RFC 8526
NETCONF Extensions to Support the Network Management Datastore Architecture
RFC 8526: NETCONF Extensions to Support the Network Management Datastore Architecture ✨
okay bestie, this one is a Standards Track doc from the IETF, dated March 2019 🎀 The authors are M. Bjorklund (Tail-f Systems), J. Schoenwaelder (Jacobs University), P. Shafer (Juniper Networks), K. Watsen (Watsen Networks), and R. Wilton (Cisco Systems). The ISSN is 2070-1721 🦋 It updates RFC 6241 and RFC 7950, which is the main plot twist, so keep that in mind as we go 👑
Abstract 🌸
okay so this doc extends NETCONF from RFC 6241 so it can support the Network Management Datastore Architecture (NMDA) from RFC 8342 💖 It also updates RFCs 6241 and 7950. The RFC 6241 update adds new <get-data> and <edit-data> operations and augments the existing <lock>, <unlock>, and <validate> operations ✨ The RFC 7950 update means NETCONF servers doing NMDA have to use the YANG library (described in RFC 8525) 💅
Status of This Memo 🧚
this is an Internet Standards Track document 🔥
it's a product of the IETF, so it reflects what the IETF community agreed on 🫶 it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). if you want more on Internet Standards, check Section 2 of RFC 7841 🍓
for the current status, errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8526 🌈
Copyright Notice 💜
Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.
so this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they were on the publication date 📜 please actually read those, because they're your rights and restrictions 🙈 any Code Components pulled out of this doc have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 💅
Table of Contents 🎀
1. Introduction ....................................................3
1.1. Terminology ................................................3
1.2. Tree Diagrams ..............................................3
2. Datastore and YANG Library Requirements .........................3
3. NETCONF Extensions ..............................................4
3.1. New NETCONF Operations .....................................4
3.1.1. The <get-data> Operation ............................4
3.1.2. The <edit-data> Operation ..........................10
3.2. Augmentations to NETCONF Operations .......................11
4. NETCONF Datastores YANG Module .................................12
5. IANA Considerations ............................................20
6. Security Considerations ........................................21
7. References .....................................................21
7.1. Normative References ......................................21
7.2. Informative References ....................................22
Authors' Addresses ................................................231. Introduction ✨
okay so this doc extends the NETCONF protocol from [RFC6241] so it can support the Network Management Datastore Architecture (NMDA) from [RFC8342] 🦋
this doc updates [RFC6241] so NETCONF clients can talk to all the datastores a server doing the NMDA supports 💖 It adds new <get-data> and <edit-data> operations and augments the existing <lock>, <unlock>, and <validate> operations, so it's a lot of glow-up energy ✨
it also updates [RFC7950] so NETCONF clients can figure out which datastores the server supports and which modules are supported in each one 🧚 That update means NETCONF servers doing the NMDA have to support the YANG library [RFC8525] 👑
1.1. Terminology
this doc uses the terminology the NMDA defines in [RFC8342] 🌸
the following term is defined in [RFC8525]:
- YANG library content identifier
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are to be read as described in BCP 14 [RFC2119] [RFC8174] only when they show up in all capitals, like they do right here 💅 otherwise they're just regular words, bestie 🙈
1.2. Tree Diagrams
tree diagrams in this doc follow the notation from [RFC8340] 🍓
2. Datastore and YANG Library Requirements 🔥
okay this part is important, so listen up 👀 an NMDA-compliant NETCONF server MUST implement the "ietf-netconf-nmda" module defined in this doc, MUST support the operational state datastore, and MUST implement at least revision 2019-01-04 of the "ietf-yang-library" module defined in [RFC8525] 💖
a NETCONF client can find out which datastores and YANG modules the server supports by reading the YANG library info from the operational state datastore 🧚
the server MUST advertise the following capability in the <hello> message. the line breaks and whitespace are only there for formatting, so they don't mean anything 🎀
urn:ietf:params:netconf:capability:yang-library:1.1?
