Subject: [Netconf] Summary of the NETCONF Session in IETF #82

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Thu, 17 Nov 2011 08:33:53 +0100

Dear Dan, 

below is a summary and action items from the NETCONF WG session on
November 15, 2011 in Taipei, Taiwan: 
- We had approx. 23 participants in the 1 hour NETCONF session. 
- We reviewed the status of the WG
- We went through the chartered WG items and had a good discussion and
review of the documents.

Status of the documents:

NETCONF Access Control Model and NETCONF System Notifications documents
are both in IETF LC, which end Nov. 28, 2011.
Andy discussed the issues raised by the AD review and will fix them as
part of LC comments.

Non-chartered items:

Update of NETCONF over TLS (5539bis):
Juergen Schoenwaelder explained the addons in 5539bis document, which
are the different methods for the extraction of username from TLS
certificates, and the necessary extensions based on the Chunked Framing
Mechanism as well as the requirements from RFC 6241. The document is
especially necessary because of the security issue of the EOM character
sequence. The participants of the session were in favor to adopt the
document as WG item.

Carsten Bormann raised the issue of deriving user identity from TLS, if
a user has multiple keys. RFC4279 (Pre-Shared Key Ciphersuites for
Transport Layer Security (TLS)) should be checked whether it provides a
solution. Carsten will post his question on PSK key rollover to the list
to start a discussion.

NETCONF over Web Sockets:
Tomoyuki Iijima explained the changes since last time. The document is
based on his implementation experience and proposed to publish as
Experimental RFC. The document does not handle usernames as required by
RFC 6241 should be extended. 
There were comments in the room against the Web Sockets as transport as
it would be not useful in a huge network with some thousand nodes.
Others in the room were in favor of the document as they think a
browser-based solution would be helpful for testing and small networks.
The document will be further discussed on the maillist.
There was a question whether a REST-based solution better than a Web
Socket based solution, which needs to be discussed on the maillist.
Tomoyuki is going to update his implementation and the document
concerning the username handling.

There was some discussion on what the WG should do with other transport
bindings for NETCONF (i.e. NETCONF over BEEP and NETCONF over SOAP) as
they also miss the username handling introduced by RFC 6141. The WG
co-chairs will ask the WG whether these transport bindings are in use,
whether somebody in NETCONF ML is interested to keep them as transport
and in this case whether they volunteer to update the corresponding
document appropriately. It has been proposed to make these documents
historic, if there is not sufficient interest to keep them.

AOB

Juergen proposed to introduce sub-modules for NETCONF. Martin stated
that the natural place to specify the advertisement of submodules would
be in YANG. Juergen will send a summary to the list and then ask peoples
opinion on what to do.

Bert & Mehmet