Subject: [Syslog] Status of syslog/dtls ISSUES

From: Chris Lonvick <[email-masked]>
Date: Fri, 18 Jun 2010 15:23:38 -0700 (PDT)

Hi Folks,

Here's where we stand on the open issues:

Issue 1 - COMMENT from Alexy
STATUS: One note from Tom Petch on this (combining Issues 1, 2, and 10). 
See Issue 10.

Issue 2 - Fragmentation
STATUS: Same as Issue 1.

Issue 3 - Text revision from GENART review
STATUS: Joe to compose text.

Issue 4 - Service code subregistry
STATUS: I havn't seen any review on the list but the thread was pretty 
conclusive.  Joe to incorporate text into a new revision.

Issue 5 - Reference
STATUS: Joe to incorporate text proposed by Tom.

Issue 6 - Reference 2
STATUS: Joe to revise ID with proposed text.

Issue 7 - text
STATUS: Joe to revise ID.

Issue 8 - Tim Polk DISCUSS
STATUS: Discussed by Tom and David.  Joe to incorporate changes.

Issue 9, 9a, and 9b - from a Tim Polk COMMENT
STATUS:  It looks like 9 and 9a have been discussed and Tom has proposed 
text to resolve them.  Sean proposed text on 9b.  I'd like some discussion 
on that.

Issue 10 - Jari Arrko DISCUSS
STATUS: Same as Issue 1.  Is the text proposed by Sean good to cover all 
of this Issue, Issue 1 and Issue 2?

Issue 11 - Adrian Farrel DISCUSS
STATUS: CLOSED

Issue 12 - nit
STATUS: Tom agrees with this, Joe to revise text in a new ID.

Issue 13 - DCCP?
STATUS: With no discussion, I'm closing this.

Just FYI to all, Joe has been swamped with the day job but he'll look at 
the issues as soon as he can.

Thanks,
Chris

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Sun, 20 Jun 2010 22:08:35 -0700

> STATUS: Discussed by Tom and David.  Joe to incorporate changes.
[Joe] For this one I have Section 5 as:

"Implementations of this
   specification MUST support DTLS over UDP and MUST support DTLS over
   DCCP [RFC5238] if the DCCP transport is available at run-time."

And section 6 as:

" DCCP has congestion control.  For this reason, when DCCP is
   available, the syslog over DTLS over DCCP option is RECOMMENDED in
   preference to the syslog over the DTLS over UDP option."

I'm think the RECOMMENDED in the section 6 needs to be replaced with
something else, I'm not quite sure what.  

> text to resolve them.  Sean proposed text on 9b.  I'd like some
discussion
[Joe] I'm not sure 9b is necessary, but I don't think it causes harm.
I'd modify the text to say " implementations often generate their own
key pairs" since its possible for the generation to be done outside the
implementation.  

> of this Issue, Issue 1 and Issue 2?
[Joe] I incorporated the text, I'm not sure it covers all the issues, I
think Tom initiated some discussion on the TLS list, but  I don't think
it changes the result.

---

From: "David Harrington" <[email-masked]>
Date: Mon, 21 Jun 2010 11:46:13 -0400

Hi,

The proposed text is:
"Implementations of this

So if I am an implementer, and I have no idea whether my customers
will have DCCP available at runtime, MUST I implement those
DCCP-related things that are specified in this document?

Even if I see no customer demand for DCCP, and assume it will NOT be
available at runtime, MUST my implementation support the service code
SYLG? 

If I don't implement support for this, and the customer DOES NOT have
DCCP at runtime, is my implementation compliant to this spec?

If I don't implement support for this, and the customer DOES have DCCP
at runtime, is my implementation still compliant to this spec?

dbh

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Joseph Salowey 
> (jsalowey)
> Sent: Monday, June 21, 2010 1:09 AM
> To: Chris Lonvick (clonvick); [email-masked]
> Subject: Re: [Syslog] Status of syslog/dtls ISSUES
> 
> I'm think the RECOMMENDED in the section 6 needs to be 
> replaced with something else, I'm not quite sure what.  
> 
> I'd modify the text to say " implementations often generate 
> their own key pairs" since its possible for the generation to 
> be done outside the implementation.  
> 
> > STATUS: Same as Issue 1.  Is the text proposed by Sean good to
cover
> all
> [Joe] I incorporated the text, I'm not sure it covers all the 
> issues, I think Tom initiated some discussion on the TLS 
> list, but  I don't think it changes the result.  
> 
> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/syslog
>

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Mon, 21 Jun 2010 09:38:59 -0700

What text would you suggest?  

> From: David Harrington [mailto:[email-masked]]
> Sent: Monday, June 21, 2010 8:46 AM
> To: Joseph Salowey (jsalowey); Chris Lonvick (clonvick);
[email-masked]
> Subject: RE: [Syslog] Status of syslog/dtls ISSUES
> 
> Hi,
> 
> The proposed text is:
> "Implementations of this

---

From: "David Harrington" <[email-masked]>
Date: Mon, 21 Jun 2010 17:21:53 -0400

How about 

 "Implementations of this
    specification MUST support DTLS over UDP and MUST support the DTLS
over
    DCCP [RFC5238] features of this specification."

