Re: [netmod] WHEN statement within mandatory objects doesn't ensure presence of the mandatory object

Andy Bierman <andy@yumaworks.com> Thu, 11 October 2018 18:48 UTC

Return-Path: <andy@yumaworks.com>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3250212008A for <netmod@ietfa.amsl.com>; Thu, 11 Oct 2018 11:48:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=yumaworks-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q9ae_CK7JRqc for <netmod@ietfa.amsl.com>; Thu, 11 Oct 2018 11:48:17 -0700 (PDT)
Received: from mail-lj1-x242.google.com (mail-lj1-x242.google.com [IPv6:2a00:1450:4864:20::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47846130ED0 for <netmod@ietf.org>; Thu, 11 Oct 2018 11:48:15 -0700 (PDT)
Received: by mail-lj1-x242.google.com with SMTP id 63-v6so9193626ljs.4 for <netmod@ietf.org>; Thu, 11 Oct 2018 11:48:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yumaworks-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=0bmAysdM6iFX5cPTXD94UpycqPc2a+4nRYT/IBOpvHs=; b=Eq99R/TjmsIw3vao4kGR/Ab1jqtgSxRu2fw6WF5PENSzbbh4Mo5rdE4bP2uwHHFWgY eKKRInp5H7l1RqLD9D5QjckIcZFIrVxJMvtvnXz0MczDEQounEQ2fJpZi8eh8NiVN//y CORWm18c3uaWc2+aLopvSJp46CL5MoUfIfcRhzqGlp9hItM/DFBzU5sRu9/HNv9UcFsd gXOyxajwBmFhZBG+TBSbZNbzkPmbyBjyQjEO+02M0AHoe72N29f+nl/n860zzYsYbZlv R50+MFPnLwOsRBoE0K0Xjo2Dk1IsJcrqFY4xNQaEMjJFwekCff7aS7enviiNSDWQm1d/ DCGg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=0bmAysdM6iFX5cPTXD94UpycqPc2a+4nRYT/IBOpvHs=; b=JBE3LEi69n2bV0g9t1/YF1s4t7WqGynQkUgaVZyvIMgaUcrjtL6/jyelypqjmQG2wT ALrnvZDV7BByWB/4wYPOPxRRavYxwfOjSO70VDEEGqkrxBcx1bd/OQi87T7xsYZeoYyJ rjL/3cOiP/X8i6hZ1eGKedCaS7EgbjRTqofPWcA7mHm9xlS1qxCS/CB2Y31U7LNofegU X3efn0UF5QIwlrByXubATHtzxF4COAOFi25gVqwSPowJbP19K+EbCxYV2t4F2ocH08I0 cE8nZ0LhYeEIY8Tc3hlr97p/VoIlNXxnQhJDI58jT1u70eA1HPiJyZuL/v0TS353NoXA RBdQ==
X-Gm-Message-State: ABuFfoj2C4lc+bebAkTdHwzJCDlJB9kq00xtlAxKYkekdqLNs1NtJCMp MY6C8wiTE4jtpDqqEzdqAzD8iSqlfVGTPur2DqYEfw==
X-Google-Smtp-Source: ACcGV60seoxpJT2VELZanQrogmwVSa4FiSxJzD01GcHghMSux9MMfLpOuVgCmmQwK9obfcSG4BuMhywXJ9k9DFhStfM=
X-Received: by 2002:a2e:810e:: with SMTP id d14-v6mr1997693ljg.170.1539283693162; Thu, 11 Oct 2018 11:48:13 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a19:f811:0:0:0:0:0 with HTTP; Thu, 11 Oct 2018 11:48:12 -0700 (PDT)
In-Reply-To: <DB6PR06MB408599478F23AD524F2840BCE7E10@DB6PR06MB4085.eurprd06.prod.outlook.com>
References: <AM0PR06MB4083426FA0F1D3F6515F2ECFE7E70@AM0PR06MB4083.eurprd06.prod.outlook.com> <87zhvlvpts.fsf@nic.cz> <AM0PR06MB40833D8AED0744BB597394E7E7E00@AM0PR06MB4083.eurprd06.prod.outlook.com> <d322e012-2767-a045-767a-ddf57649f36e@cisco.com> <AM0PR06MB4083B172F2424F1EEF08CFA0E7E00@AM0PR06MB4083.eurprd06.prod.outlook.com> <20181010182529.rhbu56qx4ogpb3st@anna.jacobs.jacobs-university.de> <AM0PR06MB4083AB058834759ECEA3FEEEE7E00@AM0PR06MB4083.eurprd06.prod.outlook.com> <CABCOCHQKz-S2jcqeoJCtuG9U0DxOOw4musJz4DzwEtbCrEjqYA@mail.gmail.com> <DB6PR06MB4085D91F66023AC98122FEDFE7E10@DB6PR06MB4085.eurprd06.prod.outlook.com> <CABCOCHRR92w3ouFmi6igg+AN=TM7BKfnaMiweOPxq_t9WTvvyg@mail.gmail.com> <DB6PR06MB408599478F23AD524F2840BCE7E10@DB6PR06MB4085.eurprd06.prod.outlook.com>
From: Andy Bierman <andy@yumaworks.com>
Date: Thu, 11 Oct 2018 11:48:12 -0700
Message-ID: <CABCOCHT4fTtQGOmhN0-nbqQx3ebCm-rtJuVwL_CWa3NyhCB+DA@mail.gmail.com>
To: Michael Rehder <Michael.Rehder@amdocs.com>
Cc: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>, "Walker, Jason (Jason_Walker2@comcast.com)" <Jason_Walker2@comcast.com>, "netmod@ietf.org" <netmod@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000bd700e0577f86945"
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/fWLXZgx8QJow6zm8xys4U1otejs>
Subject: Re: [netmod] WHEN statement within mandatory objects doesn't ensure presence of the mandatory object
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Oct 2018 18:48:21 -0000

On Thu, Oct 11, 2018 at 11:14 AM, Michael Rehder <Michael.Rehder@amdocs.com>
wrote:

> There is no specific text - the text just says it is “conditional”.
>
> However the implementation forces it optional:
>
> -          The RNG file makes it optional (I’m not actually running this
> for various reasons so I’m just interpreting the file generated – maybe I
> misunderstand RNG)
>
> -          Schematron doesn’t check for its existence (like it does for a
> mandatory choice case)
>
>
>

So change the implementation so it conforms to the spec.



> Thanks
>
> Mike
>

Andy


>
>
> *From:* Andy Bierman [mailto:andy@yumaworks.com]
> *Sent:* Thursday, October 11, 2018 2:06 PM
> *To:* Michael Rehder <Michael.Rehder@Amdocs.com>
> *Cc:* Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>de>;
> Walker, Jason (Jason_Walker2@comcast.com) <Jason_Walker2@comcast.com>om>;
> netmod@ietf.org
> *Subject:* Re: [netmod] WHEN statement within mandatory objects doesn't
> ensure presence of the mandatory object
>
>
>
>
>
>
>
> On Thu, Oct 11, 2018 at 11:00 AM, Michael Rehder <
> Michael.Rehder@amdocs.com> wrote:
>
> I think the wording is relevant - something can be conditional but still
> required.
>
> It should be clarified that elements become implicitly “mandatory false”
> when a “when” statement is used.
>
>
>
> I would like to see an enhancement to YANG to control this behavior, to
> allow the mandatory status to be enforced.
>
> That is, support also “conditionally required” instead of only the current
> “conditionally optional”.
>
>
>
>
>
>
>
>   leaf foo {
>
>      when "../some-other-node = 5";
>
>      type int32;
>
>      mandatory true;
>
>  }
>
>
>
>
>
> This leaf is mandatory if the when-expr is true.
>
> Where is the text in 7950 that says this mandatory true is ignored if
> when-stmt is present?
>
>
>
>
>
>
>
> Thanks
>
> Mike
>
>
>
> Andy
>
>
>
>
>
>
>
> *From:* Andy Bierman [mailto:andy@yumaworks.com]
> *Sent:* Wednesday, October 10, 2018 2:52 PM
> *To:* Michael Rehder <Michael.Rehder@Amdocs.com>
> *Cc:* Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>de>;
> Walker, Jason (Jason_Walker2@comcast.com) <Jason_Walker2@comcast.com>om>;
> netmod@ietf.org
> *Subject:* Re: [netmod] WHEN statement within mandatory objects doesn't
> ensure presence of the mandatory object
>
>
>
>
>
>
>
> On Wed, Oct 10, 2018 at 11:44 AM, Michael Rehder <
> Michael.Rehder@amdocs.com> wrote:
>
> Sure.
