Re: [Dots] WGLC on draft-ietf-dots-server-discovery-05

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail]
> <[e-mail]>
> Sent: Thursday, November 7, 2019 3:06 PM
> To: Konda, Tirumaleswar Reddy
> <[e-mail]>; Jon Shallow <supjps-
> [e-mail]>; 'Valery Smyslov' <[e-mail]>; [e-mail];
> [e-mail]
> Subject: RE: [Dots] WGLC on draft-ietf-dots-server-discovery-05
> 
> CAUTION: External email. Do not click links or open attachments unless you
> recognize the sender and know the content is safe.
> 
> Yes, but I was referring to this part:
> 
>       few certification authorities issue server certificates based on
> 
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> ^^
>       IP addresses, but preliminary evidence indicates that such
>       ^^^^^^^^^^^^
>       certificates are a very small percentage (less than 1%) of issued
>       certificates.

It is part of the out of scope section 1.2 but ACME will make it more common.

-Tiru

> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy
> > [mailto:[e-mail]]
> > Envoyé : jeudi 7 novembre 2019 10:32
> > À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; 'Valery Smyslov';
> > [e-mail]; [e-mail] Objet : RE: [Dots] WGLC on
> > draft-ietf-dots-server-discovery-05
> >
> > > -----Original Message-----
> > > From: [e-mail]
> > > <[e-mail]>
> > > Sent: Thursday, November 7, 2019 2:52 PM
> > > To: Konda, Tirumaleswar Reddy
> > > <[e-mail]>; Jon Shallow <supjps-
> > > [e-mail]>; 'Valery Smyslov' <[e-mail]>;
> > [e-mail];
> > > [e-mail]
> > > Subject: RE: [Dots] WGLC on draft-ietf-dots-server-discovery-05
> > >
> > > CAUTION: External email. Do not click links or open attachments
> > > unless
> > you
> > > recognize the sender and know the content is safe.
> > >
> > > Hi Tiru,
> > >
> > > I'm not sure this reference is needed. We do already cite 6125 to
> > > mention that CAs already issue certificates based on IP addresses.
> >
> > https://tools.ietf.org/html/rfc6125#section-1.7.2 says certificates
> > based on IP addresses is out of scope.
> >
> > Cheers,
> > -Tiru
> >
> > >
> > > Cheers,
> > > Med
> > >
> > > > -----Message d'origine-----
> > > > De : Konda, Tirumaleswar Reddy
> > > > [mailto:[e-mail]]
> > > > Envoyé : jeudi 7 novembre 2019 09:56 À : BOUCADAIR Mohamed
> > > > TGI/OLN; Jon Shallow; 'Valery Smyslov'; [e-mail];
> > > > [e-mail] Objet : RE: [Dots] WGLC on
> > > > draft-ietf-dots-server-discovery-05
> > > >
> > > >    If the DHCP client receives OPTION_V6_DOTS_ADDRESS only, the
> > > >    address(es) included in OPTION_V6_DOTS_ADDRESS are used to
> > > > reach
> > > the
> > > >    peer DOTS agent.  In addition, these addresses can be used as
> > > >    identifiers for authentication.
> > > >
> > > > We may want to add the following line to support the above lines:
> > > > [I-D.ietf-acme-ip] describes a new protocol that allows CA to
> > > > issue certificates for IP addresses.
> > > >
> > > > Cheers,
> > > > -Tiru
> > > >
> > > > > -----Original Message-----
> > > > > From: Dots <[e-mail]> On Behalf Of
> > > > > [e-mail]
> > > > > Sent: Thursday, November 7, 2019 12:19 PM
> > > > > To: Jon Shallow <[e-mail]>; 'Valery Smyslov'
> > > > > <[e-mail]>; [e-mail]; [e-mail]
> > > > > Subject: Re: [Dots] WGLC on draft-ietf-dots-server-discovery-05
> > > > >
> > > > > CAUTION: External email. Do not click links or open attachments
> > > > > unless
> > > > you
> > > > > recognize the sender and know the content is safe.
> > > > >
> > > > > Hi Jon,
> > > > >
> > > > > OK, thanks.
> > > > >
> > > > > In order to further make things clear, I suggest to add this NEW
> > > > > text in
> > > > the
> > > > > introduction of Section 5:
> > > > >
> > > > >    The list of the IP addresses returned by DHCP servers is typically
> > > > >    used to fed the DOTS server selection procedure detailed in
> > > > >    Section 4.3 of [I-D.ietf-dots-signal-channel] or to provide DOTS
> > > > >    agents with primary and backup IP addresses of their peer DOTS
> > > > >    agents.
> > > > >
> > > > > Would that be OK?
> > > > >
> > > > > I'm not sure the text need to hint any priority order set by the
> > > > > server
> > > > (backup
> > > > > case), though. The reason is that list will be ordered by the
> > > > > client
> > > > following HE.
> > > > >
> > > > > Cheers,
> > > > > Med
> > > > >
> > > > > > -----Message d'origine-----
> > > > > > De : Jon Shallow [mailto:[e-mail]]
> > > > > > Envoyé : mercredi 6 novembre 2019 17:23 À : BOUCADAIR
> Mohamed
> > > > > TGI/OLN;
> > > > > > 'Valery Smyslov'; [e-mail]; dots- [e-mail] Objet : RE:
> > > > > > [Dots] WGLC on draft-ietf-dots-server-discovery-05
> > > > > >
> > > > > > Hi Med,
> > > > > >
> > > > > > Sorry - not thinking straight - yes, you are correct in that a
> > > > > > single OPTION_Vx_DOTS_ADDRESS can contain multiple IP
> > > > > > addresses - must have glazed over the specific definition
> > > > > > before hitting the "it MUST only use the first instance" in
> > > > > > the next section (Client
> > > Behavior).
> > > > > >
> > > > > > Regards
> > > > > >
> > > > > > Jon
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: Dots [mailto: [e-mail]] On Behalf Of
> > > > > > [e-mail]
> > > > > > > Sent: 06 November 2019 15:52
> > > > > > > To: Jon Shallow; 'Valery Smyslov'; [e-mail];
> > > > > > > [e-mail]
> > > > > > > Subject: Re: [Dots] WGLC on
> > > > > > > draft-ietf-dots-server-discovery-05
> > > > > > >
> > > > > > > Hi Jon,
> > > > > > >
> > > > > > > Thank you for the comments.
> > > > > > >
> > > > > > > Please see inline.
> > > > > > >
> > > > > > > Cheers,
> > > > > > > Med
> > > > > > >
> > > > > > > > -----Message d'origine----- De : Dots
> > > > > > > > [mailto:[e-mail]] De la part de Jon Shallow
> > > > > > > > Envoyé : mercredi 6 novembre 2019 15:59 À : 'Valery
> > > > > > > > Smyslov'; [e-mail]; [e-mail] Objet : Re:
> > > > > > > > [Dots] WGLC on
> > > > > > > > draft-ietf-dots-server-discovery-05
> > > > > > > >
> > > > > > > > Hi All,
> > > > > > > >
> > > > > > > > I have read through draft-ietf-dots-server-discovery-05
> > > > > > > > and think that
> > > > > > it
> > > > > > > > is
> > > > > > > > a good document.
> > > > > > > >
> > > > > > > > However, in particular with DHCPv(4|6), it is only
> > > > > > > > possible to use the first OPTION_Vx_DOTS_ADDRESS (5.1.3,
> 5.2.3).
> > > > > > >
> > > > > > > [Med] Yes
> > > > > > >
> > > > > > >   If the server at the first address
> > > > > > > > is down / unavailable for whatever reason, it is not
> > > > > > > > possible to define
> > > > > > a
> > > > > > > > backup IP address as a secondary entry.  Is it the
> > > > > > > > intention to not
> > > > > > allow
> > > > > > > > backup IP addresses?
> > > > > > >
> > > > > > > [Med] Hmm, that is possible given that an instance is
> > > > > > > designed to carry a
> > > > > > list
> > > > > > > of IP addresses.
> > > > > > >
> > > > > > >    If the DHCP client receives OPTION_V6_DOTS_ADDRESS only,
> the
> > > > > > >    address(es) included in OPTION_V6_DOTS_ADDRESS are used
> > > > > > > to reach
> > > > > the
> > > > > > >    ^^^^^^^^^^
> > > > > > >    peer DOTS agent.  In addition, these addresses can be used as
> > > > > > >    identifiers for authentication.
> > > > > > >
> > > > > > > >
> > > > > > > > With DNS, I know that A/AAAA records can be presented
> > > > > > > > round-robin
> > > > > > > which
> > > > > > > > gives the possibility of backup IP addresses, but am not
> > > > > > > > sure whether
> > > > > > this
> > > > > > > > holds true for implementations for other Resource Records.
> > > > > > > > If backup addresses are to be allowed, the draft is
> > > > > > > > unclear whether only the
> > > > > > first
> > > > > > > > A/AAAA RR is allowed, or each can be tested until the
> > > > > > > > first non-failure
> > > > > > is
> > > > > > > > found, or whether happy-eyeballs it to be invoked against
> > > > > > > > all of the IP addresses and then the final IP
> > > > > > > > preferentially chosen according to the
> > > > > > RR
> > > > > > > > returned order.
> > > > > > >
> > > > > > > [Med] Considerations related to address selection (including
> > > > > > > HE) are not detailed here on purpose because this is not
> > > > > > > part of
> > discovery.
> > > > > > >
> > > > > > > >
> > > > > > > > Regards
> > > > > > > >
> > > > > > > > Jon
> > > > > > > >
> > > > > > > > > -----Original Message-----
> > > > > > > > > From: Dots [mailto:[e-mail]] On
> > > > > > > > > Behalf Of
> > > > > > > Valery
> > > > > > > > > Smyslov
> > > > > > > > > Sent: 23 October 2019 08:37
> > > > > > > > > To: [e-mail]
> > > > > > > > > Cc: [e-mail]
> > > > > > > > > Subject: [Dots] WGLC on
> > > > > > > > > draft-ietf-dots-server-discovery-05
> > > > > > > > >
> > > > > > > > > Hi,
> > > > > > > > >
> > > > > > > > > this message starts a Work Group Last Call (WGLC) for
> > > > > > > > draft-ietf-dots-server-
> > > > > > > > > discovery-05.
> > > > > > > > > The version to be reviewed is here:
> > > > > > > > https://www.ietf.org/id/draft-ietf-dots-
> > > > > > > > > server-discovery-05.txt
> > > > > > > > >
> > > > > > > > > The WGLC will last for two weeks and will end on
> > > > > > > > > November the
> > > > 7th.
> > > > > > > > > Please send your comments to the list before this date.
> > > > > > > > >
> > > > > > > > > Regards,
> > > > > > > > > Frank & Valery.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > _______________________________________________
> > > > > > > > > Dots mailing list
> > > > > > > > > [e-mail]
> > > > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > > > > > > >
> > > > > > > > _______________________________________________
> > > > > > > > Dots mailing list
> > > > > > > > [e-mail]
> > > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Dots mailing list
> > > > > > > [e-mail]
> > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > > > >
> > > > > _______________________________________________
> > > > > Dots mailing list
> > > > > [e-mail]
> > > > > https://www.ietf.org/mailman/listinfo/dots