Network Working Group                                       M. Bjorklund
Internet-Draft                                            Tail-f Systems
Updates: 6241, 7950 (if approved)                       J. Schoenwaelder
Intended status: Standards Track                       Jacobs University
Expires: May 3, July 21, 2018                                         P. Shafer
                                                               K. Watsen
                                                        Juniper Networks
                                                               R. Wilton
                                                           Cisco Systems
                                                        October 30, 2017
                                                        January 17, 2018

     NETCONF Model for NMDA
                   draft-ietf-netconf-nmda-netconf-01

Abstract

   The "Network Extensions to Support the Network Management Datastore Architecture" (NMDA) improves on
                              Architecture
                   draft-ietf-netconf-nmda-netconf-02

Abstract

   This document extends the NETCONF by adding new features protocol defined in RFC 6241 in
   order to give more accurate handling of
   configuration support the Network Management Datastore Architecture
   defined in I-D.ietf-netmod-revised-datastores.

   This document updates both RFC 6241 and operational data.  These include ability RFC 7950.  The update to RFC
   6241 adds new operations <get-data> and <edit-data>, and augments
   existing operations <lock>, <unlock>, and <validate>.  The update to inspect
   RFC 7950 requires the current operational values usage of configuration data, allowing
   clients to use identical paths for retrieving I-D.ietf-netconf-rfc7895bis by NETCONF
   servers implementing the configured values Network Management Datastore Architecture.

   REF Editor: please replace "I-D.ietf-netmod-revised-datastores" and the operational values.  These new features require additional
   operations in network management applications such as NETCONF.  This
   document details those new operations.
   "I-D.ietf-netconf-rfc7895bis" above with their final RFC assignments.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on May 3, July 21, 2018.

Copyright Notice

   Copyright (c) 2017 2018 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Keywords  .  Terminology . . . . . . . . . . . . . . . . . . . . . . .   3
     1.2.  Terminology .  Tree Diagrams . . . . . . . . . . . . . . . . . . . . . .   3
   2.  The NMDA Model for NETCONF  Datastore and YANG Library Requirements . . . . . . . . . . .   3
   3.  NETCONF Extensions  . . . . . . .   3
     2.1.  Operations . . . . . . . . . . . . . .   4
     3.1.  New NETCONF Operations  . . . . . . . . .   3
       2.1.1. . . . . . . . .   4
       3.1.1.  The <get-data> Operation  . . . . . . . . . . . . . .   3
       2.1.2.   4
       3.1.2.  The <edit-data> Operation . . . . . . . . . . . . . .   4
     2.2.   6
     3.2.  Augmentations to the Base NETCONF Model . . Operations . . . . . . .   5
     2.3.  RPCs and Actions . . . .   6
   4.  NETCONF Datastores YANG Module  . . . . . . . . . . . . . . .   7
   5.  IANA Considerations .   5
     2.4.  YANG Library Capability . . . . . . . . . . . . . . . . .   5
   3.  YANG Model . . .  13
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .  14
   7.  References  . . .   6
   4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  11
   5.  Security Considerations .  14
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .  11
   6.  14
     7.2.  Informative References  . . . . . . . . . . . . . . . . . . .  12  16
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  12  16

1.  Introduction

   This document provides a YANG model that adds extends the NETCONF ([RFC6241]) protocol defined in [RFC6241] in
   order to support for the "Network Network Management Datastore Architecture" Architecture (NMDA)
   defined in [I-D.ietf-netmod-revised-datastores].  NMDA defines a framework for
   datastores, a fundamental concept binding network management data
   models to network management protocols, enabling data models to be
   written

   This document updates [RFC6241] in a network management protocol agnostic way. order to enable NETCONF
   operations currently refer clients to
   interact with all the datastores defined in supported by a server implementing
   the original
   model, so NMDA.  The update both adds new operations are required <get-data> and
   <edit-data>, and augments existing operations <lock>, <unlock>, and
   <validate>.

