[netconf] a comment on draft-ietf-netconf-tls-client-server-15

[Martin Bjorklund <[e-mail]>]

Hi,

This is not a full review, just one thing that I stubmled upon.

The model has (pruned to illustrate my point):

       container server-authentication {
         nacm:default-deny-write;
         must 'ca-certs or server-certs';
         container ca-certs {
           if-feature "ts:x509-certificates";
           presence ...;
           ...
         }
         container server-certs {
           if-feature "ts:x509-certificates";
           presence ...;
           ...
         }
       }

1.  If a server doesn't implement the feature ts:x509-certificates,
    the model effectively becomes:

       container server-authentication {
         nacm:default-deny-write;
         must 'ca-certs or server-certs';
       }

    This must expression will never be true, which means that it is
    not possible to configure anything!


2.  When this grouping is used in ietf-https-notifs, it looks like
    this:

  +--rw receivers
     +--rw receiver* [name]
        +--rw name           string
        ...
        |  +--rw server-authentication
        |  |  +--rw ca-certs! {ts:x509-certificates}?
                 ...            
        |  |  +--rw server-certs! {ts:x509-certificates}?
                 ...

   Now, the container 'server-authentication' has
   nacm:default-deny-write, and its contents is mandatory (due to the
   must expression).  This means that it is not possible to configure
   a single receiver without explicit NACM rules for this container.  Is
   that really the intention?


/martin