Subject: [secdir] Secdir last call review of draft-ietf-i2rs-rib-info-model-14

From: Paul Wouters <[email-masked]>
Date: Sun, 25 Feb 2018 10:59:16 -0800

Reviewer: Paul Wouters
Review result: Has Issues

I have reviewed this document as part of the security directorate's  ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat  these comments just like any
other last call comments.

The summary of the review is Has Issues.

This Informational draft specifies an information model for routing information
bases (RIBs) , and hints at how a read/write API would look like. I think the
document should be improved to clarify this API beyond a simple mention of SSH
and TLS in its own section, outside of the Security Consideration section. For
example, if this is TLS, what is used? Something restful? xml? json? What would
the URI be? And for ssh, what kind of access would be given? How is this
restricted to the RIB API ?

---

From: "Susan Hares" <[email-masked]>
Date: Sun, 25 Feb 2018 18:44:41 -0500

Paul: 

The current I2RS  RIB Data model is a yang model which can be access via
netconf and restconf with the restrictions in the network management
datastore architecture.   Are you looking for us to specify the
netconf/restconf suite protocols, and the CBOR for binary in this section. 

If you are looking for more than that, are you looking for what is in 
https://datatracker.ietf.org/doc/draft-ietf-i2rs-security-environment-reqs/

Thank you, 
Sue Hares
WG co-chair

-----Original Message-----
From: i2rs [mailto:[email-masked]] On Behalf Of Paul Wouters
Sent: Sunday, February 25, 2018 1:59 PM
To: [email-masked]
Cc: [email-masked]; [email-masked];
[email-masked]
Subject: [i2rs] Secdir last call review of draft-ietf-i2rs-rib-info-model-14

Reviewer: Paul Wouters

comments were written primarily for the benefit of the security area
directors.

This Informational draft specifies an information model for routing
information bases (RIBs) , and hints at how a read/write API would look
like. I think the document should be improved to clarify this API beyond a
simple mention of SSH and TLS in its own section, outside of the Security
Consideration section. For example, if this is TLS, what is used? Something
restful? xml? json? What would the URI be? And for ssh, what kind of access
would be given? How is this restricted to the RIB API ?

_______________________________________________
i2rs mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i2rs

---

From: "Susan Hares" <[email-masked]>
Date: Sun, 25 Feb 2018 18:51:08 -0500

Paul:

I hit return to soon.  Thank you for the security review. 

Cheerily, Susan Hares 

-----Original Message-----
From: Susan Hares [mailto:[email-masked]] 
Sent: Sunday, February 25, 2018 6:45 PM
To: 'Paul Wouters'; [email-masked]
Cc: [email-masked]; [email-masked];
[email-masked]
Subject: RE: [i2rs] Secdir last call review of
draft-ietf-i2rs-rib-info-model-14

Paul: 

Thank you,
Sue Hares
WG co-chair

-----Original Message-----
From: i2rs [mailto:[email-masked]] On Behalf Of Paul Wouters
Sent: Sunday, February 25, 2018 1:59 PM
To: [email-masked]
Cc: [email-masked]; [email-masked];

Reviewer: Paul Wouters

---

From: Mahesh Jethanandani <[email-masked]>
Date: Sun, 25 Feb 2018 22:18:14 -0800

> On Feb 25, 2018, at 10:59 AM, Paul Wouters <[email-masked]> wrote:
> 
> Reviewer: Paul Wouters

When I was reviewing the draft, I was wondering if the document needs a Security Considerations section. I would say that the information model should describe the routing information. I do not think it should specify it. It is more the data model (draft-ietf-i2rs-rib-data-model) that defines or specifies the model, and should have security considerations documented.

Suggest /specifies/describes/g

Mahesh Jethanandani
[email-masked]

---

From: Paul Wouters <[email-masked]>
Date: Wed, 28 Feb 2018 15:55:37 -0500 (EST)

> https://datatracker.ietf.org/doc/draft-ietf-i2rs-security-environment-reqs/

Thanks for the clarification. It was indeed a misunderstanding on my
part.

It seems I cannot update my review status from the tracker tool to
"ready" though. Does anyone know how to update a review result?

Paul

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 28 Feb 2018 16:41:14 -0600

> "ready" though. Does anyone know how to update a review result?

If you go to the datatracker page for the review request, there is a
"correct review" button that seems to allow edits.
At least, there is for me.

-Ben

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 28 Feb 2018 16:51:05 -0600

> At least, there is for me.

And to follow up, to get to the review *request* page (as opposed to
the page for the review itself, which is linked from the document
page), you can go to "my reviews" in the left sidebar.

-Ben