Subject: Re: [netconf] Question about RFC 6242 : netconf over ssh

From: "Jeffrey Ladouceur (jladouce)" <[email-masked]>
Date: Mon, 8 Jun 2020 15:39:01 +0000

Hello,

It's my understanding that running netconf over a pseudo terminal via ssh (i.e. pty-req) is most likely not a widely supported use-case as I don't see any refence to such use-case.

The pseudo terminal is typically used by an ssh client when the program on the server side expect to interreact with a terminal. To the best of my knowledge, a netconf server has no expectation, and in-fact may expect to be directly connected to the ssh server instance and not to a pty device.

Would it be reasonable for a netconf subsytem to sanitize its STDIN/STDOUT/STDERR and if they were attached to a tty to exit and drop the connection ?

Regards,
Jeffrey Ladouceur 

On 2020-05-07, 4:59 PM, "netconf on behalf of Jeffrey Ladouceur (jladouce)" <[email-masked] on behalf of jladouce=[email-masked]> wrote:

    Hello,

    I would like some input on a the following use-case and possible acceptable outcomes. 

    Summary:

    RFC 6242 doesn't explicitly indicate any lower level messaging in RFC 4254 which could "break" the netconf messaging between client and server.
    Specifically, the client can send a https://tools.ietf.org/html/rfc4254#section-6. "pty-req" just prior to invoking the "netconf" ssh subsystem.
    Having a pseudo-terminal device in between the client-server could result in the breakage of the messaging being client/server. 

    RFC 6242 states:
    https://tools.ietf.org/html/rfc6242#section-3 (Starting NECONF over SSH)

    1. Once the user has been successfully authenticated, the SSH client will invoke the "ssh-connection" service, also known as the SSH connection protocol.
    2. After the ssh-connection service is established, the SSH client will open a channel of type "session", which will result in an SSH session.
    3. Once the SSH session has been established, the NETCONF client will invoke NETCONF as an SSH subsystem called "netconf".
    4. Running NETCONF as an SSH subsystem avoids the need for the script to recognize shell prompts or skip over extraneous information, such as a system message that is sent at shell start-up.

    If I were to translate these steps into the corresponding RFC 4254 messages.

    Step (2) translates to:
    https://tools.ietf.org/html/rfc4254#section-6.1 (Opening a Session) , upon which a session has been established

    Step (3), this translates to https://tools.ietf.org/html/rfc4254#section-6.5 (Starting a Shell or a Command), but specifically the "subsystem" variant.
    With a string of “subsystem” and “subsystem name” set to netconf.

    Question:
    1- Does  RFC 6242 imply that it expects direct client/server connection without any interference from a pty device ? The text in item (4) appears to me to imply this.

    From what I can tell, the usage of this pty pattern is when a client wants netconf over tty.

    Thank you for any feedback.

    Regards,
    Jeff

    _______________________________________________
    netconf mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/netconf