Re: [netmod] Use of unrestricted string in YANG (was RE: naming scope of a grouping which uses a grouping)

On Thu, Jan 12, 2023 at 4:38 AM Italo Busi <Italo.Busi@huawei.com> wrote:

> I have seen the comment from Tom about the unrestricted string in YANG on
> other drafts in WG LC or WG adoption poll and I would like to understand
> what is the position of the Netmod WG on this issue
>
>
>
> Using unrestricted string is quite common practice in existing IETF
> standard YANG models, also as in key attributes (e.g., see RFC8343).
> However, the comments looks valid and it is worthwhile investigating it
> further
>
> From the previous discussion I have understood that Martin does not think
> this is an issue while Andy agrees with Tom …
>

Engineering is about trade-offs.
An unrestricted string provides complete flexibility, but at a cost.
It increases the cascading security vulnerabilities of the system.

The string length issue is only part of it.  It is harder to find buffer
overrun exploits
with a 64 byte string than with unrestricted length. The 'yang-identifier'
type is better
than plain string and still provides unlimited length.

Just because the escaped string is "safe" inside a NETCONF protocol message
does not mean it is safe to use in other tools. Data (especially list keys)
gets moved
between software programs. Unrestricted strings increase the risk of data
injection attacks.

Andy

>
> I have a mixed feeling about the resolution but I think this is something
> to be documented either in RFC7950 (update) or in RFC8407 (update)
>
>
>
> For integers, RFC7950 defines different built-in types for 8-bit, 16-bit
> and 64-bit integers, while for string there is only one type and the length
> sub-statement is optional
>
>
>
> While it is true that unrestricted strings can cause an implementation to
> run out of memory, it is also true that in some cases it is not trivial to
> define the maximum length for a string attribute
>
>
>
> Moreover, I am not sure whether restricting the strings would solve the
> out of memory: what happens if a huge YANG list is configured?
>
>
>
> What is your view/opinion about using the string type in IETF standard
> YANG models?
>
>
>
> Thanks, Italo
>
>
>
> *From:* Andy Bierman <andy@yumaworks.com>
> *Sent:* mercoledì 21 dicembre 2022 00:30
> *To:* Martin Björklund <mbj+ietf@4668.se>
> *Cc:* ietfc@btconnect.com; netmod@ietf.org
> *Subject:* Re: [netmod] naming scope of a grouping which uses a grouping
>
>
>
>
>
>
>
> On Mon, Dec 19, 2022 at 5:15 AM Martin Björklund <mbj+ietf@4668.se> wrote:
>
> tom petch <ietfc@btconnect.com> wrote:
> > From: Martin Björklund <mbj+ietf@4668.se>
> > Sent: 19 December 2022 12:18
> > To: tom petch
> >
> > tom petch <ietfc@btconnect.com> wrote:
> > > draft-ietf-opsawg-sap-12
> > > defines a grouping sap-list which uses grouping sap-entry.  The
> groupings are intended for import by service specific modules.  The uses
> does not include a prefix; should it?
> >
> > From a YANG perspective this is correct.  Since it references a
> > grouping in the local module, the prefix is optional.
> >
> > <tp>
> > But it will not be the local module when it is used in other modules
> which is the only reason it is a grou[ing
>
> It doesn't matter how sap-list is used; it is well-defined in the
> module ietf-sap-ntw.  See section 5.4 in RFC 7950.
>
>
> /martin
>
>
> >
> > module ietf-sap-vpn
> >  prefix sap-vpn
> > import ietf-sap-ntw
> >  prefix sap
> > container sap-l2vpn
> >
> > list l2vpn-service
> >  uses sap:sap-list
> > .....
> >
> > Does it need to know where to find sap-entry which sap-list 'uses'
> without a prefix?
> >
> > Tom Petch
> >
> > > The module also has my favourite YANG construct, an unrestricted
> string as a YANG key.
> >
> > I don't think that this is a problem.  Or rather, if the theory is
> > that we need to have restricted length on strings b/c otherwise an
> > implementation may run out memory, then I don't think this solves that
> > problem.  But perhaps there is some other reason?
> >
>
>
>
> There is an argument to be made that it is better to pick a reasonable
> length
>
> and a reasonable character set for an administrative string (going back to
> SnmpAdminString)
>
> That way, every implementation MUST support the same set of strings
> (modulo resource errors).
>
>
>
> I have the same reaction as Tom when I see 'string' as a key.
>
> Really? The server accepts zero-length identifiers, all-whitespace
> identifiers, and much worse...
>
> Probably not.
>
>
>
>
> >
> > /martin
>
>
>
>
>
> Andy
>
>
>
> >
> > >
> > > Copying Martin as he performed a YANG Doctor review earlier in 2022.
> > >
> > > Tom Petch
>
> _______________________________________________
> netmod mailing list
> netmod@ietf.org
> https://www.ietf.org/mailman/listinfo/netmod
>
>