Re: [Sidrops] I-D Action: draft-ietf-sidrops-prefer-rrdp-00.txt

Randy Bush <randy@psg.com> Fri, 26 March 2021 17:46 UTC

Return-Path: <randy@psg.com>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92EB33A242B; Fri, 26 Mar 2021 10:46:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AUrRs9vKgCgR; Fri, 26 Mar 2021 10:46:28 -0700 (PDT)
Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B095B3A2428; Fri, 26 Mar 2021 10:46:28 -0700 (PDT)
Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from <randy@psg.com>) id 1lPqXT-0003VT-7U; Fri, 26 Mar 2021 17:46:27 +0000
Date: Fri, 26 Mar 2021 10:46:26 -0700
Message-ID: <m2tuoxst8t.wl-randy@psg.com>
From: Randy Bush <randy@psg.com>
To: Job Snijders <job=40fastly.com@dmarc.ietf.org>
Cc: Ties de Kock <tdekock@ripe.net>, SIDR Operations WG <sidrops@ietf.org>, Tim Bruijnzeels <tim@nlnetlabs.nl>
In-Reply-To: <YF4Irln8qM4w8i3o@snel>
References: <161403751321.2598.9484858333244233389@ietfa.amsl.com> <76D4E3AD-97BD-40D5-804C-3ED6B875044F@nlnetlabs.nl> <2B8DFACB-E2C6-48F6-B2DF-D762FCAF2384@ripe.net> <YF4Irln8qM4w8i3o@snel>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue")
Content-Type: text/plain; charset=US-ASCII
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/5lwilukFpb7Li0outgApnEEbz1g>
Subject: Re: [Sidrops] I-D Action: draft-ietf-sidrops-prefer-rrdp-00.txt
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Mar 2021 17:46:34 -0000

>> However, scaling rsync so it is available when all clients fallback in
>> a short period (we see ~1170 unique ips retrieve notification.xml in a
>> 10 minute window) is difficult.
> 
> Have you considered using a TCP proxy application like 'haproxy' to
> distribute rsync clients across multiple rsync backends? One can even
> anycast rsync servers to distribute load!

it is inappropriate to place undue financial and ops burden on the
operator of a publication point because we can not design protocols.

> It appears Randy came up with a simple suggestion:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-rpki-rov-timing-03

if you mean jittering fallover, credit to ggm.  but it is not clear to
me that it is actualy needed if the rrdp clients are not in convoy.

> The rpki-client default installation on OpenBSD/Ubuntu/Debian will be
> launched at a random minute of the hour, and will (for the lifetime of
> the governing cron/systemd process) fetch at that choosen minute of the
> hour.

yes, copied from drl's.  but those are arbitrary implementations, not
protocol specifications.

> Validator implementations which are started in 'oneshot' mode
> (rpki-client, 'routinator vrps', 'fort --mode=standalone') should
> immediately try rsync when RRDP fails for one reason or another.
> 
> A 'oneshot' implementation should not insert a 'sleep' between a failed
> rrdp fetch and an attempt to connect using rsync.

so you argue against ggm's jittered fallover delay?  maybe give us more
of a hint as to the motivation here.

randy

---
randy@psg.com
`gpg --locate-external-keys --auto-key-locate wkd randy@psg.com`
signatures are back, thanks to dmarc header butchery