Subject: [netmod] sec. 7.16.2; identity base

From: Andy Bierman <[email-masked]>
Date: Tue, 02 Dec 2008 08:10:16 -0800

Hi,

1) Can any identity be a base for another one?

 From 17.6.3:

   module des {
          namespace "http://example.com/des";
          prefix "des";

          import "crypto-base" {
              prefix "crypto";
          }

          identity des {
              base "crypto:crypto-alg";
              description "DES crypto algorithm";
          }

          identity des3 {
              base "crypto:crypto-alg";
              description "Triple DES crypto algorithm";
          }
      }

What if the 'des' module defined its own base?
Is this allowed?

   module des {
          namespace "http://example.com/des";
          prefix "des";

          import "crypto-base" {
              prefix "crypto";
          }

          identity des-base {
              base "crypto:crypto-alg";
              description "identity base for all identities in this module";
          }

          identity des {
              base "des-base";
              description "DES crypto algorithm";
          }

          identity des3 {
              base "des-base";
              description "Triple DES crypto algorithm";
          }
      }

2) Is a base-reference loop a fatal error?  (I hope so)

    identity A { base B; }
    identity B { base C; }
    identity C { base A; }

Andy

_______________________________________________
netmod mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netmod

---

From: Martin Bjorklund <[email-masked]>
Date: Tue, 02 Dec 2008 20:46:09 +0100 (CET)

> 1) Can any identity be a base for another one?

[...]

> What if the 'des' module defined its own base?

Yes.  Do you think it needs to be explicitly stated?  Today it says:

  The base statement, which is optional, takes as an argument a string
  which is the name of an existing identity, from which the new
  identity is derived.

Without any constraints on the existing identity.

> 2) Is a base-reference loop a fatal error?  (I hope so)

Yes.  I will add the same text we have for groupings and typedefs:

  An identity MUST NOT reference itself, neither directly nor
  indirectly through a chain of other identities.

/martin