Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

From: "QIU Ying" <[email-masked]>
Date: Tue, 14 Jul 2009 15:37:09 +0800

Since the zero of next header value is used for HOPOPT already, maybe applying a new value for this intention is better to avoid the confliction.

Regards
Qiu Ying

  ----- Original Message ----- 
  From: QIU Ying 
  To: Yaron Sheffer ; [email-masked] 
  Sent: Tuesday, July 14, 2009 3:30 PM
  Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

  Regarding the Next Header in section 2, what will be happened if the value of Next Header is zero (i.e. IPv6 Hop-by-Hop option) and the packet is not encrypted?

  Regards
  Qiu Ying

    ----- Original Message ----- 
    From: Yaron Sheffer 
    To: [email-masked] 
    Sent: Sunday, July 05, 2009 3:48 AM
    Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

    This is the beginning of a two-week WG Last Call, which will end July 18. The target status for this document is Proposed Standard. The current document is at http://tools.ietf.org/html/draft-ietf-ipsecme-traffic-visibility-05.

    If you have not read the document before now, please do so. Having fresh eyes on the document often brings up important issues. If you HAVE read it before, please note that there have been several revisions since San Francisco, so you might want to read it again (plus it's a short document). Send any comments to the list, even if they are as simple as "I read it and it seems fine".

    Please clearly indicate the position of any issue in the Internet Draft, and if possible provide alternative text. Please also indicate the nature or severity of the error or correction, e.g. major technical, minor technical, nit, so that we can quickly judge the extent of problems with the document.

    Thanks,

                Yaron

----------------------------------------------------------------------------

    _______________________________________________
    IPsec mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/ipsec

Institute for Infocomm Research disclaimer:  "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."

---

From: "Grewal, Ken" <[email-masked]>
Date: Tue, 14 Jul 2009 11:31:19 -0600

Thanks Qiu Ying - great observation.

We had originally proposed using a bit from the WESP flags (integrity only) for differentiating between ESP-encrypted and ESP-NULL traffic, but changed this to using a value of zero in the next header for efficient encoding, although this is overloading the meaning of next header.
With your observation, the current definition is not practical so we have the following options:

 1.  Revert back to using a bit in the flags to differentiate between encrypted / NULL traffic.
 2.  Allocate a new protocol value for the next header field to indicate encrypted data, which seems like an overkill.

As we are already asking for a new protocol value for WESP, option 1 seems to be the better choice.

Other opinions?

Thanks,
- Ken

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of QIU Ying
Sent: Tuesday, July 14, 2009 12:37 AM
To: QIU Ying; Yaron Sheffer; [email-masked]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[email-masked]>
To: Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Tuesday, July 14, 2009 3:30 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: Yaron Sheffer<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]>
Sent: Sunday, July 05, 2009 3:48 AM
Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Thanks,
            Yaron
________________________________
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec
Institute for Infocomm Research disclaimer: "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."

---

From: "QIU Ying" <[email-masked]>
Date: Wed, 15 Jul 2009 10:42:03 +0800

Hi, Ken

Agree that Option 1 is better as it applies lesser new IANA numbers. But in this case, it seems redundancy to copy the value of Next Header field in the ESP trailer to here. How about simply setting the value as ESP here? I think it more meet the original concept of Next Header.

Maybe I am missing something

Regards
Qiu Ying

  ----- Original Message ----- 
  From: Grewal, Ken 
  To: QIU Ying ; Yaron Sheffer ; [email-masked] 
  Sent: Wednesday, July 15, 2009 1:31 AM
  Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

    1.. Revert back to using a bit in the flags to differentiate between encrypted / NULL traffic. 
    2.. Allocate a new protocol value for the next header field to indicate encrypted data, which seems like an overkill. 

  Other opinions?

  Thanks, 

  - Ken

------------------------------------------------------------------------------

  Regards

  Qiu Ying

    ----- Original Message ----- 

    From: QIU Ying 

    Regards

    Qiu Ying

      ----- Original Message ----- 

      From: Yaron Sheffer 

      To: [email-masked] 

      Thanks,

                  Yaron

--------------------------------------------------------------------------

---

From: "Grewal, Ken" <[email-masked]>
Date: Wed, 15 Jul 2009 09:27:01 -0600

Qiu Ying,
Copying the value of the ESP next header to the WESP next header is useful for efficient HW parsing when using ESP-NULL.
You are correct that in the case of encrypted traffic, we can set this value to 'ESP', which could denote that the payload is encrypted.
Having said that, some people in the past have mentioned that it may be cleaner to have a dedicated bit to denote whether the payload is encrypted or using ESP-NULL.

