Re: [secdir] secdir review of draft-ietf-netmod-rfc8022bis

"Acee Lindem (acee)" <acee@cisco.com> Mon, 22 January 2018 20:06 UTC

From: "Acee Lindem (acee)" <acee@cisco.com>
To: Carl Wallace <carl@redhoundsoftware.com>, "draft-ietf-netmod-rfc8022bis.all@ietf.org" <draft-ietf-netmod-rfc8022bis.all@ietf.org>
CC: "secdir@ietf.org" <secdir@ietf.org>, "iesg@ietf.org" <iesg@ietf.org>
Thread-Topic: secdir review of draft-ietf-netmod-rfc8022bis
Thread-Index: AQHTk7NiLwnCM3+r8067/UkErtLxMKOAUGMAgAABM4A=
Date: Mon, 22 Jan 2018 20:06:29 +0000
Message-ID: <419C7C18-650C-4280-BE36-E2D5CC24A33B@cisco.com>
References: <D68B9F11.ADD98%carl@redhoundsoftware.com> <E3BEEA47-9D31-4D90-9458-606DE565A9FA@cisco.com>
In-Reply-To: <E3BEEA47-9D31-4D90-9458-606DE565A9FA@cisco.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.116.152.198]
Content-Type: text/plain; charset="utf-8"
Content-ID: <EA4C90ACA937BA4CB0EE0B5C81C3A6EE@emea.cisco.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/OCdVOu9cOYv4A9_Oyo78UGBU09w>
Subject: Re: [secdir] secdir review of draft-ietf-netmod-rfc8022bis
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Jan 2018 20:06:35 -0000

Hi Carl,

Correction:/routing/ribs/rib is, in fact, the YANG list. /routing/ribs is a container for the list of RIBs. So, this is the proper terminology.

Thanks,
Acee

On 1/22/18, 3:02 PM, "Acee Lindem (acee)" <acee@cisco.com> wrote:

Hi Carl,

Thanks for the review.

On 1/22/18, 2:01 PM, "Carl Wallace" <carl@redhoundsoftware.com> wrote:

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

I found no issues with the draft. The security considerations section
references NETCONF and RESTCONF for network security, with SSH and TLS
used. This seems fine but I wonder if some guidance on using these a la
RFC6125 would be helpful for some.

The information on transport layer security is a boilerplate. https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines
If this were to be added, it should added here first. However, I’m not this draft on how to use TLS with PKI is really necessary. This is more a consideration for TLS itself than its usage with NETCONF/RESTCONF.

One question in the security
consideration section. Twice "/routing/ribs/rib" is referred to a list.
Should this be "/routing/ribs"?

Yes – this probably should be changed since the current node refers to a list element and not the list itself. I’ll update it.

Thanks,
Acee

[secdir] secdir review of draft-ietf-netmod-rfc80… Carl Wallace
Re: [secdir] secdir review of draft-ietf-netmod-r… Acee Lindem (acee)
Re: [secdir] secdir review of draft-ietf-netmod-r… Acee Lindem (acee)