Subject: Re: [Isms] [IANA #305455] Last Call: draft-ietf-isms-dtls-tm (Transport Layer Security (TLS) Transport Model for SNMP) to Proposed Standard

From: Wes Hardaker <[email-masked]>
Date: Wed, 07 Apr 2010 09:42:53 -0700

>>>>> On Wed, 7 Apr 2010 08:55:12 +0200, Juergen Schoenwaelder <[email-masked]> said:

>> Decimal Name Description References
>> ------- ---- ----------- ----------
>> xxxx tlstm The TLS Transport [RFC-isms-dtls-tm-09]

JS> According to the MIB module, this would be named tlstmMIB not tlstm
JS> (but the IANA instructions were not clear). Wes, the MIB module says
JS> "snmpModules xxxx" where it should be "mib-2 189".

Actually, it needs to be 'mib-2 xxxx' and I've changed it to such.

JS> Since RFC 5592 prefixes everything with 'snmp', I am wondering
JS> whether we should have done the same and even have called the module
JS> SNMP-TLS-TM-MIB for consistency with SNMP-SSH-TM-MIB instead of
JS> TLSTM-MIB. Interestingly, the error counters are prefixed with
JS> 'snmp'. I know, this naming issues comes up very late now but I
JS> thought I still raise it. Perhaps we really need a good MIB doctor
JS> review. ;-)

I've changed this as well as renamed the MIB to SNMP-TLS-TM-MIB.

I worry about getting all the references in the document correctly to
rename all the objects, but I'll go through the work in doing so if
that's what we feel is the right thing to do.

>> Upon approval of this document, IANA will make the following 
>> assignments in "iso.org.dod.internet.snmpv2.snmpDomains (1.3.6.1.6.1)" at
>> http://www.iana.org/assignments/smi-numbers 
>> 
>> Decimal Name Description Reference
>> ------- ----------------- ----------------------------- ---------
>> xx snmpTLSTCPDomain SNMP over TLS via TCP [RFC-isms-dtls-tm-09]
>> yy snmpTLSDUDPDomain SNMP over TLS via TCP [RFC-isms-dtls-tm-09]

JS> (I am wondering what is really TCP/UDP specific in this document.)
JS> Anyway, the second assignment is clearly wrong, the document requests
JS> snmpDTLSUDPDomain not snmpTLSDUDPDomain.

Yep.  Both TLS and DTLS can be run over things other than their common
TCP and UDP cases so I think it's important we distinguish them
appropriately both for understanding today as well as matching future
naming if someone wants to expand the suite later.

But the assignment in the second one above definitely should be
snmpDTLSUDPDomain and I think the text already says this clearly and the
above example assignment was simply a human error.

>> Action #3
>> 
>> Upon approval of this document, IANA will make the following 
>> assignments in the "SNMP Transport Domains" registry at
>> http://www.iana.org/assignments/snmp-number-spaces
>> 
>> Prefix snmpDomains Reference
>> ------- ----------------------------- ---------
>> tls snmpTLSTCPDomain [RFC-isms-dtls-tm-09]
>> dudp snmpDTLSUDPDomain [RFC-isms-dtls-tm-09]

JS> This is correct with regard to -09 but it seems the second prefix
JS> really should be 'dtls' and not 'dudp'. (And since we do not
JS> distinguish the transports here, perhaps we also do not need to do
JS> this for the *Domain names?)

dudp was the request we made originally because we were going to support
multiple instances of DTLS so we had dudp and dsct as well.  If we're
only going to do dtls/udp now then we should either pick:

1) 'tls' and 'dtls' as prefixes.
2) 'ttcp' and 'dudp' as prefixes (letting future 'tsct' and 'dsct' match
   future (D)TLS over SCTP match existing naming assignments).
 
>> Upon approval of this document, IANA will assign the following 
>> registered port numbers at
>> http://www.iana.org/assignments/port-numbers
>> 
>> Keyword Decimal Description References
>> ------- ------- ----------- ----------
>> smtptls TBD1/tcp SNMPv3-TLS [RFC-isms-dtls-tm-09]
>> TBD1/udp SNMPv3-TLS [RFC-isms-dtls-tm-09]
>> smtpltls-trap TBD2/tcp SNMPv3-Trap-TLS [RFC-isms-dtls-tm-09]
>> TBD2/udp SNMPv3-Trap-TLS [RFC-isms-dtls-tm-09]

JS> This should be snmptls and snmptls-trap, as requested in the document.

