Subject: [Tools-discuss] I-D submission tool

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 2 Jul 2013 18:21:52 +0100

Hello tools people,

Is there a filter on who can post a new revision of an I-D?

Can an AD post an I-D without being an author?
Can a new author add herself to an I-D and post a new revision?

Many thanks,
Adrian

---

From: Martin Thomson <[email-masked]>
Date: Tue, 2 Jul 2013 10:32:03 -0700

> Can a new author add herself to an I-D and post a new revision?

I have done this myself, yes.  (And yes, it was legitimate, not an attack.)

It's a security vulnerability: anyone with an email address and 5
minutes can provide a new version of any draft.

The automatic process permits anyone who appears as an author in the
draft to post, as long as they are able to receive email at the
identified address.    As far as I am aware, the only restrictions are
that it pass idnits and increment the number by one.  There are no
author-continuity conditions or anything like that, from what I've
seen.  draft-ietf-* drafts don't appear to have any special
protection, with the exception of new (-00) drafts, which require
chair approval.

Manual posting might be possible (the AD posting without being an
author), but the secretariat probably see those.

--Martin

p.s., Refraining from doing this has taken some willpower.  I know a
few drafts that could use some "improvement".

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 02 Jul 2013 19:54:56 +0200

Hi Adrian,

> Is there a filter on who can post a new revision of an I-D?

Yes.

> Can an AD post an I-D without being an author?

Anybody can upload a draft, but (for non-00 drafts) only the authors
of the previous version (and the wg chairs for wg documents) will get
the verification emails, and be able to confirm the posting.

The spec (RFC 4228) says the following, but the /c group of requirements
have not been uniformly implemented:

   The following possible expected submitters are identified by the
   Toolset, without any Secretariat intervention:

      For version 00 of a draft, any submitter (R119/a).
      For version N+1 of a draft, an author of version N of the same
      draft (R120/a).  This requirement only needs to be satisfied for
      drafts for which Nth version was posted using the Toolset; other
      drafts may not have the meta-information available that is
      required to reliably get a list of authors.
      For a WGN draft, a Chair of the corresponding WG (R121/b).
      For any draft, an IESG member (R122/c).

> Can a new author add herself to an I-D and post a new revision?

She can upload, but one of the current authors will have to confirm the
posting.  The secretariat can always expedite a new posting, however.

There's a recent bug filed on the fact that when somebody tries to
add themselves and post, there's no message about the confirmation emails
only going to the authors of the previous version -- there should be,
and I'll try to get that addressed during next week.

Best regards,

	Henrik

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 02 Jul 2013 19:58:39 +0200

Hi Martin,

> minutes can provide a new version of any draft.

This was indeed the case until the deployment of version 4.44, around
2013-04-16.  It is not the case any more. The commit which changed this
was 5650:

  http://wiki.tools.ietf.org/tools/ietfdb/changeset/5650/trunk

Best regards,

	Henrik

> _______________________________________________
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss
>

---

From: Martin Thomson <[email-masked]>
Date: Tue, 2 Jul 2013 11:09:27 -0700

> 2013-04-16.  It is not the case any more. The commit which changed this

Oh well, I'm disappointed that I wont be able to exploit that any more.

What you have is a pragmatic solution.  I'm glad that you're improving
transparency, but that's secondary.