Subject: [Netconf] Review of: draft-ietf-netconf-access-control-02.txt

From: "Bert (IETF) Wijnen" <[email-masked]>
Date: Thu, 10 Mar 2011 13:33:11 +0100

I would like to encourage all WG participants to review and
comment on draft-ietf-netconf-access-control-02.txt.
If you can do so (well) before our meeting in Prague, then
the editor(s)/author(s) have time to construct a list
of open issues (if any) and prepare answers or proposal
on how to address the issues. We can then make better
progress in Prague.

Here are a first few comments from me.

It seems most of my initial comments on revision 01 have been
addressed. But

    7. sect 3.4 page 10
       speaks about databases. I think it is better to use datastores
       here, is it not?

has been addressed in the text. But the YANG module still uses
database in most places. Is that intentional?

The following 2 comments did not cause change in the doc.
That may be fine, but can you then comment/answer:
10. WHat is the intent of sect 3.8
    It seems to me to be a list of reasons as to why we might need
    some machine readable atg on data-nodes. Is that the intention?
    Are we implicitly saying that YANG is incomplete in this aspect?

11. Sect 3.10
      A session must always be authorized to receive the <replayComplete>
      and <notificationComplete> notification events, defined in [RFC5277]
    Do you mean "send" instead of "receive" ??
    I thought NACM is applied at the server side, so theese two
    events would be "send" at the server, no?

Thanks,
Bert

On 11/7/10 7:41 AM, Bert (IETF) Wijnen wrote:
> Part 1 of my current review/reading of the NACM document
> draft-ietf-netconf-access-control-01
>
> 1. RFC4741 is cited/referenced. Should be rfc4741bis
>
> 2. RFC4742 is cited/referenced. Should be rfc4742bis
>
> 3. Sect 2. are there no MUSTs needed here?
>
> 4. figure 1 (but also other places in the doc) talks about
>    RPC operation. I thought that in the new terminology we
>    talk about rpc messages and protocol operations
>    (rfc4741bis seems to use "<rpc> operation" once,
>    maybe that should also be fixed?
>
> 5. figure 1 speaks about a "data node". I assume that is
>    the data node as defined in RFC6020? Migth ewant to add
>    this term to the terminology section and indicate it is
>    taken from RFC6020 (if this indeed the case)
>
> 6. sect 3.4
>      It must be possible control access to specific
>    s/possible control/possible to control/
>
> 7. sect 3.4 page 10
>    speaks about databases. I think it is better to use datastores
>    here, is it not?
>
> 8. sect 3.4 (at the end):
>      Only a privileged user should be able to alter the factory-default
>      access control rules.
>    Did we define the term "privileged user"? Is this the superuser?
>    or is it any use who has proper privilege (authorization) ?
>
> 9. Sect 3.8
>       It is customary for security-sensitive objects to be documented in
>       the Security Considerations section of an RFC.
>    Mmm... I thought it is mandatory instead of just customary.
>
> 10. WHat is the intent of sect 3.8
>    It seems to me to be a list of reasons as to why we might need
>    some machine readable atg on data-nodes. Is that the intention?
>    Are we implicitly saying that YANG is incomplete in this aspect?
>
> 11. Sect 3.10
>      A session must always be authorized to receive the <replayComplete>
>      and <notificationComplete> notification events, defined in [RFC5277]
>    Do you mean "send" instead of "receive" ??
>    I thought NACM is applied at the server side, so theese two
>    events would be "send" at the server, no?
>
>
> - additional notes
>
> In general, a thouroough check of termonilogy consistency
> within this document is needed. And make sure it is in sync
> with the terminology in the rfc4741bis and YANG rfc6020.
>
> 1. DBH mentioned something about XML accessControl work don in W3C
>    Hannes may be able to help here
>
> Bert

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 10 Mar 2011 18:31:48 +0100 (CET)

Hi,

> database in most places. Is that intentional?

No, we will fix that.

> The following 2 comments did not cause change in the doc.

The second comment actually did cause a change in the doc.

>    some machine readable atg on data-nodes. Is that the intention?

Yes.

>    Are we implicitly saying that YANG is incomplete in this aspect?

Not really; YANG has an extension mechanism which is designed to be
used in situations like this.  NACM is using that mechanism and
defines two extension statements.

>    events would be "send" at the server, no?

Actually, the new text in -02 says:

   A client MUST always be authorized to receive the <replayComplete>
   and <notificationComplete> notification events, defined in [RFC5277]

I hope this is clearer than the old text.

/martin

---

From: "Bert Wijnen \(IETF\)" <[email-masked]>
Date: Thu, 10 Mar 2011 19:14:13 +0100

OK. Thanks Martin.

Bert