Re: [sidr] Warren Kumari's Discuss on draft-ietf-sidr-slurm-07: (with DISCUSS and COMMENT)

Warren Kumari <warren@kumari.net> Sat, 07 April 2018 15:38 UTC

Return-Path: <warren@kumari.net>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E9671270AE for <sidr@ietfa.amsl.com>; Sat, 7 Apr 2018 08:38:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.598
X-Spam-Level:
X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WjlOS3PCcJjE for <sidr@ietfa.amsl.com>; Sat, 7 Apr 2018 08:38:27 -0700 (PDT)
Received: from mail-wm0-x22c.google.com (mail-wm0-x22c.google.com [IPv6:2a00:1450:400c:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDDA11270AC for <sidr@ietf.org>; Sat, 7 Apr 2018 08:38:26 -0700 (PDT)
Received: by mail-wm0-x22c.google.com with SMTP id i3so8004749wmf.3 for <sidr@ietf.org>; Sat, 07 Apr 2018 08:38:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=avtTBzXkEZyz9iPCBXNKSnUY57RBPg+sGUVIVz0uXeY=; b=L8f5PaqV9p1BcaXG6cA9Xq5xrazJ8F3IPcCIujkFcCEXohBMMIlxSwqbVWpsBm9um9 Xde1cqLvvPzkXTE0QU2gNXcVSKC5Uw0LkqD09NehzKirtVXUsp3zGxlH0lYtcnxn8dv8 x3Rx/OKWSG4ky3v9JTVED5Ka3bl6BIr+wpKJcXRP57Kiuf8GpM1jMqSZZSjx9ar+zNxX 1BVb2xGKffNQTeuyn0MLqvz9sOkOmvUf4n99D7Klk201PcMKiR5RJA7nJIRYr9Uho9NW MahVzTfjowZsweVmJiL5D/5W4lwT7sJwEMAjJHFKBNWhQ6Ku4voTy5/wdyHa4RWdtwZY 5+Pw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=avtTBzXkEZyz9iPCBXNKSnUY57RBPg+sGUVIVz0uXeY=; b=Z3rw7MjJYOyLU55Bro+v498eT0LcupYxX8kwpyXigjhmtkoFemeA2EUivLktK1QDaU WhkzbIfNArJSWbFy+fueiO72+ZTL5rBy0+SwqjPzdpxCsOTQPaDFsXI9XJJd1VW2pKR/ 3E3ydIh6wnab2BsLnIGs0SLDzk8y9tOmqfh8pwh3LzQ4nRTBe4zht1EN0HVJFtLlfKvn 0nHNZeIr0rc12Xow5/N6T8Dp1KnNmXSmd3UNhy5DpzujORz0xvClvUOykEVQ7yCLSWS2 EdvsHleW+07c/WNNqkW+iYAFXtLWanvL2LyxUpm2jd3Edql2r4TDLPelv3fe2M95v0KI pTuA==
X-Gm-Message-State: AElRT7F2Ed04SuHchh32iAJ0xIkvet9NTbYHFjOwA01JgCaozvBmq06R AO/DquzBJBB6Hx2bWgRhoAQ2KLwNphDDhPCyZ6er/A==
X-Google-Smtp-Source: AIpwx48hNjMOSsHQJZyWFq3xht6K0Ji4TnOcACN3xMthRQd1ApcJ4Dkjm4B1Ae3JtMJ//tJL9+biqz8gaZR4k+uUv7s=
X-Received: by 10.28.139.18 with SMTP id n18mr15125219wmd.26.1523115504798; Sat, 07 Apr 2018 08:38:24 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.223.226.76 with HTTP; Sat, 7 Apr 2018 08:37:44 -0700 (PDT)
In-Reply-To: <9958A258-44B0-4965-B1C9-5E76031198C2@zdns.cn>
References: <152261657190.23824.4759371193986790926.idtracker@ietfa.amsl.com> <9958A258-44B0-4965-B1C9-5E76031198C2@zdns.cn>
From: Warren Kumari <warren@kumari.net>
Date: Sat, 7 Apr 2018 11:37:44 -0400
Message-ID: <CAHw9_i+Y73rq=PakWYJTUFQj1xU6naauRTp3qP7gEqgSS2KQVg@mail.gmail.com>
To: Di Ma <madi@zdns.cn>
Cc: The IESG <iesg@ietf.org>, draft-ietf-sidr-slurm@ietf.org, Chris Morrow <morrowc@ops-netman.net>, sidr@ietf.org, sidr-chairs@ietf.org
Content-Type: multipart/alternative; boundary="001a11443d9a9da3fd056943f6d3"
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidr/AO3FvCFRH4Wp3sf0IV2oOW5WTsg>
Subject: Re: [sidr] Warren Kumari's Discuss on draft-ietf-sidr-slurm-07: (with DISCUSS and COMMENT)
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidr/>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 07 Apr 2018 15:38:30 -0000

