RE: [Geopriv] New Version = Notificationfordraft-busin-geopriv-location-qos-req-00

http://weekrail.com/

I've seen a number of VPNs that send Internet traffic
across the local

network interface. But, I think that's beside the point. Would the

following rewording be better?

To minimize the impact of VPNs, endpoints using IP address as the HELD

identifier need to do their HELD query prior to establishing a VPN

tunnel.

-----Original Message-----

From: Marc Linsner [mailto:mlinsner@cisco.com] 

Sent: Wednesday, November 07, 2007 11:12 AM

To: Stark, Barbara; geopriv@ietf.org

Subject: RE: [Geopriv] HELD guidance for IP address ID

Barbara, 

> 

> To minimize the impact of VPNs that do not support split 

> tunneling, endpoints using IP address as the HELD identifier 

> need to do their HELD query prior to establishing a VPN tunnel.

> 

Even if the VPN soft client supports split tunneling (allowing traffic

on

the local subnet as well as the tunnel), this does not guarantee that

HELD

will work.  When an end host has more than one interface, in this
case a

tunnel interface and local network interface, you must be ensure that

the

routing table in the host sends the HELD request via the correct

interface

otherwise the request will arrive at the LIS with an unknown source

address

on the packet.  My experience has been that VPN tunnel establishment

modifies the host routing table such that the only traffic put out the

local

network interface is traffic destined for that subnet (the default

gateway

is on the tunnel).

-Marc-

_______________________________________________

Geopriv mailing list

Geopriv@ietf.org

https://www1.ietf.org/mailman/listinfo/geopriv

I've seen a =
number of VPNs
that send Internet traffic across the local
network interface. But, I think that's beside the point. Would =
the
following rewording be better?
To minimize the impact of VPNs, endpoints using IP address as the =
HELD
identifier need to do their HELD query prior to establishing a =
VPN
tunnel.
-----Original Message-----
From: Marc Linsner [mailto:mlinsner@cisco.com] 
Sent: Wednesday, November 07, 2007 11:12 AM
To: Stark, Barbara; geopriv@ietf.org
Subject: RE: [Geopriv] HELD guidance for IP address ID
Barbara, 
> 
> To minimize the impact of VPNs that do not support split =

> tunneling, endpoints using IP address as the HELD identifier =

> need to do their HELD query prior to establishing a VPN =
tunnel.
> 
Even if the VPN soft client supports split tunneling (allowing =
traffic
on
the local subnet as well as the tunnel), this does not guarantee =
that
HELD
will work.  When an end host has more than one interface, in =
this case
a
tunnel interface and local network interface, you must be ensure =
that
the
routing table in the host sends the HELD request via the =
correct
interface
otherwise the request will arrive at the LIS with an unknown =
source
address
on the packet.  My experience has been that VPN tunnel =
establishment
modifies the host routing table such that the only traffic put out =
the
local
network interface is traffic destined for that subnet (the =
default
gateway
is on the tunnel).
-Marc-
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www1.ietf.org/mailman/listinfo/geopriv
That's a good one.

It's low-runner I think - a locked down tunnel in such a casual

situation. I'd look darkly at your buddy. Somebody who knows enough to

set up a VPN tunnel for you but doesn't know enough not to make it

split...

It also means that every bit-torrent client your kids run, every

Wikipedia page entry they edit, every hotmail account they use will be

attributed to your business' IP address.

Nevertheless, it's a valid scenario and the sort of one that I agree

could occur. As VPN products become more intelligent about recognizing

HELD messaging.this should become even more marginal.

Cheers,

Martin

-----Original Message-----

From: Brian Rosen [mailto:br@brianrosen.net] 

Sent: Friday, 9 November 2007 12:49 PM

To: Dawson, Martin; 'Ted Hardie'; 'Marc Linsner'; 'Stark, Barbara';

geopriv@ietf.org

Subject: RE: [Geopriv] HELD guidance for IP address ID

Indeed the text has to advise any VPN implementation to make sure that

the

VPN IP addresses don't return locations from the LIS.  This is a

necessary

step, but it's not sufficient.

I've used the following example before:

You have a small business.  You have a computer in your business and
you

have a DSL connection.  Your buddy set you up a VPN tunnel from your

home to

your business.  It happens that your home broadband provider is the
same

provider as your business.

