Re: [Gen-art] Genart telechat review of draft-ietf-opsawg-tacacs-13

Alissa Cooper <alissa@cooperw.in> Wed, 15 May 2019 18:57 UTC

Return-Path: <alissa@cooperw.in>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 912A11201BE; Wed, 15 May 2019 11:57:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.701
X-Spam-Level:
X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cooperw.in header.b=It6YZVkt; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=DX/BWCt1
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BVsEMG0euME4; Wed, 15 May 2019 11:57:30 -0700 (PDT)
Received: from wout5-smtp.messagingengine.com (wout5-smtp.messagingengine.com [64.147.123.21]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C39B1207A2; Wed, 15 May 2019 11:57:30 -0700 (PDT)
Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id 46AB2313; Wed, 15 May 2019 14:57:29 -0400 (EDT)
Received: from mailfrontend2 ([10.202.2.163]) by compute7.internal (MEProxy); Wed, 15 May 2019 14:57:29 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cooperw.in; h= content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=fm3; bh=a 7YBGRqbxIodqtoYrjlVklvzHv8m5CcpolIczuI9Xyk=; b=It6YZVktRKDM4hDCF FHk/0j1fRdn1jPvs0O/W+UL4ux2can8KensAPmY3l59VMLnHchH4C1Vc1vVaXNF1 4PYvnSTNZJMWZZKdBMc3UV2k78AZ67zU+TpcBNLQzAQupaBWtGbdxRqwZKXR0+4p Ljx9fmg1oqtpNf+cSk79bclmq8MBL41kT8h1yw0cJqdBe3O/3j0oyfnar2NPyM/d bqqnqUF69achtDy0MhHQpGpfMaeOBd3PzD6Mu736cj+Nt4g5qQoSqbzxs3CaCCsn OZhJebHdO9EJ1vjU2w+3nb4e8y9hTeqE0GvKLql+WvdRYRySHd2/KbXkhx2r8bdZ rFccA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=a7YBGRqbxIodqtoYrjlVklvzHv8m5CcpolIczuI9X yk=; b=DX/BWCt10UUA5e6UbAyLTIEchtrA+DbpMJz/gWiwb55tGFszWvlErewab 3l4r2CvXr8oHCmVnArRRHbS7Sqkmv8AEiQojdPNhDbiISPc9+qk/OP1Hihf+TLk8 /N3GEZPJJsTkgGr12RJItbRmsEzzGzilV2rxtrVpa4uGCgaIrVhjxClOjrug281H AhX6TYurXla+U+VIrGAczDByv9s/d8T7JSRA6FYNDwG3yGrkjgGw4HgCG+ZgHhdM gybooSlexdkGgQE3EG7Uz4HMWGa1o2bh0aTQZZMQ8sK7Vasaid921QZbTnVSdHBZ 33VN4YGnxabzSeAcd5oRCWki6yJEQ==
X-ME-Sender: <xms:GGHcXHj2vZfXnoEEIuNxdTpScLrVLkwh-hafLeGLxBc7i-5Uxm9t2w>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduuddrleekgdduvdeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurheptggguffhjgffgffkfhfvofesthhqmhdthhdtvdenucfhrhhomheptehlihhs shgrucevohhophgvrhcuoegrlhhishhsrgestghoohhpvghrfidrihhnqeenucffohhmrg hinhepihgvthhfrdhorhhgnecukfhppedujeefrdefkedruddujedrkeelnecurfgrrhgr mhepmhgrihhlfhhrohhmpegrlhhishhsrgestghoohhpvghrfidrihhnnecuvehluhhsth gvrhfuihiivgeptd
X-ME-Proxy: <xmx:GGHcXKBghWbbNNZz_Y3YLuH0JKqgMBPKRHiyBz-VpBhOfUQIv7n3vA> <xmx:GGHcXEvaYoOtC0TH-BnjfJCZtIohtRI-ew_HrFXWW2x9Ky6YcsZ7qg> <xmx:GGHcXPacNDA_J_K2LFucCGGBfMkNalv86VkvKTlvnkQZqno5MPPJYQ> <xmx:GGHcXG_txYthOj-97i-3aF5bqFrsAvCb-bA0L9MUVsmKZUPbC3rqwA>
Received: from rtp-alcoop-nitro5.cisco.com (unknown [173.38.117.89]) by mail.messagingengine.com (Postfix) with ESMTPA id 4083010378; Wed, 15 May 2019 14:57:28 -0400 (EDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
From: Alissa Cooper <alissa@cooperw.in>
In-Reply-To: <155775206584.23645.18248080061887454144@ietfa.amsl.com>
Date: Wed, 15 May 2019 14:57:26 -0400
Cc: gen-art@ietf.org, opsawg@ietf.org, ietf@ietf.org, draft-ietf-opsawg-tacacs.all@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <2ED46465-7FBE-49D5-BD71-0A3BCF72F8AD@cooperw.in>
References: <155775206584.23645.18248080061887454144@ietfa.amsl.com>
To: Stewart Bryant <stewart.bryant@gmail.com>
X-Mailer: Apple Mail (2.3445.9.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/gen-art/eWSAwJZKWLdouXLNLGbyzBo_Wes>
Subject: Re: [Gen-art] Genart telechat review of draft-ietf-opsawg-tacacs-13
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 May 2019 18:57:34 -0000

Stewart, thanks for your review. I have entered a DISCUSS ballot based on a couple of your points.

