[netconf] Re: http and RC client-server updates

["Rob Wilton (rwilton)" <[e-mail]>]

Hi Kent,

Just commenting on the http-client-server draft (--21), I think that these changes make sense (based on the discussion that we had with Mark & Lars in Brisbane at IETF 119).

A few comments for you to consider

1)
In Section 2.2, you use an example which includes tls-client-parameters and server-authentication.  I think that it might also be helpful to also include the trivial example of just using a URI, since that may well be the most common use case?

2)
Section 2.3:

     feature tls-supported {
       description
         "Indicates that the server supports configuring
          HTTP client certificates.";
       reference
         "RFC 9110: HTTP Semantics";
     }

Is “tls-supported” the right name for this feature?  Will clients that support HTTPS (and hence TLS) always be expected to support these additional parameters?  Please consider whether tweaking the grouping name would make sense.

3) Section 2.3:

       leaf uri {

         nacm:default-deny-all;

         type inet:uri;

         mandatory true;

I was surprised by the default-deny-all on the URI, since I don’t generally think of these as being particularly security sensitive beyond any other configuration.  Was this intentional?  And if this does remain, then you may need to update the security considerations in section 4.1 which talks about other nodes, but not this one.  In fact, looking at the security considerations text, perhaps you wanted the nacm:default-deny-all to be on the proxy-uri instead?

Regards,
Rob



From: Kent Watsen <[e-mail]>
Date: Tuesday, 9 July 2024 at 02:39
To: [e-mail] <[e-mail]>
Subject: [netconf] http and RC client-server updates
I posted updates for the following drafts:

- http-client-server
- restconf-client-server

The updates are as follows:

For the http-client-server draft, the update is rather big.  After discussing with HTTP chairs and other experts, it was noted that our configuration for the HTTP-client was not expected.   What was stated was that the URI itself should be sufficient.  The update only affects the “client” groupings.  Now the client groupings have a “uri” leaf that is expected to encode transport details.

For the restconf-client-server draft, the update is only to adjust the examples to reflect the changes in the http-client-server draft.

Best,
K