Subject: SOAP/HTTP over SSH

From: Pooja Malhotra <[email-masked]>
Date: Thu, 1 Jun 2006 18:07:48 +0530

Hi...

We are planning to implement NetConf.And I am very new to this standard.
In this effort I went thro' the initial draft
"NETCONF Configuration Protocol draft-ietf-netconf-prot-12" proposed by
IETF.
After going through it , I understood the architecture
as shown below in the figure:

      Layer                      Example
         +-------------+      +-----------------------------+
     (4) |   Content   |      |     Configuration data      |
         +-------------+      +-----------------------------+
                |                           |
         +-------------+      +-----------------------------+
     (3) | Operations  |      | NETCONF operation		|
         +-------------+      +-----------------------------+
                |                           |
         +-------------+      +-----------------------------+
     (2) |     RPC     |      |   SOAP over HTTP    		|
         +-------------+      +-----------------------------+
                |                           |
         +-------------+      +-----------------------------+
     (1) |  Transport  |      |  SSH                        |
         |   Protocol  |      |                             |
         +-------------+  	+-----------------------------+

As you can see, our proposed solution indicated that the SSH would
be used as Transport Protocol.This choice was made because it
is mentioned in section 2.4.(Mandatory Transport Protocol )
that SSH is  mandatory  for NetConf. Now we
are stuck with the RPC layer protocol. Intially we thought of
SOAP over HTTP (as RPC layer implementation), But if this the case,
we fail to understand how the SSH layer will communicate with
the RPC layer.
How the SSH layer will interact with the RPC layer over HTTP as it is not
secure.

Also,once the SSH session is opened between the remote machine,
how can we ensure that the data transfer is secured through SOAP/HTTP?

What is the nature of the SSH connection?Is it socket connection like SSL?

We tried implementing SSH using opensource Library from JSch
(for client)and OpenSSH (for SSH Server).
Other tool we tried was Corkscrew(tool for tunneling SSH
through HTTP proxies.)

Also Is it mandatory to implement SSH.Instead can we use SOAP
over HTTPS.

I would be highly obliged if you could please throw some light on
the queries I have and tell us some tools which can help us in
implementation.

Thanks,

Pooja Malhotra
Senior Software Engineer,
MASCON Global ltd.
Bangalore
Karnatka (India)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 1 Jun 2006 19:05:42 +0200

> as shown below in the figure:

It might help if you actually look at the figure contained in the
draft you are citing since the one above is not correct. It figure in
the draft looks like this:

              Layer                      Example
         +-------------+      +-----------------------------+
     (4) |   Content   |      |     Configuration data      |
         +-------------+      +-----------------------------+
                |                           |
         +-------------+      +-----------------------------+
     (3) | Operations  |      | <get-config>, <edit-config> |
         +-------------+      +-----------------------------+
                |                           |
         +-------------+      +-----------------------------+
     (2) |     RPC     |      |    <rpc>, <rpc-reply>       |
         +-------------+      +-----------------------------+
                |                           |
         +-------------+      +-----------------------------+
     (1) |  Transport  |      |   BEEP, SSH, SSL, console   |
         |   Protocol  |      |                             |
         +-------------+      +-----------------------------+

The RPC layer is netconf's RPC mechanism and not SOAP/HTTP. If you run
NETCONF over SSH, there is no SOAP or HTTP involved at all.

> What is the nature of the SSH connection?Is it socket connection

SSH provides your application with so called channels where each
channel realizes a data stream interface (much like a TCP socket if
you like).
 
> Also Is it mandatory to implement SSH. Instead can we use SOAP
> over HTTPS.

I think the wording in the document is rather clear:

: 2.4.  Mandatory Transport Protocol
:
:   A NETCONF implementation MUST support the SSH transport protocol
:   mapping [4].

Sure, you can choose to not support the SSH transport. But then you
can't claim to be compliant.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Andy Bierman <[email-masked]>
Date: Thu, 01 Jun 2006 10:14:09 -0700

> as shown below in the figure:

You have misunderstood the document.
The RPC layer is 'SOAP over HTTP'.
The transport protocol SOAP over HTTPS (HTTP over TLS)
is supported.  You would use this instead of SSH.

Andy

---

From: Andy Bierman <[email-masked]>
Date: Fri, 02 Jun 2006 05:31:37 -0700

Pooja Malhotra wrote:
> Thanks Andy..
> I really appreciate ur help.
> But again..as the draft says
> that SSH is an mandatory transport
> protocol , Can we implement
> SOAP over HTTPS (as transport Protocol)
> and still be netconf compliant.

Not unless you also implement NETCONF over SSH.

> Regards,
> Pooja

Andy

> 
> 
> -----Original Message-----
> From: Andy Bierman [mailto:[email-masked]]
> Sent: Thursday, June 01, 2006 10:44 PM
> To: Pooja Malhotra
> Cc: [email-masked]
> Subject: Re: SOAP/HTTP over SSH
> 
> 
> Pooja Malhotra wrote:
>> Hi...
>>

---

From: Pooja Malhotra <[email-masked]>
Date: Fri, 2 Jun 2006 15:09:44 +0530

Thanks Andy..

Regards,
Pooja

-----Original Message-----
From: Andy Bierman [mailto:[email-masked]]
Sent: Thursday, June 01, 2006 10:44 PM
To: Pooja Malhotra
Cc: [email-masked]
Subject: Re: SOAP/HTTP over SSH

Andy