MTA MIB pktcMtaDevProvSolicitedKeyTimeout

Along the same lines, scanning through the same genError use in the MIB, we have the same pb in pktcMtaDevProvUnsolicitedKeyMaxTimeout, pktcMtaDevProvUnsolicitedKeyNomTimeout, pktcMtaDevProvUnsolicitedKeyMaxRetries and many other timers.

Along the same lines of what we agreed for the configkey object, here are the changes:
  pktcMtaDevProvSolicitedKeyTimeout  OBJECT-TYPE 
    SYNTAX      Unsigned32 (1..180) 
    UNITS       "seconds" 
    MAX-ACCESS  read-write 
    STATUS      current 
    DESCRIPTION
        " This object defines a Kerberos Key Management timer on the
          MTA. It is the time period during which the MTA saves the
          nonce and Server Kerberos Principal Identifier to match an
          AP Request and its associated AP Reply response from the
          Provisioning Server.
          After the timeout has been exceeded, the client discards
          this (nonce, Server Kerberos Principal Identifier) pair,
          after which it will no longer accept a matching AP Reply.
          This timer only applies when the Provisioning Server
          initiated key management for SNMPv3 (with a
          Wake Up message). 
--->      This object should not be used in non
          secure provisioning modes. In non secure provisioning
          modes, the MTA MUST return an 'inconsistentValue' in
          response to SNMP SET operations, and the MTA MUST
--->      return a 'genErr' error in response to SNMP GET
          operations."
    DEFVAL { 3 } 
    ::= { pktcMtaDevServer 11 } 

So I changed it to allow 0 to be returned in non secure modes:

pktcMtaDevProvSolicitedKeyTimeout  OBJECT-TYPE 
    SYNTAX      Unsigned32 (0..180) 
[snip]
--->      If this object is set to a zero value, the MTA MUST return
          an 'inconsistentValue' in response to SNMP SET operations.
          This object should not be used in non secure provisioning
          modes. In non secure provisioning modes, the MTA MUST
          return an 'inconsistentValue' in response to SNMP SET
          operations, and the MTA MUST return a zero value in
          response to SNMP GET operations."
    DEFVAL { 3 } 
    ::= { pktcMtaDevServer 11 } 

And same for the rest (lines changed marked with bars):


pktcMtaDevProvUnsolicitedKeyMaxTimeout  OBJECT-TYPE 
|   SYNTAX      Unsigned32 (0..600) 
    UNITS       "seconds" 
    MAX-ACCESS  read-only 
    STATUS      current 
    DESCRIPTION 
        " This object defines the timeout value that applies to
          an MTA-initiated AP-REQ/REP key management exchange with
          the Provisioning Server in SNMPv3 provisioning.
          It is the maximum timeout value and it may not be exceeded
          in the exponential back-off algorithm. If the DHCP option
          code 122 sub-option 5 is provided to the MTA, it 
          overwrites this value.
|         If this object is set to a zero value, the MTA MUST return
|         an 'inconsistentValue' in response to SNMP SET operations.
|         In non secure provisioning modes, the MTA MUST
|         MTA MUST return a zero value in response to SNMP GET
|         operations."
    REFERENCE 
        " PacketCable Security Specification." 
    DEFVAL {600} 
    ::= { pktcMtaDevServer 12 } 


pktcMtaDevProvUnsolicitedKeyNomTimeout  OBJECT-TYPE 
|   SYNTAX      Unsigned32 (0..600) 
    UNITS       "seconds" 
    MAX-ACCESS  read-only 
    STATUS      current 
    DESCRIPTION    
        " This object defines the starting value of the timeout
          for the AP-REQ/REP Backoff and Retry mechanism
          with exponential timeout in SNMPv3 provisioning.
          If the DHCP option code 122 sub-option 5 is provided
          the MTA, it overwrites this value.
|         If this object is set to a zero value, the MTA MUST return
|         an 'inconsistentValue' in response to SNMP SET operations.
|         In non secure provisioning modes, the MTA MUST
|         MTA MUST return a zero value in response to SNMP GET
|         operations."
    REFERENCE 
        " PacketCable Security Specification." 
    DEFVAL {3} 
    ::= { pktcMtaDevServer 13} 

pktcMtaDevProvUnsolicitedKeyMaxRetries  OBJECT-TYPE 
|   SYNTAX      Unsigned32 (0..32) 
    MAX-ACCESS  read-only 
    STATUS      current 
    DESCRIPTION 
        " This object contains a retry counter that applies to
          an MTA-initiated AP-REQ/REP key management exchange with
          the Provisioning Server in secure SNMPv3 provisioning.
          It is the maximum number of retries before the MTA stops
          attempting to establish a Security Association with
          Provisioning Server.
          If the DHCP option code 122 sub-option 5 is provided to
          the MTA, it overwrites this value.
|         If this object is set to a zero value, the MTA MUST return
|         an 'inconsistentValue' in response to SNMP SET operations.
|         In non secure provisioning modes, the MTA MUST
|         MTA MUST return a zero value in response to SNMP GET
|         operations."
    REFERENCE 
        " PacketCable Security Specification." 
    DEFVAL {8} 
    ::= { pktcMtaDevServer 14 } 

These set of changes will be integrated in draft06. If the wg participants have strong objections, please comment and we will consider reverting the text back.

Jean-François