Re: [Netconf] We NEED RESPONSES: WG Last Call ended for:draft-ietf-netconf-4741bis-04.txt

On Sun, 3 Oct 2010 22:55:40 +0200, Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> wrote:
> On Sun, Oct 03, 2010 at 09:42:25PM +0200, Ersue, Mehmet (NSN - DE/Munich) wrote:
> > > > Section 9. Security Considerations
> > > >
> > > > I would suggest to add a few sentences for the EOM handling
> > > > and the possible thread concerning section 3. It would be
> > > > interesting to recommend a possible reaction if this happens
> > > > frequently, e.g. to drop the NETCONF session.
> > > 
> > > 4741bis does not have an EOM marker - so how can we discuss it in
> > > the security considerations?
> > 
> > EOM handling is for sure not part of NETCONF but the possible 
> > thread concerning EOM handling is. I think security considerations 
> > section should discuss the related security thread, as we did on 
> > NETCONF ML with a long mail thread.
> 
> There is no EOM issue if you run NETCONF over BEEP. We should stick to
> modularity and discuss things where they belong. Perhaps you want
> different text than the one I currently image you want...

SSH is the *mandatory* transport, so any appearance of ']]>]]>' in the
Messages, Operation or Content layer necessarily has an impact on
operation and is a potential security hole. So I agree with Mehmet that
4741bis should not dismiss this issue completely. The protocol
modularity has been damaged by the unfortunate EOM choice.

Apart from Security Considerations, text in Sec. 3 should be changed as
follows:

OLD

  All NETCONF messages MUST be well-formed XML, encoded in UTF-8.

NEW

  All NETCONF messages MUST be well-formed XML, encoded in UTF-8, and
  MUST NOT contain the character sequence ']]>]]>'.

Lada

> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org
> https://www.ietf.org/mailman/listinfo/netconf

-- 
Ladislav Lhotka, CESNET
PGP Key ID: E74E8C0C