Subject: [netconf] draft-ietf-keystore - certificate leafref

From: Balázs Kovács <[email-masked]>
Date: Wed, 12 Jun 2019 09:14:51 +0000

Hi Kent,

Ietf-keystore model contains this leafref:

     typedef asymmetric-key-certificate-ref {

       type leafref {

         path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key"

            + "/ks:certificates/ks:certificate/ks:name";

       }

       description

         "This typedef enables modules to easily define a reference

          to a specific certificate associated with an asymmetric key

          stored in the keystore.";

     }

Shouldn't the leafref be constrained to point to a certificate within a specific asymmetric-key list element?

Example:
https://mailarchive.ietf.org/arch/msg/netmod/m0s9xAcDpJVm1a0-eWyTDvpXtZ0

Best Regards,
Balazs

---

From: Kent Watsen <[email-masked]>
Date: Wed, 12 Jun 2019 10:39:41 +0000

Hi Balazs,

Yes, that would be better.  Please provide the NEW text needed. 

Kent 

Sent from my iPhone

> On Jun 12, 2019, at 5:14 AM, Balázs Kovács <[email-masked]> wrote:
> 
> Hi Kent,
>  
> Shouldn’t the leafref be constrained to point to a certificate within a specific asymmetric-key list element?
>  
> Example:

---

From: Balázs Kovács <[email-masked]>
Date: Fri, 14 Jun 2019 08:02:42 +0000

Hi Kent,

I hope it is ok this way.

  1.  I changed local-or-keystore-end-entity-cert-with-key-grouping (see container ‘keystore-reference’).

  grouping local-or-keystore-end-entity-cert-with-key-grouping {
    description
      "A grouping that expands to allow an end-entity certificate
       (and its associated private key) to be either stored locally,
       within the using data model, or be a reference to a specific
       certificate in the keystore.";
    choice local-or-keystore {
      mandatory true;
      case local {
        if-feature "local-keys-supported";
        container local-definition {
          must '(algorithm and public-key and private-key)
                or not (algorithm or public-key or private-key)' {
            description
              "These descendent nodes are not mandatory because they
               MAY be defined in <operational>.  Implementations MUST
               assert that these values are either configured or that
               they exist in <operational>.";
          }
          description
            "Container to hold the local key definition.";
          uses ct:asymmetric-key-pair-grouping;
          uses ct:end-entity-cert-grouping;
        }
      }
      case keystore {
        if-feature "keystore-supported";
        container keystore-reference {
          description
            "A reference to a specific certificate, and its
             associated private key, stored in the keystore.";
          leaf asymmetric-key {
            type ks:asymmetric-key-ref;
            description
              "A reference to an asymmetric key that exists in
               the keystore.";
          }
          leaf certificate {
            type leafref {
                path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key[name = current()/../asymmetric-key]/ks:certificates/ks:certificate/ks:name";
            }
            description
              "A reference to a specific certificate of the
               asymmetric key in the keystore.";
          }
        }
      }
      description
        "A choice between an inlined definition and a definition
         that exists in the keystore.";
    }
  }

  1.  I would recommend to remove ks:asymmetric-key-certificate-ref
  2.  The client server model examples would need to be updated, but those I have not touched.

Br,
Balazs

From: Kent Watsen <[email-masked]>
Sent: Wednesday, June 12, 2019 12:40 PM
To: Balázs Kovács <[email-masked]>
Cc: [email-masked]
Subject: Re: draft-ietf-keystore - certificate leafref

Hi Balazs,

Kent

Sent from my iPhone

On Jun 12, 2019, at 5:14 AM, Balázs Kovács <[email-masked]<mailto:[email-masked]>> wrote:
Hi Kent,

       type leafref {

       }

       description

     }

Example:

Best Regards,
Balazs

---

From: Kent Watsen <[email-masked]>
Date: Mon, 17 Jun 2019 16:46:41 +0000

Hi Balazs,

I decided to replaced typedef asymmetric-key-certificate-ref with new "asymmetric-key-certificate-ref-grouping".  Effectively the same, but allow use elsewhere.  Here's the diff:

	https://github.com/netconf-wg/keystore/commit/2f59e8d91709a87d0ff98efafac2a36f420a1882 <https://github.com/netconf-wg/keystore/commit/2f59e8d91709a87d0ff98efafac2a36f420a1882>

I also fixed a typo in the 'path' statement: s/name/ks:name.   Some light testing suggests it's working as expected.

Thanks,
Kent // contributor

> On Jun 14, 2019, at 4:02 AM, Balázs Kovács <[email-masked]> wrote:
> 
> Hi Kent,
>  
> I changed local-or-keystore-end-entity-cert-with-key-grouping (see container ‘keystore-reference’).
>  
> I would recommend to remove ks:asymmetric-key-certificate-ref
> The client server model examples would need to be updated, but those I have not touched.
>  
> Br,
> Balazs
>  
> From: Kent Watsen <[email-masked] <mailto:[email-masked]>> 
> To: Balázs Kovács <[email-masked] <mailto:[email-masked]>>
> Cc: [email-masked] <mailto:[email-masked]>
> On Jun 12, 2019, at 5:14 AM, Balázs Kovács <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Hi Kent,
>  
> https://mailarchive.ietf.org/arch/msg/netmod/m0s9xAcDpJVm1a0-eWyTDvpXtZ0 <https://mailarchive.ietf.org/arch/msg/netmod/m0s9xAcDpJVm1a0-eWyTDvpXtZ0>
>  
> Best Regards,
> Balazs
>  
>  
> _______________________________________________
> netconf mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/netconf <https://www.ietf.org/mailman/listinfo/netconf>