Subject: Re: [Netconf] draft-ietf-netconf-rfc6536bis Query

From: Rohit R Ranade <[email-masked]>
Date: Thu, 30 Nov 2017 03:06:50 +0000

Hi Andy/Martin,

Can you please clarify the below query about rule-list group having "*".  Whether we need to allow a new group to be added a rule-list which already has a "*" in the leaf-list.

With Regards,
Rohit R

From: Rohit R Ranade
Sent: 16 November 2017 13:17
To: [email-masked]' <[email-masked]>
Subject: RE: [Netconf] draft-ietf-netconf-rfc6536bis Query

Hi All,

1 more point I wanted clarified was for the below point

leaf-list group {
           type union {
             type matchall-string-type;
             type group-name-type;
           }
           description
             "List of administrative groups that will be
              assigned the associated access rights
              defined by the 'rule' list.

              The string '*' indicates that all groups apply to the
              entry.";

Consider that existing configuration is like below:
<rule-list>
   <name>list1</name>
   <group>ug1</group>
</rule-list>

Consider that user will add to this group a record of '*"
<rule-list>
   <name>list1</name>
   <group>ug1</group>
<group>*</group>
</rule-list>

?  Whether this is valid configuration ? "*" can be considered as a super-set as it will apply for all group. So can this leaf-list contain * along with other UGs ?

One scenario where this is possible is when initially the user had thought of applying a rule-list to only a particular Group , but later the user wants to apply to all groups.

With Regards,
Rohit R

From: Rohit R Ranade
Sent: 15 November 2017 10:42
To: [email-masked]<mailto:[email-masked]>
Subject: [Netconf] draft-ietf-netconf-rfc6536bis Query

Hi All,

For the state-data in NACM like the below :

leaf denied-operations {
         type yang:zero-based-counter32;
         config false;
         mandatory true;
         description
           "Number of times since the server last restarted that a
            protocol operation request was denied.";
       }

"Number of times since the server" ==> Here the server is being referenced to NETCONF server or RESTCONF server ?
Please note that the both the NETCONF server and RESTCONF server maybe using the same NACM configurations but the state-data maintained by each protocol maybe different.

With Regards,
Rohit R

---

From: Andy Bierman <[email-masked]>
Date: Wed, 29 Nov 2017 19:37:32 -0800

On Wed, Nov 29, 2017 at 7:06 PM, Rohit R Ranade <[email-masked]>
wrote:

> Hi Andy/Martin,
>
>
>
> Can you please clarify the below query about rule-list group having “*”.
> Whether we need to allow a new group to be added a rule-list which already
> has a “*” in the leaf-list.
>
>
>

Yes -- both group entries are allowed, even though 1 of them is redundant

> Rohit R

Andy

>
>
> *From:* Rohit R Ranade
> *Sent:* 16 November 2017 13:17
> *To:* [email-masked]' <[email-masked]>
> *Subject:* RE: [Netconf] draft-ietf-netconf-rfc6536bis Query
>
>
>
> Hi All,
>
>
>
> Consider that user will add to this group a record of ‘*”
>
> <rule-list>
>
>    <name>list1</name>
>
>    <group>ug1</group>
>
> <group>*</group>
>
> </rule-list>
>
> ð  Whether this is valid configuration ? “*” can be considered as a
> super-set as it will apply for all group. So can this leaf-list contain *
> along with other UGs ?
>
>
>
> One scenario where this is possible is when initially the user had thought
> of applying a rule-list to only a particular Group , but later the user
> wants to apply to all groups.
>
>
>
> With Regards,
>
> Rohit R
>
>
>
> *From:* Rohit R Ranade
> *Sent:* 15 November 2017 10:42
> *To:* [email-masked]
> *Subject:* [Netconf] draft-ietf-netconf-rfc6536bis Query
>
>
>
> Hi All,
>
>
>
> “Number of times since the server” è Here the server is being referenced
> to NETCONF server or RESTCONF server ?
>
> Please note that the both the NETCONF server and RESTCONF server maybe
> using the same NACM configurations but the state-data maintained by each
> protocol maybe different.
>
>
>
> With Regards,
>
> Rohit R
>
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>
>