Subject: [mpls] Benoit Claise's Discuss on draft-ietf-mpls-tp-oam-id-mib-09: (with DISCUSS and COMMENT)

From: "Benoit Claise" <[email-masked]>
Date: Wed, 02 Sep 2015 23:59:02 -0700

Benoit Claise has entered the following ballot position for
draft-ietf-mpls-tp-oam-id-mib-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-mpls-tp-oam-id-mib/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Based on the feedback of the security AD, the security guidelines for the
IETF MIB modules
(http://trac.tools.ietf.org/area/ops/trac/wiki/mib-security) have been
changed 9 months ago.
The exact change at
http://trac.tools.ietf.org/area/ops/trac/wiki/mib-security?action=diff&version=7&old_version=6

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

The MIB doctor latest review from Joan Cucchiara:

My comments (which I made to the authors also about Feb 28, 2015) was
about these warnings:
Warning with SMICNG compiler:

W: f(MPLS-TP-OAM-MIB.my), (883,22) MIN-ACCESS value identical to access
specified for "mplsOamIdMegOperStatus"
W: f(MPLS-TP-OAM-MIB.my), (888,22) MIN-ACCESS value identical to access
specified for "mplsOamIdMegSubOperStatus"

Yes, these are just warnings, but they are easily fixable and I believe
the authors agreed to fix these warnings during the AD review process
(that would be you 

Other than these warnings, the MIB is fine with me to go forward.

---

From: Venkatesan Mahalingam <[email-masked]>
Date: Thu, 3 Sep 2015 11:01:22 -0700

Hi Benoit and Joan,

We will publish the next version with the below changes in the security
section, hope this is fine.

OLD

Section-8

   There are number of management objects defined in this MIB module
   with a MAX-ACCESS clause of read-create. Such objects may be
   considered sensitive or vulnerable in some network environments.
   The support for SET operations in a non-secure environment
   *without proper protection can have negative effect on network
   operations.*

NEW

Section-8

There are number of management objects defined in this MIB module
   with a MAX-ACCESS clause of read-create. Such objects may be
   considered sensitive or vulnerable in some network environments.
   The support for SET operations in a non-secure environment without
proper protection opens devices to attack.

  Regd, Joan's comments, I dont see any reported warnings on version 09,

Joan: If you could quickly verify the compilation on version 09 and
confirm, if would be of great help as IESG approval is pending for this
draft.

timeout 10 smilint -s -e -l 6 mibs/MPLS-OAM-ID-STD-MIB 2>report.txt

While processing your request the following errors and/or warnings have
been found:

mibs/MPLS-OAM-ID-STD-MIB:83: [2] {object-identifier-not-prefix} Object
identifier element `xxx' name only allowed as first element
mibs/MPLS-OAM-ID-STD-MIB:23: [2] {module-identity-registration}
illegal module identity registration

-Venkat.

---

From: Venkatesan Mahalingam <[email-masked]>
Date: Tue, 8 Sep 2015 08:33:45 -0700

Dear Benoit,

I've addressed all your comments and published the new version 10, please
take look.

-Venkat.

On Thu, Sep 3, 2015 at 11:01 AM, Venkatesan Mahalingam <
[email-masked]> wrote:

>    The support for SET operations in a non-secure environment without proper protection opens devices to attack.
>
> mibs/MPLS-OAM-ID-STD-MIB:83: [2] {object-identifier-not-prefix} Object identifier element `xxx' name only allowed as first element
> mibs/MPLS-OAM-ID-STD-MIB:23: [2] {module-identity-registration} illegal module identity registration
>
>
> -Venkat.
>