Subject: Re: [Int-area] I-D Action:draft-ietf-intarea-server-logging-recommendations-02.txt

From: <[email-masked]>
Date: Mon, 7 Feb 2011 15:15:49 +0100

Dear authors, all,

I read this I-D and have the following comments:

* In its current state, this I-D does not add more content compared to what is stated in http://tools.ietf.org/html/draft-ietf-intarea-shared-addressing-issues-02#section-12. I understand this document aims to make a recommendation but IMHO it would be useful if the I-D discusses other aspects which are not covered so far such as the behaviour of the server when some headers such XFF are used. Storing the content of such headers would be useful in some scenarios (the port binding is not logged in the address sharing side) which prefer to expose an identifier to the destination server instead of maintaining a binding. 

* The I-D should mention that perceived IP address and source may not be sufficient to find the identity of the user; in particular when anonymization capabilities (e.g., infrastructures with onion routing or proxies, etc.) are used.

* Section 3 is out of scope and should be removed.

Cheers,
Med

-----Message d'origine-----
De : [email-masked] [mailto:[email-masked]] De la part de Laganier, Julien
Envoyé : jeudi 27 janvier 2011 18:52
À : [email-masked]
Cc : [email-masked]; [email-masked]
Objet : Re: [Int-area] I-D Action:draft-ietf-intarea-server-logging-recommendations-02.txt

Folks,

We believe that the authors of draft-ietf-intarea-server-logging-recommendations have addressed comments that were made at the last IETF meeting and on the mailing list thereafter:

	Title           : Logging recommendations for Internet facing servers
 	Author(s)       : A. Durand, et al.
 	Filename        : draft-ietf-intarea-server-logging-recommendations-02.txt
	Pages           : 6
	Date            : 2011-01-19
	URL             : http://tools.ietf.org/html/draft-ietf-intarea-server-logging-recommendations-02

This note initiate a two weeks Working Group Last Call. Please review the document and send your comments to the list and state whether or not you think this document is ready to be forwarded to IESG. The Working Group Last Call closes on 2010-02-10 COB PST.

Thank you for your support.

--julien & christian
_______________________________________________
Int-area mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/int-area

*********************************
This message and any attachments (the "message") are confidential and intended solely for the addressees. 
Any unauthorised use or dissemination is prohibited.
Messages are susceptible to alteration. 
France Telecom Group shall not be liable for the message if altered, changed or falsified.
If you are not the intended addressee of this message, please cancel it immediately and inform the sender.
********************************

---

From: Alain Durand <[email-masked]>
Date: Thu, 10 Feb 2011 01:48:50 -0800

> * In its current state, this I-D does not add more content compared to what is stated in http://tools.ietf.org/html/draft-ietf-intarea-shared-addressing-issues-02#section-12. I understand this docu…

Med:

draft-ietf-intarea-shared-addressing-issues was about describing issues, not making recommendations.

  - Alain.

---

From: <[email-masked]>
Date: Thu, 10 Feb 2011 11:32:46 +0100

Dear Alain,

Yes, your are right.  

Still, I re-iterate my comments for this I-D:

* It would be useful if the I-D discusses other aspects such as the behaviour of the server when some headers such XFF are used. Storing the content of such headers would be useful in some scenarios (the port binding is not logged in the address sharing side) which prefer to expose an identifier to the destination server instead of maintaining a binding. 

 
Cheers,
Med

-----Message d'origine-----
De : Alain Durand [mailto:[email-masked]] 
Envoyé : jeudi 10 février 2011 10:49
À : BOUCADAIR Mohamed OLNC/NAD/TIP
Cc : Julien Laganier; [email-masked]; [email-masked]; Christian Vogt; Jari Arkko
Objet : Re: [Int-area] I-D Action:draft-ietf-intarea-server-logging-recommendations-02.txt

Med:

  - Alain.

---

From: Matthew Ford <[email-masked]>
Date: Fri, 11 Feb 2011 12:05:29 +0100

> draft-ietf-intarea-shared-addressing-issues was about describing issues, not making recommendations.

I agree. The shared-addressing-issues document was always intended to be a catalogue of issues, and not to get into a large amount of detail regarding any particular issue, and certainly not to make any specific recommendations about how issues can be addressed. So in that light, I think the server-logging-recommendations document is a helpful addition.

