Re: [netmod] Eric Rescorla's Discuss on draft-ietf-netmod-schema-mount-11: (with DISCUSS)

Martin Bjorklund <mbj@tail-f.com> Wed, 17 October 2018 07:24 UTC

Return-Path: <mbj@tail-f.com>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FEAF129AB8; Wed, 17 Oct 2018 00:24:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TlIL3gT-SLc8; Wed, 17 Oct 2018 00:24:54 -0700 (PDT)
Received: from mail.tail-f.com (mail.tail-f.com [46.21.102.45]) by ietfa.amsl.com (Postfix) with ESMTP id 9299D12D4E8; Wed, 17 Oct 2018 00:24:53 -0700 (PDT)
Received: from localhost (unknown [173.38.220.61]) by mail.tail-f.com (Postfix) with ESMTPSA id 228E91AE0399; Wed, 17 Oct 2018 09:24:52 +0200 (CEST)
Date: Wed, 17 Oct 2018 09:24:51 +0200 (CEST)
Message-Id: <20181017.092451.1101351547387658756.mbj@tail-f.com>
To: ekr@rtfm.com
Cc: joelja@gmail.com, iesg@ietf.org, netmod-chairs@ietf.org, netmod@ietf.org, draft-ietf-netmod-schema-mount@ietf.org, kwatsen@juniper.net, lberger@labn.net
From: Martin Bjorklund <mbj@tail-f.com>
In-Reply-To: <CABcZeBOkEYC7Y_8KB_O3VwX8KPMxKfdByqwtmYRRDA8=JY4p2Q@mail.gmail.com>
References: <CABcZeBPaFXsven2XOC9+CdNqEfxvO4n0RivYuWCLXu9KGFYgDw@mail.gmail.com> <68a6fced-b67d-633e-fbbc-6b3d3fe4240d@gmail.com> <CABcZeBOkEYC7Y_8KB_O3VwX8KPMxKfdByqwtmYRRDA8=JY4p2Q@mail.gmail.com>
X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/ENlBmGA6lLiUHxxsGMEolm5pj8w>
Subject: Re: [netmod] Eric Rescorla's Discuss on draft-ietf-netmod-schema-mount-11: (with DISCUSS)
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Oct 2018 07:24:57 -0000

Hi,

Eric Rescorla <ekr@rtfm.com>; wrote:
> OK, after reading your explanation and the example, I think I am clearer on
> the use case and the text you propose seems appropriate. Why don't you
> provide a new ID and I'll clear my DISCUSS

Thank you!  I have fixed this and uploaded a new version
(draft-ietf-netmod-schema-mount-12).


