Re: [secdir] [i2rs] Asynchronous Nature of the I2RS Protocol - vs RESTCONF and NETCONF

Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> Wed, 04 March 2015 23:09 UTC

Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 267091A0016; Wed, 4 Mar 2015 15:09:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.86
X-Spam-Level:
X-Spam-Status: No, score=-3.86 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LLzrzq8Ps-ap; Wed, 4 Mar 2015 15:09:49 -0800 (PST)
Received: from atlas3.jacobs-university.de (atlas3.jacobs-university.de [212.201.44.18]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82BA01A000E; Wed, 4 Mar 2015 15:09:49 -0800 (PST)
Received: from localhost (demetrius5.irc-it.jacobs-university.de [10.70.0.222]) by atlas3.jacobs-university.de (Postfix) with ESMTP id 1FB1CF9B; Thu, 5 Mar 2015 00:09:47 +0100 (CET)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from atlas3.jacobs-university.de ([10.70.0.220]) by localhost (demetrius5.jacobs-university.de [10.70.0.222]) (amavisd-new, port 10030) with ESMTP id GGhQy-i2gUxQ; Thu, 5 Mar 2015 00:09:30 +0100 (CET)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hermes.jacobs-university.de", Issuer "Jacobs University CA - G01" (verified OK)) by atlas3.jacobs-university.de (Postfix) with ESMTPS; Thu, 5 Mar 2015 00:09:46 +0100 (CET)
Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id 53C2C2003A; Thu, 5 Mar 2015 00:09:46 +0100 (CET)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id fotb3XaTAPCE; Thu, 5 Mar 2015 00:09:45 +0100 (CET)
Received: from elstar.local (elstar.jacobs.jacobs-university.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 4666020039; Thu, 5 Mar 2015 00:09:43 +0100 (CET)
Received: by elstar.local (Postfix, from userid 501) id 24F3C325BF2D; Thu, 5 Mar 2015 00:09:41 +0100 (CET)
Date: Thu, 5 Mar 2015 00:09:40 +0100
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: Jeffrey Haas <jhaas@pfrc.org>
Message-ID: <20150304230940.GA68185@elstar.local>
Mail-Followup-To: Jeffrey Haas <jhaas@pfrc.org>, Susan Hares <shares@ndzh.com>, i2rs@ietf.org, 'Melinda Shore' <melinda.shore@gmail.com>, secdir@ietf.org
References: <01c301d05538$0b4846c0$21d8d440$@ndzh.com> <54F4E7D7.1000603@gmail.com> <023e01d055fe$8688c9b0$939a5d10$@ndzh.com> <20150304194244.GB9142@pfrc>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150304194244.GB9142@pfrc>
User-Agent: Mutt/1.4.2.3i
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/G93allHzbI1_60jW82_26QIF5jk>
Cc: i2rs@ietf.org, Susan Hares <shares@ndzh.com>, secdir@ietf.org
Subject: Re: [secdir] [i2rs] Asynchronous Nature of the I2RS Protocol - vs RESTCONF and NETCONF
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Mar 2015 23:09:52 -0000

On Wed, Mar 04, 2015 at 02:42:44PM -0500, Jeffrey Haas wrote:
> 
> There is a presumption that it may be possible for the I2RS agent to
> restart.  Given that a number of I2RS operations are likely to be built
> using multiple interactions with the agent, it's necessary to understand
> what state the agent may be in with regard to last-reset.  A simple but
> unscalable way to implement this is to preceed each operation with a
> get/get-config to verify the state of the system prior to sending in the
> next I2RS operation.
>

If this is a problem (which I am not sure), then send a get/get-config
before each edit operation won't buy you much since the agent can
still restart inbetween.

> What is likely more stable is simply knowing whether
> the system is in the same state as when you last interacted with it.
> 
> A version numbering system of some sort, whether system-wide or potentially
> as part of some models (perhaps even just I2RS models) would be sufficient
> to provide such a checkpoint.
> 
> An example of the problem space this would address presuming three
> operations must be completed to accomplish a given I2RS goal, "A B C".
> If the agent crashes after B has been done, C may either complete with no
> errors, or may fail before the setup state for A and B are no longer in the
> system.

The simple solution is to make "A B C" one atomic edit.

> An analogous mechanism in SNMP to address such issues are discontinuity
> objects.

No, not really. Discontinuity objects help with monitoring, not so
much with sets. SNMP folks invented TestAndIncr (RFC 2579), which is
used to implement so called spin-lock objects. While this can be made
to work, I am not sure I would recommend this approach. While this
method allows to detect that edits were conflicting, it makes the
clients responsible to clean up the mess.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>