> IMHO, if this module is supposed to be useful in practice, without > requiring immediately proprietary augmentations, UDP needs to be > supported. RFC 5424 also states that implementations SHOULD > support a UDP transport per RFC 5426.
Agreed. > Whether TCP support should be included is debatable because not a > standard transport. Perhaps it should not, however given that it > has already been specified, I don't think it hurts to have it as > a feature/option for implementations that require it. Given the IESG statement (copied below) and the HISTORIC downref, I think that this would be a hard sell. But, if it turns out that most vendors support RFC 6587, then a case could be made for it. Kent > -----Original Message----- > From: netmod [mailto:[email protected]] On Behalf Of Alex > Campbell > Sent: Tuesday, January 16, 2018 1:46 PM > To: Benoit Claise <[email protected]>; Kent Watsen > <[email protected]>; [email protected] > Subject: Re: [netmod] I-D Action: draft-ietf-netmod-syslog-model-19.txt > > By the same reasoning surely UDP should not be available either, because it > also doesn't provide security. > ________________________________________ > From: netmod <[email protected]> on behalf of Benoit Claise > <[email protected]> > Sent: Wednesday, 17 January 2018 6:23 a.m. > To: Kent Watsen; [email protected] > Subject: Re: [netmod] I-D Action: draft-ietf-netmod-syslog-model-19.txt > > Hi, > > > > ** Downref: Normative reference to an Historic RFC: RFC 6587 > > > > Kent: hmmm, what's going on here? This YANG module is providing an > ability to configure the "tcp" transport, even though the IESG made that > ability historic in 2012 (see IESG Note below). Searching online, it looks > like > Cisco supports this, but Juniper does not. What about other vendors, is it > widely supported? Was this discussed in the WG? Answering my own > question, searching my local mailbox, I don't see this ever being discussed > before, other than Martin questioning if it was a good idea in Mar 2016 (no > response). Please start a thread on the list to get WG opinion if it's okay > for > the draft to proceed as is or not. Here's the IESG Note from RFC 6587: > > > > IESG Note > > > > The IESG does not recommend implementing or deploying syslog over > > plain tcp, which is described in this document, because it lacks the > > ability to enable strong security [RFC3365]. > > > > Implementation of the TLS transport [RFC5425] is recommended so that > > appropriate security features are available to operators who want to > > deploy secure syslog. Similarly, those security features can be > > turned off for those who do not want them. > > > > > > > Well, I believe it's clear plain TCP should not be in the YANG module. > > Regards, Benoit > _______________________________________________ netmod mailing list [email protected] https://www.ietf.org/mailman/listinfo/netmod
