Ballot for draft-ietf-cdni-edge-control-metadata
Discuss
Yes
No Objection
No Record
Summary: Has 2 DISCUSSes. Has enough positions to pass once DISCUSS positions are resolved.
I have three DISCUSS items that I would like some discussion around. Two of them should be easy to fix, and Chris has already brought up the third one. Primarily, they are around normative use of a living standard, mention of FCI, and a naming inconsistency that would affect the IANA registry. Section 3.1, paragraph 1 > Cross-origin resource sharing (CORS) is a protocol that allows a HTTP > client application to access restricted resources from a server on a > domain different from the domain that served the original request. > It is defined by the Web Hypertext Application Technology Working > Group (WHATWG) Fetch Living Standard [WHATWG-FETCH]. This section and the following section make multiple normative (section specific and definitional) references to [WHATWG-FETCH]. Despite this, [WHATWG-FETCH] is listed as an Informative Reference (Section 10). A reference that defines the semantics of the protocol being specified cannot be informative. It must be Normative, as Chris points out, whose DISCUSS position, I support. However, moving it to Normative creates a second problem: WHATWG-FETCH is a living standard with no fixed version or stable section numbers. The section numbers cited in this document (3.1, 3.2.2, 3.3.2) may change without notice. RFC Editor policy discourages normative references to undated living standards because they can silently change the meaning of a published RFC. The authors must either: (a) identify a stable, dated snapshot of the Fetch Standard that can be cited with stable section numbers, or (b) replace the normative dependencies on WHATWG-FETCH with equivalent references to RFC 6454 (The Web Origin Concept) and RFC 9110 for those definitions covered by published standards. The GENART reviewer (thanks, Elwyn Davies) recommended adding RFC 6454 precisely to address the Origin header ambiguity. Section 3.3.2, paragraph 1 > 3.3.2. MI.AccessControlHeaders > > The MI.AccessControlAllowHeaders object has the following properties: There is a naming inconsistency here between the Section title, the body of the section, and the IANA registration request. These are two different names. The IANA table in Section 7 registers the payload type as MI.AccessControlHeaders. The IANA subsection 7.1.5 refers to it as MI.AccessControlHeaders. But this section's body uses MI.AccessControlAllowHeaders. Can this be fixed? Section 6, paragraph 0 > The FCI and MI objects defined in this document are transferred via > the interfaces defined in CDNI [RFC8006] which describes how to > secure these interfaces by protecting integrity and confidentiality > while ensuring the authenticity of the dCDN and uCDN. This document does not define any FCI (Footprint and Capability Advertisement) objects. It defines only MI (Metadata Interface) objects. However, the IANA subsections (7.1.1–7.1.5) each say Interface: MI/FCI, suggesting the payload types can also be used for capability advertisement. If these payload types are intended for FCI use as well, the document should explain how and include any FCI-specific behavior. If they are MI-only, the IANA entries should say Interface: MI and Section 6 should not reference FCI.
Section 2, paragraph 0 > The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", > "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this > document are to be interpreted as described in [RFC2119]. This section cites only RFC 2119 for the BCP 14 keywords boilerplate. Per current IETF practice, RFC 8174 must also be cited. The standard boilerplate reads: "...described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals..." Section 3, paragraph 0 > 3. MI.CrossoriginPolicy The document references the Origin HTTP request header extensively in this section but never cites RFC 6454 ("The Web Origin Concept"), which is the IETF-standards-track definition of the Origin header. Regardless of how the WHATWG-FETCH dependency is resolved, RFC 6454 should be cited when the Origin header is introduced. The GENART reviewer (Elwyn Davies, thanks, Elwyn) made this recommendation. Section 4, paragraph 5 > * Description: If set to "true", the dCDN SHOULD try to compress the > response to the client based on the Accept-Encoding request header > and its available capabilities. In case is not able to do the > compression, the content will be delivered uncompressed. The normative SHOULD implies that a dCDN may choose not to compress even when instructed. But the fallback text says compression failure still delivers the content. This creates an ambiguity: is the SHOULD a soft recommendation that a dCDN can always ignore (rendering the flag meaningless), or does it mean "try compression, but failure is permissible"? If the intent is the latter, the language should be "the dCDN MUST attempt to compress the response... and MUST deliver the content uncompressed if compression is not possible." The grammar error (s/In case is not able/In case it is not able) should also be corrected. Section 5, paragraph 0 > Configuration metadata is required to define how connections to a > client are maintained by a dCDN. In some use cases, like video > streaming or other critical object delivery, UA applications' > connection to the cache server must be managed to ensure the best > possible user experience. This metadata allows a uCDN to accommodate > device-specific constraints and performance optimization. A dCDN can > also benefit from this configuration metadata to meet its security > and resource consumption requirements. The section's description says it is about "how connections to a client are maintained, and mentions "connection setup" in Section 5.1 example caption, yet the only property defined is a keep-alive timeout. If the scope was intentionally limited to just this one property, a brief note explaining what was out of scope would prevent implementers from assuming other connection parameters (e.g., initial connection timeout, maximum connections) are implicitly configurable.
