Subject: [netmod] require-instance

From: Michael Vaughn <[email-masked]>
Date: Thu, 14 May 2009 17:06:31 -0400 (EDT)

shouldn't require-instance be listed in the type substatements(7.4.1)?

mike

---

From: Martin Bjorklund <[email-masked]>
Date: Mon, 18 May 2009 09:56:05 +0200 (CEST)

> shouldn't require-instance be listed in the type substatements(7.4.1)?

Yes.  Fixed, thanks.

/martin

---

From: David Spakes <[email-masked]>
Date: Thu, 21 May 2009 14:40:32 -0400 (EDT)

In Section 9.13.4 (Usage Example for instance-indentifier), the first
example is:

     /* instance-identifier for a container */
     /ex:system/ex:services/ex:ssh

Would someone clarify my understanding?  I have these questions:

  1. Can the instance-identifier refer to a container that exists "only
     for organizing the hierarchy of data nodes"?  Or, must the
     instance-identifier refer only to a "presence container"?

  2. If the instance-identifier has a require-instance substatement, must
     it refer only to a "presence container" that presently exists?

Regards,

David Spakes

-------------------------------------------------------------
 David Spakes                       email:   [email-masked]
 SNMP Research                      voice:   +1 865 573 1434
 3001 Kimberlin Heights Road          fax:   +1 865 573 9197
 Knoxville, TN  37920-9716  USA      http://www.snmp.com
-------------------------------------------------------------

---

From: David Spakes <[email-masked]>
Date: Thu, 21 May 2009 16:07:46 -0400 (EDT)

>      it refer only to a "presence container" that presently exists?

Let me rephrase question 2:

  2. If the instance-identifier has the substatement
     "require-instance true", must it refer only to a
     "presence container" that presently exists?

Regards,

David Spakes

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 21 May 2009 22:42:25 +0200 (CEST)

Hi,

David Spakes <[email-masked]> wrote:
> >      for organizing the hierarchy of data nodes"?

Good question - my first reaction was that this would not make much
sense.  But suppose you designed an access control module, where you
specify access to subtrees.  Each such subtree could be an
instance-identifier, and it could be useful to point to a
NP-container.

> >      Or, must the

First of all, an instance-identifier can also refer to leafs and list
instances.  As for NP-containers, I don't think we should rule them
out.  A leaf of type instance-identifier with require-instance true
will probably have some description of its semantics, and some may
have no restrictions what so ever, and some may say that the
instance-identifier must refer to a list instance in list X or list Y,
etc.

/martin

---

From: Andy Bierman <[email-masked]>
Date: Thu, 21 May 2009 14:03:27 -0700

> instance-identifier, and it could be useful to point to a

IMO, it is fine to point at any real XML node in the database.
I think error-path should be clarified to contain an
instance-identifier (*).

* -- except sometimes the keys are missing or there
      are too many container instances, etc.
      Then the node is identified by position (foo[2])
      in the error-path. (remember that foo == foo[1])

Consider an access control rule, where you want to make sure
the user cannot even create the NP container, let
alone any of the sensitive data within it.

> instance-identifier must refer to a list instance in list X or list Y,

Andy