Re: [secdir] secdir review of draft-ietf-rtgwg-lne-model-05

[Lou Berger <[e-mail]>]

Hi Taylor,

     Please see responses below.


On 2/6/2018 7:40 PM, Taylor Yu wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
> The summary of the review is Ready With Issues.
>
> I agree somewhat with the Major Concerns in Russ Housley's Gen-ART
> review
> https://datatracker.ietf.org/doc/review-ietf-rtgwg-lne-model-05-genart-lc-housley-2018-01-20/
> although I disagree that it makes the document Not Ready.
>
>> Major Concerns:
>>
>> Section 4 listed three data nodes that are sensitive or vulnerable:
>>     -  /logical-network-elements/logical-network-element
>>     -  /logical-network-elements/logical-network-element/managed
>>     -  /if:interfaces/if:interface/bind-lne-name
>>
>> All three of them deserve a bit more discussion, although the middle
>> one is covered in much more detail than the other two.  If a bad actor
>> gets "unauthorized access" is there something more specific about each
>> of these that can be said?  The characterization of "network
>> malfunctions, delivery of packets to inappropriate destinations, and
>> other problems" seems very broad.  Consequences that are specific to
>> these data nodes would be more helpful to the reader.
> My limited understanding is that there is a lot of variation in the
> security impact among specific equipment models and deployment
> scenarios.  Therefore, they would likely need to be analyzed on a
> case-by-case basis.  Perhaps there should be Security Considerations
> text to this effect, maybe with some broad guidance about how to do such
> an analysis?

I think this is still a little too vague for me to know what to add. On 
the other hand...
> For example, does changing the "bind-lne-name" of an interface have the
> effect of making it unavailable to the LNE it was previously associated
> with, while providing the new LNE with an unconfigured new interface?
> Or does it also carry some configuration or routing state from the
> former LNE with it to the new LNE?  The latter might have a greater
> security impact.

This is *very* helpful, we in fact have considered this case under the 
general text, but highlighting in here makes perfect senses. How about:
      Implementations should pay particular attention to when
       changes to this leaf are permitted as removal of an interface from
       an LNE can have major impact on the LNEs operation as it is
       similar to physically removing an interface from the
       device. Implementations can reject an reassignment using the
       previously described error message generation.

> This final paragraph in the Security Considerations of this document
> seems copied almost verbatim from that of RFC 8022:
>
>>     Unauthorized access to any of these lists can adversely affect the
>>     security of both the local device and the network.  This may lead to
>>     network malfunctions, delivery of packets to inappropriate
>>     destinations, and other problems.
> That seems to have been acceptable for RFC 8022, but perhaps we should
> do better here?  Or do we follow the precedent that this level of
> detail in the Security Considerations of YANG specifications is
> acceptable?

Note that https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines 
doesn't include this text so if you'd like we can remove it to remain 
consistent with current guidelines.

Thank you for the comments!
Lou

> Best regards,
> -Taylor
>