From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: RFC4303 (IPsec/ESP) auditing requirements Date: Thu, 6 Dec 2007 13:46:32 -0500 Message-ID: <200712061346.32823.paul.moore@hp.com> References: <200712051445.13051.paul.moore@hp.com> <9124.1196965550@turing-police.cc.vt.edu> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id lB6Ild5O026707 for ; Thu, 6 Dec 2007 13:47:39 -0500 Received: from g5t0006.atlanta.hp.com (g5t0006.atlanta.hp.com [15.192.0.43]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id lB6IkgKa010571 for ; Thu, 6 Dec 2007 13:46:42 -0500 In-Reply-To: <9124.1196965550@turing-police.cc.vt.edu> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Valdis.Kletnieks@vt.edu Cc: Joy Latten , linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday 06 December 2007 1:25:50 pm Valdis.Kletnieks@vt.edu wrote: > On Wed, 05 Dec 2007 14:45:12 EST, Paul Moore said: > > Hello all, > > > > I'm looking at RFC4303 at some of the auditing requirements and one of > > the gaps between what the specification requires and what we currently > > provide involves the SA's sequence number and the IPv6 flow ID. > > According the list of existing audit fields[1] there doesn't appear to > > any fields which are a good match. With that in mind I'd like to propose > > two new fields: > > > > * seqno - sequence number > > * flowid - flow id > > > > Any comments, objections, suggestions? > > I see a note from Sep 12 or so from Joy Latten that was talking about > adding support for rfcs430[1-3] - are you two collaborating or working at > cross purposes? Joy who? ;) The Linux Foundation, of which both HP (my employer) and IBM (Joy's employer) are members, is currently going through an IPv6 "gap analysis" trying to bring the Linux IPv6 implementation more in line with the various IPv6 specifications. IPsec, including RFC4303, is part of this effort. Needless to say there are several people involved (I only know a small handful) and I'm just trying to help out by taking care of the auditing requirements in RFC4303. > Are any other fields/calls needed to complete the set? > (Feel free to just handwave a "Somebody should add XYZ in 2.6.N+3" if > warranted) Not according to RFC4303, but let's do some vague handwaving anyway :) > Other than that, the RFC looks sane, and has a rfc2119-SHOULD for those > fields, so it certainly sounds like a good idea. Besides, I *know* that if > we don't, at some point I'm going to be doing forensics or debugging, and > cursing the fact that not all my sensors reported flowid to cross-correlate > on :) :) -- paul moore linux security @ hp