc+KAnS4gIElzDQo+IHRoZXJlIGFueSBpbmRpY2F0aW9uIHRoYXQgdGhlIG5l dHdvcmtzIHdoaWNoIG9yaWdpbmF0ZSB0aGUgdHJhZmZpYyBhcmUgZG9pbmcNCj4gZmlsdGVyaW5n IG9mIG91dGJvdW5kIHRyYWZmaWM/DQoNCldlIG1vc3RseSBtZWFudCBpbi1ib3VuZCBhY2NlcHQt bGlzdCBjbG9zZXIgdG8gdGhlIGRlc3RpbmF0aW9uIHN5c3RlbXMuDQpIb3dldmVyLCBpbiBzdWNo IGNhc2VzLCBzdWNoIGRldmljZXMgYmxvY2sgYm90aCBpbmNvbWluZyBhbmQgb3V0Z29pbmcNCnBh Y2tldHMuDQoNCkFuZCB5ZXAsIGNsb3NlIHRvIHRoZSBlZGdlcyB5b3UgZ2V0IGFsbCBzb3J0IG9m IGZpbHRlcmluZy4NCg0KDQoNCg0KPiAqKiBTZWN0aW9uIDIuMSAgUGVyIOKAnOKApiBhbmQgaXJy ZXNwZWN0aXZlIG9mIHdoZXRoZXIgdGhlIHNwZWNpZmljIGZpbHRlcmluZw0KPiBhY3Rpb24gaXMg bG9nZ2Vk4oCdLCBubyBpc3N1ZXMgd2l0aCBtYWtpbmcgdGhpcyBkaXN0aW5jdGlvbi4gIEhvd2V2 ZXIsIGl0IHNlZW1zDQo+IG91dCBvZiBwbGFjZSBzaW5jZSBub25lIG9mIHRoZSBwcmV2aW91cyB0 ZXh0IHNhaWQgYW55dGhpbmcgYWJvdXQgbG9nZ2luZyBhcyBhDQo+IGRpc2NyaW1pbmF0b3IgYW1v bmcgdGhlIHBlcm1pdCwgZHJvcCBvciByZWplY3QgYWN0aW9ucy4NCg0KSG93IGFib3V0IHNpbXBs eSByZW1vdmluZyAiLCBhbmQgaXJyZXNwZWN0aXZlIG9mDQogICB3aGV0aGVyIHRoZSBzcGVjaWZp YyBmaWx0ZXJpbmcgYWN0aW9uIGlzIGxvZ2dlZC4iPw0KDQoNCg0KDQo+ICoqIFNlY3Rpb24gMi4z LiAgVGhpcyBzZWN0aW9uIHNlZW1zIG1pc3RpdGxlZCBhcyDigJxDb252ZW50aW9uc+KAnS4gIFRo ZSB0ZXh0DQo+IGFwcGVhcnMgdG8gYmUgZGVzY3JpYmluZyBhc3N1bXB0aW9ucyBmb3Igbm9kZXMg YW5kIGhvdyB0aGUgZ3VpZGFuY2Ugd2lsbCBiZQ0KPiB1c2VkLg0KDQpBbnkgc3VnZ2VzdGlvbnMg Zm9yIGEgYmV0dGVyIHRpdGxlPw0KDQoNCg0KDQo+ICoqIFNlY3Rpb24gMy4yLiAgUGVyIHRoZSBj aXRlZCByZWZlcmVuY2VzOg0KPiANCj4gLS0gW0ZXLUJlbmNobWFya10uICBUaGlzIGFzc29jaWF0 ZWQgVVJMIHJldHVybmVkIGEgNDA0IGVycm9yIGZvciBtZQ0KPiAoaHR0cDovL3d3dy5pcHY2aGFj a2Vycy5vcmcvbWVldGluZ3MvaXB2Ni1oYWNrZXJzLTEvemFjay1pcHY2aGFja2VyczEtZmlyZXdh bGwtc2VjdXJpdHktYXNzZXNzbWVudC1hbmQtYmVuY2htYXJraW5nLnBkZikNCg0KV2lsbCBnZXQg dGhpcyBvbmUgZml4ZWQuIFRoYW5rcyENCg0KDQoNCj4gLS0gW0Npc2NvLUVIXS4gIFRoaXMgZG9j dW1lbnQgd2FzIGxhc3QgdXBkYXRlZCBpbiAyMDA2LiAgQXJlIHRoZSBkZXNpZ24NCj4gZGVzY3Jp cHRpb25zIGl0IGNhcHR1cmVzIHN0aWxsIGFjY3VyYXRlPw0KDQpUaGV5IGFyZS4gLS0gd2UgYXJl IGFyb3VuZmQgdGhlIHNhbWUgbGluZXMgaW4NCmRyYWZ0LWlldGYtdjZvcHMtaXB2Ni1laHMtcGFj a2V0LWRyb3BzIC4NCg0KDQoNCj4gKiogU2VjdGlvbiA0LiAgVGFibGUgMSBzdW1tYXJpemVkIHRo ZSByZWNvbW1lbmRhdGlvbnMgb2YgU2VjdGlvbiAzLiAgQSBzaW1pbGFyDQo+IHRhYmxlIHdvdWxk IGJlIGhlbHBmdWwgZm9yIHRoZSByZWNvbW1lbmRhdGlvbnMgb2YgdGhpcyBzZWN0aW9uLiAgRm9y IGV4YW1wbGU6DQo+ICAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tKw0KPiAgICB8ICAgICAgICAgIE9wdGlvbiAgICAg ICAgICAgIHwgICAgIEZpbHRlcmluZyBwb2xpY3kgICAgIHwgUmVmZXJlbmNlIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgICAgICAgUGFkMSAgICAgICAgICAgfCAgICAgICAgIFBl cm1pdCAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHgwMCkg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjEgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgICAgICAgUGFkTiAgICAgICAgICAgfCAgICAgICAgIFBl cm1pdCAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHgwMSkg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjIgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgIEp1bWJvIFBheWxvYWQgICAgICAgfCAgICAgUGVybWl0 IGJhc2VkIG9uICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHhDMikg ICAgICAgIHwgICBuZWVkZWQgZnVuY3Rpb25hbGl0eSAgIHwgICAgNC4zLjMgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgIFJQTCBPcHRpb24gICAgICAgICAgfCAgUm91dGVyLXNw ZWNpZmljIGZpbHRlciAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHg2Mykg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjQgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgICAgIFJQTCBPcHRpb24gICAgICAgfCAgICAgICAgIFBl cm1pdCAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHgyMykg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjUgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgVHVubmVsIEVuY2Fwc3VsYXRpb24gTGltaXQgfCAgICAgICAgIFBl cm1pdCAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHgwNCkg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjYgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgIFJvdXRlciBBbGVydCAgICAgICAgfCAgICAgICBQZXJt aXQgYmFzZWQgb24gICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHgwNSkg ICAgICAgIHwgICAgbmVlZGVkIGZ1bmN0aW9uYWxpdHkgIHwgICAgNC4zLjcgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgICAgUXVpY2sgU3RhcnQgICAgICAgfCAgICAgICAgIFBl cm1pdCAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHgyNikg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjggIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgICAgQ0FMSVBTTyAgICAgICAgICAgfCAgICAgIFBlcm1p dCBiYXNlZCBvbiAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHgwNykg ICAgICAgIHwgICAgIG5lZWRlZCBmdW5jdGlvbmFsaXR5IHwgICAgNC4zLjkgIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgSG9tZSBBZGRyZXNzICAgICAgICAgICAgfCAgICAgICAgIFBl cm1pdCAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHhDOSkg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjExIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgRW5kcG9pbnQgSWRlbnRpZmljYXRpb24gfCAgICAgICAgIERy b3AgICAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHg4QSkg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjEyIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgICAgSUxOUCBOb25jZSAgICAgICAgfCAgICAgICAgIFBl cm1pdCAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHg4Qikg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjEzIHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICBMaW5lLUlkZW50aWZpY2F0aW9uICAgICAgfCAgICAgICAgIERy b3AgICAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHg4Qykg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjE0IHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQo+ICAgIHwgICAgICAgIERlcHJlY2F0ZWQgICAgICAgICAgfCAgICAgICAgIERy b3AgICAgICAgICAgICAgfCAgU2VjdGlvbiAgfA0KPiAgICB8ICAgICAgICAgKFR5cGU9MHg0RCkg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNC4zLjE1IHwNCj4gICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0t LS0tLS0tLS0rDQoNCldpbGwgZG8uIFRoYW5rcyBhIGxvdCENCg0KDQoNCg0KPiAqKiBTZWN0aW9u IDcuICBUaGUgdGV4dCBkb2VzbuKAmXQgc2VlbSB0byBtYWtlIGEgc3RhdGVtZW50IGFib3V0IHNl Y3VyaXR5IGJleW9uZA0KPiByZWl0ZXJhdGluZyB0aGUgaW50ZW50IG9mIHRoZSBkb2N1bWVudC4g IERvZXMgYWRvcHRpbmcgdGhlIHByYWN0aWNlcyBpbiB0aGlzDQo+IGRvY3VtZW50IGltcHJvdmUg dGhlIHNlY3VyaXR5IHBvc3R1cmUgb2YgdGhlIG5ldHdvcms/ICANCg0KDQpBcyBub3RlZCBhYm92 ZSwgdGhpcyBkb2N1bWVudCBqdXN0IHJlY29tbWVuZHMgdG8gZHJvcHMgc3R1ZmYgdGhhdCBpcw0K d2VsbC1rbm93biB0byBiZSBoYXJtZnVsLiBCdXQgaXQgYWxzbyBub3RlcyB0aGF0Og0KDQogICBP cGVyYXRvcnMgYXJlIHVyZ2VkIHRvIGNvbnNpZGVyIHRoZSBJUHY2IEVIIGFuZCBJUHY2IG9wdGlv bnMgaGFuZGxpbmcNCiAgIGNhcGFiaWxpdGllcyBvZiB0aGVpciBkZXZpY2VzIGFzIHRoZXkgbWFr ZSBkZXBsb3ltZW50IGRlY2lzaW9ucyBpbg0KICAgZnV0dXJlLg0KDQouLiB3aGljaCB3b3VsZCBw cm9iYWJseSBtYWtlIHBlb3BsZSBhbmFseXplIHRoZWlyIGVudmlyb25tZW50Li4uIGluDQp3aGlj aCBjYXNlLCBpZiBFSHMgY291bGQgbGVhZCB0byBlLmcuIERvUyBhdHRhY2tzLCB0aGV5IHdvdWxk IHByb2JhYmx5DQpkZWNpZGUgdG8gZHJvcCBzdWNoIHBhY2tldHMuDQoNCkkgZG8gYmVsaWV2ZSB0 aGF0IHRoaXMgd291bGQgcmVzdWx0IGluIGFuIGltcHJvdmVtZW50IG9mIHRoZSBzZWN1cml0eQ0K cG9zdHVyZS4NCg0KDQoNCj4gQXJlIHRoZXJlIGFueSBuZXcNCj4gc2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgdG8gY29uc2lkZXIgaWYgdGhlc2UgcHJhY3RpY2VzIGFyZSBhZG9wdGVkPw0KDQpOb3Qg dGhhdCBJIGtub3cgb2YuDQoNCg0KDQo+IA0KPiAqKiBFZGl0b3JpYWwNCj4gDQo+IC0tIFNlY3Rp b24gMi4zLiAgRWRpdG9yaWFsLiAgUGVyIHRoZSBwYXJhZ3JhcGggdGhhdCBzdGFydHMgd2l0aCDi gJxGaW5hbGx5LCB3ZQ0KPiBub3RlIHRoYXQg4oCm4oCdLCB0aGlzIGd1aWRhbmNlIHNlZW1zIHZl cnkgc2ltaWxhciAocmVwZXRpdGl2ZSkgdG8gdGhlIGV4cGxhbmF0aW9uDQo+IGFscmVhZHkgcHJv dmlkZWQgaW4gU2VjdGlvbiAyLjEuDQoNCkknZCBwcm9iYWJseSBrZWVwIGl0LCBmb3IgY2xhcml0 eSBzYWtlLCBzaW5jZSBoZXJlIHdlJ3JlIGFyZ3VpbmcgaW4NCmZhdm9yIG9mIHJlcG9ydGluZyB0 aGUgZHJvcHMsDQoNCg0KDQo+IC0tIFNlY3Rpb24gMy4yLiAgRWRpdG9yaWFsLiAgcy9kZWNpc2lv bnMgaW4gZnV0dXJlL2RlY2lzaW9ucyBpbiB0aGUgZnV0dXJlLw0KDQpXaWxsIGZpeCBpdC4NCg0K DQoNCj4gLS0gU2VjdGlvbiA0LjMuOS41LiAgRWRpdG9yaWFsLiAgUmVjb21tZW5kIHJlbW92aW5n IHRoZSB1bmlxdWUg4oCcUkZDLTU1NzDigJ0gc3R5bGUNCj4gbm90YXRpb24uDQoNClllcC4gV2ls bCBmaXggdGhpcyBvbmUsIHRvby4NCg0KDQpUaGFua3MhDQoNClJlZ2FyZHMsDQotLSANCkZlcm5h bmRvIEdvbnQNCkRpcmVjdG9yIG9mIEluZm9ybWF0aW9uIFNlY3VyaXR5DQpFZGdlVW5vLCBJbmMu DQpQR1AgRmluZ2VycHJpbnQ6IERGQkQgNjNFMyBCMjQ4IEFFNzkgQzU5OCBBRjIzIEVCQUUgREEw MyAwNjQ0IDE1MzENCg== From nobody Thu Jul 15 00:01:05 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B16AC3A13D3; Thu, 15 Jul 2021 00:00:58 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Murray Kucherawy via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Murray Kucherawy Message-ID: <162633245832.12330.18191027285156100981@ietfa.amsl.com> Date: Thu, 15 Jul 2021 00:00:58 -0700 Archived-At: Subject: [OPSEC] Murray Kucherawy's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 07:00:59 -0000 Murray Kucherawy has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- I love a good "good advice" document where such advice is missing in an important area. Thanks for doing this. General feedback: * There are several places where "*not*" appears. Is this necessary? * There are so few BCP 14 keywords in this document, which is Informational anyway, that you might consider not using it/them at all. Section 1: * "... it is possible that some of the measured packet drops be the result of ..." -- s/be/are/ * "... likely to be much more permissive that a filtering policy ..." -- s/that/than/ * "This document completes and complements the considerations for protecting the control plane from packets containing IP options that can be found in [RFC6192]." -- Should this document formally update that one? It's also Informational. * "Section 2 of this document specifies the terminology and conventions employed throughout this document. Section 3 of this document ..." -- You can get rid of "this document" everywhere in this paragraph except at the end of the first sentence. Section 3.3: Most of the forward links in the table are broken because the full section numbers got wrapped. Can this weird rendering get fixed? From nobody Thu Jul 15 03:15:38 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B76063A25A1; Thu, 15 Jul 2021 03:15:36 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?=C3=89ric_Vyncke_via_Datatracker?= To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com, tim.chown@jisc.ac.uk X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: =?utf-8?q?=C3=89ric_Vyncke?= Message-ID: <162634413621.32064.14822669773076904378@ietfa.amsl.com> Date: Thu, 15 Jul 2021 03:15:36 -0700 Archived-At: Subject: [OPSEC] =?utf-8?q?=C3=89ric_Vyncke=27s_Recuse_on_draft-ietf-opse?= =?utf-8?q?c-ipv6-eh-filtering-08=3A_=28with_COMMENT=29?= X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 10:15:37 -0000 Éric Vyncke has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: Recuse When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- As I am the doc shepherd... But please address the INT directorate review by Tim Chown: draft-ietf-opsec-ipv6-eh-filtering Regards -éric From nobody Thu Jul 15 03:17:04 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2042A3A25AD; Thu, 15 Jul 2021 03:16:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.896 X-Spam-Level: X-Spam-Status: No, score=-11.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=je3bLnyR; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=v1h9HOUS Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GSsTOT6enABt; Thu, 15 Jul 2021 03:16:53 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B57B63A25AC; Thu, 15 Jul 2021 03:16:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4812; q=dns/txt; s=iport; t=1626344212; x=1627553812; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=jEn5WmpmgnOJ0Q4Cy0kKY6paaqjh9uLKCY5zcyHOsDU=; b=je3bLnyRMaQZGJMyNm2DNTTNdV6jNPsbBuR0fb/Le3LdM8y0iCwfS3Af 2wJgGf//4CK3P+28zge0J+0z6IdM0I0ztPtfRwaxX0taOwRE8VfC+wOA7 aI5ddcUu0iWc97U19TLrnUIiar4/SRYe8bSlRl750NNT7bdkUm3Ube2+r 4=; X-IPAS-Result: =?us-ascii?q?A0AjAgCSCvBgl4oNJK1aDhABAQsSDECBTguBU1F+Wjcxh?= =?us-ascii?q?EiDSAOFOYhWA5otgS6BJQNUCwEBAQ0BASoLDAQBAYRUAheCWQIlNAkOAgQBA?= =?us-ascii?q?QEBAwIDAQEBAQUBAQUBAQECAQYEFAEBAQEBAQEBaIVoDYZFAQEBBAEBEBERD?= =?us-ascii?q?AEBLAsBCwQCAQgRAwECAwImAgICJQsUAQgIAgQBDQUigk8BglUDLwEOmwcBg?= =?us-ascii?q?ToCih96gTKBAYIHAQEGBASFQhiCMgMGgRAqgnuEDoZiJxyBSUSBFSccgjIwP?= =?us-ascii?q?oJiAQGEdzaCLoI6gUUELxQQWyQZTAEdEWSUcKZwgQ0KgySRa4VtgQGFXQUmh?= =?us-ascii?q?CSiN5YHoBeEcQIEAgQFAg4BAQaBWzmBW3AVOyoBgj5QGQ6OHxmDWIUUhQVFc?= =?us-ascii?q?zgCBgEJAQEDCYwiAQE?