Subject: RE: [ipcdn] MTA MIB draft06 - pktcMtaDevProvKerbRealmName - object SYNTAX - AD Comment 31

From: "Eugene Nechamkin" <[email-masked]>
Date: Thu, 8 Sep 2005 17:09:42 -0700

A small editorial correction: instead of "pktcMtaDevKerberosRealm" in the
list of three MIB Objects below, the "pktcMtaDevCmsKerbRealmName" MIB Object
is meant to be.

Eugene.

-----Original Message-----
From: Jean-Francois Mule [mailto:[email-masked]] 
Sent: Thursday, September 08, 2005 6:23 AM
To: Randy Presuhn; [email-masked]; Ipcdn (E-mail)
Cc: Eugene Nechamkin
Subject: RE: [ipcdn] MTA MIB draft06 - pktcMtaDevProvKerbRealmName - object
SYNTAX - AD Comment 31

Same proposal applies to:
pktcMtaDevProvKerbRealmName
pktcMtaDevKerberosRealm
pktcMtaDevRealmName

Jean-François
> -----Original Message-----
> From: Jean-Francois Mule
> Sent: Thursday, September 08, 2005 7:23 AM
> To: 'Randy Presuhn'; Bert Wijnen ([email-masked]); Ipcdn (E-mail)
> Cc: Eugene Nechamkin ([email-masked])
> Subject: [ipcdn] MTA MIB draft06 - pktcMtaDevProvKerbRealmName - 
> object SYNTAX - AD Comment 31
> 
> Randy, Bert and all,
> 
> Looking for any ack/nack to close on this one.
> 
> To recap, Bert and Randy had raised the following question:
> 
> ----
> # Comment 31
> > - I wonder if for an object like pktcMtaDevProvKerbRealmName
> >   it is wise to use SnmpAdminString while the content MUST be
> >   uppercase ASCII ??
> 
> Proposed resolution:
> The Kerberos protocol (RFC1510, RFC4120) defines the RealmName to be 
> of ASN.1 type "GeneralString". This type has numerous interop problems 
> (RFC4120, section 5.2.1).
> The newer version of Kerberos protocol (RFC4120) requires that the 
> RealmName follows a new type "KerberosString" which effectively 
> constrains the value of the GeneralString to only contain characters 
> in IA5String.
>      KerberosString  ::= GeneralString (IA5String) The "IA5String" 
> type is defined in ISO/IEC646:1991 and also known as US-ASCII.
> Hence, based on the above analysis, "DisplayString" and 
> "SnmpAdminString" seem to be the closest mapping in SMI. The 
> co-authors are shared on whether to change the current SYNTAX from 
> SnmpAdminstring to DisplayString.
> 
> Any input on this?
> ----
> 
> In addition, Eugene provided additional comments:
> per description of the SnmpAdmninString TC:
>                  For information encoded in 7-bit US-ASCII,
>                  the UTF-8 encoding is identical to the
>                  US-ASCII encoding.
> 
> and I would like to underline one paragraph of the newest Kerberos 
> RFC, section 5.2.1.
>  " Future revisions to this protocol will almost certainly allow for a
>    more interoperable representation of principal names, probably
>    including UTF8String."
>              ^^^^^^^^^^
> 
> ==> Our preference is to not change the syntax, leave it 
> SnmpAdminString but add pointers to the newest Kerberos RFC.
> 
> 
> Current MIB object def:
> pktcMtaDevProvKerbRealmName  OBJECT-TYPE
>        SYNTAX      SnmpAdminString (SIZE(1..255))
>        MAX-ACCESS  read-only
>        STATUS      current
>        DESCRIPTION
>            " This object contains the name of the associated
>              provisioning Kerberos realm acquired during the MTA4
>              provisioning step (DHCP Ack) for SNMPv3 provisioning.
>              This object value is used as an index into the
>              pktcMtaDevRealmTable. The upper case ASCII representation
>              of the associated Kerberos realm name MUST be used by 
> both
>              the Manager (SNMP entity) and the MTA.
>              The Kerberos realm name for the Provisioning Server is
>              supplied to the MTA via DHCP option code 122 sub-option 6
>              as defined in RFC 3495. In secure SNMP provisioning mode
>              the value of the Kerberos realm name for the Provisioning
>              Server supplied in the MTA configuration file must match
>              the value supplied in the DHCP option code 122
>              sub-option 6. Otherwise the value of this object must
>              contain the value supplied in DHCP Option 122
>              sub-option 6."
>        REFERENCE
>            " PacketCable MTA Device Provisioning Specification;
>              RFC 3495, DHCP Option for CableLabs Client 
> Configuration."
>        ::= { pktcMtaDevServer 15 }
> 
> Proposed New MIB object def:
> pktcMtaDevProvKerbRealmName  OBJECT-TYPE
>        SYNTAX      SnmpAdminString (SIZE(1..255))
>        MAX-ACCESS  read-only
>        STATUS      current
>        DESCRIPTION
>            " This object contains the name of the associated
>              provisioning Kerberos realm acquired during the MTA4
>              provisioning step (DHCP Ack) for SNMPv3 provisioning.
>              This object value is used as an index into the
>              pktcMtaDevRealmTable. The upper case ASCII representation
>              of the associated Kerberos realm name MUST be used by 
> both
>              the Manager (SNMP entity) and the MTA. RFC 4120 sections
>              5.2.1 and 6.1 define Kerberos types and naming 
> constraints
>              for Kerberos Realm Names.
> 
>              The Kerberos realm name for the Provisioning Server is
>              supplied to the MTA via DHCP option code 122 sub-option 6
>              as defined in RFC 3495. In secure SNMP provisioning mode
>              the value of the Kerberos realm name for the Provisioning
>              Server supplied in the MTA configuration file must match
>              the value supplied in the DHCP option code 122
>              sub-option 6. Otherwise the value of this object must
>              contain the value supplied in DHCP Option 122
>              sub-option 6."
>        REFERENCE
>            " PacketCable MTA Device Provisioning Specification;
>              RFC 3495, DHCP Option for CableLabs Client Configuration.
>              RFC 4120, The Kerberos Network Authentication Service 
> (V5)"
>        ::= { pktcMtaDevServer 15 }
> 
> 
> Unless we hear from anyone, this will be in draft07.
> Jean-François
> 
> 
> 
> 
> 
> 
> > -----Original Message-----
> > From: Randy Presuhn [mailto:[email-masked]]
> > Sent: Tuesday, February 22, 2005 3:17 PM
> > To: Ipcdn (E-mail)
> > Subject: Re: [ipcdn] pktcMtaDevRealmName
> >
> > Hi -
> >
> > > From: "Jean-Francois Mule" <[email-masked]>
> > > To: "Randy Presuhn" <[email-masked]>; "Ipcdn (E-
> mail)"
> > <[email-masked]>
> > > Sent: Thursday, February 17, 2005 4:51 PM
> > > Subject: RE: [ipcdn] pktcMtaDevRealmName
> > ...
> > > > I think the use of SnmpAdminString for pktcMtaDevRealmName might 
> > > > need some more thought.  The language about "all capitals"
> > > > and search operations using upper-case ASCII doesn't mesh too 
> > > > well with SnmpAdminString.
> > > >
> > > > Whether it makes any sense at all will depend on whether 
> > > > Kerberos will ever permit realm names which are not upper-case 
> > > > ASCII.
> > >
> > >   How about changing the syntax to DisplayString?
> > >   This would address your point and align the mib object syntax
> with
> > the kerberos type.
> > ...
> >
> > This would be OK with me.  It wouldn't hurt to add some text to the 
> > BEHAVIOUR explaining that the kerberos type is limited to ASCII, so 
> > that well-meaning folks who want to help the cause of 
> > internationalization aren't led astray, and so that other MIB 
> > reviewers understand why it isn't SnmpAdminString.
> >
> > Randy
> >
> >
> >
> > _______________________________________________
> > IPCDN mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/ipcdn

