Re: [CDNi] [E] Re: I-D Action: draft-ietf-cdni-interfaces-https-delegation-07.txt

["Mishra, Sanjay" <[e-mail]>]

Hi Guillaume - My reply (as a co-author) is inline below:

you wrote:
>Section 3:
One read the following: " This document only considers the Short-term,
Automatically-Renewed   (STAR) certificates in Automated Certificate
Management  Environment(ACME) [RFC8739]"
However I think, it looks like the  draft proposal is mostly  assume  RFC
9115.
[SM]: Yes, you are correct. The I-D will be updated as it indeed aligns
with RFC 9115

you wrote:
>section 4:
There is an inversion between uCDN and dCDN. One should read:
" In order for CDNs to negotiate on which methods are supported, the
Footprint and Capabilities interface as defined in RFC8008, allows a  dCDN
to send a FCI capability type objects, named
FCI.SupportedDelegationMethods, to uCDN.
[SM]: Correct, will update.

>Regarding the name of the FCI object, I suggest a name that is less
ambiguous (delegation method refers to request routing). For instance:
FCI.HttpsDelegation.
This said, I am not sure whether that new  FCI object is required. If it
is  planned to define one MI object per HTTPS delegation method then FCI
already informs the uCDN about the generic MI objects supported by the
dCDN.  A new FCI object would be required if you need to communicate about
options supported within a said HTTPS delegation method that is not the
case in your draft.
[SM]: I get what you are saying. Need to verify once more but I believe
advertising capability is still OK even with use of generic MI. On the FCI
object name, there appears a typo and will fix it.

you wrote:
>In you 5.1 example, you indicate "hostmetadata" as a property to the
MI.HostMetadata object which does not exist indeed. The correct name is
"metadata".
[SM]: Agree. Next revision.

you wrote:
>Section 8
I think you must also register a new FCI payload type as well as a new CDNI
Supported Delegation Methods.
[SM]: Yes, agree

Thanks
Sanjay


On Wed, Oct 27, 2021 at 5:55 AM Guillaume Bichot <
[e-mail]> wrote:

