Re: [netmod] Eric Rescorla's Discuss on draft-ietf-netmod-schema-mount-11: (with DISCUSS)

Eric Rescorla <ekr@rtfm.com> Tue, 16 October 2018 21:52 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9965C130E5D for <netmod@ietfa.amsl.com>; Tue, 16 Oct 2018 14:52:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u49xrjlwK4E9 for <netmod@ietfa.amsl.com>; Tue, 16 Oct 2018 14:52:24 -0700 (PDT)
Received: from mail-lf1-x12f.google.com (mail-lf1-x12f.google.com [IPv6:2a00:1450:4864:20::12f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9FBF130E4A for <netmod@ietf.org>; Tue, 16 Oct 2018 14:52:20 -0700 (PDT)
Received: by mail-lf1-x12f.google.com with SMTP id y10-v6so18210028lfj.1 for <netmod@ietf.org>; Tue, 16 Oct 2018 14:52:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=G0ezwqOHv92tR2a71YKBQCScqSACaAa5ysnHAIDzb/g=; b=vWrSkdvinYtUDBQEESEOLDXvRHGrBo2lw4otPEJIlrX7FRwwbAJ0f264PRsOgVh1Ux o4a5MXqm8EAO445pFAKwXrysRW/DWqk3cvANZXDILIKCSQmgBVKs9TRc2bbjPdgdMR/v siDbZak1JHcpsL+jPy2c1gZY+9ujuMzSLhEEiYftcMJVRwRfX06EiaoYndn8rAojEAmH 17lj3O+MliLeg99oErq1ZvrSAlk+jd5UEtkapcVy1QVwwdd2JIrc5iaBlviLtBwPRbKJ 8qzKV/HYz4uTtQu0HK8Z81xK3y5jsNMVCIs8BrJ3GlIV7IsgFRZdESTaz/s8vwC0rtQy /R+w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=G0ezwqOHv92tR2a71YKBQCScqSACaAa5ysnHAIDzb/g=; b=BWVrfAQjP6byIa036kdhFoBY+SgbhOG1vsjq9AKr8e1IH5VOXhUbHA5k+NVCsi2s7m hkiFo9weBadKjltkHPpCGdRiXOoWg36uBtSP9ad7DGlnDKg2Tgzqo4s2TpRkTwqT8UTf 5MHvHmc+0BLAtidQBGy0ul2EC6gDATpBgstkAy1FRnRL5TCQOsWCZ7l/3W/qN88SdD0w Vkaqu95UOwwg9RcOmdyLSccQ9KqM6VfSrnBffzDOeoW8NOQoD57URLU0wiUAOYTMGlVt 2usCVPkWY1m5DpBH80XFbdqzbHck+XoA2t7+L8Dg5LjQsJHsMpPJ8Tj9mv0DziRspnEA UdnQ==
X-Gm-Message-State: ABuFfoi6IMlbTi2b2oGNnH2Vg0XIr9T7LfE+28oTeQt5uakEWaXsXTWU 1J2++elweFZinctBtF0zT+gHxcsPcxow9Rz0g5rXCw==
X-Google-Smtp-Source: ACcGV63pA4wY/c+cX+jXN/u+IpUCBltOfnDQeEbE4QAWk9Qy1ILiZu4gR7cB/a7/Q+pxXdDZd8YZapkME/uHyxNsxOo=
X-Received: by 2002:a19:a90f:: with SMTP id s15-v6mr13511381lfe.154.1539726739019; Tue, 16 Oct 2018 14:52:19 -0700 (PDT)
MIME-Version: 1.0
References: <CABcZeBMJmM_NaRY3GzcV4HO+BB14ooqxJ9oGrrer6nx3ZAqMxw@mail.gmail.com> <20181011.091817.1727547509052700274.mbj@tail-f.com> <CABcZeBNZ+AMXXNu7C5nvxie6NmJdJ_6FbHJXtdkxnMAN3rNGHQ@mail.gmail.com> <20181016.144545.1184951335260453665.mbj@tail-f.com> <CABcZeBPaFXsven2XOC9+CdNqEfxvO4n0RivYuWCLXu9KGFYgDw@mail.gmail.com> <68a6fced-b67d-633e-fbbc-6b3d3fe4240d@gmail.com>
In-Reply-To: <68a6fced-b67d-633e-fbbc-6b3d3fe4240d@gmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Tue, 16 Oct 2018 14:51:41 -0700
Message-ID: <CABcZeBOkEYC7Y_8KB_O3VwX8KPMxKfdByqwtmYRRDA8=JY4p2Q@mail.gmail.com>
To: joel jaeggli <joelja@gmail.com>
Cc: =?UTF-8?Q?martin_bj=C3=B6rklund?= <mbj@tail-f.com>, IESG <iesg@ietf.org>, NetMod WG Chairs <netmod-chairs@ietf.org>, NetMod WG <netmod@ietf.org>, draft-ietf-netmod-schema-mount@ietf.org, Kent Watsen <kwatsen@juniper.net>, Lou Berger <lberger@labn.net>
Content-Type: multipart/alternative; boundary="00000000000054d0a205785f91af"
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/TXjyXbOflaz7Rv5SsO-AN9E5wRc>
Subject: Re: [netmod] Eric Rescorla's Discuss on draft-ietf-netmod-schema-mount-11: (with DISCUSS)
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 16 Oct 2018 21:52:29 -0000

