Subject: [Netconf] I-D Action: draft-ietf-netconf-zerotouch-18.txt

From: [email-masked]
Date: Tue, 17 Oct 2017 21:48:58 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Network Configuration WG of the IETF.

        Title           : Zero Touch Provisioning for NETCONF or RESTCONF based Management
        Authors         : Kent Watsen
                          Mikael Abrahamsson
                          Ian Farrer
	Filename        : draft-ietf-netconf-zerotouch-18.txt
	Pages           : 80
	Date            : 2017-10-17

Abstract:
   This draft presents a secure technique for establishing a NETCONF or
   RESTCONF connection between a newly deployed device, configured with
   just its preconfigured initial state (e.g., factory default
   settings), and its deployment specific network management system
   (NMS).

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-netconf-zerotouch/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-netconf-zerotouch-18
https://datatracker.ietf.org/doc/html/draft-ietf-netconf-zerotouch-18

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-netconf-zerotouch-18

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Kent Watsen <[email-masked]>
Date: Wed, 18 Oct 2017 05:03:37 +0000

This update resolves all the issues from Martin's review (see Change
Log for details).  Since quite a lot changed, I also went thru the 
whole thing from top to bottom to catch anything I may have missed.
I believe that this document is now ready for a final (hopefully)
last call.

Kent // contributor

--

Abstract:

The IETF datatracker status page for this draft is:
https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dnetconf-2Dzerotouch_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=cG8QrJkXZ34w3AfC5XxlxDhroR1a-PjfuSzKIdzFL2w&s=aKQi3cZIjq6QbWmQdSsLt6ViAKMSNuEPIlyqN_Cu1wo&e=

There are also htmlized versions available at:
https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dnetconf-2Dzerotouch-2D18&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=cG8QrJkXZ34w3AfC5XxlxDhroR1a-PjfuSzKIdzFL2w&s=RWVPrJMpGrqN1rc5UJHooULUDrdQp2tT4rPW-YxUeJ0&e=
https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_html_draft-2Dietf-2Dnetconf-2Dzerotouch-2D18&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=cG8QrJkXZ34w3AfC5XxlxDhroR1a-PjfuSzKIdzFL2w&s=9ykXx8atI6vFikx660DdMQfZ4IkFOzwOswhaHnMYiSw&e=

A diff from the previous version is available at:
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dnetconf-2Dzerotouch-2D18&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=cG8QrJkXZ34w3AfC5XxlxDhroR1a-PjfuSzKIdzFL2w&s=peqGSGySYUVsRjOM8zJA5xAobLLBI9myavP39G770wA&e=

Internet-Drafts are also available by anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.ietf.org_internet-2Ddrafts_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=cG8QrJkXZ34w3AfC5XxlxDhroR1a-PjfuSzKIdzFL2w&s=19QyGsRrVjptyKMhWOhXjCUxYxBe8yNH-rzGTlf4Ah0&e=

_______________________________________________
Netconf mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netconf&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=cG8QrJkXZ34w3AfC5XxlxDhroR1a-PjfuSzKIdzFL2w&s=UHJ5ibCR53t0tZbxjkMyNyj7Ct62HrhUP1ekwFal43k&e=

---

From: Kent Watsen <[email-masked]>
Date: Wed, 18 Oct 2017 16:09:48 +0000

As a follow-up to this.  I asked a question to the NETMOD list yesterday
regarding how this draft has a 'must' statement to a 'choice' node.  The
tools I'm using all seemed okay with it, and there were no submission 
validation warnings or errors.  That said, it seems to be illegal and I
should fix it immediately.

It would be incredibly helpful if folks could take a look at all use of 
XPaths in the YANG modules.  Also, a close look at the various examples
would be helpful, as the last update switched some examples from NETCONF
to RESTCONF, and other examples from XML to JSON.  Sadly, tool-support
is lacking for validating RESTCONF-based and yang-data based instance 
documents.  So, manual-checking of most of the examples in this draft
is needed now.

One last thing, in addressing one of the comments, I added a new RPC
input parameter (previously modelled as query parameters) called 
"untrusted-connection".  This query-parameters enables a promotion of
an untrusted connection to a trusted connection, through which normal
interactions can occur.  Anyway, it would be good for folks to look 
at that also.

I'll start fixing the 'must' issue.  In the meanwhile, it would be 
good to receive quick comments on the general use of xpaths, the 
various examples, and the "untrusted-connection" bits. (TIA!)

Kent (contributor/author)

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 19 Oct 2017 15:57:03 +0200 (CEST)

Kent Watsen <[email-masked]> wrote:
> XPaths in the YANG modules.

I checked these tools with 'yanger' (another open source YANG
compiler, found on my github page).  It complains about the 'choice'
in yang-data, but after temporarily fixing that I get:

[email-masked]:149: warning: The XPath expression references an undefined node: the node 'hash-algorithm' from module 'ietf-zerotouch-information' (in node 'boot-image' from 'ietf-zerotouch-information') is not found
[email-masked]:165: warning: The XPath expression references an undefined node: the node 'uri' from module 'ietf-zerotouch-information' (in node 'onboarding-information' from 'ietf-zerotouch-information') is not found

The first one is the must to a choice node.

The second one is the must *in* the choice; note that the XPath
context node for this expression is the parent node in the data tree,
which is "container boot-image".  Thus the must statement should be:
"must 'uri';"

/martin

---

From: Kent Watsen <[email-masked]>
Date: Thu, 19 Oct 2017 15:55:21 +0000

Hi Martin,

> which is "container boot-image".  Thus the must statement should be:

Thanks Martin.  I just posted the update/fix for both these issues, by
getting rid of the 'choice' altogether.  Now it's a 'list', which is
better since it means that more than one hash can be provided, which
is more flexible.

BTW, regarding the 'choice' in yang-data, `pyang` continues to say:

  [email-masked]:71: error: the 'yang-data'
  extension must have exactly one child that is a container

But over the summer (when you were sailing, I think) we concluded
that what the zerotouch draft is legal, as it does resolve to just
a single container.  I've been meaning to circle back around with
you on this...

Kent

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 19 Oct 2017 22:34:09 +0200 (CEST)

> a single container.  I've been meaning to circle back around with

I read that thread, and I think it is inconclusive.  I think the text
in RFC 8040 is quite clear:

          It MUST contain data definition statements
          that result in exactly one container data node definition.

The text does NOT say:

          It MUST contain data definition statements
          that result in exactly one container data node definition or
          a choice data node where each case contains exactly one
          container data node.

I agree that the latter would have worked equally well, but that's not
what the spec says.  I don't think we can change the spec in an
errata.

However, I think we should add 'yang-data' to Andy's
yang-data-augmentation draft, make this change there, and make that
draft a WG document (in NETMOD).

/martin