Re: [netconf] Configured receiver capability exchange

["Eric Voit (evoit)" <[e-mail]>]

> Hi,
> 
> Mahesh Jethanandani <[e-mail]> wrote:
> > Hi Eric,
> >
> > Specifically to your suggestion towards
> > draft-ietf-netconf-https-notif, and its ability to learn the receiver
> > capabilities …
> >
> > As you might have seen, we had suggested a rather simple mechanism to
> > learn the capabilities of the receiver that involved a GET with a
> > specific Content-Type to invoke a response that returns the metadata
> > we desire. All the method requires is a HTTP(S) server at the other
> > end. If the Content-Type is not supported by the server, the server
> > will return an error. We like it for its simplicity.
> 
> I prefer this over the proposal to (mis?)use <subscription-started>.
> 
> First of all, one thing you want to discover is the encoding for notifications.
> <subscription-started> is a notification.  So which encoding should be used
> to send it?

<subscription-started> is just for configured subscriptions.  The encoding is set as part of the publisher configuration.
 
> Second, there is no "reply" defined for <subscription-started> since it is a
> one-way notification, so adding that seems a bit out of place.

With configured subscriptions, there is a need the receiver to confirm acceptance of the subscription.  Otherwise, configured subscriptions becomes a denial-of-service risk.  As a result of this need, there is the following text in the Security Considerations of RFC-8639:

  With configured subscriptions, one or more publishers could be used
   to overwhelm a receiver.  To counter this, notification messages
   SHOULD NOT be sent to any receiver that does not support this
   specification.  Receivers that do not want notification messages need
   only terminate or refuse any transport sessions from the publisher.

This is one reason we already need to do an "ok" is in reply to the HTTP, even without capability exchange.   I am just thinking we can use the already needed "OK" message for additional information on receiver capabilities.

Eric

> /martin
> 
> 
> 
> >
> > Your suggestion is of using <subscription-started>. Does that not
> > involve having a RESTCONF/NETCONF server support on the receiver? If
> > <subscription-started> is supported, does it mean
> > <subscription-modified> or <subscription-terminated> also needs to be
> > supported? If we do not/cannot support modification of subscription,
> > and instead require establishment of a new subscription to learn of
> > modifications, what would we be missing out with the GET method? Could
> > subscription be terminated simply by terminating the session?
> >
> > Thanks.
> >
> > > On Jan 15, 2020, at 12:23 PM, Eric Voit (evoit) <[e-mail]>
> > > wrote:
> > >
> > > Hi Mahesh,
> > >
> > > During the IETF 106 session, there was discussion on how both a
> > > publisher might know if there is receiver support for
> > > draft-ietf-netconf-notification-messages
> > > <https://datatracker.ietf.org/doc/draft-ietf-netconf-notification-
> messages/?include_text=1>.
> > > Section 6 highlights several of the considerations.  Relevant are
> > > the
> > > following:
> > >
> > > (a) Remote device capability discovery from the point of view of the
> > > Publisher needs to be enhanced to know if the far end can interpret
> > > notification messages type beyond RFC-5277, Section 4.
> > >
> > > (b) This capability discovery question is relevant for both
> > > configured subscription receivers and dynamic subscribers.
> > >
> > > (c) The capability discovery question can be generalized beyond
> > > subscriptions, as there are many reasons to know the available
> > > capabilities of the far end.
> > >
> > > (d) Capability discovery advertisement has traditionally been
> > > discussed within transport documents (e.g. RFC-6241 Section 8.1).
> > >
> > >
> > > Based on (a)-(d), coming up with a transport independent
> > > point-solution within draft-ietf-netconf-notification-messages
> > > <https://datatracker.ietf.org/doc/draft-ietf-netconf-notification-me
> > > ssages/?include_text=1>
> > > *just* to discover this single element of client functionality seems
> > > overkill/heavyweight.
> > >
> > > I was fine with letting this remote capabilities discovery question
> > > sit for a while.  However draft-ietf-netconf-https-notif
> > > <https://tools.ietf.org/html/draft-ietf-netconf-https-notif-01>
> > > shows that we now must address this question.  Specifically should
> > > the diagram section 1.4.1 show this capability exchange?
> > >
> > > It turns out that independent of
> > > draft-ietf-netconf-notification-messages, there several questions in
> > > draft-ietf-netconf-https-notif which need to be answered prior to
> > > the section 1.4.1 arrow: "Send HTTPS POST message with YANG defined
> > > notification #1" anyway.  These questions are:
> > >   (1) Does the targeted HTTPS receiver support configured subscriptions?
> > >   (2) Can the targeted HTTP@ receiver accept a new subscription as
> > >   described in a <subscription-started>?
> > > Only if these questions are "yes", should the <subscription-started>
> > > be responded to with an "OK".
> > >
> > > Add to this a third question driven from (a)-(d):
> > >   (3) Does the receiver support the message type within
> > >   "draft-ietf-netconf-notification-messages"?
> > >
> > > A strawman way to handle the all three questions within
> > > draft-ietf-netconf-https-notif would be to respond to a
> > > <subscription-started> notification with an HTTP Status 202
> > > (Accepted)" acknowledgement.  This 202 would include body elements
> > > listing supported receiver resources.  Maybe something YANG encoded
> > > via ietf-yang-structure-ext containing:
> > >
> > >       <foo xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
> > >         <capabilities>
> > >           <capability>
> > >             urn:ietf:params:xml:ns:yang:ietf-notification-messages:1.0
> > >           </capability>
> > >         </capabilities>
> > >       </foo>
> > >
> > > What do you think of this approach?
> > >
> > > Eric
> >
> > Mahesh Jethanandani
> > [e-mail]
> >
> >
> >