Subject: [secdir] secdir review of draft-ietf-opsec-protect-control-plane-04

From: "Glen Zorn" <[email-masked]>
Date: Tue, 14 Dec 2010 13:39:31 +0700

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

Section 3.1 says:

   o  Permit RADIUS authentication and accounting replies from RADIUS
      servers 198.51.100.9, 198.51.100.10, 2001:DB8:100::9, and 2001:
      DB8:100::10 that are listening on UDP ports 1645 and 1646.  Note
      that this doesn't account for a server using Internet Assigned
      Numbers Authority (IANA) ports 1812 and 1813 for RADIUS.

So, in other words, RADIUS traffic on the ports (officially assigned for
more than ten years now) will be blocked.  This seems like a very poor
example.

---

From: Sean Turner <[email-masked]>
Date: Tue, 14 Dec 2010 10:51:06 -0500

I hoping that this was a typo.  I pulled out all the registered RADIUS 
ports from http://www.iana.org/assignments/port-numbers and 1645/1646:

sightline       1645/tcp  SightLine
sightline       1645/udp  SightLine
#                         admin <iana&sightlinesystems.com>
sa-msg-port     1646/tcp  sa-msg-port
sa-msg-port     1646/udp  sa-msg-port
#                         Eric Whitehill <Eric.Whitehill&itt.com>

radius          1812/tcp    RADIUS
radius          1812/udp    RADIUS
#                           [RFC2865]
radius-acct     1813/tcp    RADIUS Accounting
radius-acct     1813/udp    RADIUS Accounting
#                           [RFC2866]
radsec          2083/tcp   Secure Radius Service
radsec          2083/udp   Secure Radius Service
#                          Mike McCauley <mikem&open.com.au> May 2005
radius-dynauth  3799/tcp   RADIUS Dynamic Authorization
radius-dynauth  3799/udp   RADIUS Dynamic Authorization
#                          RFC 3576 - July 2003

Should 1812 & 1813 be listed or also 2083 & 3799?

spt

---

From: Sean Turner <[email-masked]>
Date: Tue, 14 Dec 2010 11:20:03 -0500

Note that the example filters in the Appendicies will also need to be fixed.

spt

On 12/14/10 11:04 AM, Ronald Bonica wrote:
> Authors,
>
> I think that we can correct this problem with an RFC editors note before the telechat on Thursday. Could one of you please provide the updated text?
>
>                                      Ron
>
>
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On Behalf Of
>> Sean Turner
>> Sent: Tuesday, December 14, 2010 10:51 AM
>> To: Glen Zorn; [email-masked]
>> Cc: [email-masked]; [email-masked]; [email-masked]
>> Subject: Re: secdir review of draft-ietf-opsec-protect-control-plane-04
>>
>> #                         admin<iana&sightlinesystems.com>
>> #                         Eric Whitehill<Eric.Whitehill&itt.com>
>>
>>
>> radius          1812/tcp    RADIUS
>> radius          1812/udp    RADIUS
>> #                           [RFC2865]
>> #                          Mike McCauley<mikem&open.com.au>  May 2005
>> Should 1812&  1813 be listed or also 2083&  3799?
>>
>> spt
>>

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Tue, 14 Dec 2010 11:43:09 -0500

Glen,

Thanks much for your review. 
Please see inline. 

Thumb typed by Carlos Pignataro.

On Dec 14, 2010, at 8:26 AM, "Joe Abley" <[email-masked]> wrote:

> 
> On 2010-12-14, at 01:39, Glen Zorn wrote:
> 

Please note that this was intentional, as a doc produced in Opsec we intended to make it as close to the operational reality we know as possible. And our perspective was that we see more 1645/1646. 

We can change it, sure. But just for the record this was discussed and intentionally decided.

If our argument was "let's write what we see is in use", what's the operational argument for 1812/1813, or is that you think IANA's assigned is inuse more ubiquitously?

> 
> This is a cisco-ism -- cisco devices use 1645/1646 by default and have to be configured explicitly to use 1812/1813.

For the record it's not only cisco that defaults to the "tradition" ports. Juniper listens on both, others also. 

> I think this should be changed, as you intimate.

Ok. 

Thanks,

Carlos. 

> Good catch.
> Joe

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Tue, 14 Dec 2010 14:51:13 -0600

Joe,

Not the most authoritative source, granted, but I believe at the time we
discussed this we checked Wikipedia (and not C J as precedence), at
<http://en.wikipedia.org/wiki/RADIUS#UDP_port_numbers>, that says "The
tradition of using 1645 and 1646 for backwards compatibility continues
to this day", and with full context:

"However, prior to IANA allocation of ports 1812 and 1813, ports 1645
and 1646 (authentication and accounting, respectively) were used
unofficially and became the default ports assigned by many RADIUS
Client/Server implementations of the time. The tradition of using 1645
and 1646 for backwards compatibility continues to this day. For this
reason many RADIUS Server implementations monitor both sets of UDP ports
for RADIUS requests."

That said, I think that you can make a strong case for using the
"proper" ones. We will make this change.

Thanks, Joe and Glen.

-- Carlos.

-----Original Message-----
From: Joe Abley [mailto:[email-masked]] 
Sent: Tuesday, December 14, 2010 11:55 AM
To: Carlos Pignataro (cpignata)
Cc: Glen Zorn; [email-masked]; [email-masked];
[email-masked];
[email-masked]
Subject: Re: secdir review of draft-ietf-opsec-protect-control-plane-04

On 2010-12-14, at 11:43, Carlos Pignataro (cpignata) wrote:

> Please note that this was intentional, as a doc produced in Opsec we
intended to make it as close to the operational reality we know as
possible. And our perspective was that we see more 1645/1646. 

I understand that's your perspective, which is entirely understandable
given what cisco devices do by default, but I don't think it's
necessarily the case that 1645/1646 are universally prevalent (at least,
claims that it is ought to be balanced with some balanced, real-world
observation). I take your point that juniper devices accommodate the
pre-standard ports as well as the IANA-assigned ones. There are more
vendors in the world than just C and J, however.

I think pointing out that 1645/1646 are also used is perfectly valid,
for the reasons of operational reality that you mention, but that the
examples should use 1812/1813.

Joe

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Tue, 14 Dec 2010 15:53:27 -0600

Ron, (Glen, Joe,)

Please find attached ABDiffs (RFC-Ed style Diffs) for this change.
Please note that because of the actual change in the example filter in
the Appendices, the diffs are longer than should (treats big chunks of
configs as single para). But my `rfcdiff` marks the line of change with
a beginning "|" at least.

If you'd rather, we can ship a new revision (it's cheap with the IDST).

Thanks !

-- Carlos.

-----Original Message-----
From: Ronald Bonica [mailto:[email-masked]] 
Sent: Tuesday, December 14, 2010 11:04 AM
To: Sean Turner; Glen Zorn;
[email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: RE: secdir review of draft-ietf-opsec-protect-control-plane-04

Authors,

I think that we can correct this problem with an RFC editors note before
the telechat on Thursday. Could one of you please provide the updated
text?

                                    Ron

> Subject: Re: secdir review of
draft-ietf-opsec-protect-control-plane-04

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 15 Dec 2010 12:19:18 +0700

Rodney Dunn [mailto:[email-masked]] writes:

> Thanks Joe/Glen,
> 
> I made the updates to change them to 1812/1813 with a not to the
> reference to the 1645/1646 ports.
> 
> "Permit RADIUS authentication and accounting replies from RADIUS servers
> 198.51.100.9, 198.51.100.10, 2001:DB8:100::9, and 2001:DB8:100::10 that
> are listening on UDP ports 1812 and 1813. Note that this doesn't account
> for a server using the commonly deployed pre-standard UDP ports of 1812
> and 1813."

That's better, except that "pre-standard" isn't exactly accurate: port 1812
was specified in RFC 2058 but it was discovered after the fact that the port
was already assigned to the datametrics service (thus the new allocation);
furthermore, RADIUS Accounting has _never_ been a standard.  I would
suggest:

OLD:
Note that this doesn't account for a server using the commonly deployed
pre-standard UDP ports of 1812 and 1813.

NEW:
Note that this doesn't account for a server using the original UDP ports of
1812 and 1813.

...

Hope this helps.

 ~gwz

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 15 Dec 2010 12:20:43 +0700

Joe Abley [mailto:[email-masked]] writes:

...

> > "Permit RADIUS authentication and accounting replies from RADIUS
> servers 198.51.100.9, 198.51.100.10, 2001:DB8:100::9, and
> 2001:DB8:100::10 that are listening on UDP ports 1812 and 1813. Note
> that this doesn't account for a server using the commonly deployed pre-
> standard UDP ports of 1812 and 1813."
> 
> I think you mean "1645 and 1646" in the final sentence.
> 
> I would also drop "commonly deployed" since I think the phrase is
> subjective and difficult to qualify, and replace "account for" with
> "accommodate" since one of the ports you're opening a hole for is for
> accounting and different uses of the same word seems worth avoiding
> (e.g. for non-English speakers).

Good idea.

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 15 Dec 2010 12:28:30 +0700

> Should 1812 & 1813 be listed or also 2083 & 3799?

radsec isn't RADIUS; RFC 3576 isn't a core part of RADIUS, either.  I think
that 1812 & 1813 are fine in the context of this example.

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 15 Dec 2010 12:42:13 +0700

Carlos Pignataro (cpignata) [mailto://[email-masked]] writes:

...

> possible. And our perspective was that we see more 1645/1646.

There are lots of non-standard hacks in the wild; I don't think that it's
the job of the IETF to document them.

...

---

From: Joe Abley <[email-masked]>
Date: Tue, 14 Dec 2010 08:25:42 -0500

> more than ten years now) will be blocked.  This seems like a very poor

This is a cisco-ism -- cisco devices use 1645/1646 by default and have to be configured explicitly to use 1812/1813. I think this should be changed, as you intimate. Good catch.

Joe

---

From: Rodney Dunn <[email-masked]>
Date: Tue, 14 Dec 2010 06:16:39 -0800

Thanks Joe/Glen,

Also updated the relevant configurations.

Rodney

---

From: Joe Abley <[email-masked]>
Date: Tue, 14 Dec 2010 09:26:19 -0500

On 2010-12-14, at 09:16, Rodney Dunn wrote:

> Thanks Joe/Glen,
> 
> I made the updates to change them to 1812/1813 with a not to the reference to the 1645/1646 ports.
> 
> "Permit RADIUS authentication and accounting replies from RADIUS servers 198.51.100.9, 198.51.100.10, 2001:DB8:100::9, and 2001:DB8:100::10 that are listening on UDP ports 1812 and 1813. Note that this doesn't account for a server using the commonly deployed pre-standard UDP ports of 1812 and 1813."

I would also drop "commonly deployed" since I think the phrase is subjective and difficult to qualify, and replace "account for" with "accommodate" since one of the ports you're opening a hole for is for accounting and different uses of the same word seems worth avoiding (e.g. for non-English speakers).

Joe

---

From: Rodney Dunn <[email-masked]>
Date: Tue, 14 Dec 2010 06:44:26 -0800

Fixed and updated:

"Permit RADIUS authentication and accounting replies from RADIUS servers 
198.51.100.9, 198.51.100.10, 2001:DB8:100::9, and 2001:DB8:100::10 that 
are listening on UDP ports 1812 and 1813.
Note that this does not accommmodate a server using pre-standard UDP 
ports of 1645 and 1646."

Thanks,
Rodney

---

From: Ronald Bonica <[email-masked]>
Date: Tue, 14 Dec 2010 11:04:25 -0500

Authors,

                                    Ron

> 2001:

---

From: Joe Abley <[email-masked]>
Date: Tue, 14 Dec 2010 11:54:42 -0500

> Please note that this was intentional, as a doc produced in Opsec we intended to make it as close to the operational reality we know as possible. And our perspective was that we see more 1645/1646. 

I understand that's your perspective, which is entirely understandable given what cisco devices do by default, but I don't think it's necessarily the case that 1645/1646 are universally prevalent (at least, claims that it is ought to be balanced with some balanced, real-world observation). I take your point that juniper devices accommodate the pre-standard ports as well as the IANA-assigned ones. There are more vendors in the world than just C and J, however.

I think pointing out that 1645/1646 are also used is perfectly valid, for the reasons of operational reality that you mention, but that the examples should use 1812/1813.

Joe

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Wed, 15 Dec 2010 11:40:01 -0600

This helps. Thanks !

-----Original Message-----
From: Glen Zorn [mailto:[email-masked]] 
Sent: Wednesday, December 15, 2010 12:21 AM
To: 'Joe Abley'; Rodney Dunn (rodunn)
Cc: [email-masked]; [email-masked];

..

Good idea.