So, from the broadband provider's point of view, a HELD request from you

through the tunnel is a valid request from your business, and it will

return

the location of your business.  You unfortunately are at home.

If your home system always manages to get location captured before the

tunnel is established, or can bypass the VPN, you can get the correct

location.  The problem with this scenario is that it fails really
badly.

Failing with no location is bad, but failing with wrong location is

very,

very bad.

How is anyone supposed to make this work right?  Let's list the players,

shall we?

The DSL provider

The VPN software vendor

The O/S vendor

The softclient vendor

Possibly your buddy

You, the small business owner

In this particular scenario, the broadband supplier can't help much.

Every VPN vendor needs to know to make sure the tunnel can be bypassed

Every O/S vendor (I'm assuming the O/S vendor is writing the HELD

client)

has to know how to make the bypass work, and use that in the HELD

client.  I

have no idea how to make "location before tunnel opens" work.
 If a

client

is mobile, you can't do that.

The softclient vendor has to use the O/S mechanism, or if he implements

the

HELD client himself, has to do what the O/S vendor does.  He can't
do

the

"location before tunnel opens" trick.

Your buddy had better not screw up the configuration in any way that

makes

the bypass not work

You are helpless.

Brian

> -----Original Message-----

> From: Dawson, Martin [mailto:Martin.Dawson@andrew.com]

> Sent: Thursday, November 08, 2007 8:23 PM

> To: Ted Hardie; Marc Linsner; Stark, Barbara; geopriv@ietf.org

> Subject: RE: [Geopriv] HELD guidance for IP address ID

> 

> Hi Ted,

> 

> You're bang on. Any LIS that (is discoverable and) services HELD

> requests from devices attached over a VPN needs to either be able
to

> provide location reliably for those devices or not actually provide

> location. It should be noted that the process of location

determination

> will involve relating the IP address to some other physical network

> parameters associated with that IP address and during that process
it

> should become evident that the device isn't on any physically

measurable

> part of the network.

> 

> Some VPN scenarios are perfectly reasonable. Two sites connected via
a

> branch to branch tunnel over the Internet are effectively a single

> network. A LIS located at one of those sites can still query network

> elements at the other site and determine location for the target IP

> address. On the other hand a target device connecting from off-net

using

> a VPN should only be able to be traced back to the VPN server and
the

> LIS should recognize that as a situation where location cannot be

> determined.

> 

> Cheers,

> Martin

> 

> -----Original Message-----

> From: Ted Hardie [mailto:hardie@qualcomm.com]

> Sent: Friday, 9 November 2007 4:54 AM

> To: Marc Linsner; 'Stark, Barbara'; geopriv@ietf.org

> Subject: RE: [Geopriv] HELD guidance for IP address ID

> 

> At 7:03 AM -0500 11/8/07, Marc Linsner wrote:

> >Barbara,

> >

> >

> >>

> >> To minimize the impact of VPNs, endpoints using IP address
as

> >> the HELD identifier need to do their HELD query prior to

> >> establishing a VPN tunnel.

> >

> >I agree with this.

> >

> >-Marc-

> 

> So, I've been following this discussion silently, and I seen an

emerging

> consensus to recommend this.  But I don't really follow how this
logic

> doesn't apply to multi-interface situations in general.  On the
laptop

> on which

> I am typing, there are three potential non-VPN interfaces:  one
wired,

> one 802.11, and one EVDO.  The logic to me in selection seems
to be

> that someone presenting a query to a Location information server using

> a particular interface should always use that interface's IP address

if

> the IP address is the HELD identifier.  (That is, I should use
the IP

> assigned

> by my EVDO provider, if I'm using the DO interface to query a LIS).

If

> the LIS I reach across that interface doesn't understand that IP

> address,

> it does not return a location (and that can happen when the configured

> address of the LIS doesn't know anything about the interface I chose).

> 

> In a lot of cases, it seems to me a network can achieve this same

effect

> with VPN interfaces, simply by marking the pool of addresses

associated

> with VPN termination points as "unknown location" in the
LIS

> configuration.

> I think it would be good practice for it to do so in any case, as

> timing-related

> configuration is always subject to oddity as interfaces come up and

> down.

> That doesn't mean that the above isn't reasonable advice, but given

the

> rest

> of the data a LIS has to track, the VPN termination pool data doesn't

> seem

> to be a big extra burden to maintain.

> 

> Have I missed the point here?

>                  

                 Ted

> 

> 

> _______________________________________________

> Geopriv mailing list

> Geopriv@ietf.org

> https://www1.ietf.org/mailman/listinfo/geopriv

> 

>

------------------------------------------------------------------------

--

> ----------------------

> This message is for the designated recipient only and may

> contain privileged, proprietary, or otherwise private information.

> If you have received it in error, please notify the sender

> immediately and delete the original.  Any unauthorized use of

> this email is prohibited.

>

------------------------------------------------------------------------

--

> ----------------------

> [mf2]

> 

> 

> 

> _______________________________________________

> Geopriv mailing list

> Geopriv@ietf.org

> https://www1.ietf.org/mailman/listinfo/geopriv

------------------------------------------------------------------------------------------------

This message is for the designated recipient only and may

contain privileged, proprietary, or otherwise private information.  

If you have received it in error, please notify the sender

immediately and delete the original.  Any unauthorized use of

this email is prohibited.

------------------------------------------------------------------------------------------------

[mf2]

_______________________________________________

Geopriv mailing list

Geopriv@ietf.org

https://www1.ietf.org/mailman/listinfo/geopriv

Yes, Martin T. has suggested that we add an informational
reference to the identity extensions draft.  That will fit in nicely
with the text we are adding to discuss the use of IP address as identifier.
I'll shortly post an update to the overall text proposal that also addresses
a couple of the points made recently by Martin D.

Mary.  

-----Original Message-----

From: Brian Rosen [mailto:br@brianrosen.net] 

Sent: Friday, November 16, 2007 10:22 AM

To: Barnes, Mary (RICH2:AR00); peter_blatherwick@mitel.com; 'Geopriv'

Subject: RE: [Geopriv] Question on client identifier in HELD (re: HELDguidance
for IP address ID)

I had the same reaction, but the only thing I think we should change is
to add some text that makes it more clear that the protocol is intended
to be extended for other identifiers, and while IP address is a suitable
identifier for many networks, it may not work well in others.  Perhaps
this could be tied to the text we are discussing that describes the issues
with using IP address as the identifier.

I have no problem with other identifiers being covered in an extension
document, and do not want to hold up HELD to get other text in it that
covers other identifiers.

Brian

________________________________________

From: Mary Barnes [mailto:mary.barnes@nortel.com]

Sent: Friday, November 16, 2007 11:12 AM

To: peter_blatherwick@mitel.com; Geopriv

Subject: RE: [Geopriv] Question on client identifier in HELD (re:

HELDguidance for IP address ID)

Hi Peter,

This wasn't something that was simplified out of the original HELD proposal

- i.e, using the source IP address as the device ID was the premise
of the original proposal.   Feedback I got from James (he and others
will jump in if I've gotten this wrong) is that the source IP address is
sufficient for many applications. 

Mary. 

________________________________________

From: peter_blatherwick@mitel.com [mailto:peter_blatherwick@mitel.com]

Sent: Friday, November 09, 2007 3:01 PM

To: Geopriv

Subject: [Geopriv] Question on client identifier in HELD (re: HELD guidance
for IP address ID)

Hi all, 

All this chatter about IP address as device identifier made me go back
and look again at how this identifier is described in HELD itself.  I
was surprised to notice that HELD itself

(draft-ietf-geopriv-http-location-delivery-02) does not appear to spec
a device identifier internal to the encoding schema at all.  It appears
to be the intent to use the source address of the message as it arrives
at the LIS to derive source IP address of the sender (or their out-most
external facing NAT really).  I also see that a format for encoding
device identifier is described as an extension (draft-winterbottom-geopriv-held-identity-extensions-03).
 Did I miss something?? 

This seems a bit odd to me, and that's probably why I never noticed --
just assumed it had to be there somewhere.  I am curious about the
reasoning to not include device identifier in the base protocol.  Just
weight reduction, given that not all applications would use it?  I'm
probably fine either way, just interested to know.   

BTW, Since the device may have little-to-no idea about its IP address as
visible to the outside world (it is generally behind one or more NATs),
I don't think this question plays into that other debate at all. 

-- Peter 

"HELD, as described here, assumes the use of
IP address of the Device as an identifier used by the server in determining
the location of the Device.  This identifier is revealed to the LIS
through the source address in requests sent by the Device.  The use
of additional identifiers for HELD is allowed for, but outside the scope
of this document.  Such extensions may be described in separate documents
such as [reference to draft-winterbottom-geopriv-held-identity-extensions-03.txt]
"

Hi Marc,

The intent is just to highlight that the use of other identifiers is out
of scope for this document and is addressed elsewhere, with an INFORMATIONAL
reference to the current individual draft. It's only intended to help answer
the question that Peter asked originally, which is a natural question.
 The proposal is to add text something like the following to the end
of section 3:

"HELD uses the IP address of the Device as an identifier in determining
the location of the device.  This identifier is revealed to the LIS
through the source address in requests sent by the Device.  The use
of additional identifiers for HELD is outside the scope of this document
and is described in [reference to draft-winterbottom-geopriv-held-identity-extensions-03.txt]
"

Mary.

-----Original Message-----

From: Marc Linsner [mailto:mlinsner@cisco.com] 

Sent: Friday, November 16, 2007 11:11 AM

To: 'Brian Rosen'; 'Geopriv'

Subject: RE: [Geopriv] Question on client identifier in HELD (re:HELDguidance
for IP address ID)

Brian,

> 

> I think Mary's latest is okay.

> 

> I'm not sure what the additional security issues are: were you 

> referring to the fact that the IP address comes automatically and

> another identifier would have to be added by a client?  I think
that 

> such issues could be left to the extension document.

> 

> LCP is "give me my location".  If "my" is
determined by some ID other 

> than an IP address, it's still an LCP.

It's now an LCP that can be spoofed by someone other than "my".
 Large security/privacy issues.

The identity extensions draft Mary mentioned in not a wg item, you want
to reference it?

More discussion required.

-Marc-

> 

> Brian

> 

> > -----Original Message-----

> > From: Marc Linsner [mailto:mlinsner@cisco.com]

> > Sent: Friday, November 16, 2007 11:33 AM

> > To: 'Brian Rosen'; 'Geopriv'

> > Subject: RE: [Geopriv] Question on client identifier in HELD

> > (re:HELDguidance for IP address ID)

> > 

> > Brian,

> > 

> > I would suggest to leave words around additional identifiers
for 

> > future documents due to the security aspects.  If you are
going to 

> > mention it, then you should cover the security aspects, which
I 

> > envision will be a looooong debate.

> > 

> > Remember the task at hand is LCP.

> > 

> > -Marc-

> > 

> > 

> > 

> > 

> > >

> > > I had the same reaction, but the only thing I think we

> should change

> > > is to add some text that makes it more clear that the protocol
is 

> > > intended to be extended for other identifiers, and while

> IP address

> > > is a suitable identifier for many networks, it may not

> work well in

> > > others.  Perhaps this could be tied to the text we
are discussing 

> > > that describes the issues with using IP address as the identifier.

> > >

> > > I have no problem with other identifiers being covered in
an 

> > > extension document, and do not want to hold up HELD to get
other 

> > > text in it that covers other identifiers.

> > >

> > > Brian

> > >

> > > ________________________________________

> > > From: Mary Barnes [mailto:mary.barnes@nortel.com]

> > > Sent: Friday, November 16, 2007 11:12 AM

> > > To: peter_blatherwick@mitel.com; Geopriv

> > > Subject: RE: [Geopriv] Question on client identifier in
HELD (re:

> > > HELDguidance for IP address ID)

> > >

> > > Hi Peter,

> > >

> > > This wasn't something that was simplified out of the

> original HELD

> > > proposal

> > > - i.e, using the source IP address as the device ID was

> the premise

> > > of the original proposal.   Feedback I got from James
(he

> and others

> > > will jump in if I've gotten this wrong) is that the source
IP 

> > > address is sufficient for many applications.

> > >

> > > Mary.