I'm not sure what else is necessary, but there are only two DCCP
things mentioned in this spec - the CCIDs and SYSL service name. The
CCID text is already written using RFC2119 language.

dbh

> From: Joseph Salowey (jsalowey) [mailto:[email-masked]] 
> Sent: Monday, June 21, 2010 12:39 PM
> To: David Harrington; Chris Lonvick (clonvick); [email-masked]

> > >    specification MUST support DTLS over UDP and MUST support
DTLS
> > over
> > >    available, the syslog over DTLS over DCCP option is
RECOMMENDED
> > in
> > > > STATUS:  It looks like 9 and 9a have been discussed and Tom
has
> > > proposed
> > > > text to resolve them.  Sean proposed text on 9b.  I'd like
some
> > > I'd modify the text to say " implementations often generate
their 
> > > own key pairs" since its possible for the generation to be done 
> > > outside the implementation.
> > >

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Mon, 21 Jun 2010 15:25:58 -0700

I think DCCP features isn't really much clearer.  Perhaps the following
would be better,

"Implementations of this specification MUST support DTLS over UDP and
MUST support the DTLS over
 DCCP [RFC5238] CCIDs and service name specified in this document."

This still seems to mandate a DCCP implementation to be compliant with
the spec.    

> Sent: Monday, June 21, 2010 2:22 PM
[email-masked]

---

From: "David Harrington" <[email-masked]>
Date: Mon, 21 Jun 2010 19:22:06 -0400

It doesn't. And you can be explicit about that if you want.

dbh 

> Sent: Monday, June 21, 2010 6:26 PM
> I think DCCP features isn't really much clearer.  Perhaps the 
> following would be better,
> 
> "Implementations of this specification MUST support DTLS over 
> UDP and MUST support the DTLS over  DCCP [RFC5238] CCIDs and 
> service name specified in this document."
> 
> > > > > [Joe] I'm not sure 9b is necessary, but I don't think 
> it causes
> > > > harm.

---

From: Chris Lonvick <[email-masked]>
Date: Tue, 22 Jun 2010 17:11:12 -0700 (PDT)

Hi Folks,

How about this:

- We leave Section 5 just as it is:
CURRENT:
    DTLS can run over multiple transports.  Implementations of this
    specification MUST support DTLS over UDP and SHOULD support DTLS over
    DCCP [RFC5238].  Transports, such as UDP or DCCP do not provide
    session multiplexing and session-demultiplexing.  In such cases, the
    application implementer provides this functionality by mapping a
    unique combination of the remote address, remote port number, local
    address and local port number to a session.

- We modify Section 6 as follows:
CURRENT:
    DCCP has congestion control.  For this reason the syslog over DTLS
    over DCCP option is recommended in preference to the syslog over the
    DTLS over UDP option.  Implementations of syslog over DTLS over DCCP
    MUST support CCID 3 and SHOULD support CCID 2 to ensure
    interoperability.
PROPOSED:
    DCCP has congestion control but is not widely deployed at the time of
    this writing.  Since it does have congestion control, whereas UDP does
    not, syslog over DTLS over DCCP is recommended in preference to the
    syslog over DTLS over UDP.  Implementations of syslog over DTLS over
    DCCP MUST support CCID 3 and SHOULD support CCID 2 to ensure
    interoperability.

Please get your comments in quickly as we'd like to close this out.

Thanks,
Chris

---

From: "David Harrington" <[email-masked]>
Date: Tue, 22 Jun 2010 23:24:17 -0400

Hi,

Tim, your orignal concern was that the section 5 advice and the
section 6 advice didn't align: a RECOMMENDED to use should be
accompanied by a mandatory-to-implement.
I agree there should be mandatory support for syslog/dtls to provide
an interace to DCCP, so that when DCCP is available it can be used.
But apparently the WG doesn't agree.
Good luck getting operators to use it, even when DCCP is available, if
implementers don't implement the necessary interface to call DCCP from
syslog/DTLS. I have not seen any technical arguments as to why this
cannot be done. 

But I recused, since I am chair of syslog, so this is not my DISCUSS.
I recommend the following as a compromise position:
 
Leave section 5 as is:
CURRENT:
    DTLS can run over multiple transports.  Implementations of this
    specification MUST support DTLS over UDP and SHOULD support DTLS
over
    DCCP [RFC5238].  Transports, such as UDP or DCCP do not provide
    session multiplexing and session-demultiplexing.  In such cases,
the
    application implementer provides this functionality by mapping a
    unique combination of the remote address, remote port number,
local
    address and local port number to a session.

section 6:
CURRENT:
    DCCP has congestion control.  For this reason the syslog over DTLS
    over DCCP option is recommended in preference to the syslog over
the
    DTLS over UDP option.  Implementations of syslog over DTLS over
DCCP
    MUST support CCID 3 and SHOULD support CCID 2 to ensure
    interoperability.
NEW:
    DCCP has congestion control.  If DCCP is available, syslog over
DTLS
    over DCCP is RECOMMENDED in preference to syslog over 
    DTLS over UDP.  Implementations of syslog over DTLS over DCCP
    MUST support CCID 3 and SHOULD support CCID 2 to ensure
    interoperability.

This provides clear guidance to implementers that they SHOULD
implement, and to users that they SHOULD use it if available. 

(I find this much better than "MUST implement if DCCP is available at
runtime", since an implementer would not necessarily know if DCCP
would be available at runtime.)

dbh

> From: Chris Lonvick [mailto:[email-masked]] 
> Sent: Tuesday, June 22, 2010 8:11 PM
> To: [email-masked]; Joseph Salowey (jsalowey)
> Cc: David Harrington
> > MUST support the DTLS over DCCP [RFC5238] CCIDs and service name 
> > specified in this document."
> >
> >>     specification MUST support DTLS over UDP and MUST support the

> >> DTLS over
> >>>>> [Joe] I'm not sure 9b is necessary, but I don't think it
causes