Network Configuration Protocol (NETCONF)
draft-ietf-netconf-4741bis-10

[Ballot discuss] 1) should there be constraints on the basic format of username? if it is expected to be specified by an operator in config ...

[Ballot discuss]
1) should there be constraints on the basic format of username? if it is expected to be specified by an operator in config files or databases, should it be human-readable? ascii? utf-8?

2) should the format be predictable, so the operator can determine what the NC username will be, given a knowledge of the corresponding identifier in the secure transport protocol?

[Ballot discuss] This is a placeholder DISCUSS which (by agreement with Dan) I am entering before I finish my review of the document before March ...

[Ballot discuss]
This is a placeholder DISCUSS which (by agreement with Dan) I am entering before I finish my review of the document before March 10th. Then I will either clear or enter a proper DISCUSS.

I am also agreeing with David's DISCUSS points # 1 and # 2, and I also think that Peter's Comment points # 1 and # 4 are worth being DISCUSS level.

[Ballot comment] (1) 2.2. paragraph 1 - last sentence is awkward. In general connections are encrypted "in" an algorithm (e.g., AES) or "using" a ...

[Ballot comment]
(1)

2.2.  paragraph 1 - last sentence is awkward.  In general connections are
encrypted "in" an algorithm (e.g., AES) or "using" a protocol (e.g., TLS).
Suggest:

s/encrypted in TLS [16] or SSH [14]/encrypted using TLS [16] or SSH [14]/

(2)

3.1.  Namespace

Should this text reference the namespace base:1.1 instead of base:1.0 ??

(3)

The example in 6.2.2 Attribute Match Expressions references containment nodes
and selection nodes, which are described in 6.2.3 and 6.2.4, respectively.

It might be cleaner to reorder as 6.2.2 Containment Nodes, 6.2.3 Selection Nodes,
and 6.2.4 Attribute Match Expressions so that concepts are introduced sequentially

(4)

Section 8.1  The following sentence implies that clients can attack other sessions
by guessing session-ids:

A server receiving a <session-id> element MUST close the NETCONF
  session.

I believe the intent was as follows:

A server receiving a <hello> element that includes a <session-id> element
MUST ignore the session-id and close the NETCONF session.

If that is the intent, I suggest the latter wording.

(5)

Section 9.  Security Considerations, paragraph five states:

  Configuration information is by its very nature sensitive.  Its
  transmission in the clear and without integrity checking leaves
  devices open to classic eavesdropping attacks.  Configuration
  information often contains passwords, user names, service
  descriptions, and topological information, all of which are
  sensitive.  Because of this, this protocol SHOULD be implemented
  carefully with adequate attention to all manner of attack one might
  expect to experience with other management interfaces.

The clause "and without integrity checking" is not relevant to eavesdropping attacks.
Suggest:

s/classic eavesdropping attacks/classic eavesdropping and false data injection attacks/

[Ballot comment] 1. DTDs are forbidden (presumably you mean internal or external DTD subsets in accordance with section 2.8 of the XML specification). What ...

[Ballot comment]
1. DTDs are forbidden (presumably you mean internal or external DTD subsets in accordance with section 2.8 of the XML specification). What about comments, processing instructions, and internal or external entity references?

2. In Section 6.2.5, 'for which the <name> element is equal to "fred"' is more precisely expressed as 'for which XML character data of the <name> element is equal to "fred"'. (The same text occurs in Section 6.4.5.)

3. Section 6.4.3 states:

  In a real data model, the <company-info> would not
  likely be returned with the list of users for a particular host or
  network.

Why not?

4. In Section 7.5, is the server allowed to terminate a lock for reasons other than session closure? If not, it appears than an entity could maintain a lock indefinitely.

[Ballot comment] 1. DTDs are forbidden (presumably you mean internal or external DTD subsets in accordance with section 2.8 of the XML specification). What ...

[Ballot comment]
1. DTDs are forbidden (presumably you mean internal or external DTD subsets in accordance with section 2.8 of the XML specification). What about comments, processing instructions, and internal or external entity references?

2. In Section 6.2.5, 'for which the <name> element is equal to "fred"' is more precisely expressed as 'for which XML character data of the <name> element is equal to "fred"'.

[Ballot comment] 1. DTDs are forbidden (presumably you mean internal or external DTD subsets in accordance with section 2.8 of the XML specification). What ...

[Ballot comment]
1. DTDs are forbidden (presumably you mean internal or external DTD subsets in accordance with section 2.8 of the XML specification). What about comments, processing instructions, and internal or external entity references?

2.

[Ballot comment] 1) copyright in yang module needs updating. 2) appendix F doesn't mention dropping the local file requirement for URLs, 3) terminology should ...

[Ballot comment]
1) copyright in yang module needs updating.

2) appendix F doesn't mention dropping the local file requirement for URLs,

3) terminology should probably define username, not user. It is doubtful username is commonly referred, since it did not exist in 1.0.

