Re: [OPSAWG] Éric Vyncke's No Objection on draft-ietf-opsawg-tacacs-13: (with COMMENT)

"Eric Vyncke (evyncke)" <evyncke@cisco.com> Fri, 05 July 2019 10:19 UTC

Return-Path: <evyncke@cisco.com>
X-Original-To: opsawg@ietfa.amsl.com
Delivered-To: opsawg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71F1912009C; Fri, 5 Jul 2019 03:19:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.501
X-Spam-Level:
X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=btIIewBZ; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=M6ECJ3Kt
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vpn_jiZR0MXC; Fri, 5 Jul 2019 03:19:42 -0700 (PDT)
Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC21512017C; Fri, 5 Jul 2019 03:19:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5892; q=dns/txt; s=iport; t=1562321982; x=1563531582; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=QDMGmSO0Hn0U4WRU/jGsofao0ZsiN7Qmq2rmn0tfR0M=; b=btIIewBZaTsPGCORMdGlOJblHCWgTLGjOtJXfqs/O7TXcB9Dsgu8QYb6 +7k2Jc7hloc3VpqeslHUlJKCbOG2vu0MVerMUyBSCU607KSijG7109n6m OClsMsmKvcajn6ygK27a4x4dttnf7ROyaREXNGPcxhea6Lw3vbHkyerCR A=;
IronPort-PHdr: =?us-ascii?q?9a23=3AKHbrQhJGSAyQKXNZktmcpTVXNCE6p7X5OBIU4Z?= =?us-ascii?q?M7irVIN76u5InmIFeBvad2lFGcW4Ld5roEkOfQv636EU04qZea+DFnEtRXUg?= =?us-ascii?q?Mdz8AfngguGsmAXEDlPfjhbCESF8VZX1gj9Ha+YgBY?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A1AAD4Ih9d/4oNJK1mGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBVQQBAQELAYFDUANqVSAECyiEHINHA45JmiGBLhSBEANUCQEBAQw?= =?us-ascii?q?BASMKAgEBhEACF4IXIzYHDgEDAQEEAQECAQVtijcMhUsCAQMSEREMAQE3AQ8?= =?us-ascii?q?CAQgaAhIBEwICAjAVBQsCBAENBSKDAAGBagMdAQIMmi0CgTiIYHGBMoJ5AQE?= =?us-ascii?q?FgUZBgxAYghIDBoEMKAGLXheBQD+BEAEnH4JMPoJhAgECAYEqARECATUxAoJ?= =?us-ascii?q?AMoImjBkvgiKFIIhAjX8JAoIXhlaIVWmDbxuCLIceji6DJYoLgTCGD498AgQ?= =?us-ascii?q?CBAUCDgEBBYFXATBnWBEIcBU7KgGCQYJBDBeDToUUhT9yAYEoixINF4IsAQE?=
X-IronPort-AV: E=Sophos;i="5.63,454,1557187200"; d="scan'208";a="294673768"
Received: from alln-core-5.cisco.com ([173.36.13.138]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 05 Jul 2019 10:19:40 +0000
Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by alln-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id x65AJeYn027645 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 5 Jul 2019 10:19:40 GMT
Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 5 Jul 2019 05:19:39 -0500
Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 5 Jul 2019 05:04:36 -0500
Received: from NAM04-SN1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 5 Jul 2019 05:04:36 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QDMGmSO0Hn0U4WRU/jGsofao0ZsiN7Qmq2rmn0tfR0M=; b=M6ECJ3Kt4o9UmNQRx6hvXVLuS6ORoZWLxPkMQgwkmq3UWMD9Rd99jTyVQ8GkFH0+qdU2rCr3edZkkB80Cz+z23jxi3ekCPL7aNEqqzjFgjxnTAon6TvZln2UO8W20+xKmcCQ/3iXWNT1pPBxkk+/w6O/IpgrLHIBWEv6+5a/BGQ=
Received: from MN2PR11MB4144.namprd11.prod.outlook.com (20.179.150.210) by MN2PR11MB4477.namprd11.prod.outlook.com (52.135.36.93) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2032.20; Fri, 5 Jul 2019 10:04:35 +0000
Received: from MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::b179:dc88:3c29:4474]) by MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::b179:dc88:3c29:4474%6]) with mapi id 15.20.2032.022; Fri, 5 Jul 2019 10:04:35 +0000
From: "Eric Vyncke (evyncke)" <evyncke@cisco.com>
To: "Douglas Gash (dcmgash)" <dcmgash@cisco.com>, The IESG <iesg@ietf.org>
CC: "draft-ietf-opsawg-tacacs@ietf.org" <draft-ietf-opsawg-tacacs@ietf.org>, "Joe Clarke (jclarke)" <jclarke@cisco.com>, "opsawg-chairs@ietf.org" <opsawg-chairs@ietf.org>, "opsawg@ietf.org" <opsawg@ietf.org>
