Re: [lamps] CAA Simplification draft

On 09/12/2017 06:28 PM, Roland Bracewell Shoemaker wrote:
> While this removes the ambiguities with regard to CNAME and DNAME alias
> handling I think the definition of the algorithm is still unnecessarily
> hard to read. Also references to 'CNAME' should be replaced with
> 'aliases' since 1034 section 4.3.2 as updated by 6672 also handles
> DNAMEs (although to be honest I think any references to specific 1034
> 4.3.2 behavior can just be removed since they are incorporated simply by
> referencing that algorithm).
> 
> I'd suggest that Section 4 paragraphs 3-9 be replaced with the following
> cleaned up definition using pseudocode and a better explanation of the
> steps the algorithm uses in the example:
> 
> https://github.com/jsha/caa-simplification/compare/master...rolandshoemaker:alg-cleanup?expand=1
> 
> I'd also recommend this RFC be paired down to only section 4 since that
> is all that is being changed and make it a 'Updates' instead of
> 'Obsoletes' style RFC that just redefines the lookup algorithm.

I'll actually retract this after reading through RFC 2223 and 7322,
since this is a breaking change from the algorithm in 6844 this should
probably be a 'Obsoletes' and therefore contain all of the existing
content that isn't being changed.

> 
> Thanks for doing the work on this! I think taking this approach, of
> simplifying the algorithm definition, is better as completely
> re-designing the algorithm and using a different record style,
> especially given this is what CABF has already adopted, without a well
> defined reason is just asking for more problems down the line.
> 
> On 09/12/2017 05:23 PM, Jacob Hoffman-Andrews wrote:
>> Hi all,
>>
>> This is a revision to RFC6844 as discussed previously on the list and at
>> IETF 99. In particular, RFC6844 specifies that CAs should implement
>> "tree climbing" not only on the original FQDN, but also on any
>> intermediate CNAMEs discovered during primary lookup. As discussed
>> on-list, this disallows certain deployment scenarios, and can produce
>> surprising results in common CNAME-based hosting scenarios.
>>
>> Additionally, because RFC6844 re-specified parts of CNAME lookup, some
>> details were ambiguous. This draft updates RFC6844 to eliminate tree
>> climbing on CNAME targets, and to reference RFC 1034 for the standard
>> DNS lookup algorithm, including CNAME resolution.
>>
>> Because all of this draft is the same as RFC6884 except for the
>> "Certification Authority Processing" section, I've retained the original
>> two authors and added my own name. Please let me know if IETF etiquette
>> indicates a different approach.
>>
>> I'd like to propose this draft for adoption by the WG.
>>
>> https://www.ietf.org/id/draft-hoffman-andrews-caa-simplification-00.txt
>>
>> Thanks,
>> Jacob
>>
>> _______________________________________________
>> Spasm mailing list
>> Spasm@ietf.org
>> https://www.ietf.org/mailman/listinfo/spasm
>>