Subject: RE: [Syslog-sec] RE: While you are at it ...

From: "Rainer Gerhards" <[email-masked]>
Date: Mon, 18 Apr 2005 17:41:56 +0200

Tom,

I've gone through RFC 3511 and draft-ietf-ipv6-addr-arch-v4-02.txt. In
syslog-protocol, what we are talking about is the textual representation
of IPv6 addresses, so this is actually section 2.2 of RFC 3511. I've
compared that to the new draft and found only a minor change, which is a
change in the wording, but not in the essence. So I think we can go
ahead with a reference to RFC 3511. I've also updated my ID to point
precisely to section 2.2 instead to section 2. I hope that will it make
easier to keep track of implicatons in IPv6 changes.

I think I will publish my newest ID soon. It will contain some new
wording plus a number of updates. If there is anything else that needs
fixing, we can always go for the next revision.

RAiner

> -----Original Message-----
> From: Tom Petch [mailto:[email-masked]] 
> Sent: Saturday, April 16, 2005 1:08 PM
> To: [email-masked]; Rainer Gerhards; 'syslog'
> Subject: Re: [Syslog-sec] RE: While you are at it ...
> 
> The latest IPv6 address architecture draft does change the rules about
> representation in minor ways and does deprecate two classes 
> of address, site
> local and IPv6 compatible (details in the draft).  Is this 
> significant in the
> context of syslog?  Don't know.  If not, then I will go along 
> with David about
> using RFC 3513.
> 
> Tom Petch
> 
> ----- Original Message -----
> From: "David B Harrington" <[email-masked]>
> To: "'Tom Petch'" <[email-masked]>; "'Rainer Gerhards'"
> <[email-masked]>; "'syslog'" <[email-masked]>
> Sent: Friday, April 15, 2005 11:05 PM
> Subject: RE: [Syslog-sec] RE: While you are at it ...
> 
> 
> > Hi,
> >
> > Unless there is something in the new I-D that is referenced here, I
> > would reference one of the already published RFCs. I think 
> that would
> > cause the least delay in getting this work to RFC.
> >
> > If thr RFC does not advance from PS when this WG wishes to advance
> > this document to DS, a new draft can be publsihed with an updated
> > reference, as part of the process of advancement from PS to DS.
> >
> > David Harrington
> > [email-masked]
> >
> > > -----Original Message-----
> > > From: [email-masked]
> > > [mailto:[email-masked]] On Behalf 
> Of Tom Petch
> > > Sent: Friday, April 15, 2005 3:33 PM
> > > To: 'Rainer Gerhards'; 'syslog'
> > > Subject: Re: [Syslog-sec] RE: While you are at it ...
> > >
> > > Agreeing with everything Sharon and David said, what about
> > > the reference [8] to
> > >  RFC 2373 (for a valid textual representation of an IPv6 address)?
> > >
> > > RFC2373 has been superseded by RFC3513 (still PS) which is
> > > now being superseded
> > > by
> > > draft-ietf-ipv6-addr-arch-v4-02.txt
> > > and there are changes in this area of textual representation,
> > > some additions,
> > > some removals.
> > >
> > > So, if you really mean RFC2373, then there is a technical
> > > problem which will
> > > stop this work progressing.
> > >
> > > If you mean whatever IPv6 comes up with, then a reference to
> > > RFC3513 will be
> > > technically ok but will stop progress along the standards
> > > track since RFC3513
> > > will not progress but the one that supersedes it may.
> > >
> > > So again, I think you want a reference here to work in
> > > progress, citing the I-D
> > > name, with a note as David suggests
> > > -- RFC Ed.: replace XXXX with RFC number and remove this note
> > > alongside reference [8].  (I trust the RFC editor to delay
> > > publication until the
> > > IPv6 draft makes it to RFC:-)
> > >
> > > In passing, you can see a reference of the form I like,
> > > albeit without the RFC
> > > editor note,
> > > in
> > > draft-ietf-bmwg-igp-dataplane-conv-app-05.txt
> > >
> > > Tom Petch
> > >
> > > ----- Original Message -----
> > > From: "David B Harrington" <[email-masked]>
> > > To: "'Rainer Gerhards'" <[email-masked]>; "'syslog'"
> > > <[email-masked]>
> > > Sent: Friday, April 15, 2005 2:45 PM
> > > Subject: RE: [Syslog-sec] RE: While you are at it ...
> > >
> > >
> > > > Hi,
> > > >
> > > > Sharon's suggestion had two parts:
> > > > RFCXXXX rather than RFC9999 - ok.
> > > > But also instructions to the RFC Editor in a format the 
> RFC Editor
> > > > knows to look for:
> > > > -- RFC Ed.: replace XXXX with RFC number and remove this note
> > > >
> > > > dbh
> > > >
> > > > > -----Original Message-----
> > > > > From: [email-masked]
> > > > > [mailto:[email-masked]] On Behalf Of
> > > > > Rainer Gerhards
> > > > > Sent: Friday, April 15, 2005 8:43 AM
> > > > > To: syslog
> > > > > Subject: RE: [Syslog-sec] RE: While you are at it ...
> > > > >
> > > > > Sharon,
> > > > >
> > > > > thanks for the comment. I'll change it to RFC XXXX.
> > > > >
> > > > > Rainer
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: [email-masked]
> > > > > > [mailto:[email-masked]] On Behalf Of
> > > > > > Sharon Chisholm
> > > > > > Sent: Friday, April 15, 2005 1:58 PM
> > > > > > To: syslog
> > > > > > Subject: RE: [Syslog-sec] RE: While you are at it ...
> > > > > >
> > > > > >
> > > > > >
> > > > > > </Rainer>
> > > > > > >
> > > > > > > b) RFC9999 I find confusing, irritating even; normative
> > > > > > > references to I-Ds is
> > > > > > > elementary RFC-editing, they deal with it every 
> day; put in
> > > > > > > the I-D name and
> > > > > > > trust the editor to sort it out:-)
> > > > > >
> > > > > > As far as I have been told, the way it currently is is the
> > > > > > way to do it.
> > > > > > Once it is through the last call, *I* will get a 
> last editing
> > > > > > chance at
> > > > > > which time this is replaced by the actual RFC 1. As far as
> > > > > > I've been told, a
> > > > > > normative RFC must only refer to other RFCs, not I-Ds. If it
> > > > > > does, it won't
> > > > > > be normative until the other I-D has become an RFC.
> > > > > > </Rainer>
> > > > > >
> > > > > > No, more typically one would say RFCXXXX with a 
> note that the
> > > > > > RFC editor
> > > > > > should fill this in when the number is available. RFC9999
> > > > > is much less
> > > > > > likely to be caught before publication.
> > > > > >
> > > > > > Sharon
> > > > > > _______________________________________________
> > > > > > Syslog-sec mailing list
> > > > > > [email-masked]
> > > > > > http://www.employees.org/mailman/listinfo/syslog-sec
> > > > > >
> > > > > _______________________________________________
> > > > > Syslog-sec mailing list
> > > > > [email-masked]
> > > > > http://www.employees.org/mailman/listinfo/syslog-sec
> > > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > Syslog-sec mailing list
> > > > [email-masked]
> > > > http://www.employees.org/mailman/listinfo/syslog-sec
> > >
> > > _______________________________________________
> > > Syslog-sec mailing list
> > > [email-masked]
> > > http://www.employees.org/mailman/listinfo/syslog-sec
> > >
> >
> >
> 
> 
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "Tom Petch" <[email-masked]>
Date: Thu, 21 Apr 2005 14:46:36 +0200

