Subject: [Lsr] Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26

From: Alvaro Retana <[email-masked]>
Date: Wed, 21 Aug 2019 08:08:26 -0700

[It looks like the datatracker didn’t send out the text to Roman’s
DISCUSS.  I didn’t receive it, nor do I see it in the mail archive.  So I’m
pasting it here. — Alvaro.]

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

A “discuss to discuss”.  Per the convention outlined in
https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines, thank you for
clearly noting the implication of not securing these nodes properly.

Furthermore, following the convention, I would have expected Section 4 to
have enumerated the sensitive writeable/creatable/deletable data nodes; and
the sensitive readable nodes individually.  For a model this large, I can
imagine that individual enumeration would be a long list.

In the case of read operations, the text opens with saying that “some of
the readable data nodes ...” and later says “The exposure of the ... LSDB
will expose the detailed topology ...”.  Can you help me understand which
part of ietf-ospf.yang is the LSDB and which parts refer to “some of the
readable nodes”?  Is there are a difference, or is this text asserting that
all parts of the modules are sensitive and need access control?

A related line of questioning for the write operation.  The text opens with
saying that “There are a number of data nodes defined in ietf-ospf.yang ...
[and that] [w]rite operations ... to these nodes without proper protection
can have a negative effect on the network operations ... [and] ... the
ability to modify OSPF configuration ...” is problematic.  Can you help me
understand which parts of the text is the “OSPF configuration” vs. “there
are number of data nodes ...”?  If there isn’t a different, is the text
asserting that all parts of the modules are sensitive and need access
control?

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

(1) Idnits returned a seemingly valid few reference issues:

  ** Downref: Normative reference to an Experimental RFC: RFC 1765

  ** Downref: Normative reference to an Experimental RFC: RFC 4973

(2) Editorial
-- Section 4.  Isn’t RFC8341, “the Network Configuration Access Control
Model” rather than the “NETCONF access control model”?

-- Section 4.  Typo.  s/specificationn/specification/

-- Section 4.  Remove the duplicate instance of the phrase “for legacy
implementations that do not support key-chains”.

-- Section 4.  Typo.  s/The OSPF YANG module support/the OSPF YANG module
supports/

Alvaro Retana

---

From: Alvaro Retana <[email-masked]>
Date: Wed, 21 Aug 2019 08:12:45 -0700

On August 21, 2019 at 11:08:26 AM, Alvaro Retana ([email-masked])
wrote:

Hi!

Just replying to this piece:

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

Yes, we listed as Normative all the references to features implemented in
the model.  In particular, these two RFCs document features that are widely
used, and were considered important by the team to include.

Both of these were called out in the IETF LC.

Alvaro.

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Wed, 21 Aug 2019 17:12:18 +0000

Hi Alvaro, Roman,

See nits only response.

From: Alvaro Retana <[email-masked]>
Date: Wednesday, August 21, 2019 at 11:11 AM
To: "[email-masked]" <[email-masked]>
Cc: Roman Danyliw <[email-masked]>, Stephane Litkowski <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, The IESG <[email-masked]>
Subject: Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26
Resent-From: <[email-masked]>
Resent-To: Yingzhen Qu <[email-masked]>, Christian Hopps <[email-masked]>, Acee Lindem <[email-masked]>
Resent-Date: Wednesday, August 21, 2019 at 11:08 AM

[It looks like the datatracker didn’t send out the text to Roman’s DISCUSS.  I didn’t receive it, nor do I see it in the mail archive.  So I’m pasting it here. — Alvaro.]

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

A “discuss to discuss”.  Per the convention outlined in https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines, thank you for clearly noting the implication of not securing these nodes properly.

Furthermore, following the convention, I would have expected Section 4 to have enumerated the sensitive writeable/creatable/deletable data nodes; and the sensitive readable nodes individually.  For a model this large, I can imagine that individual enumeration would be a long list.

In the case of read operations, the text opens with saying that “some of the readable data nodes ...” and later says “The exposure of the ... LSDB will expose the detailed topology ...”.  Can you help me understand which part of ietf-ospf.yang is the LSDB and which parts refer to “some of the readable nodes”?  Is there are a difference, or is this text asserting that all parts of the modules are sensitive and need access control?

A related line of questioning for the write operation.  The text opens with saying that “There are a number of data nodes defined in ietf-ospf.yang ... [and that] [w]rite operations ... to these nodes without proper protection can have a negative effect on the network operations ... [and] ... the ability to modify OSPF configuration ...” is problematic.  Can you help me understand which parts of the text is the “OSPF configuration” vs. “there are number of data nodes ...”?  If there isn’t a different, is the text asserting that all parts of the modules are sensitive and need access control?

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

As Alvaro indicated, this was discussed and both these are implemented.

(2) Editorial
-- Section 4.  Isn’t RFC8341, “the Network Configuration Access Control Model” rather than the “NETCONF access control model”?

This refers to the NACM model itself and not the RFC title. However, I believe “ NETCONF Access Control Model (NACM)” is better and have updated.

Fixed in -27.

-- Section 4.  Remove the duplicate instance of the phrase “for legacy implementations that do not support key-chains”.
Fixed in -27.

-- Section 4.  Typo.  s/The OSPF YANG module support/the OSPF YANG module supports/
Fixed in -27.

Thanks,
Acee

Alvaro Retana

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Wed, 21 Aug 2019 17:50:31 +0000

Hi Roman,

Discussion on discuss.

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

It doesn’t make sense to talk about every configurable leaf so the section describes the general problems that can ensue if OSPF protocol configuration is compromised. We could go into classes of writeable nodes but I question what benefit that would actually have.

The LSDB refers to the instance, area, virtual link, sham-link, and interface Link State DataBases (LSDB).

             /ospf/database
            /ospf/areas/area[area-id]/database
            /ospf/virtual-links/virtual-link[transit-area-id router-id]/database
            /ospf/areas/area[area-id]/interfaces/interface[name]/database
            /ospf/area/area[area-id]/sham-links/sham-link[local-id remote-id]/database

All parts are sensitive. The LSDB is more so since it gives visibility beyond the network device itself.

This is alludes to the “config true” nodes which comprise OSPF configuration. I guess this is a repeat of your first comment.

Thanks,
Acee

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

(2) Editorial

Alvaro Retana

---

From: Roman Danyliw <[email-masked]>
Date: Thu, 22 Aug 2019 03:58:07 +0000

Hi Acee!

Thanks for the explanation.  More inline …

From: Acee Lindem (acee) [mailto:[email-masked]]
Sent: Wednesday, August 21, 2019 1:51 PM
To: Alvaro Retana <[email-masked]>; [email-masked]
Cc: Roman Danyliw <[email-masked]>; Stephane Litkowski <[email-masked]>; [email-masked]; [email-masked]; The IESG <[email-masked]>
Subject: Re: Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26

Hi Roman,

Discussion on discuss.

From: Alvaro Retana <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, August 21, 2019 at 11:11 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: Roman Danyliw <[email-masked]<mailto:[email-masked]>>, Stephane Litkowski <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, The IESG <[email-masked]<mailto:[email-masked]>>
Subject: Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26
Resent-From: <[email-masked]<mailto:[email-masked]>>
Resent-To: Yingzhen Qu <[email-masked]<mailto:[email-masked]>>, Christian Hopps <[email-masked]<mailto:[email-masked]>>, Acee Lindem <[email-masked]<mailto:[email-masked]>>
Resent-Date: Wednesday, August 21, 2019 at 11:08 AM

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

[Roman]  It was thinking this would be the case.  I don’t think we need the specificity.

             /ospf/database

[Roman] Thanks for this clarification.  IMO, it wouldn’t hurt to enumerate this list as being part of the LSDB (this is not DISCUS-level feedback)

[Roman]  I agree with “all parts are sensitive” assessment without enumerating the individual nodes of the model.  The conflict for me is that the opening sentence of this discussion is a much weaker statement of “Some of the readable data nodes in the ietf-ospf.yang module may be considered sensitive or vulnerable in some network environments.  It is thus important to control read access (e.g., via get, get-config, or notification) to these data nodes.”  Would it be a problem to say something on the order of “The readable data nodes in the ietf-ospf.yang module are sensitive. Thus, it is thus important to control read access … to them.”?  This edit make clear that “all parts are sensitive”.

