Re: [netmod] Last Call: draft-ietf-netmod-snmp-cfg-03 (20131220)

[Martin Bjorklund <[e-mail]>]

"Randy Presuhn" <[e-mail]> wrote:
> Hi -
> 
> > From: "Martin Bjorklund" <[e-mail]>
> > To: <[e-mail]>
> > Cc: <[e-mail]>
> > Sent: Monday, January 06, 2014 1:53 PM
> > Subject: Re: [netmod] Last Call: draft-ietf-netmod-snmp-cfg-03 (20131220)
> ...
> > What do you mean by a "group which does not exist"?  
> > 
> > Maybe you can provide an example (MIB) configuration that is not
> > possible to express in the YANG model?  (assuming also that we remove
> > the min-elements constraint from the "member" list).
> 
> Sure.  An instance of  vacmGroupName with value "TBD",
> when no entry exists in vacmAccessTable with such a value.
> Note that this is explicitly permitted by the definitions of
> vacmGroupName.

This is expressable, see below.

> > > If VACM has been configured with one or more users referring
> > > to groups that don't happen to exist at the moment, a fairly
> > > reasonable thing to do, the Yang/Netconf interface cannot
> > > represent that configuration.
> > 
> > If you mean an entry in vacmSecurityToGroupTable with a vacmGroupName
> > that does not exist in vacmAccessTable, this is possible to express
> > with the YANG model.
> 
> Cool.  I couldn't see how the Yang model would allow it, since the
> list "member" 
> is contained by the list "group".  Could you explain how one could create
> a "member" without creating the containing "group"?

That's not what I wrote.  Let's be concrete.

  vacmGroupName.3.3.b.o.b = TBD
  vacmGroupName.3.5.a.l.i.c.e = TBD

can be represented as

  <group>
    <name>TBD</name>
    <member>
      <security-name>alice</security-name>
      <security-model>usm</security-model>
    </member>
    <member>
      <security-name>bob</security-name>
      <security-model>usm</security-model>
    </member>
  </group>


/martin