Either way works, as long as there is a discrete, unambiguous way to denote this.

Thanks,
- Ken

________________________________
From: QIU Ying [mailto:[email-masked]]
Sent: Tuesday, July 14, 2009 7:42 PM
To: Grewal, Ken; Yaron Sheffer; [email-masked]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Hi, Ken

Regards
Qiu Ying

----- Original Message -----
From: Grewal, Ken<mailto:[email-masked]>
To: QIU Ying<mailto:[email-masked]> ; Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Wednesday, July 15, 2009 1:31 AM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Other opinions?

Thanks,
- Ken

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[email-masked]>
To: Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Tuesday, July 14, 2009 3:30 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: Yaron Sheffer<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]>
Sent: Sunday, July 05, 2009 3:48 AM
Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Thanks,
            Yaron

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Thu, 16 Jul 2009 11:57:13 +0530

We can use ESP as the next header to denote encryption being used as long as we are sure that we will never have an ESP packet inside the WESP encapsulation. In my view there is nothing that precludes that from happening, which means that we may have some corner cases where WESP may actually be carrying an ESP packet inside it. Given this, i would rather that we don't use the ESP value to denote encryption being used.

I am also not a big fan of the encryption bit as that takes away one bit from the already limited number of bits that we have at our disposal in the flags field.

Given that a packet will never carry a protocol ID of 0xFF i propose to use this value in the next-header to denote encryption being used. Would this work?

Cheers, Manav

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Grewal, Ken
Sent: Wednesday, July 15, 2009 8.57 PM
To: QIU Ying; Yaron Sheffer; [email-masked]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Qiu Ying,

Thanks,
- Ken

Hi, Ken

Regards
Qiu Ying

----- Original Message -----
From: Grewal, Ken<mailto:[email-masked]>
To: QIU Ying<mailto:[email-masked]> ; Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Wednesday, July 15, 2009 1:31 AM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Other opinions?

Thanks,
- Ken

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[email-masked]>
To: Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Tuesday, July 14, 2009 3:30 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: Yaron Sheffer<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]>
Sent: Sunday, July 05, 2009 3:48 AM
Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Thanks,
            Yaron

---

From: "QIU Ying" <[email-masked]>
Date: Thu, 16 Jul 2009 15:11:35 +0800

Hi, Manav

0xFF (255) is reserved by IANA. Maybe you are correct that IANA  would never release the special number to a document. But it is risk for a long term RFC.

If I am not wrong, Ken's meaning is to set the next header as ESP if carrying an ESP packet inside it. Otherwise, still use the same value of the next header in ESP trailer. So it seems acceptable.

Regards
Qiu Ying

  ----- Original Message ----- 
  From: Bhatia, Manav (Manav) 
  To: Grewal, Ken ; QIU Ying ; Yaron Sheffer ; [email-masked] 
  Sent: Thursday, July 16, 2009 2:27 PM
  Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

  Cheers, Manav

    Qiu Ying, 

    Thanks, 

    - Ken

    Hi, Ken

    Regards

    Qiu Ying

      ----- Original Message ----- 

      From: Grewal, Ken 

      Other opinions?

      Thanks, 

      - Ken

      Regards

      Qiu Ying

        ----- Original Message ----- 

        From: QIU Ying 

        Regards

        Qiu Ying

          ----- Original Message ----- 

          From: Yaron Sheffer 

          To: [email-masked] 

          Thanks,

                      Yaron

----------------------------------------------------------------------

---

From: "QIU Ying" <[email-masked]>
Date: Thu, 16 Jul 2009 15:31:27 +0800

Oh, maybe I misunderstood Manav's thought.

Perhaps Manav's meaning is that WESP carries an ESP-null packet which trailer next header is happened ESP. It will cause the conflict. But I do not think this assumption were practical.

Regards
Qiu Ying

  ----- Original Message ----- 
  From: QIU Ying 
  To: Bhatia, Manav (Manav) ; Grewal, Ken ; Yaron Sheffer ; [email-masked] 
  Sent: Thursday, July 16, 2009 3:11 PM
  Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

  Hi, Manav

  Regards
  Qiu Ying

    ----- Original Message ----- 
    From: Bhatia, Manav (Manav) 
    To: Grewal, Ken ; QIU Ying ; Yaron Sheffer ; [email-masked] 
    Sent: Thursday, July 16, 2009 2:27 PM
    Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

    Cheers, Manav

      Qiu Ying, 

      Thanks, 

      - Ken

      Hi, Ken

      Regards

      Qiu Ying

        ----- Original Message ----- 

        From: Grewal, Ken 

        Other opinions?

