Subject: [Netconf] NACM of implicitly created nodes

From: Milan Lenčo <[email-masked]>
Date: Wed, 18 Jan 2017 14:38:52 +0000

Hi,

I am currently working on implementation of NACM for NETCONF and I would like to ask you for clarification on access control for implicitly created nodes.

Namely, if in order to create a new container/list, it is necessary for the user to have permission to create direct ancestors with default values (that will effectively start to exist from that point) and child non-presence containers (created automatically as per YANG 1.1: RFC 7950, section 6.4.1). Similarly for the delete operation that includes previously implicitly created nodes which, however, haven't been touched by the user.

If the answer is "no", then my follow up question is, if changing leaf with default value to the same value should be then treated as target for data access validation, even though the effective change is none, since the existence of that leaf became explicit. Similarly, if explicitly creating non-presence container that existed before only because of the rule from YANG 1.1 should be considered as starting point for the access control of that container.

Thanks,

Milan Lenčo

MilanLenčo
Software Developer

Sídlo / Mlynské Nivy 56 / 821 05 Bratislava / Slovakia
R&D centrum / Janka Kráľa 9 /  974 01 Banská Bystrica / Slovakia
/ [email-masked]
reception: +421 2 206 65 114 / www.pantheon.tech

[logo]