Subject: [Netconf] updates to the client/server drafts

From: Kent Watsen <[email-masked]>
Date: Fri, 21 Sep 2018 02:56:53 +0000

Updated the suite of drafts.

Issues from IETF 102 not yet addressed are:
 - Should algorithm identities be moved from ietf-[ssh/tls]-common
   to crypto-types? (some progress here, but nothing to report yet)
 - Add support for TCP Keepalives?  (this needs more discussion)

Note that for the issue "Should some of Keystore's groupings be 
moved to crypto-types?", I just went ahead and did it.  My idea
is that there is no way we'll know unless we try, so I did.  If
we don't like it, we can put it back.  [Please review!]

Changes made discussed post-102 include:
  - refactoring the ssh/tls client/server groupings (per Balazs)
  - replacing reconnect-timeout with period/anchor-time (per Martin)

Changes NOT made discussed post-102 include:
  - adding an "on-demand" connection-type. This needs more 
    discussion.

Changes made though NOT discussed:
  - removed the "on-demand" option for the periodic connection
    type.  This is related to the above non-change.  Basically,
    we need to think harder about on-demand connections and
    how they relate to the "call-home-reason" idea that was
    discussed some.

The per-draft Change Logs are listed below.

crypto-types:
   o  Moved groupings from the draft-ietf-netconf-keystore here.

trust-anchors:
   o  Added features "x509-certificates" and "ssh-host-keys".
   o  Added nacm:default-deny-write to "trust-anchors" container.

keystore:
   o  Added feature "local-keys-supported"
   o  Added nacm:default-deny-all and nacm:default-deny-write
   o  Renamed generate-asymmetric-key to generate-hidden-key
   o  Added an install-hidden-key action
   o  Moved actions inside fo the "asymmetric-key" container
   o  Moved some groupings to draft-ietf-netconf-crypto-types

ssh-client-server:
   o  factored the ssh-[client|server]-groupings into more reusable
      groupings.
   o  added if-feature statements for the new "ssh-host-keys" and
      "x509-certificates" features defined in draft-ietf-netconf-trust-
      anchors.

tls-client-server:
   o  factored the tls-[client|server]-groupings into more reusable
      groupings.
   o  added if-feature statements for the new "x509-certificates"
      feature defined in draft-ietf-netconf-trust-anchors.

netconf-client-server:
   o  Removed "idle-timeout" from "persistent" connection config.
   o  Added "random-selection" for reconnection-strategy's "starts-with"
      enum.
   o  Replaced "connection-type" choice default (persistent) with
      "mandatory true".
   o  Reduced the periodic-connection's "idle-timeout" from 5 to 2
      minutes.
   o  Replaced reconnect-timeout with period/anchor-time combo.

restconf-client-server:
   o  removed "idle-timeout" from "persistent" connection config.
   o  Added "random-selection" for reconnection-strategy's "starts-with"
      enum.
   o  Replaced "connection-type" choice default (persistent) with
      "mandatory true".
   o  Reduced the periodic-connection's "idle-timeout" from 5 to 2
      minutes.
   o  Replaced reconnect-timeout with period/anchor-time combo.

Kent // contributor