[Netconf] updates to the client/server drafts

Kent Watsen <kwatsen@juniper.net> Fri, 21 September 2018 02:56 UTC

From: Kent Watsen <kwatsen@juniper.net>
To: "netconf@ietf.org" <netconf@ietf.org>
Thread-Topic: updates to the client/server drafts
Thread-Index: AQHUUVbAvgWl9XKJDky/TADn8k/2zg==
Date: Fri, 21 Sep 2018 02:56:53 +0000
Message-ID: <1B690DF4-4174-41C2-8E85-C18DAAD01B54@juniper.net>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/f.20.0.170309
received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-ID: <55AF2098042AE0489D989B8328511AEF@namprd05.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 05185fae-7c31-4955-620c-08d61f6de2f5
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Sep 2018 02:56:53.8251 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB5099
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-09-20_13:, , signatures=0
X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1809210028
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/eWVycg8A5zSphoYXx9EF7Co7Ad4>
Subject: [Netconf] updates to the client/server drafts
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Network Configuration WG mailing list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Sep 2018 02:57:00 -0000

Updated the suite of drafts.

Issues from IETF 102 not yet addressed are:
 - Should algorithm identities be moved from ietf-[ssh/tls]-common
   to crypto-types? (some progress here, but nothing to report yet)
 - Add support for TCP Keepalives?  (this needs more discussion)

Note that for the issue "Should some of Keystore's groupings be 
moved to crypto-types?", I just went ahead and did it.  My idea
is that there is no way we'll know unless we try, so I did.  If
we don't like it, we can put it back.  [Please review!]

Changes made discussed post-102 include:
  - refactoring the ssh/tls client/server groupings (per Balazs)
  - replacing reconnect-timeout with period/anchor-time (per Martin)

Changes NOT made discussed post-102 include:
  - adding an "on-demand" connection-type. This needs more 
    discussion.

Changes made though NOT discussed:
  - removed the "on-demand" option for the periodic connection
    type.  This is related to the above non-change.  Basically,
    we need to think harder about on-demand connections and
    how they relate to the "call-home-reason" idea that was
    discussed some.

The per-draft Change Logs are listed below.

crypto-types:
   o  Moved groupings from the draft-ietf-netconf-keystore here.

trust-anchors:
   o  Added features "x509-certificates" and "ssh-host-keys".
   o  Added nacm:default-deny-write to "trust-anchors" container.

keystore:
   o  Added feature "local-keys-supported"
   o  Added nacm:default-deny-all and nacm:default-deny-write
   o  Renamed generate-asymmetric-key to generate-hidden-key
   o  Added an install-hidden-key action
   o  Moved actions inside fo the "asymmetric-key" container
   o  Moved some groupings to draft-ietf-netconf-crypto-types

ssh-client-server:
   o  factored the ssh-[client|server]-groupings into more reusable
      groupings.
   o  added if-feature statements for the new "ssh-host-keys" and
      "x509-certificates" features defined in draft-ietf-netconf-trust-
      anchors.

tls-client-server:
   o  factored the tls-[client|server]-groupings into more reusable
      groupings.
   o  added if-feature statements for the new "x509-certificates"
      feature defined in draft-ietf-netconf-trust-anchors.

netconf-client-server:
   o  Removed "idle-timeout" from "persistent" connection config.
   o  Added "random-selection" for reconnection-strategy's "starts-with"
      enum.
   o  Replaced "connection-type" choice default (persistent) with
      "mandatory true".
   o  Reduced the periodic-connection's "idle-timeout" from 5 to 2
      minutes.
   o  Replaced reconnect-timeout with period/anchor-time combo.


restconf-client-server:
   o  removed "idle-timeout" from "persistent" connection config.
   o  Added "random-selection" for reconnection-strategy's "starts-with"
      enum.
   o  Replaced "connection-type" choice default (persistent) with
      "mandatory true".
   o  Reduced the periodic-connection's "idle-timeout" from 5 to 2
      minutes.
   o  Replaced reconnect-timeout with period/anchor-time combo.



Kent // contributor

[Netconf] updates to the client/server drafts Kent Watsen