   This document also updates [RFC7950] in order to allow references enable NETCONF
   clients to both discover which datastores are supported by the new
   datastores.

   Operations like <copy-config>, <lock> and <unlock>
   NETCONF server, as well as determine which modules are augmented to
   allow them to target additional datastores.

   In addition supported in
   each datastore.  The update requires NETCONF servers implementing the original <get> operation is deprecated, since
   NMDA to support [I-D.ietf-netconf-rfc7895bis].

1.1.  Terminology

   This document uses the
   information it returns is no longer needed.  <get>'s deficiencies
   were a major motivation for terminology defined by the NMDA.

1.1.  Keywords NMDA
   [I-D.ietf-netmod-revised-datastores].

   The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in BCP
   14, [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.. here.

1.2.  Terminology

   This  Tree Diagrams

   Tree diagrams used in this document uses follow the terminology notation defined in
   [I-D.ietf-netmod-yang-tree-diagrams].

2.  Datastore and YANG Library Requirements

   RFC Ed.: Update 201X-XX-XX below with correct date.

   An NMDA-compliant NETCONF server MUST support the operational state
   datastore and it MUST implement at least revision 201X-XX-XX of the
   "ietf-yang-library" module defined in [I-D.ietf-netconf-rfc7895bis].

   The server MUST advertise the following capability in the <hello>
   message (line breaks and whitespaces are used for formatting reasons
   only):

     urn:ietf:params:netconf:capability:yang-library:1.1?
       revision=<date>&checksum=<checksum-value>

   The parameter "revision" has the same value as the revision date of
   the "ietf-yang-library" module implemented by the NMDA
   [I-D.ietf-netmod-revised-datastores].

2. server.  This
   parameter MUST be present.

   The NMDA Model parameter "checksum" has the same value as the leaf
   "/yang-library/checksum" from "ietf-yang-library".  This parameter
   MUST be present.

   With this mechanism, a client can cache the supported modules for a
   server and only update the cache if the "checksum" value in the
   <hello> message changes.

   This document updates [RFC7950], Section 5.6.4, to allow servers to
   advertise the capability :yang-library:1.1 instead of :yang-
   library:1.0, and to implement the subtree "/yang-library"
   [I-D.ietf-netconf-rfc7895bis] instead of "/modules-state".

3.  NETCONF Extensions

   This section describes the changes NETCONF extensions needed for NMDA support. to support the
   NMDA.  These changes are contained defined in a new YANG ([RFC7950]) model
   "ietf-netconf-datastores". module
   "ietf-netconf-nmda".

   These changes include the use of source and target parameters based
   on the "datastore" identity defined in the "ietf-datastores" from module
   [I-D.ietf-netmod-revised-datastores].  The use of identities allows
   future expansion in a way that the choice-based strategy from the
   original operations (e.g., <get-config>, <edit-config>) do does not.

2.1.

3.1.  New NETCONF Operations

   Support for the NMDA includes two

   Two new operations <get-data> and <edit-data> are defined in this
   document.

2.1.1.
   document in order to support the NMDA.  These operations are similar
   to the <get-config> and <edit-config> operations but they can work on
   an extensible set of datastores.

3.1.1.  The <get-data> Operation

   The <get-data> operation retrieves data from a specific NMDA
   datastore.  This operation is similar to NETCONF's <get-config>
   operation, but
   operation defined in [RFC6241], but it adds the flexibility in naming to select
   the source datastore.

       +---x get-data
          +---w input
          |  +---w datastore         ds:datastore-ref
          |  +---w (filter-spec)?
          |  |  +--:(subtree-filter)
          |  |  |  +---w subtree-filter?   <anydata>
          |  |  +--:(xpath-filter)
          |  |     +---w xpath-filter?     yang:xpath1.0 {nc:xpath}?
          |  +---w config-filter?    boolean
          |  +---w origin-filter?    identityref {origin}?
          |  +---w max-depth?        union
          |  +---w with-origin?      empty {origin}?
          |  +---w with-defaults?    with-defaults-mode
          +--ro output
             +--ro data?   <anydata>

   The "source" "datastore" parameter indicates the datastore which is the source
   of the data to be retrieved.  This is a datastore identity.