>
> I think the RFC is unclear since it seems that the semantics are
> consistent in the back-end checks.
> One can read the RFC and not notice by its absence that the when clause
> doesn't require anything to be present.
>
>      The "when" statement makes its parent data definition statement
> conditional.
> Should be
>     The "when" statement makes its parent data definition statement
> conditional and optional.
>
>
>
> This is not correct.
>
>
>
> Step 1) if-feature makes the schema node conditional
>
>
>
> Step 2) when-stmt makes instances of the schema-node conditional
>
>
>
> Step 3) YANG validation applies to instances of data nodes (or the YANG
> default value if applicable)
>
>
>
> Step 2 is only relevant if Step 1 is true or non-existent
>
> Step 3 is only relevant if Step 2 is true or non-existent
>
>
>
> Andy
>
>
>
>
>
> I think there should be a more definite statement about this overriding
> any mandatory status of the parent data definition statement.
> Like
>      "Any mandatory status of the parent data definition statement
> (mandatory statement, min-element statement etc.) is overridden by this
> statement and made non-mandatory."
>
> That would have made the side-effect of "when" on other declarations
> clearer.
>
> Thanks
> mike
> > -----Original Message-----
> > From: Juergen Schoenwaelder [mailto:j.schoenwaelder@jacobs-university.de
> ]
> > Sent: Wednesday, October 10, 2018 2:25 PM
> > To: Michael Rehder <Michael.Rehder@Amdocs.com>
> > Cc: Robert Wilton <rwilton@cisco.com>om>; Ladislav Lhotka <lhotka@nic.cz>cz>;
> > netmod@ietf.org; Walker, Jason (Jason_Walker2@comcast.com)
> > <Jason_Walker2@comcast.com>
> > Subject: Re: [netmod] WHEN statement within mandatory objects doesn't
> > ensure presence of the mandatory object
> >
> > Michael,
> >
> > what matters here is what the YANG specification (RFC 7950) says. Is
> there a
> > reason to believe the IPAddresses list in your example can be absent or
> have no
> > elements based on what RFC 7950 says? Or do we talk about a shortcoming
> of
> > RFC 6110?
> >
> > /js
> >
> > On Wed, Oct 10, 2018 at 06:17:26PM +0000, Michael Rehder wrote:
> > > If the list has a "when" clause the RNG file actually produces a
> "OneOrMore"
> > which has a choice of <empty> or the list so it actually doesn't enforce
> the
> > presence at least one row of the list (unless I'm mistaken in my
> reading).
> > >               <oneOrMore>
> > >                 <choice>
> > >                   <empty/>
> > >                   <element name="IPAddresses">
> > >                     <element name="Address">
> > >                       <ref name="types__IPv4Address"/>
> > >                     </element>
> > >                     <empty/>
> > >                   </element>
> > >                 </choice>
> > >               </oneOrMore>
> > >
> > > A leaf/container would be a simpler example but would result in the
> same
> > lack of enforcement of the mandatory status of an element with a "when"
> > clause.
> > >
> > > This RNG seems consistent with the Schematron rules that "when" makes
> > something optional.
> > >
> > >
> > > I think a workaround would be choice with mandatory true and a when
> clause
> > on the cases. This would ensure that at least one case is present since
> the
> > mandatory clause implements a Schematron existence constraint.
> > >
> > > Thanks
> > > Mike
> > > > -----Original Message-----
> > > > From: Robert Wilton [mailto:rwilton@cisco.com]
> > > > Sent: Wednesday, October 10, 2018 11:33 AM
> > > > To: Michael Rehder <Michael.Rehder@Amdocs.com>om>; Ladislav Lhotka
> > > > <lhotka@nic.cz>cz>; netmod@ietf.org
> > > > Cc: Walker, Jason (Jason_Walker2@comcast.com)
> > > > <Jason_Walker2@comcast.com>
> > > > Subject: Re: [netmod] WHEN statement within mandatory objects
> > > > doesn't ensure presence of the mandatory object
> > > >
> > > > Hi Mike,
> > > >
> > > > I think that the YANG below already enforces what you want, or
> > > > otherwise I don't follow your issue.
> > > >
> > > > The YANG below is valid in two cases:
> > > >
> > > > (1) AssignmentMechanism = DHCP, and IPAddresses is not present in
> > > > the config (due to the when statement).
> > > > (2) AssignmentMechanism = Static, IPAddresses exists and has at
> > > > least one element (due to min-elements 1).
> > > >
> > > > Thanks,
> > > > Rob
> > > >
> > > >
> > > > On 10/10/2018 16:23, Michael Rehder wrote:
> > > > > Container "foo" would be mandatory if not for the "when" child
> element.
> > > > > With the "when" child element, the logic becomes "inverted" and
> > > > > the
> > > > constraint is a negative one of "disallowed under certain condition".
> > > > >
> > > > > The UC is for enforcement in REST API payloads.
> > > > > For a practical example:
> > > > >
> > > > >           leaf AssignmentMechanism {
> > > > >              type enumeration {
> > > > >                enum "DHCP";
> > > > >                enum "Static";
> > > > >              }
> > > > >              mandatory true;
> > > > >              description "The address assignment mechanism.";
> > > > >            }
> > > > >            list IPAddresses {
> > > > >              when "../AssignmentMechanism = 'Static'";
> > > > >              key Address;
> > > > >              min-elements 1;
> > > > >
> > > > >              leaf Address {
> > > > >                type capit:IPv4Address;
> > > > >                description "An ipv4 address.";
> > > > >              }
> > > > >             }
> > > > >
> > > > > There is no way in the IPAddresses list to enforce that there is
> > > > > at least one IP
> > > > Address when the assignment method is "Static".
> > > > > One could put a "must" on "AssignmentMechanism" to ensure at least
> > > > > one
> > > > element of the IPAddresses list when "Static", but I don't see this
> > > > as a good schema design, to have the controlling attribute check
> controlled
> > attributes.
> > > > >
> > > > > I appreciate that this semantic can't be changed in YANG at this
> point.
> > > > > Could the "when" statement have a modifying child element to state
> > > > > that the
> > > > mandatory status of the element is to be enforced?
> > > > > Like
> > > > >      container foo {
> > > > >        when "condition" {
> > > > >            enforce-mandatory-status;
> > > > >        }
> > > > >
> > > > > There is already back-end for existential checks for mandatory
> > > > > choice so this
> > > > seems reasonably consistent to me.
> > > > > I appreciate there are existing issues for "when" but I don't see
> > > > > why this
> > > > would make things any worse.
> > > > > In fact by promoting a better dependency "direction" between
> > > > > schema
> > > > elements,  think it could simplify things (so I naively think :) ).
> > > > >
> > > > > Thanks
> > > > > Mike
> > > > >> -----Original Message-----
> > > > >> From: Ladislav Lhotka [mailto:lhotka@nic.cz]
> > > > >> Sent: Wednesday, October 10, 2018 10:28 AM
> > > > >> To: Michael Rehder <Michael.Rehder@Amdocs.com>om>; netmod@ietf.org
> > > > >> Subject: Re: [netmod] WHEN statement within mandatory objects
> > > > >> doesn't ensure presence of the mandatory object
> > > > >>
> > > > >> Michael Rehder <Michael.Rehder@Amdocs.com> writes:
> > > > >>
> > > > >>> I have a question about “when” and mandatory objects.
> > > > >>>
> > > > >>> It seems to me that the implemented semantics of “when” are
> > > > >>> really
> > > > >> “optional when”, in that the enclosing object can be absent even
> > > > >> though it is mandatory and the “when” clause holds true.
> > > > >>> The RFC could be clearer about this.
> > > > >>>
> > > > >>> Example
> > > > >>>
> > > > >>>     leaf color {
> > > > >>>       enumeration  {
> > > > >>>          enum “blue”;
> > > > >>>          enum “black”;
> > > > >>>       }
> > > > >>>       mandatory true;
> > > > >>>     }
> > > > >>>     container foo {
> > > > >>>        when ../color = ‘blue’;
> > > > >>>        etc.
> > > > >>>     }
> > > > >>>
> > > > >>> “foo” is optional due to the presence of the “when” statement
> > > > >>> even though the object is mandatory (same is true for mandatory
> > > > >>> leaf,
> > > > >>> min-elements=1 list etc.).
> > > > >> Maybe you intended to have, e.g., a "mandatory true" leaf inside
> > > > >> "container foo"?