_______________________________________________
IPCDN mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipcdn

---

From: "Eugene Nechamkin" <[email-masked]>
Date: Thu, 8 Sep 2005 17:16:43 -0700

Thomas, 

The sentence you pointed out must not be the part of description as the
RealmTable is not indexed by the pktcMtaDevRealmTable but by the
pktcMtaDevRealmIndex instead (as you mentioned).

This sentence must be deleted from the DESCRIPTION clause of the
pktcMtaDevProvKerbRealmName MIB Object.

Eugene.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Thomas Anders
Sent: Thursday, September 08, 2005 7:49 AM
To: [email-masked]
Subject: Re: [ipcdn] MTA MIB draft06 - pktcMtaDevProvKerbRealmName - object
SYNTAX - AD Comment 31

>>             This object value is used as an index into the
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>             pktcMtaDevRealmTable.
                ^^^^^^^^^^^^^^^^^^^^
Isn't pktcMtaDevRealmTable now indexed with pktcMtaDevRealmIndex instead??

    pktcMtaDevRealmEntry  OBJECT-TYPE
        SYNTAX      PktcMtaDevRealmEntry
        MAX-ACCESS  not-accessible
        STATUS      current
        DESCRIPTION
            " This table entry object lists the MTA security parameters
              for a single Kerberos realm. The conceptual rows MUST NOT
              persist across MTA reboots."
        INDEX { pktcMtaDevRealmIndex }

+Thomas

--
Thomas Anders (thomas.anders at blue-cable.de)