Subject: Re: [yang-doctors] security boilerplate for RESTCONF

From: Benoit Claise <[email-masked]>
Date: Wed, 7 Sep 2016 14:45:18 +0200

On 8/11/2016 3:02 AM, Mahesh Jethanandani wrote:
>
>> On Aug 10, 2016, at 5:11 PM, Andy Bierman <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>
>>
>>
>> On Wed, Aug 10, 2016 at 5:07 PM, Mahesh 
>> Jethanandani<[email-masked] 
>> <mailto:[email-masked]>>wrote:
>>
>>     Andy,
>>
>>     > On Aug 10, 2016, at 4:24 PM, Andy Bierman <[email-masked]
>>     <mailto:[email-masked]>> wrote:
>>     >
>>     > Hi,
>>     >
>>     > The boilerplate for YANG modules SC section is for NETCONF only:
>>     >
>>     > 12.  Security Considerations
>>     >
>>     >    The "ietf-restconf-monitoring" YANG module defined in this
>>     memo is
>>     >    designed to be accessed via the NETCONF protocol [RFC6241].  The
>>     >    lowest NETCONF layer is the secure transport layer, and the
>>     >    mandatory-to-implement secure transport is Secure Shell (SSH)
>>     >    [RFC6242].  The NETCONF access control model [RFC6536]
>>     provides the
>>     >    means to restrict access for particular NETCONF users to a pre-
>>     >    configured subset of all available NETCONF protocol
>>     operations and
>>     >    content.
>>     >
>>     >
>>     > It does seem odd that the RESTCONF SC section talks about NETCONF
>>     > and not RESTCONF
>>     >
>>     >
>>     > Dale suggested this text for RESTCONF:
>>     >
>>     >    The lowest RESTCONF layer is HTTPS, and the mandatory to
>>     implement
>>     >    secure transport is TLS [RFC5246].  The RESTCONF protocol
>>     uses the
>>     >    NETCONF access control model [RFC6536], which provides the
>>     means to
>>     >    restrict access for particular RESTCONF users to a
>>     pre-configured
>>     >    subset of all available RESTCONF protocol operations and
>>     content.
>>
>>     s/mandatory to implement/mandatory-to-implement/
>>
>>
>> cut-and-paste changed that.  It was correct in Dale's comments
>>
>>     >
>>     >
>>     > Any suggestions for new SC template text so NETCONF and
>>     RESTCONF are
>>     > both covered?
>>
>>     Isn't this for RESTCONF draft?
>>
>>
>>
>> Well once RESTCONF is published then presumably each YANG module
>> (like ietf-routing) needs boilerplate text
>>
>> https://trac.tools.ietf.org/area/ops/trac/wiki/yang-security-guidelines
>>
>>
>> This is the text that needs updating when RESTCONF is published.
>
> Ok. So there are two asks. One for RESTCONF which to me looks ok and 
> one for the boilerplate.
>
> How about this for the boilerplate?
>
>             OLD
>
>     The YANG module defined in this memo is designed to be accessed
>     via the NETCONF protocol [RFC6241]. The lowest NETCONF layer is
>     the secure transport layer, and the mandatory-to-implement secure
>     transport is Secure Shell (SSH) [RFC6242]. The NETCONF access
>     control model [RFC6536] provides the means to restrict access for
>     particular NETCONF users to a pre-configured subset of all
>     available NETCONF protocol operations and content.
>
>     NEW
>
>     The YANG module defined in this memo is designed to be accessed
>     via the NETCONF [RFC6241] or RESTCONF [RFCXXXX] protocol. The
>     lowest NETCONF layer is the secure transport layer, and
>     mandatory-to-implement is Secure Shell (SSH) [RFC6242], while the
>     lowest RESTCONF layer is HTTP, and the mandatory-to-implement
>     secure transport is Transport Layer Security (TLS) [RFC5246].
>     The NETCONF access control model [RFC6536] provides the means to
>     restrict access for particular NETCONF or RESTCONF users to a
>     pre-configured subset of all available NETCONF or RESTCONF
>     protocol operations and content.
>
That works.
We should not forget to update the WIKI at 
https://trac.tools.ietf.org/area/ops/trac/wiki/yang-security-guidelines 
when the RESTCONF RFC is (about to be) published.

Regards, B.
>>
>>     >
>>     >
>>     > Andy
>>     >
>>
>>
>>
>> Andy
>>
>>     > _______________________________________________
>>     > yang-doctors mailing list
>>     >[email-masked] <mailto:[email-masked]>
>>     >https://www.ietf.org/mailman/listinfo/yang-doctors
>>     <https://www.ietf.org/mailman/listinfo/yang-doctors>
>>
>>     Mahesh Jethanandani
>>     [email-masked] <mailto:[email-masked]>
>>
>
> Mahesh Jethanandani
> [email-masked] <mailto:[email-masked]>
>
>
>
>
>
> _______________________________________________
> yang-doctors mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/yang-doctors