From 23b466a854acb69202629de6c480c0149b4986e0 Mon Sep 17 00:00:00 2001
From: Olof hagsand <olof@hagsand.se>
Date: Tue, 8 Mar 2022 09:18:10 +0100
Subject: [PATCH] * YANG unique: added single descendant node ids as special
 case   * This means that two variants are supported:     * unique "a b c", ie
 multiple direct chidlren     * unique "a/b/c", ie single descendants   * RFC
 7950 Sec 7.8.3 is somewhat unclear   * The combination is not supported *
 Netconf data-not-unique info changed to return schema nodes instead of XML
 for RFC7950 compliance

---
 CHANGELOG.md                   |  10 ++
 lib/src/clixon_netconf_lib.c   |   8 +-
 lib/src/clixon_validate.c      | 177 ++++++++++++++++++++++++++++++---
 test/test_restconf_op.sh       |   2 +-
 test/test_rpc.sh               |   2 +-
 test/test_unique.sh            |   8 +-
 test/test_unique_descendant.sh | 169 +++++++++++++++++++++++++++++++
 7 files changed, 349 insertions(+), 27 deletions(-)
 create mode 100755 test/test_unique_descendant.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bbbaead9..35649cc3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,11 +41,21 @@ Expected: May 2022
 
 Users may have to change how they access the system
 
+* Netconf data-not-unique info changed to return schema nodes instead of XML for RFC7950 compliance
 * CLI reconnects to backend if backend restarts with a warning
   * Note that edits to the candidate database or locks will be lost
   * To force the CLI to exit if backend restarts, undef `PROTO_RESTART_RECONNECT`
   * This is an effect of the fix of [Broken pipe error seen in client (cli) when backend restarts and CLICON_SOCK is recreated](https://github.com/clicon/clixon/issues/312), the CLI behavior on backend restart is changed.
 
+### Minor features
+
+* YANG unique: added single descendant node ids as special case
+  * This means that two variants are supported:
+    * unique "a b c", ie multiple direct chidlren
+    * unique "a/b/c", ie single descendants
+  * RFC 7950 Sec 7.8.3 is somewhat unclear
+  * The combination is not supported
+
 ### Corrected Bugs
 
