Re: [L3sm] New Version Notification for draft-wu-l3sm-rfc8049bis-02.txt

[Qin Wu <[e-mail]>]

发件人: David Ball [mailto:[e-mail]]
发送时间: 2017年8月23日 19:45
收件人: Qin Wu; [e-mail]
抄送: Stephane Litkowski; Kenichi Ogaki; [e-mail]
主题: Re: [L3sm] New Version Notification for draft-wu-l3sm-rfc8049bis-02.txt

On 21/08/2017 09:39, Qin Wu wrote:


> 11. In accordance with the clarified scope, parts of the model that correspond

>       with information provided by the SP need to be marked with "config false".

>       I've identified the following, but there might be more.

>      1. The list of profiles of various types (i.e. l3vpn-service/vpn-profiles)

>      2. For the connection addresses, the provider's IP address/mask:

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv4/provider-dhcp/provider-address

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv4/provider-dhcp/mask

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv4/dhcp-relay/provider-address

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv4/dhcp-relay/mask

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv4/addresses/provider-address

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv4/addresses/mask

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv6/provider-dhcp/provider-address

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv6/provider-dhcp/mask

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv6/dhcp-relay/provider-address

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv6/dhcp-relay/mask

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv6/addresses/provider-address

>     • l3vpn-service/sites/site/site-network-accesses/site-network-access/ip-connection/ipv6/addresses/mask



That sounds reasonable.

[Qin]: One more comment, we can not put ‘config false’ for l3vpn-service/vpn-profiles, since Config true leafrefs MUST NOT refer to config false data

This issue was discussed before, see discussion available at:

https://www.ietf.org/mail-archive/web/l3sm/current/msg00683.html

Ah yes, I had forgotten that.  Yang doesn't really handle this case - the semantics we want are that only the SP (i.e., the server) can modify these values, but they still have to respect the constraint embodied in the leafref i.e. that the values are not deleted if they are in use.  I don't think NACM quite does it, because that is about access control for clients, but here it is the server that can change the values.  Having said that, adding "nacm:default-deny-write" to l3vpn-service/vpn-profiles and everything under it would be a strong hint as to the intended behaviour.

    David

[Qin]: Okay, the propose change will look like this:
“
import ietf-netconf-acm {
  prefix nacm;
}
……
grouping vpn-profile-cfg {
  container valid-provider-identifiers {
   list cloud-identifier {
    if-feature cloud-access;
    key id;
    leaf id {
     type string;
     description
      "Identification of cloud service.
       Local administration meaning.";
    }
    nacm:default-deny-write;
    description
    "List for Cloud Identifiers.";
  }
   list encryption-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the SP encryption profile
       to be used. Local administration meaning.";
    }
    nacm:default-deny-write;
    description
    "List for encryption profile identifiers.";
   }
   list qos-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the QoS Profile to be used.
       Local administration meaning.";
   }
         nacm:default-deny-write;
    description
    "List for QoS Profile Identifiers.";
   }

   list bfd-profile-identifier {
    key id;
    leaf id {
     type string;
     description
      "Identification of the SP BFD Profile to be used.
       Local administration meaning.";
    }
         nacm:default-deny-write;
    description
    "List for BFD profile Identifiers.";
   }
     description
    "Container for Valid Provider Identifies.";
  }
   description
   "Grouping for VPN Profile configuration.";
}
”
This will get in line with Jan’s proposal as well.

--

David Ball

<[e-mail]><mailto:[e-mail]>