On Tue, May 25, 2021 at 08:18:06PM -0700, Randy Bush wrote: > >>> If we're going with "[#RPKI Signature] address range MUST match [inetnum: > >>> followed to get here]", then there are probably a couple places that still > >>> talk about "covered by" that should catch up. > >> > >> don't find any > >> > >> what i did find is that i forgot to remove > >> > >> The address range of the signing certificate MUST cover all > >> - prefixes in the geofeed file it signs; and therefore must be > >> - covered by the range of the inetnum:. > >> + prefixes in the geofeed file it signs. > > > > ok. > > > > It looks like the thing in the diff that stuck out at me is actually for > > the unsigned case, and "covered by" is (AFAICT) the right semantics for > > that situation. > > if it still itches, could i get a direct pointer?
Sorry, I wasn't clear -- it *doesn't* itch anymore, now that I actually read it. There's nothing to change. > > Having slept it over, I think the "IP address range [of "# RPKI > > Signature:"/"# End Signature"] must match the inetnum: URL followed to get > > to the file" is a good choice and helps identify the intended semantics > > (though, of course, is not itself covered by the signature). > > consider yourself lucky to have missed the dozen messages where we went > down this rathole. > > > I think we still need to update the example to show how to represent a > > non-CIDR range, though. (I think, from the previous discussion, we > > wanted the "RPKI Signature" line to have a starting address and the > > "End Signature" line to have an ending address, but could be > > misremembering.) > > uh, i think it would be > > # RPKI Signature: 192.0.2.0 - 192.0.2.255 > # MIIGlwYJKoZIhvcNAQcCoIIGiDCCBoQCAQMxDTALBglghkgBZQMEAgEwDQYLKoZ > # IhvcNAQkQAS+gggSxMIIErTCCA5WgAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu > ... > # imwYkXpiMxw44EZqDjl36MiWsRDLdgoijBBcGbibwyAfGeR46k5raZCGvxG+4xa > # O8PDTxTfIYwAnBjRBKAqAZ7yX5xHfm58jUXsZJ7Ileq1S7G6Kk= > # End Signature: 192.0.2.0 - 192.0.2.255 > > change made in my emacs buffer Okay, I think that works fine. -Ben > > P.S. I am impressed by the (apparent) automation to re-generate the > > certificate (and example) at the time of building the document! > > no comment > > randy _______________________________________________ OPSAWG mailing list [email protected] https://www.ietf.org/mailman/listinfo/opsawg
