Subject: [Isms] Question on TSM outgoing step 1

From: Wes Hardaker <[email-masked]>
Date: Fri, 12 Sep 2008 10:49:58 -0700

To quote the TSM-08 document:

   1) If there is a securityStateReference, then this is a response
   message.  Extract transportDomain, transportAddress, securityName,
   securityLevel, securityModel, and tmStateReference from the
   securityStateReference cache.  Set the tmRequestedSecurityLevel to
   the value of the extracted securityLevel.  The cachedSecurityData for
   this message can now be discarded.  Set the tmSameSecurity parameter
   in the tmStateReference cache to true.

I'm not sure why the cache is supposed to contain half of that
information that the second sentence is saying to extract.  Most of it
is passed in via the ASI parameters, and almost none of it is actually
used in the following text.  (the most confusing one would be the
reference to the "securityModel" which should always be "self" and am
not sure how it would ever be anything other than "TSM").

The third sentence (tmRequestedSecurityLevel = securityLevel) also
doesn't make sense since no where in the incoming procedures did we
cache the securityLevel in the first place.  And regardless, wouldn't it
make more sense to set the tmRequestedSecurityLevel to what was
requested from the ASI parameters rather than a cached value?

Suggestions:

1) Change the second sentence to just:

    "Extract tmStateReference from the securityStateReference cache."

  or even:

    "Extract tmStateReference and any other implementation-dependent
    parameters from the securityStateReference cache."

2) Change the forth sentence to:

    "Set the tmRequestedSecurityLevel to the securityLevel value.

   (unless I'm missing something on this particular point...  I think
   the MP already assigns the security level to be the same, so all we
   have to do is pass what's passed on to us to the TM)
-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Fri, 12 Sep 2008 14:09:09 -0400

Hi,

The cache should contain all the security properties related to the
incoming request, and make sure the same security properties are
applied to the response.

My documentation might be missing osmehting, but that is the intent.

Extracting securityModel is a left-over from when we were discussing
if the TM can specify which securtityModel should be used, and is also
left over from cut-and-paste from SNMPv3, where extracting the
securityModel is important because the SNMPv3 message carries that in
the securityParameters.
We should probably add a check to ensure that, on the response, we are
using the same security model as was used with the request.

If the request specified authpriv, then the response should also be
sent authpriv. That is why we do not take the securityLevel form the
ASI, but from the securityCache. IIRC, the MPM doesn't look in the
securityCache.

dbh

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Wes Hardaker
> Sent: Friday, September 12, 2008 1:50 PM
> To: ISMS WG
> Subject: [Isms] Question on TSM outgoing step 1
> 
>

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 12 Sep 2008 13:10:57 -0700

>>>>> On Fri, 12 Sep 2008 14:09:09 -0400, "David Harrington" <[email-masked]> said:

DH> The cache should contain all the security properties related to the
DH> incoming request, and make sure the same security properties are
DH> applied to the response.

If you want to do that then text saying that needs to be added, as well
as text put into the incoming EOP describing to cache that data.

DH> We should probably add a check to ensure that, on the response, we are
DH> using the same security model as was used with the request.

That sounds more like a job for the MP than the security model itself...

DH> If the request specified authpriv, then the response should also be
DH> sent authpriv. That is why we do not take the securityLevel form the
DH> ASI, but from the securityCache. IIRC, the MPM doesn't look in the
DH> securityCache.

I agree if you want the security model to be authoritative, that's the
right place to do it.  (from an implementation point of view, though,
the security model can't be authoritative since other modules can trump
it's decisions anyway since they get to handle the packet after the SM
gets done with it).
-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 12 Sep 2008 16:19:16 -0400

> That sounds more like a job for the MP than the security model itself...

Maybe David means s/security model/secure transport/ ?

-- Jeff

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 12 Sep 2008 13:41:29 -0700

>>>>> On Fri, 12 Sep 2008 16:19:16 -0400, Jeffrey Hutzelman <[email-masked]> said:

>> That sounds more like a job for the MP than the security model itself...

JH> Maybe David means s/security model/secure transport/ ?

The current text currently says the security model, when processing an
out going message, should extract the securityModel parameter from it's
cache.  That's what we were talking about.  (The Domain is also listed
as to be extracted from the cache; so both the transport and the model
are listed as to be extracted from the cache currently).
-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Fri, 12 Sep 2008 17:28:12 -0400

No, I meant security model.

The security model that gets asked to send the response should check
that the securityCache has a matching securityModel, and if not send
an error back to the MPM (and application) that sent the response to a
different securityModel than the request came through. It is an error
for an application to send a response via a different securityModel.

dbh

> From: Jeffrey Hutzelman [mailto:[email-masked]] 
> Sent: Friday, September 12, 2008 4:19 PM
> To: Wes Hardaker; David Harrington
> Cc: 'ISMS WG'; [email-masked]
> Subject: Re: [Isms] Question on TSM outgoing step 1
>