Subject: Re: [Netconf] keystore and the client/server drafts

From: Benoit Claise <[email-masked]>
Date: Mon, 10 Jul 2017 12:03:14 +0200

Hi Kent,

Are all of these four new drafts below posted?
I don't see the updated ssh-client-server and tls-client-server version 4?

Regards, Benoit
> Hi Balazs,
>
> 1) Fixed in my local copy.
>
> 2) Fixed to my local copy.  I had added it to the tls/ssh-client-groupings, just missed it in the tls/ssh-server-groupings...
>
>
> You can see these changes here:
>
>    https://github.com/netconf-wg/ssh-client-server/commit/34d673a812b9f2015af072e7fedfd8a6afb0a3cf
>    https://github.com/netconf-wg/tls-client-server/commit/e157926f6de69dce59d15204e7845a98a2bebad9
>    https://github.com/netconf-wg/netconf-client-server/commit/9542ce49632a6be6be083ea7475d13007eddd817
>    https://github.com/netconf-wg/restconf-client-server/commit/1e7a203670bc03b719151e460737af2e0491ba23
>
> I'll defer posting a new draft for now.
>
> Kent
>
>
> -----ORIGINAL MESSAGE-----
>
> Hi,
>
> 1) Kent, you added some text to the description of 'trusted-ca-certs' of tls/ssh-client-grouping, but I think you missed the symmetrical text from the tls/ssh-server-grouping. I believe this sentence should be added to tls/ssh servers, to 'trusted-ca-certs':
>
> "A client certificate is authenticated if it has a valid chain of trust to a configured trusted CA certificate."
>
> 2) We talked about adding must statements for 'trusted-*' nodes, and for the tls/ssh server cases we agreed that some TLS/SSH servers might be ok to not do client certificate authentication, but Netconf and Restconf servers do require client certificate. I don't see this expressed with a must statement in the new versions of the drafts:
>
>                uses ts:tls-server-grouping {
>                  augment "client-auth" {
>                    description
>                      "Augments in the cert-to-name structure.";
>                    uses cert-maps-grouping;
>                  }
>                }
>
> I'd expect a 'must trusted-ca-certs or trusted-client-certs' line.
>
> Br,
> Balázs
>
>
>
> -----Original Message-----
> From: Netconf [mailto:[email-masked]] On Behalf Of Kent Watsen
> Sent: Wednesday, June 14, 2017 2:04 AM
> To: [email-masked]
> Subject: [Netconf] keystore and the client/server drafts
>
>
> Dear WG,
>
> These latest updates reflect all comments received and close all of the open issues.  At this point, there are no more issues to resolve.
> I believe that these drafts are now ready for Last Call.
>
>    https://tools.ietf.org/html/draft-ietf-netconf-keystore-02
>    https://tools.ietf.org/html/draft-ietf-netconf-ssh-client-server-03
>    https://tools.ietf.org/html/draft-ietf-netconf-tls-client-server-03
>    https://tools.ietf.org/html/draft-ietf-netconf-netconf-client-server-03
>    https://tools.ietf.org/html/draft-ietf-netconf-restconf-client-server-03
>
> Thanks,
> Kent
>
>
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>
>
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

---

From: Kent Watsen <[email-masked]>
Date: Mon, 10 Jul 2017 14:59:44 +0000

Hi Benoit,

4 YANG modules were updated in 2 two drafts (the NC/RC c/s drafts).  

The ssh/tls c/s drafts were not updated.  There two drafts only contain
a single grouping that is used by both the client/server modules in the
NC/RC drafts.

So the ssh/tls drafts are still -03, which the nc/rc drafts were bumped
up to -04.  Makes sense?

Kent

--

Hi Kent,

Regards, Benoit

---

From: Kent Watsen <[email-masked]>
Date: Mon, 10 Jul 2017 18:06:09 +0000

A couple typos below!

  s/There/These/
  s/which/while/

K.

Hi Benoit,

Kent

--

Hi Kent,

Regards, Benoit