Subject: [netconf] today's updates to the client-server suite of drafts

From: Kent Watsen <[email-masked]>
Date: Sat, 2 Nov 2019 20:55:21 +0000

The biggest change is in the crypto-types draft, as it continues to try to grapple with the "algorithm" problem.  

I don't think there is consensus for having distinct "iana-" modules for each type of algorithm yet.  For one, if it were a module to be be supported by IANA, one might expect more of a template but, as the algorithm-lists pull from numerous RFCs, how to make a template wasn't clear to me and, besides, having a distinct module for each type of algorithm became a convenient way to define a "config false" list for the algorithms supported by the server.

In any case, I offer this update to the WG for discussion.  Below are the change logs for each draft.

Kent // contributor

===== change logs =====

crypto-types:

   o  Removed all non-essential (to NC/RC) algorithm types.

   o  Moved remaining algorithm types each into its own module.

   o  Added a 'config false' "algorithms-supported" list to each of the
      algorithm-type modules.

trust-anchors (truststore):

   o  Added Henk Birkholz as a co-author (thanks Henk!)

   o  Added PSKs and raw public keys to Truststore.

keystore:

   o  Updated YANG module and examples to incorporate the new
      iana-*-algorithm modules in the crypto-types draft.

tcp-client-server

   o  No update.

ssh-client-server

   o  Removed unnecessary if-feature statements in the -client and
      -server modules.

   o  Cleaned up some description statements in the -client and -server
      modules.

   o  Fixed a canonical ordering issue in ietf-ssh-common detected by
      new pyang.

tls-client-server

   o  Removed unnecessary if-feature statements in the -client and
      -server modules.

   o  Cleaned up some description statements in the -client and -server
      modules.

   o  Fixed a canonical ordering issue in ietf-ssh-common detected by
      new pyang.

http-client-server

   o  Removed "protocol-version" leaf in http-client-grouping.

netconf-client-server

   o  Added refinement to make "cert-to-name/fingerprint" be mandatory
      false.

   o  Commented out refinement to "tls-server-grouping/client-
      authentication" until a better "must" expression is defined.

restconf-client-server

   o  Added refinement to make "cert-to-name/fingerprint" be mandatory
      false.

   o  Commented out refinement to "tls-server-grouping/client-
      authentication" until a better "must" expression is defined.

   o  Updated restconf-client example to reflect that http-client-
      grouping no longer has a "protocol-version" leaf.

---

From: Martin Bjorklund <[email-masked]>
Date: Wed, 06 Nov 2019 10:53:03 +0100 (CET)

Hi,

What happened to the YANG module in
draft-ietf-netconf-trust-anchors-07?  It just has:

   <CODE BEGINS> file "[email-masked]"

   <CODE ENDS>

/martin

Kent Watsen <[email-masked]> wrote:
> 
> The biggest change is in the crypto-types draft, as it continues to
> try to grapple with the "algorithm" problem.
> 
> I don't think there is consensus for having distinct "iana-" modules
> for each type of algorithm yet.  For one, if it were a module to be be
> supported by IANA, one might expect more of a template but, as the
> algorithm-lists pull from numerous RFCs, how to make a template wasn't
> clear to me and, besides, having a distinct module for each type of
> algorithm became a convenient way to define a "config false" list for
> the algorithms supported by the server.
>

---

From: Kent Watsen <[email-masked]>
Date: Wed, 6 Nov 2019 15:23:02 +0000

> draft-ietf-netconf-trust-anchors-07?  

The YANG module contained a TAB character, and the new `rfcfold` script's failure wasn't caught.

Here is the file:  https://github.com/netconf-wg/trust-anchors/blob/master/ietf-truststore.yang <https://github.com/netconf-wg/trust-anchors/blob/master/ietf-truststore.yang>

Kent

> It just has: