Re: [i2rs] Kathleen Moriarty's Discuss on draft-ietf-i2rs-protocol-security-requirements-07: (with DISCUSS and COMMENT)

["Susan Hares" <[e-mail]>]

Joel and Kathleen: 

Just for the record, I disagree that putting in Yang 1.1 is awkward.  It is
only a key-word on an item that gives information to a implementation what
transports can be used to transport data.   If the telemetry information is
events (pub/sub), then this telemetry information could encode it to go on
secure stream or an insecure stream. 

If we are going to say that something is too difficult, I would like to
discuss this point.  Large routing systems are not what NETCONF/RESTCONF has
been designing for the last 5 years.    This telemetry information is target
at those systems.  The changes that I2RS is pushing is for routing systems.
One of the reasons that Juergen and I disagree on the difficulty of the work
is different of focus of IP systems (1-20 interfaces) and the large routing
systems.  I have given you BGP examples from Large routing systems.  I
believe this is necessary for large routing systems to give the BGP
telemetry information to aid provider networks.   I welcome comments from
Joel on the usefulness of the BGP Route View information. 

+1 on the disconnect between the WG and the IESG.  The I2RS architecture has
the concept of an unsecure channel. 

Sue 

-----Original Message-----
From: Joel Halpern [mailto:[e-mail]] 
Sent: Thursday, August 18, 2016 10:31 AM
To: Susan Hares; 'Juergen Schoenwaelder'
Cc: [e-mail]; [e-mail]; 'Kathleen Moriarty'; 'The IESG';
[e-mail]; [e-mail]
Subject: RE: [i2rs] Kathleen Moriarty's Discuss on
draft-ietf-i2rs-protocol-security-requirements-07: (with DISCUSS and
COMMENT)

Let me try a different take approach to this particular question.

Let me start by putting aside the question of where things are marked, and
come back to that afterwards.

There are a number of cases that I2RS has been asked to cover of high rate
telemetry data.  This may be BGP update information, it may be frequent
information about line card activity.  There are other cases, some of which
have been documented.

While not completely insensitive, the operators have made clear that they
see protecting this data as unnecessary.  While I would hope over time to
move to a domain where all of it is protect, that is not trivial.  As the
I2RS Architecture points out, it is expected that what we describe as a
single I2RS communication between a client and agent is actually associated
with multiple channels of communication.

Now, if you want to say that the I2RS protocol requirements cannot allow for
unprotected channels, I guess we have disconnect between the IESG and the
WG.

If we say that we can allow for unprotected channels, we then get to the
question of which data can be sent over such channels.  While
architecturally I agree with Juergen that the model is a bad place to
specify it, the obverse is also true.  Not having some limits on what can be
sent unprotected causes concern about insufficient protection.  If I recall
correctly, earlier security reviews called us to task for being too broad in
what we allowed.

So, if the IESG wants us to just allow it anywhere, because the model is an
awkward place to define the limitation, I can live with that.  What I can't
live with is being told both that the model is a bad place to define it and
that there must be restrictions on what is sent unprotected, without any
proposal on how we are to move forward.

Yours,
Joel

-----Original Message-----
From: Susan Hares [mailto:[e-mail]]
Sent: Thursday, August 18, 2016 9:17 AM
To: 'Juergen Schoenwaelder' <[e-mail]>
Cc: [e-mail]; [e-mail]; 'Kathleen Moriarty'
<[e-mail]>; 'The IESG' <[e-mail]>;
[e-mail]; [e-mail]
Subject: RE: [i2rs] Kathleen Moriarty's Discuss on
draft-ietf-i2rs-protocol-security-requirements-07: (with DISCUSS and
COMMENT)

Juergen and Kathleen: 

Let me proceed with two examples: BGP route views data model and the event
for the web-service data.  

The content of these data models are designated as exposed to public.  The
routing system only populates the proposed BGP route views data model with
the data destined for the BGP looking glass.  The policy on the routing
system indicates what information gets transferred.  The data model is
completely available to the public.  The Yang Doctors are going to review
this by seeing the whole model is public and available via non-secure means.
The security people are going to review this seeing that the whole model is
public, and available via an unprotect means.  The fact the data model is
all public should simplify the review. 

An event from the I2RS RIB that a web-service route is up is the second
case.  The I2RS RIB has an event based on policy that indicates a
web-service route is up.  The yang-1.1 doctors must review the content of
the event text to see it does not break privacy or provide too much
information   The event mechanisms will need to work over secure transport
and insecure transport.  Most of the data will go over the secure transport
event stream. However, a small amount of information may go over the
insecure transport stream. 

