Subject: [Netconf] Barry Leiba's No Objection on draft-ietf-netconf-call-home-11: (with COMMENT)

From: "Barry Leiba" <[email-masked]>
Date: Tue, 20 Oct 2015 11:47:35 -0700

Barry Leiba has entered the following ballot position for
draft-ietf-netconf-call-home-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-netconf-call-home/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

In Section 2.1, C5:

       This validation MAY be accomplished by certificate
       path validation or by comparing the host key or certificate to a
       previously trusted or "pinned" value.

It's a finnicky point, but I think it's an important one:  You list two
methods for validation: (1) cert path validation, and (2) comparing to a
pinned value.  Is it (A) acceptable for the validation to be done by
other methods as well as those two?  Or is it (B) required that one of
those two be used, but either is acceptable?

If (A), then the text is fine as it is.  But if (B), the text as written
doesn't require the use of one of the specified methods, because "MAY" is
optional.  If you mean (B), you should write it as "MUST be accomplished
either by [...] or by [...]."  Alternatively, you could just add it to
the previous sentence, as, '...client MUST validate the server's
presented host key or certificate, either using certificate path
validation or by comparing the host key or certificate to a previously
trusted or "pinned" value.'

(That wasn't a DISCUSS point because I think implmentors are likely to
get it right anyway.  But I do think the text needs to be tightened up in
order to make it fully clear.)

In Section 2.1, C8, an even more finnicky and not very important point:

       Once the SSH or TLS connection is established, the NETCONF/
       RESTCONF client MUST immediately start using either the NETCONF-
       client [RFC6241] or RESTCONF-client [draft-ietf-netconf-restconf]
       protocol.

What *else* might the client do, which merits a MUST here?  I think all
you should say here is, "Once the SSH or TLS connection is established,
the NETCONF/RESCONF client starts using either [...the protocols...]."

Continuing...

       Assuming the use of the IANA-assigned ports, the
       NETCONF-client protocol is started when the connection is
       accepted on either port PORT-X or PORT-Y and the RESTCONF-client
       protocol is started when the connection is accepted on port PORT-
       Z.

But no: the (NETCONF/RESCONF)-client protocol is NOT started when the
connection is accepted (that was in C2), but when the SSH/TLS
connection/session is established.  Which you already said in the
previous sentence, and C1 already said what ports the client listens on. 
Why is this sentence even here?  Why not just remove it?

These same two comments apply to S6 in Section 3.1.

---

From: Kent Watsen <[email-masked]>
Date: Wed, 21 Oct 2015 22:03:59 +0000

Hi Barry,

Thank you for your review.

>those two be used, but either is acceptable?

It is A, but these two are by far the most common.

>trusted or "pinned" value.'

I’ll plan to keep the current text then.

>the NETCONF/RESCONF client starts using either [...the protocols...]."

A misbehaving client might try to start another protocol, or send some other kind of data, or maybe not do it “immediately”.   That said, I’m okay removing the "MUST immediately” if you think it improves the text.

>Why is this sentence even here?  Why not just remove it?

I think you’re saying two things.

1. The "is started when the connection is accepted” is inaccurate, in that it isn’t really started then.  Perhaps “is used when the connection is accepted” would be better?

2. The sentence may not be needed at all.   I think that it is needed in that it clarifies the expected behavior. For instance, we wouldn’t want a client that is suppose to start NETCONF to accidentally start RESTCONF.  Makes sense, or do you still feel that the sentence should be removed?

>These same two comments apply to S6 in Section 3.1.

ACK.

Thanks again,
Kent

---

From: Barry Leiba <[email-masked]>
Date: Thu, 22 Oct 2015 08:21:35 -0400

Hi, Kent, and thanks for the response.

First, note that all my comments are non-blocking review comments,
which you should consider no differently to any other last-call
comments.

> It is A, but these two are by far the most common.

Good; then, as you say, leave the text as it is.

> A misbehaving client might try to start another protocol, or send some
> other kind of data, or maybe not do it “immediately”.   That said, I’m
> okay removing the "MUST immediately” if you think it improves the text.

Well, as I say, it's not an important point, so please do as you think
best.  I personally think it's better as I suggest above, and it's
pretty far-fetched to think that a NETCONF client would suddenly start
talking RESCONF or FTP or some such.  But just consider that as input,
and no need to discuss it further..

