Subject: Re: [NSIS] Getting started on NSIS extensibilty draft

From: Elwyn Davies <[email-masked]>
Date: Wed, 04 Mar 2009 00:55:22 +0000

I am working on this and should have a new version out tomorrow.

It appears to me that interception classes could benefit from an IANA
registry since they need to be common across multiple imstantiations,
although it is not strictly necessary as they never appear on the wire
and are only used to communicate acros the API to GIST locally in each
router.  I guess we can do without but it might be good to ad a sentence
to GIST to the effect that a registry is not needed.

/Elwym

Martin Stiemerling wrote:
> Hi,
>
> We need especially fulfil the dependency of the GIST draft mentioned in Section 5.3.2.5.  Q-Mode Interception Extensibility of GIST. 
>
> The text there says:
> Guidelines on defining  interception classes are given in [13].
>
> Where [13] is the extensibility document.
>
>    Martin 
>
> [email-masked]
>
> NEC Laboratories Europe - Network Research Division
> NEC Europe Limited | Registered Office: NEC House, 1 Victoria Road, London W3 6BL | Registered in England 2832014 
>
>   
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On Behalf Of
>> Jukka MJ Manner
>> Sent: Friday, February 20, 2009 1:02 PM
>> To: NSIS Working Group
>> Subject: Re: [NSIS] Getting started on NSIS extensibilty draft
>>
>>
>> Dear all,
>>
>> We would really need feedback to this draft to finalize it. I would
>> like
>> to issue a WGLC very soon, thus, one round of comments would be good to
>> have before that.
>>
>> Alternatively, we can also issue a WGLC now, and discuss the comments
>> in
>> SF. Still, I'd rather see one round of comments before a WGLC.
>>
>> Regards,
>> Jukka
>>
>> On Wed, 4 Feb 2009, Elwyn Davies wrote:
>>
>>     
>>> Hi, Magnus.
>>>
>>> At the last IETF you offered to provide me some guidance on the way
>>> forward with this document.
>>>
>>> Since as I understand it, the IESG wants to see this document at the
>>> same time as GIST this is urgent.
>>>
>>> The only suggestion I have stemming from comments at the meeting is
>>>       
>> to
>>     
>>> 'separate the rules and guidelines.'
>>>
>>> Any input gratefully received.
>>> In the meantime I will try to make a 'null' update just to change the
>>> title.
>>>
>>> Regards,
>>> Elwyn
>>>
>>> Martin Stiemerling wrote:
>>>       
>>>> The new file name should basically read this way (copy'n'paste
>>>>         
>> error):
>>     
>>>> draft-ietf-nsis-ext-00.txt.
>>>>
>>>> Thanks to Hannes for pointing this
>>>>
>>>>  Martin
>>>>
>>>> [email-masked]
>>>>
>>>> NEC Laboratories Europe - Network Research Division
>>>> NEC Europe Limited | Registered Office: NEC House, 1 Victoria Road,
>>>>         
>> London W3 6BL | Registered in England 2832014
>>     
>>>>         
>>>>> -----Original Message-----
>>>>> From: [email-masked] [mailto:[email-masked]] On
>>>>>           
>> Behalf Of
>>     
>>>>> Martin Stiemerling
>>>>> Sent: Monday, January 26, 2009 3:05 PM
>>>>> To: [email-masked]
>>>>> Subject: [NSIS] Getting started on NSIS extensibilty draft
>>>>>
>>>>> Dear all,
>>>>>
>>>>> We have a draft to be completed urgently :)
>>>>>
>>>>> Using and Extending the NSIS Protocol Family
>>>>> draft-nsis-ext-02.txt
>>>>>
>>>>> http://tools.ietf.org/html/draft-nsis-ext-02
>>>>>
>>>>>
>>>>> First thing to do is changing the file name to draft-ietf-nsis-
>>>>>           
>> ext-
>>     
>>>>> 02.txt.
>>>>>
>>>>> Please review it and send your comments.
>>>>>
>>>>>  Martin
>>>>>
>>>>>
>>>>> [email-masked]
>>>>>
>>>>> NEC Laboratories Europe - Network Research Division
>>>>> NEC Europe Limited | Registered Office: NEC House, 1 Victoria
>>>>>           
>> Road,
>>     
>>>>> London W3 6BL | Registered in England 2832014
>>>>>
>>>>> _______________________________________________
>>>>> nsis mailing list
>>>>> [email-masked]
>>>>> https://www.ietf.org/mailman/listinfo/nsis
>>>>>
>>>>>           
>>>> _______________________________________________
>>>> nsis mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/nsis
>>>>
>>>>
>>>>         
>>> _______________________________________________
>>> nsis mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/nsis
>>>
>>>       
>> _______________________________________________
>> nsis mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/nsis
>>     
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nsis
>
>

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 4 Mar 2009 20:13:56 +0200

Hi Elwyn, 

Thanks for the draft update. 

The changes look good to me. Only a minor comment:

7. Security Features

   Basic security functions are provided at the GIST layer, e.g.,
   protection against some blind or denial-of-service attacks.

These security features are available with the the path-coupled MRM in the
GIST specification. 
Other MRMs might provide different security features. 

   Conceptually it is difficult to protect against on-path attacker and
   man-in-the-middle attacks, because a basic functionality of GIST is
   to discover yet unknown signaling peers.

This is also only true for the path-coupled MRM. 

   While GIST is handling authentication of peer nodes, more fine

... and basic authorization 

   grained authentication may be required in the NSLP protocols.
          
s/authentication/authorization

  There
   is currently an ongoing work to specify common authorization
   mechanisms to be used in NSLP protocols [I-D.manner-nsis-nslp-auth],
   thus allowing, e.g., per-user and per-service authorization.

Ciao
Hannes

>Behalf Of Elwyn Davies
>Sent: 04 March, 2009 02:55
>To: Martin Stiemerling
>Cc: [email-masked]
>It appears to me that interception classes could benefit from 
>an IANA registry since they need to be common across multiple 
>imstantiations, although it is not strictly necessary as they 
>never appear on the wire and are only used to communicate 
>acros the API to GIST locally in each router.  I guess we can 
>do without but it might be good to ad a sentence to GIST to 
>the effect that a registry is not needed.
>
>/Elwym
>
>> We need especially fulfil the dependency of the GIST draft 
>mentioned in Section 5.3.2.5.  Q-Mode Interception 
>Extensibility of GIST. 
>>
>> The text there says:
>> NEC Laboratories Europe - Network Research Division NEC 
>Europe Limited 
>> | Registered Office: NEC House, 1 Victoria Road, London W3 6BL | 
>> Registered in England 2832014
>>
>>   
>>> From: [email-masked] [mailto:[email-masked]] 
>On Behalf 
>>> Of Jukka MJ Manner
>>> like to issue a WGLC very soon, thus, one round of comments 
>would be 
>>> good to have before that.
>>>
>>> in SF. Still, I'd rather see one round of comments before a WGLC.
>>>
>>> Regards,
>>> Jukka
>>>
>>>> In the meantime I will try to make a 'null' update just to change 
>>>> the title.
>>>>
>>>> Regards,
>>>> Elwyn
>>>>
>>>>> NEC Laboratories Europe - Network Research Division NEC Europe 
>>>>> Limited | Registered Office: NEC House, 1 Victoria Road,
>>>>>         
>>>>>> NEC Laboratories Europe - Network Research Division NEC Europe 
>>>>>> Limited | Registered Office: NEC House, 1 Victoria
>>>>>>           
>>> Road,
>>>