Subject: [Netconf] RFC 6536 query

From: Rohit Pobbathi <[email-masked]>
Date: Fri, 15 Jun 2012 10:27:38 +0530

Hi, 

I have a query regarding Section 3.2.2 of RFC 6536 (NACM). 

It is mentioned "Data nodes to which the client does not have read access
are silently omitted from the <rpc-reply> message". 

If the <get-config> operation contains a subtree filter only for a data node
(as a selection node) for which read access is restricted, then should the
<rpc-reply> message contain empty <data> OR "access-denied" <rpc-error>" ?

Scenario: 
a) Access rule exists to DENY READ access to "/top/users" data node 

b) <get-config> with NO FILTER will OMIT the data node /top/users (even if
records exist for this Container) 
<rpc message-id="101" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> 
 <get-config> 
  <source> 
   <running/> 
  </source> 
 </get-config> 
</rpc> 

c) <get-config> with a Selection FILTER for "/top/users" [records exist for
"users" in the device] 
   What should be the response for below request ? 
   i) <rpc-reply> with EMPTY <data>, OR
   ii) <rpc-reply> with "access-denied" <rpc-error> 

<rpc message-id="102" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> 
 <get-config> 
  <source> 
   <running/> 
  </source> 
  <filter type="subtree"> 
   <top xmlns="http://example.com/schema/1.2/config"> 
    <users/> 
   </top> 
  </filter> 
 </get-config> 
</rpc> 

Regards,

Rohit

---

From: Andy Bierman <[email-masked]>
Date: Sat, 16 Jun 2012 07:24:03 -0700

The server would return empty data. access-denied errors do not get
generated for read operations.

On Thu, Jun 14, 2012 at 9:57 PM, Rohit Pobbathi
<[email-masked]>wrote:

> *If the <get-config> operation contains a subtree filter only for a data
> node (as a selection node) for which read access is restricted, then should
> the <rpc-reply> message contain empty <data> OR "access-denied" <rpc-error>"
> **?*
>
> *Scenario:*
> c) <get-config> with a Selection FILTER for "/top/users" [records exist
> for "users" in the device]
>    *What should be the response for below request ?**
> **   i) <rpc-reply> with EMPTY <data>, OR
> **   ii) <rpc-reply> with "access-denied" <rpc-error>
> *
> </rpc> ****
> ** **
> Regards,****
> Rohit****
> ** **
> ** **
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>
>