On Fri, Apr 6, 2018 at 10:02 AM Di Ma <madi@zdns.cn> wrote:

> Warren,
>
> Thanks very much for your comments.
>
> Please see my responses in lines.
>
> > 在 2018年4月2日,05:02,Warren Kumari <warren@kumari.net> 写道:
> >
> > Warren Kumari has entered the following ballot position for
> > draft-ietf-sidr-slurm-07: Discuss
> >
> > When responding, please keep the subject line intact and reply to all
> > email addresses included in the To and CC lines. (Feel free to cut this
> > introductory paragraph, however.)
> >
> >
> > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.
> html
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > https://datatracker.ietf.org/doc/draft-ietf-sidr-slurm/
> >
> >
> >
> > ----------------------------------------------------------------------
> > DISCUSS:
> > ----------------------------------------------------------------------
> >
> > I don't understand the targeting as it related to domain/host names (and
> > suspect that others will have the same issue).
> >
> >> From section 3.3:
> > "  If a "slurmTarget" element is
> >   present, an RP SHOULD verify that the target is an acceptable value,
> >   and reject this SLURM file if the "slurmTarget" element is not
> >   acceptable.... Accordingly, the SLURM file
> >   source needs to indicate which RP(s) should make use of the file by
> >   adding the domain name(s) of the RP(s) to the SLURM file target...
> >  Such a target value is a server name expressed in FQDN.
> >
> >   "slurmTarget": [
> >     {
> >       "hostname": "rpki.example.com",
> >       "comment": "This file is intended for RP server rpki.example.com"
> >     }
> > ]
> >
> > So, if I want to target multiple RPs (rpki1.example.com,
> rpki2.example.com) can
> > I do:
> >
> >   "slurmTarget": [
> >     {
> >       "hostname": "example.com",
> >       "comment": "This file is intended for RP server rpki.example.com"
> >     }
> > ]
> >
> > ?
> > The "domain names(s)" versus "hostname" vs "server name expressed in
> FQDN" text
> > is handwavey. I'm assuming that I'd need to do:
> >
> >   "slurmTarget": [
> >     {
> >       "hostname": "rpki1.example.com",
> >       "comment": "This file is intended for RP server rpki1.example.com"
> >     },
> > {
> >       "hostname": "rpki2.example.com",
> >       "comment": "This file is intended for the RP server,
> rpki2.example.com"
> >     },
> > ]"
> > Can you please make this clearer, and hopefully add more targets to the
> > examples? This seems like an easy fix / clarification, happy to clear
> once it
> > is, er, clear.
> >
> >
>
> We authors have decided to drop the slurmTarget element completely.
>


That works for me
​.​

Please
​(explicitly and loudly!) ​
let me know when the new version is
​submitted ​and I'll remove my discuss.


​W​


> Initially the implementation team was thinking that it would be useful to
> have the ability to offer the same set of SLURM files to all RPs deployed
> in a network, where local config of the RP would then evaluate the
> applicability of each file. However, now that both implementations (RIPE
> NCC Validator and RPSTIR) progressed we reconsider and we feel that it
> would be better to deal with this on the provisioning side. I.e. only offer
> the SLURM file(s) relevant to each RP.
>
>
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> >
> > I have a few questions and editorial comments:
> >
> > 1: Section Abstract:
> > ISPs can also be able to use the RPKI to validate the path of a BGP
> route.
> > I think you meant “ISPs can also use the RPKI..."
>
>
> ACK.
>
> >
> > 2: Section 1.  Introduction
> > "However, an "RPKI relying party" (RP) may want to override some of the
> > information expressed via putative Trust Anchor(TA) and the certificates
> > downloaded from the RPKI repository system." I think this should be
> either "a
> > putative Trust Anchor (TA)" or "putative Trust Anchors (TA)" (single vs
> > plurals). I agree with others that "putative TA" is not a well known
> term -
> > perhaps you can find a better one?
> >
>
> We will use ‘configured Trust Anchor(s)’ instead.
>
>
> > Section 3.4.1.  Validated ROA Prefix Filters
> > In the "prefixFilters examples", I think it would be helpful to update
> the
> > comments to be more explicit about what is being matched (e.g"All VRPs
> covered
> > by 198.51.100.0/24 and matching AS 64497")
> >
> >
> ACK.
>
> And we will update JSON related content in this draft based on Adam’s
> suggestions.
>
> Di
>
>