A related line of questioning for the write operation.  The text opens with saying that “There are a number of data nodes defined in ietf-ospf.yang ... [and that] [w]rite operations ... to these nodes without proper protection can have a negative effect on the network operations ... [and] ... the ability to modify OSPF configuration” is problematic.  Can you help me understand which parts of the text is the “OSPF configuration” vs. “there are number of data nodes ...”?  If there isn’t a different, is the text asserting that all parts of the modules are sensitive and need access control?

[Roman] Exactly.  The text wasn’t clear on whether you meant part of all of the model should have access control  Would a similar approach to the above be possible here too – say deleting the sentence “These data nodes may be considered sensitive of vulnerable in some network environments.”  By making this edit, the text will then read that all of the write operations are sensitive.

Regards,
Roman

Thanks,
Acee

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

(2) Editorial

Alvaro Retana

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Fri, 23 Aug 2019 00:53:17 +0000

Hi Roman, Benjamin, Alvaro,
I included most of the corrections and clarifications in the -27 version of the draft. I’m going to improve the “Security Considerations” in the -28 version.
Thanks,
Acee

From: Roman Danyliw <[email-masked]>
Date: Wednesday, August 21, 2019 at 11:58 PM
To: Acee Lindem <[email-masked]>, Alvaro Retana <[email-masked]>, "[email-masked]" <[email-masked]>
Cc: Stephane Litkowski <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, The IESG <[email-masked]>
Subject: RE: Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26

Hi Acee!

Hi Roman,

Discussion on discuss.

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

             /ospf/database

Regards,
Roman

Thanks,
Acee

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

(2) Editorial

Alvaro Retana

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 26 Aug 2019 15:43:28 +0000

Hi Roman,
Please take a look at “Security Considerations” in the -28 version and comment.
Thanks,
Acee

Hi Acee!

Hi Roman,

Discussion on discuss.

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

             /ospf/database

Regards,
Roman

Thanks,
Acee

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

(2) Editorial

Alvaro Retana

---

From: Roman Danyliw <[email-masked]>
Date: Mon, 26 Aug 2019 20:05:21 +0000

Hi Acee!

-28 addresses my discuss items and my ballot now reflects that.  Thanks much for this iteration and updated text.

Regards,
Roman

From: Acee Lindem (acee) [mailto:[email-masked]]
Sent: Monday, August 26, 2019 11:43 AM
To: Roman Danyliw <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked]
Cc: Stephane Litkowski <[email-masked]>; [email-masked]; [email-masked]; The IESG <[email-masked]>
Subject: Re: Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26

Hi Roman,

From: Roman Danyliw <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, August 21, 2019 at 11:58 PM
To: Acee Lindem <[email-masked]<mailto:[email-masked]>>, Alvaro Retana <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: Stephane Litkowski <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, The IESG <[email-masked]<mailto:[email-masked]>>
Subject: RE: Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26

Hi Acee!

From: Acee Lindem (acee) [mailto:[email-masked]]
Sent: Wednesday, August 21, 2019 1:51 PM
To: Alvaro Retana <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Cc: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; Stephane Litkowski <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; The IESG <[email-masked]<mailto:[email-masked]>>
Subject: Re: Roman Danyliw’s DISCUSS on draft-ietf-ospf-yang-26

Hi Roman,

Discussion on discuss.

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

             /ospf/database

Regards,
Roman

Thanks,
Acee

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

(2) Editorial

Alvaro Retana

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 26 Aug 2019 21:54:28 +0000

Hi Roman,
Thanks much for the review and suggestions.
Acee

Date: Monday, August 26, 2019 at 4:05 PM

Hi Acee!

Regards,
Roman

Hi Roman,

Hi Acee!

Hi Roman,

Discussion on discuss.

- - - - - - - - - - -
DISCUSS
- - - - - - - - - - -

             /ospf/database

Regards,
Roman

Thanks,
Acee

- - - - - - - - - - -
COMMENT
- - - - - - - - - - -

(2) Editorial

Alvaro Retana