= IronPort-PHdr: A9a23:ffymax3mzq342+hEsmDPt1BlVkEcU/3cPA8O4dwugPRTcffr85fjO RnZ4vNgxB/MUJ7A4v1Jw+zRr+j7WGMG7JrA1RJKcJFFWxIfz8lDmQsmDZ2HCFbwavfhKTE5T 4xOUVZ/9CS9Nk5YUM/1e1zVpCi06jgfUhXyPAZ4PKL7AInX2s+2zOu1vZbUZlYguQ== IronPort-HdrOrdr: A9a23:N70UtqMqXBBpPcBcT3X155DYdb4zR+YMi2TDiHoRdfUFSKKlfp 6V88jzjSWE9wr4WBkb6Le90DHpewKdyXcH2/huAV7EZnikhILIFvAi0WKG+V3d8kLFh5VgPM tbAs1D4ZjLfCRHZKXBkUuF+rQbsaO6GcmT7I+0pRoAPGIaCZ2IrT0JdzpzeXcGIjWucKBJbK Z0kfA33gZIF05nCviTNz0gZazuttfLnJXpbVotHBg88jSDijuu9frTDwWY9g12aUIL/Z4StU z+1yDp7KSqtP+2jjXG0XXI0phQkNz9jvNeGc23jNQPIDmEsHftWG0hYczEgNkGmpD31L8Yqq iVn/7mBbUp15rlRBDynfIq4Xi77N9h0Q6+9bbSuwqTnSWwfkNLNyMGv/METvMcgHBQ4u2VF8 lwrj2kXtNsfGH9dG6W3am6azh60kWzunYsiugVkjhWVpYfcqZYqcgF8FpSC4poJlO21GkLKp gkMCjn3ocdTbpaVQGugkB/hNi3GngjFBaPRUYP/sSTzjhNhXh8i08V3tYWkHsM/I80D8As3Z WKDo140LVVCsMGZ6N0A+kMBcOxF2zWWBrJdGafO07uGq0LM2/E75T3/LI27ue3f4Fg9up/pH 0AaiIRiYcWQTOhNSSj5uw+zvn9ehT1Yd228LAq23FQgMyKeIbW X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.84,240,1620691200"; d="scan'208";a="741676065" Received: from alln-core-5.cisco.com ([173.36.13.138]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 15 Jul 2021 10:16:51 +0000 Received: from mail.cisco.com (xbe-rcd-002.cisco.com [173.37.102.17]) by alln-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id 16FAGpZR025188 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Thu, 15 Jul 2021 10:16:51 GMT Received: from xfe-rcd-001.cisco.com (173.37.227.249) by xbe-rcd-002.cisco.com (173.37.102.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Thu, 15 Jul 2021 05:16:51 -0500 Received: from xfe-aln-001.cisco.com (173.37.135.121) by xfe-rcd-001.cisco.com (173.37.227.249) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Thu, 15 Jul 2021 05:16:51 -0500 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (173.37.151.57) by xfe-aln-001.cisco.com (173.37.135.121) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15 via Frontend Transport; Thu, 15 Jul 2021 05:16:50 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UXGa4uVjIJwu6Rzz9pmjPLOt14Y9ZeE1IqifuJds+jNVDBnWp+UE/UmtQf5CZR5zB5dmrn+rF8IWA5i8WSGAn/c4t+4QkRsviTPGRc7PgpNHTO00dxiEVQE3nc2ELqNvbpgxlQsurEMPj9P3xVG+hzBK0lMYHzOlBPHyfcOzJD71RkiwadZVgNi6FKzsh4v38GXQ5SwfToYJVAPC+9EiRTBmUzzJyiBDMx8oDZfWqzHmxiFPwrp/WTP1C8jitYqpRvjoh9wdJq0MG7g4I5hWhOUvuXhFYzhVJNeRvVTYGggm3J46KyMguNX5hoZ3Fpvqbt9GcTGxuFo9+Z5EtfHZ3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jEn5WmpmgnOJ0Q4Cy0kKY6paaqjh9uLKCY5zcyHOsDU=; b=M+XvI6FU3HvEHU4cZLjT7k44OHoN274ravRk3HzucihuLOi17fZz0Fl2wVS8INHPfyZfBZtUNSj+Jh0VEmIgy01n+Abho/l0JbdwR2bcmX/7auKsU/e3IIjlWR3wgNGd+rpbyT/hP1mljPgmEPhEatngs2MkBYea7bsPnMvsWfm/siC5ftpqG9frykW7nkBcPh3XQ+MSg8Fm34B03i5KcEIvFZMX5aES2RDxCX8DQpyL2Xp0adSec0JsBeaGVp6mjxzsAgmpiCoymUCbKe4ihZ5uV2WUSXSZHo01DEHEFXYeBQgcYigaZ86fDsfppPP3fPuvGXWC2XPtlPg4v7BZHA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jEn5WmpmgnOJ0Q4Cy0kKY6paaqjh9uLKCY5zcyHOsDU=; b=v1h9HOUSe+0e5nGBAvkQ7sxVMeignrEQHiPYOgepaabp/RZ7AUJh41NSTBHGrrd24zwjUiA0AbtJk1S4bOQW6LI8Het1IsRrYKIrbgZkYI68mb8WtS/tH6Y3Nn3HUkRmJPmAB3/hixdfMRiXk3UUe1648jiH1XZaP6zv1aDfFnM= Received: from PH0PR11MB4966.namprd11.prod.outlook.com (2603:10b6:510:42::21) by PH0PR11MB4968.namprd11.prod.outlook.com (2603:10b6:510:39::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.23; Thu, 15 Jul 2021 10:16:47 +0000 Received: from PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::6d61:c160:def1:bc64]) by PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::6d61:c160:def1:bc64%3]) with mapi id 15.20.4331.024; Thu, 15 Jul 2021 10:16:47 +0000 From: "Eric Vyncke (evyncke)" To: Tim Chown , "int-dir@ietf.org" CC: "opsec@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering.all@ietf.org" Thread-Topic: [Int-dir] Intdir last call review of draft-ietf-opsec-ipv6-eh-filtering-08 Thread-Index: AQHXeMRemGqmoZ4Rok++xNDkI+jo76tD9QYA Date: Thu, 15 Jul 2021 10:16:47 +0000 Message-ID: <8DF861E8-1FDC-4D59-9DB4-D3ADEE87A506@cisco.com> References: <162627627419.7903.7002704723951798048@ietfa.amsl.com> In-Reply-To: <162627627419.7903.7002704723951798048@ietfa.amsl.com> Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.51.21071101 authentication-results: jisc.ac.uk; dkim=none (message not signed) header.d=none;jisc.ac.uk; dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ac1ea332-c670-46a0-50db-08d94779a75e x-ms-traffictypediagnostic: PH0PR11MB4968: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: hE7kgw/xUSYYi5bekOq25BiczMOHLrYbPsMZrZa8WTDxxMgrCanU5eCslnlEn1cqsodIRKZV+WCod93JuZF2zPnfo81VAq6uyJv0gFEifXQSNmNHIYlzQsXtlKemzUg4UCp7HXK/qfqRNlOhTCRHvUqOmMtbyqEokCa5DcXL+nlWR3uKhnT2P/OU+jkvin2BPi0r0TcNDrUOWPEif/b4D6n+O2c2dUeBBJD7fBod3MDiZUUYgvZzUBn5+w1UHiLbWv6OSdGy3xIaORHj5kuUE36+Z9pa8LORstNkQqQhyELUCufV0J/4O92CZa9Wru+fdwBtQXuNU3XH/qcAKyWNDs6LYzDlz3NVvDaAOApId+W4LJnYqKD+RNzptr2tgiIndTUaTxXpD6rNRGVj3225hmSQdVpcUMGolOvHB9X1T2sgTG7PV3V2D3tVFEHEjeDWEk8O5e2SES0PP6qhg0P3C6LY5d4B2gdgGYLpPeVYPnNloM0QW38AHhY/jeAR48oTIsjJ5WII2kSA377NGwYzQZ3LlIVB9LtlhbbH0dtIhm1RTPXRN72xeGW4LsXyom9rsoQ6uavgRf7AMgvY9NMDP/FLmLsWxjGH43fVCbUXJoKdGuI3zh3V4njR2v07vbjNSxZWRfmEeOcTCGGLTuLRJj0pDOnJywFB24KyWIc/bnUgat7j6DdaJ/L61/jMSxMeNA/8ESzyr5XPOJP2jxtsD/8VXehvx45LaSINMsjI7cBWn8Wl9RBSMuNL0EuDOAt6gqGJq4IiS5JkoN4OIkZojNIe6/J/f47/EaKL9aJTMZBjgNtl+bVguEbEOcS0DVkY x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PH0PR11MB4966.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(376002)(396003)(136003)(346002)(39860400002)(366004)(110136005)(71200400001)(2616005)(316002)(54906003)(53546011)(5660300002)(38100700002)(8936002)(2906002)(122000001)(66446008)(64756008)(66556008)(66476007)(4326008)(6506007)(66946007)(186003)(8676002)(36756003)(6512007)(83380400001)(76116006)(91956017)(6486002)(966005)(86362001)(33656002)(478600001)(38070700004)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?VVhiN1lyMThTVzExazAwTktxUGtNOGVOaG5BcUJqdU1FaUprSCtLL1lwWFZv?= =?utf-8?B?YVlKRUl5NTlIdFh6ekhTcTlXejVpLzVzT0ljeFFrb1kzSGoybCsrYlo5cytr?= =?utf-8?B?VmRwWE12aFhpMXR0SlNBck1SRmZpbTEyeGQ5bTQvb0FzWFhBNXB6bXhMVVMx?= =?utf-8?B?RytLR0NuZDBnWS93dEFES3NDQmxCblkwSDNVMVpaRjVnbGFDZHpRWGxNeEIr?= =?utf-8?B?dWMvSThQK2ROMU9zR2E1eXovTjJOSXJRc3ZBN0ZSVkR2cmZBWnMvT0piSzA3?= =?utf-8?B?Sk9xdGFFTEI2WUsvYy9MUnhob293amJLdmNIdTZmZmdabUZQRytMWFFCZnRO?= =?utf-8?B?MmJDZmhobVlSb1Z1MThTUmQwVytla0VMbTFaL2tXcTlVeFFPUW1ReTl5a29s?= =?utf-8?B?bkdiSFFrVGtDMjEzazVEZzRHR2N1enE0VGRaeUdVSE9FbmVUM0ovNjAzd1gy?= =?utf-8?B?MXJ1THZFUXFsOWl1UStvT3hUY1dGdFJGME1ocXFSTTc0ZU9WcnBFQlVUenlE?= =?utf-8?B?Uy85SDBvU0Zld0dXRnpQTGNOdjJrWHh5dUYwL2I2TzRhZmFRbStYaGNQR1pV?= =?utf-8?B?Zk4wWXNyUVY3OCtxQm9yYmE5ZFNxVWk3YVBaOEU2N2pTWHpYY2VQbzAvVEMv?= =?utf-8?B?YXpDMG5TaUVmTlRsU25EZFkwVUFxc0VNMlV0YVRQbDl0aGd3TDQwcExEYjFC?= =?utf-8?B?TktvNXdldm9wbWhPY2hxZGNSUm0xeVBLb3RZYnZ2MkZ6RzQzSGZhRkNvNk1K?= =?utf-8?B?cWQvUTRVVE5ic0JMdmJocVkwbTdLYlhVZEZWUWlYa0ZDWDZYblVXTDJwWkJi?= =?utf-8?B?bGVNUlBwR3Q1bkNHMDdheDM3dVZuOHFaLytWT256N1VQTU9pYi9acWx5OVpQ?= =?utf-8?B?VFBReS9CcEdPTDc0V2V5YVdPTDEyK2hjWHVIQUswTHdSSm9kd1ZVQWhLek1H?= =?utf-8?B?c2tVNTR0UTdaNmtPeEpNMGVpeFZUc2NRREJDNlZaa2VLMFpDck5SWTF3L2kv?= =?utf-8?B?UTY0eHIwVGJhOU5JRHl4WVgxMnh0VDhtL2cxZW5UaWF1Mnl6V1hpRFU0Ynli?= =?utf-8?B?WFg5d0tGWHpvcFhCbUNwd2t2azdBdHI3TE5lcGFTU0xTeGJMU2Y5YkduTURr?= =?utf-8?B?bHhFUVFQR3ZQa2xWcSt6cnhzdUlsKzNTb1FXMERWdmd4Q0dubEpWd2V0Ym13?= =?utf-8?B?Yk1FWnhtVEZ4UEFmcXJacnBlbVdBajFlcjNxUGtqM1Rqd0Z3TXhpcityWlph?= =?utf-8?B?K3VDaTRSUTlvOWRpT1ZZK28wWW56M0JVZWFtcy9Zd1BYQzQ0WGc5L2FaUWU2?= =?utf-8?B?WXpEeUtBRjJHWlVzdHJlS3dveW9zeFNHK0gxMXRRUVEzbTJrczVPSzAzUEd3?= =?utf-8?B?RTk2NXF0amJSUWoyLzBvQnZSZDlNSm54UGZyWmd6T2FEN0tBMFBRb3pmaDg5?= =?utf-8?B?VHVjdmdnS3hLeHZpTFkyMDZucVRLOFlsQnhYYkFiSUlRSUpCREJMZ0w3WXE1?= =?utf-8?B?STJpS3U2cXBTYit1YmdZTW1tV2RHLzZzaHhPU0U1S0QvSmkvYmxBcm1SVS8w?= =?utf-8?B?TVpTNkVUc1BtVGdWaG1YRG05NWxjZVJVV2ROSGRNSlpMK1hCN0xSdUtmV29s?= =?utf-8?B?ZGNUb1MrNlp6cGxiUzZ2WEVpZEVvUjVUWUhpcDkwQjdjejlSSlpUYU0vOFQr?= =?utf-8?B?MFMzRElBZ1FMa01LcFFHZ0ZIaFZKcFFNNVB1NzM0UUptL0tFSEtSMjhYbjla?= =?utf-8?B?dVd5VWtvS2Frbm1CNEVRYXZ5RVFGNGc5R1pIdkZxZEIwdTJyc2c1UFZKTVky?= =?utf-8?B?dXNpWkF4VnJzY0hQc1gzNWRrOUdFQjBTa2ltQzB6Y2RFZ3d0QVp3QnhKRjRh?= =?utf-8?Q?AirhMjQ7Aix82?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4966.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: ac1ea332-c670-46a0-50db-08d94779a75e X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2021 10:16:47.2932 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: FdSof4l0XViutwfB67214clbvPhVprWp/Z+R6EOrKjvpncr04RMzFrSbXRdmhvM0obz9zp0leA1TusCv59LZ4g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB4968 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.17, xbe-rcd-002.cisco.com X-Outbound-Node: alln-core-5.cisco.com Archived-At: Subject: Re: [OPSEC] [Int-dir] Intdir last call review of draft-ietf-opsec-ipv6-eh-filtering-08 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 10:16:58 -0000 VGhhbmsgeW91IFRpbSBmb3IgeW91ciByZXZpZXcganVzdCBpbiB0aW1lIGJlZm9yZSB0aGUgSUVT RyBldmFsdWF0aW9uLiANCg0KSSBoYXZlIGp1c3QgYWRkZWQgeW91ciByZXZpZXcgdG8gbXkgYmFs bG90IHBvc2l0aW9uLg0KDQpSZWdhcmRzDQoNCi3DqXJpYw0KDQrvu78tLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KRnJvbTogSW50LWRpciA8aW50LWRpci1ib3VuY2VzQGlldGYub3JnPiBvbiBi ZWhhbGYgb2YgVGltIENob3duIHZpYSBEYXRhdHJhY2tlciA8bm9yZXBseUBpZXRmLm9yZz4NClJl cGx5LVRvOiBUaW0gQ2hvd24gPHRpbS5jaG93bkBqaXNjLmFjLnVrPg0KRGF0ZTogV2VkbmVzZGF5 LCAxNCBKdWx5IDIwMjEgYXQgMTc6MjQNClRvOiAiaW50LWRpckBpZXRmLm9yZyIgPGludC1kaXJA aWV0Zi5vcmc+DQpDYzogImxhc3QtY2FsbEBpZXRmLm9yZyIgPGxhc3QtY2FsbEBpZXRmLm9yZz4s ICJvcHNlY0BpZXRmLm9yZyIgPG9wc2VjQGlldGYub3JnPiwgImRyYWZ0LWlldGYtb3BzZWMtaXB2 Ni1laC1maWx0ZXJpbmcuYWxsQGlldGYub3JnIiA8ZHJhZnQtaWV0Zi1vcHNlYy1pcHY2LWVoLWZp bHRlcmluZy5hbGxAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbSW50LWRpcl0gSW50ZGlyIGxhc3QgY2Fs bCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1vcHNlYy1pcHY2LWVoLWZpbHRlcmluZy0wOA0KDQogICAg UmV2aWV3ZXI6IFRpbSBDaG93bg0KICAgIFJldmlldyByZXN1bHQ6IFJlYWR5IHdpdGggTml0cw0K DQogICAgSGksDQoNCiAgICBUaGlzIGRyYWZ0IHByb3ZpZGVzIGFuIGFuYWx5c2lzIG9mIElQdjYg RXh0ZW5zaW9uIEhlYWRlcnMgYW5kIE9wdGlvbnMsDQogICAgZGlzY3Vzc2VzIHRoZSBpbXBsaWNh dGlvbnMgb2YgZGlzY2FyZGluZyBwYWNrZXRzIGNvbnRhaW5pbmcgdGhlbSwgYW5kIG1ha2VzDQog ICAgcmVjb21tZW5kYXRpb25zIG9uIGNvbmZpZ3VyYWJsZSBmaWx0ZXJpbmcgcG9saWN5IGZvciBl YWNoIEVIIGFuZCBPcHRpb24gZm9yDQogICAgdHJhbnNpdCByb3V0ZXJzLg0KDQogICAgSSBoYXZl IGZvbGxvd2VkIHRoZSBkZXZlbG9wbWVudCBvZiB0aGlzIGRyYWZ0LCB0aG91Z2ggbm90IGluIGdy ZWF0IGRldGFpbCwgYW5kDQogICAgd2FzIGEgY28tYXV0aG9yIG9mIFJGQzc4NzIgb24g4oCcT2Jz ZXJ2YXRpb25zIG9uIHRoZSBEcm9wcGluZyBvZiBQYWNrZXRzIHdpdGgNCiAgICBJUHY2IEV4dGVu c2lvbiBIZWFkZXJzIGluIHRoZSBSZWFsIFdvcmxk4oCdLCB0d28gb3RoZXIgYXV0aG9ycyBvZiB3 aGljaCBhcmUgdGhlDQogICAgYXV0aG9ycyBvZiB0aGlzIGRvY3VtZW50LiAgU28gSSBoYXZlIGZh bWlsaWFyaXR5IHdpdGggdGhpcyBzdHJhbmQgb2Ygd29yay4NCg0KICAgIE92ZXJhbGwgSSBjb25z aWRlciB0aGlzIGRvY3VtZW50IGlzIFJlYWR5IHdpdGggTml0cy4NCg0KICAgIEdlbmVyYWwgY29t bWVudHM6DQoNCiAgICBUaGUgcHVibGljYXRpb24gb2YgSUVURiBndWlkYW5jZSBpbiB0aGUgYXJl YSBvZiBJUHY2IEVIIGFuZCBPcHRpb24NCiAgICBoYW5kbGluZy9maWx0ZXJpbmcsIGFuZCBzcGVj dWxhdGlvbiBvbiB0aGUgcmVhc29ucyBiZWhpbmQgdGhlIGRyb3BzIG9ic2VydmVkIGluDQogICAg UkZDNzg3MiwgaGFzIGJlZW4gc29tZXdoYXQgY29udHJvdmVyc2lhbCBpbiB0aGUgNm1hbiBhbmQg djZvcHMgV0dzLiAgSG93ZXZlciwNCiAgICBoYXZpbmcgaGFkIHRoZSBvYnNlcnZhdGlvbnMgcHVi bGlzaGVkIHNvbWUgdGltZSBhZ28gKHNlcGFyYXRlIHRvIGFueQ0KICAgIHJlY29tbWVuZGF0aW9u cyksIEkgd291bGQgYWdyZWUgdGhhdCBpdCBpcyBub3cgdGltZWx5IHRvIHB1Ymxpc2ggdGhpcw0K ICAgIEluZm9ybWF0aW9uYWwgZG9jdW1lbnQgYXMgaXQgcHJvdmlkZXMgd2hhdCBJ4oCZZCBjb25z aWRlciBnb29kIGd1aWRhbmNlLg0KDQogICAgVGhlIHN1bW1hcnkgb2YgZXhpc3RpbmcgRUhzIGFu ZCBPcHRpb25zIHByZXNlbnRlZCBpbiB0aGlzIGRyYWZ0IGlzIHVzZWZ1bCBpbg0KICAgIGl0c2Vs Zi4gIFRoZSBzdHlsZSBhbmQgZm9ybWF0IG9mIHRoZSBkb2N1bWVudCBpcyByZWFsbHkgbmljZSwg ZWFzeSB0byBmb2xsb3csDQogICAgYW5kIHdlbGwtd3JpdHRlbi4NCg0KICAgIEkgbm90aWNlIFJG QzY1NjQgaXNu4oCZdCBtZW50aW9uZWQsIHNob3VsZCBpdCBiZT8NCg0KICAgIFNwZWNpZmljIGNv bW1lbnRzOg0KDQogICAgUC4zDQogICAg4oCcU2luY2UgdmFyaW91cyBwcm90b2NvbHMgbWF5IHVz ZSBJUHY2IEVIc+KAnQ0KICAgIEl0IHdvdWxkIGJlIHJlYWxseSBuaWNlIHRvIGhhdmUgYSBsaXN0 IG9mIHN1Y2ggcHJvdG9jb2xzIGluY2x1ZGVkIGluIHRoZQ0KICAgIGRvY3VtZW50LCBzbyB0aG9z ZSBjaG9vc2luZyB0byBzZXQgYW5kIGltcGxlbWVudCBwb2xpY3kgY2FuIG1vcmUgY2xlYXJseQ0K ICAgIHVuZGVyc3RhbmQgdGhlIGltcGFjdCBvZiB0aGF0IHBvbGljeS4gVGhpcyBjb21tZW50IGFs c28gYXBwbGllcyB0byAzLjQuMS40IChwLjkpDQoNCiAgICBQLjQNCiAgICDigJxBbGwgc3RhbmRh cmQgSVB2NiBFSHPigJ0NCiAgICBEbyB5b3UgbWVhbiB0aGUgbGlzdCBpbiBUYWJsZSAxIGhlcmU/ DQoNCiAgICDigJxXaXRoIHJlc3BlY3QgdG8gb3BlcmF0aW9uYWwgY29uZmlndXJhdGlvbnPigJ0N CiAgICBQZXJoYXBzIHNheSDigJxwb2xpY3nigJ0gaGVyZSBhcyBpdCBpcyBwb2xpY3kgdGhhdCBw cm92aWRlcyB0aGUgcmF0aW9uYWxlIGZvciBub3QNCiAgICBqdXN0IHBhc3NpbmcgdGhlIHBhY2tl dCBhcyBwZXIgNzA0NSwgYW5kIGl0IE1VU1QgYmUgY29uZmlndXJlZCBwb2xpY3kgdGhhdA0KICAg IGRpY3RhdGVzIGEgZGlmZmVyZW50IGhhbmRsaW5nLg0KDQogICAgUC45DQogICAgSSBhc3N1bWUg eW91IGNhbiBhbHNvIHNheSB0aGF0IHJhdGUgbGltaXRpbmcgd2lsbCBicmVhayBwcm90b2NvbHMg dG9vPyAgU2hvdWxkDQogICAgd2Ugc2F5IOKAnERpc2NhcmRpbmcgb3IgcmF0ZS1saW1pdGluZ+KA nSBpbiAzLjQuMS40Pw0KDQogICAgcC4xNw0KICAgIENvdWxkIHdlIGFkZCBhIHN1bW1hcnkgdGFi bGUgZm9yIE9wdGlvbnMgbGlrZSB3ZSBoYXZlIGZvciBFSHM/DQogICAgKFRoZXJlIGFyZSBzb21l IGhlcmUgdGhhdCBJ4oCZZCBmb3Jnb3R0ZW4gZXhpc3RlZCBhbmQgYXQgbGVhc3Qgb25lIEkgd2Fz IHVuYXdhcmUNCiAgICBvZuKApikNCg0KICAgIE5pdHM6DQoNCiAgICBQLjcgYW5kIGVsc2V3aGVy ZQ0KICAgIElzIGl0IFJIVDAgZXRjIG9yIFJUSDAgPyAgQWxsIHRoaXMgdGltZSBJ4oCZZCB0aG91 Z2h0IFJvdVRpbmcgSGVhZGVyIDopDQoNCiAgICBwLjgNCiAgICBQdXQgdGhlIFR5cGVzIGluIG9y ZGVyIGJ5IGNvZGU/DQogICAgU2FtZSBvbiBwLjEzDQoNCiAgICDigJQNCiAgICBUaW0NCg0KDQog ICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAgICBJ bnQtZGlyIG1haWxpbmcgbGlzdA0KICAgIEludC1kaXJAaWV0Zi5vcmcNCiAgICBodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ludC1kaXINCg0K From nobody Thu Jul 15 04:40:20 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A268B3A27F4; Thu, 15 Jul 2021 04:40:18 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Zaheduzzaman Sarker via Datatracker To: "The IESG" Cc: draft-ietf-opsec-ipv6-eh-filtering@ietf.org, opsec-chairs@ietf.org, opsec@ietf.org, =?utf-8?q?=C3=89ric_Vyncke?= , evyncke@cisco.com X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Zaheduzzaman Sarker Message-ID: <162634921816.10311.15436698790061553757@ietfa.amsl.com> Date: Thu, 15 Jul 2021 04:40:18 -0700 Archived-At: Subject: [OPSEC] Zaheduzzaman Sarker's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 11:40:19 -0000 Zaheduzzaman Sarker has entered the following ballot position for draft-ietf-opsec-ipv6-eh-filtering-08: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-eh-filtering/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thanks for the efforts on the document. I think most of my comments have already been mentioned by my fellow ADs. I have got one in addition - * Section 2.3 : says -- o Permit this IPv6 EH or IPv6 Option type. o Discard (and log) packets containing this IPv6 EH or option type. o Reject (and log) packets containing this IPv6 EH or option type (where the packet drop is signaled with an ICMPv6 error message). I believe logs are mentioned here for a good reason but I haven't seen any mention of logging in any of the Operational and Interoperability Impact sub sections. I was expecting some discussions somewhere as "log" is mentioned in this section, otherwise this mention of log is out of context in the document. Is there any particular reason for not mentioning (and log) for the permit case? From nobody Thu Jul 15 13:04:17 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 351B23A0EFF; Thu, 15 Jul 2021 13:04:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.498 X-Spam-Level: X-Spam-Status: No, score=-1.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.399, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MxgjO5NX5MNd; Thu, 15 Jul 2021 13:04:06 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E9553A0EFC; Thu, 15 Jul 2021 13:04:05 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 16FK3umt012694 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Jul 2021 16:04:00 -0400 Date: Thu, 15 Jul 2021 13:03:56 -0700 From: Benjamin Kaduk To: Fernando Gont Cc: "ek.ietf@gmail.com" , "opsec@ietf.org" , "opsec-chairs@ietf.org" , "iesg@ietf.org" , "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" Message-ID: <20210715200356.GX74365@kduck.mit.edu> References: <162511582896.10745.1599530578040574909@ietfa.amsl.com> <20210708020020.GA17170@mit.edu> <33b1186c2b8283be587e4a7011836d4e653bcde4.camel@edgeuno.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <33b1186c2b8283be587e4a7011836d4e653bcde4.camel@edgeuno.com> Archived-At: Subject: Re: [OPSEC] Erik Kline's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 20:04:11 -0000 Hi Fernando, On Thu, Jul 08, 2021 at 03:48:05AM +0000, Fernando Gont wrote: > Hello, Ben, > > On Wed, 2021-07-07 at 19:00 -0700, Benjamin Kaduk wrote: > > On Wed, Jun 30, 2021 at 10:03:48PM -0700, Erik Kline via Datatracker > > wrote: > > > [S4.3.9.4] [comment] > > > > > > * It seems fairly clear from RFC 5570 Security Considerations that > > > a > > > CALIPSO option is best protected with an AH, and in such cases > > > stripping > > > the CALIPSO option would cause the packet to fail validation at > > > the > > > (suitably configured) destination. > > > > > > Similarly, it might be good to note in S4.3.9.5 that if an AH is > > > present > > > presumably the advice from S3.4.5.5 applies. > > > > Probably not very relevant here, but the current IPSECME advice is to > > use > > ESP with null encryption rather than AH. > > A pointer might be worth including. What document and section should we > be referencing here? It's not perfect, but https://datatracker.ietf.org/doc/html/rfc8221#section-5 does include: ENCR_NULL status was set to MUST in [RFC7321] and remains a MUST to enable the use of ESP with only authentication, which is preferred over AH due to NAT traversal. ENCR_NULL is expected to remain MUST by protocol requirements. -Ben From nobody Mon Jul 19 13:05:05 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B87483A0045 for ; Mon, 19 Jul 2021 13:05:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.547 X-Spam-Level: X-Spam-Status: No, score=-2.547 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.452, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=Q/H7g39H; dkim=pass (1024-bit key) header.d=juniper.net header.b=dX3M0P3S Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qSXTTzzFDwuC for ; Mon, 19 Jul 2021 13:04:57 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BA773A003E for ; Mon, 19 Jul 2021 13:04:57 -0700 (PDT) Received: from pps.filterd (m0108157.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 16JK0PDT006254; Mon, 19 Jul 2021 13:04:56 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : subject : date : message-id : content-type : mime-version; s=PPS1017; bh=xVRtigLUx7G7e42A4LLzYNRiWyj7OlBHHGNc5EMJuF8=; b=Q/H7g39HpfWwXmqS4+vqwLvpmIAZJ+yQeVYanCz1L9YCvc0LAQ2WoZxxYIQ+D970dElM sMe55lRlZSBL05K1a40EK7E5F2K4Y9cQIoDlDk3RipphdP1CMvSiDt/A/p2rfH09KZrx S7rqsI2bG+Au8YUKXrlr41tS/5AtV+mhws5oyAQWq/64/xjG5SLr5boi1Nub/FRjP99X NORiYFO/7QJURCgcNNitiaQnizTQOBwvRPYNI5GEu5InKRngyH/OXsD25xvElBGa/FKZ VFN9i/5V0h+ERHHJkLeusmxybjQHBTSxj9Hum0TfKyuHVLqrq/gmcVdL+5F3kMH6J9qB TA== Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2103.outbound.protection.outlook.com [104.47.55.103]) by mx0a-00273201.pphosted.com with ESMTP id 39w834ruh3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 19 Jul 2021 13:04:56 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SZc5CBln2VYxHGAYzVqUlH+qOtR8TcJVB8dq0tw1fZ2aW0ntM+pLLYAogryzL1GkrjxkdEkz7fGARMUiqGot5hHql/+DRhcEN8mWjGDQNQV508jzcrIgaIRtUftOptHuLgPNGmQUvoBsIIpVDjFqspdJRJ7ZQrzh9C9COwIQWbE7KhJll2vmKJc4tdDFfonoKBqcg8YXoQd/khYjkkra6WkD3+N57rpU2un1pHVGI72jQh7jNj5bm5lXwestt/WR3DDY/Bqp0s9MOH8eJ0vyMc5ppqNcQ13YbaaSMm1Wtm2smtF9M/9ek0DozhzU7eEOsUPzLCC/vq7+c4VMP54keA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xVRtigLUx7G7e42A4LLzYNRiWyj7OlBHHGNc5EMJuF8=; b=ddM0AqDcpT4qd6g7v0/Ra2+Yuc6Gj1+JCAPV9jfnJiqpAwMxHHJLniZbZ3RiINCyFE+hMGB9sNOBWaxYqcEJz8L4KOX7QTtbyx5NjC/K/MF4fYA5yaIQrcjFHNFW7TTVZmScI9U4nKgFxbI5BWzhaQ8/JDjIX3xZ9K99JDehTdBa1VQq1fqxzktw3HjHwqUkcNnzfApnoA/l3D40JwC6Osfv42o6svDTNmoYMcsFy/S/78jN/QFufTZhz2uHFAiB9cVKRtTuMJL53Lm0wLaPx8J6SSijtuYKciQqpYwUwClaZQ0+yhyHhEfSdFmNYivaRi45KNonMn3kgcvulf41Kg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xVRtigLUx7G7e42A4LLzYNRiWyj7OlBHHGNc5EMJuF8=; b=dX3M0P3SCerpbiPF6RzZw8Zh4YEYW/v/WXqTjDgluVNykVhbEPK/FvZ4Hi9Esn6oQ87yyHms2PvRu/JgkOhoh5wD0npYGPI+zM/TsggU5snkq6fPFpg1ptMOPHLIxPx34+/5Nlh30VQDQ3MtpsEzL87jWg6eNW5M3pqIF8WMYhs= Received: