Re: [Netconf] draft-ietf-netconf-rfc6536bis Query

Rohit R Ranade <rohitrranade@huawei.com> Thu, 30 November 2017 03:07 UTC

From: Rohit R Ranade <rohitrranade@huawei.com>
To: "netconf@ietf.org" <netconf@ietf.org>
Thread-Topic: [Netconf] draft-ietf-netconf-rfc6536bis Query
Thread-Index: AdNdz9MehD+d0xYjTJ+ndshlR/LYrAA3pAkgArZagoA=
Date: Thu, 30 Nov 2017 03:06:50 +0000
Message-ID: <991B70D8B4112A4699D5C00DDBBF878A6B15CE6B@DGGEMA502-MBX.china.huawei.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_991B70D8B4112A4699D5C00DDBBF878A6B15CE6BDGGEMA502MBXchi_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/UYUUYn6DrYO-x-YLezD_ui8sYjk>
Subject: Re: [Netconf] draft-ietf-netconf-rfc6536bis Query
Precedence: list

Hi Andy/Martin,

Can you please clarify the below query about rule-list group having "*".  Whether we need to allow a new group to be added a rule-list which already has a "*" in the leaf-list.

With Regards,
Rohit R

From: Rohit R Ranade
Sent: 16 November 2017 13:17
To: 'netconf@ietf.org' <netconf@ietf.org>
Subject: RE: [Netconf] draft-ietf-netconf-rfc6536bis Query

Hi All,

1 more point I wanted clarified was for the below point

leaf-list group {
           type union {
             type matchall-string-type;
             type group-name-type;
           }
           description
             "List of administrative groups that will be
              assigned the associated access rights
              defined by the 'rule' list.

              The string '*' indicates that all groups apply to the
              entry.";

Consider that existing configuration is like below:
<rule-list>
   <name>list1</name>
   <group>ug1</group>
</rule-list>

Consider that user will add to this group a record of '*"
<rule-list>
   <name>list1</name>
   <group>ug1</group>
<group>*</group>
</rule-list>

?  Whether this is valid configuration ? "*" can be considered as a super-set as it will apply for all group. So can this leaf-list contain * along with other UGs ?

One scenario where this is possible is when initially the user had thought of applying a rule-list to only a particular Group , but later the user wants to apply to all groups.

With Regards,
Rohit R

From: Rohit R Ranade
Sent: 15 November 2017 10:42
To: netconf@ietf.org<mailto:netconf@ietf.org>
Subject: [Netconf] draft-ietf-netconf-rfc6536bis Query

Hi All,

For the state-data in NACM like the below :

leaf denied-operations {
         type yang:zero-based-counter32;
         config false;
         mandatory true;
         description
           "Number of times since the server last restarted that a
            protocol operation request was denied.";
       }

"Number of times since the server" ==> Here the server is being referenced to NETCONF server or RESTCONF server ?
Please note that the both the NETCONF server and RESTCONF server maybe using the same NACM configurations but the state-data maintained by each protocol maybe different.

With Regards,
Rohit R

[Netconf] draft-ietf-netconf-rfc6536bis Query Rohit R Ranade
Re: [Netconf] draft-ietf-netconf-rfc6536bis Query Rohit R Ranade
Re: [Netconf] draft-ietf-netconf-rfc6536bis Query Rohit R Ranade
Re: [Netconf] draft-ietf-netconf-rfc6536bis Query Andy Bierman