Re: [lmap] Feedback on draft-eardley-lmap-terminology

[Paul Aitken <[e-mail]>]

Juergen,

> On Wed, Jul 24, 2013 at 10:07:09PM +0100, Paul Aitken wrote:
>
> [...]
>
> You I think you are proposing that instructions received from
> different Controllers must be kept separate and the MA must act
> towards a Controller as if there are no other controllers.

To some extent, yes.


> A potential
> problem with this is that there are likely instructions and tests that
> do impact each other through side effects.
>
>     If C1 schedules a test to be started every 5 min past the hour that
>     requires no cross traffic while C2 schedules a test to measure
>     video streaming capabilities during the interval 3-7 minutes past
>     the hour, then C1 will be surprised that the scheduled test never
>     executes or produces wrong results.

Forget about multiple controllers: this situation could arise from a 
single controller.

So a rejection mechanism will surely be necessary regardless of whether 
there are one or multiple controllers:
     - whether the command protocol is two-way, so the command is 
immediately rejected.
     - or, the report protocol includes a way of reporting that the 
requested test could not be done.
     - or both.


> Do you require that the MA has the logic to reject one of the
> instructions in such a case?

Definitely, even for the single controller case.


> Or do you expect that the Controllers
> will simply accept that MAs may not do what they think they should be
> doing?

Ideally the MA would report that a) it cannot perform the requested 
test, and b) why that is so.
Revealing too much information in (b) is usually a security risk. 
However it's not an issue in this case since we're assuming that the 
system is under control of a single organisation.


> Or do you expect to have at least read access to all
> instructions? Will we end up with an access control model to handle
> things properly in a configurable manner (like we did with SNMP and
> NETCONF)?

No, not at all.


> If the assumption is complete separation then I believe this is quite
> a big one - in particular if I consider devices like home routers or
> hardware probes of some bigger existing measurement platforms as
> potential targets for this work (usuall small embedded Linux systems
> running on cheap hardware).

If an MA may be commanded to perform multiple tests¹ by a single 
controller, then the potential conflicts are the same as multiple tests 
from multiple controllers.

¹ This is necessary if we are to build complex tests out of simpler test 
primitives, eg DNS lookup followed by file download.

P.