> Frederic, all
>
> Section 3:
> One read the following: " This document only considers the Short-term,
> Automatically-Renewed   (STAR) certificates in Automated Certificate
> Management  Environment(ACME) [RFC8739]"
> However I think, it looks like the  draft proposal is mostly  assume  RFC
> 9115.
>
> section 4:
> There is an inversion between uCDN and dCDN. One should read:
> " In order for CDNs to negotiate on which methods are supported, the
> Footprint and Capabilities interface as defined in RFC8008, allows a  dCDN
> to send a FCI capability type objects, named
> FCI.SupportedDelegationMethods, to uCDN.
> Regarding the name of the FCI object, I suggest a name that is less
> ambiguous (delegation method refers to request routing). For instance:
> FCI.HttpsDelegation.
> This said, I am not sure whether that new  FCI object is required. If it
> is  planned to define one MI object per HTTPS delegation method then FCI
> already informs the uCDN about the generic MI objects supported by the
> dCDN.  A new FCI object would be required if you need to communicate about
> options supported within a said HTTPS delegation method that is not the
> case in your draft.
>
> Section 5:
> It refers to a ACME/STAR API  as part of RFC8739 which does not define
> such API.
> The MI.AcmeStarDelegationMethod contains the property
> "credentials-location-uri" for which there is no explanation about how to
> use that property, neither in this draft  nor in  RFC 9115.
> Basically it is unclear how the dCDN should proceed. Why a CSR template?
> The CSR template should be known in advance on both sides. Who decides
> about the delegated name ? is it the IdO (the uCDN) or the dCDN? In other
> words who builds the delegation configuration? In RFC 9115, it is assumed
> that before all, the uCDN gathers a delegation configuration applying for
> that dCDN gathering the necessary domain name mapping (e.g. cp.uCDN.com:c
> p.uCDN.dCDN.com) .
>
> All this process must be synchronized with the CDNi delegation process.
> When a uCDN configures the dCDN for streaming delegation, it must first
> ensure the dCDN is ready (configured) for certificate delegation. How is it
> guarantied?
>
> I think there should be a paragraph about whether such mechanism about
> delegated certificate mechanism applies to CDNi delegation based on HTTP
> redirect.
>
> Guillaume
>
> -----Original Message-----
> From: Guillaume Bichot
> Sent: Monday, October 11, 2021 4:17 PM
> To: [e-mail]; [e-mail]
> Subject: RE: [CDNi] I-D Action:
> draft-ietf-cdni-interfaces-https-delegation-06.txt
>
> Frederic,
> there is small mistake in your draft and may be missing registration tasks.
>
> Section 5.1 Extension to HostMetadata object and section 5.2 Extension to
> PathMetadata object
>
> Strictly speaking, you do not extend the HostMetadata or the PathMetadata
> object. Instead, you propose to create a new Generic Metadata object.
> Therefore, you do not need 5.1 or even 5.2 either. Both MI.HostMetatada and
> MI.PathMetadata objects have a property (metadata) that refers to a list
> (an array) of generic metadata objects (MI.GenericMetadata).
>
> So instead you should just remove these subsections. I think they bring
> confusion as there is nothing specific regarding  5.1  versus 5.2.   As any
> other MI generic metadata object, the AcmeStarDelegationMethod
> configuration object can be attached to a host name or to host name + a
> path pattern.
>
> In you 5.1 example, you indicate "hostmetadata" as a property to the
> MI.HostMetadata object which does not exist indeed. The correct name is
> "metadata".
>
> Your new object should be describe like this :
>
> Following the example above, the MI.HostMetadata can be modeled
>            for ACMEStarDelegationMethod as:
>
>                    {
>                "metadata": [
>                        {
>                    "generic-metadata-type":
> "MI.AcmeStarDelegationMethod",
>                    "generic-metadata-value": {
>                       "star-proxy": "10.2.2.2",
>                       "acme-server" : "10.2.3.3",
>                       "credentials-location-uri": "
> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ucdn.com_credentials&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=c_x5S7bwh6JWaEEwARG0xZ8OLIYNYAEkb0z-xR_XbLI&s=KTnh0aLbZNxM3zWC4ydGNFUzGBoWs7J-NDNl89xI8As&e=
> ",
>                       "periodicity": 36000,
>                       "CSR-template": Json/Text of the CSR template (see
> 4.2)
>                        }}]
>                    }
>
> Section 8
> I think you must also register a new FCI payload type as well as a new
> CDNI Supported Delegation Methods.
>
> Guillaume
>
> Guillaume Bichot
> Principal Engineer, Head of Exploration
> broadpeak
> m: [phone]    p: [phone] [e-mail]
>
> Broadpeak, S.A.S.|Registered offices at 15 rue Claude Chappe, Zone des
> Champs Blancs, 35510 Cesson-Sévigné, France | Rennes Trade Register: 524
> 473 063 This e-mail and its attachments contain confidential information
> from Broadpeak S.A.S and/or its affiliates (Broadpeak),  which is intended
> only for the person to whom it is addressed. If you are not the intended
> recipient of this email, please notify immediately the sender by phone or