Thread-Topic: =?utf-8?B?w4lyaWMgVnluY2tlJ3MgTm8gT2JqZWN0aW9uIG9uIGRyYWZ0LWlldGYtb3Bz?= =?utf-8?Q?awg-tacacs-13:_(with_COMMENT)?=
Thread-Index: AQHVK9TNstuJPt5hpk+txpn05Ag6/6a7+/QA
Date: Fri, 5 Jul 2019 10:04:35 +0000
Message-ID: <1922C268-3D91-407B-AA67-E8E382FEF7E9@cisco.com>
References: <155795250991.30689.1445498577568703956.idtracker@ietfa.amsl.com> <C73F37B5-C1CE-4192-A627-653EF4174A83@cisco.com>
In-Reply-To: <C73F37B5-C1CE-4192-A627-653EF4174A83@cisco.com>
Accept-Language: fr-BE, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.1a.0.190609
authentication-results: spf=none (sender IP is ) smtp.mailfrom=evyncke@cisco.com;
x-originating-ip: [2001:420:c0c1:36:b140:b5db:3aad:865b]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: b0fd8c7d-7f93-4279-3bd6-08d701302f18
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB4477;
x-ms-traffictypediagnostic: MN2PR11MB4477:
x-ms-exchange-purlcount: 2
x-microsoft-antispam-prvs: <MN2PR11MB44773486E12C0E378FE48567A9F50@MN2PR11MB4477.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 008960E8EC
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(366004)(136003)(396003)(346002)(376002)(51914003)(199004)(189003)(6116002)(2616005)(186003)(6512007)(33656002)(6306002)(46003)(6436002)(14444005)(25786009)(58126008)(486006)(86362001)(14454004)(66476007)(7736002)(476003)(305945005)(316002)(966005)(76116006)(91956017)(446003)(256004)(11346002)(36756003)(6246003)(66946007)(5660300002)(68736007)(6506007)(102836004)(478600001)(53546011)(450100002)(54906003)(2906002)(53936002)(81166006)(81156014)(76176011)(8936002)(64756008)(229853002)(66556008)(224303003)(66446008)(6486002)(71190400001)(73956011)(110136005)(71200400001)(4326008)(99286004); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4477; H:MN2PR11MB4144.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: zjNYfgq+v1rla2X3tXmHoacPYAjyv2t74oPhNbo5uWNerIaqdIuJOQyiu3nxw+pk4soIyah2vEsSPvakJWy1r+P98AQDaPuv9LzfL++GcrEa/LI/p7w4zusLQgdFbrXirIPi11ZFYPnep+6c/hnypmqQTt+/nHNIur+HdCNJTFiD02517k/CRvfr1tEZWhU/UpEIj5kfqIu5thkWV61AR+TeKKPEBkhlzFWRGjn1lXI0te+rR9a4VDqqYhZ1fzlP7NpKjFWfSqp4LLSMSFxE/Nr17J8vTBTGVQ5twE8NAszib8ofHkplUnZKmj3fzZ28XTheKaeX9hEkfXhi2Jv6JnEW9Waan9Twre7bg6AgE+YEaicnCu07RqGStoYKXCBOS6Hy7C4kTiMLKrUxlXpt91A+HEiUjX1Uxn5qN1or2Qg=
Content-Type: text/plain; charset="utf-8"
Content-ID: <433C8CC6F9D5624A8E4015807787239C@namprd11.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: b0fd8c7d-7f93-4279-3bd6-08d701302f18
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jul 2019 10:04:35.4420 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: evyncke@cisco.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4477
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com
X-Outbound-Node: alln-core-5.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsawg/_xalvJD7ftIIWR5lBAY7flymG1k>
Subject: Re: [OPSAWG] =?utf-8?q?=C3=89ric_Vyncke=27s_No_Objection_on_draft-ie?= =?utf-8?q?tf-opsawg-tacacs-13=3A_=28with_COMMENT=29?=
X-BeenThere: opsawg@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OPSA Working Group Mail List <opsawg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsawg>, <mailto:opsawg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsawg/>
List-Post: <mailto:opsawg@ietf.org>
List-Help: <mailto:opsawg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsawg>, <mailto:opsawg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Jul 2019 10:19:44 -0000

Sorry for belated reply...

