Re: [netconf] draft-ietf-netconf-tls-client-server-34 tls-version

[Kent Watsen <[e-mail]>]

Hi Michal,

> On Mar 4, 2024, at 2:09 AM, Michal Vasko <[e-mail]> wrote:
> 
> Hi Kent,
> 
> thanks, that seems good except I would not be sure what the meaning of "no configured min/max version" is. Does it depend on the implementation (so, for example, if it supports TLS 1.0 and no `min` is defined, it is supported as well) or it is derived from the TLS versions supported by the module (which depends on the enabled features)? In my opinion, it needs clarification at least in the form of more detailed descriptions and I assume it is the latter.
> 

Two possible fixes:

  1) make these two  leafs “mandatory true” 

	PROs: forces the min/max “features”  to be enabled.
	CONs: rely solely on that the full set of features are enabled.

  2) remove the “tls-versions” container entirely

	PROs: rely solely on that features are enabled accurately.
	CONs: no way to configure limits per TLS endpoint (features are global)

Thoughts?

PS: have only a few hours untill submission-cutoff, so a quick response would be appreciated.

Kent





> Regards,
> Michal
> 
> On 2. 3. 2024 4:57, Kent Watsen wrote:
>> Hi Michal,
>> 
>>> On Mar 1, 2024, at 2:11 AM, Michal Vasko <[e-mail]> <mailto:[e-mail]> wrote:
>>> 
>>> Hi Kent,
>>> 
>>> yeah, I was not sure whether you have seen it but had enough other work and then forgotten about it.
>>> 
>> Distracted by life  ;)
>> 
>>> As stated in the email, being able to set both min and max supported version makes sense to me (and is supported by OpenSSL), not so much customizing the priority of each TLS version, so that is my proposal. Thanks.
>>> 
>> Okay, so I just did this:
>> 
>> 162     container tls-versions {
>> 163       description
>> 164         "Parameters regarding TLS versions.";
>> 165       leaf min {
>> 166         type identityref {
>> 167           base tls-version-base;
>> 168         }
>> 169         description
>> 170           "If not specified, then there is no configured
>> 171            minimum version.";
>> 172       }
>> 173       leaf max {
>> 174         type identityref {
>> 175           base tls-version-base;
>> 176         }
>> 177         description
>> 178           "If not specified, then there is no configured
>> 179            maximum version.";
>> 180       }
>> 181     }   
>> 
>> All good?
>> 
>>> Regards,
>>> Michal
>>> 
>> 
>> Thanks again,
>> Kent
>>