Re: [netconf] draft-ietf-netconf-keystore-09.txt

[Kent Watsen <[e-mail]>]

Hi Nick,

You are correct that something is amiss, but I'd like to discuss the fix more.

Your proposal looks (squinting my eyes) right (have you tested it?), but I'm wondering if there isn't a lower-level and potentially more useful fix...

In particular, note that 'ks:asymmetric-key-certificate-ref' points to a certificate in the the keystore that comes from the 'uses ct:asymmetric-key-pair-with-certs-grouping' statement.   The idea behind this grouping is that, whenever a certificate is configured, whether in the keystore or not, that the 'asymmetric-key-pair-grouping 3-tuple (alg, pub key, private key) is also configured.   This suggests that ct:asymmetric-key-pair-with-certs-grouping may be missing a 'must' statement or, more likely (due to the fact that the 3-tuple may only exist in <operational>), its 'description' statement is missing that precondition in its text.

Thoughts?

Kent // contributor



> On Apr 30, 2019, at 11:39 AM, Nick Hancock <[e-mail]> wrote:
> 
> Hi Kent,
> 
> I have just noticed a issue with the leaf 'keystore-reference' used 
> in the grouping 'local-or-keystore-end-entity-cert-with-key-grouping' 
> in ietf-keystore.
> 
> This leafref uses the typedef 'asymmetric-key-certificate-ref', but, 
> unless I am missing something, this alone will not work, because a 
> predicate for the list 'asymmetric-key' is missing. 
> 
> I would expect something like the following:
> 
> case keystore {
>  if-feature "keystore-supported";
>  leaf asymmetric-key-name {
>    type ks:asymmetric-key-ref;
>      description
>        "A reference to an asymmetric key that exists in
>         the keystore. "; 
>  }
>  leaf certificate-name {
>    type leafref {
>      path 
>        "/ks:keystore"
>        + "/ks:asymmetric-keys"
>        + "/ks:asymmetric-key"
>        + "[ks:name=current()/../" 
>        + "asymmetric-key-name]" 
>        + "/ks:certificates" 
>        + "/ks:certificate/ks:name";
>    }
>    description
>     "A reference to a specific certificate associated 
>      with the given private key, stored in the keystore.";   
>  }
> }
> 
> Regards
> Nick
>