Subject: [netconf] updates to the client/server suite of drafts

From: Kent Watsen <[email-masked]>
Date: Fri, 18 Oct 2019 22:27:50 +0000

Below are the change-logs for the updates just posted.

Not yet incorporated:

  1. a resolution to the "algorithms" problem in the
     crypto-types draft.  (IANA templates?)
  2. an update to the Truststore draft to add support
     for PSK and raw keys.
  3. an update to the Keystore draft to add support
     for PSK and raw keys. (Henk's response pending)
  4. an update to the SSH and TLS drafts to reflect
     the final outcome to (1).

Kent

===== change logs =====

crypto-types:

  - Added a "key-format" identity.
  - Added symmetric keys to the example in the Examples section.

truststore:

  - Editorial changes only.

keystore:

  - Updated examples to incorporate new "key-format" identities.
  - Made the two "generate-*-key" RPCs be "action" statements
    instead.

tcp-client-server: (changes from co-author Micheal Scharf)

  - Moved the common model section to be before the
    client and server specific sections.
  - Added sections "Model Scope" and "Usage Guidelines
    for Configuring TCP Keep-Alives" to the Common
    Model section.

ssh-client-server:

  - Updated examples to reflect ietf-crypto-types change
    (e.g., identities --&gt; enumerations)
  - Updated "server-authentication" and "client-authentication"
    nodes from being a leaf of type "ts:host-keys-ref" or 
    "ts:certificates-ref" to a container that uses 
    "ts:local-or-truststore-host-keys-grouping" or 
    "ts:local-or-truststore-certs-grouping".

tls-client-server:

  - Updated "server-authentication" and "client-authentication"
    nodes from being a leaf of type "ts:certificates-ref" to a
    container that uses "ts:local-or-truststore-certs-grouping".
  - Note: this update needed by the TCPM WG.

http-client-server:

  - in ietf-http-client, removed all but the "basic" 
    authentication scheme.
  - in ietf-http-client, factored out a "client-identity-grouping"
    grouping, which is now used in both the primary and proxy
    configuration models.
  - in ietf-http-server under /client-authentication/local, added
    an ability to configure authentication credentials for the
    "basic" authentication scheme.
  - Note: this update was blocking the adoption call from before.

netconf-client-server:

  - Refactored both the client and server modules similar to
    how the ietf-restconf-server module was refactored in -13 
    presented in Montreal.

restconf-client-server:

  - Refactored both the client and server modules similar to
    how the ietf-restconf-server module was refactored in -13 
    presented in Montreal.
  - Added missing "or https-listen" clause in a "must" expression.

Kent // contributor

---

From: Martin Bjorklund <[email-masked]>
Date: Mon, 21 Oct 2019 14:07:35 +0200 (CEST)

Hi,

>   - Added symmetric keys to the example in the Examples section.

I note that the issue with the union of enum and uint16 is not
resolved (see thread
https://mailarchive.ietf.org/arch/msg/netconf/p8oBYkx7Ps7J8ATsqFslX4ApvWg)

Also, there is no explanation of what a "key-format" really is.
There are just a bunch of identities.

/martin

---

From: Kent Watsen <[email-masked]>
Date: Mon, 21 Oct 2019 16:39:37 +0000

Hi Martin,

Thanks for double-checking on such things.

> https://mailarchive.ietf.org/arch/msg/netconf/p8oBYkx7Ps7J8ATsqFslX4ApvWg)

Right, but tentative (pending the IANA template discussion) plan is replace the enumeration with an identity, or perhaps a string.

This was what was meant by:

	Not yet incorporated:

> There are just a bunch of identities.

Not completely true, for instance:

    leaf key-format {
      nacm:default-deny-write;
      when "../key";
      type identityref {
        base symmetric-key-format;
      }
      description "Identifies the symmetric key's format.";
    }

That said, if we choose to pursue this approach (using a "key-format" leaf), we should add more detail to its definition to improve understandability.

Kent // contributor