Re: [OPSAWG] Benjamin Kaduk's Discuss on draft-ietf-opsawg-finding-geofeeds-12: (with DISCUSS and COMMENT)

[Randy Bush <[e-mail]>]

>>> If we're going with "[#RPKI Signature] address range MUST match [inetnum:
>>> followed to get here]", then there are probably a couple places that still
>>> talk about "covered by" that should catch up.
>> 
>> don't find any
>> 
>> what i did find is that i forgot to remove
>> 
>>          The address range of the signing certificate MUST cover all
>> -        prefixes in the geofeed file it signs; and therefore must be
>> -        covered by the range of the inetnum:.
>> +        prefixes in the geofeed file it signs.
> 
> ok.
> 
> It looks like the thing in the diff that stuck out at me is actually for
> the unsigned case, and "covered by" is (AFAICT) the right semantics for
> that situation.

if it still itches, could i get a direct pointer?

> Having slept it over, I think the "IP address range [of "# RPKI
> Signature:"/"# End Signature"] must match the inetnum: URL followed to get
> to the file" is a good choice and helps identify the intended semantics
> (though, of course, is not itself covered by the signature).

consider yourself lucky to have missed the dozen messages where we went
down this rathole.

> I think we still need to update the example to show how to represent a
> non-CIDR range, though.  (I think, from the previous discussion, we
> wanted the "RPKI Signature" line to have a starting address and the
> "End Signature" line to have an ending address, but could be
> misremembering.)

uh, i think it would be

    # RPKI Signature: 192.0.2.0 - 192.0.2.255
    # MIIGlwYJKoZIhvcNAQcCoIIGiDCCBoQCAQMxDTALBglghkgBZQMEAgEwDQYLKoZ
    # IhvcNAQkQAS+gggSxMIIErTCCA5WgAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu
    ...
    # imwYkXpiMxw44EZqDjl36MiWsRDLdgoijBBcGbibwyAfGeR46k5raZCGvxG+4xa
    # O8PDTxTfIYwAnBjRBKAqAZ7yX5xHfm58jUXsZJ7Ileq1S7G6Kk=
    # End Signature: 192.0.2.0 - 192.0.2.255

change made in my emacs buffer

> P.S. I am impressed by the (apparent) automation to re-generate the
> certificate (and example) at the time of building the document!

no comment

randy