OK, after reading your explanation and the example, I think I am clearer on
the use case and the text you propose seems appropriate. Why don't you
provide a new ID and I'll clear my DISCUSS

-Ekr


On Tue, Oct 16, 2018 at 9:05 AM joel jaeggli <joelja@gmail.com>; wrote:

> On 10/16/18 06:00, Eric Rescorla wrote:
> > I'm sorry, but I still don't think I understand the security impacts of
> > this well enough to know if this text is OK.
> >
> > Can you provide a more detailed explanation of what XPath expressions
> > can and cannot do here? Happy to discuss live either on the phone or in
> BKK
> I'm probably grossly simplifying the goal here, but.
>
> xpath statement allow for referencing another path or applying
> constraints e.g. when / must (rfc 6020)
>
> the canonical example in 6020 being something like
>
>   container interface {
>       leaf ifType {
>           type enumeration {
>               enum ethernet;
>               enum atm;
>           }
>       }
>       leaf ifMTU {
>           type uint32;
>       }
>       must "ifType != 'ethernet' or " +
>            "(ifType = 'ethernet' and ifMTU = 1500)" {
>           error-message "An ethernet MTU must be 1500";
>       }
>       must "ifType != 'atm' or " +
>            "(ifType = 'atm' and ifMTU <= 17966 and ifMTU >= 64)" {
>           error-message "An atm MTU must be  64 .. 17966";
>       }
>
> http://www.yang-central.org/twiki/pub/Main/YangDocuments/rfc6020.html#xpath
>
> Imposing constraints using nodes in mounted modules is kind of a key
> application of schema-mount.
>
> > -Ekr
> >
> >
> > On Tue, Oct 16, 2018 at 5:45 AM Martin Bjorklund <mbj@tail-f.com
> > <mailto:mbj@tail-f.com>> wrote:
> >
> >     Hi,
> >
> >     Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
> >     > That seems like it's going to have some pretty surprising
> >     consequences and
> >     > at minimum needs more information in the Security Considerations.
> >
> >     Ok.  Howabout we add a paragraph to the end of the Security
> >     Considerations section:
> >
> >       Care must be taken when the "parent-reference" XPath expressions
> are
> >       constructed, since the result of the evaluation of these
> expressions
> >       is added to the accessible tree for any XPath expression found in
> >       the mounted schema.
> >
> >
> >     /martin
> >
> >     > On Thu, Oct 11, 2018 at 12:18 AM Martin Bjorklund <mbj@tail-f.com
> >     <mailto:mbj@tail-f.com>> wrote:
> >     >
> >     > > Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
> >     > > > I'm sorry but I don't understand this.
> >     > > >
> >     > > > Does the externally visible behavior of any mounted module
> >     depend in any
> >     > > > way on these XPATH references
> >     > >
> >     > > Yes, but note that these XPath expressions ("parent-reference")
> are
> >     > > read-only (config false in the YANG model).  Thus they are set
> >     by the
> >     > > implementation, and used to inform the operator about the
> >     environment
> >     > > in which other XPath expressions are evaluated.
> >     > >
> >     > >
> >     > > /martin
> >     > >
> >     > >
> >     > > >
> >     > > > -Ekr
> >     > > >
> >     > > >
> >     > > >
> >     > > >
> >     > > > On Wed, Oct 10, 2018 at 6:38 AM Martin Bjorklund
> >     <mbj@tail-f.com <mailto:mbj@tail-f.com>> wrote:
> >     > > >
> >     > > > > Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
> >     > > > > > On Wed, Oct 10, 2018 at 5:32 AM Martin Bjorklund
> >     <mbj@tail-f.com <mailto:mbj@tail-f.com>>
> >     > > wrote:
> >     > > > > >
> >     > > > > > > Hi,
> >     > > > > > >
> >     > > > > > > Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>>
> wrote:
> >     > > > > > > > Eric Rescorla has entered the following ballot