   The <get-data> operation accepts a content filter parameter, similar
   to the "filter" parameter of "get-config", <get-config>, but using explicit nodes
   for subtree filtering ("subtree-filter") and XPath filtering.

   Additional filters are defined filtering
   ("xpath-filter").

   The "config-filter" parameter can be used to retrieve only "config
   true" nodes or "config false" nodes.  The "origin-filter" can be used to
   select nodes matching a given "origin" value.

   The "max-depth" parameter can be used by the client to limit the
   number of sub-tree levels that are returned in the reply.

   The <get-data> operation also supports the "with-defaults" parameter
   as defined in [RFC6243].  The supported values follow the constraints
   given by the "with-defaults" capability.

2.1.1.1.

   The "with-defaults" parameter does not apply when interacting with an
   operational datastore.  This means that all "in use" values, as
   defined in [I-D.ietf-netmod-revised-datastores] section 5.3, are
   returned from the operational state datastore, even if a node happens
   to have a default statement in the YANG module, and this default
   value is being used by the server.  If the "with-defaults" parameter
   is present in a request to such a datastore, then the server MUST
   return an error, as specified in "ietf-netconf-nmda" (see Section 4).

3.1.1.1.  Origin Metadata Attribute

   The <get-data> operation adds defines a new parameter named "with-origin",
   which if present, requests that the server includes "origin" metadata
   anotations in its response, as detailed in the NMDA.  This parameter
   is only valid for <operational> the operational state datastore and any datastores
   with identities derived from the "operational" identity.  Otherwise,
   if an invalid datastore is specified then an <rpc-error> element error is returned with
   an <error-tag> value of "invalid-value". returned, as
   specified in "ietf-netconf-nmda" (see Section 4).  Note that "origin"
   metadata annotations are not included in a response unless a client
   explicitly requesteds requests them.

   Data from <operational> in the operational state datastore can come from multiple
   sources.  The server should return the most accurate value for the
   "origin" metadata annotation as possible, indicating the source of
   the operational value, as specified in section Section 5.3.4 of the NMDA.
   [I-D.ietf-netmod-revised-datastores].

   When encoding the origin metadata annotation for a hierarchy of
   returned nodes, the annotation may be omitted for a child node when
   the value matches that of the parent node (as node, as described in ietf-
   origin@2017-08-17).  [RFC Editor, please check published revision
   date.] the
   "ietf-origin" YANG module [I-D.ietf-netmod-revised-datastores].

   The "with-origin" parameter is optional to support.  It is identified
   with the URI:

     urn:ietf:params:netconf:capability:with-origin:1.0

2.1.2.

3.1.2.  The <edit-data> Operation

   The <edit-data> operation changes the contents of a specific writable
   datastore, similar to the <edit-config> operation, operation defined in
   [RFC6241], but with additional flexibility in naming the target
   datastore.  If an <edit-data> operation is invoked on a non-writable
   datastore, then an error is returned, as specified in
   "ietf-netconf-nmda" (see Section 4).

       +---x edit-data
          +---w input
             +---w datastore?           ds:datastore-ref
             +---w default-operation?   enumeration
             +---w (edit-content)
                +--:(config)
                |  +---w config?              <anydata>
                +--:(url)
                   +---w url?                 inet:uri {nc:url}?

   The "datastore" parameter is a datastore identity that indicates the
   desired target datastore where changes should be made.

   The "edit-content" "default-operation" parameter from "edit-config" it is modified to
   allow use "type anydata" for configuration content, rather than the
   "edit-config"'s use a copy of "type anyxml".

   The the
   "default-operation" parameter of the <edit-config> operation.

   The "edit-content" choice mirrors the parameter "edit-content" choice of the
   <edit-config> operation.  Note, however, that the "config" element in
   the "edit-content" choice of <edit-data> uses "anydata" (introduced
   in YANG 1.1) while the "config" element in the "edit-content" choice
   of <edit-config> used "anyxml".

   The <edit-data> operation does not support the "error-option" and the
   "test-option" parameters that were part of the <edit-config>
   operation.

2.2.

3.2.  Augmentations to the Base NETCONF Model Operations

   Several of the operations defined in the base NETCONF data model
   (ietf-netconf@2011-06-01.yang) will continue to YANG module
   "ietf-netconf" [RFC6241] may be used under with new datastores.  Hence, the
   NMDA.  The
   <lock>, <unlock>, and <validate> operations are augmented with a new
   "datastore" leaf that can indicate a select the desired NMDA datastore.

   Only writable datastores can be locked.

2.3.  RPCs and Actions

   RPC operations and actions can be defined in YANG modules.  The
   evaluation context for constraints and references in RPC operations
   and actions  If a <lock>,
   <unlock>, or <validate> operation is <operational>, not supported on a particular
   datastore then an error is returned, as specified in the NMDA.

2.4.
   "ietf-netconf-nmda" (see Section 4).

4.  NETCONF Datastores YANG Library Capability

   RFC Ed.: Update 201X-XX-XX below with correct date.

   Support for NMDA requires the server to implement at least revision
   201X-XX-XX of the "ietf-yang-library" module defined in
   [I-D.nmdsdt-netconf-rfc7895bis].  The server MUST advertise the
   following capability in the <hello> message (line breaks and
   whitespaces are used for formatting reasons only):

     urn:ietf:params:netconf:capability:yang-library:1.1?
       revision=<date>&checksum=<checksum-value>

   The parameter "revision" has the same value as the revision date of
   the "ietf-yang-library" module implemented by the server. Module

   This
   parameter MUST be present.

   The parameter "checksum" has the same value as the leaf
   "/yang-library/checksum" module imports definitions from "ietf-yang-library".  This parameter
   MUST be present.

   With this mechanism, a client can cache the supported modules for a
   server [RFC6991], [RFC6241], [RFC6243],
   and only [I-D.ietf-netmod-revised-datastores].

   RFC Ed.: update the cache if the "checksum" value in the
   <hello> message changes.

   This document updates [RFC7950], section 5.6.4, to allow servers to
   advertise the capability :yang-library:1.1 instead of :yang-
   library:1.0, and to implement date below with the subtree "/yang-library"
   [I-D.nmdsdt-netconf-rfc7895bis] instead date of "/modules-state".

3.  YANG Model RFC publication and
   remove this note.

   <CODE BEGINS> file "ietf-netconf-datastores@2017-08-24.yang" "ietf-netconf-nmda@2018-01-17.yang"

  module ietf-netconf-datastores ietf-netconf-nmda {
    yang-version 1.1;
    namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-datastores"; "urn:ietf:params:xml:ns:yang:ietf-netconf-nmda";
    prefix ncds;

    import ietf-yang-types {
      prefix yang;
    }
    import ietf-inet-types {
      prefix inet;
    }
    import ietf-datastores {
      prefix ds;
    }
    import ietf-origin {
      prefix or;
    }
    import ietf-netconf {
      prefix nc;
    }
    import ietf-netconf-with-defaults {
      prefix ncwd;
    }

    organization
      "IETF NETCONF Working Group";
    contact
      "WG Web:   <https://datatracker.ietf.org/wg/netconf/>

       WG List:  <mailto:netconf@ietf.org>

       Author:   Martin Bjorklund
                 <mailto:mbj@tail-f.com>

       Author:   Juergen Schoenwaelder
                 <mailto:j.schoenwaelder@jacobs-university.de>

       Author:   Phil Shafer
                 <mailto:phil@juniper.net>

       Author:   Kent Watsen
                 <mailto:kwatsen@juniper.net>

       Author:   Rob Wilton
                 <rwilton@cisco.com>";
    description
      "This YANG module defines a set of NETCONF operations for to support
       the Network Management Datastore Architecture (NMDA).

       Copyright (c) 2017 2018 IETF Trust and the persons identified as
       authors of the code.  All rights reserved.

       Redistribution and use in source and binary forms, with or
       without modification, is permitted pursuant to, and subject to
       the license terms contained in, the Simplified BSD License set
       forth in Section 4.c of the IETF Trust's Legal Provisions
       Relating to IETF Documents
       (http://trustee.ietf.org/license-info).

       This version of this YANG module is part of RFC XXXX
       (http://www.rfc-editor.org/info/rfcxxxx); see the RFC itself
       for full legal notices.";

    revision 2017-08-24 2018-01-17 {
      description
        "Initial revision.";
      reference
        "RFC XXXX: NETCONF Extensions to Support for NMDA"; the Network Management
                   Datastore Architecture";
    }

    feature origin {
      description
        "Indicates that the server supports the 'origin' annotation.";
      reference
        "RFC XXXX: Network Management Datastore Architecture";
    }

     typedef datastore {
       type identityref {
         base ds:datastore;
       }
       description
         "An NMDA datastore.";
       reference "RFC XXXX: Network Management Datastore Architecture";
     }

    rpc get-data {
      description
        "Retrieve data from an NMDA datastore."; datastore. The content returned
         by get-data must satisfy all filters, i.e., the filter
         criteria are logically ANDed.

         The 'with-origin' parameter is only valid for an operational
         datastore. If 'with-origin' is used with an invalid datastore,
         then the server MUST return an <rpc-error> element with an
         <error-tag> value of 'invalid-value'.

         The 'with-defaults' parameter does not apply to operational
         datastores. If the 'with-defaults' parameter is present in a
         request to an operational datastore, then the server MUST
         return an <rpc-error> element with an <error-tag> value of
         'invalid-value'.";
      input {
        leaf datastore {
          type ncds:datastore; ds:datastore-ref;
          mandatory true;
          description
            "Datastore from which to retrieve data.";
        }

        choice filter-spec {
          description
            "The content filter specification for this request.";

          anydata subtree-filter {
            description
              "This parameter identifies the portions of the
               target datastore to retrieve.";
            reference
              "RFC 6241, 6241: Network Configuration Protocol, Section 6.";
          }
          leaf xpath-filter {
            if-feature nc:xpath;
            type yang:xpath1.0;
            description
              "This parameter contains an XPath expression identifying
               the portions of the target datastore to retrieve.";
           }
         }

         container where {
           description
             "Filter content with retrieve.

               If the specified criteria.  All given
              criteria expression returns a node-set, all nodes in the
               node-set are logically AND:ed."; selected by the filter.  Otherwise, if the
               expression does not return a node-set, then the get-data
               operation fails.

               The expression is evaluated in the following XPath
               context:

                 o  The set of namespace declarations are those in
                    scope on the 'xpath-filter' leaf config element.

                 o  The set of variable bindings is empty.

                 o  The function library is the core function library,
                    and the XPath functions defined in section 10 in
                    RFC 7950.

                 o  The context node is the root node of the target
                    datastore.";
          }
        }

        leaf config-filter {
          type boolean;
          description
            "Filter for nodes with the given value for their
             'config' property.";
        }
        leaf origin origin-filter {
          when 'derived-from-or-self(../datastore, "or:operational")';
          if-feature origin;
          type identityref {
            base or:origin;
          }
          description
            "Filter based on 'origin' annotation.  A node matches the
             filter if its 'origin' annotation is derived from or
             equal to the given filter value.";
        }

        leaf max-depth {
          type union {
            type uint16 {
              range "1..65535";
            }
            type enumeration {
              enum "unbounded";
            }
          }
          default "unbounded";
          description
            "For each node selected by the filter, this parameter
             selects how many conceptual sub-tree levels should be
             returned in the reply.  If the depth is 1, the reply
             includes just the selected nodes but no children.  If the
             depth is 'unbounded', all descendant nodes are included.";
        }

        leaf with-origin {
          when 'derived-from-or-self(../datastore, "or:operational")';
          if-feature origin;
          type empty;
          description
            "If this parameter is present, the server will return
             the 'origin' annotation for the nodes that has one.";
        }

        uses ncwd:with-defaults-parameters;

