Re: [secdir] secdir review of draft-ietf-netconf-access-control-06

[Martin Bjorklund <[e-mail]>]

Hi,

Thank you for your review.  Comments inline.

Carl Wallace <[e-mail]> wrote:
> I found the frequent references to "recovery sessions" and "non-recovery
> sessions" unnecessary and somewhat confusing.  Couldn't this concept be
> described once and omitted from the various lists of steps? 

We did think about this, but although it is currently a bit redundant,
we felt spelling it out expclitly made the "elements of procedure"
descriptions more clear.

> There are
> probably some inconsistencies in the RFC 2119 language around the
> "recovery session" concept.  For example, section 3.4.4 provides a
> bulleted list of steps that MUST be followed.  Included in this list is an
> exception for recovery sessions.  Section 3.3.1 says a "server MAY support
> a "recovery session" mechanism".  Should 3.3.1 be a MUST?

No, "MAY" is correct.  The server MUST follow the procedure in 3.4.4,
which says that if the session is a recovery session then <something>.
If the server doesn't support recovery sessions, then the current
session is clearly not a recovery session, and <something> won't
happen.

> Section 3.1.1 references both "recovery session" and the ability to
> disable the entire access control model "during operation, in order to
> debug operational problems".  What does the latter bullet that mentions
> debugging refer to in the model?  Is this bullet just a second reference
> to recovery session?

The access control model can be disabled but setting the leaf
/nacm/enable-nacm to false (see the leaf enable-nacm in the YANG
module). 

> In section 3.2.4, copy operations may be partially performed while "nodes
> to which the client does not have read access are silently omitted".  Why
> is this OK?  It seems inconsistent with section 3.1.3, which says "If the
> user is authorized to perform the requested access operation on the
> requested data, then processing continues", implying that processing does
> not continue otherwise.  The same silent skipping of items appears
> elsewhere as well, including edit config.  At a minimum, some rationale
> describing why these silent omissions are acceptable should be
> provided.

There are two reasons for this.  One is consistency with
<get-config>, and the other is if you just have access to a single
leaf, you should still be allowed to perform "copy-config running to
startup", making your change persistent.



/martin