[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: NETCONF over TLS
Eliot Lear wrote:
Mohamad Badra wrote:
Between, could you please tell what "far less functionally" does mean?
The whole point of SASL is to provide for multiple profiles so that if
you want to use the GSSAPI or PLAIN or OTP or something else, you can do
so. In fact this is a battle we keep fighting *and* losing in network
management. Shall we some day plan to have an ISMS equivalent for
netconf? I surely hope not.
And of course, you get all of this for free with the BEEP spec.
I have heard comments From Juergen that there are several foo-over-TLS
drafts out there, and perhaps one specification for NM-over-TLS
might be better. I heard concerns about 'vertical silos' from Dave H
along the same lines. I also respect Eliot's concerns about reinventing
things.
The details are always messier than the "idea".
So, with this new 'special' <request-login> RPC (that creates
a layer violation in itself) the agent needs to send 'operation-failed'
errors for any other RPC received before this one? A special mode is needed
in the RPC handler, based on, and coupled to, the transport protocol
used to establish the session -- just to support this special RPC method.
Yuch.
Eliot
Andy
--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>