Subject: RE: [Syslog-sec] Chair Review Comments ofdraft-ietf-syslog-transport-udp-04.txt

From: "Anton Okmianski (aokmians)" <[email-masked]>
Date: Wed, 6 Jul 2005 07:35:59 -0700

Chris:

Thanks for feedback.  Attached is the latest draft for final review by the group before I send it out officially.  One follow up question below...

> The dates need updating.  Copyright should be dated 2005.

Done.

> Spaces are needed before the reference bracket.
>    The informational RFC 3164[7] originally described the 
> syslog should be
>    The informational RFC 3164 [7] originally described the syslog

Done. 

> The following paragraph is part of the Introduction but 
> should be in a separate section "Conventions Used in This Document".
>    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
>    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and 
> "OPTIONAL" in this
>    document are to be interpreted as described in RFC 2119[5].  The
>    words 'byte' and 'octet' are used interchangeably in this
>    specification.
> The last sentence should be a separate paragraph.

Done.

> Section 2 "One Message Per Datagram" contains:
>    Each syslog UDP datagram MUST contain one and only one syslog
>    message.  The message MUST be formatted according to the RFC-
>    protocol[2].  Additional data MUST NOT be present in the datagram
>    payload.
> Doesn't this go against the rules of fragmentation where a 
> single udp datagram may contain less than one syslog message? 
>  (I know what Anton is trying to say here but I don't think 
> it's coming out exactly right.)

I changed this to:

"Each syslog UDP datagram MUST contain only one syslog message, which
   can be complete or truncated.  The message MUST be formatted and
   truncated according to the RFC-protocol [2].  Additional data MUST
   NOT be present in the datagram payload."

Does this look ok?

> Section 7 "UDP Checksums" needs to have the cases of keywords changed.
>    Use of UDP checksums was defined as optional in RFC 
> 768[1].  IPv6 has
>    subsequently made UDP checksums required in RFC 2460[4].
> Should be
>    Use of UDP checksums was defined as OPTIONAL in RFC 768 
> [1].  IPv6 has
>    subsequently made UDP checksums REQUIRED in RFC 2460 [4].

Done.

> Also, there seems to be a problem with this.
> It seems to state that sending IPv4 hosts don't have to send 
> accurate udp checksums but that recieveing IPv4 hosts must 
> discard datagrams with inaccurate udp checksums.

This is correct. I don't see a problem with that. There is a way to distinguish accurate checksum from one that was not computed at all.  

>    Use of UDP checksums was defined as optional in RFC 768[1].
> and
>    Syslog senders SHOULD use UDP checksums when sending
>    messages over IPv4.
> but then
>    Syslog receivers MUST check the checksums whenever they are present
>    and discard messages with incorrect checksums.

As stated in the last sentence, the receivers must only check the checksums whenever they are present.  So, if the checksum is 0, it indicates the sender did not compute the checksum per UDP RFC.  In this case, we do not require the receiver to discard the message. But if checksums are there, the receiver MUST validate them. 

> Can we get this addressed?  (Probably the section should say 
> that it is RECOMMENDED that both senders and receivers use 
> the checksums.  It's probably worth a comment in the Security 
> Considerations section as well.)

I could go for that, it you still think it is needed. Or could just clarify the requirement further.  However, I think given a requirement on Internet hosts to support UDP checksums (if not always enabled), it is a good idea to take advantage of that feature for syslog to ensure better robustness. What do you think?

 > Grammar in Section 8.2 "Message Corruption"
>    implementation itself.  For example, several earlier UDP
>    implementations defaulted to a buffer size of less than 65536 bytes
>    and truncated larger payloads upon reception [9].  By 
> following the The last sentece should be:
>    and truncated larger payloads upon receipt [9].  By following the

Done.

Thanks,
Anton.

---

From: Chris Lonvick <[email-masked]>
Date: Fri, 8 Jul 2005 09:12:52 -0700 (PDT)

Hi Anton,

>    NOT be present in the datagram payload."

OK with me.  Any other comments?

> I could go for that, it you still think it is needed. Or could just clarify the requirement further.  However, I think given a requirement on Internet hosts to support UDP checksums (if not always…

Clarity here is good.  A clear recommendation for better robustness is
also a good thing.  :)

Thanks,
Chris
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec