Re: [netconf] a comment on draft-ietf-netconf-tls-client-server-15
Kent Watsen <kent+ietf@watsen.net> Wed, 23 October 2019 18:31 UTC
Return-Path: <0100016df9e30ad6-bb72f12b-c334-4d8f-a5a1-ca997a3bbe97-000000@amazonses.watsen.net>
X-Original-To: netconf@ietfa.amsl.com
Delivered-To: netconf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 940CD120047 for <netconf@ietfa.amsl.com>; Wed, 23 Oct 2019 11:31:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazonses.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qumyCeKDTj8n for <netconf@ietfa.amsl.com>; Wed, 23 Oct 2019 11:31:11 -0700 (PDT)
Received: from a8-96.smtp-out.amazonses.com (a8-96.smtp-out.amazonses.com [54.240.8.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA390120020 for <netconf@ietf.org>; Wed, 23 Oct 2019 11:31:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; d=amazonses.com; t=1571855469; h=From:Message-Id:Content-Type:Mime-Version:Subject:Date:In-Reply-To:Cc:To:References:Feedback-ID; bh=9VF8x+79Nlzszfc6c1f2u+GStfhcWkUynF8g5FzbYo4=; b=hc8ycdbYnrWvQJshGsJQUABjj0LcK74A2/IP1VEXWj8e0bivEbcuCU8fU+gIYXj/ f9PhD2Cv2lj1tQZz4GJ7T28mVRn//d2C1qVH13cku9GMa5rc+QJcWQU0bqV1RfJt0b4 IvLqfBDzx/Bz3B95NiErmO8iyBJpSDglwqRc5EhA=
From: Kent Watsen <kent+ietf@watsen.net>
Message-ID: <0100016df9e30ad6-bb72f12b-c334-4d8f-a5a1-ca997a3bbe97-000000@email.amazonses.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_652444B9-F522-45DF-BC28-40DDAFD034C1"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Wed, 23 Oct 2019 18:31:09 +0000
In-Reply-To: <20191023.191837.484006721829897329.mbj@tail-f.com>
Cc: "netconf@ietf.org" <netconf@ietf.org>
To: Martin Bjorklund <mbj@tail-f.com>
References: <20191023.093715.2094043256766716320.mbj@tail-f.com> <0100016df97342cf-58f4f854-4372-4da7-aab6-86959cc275d7-000000@email.amazonses.com> <20191023.191837.484006721829897329.mbj@tail-f.com>
X-Mailer: Apple Mail (2.3445.104.11)
X-SES-Outgoing: 2019.10.23-54.240.8.96
Feedback-ID: 1.us-east-1.DKmIRZFhhsBhtmFMNikgwZUWVrODEw9qVcPhqJEI2DA=:AmazonSES
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/lM2WClEMtekV_20fHy414oM2aBM>
Subject: Re: [netconf] a comment on draft-ietf-netconf-tls-client-server-15
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETCONF WG list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Oct 2019 18:31:13 -0000
[reducing to open parts] >>> 2. When this grouping is used in ietf-https-notifs, it looks like >>> this: >>> >>> +--rw receivers >>> +--rw receiver* [name] >>> +--rw name string >>> ... >>> | +--rw server-authentication >>> | | +--rw ca-certs! {ts:x509-certificates}? >>> ... >>> | | +--rw server-certs! {ts:x509-certificates}? >>> ... >>> >>> Now, the container 'server-authentication' has >>> nacm:default-deny-write, and its contents is mandatory (due to the >>> must expression). This means that it is not possible to configure >>> a single receiver without explicit NACM rules for this container. Is >>> that really the intention? >> >> Yes, these are security parameters. Read access is okay, but only >> authorized clients should be able to configure them. > > I think it is odd that if I am trusted to configure a tls client, I > can't fully configure it w/o additional rules. > > For example, suppose the security admin has set up a certificate > trustore (/truststore/certificate) with trusted certificates. Now if > I want to create a receiver of notifications, I want to point to this > list. But I can't do that w/o special NACM rules. Without this default-deny-write, the second administrator could configure a `local` setting that didn't point to the truststore, or modify the `truststore` setting to point to potentially improper truststore definitions. >>> 4. The description of ca-certs and server-certs has: >>> >>> "A server certificate is authenticated if ..." >>> >>> But you don't specify what it means for a certificate to be >>> authenticated. If the intention is that the meaning depends on >>> where it is used, the description of the grouping should specify >>> this requirement. >> >> For "ca-certs", the full sentence is: >> >> A server certificate is authenticated if it has a valid >> chain of trust to a configured CA certificate."; >> >> For server-certs, the full sentence is: >> >> A server >> certificate is authenticated if it is an exact match >> to a configured server certificate."; >> >> How is the 2nd-half of these sentences not doing just what you're >> asking for? > > So the text explains when a server certificate is authenticated. But > what is supposed to happen when a server certificate is not > authenticated? What happens is TLS/SSH specific, but generally entails the server sending the client a failure message followed by closing the TCP connection. > BTW, should it rather be "A server is authenticated if its certificate > is an exact match..." etc? Yes. Language fixed in all four modules. Kent // contributor
- [netconf] a comment on draft-ietf-netconf-tls-cli… Martin Bjorklund
- Re: [netconf] a comment on draft-ietf-netconf-tls… Martin Bjorklund
- Re: [netconf] a comment on draft-ietf-netconf-tls… Kent Watsen
- Re: [netconf] a comment on draft-ietf-netconf-tls… Martin Bjorklund
- Re: [netconf] a comment on draft-ietf-netconf-tls… Kent Watsen