Subject: [Netconf] xml start directive with ssh

From: David Reid <[email-masked]>
Date: Thu, 25 Jun 2009 14:12:01 -0400

>From rfc4742 page 3:

   Once the SSH session has been established, the user (or application)
   will invoke NETCONF as an SSH subsystem called "netconf".  Subsystem
   support is a feature of SSH version 2 (SSHv2) and is not included in
   SSHv1.  Running NETCONF as an SSH subsystem avoids the need for the
   script to recognize shell prompts or skip over extraneous
   information, such as a system message that is sent at shell start-up.
   However, even when a subsystem is used, some extraneous messages may
   be printed by the user's start-up scripts.  Implementations MUST skip
   over these messages by searching for an 'xml' start directive, which
   MUST be followed by a <hello> element in the 'NETCONF' namespace.

I want to make sure I understand this correctly. Does this mean:

Both the netconf client and server MUST send an xml start directive before
the <hello> message and MAY send an xml start directive before any other
message when running over SSH.

When not running over SSH, the xml start directive is always optional.

Anything sent by either the client or server before the xml start directive
MUST be ignored when running over SSH.

When not running over SSH, any extraneous data results in a parse error.

-David Reid

---

From: Phil Shafer <[email-masked]>
Date: Thu, 25 Jun 2009 14:17:17 -0400

>   MUST be followed by a <hello> element in the 'NETCONF' namespace.

IMHO this is not right.  An SSH subsystem won't run "user's start-up
scripts", so the skipping issue is moot.  Also "'xml' start directive"
should be "XML Declaration", but that's minor.

>message when running over SSH.

Since hello and other messages are individual XML documents, they
MAY being with an XML declaration.

>MUST be ignored when running over SSH.

This is what it says, but I don't see this as real world.

>When not running over SSH, any extraneous data results in a parse error.

This RFC can't say anything about other transports.

Thanks,
 Phil

---

From: WashamFan <[email-masked]>
Date: Fri, 26 Jun 2009 09:52:47 +0800

Hi,

>From this sentence:

   Implementations MUST skip
   over these messages by searching for an 'xml' start directive, which
   MUST be followed by a <hello> element in the 'NETCONF' namespace.

<hello> message with an XML declaration is a MUST.

washam

---

From: Andy Bierman <[email-masked]>
Date: Thu, 25 Jun 2009 19:50:48 -0700

> <hello> message with an XML declaration is a MUST.

This text is a perfect example of the "CLI mentality" in place
when NETCONF was written.  It was assumed that implementations
would do a normal CLI login, and then magically (or manually)
switch to "NETCONF mode", after a bunch of screen-scraping.
(Wrong!)

IMO, this text should be removed somehow.  NETCONF agents should
expect only a stream of XML instance documents, not garbage text
sometimes.  The replacement text should say the manager MUST send
only complete XML instance documents (PDUs) and nothing else.

I doubt any agents actually support this requirement.
Since a manager has to explicitly start up the 'netconf' subsystem
in its implementation, there is no reason whatsoever for
the manager to send garbage text after that.
The manager knows (regardless of port number) whether it
is connecting to a plain CLI or to a NETCONF session.
At the time 4742 was written, nobody in the WG was aware of how
SSH subsystems actually worked.

> washam

Andy

---

From: Phil Shafer <[email-masked]>
Date: Thu, 25 Jun 2009 23:20:19 -0400

>switch to "NETCONF mode", after a bunch of screen-scraping.

This is the part that makes no sense, since NETCONF uses SSH's
subsystem mechanism.  There's no CLI login stuff going on.  The
sshd runs the netconf subsystem directly with no login shell, making
it perfectly suitable for use as a protocol transfer (just like
sftp).  I agree these words need removed.

Thanks,
 Phil

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 29 Jun 2009 10:15:01 -0700

>>>>> On Thu, 25 Jun 2009 19:50:48 -0700, Andy Bierman <[email-masked]> said:

AB> At the time 4742 was written, nobody in the WG was aware of how
AB> SSH subsystems actually worked.

No, it was a deliberate decision that some systems might want to only
start a netconf agent based on a command line flag.  Subsystems were
understood at the time, people just wanted to be able to exercise both
potential "start" mechanisms.

---

From: Andy Bierman <[email-masked]>
Date: Mon, 29 Jun 2009 10:53:02 -0700

> potential "start" mechanisms.

Well, this other 'start mechanism' was never documented,
if it was discussed in any detail.  It was understood
at the time that the 'netconf' subsystem must be specified,
when starting up ssh from the command line.

There was discussion at the time about logging into the CLI,
however that is done, and then some sort of 'switch to NETCONF'
command would be issued, and the NETCONF subsystem would
then be started somehow.

I really don't remember any rules about garbage text passed to the
NETCONF subsystem before the <hello>.  What if the <hello>
is in a string or XML comment, and not 'real'?  Is the
garbage supposed to be parsed in case there is any XML or
quoted strings in there?

I think the NETCONF subsystem should only send and receive
XML instance documents.  I would be surprised if any implementations
accepted arbitrary garbage text at any time.

Andy

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 29 Jun 2009 12:42:06 -0700

>>>>> On Mon, 29 Jun 2009 10:53:02 -0700, Andy Bierman <[email-masked]> said:

AB> I think the NETCONF subsystem should only send and receive
AB> XML instance documents.  I would be surprised if any implementations
AB> accepted arbitrary garbage text at any time.

I do agree that it would be a much cleaner service if we stop trying to
do the odd protocol mashing.  If a bis is ever done I agree it should be
dropped.