Subject: [mif-arch-dt] Taxonomy

From: Margaret Wasserman <[email-masked]>
Date: Tue, 14 May 2013 03:23:37 -0400

IMO, the first questions we need to answer are:

What is a Provisioning Source (PVS)?

What is a Provisioning Domain (PVD)?

I think we all have a concept of what we mean when we use these terms, but can we reach consensus within the DT on formal definitions?  Are there any other terms that we should formally define?  

Margaret

---

From: Ted Lemon <[email-masked]>
Date: Tue, 14 May 2013 13:47:05 +0000

> What is a Provisioning Source (PVS)?

First of all, there are actually two kinds of entities from which provisioning information comes: network services, and the operator.   I think by PvS you mean a network service.   I think operator configuration is a separate thing, which needs to be discussed separately.   PvO?

As for what things are PvSs, I think at least the following are:

- DHCP server
- RA server (IOW, just the thing that sends RAs, not any of the other stuff that's collocated on the router).
- Layer 2 services, e.g. AP SSID, but also WPA (does WPA provide a means of authenticating server to client?).   This would also include authenticated 3G services, and any configuration profile that might be received from the 3G service, I think.

NOT the RADIUS server, because the host doesn't get configuration information from it.

> What is a Provisioning Domain (PVD)?

A set of configuration information that can be attributed to a single administrative source, for a single IP stack.   Additionally, an informal provisioning domain can be said to exist for information that has no attribution tag, that applies to a particular IP stack, and that applies to a particular interface.   However, such informal provisioning domains cannot be entirely relied upon, since multiple provisioning domains can exist on a wire, and cannot be separated if they are not tagged.

> I think we all have a concept of what we mean when we use these terms, but can we reach consensus within the DT on formal definitions?  Are there any other terms that we should formally define?  

Provisioning operator (PvO)?

---

From: Hui Deng <[email-masked]>
Date: Fri, 24 May 2013 15:16:14 +0800

Inline please
 
> From: [email-masked]
> To: [email-masked]
> Date: Tue, 14 May 2013 13:47:05 +0000
> CC: [email-masked]
> Subject: Re: [mif-arch-dt] Taxonomy
> 
- ANDSF server,- HS 2.0 ANQP serveradd this two. > 
> Provisioning operator (PvO)?
Context?Provisioning domain Identifier? > 
> _______________________________________________
> mif-arch-dt mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mif-arch-dt

---

From: Dmitry Anipko <[email-masked]>
Date: Mon, 27 May 2013 23:46:39 +0000

My 2 cents:

I agree with below examples of PvS, however given that the single role of PvS, relevant in MPD context, seems to be a source of information, it seems a bit self referential to me, and I'm not sure why it is needed (e.g. if not all possible sources of information were potential PvSes, then I'd understand the need for PvS definition).

I generally agree with the definition of PvD below as well with 2 caveats: I assume "single IP stack" may cover multiple address families, and also the information may be limited not to just IP, but to layers above as well (as previously discussed - e.g. HTTP proxy server).

I wonder what are the use cases folks have for PvO (sorry if I missed the discussion, but it is not fully clear to me yet)? The only one I can think of now is that it may be useful for host policies to be able to define trust to any PvDs defined by a particular PvO (as opposed to defining trust to each PvD separately).

-Dmitry

________________________________
From: [email-masked] on behalf of Hui Deng
Sent: Friday, May 24, 2013 12:16 AM
To: Lemon Ted; [email-masked]
Cc: [email-masked]
Subject: Re: [mif-arch-dt] Taxonomy

Inline please

> - Layer 2 services, e.g. AP SSID, but also WPA (does WPA provide a means of authenticating server to client?). This would also include authenticated 3G services, and any configuration profile that…
- ANDSF server,
- HS 2.0 ANQP server
add this two.

> Provisioning operator (PvO)?
Context?
Provisioning domain Identifier?

---

From: Ted Lemon <[email-masked]>
Date: Tue, 28 May 2013 01:33:38 +0000

On May 27, 2013, at 7:46 PM, Dmitry Anipko <[email-masked]<mailto:[email-masked]>> wrote:
I generally agree with the definition of PvD below as well with 2 caveats: I assume "single IP stack" may cover multiple address families, and also the information may be limited not to just IP, but to layers above as well (as previously discussed - e.g. HTTP proxy server).

To be clear, when I said "a single IP stack" I meant it in the sense that a dual-stack host has two IP stacks.   I think your interpretation of the term is valid, but it's not the interpretation I meant.

So, in reading Margaret's response to my response, I don't recall what I meant by PvO either, which means I must have expressed myself poorly.   Oh, okay.  PvO is someone operating the host.   So an end user, in many cases, interacting with a customization UI that allows the user to say "use this PvD only for these services," for example.   But a PvO could also be a sysadmin, in cases where the host is for example a corporate laptop: "use only the VPN to access the Internet, other than to get a substrate over which the VPN can operate," for instance.

---

From: <[email-masked]>
Date: Tue, 28 May 2013 08:39:13 +0000

Hi Ted,

In the definition of PvD, you wrote:

"Additionally, an informal provisioning domain can be said to exist for information that has no attribution tag, that applies to a particular IP stack, and that applies to a particular interface."

Do you assume one single interface per provisioning domain?

Br,
Pierrick

De : [email-masked] [mailto:[email-masked]] De la part de Ted Lemon
Envoyé : mardi 28 mai 2013 03:34
À : Dmitry Anipko
Cc : [email-masked]; [email-masked]; Hui Deng
Objet : Re: [mif-arch-dt] Taxonomy

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, France Telecom - Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Margaret Wasserman <[email-masked]>
Date: Tue, 28 May 2013 06:52:00 -0400

> To be clear, when I said "a single IP stack" I meant it in the sense that a dual-stack host has two IP stacks.   I think your interpretation of the term is valid, but it's not the interpretation I…

A dual-stack host only has 2 IP stacks in a very limited sense.  In fact, only in a sense that doesn't involve a "stack"...

