From 4b0273683934d1abc029a1cff8635eb29378e2c9 Mon Sep 17 00:00:00 2001 From: italobusi Date: Mon, 12 Sep 2022 11:07:10 +0200 Subject: [PATCH] Added Manageability and Security Considerations Added Manageability and Security Considerations as per Daniel's proposals: https://github.com/aguoietf/ietf-ccamp-optical-path-computation/issues/10#issuecomment-1242047633 https://github.com/aguoietf/ietf-ccamp-optical-path-computation/issues/11#issuecomment-1242053633 --- ...gbb-ccamp-optical-path-computation-yang.md | 13 +- ...bb-ccamp-optical-path-computation-yang.txt | 200 ++++++---- ...bb-ccamp-optical-path-computation-yang.xml | 344 +++++++++++------- 3 files changed, 349 insertions(+), 208 deletions(-) diff --git a/draft-gbb-ccamp-optical-path-computation-yang.md b/draft-gbb-ccamp-optical-path-computation-yang.md index e00a5e6..53ca46c 100644 --- a/draft-gbb-ccamp-optical-path-computation-yang.md +++ b/draft-gbb-ccamp-optical-path-computation-yang.md @@ -211,11 +211,20 @@ flexi-grid-label-start-end, flexi-grid-label-hop and flexi-grid-label-step defin # Manageability Considerations - TBD. +This document provides a method for requesting path computations for WSON and Flexi-Grid tunnels. Consideration of mechanisms to gather and collate information required for the path computations will be necessary. Furthermore, storing path computation requests and responses and triggering actions according to configured will also need to be carefully managed and secured. + +Future versions of this document will contain additional information. # Security Considerations - \ +The YANG module defined in this document will be accessed via the NETCONF protocol {{!RFC6241}} or RESTCONF protocol {{!RFC8040}}. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) {{!RFC6242}}. The lowest RESTCONF layer is HTTPS and the mandatory-to-implement secure transport is TLS {{!RFC8446}}. + +The Network Configuration Access Control Model (NACM) {{!RFC8341}} provides the means to restrict access to particular NETCONF or RESTCONF users to a pre-configured subset of all available NETCONF or RESTCONF protocol operations and content. + +Some of the RPC operations defined in this YANG module may be +considered sensitive or vulnerable in some network environments. It is thus essential to control access to these operations. + +Operations defined in this document, and their sensitivities and possible vulnerabilities, will be discussed further in future versions of this document. # IANA Considerations diff --git a/draft-gbb-ccamp-optical-path-computation-yang.txt b/draft-gbb-ccamp-optical-path-computation-yang.txt index 06b6138..2974edb 100644 --- a/draft-gbb-ccamp-optical-path-computation-yang.txt +++ b/draft-gbb-ccamp-optical-path-computation-yang.txt @@ -5,10 +5,10 @@ CCAMP Working Group I. Busi Internet-Draft Huawei Technologies Intended status: Standards Track A. Guo -Expires: 12 March 2023 Futurewei Technologies +Expires: 16 March 2023 Futurewei Technologies S. Belotti Nokia - 8 September 2022 + 12 September 2022 YANG Data Models for requesting Path Computation in Optical Networks @@ -38,7 +38,7 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on 12 March 2023. + This Internet-Draft will expire on 16 March 2023. Copyright Notice @@ -53,7 +53,7 @@ Copyright Notice -Busi, et al. Expires 12 March 2023 [Page 1] +Busi, et al. Expires 16 March 2023 [Page 1] Internet-Draft Yang for Optical Path Computation September 2022 @@ -79,14 +79,14 @@ Table of Contents 4. YANG Models for Optical Path Computation . . . . . . . . . . 14 4.1. YANG Model for WSON Path Computation . . . . . . . . . . 14 4.2. YANG Model for Flexi-grid Path Computation . . . . . . . 22 - 5. Manageability Considerations . . . . . . . . . . . . . . . . 30 + 5. Manageability Considerations . . . . . . . . . . . . . . . . 31 6. Security Considerations . . . . . . . . . . . . . . . . . . . 31 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 31 - 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 31 - 8.1. Normative References . . . . . . . . . . . . . . . . . . 31 - 8.2. Informative References . . . . . . . . . . . . . . . . . 32 - Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 33 - Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 33 + 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 32 + 8.1. Normative References . . . . . . . . . . . . . . . . . . 32 + 8.2. Informative References . . . . . . . . . . . . . . . . . 33 + Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 34 + Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 34 1. Introduction @@ -109,7 +109,7 @@ Table of Contents -Busi, et al. Expires 12 March 2023 [Page 2] +Busi, et al. Expires 16 March 2023 [Page 2] Internet-Draft Yang for Optical Path Computation September 2022 @@ -165,7 +165,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 3] +Busi, et al. Expires 16 March 2023 [Page 3] Internet-Draft Yang for Optical Path Computation September 2022 @@ -221,7 +221,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 4] +Busi, et al. Expires 16 March 2023 [Page 4] Internet-Draft Yang for Optical Path Computation September 2022 @@ -277,7 +277,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 5] +Busi, et al. Expires 16 March 2023 [Page 5] Internet-Draft Yang for Optical Path Computation September 2022 @@ -333,7 +333,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 6] +Busi, et al. Expires 16 March 2023 [Page 6] Internet-Draft Yang for Optical Path Computation September 2022 @@ -389,7 +389,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 7] +Busi, et al. Expires 16 March 2023 [Page 7] Internet-Draft Yang for Optical Path Computation September 2022 @@ -445,7 +445,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 8] +Busi, et al. Expires 16 March 2023 [Page 8] Internet-Draft Yang for Optical Path Computation September 2022 @@ -501,7 +501,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 9] +Busi, et al. Expires 16 March 2023 [Page 9] Internet-Draft Yang for Optical Path Computation September 2022 @@ -557,7 +557,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 10] +Busi, et al. Expires 16 March 2023 [Page 10] Internet-Draft Yang for Optical Path Computation September 2022 @@ -613,7 +613,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 11] +Busi, et al. Expires 16 March 2023 [Page 11] Internet-Draft Yang for Optical Path Computation September 2022 @@ -669,7 +669,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 12] +Busi, et al. Expires 16 March 2023 [Page 12] Internet-Draft Yang for Optical Path Computation September 2022 @@ -725,7 +725,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 13] +Busi, et al. Expires 16 March 2023 [Page 13] Internet-Draft Yang for Optical Path Computation September 2022 @@ -781,7 +781,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 14] +Busi, et al. Expires 16 March 2023 [Page 14] Internet-Draft Yang for Optical Path Computation September 2022 @@ -837,7 +837,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 15] +Busi, et al. Expires 16 March 2023 [Page 15] Internet-Draft Yang for Optical Path Computation September 2022 @@ -893,7 +893,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 16] +Busi, et al. Expires 16 March 2023 [Page 16] Internet-Draft Yang for Optical Path Computation September 2022 @@ -949,7 +949,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 17] +Busi, et al. Expires 16 March 2023 [Page 17] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1005,7 +1005,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 18] +Busi, et al. Expires 16 March 2023 [Page 18] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1061,7 +1061,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 19] +Busi, et al. Expires 16 March 2023 [Page 19] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1117,7 +1117,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 20] +Busi, et al. Expires 16 March 2023 [Page 20] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1173,7 +1173,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 21] +Busi, et al. Expires 16 March 2023 [Page 21] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1229,7 +1229,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 22] +Busi, et al. Expires 16 March 2023 [Page 22] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1285,7 +1285,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 23] +Busi, et al. Expires 16 March 2023 [Page 23] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1341,7 +1341,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 24] +Busi, et al. Expires 16 March 2023 [Page 24] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1397,7 +1397,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 25] +Busi, et al. Expires 16 March 2023 [Page 25] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1453,7 +1453,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 26] +Busi, et al. Expires 16 March 2023 [Page 26] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1509,7 +1509,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 27] +Busi, et al. Expires 16 March 2023 [Page 27] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1565,7 +1565,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 28] +Busi, et al. Expires 16 March 2023 [Page 28] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1621,7 +1621,7 @@ Internet-Draft Yang for Optical Path Computation September 2022 -Busi, et al. Expires 12 March 2023 [Page 29] +Busi, et al. Expires 16 March 2023 [Page 29] Internet-Draft Yang for Optical Path Computation September 2022 @@ -1669,22 +1669,51 @@ Internet-Draft Yang for Optical Path Computation September 2022 Figure 5: Flexi-grid path computation YANG module -5. Manageability Considerations - TBD. -Busi, et al. Expires 12 March 2023 [Page 30] + + +Busi, et al. Expires 16 March 2023 [Page 30] Internet-Draft Yang for Optical Path Computation September 2022 +5. Manageability Considerations + + This document provides a method for requesting path computations for + WSON and Flexi-Grid tunnels. Consideration of mechanisms to gather + and collate information required for the path computations will be + necessary. Furthermore, storing path computation requests and + responses and triggering actions according to configured will also + need to be carefully managed and secured. + + Future versions of this document will contain additional information. + 6. Security Considerations - + The YANG module defined in this document will be accessed via the + NETCONF protocol [RFC6241] or RESTCONF protocol [RFC8040]. The + lowest NETCONF layer is the secure transport layer, and the + mandatory-to-implement secure transport is Secure Shell (SSH) + [RFC6242]. The lowest RESTCONF layer is HTTPS and the mandatory-to- + implement secure transport is TLS [RFC8446]. + + The Network Configuration Access Control Model (NACM) [RFC8341] + provides the means to restrict access to particular NETCONF or + RESTCONF users to a pre-configured subset of all available NETCONF or + RESTCONF protocol operations and content. + + Some of the RPC operations defined in this YANG module may be + considered sensitive or vulnerable in some network environments. It + is thus essential to control access to these operations. + + Operations defined in this document, and their sensitivities and + possible vulnerabilities, will be discussed further in future + versions of this document. 7. IANA Considerations @@ -1702,6 +1731,13 @@ Internet-Draft Yang for Optical Path Computation September 2022 This document registers the following YANG module in the "YANG Module Names" registry [RFC7950]. + + +Busi, et al. Expires 16 March 2023 [Page 31] + +Internet-Draft Yang for Optical Path Computation September 2022 + + name: ietf-wson-path-computation namespace: urn:ietf:params:xml:ns:yang:ietf-wson-path-computation prefix: wson-pc @@ -1724,20 +1760,6 @@ Internet-Draft Yang for Optical Path Computation September 2022 . - - - - - - - - - -Busi, et al. Expires 12 March 2023 [Page 31] - -Internet-Draft Yang for Optical Path Computation September 2022 - - [I-D.ietf-teas-yang-path-computation] Busi, I., Belotti, S., Dios, O. G. D., Sharma, A., and D. Ceccarelli, "A YANG Data Model for requesting path @@ -1763,6 +1785,19 @@ Internet-Draft Yang for Optical Path Computation September 2022 (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, . + + + + +Busi, et al. Expires 16 March 2023 [Page 32] + +Internet-Draft Yang for Optical Path Computation September 2022 + + + [RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure + Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011, + . + [RFC7699] Farrel, A., King, D., Li, Y., and F. Zhang, "Generalized Labels for the Flexi-Grid in Lambda Switch Capable (LSC) Label Switching Routers", RFC 7699, DOI 10.17487/RFC7699, @@ -1772,10 +1807,23 @@ Internet-Draft Yang for Optical Path Computation September 2022 RFC 7950, DOI 10.17487/RFC7950, August 2016, . + [RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF + Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017, + . + [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, . + [RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration + Access Control Model", STD 91, RFC 8341, + DOI 10.17487/RFC8341, March 2018, + . + + [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol + Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, + . + 8.2. Informative References [I-D.ietf-ccamp-flexigrid-tunnel-yang] @@ -1786,14 +1834,6 @@ Internet-Draft Yang for Optical Path Computation September 2022 2022, . - - - -Busi, et