> email and delete it. Any use of the information contained herein in any
> way, including, but not limited to, total or partial disclosure,
> reproduction, or dissemination, by persons other than the intended
> recipient(s) is prohibited, unless expressly authorized by Broadpeak.
> Broadpeak, S.A.S. and its affiliates respect privacy laws, and is committed
> to the protection of personal data. Emails and/or attachments thereof
> exchanged between us may include your personal data which may be processed
> by Broadpeak and/or its affiliates according to applicable privacy laws &
> regulations. In compliance with Regulation (EU) 2016/679 (GDPR) and
> applicable implementation in local legislations, you can exercise at any
> time your rights of access, rectification or erasure of your personal data,
> as well as your rights to restriction, portability or object to the
> processing.
> For such purpose, or to know more about how Broadpeak processes your
> personal data, you may contact Broadpeak by mail (Headquarters address
> listed here) or by email ([e-mail]).
> Local authority :  Commission Nationale Informatique et Libertés (CNIL): 3
> Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 or
> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.cnil.fr&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=Uk6ZpCxdw5jERccF5Guy0su4BFG-YKFJA4b3To-HWHA&e=
>
>
>
> -----Original Message-----
> From: CDNi <[e-mail]> On Behalf Of [e-mail]
> Sent: Wednesday, October 6, 2021 5:40 PM
> To: FIEAU Frédéric INNOV/NET <[e-mail]>; [e-mail]
> Subject: Re: [CDNi] I-D Action:
> draft-ietf-cdni-interfaces-https-delegation-06.txt
>
> Hi all,
>
> A quick recap of the main changes:
> - Removed sections related to the "Delegated Credentials" delegation method
> - Added FCI meta data to sync CDNs on the delegation methods that are
> supported
> - Added a HostMatch pattern to trigger a delegation method
>
>
> Regards,
> Frederic
>
> -----Message d'origine-----
> De : CDNi [mailto:[e-mail]] De la part de
> [e-mail] Envoyé : mercredi 15 septembre 2021 16:08 À :
> [e-mail] Objet : Re: [CDNi] I-D Action:
> draft-ietf-cdni-interfaces-https-delegation-06.txt
>
> Hi all,
>
> I posted a new version of the draft-ietf-cdni-interfaces-https-delegation.
> This last version only includes support for the ACME-STAR method for now
> and adds FCI metadata for delegation methods negotiation between CDNs.
>
> Please feel free to review and comments.
>
> Regards,
> Frederic
>
>
>
> -----Message d'origine-----
> De : CDNi [mailto:[e-mail]] De la part de
> [e-mail] Envoyé : vendredi 10 septembre 2021 16:01 À :
> [e-mail] Cc : [e-mail] Objet : [CDNi] I-D Action:
> draft-ietf-cdni-interfaces-https-delegation-06.txt
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Content Delivery Networks Interconnection
> WG of the IETF.
>
>         Title           : CDNI extensions for HTTPS delegation
>         Authors         : Frederic Fieau
>                           Emile Stephan
>                           Sanjay Mishra
>         Filename        :
> draft-ietf-cdni-interfaces-https-delegation-06.txt
>         Pages           : 10
>         Date            : 2021-09-10
>
> Abstract:
>    The delivery of content over HTTPS involving multiple CDNs raises
>    credential management issues.  This document proposes extensions in
>    CDNI Control and Metadata interfaces to setup HTTPS delegation from
>    an Upstream CDN (uCDN) to a Downstream CDN (dCDN).
>
>
> The IETF datatracker status page for this draft is:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__eur02.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fdatatracker.ietf.org-252Fdoc-252Fdraft-2Dietf-2Dcdni-2Dinterfaces-2Dhttps-2Ddelegation-252F-26amp-3Bdata-3D04-257C01-257Cguillaume.bichot-2540broadpeak.tv-257Ce4f35d52b7d94482923f08d988df8abc-257C0ebe44eac9c9438da0407e699f358ed4-257C0-257C0-257C637691315957921384-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26amp-3Bsdata-3DBHhqMqIpAXerqLsl-252B7LZXOrFdYUkpCcdmkuerx0RTdQ-253D-26amp-3Breserved-3D0&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=K8hGTKthkiu-FPdibAtBJlJogmCkSrbjNn2vs_vWTQc&e=
>
> There is also an HTML version available at:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__eur02.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fwww.ietf.org-252Farchive-252Fid-252Fdraft-2Dietf-2Dcdni-2Dinterfaces-2Dhttps-2Ddelegation-2D06.html-26amp-3Bdata-3D04-257C01-257Cguillaume.bichot-2540broadpeak.tv-257Ce4f35d52b7d94482923f08d988df8abc-257C0ebe44eac9c9438da0407e699f358ed4-257C0-257C0-257C637691315957921384-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26amp-3Bsdata-3DzhCZArN81bLaL8K7Q226vnNTGCR8Q-252Fb0CAnM8rMEmpE-253D-26amp-3Breserved-3D0&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=XeUp-uDY0Hnq_xySnlY-Kk5Gh1GibcX8_GLNJUoBMW8&e=
>
> A diff from the previous version is available at:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__eur02.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fwww.ietf.org-252Frfcdiff-253Furl2-253Ddraft-2Dietf-2Dcdni-2Dinterfaces-2Dhttps-2Ddelegation-2D06-26amp-3Bdata-3D04-257C01-257Cguillaume.bichot-2540broadpeak.tv-257Ce4f35d52b7d94482923f08d988df8abc-257C0ebe44eac9c9438da0407e699f358ed4-257C0-257C0-257C637691315957921384-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26amp-3Bsdata-3D4QAiMS2XZMJrM69hHR1mkmDv3UpcBoDlSRAGPl9CgFE-253D-26amp-3Breserved-3D0&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=MWmSbCA0ikxvvkOFysYYTPnHbijH6TJ5RwEovg8T0iM&e=
>
>
> Internet-Drafts are also available by anonymous FTP at:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__eur02.safelinks.protection.outlook.com_-3Furl-3Dftp-253A-252F-252Fftp.ietf.org-252Finternet-2Ddrafts-252F-26amp-3Bdata-3D04-257C01-257Cguillaume.bichot-2540broadpeak.tv-257Ce4f35d52b7d94482923f08d988df8abc-257C0ebe44eac9c9438da0407e699f358ed4-257C0-257C0-257C637691315957921384-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26amp-3Bsdata-3DGcL79D-252BP86q-252F6HUya2HoF5o4AyUv7kBntEqr-252FpQ-252BNo0-253D-26amp-3Breserved-3D0&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=Ws7vmICwbZ-0QyUymlCcrUbQw4RhLUMKVcZSvGkZtcI&e=
>
>
> _______________________________________________
> CDNi mailing list
> [e-mail]
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__eur02.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fwww.ietf.org-252Fmailman-252Flistinfo-252Fcdni-26amp-3Bdata-3D04-257C01-257Cguillaume.bichot-2540broadpeak.tv-257Ce4f35d52b7d94482923f08d988df8abc-257C0ebe44eac9c9438da0407e699f358ed4-257C0-257C0-257C637691315957921384-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26amp-3Bsdata-3DUYyQ0zXCnhLnBNmUsjPooYwJKTLDH63-252FcmSGlDMW-252FtU-253D-26amp-3Breserved-3D0&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=QKLUA650uC031qWWIuVEs5oCycoUR0Eb-x5PsGX8XYU&e=
>
>
> _________________________________________________________________________________________________________________________
>
> Ce message et ses pieces jointes peuvent contenir des informations
> confidentielles ou privilegiees et ne doivent donc pas etre diffuses,
> exploites ou copies sans autorisation. Si vous avez recu ce message par
> erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les
> pieces jointes. Les messages electroniques etant susceptibles d'alteration,
> Orange decline toute responsabilite si ce message a ete altere, deforme ou
> falsifie. Merci.
>
> This message and its attachments may contain confidential or privileged
> information that may be protected by law; they should not be distributed,
> used or copied without authorisation.
> If you have received this email in error, please notify the sender and
> delete this message and its attachments.
> As emails may be altered, Orange is not liable for messages that have been
> modified, changed or falsified.
> Thank you.
>
> _______________________________________________
> CDNi mailing list
> [e-mail]
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__eur02.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fwww.ietf.org-252Fmailman-252Flistinfo-252Fcdni-26amp-3Bdata-3D04-257C01-257Cguillaume.bichot-2540broadpeak.tv-257Ce4f35d52b7d94482923f08d988df8abc-257C0ebe44eac9c9438da0407e699f358ed4-257C0-257C0-257C637691315957921384-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26amp-3Bsdata-3DUYyQ0zXCnhLnBNmUsjPooYwJKTLDH63-252FcmSGlDMW-252FtU-253D-26amp-3Breserved-3D0&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=QKLUA650uC031qWWIuVEs5oCycoUR0Eb-x5PsGX8XYU&e=
>
>
> _________________________________________________________________________________________________________________________
>
> Ce message et ses pieces jointes peuvent contenir des informations
> confidentielles ou privilegiees et ne doivent donc pas etre diffuses,
> exploites ou copies sans autorisation. Si vous avez recu ce message par
> erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les
> pieces jointes. Les messages electroniques etant susceptibles d'alteration,
> Orange decline toute responsabilite si ce message a ete altere, deforme ou
> falsifie. Merci.
>
> This message and its attachments may contain confidential or privileged
> information that may be protected by law; they should not be distributed,
> used or copied without authorisation.
> If you have received this email in error, please notify the sender and
> delete this message and its attachments.
> As emails may be altered, Orange is not liable for messages that have been
> modified, changed or falsified.
> Thank you.
>
> _______________________________________________
> CDNi mailing list
> [e-mail]
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__eur02.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fwww.ietf.org-252Fmailman-252Flistinfo-252Fcdni-26amp-3Bdata-3D04-257C01-257Cguillaume.bichot-2540broadpeak.tv-257Ce4f35d52b7d94482923f08d988df8abc-257C0ebe44eac9c9438da0407e699f358ed4-257C0-257C0-257C637691315957921384-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26amp-3Bsdata-3DUYyQ0zXCnhLnBNmUsjPooYwJKTLDH63-252FcmSGlDMW-252FtU-253D-26amp-3Breserved-3D0&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=QKLUA650uC031qWWIuVEs5oCycoUR0Eb-x5PsGX8XYU&e=
>
> _______________________________________________
> CDNi mailing list
> [e-mail]
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_cdni&d=DwIFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=dlayUckp9btrUV3zODkrw0qr-IwYWLb1tbHrnu-VwdE&s=FmI5DjbSl_qgv1WGqBYEfV_u1ErwSYpIcWKUDzgfPHo&e=
>