Subject: [Netconf] Update of 4742bis before deadline WAS:Re: Status WGLC RFC4742bis WAS:FW: status WGLC RFC4741bis

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Sun, 24 Oct 2010 19:36:20 +0200

Hi Margaret, All,

the result of the discussion showed that there is consensus on the 
last proposed text for this issue (below). With this we will update 
4742bis before deadline.

Margaret: Can you please update 4742bis with the text below? 
Thanks.

Mehmet

OLD:
   "This character sequence cannot legally appear outside of a comment
in an
   XML document, so it can be unambigiously used to identify the end of
   the current document, allowing resynchronization of the NETCONF
   exchange in the event of an XML syntax or parsing error."

NEW:
   "This character sequence MUST NOT appear in an XML document."

NEW in Security Considerations section:
   "RFC 4742 assumes that the EOM sequence cannot appear in any XML
    document, which turned out to be mistaken. The EOM sequence can
cause
    operational problems and open space for attacks if sent deliberately
in an XML
    document. It is however believed that the associated threat is not
very high.
    This document keeps using the EOM sequence to avoid incompatibility
with
    existing implementations. Implementations of SSH transport must
exercise 
    extra care and make sure the EOM sequence is not present in an XML 
    document."

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of ext Ersue, Mehmet (NSN - DE/Munich)
> Sent: Friday, October 22, 2010 6:21 PM
> To: ext Phil Shafer; Juergen Schoenwaelder
> Cc: Andy Bierman; ext Margaret Wasserman; Netconf
> Subject: Re: [Netconf] Status WGLC RFC4742bis WAS:FW: status WGLC
> RFC4741bis
> 
> Hi Phil, All,
> 
> ::>> NEW:
> ::>> "This character sequence MUST NOT appear in an XML document."
> 
> > >Works for me.
> >
> > This is a change to the NETCONF protocol, since it makes a
previously
> > legal character sequence illegal.  If we're willing to change
> > NETCONF, why not just repair the SSH transport mapping, where the
> > problem really exists.
> >
> > But if the WG really is following the "it's not a bug" line, then
> > I suggest:
> >
> > (a) The draft should include an explanation of why this is illegal,
> > with the history, etc.
> >
> > (b) The draft should include a description of the means to avoid
> > this sequence (amper escaping) and a list of places where that
> > escaping is not possible (processing instructions).
> >
> > That is, the draft should give all the details as we know them so
> > an implementor can understand and properly address the issues.
> >
> > Me, I think it's a bug.  A minor one, sure, but at least on par with
> > the other issues addressed with netconf-1.1.
> 
> Yes, it is a bug. We found out it can only be addressed "thoroughly"
> in v2.0. We are now trying to fix the mistaken text in v1.0 of
4742bis.
> 
> SSH v1.0 is specified to recognize end of document with this character
> sequence. As we all were thinking, the character sequence cannot
appear
> in an XML document, I don't think it is a change for the NETCONF
> protocol
> (this BTW was the case since May 2004, see v01 of SSH draft which
> leaded
> 
> to 4742).
> 
> If you think "MUST NOT" is too strict I can go also with "SHOULD NOT".
> OTOH, if we know already it is bad, why not "MUST"?
> 
> The explanation text you are proposing should go into the security
> considerations section of 4742bis, e.g.:
> 
> NEW:
> 
> :: "RFC 4742 assumes that the EOM sequence cannot appear in any XML
> document,
> :: which turned out to be mistaken. The EOM sequence can cause
> operational
> :: problems and open space for attacks if sent deliberately in an XML
> document.
> :: It is however believed that the associated threat is not very high.
> This
> :: document keeps using the EOM sequence to avoid incompatibility with
> :: existing clients.
> :: Implementations of SSH transport must exercise extra care and make
> sure
> :: the EOM sequence is not present in an XML document."
> 
> All:
> : Knowing that this is only a (limited) bug fixing for v1.0, can we go
> : with the proposed two NEW text blocks in 4742bis?
> 
> We need a decision kind of soon to resubmit before deadline. Thank
you.
> 
> Mehmet
> 
> 
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 25 Oct 2010 16:51:53 -0400

Hi Mehmet,

This update has been done, and the -04 version of the draft has been  
posted.

Thanks,
Margaret

---

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Tue, 26 Oct 2010 15:26:10 +0200

Hi All,

based on the consensus on the NETCONF ML and as discussed 
with the authors of the NETCONF 4742bis draft the document 
is going to AD review.

Pls find attached the doc write-up.

Cheers,
Mehmet

> From: ext Margaret Wasserman [mailto:[email-masked]]
> Sent: Monday, October 25, 2010 10:52 PM
> To: Ersue, Mehmet (NSN - DE/Munich)
> Cc: Netconf
> Subject: Re: [Netconf] Update of 4742bis before deadline WAS:Re:
Status
> WGLC RFC4742bis WAS:FW: status WGLC RFC4741bis
> 
> 
> Hi Mehmet,
>