First, let me know if my use cases are understandable.  Second, let me know
if you disagree with this use cases. 

Fyi -  IESG approved the architecture with the insecure stream. 

Sue 

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[e-mail]]
Sent: Thursday, August 18, 2016 9:06 AM
To: Susan Hares
Cc: [e-mail]; [e-mail]; 'Kathleen Moriarty'; 'The IESG';
[e-mail]; [e-mail]
Subject: Re: [i2rs] Kathleen Moriarty's Discuss on
draft-ietf-i2rs-protocol-security-requirements-07: (with DISCUSS and
COMMENT)

I just do not know on which basis a data model writer can decide whether a
data object can be exposed in an unprotected way. How are YANG doctors going
to review this? How are security directorate people going to judge this? But
as promised, I leave (still puzzled) now.

/js

On Thu, Aug 18, 2016 at 09:00:14AM -0400, Susan Hares wrote:
> Juergen: 
> 
> Yes, we seem to disagree on the value of making it hardwired in the model.
> For me, the value is a common understanding of deployment distribution
such
> as the route-views.   Since the operators argued strongly for this point,
I
> think the best idea is to get it working in code and then see if the 
> deployment matches the requests.
> 
> Sue
> 
> -----Original Message-----
> From: i2rs [mailto:[e-mail]] On Behalf Of Juergen 
> Schoenwaelder
> Sent: Thursday, August 18, 2016 8:14 AM
> To: Susan Hares
> Cc: [e-mail]; [e-mail]; 'Kathleen Moriarty'; 'The 
> IESG'; [e-mail]; 
> [e-mail]
> Subject: Re: [i2rs] Kathleen Moriarty's Discuss on
> draft-ietf-i2rs-protocol-security-requirements-07: (with DISCUSS and
> COMMENT)
> 
> Sue,
> 
> I still do not see why the 'mode of exposure' of data benefits from 
> being hard-wired in the data model. For me, it is a situational and 
> deployment specific question. But I shut up here since I aired this 
> concern before (and we simply seem to disagree).
> 
> /js
> 
> On Thu, Aug 18, 2016 at 08:07:18AM -0400, Susan Hares wrote:
> > Juergen: 
> > 
> > My example is the looking glass servers for the BGP route views 
> > project
> > (http://www.routeviews.org/) or a route indicating the presence of a
> > web-server that is public.   For the BGP I2RS route, a yang model could
> > replace the looking glass function, and provide events for these looking
> > glass functions.    For the web-server route,  an event be sent when
that
> > one route is added.  
> > 
> > Sue
> > 
> > 
> > -----Original Message-----
> > From: Juergen Schoenwaelder
> > [mailto:[e-mail]]
> > Sent: Thursday, August 18, 2016 3:32 AM
> > To: Susan Hares
> > Cc: 'Kathleen Moriarty'; 'The IESG'; [e-mail]; [e-mail]; 
> > [e-mail]; 
> > [e-mail]
> > Subject: Re: [i2rs] Kathleen Moriarty's Discuss on
> > draft-ietf-i2rs-protocol-security-requirements-07: (with DISCUSS and
> > COMMENT)
> > 
> > On Wed, Aug 17, 2016 at 09:16:48PM -0400, Susan Hares wrote:
> > > ------------------------------------------------------------------
> > > --
> > > --
> > > COMMENT:
> > > ------------------------------------------------------------------
> > > --
> > > --
> > > 
> > > > Section 3: 
> > > > Can you clarify the second to last sentence?  Do you mean there 
> > > > are
> > sections that indicate an insecure transport should be used?
> > > >   I2RS allows the use of an
> > > >  insecure transport for portions of data models that clearly 
> > > > indicate  insecure transport.
> > > 
> > > >  Perhaps:
> > > >  I2RS allows the use of an
> > > >  insecure transport for portions of data models that clearly 
> > > > indicate the use of an  insecure transport.
> > 
> > I still wonder how a data model writer can reasonably decide whether 
> > a piece of information can be shipped safely over an insecure 
> > transport since this decision often depends on the specifics of a 
> > deployment
> situation.
> > 
> > /js
> > 
> > PS: I hope we do not end up with defining data multiple times (once
> >     for insecure transport and once for secured transports).
> > 
> > -- 
> > Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> > Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
> > Fax:   [phone]         <http://www.jacobs-university.de/>
> > 
> > _______________________________________________
> > i2rs mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/i2rs
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   [phone]         <http://www.jacobs-university.de/>
> 
> _______________________________________________
> i2rs mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/i2rs
> 

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <http://www.jacobs-university.de/>