Re: [secdir] Review of draft-ietf-netmod-acl-model-19.txt

[Mahesh Jethanandani <[e-mail]>]

Hi Steve,

> On Jun 29, 2018, at 3:12 PM, [e-mail] wrote:
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG. These comments were written primarily for the benefit of the
> security area directors. Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> The summary of the review is Ready with issues.
> 
> This document defines a YANG data model for ACL. When the term
> "ACL" is used in this document it means the sort of ACL that
> you might see in firewall rules (e.g., "drop IPv4 traffic with
> destination port 21").
> 
> *Overall Clarity and Quality*
> 
> The document is fairly clear and well written. However, there
> is a confusing typo that is listed in the Minor Errors section
> of this review.
> 
> *Security Analysis*
> 
> The Security Considerations section is brief but decent.
> However, the last two sentences are unclear and maybe wrong:
> 
>   Unauthorized write access to this list can allow intruders
>   to access and control the system. Unauthorized read access
>   to this list can allow intruders to spoof packets with
>   authorized addresses thereby compromising the system.
> 
> Which "system" is referred to here? Whatever the answer to
> that question, I believe that the main impact of unauthorized
> write access to the ACL is that the attacker can modify the
> ACL to permit traffic that should not be permitted or deny
> traffic that should be permitted. The former may result in
> denial of service or compromise of systems on the network.
> The latter may result in denial of service. The main impact
> of unauthorized read access to the ACL is that the attacker
> can determine what ACL rules are in effect and may be able
> to use this information to better craft an attack.

Ok. How about this?

OLD:
      /acls/acl/aces: This list specifies all the configured access
      control entries on the device.  Unauthorized write access to this
      list can allow intruders to access and control the system.
      Unauthorized read access to this list can allow intruders to spoof
      packets with authorized addresses thereby compromising the system.


NEW:
              /acls/acl/aces: This list specifies all the configured access
      control entries on the device.  Unauthorized write access to this
      list can allow intruders to modify the entries so as to permit traffic
      that should not be permitted, or deny traffic that should be permitted.
      The former may result in a DoS attack, or compromise the device.
      The latter may result in a DoS attack. The impact of an unauthorized 
      read access to the list will allow the attacker to determine which rules
      are in effect, to better craft an attack.


> 
> *Minor Errors*
> 
> Section 3 refers to "action criteria". Every other part of
> the specification refers only to "action" or "actions".
> My review of the specification indicates that this text
> in section 3 should say "actions" not "action criteria”.

There are three instances of “action criteria” in the document. But you point is well taken, they can all be changed to “action” or “actions”.

Cheers.

> 

Mahesh Jethanandani
[e-mail]