Subject: Re: [Netconf] Comments on draft-ietf-netconf-keystore-07

From: Kent Watsen <[email-masked]>
Date: Fri, 7 Dec 2018 18:03:44 +0000

Hi Ramkumar, thanks for pointing this out!

The proposed fix is to:

  *   add a “local-definition” container around the “uses” statement(s)
  *   rename “reference” to “keystore-reference”

The Github commit for this is here:
  -  https://github.com/netconf-wg/keystore/commit/7fc73f052f05dc212e7d40d82c84460ab5ea64ec

Also, to see how it plays out in the other drafts, the Github commits for them are here:
  - ssh: https://github.com/netconf-wg/ssh-client-server/commit/df25274c5c50a432e57deb7809722aee7d5e8fa9
  - tls: https://github.com/netconf-wg/tls-client-server/commit/2686e81ac5fcb98a0346b8c203ca25a071faa0e9
  - netconf: https://github.com/netconf-wg/netconf-client-server/commit/148b5cdc5b1755901d318e6a0cfe94ef04134252
  - restconf: https://github.com/netconf-wg/restconf-client-server/commit/475fb627527174795e034339fd6504def4dd4d32

If no objections are raised, this change will go into the next published version.

Kent

On 12/6/18, 5:39 AM, "Dhanapal, Ramkumar (Nokia - IN/Chennai)" <[email-masked]<mailto:[email-masked]>> wrote:

Hi Kent,
We see the following definition in draft-ietf-netconf-keystore-07.

grouping local-or-keystore-end-entity-cert-with-key-grouping {
       description
         "A grouping that expands to allow an end-entity certificate
          (and its associated private key) to be either stored locally,
         within the using data model, or be a reference to a specific
          certificate in the keystore.";
       choice local-or-keystore {
         mandatory true;
         case local {
           if-feature "local-keys-supported";
           uses ct:asymmetric-key-pair-grouping;
           uses ct:end-entity-cert-grouping;
         }
         case keystore {
           if-feature "keystore-supported";
           leaf reference {
             type ks:asymmetric-key-certificate-ref;
             description
               "A reference to a specific certificate, and its
                associated private key, stored in the keystore.";
           }
         }
         description
           "A choice between an inlined definition and a definition
            that exists in the keystore.";
       }
     }

In ct:asymmetric-key-pair-grouping, 2 actions are defined.
In ct:end-entity-cert-grouping, 1 notification is defined.

But w.r.t. RFC7950 references below, looks like it is not okay to have either actions or notifications in “case” statements.

https://tools.ietf.org/html/rfc7950#section-7.15<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc7950-23section-2D7.15&d=DwMFAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=5MdSdliP9J3hgvGhkGCct2XcKpZ02-EvBh7-1XguBpc&s=UNvfZFjpmFaI7esgjHxrocBZttgjQ5vyfn2E_TkrxFo&e=>

        Since an action cannot be defined at the top level of a module or in

        a "case" statement, it is an error if a grouping that contains an

        action at the top of its node hierarchy is used at the top level of a

        module or in a case definition

https://tools.ietf.org/html/rfc7950#section-7.16<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc7950-23section-2D7.16&d=DwMFAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=5MdSdliP9J3hgvGhkGCct2XcKpZ02-EvBh7-1XguBpc&s=rQNBqLPet_vEb3FYg0E01BhnxdNQ0u21b4frMZ6WodM&e=>

        Since a notification cannot be defined in a "case" statement, it is

        an error if a grouping that contains a notification at the top of its

        node hierarchy is used in a case definition.

Can you please check and provide your feedback? Or Am I missing something here?

Thanks & Regards,

Ramkumar