Re: [OPSAWG] Benjamin Kaduk's Discuss on draft-ietf-opsawg-finding-geofeeds-12: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

On Tue, May 25, 2021 at 08:18:06PM -0700, Randy Bush wrote:
> >>> If we're going with "[#RPKI Signature] address range MUST match [inetnum:
> >>> followed to get here]", then there are probably a couple places that still
> >>> talk about "covered by" that should catch up.
> >> 
> >> don't find any
> >> 
> >> what i did find is that i forgot to remove
> >> 
> >>          The address range of the signing certificate MUST cover all
> >> -        prefixes in the geofeed file it signs; and therefore must be
> >> -        covered by the range of the inetnum:.
> >> +        prefixes in the geofeed file it signs.
> > 
> > ok.
> > 
> > It looks like the thing in the diff that stuck out at me is actually for
> > the unsigned case, and "covered by" is (AFAICT) the right semantics for
> > that situation.
> 
> if it still itches, could i get a direct pointer?

Sorry, I wasn't clear -- it *doesn't* itch anymore, now that I actually read it.
There's nothing to change.

> > Having slept it over, I think the "IP address range [of "# RPKI
> > Signature:"/"# End Signature"] must match the inetnum: URL followed to get
> > to the file" is a good choice and helps identify the intended semantics
> > (though, of course, is not itself covered by the signature).
> 
> consider yourself lucky to have missed the dozen messages where we went
> down this rathole.
> 
> > I think we still need to update the example to show how to represent a
> > non-CIDR range, though.  (I think, from the previous discussion, we
> > wanted the "RPKI Signature" line to have a starting address and the
> > "End Signature" line to have an ending address, but could be
> > misremembering.)
> 
> uh, i think it would be
> 
>     # RPKI Signature: 192.0.2.0 - 192.0.2.255
>     # MIIGlwYJKoZIhvcNAQcCoIIGiDCCBoQCAQMxDTALBglghkgBZQMEAgEwDQYLKoZ
>     # IhvcNAQkQAS+gggSxMIIErTCCA5WgAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu
>     ...
>     # imwYkXpiMxw44EZqDjl36MiWsRDLdgoijBBcGbibwyAfGeR46k5raZCGvxG+4xa
>     # O8PDTxTfIYwAnBjRBKAqAZ7yX5xHfm58jUXsZJ7Ileq1S7G6Kk=
>     # End Signature: 192.0.2.0 - 192.0.2.255
> 
> change made in my emacs buffer

Okay, I think that works fine.

-Ben

> > P.S. I am impressed by the (apparent) automation to re-generate the
> > certificate (and example) at the time of building the document!
> 
> no comment
> 
> randy