Re: [Isms] Ismssnmp: URI scheme transport extensions

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Tue, Jul 28, 2009 at 12:08:47AM +0200, Jeffrey Hutzelman wrote:
 
> I still don't think transport= is the right approach.  In your URL example, 
> is 'tester' intended to be a securityName or part of the SSH transport 
> address?  I suspect the answer is that for UDP/USM it is a securityName, 
> but for TCP/SSM/TSM it is part of the SSH transport address, indicating the 
> SSH username to use.  That is, the syntax depends on the transport being 
> used.

In USM, you specify a user name - since in both cases (USM and SSH)
the default transform is an identity transform, the difference between
a user name and a securityName is subtle.

> The right way to have differing syntax is to use different URI schemes. 
> UDP, TCP, SSH, TLS, DTLS/UDP, and DTLS/SCTP should probably all have 
> different URI schemes.
> 
> Once you've done that, different schemes can imply different defaults, so 
> the default security model for SSH, TLS, DTLS/UDP, and DtLS/SCTP is TSM, 
> while the default security model for UDP and TCP is USM.

I note this is legal:

   sip:alice:secretword at atlanta.com;transport=tcp

They obviously do not have a siptcp: scheme - but they do have sips:
(while they deprecated the sip:<bla>;transport=tls version but then I
note that sips actually implies TLS over the complete E2E path and not
just one hop).

I guess we need advice from URI experts. There was probably a good
reason why we ignored all this when we did RFC 4088...

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>