        Thanks, 

        - Ken

------------------------------------------------------------------------

        Regards

        Qiu Ying

          ----- Original Message ----- 

          From: QIU Ying 

          Regards

          Qiu Ying

            ----- Original Message ----- 

            From: Yaron Sheffer 

            To: [email-masked] 

            Thanks,

                        Yaron

--------------------------------------------------------------------

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Thu, 16 Jul 2009 13:29:14 +0530

Yes, this is what i had meant. I agree that i don't see a use case for this, but there is really nothing that precludes the possibility of having ESP-NULL in WESP.

Cheers, Manav

________________________________
From: QIU Ying [mailto:[email-masked]]
Sent: Thursday, July 16, 2009 1.01 PM
To: QIU Ying; Bhatia, Manav (Manav); Grewal, Ken; Yaron Sheffer; [email-masked]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[email-masked]>
To: Bhatia, Manav (Manav)<mailto:[email-masked]> ; Grewal, Ken<mailto:[email-masked]> ; Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Thursday, July 16, 2009 3:11 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Hi, Manav

Regards
Qiu Ying

----- Original Message -----
From: Bhatia, Manav (Manav)<mailto:[email-masked]>
To: Grewal, Ken<mailto:[email-masked]> ; QIU Ying<mailto:[email-masked]> ; Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Thursday, July 16, 2009 2:27 PM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Cheers, Manav

Qiu Ying,

Thanks,
- Ken

Hi, Ken

Regards
Qiu Ying

----- Original Message -----
From: Grewal, Ken<mailto:[email-masked]>
To: QIU Ying<mailto:[email-masked]> ; Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Wednesday, July 15, 2009 1:31 AM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Other opinions?

Thanks,
- Ken

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[email-masked]>
To: Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Tuesday, July 14, 2009 3:30 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: Yaron Sheffer<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]>
Sent: Sunday, July 05, 2009 3:48 AM
Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Thanks,
            Yaron

---

From: Yaron Sheffer <[email-masked]>
Date: Thu, 16 Jul 2009 11:51:18 +0300

I'll vote for the Encryption Bit.

  _____  

From: Bhatia, Manav (Manav) [mailto:[email-masked]] 
Sent: Thursday, July 16, 2009 7:27
To: Grewal, Ken; QIU Ying; Yaron Sheffer; [email-masked]
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

We can use ESP as the next header to denote encryption being used as long as
we are sure that we will never have an ESP packet inside the WESP
encapsulation. In my view there is nothing that precludes that from
happening, which means that we may have some corner cases where WESP may
actually be carrying an ESP packet inside it. Given this, i would rather
that we don't use the ESP value to denote encryption being used.

I am also not a big fan of the encryption bit as that takes away one bit
from the already limited number of bits that we have at our disposal in the
flags field.

Given that a packet will never carry a protocol ID of 0xFF i propose to use
this value in the next-header to denote encryption being used. Would this
work?

Cheers, Manav

  _____  

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Grewal, Ken
Sent: Wednesday, July 15, 2009 8.57 PM
To: QIU Ying; Yaron Sheffer; [email-masked]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Qiu Ying, 

Copying the value of the ESP next header to the WESP next header is useful
for efficient HW parsing when using ESP-NULL. 

You are correct that in the case of encrypted traffic, we can set this value
to 'ESP', which could denote that the payload is encrypted. 

Having said that, some people in the past have mentioned that it may be
cleaner to have a dedicated bit to denote whether the payload is encrypted
or using ESP-NULL.

Either way works, as long as there is a discrete, unambiguous way to denote
this.  

Thanks, 

- Ken

  _____  

Hi, Ken

Agree that Option 1 is better as it applies lesser new IANA numbers. But in
this case, it seems redundancy to copy the value of Next Header field in the
ESP trailer to here. How about simply setting the value as ESP here? I think
it more meet the original concept of Next Header.

Regards

Qiu Ying

----- Original Message ----- 

From: Grewal, Ken <mailto:[email-masked]>  

To: QIU <mailto:[email-masked]>  Ying ; Yaron
<mailto:[email-masked]>  Sheffer ; [email-masked] 

We had originally proposed using a bit from the WESP flags (integrity only)
for differentiating between ESP-encrypted and ESP-NULL traffic, but changed
this to using a value of zero in the next header for efficient encoding,
although this is overloading the meaning of next header. 

With your observation, the current definition is not practical so we have
the following options:

1.	Revert back to using a bit in the flags to differentiate between
encrypted / NULL traffic. 
2.	Allocate a new protocol value for the next header field to indicate
encrypted data, which seems like an overkill. 

