RFC 4743
Using NETCONF over the Simple Object Access Protocol (SOAP)
RFC 4743: Using NETCONF over the Simple Object Access Protocol (SOAP) 💖
Okay bestie, this one is by T. Goddard from ICEsoft Technologies Inc. 🎀 It's a Standards Track doc, dated December 2006 🍓. Its title block doesn't list anything it obsoletes or updates 🙈
Status of This Memo 📜
This document specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🗣️ For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Copyright Notice 🔒
Copyright (C) The IETF Trust (2006).
Abstract ✨
NETCONF works on a wide range of devices in all kinds of environments. Web Services is one of those environments, and it's currently all about the Simple Object Access Protocol (SOAP) 💅 NETCONF gets so many perks here: reusing existing standards, easier software development, and playing nicely with systems people already deployed. In this doc we describe SOAP over HTTP and SOAP over Blocks Exchange Extensible Protocol (BEEP) bindings for NETCONF 🦋
Table of Contents 🗂️
1. Introduction ....................................................2
2. SOAP Background for NETCONF .....................................3
2.1. Use and Storage of WSDL and XSD ............................4
2.2. SOAP over HTTP .............................................4
2.3. HTTP Drawbacks .............................................4
2.4. BCP56: On the Use of HTTP as a Substrate ...................5
2.5. Important HTTP 1.1 Features ................................6
2.6. SOAP over BEEP .............................................7
2.7. SOAP Implementation Considerations .........................7
2.7.1. SOAP Feature Exploitation ...........................7
2.7.2. SOAP Headers ........................................7
2.7.3. SOAP Faults .........................................8
3. A SOAP Service for NETCONF ......................................9
3.1. Fundamental Use Case .......................................9
3.2. NETCONF Session Establishment ..............................9
3.3. NETCONF Capabilities Exchange ..............................9
3.4. NETCONF Session Usage .....................................11
3.5. NETCONF Session Teardown ..................................11
3.6. A NETCONF over SOAP Example ...............................11
3.7. NETCONF SOAP WSDL .........................................13
3.8. Sample Service Definition WSDL ............................14
4. Security Considerations ........................................15
4.1. Integrity, Privacy, and Authentication ....................15
4.2. Vulnerabilities ...........................................16
4.3. Environmental Specifics ...................................16
5. IANA Considerations ............................................17
6. References .....................................................17
6.1. Normative References ......................................17
6.2. Informative References ....................................181. Introduction ✨
Okay so, since NETCONF [1] has remote procedure call vibes and XML is involved here, it's totally natural to think about binding NETCONF operations to a SOAP [3] application protocol. This document proposes exactly that binding 💖
SOAP is a super natural messaging scheme for NETCONF, honestly, because they're both all about remote procedure call 🧚 BUT care must be taken with SOAP over HTTP, since it's inherently synchronous and client-driven 😭 SOAP over BEEP [11] is technically superior, though it isn't as widely adopted yet 🦋
Four basic topics show up here: SOAP specifics that matter for NETCONF, how to implement NETCONF as a SOAP-based web service, security considerations, and functional Web Services Description Language (WSDL) definitions. The most important bit, in a way, is the brief WSDL document in Section 3.7 🔥 With the right tools, that WSDL plus the base NETCONF XML Schemas gives you machine-readable descriptions good enough to build software applications with NETCONF 👑
Quick BCP 14 check: the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [8].