revision=<date>&content-id=<content-id-value>the "revision" parameter has the same value as the revision date of the "ietf-yang-library" module the server implements 🌈 This parameter MUST be present ✨
the "content-id" parameter holds the YANG library content identifier [RFC8525] 💅 This parameter MUST be present too 👑
this is the cute part: a client can cache the supported datastores and YANG modules for a server, and only refresh that cache if the "content-id" value in the <hello> message changes 🦋 no extra work, just vibes 🫶
this doc updates Section 5.6.4 of [RFC7950] so servers can advertise the capability :yang-library:1.1 instead of :yang-library:1.0, and so they implement the subtree "/yang-library" [RFC8525] instead of "/modules-state" 🔥
3. NETCONF Extensions 💜
this section describes the NETCONF extensions you need to support the NMDA 🧚 The changes are defined in the new "ietf-netconf-nmda" YANG [RFC7950] module 🎀
these changes use source and target parameters based on the "datastore" identity defined in the "ietf-datastores" module [RFC8342] 💖 Using identities means future expansion can happen in a way that the choice-based strategy from the original operations (like <get-config> and <edit-config>) just can't do 👑
3.1. New NETCONF Operations ✨
two new operations, <get-data> and <edit-data>, are defined in this doc to support the NMDA 🦋 They're similar to <get-config> and <edit-config>, but they can work on an extensible set of datastores, which is so iconic 💅
3.1.1. The <get-data> Operation 🌸
the <get-data> operation retrieves data from a specific NMDA datastore 🍓 It's similar to NETCONF's <get-config> operation defined in [RFC6241], but it adds the flexibility to pick the source datastore 🌈
here's the tree for it, copied exactly 🧚
+---x get-data
+---w input
| +---w datastore ds:datastore-ref
| +---w (filter-spec)?
| | +--:(subtree-filter)
| | | +---w subtree-filter? <anydata>
| | +--:(xpath-filter)
| | +---w xpath-filter? yang:xpath1.0 {nc:xpath}?
| +---w config-filter? boolean
| +---w (origin-filters)? {origin}?
| | +--:(origin-filter)
| | | +---w origin-filter* or:origin-ref
| | +--:(negated-origin-filter)
| | +---w negated-origin-filter* or:origin-ref
| +---w max-depth? union
| +---w with-origin? empty {origin}?
| +---w with-defaults? with-defaults-mode
+--ro output
+--ro data? <anydata>the "datastore" parameter says which datastore the data gets pulled from 💅 It's a "datastore" identity, so it's giving precision 💖
the <get-data> operation takes a content filter parameter, which is like the "filter" parameter of <get-config>, but it uses explicit nodes for subtree filtering ("subtree-filter") and XPath filtering ("xpath-filter") ✨
the "config-filter" parameter can be used to get only "config true" nodes or only "config false" nodes 🔥
the "origin-filter" parameter can show up multiple times, and it selects nodes equal to or derived from any of the given values 🧚 the "negated-origin-filter" can also show up multiple times, and it selects nodes that are not equal to or derived from any of the given values 🙈 the "origin-filter" and "negated-origin-filter" parameters cannot be used together, so don't try 💀
the "max-depth" parameter lets the client limit how many subtree levels come back in the reply 🌈
3.1.1.1. "origin" Metadata Annotation 🦋
the <get-data> operation defines a parameter called "with-origin". If it's present, it asks the server to include "origin" metadata annotations in its response, as the NMDA details 💜 This parameter is only valid for the operational state datastore and for any datastores with identities derived from the "operational" identity 🎀 If you specify an invalid datastore, you get an error back, as specified in the "ietf-netconf-nmda" module (see Section 4) 😭 Note that "origin" metadata annotations are not included in a response unless a client explicitly asks for them 🫶
operational state data can come from multiple sources 🌸 The server should return the "origin" metadata annotation value that most accurately shows where the operational value came from, as specified in Section 5.3.4 of [RFC8342] 💅
when you encode the "origin" metadata annotation for a hierarchy of returned nodes, the annotation may be left off a child node when its value matches the parent node's value, as described in the "ietf-origin" YANG module [RFC8342] ✨
support for the "with-origin" parameter is OPTIONAL 🍓 It's identified with the feature "origin" 🌈
3.1.1.2. "with-defaults" Interactions ✨
okay so if the server has the "with-defaults" capability 💅, then the "with-defaults" parameter from [RFC6243] works for <get-data> operations that hit the conventional configuration datastores 🎀
supporting "with-defaults" for <get-data> on <operational> is OPTIONAL 🙈 the server says it can do it using this URI:
urn:ietf:params:netconf:capability:with-operational-defaults:1.0if a server does support it for <operational>, then every retrieval mode listed in either the 'basic-mode' or 'also-supported' parameter of the "with-defaults" capability is allowed 🧚 here's how it works:
- if there's no "with-defaults" parameter, or it's set to "explicit", "report-all", or "report-all-tagged", you get the "in use" values from Section 5.3 of [RFC8342] back from the operational state datastore 🦋 this is true even when a node has a default statement in its YANG module and the server is actually using that default. if it's "report-all-tagged", any value that matches the schema default gets extra metadata tags, as described in Section 3.4 of [RFC6243] 🏷️
- if the "with-defaults" parameter is "trim", you still get all the "in use" values, but anything that matches the default in the YANG schema gets filtered out 💜
support for "with-defaults" in <get-data> on any datastore not defined in [RFC8342] should be defined by that datastore's own specification 🌈
3.1.1.3. Example: Retrieving an Entire Subtree from <running> 🍓
this is the <get-data> version of the <get-config> example from Section 7.1 of [RFC6241] 🌸 it grabs the whole "/users" subtree:
<rpc message-id="101"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-data xmlns="urn:ietf:params:yang:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores">
<datastore>ds:running</datastore>
<subtree-filter>
<top xmlns="http://example.com/schema/1.2/config">
<users/>
</top>
</subtree-filter>
</get-data>
</rpc>
<rpc-reply message-id="101"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda">
<top xmlns="http://example.com/schema/1.2/config">
<users>
<user>
<name>root</name>
<type>superuser</type>
<full-name>Charlie Root</full-name>
<company-info>
<dept>1</dept>
<id>1</id>
</company-info>
</user>
<!-- additional <user> elements appear here... -->
</users>
</top>
</data>
</rpc-reply>3.1.1.4. Example: Retrieving a Filtered Subtree from <operational> 🔥
this one shows how "origin-filter" lets you pull specific nodes out of <operational> 👑 it uses the made-up data model from Appendix C of [RFC8342] 🤭
<rpc message-id="102"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores"
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin">
<datastore>ds:operational</datastore>
<subtree-filter>
<bgp xmlns="http://example.com/ns/bgp"/>
</subtree-filter>
<origin-filter>or:intended</origin-filter>
<origin-filter>or:system</origin-filter>
<with-origin/>
</get-data>
</rpc>
<rpc-reply message-id="102"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda">
<bgp xmlns="http://example.com/ns/bgp"
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin"
or:origin="or:intended">
<peer>
<name>2001:db8::2:3</name>
<local-port or:origin="or:system">60794</local-port>
<state>established</state>
</peer>
</bgp>
</data>
</rpc-reply>if you don't want any system state nodes showing up, the "config-filter" does that job 🫶
<rpc message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores"
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin">
<datastore>ds:operational</datastore>
<subtree-filter>
<bgp xmlns="http://example.com/ns/bgp"/>
</subtree-filter>
<config-filter>true</config-filter>
<origin-filter>or:intended</origin-filter>
<origin-filter>or:system</origin-filter>
<with-origin/>
</get-data>
</rpc>
<rpc-reply message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<data xmlns="urn:ietf:params:yang:ns:yang:ietf-netconf-nmda">
<bgp xmlns="http://example.com/ns/bgp"
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin"
