Subject: [Netconf] CallHome question

From: Andy Bierman <[email-masked]>
Date: Thu, 19 Jan 2017 12:09:07 -0800

Hi,

I am implementing CallHome and I do not see any text in sec 3.
about dropping a connection if the peer is not doing the right thing.
What if the TCP initiator is really another client doing a port scan
and connects to the callhome socket?  i.e., the initiator starts sending
data right away instead of waiting for the callhome client to start
an SSH or TLS session.

Seems like the connection should get dropped right away instead of
ignoring the data.

I would also like the RFC to be published soon.
I know it is waiting on the normative RESTCONF reference,
but it is also waiting on 2 I-Ds as informative references.
IMO the server model will not be done very soon and its mention
in sec. 4.2 does not impact this draft at all.

Andy

---

From: Kent Watsen <[email-masked]>
Date: Thu, 19 Jan 2017 20:38:47 +0000

Hi Andy,

> Seems like the connection should get dropped right away instead of

I'm unsure if this is an omission or implementation detail.  For instance,
RFC4253 (SSH) doesn't specify what a server should do if the client fails
to send anything after the TCP session has been established.  Clearly it
times out, but *when* is left unspecified.

Step C3 says that the NC/RC-client immediately starts the SSH/TLS
protocol after TCP session establishment, so any timeouts or malformed
message handling would go to the SSH/TLS library being used.   Surely
such occurrences are caught and control is returned to the app, which I'd
expect to close the connection.

Are you suggesting an erratum be filed for this?

> in sec. 4.2 does not impact this draft at all.

I've been told that Informational references do not block a draft from
moving to RFC state.  On this page, the call-home draft is listed as
only being blocked by the RESTCONF draft:
    - https://www.rfc-editor.org/cluster_info.php?cid=C279

Kent

---

From: Andy Bierman <[email-masked]>
Date: Thu, 19 Jan 2017 12:49:13 -0800

> Are you suggesting an erratum be filed for this?

No -- I think after step C3 the client will be expecting a specific
response.
If this takes care of the client dropping the connection due
to an invalid SSH or TLS session startup.

In implementation, the client does not need to to a read after the accept()
on the callhome socket (as a server would normally do).  The client can
just start sending on the new connection.

>     - https://www.rfc-editor.org/cluster_info.php?cid=C279

OK

Andy