Subject: [Gen-art] Gen-ART Telechat review of draft-ietf-opsec-ip-options-filtering-05.txt

From: Suresh Krishnan <[email-masked]>
Date: Mon, 18 Nov 2013 05:54:48 +0000

I have been selected as the General Area Review Team (Gen-ART) reviewer
for this draft (for background on Gen-ART, please see
http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html).

Please wait for direction from your document shepherd or AD before
posting a new version of the draft.

Document: draft-ietf-opsec-ip-options-filtering-05.txt
Reviewer: Suresh Krishnan
Review Date: 2013/11/17
IESG Telechat date: 2013/11/21

Summary: This draft is almost ready for publication as a BCP but
I do have some issues that you may wish to consider

* Sections 4.12.5 and 4.13.5

Since these options are supposed to be used in closed environments,
how likely are these options to appear in the wild? Even if they do,
isn't it a symptom of a misconfiguration somewhere. Given this, I
would have expected the recommendation to read

Routers, security gateways, and firewalls ... SHOULD by default drop
packets because they contain this option...

but the recommendation is "SHOULD NOT by default". I think It would
be good if there was some reasoning attached to this recommendation.
Without such reasoning, I think this recommendation will probably not
be followed.

* Section 4.22.5

Have you considered that the default behavior for the option could be related
to the option class. E.g. Class 2 would default to ignore and forward and
class 0 would default to drop and log.

* Section 4.23.4

It would be good to specify a default for this knob.

Thanks
Suresh

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Mon, 18 Nov 2013 14:31:28 +0000

Many thanks for your review, Suresh. We will propose resolutions to these three comments you make.

Thanks,

-- Carlos.

On Nov 18, 2013, at 12:54 AM, Suresh Krishnan <[email-masked]> wrote:

> isn’t it a symptom of a misconfiguration somewhere. Given this, I
> Routers, security gateways, and firewalls … SHOULD by default drop
> packets because they contain this option…
>  
> but the recommendation is “SHOULD NOT by default”. I think It would

---

From: Jari Arkko <[email-masked]>
Date: Thu, 21 Nov 2013 08:49:09 -0300

Suresh: thank you very much for the review. Carlos: I assume you and Joel have the token on ensuring that changes, if any, get folded in before the document is shipped to the RFC editor. I have balloted a no-obj position for this draft.

By the way, I agree with the points that Suresh raised.

Jari

On Nov 18, 2013, at 11:31 AM, Carlos Pignataro (cpignata) <[email-masked]> wrote:

> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Thu, 21 Nov 2013 11:51:52 +0000

Jari,

Yes, Suresh and I/authors have already agreed on changes that I have incorporated into our working copy. 

Apologies for not closing the loop with you, will forward. 

Thanks!

Thumb typed by Carlos Pignataro.
Excuze typofraphicak errows

> On Nov 21, 2013, at 6:49 AM, "Jari Arkko" <[email-masked]> wrote:
>

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Thu, 21 Nov 2013 11:54:27 +0000

Closing the loop on this Gen-ART review.

Thanks again Suresh for reviewing.

Begin forwarded message:

From: Suresh Krishnan <[email-masked]<mailto:[email-masked]>>
Date: November 18, 2013 at 4:12:19 PM EST
To: "Carlos Pignataro (cpignata)" <[email-masked]<mailto:[email-masked]>>, RJ Atkinson <[email-masked]<mailto:[email-masked]>>
Cc: Fernando Gont <[email-masked]<mailto:[email-masked]>>
Subject: Re: Gen-ART Telechat review of draft-ietf-opsec-ip-options-filtering-05.txt

Hi Carlos/Ran,
 This text looks good to me. Thanks for taking care of this quickly.

Regards
Suresh

On 11/18/2013 10:21 AM, Carlos Pignataro (cpignata) wrote:
Looks good, thank you Ran. I will incorporate this in our live
copy.

Suresh, any concerns?

Thanks,

-- Carlos.

On Nov 18, 2013, at 10:07 AM, RJ Atkinson <[email-masked]<mailto:[email-masked]>>
wrote:

On 18  Nov 2013, at 09:41 , Carlos Pignataro (cpignata) wrote:
Here's the complete proposal for the complete Section 4.12.5
(and equivalent for 4.13.5).

Does this work? Please let me know and I can incorporate:

A lightly edited version follows -- edited mainly to reduce
redundant/ duplicative text and to retain phrasing "because the
IP packet contains this option" that was added in an earlier
round of review.

--- 4.12.5.  Advice

A given IP router, security gateway, or firewall has no way to
know a priori what environment it has been deployed into.  Even
closed IP deployments generally use exactly the same commercial
routers, security gateways, and firewalls that are used in the
public Internet.

Since operational problems result in environments where this
option is needed if either the option is dropped or IP packets
containing this option are dropped, but no harm results if the
option is carried in environments where it is not needed, the
default configuration SHOULD NOT (a) modify or remove this IP
option or (b) drop an IP packet because the IP packet contains
this option.

A given IP router, security gateway, or firewall MAY be
configured to drop this option or to drop IP packets containing
this option in an environment known to not use this option.

For auditing reasons, Routers, security gateways, and firewalls
SHOULD be capable of logging the numbers of packets containing
the BSO on a= per-interface basis.  Also, Routers, security
gateways, and firewalls SHOULD be capable of dropping packets
based on the BSO presence as well as the BSO values. ---

Similar text, edited to reflect "ESO" rather than "BSO", should
replace the existing advice about the IPSO ESO.

Cheers,

Ran

---

From: Jari Arkko <[email-masked]>
Date: Thu, 21 Nov 2013 09:00:46 -0300

Thanks!

On Nov 21, 2013, at 8:54 AM, Carlos Pignataro (cpignata) <[email-masked]> wrote:

>> From: Suresh Krishnan <[email-masked]>
>> To: "Carlos Pignataro (cpignata)" <[email-masked]>, RJ Atkinson <[email-masked]>
>> Cc: Fernando Gont <[email-masked]>
>>> On Nov 18, 2013, at 10:07 AM, RJ Atkinson <[email-masked]>
>>> wrote:
>>> 
>>>>