Re: [netmod] Alternative approach to draft-ma-netmod-immutable-flag-00

[Andy Bierman <[e-mail]>]

On Thu, Mar 24, 2022 at 10:14 AM Balázs Lengyel <[e-mail]>
wrote:

> As mentioned earlier immutable is not enough for predefined NACM rules
>
> because the client may always
>
> insert a rule(-list) before the immutable rule(s) that will make the
> immutable
>
> rules ineffective. The problem is that the rule(-sets) are a user ordered
> list
>
> where the order matters. It is not enough to protect the individual
> rule(sets)
>
> the order would also need protection.
>


The NMDA solution would be to simply list the effective rule-lists in
<operational>.
The server rule-list will always be first in <operational> and not even
exist in <intended>.

I think a standard solution has a higher bar than our proprietary
extensions.
The interactions with NACM need to be properly handled.

IMO a proper solution would be an update to NACM itself.
The reason nacm:default-deny-write and nacm:default-deny-all work,
even though they are optional extensions, is because they are mandatory
extensions
if NACM is supported.

A nacm:static-data extension would be similar to the other 2 extensions.
They are short-hand automatic NACM rules.
NACM itself explains how they are handled so there is no conflict with
user-provided rule-lists.




> Balazs
>

Andy


>
>
> *From:* maqiufang (A) <maqiufang1=[e-mail]>
> *Sent:* Thursday, 24 March, 2022 15:23
> *To:* Andy Bierman <[e-mail]>
> *Cc:* Balázs Lengyel <[e-mail]>; Kent Watsen <
> [e-mail]>; NETMOD Group <[e-mail]>
> *Subject:* RE: [netmod] Alternative approach to
> draft-ma-netmod-immutable-flag-00
>
>
>
> Hi, Andy, Balazs,
>
>
>
> I can see your points in some of the use cases.
>
> But as Kent mentioned, the motivation of this work is that we have some
> system-defined instance which are read-only to clients.
>
> And there may be some cases where a list/leaf-list data node may exist in
> multiple instances with different control rules.
>
>
>
> To be specific, An instance-level annotation could be useful in following
> use cases:
>
> a)      The system generates some QoS templates when QoS functionality is
> enabled, and some of the generated templates are read-only, while others
> are free to be updated by the clients.
>
> b)     The system predefines some list/leaf-list instances which are
> read-only for clients(the clients cannot update or delete them, like
> predefined NACM rules), but the clients is free to add/update/delete their
> own defined instances.
>
>
>
> While YANG-extension can be useful for a schema-level immutability.
>
> I am thinking that, maybe we need both to complete the solution?
>
>
>
> Best Regards,
>
> Qiufang
>
>
>
> *From:* netmod [mailto:[e-mail] <[e-mail]>] *On
> Behalf Of *Andy Bierman
> *Sent:* Thursday, March 24, 2022 7:14 AM
> *To:* Balázs Lengyel <[e-mail]>
> *Cc:* NetMod WG <[e-mail]>
> *Subject:* Re: [netmod] Alternative approach to
> draft-ma-netmod-immutable-flag-00
>
>
>
>
>
>
>
> On Wed, Mar 23, 2022 at 3:06 PM Balázs Lengyel <
> [e-mail]> wrote:
>
>
>
>
>
> *From:* Andy Bierman <[e-mail]>
> *Sent:* Wednesday, 23 March, 2022 22:32
> *To:* Balázs Lengyel <[e-mail]>
> *Cc:* NetMod WG <[e-mail]>
> *Subject:* Re: [netmod] Alternative approach to
> draft-ma-netmod-immutable-flag-00
>
>
>
>
>
>
>
> On Wed, Mar 23, 2022 at 2:16 PM Balázs Lengyel <
> [e-mail]> wrote:
>
> Hello Andy,
>
> I also propose an extension. (see my mail Review of
> draft-ma-netmod-immutable-flag-00)
>
> In Ericsson we saw no need for exceptions, but do see the need for
> applying it to descendant nodes. Typically we need to protect a full
> subtree.
>
>
>
> Why do you need the exceptions? Could you provide some use-case examples ?
>
>
>
> I think create/delete-only and modify-only access modes are used the most,
> after no-access.
>
> BALAZS: How is a modify-only data-node different from a mandatory
> data-node? It must be there but can be changed. It get’s an initial value
> somehow.
>
>
>
> Mandatory=true requires the system to provide a value.
>
> Modify-only allows the system to decide when an instance is created.
>
>
>
>
>
> BALAZS: Any examples when would a create/delete only data node be used?
>
>
>
> Sometimes developers do not want to write complex instrumentation that
> supports
>
> modification of resources.  Instead a user has to delete the old entry and
> create a new
>
> one with (potentially) different parameters.
>
>
>
>
>
>
>
> Applying to descendant nodes may be better, or may require more work to
>
> undo the extension used in an ancestor node. This impacts the extension
> usage within a grouping.
>
>
>
> BALAZS2: I did not include it in my mail, but we actually have one more
> rule:
>
> “Top level statements in augment or groupings do NOT inherit
>
>        the static-data value from containing nodes, they default to
>
>        static-data false.”
>
>
>
>
>
> This seems complicated to users and developers to track how the final
> schema tree was derived.
>
>
>
> The 'static-data' extension seems fine to me.
>
> We have to support 'user-write' anyways, so it is better if it is not too
> close to this extension.
>
> Things that seem the same, but are NOT the same cause the most support
> tickets.
>
>
>
>
>
> Regards Balazs
>
>
>
> Andy
>
>
>
> Andy
>
>
>
>
>
>
>
>
>
> *From:* netmod <[e-mail]> *On Behalf Of *Andy Bierman
> *Sent:* Wednesday, 23 March, 2022 21:10
> *To:* NetMod WG <[e-mail]>
> *Subject:* [netmod] Alternative approach to
> draft-ma-netmod-immutable-flag-00
>
>
>
> Hi,
>
>
>
> IMO the problem should be viewed as a refinement to the
>
> access control policy of the device.  A standard mechanism
>
> such as a YANG extension would be better than a growing
>
> mix of proprietary solutions.
>
>
>
> We have such a YANG extension called "user-write" that is widely deployed.
>
> A simple boolean is not fine enough granularity, so a bits type is
>
> needed instead to allow control of create, update, and delete access
> operations.
>
>
>
>
>
>
> https://www.yumaworks.com/pub/latest/yangauto/yumapro-yangauto-guide.html#ncx-user-write
> <https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-876c03f0bc610d95&q=1&e=c875257e-41f5-45d6-a9e9-871e5ebb4243&u=https%3A%2F%2Fwww.yumaworks.com%2Fpub%2Flatest%2Fyangauto%2Fyumapro-yangauto-guide.html%23ncx-user-write>
>
>
>
>
>
> Andy
>
>
>
>