or:origin="or:intended">
<peer>
<name>2001:db8::2:3</name>
<local-port or:origin="or:system">60794</local-port>
</peer>
</bgp>
</data>
</rpc-reply>3.1.2. The <edit-data> Operation ✍️
the <edit-data> operation changes what's inside a writable datastore 💖 it's like <edit-config> from [RFC6241], but you get more freedom to name the target datastore 🦋 if you call <edit-data> on a datastore that isn't writable, you get an error, as defined in the "ietf-netconf-nmda" module (see Section 4) 😭
+---x edit-data
+---w input
+---w datastore ds:datastore-ref
+---w default-operation? enumeration
+---w (edit-content)
+--:(config)
| +---w config? <anydata>
+--:(url)
+---w url? inet:uri {nc:url}?"datastore" is a "datastore" identity that says which datastore you want to change 🎯
"default-operation" picks the default operation to use. it's a copy of the "default-operation" parameter from <edit-config> 💅
"edit-content" holds the content for the edit. it mirrors the "edit-content" choice in <edit-config>. but heads up: the "config" element in <edit-data> uses "anydata" (added in YANG 1.1 [RFC7950]), while <edit-config> used "anyxml" 👀
<edit-data> doesn't support the "error-option" and "test-option" parameters that <edit-config> had. its error behaviour matches the "rollback-on-error" value of "error-option" ✨
if the server supports the "with-defaults" capability, editing modes work the same as <edit-config>, as described in Section 4.5.2 of [RFC6243] 🌷
the semantics for "with-defaults" in <edit-data> on any non-conventional configuration datastore should be defined by that datastore's specification 🧚
3.1.2.1. Example: Setting a Leaf of an Interface in <running> 🎀
this example is the <edit-data> version of the first <edit-config> example in Section 7.2 of [RFC6241] 💜 it sets the MTU to 1500 on an interface called "Ethernet0/0" in the running configuration datastore 🌈
<rpc message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<edit-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores">
<datastore>ds:running</datastore>
<config>
<top xmlns="http://example.com/schema/1.2/config">
<interface>
<name>Ethernet0/0</name>
<mtu>1500</mtu>
</interface>
</top>
</config>
</edit-data>
</rpc>
<rpc-reply message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<ok/>
</rpc-reply>the other <edit-config> examples in Section 7.2 of [RFC6241] can be turned into <edit-data> examples in a similar way ⭐
3.2. Augmentations to NETCONF Operations 🧩
a few operations from the base NETCONF YANG module "ietf-netconf" [RFC6241] can be used with the new datastores 🌸 so the <lock>, <unlock>, and <validate> operations get a new "datastore" leaf to pick the datastore they act on 🔐 if <lock>, <unlock>, or <validate> isn't supported on a particular datastore, you get an error, as defined in the "ietf-netconf-nmda" module (see Section 4) 🙃
4. NETCONF Datastores YANG Module 💎
this module imports definitions from [RFC6991], [RFC6241], [RFC6243], and [RFC8342] 🫧
<CODE BEGINS> file "ietf-netconf-nmda@2019-01-07.yang"
module ietf-netconf-nmda {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-nmda";
prefix ncds;
import ietf-yang-types {
prefix yang;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-datastores {
prefix ds;
reference
"RFC 8342: Network Management Datastore Architecture
(NMDA)";
}
import ietf-origin {
prefix or;
reference
"RFC 8342: Network Management Datastore Architecture
(NMDA)";
}
import ietf-netconf {
prefix nc;
reference
"RFC 6241: Network Configuration Protocol (NETCONF)";
}
import ietf-netconf-with-defaults {
prefix ncwd;
reference
"RFC 6243: With-defaults Capability for NETCONF";
}
organization
"IETF NETCONF Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/netconf/>
WG List: <mailto:netconf@ietf.org>
Author: Martin Bjorklund
<mailto:mbj@tail-f.com>
Author: Juergen Schoenwaelder
<mailto:j.schoenwaelder@jacobs-university.de>
Author: Phil Shafer
<mailto:phil@juniper.net>
Author: Kent Watsen
<mailto:kent+ietf@watsen.net>
Author: Robert Wilton
<mailto:rwilton@cisco.com>";
description
"This YANG module defines a set of NETCONF operations to support
the Network Management Datastore Architecture (NMDA).