from BL0PR05MB5316.namprd05.prod.outlook.com (2603:10b6:208:2f::25) by MN2PR05MB6959.namprd05.prod.outlook.com (2603:10b6:208:18b::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.9; Mon, 19 Jul 2021 20:04:51 +0000 Received: from BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::3ce1:4653:c6ed:80fb]) by BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::3ce1:4653:c6ed:80fb%6]) with mapi id 15.20.4352.021; Mon, 19 Jul 2021 20:04:51 +0000 From: Ron Bonica To: OPSEC , "kirsty.p@ncsc.gov.uk" Thread-Topic: Agenda IETF 111 Thread-Index: Add82QzO1OU1FA44SjS5xL8tDowy1A== Date: Mon, 19 Jul 2021 20:04:51 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.6.100.41 dlp-reaction: no-action msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=true; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2021-07-19T20:04:49Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Method=Standard; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=0633b888-ae0d-4341-a75f-06e04137d755; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=733554d0-5ac9-4474-829f-23f04c724966; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ContentBits=2 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=juniper.net; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0eb95353-fd44-487e-9148-08d94af0781b x-ms-traffictypediagnostic: MN2PR05MB6959: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: w1r53+RnVSywOu+g+OyJnKOjG/vjDz/i9ynTm01/4qxJZK4lPwpHuT2kIca7Y13EaiIrxa+g+rbOiHLs1jfpx3F4aM+gMXVExP+kL5UlXVcdsk264LBLLR/3+8HiJPhROeHiZN/mAeZH7mEh2b++1hmT5dX2zhuFGCDp3S6kzcnvx8mcgrZhagv3KDs+VhIRT2f/y7aMl7Q3rquc8x+XHe1Icuf5gT1uIhzegjLucyTG/BSzb+o1FBc217peS9HqHA67T2yG5nsvRt1T0/MmycwYzorOjNXT+Ayt1tYspgMDuMEvVXdRaXa9pAn4iNl3NpbGhy9rkBrwP5BYOYBa0e+QDpJsMx+30lK55TG7MYDEbOEOEJxXNAL+3fl2GFKPoYsOkYScPflLz7gmekTVa3T5HNyTJzZUCTjnALbbKPT1sJG+mIXez0AeITS6BONWX7dTfJk34JVJ3yodKO8abKIbqAxjEM6U8d456m48Cf+hL1GLVyvT0LbvYFBrDpGQPi/8vMqUBHyKuH0nYDqJbgdpGyCqxlGOuoCtYXitPvPStHAhFyYpRGWBTKc/EWR+91cHUffNhUQ+cXte0HWiPvUsio+wIBCYVu9CtSEqvIRR1kuwB31fdrWr0om5lILLGpC4J/8V6aTT7FRebgFHacI6AMphxZmRJhjKESYay+roHSnajIEAkdFHQpWVGxy5V6dTrbCf53tKfIPmgnSTPA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR05MB5316.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(110136005)(64756008)(66556008)(316002)(33656002)(52536014)(86362001)(71200400001)(66446008)(6506007)(7116003)(66476007)(508600001)(2906002)(9686003)(558084003)(38100700002)(5660300002)(83380400001)(186003)(122000001)(26005)(7696005)(55016002)(76116006)(8936002)(8676002)(66946007)(38070700004); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?zwI0GYnFxhAWBUZcF9v5vTgpq+EOed6s1pzHUzTLZ3a6a9l+fCr6JsSQalWz?= =?us-ascii?Q?GLOmm5wPi7FrA+lYPUvoeLRO3GrNJzsLLgzZNm+bop0hLg+eAnvME4y0IQ9Z?= =?us-ascii?Q?EPEQcKCynNefyAMu1C+RzDhMF67pj0cZUvT99R0yrkSf25LaQV4q6xkpaXbv?= =?us-ascii?Q?VKhvo+lVYc/HP3sVhH9++pYhtYMn59e6iOt+uWl7q+FNEfEEMJXQdC6O4zKP?= =?us-ascii?Q?QTWQlh27oqqzf/ZF9BpuePkzx58Eza7JxzVI59pMAv9Mv5Z5QhXOo2kc6bND?= =?us-ascii?Q?VPAig+Z704vFrR/vx9r29F2bfSF9bgZwYboesHatMfcPZNO3oin9qtaiRBgo?= =?us-ascii?Q?TOxh/XjianMbjClVHkcLj4cYUMnsveaB7KwLUWnoVge5yxUlvY9NiwQsScfm?= =?us-ascii?Q?N6zV6pFkkjnv9rGnUwA2rNwixEsfRhFkaUO9yEeNA1nrV9ciwC5knyW56WR3?= =?us-ascii?Q?/TKuZtfrpkuGwaE0Fk+XrgJ0si3E7isfVtVdNHTOnp8UxF7YB3tK3lFklJUy?= =?us-ascii?Q?TuNfNxRFUfIQbL4jAP2dZQ9MGGSTc3G7oFZ3a+lLDADyto+roKmSwz8cgsIT?= =?us-ascii?Q?Ti3wI6igkdT2w/CWevjJYIraBN6vFYVxUi9IXdLz4Y/NcQu1zChcam5wA7Te?= =?us-ascii?Q?p4wHguxptPh1Bvluf5cy/DB4T6KFHZd1CdebEHyzbQLvhvy045CHyQ6zz5cw?= =?us-ascii?Q?2lyTgAJgo1XEiQ4/NnIO6wcqdJ991Bjojoz+6LPK1Dh6/4oiDHF5bFnl22Vy?= =?us-ascii?Q?s8h42OvoOKnnoZkimXrQjgs6eYmtih9/VPquuLbHQ2dr/BUBcxxFqdhawEJe?= =?us-ascii?Q?nBI/G0kHO3/GoM38fVDhmOSFtj0XlDszMZuI3fGRC2ZMNTDrXM7BCCNEuMAZ?= =?us-ascii?Q?l5QiPz7xVYvDbUDbuT4TKpQwrtb3itWL8RH5xop+W8BP5CGpgLBnsyRMee0Q?= =?us-ascii?Q?0lhhyWISHj99ovAkQ03aDIqPY5Z3n2dXCJT/n9nILDwsLPUqnKFVgr3rAn5k?= =?us-ascii?Q?uF0K4v4NBA3YcRzQk3gI4AXk+qH1uZDzc9dclLP95da1pmh7q061sYMvzrCK?= =?us-ascii?Q?PPQRc7LsSjl1PwSEJ0kqcBAT1g31NlEE2Q5/v08sbd3Y4nLPQitth7m9eILT?= =?us-ascii?Q?B875eEyHjZ+ut2eQVFK7+AYU+NgiuQLSQvBgMDHDyZjeNGMpMdVmyiK5wCYr?= =?us-ascii?Q?8ec2enxTSsmW2va/8NQIPTpiZV5nK10x18ZTU8MLhVuZX7b/5vsxnjWVSfAN?= =?us-ascii?Q?yV1YpufUYBdyrcP8hN8T5T3F+q/1K+w/NkCiiOwpgaYTGdLhdZdhb7yHust0?= =?us-ascii?Q?J3bpKnzAzo+bn/MQq8Fjnzop?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR05MB53163386771CFD221E3BF57EAEE19BL0PR05MB5316namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BL0PR05MB5316.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0eb95353-fd44-487e-9148-08d94af0781b X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2021 20:04:51.5805 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: bLN0AIEFUzxbdRq0IHTFhDLPErHtHX6PAgpzRXJsn0hBggpW9O0LwSisay3Bg+p/+d4lxKSHObP9je8hE9EnJA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR05MB6959 X-Proofpoint-ORIG-GUID: 3bagOoC806V6JltC253itFdJe6LcE137 X-Proofpoint-GUID: 3bagOoC806V6JltC253itFdJe6LcE137 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.790 definitions=2021-07-19_10:2021-07-19, 2021-07-19 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 mlxscore=0 adultscore=0 clxscore=1011 phishscore=0 priorityscore=1501 malwarescore=0 bulkscore=0 impostorscore=0 suspectscore=0 spamscore=0 mlxlogscore=855 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2107190113 Archived-At: Subject: [OPSEC] Agenda IETF 111 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Jul 2021 20:05:04 -0000 --_000_BL0PR05MB53163386771CFD221E3BF57EAEE19BL0PR05MB5316namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Folks, I have just posted the agenda for our IETF 111 meeting. There is still plen= ty of time on the agenda, so please email me if you have something that you= want to present. Presenters, Please send your slides as soon as possible. Ron Juniper Business Use Only --_000_BL0PR05MB53163386771CFD221E3BF57EAEE19BL0PR05MB5316namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Folks,