As we are already asking for a new protocol value for WESP, option 1 seems
to be the better choice.

Other opinions?

Thanks, 

- Ken

  _____  

From: [email-masked] [mailto:[email-masked]] On Behalf Of
QIU Ying
Sent: Tuesday, July 14, 2009 12:37 AM
To: QIU Ying; Yaron Sheffer; [email-masked]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Since the zero of next header value is used for HOPOPT already, maybe
applying a new value for this intention is better to avoid the confliction.

Regards

Qiu Ying

----- Original Message ----- 

From: QIU <mailto:[email-masked]>  Ying 

To: Yaron Sheffer <mailto:[email-masked]>  ; [email-masked] 

Regarding the Next Header in section 2, what will be happened if the value
of Next Header is zero (i.e. IPv6 Hop-by-Hop option) and the packet is not
encrypted?

Regards

Qiu Ying

----- Original Message ----- 

From: Yaron Sheffer <mailto:[email-masked]>  

To: [email-masked] 

This is the beginning of a two-week WG Last Call, which will end July 18.
The target status for this document is Proposed Standard. The current
document is at
http://tools.ietf.org/html/draft-ietf-ipsecme-traffic-visibility-05.

If you have not read the document before now, please do so. Having fresh
eyes on the document often brings up important issues. If you HAVE read it
before, please note that there have been several revisions since San
Francisco, so you might want to read it again (plus it's a short document).
Send any comments to the list, even if they are as simple as "I read it and
it seems fine".

Please clearly indicate the position of any issue in the Internet Draft, and
if possible provide alternative text. Please also indicate the nature or
severity of the error or correction, e.g. major technical, minor technical,
nit, so that we can quickly judge the extent of problems with the document.

Thanks,

            Yaron

  _____  

Institute for Infocomm Research disclaimer: "This email is confidential and
may be privileged. If you are not the intended recipient, please delete it
and notify us immediately. Please do not copy or use it for any purpose, or
disclose its contents to any other person. Thank you."

Institute for Infocomm Research disclaimer: "This email is confidential and
may be privileged. If you are not the intended recipient, please delete it
and notify us immediately. Please do not copy or use it for any purpose, or
disclose its contents to any other person. Thank you."

Scanned by Check Point Total Security Gateway.

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Thu, 16 Jul 2009 14:51:42 +0530

If we're to go with the encryption bit then we need more verbiage on what the Next Header should carry (and would mean) when that bit is set and when it is not set. Also, what happens when there is a disconnect between the two, etc. This is certainly doable, but involves more moving parts then simply deriving the state from the Next Header field.

Cheers, Manav

________________________________
From: Yaron Sheffer [mailto:[email-masked]]
Sent: Thursday, July 16, 2009 2.21 PM
To: Bhatia, Manav (Manav); Grewal, Ken; QIU Ying; [email-masked]
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

I'll vote for the Encryption Bit...

Cheers, Manav

Thanks,
- Ken

Hi, Ken

Regards
Qiu Ying

----- Original Message -----
From: Grewal, Ken<mailto:[email-masked]>
To: QIU Ying<mailto:[email-masked]> ; Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Wednesday, July 15, 2009 1:31 AM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Other opinions?

Thanks,
- Ken

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[email-masked]>
To: Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Tuesday, July 14, 2009 3:30 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: Yaron Sheffer<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]>
Sent: Sunday, July 05, 2009 3:48 AM
Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Thanks,
            Yaron

---

From: "Grewal, Ken" <[email-masked]>
Date: Thu, 16 Jul 2009 22:19:02 -0600

After further offline discussion with Manav, we agree with Yaron that a discrete encryption bit is probably the best approach.

Thanks,
- Ken

________________________________
From: Bhatia, Manav (Manav) [mailto:[email-masked]]
Sent: Thursday, July 16, 2009 2:22 AM
To: Yaron Sheffer; Grewal, Ken; QIU Ying; [email-masked]
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Cheers, Manav

Cheers, Manav

Thanks,
- Ken

Hi, Ken

Regards
Qiu Ying

----- Original Message -----
From: Grewal, Ken<mailto:[email-masked]>
To: QIU Ying<mailto:[email-masked]> ; Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Wednesday, July 15, 2009 1:31 AM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Other opinions?

Thanks,
- Ken

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[email-masked]>
To: Yaron Sheffer<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Tuesday, July 14, 2009 3:30 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regards
Qiu Ying

----- Original Message -----
From: Yaron Sheffer<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]>
Sent: Sunday, July 05, 2009 3:48 AM
Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Thanks,
            Yaron