Re: [L3sm] New Version Notification for draft-wu-l3sm-rfc8049bis-02.txt

[David Ball <[e-mail]>]

On 24/08/2017 11:11, Qin Wu wrote:
>
> *发件人:*David Ball [mailto:[e-mail]]
> *发送时间:*2017年8月24日17:32
> *收件人:*Qin Wu; [e-mail]
> *抄送:*Stephane Litkowski; Kenichi Ogaki; [e-mail]
> *主题:*Re: [L3sm] New Version Notification for 
> draft-wu-l3sm-rfc8049bis-02.txt
>
> On 24/08/2017 01:50, Qin Wu wrote:
>
> [Qin]: Okay, the propose change will look like this:
>
> “
>
> import ietf-netconf-acm {
>
>   prefix nacm;
>
> }
>
> ……
>
> grouping vpn-profile-cfg {
>
>   container valid-provider-identifiers {
>
>    list cloud-identifier {
>
>     if-feature cloud-access;
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of cloud service.
>
>        Local administration meaning.";
>
>     }
>
> nacm:default-deny-write;
>
>     description
>
>     "List for Cloud Identifiers.";
>
>   }
>
>    list encryption-profile-identifier {
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of the SP encryption profile
>
>        to be used. Local administration meaning.";
>
>     }
>
>  nacm:default-deny-write;
>
>     description
>
>     "List for encryption profile identifiers.";
>
>    }
>
>    list qos-profile-identifier {
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of the QoS Profile to be used.
>
>        Local administration meaning.";
>
>    }
>
> nacm:default-deny-write;
>
>     description
>
>     "List for QoS Profile Identifiers.";
>
>    }
>
>    list bfd-profile-identifier {
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of the SP BFD Profile to be used.
>
>        Local administration meaning.";
>
>     }
>
> nacm:default-deny-write;
>
>     description
>
>     "List for BFD profile Identifiers.";
>
>    }
>
>      description
>
>     "Container for Valid Provider Identifies.";
>
>   }
>
>    description
>
>    "Grouping for VPN Profile configuration.";
>
> }
>
> ”
>
> This will get in line with Jan’s proposal as well.
>
>
> If my understanding of RFC 6536 is correct, you need to put it on the 
> leaves as well as the lists (it doesn't cascade down the tree like 
> most other yang constructs).
>
> [Qin]: ahha, I find a example on how to use 
> “nacm:default-deny-write;”, see example in RFC7317,
>
> So we only need to put it on container level, the change will be like 
> this:
>

[DB] Like I said, my reading of RFC6536 is that it doesn't cascade down 
the tree, so it needs to be put on every node.  Just putting it on the 
container would mean that the client couldn't create the container, but 
if the container already existed, they would still be able to write to 
everything inside it.  See RFC6536 section 3.2.3 for example.  I think 
the example in RFC7317 is wrong, although it is the same authors as 
RFC6536, which is curious.  I'll check with Martin.

     David

> “
>
> import ietf-netconf-acm {
>
>   prefix nacm;
>
> }
>
> ……
>
> grouping vpn-profile-cfg {
>
>   container valid-provider-identifiers {
>
>    list cloud-identifier {
>
>     if-feature cloud-access;
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of cloud service.
>
>        Local administration meaning.";
>
>     }
>
>     description
>
>     "List for Cloud Identifiers.";
>
>    }
>
>    list encryption-profile-identifier {
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of the SP encryption profile
>
>        to be used. Local administration meaning.";
>
>     }
>
>     description
>
>     "List for encryption profile identifiers.";
>
>    }
>
>    list qos-profile-identifier {
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of the QoS Profile to be used.
>
>        Local administration meaning.";
>
>     }
>
>          nacm:default-deny-write;
>
>     description
>
>     "List for QoS Profile Identifiers.";
>
>    }
>
>    list bfd-profile-identifier {
>
>     key id;
>
>     leaf id {
>
>      type string;
>
>      description
>
>       "Identification of the SP BFD Profile to be used.
>
>        Local administration meaning.";
>
>     }
>
>     description
>
>     "List for BFD profile Identifiers.";
>
>    }
>
>      description
>
>     "Container for Valid Provider Identifies.";
>
>   }
>
>   nacm:default-deny-write;
>
>    description
>
>    "Grouping for VPN Profile configuration.";
>
> }
>
> ”
>
> Does this work for you?
>
>     David
>
>
> -- 
> David Ball
> <[e-mail]> <mailto:[e-mail]>

-- 
David Ball
<[e-mail]>