Re: [netconf] draft-ietf-netconf-tls-client-server-34 tls-version

[Michal Vasko <[e-mail]>]

Hi Kent,

I cannot really decide between the 2 solutions. Solution 2) does not 
bloat basic configuration with uninteresting nodes (just like TCP 
keepalives used to) but effectively hides configuration parameters as 
features. Ideally, the nodes should have default values based on the 
enabled features but that is not supported yet so I really cannot help 
you with the decision, sorry.

Regards,
Michal

On 4. 3. 2024 16:08, Kent Watsen wrote:
> Hi Michal,
>
>> On Mar 4, 2024, at 2:09 AM, Michal Vasko <[e-mail]> wrote:
>>
>> Hi Kent,
>>
>> thanks, that seems good except I would not be sure what the meaning 
>> of "no configured min/max version" is. Does it depend on the 
>> implementation (so, for example, if it supports TLS 1.0 and no `min` 
>> is defined, it is supported as well) or it is derived from the TLS 
>> versions supported by the module (which depends on the enabled 
>> features)? In my opinion, it needs clarification at least in the form 
>> of more detailed descriptions and I assume it is the latter.
>>
>
> Two possible fixes:
>
>   1) make these two  leafs “mandatory true”
>
> PROs: forces the min/max “features” to be enabled.
> CONs: rely solely on that the full set of features are enabled.
>
>   2) remove the “tls-versions” container entirely
>
> PROs: rely solely on that features are enabled accurately.
> CONs: no way to configure limits per TLS endpoint (features are global)
>
> Thoughts?
>
> PS: have only a few hours untill submission-cutoff, so a quick 
> response would be appreciated.
>
> Kent
>
>
>
>
>
>> Regards,
>> Michal
>>
>> On 2. 3. 2024 4:57, Kent Watsen wrote:
>>> Hi Michal,
>>>
>>>> On Mar 1, 2024, at 2:11 AM, Michal Vasko <[e-mail]> wrote:
>>>>
>>>> Hi Kent,
>>>>
>>>> yeah, I was not sure whether you have seen it but had enough other 
>>>> work and then forgotten about it.
>>>>
>>> Distracted by life  ;)
>>>
>>>> As stated in the email, being able to set both min and max 
>>>> supported version makes sense to me (and is supported by OpenSSL), 
>>>> not so much customizing the priority of each TLS version, so that 
>>>> is my proposal. Thanks.
>>>>
>>> Okay, so I just did this:
>>>
>>> 162     container tls-versions {
>>> 163       description
>>> 164         "Parameters regarding TLS versions.";
>>> 165       leaf min {
>>> 166         type identityref {
>>> 167           base tls-version-base;
>>> 168         }
>>> 169         description
>>> 170           "If not specified, then there is no configured
>>> 171            minimum version.";
>>> 172       }
>>> 173       leaf max {
>>> 174         type identityref {
>>> 175           base tls-version-base;
>>> 176         }
>>> 177         description
>>> 178           "If not specified, then there is no configured
>>> 179            maximum version.";
>>> 180       }
>>> 181     }
>>>
>>> All good?
>>>
>>>> Regards,
>>>> Michal
>>>>
>>>
>>> Thanks again,
>>> Kent
>>>
>