Subject: Re: [Netconf] way forward on netconf EOM

From: "Andy Bierman" <[email-masked]>
Date: Tue, 16 Nov 2010 23:28:54 +0800

We do not need 2 ways to indicate the new framing. All peers would have to support all options.  There is no choice of eom allowed.  1.1 means new framing.  No exceptions.

Andy

----- Reply message -----
From: "Ladislav Lhotka" <[email-masked]>
Date: Tue, Nov 16, 2010 02:03
Subject: [Netconf] way forward on netconf EOM
To: "Martin Bjorklund" <[email-masked]>, <[email-masked]>
Cc: <[email-masked]>

On Mon, 15 Nov 2010 15:39:16 +0100 (CET), Martin Bjorklund <[email-masked]> wrote:
> Phil Shafer <[email-masked]> wrote:
> > Martin Bjorklund writes:
> > >> IMO, Phil's framing is the best choice from the security review POV.
> > >It should be clear by now that Phil's solution does not solve the
> > >injection problem.
> > 
> > I think he's referring to my original suggestion of a real, honest
> > to goodness framing mechanism.
> > 
> > http://www.ietf.org/mail-archive/web/netconf/current/msg06216.html
> > http://www.ietf.org/mail-archive/web/netconf/current/msg06219.html
> 
> I know.  And I referred to:
> 
> http://www.ietf.org/mail-archive/web/netconf/current/msg06556.html
> 
> If the attacker can insert something that modifies the current
> edit-config so that e.g. the password for an admin user is changed,
> then the attacker can do anything.

True, but this is no more an issue for the transport layer. I would
support Juergen's switchover hack with Phil's framing, I only think it
would be better to signal the new framing to the transport layer via a
PI. What if we had both - the base:1.1 AND the PIs? An implementation
then could decide what to use.

I guess this would be the best outcome of this whole affair, especially
if it could be fixed now.

Lada

> 
> 
> /martin
> 
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

-- 
Ladislav Lhotka, CESNET
PGP Key ID: E74E8C0C
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

---

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 16 Nov 2010 16:34:55 +0100

On Út, 2010-11-16 at 23:28 +0800, Andy Bierman wrote:
> We do not need 2 ways to indicate the new framing. All peers would
> have to support all options.  There is no choice of eom allowed.  1.1
> means new framing.  No exceptions.

OK, then I am slightly in favor of the PI as the authoritative
indication of the new framing.

Lada

-- 
Ladislav Lhotka, CESNET
PGP Key ID: E74E8C0C