Subject: [OPSEC] Review of: draft-ietf-opsec-ip-options-filtering-02

From: Arturo Servin <[email-masked]>
Date: Mon, 24 Jun 2013 13:13:07 +0100

I reviewed the document draft-ietf-opsec-ip-options-filtering-02. It is
very well written and it explains very well the problems and threats of
each IP option. The advices given through the document are clear,
plausible and very logical to me.

I have a few minor comments:

Section 4.8.5

"Additionally,
Routers, security gateways, and firewalls SHOULD have a configuration
setting that indicates whether they should react react on the Router
Alert option as indicated in the corresponding specification or
ignore the option, or whether packets containing this option should
be dropped (with the default configuration being to ignore the Router
Alert option)."

This paragraph is a bit confusing. It is not clear to me if the two
options are to drop the packet and do nothing (ignore the option). I
would suggest rephrasing it. Also it has a typo (they should react react)

Section 4.12.2

I am not sure the goal of the paragraph about the Cisco routers. It
looks to "Cisco centric" to me. I would just remove the whole paragraph
as I do not see any value added by it.

The same is for section 4.13.2 ….

Section 4.12.5

I wonder that if this option is only used within very secure networks
and it is not common or used in the Internet the advice is to forward
it. I would assume that the advice should be to drop unless the network
admin expects to see this option.

This same applies to section 4.13.5 and 4.14.5

Section 4.22.5

The advice mentions "drop and log event" as the default. I wonder that
if logging a large amount of packets with these options would create a
DoS on the control plane. Perhaps the default should be just drop or to
add an advice that excessive logging could also be an attack vector.

Same for 4.23.4 about "Other IP options" and in general every time that
the document recommends "drop and logging".

Best regards.
/Arturo Servin

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Mon, 24 Jun 2013 14:28:25 +0000

Thanks, Arturo, for this review! Much appreciated.

While we review these comments, one questions for the chairs...

There was a WGLC on this document started on Feb 18, 2013, and it appears it was never "formally closed". What is the status of that? I assume the WGLC ended on "04-Mar-2013" as per the WGLC message -- could you please summarize the outcome and next steps (i.e., is the doc ready to be submitted to the IESG, after we submit a -03 incorporating comments?)

Thanks,

-- Carlos.

On Jun 24, 2013, at 8:13 AM, Arturo Servin <[email-masked]> wrote:

> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec

---

From: Warren Kumari <[email-masked]>
Date: Mon, 24 Jun 2013 16:12:12 -0400

On Jun 24, 2013, at 10:28 AM, Carlos Pignataro (cpignata) <[email-masked]> wrote:

> There was a WGLC on this document started on Feb 18, 2013, and it appears it was never "formally closed".

Yup, you are right, it was not formally closed. We were attempting to win the record for the longest WGLC, but seeing as you asked, we have decided to abort this valiant effort :-P

> What is the status of that? I assume the WGLC ended on "04-Mar-2013" as per the WGLC message -- could you please summarize the outcome

The status was (and I apologize, this was not well communicated[0]) that we did not feel that we had gotten sufficient review.
We asked for more volunteers, and Merike, Ron Bonica and Arturo stepped up (thanks!). 
They have now completed their reviews (thanks again!)[1].

> and next steps (i.e., is the doc ready to be submitted to the IESG, after we submit a -03 incorporating comments?)

Assuming the comments are integrated (and that Merike didn't stumble across anything *too* scary) we think that the this should be ready for the IESG.

Apologies for the delay. 

W

[0]: IIRC we discussed this in the in person meeting, but then didn't really followup on-list correctly. 
[1]: Merike has reviewed the document, but is currently sitting on a plane and so has not yet had a chance to send them in… 

-- 
With Feudalism, it's your Count that votes.