I'm thinking that the snmptls should not be the proper name for DTLS/UDP
case though.  It's not TLS it's DTLS.  I think we really should end up
with is:

  Keyword         Decimal     Description References
  -------         -------     ----------- ----------
  snmptls         TBD1/tcp    SNMPv3-TLS [RFC-isms-dtls-tm-09]
  snmpdtls        TBD1/udp    SNMPv3-DTLS [RFC-isms-dtls-tm-09]
  snmpltls-trap   TBD2/tcp    SNMPv3-Trap-TLS [RFC-isms-dtls-tm-09]
  snmpdtls-trap   TBD2/udp    SNMPv3-Trap-DTLS [RFC-isms-dtls-tm-09]

(note the 'dtls')

Thoughts?
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 07 Apr 2010 10:25:07 -0700

>>>>> On Wed, 07 Apr 2010 09:42:53 -0700, Wes Hardaker <[email-masked]> said:

WH> I worry about getting all the references in the document correctly to
WH> rename all the objects, but I'll go through the work in doing so if
WH> that's what we feel is the right thing to do.

FYI, I've gone ahead and done this.  The new and updated document
reflecting all the outstanding issues I have in my list, including
Michael Peck's and IANA issues, can be found at:

  http://www.hardakers.net/temp/draft-ietf-isms-dtls-tm-10pre1.txt

And the diff comparison can be found at:

  http://tools.ietf.org/rfcdiff?difftype=--hwdiff&url1=draft-ietf-isms-dtls-tm-09.txt&url2=http://www.hardakers.net/temp/draft-ietf-isms-dtls-tm-10pre1.txt
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Apr 2010 19:53:30 -0400

what is the ltls in snmpltls?

dbh 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Wes Hardaker
> Sent: Wednesday, April 07, 2010 12:43 PM
> To: Juergen Schoenwaelder
> Cc: Amanda Baber via RT; [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]
> Subject: Re: [Isms] [IANA #305455] Last Call: 
> draft-ietf-isms-dtls-tm(Transport Layer Security (TLS) 
> Transport Model for SNMP) toProposed Standard
> 
> >>>>> On Wed, 7 Apr 2010 08:55:12 +0200, Juergen 
> Schoenwaelder <[email-masked]> said:
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/isms
>

---

From: Robert Story <[email-masked]>
Date: Thu, 8 Apr 2010 08:30:53 -0400

On Wed, 7 Apr 2010 09:42:53 -0700 Wes wrote:
WH> JS> Since RFC 5592 prefixes everything with 'snmp', I am wondering
WH> JS> whether we should have done the same and even have called the module
WH> JS> SNMP-TLS-TM-MIB for consistency with SNMP-SSH-TM-MIB instead of
WH> JS> TLSTM-MIB.
WH> 
WH> I've changed this as well as renamed the MIB to SNMP-TLS-TM-MIB.

Ugh. I, for one, hate these ever expanding object names. I don't mind
the MIB names so much.

Given that many tools prefix object names with the MIB names, prefixing
objects just makes the name longer,not any clearer.  Picking an example
from this mib, we've gone from

   TLSTM-MIB::tlstmCertToTSNStorageType

to

   SNMP-TLS-TM-MIB::snmpTlstmCertToTSNStorageType

when

   SNMP-TLS-TM-MIB::certToTSNStorageType

is quite clear.  My $.02, anyways.

-- 
Robert Story
Senior Software Engineer
SPARTA (dba Cobham Analytic Soloutions)

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 08 Apr 2010 06:27:00 -0700

>>>>> On Wed, 7 Apr 2010 19:53:30 -0400, "David Harrington" <[email-masked]> said:

DH> what is the ltls in snmpltls?

That's that rare and elusive typo inserted by IANA folks and copied by
me! (and now fixed)
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 08 Apr 2010 06:29:03 -0700

>>>>> On Thu, 8 Apr 2010 08:30:53 -0400, Robert Story <[email-masked]> said:

RS> Ugh. I, for one, hate these ever expanding object names. I don't mind
RS> the MIB names so much.

Me too, but they should ideally match the SSH draft.  And traditionally
objects that are manipulating things that have to do with management
of the snmp protocol itself (like these) have 'snmp' as a prefix.

We continue making things unreadable by tradition (and for uniqueness
insurance).

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 13 Apr 2010 11:55:19 +0200

>   http://tools.ietf.org/rfcdiff?difftype=--hwdiff&url1=draft-ietf-isms-dtls-tm-09.txt&url2=http://www.hardakers.net/temp/draft-ietf-isms-dtls-tm-10pre1.txt

Thanks for the update. If I look at the IANA considerations,
requesting on the one hand

and on the other hand

   5.  "tls" as the corresponding prefix for the snmpTLSTCPDomain in the
       SNMP Transport Model registry,

   6.  "dudp" as the corresponding prefix for the snmpDTLSUDPDomain in
       the SNMP Transport Model registry,

does not seem consistent. Suppose we have SNMP over DTLS/SCTP and SNMP
over DTLS/DCCP, would the ports be named as follows?

    snmpdtls	    TBD/sctp
    snmpdtls	    TBD/dccp

I am also wondering whether having different prefixes for dtls over
different transports really is needed. My understanding is that the
prefixes are used by TSM (RFC 5591) to map tls:joe and ssh:joe to
different security names. If we allocate "dtls" for DTLS, we can
distinguish dtls:joe from tls:joe and ssh:joe. But is it really
necessary to distinguish dtls-over-udp:joe from dtls-over-dccp:joe?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 13 Apr 2010 06:44:26 -0700

>>>>> On Tue, 13 Apr 2010 11:55:19 +0200, Juergen Schoenwaelder <[email-masked]> said:

JS> snmptls         TBD1/tcp    SNMPv3-TLS [RFC-isms-dtls-tm-09]
JS> snmpdtls        TBD1/udp    SNMPv3-DTLS [RFC-isms-dtls-tm-09]
JS> snmpltls-trap   TBD2/tcp    SNMPv3-Trap-TLS [RFC-isms-dtls-tm-09]
JS> snmpdtls-trap   TBD2/udp    SNMPv3-Trap-DTLS [RFC-isms-dtls-tm-09]

JS> and on the other hand

Right, those need to be unique per transport (udp vs tcp level transport).

JS> 5.  "tls" as the corresponding prefix for the snmpTLSTCPDomain in the
JS> SNMP Transport Model registry,

JS> 6.  "dudp" as the corresponding prefix for the snmpDTLSUDPDomain in
JS> the SNMP Transport Model registry,

Those need to be unique everywhere.

JS> does not seem consistent. Suppose we have SNMP over DTLS/SCTP and SNMP
JS> over DTLS/DCCP, would the ports be named as follows?

JS> snmpdtls	    TBD/sctp
JS> snmpdtls	    TBD/dccp

That's what I'd probably pick, yes.  It's the port for the DTLS protocol
over each transport all of which blend nicely with DTLS over UDP as well.

JS> I am also wondering whether having different prefixes for dtls over
JS> different transports really is needed. My understanding is that the
JS> prefixes are used by TSM (RFC 5591) to map tls:joe and ssh:joe to
JS> different security names. If we allocate "dtls" for DTLS, we can
JS> distinguish dtls:joe from tls:joe and ssh:joe. But is it really
JS> necessary to distinguish dtls-over-udp:joe from dtls-over-dccp:joe?

Well, that's a perfectly valid question.  In my mind I was assuming
every prefix instance would need to be unique, but you're right I don't
think we have to assume that.  Assigning them all to be just "dtls" is
a reasonable thing to do.

Anyone else with thoughts or comments on this subject?
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 13 Apr 2010 10:23:50 -0700

Hi -

> From: "Wes Hardaker" <[email-masked]>
> To: "Wes Hardaker" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Tuesday, April 13, 2010 6:44 AM
> Subject: Re: [Isms] Updated TLSTM "pre" document
...
> Anyone else with thoughts or comments on this subject?

The only case I can think of where the distinction might potentially
be useful would be in cases where outgoing notification streams
are permitted on either transport, but certain notification
types (perhaps because they potentially occur frequently) are to
be limited via VACM to just one of the transports (probably DCCP).
Seems kinda Rube-Goldberg to me, but you never know.  :-)

Randy