Re: [nfsv4] Fwd: I-D Action: draft-ietf-nfsv4-integrity-measurement-03.txt

Hi Chuck,

Thanks for the update.

At the end of the introduction (1), you add "Unlike traditional integrity management schemes, the hash is not replaced every time a file is copied.  Instead, the signed checksum is copied along with file content and presented whenever the content is about to be used."  You're alluding to a practice with which I'm not familiar, even when you're describing traditional schemes.  Copied for reading or for writing?  What would have replaced the hash every time the file is copied--a storage system?  (I want to understand this so that I can understand how the mechanism that you're proposing will replace and modify the existing mechanism.)  It sounds like a hash would have been replaced whenever a file was written, but this replacement copies the hash along with file content--presumably by some client-side tool?

Down in 1.1, you likely want to add "only" immediately before the function that it most closely modifies; "NFS acts as only a conduit ..."  rather than "NFS acts only as a conduit...".  (e.g.: I'd hope that NFS acts as more than a conduit!)

In 4.2, can there be multiple FATTR4_FILE_PROVENANCE objects with different fpv_type values?
How do I enumerate them?  
Clearly your description of the treatment of distinct fpv_type values would suggest that there would be multiple instances.  Are there other FATTR4_xxx attributes with multiple values?
It's a little odd that fpv_type is not in the fattr4 namespace, but that it represents a sub-type.  How do I specify a fpv_type to GETATTR?
Again, how do I enumerate all the stored fpv_type values?
(It might be easier if there were only one possible FATTR4_FILE_PROVENANCE attribute, so that storing any fpv_type value would replace any other FATTR4_FILE_PROVENANCE attribute.  Alternatively, you could allow for FATTR4_FILE_PROVENANCE_xxx values, in which the "xxx" extension semantically replaces your suggested fpv_type value.)

		Best,
		Craig

On 11/7/18, 10:25 AM, "nfsv4 on behalf of Chuck Lever" <nfsv4-bounces@ietf.org on behalf of chuck.lever@oracle.com> wrote:

    NetApp Security WARNING: This is an external email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

    > Begin forwarded message:
    >
    > From: internet-drafts@ietf.org
    > Subject: [nfsv4] I-D Action: draft-ietf-nfsv4-integrity-measurement-03.txt
    > Date: November 7, 2018 at 10:22:02 AM EST
    > To: <i-d-announce@ietf.org>
    > Cc: nfsv4@ietf.org
    > Reply-To: nfsv4@ietf.org
    >
    >
    > A New Internet-Draft is available from the on-line Internet-Drafts directories.
    > This draft is a work item of the Network File System Version 4 WG of the IETF.
    >
    >        Title           : File Content Provenance for Network File System version 4
    >        Author          : Charles Lever
    >       Filename        : draft-ietf-nfsv4-integrity-measurement-03.txt
    >       Pages           : 15
    >       Date            : 2018-11-07
    >
    > Abstract:
    >   This document specifies an OPTIONAL extension to NFS version 4 minor
    >   version 2 that enables file provenance information to be conveyed
    >   between NFS version 4.2 servers and clients.  File provenance
    >   information authenticates the creator of a file's content and helps
    >   guarantee the content's integrity from creation to use.
    >
    >
    > The IETF datatracker status page for this draft is:
    > https://datatracker.ietf.org/doc/draft-ietf-nfsv4-integrity-measurement/
    >
    > There are also htmlized versions available at:
    > https://tools.ietf.org/html/draft-ietf-nfsv4-integrity-measurement-03
    > https://datatracker.ietf.org/doc/html/draft-ietf-nfsv4-integrity-measurement-03
    >
    > A diff from the previous version is available at:
    > https://www.ietf.org/rfcdiff?url2=draft-ietf-nfsv4-integrity-measurement-03
    >
    >
    > Please note that it may take a couple of minutes from the time of submission
    > until the htmlized version and diff are available at tools.ietf.org.
    >
    > Internet-Drafts are also available by anonymous FTP at:
    > ftp://ftp.ietf.org/internet-drafts/
    >
    > _______________________________________________
    > nfsv4 mailing list
    > nfsv4@ietf.org
    > https://www.ietf.org/mailman/listinfo/nfsv4

    Revision -03 is an attempt to address Craig Everhart's concerns about the
    interoperability of the proposed mechanism. I've introduced an IANA registry
    for File Provenance Information types, as suggested by Benjamin Kaduk.

    Thanks for everyone's time on this project.

    --
    Chuck Lever

    _______________________________________________
    nfsv4 mailing list
    nfsv4@ietf.org
    https://www.ietf.org/mailman/listinfo/nfsv4