Re: [netconf] a comment on draft-ietf-netconf-tls-client-server-15

Martin Bjorklund <mbj@tail-f.com> Wed, 23 October 2019 17:18 UTC

Return-Path: <mbj@tail-f.com>
X-Original-To: netconf@ietfa.amsl.com
Delivered-To: netconf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B00EA12086F for <netconf@ietfa.amsl.com>; Wed, 23 Oct 2019 10:18:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hsY8XnNNogMM for <netconf@ietfa.amsl.com>; Wed, 23 Oct 2019 10:18:40 -0700 (PDT)
Received: from mail.tail-f.com (mail.tail-f.com [46.21.102.45]) by ietfa.amsl.com (Postfix) with ESMTP id 852081208A7 for <netconf@ietf.org>; Wed, 23 Oct 2019 10:18:40 -0700 (PDT)
Received: from localhost (h-4-44.A165.priv.bahnhof.se [158.174.4.44]) by mail.tail-f.com (Postfix) with ESMTPSA id EDE041AE018B; Wed, 23 Oct 2019 19:18:37 +0200 (CEST)
Date: Wed, 23 Oct 2019 19:18:37 +0200 (CEST)
Message-Id: <20191023.191837.484006721829897329.mbj@tail-f.com>
To: kent@watsen.net
Cc: netconf@ietf.org
From: Martin Bjorklund <mbj@tail-f.com>
In-Reply-To: <0100016df97342cf-58f4f854-4372-4da7-aab6-86959cc275d7-000000@email.amazonses.com>
References: <20191023.093715.2094043256766716320.mbj@tail-f.com> <0100016df97342cf-58f4f854-4372-4da7-aab6-86959cc275d7-000000@email.amazonses.com>
X-Mailer: Mew version 6.8 on Emacs 25.2
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/PgThW28it_26oUny0quDs0OS4vM>
Subject: Re: [netconf] a comment on draft-ietf-netconf-tls-client-server-15
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETCONF WG list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Oct 2019 17:18:43 -0000

Kent Watsen <kent@watsen.net> wrote:
> Hi Martin,
> 
> Thanks for digging into this.
> 
> 
> > The model has (pruned to illustrate my point):
> > 
> >       container server-authentication {
> >         nacm:default-deny-write;
> >         must 'ca-certs or server-certs';
> >         container ca-certs {
> >           if-feature "ts:x509-certificates";
> >           presence ...;
> >           ...
> >         }
> >         container server-certs {
> >           if-feature "ts:x509-certificates";
> >           presence ...;
> >           ...
> >         }
> >       }
> 
> 
> This is in ietf-tls-client.yang, for those interested.
> 
> 
> 
> > 1.  If a server doesn't implement the feature ts:x509-certificates,
> >    the model effectively becomes:
> > 
> >       container server-authentication {
> >         nacm:default-deny-write;
> >         must 'ca-certs or server-certs';
> >       }
> > 
> >    This must expression will never be true, which means that it is
> >    not possible to configure anything!
> 
> 
> The "if-feature" statements above are no longer valid since now
> "local" configuration is supported (i.e.,
> `ts:local-or-truststore-certs-grouping`), so the truststore no longer
> is required to be implemented.
> 
> Simply removing the two "if-feature" statements in
> ietf-tls-client.yang resolves the issue.  Note that
> ts:local-or-truststore-certs-grouping have within it if-feature
> statements that prune the "truststore" half out.  Checking the other
> models, there were also instances of this in ietf-tls-server.yang and
> in both the ssh client and server modules.

Ok.

> > 2.  When this grouping is used in ietf-https-notifs, it looks like
> >    this:
> > 
> >  +--rw receivers
> >     +--rw receiver* [name]
> >        +--rw name           string
> >        ...
> >        |  +--rw server-authentication
> >        |  |  +--rw ca-certs! {ts:x509-certificates}?
> >                 ...            
> >        |  |  +--rw server-certs! {ts:x509-certificates}?
> >                 ...
> > 
> >   Now, the container 'server-authentication' has
> >   nacm:default-deny-write, and its contents is mandatory (due to the
> >   must expression).  This means that it is not possible to configure
> >   a single receiver without explicit NACM rules for this container.  Is
> >   that really the intention?
> 
> Yes, these are security parameters.  Read access is okay, but only
> authorized clients should be able to configure them.

I think it is odd that if I am trusted to configure a tls client, I
can't fully configure it w/o additional rules.

For example, suppose the security admin has set up a certificate
trustore (/truststore/certificate) with trusted certificates.  Now if
I want to create a receiver of notifications, I want to point to this
list.  But I can't do that w/o special NACM rules.

> > 3.  You don't have a choice between ca-certs and server-certs, which I
> >    assume is intentional (they can both exist).  I think you need to
> >    explain what happens when both these are configured.
> 
> OLD:
>     container server-authentication {
>       ...
>       description
>         "Trusted server identities.";
> 
> NEW:
>     container server-authentication {
>       ...
>       description
>         "Trusted server identities.  Any combination of trusted
>          server identities is additive and unordered.";
> 
> Is this okay?

Ok, but see below.

> > 4.  The description of ca-certs and server-certs has:
> > 
> >      "A server certificate is authenticated if ..."
> > 
> >    But you don't specify what it means for a certificate to be
> >    authenticated.  If the intention is that the meaning depends on
> >    where it is used, the description of the grouping should specify
> >    this requirement.
> 
> For "ca-certs", the full sentence is: 
> 
>           A server certificate is authenticated if it has a valid
>            chain of trust to a configured CA certificate.";
> 
> For server-certs, the full sentence is:
> 
>            A server
>            certificate is authenticated if it is an exact match
>            to a configured server certificate.";
> 
> How is the 2nd-half of these sentences not doing just what you're
> asking for?

So the text explains when a server certificate is authenticated.  But
what is supposed to happen when a server certificate is not
authenticated?

BTW, should it rather be "A server is authenticated if its certificate
is an exact match..." etc?


/martin