Re: [netconf] draft-ietf-keystore - certificate leafref

[Balázs Kovács <[e-mail]>]

Hi Kent,

I hope it is ok this way.


  1.  I changed local-or-keystore-end-entity-cert-with-key-grouping (see container ‘keystore-reference’).


  grouping local-or-keystore-end-entity-cert-with-key-grouping {
    description
      "A grouping that expands to allow an end-entity certificate
       (and its associated private key) to be either stored locally,
       within the using data model, or be a reference to a specific
       certificate in the keystore.";
    choice local-or-keystore {
      mandatory true;
      case local {
        if-feature "local-keys-supported";
        container local-definition {
          must '(algorithm and public-key and private-key)
                or not (algorithm or public-key or private-key)' {
            description
              "These descendent nodes are not mandatory because they
               MAY be defined in <operational>.  Implementations MUST
               assert that these values are either configured or that
               they exist in <operational>.";
          }
          description
            "Container to hold the local key definition.";
          uses ct:asymmetric-key-pair-grouping;
          uses ct:end-entity-cert-grouping;
        }
      }
      case keystore {
        if-feature "keystore-supported";
        container keystore-reference {
          description
            "A reference to a specific certificate, and its
             associated private key, stored in the keystore.";
          leaf asymmetric-key {
            type ks:asymmetric-key-ref;
            description
              "A reference to an asymmetric key that exists in
               the keystore.";
          }
          leaf certificate {
            type leafref {
                path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key[name = current()/../asymmetric-key]/ks:certificates/ks:certificate/ks:name";
            }
            description
              "A reference to a specific certificate of the
               asymmetric key in the keystore.";
          }
        }
      }
      description
        "A choice between an inlined definition and a definition
         that exists in the keystore.";
    }
  }


  1.  I would recommend to remove ks:asymmetric-key-certificate-ref
  2.  The client server model examples would need to be updated, but those I have not touched.

Br,
Balazs

From: Kent Watsen <[e-mail]>
Sent: Wednesday, June 12, 2019 12:40 PM
To: Balázs Kovács <[e-mail]>
Cc: [e-mail]
Subject: Re: draft-ietf-keystore - certificate leafref


Hi Balazs,

Yes, that would be better.  Please provide the NEW text needed.

Kent

Sent from my iPhone

On Jun 12, 2019, at 5:14 AM, Balázs Kovács <[e-mail]<mailto:[e-mail]>> wrote:
Hi Kent,

Ietf-keystore model contains this leafref:


     typedef asymmetric-key-certificate-ref {

       type leafref {

         path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key"

            + "/ks:certificates/ks:certificate/ks:name";

       }

       description

         "This typedef enables modules to easily define a reference

          to a specific certificate associated with an asymmetric key

          stored in the keystore.";

     }

Shouldn’t the leafref be constrained to point to a certificate within a specific asymmetric-key list element?

Example:
https://mailarchive.ietf.org/arch/msg/netmod/m0s9xAcDpJVm1a0-eWyTDvpXtZ0

Best Regards,
Balazs