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
'MAY', and 'OPTIONAL' in this document are to be interpreted as
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
they appear in all capitals, as shown here.
Copyright (c) 2019 IETF Trust and the persons identified as
authors of the code. All rights reserved.okay the license text is still going, bestie 💖
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Simplified BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 8526; see
the RFC itself for full legal notices.";
revision 2019-01-07 {
description
"Initial revision.";
reference
"RFC 8526: NETCONF Extensions to Support the Network Management
Datastore Architecture";
}
feature origin {
description
"Indicates that the server supports the 'origin' annotation.";
reference
"RFC 8342: Network Management Datastore Architecture (NMDA)";
}
feature with-defaults {
description
"NETCONF :with-defaults capability. If the server advertises
the :with-defaults capability for a session, then this
feature must also be enabled for that session. Otherwise,
this feature must not be enabled.";
reference
"RFC 6243: With-defaults Capability for NETCONF, Section 4; and
RFC 8526: NETCONF Extensions to Support the Network Management
Datastore Architecture, Section 3.1.1.2";
}
rpc get-data {
description
"Retrieve data from an NMDA datastore. The content returned
by get-data must satisfy all filters, i.e., the filter
criteria are logically ANDed.
Any ancestor nodes (including list keys) of nodes selected by
the filters are included in the response.
The 'with-origin' parameter is only valid for an operational
datastore. If 'with-origin' is used with an invalid
datastore, then the server MUST return an <rpc-error> element
with an <error-tag> value of 'invalid-value'.
The 'with-defaults' parameter only applies to the operational
datastore if the NETCONF :with-defaults and
:with-operational-defaults capabilities are both advertised.
If the 'with-defaults' parameter is present in a request for
which it is not supported, then the server MUST return an
<rpc-error> element with an <error-tag> value of
'invalid-value'.";
input {
leaf datastore {
type ds:datastore-ref;
mandatory true;
description
"Datastore from which to retrieve data.
If the datastore is not supported by the server, then the
server MUST return an <rpc-error> element with an
<error-tag> value of 'invalid-value'.";
}
choice filter-spec {
description
"The content filter specification for this request.";
anydata subtree-filter {
description
"This parameter identifies the portions of the
target datastore to retrieve.";
reference
"RFC 6241: Network Configuration Protocol (NETCONF),
Section 6";
}
leaf xpath-filter {
if-feature "nc:xpath";
type yang:xpath1.0;
description
"This parameter contains an XPath expression identifying
the portions of the target datastore to retrieve.
If the expression returns a node-set, all nodes in the
node-set are selected by the filter. Otherwise, if the
expression does not return a node-set, then the
<get-data> operation fails.
The expression is evaluated in the following XPath
context:
o The set of namespace declarations are those in
scope on the 'xpath-filter' leaf element.
o The set of variable bindings is empty.
o The function library is the core function library,
and the XPath functions are defined in Section 10
of RFC 7950.
o The context node is the root node of the target
datastore.";
}
}
leaf config-filter {
type boolean;
description
"Filter for nodes with the given value for their 'config'
property. When this leaf is set to 'true', only 'config
true' nodes are selected, and when set to 'false', only
'config false' nodes are selected. If this leaf is not
present, no nodes are filtered.";
}
choice origin-filters {
when 'derived-from-or-self(datastore, "ds:operational")';
if-feature "origin";
description
"Filters configuration nodes based on the 'origin'
annotation. Configuration nodes that do not have an
'origin' annotation are treated as if they have the
'origin' annotation 'or:unknown'.
