Subject: [secdir] SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-09

From: Russ Housley <[email-masked]>
Date: Thu, 25 Aug 2016 10:57:26 -0400

I reviewed this document as part of the Security Directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the Security Area
Directors.  Document authors, document editors, and WG chairs should
treat these comments just like any other IETF Last Call comments.

Version reviewed: draft-ietf-nfsv4-multi-domain-fs-reqs-09

Summary: Ready

Thank you for rewriting the Abstract and Introduction.  They are much
improved.

Major Concerns:  None.

Minor Concerns:

The first paragraph in Section 3 includes: "The issues with multi-domain
deployments described in this document apply ...".  I do not think that
"issues" is the right word.  To be consistent with the title of the
document, it should be talking about guidance or deployment
alternatives.

In Section 6.2.1, it says:

   Multiple security services per NFSv4 Domain is allowed, and brings
   the issue of mapping multiple Kerberos 5 principal@REALMs to the same
   local ID.  Methods of achieving this are beyond the scope of this
   document.

I think it would be better to use "need" instead of "issue".

Nits:

Please change "internet" to "Internet" throughout the document.

In Section 2, "Stringified UID or GID" definition:  Please add "of" to
the last sentence, so that it reads: "See Section 5.9 of [RFC5661]."

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 25 Aug 2016 11:02:10 -0500

Hi, Russ,

Thank you for the review!

Spencer

---

From: "Adamson, Andy" <[email-masked]>
Date: Mon, 29 Aug 2016 19:50:18 +0000

> On Aug 25, 2016, at 10:57 AM, Russ Housley <[email-masked]> wrote:
> 

Hi Russ

Thanks for your review.

This latest round of comments - including the Gen-ART review from Brian Carpenter shows that there is still an impedance mis-match between the title/abstract and the intended status of Standards Track versus an Informational draft or best practices.

I feel that the use of "Guidelines" in the title, and "guidance" in the abstract point to an Informational draft rather than a Standards track.

This draft is a Proposed Standard (not an Informational or BCP) because the MUST and REQUIRED noted in section 6 of the doc are absolute requirements for an NFSv4 multi-domain file name space to work. These can not be BCP as an NFSv4 multi-domain file name space will _not_ work without these requirements.

I have completed a draft-ietf-nfsv4-multi-domain-fs-reqs-10 with the following changes:

1) The title to be changed from

"Multiple NFSv4 Domain Namespace Deployment Guidelines"

to

"Multiple NFSv4 Domain Namespace Deployment Requirements"

2) The first sentence in the abstract (and in the introduction) to be changed from

   This document provides guidance on the deployment of the NFSv4
   protocols for the construction of an NFSv4 file name space in
   environments with multiple NFSv4 Domains.

to
   This document presents requirements on the deployment of the NFSv4
   protocols for the construction of an NFSv4 file name space in
   environments with multiple NFSv4 Domains. 

Another common area of comment concerned the “Stand-alone Examples" examples section 5 and "Stand-alone Examples and Multiple NFSv4 Domain Namespaces” section 8. These section describe "alternatives and differing scenarios” to highlight the need for the requirements described in section 6.

I addressed the example sections comments by adding clarifying text to each of these sections as well as moving the second section from 8 to section 7.

I have also addressed the remaining comments from Brian, Russ, Alexey Melnikov, and Kathleen Moriarty.

I’ll upload the new draft soon.

—>Andy