Re: [netconf] Truststore: bags, sets, or other?

[Martin Bjorklund <[e-mail]>]

Hi,

Kent Watsen <[e-mail]> wrote:
> [CC-ing Russ, who says he knows a lot about bags ;)
> 
> 
> The truststore draft [1] has the following general structure:
> 
>    module: ietf-truststore
>      +--rw truststore
>         +--rw certificates* [name] {x509-certificates}?
>         |  +--rw name           string
>         |  +--rw certificate* [name]
>         |     +--rw name                      string
>         |     ...
>         +--rw host-keys* [name] {ssh-host-keys}?
>         |  +--rw name           string
>         |  +--rw host-key* [name]
>         |     +--rw name        string
>         |     ...
>         +--rw raw-public-keys* [name] {raw-public-keys}?
>            +--rw name              string
>            +--rw raw-public-key* [name]
>               +--rw name                 string
>               ...
> 
> 
> I have been struggling with the naming of the top-level nodes
> (/certificates, /host-keys, etc.) being plural while also being ‘list’
> elements.  What is intended is that each of these top-level nodes is a
> "list of sets/bags of things.  To resolve this issue, I’m thinking
> about the following change:
> 
> OLD:
>             +--rw <thing>s* [name] {<thing-feature>}?
>                +--rw name string
>                   +--rw <thing>* [name]
>                      +--rw name string
>                       …
> 
> NEW:
>             +--rw <thing>-bags {<thing-feature>}?
>                +--rw <thing>-bag* [name]
>                   +--rw name string
>                      +--rw <thing>* [name]
>                         +--rw name string
>                          …
> 
> Better, right?   Any other ideas?

We have current published modules with both "-list" and "-set".  No
"-bag" so far.

For example:

  "list rule-list" in ietf-netconf-acm

  "list module-set" in ietf-yang-library

There are some examples of "s" as well, but these are plural "s" for a
normal list of singletons, and should have been named w/o the plural
"s" (if we were to be consistent).

I would try to avoid "s" for a "list-of-lists", but then pick the
suffix that feels most natural in the domain.  (For example, rather
"list access-control-list" than "list access-control-set").

Perhaps you can argue that "-list" works better for ordered sequences,
and "-set" and "-bag" for unordered.  But then there are "ordeded
sets" and "unordered lists" (and even apparently "ordered bag", in
UML).

The plural "s" is better for a surrounding container (if one exists).


/martin


> 
> Note that the term “bag” is the commonly used term in crypto circles
> with regard to PKI and, in particular, in reference to the “CertBag”
> type defined in Section 4.2.3 in RFC 7292 [2].  That said, I don’t
> think that “bag" is commonly used in reference to SSH host keys or raw
> public keys.  I don’t know if that is any issue but, in case it is,
> the choices are:
> 
> 	1) use “bag” for all three
> 	2) use “set” for all three
> 	3) use “bag” for certificates and “set” for the other two
> 	4) <another idea?>
> 
> Thoughts?
> 
> 
> [1] https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors
> <https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors>
> [2] https://tools.ietf.org/html/rfc7292#section-4.2.3
> <https://tools.ietf.org/html/rfc7292#section-4.2.3>
> 
> Kent
> 
>