Alissa

> On May 13, 2019, at 8:54 AM, Stewart Bryant via Datatracker <noreply@ietf.org>; wrote:
> 
> Reviewer: Stewart Bryant
> Review result: Almost Ready
> 
> I am the assigned Gen-ART reviewer for this draft. The General Area
> Review Team (Gen-ART) reviews all IETF documents being processed
> by the IESG for the IETF Chair. Please wait for direction from your
> document shepherd or AD before posting a new version of the draft.
> 
> For more information, please see the FAQ at
> 
> <https://trac.ietf.org/trac/gen/wiki/GenArtfaq>;.
> 
> Document: draft-ietf-opsawg-tacacs-13
> Reviewer: Stewart Bryant
> Review Date: 2019-05-13
> IETF LC End Date: None
> IESG Telechat date: 2019-05-16
> 
> Summary:
> 
> There are a number of issues called out below that need addressing before publication.
> 
> Someone needs to micro-check the text to make sure that all terms are defined and referenced.
> I picked up a few, but there were a lot I did not have time to check.
> 
> Major issues:
> 
> SB> The IANA section should ask IANA to point to this RFC as a reference
> SB> for port 49
> 
> ============
> 
> 
>   The first MD5 hash is generated by concatenating the session_id, the
>   secret key, the version number and the sequence number and then
>   running MD5 over that stream.  All of those input values are
>   available in the packet header, except for the secret key which is a
>   shared secret between the TACACS+ client and server.
> 
> SB> MD5 make a good checksum, but I am surprised to see it used in this
> SB> application in a new protocol.
> 
> =============
> 
>   All TACACS+ packets begin with the following 12-byte header.  The
>   header describes the remainder of the packet:
> 
> SB> If ever there was an error in a long term session, how
> SB> how would you find in in the following packet structure?
> SB> Presumably from an incorrect major version and sequence number?
> 
> SB> Some details on the error cases and the unconditional "safety"
> SB> of the protocol would be useful.
> 
> ==========
> 
>      TAC_PLUS_AUTHEN_TYPE_ASCII := 0x01
> 
>      TAC_PLUS_AUTHEN_TYPE_PAP := 0x02
> 
>      TAC_PLUS_AUTHEN_TYPE_CHAP := 0x03
> 
>      TAC_PLUS_AUTHEN_TYPE_ARAP := 0x04 (deprecated)
> 
>      TAC_PLUS_AUTHEN_TYPE_MSCHAP := 0x05
> 
>      TAC_PLUS_AUTHEN_TYPE_MSCHAPV2 := 0x06
> 
> 
> 
> SB> There are lots of lists similar to the above.
> SB> I have not checked them all, but a number of the types 
> SB> in this and subsequent parts of the design don't seem
> SB> to be defined or have a definitive reference
> 
> ===========
> 
> The START packet MUST contain a username and the data
>   field MUST contain the PAP ASCII password.  A PAP authentication only
>   consists of a username and password RFC 1334 [RFC1334] . The REPLY
>   from the server MUST be either a PASS, FAIL or ERROR.
> 
> SB> Should there note be a note that RFC1334 is obsolete?
> 
> ===========
> 
> Minor issues:
> 
> The use of the term "packet" as a unit of data is confusing, since the protocol
> is carried over TCP which is a streaming protocol.
> 
> They are really TACAS+ PDUs
> 
> =========
> 
> (For example, Cisco uses "tty10"
>   to denote the tenth tty line and "Async10" to denote the tenth async
>   interface).  
> SB> Is it correct to quote a particular vendor in an RFC of this type?
> 
> ========
> 
>      TAC_PLUS_PRIV_LVL_MAX := 0x0f
> 
>      TAC_PLUS_PRIV_LVL_ROOT := 0x0f
> 
>      TAC_PLUS_PRIV_LVL_USER := 0x01
> 
>      TAC_PLUS_PRIV_LVL_MIN := 0x00
> 
> SB> Where are these defined?
> 
> ========
> Nits/editorial comments:
> 
>      The normative description of Legacy features such as ARAP and
> SB> ARAP not expanded anywhere in document.
> 
> =====
> 
> SB> telnet and rlogin need references
> 
> =====
>   is the user is connected via ISDN or a POTS, 
> SB> Are ISDN and POTS well known IETF terms?
> 
> =====
> 
>   It is not legal for an attribute name to contain either of the
>   separators.  It is legal for attribute values to contain the
>   separators.  
> SB> Is "legal" the correct term here?
> 
> 
> _______________________________________________
> Gen-art mailing list
> Gen-art@ietf.org
> https://www.ietf.org/mailman/listinfo/gen-art