Subject: [netmod] Question on yang?

From: Christian Hopps <[email-masked]>
Date: Sun, 11 Jan 2015 08:25:51 -0500

Hi,

Is this the appropriate list for questions on how to write something in yang?

[assuming yes for now.]

I have a list (of routers) that I want as a part of a site definition, I want to require this list be non-empty when the site is of a particular type and also require that it not be present for a site of a different type. I used the following syntax to try and do this:

list site {
  leaf site-type {
    mandatory true;
    type site-type;
  }
  leaf-list router {
    min-elements 1;
    when "../site-type = ‘foo'";
    type leafref ...
  }
}

Now the when statement appears to work when I put a router in a non “foo” site (i.e., it asserts); however, what doesn’t work is that it doesn’t require a minimum of 1 router in “foo” sites. That is it doesn’t appear to enforce min-elements 1.

Am I coding this wrong?

Thanks,
Chris.

---

From: "Thomas D. Nadeau" <[email-masked]>
Date: Sun, 11 Jan 2015 08:27:53 -0500

> On Jan 11, 2015:8:25 AM, at 8:25 AM, Christian Hopps <[email-masked]> wrote:
> 
> Hi,
> 

	You have come to the right place. 8)   The other place you can ask for suggestions is the yang-doctors list (CC:ed) but most of those folks if not all, are subscribed here too... 

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

---

From: Andy Bierman <[email-masked]>
Date: Sun, 11 Jan 2015 09:27:49 -0800

>> Now the when statement appears to work when I put a router in a non “foo” site (i.e., it asserts); however, what doesn’t work is that it doesn’t require a minimum of 1 router in “foo” sites. That…

The YANG above must be for config=false nodes, because there is
no key defined.  Servers do no run YANG validation checks on
their own output.

If there was a key, and if it was config validated by a server, then the
when-stmt check to make sure site-type=foo is done before the
check on min-elements=1.

>> Chris.

Andy

> yang-doctors mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/yang-doctors

---

From: Christian Hopps <[email-masked]>
Date: Mon, 12 Jan 2015 06:03:10 -0500

> On Jan 11, 2015, at 12:27 PM, Andy Bierman <[email-masked]> wrote:
> 
>> 
>>> [assuming yes for now.]
>>> 

Sorry I trimmed it down as the site def is much larger, the list contains a key:

    list site {
      key "site-id";
      leaf site-id {
        type site-id;
      }
      leaf site-type {
        mandatory true;
        type site-type;
      }
      // [..cut..]
      leaf-list router {
        // The combination of when and min-elms appears to allow 0 elements
        // for the when matching site types
        min-elements 1;
        when "../site-type = 'ots' or ../site-type = 'odws'";
        type leafref {
          path "../../../router/router-id";
        }
      }

I’m using yang2dsdl with (both -t data and -t config) to validate. Both ways (config or data) accept XML with no routers specified in ‘ots’ or ‘odws’ sites. Both ways correctly reject a router specified in a non-ots/odws site.

Thanks,
Chris.

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 12 Jan 2015 12:59:32 +0100

Hi Christian,

Christian Hopps <[email-masked]> writes:

> I’m using yang2dsdl with (both -t data and -t config) to
> validate. Both ways (config or data) accept XML with no routers
> specified in ‘ots’ or ‘odws’ sites. Both ways correctly reject a
> router specified in a non-ots/odws site.

This has to do with YANG 1.1 ussue Y18:

https://svn.tools.ietf.org/svn/wg/netmod/yang-1.1/issues.html#sec-19

If there is no "router" element, the XPath expression in "when" cannot
be evaluated because there is no context node for such an evaluation.

So the validation procedure assumes the XPath expression *might* be true
and doesn't flag missing "router" as an error.

The other option would be to flag missing "router" always as an error,
even if "site-type" is neither "ots" nor "odws", but I thought it was
better to have occassional false negatives than false positives.

Lada

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C

---

From: Christian Hopps <[email-masked]>
Date: Mon, 12 Jan 2015 07:24:41 -0500

> On Jan 12, 2015, at 6:59 AM, Ladislav Lhotka <[email-masked]> wrote:
> 
> Hi Christian,
> 
> Christian Hopps <[email-masked] <mailto:[email-masked]>> writes:
> 
>> 
> https://svn.tools.ietf.org/svn/wg/netmod/yang-1.1/issues.html#sec-19 <https://svn.tools.ietf.org/svn/wg/netmod/yang-1.1/issues.html#sec-19>
> 

I don’t think there is an issue with the xpath expression, as it properly flags when a router is in a non-ots/odws site. The problem is that the "min-elements 1;” is ignored.

Thanks,
Chris.

>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/netmod <https://www.ietf.org/mailman/listinfo/netmod>
> 
> --

---

From: Andy Bierman <[email-masked]>
Date: Mon, 12 Jan 2015 04:42:18 -0800

> https://svn.tools.ietf.org/svn/wg/netmod/yang-1.1/issues.html#sec-19

This does not appear to be related to Y18.

The problem here is that the "when" expression applies
to the running datastore in the server, not to the request message.

You cannot use an off-line tool to validate any NETCONF
message as if it were processed by a server.  None of the constraints
that apply to a valid configuration datastore can be
evaluated without all the datastore contents.

Andy

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 12 Jan 2015 14:10:21 +0100

> On 12 Jan 2015, at 13:24, Christian Hopps <[email-masked]> wrote:
> 
>> 

If at least one “router” element exists in an instance, then it can be used as the context node and Schematron then evaluates the XPath expression and complains if it is false.

In an older pyang version, the RELAX NG validation would *always* enforce the schema constraint “min-elements 1;”, even if the “when” expression was false. Then somebody complained about this behaviour so I changed it.

Unfortunately, nothing else can be done unless we do the trickery that is proposed in the solution Y18-01. However, the latter would be IMO impossible to implement in DSDL - RELAX NG needs a fixed grammar/schema and not one that is dependent on the instance document being validated, which is exactly what “when” does.

Lada

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 12 Jan 2015 14:34:11 +0100

> On 12 Jan 2015, at 13:42, Andy Bierman <[email-masked]> wrote:
> 

It is exactly the substance of Y18: If no <router> element is present in the instance document, the XPath expression cannot be evaluated (if we abide by XPath rules) to decide whether the “router” node is in the schema or not. That’s where Y18-01 proposes to insert a tentative <router> element and use it as the context node.

> to the running datastore in the server, not to the request message.

This is true only for the “config” target that validates an <edit-config> request. However, Chris also said he'd tried yang2dsdl with the “data” target (-t config), which is essentially the content of a datastore. I verified the result is indeed as Chris wrote.

If the “when” statement is removed, then missing <router> is flagged as an error in RELAX NG validation.

Lada

---

From: Andy Bierman <[email-masked]>
Date: Mon, 12 Jan 2015 06:05:10 -0800

> It is exactly the substance of Y18: If no <router> element is present in the instance document, the XPath expression cannot be evaluated (if we abide by XPath rules) to decide whether the “router”…

OK - you are right -- this is Y18.
Our code creates a dummy context node in this case.
If the when-stmt is true, the min-elements violation
would be generated.

Andy

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 12 Jan 2015 15:22:38 +0100

> On 12 Jan 2015, at 15:05, Andy Bierman <[email-masked]> wrote:
> 

Right, but this is really difficult to do via DSDL mapping because the RELAX NG schema generated from the YANG data model doesn’t depend on a particular instance document, and RELAX NG doesn’t do XPath evaluation.

Lada

---

From: Andy Bierman <[email-masked]>
Date: Mon, 12 Jan 2015 08:10:52 -0800

> Right, but this is really difficult to do via DSDL mapping because the RELAX NG schema generated from the YANG data model doesn’t depend on a particular instance document, and RELAX NG doesn’t do X…

You would have to generate a new config document with the context node in it.
This is actually one of the easier aspects of implementing when-stmt
correctly within a real server.  (For some definition of "correct", depending on
the evaluation order and other details).

Andy