Subject: [Netconf] NMDA related comments on draft-ietf-netconf-rfc6536bis-04

From: Robert Wilton <[email-masked]>
Date: Tue, 12 Sep 2017 14:32:27 +0100

Hi,

I appreciate that this document is well passed WG LC, but I raised an 
NMDA related question with one of the authors and he suggested that I 
post the question here.

Sections 3.2 and 3.2.1 of rfc6536bis-04 already cover the new datastores 
described in NMDA - good.

However, both the RESTCONF NMDA draft and NETCONF NMDA draft are also 
introducing new functionality that ideally would be implicitly covered 
by this draft.

I think that section in 3.2.3 on RESTCONF Methods, and in particular 
"Table 1" at the end of this section already generically cover the 
changes proposed in RESTCONF NMDA, and no changes are required.  
However, this may be worth confirming.

But for NETCONF, the plan is to introduce a new "get-data" operation, 
and hence it might be helpful to add a paragraph to the beginning on 
section 3.2.4, in a similar style to the first paragraph in 3.2.5, to 
make the text apply more generically. Hence I propose that the following 
paragraph is inserted into the beginning of section 3.2.4:

NEW:

    The NACM access rights are not directly coupled to the <get> and 
<get-config>
    protocol operations, but apply to all <rpc> operations that would 
result in a
    'read' access operation to the target datastore.  This sectiondescribes
    how these access rights apply to the specific accessoperations supported
    by the <get> and <get-config> protocol operations.

Or in context with the existing -04 text:

3.2.4.  <get> and <get-config> Operations

    The NACM access rights are not directly coupled to the <get> and 
<get-config>
    protocol operations, but apply to all <rpc> operations that would 
result in a
    'read' access operation to the target datastore.  This sectiondescribes
    how these access rights apply to the specific accessoperations supported
    by the <get> and <get-config> protocol operations.

    Data nodes to which the client does not have read access are silently
    omitted from the <rpc-reply> message.  This is done to allow NETCONF
    filters for <get> and <get-config> to function properly, instead of
    causing an "access-denied" error because the filter criteria would
    otherwise include unauthorized read access to some data nodes.  For
    NETCONF filtering purposes, the selection criteria is applied to the
    subset of nodes that the user is authorized to read, not the entire
    datastore.

3.2.5.  <edit-config> Operation

    The NACM access rights are not directly coupled to the <edit-config>
    "operation" attribute, although they are similar. Instead, a NACM
    access right applies to all protocol operations that would result in
    a particular access operation to the target datastore.  This section
    describes how these access rights apply to the specific access
    operations supported by the <edit-config> protocol operation.

    ...

Thanks,
Rob

---

From: Andy Bierman <[email-masked]>
Date: Tue, 12 Sep 2017 08:56:17 -0700

On Tue, Sep 12, 2017 at 6:32 AM, Robert Wilton <[email-masked]> wrote:

> Hi,
>
> I appreciate that this document is well passed WG LC, but I raised an NMDA
> related question with one of the authors and he suggested that I post the
> question here.
>
> introducing new functionality that ideally would be implicitly covered by
> this draft.
>
> "Table 1" at the end of this section already generically cover the changes
> proposed in RESTCONF NMDA, and no changes are required.  However, this may
> be worth confirming.
>
> But for NETCONF, the plan is to introduce a new "get-data" operation, and
> hence it might be helpful to add a paragraph to the beginning on section
> 3.2.4, in a similar style to the first paragraph in 3.2.5, to make the text
> apply more generically. Hence I propose that the following paragraph is
> inserted into the beginning of section 3.2.4:
>
> NEW:
>

OK with me to add this text as the new first paragraph to 3.2.4

Andy

---

From: Andy Bierman <[email-masked]>
Date: Wed, 13 Sep 2017 10:04:33 -0700

Hi,

I have not seen any objections to clarifying this section so it supports
NMDA.
I will add this text to the github version.

I will publish a new version of rfc6536bis that addresses your comments
and the ops-dir review comments by Linda Dunbar.

Andy

On Tue, Sep 12, 2017 at 8:56 AM, Andy Bierman <[email-masked]> wrote:

>> NMDA related question with one of the authors and he suggested that I post
>> the question here.
>>