Subject: [Netconf] Fwd: NACM question

From: David Ball <[email-masked]>
Date: Thu, 24 Aug 2017 13:42:23 +0100

I posed this question to Martin offline, but he asked me to post it to 
netconf as it may feed into work on RFC6536bis.

Note I am not subscribed to the list.

     David

-------- Forwarded Message --------
Subject: 	NACM question
Date: 	Thu, 24 Aug 2017 11:41:03 +0100
From: 	David Ball <[email-masked]>
To: 	Martin Bjorklund <[email-masked]>

Hi Martin,

I have a NACM question (this has come up on the IETF L3SM list). We want
to use nacm:default-deny-write to prevent writes to a container and all
of its contents - is it sufficient to just specify
nacm:default-deny-write on the container, or does it also need to be
specified on every node under the container as well?

My reading of RFC 6536 is the latter, i.e. every node in the container
needs to be annotated.  This is based on reading section 3.2.3, that
describes how no access control is applied if the effective operation is
'none', and section 3.4.5, where step 10 only mentions whether the data
definition statement contains 'default-deny-write', not whether the data
definition statement for any ancestor in the tree contains it.  From
this, I infer that if only the container was annotated, and if the
container already existed in the data tree, a client would still be able
to write to the other nodes under the container.

However, RFC7317 contains an example where "container authentication" is
annotated with nacm:default-deny-write, but none of the nodes under it
are annotated.  This suggests that at least the intent of RFC6536 was
that the annotation does apply to all the nodes within the container.

[Addendum: Martin points out there is also a similar example of "default-deny-all" in RFC6536 itself]

As one of the authors of both RFCs, can you help clarify?

Thanks,

     David

-- 
David Ball
<[email-masked]>

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 24 Aug 2017 14:55:40 +0200 (CEST)

Hi,

> "default-deny-all" in RFC6536 itself]

I think that the (implicit) intention was that the extension would be
inherited by the descendants.  As noted above, this is how current
modules are written.  However, it is not clear at all, so I think we
should clarify this in 6536bis.

/martin

---

From: Qin Wu <[email-masked]>
Date: Thu, 24 Aug 2017 13:52:22 +0000

Thanks Martin for confirmation, that is to say the example in RFC 7317 is correct.

-Qin
Sent from HUAWEI AnyOffice
发件人： Martin Bjorklund
收件人： daviball;
抄送： [email-masked];
主题： Re: [Netconf] Fwd: NACM question
时间： 2017-08-24 20:57:39

Hi,

/martin

_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf