Subject: [netconf] updates to client/server suite of drafts

From: Kent Watsen <[email-masked]>
Date: Wed, 20 Nov 2019 20:26:33 +0000

I just pushed an update to all the client/server drafts (except TCP).  Below is the change log entry for each draft.

The most noteworthy update is that the http-01 update should (hopefully) resolve the concerns raised by the httpbis chairs.

The biggest non-update is that the "config false" algs-supported lists were NOT moved from crypto-types to the ssh/tls drafts, only because I ran out of time (and I'm hoping that my co-authors all do it).

There are still number of FIXME's remaining in the drafts.

Kent // contributor

crypto-types:
   -  Added the four features: "[encrypted-]one-[a]symmetric-key-
      format", each protecting a 'key-format' identity of the same name.
   -  Added 'must' expressions asserting that the 'key-format' leaf
      exists whenever a non-hidden key is specified.
   -  Improved the 'description' statements and added 'reference'
      statements for the 'key-format' identities.
   -  Added a questionable forward reference to "encrypted-*" leafs in a
      couple 'when' expressions.

truststore:
   -  Added new "Support for Built-in Trust Anchors" section.
   -  Removed spurious "uses ct:trust-anchor-certs-grouping" line.

keystore:
   -  Added new "Support for Built-in Trust Anchors" section.
   -  Added 'must' expressions asserting that the 'key-format' leaf
      whenever an encrypted key is specified.

tcp-client-server:
  - No update

ssh-client-server:
   -  Removed choice local-or-external by removing the 'external' case
      and flattening the 'local' case and adding a "client-auth-config-
      supported" feature.
   -  Updated examples to include the "*-key-format" nodes.
   -  Augmented-in "must" expressions ensuring that locally-defined
      public-key-format are "ct:ssh-public-key-format" (must expr for
      ref'ed keys are TBD).

tls-client-server:
   -  Removed choice local-or-external by removing the 'external' case
      and flattening the 'local' case and adding a "client-auth-config-
      supported" feature.
   -  Removed choice required-or-optional.
   -  Updated examples to include the "*-key-format" nodes.
   -  Augmented-in "must" expressions ensuring that locally-defined
      public-key-format are "ct:ssh-public-key-format" (must expr for
      ref'ed keys are TBD).

http-client-server:
   -  Modified Abstract and Intro to be more accurate wrt intended
      applicability.
   -  In ietf-http-client, removed "protocol-version" and all auth
      schemes except "basic".
   -  In ietf-http-client, factored out "client-identity-grouping" for
      proxy connections.
   -  In ietf-http-server, removed "choice required-or-optional" and
      "choice local-or-external".
   -  In ietf-http-server, moved the basic auth under a "choice auth-
      type" limited by new "feature basic-auth".

netconf-client-server:
   -  Updated examples to include the "*-key-format" nodes.
   -  Updated examples to remove the "required" nodes.
   -  Updated examples to remove the "client-auth-defined-elsewhere"
      nodes.

restconf-client-server:
   -  Updated examples to include the "*-key-format" nodes.
   -  Updated examples to remove the "required" nodes.

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 21 Nov 2019 12:10:27 +0100 (CET)

Hi,

Two quick comments inline. 

>       exists whenever a non-hidden key is specified.

This can be made simpler:

OLD:

       leaf public-key-format {
         nacm:default-deny-write;
         when "../public-key";
         type identityref {
           base public-key-format;
         }
         description "Identifies the key's format.";
       }
       leaf public-key {
         nacm:default-deny-write;
         type binary;
         must "../public-key-format";
         mandatory true;
         description
           "The binary value of the public key.  The interpretation
            of the value is defined by 'public-key-format' field.";
       }

Now, since public-key is mandatory, the 'when' expression on
public-key-format will always be true (in a valid config).  Hence it
isn't needed.  And also, since public-key is mandatory the must on
public-key really just says that public-key-format is also mandatory:

NEW:

       leaf public-key-format {
         nacm:default-deny-write;
         mandatory true;
         type identityref {
           base public-key-format;
         }
         description "Identifies the key's format.";
       }
       leaf public-key {
         nacm:default-deny-write;
         type binary;
         mandatory true;
         description
           "The binary value of the public key.  The interpretation
            of the value is defined by 'public-key-format' field.";
       }

>       couple 'when' expressions.

Questionable indeed.  I suggest you remove the when expression
instead. You have must expressions that says thatt the key-format leaf
must exist in the relevant cases anyway.

/martin

---

From: Kent Watsen <[email-masked]>
Date: Thu, 21 Nov 2019 17:00:40 +0000

Hi Martin,

> This can be made simpler:

True.  I got caught up in the following the pattern used for symmetric/private key groupings.

>       <snip/>
>     <snip/>

Applied to my local copy.

> must exist in the relevant cases anyway.

Hmmm, but "private-key-format" should NOT be present (I think!) for a "hidden-private-key".  Maybe this?

OLD:
	when "../private-key or ../encrypted-private-key"

NEW:
	when "not(../hidden-private-key)"

BTW, the forward reference was "needed" due to the inability for the consuming module (ietf-keystone) to refine (?) the "when" expression when using the grouping.   Please add a YANG-next issue if you think this should be supported someday.

Kent // contributor

---

From: Martin Bjorklund <[email-masked]>
Date: Fri, 22 Nov 2019 09:23:22 +0100 (CET)

> 	when "not(../hidden-private-key)"

Or perhaps use a must in the 'hidden-private-key' instead:

  must 'not(../private-key-format)';

/martin

---

From: Kent Watsen <[email-masked]>
Date: Fri, 22 Nov 2019 15:32:17 +0000

Hi Martin,

>  must 'not(../private-key-format)';

Better, more symmetric.  Applied to my local copy.

Thanks,
Kent