Re: [Sidrops] [WGLC] draft-ietf-sidrops-rp - ENDS: Mar 7, 2019

Oleg Muravskiy <oleg@ripe.net> Sun, 24 March 2019 17:12 UTC

Return-Path: <oleg@ripe.net>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6D611200D7; Sun, 24 Mar 2019 10:12:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.9
X-Spam-Level:
X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fn08nWGC7NQb; Sun, 24 Mar 2019 10:12:22 -0700 (PDT)
Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A2DF127988; Sun, 24 Mar 2019 10:12:16 -0700 (PDT)
Received: from [193.0.23.13] (helo=bufobufo.ripe.net) by molamola.ripe.net with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.91) (envelope-from <oleg@ripe.net>) id 1h86fO-0000ot-NC; Sun, 24 Mar 2019 18:12:14 +0100
Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=[IPv6:2001:67c:2e8:5009::e3]) by bufobufo.ripe.net with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.91) (envelope-from <oleg@ripe.net>) id 1h86et-0005gO-Cr; Sun, 24 Mar 2019 18:11:43 +0100
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
From: Oleg Muravskiy <oleg@ripe.net>
In-Reply-To: <yj9ozhpt51ug.wl-morrowc@ops-netman.net>
Date: Sun, 24 Mar 2019 18:11:42 +0100
Cc: sidrops-chairs@ietf.org, sidrops-ads@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <E9997496-1709-4B79-9911-3E88CE8D7B1A@ripe.net>
References: <yj9ozhpt51ug.wl-morrowc@ops-netman.net>
To: sidrops@ietf.org
X-Mailer: Apple Mail (2.3445.102.3)
X-ACL-Warn: Delaying message
X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b74c1c43f0409e58a4ccb3d5195702f716d
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/9RbfnHkdxF4qclFROG5Xr8OUOrM>
Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-rp - ENDS: Mar 7, 2019
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 24 Mar 2019 17:12:25 -0000

Here are my comments on this document. Most of them I already submitted back in 2016 (https://mailarchive.ietf.org/arch/msg/sidr/ThyvBuWdCnv2t9u86sOjwdV4xKc), and authors seem to agreed to update the document, but that didn’t happen:


> 3.2.  Certificate Path Validation
> 
>    In the RPKI, issuer can only assign and/or allocate public INRs
>    belong to it,


Assignment / allocation of INRs does not happen in RPKI.


> 3.3.  CRL Processing
> 
>    The CRL processing requirements imposed on CAs and RP are described
>    in Section 5 of [RFC6487]. CRLs in the RPKI are tightly constrained;
>    only the AuthorityKeyIndetifier and CRLNumber extensions are allowed,
>    and they MUST be present.  No other CRL extensions are allowed, and
>    no CRLEntry extensions are permitted.  RPs are required to verify
>    that these constraints have been met.  Each CRL in the RPKI MUST be
>    verified using the public key from the certificate of the CA that
>    issued the CRL.


The normative language is used in an Informational document.


> 4.2.2.  ROA
> 
>    To validate a ROA, the RP is required perform all the checks
>    specified in [RFC6488] as well as the additional ROA-specific
>    validation steps.  The IP address delegation extension [RFC3779]
>    present in the end-entity (EE) certificate (contained within the
>    ROA), must encompass each of the IP address prefix(es) in the ROA.
> 
>    More details for ROA validation are specified in Section 2 of
>    [RFC6482].


Section 2 of RFC6482 defines the ROA content-type, not the validation.


> 4.2.3.  Ghostbusters
> 
> 
>    The Ghostbusters Record is optional; a publication point in the RPKI
>    can have zero or more associated Ghostbuster Records.


Since no other CMS object description in this document mentions object’s optionality, this sentence may be understood as that the Ghostbusters Record is the only type of object which is optional. This is not the case.


> 4.3.  How to Make Use of Manifest Data
> 
>    For a given publication point, the RP ought to perform tests, as
>    specified in Section 6.1 of [RFC6486], to determine the state of the
>    Manifest at the publication point.  A Manifest can be classified as
>    either valid or invalid, and a valid Manifest is either current and
>    stale.  An RP decides how to make use of a Manifest based on its
>    state, according to local (RP) policy.
> 
>    If there are valid objects in a publication point that are not
>    present on a Manifest, [RFC6486] does not mandate specific RP
>    behavior with respect to such objects.  However, most RP software
>    ignores such objects and this document recommends that this behavior
>    be adopted uniformly.


To my knowledge, most RP software notifies operator about presence of such objects, not just ignores them.

Also, I’m not sure how to treat “recommends” in an informational document.


>    In the absence of a Manifest, an RP is expected to accept all valid
>    signed objects present in the publication point.  


RFC6486 says that all such objects "SHOULD be viewed as suspect, but MAY be used by the RP, as per local policy”. This is quite different to “RP is expected to accept”.



And again, in general, I do not quite understand how authors chose to describe in detail some validation steps, and completely omit other steps, which makes the overall value of this document unclear to me.


Oleg