2. SOAP Background for NETCONF 🌸
Why wrap SOAP around something that's already a remote procedure call message? 🤔 There are technical and practical reasons. The technical ones are maybe less compelling, but let's look at them first 🧐
SOAP has a few technical perks. It's fundamentally an XML messaging scheme (one that can support remote procedure call), and it defines a simple message format made of a "header" and a "body" inside an "envelope". The "header" holds meta-information about the message and can indicate things like store-and-forward behaviour or transactional characteristics. SOAP also specifies an optional encoding for the "body". This encoding isn't applicable to NETCONF though, because one of the goals is highly readable XML, and SOAP-encoding is optimized for ease of automated de-serialization instead 🙅♀️ These SOAP message structure benefits are simple but worthwhile, because they're already standardized ✨
The practical reasons are what really make SOAP interesting for device management 💅 It's not hard to invent a way to swap XML messages over TCP. What's hard is getting that mechanism supported in a wide variety of tools and operating systems, and understood by a great many developers 😩 SOAP over HTTP (with WSDL) is seeing good success at this, so a device management protocol using these technologies has advantages when it comes to getting implemented and adopted. Admittedly there are interoperability problems with SOAP and WSDL, but those have wide attention and can be expected to be resolved 🙌
2.1. Use and Storage of WSDL and XSD 📦
Machine-readable formats like Web Services Description Language (WSDL) [16] and XML Schemas [4] are iconic because software development can use them automatically 🤖 With the right tools, WSDL and XSD can generate classes that act as remote interfaces or application-specific data structures. Document generation and service location are common uses too. A great innovation in many XML-based definition languages is using hyperlinks to refer to documents that contain supporting definitions 🔗
<import namespace="urn:ietf:params:xml:ns:netconf:base:1.0"
location="http://www.iana.org/assignments/xml-registry/
schema/netconf.xsd" />In WSDL, that import statement pulls in the definitions of XML types and elements from the base NETCONF schema. Ideally, the file with that schema is hosted on a web server under the authority of the standards body that defined it. That way dependent standards can be built up over time, and they're all accessible to automated software tools that help ensure adherence to the standards 💜 The IANA-maintained registry for this purpose is described in "The IETF XML Registry" [13].
Note that WSDL declarations for SOAP over BEEP bindings are not yet standardized 🙈
2.2. SOAP over HTTP 🌐
SOAP focuses on messages and can be bound to different underlying protocols like HTTP, SMTP, or BEEP, although most existing SOAP implementations support only HTTP or HTTP/TLS.
There are a bunch of advantages to considering SOAP over protocols other than HTTP 🦋 HTTP assigns very distinct client and server roles by connection initiation, which makes asynchronous notification tricky. That can be relieved in many ways by replacing HTTP with BEEP.
2.3. HTTP Drawbacks 😬
HTTP isn't the ideal transport for messaging, but it's adequate for the most basic interpretation of "remote procedure call" 🎀 HTTP is based on a communication pattern where the client (which initiates the TCP connection) makes a "request" to the server. The server returns a "response", and this process keeps going (possibly over a persistent connection, as described below). That matches the basic idea of a remote procedure call, where the caller invokes a procedure on a remote server and waits for the return value ⏳
Potential criticisms of HTTP could include the following:
- Server-initiated data flow is awkward to provide.
- Headers are verbose and text-based
- Idle connections may be closed by intermediate proxies
- Data encapsulation must adhere to Multipurpose Internet Mail Extensions (MIME) [15].
- Bulk transfer relies on stream-based ordering.
In many ways, these criticisms are aimed at particular compromises in HTTP's design. So they're important to consider, but it isn't clear that they result in fatal drawbacks for a device management protocol 🤷♀️
2.4. BCP56: On the Use of HTTP as a Substrate 🧁
Best Current Practice 56 [6] presents a bunch of important considerations on using HTTP in application protocols. Specifically, it raises these concerns:
- HTTP may be more complex than is necessary for the application.
- The use of HTTP may mask the application from some firewalls.
- A substantially new service should not reuse port 80 as assigned to HTTP.
- HTTP caching may mask connection state.
Fundamentally, these concerns lie directly with common usage of SOAP over HTTP, rather than with applying SOAP over HTTP to NETCONF 💅 As BCP 56 indicates, it's debatable whether HTTP is an appropriate protocol for SOAP at all, and BEEP would likely be a superior protocol for most SOAP applications. Unfortunately, SOAP over HTTP is in common use and must be supported if the practical benefits of SOAP are to be realized. Also, the verbose nature of SOAP actually makes it more readily processed by firewalls, albeit firewalls designed to process SOAP messages 👀
HTTP caches SHOULD NOT be inserted between NETCONF managers and agents, since NETCONF session state is tied to the state of the underlying transport connection 🚫 Three defensive actions can be taken:
- Caching MUST be prohibited through the use of HTTP headers
Cache-ControlandPragma: no-cache. - HTTP proxies SHOULD NOT be deployed within the management network.
- Use HTTPS.
It's also possible to respond to the concern about reusing port 80 🎀 Any NETCONF SOAP service MUST always be supported over the new standard port for NETCONF over SOAP, and all conforming implementations MUST default to attempting connections over this new standard port for NETCONF. A standard port for NETCONF over SOAP (over HTTP) has been assigned in the IANA considerations of this document 🌈
2.5. Important HTTP 1.1 Features 🎀
HTTP 1.1 [5] has two big features that help SOAP messages travel efficiently 💅. They're called "persistent connections" and "chunked transfer-coding" 🦋.