4) I found the use of RFC2119 laniguage rather inconsistent. Some uses of "can" probbaly should have been MAY. Some uses of "are" probbaly should have been MUST, to ensure interoperability.

5) I support Lars' Discuss. There is no requirement to use a transport protocol that provides congestion control. If a transport is used that does not already provide congestion control, then the NC transport should provide congestion control. It is RECOMMENDED to use an existing transprt standard that provides congestion control.

Document write-up by Bert Wijnen: (1.a) Who is the Document Shepherd for this document? Has the Document Shepherd personally reviewed this version of the ...

Document write-up by Bert Wijnen:

(1.a) Who is the Document Shepherd for this document? Has the Document Shepherd personally reviewed this version of the document and, in particular, does he or she believe this version is ready for forwarding to the IESG for publication?

Bert Wijnen is the document shepherd.
Yes, I have reviewed the document many times, including this version 6, that I believe is ready for forwarding to the AD/IESG.

(1.b) Has the document had adequate review both from key WG members and from key non-WG members? Does the Document Shepherd have any concerns about the depth or breadth of the reviews that have been performed?

The document has had wide review and re-reviews of NETCONF WG members. I do not have any concerns regarding the level of review for this document.

(1.c) Does the Document Shepherd have concerns that the document needs more review from a particular or broader perspective, e.g., security, operational complexity, someone familiar with AAA, internationalization or XML?

I do not believe any extra special review (other than normal IETF Last Call) is needed.

(1.d) Does the Document Shepherd have any specific concerns or issues with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the WG has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here. Has an IPR disclosure related to this document been filed? If so, please include a reference to the disclosure and summarize the WG discussion and conclusion on this issue.

I do not have any specific concerns.
No IPR disclosure been filed as far as we know.

(1.e) How solid is the WG consensus behind this document?
Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it?

The content of the document has strong WG consensus.

(1.f) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is entered into the ID Tracker.)

No-one has threatened with an appeal or expressed extreme discontent.

(1.g) Has the Document Shepherd personally verified that the document satisfies all ID nits? (See http://www.ietf.org/ID-Checklist.html  and http://tools.ietf.org/tools/idnits/). Boilerplate checks are not enough; this check needs to be thorough. Has the document met all formal review criteria it needs to, such as the MIB Doctor, media type and URI type reviews?

Document passes ID-nits (as shown by the IETF idnits tool:
http://tools.ietf.org/idnits?url=http://tools.ietf.org/id/
draft-ietf-netconf-4741bis-06.txt
There are no errors, but there are a few comments and warnings. We're addressing those, but we're in ID-cutoff, so we cannot submit a fixed version immediately.


(1.h) Has the document split its references into normative and informative? Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the strategy for their completion? Are there normative references that are downward references, as described in [RFC3967]? If so, list these downward references to support the Area Director in the Last Call procedure for them [RFC3967].

References are split in Normative and Informative. All normative documents have been published except draft-ietf-netconf-rfc4742bis, but that is also being submitted for IESG consideration as proposed standard.

(1.i) Has the Document Shepherd verified that the document IANA consideration section exists and is consistent with the body of the document? If the document specifies protocol extensions, are reservations requested in appropriate IANA registries? Are the IANA registries clearly identified? If the document creates a new registry, does it define the proposed initial contents of the registry and an allocation procedure for future registrations? Does it suggest a reasonable name for the new registry? See [RFC5226]. If the document describes an Expert Review process has Shepherd conferred with the Responsible Area Director so that the IESG can appoint the needed Expert during the IESG Evaluation?

IANA considerations are present and complete. No new namespaces are created and so no new Expert is needed.

(1.j) Has the Document Shepherd verified that sections of the document that are written in a formal language, such as XML code, BNF rules, MIB definitions, etc., validate correctly in an automated checker?

The YANG and XSD modules have been checked by Martin Bjorklund.
Both are found to be valid.

(1.k) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up? Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections:

Technical Summary

    The Network Configuration Protocol (NETCONF) defined in
    this document provides mechanisms to install, manipulate,
    and delete the configuration of network devices. It uses
    an Extensible Markup Language (XML)-based data encoding
    for the configuration data as well as the protocol
    messages. The NETCONF protocol operations are realized
    as Remote Procedure Calls (RPC).

    This revision of the document clarifies some text and
    fixes some minor bugs (including reported rfc4741 errata)
    as found from implementatition experience of rfc4741.

Working Group Summary

  The working group went over several versions of the
  document. The comments and reviews helped improve the
  document a lot and brought us to consensus on the
  6th revision of the docuemnt.

Document Quality

  There are implementations of this protocol, and in fact
  the rfc4741bis revision is based on implementation
  experience.

(1.a) Who is the Document Shepherd for this document? Has the Document Shepherd personally reviewed this version of the document and, in particular, does ...

