Subject: [Netconf] nacm comments/notes - part 1

From: "Bert (IETF) Wijnen" <[email-masked]>
Date: Sun, 07 Nov 2010 14:41:26 +0800

Part 1 of my current review/reading of the NACM document
draft-ietf-netconf-access-control-01

1. RFC4741 is cited/referenced. Should be rfc4741bis

2. RFC4742 is cited/referenced. Should be rfc4742bis

3. Sect 2. are there no MUSTs needed here?

4. figure 1 (but also other places in the doc) talks about
    RPC operation. I thought that in the new terminology we
    talk about rpc messages and protocol operations
    (rfc4741bis seems to use "<rpc> operation" once,
    maybe that should also be fixed?

5. figure 1 speaks about a "data node". I assume that is
    the data node as defined in RFC6020? Migth ewant to add
    this term to the terminology section and indicate it is
    taken from RFC6020 (if this indeed the case)

6. sect 3.4
      It must be possible control access to specific
    s/possible control/possible to control/

7. sect 3.4 page 10
    speaks about databases. I think it is better to use datastores
    here, is it not?

8. sect 3.4 (at the end):
      Only a privileged user should be able to alter the factory-default
      access control rules.
    Did we define the term "privileged user"? Is this the superuser?
    or is it any use who has proper privilege (authorization) ?

9. Sect 3.8
       It is customary for security-sensitive objects to be documented in
       the Security Considerations section of an RFC.
    Mmm... I thought it is mandatory instead of just customary.

10. WHat is the intent of sect 3.8
    It seems to me to be a list of reasons as to why we might need
    some machine readable atg on data-nodes. Is that the intention?
    Are we implicitly saying that YANG is incomplete in this aspect?

11. Sect 3.10
      A session must always be authorized to receive the <replayComplete>
      and <notificationComplete> notification events, defined in [RFC5277]
    Do you mean "send" instead of "receive" ??
    I thought NACM is applied at the server side, so theese two
    events would be "send" at the server, no?

- additional notes

In general, a thouroough check of termonilogy consistency
within this document is needed. And make sure it is in sync
with the terminology in the rfc4741bis and YANG rfc6020.

1. DBH mentioned something about XML accessControl work don in W3C
    Hannes may be able to help here

Bert

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 11 Nov 2010 11:08:44 +0100 (CET)

Hi Bert,

>    maybe that should also be fixed?

Actually 6020 has this definition:

   o  RPC operation: A specific Remote Procedure Call, as used within
      the NETCONF protocol.  It is also called a protocol operation.

RFC 4741 uses the term "protocol operation" for the base netconf
operations, edit-config, get-config etc.  However 4741bis uses the
term in a more generic way (which I think is a bit confusing).

So I would prefer to import the term "RPC operation" from 6020 and use
that.

/martin

---

From: Andy Bierman <[email-masked]>
Date: Thu, 11 Nov 2010 02:15:33 -0800

On 11/11/2010 02:08 AM, Martin Bjorklund wrote:
> Hi Bert,
>
> "Bert (IETF) Wijnen"<[email-masked]>  wrote:
>

OK with me, but the NACM rpc-rules are generic -- they work for <edit-config>
or <rock-the-house> in the same way.  We don't want to cause confusion.
OK -- too late for that.  We want to minimize the confusion.

> /martin

Andy

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 11 Nov 2010 11:43:10 +0100

> So I would prefer to import the term "RPC operation" from 6020 and use

But RPC operation is also called a protocol operation. ;-) If there is
a problem, we should refer to the "base protocol operations" if we
specifically mean the 4741 set of RPC operations. Even 4741 says:

   o  client: A client invokes protocol operations on a server.  In
      addition, a client may subscribe to receive notifications from a
      server.

This does not mean "base protocol operations" in 4741 either. And it
says:

   o  protocol operation: A specific remote procedure call, as used
      within the NETCONF protocol.

Is this where you think the confusion may come from? Later 4741bis
says:

   3.  The Operations layer defines a set of base protocol operations
       invoked as RPC methods with XML-encoded parameters.  Section 7
       details the list of base protocol operations.

Note "base protocol operations" being used here. (Yeah, different
authors. ;-) Further on:

   The base protocol includes the following protocol operations:

Qualified to be 'base'. [...]

I do not really see the problem with "protocol operations". I do not
think 4741bis implies "protocol operations" means "base protocol
operations" per se.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 11 Nov 2010 11:53:41 +0100 (CET)

>       addition, a client may subscribe to receive notifications from a

This is from 4741bis, not 4741.

/martin

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 11 Nov 2010 11:59:09 +0100

> This is from 4741bis, not 4741.

Sorry. Too much typing today.

/js