[netconf] Re: draft-kwatsen-netconf-quic-call-home

[Qin Wu <[e-mail]>]

-----邮件原件-----
发件人: Christian Huitema [mailto:[e-mail]] 
发送时间: 2026年7月30日 1:46
收件人: Magnus Westerlund <magnus.westerlund=[e-mail]>; Kent Watsen <[e-mail]>; [e-mail]
抄送: [e-mail]
主题: [netconf] Re: draft-kwatsen-netconf-quic-call-home


On 7/29/2026 1:31 AM, Magnus Westerlund wrote:
> Hi,
>
> If I understand this correctly you are doing mutual TLS for 
> authentication so both the *CONF client and server knows who they are 
> expecting to talk to. The server also knows the client’s address port.
> So why complicating it with a new packet type rather than to just 
> define that both *CONF clients and servers shall act as QUIC Servers, 
> and *CONF servers MAY be QUIC clients and the *CONF client MUST be 
> QUIC client, then after the QUIC connection is established the *CONF 
> Client knows its role and does the *CONF procedures over the 
> established connection?


Netconf requires mutual auth, but H3 typically does not. To run Netconf 
over H3 and get mutual auth, the standard solution would be to 
authenticate the client after H3 is established, probably using OAUTH. 
Or, if that is possible, define a profile of H3 that requires mutual 
auth at the TLS/QUIC level. I wonder which of these solutions is used 
for Netconf over H2.

[QW]Not sure there is NETCONF over H2, but RESTCONF is independent of the HTTP version
and recommend using H2.
If my understanding is correct, draft-kwatsen-netconf-quic-call-home is separated from draft-ietf-netconf-over-quic which has been adopted in NETCONF WG.
NETCONF over QUIC bypasses the HTTP stack entirely to send raw NETCONF XML/RPC messages directly over native QUIC streams.
OAuth is a web-centric application-layer authorization framework designed for HTTP workflows.
OAuth is not supported, Forcing OAuth into NETCONF layer would add unnecessary web semantics and processing overhead.

-- Christian Huitema

_______________________________________________
netconf mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]