Re: [netmod] WHEN statement within mandatory objects doesn't ensure presence of the mandatory object

[Michael Rehder <[e-mail]>]

There is no specific text - the text just says it is “conditional”.
However the implementation forces it optional:

-          The RNG file makes it optional (I’m not actually running this for various reasons so I’m just interpreting the file generated – maybe I misunderstand RNG)

-          Schematron doesn’t check for its existence (like it does for a mandatory choice case)

Thanks
Mike

From: Andy Bierman [mailto:[e-mail]]
Sent: Thursday, October 11, 2018 2:06 PM
To: Michael Rehder <[e-mail]>
Cc: Juergen Schoenwaelder <[e-mail]>; Walker, Jason ([e-mail]) <[e-mail]>; [e-mail]
Subject: Re: [netmod] WHEN statement within mandatory objects doesn't ensure presence of the mandatory object



On Thu, Oct 11, 2018 at 11:00 AM, Michael Rehder <[e-mail]<mailto:[e-mail]>> wrote:
I think the wording is relevant - something can be conditional but still required.
It should be clarified that elements become implicitly “mandatory false” when a “when” statement is used.

I would like to see an enhancement to YANG to control this behavior, to allow the mandatory status to be enforced.
That is, support also “conditionally required” instead of only the current “conditionally optional”.



  leaf foo {
     when "../some-other-node = 5";
     type int32;
     mandatory true;
 }


This leaf is mandatory if the when-expr is true.
Where is the text in 7950 that says this mandatory true is ignored if when-stmt is present?



Thanks
Mike

Andy



From: Andy Bierman [mailto:[e-mail]<mailto:[e-mail]>]
Sent: Wednesday, October 10, 2018 2:52 PM
To: Michael Rehder <[e-mail]<mailto:[e-mail]>>
Cc: Juergen Schoenwaelder <[e-mail]<mailto:[e-mail]>>; Walker, Jason ([e-mail]<mailto:[e-mail]>) <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: Re: [netmod] WHEN statement within mandatory objects doesn't ensure presence of the mandatory object



On Wed, Oct 10, 2018 at 11:44 AM, Michael Rehder <[e-mail]<mailto:[e-mail]>> wrote:
Sure.

I think the RFC is unclear since it seems that the semantics are consistent in the back-end checks.
One can read the RFC and not notice by its absence that the when clause doesn't require anything to be present.

     The "when" statement makes its parent data definition statement conditional.
Should be
    The "when" statement makes its parent data definition statement conditional and optional.

This is not correct.

Step 1) if-feature makes the schema node conditional

Step 2) when-stmt makes instances of the schema-node conditional

Step 3) YANG validation applies to instances of data nodes (or the YANG default value if applicable)

Step 2 is only relevant if Step 1 is true or non-existent
Step 3 is only relevant if Step 2 is true or non-existent

Andy


I think there should be a more definite statement about this overriding any mandatory status of the parent data definition statement.
Like
     "Any mandatory status of the parent data definition statement (mandatory statement, min-element statement etc.) is overridden by this statement and made non-mandatory."

That would have made the side-effect of "when" on other declarations clearer.

Thanks
mike
> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:[e-mail]<mailto:[e-mail]>]
> Sent: Wednesday, October 10, 2018 2:25 PM
> To: Michael Rehder <[e-mail]<mailto:[e-mail]>>
> Cc: Robert Wilton <[e-mail]<mailto:[e-mail]>>; Ladislav Lhotka <[e-mail]<mailto:[e-mail]>>;
> [e-mail]<mailto:[e-mail]>; Walker, Jason ([e-mail]<mailto:[e-mail]>)
> <[e-mail]<mailto:[e-mail]>>
> Subject: Re: [netmod] WHEN statement within mandatory objects doesn't
> ensure presence of the mandatory object
>
> Michael,
>
> what matters here is what the YANG specification (RFC 7950) says. Is there a
> reason to believe the IPAddresses list in your example can be absent or have no
> elements based on what RFC 7950 says? Or do we talk about a shortcoming of
> RFC 6110?
>
> /js
>
> On Wed, Oct 10, 2018 at 06:17:26PM +0000, Michael Rehder wrote:
> > If the list has a "when" clause the RNG file actually produces a "OneOrMore"
> which has a choice of <empty> or the list so it actually doesn't enforce the
> presence at least one row of the list (unless I'm mistaken in my reading).
> >               <oneOrMore>
> >                 <choice>
> >                   <empty/>
> >                   <element name="IPAddresses">
> >                     <element name="Address">
> >                       <ref name="types__IPv4Address"/>
> >                     </element>
> >                     <empty/>
> >                   </element>
> >                 </choice>
> >               </oneOrMore>
> >
> > A leaf/container would be a simpler example but would result in the same
> lack of enforcement of the mandatory status of an element with a "when"
> clause.
> >
> > This RNG seems consistent with the Schematron rules that "when" makes
> something optional.
> >
> >
> > I think a workaround would be choice with mandatory true and a when clause
> on the cases. This would ensure that at least one case is present since the
> mandatory clause implements a Schematron existence constraint.
> >
> > Thanks
> > Mike
> > > -----Original Message-----
> > > From: Robert Wilton [mailto:[e-mail]<mailto:[e-mail]>]
> > > Sent: Wednesday, October 10, 2018 11:33 AM
> > > To: Michael Rehder <[e-mail]<mailto:[e-mail]>>; Ladislav Lhotka
> > > <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
> > > Cc: Walker, Jason ([e-mail]<mailto:[e-mail]>)
> > > <[e-mail]<mailto:[e-mail]>>
> > > Subject: Re: [netmod] WHEN statement within mandatory objects
> > > doesn't ensure presence of the mandatory object
> > >
> > > Hi Mike,
> > >
> > > I think that the YANG below already enforces what you want, or
> > > otherwise I don't follow your issue.
> > >
> > > The YANG below is valid in two cases:
> > >
> > > (1) AssignmentMechanism = DHCP, and IPAddresses is not present in
> > > the config (due to the when statement).
> > > (2) AssignmentMechanism = Static, IPAddresses exists and has at
> > > least one element (due to min-elements 1).
> > >
> > > Thanks,
> > > Rob
> > >
> > >
> > > On 10/10/2018 16:23, Michael Rehder wrote:
> > > > Container "foo" would be mandatory if not for the "when" child element.
> > > > With the "when" child element, the logic becomes "inverted" and
> > > > the
> > > constraint is a negative one of "disallowed under certain condition".
> > > >
> > > > The UC is for enforcement in REST API payloads.
> > > > For a practical example:
> > > >
> > > >           leaf AssignmentMechanism {
> > > >              type enumeration {
> > > >                enum "DHCP";
> > > >                enum "Static";
> > > >              }
> > > >              mandatory true;
> > > >              description "The address assignment mechanism.";
> > > >            }
> > > >            list IPAddresses {
> > > >              when "../AssignmentMechanism = 'Static'";
> > > >              key Address;
> > > >              min-elements 1;
> > > >
> > > >              leaf Address {
> > > >                type capit:IPv4Address;
> > > >                description "An ipv4 address.";
> > > >              }
> > > >             }
> > > >
> > > > There is no way in the IPAddresses list to enforce that there is
> > > > at least one IP
> > > Address when the assignment method is "Static".
> > > > One could put a "must" on "AssignmentMechanism" to ensure at least
> > > > one
> > > element of the IPAddresses list when "Static", but I don't see this
> > > as a good schema design, to have the controlling attribute check controlled
> attributes.
> > > >
> > > > I appreciate that this semantic can't be changed in YANG at this point.
> > > > Could the "when" statement have a modifying child element to state
> > > > that the
> > > mandatory status of the element is to be enforced?
> > > > Like
> > > >      container foo {
> > > >        when "condition" {
> > > >            enforce-mandatory-status;
> > > >        }
> > > >
> > > > There is already back-end for existential checks for mandatory
> > > > choice so this
> > > seems reasonably consistent to me.
> > > > I appreciate there are existing issues for "when" but I don't see
> > > > why this
> > > would make things any worse.
