Subject: [secdir] secdir review of draft-ietf-netmod-rfc8022bis

From: Carl Wallace <[email-masked]>
Date: Mon, 22 Jan 2018 14:00:49 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

I found no issues with the draft. The security considerations section
references NETCONF and RESTCONF for network security, with SSH and TLS
used. This seems fine but I wonder if some guidance on using these a la
RFC6125 would be helpful for some. One question in the security
consideration section. Twice "/routing/ribs/rib" is referred to a list.
Should this be "/routing/ribs"?

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 22 Jan 2018 20:02:11 +0000

Hi Carl, 

Thanks for the review. 

On 1/22/18, 2:01 PM, "Carl Wallace" <[email-masked]> wrote:

    I found no issues with the draft. The security considerations section
    references NETCONF and RESTCONF for network security, with SSH and TLS
    used. This seems fine but I wonder if some guidance on using these a la
    RFC6125 would be helpful for some. 

The information on transport layer security is a boilerplate. https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines
If this were to be added, it should added here first. However, I’m not this draft on how to use TLS with PKI is really necessary. This is more a consideration for TLS itself than its usage with NETCONF/RESTCONF. 

    One question in the security
    consideration section. Twice "/routing/ribs/rib" is referred to a list.
    Should this be "/routing/ribs"?

Yes – this probably should be changed since the current node refers to a list element and not the list itself. I’ll update it. 

Thanks,
Acee

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 22 Jan 2018 20:06:29 +0000

Hi Carl,

Correction:/routing/ribs/rib is, in fact, the YANG list. /routing/ribs is a container for the list of RIBs. So, this is the proper terminology.

Thanks,
Acee  

On 1/22/18, 3:02 PM, "Acee Lindem (acee)" <[email-masked]> wrote:

    Hi Carl, 
    
    Thanks for the review. 

        

    
    
    Thanks,
    Acee