> I think you’re saying two things.

Yes.

> 1. The "is started when the connection is accepted” is inaccurate, in that
> it isn’t really started then.  Perhaps “is used when the connection is
> accepted” would be better?

Not really.  "...is started after the TLS/SSH connection is
established" seems to be the correct thing.  But that's already said
in the first sentence, which is why...

> 2. The sentence may not be needed at all.

Yes.

> I think that it is needed in that it clarifies the expected behavior. For
> instance, we wouldn’t want a client that is suppose to start NETCONF
> to accidentally start RESTCONF.  Makes sense, or do you still feel
> that the sentence should be removed?

As I noted above, I think that's a pretty far-fetched scenario.
You're basically saying "a NETCONF client needs to behave as a NETCONF
client, and not as something else."  If you really think that needs to
be said, go ahead and say it (as I said, these are just comments).
Maybe it'd be better to say that up in the front, in a summary of how
this works: the NETCONF/RESCONF server opens a TCP connection to the
NETCONF/RESCONF client, which accepts the connection, secures the
connection with SSH or TLS, and then behaves as a normal
NETCONF/RESCONF client afterward.

Do you really think there's a danger of anyone misunderstanding that
down here?  (And, again, no need to answer that to me: at this point
just do as you think best, and thanks for considering my comments.)

Barry

---

From: Kent Watsen <[email-masked]>
Date: Fri, 23 Oct 2015 00:11:00 +0000

Hi Barry,

I CC-ed you on a response to Suresh and Jari on the Gen-ART Telechat review thread.  As you saw, Suresh also would like to see the two words “MUST immediately” be removed.

To be clear, the “MUST immediately start” text shows up in four places: C3, C8, S3, and S6.  In all four of these places, I would replace "must immediately start” with just “start”.  

Barry said that his comments should be handled like any other Last Call comment.  To that end, I have just opened https://github.com/netconf-wg/call-home/issues/12 to track this issue.  The issues is currently in the VERIFY state.

Now I ask the working group, do we have consensus to remove “MUST immediately” from the text in C3, C8, S3, and S6?   I’ll plan to make this change on Monday if no objection is raised by then.

>just do as you think best, and thanks for considering my comments.)

Actually, I do.  The history of this draft is that there has been a lot of misunderstanding about how the solution works and over-communcating has been key to clearing it up.  So I really do think it best to keep the following text as it is:

   Assuming the use of the IANA-assigned ports, the
   NETCONF-client protocol is started when the connection is
   accepted on either port PORT-X or PORT-Y and the RESTCONF-client
   protocol is started when the connection is accepted on port PORT-Z.

Thank you again Barry.  I'll consider this comment resolved unless anyone disagrees.

Kent

---

From: t.petch <[email-masked]>
Date: Fri, 23 Oct 2015 13:09:49 +0100

----- Original Message -----
From: "Kent Watsen" <[email-masked]>
To: "Barry Leiba" <[email-masked]>
Cc: <[email-masked]>; "The IESG" <[email-masked]>;
<[email-masked]>; <[email-masked]>
Sent: Friday, October 23, 2015 1:11 AM

> I CC-ed you on a response to Suresh and Jari on the Gen-ART Telechat
review thread.  As you saw, Suresh also would like to see the two words
“MUST immediately” be removed.
>
> To be clear, the “MUST immediately start” text shows up in four
places: C3, C8, S3, and S6.  In all four of these places, I would
replace "must immediately start” with just “start”.
>
> Barry said that his comments should be handled like any other Last
Call comment.  To that end, I have just opened
https://github.com/netconf-wg/call-home/issues/12 to track this issue.
The issues is currently in the VERIFY state.
>
> Now I ask the working group, do we have consensus to remove “MUST
immediately” from the text in C3, C8, S3, and S6?   I’ll plan to make
this change on Monday if no objection is raised by then.

Weeell, I am happy with the change in principle but grammatically it
becomes 'starts' and not 'start'.  And that is not quite the same
meaning but I think that that is ok.  I did contemplate /starts
using/uses/  but that is a further shift in the semantics which I think
goes too far.

Tom Petch

> Actually, I do.  The history of this draft is that there has been a
lot of misunderstanding about how the solution works and
over-communcating has been key to clearing it up.  So I really do think