>>> If we're going with "[#RPKI Signature] address range MUST match [inetnum:
>>> followed to get here]", then there are probably a couple places that still
>>> talk about "covered by" that should catch up.
>>
>> don't find any
>>
>> what i did find is that i forgot to remove
>>
>> The address range of the signing certificate MUST cover all
>> - prefixes in the geofeed file it signs; and therefore must be
>> - covered by the range of the inetnum:.
>> + prefixes in the geofeed file it signs.
>
> ok.
>
> It looks like the thing in the diff that stuck out at me is actually for
> the unsigned case, and "covered by" is (AFAICT) the right semantics for
> that situation.
if it still itches, could i get a direct pointer?
> Having slept it over, I think the "IP address range [of "# RPKI
> Signature:"/"# End Signature"] must match the inetnum: URL followed to get
> to the file" is a good choice and helps identify the intended semantics
> (though, of course, is not itself covered by the signature).
consider yourself lucky to have missed the dozen messages where we went
down this rathole.
> I think we still need to update the example to show how to represent a
> non-CIDR range, though. (I think, from the previous discussion, we
> wanted the "RPKI Signature" line to have a starting address and the
> "End Signature" line to have an ending address, but could be
> misremembering.)
uh, i think it would be
# RPKI Signature: 192.0.2.0 - 192.0.2.255
# MIIGlwYJKoZIhvcNAQcCoIIGiDCCBoQCAQMxDTALBglghkgBZQMEAgEwDQYLKoZ
# IhvcNAQkQAS+gggSxMIIErTCCA5WgAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu
...
# imwYkXpiMxw44EZqDjl36MiWsRDLdgoijBBcGbibwyAfGeR46k5raZCGvxG+4xa
# O8PDTxTfIYwAnBjRBKAqAZ7yX5xHfm58jUXsZJ7Ileq1S7G6Kk=
# End Signature: 192.0.2.0 - 192.0.2.255
change made in my emacs buffer
> P.S. I am impressed by the (apparent) automation to re-generate the
> certificate (and example) at the time of building the document!
no comment
randy
_______________________________________________
OPSAWG mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/opsawg