System state nodes are not affected by origin-filters and
thus not filtered. Note that system state nodes can be
filtered with the 'config-filter' leaf.";
leaf-list origin-filter {
type or:origin-ref;
description
"Filter based on the 'origin' annotation. A
configuration node matches the filter if its 'origin'
annotation is derived from or equal to any of the given
filter values.";
}
leaf-list negated-origin-filter {
type or:origin-ref;
description
"Filter based on the 'origin' annotation. A
configuration node matches the filter if its 'origin'
annotation is neither derived from nor equal to any of
the given filter values.";
}
}
leaf max-depth {
type union {
type uint16 {
range "1..65535";
}
type enumeration {
enum unbounded {
description
"All descendant nodes are included.";
}
}
}
default "unbounded";
description
"For each node selected by the filters, this parameter
selects how many conceptual subtree levels should be
returned in the reply. If the depth is 1, the reply
includes just the selected nodes but no children. If the
depth is 'unbounded', all descendant nodes are included.";
}
leaf with-origin {
when 'derived-from-or-self(../datastore, "ds:operational")';
if-feature "origin";
type empty;
description
"If this parameter is present, the server will return
the 'origin' annotation for the nodes that have one.";
}
uses ncwd:with-defaults-parameters {
if-feature "with-defaults";
}
}
output {
anydata data {
description
"Copy of the source datastore subset that matched
the filter criteria (if any). An empty data
container indicates that the request did not
produce any results.";
}
}
}
rpc edit-data {
description
"Edit data in an NMDA datastore.
If an error condition occurs such that an error severity
<rpc-error> element is generated, the server will stop
processing the <edit-data> operation and restore the
specified configuration to its complete state at
the start of this <edit-data> operation.";
input {
leaf datastore {
type ds:datastore-ref;
mandatory true;
description
"Datastore that is the target of the <edit-data> operation.
If the target datastore is not writable, or is not
supported by the server, then the server MUST return an
<rpc-error> element with an <error-tag> value of
'invalid-value'.";
}
leaf default-operation {
type enumeration {
enum merge {
description
"The default operation is merge.";
}
enum replace {
description
"The default operation is replace.";
}
enum none {
description
"There is no default operation.";
}
}
default "merge";
description
"The default operation to use.";
}
choice edit-content {
mandatory true;
description
"The content for the edit operation.";
anydata config {
description
"Inline config content.";
}
leaf url {
if-feature "nc:url";
type inet:uri;
description
"URL-based config content.";
}
}
}
}
/*
* Augment the <lock> and <unlock> operations with a
* "datastore" parameter.
*/
augment "/nc:lock/nc:input/nc:target/nc:config-target" {
description
"Add NMDA datastore as target.";
leaf datastore {
type ds:datastore-ref;
description
"Datastore to lock.
The <lock> operation is only supported on writable
datastores.
If the <lock> operation is not supported by the server on
the specified target datastore, then the server MUST return
an <rpc-error> element with an <error-tag> value of
'invalid-value'.";
}
}
augment "/nc:unlock/nc:input/nc:target/nc:config-target" {
description
"Add NMDA datastore as target.";
leaf datastore {
type ds:datastore-ref;
description
"Datastore to unlock.
The <unlock> operation is only supported on writable
datastores.
If the <unlock> operation is not supported by the server on
the specified target datastore, then the server MUST return
an <rpc-error> element with an <error-tag> value of
'invalid-value'.";
}
}
/*
* Augment the <validate> operation with a
* "datastore" parameter.
*/
augment "/nc:validate/nc:input/nc:source/nc:config-source" {
description
"Add NMDA datastore as source.";
leaf datastore {
type ds:datastore-ref;
description
"Datastore to validate.
The <validate> operation is supported only on configuration
datastores.
