Skip to content

Fix empty leafref value passing validation without referred instance - #702

Open
khromenokroman wants to merge 2 commits into
clicon:masterfrom
khromenokroman:fix/leafref-empty-value
Open

khromenokroman wants to merge 2 commits into
clicon:masterfrom
khromenokroman:fix/leafref-empty-value

Conversation

@khromenokroman

Copy link
Copy Markdown
Contributor

@olofhagsand Hello

Description:
Fixes #647

Problem

validate_leafref() returned OK immediately if the leafref node had no body:

  if ((leafrefbody = xml_body(xt)) == NULL)
      goto ok;

So an empty value was always accepted, even with require-instance true and
no referred instance with an empty value:

  set test object object1 group ""
  validate   <- OK, but there is no group ""

Fix

An empty value is a value like any other (RFC 7950 9.9): it must refer to an
existing instance with the same value.

  • Treat a missing body as an empty string, both for the leafref node and for
    the referred instances. An empty leafref is valid only if some referred node
    also has an empty value.
  • The LEAFREF_OPTIMIZE binary search builds a lookup key from the value, so
    use the linear search for an empty value. Empty leafrefs are rare, so this
    has no performance impact.
  • validate_leafref_err(): print an empty body instead of (null) in the
    instance-required error, i.e. <error-info><group/></error-info>.

Behavior change

Configurations that contain an empty leafref without a matching empty referred
value were accepted before and now fail validation with instance-required.
This is the intended fix, but it may affect existing datastores.

Testing

validate_leafref() returned OK immediately if the leafref node had no
body, so an empty value was accepted even with require-instance true and
no referred instance with empty value, eg:

    set test object object1 group ""

An empty value is a value like any other: it must refer to an existing
instance with the same (empty) value. Treat a missing body as an empty
string both for the leafref and for the referred instances, so that an
empty leafref is valid only if some referred node is also empty.

The LEAFREF_OPTIMIZE binary search builds a key from the value, so use
the linear search for an empty value. Also avoid printing "(null)" in
the instance-required error.

Fixes clicon#647
Empty leafref to leaf-list, list key and non-key leaf must fail
validation, unless the referred node has an empty value.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

An empty value passes leafref validation

1 participant