> > > ________________________________________

> > > From: peter_blatherwick@mitel.com 

> > > [mailto:peter_blatherwick@mitel.com]

> > > Sent: Friday, November 09, 2007 3:01 PM

> > > To: Geopriv

> > > Subject: [Geopriv] Question on client identifier in HELD
(re:

> > > HELD guidance for IP address ID)

> > >

> > > Hi all,

> > >

> > > All this chatter about IP address as device identifier made
me go 

> > > back and look again at how this identifier is described
in HELD 

> > > itself.  I was surprised to notice that HELD itself

> > > (draft-ietf-geopriv-http-location-delivery-02) does not
appear to 

> > > spec a device identifier internal to the encoding schema

> at all.  It

> > > appears to be the intent to use the source address of the

> message as

> > > it arrives at the LIS to derive source IP address of the

> sender (or

> > > their out-most external facing NAT really).  I also
see that a 

> > > format for encoding device identifier is described as an

> extension

> > > (draft-winterbottom-geopriv-held-identity-extensions-03).

> > > Did I miss something??

> > >

> > > This seems a bit odd to me, and that's probably why I

> never noticed

> > > -- just assumed it had to be there somewhere.  I am
curious about 

> > > the reasoning to not include device identifier in the

> base protocol.

> > > Just weight reduction, given that not all applications

> would use it?

> > > I'm probably fine either way, just interested to know.

> > >

> > > BTW, Since the device may have little-to-no idea about its
IP 

> > > address as visible to the outside world (it is generally

> behind one

> > > or more NATs), I don't think this question plays into that
other 

> > > debate at all.

> > >

> > > -- Peter

> > >

> > >

> > >

> > > _______________________________________________

> > > Geopriv mailing list

> > > Geopriv@ietf.org

> > > https://www1.ietf.org/mailman/listinfo/geopriv

_______________________________________________

Geopriv mailing list

Geopriv@ietf.org

https://www1.ietf.org/mailman/listinfo/geopriv

_______________________________________________

Geopriv mailing list

Geopriv@ietf.org

https://www1.ietf.org/mailman/listinfo/geopriv

"HELD, as=20
  described here, assumes the use of IP address of the Device as an =
identifier=20
  used by the server in determining the location of the Device. =
 This=20
  identifier is revealed to the LIS through the source address in =
requests sent=20
  by the Device.  The use of additional identifiers for HELD is =
allowed=20
  for, but outside the scope of this document.  Such extensions may =
be=20
  described in separate documents such as [reference to=20
  draft-winterbottom-geopriv-held-identity-extensions-03.txt]=20
  "

Package	Quantity	Price in your = local drugstore*	Our = price	Learn More Now
10 tabs	20 doses	~~$99.95~~	$34.49
30 tabs	60 doses	~~$299.95~~	$88.50
60 tabs	120 doses	~~$449.95~~	$141.02
90 tabs	180 doses	~~$769.95~~	$176.40
180 tabs	360 doses	~~$1299.95~~	$298.46

Package	Quantity	Price in your = local drugstore*	Our = price	Learn More Now
10 tabs	20 doses	~~$99.95~~	$34.49
30 tabs	60 doses	~~$299.95~~	$88.50
60 tabs	120 doses	~~$449.95~~	$141.02
90 tabs	180 doses	~~$769.95~~	$176.40
180 tabs	360 doses	~~$1299.95~~	$298.46

Package	Quantity	Price in your = local drugstore*	Our = price	Learn More Now
10 tabs	20 doses	~~$99.95~~	$34.49
30 tabs	60 doses	~~$299.95~~	$88.50
60 tabs	120 doses	~~$449.95~~	$141.02
90 tabs	180 doses	~~$769.95~~	$176.40
180 tabs	360 doses	~~$1299.95~~	$298.46

Package	Quantity	Price in your = local drugstore*	Our = price	Learn More Now
10 tabs	20 doses	~~$95.95~~	$34.19
30 tabs	60 doses	~~$349.95~~	$104.66
60 tabs	120 doses	~~$549.95~~	$180.15
90 tabs	180 doses	~~$789.95~~	$242.06
180 tabs	360 doses	~~$1325.95~~	$445.61

Package	Quantity	Price in your = local drugstore*	Our = price	Learn More Now
10 tabs	20 doses	~~$99.95~~	$34.49
30 tabs	60 doses	~~$299.95~~	$88.50
60 tabs	120 doses	~~$449.95~~	$141.02
90 tabs	180 doses	~~$769.95~~	$176.40
180 tabs	360 doses	~~$1299.95~~	$298.46