Subject: [Netmod-ver-dt] Problems with automatic NBC checks - adding if-feature

From: Balázs Lengyel <[email-masked]>
Date: Fri, 4 Jan 2019 13:34:08 +0000

Hello,

We ran into the following update: we had an optional function in
a YAM (Yang Module) that was controlled by a YANG feature:

feature myProtocol-authentication {
description "Indicates authentication can be done using myProtocol";
}

identity myProtocol {
base sys:authentication-method;
description  "Indicates user authentication using myProtocol.";
}

augment /sys:system/... {
if-feature myProtocol-authentication ;
description "Augment in with myProtocol AA model.";
container my-protocol-authentication-config {...}

Clearly "identity myProtocol" is useless and unusable and
sometimes annoying unless the "feature myProtocol-authentication"
is supported, but we forgot to put the if-feature statement below
the identity statement. So we added the if-feature in the next
update of the YAM. In reality this is a BC change, a clear bug
correction, it will never disturb any client; however it is not
allowed according to RFC7950 list of allowed changes and would be
very difficult to evaluate for any automatic tool.

regards Balazs

--
Balazs Lengyel Ericsson Hungary Ltd.
Senior Specialist
Mobile: +36-70-330-7909 email: [email-masked]

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 4 Jan 2019 16:28:10 +0100

On Fri, Jan 04, 2019 at 01:34:08PM +0000, Balázs Lengyel wrote:
>    Hello,
> 
>    We ran into the following update: we had an optional function in a YAM
>    (Yang Module) that was controlled by a YANG feature:
> 
>    Clearly "identity myProtocol" is useless and unusable and sometimes
>    annoying unless the "feature myProtocol-authentication" is supported, but
>    we forgot to put the if-feature statement below the identity statement. So
>    we added the if-feature in the next update of the YAM. In reality this is
>    a BC change, a clear bug correction, it will never disturb any client;
>    however it is not allowed according to RFC7950 list of allowed changes and
>    would be very difficult to evaluate for any automatic tool.
>

The problem in many of these cases is that you do not know which
modules are using your identity and how. You as a human may have the
context information that myProtocol-authentication is not used
anywhere else but tools today don't have this information and hence
making the identity definition conditional may break something that is
using the identity without being conditional as well.

Definitions in YANG are not scoped; you always define something for
the entire world to use. Perhaps that is something to think about in
YANG 2.0, i.e., whether it is feasible to scope definitions somehow
(i.e., to be used withing a certain package of modules).

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>