Subject: [netconf] ietf-keystore, truststore, crypto-types

From: Balázs Kovács <[email-masked]>
Date: Mon, 29 Jul 2019 11:44:34 +0000

Hi Kent,

A few comments to the latest version of the keystore, truststore, crypto-types models.

  1.  Typo

<CODE BEGINS> file "[email-masked]"

  1.  Is mandatory true missing from 'cert' leaf in ietf-crypto-types?

     grouping end-entity-cert-grouping {

       description

         "An end entity certificate, and a notification for when

          it is about to (or already has) expire.  Implementations

          SHOULD assert that, where used, the end entity certificate

          contains the expected public key.";

       leaf cert {

         nacm:default-deny-write;

         type end-entity-cert-cms;

         description

           "The binary certificate data for this certificate.";

         reference

           "RFC YYYY: Common YANG Data Types for Cryptography";

       }

  1.  Question: why have the key generation actions been converted to RPCs? If this is because of their earlier containers having now mandatory leaves, then have you considered just moving them one level up, adding 'name' as parameter, and keeping them as actions? I'd prefer actions.

Thank you,
Balazs

---

From: Kent Watsen <[email-masked]>
Date: Tue, 30 Jul 2019 01:31:21 +0000

Hi Balazs,

> Typo
>  
> <CODE BEGINS> file "[email-masked] <mailto:[email-masked]>"

I'd previously found/fixed this in my local copy, but thanks for reporting it.

> Is mandatory true missing from ‘cert’ leaf in ietf-crypto-types?
>  
> <snip/>

Possibly, but I don't think so.  For instance, consider asymmetric-key-pair-with-cert-grouping that uses both asymmetric-key-pair-grouping and end-entity-cert-grouping.   One has to create the asymmetric-key prior to being able to execute the generate-certificate-signing-request action to create the end-entity certificate. 

That said, this probably is going to raise the question for why then asymmetric-key-pair-grouping nodes are mandatory true, or more generally, if groupings should ever define mandatory true nodes, rather than leave it to the using-schema to refine-in the mandatory true statements if desired.

> Question: why have the key generation actions been converted to RPCs? If this is because of their earlier containers having now mandatory leaves, then have you considered just moving them one level up, adding ‘name’ as parameter, and keeping them as actions? I’d prefer actions.

Because the requests are no longer bound to an "object".  The RPCs are defined have no effect on either configuration or opstate, they simply return a value that the client will, presumably (especially if encrypted), return back to the device via a standard config update request (e.g, <edit-config>).

FWIW, see "discussion #2" starting on page 12 here https://datatracker.ietf.org/meeting/105/materials/slides-105-netconf-client-server-suite-of-drafts-00 <https://datatracker.ietf.org/meeting/105/materials/slides-105-netconf-client-server-suite-of-drafts-00>.

Why do you prefer actions?

Kent