 * Fixed: [Broken pipe error seen in client (cli) when backend restarts and CLICON_SOCK is recreated](https://github.com/clicon/clixon/issues/312)
diff --git a/lib/src/clixon_netconf_lib.c b/lib/src/clixon_netconf_lib.c
index c8b14a35..4c3c89b1 100644
--- a/lib/src/clixon_netconf_lib.c
+++ b/lib/src/clixon_netconf_lib.c
@@ -1275,7 +1275,7 @@ netconf_malformed_message_xml(cxobj **xret,
  *   "unique" constraint is invalidated.
  * @param[out]  xret   Error XML tree. Free with xml_free after use
  * @param[in]   x      List element containing duplicate
- * @param[in]   cvk    List of comonents in x that are non-unique
+ * @param[in]   cvk    List of components in x that are non-unique
  * @see RFC7950 Sec 15.1
  */
 int
@@ -1321,13 +1321,9 @@ netconf_data_not_unique_xml(cxobj **xret,
 	    goto done;
 	}
 	while ((cvi = cvec_each(cvk, cvi)) != NULL){
-	    if ((xi = xml_find(x, cv_string_get(cvi))) == NULL)
-		continue; /* ignore, shouldnt happen */
-	    clicon_xml2cbuf(cb, xi, 0, 0, -1);	
 	    if (clixon_xml_parse_va(YB_NONE, NULL, &xinfo, NULL,
-				    "<non-unique>%s</non-unique>", cbuf_get(cb)) < 0)
+				    "<non-unique>%s</non-unique>", cv_string_get(cvi)) < 0)
 		goto done;
-	    cbuf_reset(cb);
 	}
     }
     retval = 0;
diff --git a/lib/src/clixon_validate.c b/lib/src/clixon_validate.c
index aa4cb6a8..d0f942ec 100644
--- a/lib/src/clixon_validate.c
+++ b/lib/src/clixon_validate.c
@@ -710,6 +710,67 @@ check_mandatory(cxobj     *xt,
  * @retval     0     OK, entry is unique
  * @retval    -1     Duplicate detected
  * @note This is currently quadratic complexity. It could be improved by inserting new element sorted and binary search.
+ * @retval     1     Validation OK
+ * @retval     0     Validation failed (cbret set)
+ * @retval    -1     Error
+ */
+static int
+unique_search_one(cxobj  *x,
+		  char   *xpath,
+		  char ***svec,
+		  size_t *slen)
+{
+    int     retval = -1;
+    cxobj **xvec = NULL;
+    size_t  xveclen;
+    int     i;
+    int     s;
+    cxobj  *xi;
+    char   *bi;
+
+    /* Collect tuples */
+    if (xpath_vec(x, NULL, "%s", &xvec, &xveclen, xpath) < 0) 
+	goto done;	
+    for (i=0; i<xveclen; i++){
+	xi = xvec[i];
+	if ((bi = xml_body(xi)) == NULL)
+	    break;
+	/* Check if bi is duplicate? 
+	 * XXX: sort svec?
+	 */
+	for (s=0; s<(*slen); s++){
+	    if (strcmp(bi, (*svec)[s]) == 0){
+		goto fail;
+	    }
+	}
+	(*slen) ++;
+	if (((*svec) = realloc((*svec), (*slen)*sizeof(char*))) == NULL){
+	    clicon_err(OE_UNIX, errno, "realloc");
+	    goto done;
+	}
+	(*svec)[(*slen)-1] = bi;
+    } /* i search results */
+    retval = 1;
+ done:
+    if (xvec)
+	free(xvec);    
+    return retval;
+ fail:
+    retval = 0;
+    goto done;
+}
+
+/*! New element last in list, check if already exists if sp return -1
+ * @param[in]  vec   Vector of existing entries (new is last)
+ * @param[in]  i1    The new entry is placed at vec[i1]
+ * @param[in]  vlen  Lenght of entry
+ * @param[in]  sorted Sorted by system, ie sorted by key, otherwise no assumption
+ * @retval     0     OK, entry is unique
+ * @retval    -1     Duplicate detected
+ * @note This is currently quadratic complexity. It could be improved by inserting new element sorted and binary search.
+ * @retval     1     Validation OK
+ * @retval     0     Validation failed (cbret set)
+ * @retval    -1     Error
  */
 static int
 check_insert_duplicate(char **vec,
@@ -750,32 +811,40 @@ check_insert_duplicate(char **vec,
 
 /*! Given a list with unique constraint, detect duplicates
  * @param[in]  x     The first element in the list (on return the last)
- * @param[in]  xt    The parent of x
+ * @param[in]  xt    The parent of x (a list)
  * @param[in]  y     Its yang spec (Y_LIST)
- * @param[in]  yu    A yang unique spec (Y_UNIQUE) for unique keyword or (Y_LIST) for list keys
+ * @param[in]  yu    A yang unique (Y_UNIQUE) for unique schema node ids or (Y_LIST) for list keys
  * @param[out] xret  Error XML tree. Free with xml_free after use
  * @retval     1     Validation OK
  * @retval     0     Validation failed (cbret set)
  * @retval    -1     Error
- * @note It would be possible to cache the vector built below
+ * Discussion: the RFC 7950 Sec 7.8.3: "constraints on valid list entries"
+ * The arguments are "descendant schema node identifiers". A direct interpretation is that
+ * this is for "direct" descendants, but it does not rule out transient descendants.
+ * The implementation supports two variants:
+ * 1) list of direct descendants, eg "a b"
+ * 2) single transient schema node identifier, eg "a/b"
+ * The problem with combining (1) and (2) is that (2) results in a potential set of results, what
+ * would unique "a/b c/d" mean if both a/b and c/d returns a set?
+ * For (1):
  * All key leafs MUST be present for all list entries.
  * The combined values of all the leafs specified in the key are used to
  * uniquely identify a list entry.  All key leafs MUST be given values
  * when a list entry is created.
  */
 static int
-check_unique_list(cxobj     *x, 
-		  cxobj     *xt, 
-		  yang_stmt *y,
-		  yang_stmt *yu,
-		  cxobj    **xret)
+check_unique_list_mult(cxobj     *x, 
+		       cxobj     *xt, 
+		       yang_stmt *y,
+		       yang_stmt *yu,
+		       cvec      *cvk,
+		       cxobj    **xret)
 {
     int       retval = -1;
-    cvec      *cvk; /* unique vector */
     cg_var    *cvi; /* unique node name */
     cxobj     *xi;
     char     **vec = NULL; /* 2xmatrix */
-    int        vlen;
+    int        clen;
     int        i;
     int        v;
     char      *bi;
@@ -789,11 +858,11 @@ check_unique_list(cxobj     *x,
 	      yang_find(y, Y_ORDERED_BY, "user") == NULL);
     cvk = yang_cvec_get(yu);
     /* nr of unique elements to check */
-    if ((vlen = cvec_len(cvk)) == 0){ 
+    if ((clen = cvec_len(cvk)) == 0){ 
 	/* No keys: no checks necessary */
 	goto ok;
     }
-    if ((vec = calloc(vlen*xml_child_nr(xt), sizeof(char*))) == NULL){
+    if ((vec = calloc(clen*xml_child_nr(xt), sizeof(char*))) == NULL){
 	clicon_err(OE_UNIX, errno, "calloc");
 	goto done;
     }
@@ -807,15 +876,15 @@ check_unique_list(cxobj     *x,
 	while ((cvi = cvec_each(cvk, cvi)) != NULL){
 	    /* RFC7950: Sec 7.8.3.1: entries that do not have value for all
 	     * referenced leafs are not taken into account */
-	    if ((xi = xml_find(x, cv_string_get(cvi))) ==NULL)
+	    if ((xi = xml_find(x, cv_string_get(cvi))) == NULL)
 		break;
 	    if ((bi = xml_body(xi)) == NULL)
 		break;
-	    vec[i*vlen + v++] = bi;
+	    vec[i*clen + v++] = bi;
 	}
 	if (cvi==NULL){
 	    /* Last element (i) is newly inserted, see if it is already there */
-	    if (check_insert_duplicate(vec, i, vlen, sorted) < 0){
+	    if (check_insert_duplicate(vec, i, clen, sorted) < 0){
 		if (xret && netconf_data_not_unique_xml(xret, x, cvk) < 0)
 		    goto done;
 		goto fail;
@@ -836,6 +905,84 @@ check_unique_list(cxobj     *x,
     goto done;
 }
 
+static int
+check_unique_list_deep(cxobj     *x, 
+		       cxobj     *xt, 
+		       yang_stmt *y,
+		       cvec      *cvk,
+		       cxobj    **xret)
+{
+    int       retval = -1;
+    cg_var    *cvi; /* unique node name */
+    char     **svec = NULL; /* vector of search results */
+    size_t     slen = 0; 
+    int        ret;
+
+    do {
+	cvi = NULL;
+	while ((cvi = cvec_each(cvk, cvi)) != NULL){
+	    /* Collect search results from one */
+	    if ((ret = unique_search_one(x, cv_string_get(cvi), &svec, &slen)) < 0)
+		goto done;
+	    if (ret == 0){
+		if (xret && netconf_data_not_unique_xml(xret, x, cvk) < 0)
+		    goto done;
+		goto fail;
+	    }
+	} /* cvi: unique arguments */
+    	x = xml_child_each(xt, x, CX_ELMNT);
+    } while (x && y == xml_spec(x));  /* stop if list ends, others may follow */
+    // ok:
+    /* It would be possible to cache vec here as an optimization */
+    retval = 1;
+ done:
+    if (svec)
+	free(svec);
+    return retval;
+ fail:
+    retval = 0;
+    goto done;
+}
+
+/*! Given a list with unique constraint, detect duplicates
+ * @param[in]  x     The first element in the list (on return the last)
+ * @param[in]  xt    The parent of x (a list)
+ * @param[in]  y     Its yang spec (Y_LIST)
+ * @param[in]  yu    A yang unique (Y_UNIQUE) for unique schema node ids or (Y_LIST) for list keys
+ * @param[out] xret  Error XML tree. Free with xml_free after use
+ * @retval     1     Validation OK
+ * @retval     0     Validation failed (cbret set)
+ * @retval    -1     Error
+ * Discussion: the RFC 7950 Sec 7.8.3: "constraints on valid list entries"
+ * The arguments are "descendant schema node identifiers". A direct interpretation is that
+ * this is for "direct" descendants, but it does not rule out transient descendants.
+ * The implementation supports two variants:
+ * 1) list of direct descendants, eg "a b"
+ * 2) single transient schema node identifier, eg "a/b"
+ * The problem with combining (1) and (2) is that (2) results in a potential set of results, what
+ * would unique "a/b c/d" mean if both a/b and c/d returns a set?
+ * For (1):
+ * All key leafs MUST be present for all list entries.
+ * The combined values of all the leafs specified in the key are used to
+ * uniquely identify a list entry.  All key leafs MUST be given values
+ * when a list entry is created.
+ */
+static int
+check_unique_list(cxobj     *x, 
+		  cxobj     *xt, 
+		  yang_stmt *y,
+		  yang_stmt *yu,
+		  cxobj    **xret)
+{
+    cvec *cvk;
+
+    cvk = yang_cvec_get(yu);
+    if (cvec_len(cvk) != 1) /* case 1: set of direct descendants */
+	return check_unique_list_mult(x, xt, y, yu, cvk, xret);
+    else /* case 2: single deep schema node */
+	return check_unique_list_deep(x, xt, y, cvk, xret);
+}
+
 /*! Given a list, check if any min/max-elemants constraints apply
  * @param[in]  xp    Parent of the xml list there are too few/many
  * @param[in]  y     Yang spec of the failing list
diff --git a/test/test_restconf_op.sh b/test/test_restconf_op.sh
index 0c616c97..d32bf35f 100755
--- a/test/test_restconf_op.sh
+++ b/test/test_restconf_op.sh
@@ -151,7 +151,7 @@ new "restconf DELETE"
 expectpart "$(curl $CURLOPTS -X DELETE $RCPROTO://localhost/restconf/data/example:cont1)" 0 "HTTP/$HVER 204"
 
 new "restconf POST from top containing duplicate keys expect error"
-expectpart "$(curl $CURLOPTS -X POST -H "Content-Type: application/yang-data+json" $RCPROTO://localhost/restconf/data -d '{"example:cont1":{"interface":[{"name":"TEST","type":"eth0"},{"name":"TEST","type":"eth0"}]}}')" 0 "HTTP/$HVER 412" '{"ietf-restconf:errors":{"error":{"error-type":"application","error-tag":"operation-failed","error-app-tag":"data-not-unique","error-severity":"error","error-info":{"non-unique":{"name":"TEST"}}}}}'
+expectpart "$(curl $CURLOPTS -X POST -H "Content-Type: application/yang-data+json" $RCPROTO://localhost/restconf/data -d '{"example:cont1":{"interface":[{"name":"TEST","type":"eth0"},{"name":"TEST","type":"eth0"}]}}')" 0 "HTTP/$HVER 412" '{"ietf-restconf:errors":{"error":{"error-type":"application","error-tag":"operation-failed","error-app-tag":"data-not-unique","error-severity":"error","error-info":{"non-unique":"name"}}}}'
 
 new "restconf GET null datastore"
 expectpart "$(curl $CURLOPTS -X GET $RCPROTO://localhost/restconf/data/example:cont1)" 0 "HTTP/$HVER 404" '{"ietf-restconf:errors":{"error":{"error-type":"application","error-tag":"invalid-value","error-severity":"error","error-message":"Instance does not exist"}}}'
diff --git a/test/test_rpc.sh b/test/test_rpc.sh
index 5f93483e..63d420bf 100755
--- a/test/test_rpc.sh
+++ b/test/test_rpc.sh
@@ -349,7 +349,7 @@ expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><example xm
 
 LIST='<u1 xmlns="urn:example:clixon"><uk>bar</uk><val>1</val></u1><u1 xmlns="urn:example:clixon"><uk>bar</uk><val>2</val></u1>'
 new "netconf example rpc input list with non-unique keys (should fail)"
-expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><example xmlns=\"urn:example:clixon\"><x>mandatory</x>$LIST</example></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique><uk>bar</uk></non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><example xmlns=\"urn:example:clixon\"><x>mandatory</x>$LIST</example></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique>uk</non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
 
 new "netconf choice ok"
 expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><example xmlns=\"urn:example:clixon\"><x>42</x><a1>x</a1><a21>x</a21><a22>x</a22></example></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><x xmlns=\"urn:example:clixon\">42</x><y xmlns=\"urn:example:clixon\">42</y><a1 xmlns=\"urn:example:clixon\">x</a1><a21 xmlns=\"urn:example:clixon\">x</a21><a22 xmlns=\"urn:example:clixon\">x</a22></rpc-reply>]]>]]>$"
diff --git a/test/test_unique.sh b/test/test_unique.sh
index b926633e..16bed7fe 100755
--- a/test/test_unique.sh
+++ b/test/test_unique.sh
@@ -109,7 +109,7 @@ expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><edit-confi
 </c></config></edit-config></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
 
 new "netconf validate (should fail)"
-expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique><ip>192.0.2.1</ip></non-unique><non-unique><port>25</port></non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique>ip</non-unique><non-unique>port</non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
 
 new "netconf discard-changes"
 expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><discard-changes/></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
@@ -138,7 +138,7 @@ expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><edit-confi
 </c></config></edit-config></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
 
 new "netconf validate (should fail)"
-expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique><ip>192.0.2.1</ip></non-unique><non-unique><port>25</port></non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique>ip</non-unique><non-unique>port</non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
 
 new "make it valid by deleting port from smtp entry"
 expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>none</default-operation><config><c xmlns=\"urn:example:clixon\" xmlns:nc=\"urn:ietf:params:xml:ns:netconf:base:1.0\"><server><name>smtp</name><port nc:operation=\"delete\">25</port></server>
@@ -163,7 +163,7 @@ expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><edit-confi
 </c></config></edit-config></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
 
 new "netconf validate (should fail)"
-expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique><ip>192.0.2.1</ip></non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique>ip</non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
 
 new "make valid by replacing IP of http entry"
 expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>none</default-operation><config><c xmlns=\"urn:example:clixon\"><single><name>http</name><ip>178.23.34.1</ip></single>
@@ -204,7 +204,7 @@ expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><edit-confi
 </c></config></edit-config></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
 
 new "netconf validate (should fail)"
-expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique><ip>192.0.2.1</ip></non-unique><non-unique><port>25</port></non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique>ip</non-unique><non-unique>port</non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
 
 new "netconf discard-changes"
 expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><discard-changes/></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
diff --git a/test/test_unique_descendant.sh b/test/test_unique_descendant.sh
new file mode 100755
index 00000000..4640d712
--- /dev/null
+++ b/test/test_unique_descendant.sh
@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# Yang list unique tests using descendant schema node identifiers
+# That is, not only direct descendants as the example in RFC7890 7.8.3.1
+
+# Magic line must be first in script (see README.md)
+s="$_" ; . ./lib.sh || if [ "$s" = $0 ]; then exi{t 0; else return 0; fi
+
+APPNAME=example
+
+cfg=$dir/conf_yang.xml
+fyang=$dir/unique.yang
+
+cat <<EOF > $cfg
+<clixon-config xmlns="http://clicon.org/config">
+  <CLICON_CONFIGFILE>$cfg</CLICON_CONFIGFILE>
+  <CLICON_YANG_DIR>${YANG_INSTALLDIR}</CLICON_YANG_DIR>
+  <CLICON_YANG_MAIN_FILE>$fyang</CLICON_YANG_MAIN_FILE>
+  <CLICON_CLISPEC_DIR>/usr/local/lib/$APPNAME/clispec</CLICON_CLISPEC_DIR>
+  <CLICON_CLI_DIR>/usr/local/lib/$APPNAME/cli</CLICON_CLI_DIR>
+  <CLICON_CLI_MODE>$APPNAME</CLICON_CLI_MODE>
+  <CLICON_SOCK>/usr/local/var/$APPNAME/$APPNAME.sock</CLICON_SOCK>
+  <CLICON_BACKEND_PIDFILE>/usr/local/var/$APPNAME/$APPNAME.pidfile</CLICON_BACKEND_PIDFILE>
+  <CLICON_XMLDB_DIR>/usr/local/var/$APPNAME</CLICON_XMLDB_DIR>
+</clixon-config>
+EOF
+
+# Example (the list server part) from RFC7950 Sec 7.8.3.1 w changed types
+cat <<EOF > $fyang
+module unique{
+  yang-version 1.1;
+  namespace "urn:example:clixon";
+  prefix un;
+  list outer{
+     key name;
+     leaf name{
+        type string;
+     }
+     unique c/inner/value;
+     container c{
+        list inner{
+           key name;
+           leaf name{
+              type string;
+           }
+           leaf value{
+              type string;
+           }
+        }
+     }
+  }
+}
+EOF
+
+new "test params: -f $cfg"
+
+if [ $BE -ne 0 ]; then
+    new "kill old backend"
+    sudo clixon_backend -zf $cfg
+    if [ $? -ne 0 ]; then
+	err
+    fi
+    new "start backend -s init -f $cfg"
+    # start new backend
+    start_backend -s init -f $cfg
+fi
+
+new "wait backend"
+wait_backend
+
+RPC=$(cat<<EOF
+$DEFAULTHELLO<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>replace</default-operation><config>
+    <outer xmlns="urn:example:clixon">
+       <name>x</name><c>
+          <inner><name>a</name><value>foo</value></inner>
+          <inner><name>b</name><value>bar</value></inner>
+       </c>
+    </outer>
+    <outer xmlns="urn:example:clixon">
+       <name>y</name><c>
+          <inner><name>a</name><value>fie</value></inner>
+          <inner><name>b</name><value>fum</value></inner>
+       </c>
+    </outer>
+</config></edit-config></rpc>]]>]]>
+EOF
+      )
+
+# RFC test two-field caes
+new "Add valid example"
+expecteof "$clixon_netconf -qf $cfg" 0 "${RPC}" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
+
+new "netconf validate ok"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
+
+new "netconf discard-changes"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><discard-changes/></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
+
+RPC=$(cat<<EOF
+$DEFAULTHELLO<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>replace</default-operation><config>
+    <outer xmlns="urn:example:clixon">
+       <name>x</name><c>
+          <inner><name>a</name><value>foo</value></inner>
+          <inner><name>b</name><value>foo</value></inner>
+       </c>
+    </outer>
+    <outer xmlns="urn:example:clixon">
+       <name>y</name><c>
+          <inner><name>a</name><value>fie</value></inner>
+          <inner><name>b</name><value>fum</value></inner>
+       </c>
+    </outer>
+</config></edit-config></rpc>]]>]]>
+EOF
+      )
+
+new "Add invalid example"
+expecteof "$clixon_netconf -qf $cfg" 0 "${RPC}" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
+
+new "netconf validate same inner (should fail)"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique>c/inner/value</non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
+
+new "netconf discard-changes"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><discard-changes/></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
+
+RPC=$(cat<<EOF
+$DEFAULTHELLO<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>replace</default-operation><config>
+    <outer xmlns="urn:example:clixon">
+       <name>x</name><c>
+          <inner><name>a</name><value>foo</value></inner>
+          <inner><name>b</name><value>bar</value></inner>
+       </c>
+    </outer>
+    <outer xmlns="urn:example:clixon">
+       <name>y</name><c>
+          <inner><name>a</name><value>fie</value></inner>
+          <inner><name>b</name><value>bar</value></inner>
+       </c>
+    </outer>
+</config></edit-config></rpc>]]>]]>
+EOF
+      )
+
+new "Add invalid example"
+expecteof "$clixon_netconf -qf $cfg" 0 "${RPC}" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
+
+new "netconf validate same in different outers (should fail)"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><validate><source><candidate/></source></validate></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique>c/inner/value</non-unique></error-info></rpc-error></rpc-reply>]]>]]>$"
+
+new "netconf discard-changes"
+expecteof "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO<rpc $DEFAULTNS><discard-changes/></rpc>]]>]]>" "^<rpc-reply $DEFAULTNS><ok/></rpc-reply>]]>]]>$"
+
+if [ $BE -ne 0 ]; then
+    new "Kill backend"
+    # Check if premature kill
+    pid=$(pgrep -u root -f clixon_backend)
+    if [ -z "$pid" ]; then
+	err "backend already dead"
+    fi
+    # kill backend
+    stop_backend -f $cfg
+fi
+
+
+rm -rf $dir
+
+unset RPC
+
+new "endtest"
+endtest