Subject: [Netconf] WG Last Call for draft-ietf-netconf-system-notifications-05.txt - runs till oct 21st

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Thu, 06 Oct 2011 13:45:53 +0200

Dear WG participants,

I thought I had already re-issued a new WG LC for this revision
5 of the system notifications document. But it seems I did not do that.

Revision 5 came out soon after our Quebec IETF session. It is supposed
top address all WGLC comments on revision 4.

So... this is a formal WG Last Call for document
draft-ietf-netconf-system-notifications-05.txt.

Pls send your comments/reviews/question no later than Oct 21st 2011.

The next step after this WGLC is to pass this to our AD for consideration
to publish as PS RFC.

Bert and Mehmet

-------- Original Message --------
Subject: [Netconf] I-D Action: draft-ietf-netconf-system-notifications-05.txt
Date: Sun, 07 Aug 2011 09:59:10 -0700
From: [email-masked]
To: [email-masked]
CC: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network 
Configuration Working Group of the IETF.

	Title           : Network Configuration Protocol (NETCONF) Base Notifications
	Author(s)       : Andy Bierman
	Filename        : draft-ietf-netconf-system-notifications-05.txt
	Pages           : 16
	Date            : 2011-08-07

    The NETCONF protocol provides mechanisms to manipulate configuration
    datastores.  However, client applications often need to be aware of
    common events such as a change in NETCONF server capabilities, that
    may impact management applications.  Standard mechanisms are needed
    to support the monitoring of the base system events within the
    NETCONF server.  This document defines a YANG module that allows a
    NETCONF client to receive notifications for some common system
    events.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-netconf-system-notifications-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-netconf-system-notifications-05.txt
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 06 Oct 2011 13:57:52 +0200 (CEST)

Hi,

"Bert Wijnen (IETF)" <[email-masked]> wrote:
> 5 of the system notifications document.

So did I...

> Pls send your comments/reviews/question no later than Oct 21st 2011.

Please consider my comments:

http://www.ietf.org/mail-archive/web/netconf/current/msg07108.html
http://www.ietf.org/mail-archive/web/netconf/current/msg07110.html

as WGLC comments for -05.

/martin

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Fri, 14 Oct 2011 09:23:14 +0200

Gentle reminder!

Please do review and post your comments/questions/support/objections
by Friday 21st of October.

We explicitly ask you to ALSO let us know if you have read and
support or agree with the document.

Bert and Mehmet

-------- Original Message --------
Subject: [Netconf] WG Last Call for draft-ietf-netconf-system-notifications-05.txt - runs till oct 21st
Date: Thu, 06 Oct 2011 13:45:53 +0200
From: Bert Wijnen (IETF) <[email-masked]>
To: netconf <[email-masked]>

Dear WG participants,

Bert and Mehmet

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 21 Oct 2011 11:25:52 +0200

> support or agree with the document.

I have read the -05 version of NACM and it has significantly improved
since the last version I reviewed. A great job done by the editors and
I think the document is basically ready to go. I only have some nits
and a clarification question / suggestion.

A clarification question: My understanding of the document is that a
user who is member of two groups (say A and B) with conflicting access
control rule lists (say R1 of group A allows access to foo while R2 of
group B denies access to foo) will either be allowed to access foo or
denied access depending on the order of the rule lists. If R1 is
before R2, then R1 matches and access is allowed. If R2 is before R1,
then R2 matches and access is denied. Is my understanding correct? If
yes, then there should perhaps be a hint in the security
considerations that changing order of rules and rule lists can have
significant impact on the access rights granted.

Nits:

- s/rules are editing directly/rules are edited directly/

- "NACM requires some a user name in each NACM group mapping." Despite
  the construction of the sentence, it is not even clear what the
  intended meaning was. I think the yang model allows a group with an
  empty leaf-list of users.

- s/"path-stmt" values/"path-stmt" values)/

- s/ot it may/or it may/

- s/<interface>. entry/<interface> entry/

- s/<interface>. entries/<interface> entries/

- What is the "mod-3" rule refered to at the end of A.4?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Andy Bierman <[email-masked]>
Date: Fri, 21 Oct 2011 08:01:05 -0700

You responded to the wrong draft thread.
We will try to add text to the security considerations that
emphasizes what most operators already know -- the order 
of access control rules matters.

Andy

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Juergen Schoenwaelder
Sent: Friday, October 21, 2011 2:26 AM
To: Bert Wijnen (IETF)
Cc: netconf
Subject: Re: [Netconf] WG Last Call for draft-ietf-netconf-system-notifications-05.txt - runs till oct 21st

Nits:

- s/ot it may/or it may/

/js

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 21 Oct 2011 19:00:07 +0200

On Fri, Oct 21, 2011 at 08:01:05AM -0700, Andy Bierman wrote:

> You responded to the wrong draft thread.  We will try to add text to
> the security considerations that emphasizes what most operators
> already know -- the order of access control rules matters.

Oops. I guess for rules this might be more or less obvious. It may be
more subtle that swapping rule lists can change acm behaviour as well.

/js

---

From: Andy Bierman <[email-masked]>
Date: Fri, 21 Oct 2011 10:14:27 -0700

We are hoping that vendors include pre-populated roles
and operators just need to add users into the proper role-based groups.
IMO, proper use of 'security tagging' in the data model
(nacm:default-deny-write and nacm:default-deny-all)
should reduce the need for detailed data access control rules.

Andy

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: Friday, October 21, 2011 10:00 AM
To: Andy Bierman
Cc: Bert Wijnen (IETF); netconf
Subject: Re: [Netconf] WG Last Call for draft-ietf-netconf-system-notifications-05.txt - runs till oct 21st

/js

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Thu, 27 Oct 2011 09:31:39 +0200

The WG Last Call for this draft has now formally ended.

Editors/authors, pls submit a new revision if needed.
Pls do so before the I-D deadline this coming Monday.

Bert