RFC 8808

A YANG Data Model for Factory Default Settings

📅 published August 2020, from ietf

RFC 8808: A YANG Data Model for Factory Default Settings 🎀

okay bestie, this one is from the IETF (Internet Engineering Task Force) and it's a Standards Track doc, so it's an actual spec that people build against 💅 it was written by Q. Wu (Huawei), B. Lengyel (Ericsson Hungary), and Y. Niu (Huawei), published August 2020, ISSN 2070-1721. the header doesn't list anything it obsoletes or updates, so it's standing on its own ✨

Abstract

this doc defines a YANG data model with a "factory-reset" RPC so clients can send a server right back to its factory default condition 🔄 it also adds an optional "factory-default" datastore, which lets clients read the factory default config for the device 👀

the YANG data model here follows the Network Management Datastore Architecture (NMDA) from RFC 8342 🧚

Status of This Memo

this is an Internet Standards Track document 🌸

it's a product of the IETF and represents the consensus of the IETF community. it went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). if you want more on Internet Standards, check Section 2 of RFC 7841 💜

info about the current status, errata, and where to send feedback lives at https://www.rfc-editor.org/info/rfc8808 🦋

Copyright Notice

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. read those carefully, they spell out your rights and restrictions 📜 any Code Components pulled out of this doc have to include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, per the Simplified BSD License 🫶

Table of Contents

   1.  Introduction
     1.1.  Terminology
   2.  "Factory-Reset" RPC
   3.  "Factory-Default" Datastore
   4.  YANG Module
   5.  IANA Considerations
   6.  Security Considerations
   7.  References
     7.1.  Normative References
     7.2.  Informative References
   Acknowledgements
   Contributors
   Authors' Addresses

1. Introduction 🌷

okay so the main point: this doc defines a YANG data model plus a mechanism to reset a server to its factory default contents 🔁 you'd use it when the existing config has major errors and starting the configuration process over from scratch is honestly the best move 🧹

there's a "factory-reset" remote procedure call (RPC) inside that YANG model. when you reset a device, every previous configuration setting gets lost and replaced with the factory default contents 💀 so yeah, be careful with it.

there's also an optional "factory-default" read-only datastore in the model. it holds the data that replaces the contents of the implemented read-write conventional configuration datastores at reset, and you can also use it with the <get-data> operation 🍓

the YANG data model here conforms to the Network Management Datastore Architecture defined in [RFC8342] ✨

1.1. Terminology

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, just like shown here 🎯

the following terms are defined in [RFC8342] and [RFC7950], and they're not redefined here:

server
startup configuration datastore
candidate configuration datastore
running configuration datastore
intended configuration datastore
operational state datastore
conventional configuration datastore
datastore schema
RPC operation

this doc defines one more term:

"factory-default" datastore: a read-only configuration datastore holding a preset initial configuration that is used to initialize the configuration of a server 🧸 it's referred to as "<factory-default>" 🎀

2. "Factory-Reset" RPC ✨

this doc introduces a brand new "factory-reset" RPC 🆕 when the RPC gets received, here's what happens:

all supported conventional read-write configuration datastores (i.e., <running>, <startup>, and <candidate>) are reset to the contents of <factory-default> 🔄
read-only datastores get their contents from other datastores (e.g., <intended> gets its contents from <running>) 🫧
all data in any dynamic configuration datastores MUST be discarded 🗑️
the contents of the <operational> datastore MUST reflect the operational state of the device after applying the factory default configuration 👑

also, the "factory-reset" RPC MUST restore nonvolatile storage to factory condition 💅 depending on the system, that can mean deleting dynamically generated files, like ones holding keys (e.g., /etc/ssl/private), certificates (e.g., /etc/ssl), logs (e.g., /var/log), and temporary files (e.g., /tmp/*) 🧹 any other cryptographic keys that came with the factory-installed image get kept, like an Initial Device Identifier (IDevID) certificate [BRSKI] 🔐

when this process includes security-sensitive data like cryptographic keys or passwords, it is RECOMMENDED to do the deletion as thoroughly as possible (e.g., overwriting the physical storage medium with zeros and/or random bits for repurposing or end-of-life (EOL) disposal) so the sensitive material is less likely to be recoverable 🚨

the "factory-reset" RPC MAY also be used to trigger other resetting tasks, like restarting the node or some of the software processes 🔧

note that operators should know that since all read-write datastores get immediately reset to factory default, the device may become unreachable as a host on the network 🙈 it's important to understand how a given vendor's device behaves after the RPC runs. Implementors SHOULD reboot the device and get it properly configured, or otherwise restart the processes needed to bootstrap it 🚀

