[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: partial locking and access control



Martin Bjorklund wrote:
Andy Bierman <ietf@andybierman.com> wrote:

.....
Also, what if another session issues a <partial-lock> that matches
this new node, but none of the nodes locked in the first partial-lock
RPC (by the other session).  This new node would of matched the
original Xpath expression had it existed at the time.

Sure, but since it didn't, it wasn't locked.


This is an important issue, and demonstrates the problems with
the current approach in the draft.

Let's say an operator locks "*/ifAdminStatus" to make sure that
nobody turns off any interfaces during some network test
or big config change.

Then a new card gets plugged in that creates some new interfaces
like "/interfaces/interface[name='Ethernet1/0']".

The operator wants all ifAdminStatus knobs to be locked.
Except, it not true for this instance:

  /interfaces/interface[name='Ethernet1/0']/ifAdminStatus

There are 2 separate issues here:

  1) Designing a partial locking mechanism that meets operator expectations
  2) Monitoring which nodes are actually locked by a partial-lock operation



/martin


Andy

--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>