      }

      output {
        anydata data {
          description
            "Copy of the source datastore subset which matched
             the filter criteria (if any).  An empty data
             container indicates that the request did not
             produce any results.";
        }
      }
    }

    rpc edit-data {
      description
        "Edit data in an NMDA datastore.";
      input {
        leaf datastore {
          type ncds:datastore; ds:datastore-ref;
          description
            "Datastore which data affects."; is the target of the edit-data operation.

             If the target datastore is not writable, then the server
             MUST return an <rpc-error> element with an <error-tag>
             value of 'invalid-value'";
        }
        leaf default-operation {
          type enumeration {
            enum "merge" {
              description
                "The default operation is merge.";
            }
            enum "replace" {
              description
                "The default operation is replace.";
            }
            enum "none" {
              description
                "There is no default operation.";
            }
          }
          default "merge";
          description
            "The default operation to use.";
        }
        choice edit-content {
          mandatory true;
          description
            "The content for the edit operation.";

          anydata config {
            description
              "Inline Config config content.";
          }
          leaf url {
            if-feature nc:url;
            type inet:uri;
            description
              "URL based config content.";
          }
        }
      }
    }

    /*
     * Augment the lock and unlock operations with a
     * "datastore" parameter.
     */

    augment "/nc:lock/nc:input/nc:target/nc:config-target" {
      description
        "Add NMDA Datastore as target.";
      leaf datastore {
        type ncds:datastore; ds:datastore-ref;
        description
          "Datastore to lock."; lock.

           If the lock operation is not supported by the server on the
           specified target datastore, then the server MUST return an
           <rpc-error> element with an <error-tag> value of
           'invalid-value'";
      }
    }
    augment "/nc:unlock/nc:input/nc:target/nc:config-target" {
      description
        "Add NMDA Datastore as target.";

      leaf datastore {
        type ncds:datastore; ds:datastore-ref;
        description
          "Datastore to unlock."; unlock.

           If the unlock operation is not supported by the server on the
           specified target datastore, then the server MUST return an
           <rpc-error> element with an <error-tag> value of
           'invalid-value'";
      }
    }

    /*
     * Augment the validate operation with a
     * "datastore" parameter.
     */

    augment "/nc:validate/nc:input/nc:source/nc:config-source" {
      description
        "Add NMDA Datastore as source.";
      leaf datastore {
        type ncds:datastore; ds:datastore-ref;
        description
          "Datastore to validate."; validate.

           If the validate operation is not supported by the server on
           the specified target datastore, then the server MUST return
           an <rpc-error> element with an <error-tag> value of
           'invalid-value'";

      }
    }
  }

   <CODE ENDS>

4.

5.  IANA Considerations

   This document registers one two capability identifier URN from URNs in the
   "Network Configuration Protocol (NETCONF) Capability URNs" registry:

     Index           Capability Identifier
     -------------   ---------------------------------------------------
     :yang-library   urn:ietf:params:netconf:capability:yang-library:1.1
     :with-origin    urn:ietf:params:netconf:capability:with-origin:1.0

   This document registers a URI in the "IETF XML Registry" [RFC3688].
   Following the format in RFC 3688, the following registration has been
   made.

       URI: urn:ietf:params:xml:ns:yang:ietf-netconf-datastores urn:ietf:params:xml:ns:yang:ietf-netconf-nmda

       Registrant Contact: The IESG.

       XML: N/A, the requested URI is an XML namespace.

   This document registers a YANG module in the "YANG Module Names"
   registry [RFC6020].

     name:         ietf-netconf-datastores         ietf-netconf-nmda
     namespace:    urn:ietf:params:xml:ns:yang:ietf-netconf-datastores    urn:ietf:params:xml:ns:yang:ietf-netconf-nmda
     prefix:       ncds
     reference:    RFC XXXX

5.

