Subject: [Netconf] review of draft-ietf-netconf-rfc5539bis-07.txt

From: Kent Watsen <[email-masked]>
Date: Mon, 15 Dec 2014 22:57:21 +0000

Missing is the alg used to calculate the fingerprint.  YANG module
ietf-x509-cert-to-name says:

  typedef tls-fingerprint {
    type yang:hex-string {
      pattern '([0-9a-fA-F]){2}(:([0-9a-fA-F]){2}){0,254}';
    }
    description
     "A fingerprint value that can be used to uniquely reference
      other data of potentially arbitrary length.

      An tls-fingerprint value is composed of a 1-octet hashing
      algorithm identifier followed by the fingerprint value.  The
      first octet value identifying the hashing algorithm is taken
      from the IANA TLS HashAlgorithm Registry (RFC 5246).  The
      remaining octets are filled using the results of the hashing
      algorithm.";
    reference "SNMP-TLS-TM-MIB.SnmpTLSFingerprint";
  }

In section 7, should the paragraph after 'F' should say something like "if
no viable username can be mapped, then the TLS session MUST be dropped"?

Suggestion, add a section somewhere like the following?

   How to configure a NETCONF server is outside the scope of this
   document, as implementations can support this protocol using
   proprietary configuration data models.  That said, a YANG
   model for configuring NETCONF over TLS is provided in
   [draft-ietf-netconf-server-model].

Nits, in section 5", s/presented/Presented/

Thanks,
Kent

On 12/11/14, 8:49 AM, "[email-masked]"
<[email-masked]> wrote:

>
>A New Internet-Draft is available from the on-line Internet-Drafts
>directories.
> This draft is a work item of the Network Configuration Working Group of
>the IETF.
>
>        Title           : Using the NETCONF Protocol over Transport Layer
>Security (TLS) with Mutual X.509 Authentication
>        Authors         : Mohamad Badra
>                          Alan Luchuk
>                          Juergen Schoenwaelder
>	Filename        : draft-ietf-netconf-rfc5539bis-07.txt
>	Pages           : 11
>	Date            : 2014-12-11
>
>Abstract:
>   The Network Configuration Protocol (NETCONF) provides mechanisms to
>   install, manipulate, and delete the configuration of network devices.
>   This document describes how to use the Transport Layer Security (TLS)
>   protocol with mutual X.509 authentication to secure the exchange of
>   NETCONF messages.  This revision of RFC 5539 documents the new
>   message framing used by NETCONF 1.1 and it obsoletes RFC 5539.
>
>
>The IETF datatracker status page for this draft is:
>https://datatracker.ietf.org/doc/draft-ietf-netconf-rfc5539bis/
>
>There's also a htmlized version available at:
>http://tools.ietf.org/html/draft-ietf-netconf-rfc5539bis-07
>
>A diff from the previous version is available at:
>http://www.ietf.org/rfcdiff?url2=draft-ietf-netconf-rfc5539bis-07
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>Internet-Drafts are also available by anonymous FTP at:
>ftp://ftp.ietf.org/internet-drafts/
>
>_______________________________________________
>Netconf mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/netconf

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 16 Dec 2014 06:48:28 +0100

>     reference "SNMP-TLS-TM-MIB.SnmpTLSFingerprint";

Since we do not define how this function is configured and the
fingerprint matching is a pure local issue, I do not think we
need to detail this here.
 
> no viable username can be mapped, then the TLS session MUST be dropped"?

Yes. I have appended "If there are no further cert-to-name list
entries, the TLS session MUST be terminated.".
 
>    [draft-ietf-netconf-server-model].

I do not think this is needed. NC over SSH does not have this text
either. I want to keep this as short and independent as possible.

> Nits, in section 5", s/presented/Presented/

fixed

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>