Subject: Re: [Netconf] server-model #18: how to configure trust-anchors for SSH X.509-based client certs?

From: Kent Watsen <[email-masked]>
Date: Mon, 5 Jan 2015 15:34:38 +0000

>From both Juergen's and Andy's comments, the consensus appears to be to
close #21 with a "WG consensus NOT granted".  As these comments were made
more then two weeks ago, I'll plan to do this during today's virtual
interim meeting.

Thanks,
Kent

On 12/18/14, 5:21 PM, "Andy Bierman" <[email-masked]> wrote:

>On Thu, Dec 18, 2014 at 1:24 PM, Kent Watsen <[email-masked]> wrote:
>>
>>
>>>Are there implementations that do not have these timeouts? That is,
>>>are there servers that wait forever if a client connects and simply
>>>does nothing?
>>>
>>>I understand that making everything optional features is great because
>>>then there is not much left to implement but then if almost everybody
>>>implements a certain feature, it might be easier to simply make things
>>>mandatory.
>>
>>
>> So this is what issue #21 is about:
>> https://github.com/netconf-wg/server-model/issues/21
>>
>
>The comment cited in the issue tracker does not give a reason
>why servers should not have to implement these timeouts.
>
>> I agree that it seems that servers would always implement these timeouts
>> and thus having no if-feature statement would be OK.  It is what I had
>> originally after all.  But the issue was raise at the IETF 91 meeting
>>and
>> is now being confirmed on the list (see email with subject "server-model
>> #21: Add a feature around the global-params section").  So far there has
>> been no response to that email, though I think you have just now raise
>> some skepticism towards needing to do it.
>
>We should always justify YANG features wrt/ large resource requirement
>or related to an optional protocol, etc.  If we do not think it is an
>implementation
>burden then make it part of the base module.  More importantly, if lack
>of implementation can disrupt operations, then it has to be part of the
>base
>module.
>
>In this case, lack of timeouts can disrupt the server if there is a
>maximum
>number of sessions allowed.  Without timeouts, some app can intentionally
>or accidentally lock out other apps by using up all the allowed admin
>sessions.
>
>
>
>>
>> Kent
>
>
>Andy
>
>>
>> _______________________________________________
>> Netconf mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/netconf