(1.a) Who is the Document Shepherd for this document? Has the
Document Shepherd personally reviewed this version of the
document and, in particular, does he or she believe this
version is ready for forwarding to the IESG for publication?

Bert Wijnen is the document shepherd.
Yes, I have reviewed the document many times, including this
version 6, that I believe is ready for forwarding to
the AD/IESG.

(1.b) Has the document had adequate review both from key WG
members and from key non-WG members? Does the Document
Shepherd have any concerns about the depth or breadth of
the reviews that have been performed?

The document has had wide review and re-reviews of NETCONF
WG members. I do not have any concerns regarding the level
of review for this document.

(1.c) Does the Document Shepherd have concerns that the
document needs more review from a particular or broader
perspective, e.g., security, operational complexity,
someone familiar with AAA, internationalization or XML?

I do not believe any extra special review (other than
normal IETF Last Call) is needed.

(1.d) Does the Document Shepherd have any specific concerns or
issues with this document that the Responsible Area Director
and/or the IESG should be aware of? For example, perhaps he
or she is uncomfortable with certain parts of the document, or
has concerns whether there really is a need for it. In any
event, if the WG has discussed those issues and has indicated
that it still wishes to advance the document, detail those
concerns here. Has an IPR disclosure related to this document
been filed? If so, please include a reference to the
disclosure and summarize the WG discussion and conclusion on
this issue.

I do not have any specific concerns.
No IPR disclosure been filed as far as we know.

(1.e) How solid is the WG consensus behind this document?
Does it represent the strong concurrence of a few individuals,
with others being silent, or does the WG as a whole understand
and agree with it?

The content of the document has strong WG consensus.

(1.f) Has anyone threatened an appeal or otherwise indicated
extreme discontent? If so, please summarise the areas of
conflict in separate email messages to the Responsible Area
Director. (It should be in a separate email because this
questionnaire is entered into the ID Tracker.)

No-one has threatened with an appeal or expressed extreme
discontent.

(1.g) Has the Document Shepherd personally verified that the
document satisfies all ID nits? (See
http://www.ietf.org/ID-Checklist.html and
http://tools.ietf.org/tools/idnits/). Boilerplate checks are
not enough; this check needs to be thorough. Has the document
met all formal review criteria it needs to, such as the MIB
Doctor, media type and URI type reviews?

Document passes ID-nits (as shown by the IETF idnits tool:
http://tools.ietf.org/idnits?url=http://tools.ietf.org/id/
draft-ietf-netconf-4741bis-06.txt
There are no errors, but there are a few comments and
warnings. We're addressing those, but we're in ID-cutoff,
so we cannot submit a fixed version immediately.


(1.h) Has the document split its references into normative and
informative? Are there normative references to documents that
are not ready for advancement or are otherwise in an unclear
state? If such normative references exist, what is the
strategy for their completion? Are there normative references
that are downward references, as described in [RFC3967]? If
so, list these downward references to support the Area
Director in the Last Call procedure for them [RFC3967].

References are split in Normative and Informative. All normative
documents have been published except draft-ietf-netconf-rfc4742bis,
but that is also being submitted for IESG consideration as
proposed standard.

(1.i) Has the Document Shepherd verified that the document IANA
consideration section exists and is consistent with the body
of the document? If the document specifies protocol
extensions, are reservations requested in appropriate IANA
registries? Are the IANA registries clearly identified? If
the document creates a new registry, does it define the
proposed initial contents of the registry and an allocation
procedure for future registrations? Does it suggest a
reasonable name for the new registry? See [RFC5226]. If the
document describes an Expert Review process has Shepherd
conferred with the Responsible Area Director so that the IESG
can appoint the needed Expert during the IESG Evaluation?

IANA considerations are present and complete. No new namespaces are
created and so no new Expert is needed.

(1.j) Has the Document Shepherd verified that sections of the
document that are written in a formal language, such as XML
code, BNF rules, MIB definitions, etc., validate correctly in
an automated checker?

The YANG and XSD modules have been checked by Martin Bjorklund.
Both are found to be valid.

(1.k) The IESG approval announcement includes a Document
Announcement Write-Up. Please provide such a Document
Announcement Write-Up? Recent examples can be found in the
"Action" announcements for approved documents. The approval
announcement contains the following sections:

Technical Summary

The Network Configuration Protocol (NETCONF) defined in
this document provides mechanisms to install, manipulate,
and delete the configuration of network devices. It uses
an Extensible Markup Language (XML)-based data encoding
for the configuration data as well as the protocol
messages. The NETCONF protocol operations are realized
as Remote Procedure Calls (RPC).

This revision of the document clarifies some text and
fixes some minor bugs (including reported rfc4741 errata)
as found from implementatition experience of rfc4741.

Working Group Summary

The working group went over several versions of the
document. The comments and reviews helped improve the
document a lot and brought us to consensus on the
6th revision of the docuemnt.

Document Quality

There are implementations of this protocol, and in fact
the rfc4741bis revision is based on implementation
experience.