Re: [netconf] a comment on draft-ietf-netconf-tls-client-server-15

[Martin Bjorklund <[e-mail]>]

Hi,

two more comments below.

Martin Bjorklund <[e-mail]> wrote:
> Hi,
> 
> This is not a full review, just one thing that I stubmled upon.
> 
> The model has (pruned to illustrate my point):
> 
>        container server-authentication {
>          nacm:default-deny-write;
>          must 'ca-certs or server-certs';
>          container ca-certs {
>            if-feature "ts:x509-certificates";
>            presence ...;
>            ...
>          }
>          container server-certs {
>            if-feature "ts:x509-certificates";
>            presence ...;
>            ...
>          }
>        }
> 
> 1.  If a server doesn't implement the feature ts:x509-certificates,
>     the model effectively becomes:
> 
>        container server-authentication {
>          nacm:default-deny-write;
>          must 'ca-certs or server-certs';
>        }
> 
>     This must expression will never be true, which means that it is
>     not possible to configure anything!
> 
> 
> 2.  When this grouping is used in ietf-https-notifs, it looks like
>     this:
> 
>   +--rw receivers
>      +--rw receiver* [name]
>         +--rw name           string
>         ...
>         |  +--rw server-authentication
>         |  |  +--rw ca-certs! {ts:x509-certificates}?
>                  ...            
>         |  |  +--rw server-certs! {ts:x509-certificates}?
>                  ...
> 
>    Now, the container 'server-authentication' has
>    nacm:default-deny-write, and its contents is mandatory (due to the
>    must expression).  This means that it is not possible to configure
>    a single receiver without explicit NACM rules for this container.  Is
>    that really the intention?

3.  You don't have a choice between ca-certs and server-certs, which I
    assume is intentional (they can both exist).  I think you need to
    explain what happens when both these are configured.


4.  The description of ca-certs and server-certs has:

      "A server certificate is authenticated if ..."

    But you don't specify what it means for a certificate to be
    authenticated.  If the intention is that the meaning depends on
    where it is used, the description of the grouping should specify
    this requirement.


/martin