> > > > >>
> > > > >>> This is considered valid XML for the above
> > > > >>>      <color>blue</color>
> > > > >> Yes, it is, under current YANG rules, no matter what "etc."
> > > > >> stands for. Note that evaluation of the XPath expression in this
> > > > >> case (with "foo" missing) requires the peculiar procedure of sec.
> 7.21.5
> > in RFC 7950.
> > > > >>
> > > > >>> In my view this makes conditionally variant schemas “loose” in
> > > > >>> their enforcement (some scenarios can use choice but it doesn’t
> > > > >>> cover everything).
> > > > >>>
> > > > >>> I think that mandatory should be respected for the enclosing
> > > > >>> objects of a “when” statement.  That is, a mandatory object must
> > > > >>> be present when its “when” clause holds true and a Schematron
> > > > >>> statement should enforce that.
> > > > >> In fact, this is one case where the DSDL mapping (RFC 6110)
> > > > >> deviates from YANG 1.0. Nodes that mandatory aren't enclosed in
> > > > >> the RELAX NG <optional> pattern, and are then required no matter
> what
> > any "when"
> > > > >> statements say (because RELAX NG validation comes before
> > Schematron).
> > > > >>
> > > > >>> What is the rationale behind the current YANG rules behavior,
> > > > >>> that the “when” Schematron mapping doesn’t check for presence of
> > > > >>> the enclosing mandatory object?
> > > > >> FWIW, I have been repeatedly protesting against this behaviour
> > > > >> but without much luck. See for example
> > > > >>
> > > > >> https://www.ietf.org/mail-archive/web/netmod/current/msg14012.htm
> > > > >> l
> > > > >>
> > > > >> As a result, "when" is the trickiest feature in YANG by far.
> > > > >>
> > > > >> Lada
> > > > >>
> > > > >>> thanks
> > > > >>> Mike Rehder
> > > > >> --
> > > > >> Ladislav Lhotka
> > > > >> Head, CZ.NIC Labs
> > > > >> PGP Key ID: 0xB8F92B08A9F76C67
> > > > > “Amdocs’ email platform is based on a third-party, worldwide,
> > > > > cloud-based
> > > > system. Any emails sent to Amdocs will be processed and stored using
> > > > such system and are accessible by third party providers of such
> > > > system on a limited basis. Your sending of emails to Amdocs
> > > > evidences your consent to the use of such system and such processing,
> > storing and access”.
> > > > > _______________________________________________
> > > > > netmod mailing list
> > > > > netmod@ietf.org
> > > > > https://www.ietf.org/mailman/listinfo/netmod
> > >
> > > “Amdocs’ email platform is based on a third-party, worldwide,
> cloud-based
> > system. Any emails sent to Amdocs will be processed and stored using such
> > system and are accessible by third party providers of such system on a
> limited
> > basis. Your sending of emails to Amdocs evidences your consent to the
> use of
> > such system and such processing, storing and access”.
> > > _______________________________________________
> > > netmod mailing list
> > > netmod@ietf.org
> > > https://www.ietf.org/mailman/listinfo/netmod
> >
> > --
> > Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> > Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
> <https://maps.google.com/?q=Campus+Ring+1+%7C+28759+Bremen+%7C+Germany&entry=gmail&source=g>
> > Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>
> “Amdocs’ email platform is based on a third-party, worldwide, cloud-based
> system. Any emails sent to Amdocs will be processed and stored using such
> system and are accessible by third party providers of such system on a
> limited basis. Your sending of emails to Amdocs evidences your consent to
> the use of such system and such processing, storing and access”.
> _______________________________________________
> netmod mailing list
> netmod@ietf.org
> https://www.ietf.org/mailman/listinfo/netmod
>
>
>
> *“Amdocs’ email platform is based on a third-party, worldwide, cloud-based
> system. Any emails sent to Amdocs will be processed and stored using such
> system and are accessible by third party providers of such system on a
> limited basis. Your sending of emails to Amdocs evidences your consent to
> the use of such system and such processing, storing and access”.*
>
>
>
> *“Amdocs’ email platform is based on a third-party, worldwide, cloud-based
> system. Any emails sent to Amdocs will be processed and stored using such
> system and are accessible by third party providers of such system on a
> limited basis. Your sending of emails to Amdocs evidences your consent to
> the use of such system and such processing, storing and access”.*
>