> > > > In fact by promoting a better dependency "direction" between
> > > > schema
> > > elements,  think it could simplify things (so I naively think :) ).
> > > >
> > > > Thanks
> > > > Mike
> > > >> -----Original Message-----
> > > >> From: Ladislav Lhotka [mailto:[e-mail]<mailto:[e-mail]>]
> > > >> Sent: Wednesday, October 10, 2018 10:28 AM
> > > >> To: Michael Rehder <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
> > > >> Subject: Re: [netmod] WHEN statement within mandatory objects
> > > >> doesn't ensure presence of the mandatory object
> > > >>
> > > >> Michael Rehder <[e-mail]<mailto:[e-mail]>> writes:
> > > >>
> > > >>> I have a question about “when” and mandatory objects.
> > > >>>
> > > >>> It seems to me that the implemented semantics of “when” are
> > > >>> really
> > > >> “optional when”, in that the enclosing object can be absent even
> > > >> though it is mandatory and the “when” clause holds true.
> > > >>> The RFC could be clearer about this.
> > > >>>
> > > >>> Example
> > > >>>
> > > >>>     leaf color {
> > > >>>       enumeration  {
> > > >>>          enum “blue”;
> > > >>>          enum “black”;
> > > >>>       }
> > > >>>       mandatory true;
> > > >>>     }
> > > >>>     container foo {
> > > >>>        when ../color = ‘blue’;
> > > >>>        etc.
> > > >>>     }
> > > >>>
> > > >>> “foo” is optional due to the presence of the “when” statement
> > > >>> even though the object is mandatory (same is true for mandatory
> > > >>> leaf,
> > > >>> min-elements=1 list etc.).
> > > >> Maybe you intended to have, e.g., a "mandatory true" leaf inside
> > > >> "container foo"?
> > > >>
> > > >>> This is considered valid XML for the above
> > > >>>      <color>blue</color>
> > > >> Yes, it is, under current YANG rules, no matter what "etc."
> > > >> stands for. Note that evaluation of the XPath expression in this
> > > >> case (with "foo" missing) requires the peculiar procedure of sec. 7.21.5
> in RFC 7950.
> > > >>
> > > >>> In my view this makes conditionally variant schemas “loose” in
> > > >>> their enforcement (some scenarios can use choice but it doesn’t
> > > >>> cover everything).
> > > >>>
> > > >>> I think that mandatory should be respected for the enclosing
> > > >>> objects of a “when” statement.  That is, a mandatory object must
> > > >>> be present when its “when” clause holds true and a Schematron
> > > >>> statement should enforce that.
> > > >> In fact, this is one case where the DSDL mapping (RFC 6110)
> > > >> deviates from YANG 1.0. Nodes that mandatory aren't enclosed in
> > > >> the RELAX NG <optional> pattern, and are then required no matter what
> any "when"
> > > >> statements say (because RELAX NG validation comes before
> Schematron).
> > > >>
> > > >>> What is the rationale behind the current YANG rules behavior,
> > > >>> that the “when” Schematron mapping doesn’t check for presence of
> > > >>> the enclosing mandatory object?
> > > >> FWIW, I have been repeatedly protesting against this behaviour
> > > >> but without much luck. See for example
> > > >>
> > > >> https://www.ietf.org/mail-archive/web/netmod/current/msg14012.htm
> > > >> l
> > > >>
> > > >> As a result, "when" is the trickiest feature in YANG by far.
> > > >>
> > > >> Lada
> > > >>
> > > >>> thanks
> > > >>> Mike Rehder
> > > >> --
> > > >> Ladislav Lhotka
> > > >> Head, CZ.NIC Labs
> > > >> PGP Key ID: 0xB8F92B08A9F76C67
> > > > “Amdocs’ email platform is based on a third-party, worldwide,
> > > > cloud-based
> > > system. Any emails sent to Amdocs will be processed and stored using
> > > such system and are accessible by third party providers of such
> > > system on a limited basis. Your sending of emails to Amdocs
> > > evidences your consent to the use of such system and such processing,
> storing and access”.
> > > > _______________________________________________
> > > > netmod mailing list
> > > > [e-mail]<mailto:[e-mail]>
> > > > https://www.ietf.org/mailman/listinfo/netmod
> >
> > “Amdocs’ email platform is based on a third-party, worldwide, cloud-based
> system. Any emails sent to Amdocs will be processed and stored using such
> system and are accessible by third party providers of such system on a limited
> basis. Your sending of emails to Amdocs evidences your consent to the use of
> such system and such processing, storing and access”.
> > _______________________________________________
> > netmod mailing list
> > [e-mail]<mailto:[e-mail]>
> > https://www.ietf.org/mailman/listinfo/netmod
>
> --
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany<https://maps.google.com/?q=Campus+Ring+1+%7C+28759+Bremen+%7C+Germany&entry=gmail&source=g>
> Fax:   [phone]         <https://www.jacobs-university.de/>
“Amdocs’ email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access”.
_______________________________________________
netmod mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/netmod


“Amdocs’ email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access”.

“Amdocs’ email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access”.