Thank you Douglas, it addresses my concers

-éric

On 26/06/2019, 06:08, "Douglas Gash (dcmgash)" <dcmgash@cisco.com> wrote:

    Many thanks for the comments.
    
    Please see responses from authors inline, marked “TA”. Action items from this mail to update the document are marked: [AI-TA] to mean: “action item for the authors”.
    
    On 15/05/2019, 21:35, "Éric Vyncke via Datatracker" <noreply@ietf.org> wrote:
    
        Éric Vyncke has entered the following ballot position for
        draft-ietf-opsawg-tacacs-13: No Objection
        
        When responding, please keep the subject line intact and reply to all
        email addresses included in the To and CC lines. (Feel free to cut this
        introductory paragraph, however.)
        
        
        Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
        for more information about IESG DISCUSS and COMMENT positions.
        
        
        The document, along with other ballot positions, can be found here:
        https://datatracker.ietf.org/doc/draft-ietf-opsawg-tacacs/
        
        
        
        ----------------------------------------------------------------------
        COMMENT:
        ----------------------------------------------------------------------
        
        Thanks for the work everyone has put into this document. I have some comments
        and some nits. I also support most of the other comments issued by the IESG
        members.
        
        And, I appreciate the time taken to document a protocol that I used in the mid
        90's ;-) it took sometime to document it... I also appreciate the use of
        'obfuscation' in section 4.7.
        
        == COMMENTS ==
        - section 1, I am unsure whether the 'today' in 'It is primarily used today...'
        still stands in 2019. - a little late to ask, but, is there any reason why
        draft-dahm-opsawg-tacacs does not refer to 'The Draft' in the datatracker? –
    
    TA> Will check that out and resolve [AI-TA]
    
        section 4.8, the flag values are 0x01 and 0x04, but what about the other bits?
        Should they be considered as 0 and ignored on reception? 
    
    TA> Good catch. Our opinion is that they should be ignored, we will clarify [AI-TA]
    
    - section 5.1, should
        TAC_PLUS_AUTHEN_SVC_ARAP := 0x04 also be deprecated ? 
    
    TA> Agreed [AI-TA]
    
    - section 5.4.2.1 about
        'ASCII login' while I understand that years ago it was ASCII only hence the
        name of the value but the text is unclear whether UTF-8 could be used (assuming
        that the network devices support this character set) – 
    
    TA> Will clarify and add the restriction as intended, to ASCII [AI-TA]
    
    section 8.2, the route
        attribute is defined only for IPv4 while the T+ can send IPv6 addresses to the
        client. Is it sensible?
    
    TA> Good catch. The original definition was not explicit, but unsurprisingly, it implicitly covered only IPv4 properly. Really with T+ being used only for the device administration use  case, we can probably deprecate these attributes.  [AI-TA]
    
        == NITS ==
        - abstract TACACS is an acronym which should be expanded in the abstract
    TA> Agreed, we will add [AI-TA]
    
        - section 3 could be updated esp around "character mode front end and then
        allow the user to telnet" - section 4.1 add that the port 49 has been allocated
        by the IANA ?
    TA> Agreed, we will follow up on that [AI-TA]
    
     - section 4.3 talks about flags but the packet format is also
        presented in section . Not a logical flow 
    TA> Agreed, will resolve [AI-TA]
    
    - section 8.1 s/IPV6 address text
        representation defined/IPv6 address text representation is defined/ (lower case
        V as well) 
    TA> Agreed, will resolve [AI-TA]
    
    - section 8.2, please clarify the inacl value, is it an ACL name or
        an ASCII representation of the list of ACL entries?
    TA> Agreed, it is listed as an identifier, will clarify this refers to the name[AI-TA]