Using NETCONF over the Simple Object Access Protocol (SOAP)
draft-ietf-netconf-soap-08

[Ballot discuss]
I hate to take out a discuss this late in the process.  However I
think there is a significant technical error that must be handled.
The new revision makes netconf over soap over https mandatory to
implement.  How are we handling the port number assigmnet?  Is the
IANA port assigned by this spec going to be netconf over soap over
https or netconf over soap over http?  Are we going to want a separate
port for http or are we going to use TLS upgrade?  I recommend against
tls upgrade because it is typically not implement in http clients.

[Ballot comment]
The reference to HTTP Digest is to RFC 2069 - needs to be 2617.

The discussion of session cleanup is very good and clear.
This is a TCP topic that is often handled badly.

[Ballot comment]
I received the following comments by Ólafur Guðmundsson from the DNS review team:

Well written clear, and the first document that actually pointed out that     
there are multiple ports required for netconf one for each profile,           
The other documents are not as clear if the port requests are for single       
port for netconf or each document. It might be a good idea to request a       
block of ports (10 or so) that are reserved for NETCONF profiles.

[Ballot discuss]
draft-ietf-netconf-prot-11 says:
  >
  > NETCONF connections must provide authentication, data integrity, and
  > privacy.  NETCONF depends on the transport protocol for this
  > capability.  A NETCONF peer assumes that an appropriate level of
  > security and privacy are provided independent of this document.  For
  > example, connections may be encrypted in TLS [9] or SSH [10],
  > depending on the underlying protocol.
  >
  This specification does not meet this requirement in an interoperable
  manner.  Section 4.1 provides some hints, but no MUST statements.  I
  see two possible solutions.  First, a mandatory-to-implement security
  solution could be specified, allowing other solutions as well.
  Second, each of the vaguely discussed solutions could be fleshed out,
  and the implementor selects the one or ones that are supported, for
  example NETCONF-over-SOAP-with-TLS.

[Ballot comment]
I really don't understand why NETCONF over SOAP over BEEP would be all that useful when there's another document on the agenda describing NETCONF over BEEP without the SOAP.  Adding a SOAP layer just seems like unnecessary complexity.

IANA Last Call Comments:
Upon approval of this document the IANA will register 2 port numbers:
NETCONF for SOAP over HTTP
NETCOND for SOAP over BEEP
These will be placed in the following registry:
http://www.iana.org/assignments/port-numbers
In which range should these port numbers be registered?

The IANA will also register the XML Namespaces "urn:ietf:params:xml:ns:netconf" .
and "urn:ietf:params:xml:ns:netconf:soap" in the following registry:
http://www.iana.org/assignments/xml-registry/ns.html

AD review comments posted to the WG mailing list


-----Original Message-----
From: owner-netconf@ops.ietf.org [mailto:owner-netconf@ops.ietf.org]On
Behalf Of Wijnen, Bert (Bert)
Sent: Thursday, September 01, 2005 16:32
To: Ted Goddard
Cc: netconf
Subject: AD review: draft-ietf-netconf-soap-05


Hre is my AD review. Sorry that this one slipped through
the cracks and took a bit longer. I have also seen
the suggested changes (as per below email from Ted) and
will assume such changes will be made.

A lot of the SOAP/WSDL stuff is completely new for me,
so pls bear with me if I ask newbee questions.
But I think we should assume that others who read the
documents may also be newbees, and so maybe we should at
least make it all clear in the document.

- I do not see in the document how a session-id gets
  passed from setting up a BEEP or HTTP conenction
  to the NetConf protocol level so that NetConf can use
  the session-id. Maybe it is there, but I do not see it.
  Pls explain and clarify in the text.