A TCP or UDP listener can accept incoming IP packets on a given port, regardless of the address family of the incoming packet.  A dual-stack IPv4/IPv6 implementation also shares interfaces.  The fact that IPv4 and IPv6 are configured separately is largely a function of specific configuration mechanisms (ND, DHCP) than an indication that there are two separate stacks.

Margaret

---

From: <[email-masked]>
Date: Tue, 28 May 2013 12:04:17 +0000

De : [email-masked] [mailto:[email-masked]] De la part de Hui Deng
Envoyé : vendredi 24 mai 2013 09:16
À : Lemon Ted; [email-masked]
Cc : [email-masked]
Objet : Re: [mif-arch-dt] Taxonomy

Inline please

> On May 14, 2013, at 3:23 AM, Margaret Wasserman <[email-masked]<mailto:[email-masked]>> wrote:
- ANDSF server,
- HS 2.0 ANQP server
add this two.

>Provisioning domain Identifier?

I think we should agree on the definition of PvD before adding new stuff.

Pierrick
> [email-masked]<mailto:[email-masked]>

---

From: Ted Lemon <[email-masked]>
Date: Tue, 28 May 2013 12:25:26 +0000

On May 28, 2013, at 4:39 AM, [email-masked]<mailto:[email-masked]> wrote:
Do you assume one single interface per provisioning domain?

In the case of informal provisioning domains, yes.   In the case of formal provisioning domains, if two provisioning domains claim the same identifier, and the identifier is authenticated, then the two provisioning domains can be treated as a single provisioning domain even if provided on two separate interfaces.

---

From: Ted Lemon <[email-masked]>
Date: Tue, 28 May 2013 12:31:14 +0000

> A TCP or UDP listener can accept incoming IP packets on a given port, regardless of the address family of the incoming packet.  A dual-stack IPv4/IPv6 implementation also shares interfaces.  The fa…

Sure, although in practice I've never been able to take advantage of the single listener socket for UDP/IP + UDP/IPv6 or for TCP/IP + TCP/IPv6.   There always seems to be some reason why I need a separate socket for each stack.   I'd be curious if other people have had different experiences with this.   I know that for example nginx supports listening on a dual-stack socket, but everybody who's actually _using_ it for IPv6 seems to wind up setting up a v6only socket.

Having said that, I don't disagree with your basic point.   We should just decide how to talk about the distinction between stacks in the context of provisioning domains, and use a consistent terminology.   I have no personal investment in what that terminology is.

---

From: <[email-masked]>
Date: Tue, 28 May 2013 12:40:53 +0000

De : Ted Lemon [mailto:[email-masked]]
Envoyé : mardi 28 mai 2013 14:25
À : SEITE Pierrick OLNC/OLN
Cc : Dmitry Anipko; [email-masked]; [email-masked]; Hui Deng
Objet : Re: [mif-arch-dt] Taxonomy

In the case of informal provisioning domains, yes.

>>Ok, I agree; but, during first call of the DT, people argued that the definition of PvD was RFC6418 was bad because assuming a single interface. So, is there an agreement on Ted's definition (Question to all)?

In the case of formal provisioning domains, if two provisioning domains claim the same identifier, and the identifier is authenticated, then the two provisioning domains can be treated as a single provisioning domain even if provided on two separate interfaces.

>> I'm not sure to understand the concept of "formal PvD"... I guess that the description of a concrete use case would help...

---

From: Lorenzo Colitti <[email-masked]>
Date: Wed, 29 May 2013 21:26:24 +0900

On Tue, May 28, 2013 at 9:31 PM, Ted Lemon <[email-masked]> wrote:

> Sure, although in practice I've never been able to take advantage of the
> single listener socket for UDP/IP + UDP/IPv6 or for TCP/IP + TCP/IPv6.
> There always seems to be some reason why I need a separate socket for each
> stack.   I'd be curious if other people have had different experiences with
> this.   I know that for example nginx supports listening on a dual-stack
> socket, but everybody who's actually _using_ it for IPv6 seems to wind up
> setting up a v6only socket.
>

Dual-stack sockets work quite well for TCP servers and clients. For servers
you just have to be careful to treat mapped addresses properly, i.e., if
you get ::ffff:1.2.3.4 you should log 1.2.3.4, not ::ffff:1.2.3.4.

For clients they mostly Just Work. Virtually all apps on android use them,
for example; in fact, in Java it's basically required for things to work,
because in Java you can create a socket and do stuff to it without
specifying the address family, and the only way to do that in a library
without large amounts of lying to the application is to create a dual-stack
socket when the application does "new Socket();".

---

From: Ted Lemon <[email-masked]>
Date: Wed, 29 May 2013 15:42:53 +0000

On May 29, 2013, at 8:26 AM, Lorenzo Colitti <[email-masked]<mailto:[email-masked]>> wrote:
For clients they mostly Just Work. Virtually all apps on android use them, for example; in fact, in Java it's basically required for things to work, because in Java you can create a socket and do stuff to it without specifying the address family, and the only way to do that in a library without large amounts of lying to the application is to create a dual-stack socket when the application does "new Socket();".

Cool, this is good to know.   Has this been successful in dual-stack environments with brokenness?   My expectation would be that this would make happy eyeballs-like stuff difficult to implement, although if the stack did some of the probing for you that would certainly ameliorate that concern.