Persistent connections let a single TCP connection carry multiple HTTP requests 🧚. That means you can swap several SOAP request/response pairs without spinning up a brand new TCP connection every single time ✨. Since one stream carries both requests and responses, you definitely need some kind of framing 🫶. For messages whose length is known in advance, the "Content-length" header handles it. For messages of dynamic length, "Chunking" is required 📦.
HTTP "Chunking" (or "chunked transfer-coding") lets the sender transmit an indefinite amount of binary data 🌈. It works by telling the receiver the size of each "chunk" (a substring of the data) before that chunk gets sent 💌. The last chunk is marked by a chunk of zero length 🏁. Chunking is super handy for sending a large XML document that's being generated on the fly from a non-XML form sitting in memory 🍓.
Okay, so for SOAP, persistent connections are obviously important for performance 🔥, and they matter even more when keeping an authenticated connection alive is what's at stake 🔐. Messages of dynamic length are the rule rather than the exception for SOAP, so Chunking is very useful 👑. Sometimes you can buffer a SOAP response and figure out its length before sending it, but the storage needed for that is prohibitive for lots of devices 😭. Together, these two features make a solid foundation for device management using SOAP over HTTP 🎀. So yeah, HTTP chunking and persistent connections [5] SHOULD be used 🫶.
2.6. SOAP over BEEP 🦋
Even though the Web Services crowd hasn't fully jumped on it 🙈, BEEP is an excellent substrate for SOAP [12]. It supports request/response exchanges started by either BEEP peer, and the number of response messages can be arbitrary, including zero 💜. The BEEP profile for SOAP just uses one single BEEP channel to swap SOAP messages, so it gets all of BEEP's inherent strengths for message exchange over a single transport connection 🌸.
2.7. SOAP Implementation Considerations 🧩
It's not the goal of this document to go deep into the SOAP [3] specification 🙅. Instead, here are a few comments that might be useful if you're implementing NETCONF over SOAP 💖.
2.7.1. SOAP Feature Exploitation 🤷
NETCONF over SOAP doesn't really go all in on SOAP features 💅. For instance, NETCONF operations aren't broken into SOAP message parts, and the SOAP header isn't used to carry <rpc> metadata 🎀. This was a deliberate design decision, because it lets an implementor offer NETCONF over multiple substrates easily while handling the messages from those different substrates in one common way 🧚.
2.7.2. SOAP Headers 👀
Implementers of NETCONF over SOAP should be aware of this characteristic of SOAP headers: a SOAP header may have the attribute mustUnderstand, and if it does, the recipient must either process the header block or not process the SOAP message at all and instead generate a fault 💀. A mustUnderstand header must not be silently discarded 🚫.
In general, though, SOAP headers are meant for application-specific uses 🫧. The NETCONF SOAP binding doesn't make use of SOAP headers at all 🙅.
2.7.3. SOAP Faults ⚠️
A SOAP Fault is returned whenever there's a NETCONF <rpc-error> 🚨. It's basically a wrapper around the <rpc-error>, but it lets SOAP processors pass that <rpc-error> up to application code using a language-appropriate exception mechanism 🎀.
A SOAP Fault is constructed from an <rpc-error> as follows: the SOAP Fault Code Value is "Receiver" in the SOAP envelope namespace, the SOAP Fault Reason Text is the contents of the NETCONF <rpc-error> "error-tag", and the SOAP Fault detail is the original <rpc-error> structure 🦋.
