Subject: Re: [Anima] I-D Action: draft-ietf-anima-bootstrapping-keyinfra-09.txt

From: Toerless Eckert <[email-masked]>
Date: Wed, 1 Nov 2017 21:51:04 +0100

My proposal to the BRSKI authors are to fix up this text in line with how i
did it for ACP for discovery of EST server across ACP for cert renewal
(reminder: Cert renewal is not part of BRSKI because BRSKI does not specify
 cert renewal and its in ACP because we need a commonly supported cert renewal method):

ACP 6.1.3: SRV.est, flooding, specified simpled default parameter

For BRSKI, service name would be SRV.brski same timing parameters.
Both are registered objective names with IANA according to GRASP.

That should give us the IMHO most simple, best understood option:

  - flooding behavior is well understood. query/reply behavior
    in the face of different topologies and stopping of discovery when first
    objective instance is discovered is a lot more novel.

The naming SRV.xxx can then later on be generalized via the definitions
proposed in https://tools.ietf.org/html/draft-eckert-anima-grasp-dnssd-00
That draft also includes the definitions for how to do distance based
("TTL") discovery and how to bring in service "priority" etc. in a DNS-SD
compatible fashion...

And we can bet up on those details long after we hopefully have BRSKI/ACP RFC
because we would just update BRSKI/ACP RFC with that later RFC - aka: definitely
i do not want to make these more generic definitions a prerequisite for BRSKI/ACP!

Cheers
    Toerless

On Wed, Nov 01, 2017 at 02:26:51PM +1300, Brian E Carpenter wrote:
> I'm confused.
> 
> On the one hand, you haven't fixed the syntax error that I
> pointed out in the flooded objective "AN_proxy".
> 
> On the other hand, you've changed the discovered objective
> "AN_join_registrar" into a flooded objective. I thought that 
> the BRSKI team had decided against that? I don't care,
> either way will work, but I'm a bit surprised.
> 
> The flooded version seems to be correctly defined, unlike
> "AN_proxy".
> 
> (Also, I thought you want to shorten its name to "AN_registrar",
> but that is a detail.)
> 
> Regards
>    Brian
> 
> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima

-- 
---
[email-masked]

---

From: Michael Richardson <[email-masked]>
Date: Wed, 01 Nov 2017 20:21:01 -0400

> pointed out in the flooded objective "AN_proxy".

Oops.  I forgot about that part.
Let me Mail_FLOOD some replacement text tomorrow.

    > The flooded version seems to be correctly defined, unlike

That's good to know so that I know how to fix AN_proxy.

    > (Also, I thought you want to shorten its name to "AN_registrar",

We have discussed the possibility that not all (EST) registrars would want to
handle join traffic, and so there might be an AN_registrar objective for use
to renew certificates, etc. once the node has joined.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Thu, 02 Nov 2017 09:37:05 -0400

Brian, did I get this right?

4.1.1.  Proxy Grasp announcements

   A proxy uses the GRASP M_FLOOD mechanism to announce itself.  The
   pledge SHOULD listen for messages of these form.  This announcement
   can be within the same message as the ACP announcement detailed in
   [I-D.ietf-anima-autonomic-control-plane].  The M_FLOOD is formatted
   as follows:

   [M_FLOOD, 12340815, h'fe80::1', 180000,
               ["AN_Proxy", 4, 1, ""],
               [O_IPv6_LOCATOR,
                    h'fe80::1', 'TCP', 4443]]

   Figure 6b: Proxy Discovery

   The formal CDDL definition is:

   flood-message = [M_FLOOD, session-id, initiator, ttl,
                    +[objective, (locator-option / [])]]

   objective = ["AN_Proxy", objective-flags, loop-count,
                                          objective-value]

   ttl             = 180000     ; 180,000 ms (3 minutes)
   initiator = ACP address to contact Registrar
   objective-flags = sync-only  ; as in GRASP spec
   sync-only       =  4         ; M_FLOOD only requires synchronization
   loop-count      =  1         ; one hop only
   objective-value = ''         ; none

   locator         = [ O_IPv6_LOCATOR, ipv6-address,
                       transport-proto, port-number ]
   ipv6-address     = the v6 LL of the proxy
   transport-proto  = 'TCP'
   port-number      = selected by proxy

   Figure 6c: AN_Proxy CDDL

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 3 Nov 2017 13:40:37 +1300

Hi,

Just a couple of minor points:

>    objective-value = ''         ; none

If you want a null string in CDDL, I think it has to be "". But why
not make it any in the formal syntax, with a RECOMMENDED value of null?
That provides extensibility at zero cost.

>    ipv6-address     = the v6 LL of the proxy

That field is supposed to be an integer. And I assume you want to
allow UDP too? So in GRASP-CDDL, that would be IPPROTO_TCP / IPPROTO_UDP

Not sure if IPIP is also an option here, that would be a tiny extension
to GRASP-CDDL (named IPPROTO_IPV6 of course).

That said, I updated my Reggie, Procksy and Pledji demos to the current
definitions and they are happily running in background as I type this.
Please check the attached diagnostic output. The first block is an M_FLOOD
message from the registrar. I coded it to send three [objective, locator]
pairs in a single message. The next three blocks are M_FLOODs from
the proxy - in this case I coded it to send three separate M_FLOODs, one for
each locator. Tell me if any of it looks unexpected. (All GRASP instances were
running on the same host for this test, so you will only see one GUA address
and one LL address).

I've pushed the code to GitHub. Doc at
https://github.com/becarpenter/graspy/blob/master/brski-demo.pdf

    Brian

---

From: Michael Richardson <[email-masked]>
Date: Mon, 06 Nov 2017 20:24:06 -0500

Brian E Carpenter <[email-masked]> wrote:
    >> one hop only objective-value = '' ; none

    > If you want a null string in CDDL, I think it has to be "". But why not
    > make it any in the formal syntax, with a RECOMMENDED value of null?

So I will write any.

    >> locator = [ O_IPv6_LOCATOR, ipv6-address, transport-proto, port-number
    >> ] ipv6-address = the v6 LL of the proxy transport-proto = 'TCP'

    > That field is supposed to be an integer. And I assume you want to allow
    > UDP too? So in GRASP-CDDL, that would be IPPROTO_TCP / IPPROTO_UDP

Right... so I want to write:

transport-proto  = IPPROTO_TCP / IPPROTO_UDP / IPPROTO_IPV6

??

    > https://github.com/becarpenter/graspy/blob/master/brski-demo.pdf

Thanks.

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 7 Nov 2017 17:31:49 +1300

> transport-proto  = IPPROTO_TCP / IPPROTO_UDP / IPPROTO_IPV6

Yes. And note that IPPROTO_IPV6 extends the list in GRASP. I don't
think that needs a formal "Updates".

(It somewhat sucks that the IETF itself doesn't have a normative
list in which IPPROTO_IPV6 is defined as the name for 41, etc.
Citing netinet/in.h doesn't really cut it.)

    Brian