Re: Follow-up on draft-ietf-netconf-http-client-server

Kent Watsen <kent+ietf@watsen.net> Thu, 23 July 2020 15:24 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 195803A0303 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Thu, 23 Jul 2020 08:24:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.918
X-Spam-Level:
X-Spam-Status: No, score=-2.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazonses.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JTg2G3h88Q3j for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Thu, 23 Jul 2020 08:24:15 -0700 (PDT)
Received: from lyra.w3.org (lyra.w3.org [128.30.52.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3EEB3A099C for <httpbisa-archive-bis2Juki@lists.ietf.org>; Thu, 23 Jul 2020 08:24:14 -0700 (PDT)
Received: from lists by lyra.w3.org with local (Exim 4.92) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1jyd1u-0001XM-NL for ietf-http-wg-dist@listhub.w3.org; Thu, 23 Jul 2020 15:21:06 +0000
Resent-Date: Thu, 23 Jul 2020 15:21:06 +0000
Resent-Message-Id: <E1jyd1u-0001XM-NL@lyra.w3.org>
Received: from titan.w3.org ([128.30.52.76]) by lyra.w3.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <010001737c434b23-44eb8c59-f98a-4c3d-8cf3-b991994f2e23-000000@amazonses.watsen.net>) id 1jyd1s-0001WP-Pn for ietf-http-wg@listhub.w3.org; Thu, 23 Jul 2020 15:21:04 +0000
Received: from a48-110.smtp-out.amazonses.com ([54.240.48.110]) by titan.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.92) (envelope-from <010001737c434b23-44eb8c59-f98a-4c3d-8cf3-b991994f2e23-000000@amazonses.watsen.net>) id 1jyd1q-0006rH-UQ for ietf-http-wg@w3.org; Thu, 23 Jul 2020 15:21:04 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1595517652; h=From:Message-Id:Content-Type:Mime-Version:Subject:Date:In-Reply-To:Cc:To:References:Feedback-ID; bh=xBQXeObRfQVA3zcBWqxIB4P1ft2fY1BwUBU8k+ibmB0=; b=DrY7LAD6xIwf6F5f4vLKHmFClo14IPevAx0EVG3YVs6QVSpEvcBKXHZZHiVGrAjI mVp6NYAT+eq5vRwwA4bGhNMgmxo1SNrlHCuGzOwHN2dQvX7y4isdZ1F6IwsuNUWTOnG tDAjOB2qDtDqebXoUkPEVCc/3m+eanqi/Y1F7AiQ=
From: Kent Watsen <kent+ietf@watsen.net>
Message-ID: <010001737c434b23-44eb8c59-f98a-4c3d-8cf3-b991994f2e23-000000@email.amazonses.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_A0F04758-0D8F-4BC8-A6E9-6D23DB53EA8E"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\))
Date: Thu, 23 Jul 2020 15:20:51 +0000
In-Reply-To: <01000173723f6de8-d6359eb6-d80e-46fa-86a3-e9fe794f74b6-000000@email.amazonses.com>
Cc: "netconf-chairs@ietf.org" <netconf-chairs@ietf.org>
To: HTTP Working Group <ietf-http-wg@w3.org>
References: <01000173723f6de8-d6359eb6-d80e-46fa-86a3-e9fe794f74b6-000000@email.amazonses.com>
X-Mailer: Apple Mail (2.3608.80.23.2.2)
X-SES-Outgoing: 2020.07.23-54.240.48.110
Feedback-ID: 1.us-east-1.DKmIRZFhhsBhtmFMNikgwZUWVrODEw9qVcPhqJEI2DA=:AmazonSES
Received-SPF: none client-ip=54.240.48.110; envelope-from=010001737c434b23-44eb8c59-f98a-4c3d-8cf3-b991994f2e23-000000@amazonses.watsen.net; helo=a48-110.smtp-out.amazonses.com
X-W3C-Hub-Spam-Status: No, score=-3.9
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: titan.w3.org 1jyd1q-0006rH-UQ 9c37e4820209e57081145f6cacc5b9ed
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Follow-up on draft-ietf-netconf-http-client-server
Archived-At: <https://www.w3.org/mid/010001737c434b23-44eb8c59-f98a-4c3d-8cf3-b991994f2e23-000000@email.amazonses.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/37908
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

TL;DR;  Is client-auth to a web proxy mandatory?

Thanks,
Kent


> On Jul 21, 2020, at 12:40 PM, Kent Watsen <kent+ietf@watsen.net> wrote:
> 
> Thank you all for your earlier comments regarding draft-ietf-netconf-http-client-server <https://tools.ietf.org/html/draft-ietf-netconf-http-client-server>.
> 
> The draft is now almost ready for WGLC (which will be CC-ed here as well), but there remains one item for which your guidance is needed (see bottom).
> 
> First, as a recap, one of the primarily takeaways from before was that proxies can be supported both at the TCP-level (i.e., via SOCKS) and at the HTTP-level (i.e. via a Web Proxy).
> 
> In order to support TCP-level proxies, the “tcp-client-grouping”, which is defined in another draft (draft-ietf-netconf-tcp-client-server <https://tools.ietf.org/html/draft-ietf-netconf-tcp-client-server>), now defines optional configuration enabling any TCP-client to initiate a connection via a proxy.  FWIW, here is a direct link to the "tree diagram” <https://tools.ietf.org/html/draft-ietf-netconf-tcp-client-server-07#section-3.1.2.1>  illustrating this.
> 
> In order to support HTTP-level proxies, *this* draft was modified to introduce a new “proxy-connect” configuration stanza that, in effect, is the complete configuration for another HTTP-client connection.  Here’s a direct link to the “tree diagram” <https://tools.ietf.org/html/draft-ietf-netconf-http-client-server-04#section-2.1.2.2> and here is a fully-populated example <https://tools.ietf.org/html/draft-ietf-netconf-http-client-server-04#section-2.2> (see 2nd example).
> 
> Does everything appear to be in order so far?
> 
> Now, for the question, do Web Proxies require client-auth?  More specifically:
> when an HTTP client is connecting to a Web Proxy via HTTP, is HTTP-level auth (i.e. Basic) mandatory or optional?
> when an HTTP client is connecting to a Web Proxy via HTTPS, is TLS-level and/or HTTP-level auth mandatory or optional?
> 
> Thanks,
> Kent
>