Subject: Re: [netmod] data-not-unique not secure

From: Martin Bjorklund <[email-masked]>
Date: Wed, 03 Sep 2008 10:06:08 +0200 (CEST)

Andy Bierman <[email-masked]> wrote:
> You don't need to send any data to have a security problem.
> 
> If I have access to 1 list entry (that uses the unique-stmt),
> then I can simply use a trial-and-error brute force attack,
> and keep setting the leaf I want to uncover to different
> values.  As soon as I get back a data-not-unique error,
> I know one of the entries has that value.  Further attacks
> may or may not be possible from that point.

This logic can be applied to other constraints as well.  For example,
if there's a constraint that a > b, and the user has access to b, but
not a, he can try to set b to different values and note when validate
fails to figure out the value of a.

So is the conclusion that no data models should contain constraints?
I hope not.

Is the conclusion that when validation fails, we should not try to
help the operator by giving precise error messages?  I hope not.

Or is the conclusion that implementations should apply access control
to the errors?  This might be tricky.

/martin
_______________________________________________
netmod mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netmod

---

From: Andy Bierman <[email-masked]>
Date: Wed, 03 Sep 2008 05:40:52 -0700

> So is the conclusion that no data models should contain constraints?

of course not

> to the errors?  This might be tricky.

yes, but it needs to be considered eventually.

I agree that punting access control completely provides some
cover for now (not that I agreed with punting the ACM ;-).
So it may be good enough for YANG to say "do not leak any
unauthorized data via XPath expressions, such as the
predicates defining key/value pairs".

If part of the target config is not accessible by the user,
and the validate-before-commit is going to fail, then does the
user even have access to the part that failed?  Is it possible,
or is this a variant of Wes's shared buffer deadlock
(2 users edit the config, each w/different access,
and suddenly neither can commit.)

Getting code to actually comply with access control
on error messages may be another story.  It's just
not gonna happen.  Nobody will bother pushing their
access control code that far down into rpc-error code.

When an ACM is standardized, the conceptual procedure
can be broken into steps, and if the user does not
have enough access to do the commit (or edit-config
on running), then the must and unique tests will never
even get run.

> /martin

Andy

---

From: "Randy Presuhn" <[email-masked]>
Date: Fri, 12 Sep 2008 21:15:10 -0700

Hi -

> From: "Andy Bierman" <[email-masked]>
> To: "Martin Bjorklund" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Wednesday, September 03, 2008 5:40 AM
> Subject: Re: [netmod] data-not-unique not secure
>
> Martin Bjorklund wrote:
...

IF constraints, including those involving multiple configuration parameters,
are machine-readable, then an access control model can defend against
these attacks by stipulating that the client needs at least "read" access for
the information needed to compute the constraints as well as to evaluate
whatever XPath expressions were used to find it.  This nicely side-steps
the problem of applying access control to errors, and keeps the sensitive
information under wraps.

Randy

---

From: Martin Bjorklund <[email-masked]>
Date: Wed, 17 Sep 2008 15:08:47 +0200 (CEST)

> predicates defining key/value pairs".

I just realized that this case is handled in RFC 4741, section 4.3:

   A server MUST NOT return application-level- or data-model-specific
   error information in an <rpc-error> element for which the client does
   not have sufficient access rights.

/martin