Re: [netconf] draft-ietf-netconf-tls-client-server-34 tls-version

[Michal Vasko <[e-mail]>]

Hi Kent,

thanks, that seems good except I would not be sure what the meaning of 
"no configured min/max version" is. Does it depend on the implementation 
(so, for example, if it supports TLS 1.0 and no `min` is defined, it is 
supported as well) or it is derived from the TLS versions supported by 
the module (which depends on the enabled features)? In my opinion, it 
needs clarification at least in the form of more detailed descriptions 
and I assume it is the latter.

Regards,
Michal

On 2. 3. 2024 4:57, Kent Watsen wrote:
> Hi Michal,
>
>> On Mar 1, 2024, at 2:11 AM, Michal Vasko <[e-mail]> wrote:
>>
>> Hi Kent,
>>
>> yeah, I was not sure whether you have seen it but had enough other 
>> work and then forgotten about it.
>>
> Distracted by life  ;)
>
>> As stated in the email, being able to set both min and max supported 
>> version makes sense to me (and is supported by OpenSSL), not so much 
>> customizing the priority of each TLS version, so that is my proposal. 
>> Thanks.
>>
> Okay, so I just did this:
>
> 162     container tls-versions {
> 163       description
> 164         "Parameters regarding TLS versions.";
> 165       leaf min {
> 166         type identityref {
> 167           base tls-version-base;
> 168         }
> 169         description
> 170           "If not specified, then there is no configured
> 171            minimum version.";
> 172       }
> 173       leaf max {
> 174         type identityref {
> 175           base tls-version-base;
> 176         }
> 177         description
> 178           "If not specified, then there is no configured
> 179            maximum version.";
> 180       }
> 181     }
>
> All good?
>
>> Regards,
>> Michal
>>
>
> Thanks again,
> Kent
>