On 10/16/18 14:51, Eric Rescorla wrote: > OK, after reading your explanation and the example, I think I am clearer > on the use case and the text you propose seems appropriate. Why don't > you provide a new ID and I'll clear my DISCUSS
Thanks I think the authors will have that out shortly. joel > -Ekr > > > On Tue, Oct 16, 2018 at 9:05 AM joel jaeggli <joe...@gmail.com > <mailto:joe...@gmail.com>> wrote: > > On 10/16/18 06:00, Eric Rescorla wrote: > > I'm sorry, but I still don't think I understand the security > impacts of > > this well enough to know if this text is OK. > > > > Can you provide a more detailed explanation of what XPath expressions > > can and cannot do here? Happy to discuss live either on the phone > or in BKK > I'm probably grossly simplifying the goal here, but. > > xpath statement allow for referencing another path or applying > constraints e.g. when / must (rfc 6020) > > the canonical example in 6020 being something like > > container interface { > leaf ifType { > type enumeration { > enum ethernet; > enum atm; > } > } > leaf ifMTU { > type uint32; > } > must "ifType != 'ethernet' or " + > "(ifType = 'ethernet' and ifMTU = 1500)" { > error-message "An ethernet MTU must be 1500"; > } > must "ifType != 'atm' or " + > "(ifType = 'atm' and ifMTU <= 17966 and ifMTU >= 64)" { > error-message "An atm MTU must be 64 .. 17966"; > } > > > http://www.yang-central.org/twiki/pub/Main/YangDocuments/rfc6020.html#xpath > > Imposing constraints using nodes in mounted modules is kind of a key > application of schema-mount. > > > -Ekr > > > > > > On Tue, Oct 16, 2018 at 5:45 AM Martin Bjorklund <m...@tail-f.com > <mailto:m...@tail-f.com> > > <mailto:m...@tail-f.com <mailto:m...@tail-f.com>>> wrote: > > > > Hi, > > > > Eric Rescorla <e...@rtfm.com <mailto:e...@rtfm.com> > <mailto:e...@rtfm.com <mailto:e...@rtfm.com>>> wrote: > > > That seems like it's going to have some pretty surprising > > consequences and > > > at minimum needs more information in the Security > Considerations. > > > > Ok. Howabout we add a paragraph to the end of the Security > > Considerations section: > > > > Care must be taken when the "parent-reference" XPath > expressions are > > constructed, since the result of the evaluation of these > expressions > > is added to the accessible tree for any XPath expression > found in > > the mounted schema. > > > > > > /martin > > > > > On Thu, Oct 11, 2018 at 12:18 AM Martin Bjorklund > <m...@tail-f.com <mailto:m...@tail-f.com> > > <mailto:m...@tail-f.com <mailto:m...@tail-f.com>>> wrote: > > > > > > > Eric Rescorla <e...@rtfm.com <mailto:e...@rtfm.com> > <mailto:e...@rtfm.com <mailto:e...@rtfm.com>>> wrote: > > > > > I'm sorry but I don't understand this. > > > > > > > > > > Does the externally visible behavior of any mounted module > > depend in any > > > > > way on these XPATH references > > > > > > > > Yes, but note that these XPath expressions > ("parent-reference") are > > > > read-only (config false in the YANG model). Thus they are set > > by the > > > > implementation, and used to inform the operator about the > > environment > > > > in which other XPath expressions are evaluated. > > > > > > > > > > > > /martin > > > > > > > > > > > > > > > > > > -Ekr > > > > > > > > > > > > > > > > > > > > > > > > > On Wed, Oct 10, 2018 at 6:38 AM Martin Bjorklund > > <m...@tail-f.com <mailto:m...@tail-f.com> <mailto:m...@tail-f.com > <mailto:m...@tail-f.com>>> wrote: > > > > > > > > > > > Eric Rescorla <e...@rtfm.com <mailto:e...@rtfm.com> > <mailto:e...@rtfm.com <mailto:e...@rtfm.com>>> wrote: > > > > > > > On Wed, Oct 10, 2018 at 5:32 AM Martin Bjorklund > > <m...@tail-f.com <mailto:m...@tail-f.com> <mailto:m...@tail-f.com > <mailto:m...@tail-f.com>>> > > > > wrote: > > > > > > > > > > > > > > > Hi, > > > > > > > > > > > > > > > > Eric Rescorla <e...@rtfm.com <mailto:e...@rtfm.com> > <mailto:e...@rtfm.com <mailto:e...@rtfm.com>>> wrote: > > > > > > > > > Eric Rescorla has entered the following ballot > > position for > > > > > > > > > draft-ietf-netmod-schema-mount-11: Discuss > > > > > > > > > > > > > > > > > > When responding, please keep the subject line intact > > and reply > > > > to all > > > > > > > > > email addresses included in the To and CC lines. > (Feel > > free to > > > > cut > > > > > > this > > > > > > > > > introductory paragraph, however.) > > > > > > > > > > > > > > > > > > > > > > > > > > > Please refer to > > > > > > > > > https://www.ietf.org/iesg/statement/discuss-criteria.html > > > > > > > > > for more information about IESG DISCUSS and COMMENT > > positions. > > > > > > > > > > > > > > > > > > > > > > > > > > > The document, along with other ballot positions, can > > be found > > > > here: > > > > > > > > > > > https://datatracker.ietf.org/doc/draft-ietf-netmod-schema-mount/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ---------------------------------------------------------------------- > > > > > > > > > DISCUSS: > > > > > > > > > > > > > > > > > > ---------------------------------------------------------------------- > > > > > > > > > > > > > > > > > > Rich version of this review at: > > > > > > > > > https://mozphab-ietf.devsvcdev.mozaws.net/D3506 > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > DETAIL > > > > > > > > > S 4. > > > > > > > > > > > > > > > > > > > > It is worth emphasizing that the nodes > specified in > > > > > > > > > > "parent-reference" leaf-list are available in > > the mounted > > > > > > schema > > > > > > > > only > > > > > > > > > > for XPath evaluations. In particular, they > > cannot be > > > > accessed > > > > > > > > there > > > > > > > > > > via network management protocols such as > NETCONF > > > > [RFC6241] or > > > > > > > > > > RESTCONF [RFC8040]. > > > > > > > > > > > > > > > > > > What are the security implications of this XPath > reference > > > > outside > > > > > > the > > > > > > > > > mount jail? Specifically, how does it interact with > > the access > > > > > > control > > > > > > > > > for the enclosing module. > > > > > > > > > > > > > > > > There is no such interaction, since access control > comes > > into play > > > > > > > > when some external entity accesses the data > through some > > management > > > > > > > > protocol, and the nodes from the "parent-reference" > > expressions > > > > cannot > > > > > > > > be accessed via management protocols. > > > > > > > > > > > > > > > > The last sentence of the quoted paragraph was supposed > > to make this > > > > > > > > clear, but it seems we might need some additional > > explanation? > > > > > > > > > > > > > > > > > > > > > > Yes, I think so. I guess I'm not clear on what the XPath > > expressions > > > > are > > > > > > > for if they > > > > > > > can't be accessed via the management protocols. How can > > they be used? > > > > > > > > > > > > These are XPath expressions defined in the YANG models > > themselves, > > > > > > such as "must" expressions or "leafrefs". The > description of > > > > > > "parent-reference" refer to them as: > > > > > > > > > > > > [...] XPath > > > > > > expressions whose context nodes are defined > > in the > > > > > > mounted schema > > > > > > > > > > > > > > > > > > > > > > > > /martin > > > > > > > > > > > > > >
signature.asc
Description: OpenPGP digital signature
_______________________________________________ netmod mailing list netmod@ietf.org https://www.ietf.org/mailman/listinfo/netmod