 

I have just posted = the agenda for our IETF 111 meeting. There is still plenty of time on the a= genda, so please email me if you have something that you want to present.

 

Presenters,

 

Please send your sl= ides as soon as possible.

 

   &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;        Ron


Juniper Business= Use Only

--_000_BL0PR05MB53163386771CFD221E3BF57EAEE19BL0PR05MB5316namp_-- From nobody Fri Jul 30 15:53:39 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F73C3A14AF for ; Fri, 30 Jul 2021 15:53:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.547 X-Spam-Level: X-Spam-Status: No, score=-2.547 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.452, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=FzZMcXdo; dkim=pass (1024-bit key) header.d=juniper.net header.b=MAj66P3e Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8tuc_d4MH2E3 for ; Fri, 30 Jul 2021 15:53:31 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BABC3A14AB for ; Fri, 30 Jul 2021 15:53:31 -0700 (PDT) Received: from pps.filterd (m0108163.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 16UMoIfx002947 for ; Fri, 30 Jul 2021 15:53:30 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : subject : date : message-id : content-type : mime-version; s=PPS1017; bh=wAaa16jWEBB2VnDxZFOaYq4uAcUxPNV2sn6neInswFM=; b=FzZMcXdoehJkqNajkp5Oo8MGsoez9wxhRSuQKAD+qo7HbPgYtFlPNP2Rw7g2hGc+bVn8 2ZdzRBInsIt/8XTTeFZMN4s1SH3/crMljNs28tSDG1/uvFne88Go1b9clzs/T+h9EiMX tQo+gYCUcGoL99EqXqteQZ0ZUKKLG7rWH/clt6QkbM1sxw5WfFDzhyPMBZsmySmL14s4 P3XCVL8MT2VLDP67JdSrXRbsGWP1T7aMleWxITxR35m33AkB/yI4yxwFOj0a/4fIjCbf Xd76Yyp9EdbqDOq46Qka15NYNVKM9aBlUF3b3PVQKCycDhoBj6IIxp1ziXt4jPnGCwp/ Iw== Received: from nam12-dm6-obe.outbound.protection.outlook.com (mail-dm6nam12lp2173.outbound.protection.outlook.com [104.47.59.173]) by mx0b-00273201.pphosted.com with ESMTP id 3a4jb0rsxs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 30 Jul 2021 15:53:30 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ayzyZ7zl9AVFLJfPO1GHpmCc8nM8oaScKPNTYI69xhDiq8y965yUoauCdU/yFHuGwlS0QlJ6OD2HuYVd56d9D7F/XcO8jZ5+JAvz4GnQsLJE0qmbJQ8i7un526b98WO1YTsJhFSBHj+vHAMcawCcDR88YLRsclHxynWQysCzZozimmo0daJWtNPbqjzzFvHV9KGMmf9YTZPvLBvh/7KJm3hHYBX4aHql1PZHx0v3aQTk9BTlaJYl4e9/eTI3R0H/qR42k1fCBxoGIPTIjvniPyiErRleT9jaY++G2SEoxE+XHKnG0Mv0fxjPoTYWjtxZ2nwRggRtfUyamFWAW9PZ1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wAaa16jWEBB2VnDxZFOaYq4uAcUxPNV2sn6neInswFM=; b=Fxjg+dOD+2teNiyRYbF9nx+69KYyppx0Mds66o341xsvcoHtD3Ea+FA1EB0Uq3KdJlWHsTUxZiko6UhKee/tANpoEbY4BApT6Vp02YQunEdZr5bk9PNU76IrjX4DJxsB9XdFhfNxH7EAqI57xcYI2heXGqip3sJfR5Myeifs/PLRSSHt7LfMtJyyHeHSvQmQIg/E1+w6WhYDqxVdBHaKm5EiZG1chVSXw8WEr/P4nAvpw03QY2H3wgeAlrh+hbIEA8BfCbmsmgkrDvwfCRmGf19vreU6fagFu5Rg+jcJvc3kFqpANlkvI4yTA/md/DscMvHYDgfIZMd/0/3u7CVk2A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wAaa16jWEBB2VnDxZFOaYq4uAcUxPNV2sn6neInswFM=; b=MAj66P3eBpV5etf9d8FpK3uuaXLRhTI9FxO3EBHXjlmNbptsQgTcHpfPraL/zIpAZ0Tvva0/fy9y835ejYCk7q8Q+B5O2+VcCtwm9o9oehPv2TgCFS9t2NGW6ObIKJ/K88+nuL0XFml29QMI0Dr1kg30fTdeAIueNveIyO00Cno= Received: from BL0PR05MB5316.namprd05.prod.outlook.com (2603:10b6:208:2f::25) by BL0PR05MB5137.namprd05.prod.outlook.com (2603:10b6:208:87::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.16; Fri, 30 Jul 2021 22:53:06 +0000 Received: from BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::3993:ce9b:ded:b3be]) by BL0PR05MB5316.namprd05.prod.outlook.com ([fe80::3993:ce9b:ded:b3be%5]) with mapi id 15.20.4373.020; Fri, 30 Jul 2021 22:53:06 +0000 From: Ron Bonica To: OPSEC Thread-Topic: Apology Thread-Index: AdeFlYwVDliTERROT+SpKaWkNch2aA== Date: Fri, 30 Jul 2021 22:53:05 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.6.100.41 dlp-reaction: no-action msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=true; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2021-07-30T22:53:04Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Method=Standard; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=0633b888-ae0d-4341-a75f-06e04137d755; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=3bce6c10-a796-4cb8-b8df-592372e24f8c; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ContentBits=2 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=juniper.net; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 57a2cc01-4caa-4e5d-0ddb-08d953accb5a x-ms-traffictypediagnostic: BL0PR05MB5137: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:2733; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fXaLYnfSUPuWNFQ1QClOUQeLf6IVZAv+f1AoQ5ayUBFCJwNXfPqvtv56VytsDoUT9iiC4Br0Q+oTRO93HY3/C0l/yJ+WQ4jyGdqO4EyB8cqQQ9/88Kh2SNRCiNCfK8zq0Zo3f4LsDtq6AcIn+3GsW0EBIMQaRph5JmCtooeyXyfE7HCn9sEdXWC3AxCdAFjv5nLdolq9JSvox9TksyImVThR9xgqL8l/zPeqDyGEONjHMUjjfAVPSxetMUaDZNkyhNuimLR0qHdgAL6FRBBjF825+lA/ANt8r4e8VPB3d7h3em0yxOA/ODWES4ffbsfGmBi54hHnZKnRL2RUA/apc8FDPWVmSWpuhobxA4Wz1dvDEwdHjVt/GXevoT3GqOwizPay7XjUPeY6Ceol6+eASR72zM4quwQXFsqJMRczVkQ38qWuRr1iRfxIREJuHDE+5H7jKy40en86DIEzYybQ30M/UMG4uR7ixQ8SZl29qBpW9FKJPZMMNVxf+QDlnzGQY5G0vgWB+wqXXmRU/310jJrwf+cfcvKC9eQQhStvi/F/zybsJMa/l4E9AqXHOYKErk4f+xETZ1W9kdLjl2H5sx4H0KyaVxxzB1lEC57QxnJf0GPgLs4dWxFGa3A8Q+NzCWdchYS2p358u+rW8mIe94vBSvIX78VPZQzLNZrIw/9/CJjQecv4wDiZFokToxOUiQIrUMeXGtgB26/1RPYNIw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR05MB5316.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(316002)(86362001)(64756008)(66556008)(3480700007)(2906002)(55016002)(9686003)(33656002)(558084003)(66446008)(66946007)(186003)(66476007)(52536014)(38070700005)(7116003)(7696005)(508600001)(6916009)(38100700002)(5660300002)(26005)(76116006)(122000001)(6506007)(8676002)(71200400001)(8936002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?XvmZeMqiEny2Q40YJN6DLlapuXZqDGvYW7TJWVKszB8h4P9FqdIxOMsUp8G6?= =?us-ascii?Q?MYJ4GufB6iTRBwFbOuS61iFUD5GbYSNNOLvNCOmBDhpVdgfxOEmiMdiA3jkr?= =?us-ascii?Q?0fLxE5w1ztKup8+k7PVlnQ089cTbINS40h0KZRmk178O5fptd+8n8QsRqPCA?= =?us-ascii?Q?mmfUzquZEdD62poMz9XIVYz0/wWspOobZs7yFnxZHDW7qWqPmtX7mKJBLkIY?= =?us-ascii?Q?/VvsyD9SAjlYRv2eSqeaLx+Ca6Rgm2942M/yP92nXh81EP7FSD6UH5n/chGl?= =?us-ascii?Q?9NBmb+TiFBDK0G6mVUrN5G4iRUVCGHoDjs0patxWddf073t0xnbXavBWlBFQ?= =?us-ascii?Q?6ZMcyr5Pgi2Uz0t3Vh/dLlaL2bqb9g5wT6pPFj9abEEmvFqQnCXHHjF1HwDA?= =?us-ascii?Q?H+H5fCdTMW2n5hM798zL851IZU/ifd+ajSh/Ovyw6k5fk+dOfnMh4UKHhcP2?= =?us-ascii?Q?LGef1ULgyCc+VVx4vcO/Ud6gXGXM9aQCo880Byk5iY09VvzLY2G/yAXyGryJ?= =?us-ascii?Q?BCzfALuR7cHQUv7R5NHO9LewR6HkOITMndNZWB//9Zmlz01XbHo9ieq9cpwU?= =?us-ascii?Q?jpUdFEsTV2CQC+QyGWbJWNGRIdvRNDkmkHAMSn6ErUpt2KxwC04EIm48xKhL?= =?us-ascii?Q?k2r925iDNXEj3Pub23PQYK0KUaqZb4i4BXvn0QHquoA0P8HRFCDdkqBpG8Rs?= =?us-ascii?Q?G+JQ//ISd5NLd+nvJHPzvWy1xZIpprXCuRu8bh+/JZnckkEm03VTWiWZhOAE?= =?us-ascii?Q?9qlbmAzwduDzzTBhHxfPvnOm+J+ylIooP1iNXr0trgkibZrVUPRi0m33xOxT?= =?us-ascii?Q?pA/APEFceGW7DysTwuS1lykku9SBY/8YUIBiYMYVTZrVr+PqsYoT6PmF4rhb?= =?us-ascii?Q?VyJv+Cn3vtPSi4ojS+xknZOfHH7vJbnpELe0Ue7dHMa6JNKwYW38M98Dd3eK?= =?us-ascii?Q?9dQKL5zRt57oHSEm1hDjurK4thTsJm1HZgqQtcciZ+Gq2a5Ajze5srlzQHKW?= =?us-ascii?Q?JzQv7+TXcnTDTv1W1JBeK82z/tnnDOuoUHAYjJVb9kXCuYYTeQsPG7clVWZG?= =?us-ascii?Q?r5Y3ntoOso3IYl3jJ1GEaedaD/zHLLpz4XJ69Yx5GyJxxIbo+AeyQWcFAWfr?= =?us-ascii?Q?g88TIlV2JAqIPJs5wZJTsMmFSwC7fkqePxzFMXiGUde8rRki4dUJgiFlKd8b?= =?us-ascii?Q?RqvOZtMQrULG3SM9OAjoCFcrNN/EWf+cwKp4CaRi7TxSWfnNu2bhH/kz/IgF?= =?us-ascii?Q?pWLQpf6QV94XkzCaXpsv5jUPdk2LBCiU9ubbDT8JMQ82tB8ahTbFJwdUjUKy?= =?us-ascii?Q?mjQvxCYTXb1H3miu1b4pAmVi?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR05MB53167B34F0444EE766C35663AEEC9BL0PR05MB5316namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BL0PR05MB5316.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 57a2cc01-4caa-4e5d-0ddb-08d953accb5a X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2021 22:53:05.9753 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: yge3VxngGboF7KUXBWqBEBlB8rYC+W2c17bLcVgj/Va6qmwcngIPH2b1rEQdIAxUkaoRulqB76+CamusK0euIw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR05MB5137 X-Proofpoint-ORIG-GUID: EMOK-6iQaFrYVGH3tEYo-R9Zjuj5lwZA X-Proofpoint-GUID: EMOK-6iQaFrYVGH3tEYo-R9Zjuj5lwZA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.790 definitions=2021-07-30_11:2021-07-30, 2021-07-30 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 suspectscore=0 bulkscore=0 phishscore=0 spamscore=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 mlxlogscore=697 impostorscore=0 mlxscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000 definitions=main-2107300154 Archived-At: Subject: [OPSEC] Apology X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jul 2021 22:53:38 -0000 --_000_BL0PR05MB53167B34F0444EE766C35663AEEC9BL0PR05MB5316namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Folks, I offer my sincere apology for missing our meeting today. I converted time = zones incorrectly and showed up 45 minutes late. Ron Juniper Business Use Only --_000_BL0PR05MB53167B34F0444EE766C35663AEEC9BL0PR05MB5316namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Folks,