6.  Security Considerations

   This

   The YANG module defined in this document has no extends the base operations
   of the NETCONF [RFC6241] protocol.  The lowest NETCONF layer is the
   secure transport layer and the mandatory-to-implement secure
   transport is Secure Shell (SSH) [RFC6242].

   The network configuration access control model
   [I-D.ietf-netconf-rfc6536bis] provides the means to restrict access
   for particular NETCONF users to a preconfigured subset of all
   available NETCONF protocol operations and content.

   The security considerations.

6.  Informative considerations for the base NETCONF protocol operations
   (see Section 9 of [RFC6241]) apply to the new NETCONF <get-data> and
   <edit-data> operations defined in this document.

7.  References

   [I-D.ietf-netmod-revised-datastores]
              Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,

7.1.  Normative References

   [I-D.ietf-netconf-rfc6536bis]
              Bierman, A. and R. Wilton, M. Bjorklund, "Network Management Datastore
              Architecture", draft-ietf-netmod-revised-datastores-05 Configuration
              Access Control Module", draft-ietf-netconf-rfc6536bis-09
              (work in progress), October December 2017.

   [I-D.nmdsdt-netconf-rfc7895bis]

   [I-D.ietf-netconf-rfc7895bis]
              Bierman, A., Bjorklund, M., and K. Watsen, "YANG Library",
              draft-nmdsdt-netconf-rfc7895bis-01
              draft-ietf-netconf-rfc7895bis-02 (work in progress),
              July
              October 2017.

   [I-D.ietf-netmod-revised-datastores]
              Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,
              and R. Wilton, "Network Management Datastore
              Architecture", draft-ietf-netmod-revised-datastores-10
              (work in progress), January 2018.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, 10.17487/
              RFC2119, March 1997, <https://www.rfc-editor.org/info/
              rfc2119>.

   [RFC3688]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
              DOI 10.17487/RFC3688, January 2004, <https://www.rfc-
              editor.org/info/rfc3688>.

   [RFC6020]  Bjorklund, M., Ed., "YANG - A Data Modeling Language for
              the Network Configuration Protocol (NETCONF)", RFC 6020,
              DOI 10.17487/RFC6020, October 2010, <https://www.rfc-
              editor.org/info/rfc2119>.
              editor.org/info/rfc6020>.

   [RFC6241]  Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
              and A. Bierman, Ed., "Network Configuration Protocol
              (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
              <https://www.rfc-editor.org/info/rfc6241>.

   [RFC6242]  Wasserman, M., "Using the NETCONF Protocol over Secure
              Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
              <https://www.rfc-editor.org/info/rfc6242>.

   [RFC6243]  Bierman, A. and B. Lengyel, "With-defaults Capability for
              NETCONF", RFC 6243, DOI 10.17487/RFC6243, June 2011,
              <https://www.rfc-editor.org/info/rfc6243>.

   [RFC6991]  Schoenwaelder, J., Ed., "Common YANG Data Types", RFC
              6991, DOI 10.17487/RFC6991, July 2013, <https://www.rfc-
              editor.org/info/rfc6991>.

   [RFC7950]  Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
              RFC 7950, DOI 10.17487/RFC7950, August 2016,
              <https://www.rfc-editor.org/info/rfc7950>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

7.2.  Informative References

   [I-D.ietf-netmod-yang-tree-diagrams]
              Bjorklund, M. and L. Berger, "YANG Tree Diagrams", draft-
              ietf-netmod-yang-tree-diagrams-04 (work in progress),
              December 2017.

Authors' Addresses

   Martin Bjorklund
   Tail-f Systems

   Email: mbj@tail-f.com

   Juergen Schoenwaelder
   Jacobs University

   Email: j.schoenwaelder@jacobs-university.de

   Phil Shafer
   Juniper Networks

   Email: phil@juniper.net

   Kent Watsen
   Juniper Networks

   Email: kwatsen@juniper.net

   Robert Wilton
   Cisco Systems

   Email: rwilton@cisco.com