Re: [netconf] draft-ietf-netconf-tls-client-server-34 tls-version

[Kent Watsen <[e-mail]>]

Being able to set TLS min/max version on a per-connection basis seems important to me.   I have had to do this in the past (using native TLS config).  So I lean towards Option 1.  Also, Option 2 is a somewhat large change at this late stage in the publication process.

Kent


> On Mar 4, 2024, at 10:19 AM, Michal Vasko <[e-mail]> wrote:
> 
> Hi Kent,
> 
> I cannot really decide between the 2 solutions. Solution 2) does not bloat basic configuration with uninteresting nodes (just like TCP keepalives used to) but effectively hides configuration parameters as features. Ideally, the nodes should have default values based on the enabled features but that is not supported yet so I really cannot help you with the decision, sorry.
> 
> Regards,
> Michal
> 
> On 4. 3. 2024 16:08, Kent Watsen wrote:
>> Hi Michal,
>> 
>>> On Mar 4, 2024, at 2:09 AM, Michal Vasko <[e-mail]> <mailto:[e-mail]> wrote:
>>> 
>>> Hi Kent,
>>> 
>>> thanks, that seems good except I would not be sure what the meaning of "no configured min/max version" is. Does it depend on the implementation (so, for example, if it supports TLS 1.0 and no `min` is defined, it is supported as well) or it is derived from the TLS versions supported by the module (which depends on the enabled features)? In my opinion, it needs clarification at least in the form of more detailed descriptions and I assume it is the latter.
>>> 
>> 
>> Two possible fixes:
>> 
>>   1) make these two  leafs “mandatory true” 
>> 
>> 	PROs: forces the min/max “features”  to be enabled.
>> 	CONs: rely solely on that the full set of features are enabled.
>> 
>>   2) remove the “tls-versions” container entirely
>> 
>> 	PROs: rely solely on that features are enabled accurately.
>> 	CONs: no way to configure limits per TLS endpoint (features are global)
>> 
>> Thoughts?
>> 
>> PS: have only a few hours untill submission-cutoff, so a quick response would be appreciated.
>> 
>> Kent
>> 
>> 
>> 
>> 
>> 
>>> Regards,
>>> Michal
>>> 
>>> On 2. 3. 2024 4:57, Kent Watsen wrote:
>>>> Hi Michal,
>>>> 
>>>>> On Mar 1, 2024, at 2:11 AM, Michal Vasko <[e-mail]> <mailto:[e-mail]> wrote:
>>>>> 
>>>>> Hi Kent,
>>>>> 
>>>>> yeah, I was not sure whether you have seen it but had enough other work and then forgotten about it.
>>>>> 
>>>> Distracted by life  ;)
>>>> 
>>>>> As stated in the email, being able to set both min and max supported version makes sense to me (and is supported by OpenSSL), not so much customizing the priority of each TLS version, so that is my proposal. Thanks.
>>>>> 
>>>> Okay, so I just did this:
>>>> 
>>>> 162     container tls-versions {
>>>> 163       description
>>>> 164         "Parameters regarding TLS versions.";
>>>> 165       leaf min {
>>>> 166         type identityref {
>>>> 167           base tls-version-base;
>>>> 168         }
>>>> 169         description
>>>> 170           "If not specified, then there is no configured
>>>> 171            minimum version.";
>>>> 172       }
>>>> 173       leaf max {
>>>> 174         type identityref {
>>>> 175           base tls-version-base;
>>>> 176         }
>>>> 177         description
>>>> 178           "If not specified, then there is no configured
>>>> 179            maximum version.";
>>>> 180       }
>>>> 181     }   
>>>> 
>>>> All good?
>>>> 
>>>>> Regards,
>>>>> Michal
>>>>> 
>>>> 
>>>> Thanks again,
>>>> Kent
>>>> 
>>