Re: [nfsv4] Soliciting next steps for RPCSEC_GSSv3

["J. Bruce Fields" <[e-mail]>]

On Wed, May 15, 2013 at 08:58:03PM +0000, Haynes, Tom wrote:
> 
> On May 15, 2013, at 12:39 PM, J. Bruce Fields <[e-mail]> wrote:
> 
> > On Wed, May 15, 2013 at 04:13:46PM +0000, Haynes, Tom wrote:
> >> The issue with the RPCSEC I-D is that we do not know what is remaining to be done.
> >> 
> >> I do not like option c.
> >> 
> >> I do not like option b, in my mind that opens us up for the same type
> >> of issues we saw with migration.
> > 
> > Could you elaborate?
> 
> Just a rough feeling that if we leave out inter-server, by the time we get
> back to it, we will find issues as implementations diverge from the spec.

OK, so you're referring to the issues discussed e.g. in
http://tools.ietf.org/html/draft-noveck-nfsv4-migration-issues-00.

I still don't understand what you mean by "opens us up for the same type
of issues".

--b.

> >> We have existing implementations of server side copy that do not use
> >> RPCSEC_GSSv3.
> > 
> > Which implementations exactly are you referring to?
> > 
> >> Whether the mechanism is proprietary or NFSv4.x should not matter. So
> >> I do not like all of option a.
> > 
> >> What I would like to see is that we keep enough in place such that
> >> when RPCSEC_GSSv3 is delivered, we can produced a smaller document
> >> specific to all NFSv4.2+ implementations that will allow it to be
> >> incorporated.
> > 
> > So I think you're choosing some variant of option a), but I think the
> > details here are tricky.
> > 
> 
> Yes, a variant of A.
> 
> And yes, tricky, but Spencer did ask for opinions.
> 
> I want us to deliver something that people can use and that can grow
> to meet future security needs.