- sect 3.7
  - Is it OK to assume a "hypothetical location", or should we
    decide and/or request IANA or xmlsoap.org to define a
    real and approved location?
  - Have you (has anyone) done a SYNTAX check on the WSDL
    document, and if so, which tool was used?
  - In the WSDL document, there are www.iana.org items.
    for example I see:
   
    WHere is that coming from.
    Maybe that is to be found in the missing (i.e. TBD) text from
    the netconf-protocol document?
    Another example 
      xmlns:SOAP="http://schemas.xmlsoap.org/wsdl/soap/"
    Does that need a citation/reference?
      xmlns:tns="urn:ietf:params:xml:ns:netconf:soap:1.0"
    Does IANA now how to create that? Or is there no IANA
    action needed for that?
    There may be other stuff. Once I understand the above I can
    check further and see if I have more questions.

- IANA considerations Section
  - says "IANA will". Maybe better: "IANA is requested to"
  - Is the port for BEEP not already requested via the
    netconf-over-beep document?
  - Where is IANA supposed to put the WSDL definition?
    you say in the XML registry. WHich is the document that
    explains how to do that? Where is the ptr to the iana
    we page that contains these sort of documents?

CItation/Reference issues:


!! Missing citation for Normative reference:
  P018 L030:    [5]  Freed, N. and N. Borenstein, "Multipurpose Internet Mail

!! Missing citation for Normative reference:
  P018 L034:    [6]  Freed, N. and N. Borenstein, "Multipurpose Internet Mail

!! Missing citation for Normative reference:
  P019 L014:    [13]  Rose, M. and D. New, "Reliable Delivery for syslog", RFC 3195,

!! Missing citation for Informative reference:
  P019 L035:    [18]  Barton, J., Nielsen, H. and S. Thatte, "SOAP Messages with

!! Missing citation for Informative reference:
  P019 L045:    [20]  Nadalin, A., Kaler, C., Hallam-Baker, P. and R. Monzillo, "Web

NITS:

- Pls expand Acrionyms first time they are used.
  For example BEEP in the abstract.
  WSDL in 3rd para section 1.
- Sect 2.5, last sentence.
  you may want to add a citation (and reference) to the RFC(s)
  that describes "chunking and persistent connections". 
- I see sometimes "Reciever" and other times "Receiver".
  I think it should be consistent: "Receiver"
- Security COnsiderations section:  s/IPSec/IPsec/

Bert

> -----Original Message-----
> From: owner-netconf@ops.ietf.org [mailto:owner-netconf@ops.ietf.org]On
> Behalf Of Ted Goddard
> Sent: Tuesday, August 30, 2005 19:46
> To: netconf
> Subject: proposed changes for draft-ietf-netconf-soap-06
>
>
>
> Hi All,
>
> I would like to propose the following changes for the NETCONF SOAP
> draft in the indicated sections:
>
>
> Section 0
>
>      RFC 3978 boilerplate
>
> Section 2.4  BCP56: On the Use of HTTP as a Substrate
>
>      It is also possible to respond to the concern on the re-use of
>      port 80.  A NETCONF SOAP service SHOULD be offered over a new
>      standard port for NETCONF over SOAP (over HTTP) to
>      be defined as requested in the IANA considerations of this
>      document.
>
> Section 4  Security Considerations
>
>      The IANA requested port SHOULD be used, as this provides a means
>      for efficient firewall filtering during possible
> denial-of-service
>      attacks.
>
> Section 5  IANA Considerations
>
>      The IANA is requested to assign TCP ports for NETCONF for SOAP
>      over HTTP and SOAP over BEEP.
>
>      The IANA is requested to place netconf-soap_1.0.wsdl in the
>      IANA XML registry.
>
> The following indicated ID-nits appear to be in error (xml2rfc
> output checked with "od -c"):
>
> tmp/draft-ietf-netconf-soap-05.txt(452):
>    Line is too long: the offending characters are 'elope"'
> tmp/draft-ietf-netconf-soap-05.txt(464):
>    Line is too long: the offending characters are
> 's:netconf:base:1.0">'
>
>
> Thanks,
> Ted.