Subject: [Netconf] NACM data node path rules

From: Robert Wilton <[email-masked]>
Date: Fri, 18 Mar 2016 11:14:30 +0000

Hi,

Having read the NACM RFC there were a few points that weren't clear to 
me, and hence I was hoping that someone would be able to clarify please:

1. Does a data node path based rule automatically apply to all 
descendant children nodes?
I presume yes, but the standard doesn't seem to be explicit on this.

2. if the data node path based rules do apply to descendant children 
nodes then are you allowed to have a less restrictive path based rule on 
a child node?  E.g. one rule that disallows read access to /interfaces, 
but preceded by a rule that explicitly allows read access to 
/interfaces/interface/enabled.

3. Likewise, I presume that the default-deny-write and default-deny-all 
extensions apply to all descendant children nodes. Is that right?  I 
guess that they wouldn't make much sense otherwise.

Thanks,
Rob

---

From: Andy Bierman <[email-masked]>
Date: Fri, 18 Mar 2016 09:44:27 -0700

On Fri, Mar 18, 2016 at 4:14 AM, Robert Wilton <[email-masked]> wrote:

> Hi,
>
> Having read the NACM RFC there were a few points that weren't clear to me,
> and hence I was hoping that someone would be able to clarify please:
>
> 1. Does a data node path based rule automatically apply to all descendant
> children nodes?
It applies to the entire subtree (unless another rule gives access
to the subtree -- this applies to write access.

It will be clear in the rfc6536bis draft we are working on.
In NETCONF all data access is from the root down, but not
true in RESTCONF.

> 2. if the data node path based rules do apply to descendant children nodes
> then are you allowed to have a less restrictive path based rule on a child
> node?  E.g. one rule that disallows read access to /interfaces, but
> preceded by a rule that explicitly allows read access to

you can have less restrictive rules, similar to files permissions
(/home is owned by root, but /home/joe is owned by joe).
NETCONF supports this mode by using default-operation=none.

> extensions apply to all descendant children nodes. Is that right?  I guess
> that they wouldn't make much sense otherwise.
>

These rules need to apply to the whole subtree.
If a rule exists that allows access then the default-deny-* does not apply.

> Rob

Andy

>
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>

---

From: Robert Wilton <[email-masked]>
Date: Fri, 18 Mar 2016 19:10:13 +0000

Hi Andy,

Thanks for the comments, one further clarification please:

In your example (/home is owned by root, but /home/joe is owned by joe), 
if for user "joe"  the read access for /home was disallowed (so he 
couldn't see which other users are present in the system), but read 
access for /home/joe was permitted, then would a RESTCONF GET request by 
joe on "/home/joe" return his data?

Thanks,
Rob

On 18/03/2016 16:44, Andy Bierman wrote:
>
>
> On Fri, Mar 18, 2016 at 4:14 AM, Robert Wilton <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     Hi,
>
>     Having read the NACM RFC there were a few points that weren't
>     clear to me, and hence I was hoping that someone would be able to
>     clarify please:
>
>     2. if the data node path based rules do apply to descendant
>     children nodes then are you allowed to have a less restrictive
>     path based rule on a child node?  E.g. one rule that disallows
>     read access to /interfaces, but preceded by a rule that explicitly
>     allows read access to /interfaces/interface/enabled.
>
>
>
>     3. Likewise, I presume that the default-deny-write and
>     default-deny-all extensions apply to all descendant children
>     nodes. Is that right?  I guess that they wouldn't make much sense
>     otherwise.
>
>
>     [email-masked] <mailto:[email-masked]>

---

From: Andy Bierman <[email-masked]>
Date: Fri, 18 Mar 2016 12:43:59 -0700

On Fri, Mar 18, 2016 at 12:10 PM, Robert Wilton <[email-masked]> wrote:

> if for user "joe"  the read access for /home was disallowed (so he couldn't
> see which other users are present in the system), but read access for
> /home/joe was permitted, then would a RESTCONF GET request by joe on
> "/home/joe" return his data?
>
>
IMO this should work in RESTCONF.
The RFC does not support RESTCONF so this is speculation
about the WG consensus in the future.

Andy

>> nodes then are you allowed to have a less restrictive path based rule on a
>> child node?  E.g. one rule that disallows read access to /interfaces, but