Some minor suggestions

p.2 "..  standardization efforts for reliable, secure and signed .."

'signed' throws me somewhat - I assume this is a reference to syslog-sign in
which case, I suggest a informative reference to it.  And is 'signed' necessary?
I assume it means the very specific way of authenticating a message which for me
is already part of "secure".  It makes me think I am missing something (I am?)

p.4 ditto

p.4 "... instead **of** multiple times..." (insert of)

p.5  (add) RECOMMENDED (used on pp. 19, 28)

p.5 "...RFC2119 RFC 2119 [5]. "

p.12  "  OCTET   = %d00..255" (I don't think ABNF ranges can be specified with
..)

p.19 "STRUCTURED-DATE" (should be DATA)

Tom Petch

---

From: "Tom Petch" <[email-masked]>
Date: Thu, 21 Apr 2005 14:56:46 +0200

Good stuff.

I would like the section on SD-ID to be more precise on acceptable formats.

enterpriseID (enterpriseId? p.41 does say 'This document uses "camel case"
consistently' ) allows multiple sub-identifiers but does not
specify a textual representation or a separator.  I assume decimal number and
period, eg
"9.1.30"
"11.2.3.7.5.12"
but think this should be spelt out

sysUpTime again I would like specifying.  I do not think the reference to
RFC3418 enough especially as there, the syntax is TimeTicks ie integer:-).  And
since it is in hundredths of a second, is one minute represented as "6000 or
"60.00 or ...?  I assume the first is meant ie decimal representation of an
integer (which, after six months running, would be 1576800000 ... mmm).

Tom Petch