Re: [netmod] AD review: draft-ietf-netmod-snmp-cfg-05

[Juergen Schoenwaelder <[e-mail]>]

On Mon, Jun 09, 2014 at 11:41:05AM -0700, Randy Presuhn wrote:
> Hi -
> 
> >From: Juergen Schoenwaelder <[e-mail]>
> >Sent: Jun 7, 2014 12:02 AM
> >To: Benoit Claise <[e-mail]>
> >Cc: [e-mail], NETMOD Working Group <[e-mail]>
> >Subject: Re: [netmod] AD review: draft-ietf-netmod-snmp-cfg-05
> ...
> >Concerning "designed to": The data model has been designed to cover
> >everything that the SNMP configuration models describe. It allows an
> >implementation that supports both configuration via NETCONF and
> >configuration via SNMP. The details are discussed in section 3.2.
> 
> When SNMP is used to change the value of an
> instance of vacmGroupName in the vacmSecurityToGroupTable,
> some side-effects will need to happen in the netconf datastores,
> due to the decision to model the information differently.
> I know this has come up before, but it's unclear to me what
> needs to happen on the netconf server side in a couple
> of specific cases:
> 
> (1) If the vacmGroupName has a value that hasn't been seen before,
> a "group" obviously needs to be created as a side-effect in
> netconf land.  What's less obvious is what happens to the
> old "group" in the case where no other entries in the
> vacmSecurityToGroupTable still have that particular value
> for vacmGroupName.  Is it to be automagically deleted
> because the security-model's min-elements constrainted
> would otherwise be violated?

We previously removed the min-elements from the 'member' list and as
such it is not necessary to remove the group until all references to
it have been removed. The min-elements of the 'security-model' only
applies if an instance exists in the 'member' list, which seems to be
consistent with the way VACM works.

> (2) Likewise, when the value of the StorageType of an entry
> in vacmSecurityToGroupTable is modified from nonVolatile
> to volatile, does similar "garbage collection" have
> to happen as a side-effect?

An implementation may do garbage collection if no nonVolatile
references to a group exist anymore.

> (3) When the entry in vacmSecurityToGroupTable is volatile,
> and some (but not all) of the corresponding vacmAccessTable
> entries are nonVolatile, what happens in the netconf datastores?

In this case the configuration datastore would only store the group
without any members.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
Fax:   [phone]         <http://www.jacobs-university.de/>