Subject: [netmod] VRFY :Y58: associate an actions with a data node

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 5 Nov 2014 15:14:03 +0100

The 2014-10-15 virtual interim meeting proposal is to use the encoding
but to remove the data wrapper. In addition, issue Y36 should be
opened again, asking for proposals how to encode notifications
associated with data nodes.

Please speak up by Wednesday 2014-11-12 if you disagree with this
proposal.

For more details, see the issues list and the virtual interim meeting
minutes available here:

     http://svn.tools.ietf.org/svn/wg/netmod/yang-1.1/

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Andy Bierman <[email-masked]>
Date: Wed, 5 Nov 2014 06:49:13 -0800

> associated with data nodes.

I do not remember that we agreed to remove the data wrapper
(meaning the instance information for the action).  The main
rationale for this change was lack of NACM support for <rpc>
parameter values. (e.g., user is only allowed to reset certain
interfaces).

If the data wrapper is changed to an XPath leaf then the NACM
capabilities will be the same as we have now.  The whole point
of this feature is to tie actions to the datastore.

The same requirements do not apply to notifications
(e.g., user only allowed to receive notifications for certain interfaces).
The server can determine the access control based on internal
information.

In either case, applying the datastore access control rules to
actions or notifications is an entirely new access control model
and NACM will require significant examination, redesign,
re-publication, and re-implementation.

Unless RFC6536bis is also on the charter then I object to this
change.  I would rather drop this new feature than leave
the standard access control model broken.

Andy

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

---

From: Martin Bjorklund <[email-masked]>
Date: Wed, 05 Nov 2014 15:55:54 +0100 (CET)

Andy Bierman <[email-masked]> wrote:
> (meaning the instance information for the action).

NOTE: this means that instead of doing:

     <rpc message-id="101"
          xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"
          xmlns:yang="urn:ietf:params:xml:ns:yang:1">
        <yang:action>
            <data>
                <server xmlns="http://example.net/server-farm">
                    <name>apache-1</name>
                    <reset>
                        <reset-at>2014-07-29T13:42Z</reset-at>
                    </reset>
                </server>
            </data>
        </action>
     </rpc>

we'd do:

     <rpc message-id="101"
          xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"
          xmlns:yang="urn:ietf:params:xml:ns:yang:1">
        <yang:action>
          <server xmlns="http://example.net/server-farm">
            <name>apache-1</name>
            <reset>
              <reset-at>2014-07-29T13:42Z</reset-at>
            </reset>
          </server>
        </action>
     </rpc>

/martin

---

From: Andy Bierman <[email-masked]>
Date: Thu, 6 Nov 2014 07:38:16 -0800

Hi,

OK, I thought Juergen meant the generic data wrapper,
not the literal <data> element wrapper.  That is fine.

But what about NACM?  We are the co-authors, and I think
we are willing to do the editing, but it is up to the IESG to
charter and the WG to do the work.

What about I2RS requirements for owner-based access-control?
IMO NACM is applied first. Owner priority applies when the
data already exists (both clients have NACM permission).
It is not clear if any changes to NACM are required to support I2RS.

Andy

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 13 Nov 2014 20:38:22 +0100

> It is not clear if any changes to NACM are required to support I2RS.

We probably have to serialize work and NACM belongs to NETCONF, so we
would have to take any update needed to NETCONF I think.

/js

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 13 Nov 2014 20:40:05 +0100

Andy,

given Martin's clarification, are you find the proposed resolution of
Y58?

/js

---

From: Andy Bierman <[email-masked]>
Date: Thu, 13 Nov 2014 12:02:07 -0800

> given Martin's clarification, are you find the proposed resolution of

I do not see any text proposing how to fix NACM.
Adding actions and notifications to the datastore is an architectural hack.
The ARCH (RFC 6244) needs to support it. NACM (RFC 6536) needs
to support it.

I strongly object to adding this feature to YANG without proper support in
all protocols that use YANG.  The feature is nice-to-have, not required
to fix anything broken.  But if the fix is half-baked and incomplete across
all impacted standards, then I cannot support it anymore.

Andy