Re: [Isms] draft-hardaker-isms-dtls-tm-05 submitted - tlstmNotifications

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Mon, Sep 14, 2009 at 07:36:55PM +0200, Wes Hardaker wrote:
> >>>>> On Mon, 14 Sep 2009 12:40:38 -0400, "Donati Andrew-MGIA0477" <adonati at motorola.com> said:
> 
> DA> Will it be feasible to define optional notifications for each the 
> DA> events defined by the counters below ?
> 
> DA> tlstmSessionInvalidClientCertificates
> DA> tlstmSessionInvalidServerCertificates 
> 
> I think it's a good idea to have notifications defined for those two
> cases.  The likely triggering points would be:
> 
> 1) tlstmSessionInvalidClientCertificates
> 
>    - command responder, notification responder or proxy application
>      receives a client cert it can't cope with.
> 
> 2) tlstmSessionInvalidServerCertificates
> 
>    - a command generator in a remote device (e.g., disman-event mib type
>      functionality or ...) or proxy application receives a server cert
>      it can't cope with.
> 
>    - in theory a local manager could trigger this condition too, but it
>      doesn't make as much sense.  There is no reason to say they can't
>      send it though.

The question is to what extend the SNMP agent is really involved in
all this or whether the DTLS transport takes care of the processing
itself. In the SNMP over SSH case, we did decide to stay out of things
that really concern the SSH layer. It seems with TLS/DTLS, we seem to
go into much more details - perhaps this is even justified. I just
notice that we seem to deal with these different secure transports
differently.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>