Subject: [netconf] a comment on draft-ietf-netconf-tls-client-server-15

From: Martin Bjorklund <[email-masked]>
Date: Wed, 23 Oct 2019 09:37:15 +0200 (CEST)

Hi,

This is not a full review, just one thing that I stubmled upon.

The model has (pruned to illustrate my point):

       container server-authentication {
         nacm:default-deny-write;
         must 'ca-certs or server-certs';
         container ca-certs {
           if-feature "ts:x509-certificates";
           presence ...;
           ...
         }
         container server-certs {
           if-feature "ts:x509-certificates";
           presence ...;
           ...
         }
       }

1.  If a server doesn't implement the feature ts:x509-certificates,
    the model effectively becomes:

       container server-authentication {
         nacm:default-deny-write;
         must 'ca-certs or server-certs';
       }

    This must expression will never be true, which means that it is
    not possible to configure anything!

2.  When this grouping is used in ietf-https-notifs, it looks like
    this:

  +--rw receivers
     +--rw receiver* [name]
        +--rw name           string
        ...
        |  +--rw server-authentication
        |  |  +--rw ca-certs! {ts:x509-certificates}?
                 ...            
        |  |  +--rw server-certs! {ts:x509-certificates}?
                 ...

   Now, the container 'server-authentication' has
   nacm:default-deny-write, and its contents is mandatory (due to the
   must expression).  This means that it is not possible to configure
   a single receiver without explicit NACM rules for this container.  Is
   that really the intention?

/martin

---

From: Martin Bjorklund <[email-masked]>
Date: Wed, 23 Oct 2019 10:00:37 +0200 (CEST)

Hi,

two more comments below.

>    that really the intention?

3.  You don't have a choice between ca-certs and server-certs, which I
    assume is intentional (they can both exist).  I think you need to
    explain what happens when both these are configured.

4.  The description of ca-certs and server-certs has:

      "A server certificate is authenticated if ..."

    But you don't specify what it means for a certificate to be
    authenticated.  If the intention is that the meaning depends on
    where it is used, the description of the grouping should specify
    this requirement.

/martin

---

From: Kent Watsen <[email-masked]>
Date: Wed, 23 Oct 2019 16:29:03 +0000

Hi Martin,

Thanks for digging into this.

>           if-feature "ts:x509-certificates";

This is in ietf-tls-client.yang, for those interested.

>    not possible to configure anything!

The "if-feature" statements above are no longer valid since now "local" configuration is supported (i.e., `ts:local-or-truststore-certs-grouping`), so the truststore no longer is required to be implemented.

Simply removing the two "if-feature" statements in ietf-tls-client.yang resolves the issue.  Note that ts:local-or-truststore-certs-grouping have within it if-feature statements that  prune the "truststore" half out.  Checking the other models, there were also instances of this in ietf-tls-server.yang and in both the ssh client and server modules.

>   that really the intention?

Yes, these are security parameters.  Read access is okay, but only authorized clients should be able to configure them.

>    explain what happens when both these are configured.

OLD:
    container server-authentication {
      ...
      description
        "Trusted server identities.";

NEW:
    container server-authentication {
      ...
      description
        "Trusted server identities.  Any combination of trusted
         server identities is additive and unordered.";

Is this okay?

>    where it is used, the description of the grouping should specify

For "ca-certs", the full sentence is: 

          A server certificate is authenticated if it has a valid
           chain of trust to a configured CA certificate.";

For server-certs, the full sentence is:

           A server
           certificate is authenticated if it is an exact match
           to a configured server certificate.";

How is the 2nd-half of these sentences not doing just what you're asking for?

Kent // contributor

---

From: Martin Bjorklund <[email-masked]>
Date: Wed, 23 Oct 2019 19:18:37 +0200 (CEST)

Kent Watsen <[email-masked]> wrote:
> The "if-feature" statements above are no longer valid since now
> "local" configuration is supported (i.e.,
> `ts:local-or-truststore-certs-grouping`), so the truststore no longer
> is required to be implemented.
> 
> Simply removing the two "if-feature" statements in
> ietf-tls-client.yang resolves the issue.  Note that
> ts:local-or-truststore-certs-grouping have within it if-feature
> statements that prune the "truststore" half out.  Checking the other
> models, there were also instances of this in ietf-tls-server.yang and
> in both the ssh client and server modules.

Ok.

> Yes, these are security parameters.  Read access is okay, but only
> authorized clients should be able to configure them.

I think it is odd that if I am trusted to configure a tls client, I
can't fully configure it w/o additional rules.

For example, suppose the security admin has set up a certificate
trustore (/truststore/certificate) with trusted certificates.  Now if
I want to create a receiver of notifications, I want to point to this
list.  But I can't do that w/o special NACM rules.

>          server identities is additive and unordered.";

Ok, but see below.

> How is the 2nd-half of these sentences not doing just what you're

So the text explains when a server certificate is authenticated.  But
what is supposed to happen when a server certificate is not
authenticated?

BTW, should it rather be "A server is authenticated if its certificate
is an exact match..." etc?

/martin

---

From: Kent Watsen <[email-masked]>
Date: Wed, 23 Oct 2019 18:31:09 +0000

[reducing to open parts]

> list.  But I can't do that w/o special NACM rules.

Without this default-deny-write, the second administrator could
configure a `local` setting that didn't point to the truststore, or
modify the `truststore` setting to point to potentially improper
truststore definitions.

> what is supposed to happen when a server certificate is not

What happens is TLS/SSH specific, but generally entails the server
sending the client a failure message followed by closing the TCP
connection.

> is an exact match..." etc?

Yes.  Language fixed in all four modules.

Kent // contributor