Subject: [Netconf] Question on NACM usage

From: "Bogaert, Bart (Nokia - BE)" <[email-masked]>
Date: Wed, 14 Dec 2016 07:49:11 +0000

Hi

I would like to continue on one of the examples given in the appendix of the
NACM RFC:

       <rule>

         <name>permit-dummy-interface</name>

         <path xmlns:acme="http://example.com/ns/itf">

           /acme:interfaces/acme:interface[acme:name='dummy']

         </path>

         <access-operations>read update</access-operations>

         <action>permit</action>

         <comment>

           Allow the limited and guest groups read

           and update access to the dummy interface.

         </comment>

       </rule>

I am assuming that this rule allows read and update access to all leaves of
the data node identified by the path, so it would allow to update a specific
leaf of that data node.  Is my understanding correct?

Another question I have is related to the XPATH itself.  In the above
example I think that the name leaf is the key of the list.  Can we use
another leaf to identify a data node and allow specific access to that data
node?

Assume that there would be a leaf called 'pool-id' which can take values
from 1 to 10, could the XPATH look like below?

         <path xmlns:acme="http://example.com/ns/itf">

           /acme:interfaces/acme:interface[acme:pool-id=5]

         </path>

We would like to allow/deny access to data nodes (and the leafs of that data
node) to groups based on the value of the pool-id.  Is the above the correct
way to express the access control?

Best regards - Vriendelijke groeten,

Bart Bogaert

Broadband-Access System Architect Data

Contact number +32 3 2408310 (+32 477 673952)

NOKIA

Copernicuslaan 50, 2018 Antwerp, Belgium

---

From: Martin Bjorklund <[email-masked]>
Date: Wed, 14 Dec 2016 12:22:05 +0100 (CET)

> leaf of that data node.  Is my understanding correct?

Yes.  (not just leafs but also leaf-lists and containers and lists).

> another leaf to identify a data node and allow specific access to that data

No.

> way to express the access control?

No this is not possible.  The reason is that if we allow any XPath
expression here, the complexity of implementing this increases
dramatically.  Also the complexity of using this and understanding how
rules interact will increase, thus increasing the risk of
mis-configuration (which would be security impacting).

/martin

---

From: Per Hedeland <[email-masked]>
Date: Wed, 14 Dec 2016 12:39:57 +0100

> mis-configuration (which would be security impacting).

...and of course, the spec says that it's not possible - RFC 6536:

  typedef node-instance-identifier {
    type yang:xpath1.0;
    description
      "Path expression used to represent a special
       data node instance identifier string.

       A node-instance-identifier value is an
       unrestricted YANG instance-identifier expression.
       All the same rules as an instance-identifier apply
       except predicates for keys are optional.  If a key
       predicate is missing, then the node-instance-identifier
       represents all possible server instances for that key.

RFC 6020, section 9.13:

   The syntax for an instance-identifier is a subset of the XPath
   abbreviated syntax, formally defined by the rule
   "instance-identifier" in Section 12.  It is used to uniquely identify
   a node in the data tree.  Predicates are used only for specifying the
   values for the key nodes for list entries, a value of a leaf-list
   entry, or a positional index for a list without keys.  For
   identifying list entries with keys, each predicate consists of one
   equality test per key, and each key MUST have a corresponding
   predicate.

--Per Hedeland