Subject: Re: [tsv-area] [saag] draft-stjohns-sipso-05 & transport protocols

From: Lars Eggert <[email-masked]>
Date: Mon, 6 Oct 2008 08:49:51 +0300

Bill somehow ended up in the auto-reject set of tav-area. I fixed this  
and will forward his discarded emails. Sorry for the mess.

Lars

Begin forwarded message:

> From: "ext [email-masked]" <[email-masked]>
> Date: October 6, 2008 0:29:39 GMT+03:00
> To: [email-masked]
> Subject: Auto-discard notification
>
> The attached message has been automatically discarded.
> From: Bill Sommerfeld <[email-masked]>
> Date: October 3, 2008 20:38:23 GMT+03:00
> To: "Steven M. Bellovin" <[email-masked]>
> Cc: Joe Touch <[email-masked]>, TSV Area <[email-masked]>, [email-masked] 
> , [email-masked]
> Subject: Re: [saag] draft-stjohns-sipso-05 & transport protocols
>
>
> On Fri, 2008-10-03 at 12:15 -0400, Steven M. Bellovin wrote:
>> On Fri, 03 Oct 2008 07:32:44 -0700
>> Bill Sommerfeld <[email-masked]> wrote:
>>> It is IMHO not necessary to specify what a label-unaware system  
>>> should
>>> do with a labeled packet -- if they get one at all, it's a serious
>>> error on the part of the sender.
>>>
>> Actually, 793 disagrees:
>>
>>  The security paramaters may be used even in a non-secure environment
>>  (the values would indicate unclassified data), thus hosts in
>>  non-secure environments must be prepared to receive the security
>>  parameters, though they need not send them.
>>
>> The question is how realistic that statement is.
>
> As you probably would have guessed, I think it's entirely unrealistic.
>
> 						- Bill
>
>
>
>

---

From: Lars Eggert <[email-masked]>
Date: Mon, 6 Oct 2008 08:50:29 +0300

Bill somehow ended up in the auto-reject set of tsv-area. I fixed this  
and will forward his discarded emails. Sorry for the mess.

Lars

Begin forwarded message:

> Date: October 6, 2008 0:59:52 GMT+03:00
> Date: October 3, 2008 17:32:44 GMT+03:00
> To: Joe Touch <[email-masked]>
> Cc: RJ Atkinson <[email-masked]>, [email-masked] 
> , TSV Area <[email-masked]>, [email-masked]
> On Fri, 2008-10-03 at 06:58 -0700, Joe Touch wrote:
>
>> There appears to be at least one change that might be required by all
>> Internet hosts; current behavior upon receipt of an IP packet at a
>> security level not supported is to send a TCP RST. This document
>> indicates that such hosts MUST silently drop such packets.
>
> In a securely-configured MLS environment, systems not running an MLS
> operating system will never receive a packet with an MLS label -- if
> they did, that inherently means that an MLS system somewhere is
> misconfigured and information is flowing in violation of the MLS  
> policy.
>
> It is IMHO not necessary to specify what a label-unaware system should
>>> 2) MLS operating systems have different requirements:
>>>  In turn, this specification *only* applies to Multi-Level
>>>  Secure (MLS) operating systems that choose to implement
>>>  this particular IPv6 labelling specification.  The draft
>>>  is very clear about this.
>>
>> The draft does not appear to indicate how an MLS system would  
>> interact
>> with legacy systems that are not updated.
>
> are you asking about labeled or unlabeled interoperability?
>
> the MLS systems I'm familiar with are configured with policy  
> indicating
> the clearances of other hosts.  That policy can indicate whether or  
> not
> packets to the other system should contain an explicit MLS label.
>
> non-MLS systems will typically never see a label.
>
>>> 3) The MLS-specific proposal is accepted by long-term
>>>   members of the Transport community:
>>>   Please see Dave Borman's note to the IETF discuss
>>>   list from yesterday.  Dave has about as much TCP
>>>   experience as anyone.
>>
>> I consider it very incomplete with regard to the impact of the  
>> changes
>> proposed on the architecture of MLS endpoints.
>
> I have a modest amount of MLS implementation experience.  I believe  
> the
> spec is complete enough to publish in its current form.
>
>
>

---

From: Lars Eggert <[email-masked]>
Date: Mon, 6 Oct 2008 09:47:33 +0300

Lars

Begin forwarded message:

> From: <[email-masked]>
> Date: October 6, 2008 1:00:34 GMT+03:00
> To: <[email-masked]>
> -----Begin Embedded Message-----
>     From: Bill Sommerfeld
>     Sent: 03/10/2008 17:32:44
>     To: "Joe Touch" <[email-masked]>
>     Cc: "RJ Atkinson" <[email-masked]> ; "[email-masked] 
> " <[email-masked]> ; "TSV Area" <[email-masked] 
> > ; "[email-masked]" <[email-masked]>
>     do with a labeled packet -- if they get one at all, it's a  
> serious error
>     on the part of the sender.
>
>     the clearances of other hosts.  That policy can indicate wh