Subject: [nfsv4] Barry Leiba's Discuss on draft-ietf-nfsv4-lfs-registry-04: (with DISCUSS and COMMENT)

From: "Barry Leiba" <[email-masked]>
Date: Tue, 07 Apr 2015 08:43:10 -0700

Barry Leiba has entered the following ballot position for
draft-ietf-nfsv4-lfs-registry-04: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-nfsv4-lfs-registry/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Setting up this registry is a fine thing, and I just have two points I'd
like to sort out before we approve this:

-- Section 5.2 --

1. Is it your intent that the Designated Expert still has to do expert
review when the specification is a Standards Track RFC?

2. You have no instructions to guide the Designated Expert; some
instructions are needed.  Is the DE expected to just give a basic sanity
check to the specification?  Is more thorough review of the specification
expected?  Will the DE be making any judgments about whether the
specified label format is useful, or is or isn't a "good idea", or is the
DE expected to approve any request with a suitable specification?  Both
DEs and applicants need to know what's expected.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Some non-blocking, minor comments here:

Very much a nit, but drafts have this sort of thing all the time, and we
should probably say something more generally (I think I'll post to the
IETF discussion list about the general point):

In the abstract...

   To allow multiple MAC mechanisms and label formats to co-exist in a
   network, this document proposes a registry of label format
   specifications.  This registry would contain label format identifiers
   and would provide for the association of each such identifier with a
   corresponding extensive document document outlining the exact syntax
   and use of the particular label format.

When the draft was written, it was "proposing" a registry, and should
that registry be created it "would contain" and "would provide" things. 
But it's now up for approval for RFC publication, and these
characterizations are inapt; when it's published, the registry will have
been created and will be providing all that.  Drafts should be written --
at least by the time they enter last call -- to have the right tone as
published RFCs.  Here, I suggest these changes:

1. "proposes" -> "creates"
2. "would contain" -> "contains"
3. "would provide" -> "provides"

-- Section 5 --
As best I can tell, this question from IANA wasn't answered in the last
call discussion, and it needs to be:

> Where should this new registry be located? Should it be placed at an
> existing URL? If not, should the title of the new webpage be "NFS
> Security Label Format Selection," or do you expect other registries
> that would require a different title to be placed there? Also, should
> it be filed under a new or an existing category at
http://www.iana.org/protocols?

IANA will sort this out with you in any case, but it would be good for
the document to say where you would like IANA to put the registry.

In Table 1, I think "Available for IANA Assignment" would be better than
"Reserved for IANA Assignment", but it's a really small point.

In Section 5.2, I suggest using the full name for the registry (add the
word "Security").

---

From: Tom Haynes <[email-masked]>
Date: Wed, 8 Apr 2015 16:34:32 -0700

> On Apr 7, 2015, at 8:43 AM, Barry Leiba <[email-masked]> wrote:
> 

I think that would be the easiest review of all.

But yes, the expert reviewer would verify that it was a Standards Track RFC
and approve it.

> instructions are needed.

Agreed.

>  Is the DE expected to just give a basic sanity

I think the judgement is not whether the specified label format
useful or a “good idea”, but rather does it provide for a sound
MAC implementation?

> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Tom Haynes <[email-masked]>
Date: Wed, 8 Apr 2015 17:41:22 -0700

Hi Barry,

I just realized I should be proposing some changes, so please see below!

Thanks,
Tom

> On Apr 8, 2015, at 4:34 PM, Tom Haynes <[email-masked]> wrote:
> 
>> 

A new paragraph to be added after the one in Section 5.2:

In reviewing the published label format specification, the Designated Expert
should consider whether or not the specification provides sufficient
semantics for the object and subject labels to enforce the MAC model
and policy administration when deployed within an organization. Another
consideration is if the label format allows the given protocol to
process and enforce labels as a policy administration mechanism.

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 8 Apr 2015 21:00:50 -0400

> process and enforce labels as a policy administration mechanism.

For the above proposal, I would suggest:

  s/the given protocol/a correct and complete implementation of the protocol/

This new paragraph probably also should say something about any
proposed new label format specification having clearly defined 
both the syntax & semantics of the proposed new label, not only
the semantics of the label.  Without clear syntax rules, one could
have interoperability issues.  (Been there, done that, and didn’t like
the outcome with the several variants of CIPSO from the original 
CIPSO I-D.)

Yours,

Ran

---

From: Tom Haynes <[email-masked]>
Date: Wed, 8 Apr 2015 18:21:06 -0700

> On Apr 8, 2015, at 6:00 PM, RJ Atkinson <[email-masked]> wrote:
> 
>> 

Hi Ran,

Thanks for your comments, I was hoping you would have some suggestions
based on experience. :-)

Tom

New paragraph:

In reviewing the published label format specification, the Designated Expert
should consider whether or not the specification provides sufficient
semantics for the object and subject labels to enforce the MAC model
and policy administration when deployed within an organization. Another
consideration is if the label format allows a correct and complete
implementation of the protocol to process and enforce labels as a
policy administration mechanism. Finally, to reduce interoperability
issues, the review must determine if the new label format specification
has clearly defined syntax and semantics for the proposed new labels.

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 9 Apr 2015 08:42:35 -0400

> On 08  Apr 2015, at 21:21 , Tom Haynes <[email-masked]> wrote:
> 
> New paragraph:
> 

That text looks great to me.

Thanks very much,

Ran Atkinson

---

From: Barry Leiba <[email-masked]>
Date: Thu, 9 Apr 2015 11:51:12 -0400

> That text looks great to me.

And to me.  Pop that in, and I'll clear the discuss tout de suite.

Thanks!

Barry

---

From: Tom Haynes <[email-masked]>
Date: Thu, 9 Apr 2015 10:51:48 -0700

> On Apr 9, 2015, at 8:51 AM, Barry Leiba <[email-masked]> wrote:
> 
>>> New paragraph:
>>> 

Thanks for help:

A new version (-05) has been submitted for draft-ietf-nfsv4-lfs-registry:
http://www.ietf.org/internet-drafts/draft-ietf-nfsv4-lfs-registry-05.txt <http://www.ietf.org/internet-drafts/draft-ietf-nfsv4-lfs-registry-05.txt>

The IETF datatracker page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-lfs-registry/ <https://datatracker.ietf.org/doc/draft-ietf-nfsv4-lfs-registry/>

Diff from previous version:
http://www.ietf.org/rfcdiff?url2=draft-ietf-nfsv4-lfs-registry-05 <http://www.ietf.org/rfcdiff?url2=draft-ietf-nfsv4-lfs-registry-05>