Subject: [lamps] The LAMPS WG has placed draft-hoffman-andrews-caa-simplification in state "Candidate for WG Adoption"

From: IETF Secretariat <[email-masked]>
Date: Sat, 24 Feb 2018 11:26:36 -0800

The LAMPS WG has placed draft-hoffman-andrews-caa-simplification in state
Candidate for WG Adoption (entered by Russ Housley)

The document is available at
https://datatracker.ietf.org/doc/draft-hoffman-andrews-caa-simplification/

Comment:
Should this document be adopted by the LAMPS WG as the starting point for
rfc6844bis?

---

From: Tim Hollebeek <[email-masked]>
Date: Mon, 26 Feb 2018 14:46:29 +0000

This document contains many useful improvements.

On the subject of blocked queries and responses, the proposed text is
excellent.  It doesn't actually fix anything (just adds a SHOULD and some
informative text and guidance), but it does point out some of the challenges
in this area, and will be helpful in convincing the CA/B Forum that the
current BR CAA error handling requirements are impractical in the world as
it exists today, and need to be revised.  The policy discussion will be much
easier with the documented, specific examples of why the current failure
handling rules cause a lot of pain for people trying to get certificates.
Perhaps it would be worthwhile adding text to clarify that these sorts of
failure can prevent issuance of certificates, even for domains that don't
use and don't want to use CAA.  When CAA was originally being sold, it was
claimed that if people didn't want to use it, they wouldn't be affected, and
that has turned out to be very, very far from the truth.

The draft unfortunately prioritizes a few issues (the CNAME issues and
blocked queries), while ignoring some more critical issues, like the fact
that the RFC 6844 grammar contradicts the examples.  Corey had an excellent
proposed fix for this issue.  It should probably be incorporated.

-Tim

> -----Original Message-----
> From: Spasm [mailto:[email-masked]] On Behalf Of IETF Secretariat
> Sent: Saturday, February 24, 2018 12:27 PM
> To: [email-masked]; [email-masked]; draft-hoffman-andrews-caa-
> [email-masked]
> Subject: [lamps] The LAMPS WG has placed draft-hoffman-andrews-caa-
> simplification in state "Candidate for WG Adoption"
> 
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Mon, 26 Feb 2018 11:04:50 -0800

On 02/26/2018 06:46 AM, Tim Hollebeek wrote:
> the RFC 6844 grammar contradicts the examples.  Corey had an excellent
I tried to incorporate changes based on the thread Corey started, but
wound up deciding it was better to have something to adopt sooner rather
than later. Definitely happy to continue to work on those changes in
parallel with the call for adoption. Assuming the draft gets adopted as
a WG work product, it's easy enough to land the changes on the WG draft.

---

From: Tim Hollebeek <[email-masked]>
Date: Mon, 26 Feb 2018 21:01:50 +0000

Ok.  I just want to make sure it gets in soon.  Having a grammar that's
incorrect
is a pretty serious issue.  Corey and I can help support the effort if that
helps
keep things moving.

I'd support getting RFC 6844bis out on an expedited timeline, since some of
the
errors in RFC 6844 are so serious.  If we end up with a RFC6844bisbis later,
so be it.

-Tim

> From: Jacob Hoffman-Andrews [mailto:[email-masked]]
> Sent: Monday, February 26, 2018 12:05 PM
> To: Tim Hollebeek <[email-masked]>; IETF Secretariat <ietf-
> [email-masked]>; [email-masked]; [email-masked]; draft-
> [email-masked]
> Subject: Re: [lamps] The LAMPS WG has placed draft-hoffman-andrews-caa-
wound up
> deciding it was better to have something to adopt sooner rather than
later.
> Definitely happy to continue to work on those changes in parallel with the
call
> for adoption. Assuming the draft gets adopted as a WG work product, it's
easy
> enough to land the changes on the WG draft.

---

From: Corey Bonnell <[email-masked]>
Date: Tue, 27 Feb 2018 20:20:19 +0000

Hi Jacob,
I have a few minor changes I'd like to make to the grammar I proposed a few months ago, namely to add support for whitespace surrounding the equals sign in parameter tag/value pairs as well as to allow for hyphens to appear in parameter tags (this is necessary to support the parameter names proposed in https://tools.ietf.org/html/draft-ietf-acme-caa-03):

issuevalue = *WSP [domain] *WSP [";" *WSP [parameters] *WSP]

domain = label *("." label)
label = (ALPHA / DIGIT) *( *("-") (ALPHA / DIGIT))

parameters = (parameter *WSP “;” *WSP parameters) / parameter
parameter = tag *WSP "=" *WSP value
tag = (ALPHA / DIGIT) *( *("-") (ALPHA / DIGIT))
value = *(%x21-3A / %x3C-7E)

I used the same production rule value for "tag" that currently exists for "label" to allow for hyphens in the parameter tag, but didn't combine them so that we can continue to use the descriptive rule names of "tag" and "label" as opposed to something potentially confusing like "tag-or-label".

For the purposes of getting this incorporated into RFC 6844-bis (or RFC 6844-bis-bis), should I create an erratum, or is this email sufficient?

Thanks,
Corey

On 2/26/18, 2:04 PM, "Spasm on behalf of Jacob Hoffman-Andrews" <[email-masked] on behalf of [email-masked]> wrote:

    _______________________________________________
    Spasm mailing list
    [email-masked]
    https://scanmail.trustwave.com/?c=4062&d=2NqU2pDGsMarVBeRjdNh5mhb8N_iwA-esZb_hxFN5Q&s=5&u=https%3a%2f%2fwww%2eietf%2eorg%2fmailman%2flistinfo%2fspasm

---

From: Russ Housley <[email-masked]>
Date: Tue, 27 Feb 2018 16:07:05 -0500

Playing with BAP (on tools.ietf.org <http://tools.ietf.org/>) I see a few improvements in the ABNF.
I did not try to change the syntax in any way.

Russ

= = = = = = 

issuevalue = *WSP [domain] *WSP [";" *WSP [parameters *WSP]]

domain = label *("." label)
label = (ALPHA / DIGIT) *( *"-" (ALPHA / DIGIT))

parameters = parameter *WSP ";" *WSP parameters / parameter
parameter = tag *WSP "=" *WSP value
tag = (ALPHA / DIGIT) *( *"-" (ALPHA / DIGIT))
value = *(%x21-3A / %x3C-7E)

> On Feb 27, 2018, at 3:20 PM, Corey Bonnell <[email-masked]> wrote:
> 
> Hi Jacob,

---

From: Russ Housley <[email-masked]>
Date: Tue, 27 Feb 2018 16:17:02 -0500

Many years ago, Tony Finch offered a slightly different ABNF definition for domain:

https://www.ietf.org/mail-archive/web/ietf-smtp/current/msg01490.html <https://www.ietf.org/mail-archive/web/ietf-smtp/current/msg01490.html>

Russ

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Tue, 27 Feb 2018 14:59:29 -0800

> For the purposes of getting this incorporated into RFC 6844-bis (or RFC 6844-bis-bis), should I create an erratum, or is this email sufficient?
This email is sufficient, thanks.