Subject: [Netconf] FW: DISCUSS: draft-ietf-netconf-tls

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Wed, 11 Mar 2009 18:13:28 +0100

Hi All,

FYI. This was the first DISCUSS for the TLS draft we solved. 
Please state if you cannot live with the solution.

Cheers, 
Mehmet

-----Original Message-----
From: ext Jari Arkko [mailto:[email-masked]] 
Sent: Wednesday, March 11, 2009 5:36 PM
To: Ersue, Mehmet (NSN - DE/Munich)
Cc: [email-masked]; [email-masked]; ext Badra; Romascanu,
Dan (Dan)
Subject: Re: DISCUSS: draft-ietf-netconf-tls

This would clear my issue.

Thanks for a fast response.

Jari

Ersue, Mehmet (NSN - DE/Munich) wrote:
>
> Hi Jari,
>
> thank you for uncovering this issue.
>
> It is correct that according to RFC 4741 the identity of each
> end of a NETCONF session is expected to be available to the
> other side and an authentication must be done also "on the server
> side" to enjure that the incoming client request is legitimate.
>
> We suggest to change the text in chapter 3.2. as following:
>
> "3.2. Client Identity
>
> The server MUST verify and authenticate the identity of the
> client according to local policy to ensure that the incoming
> client request is legitimate before any configuration or state
> data is sent to or received from the client."
>
>
> Would this change be sufficient for you?
>
> Thank you for your support.
>
> Mehmet
>  
>
> > -----Original Message-----
> > From: ext Jari Arkko [_mailto:[email-masked]]
> > Sent: Wednesday, March 11, 2009 3:13 PM
> > To: [email-masked]
> > Cc: [email-masked];
> > [email-masked]; [email-masked]
> > Subject: DISCUSS: draft-ietf-netconf-tls
> >
> > Discuss:
> >
> > I expected to ballot Yes on this but at the end I found I was
missing
> > some fundamental information. My understanding of RFC 4741 is that
> > authentication/authorization is something left to the protocol that
> > carries NETCONF messages. RFC 4742 (NETCONF over SSH) for
> > instance says:
> >
> >    The identity of the server MUST be verified and
> > authenticated by the
> >    client according to local policy ...
> >
> >    The identity of the client MUST also be verified and
> >    authenticated by the server according to local policy ...
> >
> > However, the current document has explicit guidance about server
side
> > authentication, but not much about clients:
> >
> >    The server may have no external knowledge on client's identity
and
> >    identity checks might not be possible (unless the client has a
> >    certificate chain rooted in an appropriate CA).  If a server has
> >    knowledge on client's identity (typically from some source
external
> >    to NETCONF or TLS) it MUST check the identity as described above.
> >
> > This seems to be in violation of RFC 4741 thinking:
> >
> >    It is further
> >    expected that the identity of each end of a NETCONF session will
be
> >    available to the other in order to determine authorization for
any
> >    given request.
> >
> > But I can't think that the authors would have missed client side
> > authentication; its so fundamental to configuration operations
> > to network devices. What am I missing? Is there some other
> > authentication
> > layer for client/user side somewhere? If there is not, I cannot see
> > how you can allow one-side TLS authentication except maybe for
reading
> > information.