Subject: [netmod] if-feature on identities

From: Ladislav Lhotka <[email-masked]>
Date: Thu, 08 Jan 2015 10:38:51 +0100

Hi,

some routing folks came up with the idea that it would be useful to allow
if-feature on identities (the discussion was related to
crypto-algorithms).

What's behind it is the same issue we have with the iana-interface-type
module: a server advertising that module should in fact be prepared to
receive all kinds of weird interface types. This is not only annoying
but it could also have security implications.

In my view, this is exactly the problem that identities (as opposed to
enumerations) are able to avoid. If an identity for an interface type
(or crypto-algorithm or whatever) was always defined in the same module
as config and state data for that interface type, all would be fine.

Lada

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 08 Jan 2015 11:12:10 +0100 (CET)

> if-feature on identities (the discussion was related to

This is part of Y11, already in the current draft for yang-1.1.

> receive all kinds of weird interface types.

Receive yes, but that is not the same thing as accept.

> as config and state data for that interface type, all would be fine.

Agreed.

/martin

---

From: Ladislav Lhotka <[email-masked]>
Date: Thu, 8 Jan 2015 11:45:41 +0100

> On 08 Jan 2015, at 11:12, Martin Bjorklund <[email-masked]> wrote:
> 

Oh, I didn’t realize (or forgot) that Y11 includes identities, too. But then I think it would be a real nuisance to define a feature for each interface type along with the identity itself and putting if-feature in all identity definitions.

Also, a server would have to separately advertise support for the identity value on one hand, and for the data corresponding to that interface type on the other.

We had that discussion before but I still think iana-interface-type has more drawbacks than benefits.

> Receive yes, but that is not the same thing as accept.

Yes, but an implementor has to keep that in mind.

Lada

---

From: Ladislav Lhotka <[email-masked]>
Date: Fri, 09 Jan 2015 10:25:37 +0100

> This is part of Y11, already in the current draft for yang-1.1.

With if-feature on an identity, what is be the rule for identities
derived from it? Are they required to have the same or stricter
if-feature? And how about identityrefs?

I think the distributed nature of identities makes it a bit awkward, so
I wonder whether it is really needed to allow if-feature on
identities. Perhaps it could suffice to have if-feature as an XPath
function (actually, I thought it was planned to have it).

Lada