3. "Factory-Default" Datastore 🦋

following the guidelines for defining datastores in Appendix A of [RFC8342], this doc introduces a new optional datastore resource named "factory-default". it represents a preset initial configuration that can be used to initialize the configuration of a server 🧚 a device MAY implement the "factory-reset" RPC without implementing the "factory-default" datastore. that would only remove the ability to programmatically determine the factory default configuration 🤷‍♀️

here's the datastore definition, field by field 📋

Name: "factory-default".
YANG modules: the "factory-default" datastore schema MUST be either (1) the same as the conventional configuration datastores or (2) a subset of the datastore schema for the conventional configuration datastores.
YANG nodes: all "config true" data nodes.
Management operations: the contents of the datastore are set by the server in an implementation-dependent manner. the contents cannot be changed by management operations via the Network Configuration Protocol (NETCONF), RESTCONF, the CLI, etc., unless specialized, dedicated operations are provided 🙅‍♀️ the datastore can be read using the standard NETCONF/RESTCONF protocol operations. the "factory-reset" operation copies the factory default contents to <running> and, if present, <startup> and/or <candidate>. then the contents of these datastores get propagated automatically to any other read-only datastores, e.g., <intended> and <operational> 💫
Origin: this doc does not define a new origin identity, since it doesn't interact with the <operational> datastore 🫶
Protocols: RESTCONF, NETCONF, and other management protocols.
Defining YANG module: "ietf-factory-default".

the contents of <factory-default> are defined by the device vendor and MUST persist across device restarts 🔥 if it's supported, the "factory-default" datastore MUST be included in the list of datastores in the YANG library [RFC8525] 👑

4. YANG Module ✨

okay so this section is where the actual YANG module lives 🎀 it uses the "datastore" identity from [RFC8342] and the "default-deny-all" extension statement from [RFC8341], so bestie, those are the two things it's borrowing 💅

The file is ietf-factory-default@2020-08-31.yang 🦋

module ietf-factory-default {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-factory-default";
  prefix fd;

  import ietf-datastores {
    prefix ds;
    reference
      "RFC 8342: Network Management Datastore Architecture
       (NMDA)";
  }
  import ietf-netconf-acm {
    prefix nacm;
    reference
      "RFC 8341: Network Configuration Access Control Model";
  }

  organization
    "IETF Network Modeling (netmod) Working Group";
  contact
    "WG Web:   <https://datatracker.ietf.org/wg/netmod/>
     WG List:  <mailto:netmod@ietf.org>

     Editor:   Qin Wu
               <mailto:bill.wu@huawei.com>

     Editor:   Balazs Lengyel
               <mailto:balazs.lengyel@ericsson.com>

     Editor:   Ye Niu
               <mailto:niuye@huawei.com>";
  description
    "This module provides functionality to reset a server to its
     factory default configuration and, when supported, to
     discover the factory default configuration contents
     independently of resetting the server.

     Copyright (c) 2020 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject
     to the license terms contained in, the Simplified BSD License
     set forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC 8808; see the
     RFC itself for full legal notices.";

  revision 2020-08-31 {
    description
      "Initial revision.";
    reference
      "RFC 8808: A YANG Data Model for Factory Default Settings";
  }

  feature factory-default-datastore {
    description
      "Indicates that the factory default configuration is
       available as a datastore.";
  }

  rpc factory-reset {
    nacm:default-deny-all;
    description
      "The server resets all datastores to their factory
       default contents and any nonvolatile storage back to
       factory condition, deleting all dynamically
       generated files, including those containing keys,
       certificates, logs, and other temporary files.

       Depending on the factory default configuration, after
       being reset, the device may become unreachable on the
       network.";
  }

  identity factory-default {
    if-feature "factory-default-datastore";
    base ds:datastore;
    description
      "This read-only datastore contains the factory default
       configuration for the device that will be used to replace
       the contents of the read-write conventional configuration
       datastores during a 'factory-reset' RPC operation.";
  }
}

5. IANA Considerations 🌸

IANA has some registering to do 📝 It's registering the namespace URI in the "ns" subregistry of the "IETF XML Registry" [RFC3688], and it's also adding the YANG module to the "YANG Module Names" subregistry [RFC6020] inside the "YANG Parameters" registry. Here's the exact paperwork:

URI:  urn:ietf:params:xml:ns:yang:ietf-factory-default
Registrant Contact:  The IESG.
XML:  N/A; the requested URI is an XML namespace.

Name:  ietf-factory-default
Namespace:  urn:ietf:params:xml:ns:yang:ietf-factory-default
Prefix:  fd
Reference:  8808

6. Security Considerations 🔥

okay this part is seriously important bestie, so pay attention 🚨 The YANG module in this document defines a schema for data that's meant to be reached through network management protocols like NETCONF [RFC6241] or RESTCONF [RFC8040]. The bottom layer of NETCONF is the secure transport layer, and the secure transport it must support is Secure Shell (SSH) [RFC6242]. The bottom layer of RESTCONF is HTTPS, and its mandatory-to-implement secure transport is TLS [RFC8446].

The Network Configuration Access Control Model (NACM) [RFC8341] is what lets you restrict particular NETCONF or RESTCONF users to a preset subset of the protocol operations and content available to them 🔐

Access to the "factory-reset" RPC operation, plus the factory default values of every configuration data node in the "factory-default" datastore, is considered sensitive 😭 That's why it's locked down with the "default-deny-all" access control statement defined in [RFC8341].

The "factory-reset" RPC can stop any further management of the device once it's reset back to factory default condition. For example, the session and client configurations might be part of the factory default contents, or get treated as dynamic files in nonvolatile storage and overwritten by the "factory-reset" RPC.

The operational disruption from setting the configuration to factory default contents, or from not having proper security control over the factory default configuration, varies a LOT depending on the implementation and the current configuration 💀

The nonvolatile storage is expected to get wiped clean and reset to the factory default state. However, there's no guarantee that the data is wiped according to any particular data-cleansing standard. So the owner of the device MUST NOT rely on any sensitive data (for example, private keys) being forensically unrecoverable from the device's nonvolatile storage after a "factory-reset" RPC has been invoked 🙈

7. References 📚

7.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC3688]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
           DOI 10.17487/RFC3688, January 2004,
           <https://www.rfc-editor.org/info/rfc3688>.

[RFC6020]  Bjorklund, M., Ed., "YANG - A Data Modeling Language for
           the Network Configuration Protocol (NETCONF)", RFC 6020,
           DOI 10.17487/RFC6020, October 2010,
           <https://www.rfc-editor.org/info/rfc6020>.

[RFC6241]  Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
           and A. Bierman, Ed., "Network Configuration Protocol
           (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
           <https://www.rfc-editor.org/info/rfc6241>.

[RFC6242]  Wasserman, M., "Using the NETCONF Protocol over Secure
           Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
           <https://www.rfc-editor.org/info/rfc6242>.

[RFC7950]  Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
           RFC 7950, DOI 10.17487/RFC7950, August 2016,
           <https://www.rfc-editor.org/info/rfc7950>.

[RFC8040]  Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
           Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
           <https://www.rfc-editor.org/info/rfc8040>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8341]  Bierman, A. and M. Bjorklund, "Network Configuration
           Access Control Model", STD 91, RFC 8341,
           DOI 10.17487/RFC8341, March 2018,
           <https://www.rfc-editor.org/info/rfc8341>.

[RFC8342]  Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,
           and R. Wilton, "Network Management Datastore Architecture
           (NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018,
           <https://www.rfc-editor.org/info/rfc8342>.

[RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
           Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
           <https://www.rfc-editor.org/info/rfc8446>.

[RFC8525]  Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K.,
           and R. Wilton, "YANG Library", RFC 8525,
           DOI 10.17487/RFC8525, March 2019,
           <https://www.rfc-editor.org/info/rfc8525>.

7.2. Informative References

[BRSKI]    Pritikin, M., Richardson, M. C., Eckert, T., Behringer, M.
           H., and K. Watsen, "Bootstrapping Remote Secure Key
           Infrastructures (BRSKI)", Work in Progress, Internet-
           Draft, draft-ietf-anima-bootstrapping-keyinfra-43, 7
           August 2020, <https://tools.ietf.org/html/draft-ietf-
           anima-bootstrapping-keyinfra-43>.

Acknowledgements 🫶

Huge thanks to Juergen Schoenwaelder, Ladislav Lhotka, Alex Campbell, Joe Clarke, Robert Wilton, Kent Watsen, Joel Jaeggli, Lou Berger, Andy Bierman, Susan Hares, Benjamin Kaduk, Stephen Kent, Stewart Bryant, Éric Vyncke, Murray Kucherawy, Roman Danyliw, Tony Przygienda, and John Heasley for reviewing this document and giving important input 👑

Contributors 💜

Rohit R Ranade
Huawei

Email: rohitrranade@huawei.com

Authors' Addresses 🧚

Qin Wu
Huawei
Yuhua District
101 Software Avenue
Nanjing
Jiangsu, 210012
China

Email: bill.wu@huawei.com


Balazs Lengyel
Ericsson Hungary
Budapest
Magyar Tudosok korutja 11
1117
Hungary

Phone: +36-70-330-7909
Email: balazs.lengyel@ericsson.com


Ye Niu
Huawei

Email: niuye@huawei.com

That's the whole thing, bestie! 🌈✨ RFC 8808 is a wrap 💅🦋

📦 where this page comes from

ietf: rfc8808 2020-08
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms