Subject: [netmod] XPath errors in ietf-snmp.yang

From: Andy Bierman <[email-masked]>
Date: Sat, 28 Jul 2012 16:34:02 -0700

Hi,

I am getting lots of XPath errors reported from yangdump:

*** Generated by yangdump 5.0.da08cd7
*** Copyright (c) 2008-2012, Andy Bierman, All Rights Reserved.

Warning: no child nodes found in XPath expr '../type = read or ../type = write'
ietf-snmp-proxy.yang:114.24: warning(432): no child node available

Warning: no child nodes found in XPath expr '../type = read or ../type = write'
ietf-snmp-proxy.yang:114.42: warning(432): no child node available

Warning: no child nodes found in XPath expr '../type = trap or ../type = inform'
ietf-snmp-proxy.yang:123.24: warning(432): no child node available

Warning: no child nodes found in XPath expr '../type = trap or ../type = inform'
ietf-snmp-proxy.yang:123.42: warning(432): no child node available

These errors in ietf-snmp-proxy.yang are because the strings need to
be quoted.  When unquoted, they are XPath node names, not strings.

e.g.:

  ../type = 'trap' or ../type = 'inform'

Warning: no child nodes found in XPath expr 'snmp:params/snmp:v1 or
snmp:params/snmp:v2c'
ietf-snmp-community.yang:196.12: warning(432): no child node available

Warning: no child nodes found in XPath expr 'snmp:params/snmp:v1 or
snmp:params/snmp:v2c'
ietf-snmp-community.yang:196.35: warning(432): no child node available

There is a missing '/' so XPath this is supposed to be a child node

e.g.
   /snmp:params/snmp:v1

Warning: no child nodes found in XPath expr
'/snmp/usm/remote[engine-id=current()]/user[name=current()/../usm/user-name]'
ietf-snmp-usm.yang:194.13: warning(432): no child node available

Warning: no child nodes found in XPath expr
'/snmp/usm/remote[engine-id=current()]/user[name=current()/../usm/user-name]'
ietf-snmp-usm.yang:194.29: warning(432): no child node available

Warning: no child nodes found in XPath expr
'/snmp/usm/remote[engine-id=current()]/user[name=current()/../usm/user-name]'
ietf-snmp-usm.yang:194.55: warning(432): no child node available

Not sure if the 3 errors above are yangdump problems or due to
restrictions on what can be
referenced within an augment-stmt.  The XPath and combination of uses
and augments
is complicated to follow, so not sure if it is correct yet.

Warning: no child nodes found in XPath expr '../map-type = snmp:specified'
ietf-snmp-tls.yang:174.30: warning(432): no child node available

Not sure what snmp:specified is -- XPath thinks it is a node name because this
is an unquoted string.  There is no child 'specified' under this leaf.

*** /usr/share/yuma/modules/ietf/ietf-snmp.yang
*** 0 Errors, 10 Warnings

---

From: Jernej Tuljak <[email-masked]>
Date: Mon, 30 Jul 2012 12:19:22 +0200

>    ../type = 'trap' or ../type = 'inform'

I agree. These should be quoted.

> There is a missing '/' so XPath this is supposed to be a child node

No. There is no toplevel params node in this module. These should 
probably be
"../snmp:v1 or ../snmp:v2c". They appear to be refering to nodes of the 
params choice inside /snmp:snmp/snmp:target.

> is complicated to follow, so not sure if it is correct yet.

I don't think these are errors. I can "manually" resolve them by 
browsing this module's expanded schema tree and by validating content 
based on this module via RFC6110.

Example config instance:

<?xml version="1.0" encoding="utf-8"?>
<config xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<snmp:snmp xmlns:snmp="urn:ietf:params:xml:ns:yang:ietf-snmp">
<snmp:target>
<snmp:name>test</snmp:name>
<snmp:usm>
<snmp:user-name>jernej</snmp:user-name>
<snmp:security-level>auth-priv</snmp:security-level>
</snmp:usm>
<snmp:engine-id>01:af:b6:c8:2b</snmp:engine-id>
</snmp:target>
<snmp:usm>
<snmp:remote>
<snmp:engine-id>01:af:b6:c8:2b</snmp:engine-id>
<snmp:user>
<snmp:name>jernej</snmp:name>
</snmp:user>
<snmp:user>
<snmp:name>andy</snmp:name>
</snmp:user>
</snmp:remote>
</snmp:usm>
</snmp:snmp>
</config>

returns a single validation error in our tool (snmp:target is 
incomplete) which means that the when statement's XPath for 
snmp:engine-id evaluated to true during Schematron asserts. Changing the 
snmp:user-name to an invalid value is correctly reported as an error.

I think this is a bug in yangdump and that it has something to do with 
current() being used. Perhaps the context is not set properly while 
evaluating the expression. I'm not sure how syntax of XPath expressions 
is validated within yangdump, but using current() would require an 
instance document to test (like the one I posted above).

> is an unquoted string.  There is no child 'specified' under this leaf.

snmp:specified appears to be an identity in ietf-snmp-tls (base 
cert-to-tm-security-name). This should also be quoted, it's a QName value.

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

Jernej

---

From: Andy Bierman <[email-masked]>
Date: Mon, 30 Jul 2012 07:36:30 -0700

On Mon, Jul 30, 2012 at 3:19 AM, Jernej Tuljak <[email-masked]> wrote:
> No. There is no toplevel params node in this module. These should probably
> be
> I don't think these are errors. I can "manually" resolve them by browsing
> this module's expanded schema tree and by validating content based on this
> module via RFC6110.
>

You mean by manually inspecting them?
Because pyang and other tools completely ignore XPath expressions
and make no attempt whatsoever to validate their contents as correct
for the data model module.  AFAIK, only yangdump attempts to validate XPath.
The code does this against the object tree, and there is a different
code path for evaluating real expressions against a data tree.

I thought RFC 6020 made some restrictions about referencing
nodes outside the 'augment' subtree, but probably not.  It was
discussed (around the time we ended up restricting where
augment-stmt can be used).

Andy

> returns a single validation error in our tool (snmp:target is incomplete)
> which means that the when statement's XPath for snmp:engine-id evaluated to
> true during Schematron asserts. Changing the snmp:user-name to an invalid
> value is correctly reported as an error.
>
> evaluating the expression. I'm not sure how syntax of XPath expressions is
> validated within yangdump, but using current() would require an instance
> document to test (like the one I posted above).
>
>>

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 30 Jul 2012 07:49:26 -0700

> code path for evaluating real expressions against a data tree.

Schematron will mostly detect XPath errors, except cases like

must "not(nonsense)";

This is how I debug my XPath expressions.

> augment-stmt can be used).

Right, but it's not in 6020.

Lada

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C

---

From: Jernej Tuljak <[email-masked]>
Date: Mon, 30 Jul 2012 16:53:33 +0200

Dne 30.7.2012 16:36, piše Andy Bierman:
> On Mon, Jul 30, 2012 at 3:19 AM, Jernej Tuljak<[email-masked]>  wrote:

By loading them in our tool and inspecting them.

You are wrong about pyang ignoring XPath expressions. True that they are 
not checked during YANG validation thoroughly but are later used within 
it's DSDL plugin to validate instance documents. This represents one way 
of debugging XPath used within YANG. I'm quite familiar with pyang since 
I ported major parts of it to Java.

Jernej

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 30 Jul 2012 08:48:58 -0700

On Jul 30, 2012, at 7:53 AM, Jernej Tuljak wrote:

> You are wrong about pyang ignoring XPath expressions. True that they are not checked during YANG validation thoroughly but are later used within it's DSDL plugin to validate instance documents. This represents one way of debugging XPath used within YANG. I'm quite familiar with pyang since I ported major parts of it to Java.

Interesting. Regarding DSDL, does it mean that you generate the hybrid schema in Java and then use the XSLT stylesheets from pyang?

Lada

---

From: Jernej Tuljak <[email-masked]>
Date: Tue, 31 Jul 2012 08:25:40 +0200

Yes. Modified pyang XSLT stylesheets. That's also why I've been sending 
bug reports. Learned a lot while doing all this and it wasn't easy but 
now we got a working YANG-aware XML editor as a result.

Jernej

---

From: Martin Bjorklund <[email-masked]>
Date: Tue, 31 Jul 2012 07:21:42 -0700 (PDT)

Hi,

> I agree. These should be quoted.

Fixed.

> No. There is no toplevel params node in this module. These should probably be
> "../snmp:v1 or ../snmp:v2c". They appear to be refering to nodes of
> > the params choice inside /snmp:snmp/snmp:target.

Yes.  I fixed this by moving the when stmt up one level:

  augment /snmp:snmp/snmp:target {
    when "snmp:params/snmp:v1 or snmp:params/snmp:v2c";
    leaf mms {
    ...

> I don't think these are errors.

Neither do I.

> > cert-to-tm-security-name). This should also be quoted, it's a

Fixed.

/martin