Re: [netmod] draft-bjorklund-netmod-structural-mount: Namespace issues

[Ladislav Lhotka <[e-mail]>]

> On 24 Mar 2016, at 14:13, Juergen Schoenwaelder <[e-mail]> wrote:
> 
> On Thu, Mar 24, 2016 at 12:56:40PM +0100, Ladislav Lhotka wrote:
>> Martin Bjorklund <[e-mail]> writes:
>> 
>>> The fact that anydata can represent "really anything" does not mean
>>> that every server MUST allow the client to create "really anything"
>>> for all anydata config nodes.  It will depend on the semantics of each
>>> particular anydata node.
>> 
>> Schema validation is effectively disabled for anydata nodes. This may be
>> a problem especially for implementations that perform validation as a
>> separate step, perhaps automatically from the data model.
>> 
>> And with schema validation out of the way, it is easier to exploit
>> potential bugs in the server.
>> 
> 
> Lada, as far as I recall you wrote an I-D that proposed to mount data
> anywhere. So what did change your mind that you now want strict schema
> validation?

With YSDL, the schema validation is absolutely strict: The server provides a list of modules and revisions in yang-library, and a recipe how the modules are combined. Everything is fixed and static, as it is without YSDL, only some of the schema subtrees are attached to non-root locations. As I said in the interim, YSDL is just an externally specified augment.  

> 
>>> I think that using mount-point as a substatement to anydata is in fact
>>> the only really safe option to mount.  Both the proposed solutions in
>> 
>> Well, if safe means (partial) compatibility of old clients - and I am
>> not even convinced about this. Otherwise it is IMO less safe because the
>> schema is loosened.
>> 
>>> the current structural mount and ysdl drafts are unsafe for clients
>>> that don't understand the mount.
>> 
>> True.
> 
> What do you mean with 'partial' compatibility? I also do not

Take the rtgyangdt model, for example. If a mounting mechanism is in place, a client that doesn't understand it will only see a void top-level structure, which is hardly useful.

> understand which schema is 'loosened'? Can you give me an example of

Loosened means exactly that anydata is used. For example, a rogue client may use it to send data that test the robustness of the server's Unicode implementation.

For instance, a server implementor can place a rock-solid off-the-shelf RELAX NG validator in front of the backend and rely on it to catch everything that violates the schema. If anydata is involved, the RELAX NG validator will, well, relax, and pass everything to the backend.

> 'partial' compatibility and 'loosened' schema? Do you have a counter
> proposal that avoids these issues?

Sure: avoid anydata, and forget about supporting clients that don't understand mounts.

Lada

> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   [phone]         <http://www.jacobs-university.de/>

--
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C