Re: [secdir] review of draft-ietf-netconf-nmda-restconf-04

[Daniel Harkins <[e-mail]>]

On 7/4/18 5:41 AM, Juergen Schoenwaelder wrote:
> On Tue, Jul 03, 2018 at 11:32:35AM -0700, Daniel Harkins wrote:
>>    Hello,
>>
>>    I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>>    The summary of the review is "Ready with nits".
>>
>>    This draft defines two new capability identifier URNs for use in
>> the RESTCONF protocol and also some new behavioral requirements on
>> servers implementing it. My nit is on that last bit. In sections
>> 3.2.1 and 3.2.2 present the new query parameters and say that they
>> are "optional to support" and then go on saying what behavior is
>> needed if it is supported. I think those need to be changed to be
>> RFC 2119 words, either SHOULD or MAY depending on the reasons that
>> might exist for not implementing them (basically conform to what
>> the words mean in RFC 2119).
>>
> I am not sure where exactly we are asked to use SHOULD and MAY and why
> that would be necessary. Note that we follow the wordings in RFC 8040
> (search for optional), which this document updates.

   I'm suggesting SHOULD _or_ MAY and I thought where would be obvious.
It is the places that say "optional to support" in 3.2.1. and 3.2.2 as
I indicated. For example, 3.2.1 says,

    The "with-defaults" query parameter ([RFC8040], Section 4.8.9 <https://tools.ietf.org/html/rfc8040#section-4.8.9>) is
    optional to support when interacting with {+restconf}/ds/ietf-
    datastores:operational.

3.2.2 has similar text. As to why, it is for consistency and clarity in
expressing what you want.

   Dan.