On Thu, Mar 24, 2022 at 10:14 AM Balázs Lengyel <[email protected]> wrote:
> As mentioned earlier immutable is not enough for predefined NACM rules > > because the client may always > > insert a rule(-list) before the immutable rule(s) that will make the > immutable > > rules ineffective. The problem is that the rule(-sets) are a user ordered > list > > where the order matters. It is not enough to protect the individual > rule(sets) > > the order would also need protection. > The NMDA solution would be to simply list the effective rule-lists in <operational>. The server rule-list will always be first in <operational> and not even exist in <intended>. I think a standard solution has a higher bar than our proprietary extensions. The interactions with NACM need to be properly handled. IMO a proper solution would be an update to NACM itself. The reason nacm:default-deny-write and nacm:default-deny-all work, even though they are optional extensions, is because they are mandatory extensions if NACM is supported. A nacm:static-data extension would be similar to the other 2 extensions. They are short-hand automatic NACM rules. NACM itself explains how they are handled so there is no conflict with user-provided rule-lists. > Balazs > Andy > > > *From:* maqiufang (A) <[email protected]> > *Sent:* Thursday, 24 March, 2022 15:23 > *To:* Andy Bierman <[email protected]> > *Cc:* Balázs Lengyel <[email protected]>; Kent Watsen < > [email protected]>; NETMOD Group <[email protected]> > *Subject:* RE: [netmod] Alternative approach to > draft-ma-netmod-immutable-flag-00 > > > > Hi, Andy, Balazs, > > > > I can see your points in some of the use cases. > > But as Kent mentioned, the motivation of this work is that we have some > system-defined instance which are read-only to clients. > > And there may be some cases where a list/leaf-list data node may exist in > multiple instances with different control rules. > > > > To be specific, An instance-level annotation could be useful in following > use cases: > > a) The system generates some QoS templates when QoS functionality is > enabled, and some of the generated templates are read-only, while others > are free to be updated by the clients. > > b) The system predefines some list/leaf-list instances which are > read-only for clients(the clients cannot update or delete them, like > predefined NACM rules), but the clients is free to add/update/delete their > own defined instances. > > > > While YANG-extension can be useful for a schema-level immutability. > > I am thinking that, maybe we need both to complete the solution? > > > > Best Regards, > > Qiufang > > > > *From:* netmod [mailto:[email protected] <[email protected]>] *On > Behalf Of *Andy Bierman > *Sent:* Thursday, March 24, 2022 7:14 AM > *To:* Balázs Lengyel <[email protected]> > *Cc:* NetMod WG <[email protected]> > *Subject:* Re: [netmod] Alternative approach to > draft-ma-netmod-immutable-flag-00 > > > > > > > > On Wed, Mar 23, 2022 at 3:06 PM Balázs Lengyel < > [email protected]> wrote: > > > > > > *From:* Andy Bierman <[email protected]> > *Sent:* Wednesday, 23 March, 2022 22:32 > *To:* Balázs Lengyel <[email protected]> > *Cc:* NetMod WG <[email protected]> > *Subject:* Re: [netmod] Alternative approach to > draft-ma-netmod-immutable-flag-00 > > > > > > > > On Wed, Mar 23, 2022 at 2:16 PM Balázs Lengyel < > [email protected]> wrote: > > Hello Andy, > > I also propose an extension. (see my mail Review of > draft-ma-netmod-immutable-flag-00) > > In Ericsson we saw no need for exceptions, but do see the need for > applying it to descendant nodes. Typically we need to protect a full > subtree. > > > > Why do you need the exceptions? Could you provide some use-case examples ? > > > > I think create/delete-only and modify-only access modes are used the most, > after no-access. > > BALAZS: How is a modify-only data-node different from a mandatory > data-node? It must be there but can be changed. It get’s an initial value > somehow. > > > > Mandatory=true requires the system to provide a value. > > Modify-only allows the system to decide when an instance is created. > > > > > > BALAZS: Any examples when would a create/delete only data node be used? > > > > Sometimes developers do not want to write complex instrumentation that > supports > > modification of resources. Instead a user has to delete the old entry and > create a new > > one with (potentially) different parameters. > > > > > > > > Applying to descendant nodes may be better, or may require more work to > > undo the extension used in an ancestor node. This impacts the extension > usage within a grouping. > > > > BALAZS2: I did not include it in my mail, but we actually have one more > rule: > > “Top level statements in augment or groupings do NOT inherit > > the static-data value from containing nodes, they default to > > static-data false.” > > > > > > This seems complicated to users and developers to track how the final > schema tree was derived. > > > > The 'static-data' extension seems fine to me. > > We have to support 'user-write' anyways, so it is better if it is not too > close to this extension. > > Things that seem the same, but are NOT the same cause the most support > tickets. > > > > > > Regards Balazs > > > > Andy > > > > Andy > > > > > > > > > > *From:* netmod <[email protected]> *On Behalf Of *Andy Bierman > *Sent:* Wednesday, 23 March, 2022 21:10 > *To:* NetMod WG <[email protected]> > *Subject:* [netmod] Alternative approach to > draft-ma-netmod-immutable-flag-00 > > > > Hi, > > > > IMO the problem should be viewed as a refinement to the > > access control policy of the device. A standard mechanism > > such as a YANG extension would be better than a growing > > mix of proprietary solutions. > > > > We have such a YANG extension called "user-write" that is widely deployed. > > A simple boolean is not fine enough granularity, so a bits type is > > needed instead to allow control of create, update, and delete access > operations. > > > > > > > https://www.yumaworks.com/pub/latest/yangauto/yumapro-yangauto-guide.html#ncx-user-write > <https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-876c03f0bc610d95&q=1&e=c875257e-41f5-45d6-a9e9-871e5ebb4243&u=https%3A%2F%2Fwww.yumaworks.com%2Fpub%2Flatest%2Fyangauto%2Fyumapro-yangauto-guide.html%23ncx-user-write> > > > > > > Andy > > > >
_______________________________________________ netmod mailing list [email protected] https://www.ietf.org/mailman/listinfo/netmod
