[netconf] netconf-tls wasRe: Summary of updates

[tom petch <[e-mail]>]

From: netconf <[e-mail]> on behalf of Kent Watsen <[e-mail]>
Sent: 18 May 2021 19:37

Thank you to all that contributed to the WGLC of the tcp-, ssh-, tls-, and http- client-server drafts.  Below is the result change log for each draft, but the highlights for me are:

   1) for the “tcp” draft, the abstract/introduction sections were enhanced by Michael, my co-author and TCP WG co-chair.
   2) for the “ssh” draft, we added and then removed the keyboard-interactive and GSS-API support.
   3) for the “tls” draft, we marked the feature statements for versions  other than 1.3 as “not recommended”.

<tp>
I still think that the I-D lacks clarity about supported versions.

Introduction 
TLS Protocol [RFC5246] 
Clearly this is TLS1.2 only

s.2
This model supports both TLS1.2 and TLS1.3
Ah, no, TLS1.2 and TLS1.3 but not TLS1.0 or TLS1.1

s.2.1.1
Features
tls-1_0
tls-1_1
tls-1_2
tls-1_3
Ah no, it may not support 1.0 and 1.1 but it ........ for them but I know not what.

2.2 
an example for 1.1 and 1.2 but not 1.3; interesting.

Reverse engineering the YANG I find that that 'Version 1.0 is supported', 'Version 1.1 is supported'.

hello-params-grouping
Only 1.2 is referenced as indeed is repeatedly the case in the YANG modules

Mmm I dunno!

I want the Introduction to set the scene which subsequent sections expand on and that I see as lacking.  Support fot 1.0 and 1.1 would, for me, catering for the different cipher suites that they have.

In passing, I was wrong about public keys.  I misread the statement that only certificates and PSK are supported in TLS1.3, forgetting that certificate(255) is a public key!

Tom Petch




   4) for the “http” draft, no significant update (really? hmm...)
   5) for the “netconf” draft, whilst not in WGLC, significant updates wrt the "client-identity-mappings” nodes.

Notably, beware that the Last Call YANG-doctor review for some of these four drafts has been pending this update, so expect to see a little more activity on these drafts yet.

K.


DETAILS:

crypto-types:
   *  Nits found via YANG Doctors reviews.
   *  Aligned modules with `pyang -f` formatting.

truststore:
   *  Added prefixes to 'path' statements per trust-anchors/issues/1
   *  Renamed feature "truststore-supported" to "central-truststore-supported".
   *  Associated with above, generally moved text to refer to a
      "central" truststore.
   *  Removed two unecessary/unwanted "min-elements 1" and associated
      "presence" statements.
   *  Aligned modules with `pyang -f` formatting.
   *  Fixed nits found by YANG Doctor reviews.

keystore:
   *  Added prefixes to 'path' statements per trust-anchors/issues/1
   *  Renamed feature "keystore-supported" to "central-keystore-
      supported".
   *  Associated with above, generally moved text to refer to a
      "central" keystore.
   *  Aligned modules with `pyang -f` formatting.
   *  Fixed nits found by YANG Doctor reviews.

tcp-client-server:
   *  Updated Abstract and Intro to address comments by Tom Petch.
   *  Removed the "tcp-connection-grouping" grouping (now models use the
      "tcp-common-grouping" directly).
   *  Added XML-comment above examples explaining the reason for the
      unusual top-most element's presence.
   *  Added Securty Considerations section for the "local-binding-
      supported" feature.
   *  Replaced some hardcoded refs to <xref> elements.
   *  Fixed nits found by YANG Doctor reviews.
   *  Aligned modules with `pyang -f` formatting.
   *  Added an "Acknowledgements" secetion.

ssh-client-server:
   *  Removed the 'supported-authentication-methods' from {grouping ssh-
      server-grouping}/client-authentication.
   *  Added XML-comment above examples explaining the reason for the
      unexepected top-most element's presence.
   *  Added RFC-references to various 'feature' statements.
   *  Renamed "credentials" to "authentication methods"
   *  Renamed "client-auth-*" to "userauth-*"
   *  Renamed "client-identity-*" to "userauth-*"
   *  Fixed nits found by YANG Doctor reviews.
   *  Aligned modules with `pyang -f` formatting.
   *  Added a 'Contributors' section.

tls-client-server:
   *  Added missing reference to "FIPS PUB 180-4".
   *  Added identity "tls-1.3" and updated description statement in
      other identities indicating that the protocol version is obsolete
      and enabling the feature is NOT RECOMMENDED.
   *  Added XML-comment above examples explaining the reason for the
      unexpected top-most element's presence.
   *  Added missing "client-ident-raw-public-key" and "client-ident-psk"
      featutes.
   *  Aligned modules with `pyang -f` formatting.
   *  Fixed nits found by YANG Doctor reviews.
   *  Added a 'Contributors' section.

http-client-server:
   *  Added XML-comment above examples explaining the reason for the
      unusual top-most element's presence.
   *  Renamed 'client-auth-config-supported' to 'client-auth-supported'
      consistent with other drafts.
   *  Wrapped 'container basic' choice inside a 'case basic' per best
      practice.
   *  Aligned modules with `pyang -f` formatting.
   *  Fixed nits found by YANG Doctor reviews.

netconf-client-server:
   *  Floated an 'if-feature' statement in a grouping down to where the
      grouping is used.
   *  Clarified 'client-identity-mappings' for both the SSH and TLS
      transports.
   *  For netconf-client, augmented-in a 'mapping-required' flag into
      'client-identity-mappings' only for the SSH transport, and
      refined-in a 'min-elements 1' only for the TLS transport.
   *  Aligned modules with `pyang -f` formatting.

restconf-client-server:
   *  Further clarified why some 'presence' statements are present.
   *  Addressed nits found in YANG Doctor reviews.
   *  Aligned modules with `pyang -f` formatting.




_______________________________________________
netconf mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/netconf