Mat

---

From: Alain Durand <[email-masked]>
Date: Fri, 11 Feb 2011 03:33:55 -0800

Dear Med

> * It would be useful if the I-D discusses other aspects such as the behaviour of the server when some headers such XFF are used. Storing the content of such headers would be useful in some scenario…

This should be done in a separate document as this is application specific.

> * The I-D should mention that perceived IP address and source may not be sufficient to find the identity of the user; in particular when anonymization capabilities (e.g., infrastructures with onion…

This is already the case today without carrier grade NAT... Logging is necessary but not always sufficient.

> * Section 3 is out of scope and should be removed.

This section was requested in a previous comment I received to specifically say that this document will not make any recommendation on the ISP NAT side.

   - Alain.

---

From: <[email-masked]>
Date: Fri, 11 Feb 2011 13:55:38 +0100

Re-,

Please see inline.

Cheers,
Med

-----Message d'origine-----
De : Alain Durand [mailto:[email-masked]] 
Envoyé : vendredi 11 février 2011 12:34
À : BOUCADAIR Mohamed OLNC/NAD/TIP
Cc : Julien Laganier; [email-masked]; [email-masked]; Christian Vogt; Jari Arkko
Objet : Re: [Int-area] I-D Action:draft-ietf-intarea-server-logging-recommendations-02.txt

Dear Med

Med: Why not cover this in this document? These are related issues. 

Med: Mention it in the I-D won't harm.  

Med: I checked the diffs and saw this section was there from the 00 of the individual submission. This text is redundant with the note you have in the introduction:

"   Note: this document provides recommendations for Internet facing
   servers logging incoming connections.  It does not provide any
   recommendations about logging on carrier-grade NAT or other address
   sharing tools."

   - Alain.

---

From: Julien Laganier <[email-masked]>
Date: Fri, 11 Feb 2011 12:49:00 -0800

Med,

Please see below:

<[email-masked]> wrote:
>
> [...]
>
> Alain Durand <[email-masked]> wrote:
>
> Dear Med
>

Although I can agree with you that the cause and symptoms of the
issues are related, they do belong to different layers and IMO it is
not the role of an internet area WG to make recommendations on
protocols of the application area. If you think a similar
recommendation should be made w.r.t. XFF, which I actually don't think
is even a standard, I believe this should be discussed in the
application area.

--julien

---

From: <[email-masked]>
Date: Mon, 14 Feb 2011 07:53:43 +0100

Dear Julien,

This is fair but IP-related information is conveyed sometimes at the application layer. I provided XFF as an example, other application-specific headers can be considered for other internet-facing servers (e.g., SIP/SPTM/etc.).

Having something like the following in the I-D would be fine with me:

"Note that information about the identity of the source (e.g., source IP address, source port number) can be leaked in the application payload. It is encouraged to log this information too."

Cheers,
Med 

-----Message d'origine-----
De : Julien Laganier [mailto:[email-masked]] 
Envoyé : vendredi 11 février 2011 21:49
À : BOUCADAIR Mohamed OLNC/NAD/TIP
Cc : Alain Durand; Julien Laganier; [email-masked]; [email-masked]; Vogt; [email-masked]
Objet : Re: [Int-area] I-D Action:draft-ietf-intarea-server-logging-recommendations-02.txt

Med,

Please see below:

--julien

---

From: Julien Laganier <[email-masked]>
Date: Mon, 14 Feb 2011 09:04:06 -0800

Med,

We can certainly have an informational statement highlighting the fact
that some application layer payloads embed address and port number
information. Making a recommendation on what to do with that
information is however out of scope for this WG.

--julien

---

From: Alain Durand <[email-masked]>
Date: Tue, 15 Feb 2011 01:04:57 -0800

> "Note that information about the identity of the source (e.g., source IP address, source port number) can be leaked in the application payload. It is encouraged to log this information too."

Again, this was discussed and ruled out of scope.

  - Alain.

---

From: Julien Laganier <[email-masked]>
Date: Tue, 15 Feb 2011 14:24:15 -0800

Folks,

The WGLC for this draft has concluded. Med made proposed some
modifications but there was no consensus to change the draft thus we
considered that this draft reflects WG consensus and we will forward
to IESG for publication.

--julien