Subject: [sidr] [Editorial Errata Reported] RFC6487 (5187)

From: RFC Errata System <[email-masked]>
Date: Tue, 28 Nov 2017 01:04:11 -0800 (PST)

The following errata report has been submitted for RFC6487,
"A Profile for X.509 PKIX Resource Certificates".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5187

--------------------------------------
Type: Editorial
Reported by: Nikolai Malykh <[email-masked]>

Section: 7.1

Original Text
-------------
      encompass
         Given two IP address and AS number sets, X and Y, X
         "encompasses" Y if, for every contiguous range of IP addresses
         or AS numbers elements in set Y, the range element is either
         "more specific" than or "equal" to a contiguous range element
         within the set X.

Corrected Text
--------------
      encompass
         Given two IP address or two AS number sets, X and Y, X
         "encompasses" Y if, for every contiguous range of IP addresses
         or AS numbers elements in set Y, the range element is either
         "more specific" than or "equal" to a contiguous range element
         within the set X.

Notes
-----

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6487 (draft-ietf-sidr-res-certs-22)
--------------------------------------
Title               : A Profile for X.509 PKIX Resource Certificates
Publication Date    : February 2012
Author(s)           : G. Huston, G. Michaelson, R. Loomans
Category            : PROPOSED STANDARD
Source              : Secure Inter-Domain Routing
Area                : Routing
Stream              : IETF
Verifying Party     : IESG

---

From: Geoff Huston <[email-masked]>
Date: Tue, 28 Nov 2017 21:01:33 +1100

Reject - in the context of resource certificates the resources may contain
both IP addresses _AND_ AS numbers. 

> On 28 Nov 2017, at 8:04 pm, RFC Errata System <[email-masked]> wrote:
>

---

From: Nikolai Malykh <[email-masked]>
Date: Tue, 28 Nov 2017 13:30:19 +0300

May but not must.
What about certificate that contain IP address set only OR AS number set
only (not both)?

---

From: Randy Bush <[email-masked]>
Date: Tue, 28 Nov 2017 21:17:34 +0900

> What about certificate that contain IP address set only OR AS number set

s/and/or/ seems formally correct, albeit a bit nitty

---

From: Geoff Huston <[email-masked]>
Date: Wed, 29 Nov 2017 05:47:37 +1100

the set may be empty - still reject

> On 28 Nov 2017, at 9:30 pm, Nikolai Malykh <[email-masked]> wrote:
> 
> May but not must.
> What about certificate that contain IP address set only OR AS number set only (not both)?
>

---

From: Randy Bush <[email-masked]>
Date: Wed, 29 Nov 2017 10:16:20 +0900

> the set may be empty - still reject

that is orthogonal.  if you think the syntax even allows it, the text
should handle the null set or sets.  you may wish to read

4.8.10.  IP Resources

   Either the IP Resources extension, or the AS Resources extension, or
   both, MUST be present in all RPKI certificates, and if present, MUST
   be marked critical.

   This extension contains the list of IP address resources as per
   [RFC3779].  The value may specify the "inherit" element for a
   particular Address Family Identifier (AFI) value.  In the context of
   resource certificates describing public number resources for use in
   the public Internet, the Subsequent AFI (SAFI) value MUST NOT be
   used.

   This extension MUST either specify a non-empty set of IP address
   records, or use the "inherit" setting to indicate that the IP address
   resource set of this certificate is inherited from that of the
   certificate's issuer.

---

From: "t.petch" <[email-masked]>
Date: Thu, 30 Nov 2017 12:18:29 -0000

----- Original Message -----
From: "Geoff Huston" <[email-masked]>
Sent: Tuesday, November 28, 2017 10:01 AM
> both IP addresses _AND_ AS numbers.

Precisely; it is a 'may' whereas the current text

"Given two IP address and AS number sets,"

has overtones of requiring both to be present.  The later phrase,
"for every contiguous range of IP addresses or AS numbers elements in
set Y,"
does imply one or the other or both, so I am on the side of 'Accept'.

Note, too, that the two earlier definitions, ' more specific' and
'equal', both say

"        Given two contiguous IP address ranges or two contiguous AS
         number ranges,  ..."

Why should 'encompass' be different?

Tom Petch

> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr