Subject: [Netconf] NACM: <edit-config> with mix of authorized & non-auth changes

From: "Sterne, Jason (Nokia - CA/Ottawa)" <[email-masked]>
Date: Tue, 27 Feb 2018 17:41:11 +0000

Hi all,

>From reading the NACM RFC6536 it is pretty clear that a <get-config> response simply has the unauthorized nodes filtered out (no error - even if a node that is unauthorized is specifically requested in the filter).

But I'm not clear on how an <edit-config> is supposed to be handled if the request has a mix of authorized changes (a) and unauthorized changes (b).  The RFC uses the term "protocol operation" in section 3.2.3 which seems to imply that each individual node is evaluated and processed/rejected separately.  But is it the intention that the subset of authorized changes are applied while the unauthorized changes are rejected from within a single <edit-config> ?  Or should the contents of the entire <edit-config> be "atomic" as far as NACM success/failure is concerned (i.e. none of the edits should apply if even just a single part of them is unauthorized) ?

Rgds,
Jason

---

From: Martin Bjorklund <[email-masked]>
Date: Tue, 27 Feb 2018 22:55:39 +0100 (CET)

Hi,

"Sterne, Jason (Nokia - CA/Ottawa)" <[email-masked]> wrote:
> Hi all,
> 
> >From reading the NACM RFC6536 it is pretty clear that a <get-config>
> >response simply has the unauthorized nodes filtered out (no error -
> >even if a node that is unauthorized is specifically requested in the
> >filter).
> 
> But I'm not clear on how an <edit-config> is supposed to be handled if
> the request has a mix of authorized changes (a) and unauthorized
> changes (b).  The RFC uses the term "protocol operation" in section
> 3.2.3 which seems to imply that each individual node is evaluated and
> processed/rejected separately.

On the contrary; it says that if the edit-config would result in
something that the user is not authorized to do, then the edit-config
fails with access-denied.

> But is it the intention that the
> subset of authorized changes are applied while the unauthorized
> changes are rejected from within a single <edit-config> ?  Or should
> the contents of the entire <edit-config> be "atomic" as far as NACM
> success/failure is concerned (i.e. none of the edits should apply if
> even just a single part of them is unauthorized) ?

This depends on the "error-option" - in the normal case the result is
atomic.

/martin

---

From: "Sterne, Jason (Nokia - CA/Ottawa)" <[email-masked]>
Date: Tue, 27 Feb 2018 21:59:25 +0000

Thx Martin.  Pls see below.
Jason

> -----Original Message-----
> From: Martin Bjorklund [mailto:[email-masked]]
> Sent: Tuesday, February 27, 2018 4:56 PM
> To: Sterne, Jason (Nokia - CA/Ottawa) <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [Netconf] NACM: <edit-config> with mix of authorized & non-
> auth changes
> 
> Hi,
> 

[>>JTS: ] OK.  So from your additional reply below I guess the edit-config fails but in some cases (e.g. stop-on-error) some of the edits may stay in the candidate.

> This depends on the "error-option" - in the normal case the result is

[>>JTS: ] What do you mean by normal case ?  The default for error handling is stop-on-error (which isn't atomic for an edit-config).