 

I offer my sincere = apology for missing our meeting today. I converted time zones incorrectly a= nd showed up 45 minutes late.

 

   &= nbsp;           &nbs= p;            &= nbsp;            &nb= sp;            =             Ron=

 


Juniper Business= Use Only

--_000_BL0PR05MB53167B34F0444EE766C35663AEEC9BL0PR05MB5316namp_-- From nobody Fri Jul 30 19:47:46 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 392AF3A09F5; Fri, 30 Jul 2021 19:47:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.848 X-Spam-Level: X-Spam-Status: No, score=-1.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0rzO5Wq7wpJM; Fri, 30 Jul 2021 19:47:39 -0700 (PDT) Received: from mail-ej1-x62d.google.com (mail-ej1-x62d.google.com [IPv6:2a00:1450:4864:20::62d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFD013A09F3; Fri, 30 Jul 2021 19:47:38 -0700 (PDT) Received: by mail-ej1-x62d.google.com with SMTP id x11so19245932ejj.8; Fri, 30 Jul 2021 19:47:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=PzcrbVgHvJfgU3U3W20A/D+uSWd6zQjdsIIEFJmbve4=; b=LfIfaNkbjU90iMl0pGnN9XymCac3T/HBUEQb6qQ3UuToOeBB0TLD2OoXhPK6i8Gkv1 WQRoBKSr+iXsQSrtdMeF2KE+60jJL02jSMo9e2sBlimvu5CvInpbngyCGOwGPBuiM9G/ 7YgWQSwMmcxhqRkukjdFVk3ABmt7gzMDHBKLFBHyPEHbNWJXVuz6DUPiitt098HK9bzb ofj4t1mB4fTWAxMcwHSJqVCdiHrww0519yrNywBrrdo6iptkPKVMhYRckJcUeIPo+OGd d1usN90FbvV1b2kyca1buwYsOfu2fLgLEp9sqJQduChaJa/ojNzJO52L37daNMhLpPYN e8Rg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=PzcrbVgHvJfgU3U3W20A/D+uSWd6zQjdsIIEFJmbve4=; b=Qb/8qckii6Y8w/pxdXN1UwDOozGeNlXHhXWHc1rdF2Y40Jlx3S72X01afU6BPD2sfF 2SRphf00E5WVbTM4uTCXxDNDgXDsgtAAFD3DWUhox3221R342jBnuXRVKDzZ6e/edGWL /wGXg2JZTIpI5LzbYp/cS8NNvFsXNE/R8POXadbc2mptpMWLXg+y8ruXK63/1AF9rU8Y l3YcpXKtvQVtMJo2pYcnhXt03pmYMtij+Se9CN5qJuwDz/5YZY4Ay3usZx/6rhsW71a9 8WIgJN8KhiYMiSN6iIS2L9dgTS5/Ci4Do6YmAOrb0wpjiln8rX66o0csFxTTfkB+iz8O G9vw== X-Gm-Message-State: AOAM531JPYsi/txQfKC0mb10q3Zt5pb/xZ9PfYqAKNlYc29grmvoMInJ hPhVQYrDhBTdjilJFMRUqz0h+mBZw8S/Bmi1vZa9A7xv3sx9xA== X-Google-Smtp-Source: ABdhPJxnQF8rjFf3+ubycf3qxmFMl6CkcULsBHEdE/6BX/oeDNJ4mnFjp+8TvYFPTb4Sp+3/s+8qDF6MnJESVU+FFpM= X-Received: by 2002:a17:906:d9c4:: with SMTP id qk4mr5693303ejb.492.1627699655757; Fri, 30 Jul 2021 19:47:35 -0700 (PDT) MIME-Version: 1.0 From: Jen Linkova Date: Sat, 31 Jul 2021 12:47:24 +1000 Message-ID: To: opsec WG Cc: OpSec Chairs Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [OPSEC] OpSec@IETF111 Minutes X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Jul 2021 02:47:44 -0000 The meeting minutes for the session have been uploaded: https://datatracker.ietf.org/meeting/111/materials/minutes-111-opsec If you have said something at the mic - please take a look and let the chairs know if the minutes need to be updated. Florence, thank you very much for taking minutes - especially at your first meeting! -- SY, Jen Linkova aka Furry