Subject: Re: [Netconf] way forward on netconf EOM

From: "Andy Bierman" <[email-masked]>
Date: Wed, 17 Nov 2010 02:06:19 +0800

I object to any parsing of XML at the transport layer.  A 4741bis peer must be able to tell base 1.0 from 1.1.
This is always the correct answer for which framing. There is no way additional flags should be used.

----- Reply message -----
From: "Ladislav Lhotka" <[email-masked]>
Date: Tue, Nov 16, 2010 07:34
Subject: [Netconf] way forward on netconf EOM
To: "Andy Bierman" <[email-masked]>
Cc: "Martin Bjorklund" <[email-masked]>, <[email-masked]>, <[email-masked]>

On Út, 2010-11-16 at 23:28 +0800, Andy Bierman wrote:
> We do not need 2 ways to indicate the new framing. All peers would
> have to support all options.  There is no choice of eom allowed.  1.1
> means new framing.  No exceptions.

OK, then I am slightly in favor of the PI as the authoritative
indication of the new framing.

Lada

> 
> Andy
> 
> 
> ----- Reply message -----
> From: "Ladislav Lhotka" <[email-masked]>
> Date: Tue, Nov 16, 2010 02:03
> Subject: [Netconf] way forward on netconf EOM
> To: "Martin Bjorklund" <[email-masked]>, <[email-masked]>
> Cc: <[email-masked]>
> 
> 
> On Mon, 15 Nov 2010 15:39:16 +0100 (CET), Martin Bjorklund
> <[email-masked]> wrote:
> > Phil Shafer <[email-masked]> wrote:
> > > Martin Bjorklund writes:
> > > >> IMO, Phil's framing is the best choice from the security review
> POV.
> > > >It should be clear by now that Phil's solution does not solve the
> > > >injection problem.
> > > 
> > > I think he's referring to my original suggestion of a real, honest
> > > to goodness framing mechanism.
> > > 
> > > http://www.ietf.org/mail-archive/web/netconf/current/msg06216.html
> > > http://www.ietf.org/mail-archive/web/netconf/current/msg06219.html
> > 
> > I know.  And I referred to:
> > 
> > http://www.ietf.org/mail-archive/web/netconf/current/msg06556.html
> > 
> > If the attacker can insert something that modifies the current
> > edit-config so that e.g. the password for an admin user is changed,
> > then the attacker can do anything.
> 
> True, but this is no more an issue for the transport layer. I would
> support Juergen's switchover hack with Phil's framing, I only think it
> would be better to signal the new framing to the transport layer via a
> PI. What if we had both - the base:1.1 AND the PIs? An implementation
> then could decide what to use.
> 
> I guess this would be the best outcome of this whole affair,
> especially
> if it could be fixed now.
> 
> Lada
> 
> > 
> > 
> > /martin
> > 
> > _______________________________________________
> > Netconf mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/netconf
> 
> -- 
> Ladislav Lhotka, CESNET
> PGP Key ID: E74E8C0C
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
> 
> 
> 

-- 
Ladislav Lhotka, CESNET
PGP Key ID: E74E8C0C