> >     position for
> >     > > > > > > > draft-ietf-netmod-schema-mount-11: Discuss
> >     > > > > > > >
> >     > > > > > > > When responding, please keep the subject line intact
> >     and reply
> >     > > to all
> >     > > > > > > > email addresses included in the To and CC lines. (Feel
> >     free to
> >     > > cut
> >     > > > > this
> >     > > > > > > > introductory paragraph, however.)
> >     > > > > > > >
> >     > > > > > > >
> >     > > > > > > > Please refer to
> >     > > > > > >
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> >     > > > > > > > for more information about IESG DISCUSS and COMMENT
> >     positions.
> >     > > > > > > >
> >     > > > > > > >
> >     > > > > > > > The document, along with other ballot positions, can
> >     be found
> >     > > here:
> >     > > > > > > >
> >     https://datatracker.ietf.org/doc/draft-ietf-netmod-schema-mount/
> >     > > > > > > >
> >     > > > > > > >
> >     > > > > > > >
> >     > > > > > > >
> >     > > > >
> >
>  ----------------------------------------------------------------------
> >     > > > > > > > DISCUSS:
> >     > > > > > > >
> >     > > > >
> >
>  ----------------------------------------------------------------------
> >     > > > > > > >
> >     > > > > > > > Rich version of this review at:
> >     > > > > > > > https://mozphab-ietf.devsvcdev.mozaws.net/D3506
> >     > > > > > > >
> >     > > > > > > >
> >     > > > > > > >
> >     > > > > > > > DETAIL
> >     > > > > > > > S 4.
> >     > > > > > > > >
> >     > > > > > > > >      It is worth emphasizing that the nodes
> specified in
> >     > > > > > > > >      "parent-reference" leaf-list are available in
> >     the mounted
> >     > > > > schema
> >     > > > > > > only
> >     > > > > > > > >      for XPath evaluations.  In particular, they
> >     cannot be
> >     > > accessed
> >     > > > > > > there
> >     > > > > > > > >      via network management protocols such as NETCONF
> >     > > [RFC6241] or
> >     > > > > > > > >      RESTCONF [RFC8040].
> >     > > > > > > >
> >     > > > > > > > What are the security implications of this XPath
> reference
> >     > > outside
> >     > > > > the
> >     > > > > > > > mount jail? Specifically, how does it interact with
> >     the access
> >     > > > > control
> >     > > > > > > > for the enclosing module.
> >     > > > > > >
> >     > > > > > > There is no such interaction, since access control comes
> >     into play
> >     > > > > > > when some external entity accesses the data through some
> >     management
> >     > > > > > > protocol, and the nodes from the "parent-reference"
> >     expressions
> >     > > cannot
> >     > > > > > > be accessed via management protocols.
> >     > > > > > >
> >     > > > > > > The last sentence of the quoted paragraph was supposed
> >     to make this
> >     > > > > > > clear, but it seems we might need some additional
> >     explanation?
> >     > > > > > >
> >     > > > > >
> >     > > > > > Yes, I think so. I guess I'm not clear on what the XPath
> >     expressions
> >     > > are
> >     > > > > > for if they
> >     > > > > > can't be accessed via the management protocols. How can
> >     they be used?
> >     > > > >
> >     > > > > These are XPath expressions defined in the YANG models
> >     themselves,
> >     > > > > such as "must" expressions or "leafrefs".   The description
> of
> >     > > > > "parent-reference" refer to them as:
> >     > > > >
> >     > > > >                [...] XPath
> >     > > > >                expressions whose context nodes are defined
> >     in the
> >     > > > >                mounted schema
> >     > > > >
> >     > > > >
> >     > > > >
> >     > > > > /martin
> >     > > > >
> >     > >
> >
>
>
>