David B Harrington wrote:
If BEEP is just TLS + SASL + framing, why can't we just use TLS + SASL + framing? Where is the value-add for using BEEP instead of using the independent components? How does BEEP make it easier for an operator to operate their network than if they simply used TLS + SASL + a standardized framing approach?
I think these are good and fair questions. First, I didn't say that BEEP is *only* that. BEEP has a couple of what I would call frills, like the ability eliminate directionality to ease "call home". That's going to valuable to operators who need to manage hundreds of thousands of devices. Again, think along the lines of DOCSIS. A management model where the manager connects to hundreds of thousands of devices is just a non-starter. In addition, the framing allows interspersing of different (presumably related) applications. This would simplify operator access-lists, not to mention AAA operations (one versus N). SSH offers this sort of functionality, as you correctly pointed out elsewhere yesterday.
But beyond that, I'd tend to agree with your sentiment. If you wanted to do what I would call a "BEEP light" that does TLS + user login, then I implement SASL first, and then a very simple framing protocol that NETCONF sits above, particularly one that doesn't require funky tags in the data, making parsing a pain.
And so before you start NETCONF you add some gook along the lines of: C: start-netconf S: 354-authenticate first S: 354-SASL/PLAIN S: 354-SASL/OTP (...) S: 354 SASL/GSS-API C: SASL PLAIN username=foo password=bar S: 250 OK C: start-netconf S: 350 228 greeting follows <greeting> ... C: 278 <greeting> ... (where 228 and 278 are byte counts) What this gets you is integrated authentication and out of the byte counting business. You might even be able to steel the byte count code from either SMTP CHUNKING or IMAP (although IMAP is a bit weird). Eliot Eliot -- to unsubscribe send a message to netconf-request@ops.ietf.org with the word 'unsubscribe' in a single line as the message text body. archive: <http://ops.ietf.org/lists/netconf/>