Follow-up on draft-ietf-netconf-http-client-server

Kent Watsen <> Tue, 21 July 2020 16:43 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BE95D3A0BAD for <>; Tue, 21 Jul 2020 09:43:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.918
X-Spam-Status: No, score=-2.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id pFLgVjRc97rl for <>; Tue, 21 Jul 2020 09:43:17 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 206813A0BAC for <>; Tue, 21 Jul 2020 09:43:17 -0700 (PDT)
Received: from lists by with local (Exim 4.92) (envelope-from <>) id 1jxvJp-0003je-9P for; Tue, 21 Jul 2020 16:40:41 +0000
Resent-Date: Tue, 21 Jul 2020 16:40:41 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <>) id 1jxvJn-0003iJ-EC for; Tue, 21 Jul 2020 16:40:39 +0000
Received: from ([]) by with esmtps (TLS1.2:ECDHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.92) (envelope-from <>) id 1jxvJl-0007e4-HD for; Tue, 21 Jul 2020 16:40:39 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=224i4yxa5dv7c2xz3womw6peuasteono;; t=1595349626; h=From:Content-Type:Mime-Version:Subject:Message-Id:Date:Cc:To:Feedback-ID; bh=qWmgUtsb+b1WKltSTa9G8gfvCOT9rE0xzmhqCKEXg7A=; b=a3kLBvoQDHNd8Kr16ugep2UHbpfIu0WQXTW1JSXR5PAx1aKm3k3OZO16s2VD9Vmh WwR7nf2XKBQW47oChEzlGF/9pZgs7cJoej2WOtu1mN6HDYY7DtOgBZExIwXkQAlF0jM Y5QuR86iRbid5wdM26spWWUi3lPuMweWBqzNgu2Q=
From: Kent Watsen <>
Content-Type: multipart/alternative; boundary="Apple-Mail=_E92325BB-9611-43FF-8FE8-48BC05B103E9"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.\))
Message-ID: <>
Date: Tue, 21 Jul 2020 16:40:26 +0000
Cc: "" <>
To: HTTP Working Group <>
X-Mailer: Apple Mail (2.3608.
X-SES-Outgoing: 2020.07.21-
Received-SPF: none client-ip=;;
X-W3C-Hub-Spam-Status: No, score=-3.9
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: 1jxvJl-0007e4-HD c00a03c9452114af2f03e3d1ca73fa67
Subject: Follow-up on draft-ietf-netconf-http-client-server
Archived-At: <>
X-Mailing-List: <> archive/latest/37900
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

Thank you all for your earlier comments regarding draft-ietf-netconf-http-client-server <>.

The draft is now almost ready for WGLC (which will be CC-ed here as well), but there remains one item for which your guidance is needed (see bottom).

First, as a recap, one of the primarily takeaways from before was that proxies can be supported both at the TCP-level (i.e., via SOCKS) and at the HTTP-level (i.e. via a Web Proxy).

In order to support TCP-level proxies, the “tcp-client-grouping”, which is defined in another draft (draft-ietf-netconf-tcp-client-server <>), now defines optional configuration enabling any TCP-client to initiate a connection via a proxy.  FWIW, here is a direct link to the "tree diagram” <>  illustrating this.

In order to support HTTP-level proxies, *this* draft was modified to introduce a new “proxy-connect” configuration stanza that, in effect, is the complete configuration for another HTTP-client connection.  Here’s a direct link to the “tree diagram” <> and here is a fully-populated example <> (see 2nd example).

Does everything appear to be in order so far?

Now, for the question, do Web Proxies require client-auth?  More specifically:
when an HTTP client is connecting to a Web Proxy via HTTP, is HTTP-level auth (i.e. Basic) mandatory or optional?
when an HTTP client is connecting to a Web Proxy via HTTPS, is TLS-level and/or HTTP-level auth mandatory or optional?