/martin


> 
> -Ekr
> 
> 
> On Tue, Oct 16, 2018 at 9:05 AM joel jaeggli <joelja@gmail.com>; wrote:
> 
> > On 10/16/18 06:00, Eric Rescorla wrote:
> > > I'm sorry, but I still don't think I understand the security impacts of
> > > this well enough to know if this text is OK.
> > >
> > > Can you provide a more detailed explanation of what XPath expressions
> > > can and cannot do here? Happy to discuss live either on the phone or in
> > BKK
> > I'm probably grossly simplifying the goal here, but.
> >
> > xpath statement allow for referencing another path or applying
> > constraints e.g. when / must (rfc 6020)
> >
> > the canonical example in 6020 being something like
> >
> >   container interface {
> >       leaf ifType {
> >           type enumeration {
> >               enum ethernet;
> >               enum atm;
> >           }
> >       }
> >       leaf ifMTU {
> >           type uint32;
> >       }
> >       must "ifType != 'ethernet' or " +
> >            "(ifType = 'ethernet' and ifMTU = 1500)" {
> >           error-message "An ethernet MTU must be 1500";
> >       }
> >       must "ifType != 'atm' or " +
> >            "(ifType = 'atm' and ifMTU <= 17966 and ifMTU >= 64)" {
> >           error-message "An atm MTU must be  64 .. 17966";
> >       }
> >
> > http://www.yang-central.org/twiki/pub/Main/YangDocuments/rfc6020.html#xpath
> >
> > Imposing constraints using nodes in mounted modules is kind of a key
> > application of schema-mount.
> >
> > > -Ekr
> > >
> > >
> > > On Tue, Oct 16, 2018 at 5:45 AM Martin Bjorklund <mbj@tail-f.com
> > > <mailto:mbj@tail-f.com>> wrote:
> > >
> > >     Hi,
> > >
> > >     Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
> > >     > That seems like it's going to have some pretty surprising
> > >     consequences and
> > >     > at minimum needs more information in the Security Considerations.
> > >
> > >     Ok.  Howabout we add a paragraph to the end of the Security
> > >     Considerations section:
> > >
> > >       Care must be taken when the "parent-reference" XPath expressions
> > are
> > >       constructed, since the result of the evaluation of these
> > expressions
> > >       is added to the accessible tree for any XPath expression found in
> > >       the mounted schema.
> > >
> > >
> > >     /martin
> > >
> > >     > On Thu, Oct 11, 2018 at 12:18 AM Martin Bjorklund <mbj@tail-f.com
> > >     <mailto:mbj@tail-f.com>> wrote:
> > >     >
> > >     > > Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
> > >     > > > I'm sorry but I don't understand this.
> > >     > > >
> > >     > > > Does the externally visible behavior of any mounted module
> > >     depend in any
> > >     > > > way on these XPATH references
> > >     > >
> > >     > > Yes, but note that these XPath expressions ("parent-reference")
> > are
> > >     > > read-only (config false in the YANG model).  Thus they are set
> > >     by the
> > >     > > implementation, and used to inform the operator about the
> > >     environment
> > >     > > in which other XPath expressions are evaluated.
> > >     > >
> > >     > >
> > >     > > /martin
> > >     > >
> > >     > >
> > >     > > >
> > >     > > > -Ekr
> > >     > > >
> > >     > > >
> > >     > > >
> > >     > > >
> > >     > > > On Wed, Oct 10, 2018 at 6:38 AM Martin Bjorklund
> > >     <mbj@tail-f.com <mailto:mbj@tail-f.com>> wrote:
> > >     > > >
> > >     > > > > Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
> > >     > > > > > On Wed, Oct 10, 2018 at 5:32 AM Martin Bjorklund
> > >     <mbj@tail-f.com <mailto:mbj@tail-f.com>>
> > >     > > wrote:
> > >     > > > > >
> > >     > > > > > > Hi,
> > >     > > > > > >
> > >     > > > > > > Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>>
> > wrote:
> > >     > > > > > > > Eric Rescorla has entered the following ballot
> > >     position for
> > >     > > > > > > > draft-ietf-netmod-schema-mount-11: Discuss
> > >     > > > > > > >
> > >     > > > > > > > When responding, please keep the subject line intact
> > >     and reply
> > >     > > to all
> > >     > > > > > > > email addresses included in the To and CC lines. (Feel
> > >     free to
> > >     > > cut
> > >     > > > > this
> > >     > > > > > > > introductory paragraph, however.)
> > >     > > > > > > >
> > >     > > > > > > >
> > >     > > > > > > > Please refer to
> > >     > > > > > >
> > https://www.ietf.org/iesg/statement/discuss-criteria.html
> > >     > > > > > > > for more information about IESG DISCUSS and COMMENT
> > >     positions.
> > >     > > > > > > >
> > >     > > > > > > >
> > >     > > > > > > > The document, along with other ballot positions, can
> > >     be found
> > >     > > here:
> > >     > > > > > > >
> > >     https://datatracker.ietf.org/doc/draft-ietf-netmod-schema-mount/
> > >     > > > > > > >
> > >     > > > > > > >
> > >     > > > > > > >
> > >     > > > > > > >
> > >     > > > >
> > >
> >  ----------------------------------------------------------------------
> > >     > > > > > > > DISCUSS:
> > >     > > > > > > >
> > >     > > > >
> > >
> >  ----------------------------------------------------------------------
> > >     > > > > > > >
> > >     > > > > > > > Rich version of this review at:
> > >     > > > > > > > https://mozphab-ietf.devsvcdev.mozaws.net/D3506
> > >     > > > > > > >
> > >     > > > > > > >
> > >     > > > > > > >
> > >     > > > > > > > DETAIL
> > >     > > > > > > > S 4.
> > >     > > > > > > > >
> > >     > > > > > > > >      It is worth emphasizing that the nodes
> > specified in
> > >     > > > > > > > >      "parent-reference" leaf-list are available in
> > >     the mounted
> > >     > > > > schema
> > >     > > > > > > only
> > >     > > > > > > > >      for XPath evaluations.  In particular, they
> > >     cannot be
> > >     > > accessed
> > >     > > > > > > there
> > >     > > > > > > > >      via network management protocols such as NETCONF
> > >     > > [RFC6241] or
> > >     > > > > > > > >      RESTCONF [RFC8040].
> > >     > > > > > > >
> > >     > > > > > > > What are the security implications of this XPath
> > reference
> > >     > > outside
> > >     > > > > the
> > >     > > > > > > > mount jail? Specifically, how does it interact with
> > >     the access
> > >     > > > > control
> > >     > > > > > > > for the enclosing module.
> > >     > > > > > >
> > >     > > > > > > There is no such interaction, since access control comes
> > >     into play
> > >     > > > > > > when some external entity accesses the data through some
> > >     management
> > >     > > > > > > protocol, and the nodes from the "parent-reference"
> > >     expressions
> > >     > > cannot
> > >     > > > > > > be accessed via management protocols.
> > >     > > > > > >
> > >     > > > > > > The last sentence of the quoted paragraph was supposed
> > >     to make this
> > >     > > > > > > clear, but it seems we might need some additional
> > >     explanation?
> > >     > > > > > >
> > >     > > > > >
> > >     > > > > > Yes, I think so. I guess I'm not clear on what the XPath
> > >     expressions
> > >     > > are
> > >     > > > > > for if they
> > >     > > > > > can't be accessed via the management protocols. How can
> > >     they be used?
> > >     > > > >
> > >     > > > > These are XPath expressions defined in the YANG models
> > >     themselves,
> > >     > > > > such as "must" expressions or "leafrefs".   The description
> > of
> > >     > > > > "parent-reference" refer to them as:
> > >     > > > >
> > >     > > > >                [...] XPath
> > >     > > > >                expressions whose context nodes are defined
> > >     in the
> > >     > > > >                mounted schema
> > >     > > > >
> > >     > > > >
> > >     > > > >
> > >     > > > > /martin
> > >     > > > >
> > >     > >
> > >
> >
> >
> >