Re: [L3sm] New Version Notification for draft-wu-l3sm-rfc8049bis-02.txt

[Qin Wu <[e-mail]>]

发件人: L3sm [mailto:[e-mail]] 代表 David Ball
发送时间: 2017年8月24日 18:31
收件人: Qin Wu; [e-mail]
抄送: Stephane Litkowski; Kenichi Ogaki; [e-mail]
主题: Re: [L3sm] New Version Notification for draft-wu-l3sm-rfc8049bis-02.txt




On 24/08/2017 11:11, Qin Wu wrote:


发件人: David Ball [mailto:[e-mail]]
发送时间: 2017年8月24日 17:32
收件人: Qin Wu; [e-mail]<mailto:[e-mail]>
抄送: Stephane Litkowski; Kenichi Ogaki; [e-mail]<mailto:[e-mail]>
主题: Re: [L3sm] New Version Notification for draft-wu-l3sm-rfc8049bis-02.txt

On 24/08/2017 01:50, Qin Wu wrote:


[Qin]: Okay, the propose change will look like this:
“
import ietf-netconf-acm {
  prefix nacm;
}
……
grouping vpn-profile-cfg {
  container valid-provider-identifiers {
   list cloud-identifier {
    if-feature cloud-access;
    key id;
    leaf id {
     type string;
     description
      "Identification of cloud service.
       Local administration meaning.";
    }
    nacm:default-deny-write;
    description
    "List for Cloud Identifiers.";
  }
   list encryption-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the SP encryption profile
       to be used. Local administration meaning.";
    }
    nacm:default-deny-write;
    description
    "List for encryption profile identifiers.";
   }
   list qos-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the QoS Profile to be used.
       Local administration meaning.";
   }
         nacm:default-deny-write;
    description
    "List for QoS Profile Identifiers.";
   }

   list bfd-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the SP BFD Profile to be used.
       Local administration meaning.";
    }
         nacm:default-deny-write;
    description
    "List for BFD profile Identifiers.";
   }
     description
    "Container for Valid Provider Identifies.";
  }
   description
   "Grouping for VPN Profile configuration.";
}
”
This will get in line with Jan’s proposal as well.

If my understanding of RFC 6536 is correct, you need to put it on the leaves as well as the lists (it doesn't cascade down the tree like most other yang constructs).


[Qin]: ahha, I find a example on how to use “nacm:default-deny-write;”, see example in RFC7317,
So we only need to put it on container level, the change will be like this:

[DB] Like I said, my reading of RFC6536 is that it doesn't cascade down the tree, so it needs to be put on every node.  Just putting it on the container would mean that the client couldn't create the container, but if the container already existed, they would still be able to write to everything inside it.  See RFC6536 section 3.2.3 for example.  I think the example in RFC7317 is wrong, although it is the same authors as RFC6536, which is curious.  I'll check with Martin.

[Qin]:  Yes, we need to get confirm about this, it looks to me if we apply “nacm:default-deny-write” to top level node, “nacm:default-deny-write” applicability will spread to the lower level nodes as well.
By reading RFC6536 section 3.2.3 example, I didn’t get the same understanding. Please correct me if I am wrong.


    David


“
import ietf-netconf-acm {
  prefix nacm;
}
……
grouping vpn-profile-cfg {
  container valid-provider-identifiers {
   list cloud-identifier {
    if-feature cloud-access;
    key id;
    leaf id {
     type string;
     description
      "Identification of cloud service.
       Local administration meaning.";
    }
    description
    "List for Cloud Identifiers.";
   }
   list encryption-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the SP encryption profile
       to be used. Local administration meaning.";
    }
    description
    "List for encryption profile identifiers.";
   }
   list qos-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the QoS Profile to be used.
       Local administration meaning.";
    }
         nacm:default-deny-write;
    description
    "List for QoS Profile Identifiers.";
   }

   list bfd-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the SP BFD Profile to be used.
       Local administration meaning.";
    }
    description
    "List for BFD profile Identifiers.";
   }
     description
    "Container for Valid Provider Identifies.";
  }
  nacm:default-deny-write;
   description
   "Grouping for VPN Profile configuration.";
}
”
Does this work for you?

    David




--

David Ball

<[e-mail]><mailto:[e-mail]>



--

David Ball

<[e-mail]><mailto:[e-mail]>