Re: [mif] next step for MIF PVD configuration

[Mikael Abrahamsson <[e-mail]>]

On Thu, 3 Mar 2016, Stjepan Groš wrote:

> Finally, obviously this solution assumes a single DNS server from one 
> ISP will provide all the data about PvDs. If you have two or more ISPs 
> and expect them to be collaborative is nice thing to hope for, but in 
> case they don't user is stuck. And even if they collaborate, that 
> neither scales nor is responsive.

I re-read draft-stenberg-mif-mpvd-dns-00 . It's not obvious to me if the 
PvD information is globally available for anyone to ask (or not), or if 
there is a requirement for some kind of split horizon DNS view where you 
need to ask from an address within the PvD to actually get an answer back 
regarding the PvD.

I have doubts about the DNS method, and I would prefer to have some kind 
of other mechanism to distribute the PvD information.

What about having one more level of indirection (yeah, yeah, I know, RFC 
1915 6a), and instead find the configuration resource via some kind of SRV 
record either available via DNSSD or via PTR .arpa lookup, or via DHCP 
option? Then the information could be fetched using HTTPS or some other 
mechanism.

draft-ietf-netconf-zerotouch-04 uses these kinds of mechanisms to provide 
data, where you instead sign the configuration data that can be downloaded 
through insecure means, but you won't use it until you've verified its 
authenticity (for instance by doing lookups using DNSSEC to get 
certificate ID or similar).

I also would like to separate the mechanism(s) how the information is 
transmitted and what information we want to transmit. These discussions 
are very different, and the mechanism how to transmit the information is 
probably not going to be changed that much, whereas we might want to add 
information we want to transmit more frequently.

-- 
Mikael Abrahamsson    email: [e-mail]