Re: [netmod] draft-bjorklund-netmod-structural-mount: Namespace issues

[Juergen Schoenwaelder <[e-mail]>]

On Thu, Mar 24, 2016 at 02:47:33PM +0100, Ladislav Lhotka wrote:
> 
> > On 24 Mar 2016, at 14:13, Juergen Schoenwaelder <[e-mail]> wrote:
> > 
> > On Thu, Mar 24, 2016 at 12:56:40PM +0100, Ladislav Lhotka wrote:
> >> Martin Bjorklund <[e-mail]> writes:
> >> 
> >>> The fact that anydata can represent "really anything" does not mean
> >>> that every server MUST allow the client to create "really anything"
> >>> for all anydata config nodes.  It will depend on the semantics of each
> >>> particular anydata node.
> >> 
> >> Schema validation is effectively disabled for anydata nodes. This may be
> >> a problem especially for implementations that perform validation as a
> >> separate step, perhaps automatically from the data model.
> >> 
> >> And with schema validation out of the way, it is easier to exploit
> >> potential bugs in the server.
> >> 
> > 
> > Lada, as far as I recall you wrote an I-D that proposed to mount data
> > anywhere. So what did change your mind that you now want strict schema
> > validation?
> 
> With YSDL, the schema validation is absolutely strict: The server provides a list of modules and revisions in yang-library, and a recipe how the modules are combined. Everything is fixed and static, as it is without YSDL, only some of the schema subtrees are attached to non-root locations. As I said in the interim, YSDL is just an externally specified augment.  
>

But the same applies here. This discussion is about how to arrange
things such that _old_ clients that do not understand mounts break.
At least that is what I thought.

> Take the rtgyangdt model, for example. If a mounting mechanism is in place, a client that doesn't understand it will only see a void top-level structure, which is hardly useful.

Yes, but it does not _break_ an old client (which likely is not
interested at all in the stuff it does not understand).
 
> > understand which schema is 'loosened'? Can you give me an example of
> 
> Loosened means exactly that anydata is used. For example, a rogue client may use it to send data that test the robustness of the server's Unicode implementation.

We have been there. Since the server understands the model, the server
will reject bad input.
 
> For instance, a server implementor can place a rock-solid off-the-shelf RELAX NG validator in front of the backend and rely on it to catch everything that violates the schema. If anydata is involved, the RELAX NG validator will, well, relax, and pass everything to the backend.
>

Again, the server understands the data model, it will not implement
anydata.

> > 'partial' compatibility and 'loosened' schema? Do you have a counter
> > proposal that avoids these issues?
> 
> Sure: avoid anydata, and forget about supporting clients that don't understand mounts.

So you propose a flag day from which on all clients must support
mounts? Not very realistic I think.

I believe not breaking existing clients is a key requirement in order
to allow incremental deployment of new features.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <http://www.jacobs-university.de/>