If the <validate> operation is not supported by the server
on the specified target datastore, then the server MUST
return an <rpc-error> element with an <error-tag> value of
'invalid-value'.";
}
}
}
<CODE ENDS>more of the module is coming, stay tuned 🦋
5. IANA Considerations 🎀
Okay bestie, time for the paperwork 📋 IANA gets two new capability identifier URNs in the "Network Configuration Protocol (NETCONF) Capability URNs" registry, and they look like this:
Index
Capability Identifier
---------------------
:yang-library:1.1
urn:ietf:params:netconf:capability:yang-library:1.1
:with-operational-defaults
urn:ietf:params:netconf:capability:with-operational-defaults:1.0This document also registers a URI in the "IETF XML Registry" [RFC3688] 💜 Following the format in RFC 3688, the registration looks like this:
URI: urn:ietf:params:xml:ns:yang:ietf-netconf-nmda
Registrant Contact: The IESG.
XML: N/A, the requested URI is an XML namespace.And last but not least, a YANG module goes into the "YANG Module Names" registry [RFC6020] ✨
name: ietf-netconf-nmda
namespace: urn:ietf:params:xml:ns:yang:ietf-netconf-nmda
prefix: ncds
reference: RFC 85266. Security Considerations 🔐💀
Okay, this section is serious, so listen up 👑 The YANG module in this document extends the base operations of the NETCONF [RFC6241] protocol. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. Think of SSH as the bodyguard 🧱
The Network Configuration Access Control Model (NACM) [RFC8341] is what lets you restrict access for particular NETCONF users. You get to pick a preconfigured subset of all the available NETCONF protocol operations and content, so people only touch what they're allowed to touch. Main character security energy 😤
The security considerations for the base NETCONF protocol operations (see Section 9 of [RFC6241]) apply to the new NETCONF <get-data> and <edit-data> operations defined in this document. So everything you already know about the base operations carries over to these two, no exceptions 🫶
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
DOI 10.17487/RFC3688, January 2004,
<https://www.rfc-editor.org/info/rfc3688>.
[RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for
the Network Configuration Protocol (NETCONF)", RFC 6020,
DOI 10.17487/RFC6020, October 2010,
<https://www.rfc-editor.org/info/rfc6020>.
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<https://www.rfc-editor.org/info/rfc6241>.
[RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure
Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
<https://www.rfc-editor.org/info/rfc6242>.
[RFC6243] Bierman, A. and B. Lengyel, "With-defaults Capability for
NETCONF", RFC 6243, DOI 10.17487/RFC6243, June 2011,
<https://www.rfc-editor.org/info/rfc6243>.
[RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types",
RFC 6991, DOI 10.17487/RFC6991, July 2013,
<https://www.rfc-editor.org/info/rfc6991>.
[RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
RFC 7950, DOI 10.17487/RFC7950, August 2016,
<https://www.rfc-editor.org/info/rfc7950>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration
Access Control Model", STD 91, RFC 8341,
DOI 10.17487/RFC8341, March 2018,
<https://www.rfc-editor.org/info/rfc8341>.
[RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,
and R. Wilton, "Network Management Datastore Architecture
(NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018,
<https://www.rfc-editor.org/info/rfc8342>.
[RFC8525] Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K.,
and R. Wilton, "YANG Library", RFC 8525,
DOI 10.17487/RFC8525, March 2019,
<https://www.rfc-editor.org/info/rfc8525>.7.2. Informative References
[RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
<https://www.rfc-editor.org/info/rfc8340>.Authors' Addresses 🫶🦋
Martin Bjorklund
Tail-f Systems
Email: mbj@tail-f.com
Juergen Schoenwaelder
Jacobs University
Email: j.schoenwaelder@jacobs-university.de
Phil Shafer
Juniper Networks
Email: phil@juniper.net
Kent Watsen
Watsen Networks
Email: kent+ietf@watsen.net
Robert Wilton
Cisco Systems
Email: rwilton@cisco.com📦 where this page comes from
- ietf: rfc8526 2019-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms