Reviewer: Alexey Melnikov Review result: Has Nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document defines an RPC operation to compare management datastores that comply with the NMDA architecture. The Security Considerations talks about a couple of issues specific to the new operation: 1) sensitivity of the new "compare" operation and how access control rights to access it should be restricted. 2) performance considerations of running "compare" and how it can lead to Denial-of-Service, if the number of requests allowed in any given time interval is not restricted. I can't think of other security issues raised by this document that are missing from it. Nits: In Section 6: > The same request in RESTCONF (using JSON format): > > POST /restconf/operations/ietf-nmda-compare:compare HTTP/1.1 > Host: example.com > Content-Type: application/yang-data+json > Accept: application/yang-d Please insert an empty line after the HTTP request header and before the following payload, or your example is not syntactically valid. Also, I don't "application/yang-d" in the list of registered media types on <https://www.iana.org/assignments/media-types/media-types.xhtml>. Did I miss it? > { "ietf-nmda-compare:input" { > "source" : "ietf-datastores:operational", > "target" : "ietf-datastores:intended", > "report-origin" : null, > "xpath-filter" : "/ietf-interfaces:interfaces" > } > } > > The same response in RESTCONF (using JSON format): > > HTTP/1.1 200 OK > Date: Thu, 26 Jan 2019 20:56:30 GMT > Server: example-server > Content-Type: application/yang-d Similar to the above, you need an empty line inserted here. > { "ietf-nmda-compare:output" : { > "differences" : { > "ietf-yang-patch:yang-patch" : { > "patch-id" : "interface status", > "comment" : "diff between intended (source) and operational", > "edit" : [ > { > "edit-id" : "1", > "operation" : "replace", > "target" : "/ietf-interfaces:interface=eth0/enabled", > "value" : { > "ietf-interfaces:interface/enabled" : "false" > }, > "source-value" : { > "ietf-interfaces:interface/enabled" : "true", > "@ietf-interfaces:interface/enabled" : { > "ietf-origin:origin" : "ietf-origin:learned" > } > } > }, > { > "edit-id" : "2", > "operation" : "create", > "target" : "/ietf-interfaces:interface=eth0/description", > "value" : { > "ietf-interface:interface/description" : "ip interface" > } > } > ] > } > } > } > } Best Regards, Alexey -- last-call mailing list last-call@xxxxxxxx https://www.ietf.org/mailman/listinfo/last-call