al. Expires 12 March 2023 [Page 32] - -Internet-Draft Yang for Optical Path Computation September 2022 - - [I-D.ietf-ccamp-wson-tunnel-model] Lee, Y., Zheng, H., Guo, A., Lopez, V., King, D., Yoon, B. Y., and R. Vilalta, "A Yang Data Model for WSON Tunnel", @@ -1802,6 +1842,14 @@ Internet-Draft Yang for Optical Path Computation September 2022 . + + + +Busi, et al. Expires 16 March 2023 [Page 33] + +Internet-Draft Yang for Optical Path Computation September 2022 + + [I-D.ietf-teas-actn-poi-applicability] Peruzzini, F., Bouquier, J., Busi, I., King, D., and D. Ceccarelli, "Applicability of Abstraction and Control of @@ -1842,20 +1890,21 @@ Acknowledgments Contributors + Daniel King + Old Dog Consulting + Email: daniel@olddog.co.uk +Authors' Addresses -Busi, et al. Expires 12 March 2023 [Page 33] - -Internet-Draft Yang for Optical Path Computation September 2022 - Daniel King - Old Dog Consulting - Email: daniel@olddog.co.uk -Authors' Addresses +Busi, et al. Expires 16 March 2023 [Page 34] + +Internet-Draft Yang for Optical Path Computation September 2022 + Italo Busi Huawei Technologies @@ -1901,4 +1950,11 @@ Authors' Addresses -Busi, et al. Expires 12 March 2023 [Page 34] + + + + + + + +Busi, et al. Expires 16 March 2023 [Page 35] diff --git a/draft-gbb-ccamp-optical-path-computation-yang.xml b/draft-gbb-ccamp-optical-path-computation-yang.xml index e76aebb..32c9947 100644 --- a/draft-gbb-ccamp-optical-path-computation-yang.xml +++ b/draft-gbb-ccamp-optical-path-computation-yang.xml @@ -36,7 +36,7 @@ - + CCAMP Working Group @@ -1403,12 +1403,21 @@ module ietf-flexi-grid-path-computation {
Manageability Considerations -TBD. +This document provides a method for requesting path computations for WSON and Flexi-Grid tunnels. Consideration of mechanisms to gather and collate information required for the path computations will be necessary. Furthermore, storing path computation requests and responses and triggering actions according to configured will also need to be carefully managed and secured. + +Future versions of this document will contain additional information.
Security Considerations -<Add any security considerations> +The YANG module defined in this document will be accessed via the NETCONF protocol or RESTCONF protocol . The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) . The lowest RESTCONF layer is HTTPS and the mandatory-to-implement secure transport is TLS . + +The Network Configuration Access Control Model (NACM) provides the means to restrict access to particular NETCONF or RESTCONF users to a pre-configured subset of all available NETCONF or RESTCONF protocol operations and content. + +Some of the RPC operations defined in this YANG module may be +considered sensitive or vulnerable in some network environments. It is thus essential to control access to these operations. + +Operations defined in this document, and their sensitivities and possible vulnerabilities, will be discussed further in future versions of this document.
IANA Considerations @@ -1651,6 +1660,62 @@ module ietf-flexi-grid-path-computation { + + +RESTCONF Protocol + + + + +This document describes an HTTP-based protocol that provides a programmatic interface for accessing data defined in YANG, using the datastore concepts defined in the Network Configuration Protocol (NETCONF). + + + + + + + + + +Using the NETCONF Protocol over Secure Shell (SSH) + + +This document describes a method for invoking and running the Network Configuration Protocol (NETCONF) within a Secure Shell (SSH) session as an SSH subsystem. This document obsoletes RFC 4742. [STANDARDS-TRACK] + + + + + + + + + +The Transport Layer Security (TLS) Protocol Version 1.3 + + +This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery.This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. + + + + + + + + + +Network Configuration Access Control Model + + + +The standardization of network configuration interfaces for use with the Network Configuration Protocol (NETCONF) or the RESTCONF protocol requires a structured and secure operating environment that promotes human usability and multi-vendor interoperability. There is a need for standard mechanisms to restrict NETCONF or RESTCONF protocol access for particular users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. This document defines such an access control model.This document obsoletes RFC 6536. + + + + + + + + The IETF XML Registry @@ -1865,137 +1930,148 @@ who have contributed to the development of path computation augmentations for WS