Hi Alfonso and Glenn, Thank you for the effort put into this document. Thank you to Sure Hares for the OPSDIR. The review is still to be addressed. Looking forward addressing those comments per the recent note from Alfonso [1]. # Missing a reference to rfc6707 Several concepts in this document were defined in rfc6707 (metadata, upstream CDN, downstream CDN, etc.). Please add a mention that the document uses the terminology in rfc6707. # What about retrieval? The document reasons about “configuring”, “setting”, etc. But what about retrieval of default behaviors? Such means are needed to detect anormal behaviors and adjust the behavior accordingly. Please consider adding a pointer to an existing spec to covers such aspects if such spec exists. If not, please consider adding an Operational Considerations Section that discusses the need to have such means and also to monitor the configuration in place. This is important to interop but also to detect misuse between *CDNs. As I’m there, what are the guards in place to ensure that the configuration in place operates as expected? How that is monitored? # CORS CURRENT: It is defined by the Web Hypertext Application Technology Working Group (WHATWG) Fetch Living Standard [WHATWG-FETCH]. … MI.CrossoriginPolicy is a GenericMetadata object that allows configuring dynamically generated CORS headers. [WHATWG-FETCH] should be listed as normative.
# Extensions: Need and Integration in the CDNI System I hesitated to list this as as DISCUSS because I do think this is important to assess the technical contribution and help understanding how the extensions can be integrated in an existing CDNI system. There current introduction and section 3 are short in explaining how the new extension graft to existing CNDI component. Also, an explanation about the reasoning behind the set of required capabilities and how these capabilities are mapped to individual objects would strengthen the specification. # Maybe cite rfc6454 in the following CURRENT: While this transition is necessary for delivery, many User Agents apply strict 'same-origin' security restrictions to these network requests, which can block the content unless specific access rules are defined. # More than two situations can occur: e.g., target resource may not exist at the first place I suggest: OLD: Two situations can occur when one or more CDNs are involved in processing these requests: NEW: At least, two situations can occur when one or more CDNs are involved in processing these requests: # out of context CURRENT: The dynamic generation of CORS headers is typical in modern HTTP request processing and avoids forwarding CORS headers to the uCDN, thereby reducing the load between dCDN and uCDN when the content to be delivered is already cached in the dCDN. uCDN and dCDN are mentioned here while I don’t think it is true to say that there is always more than one CDN involved in the processing. The assumptions should be stated clearly. Also, these are introduced while CDNI arch is not introduced first. # Inadequate use of normative language: s/MUST/must CURRENT: The CDN Interconnection (CDNI) metadata model requires extensions to permit a uCDN to declare how a dCDN MUST evaluate and dynamically generate the necessary CORS response headers, avoiding the forwarding of CORS requests and/or preflight requests to the uCDN. # (Lack of) Clarity again CURRENT: Required capabilities: Capabilities of which entities? Which system components? Cheers, Med [1] https://mailarchive.ietf.org/arch/msg/ops-dir/oKvfnrMJAU6Bn49ufTLmPa7Yj6g/
I would like to thank Elwyn D. for his comprehensive GENART review. Elwyn has good suggestions beyond the one I will make in my comments in ways to strengthen the document further. I believe this one issue is worth calling out a second time: * Please expand the acronym (or make positive reference to RFC8006) to explain `uCDN` and `dCDN` > 140 The dynamic generation of CORS headers is typical in modern HTTP > 141 request processing and avoids forwarding CORS headers to the uCDN, > 142 thereby reducing the load between dCDN and uCDN when the content to > 143 be delivered is already cached in the dCDN. Thanks for the updates to address my discuss points. And my comments too. Thanks chris
I support the discusses by Chris and Eric.
Thanks for the work done in this document and for addressing my previous blocking DISCUSS ballot: https://mailarchive.ietf.org/arch/msg/cdni/o4Gg3s217xP6KUGYPHI_o67Okpo/
the boilerplate template used seems outdated: 90 2. Requirements 92 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 93 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 94 document are to be interpreted as described in [RFC2119]. Should look something as follows: " The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. "
Thanks to the authors and the WG for their work on this document. I find that Eric has already caught all the comments that I had and hence skipping the email out.
Thank you to Elwyn Davies for the GENART review. I support the DISCUSS positions of Christopher Inacio, Mahesh Jethanandani, and Mohamed Boucadair on the how the [WHATWG-FETCH] reference is treated -- it needs to be normative and point to a specific reference. In previous discussions on WHATWG references in documents, specific github commit messages with a date stamp were referenced.
I support the existing DISCUSSes but think this is ready to publish after those are addressed.