For instance, given the following <rpc-error>,
<rpc-error xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<error-type>rpc</error-type>
<error-tag>MISSING_ATTRIBUTE</error-tag>
<error-severity>error</error-severity>
<error-info>
<bad-attribute>message-id</bad-attribute>
<bad-element>rpc</bad-element>
</error-info>
</rpc-error>the associated SOAP Fault message is
<soapenv:Envelope
xmlns:soapenv=
"http://www.w3.org/2003/05/soap-envelope"
xmlns:xml="http://www.w3.org/XML/1998/namespace">
<soapenv:Body>
<soapenv:Fault>
<soapenv:Code>
<soapenv:Value>env:Receiver</soapenv:Value>
</soapenv:Code>
<soapenv:Reason>
<soapenv:Text
xml:lang="en">MISSING_ATTRIBUTE</soapenv:Text>
</soapenv:Reason>
<detail>
<rpc-error xmlns=
"urn:ietf:params:xml:ns:netconf:base:1.0">
<error-type>rpc</error-type>
<error-tag>MISSING_ATTRIBUTE</error-tag>
<error-severity>error</error-severity>
<error-info>
<bad-attribute>message-id</bad-attribute>
<bad-element>rpc</bad-element>
</error-info>
</rpc-error>
</detail>
</soapenv:Fault>
</soapenv:Body>
</soapenv:Envelope>3. A SOAP Service for NETCONF 🌈
3.1. Fundamental Use Case 🖥️
The fundamental use case for NETCONF over SOAP is a management console ("manager" role) managing one or more devices running NETCONF agents ("agent" role) 💅. The manager starts an HTTP or BEEP connection to an agent and drives the NETCONF session through a sequence of SOAP messages 🫶. When the manager closes the connection, the NETCONF session closes too 👋.
3.2. NETCONF Session Establishment 🌸
A NETCONF over SOAP session is established by the initial message exchange on the underlying substrate 🧚. For HTTP, a session is established once a SOAP message is POSTed to the NETCONF web application URI 📮. For BEEP, it's established once the BEEP profile for SOAP handshake sets up the SOAP channel 🦋.
3.3. NETCONF Capabilities Exchange 💌
Capabilities exchange and session ID establishment happen through the exchange of <hello> messages ✨. For SOAP over HTTP, the HTTP client MUST send the first <hello> message 🚨. SOAP over BEEP has no ordering constraints at all 🙌. For instance, the following example shows the <hello> exchange and establishes a session ID value of 4 👑. Notice that the management client starts the exchange and the server agent assigns the session ID 💜.
C: POST /netconf HTTP/1.1
C: Host: netconfdevice
C: Content-Type: text/xml; charset=utf-8
C: Accept: application/soap+xml, text/*
C: Cache-Control: no-cache
C: Pragma: no-cache
C: Content-Length: 376
C:
C: <?xml version="1.0" encoding="UTF-8"?>
C: <soapenv:Envelope
C: xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
C: <soapenv:Body>
C: <hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
C: <capabilities>
C: <capability>
C: urn:ietf:params:netconf:base:1.0
C: </capability>
C: </capabilities>
C: </hello>
C: </soapenv:Body>
C: </soapenv:Envelope>
S: HTTP/1.1 200 OK
S: Content-Type: application/soap+xml; charset=utf-8
S: Content-Length: 600
S:
S: <?xml version="1.0" encoding="UTF-8"?>
S: <soapenv:Envelope
S: xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
S: <soapenv:Body>
S: <hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
S: <capabilities>
S: <capability>
S: urn:ietf:params:netconf:base:1.0
S: </capability>
S: <capability>
S: urn:ietf:params:netconf:capability:startup:1.0
S: </capability>
S: <capability>
S: http:/example.net/router/2.3/myfeature
S: </capability>
S: </capabilities>
S: <session-id>4</session-id>
S: </hello>
S: </soapenv:Body>
S: </soapenv:Envelope>3.4. NETCONF Session Usage 💖
NETCONF sessions are persistent for both performance and semantic reasons 🌷. NETCONF session state contains the following:
- Authentication Information
- Capability Information
- Locks
- Pending Operations
- Operation Sequence Numbers
Authentication must be maintained throughout a session, because it's expensive to establish 🔐. Capability Information is maintained so appropriate operations can be applied during a session 🧩. Locks are released when a session terminates, since that makes the protocol more robust 🔓. Pending operations come and go during the normal course of remote procedure call (RPC) operations 🔄. Operation sequence numbers are small but necessary state information for referring to operations during the session 🔢.
In the case of SOAP over HTTP, a NETCONF session is supported by an HTTP connection with an authenticated user 🌐. For SOAP over BEEP, a NETCONF session is supported by a BEEP channel operating according to the BEEP profile for SOAP [12] 🦋.
3.5. NETCONF Session Teardown 🧹
To allow automated cleanup, NETCONF over SOAP session teardown takes place when the underlying connection (in the case of HTTP) or channel (in the case of BEEP) is closed 💫. Heads up: the root cause of that teardown may be the closure of the TCP connection under either HTTP or BEEP, depending on the case 🤔. NETCONF managers and agents must be capable of programmatically closing the transport connections associated with NETCONF sessions, such as in response to a <close-session> operation 🎀. So the HTTP or BEEP substrate implementation must expose this appropriately 💜.
