Re: [Rats] Pull request for the charra YANG model

["Eric Voit (evoit)" <[e-mail]>]

Hi Bill,

 

From: Bill Sulzen (bsulzen), June 22, 2020 10:33 AM
Subject: RE: Pull request for the charra YANG model

 

Eric,

 

Regarding your issue:

 

*	Most devices do not have multiple line cards. Because of that, we
should not have nested keys of [node id] [tpm name]. This adds unnecessary
complexity for the vast majority of users. Instead the tpm should have a
mandatory leafref back to node-id when compute-nodes is not null.

as I read the updated attestation tree, there still is support for multiple
TPMs in a given management plane (i.e. there's still support for multiple
linecards - AKA "composite systems.") 

 

<eric>   Yes your interpretation is correct.  When there are multiple
line-cards, the YANG model requires a leaf-ref to that card. 

 

But if a given linecard/node within a management plane entity, then they
would have to be differentiated by tpm-name rather than by node-id. Is that
correct?

 

<eric> The 'tpm-name' object needs to be unique across a composite device,
it could be a random string (in fact this is a common practice for YANG
models).   

 

Initially I thought about populating that name with the 'tpm-path'.  However
that 'tpm-path' might change across reboots.   Both the 'tpm-path' and
'tpm-name' are unique within a single boot cycle, and can be used as part of
a lookup within the data nodes of 'rats-support-structures'.

 

Eric

 

Thanks,

Bill

 

From: Eric Voit (evoit) 
Sent: Wednesday, June 10, 2020 12:18 PM
To: [e-mail] <mailto:[e-mail]>
; [e-mail] <mailto:[e-mail]> ;
Shwetha Bhandari (shwethab) <[e-mail] <mailto:[e-mail]>
>; Bill Sulzen (bsulzen) <[e-mail] <mailto:[e-mail]> >;
[e-mail] <mailto:[e-mail]> ;
[e-mail] <mailto:[e-mail]> ; Guy Fedorkow
<[e-mail] <mailto:[e-mail]> >
Cc: [e-mail] <mailto:[e-mail]> 
Subject: Pull request for the charra YANG model

 

Henk,         Michael,

Shwetha,   Bill,

Frank,        Tom,

Guy,

 

As authors of the Charra YANG model, I wanted to let you know I have created
a pull request
<https://github.com/ietf-rats-wg/basic-yang-module/pull/8/files> .  I am
proposing some fixes due to a number of concerns
<https://github.com/ietf-rats-wg/basic-yang-module/issues/6>  I had about
the YANG model:

 

*	PCR numbers should be their own type, not a UINT8. PCRs should be
limited to [0..31]
*	We should use ENUMs instead of strings for TCG and IETF crypto
algorithm types. Strings allow lots of errors to be introduced which we can
protect using a larger, more detailed ENUM construct.
*	Most devices do not have multiple line cards. Because of that, we
should not have nested keys of [node id] [tpm name]. This adds unnecessary
complexity for the vast majority of users. Instead the tpm should have a
mandatory leafref back to node-id when compute-nodes is not null.
*	The YANG doctors will not let us have a TPM-Name of "ALL". Instead
of "ALL" we should be able to assume that an RPC means all hardware based
TPMs if a specific TPM is not named in the RPC. 
*	We should add leaf for a unique 'certificate-name' is used. This
allows for a cleaner certificate migration path, and most RPC users won't
need to track node-ids. 
*	We should have optional YANG features for TPM1.2 and TPM2.0 so that
RPCs are not exposed when there are no such TPMs of that type are supported.
*	We should create new reusable groupings rather than repeat
definitions. 

If your guys have suggestions and improvements for this pull request, that
would be great.   I also think the netequip boot pull request
<https://github.com/ietf-rats-wg/basic-yang-module/pull/5>  can also be
integrated.

 

Thanks,

Eric