Re: [Netconf] Question on NACM usage

[Per Hedeland <[e-mail]>]

On 2016-12-14 12:22, Martin Bjorklund wrote:
> 
> No this is not possible.  The reason is that if we allow any XPath
> expression here, the complexity of implementing this increases
> dramatically.  Also the complexity of using this and understanding how
> rules interact will increase, thus increasing the risk of
> mis-configuration (which would be security impacting).

...and of course, the spec says that it's not possible - RFC 6536:

  typedef node-instance-identifier {
    type yang:xpath1.0;
    description
      "Path expression used to represent a special
       data node instance identifier string.

       A node-instance-identifier value is an
       unrestricted YANG instance-identifier expression.
       All the same rules as an instance-identifier apply
       except predicates for keys are optional.  If a key
       predicate is missing, then the node-instance-identifier
       represents all possible server instances for that key.

RFC 6020, section 9.13:

   The syntax for an instance-identifier is a subset of the XPath
   abbreviated syntax, formally defined by the rule
   "instance-identifier" in Section 12.  It is used to uniquely identify
   a node in the data tree.  Predicates are used only for specifying the
   values for the key nodes for list entries, a value of a leaf-list
   entry, or a positional index for a list without keys.  For
   identifying list entries with keys, each predicate consists of one
   equality test per key, and each key MUST have a corresponding
   predicate.

--Per Hedeland