3.6. A NETCONF over SOAP Example 🎀
okay so the proposed WSDL in Section 3.7 uses document/literal encoding, which means the SOAP header and body barely change how a NETCONF operation looks on the wire 💅 This example uses HTTP/1.1 to keep things simple. A BEEP example would look pretty much the same ✨
C: POST /netconf HTTP/1.1
C: Host: netconfdevice
C: Content-Type: text/xml; charset=utf-8
C: Accept: application/soap+xml, text/*
C: Cache-Control: no-cache
C: Pragma: no-cache
C: Content-Length: 465
C:
C: <?xml version="1.0" encoding="UTF-8"?>
C: <soapenv:Envelope
C: xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
C: <soapenv:Body>
C: <rpc message-id="101"
C: xmlns="xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
C: <get-config>
C: <filter type="subtree">
C: <top xmlns="http://example.com/schema/1.2/config">
C: <users/>
C: </top>
C: </filter>
C: </get-config>
C: </rpc>
C: </soapenv:Body>
C: </soapenv:Envelope>the HTTP/1.1 response is also super straightforward 🦋
S: HTTP/1.1 200 OK
S: Content-Type: application/soap+xml; charset=utf-8
S: Content-Length: 917
S:
S: <?xml version="1.0" encoding="UTF-8"?>
S: <soapenv:Envelope
S: xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
S: <soapenv:Body>
S: <rpc-reply message-id="101"
S: xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
S: <data>
S: <top xmlns="http://example.com/schema/1.2/config">
S: <users>
S: <user>
S: <name>root</name>
S: <type>superuser</type>
S: <full-name>Charlie Root</full-name>
S: <dept>1</dept>
S: <id>1</id>
S: </company-info>
S: </user>
S: <user>
S: <name>fred</name>
S: <type>admin</type>
S: <full-name>Fred Flintstone</full-name>
S: <dept>2</dept>
S: <id>2</id>
S: </company-info>
S: </user>
S: </users>
S: </top>
S: </data>
S: </rpc-reply>
S: </soapenv:Body>
S: </soapenv:Envelope>3.7. NETCONF SOAP WSDL 🧚
this is the WSDL that defines the NETCONF over SOAP service itself, so bookmark it bestie 💜
<?xml version="1.0" encoding="UTF-8"?>
<definitions
xmlns="http://schemas.xmlsoap.org/wsdl/"
xmlns:SOAP="http://schemas.xmlsoap.org/wsdl/soap/"
xmlns:tns="urn:ietf:params:xml:ns:netconf:soap:1.0"
xmlns:netb="urn:ietf:params:xml:ns:netconf:base:1.0"
targetNamespace="urn:ietf:params:xml:ns:netconf:soap:1.0"
name="netconf-soap_1.0.wsdl">
<import namespace="urn:ietf:params:xml:ns:netconf:base:1.0"
location="http://www.iana.org/assignments/xml-registry/
schema/netconf.xsd" />
<message name="helloRequest">
<part name="in" element="netb:hello"/>
</message>
<message name="helloResponse">
<part name="out" element="netb:hello"/>
</message>
<message name="rpcRequest">
<part name="in" element="netb:rpc"/>
</message>
<message name="rpcResponse">
<part name="out" element="netb:rpc-reply"/>
</message>
<portType name="netconfPortType">
<operation name="rpc">
<input message="tns:rpcRequest"/>
<output message="tns:rpcResponse"/>
</operation>
<operation name="hello">
<input message="tns:helloRequest"/>
<output message="tns:helloResponse"/>
</operation>
</portType>
<binding name="netconfBinding" type="tns:netconfPortType">
<SOAP:binding style="document"
transport="http://schemas.xmlsoap.org/soap/http"/>
<operation name="hello">
<SOAP:operation/>
<input>
<SOAP:body use="literal"
namespace="urn:ietf:params:xml:ns:netconf:soap:1.0"/>
</input>
<output>
<SOAP:body use="literal"
namespace="urn:ietf:params:xml:ns:netconf:soap:1.0"/>
</output>
</operation>
<operation name="rpc">
<SOAP:operation/>
<input>
<SOAP:body use="literal"
namespace="urn:ietf:params:xml:ns:netconf:base:1.0"/>
</input>
<output>
<SOAP:body use="literal"
namespace="urn:ietf:params:xml:ns:netconf:base:1.0"/>
</output>
</operation>
</binding>
</definitions>3.8. Sample Service Definition WSDL 🌸
this WSDL assumes the NETCONF over SOAP WSDL definitions live at a local location 🏠 A typical device that's manageable via NETCONF over SOAP would ship with a service definition kinda like this one, which tells you the device's address 🫶
<?xml version="1.0" encoding="UTF-8"?>
<definitions
xmlns="http://schemas.xmlsoap.org/wsdl/"
xmlns:SOAP="http://schemas.xmlsoap.org/wsdl/soap/"
xmlns:nets="urn:ietf:params:xml:ns:netconf:soap:1.0"
targetNamespace="urn:myNetconfService"
name="myNetconfService.wsdl">
<import namespace="urn:ietf:params:xml:ns:netconf:soap:1.0"
location="http://localhost:8080/netconf/
schema/netconf-soap_1.0.wsdl"/>
<service name="netconf">
<port name="netconfPort" binding="nets:netconfBinding">
<SOAP:address location="http://localhost:8080/netconf"/>
</port>
</service>
</definitions>4. Security Considerations 🔐
this section is serious business, so no skipping ahead, periodt 💀
NETCONF is used to access and modify configuration information, so access to this protocol should be limited to the users and systems that are authorized to view or modify the agent's configuration data 🔒
because configuration information is sent in both directions, it is not enough for just the client or user to be authenticated with the server. The server's identity should also be authenticated with the client 🤝
configuration data may include sensitive stuff like user names or security keys 😭 So NETCONF should only be used over communication channels that provide strong encryption for data privacy 💜
if the NETCONF server provides remote access through insecure protocols, such as HTTP, care should be taken to stop the NETCONF program from being executed when strong user authentication or data privacy isn't available 🙈
The IANA assigned port SHOULD be used, because it gives you an efficient way to do firewall filtering during possible denial-of-service attacks 🛡️
4.1. Integrity, Privacy, and Authentication 🦋
the NETCONF SOAP binding relies on an underlying secure transport for integrity and privacy. Those transports are expected to include TLS [9] (which, when combined with HTTP, is called HTTPS) and IPsec. There are a bunch of authentication options, and some of them are deployment-specific:
- within the transport (such as with TLS client certificates)
- within HTTP (such as Digest Access Authentication [7])
- within SOAP (such as a digital signature in the header [17])
HTTP, BEEP, and SOAP level authentication can be integrated with Remote Authentication Dial-In User Service (RADIUS) [10] to support remote authentication databases 🗄️
at a minimum, all conforming NETCONF over SOAP implementations MUST support TLS. Specifically, NETCONF over SOAP over HTTP MUST support NETCONF over SOAP over HTTPS, and NETCONF over SOAP over BEEP MUST support NETCONF over SOAP over BEEP over TLS 👑
4.2. Vulnerabilities 🥀
the protocols above may have their own vulnerabilities, and NETCONF over SOAP may inherit them 😬
NETCONF itself may have vulnerabilities because an authorization model is not currently specified.
it's important that device capabilities and authorization stay constant for the duration of any outstanding NETCONF session. With NETCONF, it's also important to remember that device management may happen over multiple substrates (on top of SOAP), so those different substrates need a common authentication model ✨
4.3. Environmental Specifics 🌍
some deployments of NETCONF over SOAP may choose transports without encryption. That presents vulnerabilities, but it may be picked for deployments on closed networks or for debugging scenarios 🛠️
a device managed by NETCONF may interact, over protocols other than NETCONF, with devices managed by other protocols that have different security levels. Each point of entry brings its own potential vulnerability 🚪
5. IANA Considerations 🌷
IANA assigned TCP port (833) for NETCONF over SOAP over BEEP, and TCP port (832) for NETCONF over SOAP over HTTPS 🔌
IANA will allow for the assignment of an XML namespace within the NETCONF namespace urn:ietf:params:xml:ns:netconf for the NETCONF over SOAP WSDL definitions. Following the policies outlined in RFC 2434 [14], assigned values in this subordinate namespace are requested to be allocated according to the "Specification Required" policy 📋
URI: urn:ietf:params:xml:ns:netconf:soap
6. References 📚
6.1. Normative References 🧠
[1] Enns, R., Ed., "NETCONF Configuration Protocol", RFC 4741, December 2006.
[2] Bray, T., Paoli, J., Sperberg-McQueen, C., and E. Maler, "Extensible Markup Language (XML) 1.0 (Second Edition)", W3C REC REC-xml-20001006, October 2000, <http://www.w3.org/TR/2000/REC-xml-20001006>.
[3] Gudgin, M., Hadley, M., Moreau, JJ., and H. Nielsen, "SOAP Version 1.2 Part 1: Messaging Framework", W3C Recommendation REC-soap12-part1-20030624, June 2002, <http://www.w3.org/TR/soap12-part1/>.
[4] Thompson, H., Beech, D., Maloney, M., and N. Mendelsohn, "XML Schema Part 1: Structures", W3C Recommendation REC-xmlschema-1-20010502, May 2001, <http://www.w3.org/TR/2001/REC-xmlschema-1-20010502/>.
[5] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.
[6] Moore, K., "On the use of HTTP as a Substrate", RFC 3205, February 2002.
[7] Franks, J., Hallam-Baker, P., Hostetler, J., Leach, P., Luotonen, A., Sink, E., and L. Stewart, "HTTP Authentication: Basic and Digest Access Authentication", RFC 2617, June 1999.
[8] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997.
[9] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.1", RFC 4346, April 2006.
[10] Rigney, C., Willens, S., Rubens, A., and W. Simpson, "Remote Authentication Dial In User Service (RADIUS)", RFC 2865, June 2000.
[11] Rose, M., "The Blocks Extensible Exchange Protocol Core", RFC 3080, March 2001.
[12] O'Tuathail, E. and M. Rose, "Using the Simple Object Access Protocol (SOAP) in Blocks Extensible Exchange Protocol (BEEP)", RFC 4227, January 2006.
[13] Mealling, M., "The IETF XML Registry", RFC 3688, January 2004.
[14] Alvestrand, H. and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", RFC 2434, October 1998.
6.2. Informative References 🦋
okay bestie, these are the informative refs, aka the background pile 💅 they're here for context, not for the rules.
- [15] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996. 📬
- [16] Christensen, E., Curbera, F., Meredith, G., and S. Weerawarana, "Web Services Description Language (WSDL) 1.1", W3C Note NOTE-wsdl-20010315, March 2001, <http://www.w3.org/TR/2001/NOTE-wsdl-20010315>. 🧚
- [17] Brown, A., Fox, B., Hada, S., LaMacchia, B., and H. Maruyama, "SOAP Security Extensions: Digital Signature", W3C Note NOTE-SOAP-dsig-20010206, Feb 2001, <http://www.w3.org/TR/SOAP-dsig/>. 🔐
Author's Address 🎀
this is who wrote it, so you know who to thank (or who to DM 😭)
Ted Goddard
ICEsoft Technologies Inc.
Suite 300, 1717 10th St. NW
Calgary, AB T2M 4S2
Canada
Phone: (403) 663-3322
EMail: ted.goddard@icesoft.com
URI: http://www.icesoft.comFull Copyright Statement 💜
Copyright (C) The IETF Trust (2006).
okay so this doc is covered by the rights, licenses and restrictions in BCP 78, and unless it says otherwise there, the authors keep all their rights 🔥
THIS DOCUMENT AND THE INFORMATION CONTAINED HEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST, AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🌈
the IETF is staying neutral here, bestie 🫶 it takes no position on whether any IPR claims that might cover the tech in this doc are valid or how far they reach, or whether licenses would be available. it also doesn't say it has done any independent work to find those rights. the procedures for rights in RFC docs are in BCP 78 and BCP 79.
if you want copies of IPR disclosures that were sent to the IETF Secretariat, or the assurances of licenses that might be available, or the results of any attempt to get a general license or permission for implementers or users to use these proprietary rights, check the IETF online IPR repository at http://www.ietf.org/ipr. 📂
the IETF also invites anyone to flag any copyrights, patents, patent applications or other proprietary rights that might cover technology needed to implement this standard. send that to the IETF at ietf-ipr@ietf.org 📨
Acknowledgement 🍓
the Internet Society is the one currently funding the RFC Editor function, so a big thank you to them ✨
📦 where this page comes from
- ietf: rfc4743 2006-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms