draft-ietf-netconf-nmda-netconf-08.txt   rfc8526.txt 
Network Working Group M. Bjorklund Internet Engineering Task Force (IETF) M. Bjorklund
Internet-Draft Tail-f Systems Request for Comments: 8526 Tail-f Systems
Updates: 6241, 7950 (if approved) J. Schoenwaelder Updates: 6241, 7950 J. Schoenwaelder
Intended status: Standards Track Jacobs University Category: Standards Track Jacobs University
Expires: April 20, 2019 P. Shafer ISSN: 2070-1721 P. Shafer
K. Watsen
Juniper Networks Juniper Networks
K. Watsen
Watsen Networks
R. Wilton R. Wilton
Cisco Systems Cisco Systems
October 17, 2018 March 2019
NETCONF Extensions to Support the Network Management Datastore NETCONF Extensions to Support the
Architecture Network Management Datastore Architecture
draft-ietf-netconf-nmda-netconf-08
Abstract Abstract
This document extends the NETCONF protocol defined in RFC 6241 in This document extends the Network Configuration Protocol (NETCONF)
order to support the Network Management Datastore Architecture defined in RFC 6241 in order to support the Network Management
defined in RFC 8342. Datastore Architecture (NMDA) defined in RFC 8342.
This document updates both RFC 6241 and RFC 7950. The update to RFC
6241 adds new operations <get-data> and <edit-data>, and augments
existing operations <lock>, <unlock>, and <validate>. The update to
RFC 7950 requires the usage of I-D.ietf-netconf-rfc7895bis by NETCONF
servers implementing the Network Management Datastore Architecture.
RFC Ed.: Please replace "I-D.ietf-netconf-rfc7895bis" above with its This document updates RFCs 6241 and 7950. The update to RFC 6241
final RFC assignment and remove this note. adds new <get-data> and <edit-data> operations and augments existing
<lock>, <unlock>, and <validate> operations. The update to RFC 7950
requires the usage of the YANG library (described in RFC 8525) by
NETCONF servers implementing the NMDA.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This is an Internet Standards Track document.
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
This Internet-Draft will expire on April 20, 2019. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc8526.
Copyright Notice Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction ....................................................3
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Terminology ................................................3
1.2. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Tree Diagrams ..............................................3
2. Datastore and YANG Library Requirements . . . . . . . . . . . 3 2. Datastore and YANG Library Requirements .........................3
3. NETCONF Extensions . . . . . . . . . . . . . . . . . . . . . 4 3. NETCONF Extensions ..............................................4
3.1. New NETCONF Operations . . . . . . . . . . . . . . . . . 4 3.1. New NETCONF Operations .....................................4
3.1.1. The <get-data> Operation . . . . . . . . . . . . . . 4 3.1.1. The <get-data> Operation ............................4
3.1.2. The <edit-data> Operation . . . . . . . . . . . . . . 8 3.1.2. The <edit-data> Operation ..........................10
3.2. Augmentations to NETCONF Operations . . . . . . . . . . . 10 3.2. Augmentations to NETCONF Operations .......................11
4. NETCONF Datastores YANG Module . . . . . . . . . . . . . . . 10 4. NETCONF Datastores YANG Module .................................12
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18 5. IANA Considerations ............................................20
6. Security Considerations . . . . . . . . . . . . . . . . . . . 19 6. Security Considerations ........................................21
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 19 7. References .....................................................21
7.1. Normative References . . . . . . . . . . . . . . . . . . 20 7.1. Normative References ......................................21
7.2. Informative References . . . . . . . . . . . . . . . . . 21 7.2. Informative References ....................................22
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21 Authors' Addresses ................................................23
1. Introduction 1. Introduction
This document extends the NETCONF protocol defined in [RFC6241] in This document extends the NETCONF protocol defined in [RFC6241] in
order to support the Network Management Datastore Architecture (NMDA) order to support the Network Management Datastore Architecture (NMDA)
defined in [RFC8342]. defined in [RFC8342].
This document updates [RFC6241] in order to enable NETCONF clients to This document updates [RFC6241] in order to enable NETCONF clients to
interact with all the datastores supported by a server implementing interact with all the datastores supported by a server implementing
the NMDA. The update both adds new operations <get-data> and the NMDA. The update both adds new <get-data> and <edit-data>
<edit-data>, and augments existing operations <lock>, <unlock>, and operations and augments existing <lock>, <unlock>, and <validate>
<validate>. operations.
This document also updates [RFC7950] in order to enable NETCONF This document also updates [RFC7950] in order to enable NETCONF
clients to both discover which datastores are supported by the clients to both discover which datastores are supported by the
NETCONF server, as well as determine which modules are supported in NETCONF server and determine which modules are supported in each
each datastore. The update requires NETCONF servers implementing the datastore. The update requires NETCONF servers implementing the NMDA
NMDA to support [I-D.ietf-netconf-rfc7895bis]. to support the YANG library [RFC8525].
1.1. Terminology 1.1. Terminology
This document uses the terminology defined by the NMDA [RFC8342]. This document uses the terminology defined by the NMDA [RFC8342].
The following term is defined in [I-D.ietf-netconf-rfc7895bis]: The following term is defined in [RFC8525]:
o YANG library content identifier o YANG library content identifier
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP "OPTIONAL" in this document are to be interpreted as described in
14, [RFC2119] [RFC8174] when, and only when, they appear in all BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
1.2. Tree Diagrams 1.2. Tree Diagrams
Tree diagrams used in this document follow the notation defined in Tree diagrams used in this document follow the notation defined in
[RFC8340]. [RFC8340].
2. Datastore and YANG Library Requirements 2. Datastore and YANG Library Requirements
RFC Ed.: Update 201X-XX-XX below with correct date. An NMDA-compliant NETCONF server MUST implement the
"ietf-netconf-nmda" module defined in this document, MUST support the
An NMDA-compliant NETCONF server MUST implement the module operational state datastore, and MUST implement at least revision
"ietf-netconf-nmda" defined in this document, MUST support the 2019-01-04 of the "ietf-yang-library" module defined in [RFC8525].
operational state datastore, and it MUST implement at least revision
201X-XX-XX of the "ietf-yang-library" module defined in
[I-D.ietf-netconf-rfc7895bis].
A NETCONF client can discover which datastores and YANG modules the A NETCONF client can discover which datastores and YANG modules the
server supports by reading the YANG library information from the server supports by reading the YANG library information from the
operational state datastore. operational state datastore.
The server MUST advertise the following capability in the <hello> The server MUST advertise the following capability in the <hello>
message (line breaks and whitespaces are used for formatting reasons message (line breaks and whitespace are used for formatting reasons
only): only):
urn:ietf:params:netconf:capability:yang-library:1.1? urn:ietf:params:netconf:capability:yang-library:1.1?
revision=<date>&content-id=<content-id-value> revision=<date>&content-id=<content-id-value>
The parameter "revision" has the same value as the revision date of The parameter "revision" has the same value as the revision date of
the "ietf-yang-library" module implemented by the server. This the "ietf-yang-library" module implemented by the server. This
parameter MUST be present. parameter MUST be present.
The parameter "content-id" contains the YANG library content The parameter "content-id" contains the YANG library content
identifier [I-D.ietf-netconf-rfc7895bis]. This parameter MUST be identifier [RFC8525]. This parameter MUST be present.
present.
With this mechanism, a client can cache the supported datastores and With this mechanism, a client can cache the supported datastores and
YANG modules for a server and only update the cache if the YANG modules for a server and only update the cache if the
"content-id" value in the <hello> message changes. "content-id" value in the <hello> message changes.
This document updates [RFC7950], Section 5.6.4, to allow servers to This document updates Section 5.6.4 of [RFC7950] to allow servers to
advertise the capability :yang-library:1.1 instead of :yang- advertise the capability :yang-library:1.1 instead of
library:1.0, and to implement the subtree "/yang-library" :yang-library:1.0 and to implement the subtree "/yang-library"
[I-D.ietf-netconf-rfc7895bis] instead of "/modules-state". [RFC8525] instead of "/modules-state".
3. NETCONF Extensions 3. NETCONF Extensions
This section describes the NETCONF extensions needed to support the This section describes the NETCONF extensions needed to support the
NMDA. These changes are defined in a new YANG ([RFC7950]) module NMDA. These changes are defined in the new "ietf-netconf-nmda" YANG
"ietf-netconf-nmda". [RFC7950] module.
These changes include the use of source and target parameters based These changes include the use of source and target parameters based
on the "datastore" identity defined in the "ietf-datastores" module on the "datastore" identity defined in the "ietf-datastores" module
[RFC8342]. The use of identities allows future expansion in a way [RFC8342]. The use of identities allows future expansion in a way
that the choice-based strategy from the original operations (e.g., that the choice-based strategy from the original operations (e.g.,
<get-config>, <edit-config>) does not. <get-config> and <edit-config>) does not.
3.1. New NETCONF Operations 3.1. New NETCONF Operations
Two new operations <get-data> and <edit-data> are defined in this Two new operations -- <get-data> and <edit-data> -- are defined in
document in order to support the NMDA. These operations are similar this document in order to support the NMDA. These operations are
to the <get-config> and <edit-config> operations but they can work on similar to the <get-config> and <edit-config> operations, but they
an extensible set of datastores. can work on an extensible set of datastores.
3.1.1. The <get-data> Operation 3.1.1. The <get-data> Operation
The <get-data> operation retrieves data from a specific NMDA The <get-data> operation retrieves data from a specific NMDA
datastore. This operation is similar to NETCONF's <get-config> datastore. This operation is similar to NETCONF's <get-config>
operation defined in [RFC6241], but it adds the flexibility to select operation defined in [RFC6241], but it adds the flexibility to select
the source datastore. the source datastore.
+---x get-data +---x get-data
+---w input +---w input
skipping to change at page 5, line 25 skipping to change at page 5, line 25
| | +--:(origin-filter) | | +--:(origin-filter)
| | | +---w origin-filter* or:origin-ref | | | +---w origin-filter* or:origin-ref
| | +--:(negated-origin-filter) | | +--:(negated-origin-filter)
| | +---w negated-origin-filter* or:origin-ref | | +---w negated-origin-filter* or:origin-ref
| +---w max-depth? union | +---w max-depth? union
| +---w with-origin? empty {origin}? | +---w with-origin? empty {origin}?
| +---w with-defaults? with-defaults-mode | +---w with-defaults? with-defaults-mode
+--ro output +--ro output
+--ro data? <anydata> +--ro data? <anydata>
The "datastore" parameter indicates the datastore which is the source The "datastore" parameter indicates the datastore that is the source
of the data to be retrieved. This is a datastore identity. of the data to be retrieved. This is a "datastore" identity.
The <get-data> operation accepts a content filter parameter, similar The <get-data> operation accepts a content filter parameter, similar
to the "filter" parameter of <get-config>, but using explicit nodes to the "filter" parameter of <get-config>, but uses explicit nodes
for subtree filtering ("subtree-filter") and XPath filtering for subtree filtering ("subtree-filter") and XPath filtering
("xpath-filter"). ("xpath-filter").
The "config-filter" parameter can be used to retrieve only "config The "config-filter" parameter can be used to retrieve only "config
true" or "config false" nodes. true" or "config false" nodes.
The "origin-filter" parameter, which can be present multiple times, The "origin-filter" parameter, which can be present multiple times,
selects nodes equal to or derived from any of the given values. The selects nodes equal to or derived from any of the given values. The
"negated-origin-filter", which can be present multiple times, selects "negated-origin-filter", which can be present multiple times, selects
nodes that do are not equal or derived from any of the given values. nodes that are not equal to or derived from any of the given values.
The "origin-filter" and "negated-origin-filter" parameters cannot be The "origin-filter" and "negated-origin-filter" parameters cannot be
used together. used together.
The "max-depth" parameter can be used by the client to limit the The "max-depth" parameter can be used by the client to limit the
number of sub-tree levels that are returned in the reply. number of subtree levels that are returned in the reply.
3.1.1.1. Origin Metadata Attribute 3.1.1.1. "origin" Metadata Annotation
The <get-data> operation defines a parameter named "with-origin", The <get-data> operation defines a parameter named "with-origin",
which if present, requests that the server includes "origin" metadata which if present, requests that the server includes "origin" metadata
annotations in its response, as detailed in the NMDA. This parameter annotations in its response, as detailed in the NMDA. This parameter
is only valid for the operational state datastore and any datastores is only valid for the operational state datastore and any datastores
with identities derived from the "operational" identity. Otherwise, with identities derived from the "operational" identity. Otherwise,
if an invalid datastore is specified then an error is returned, as if an invalid datastore is specified then an error is returned, as
specified in "ietf-netconf-nmda" (see Section 4). Note that "origin" specified in the "ietf-netconf-nmda" module (see Section 4). Note
metadata annotations are not included in a response unless a client that "origin" metadata annotations are not included in a response
explicitly requests them. unless a client explicitly requests them.
Data in the operational state datastore can come from multiple Data in the operational state datastore can come from multiple
sources. The server should return the most accurate value for the sources. The server should return the "origin" metadata annotation
"origin" metadata annotation as possible, indicating the source of value that most accurately indicates the source of the operational
the operational value, as specified in Section 5.3.4 of [RFC8342]. value, as specified in Section 5.3.4 of [RFC8342].
When encoding the origin metadata annotation for a hierarchy of When encoding the "origin" metadata annotation for a hierarchy of
returned nodes, the annotation may be omitted for a child node when returned nodes, the annotation may be omitted for a child node when
the value matches that of the parent node, as described in the the value matches that of the parent node, as described in the
"ietf-origin" YANG module [RFC8342]. "ietf-origin" YANG module [RFC8342].
The "with-origin" parameter is OPTIONAL to support. It is identified Support for the "with-origin" parameter is OPTIONAL. It is
with the feature "origin". identified with the feature "origin".
3.1.1.2. With-defaults interactions 3.1.1.2. "with-defaults" Interactions
If the "with-defaults" capability is supported by the server, then If the "with-defaults" capability is supported by the server, then
the "with-defaults" parameter, defined in [RFC6243], is supported for the "with-defaults" parameter, defined in [RFC6243], is supported for
<get-data> operations that target conventional configuration <get-data> operations that target conventional configuration
datastores. datastores.
The "with-defaults" parameter is OPTIONAL to support for <get-data> Support for the "with-defaults" parameter is OPTIONAL for <get-data>
operations that target <operational>. The associated capability to operations that target <operational>. The associated capability to
indicate a server's support is identified with the URI: indicate a server's support is identified with the URI:
urn:ietf:params:netconf:capability:with-operational-defaults:1.0 urn:ietf:params:netconf:capability:with-operational-defaults:1.0
If the "with-defaults" parameter is supported for <get-data> If the "with-defaults" parameter is supported for <get-data>
operations on <operational>, then all retrieval modes specified in operations on <operational>, then all retrieval modes specified in
either the 'basic-mode' or 'also-supported' parameters of the either the 'basic-mode' or 'also-supported' parameter of the
"with-defaults" capability are permitted. The behavior of the "with-defaults" capability are permitted. The behavior of the
"with-defaults" parameter for <operational> is defined as below: "with-defaults" parameter for <operational> is defined as below:
o If no "with-defaults" parameter is specified, or if it is set to o If no "with-defaults" parameter is specified, or if it is set to
"explicit", "report-all", or "report-all-tagged", then the "in "explicit", "report-all", or "report-all-tagged", then the "in
use" values, as defined in [RFC8342] section 5.3, are returned use" values, as defined in Section 5.3 of [RFC8342], are returned
from the operational state datastore, even if a node happens to from the operational state datastore, even if a node happens to
have a default statement in the YANG module, and this default have a default statement in the YANG module, and this default
value is being used by the server. If the "with-defaults" value is being used by the server. If the "with-defaults"
parameter is set to "report-all-tagged", any values that match the parameter is set to "report-all-tagged", any values that match the
schema default are tagged with additional metadata, as described schema default are tagged with additional metadata, as described
in [RFC6243] section 3.4. in Section 3.4 of [RFC6243].
o If the "with-defaults" parameter is set to "trim", all "in use" o If the "with-defaults" parameter is set to "trim", all "in use"
values are returned, except that the output is filtered to exclude values are returned, except that the output is filtered to exclude
any values that match the default defined in the YANG schema. any values that match the default defined in the YANG schema.
Support for "with-defaults" in <get-data> operations on any datastore Support for "with-defaults" in <get-data> operations on any datastore
not defined in [RFC8342] should be defined by the specification for not defined in [RFC8342] should be defined by the specification for
the datastore. the datastore.
3.1.1.3. Example: Retrieving an entire subtree from <running> 3.1.1.3. Example: Retrieving an Entire Subtree from <running>
The following example shows the <get-data> version of the The following example shows the <get-data> version of the
<get-config> example shown in Section 7.1 of [RFC6241], which selects <get-config> example shown in Section 7.1 of [RFC6241], which selects
the entire "/users" subtree: the entire "/users" subtree:
<rpc message-id="101" <rpc message-id="101"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda" <get-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores"> xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores">
<datastore>ds:running</datastore> <datastore>ds:running</datastore>
skipping to change at page 8, line 5 skipping to change at page 8, line 5
<dept>1</dept> <dept>1</dept>
<id>1</id> <id>1</id>
</company-info> </company-info>
</user> </user>
<!-- additional <user> elements appear here... --> <!-- additional <user> elements appear here... -->
</users> </users>
</top> </top>
</data> </data>
</rpc-reply> </rpc-reply>
3.1.1.4. Example: Retrieving a filtered subtree from <operational> 3.1.1.4. Example: Retrieving a Filtered Subtree from <operational>
The following example shows how the "origin-filter" can be used to The following example shows how the "origin-filter" can be used to
retrieve nodes from <operational>. The example uses the fictional retrieve nodes from <operational>. The example uses the fictional
data model defined in Appendix C of [RFC8342]. data model defined in Appendix C of [RFC8342].
<rpc message-id="102" <rpc message-id="102"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda" <get-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores" xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores"
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin"> xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin">
skipping to change at page 8, line 40 skipping to change at page 9, line 4
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin" xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin"
or:origin="or:intended"> or:origin="or:intended">
<peer> <peer>
<name>2001:db8::2:3</name> <name>2001:db8::2:3</name>
<local-port or:origin="or:system">60794</local-port> <local-port or:origin="or:system">60794</local-port>
<state>established</state> <state>established</state>
</peer> </peer>
</bgp> </bgp>
</data> </data>
</rpc-reply> </rpc-reply>
In order to not retrieve any system state nodes, the "config-filter"
can be used:
<rpc message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores"
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin">
<datastore>ds:operational</datastore>
<subtree-filter>
<bgp xmlns="http://example.com/ns/bgp"/>
</subtree-filter>
<config-filter>true</config-filter>
<origin-filter>or:intended</origin-filter>
<origin-filter>or:system</origin-filter>
<with-origin/>
</get-data>
</rpc>
<rpc-reply message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda">
<bgp xmlns="http://example.com/ns/bgp"
xmlns:or="urn:ietf:params:xml:ns:yang:ietf-origin"
or:origin="or:intended">
<peer>
<name>2001:db8::2:3</name>
<local-port or:origin="or:system">60794</local-port>
</peer>
</bgp>
</data>
</rpc-reply>
3.1.2. The <edit-data> Operation 3.1.2. The <edit-data> Operation
The <edit-data> operation changes the contents of a writable The <edit-data> operation changes the contents of a writable
datastore, similar to the <edit-config> operation defined in datastore, similar to the <edit-config> operation defined in
[RFC6241], but with additional flexibility in naming the target [RFC6241] but with additional flexibility in naming the target
datastore. If an <edit-data> operation is invoked on a non-writable datastore. If an <edit-data> operation is invoked on a non-writable
datastore, then an error is returned, as specified in datastore, then an error is returned, as specified in the
"ietf-netconf-nmda" (see Section 4). "ietf-netconf-nmda" module (see Section 4).
+---x edit-data +---x edit-data
+---w input +---w input
+---w datastore ds:datastore-ref +---w datastore ds:datastore-ref
+---w default-operation? enumeration +---w default-operation? enumeration
+---w (edit-content) +---w (edit-content)
+--:(config) +--:(config)
| +---w config? <anydata> | +---w config? <anydata>
+--:(url) +--:(url)
+---w url? inet:uri {nc:url}? +---w url? inet:uri {nc:url}?
The "datastore" parameter is a datastore identity that indicates the The "datastore" parameter is a "datastore" identity that indicates
desired target datastore where changes should be made. the desired target datastore where changes should be made.
The "default-operation" parameter selects the default operation to The "default-operation" parameter selects the default operation to
use. It is a copy of the "default-operation" parameter of the use. It is a copy of the "default-operation" parameter of the
<edit-config> operation. <edit-config> operation.
The "edit-content" parameter specifies the content for the edit The "edit-content" parameter specifies the content for the edit
operation. It mirrors the "edit-content" choice of the <edit-config> operation. It mirrors the "edit-content" choice of the <edit-config>
operation. Note, however, that the "config" element in the operation. Note, however, that the "config" element in the
"edit-content" choice of <edit-data> uses "anydata" (introduced in "edit-content" choice of <edit-data> uses "anydata" (introduced in
YANG 1.1) while the "config" element in the "edit-content" choice of YANG 1.1 [RFC7950]) while the "config" element in the "edit-content"
<edit-config> used "anyxml". choice of <edit-config> used "anyxml".
The <edit-data> operation does not support the "error-option" and the The <edit-data> operation does not support the "error-option" and the
"test-option" parameters that were part of the <edit-config> "test-option" parameters that were part of the <edit-config>
operation. The error behaviour of <edit-data> corresponds to the operation. The error behavior of <edit-data> corresponds to the
"error-option" "rollback-on-error". "rollback-on-error" value in the "error-option" parameter.
If the "with-defaults" capability is supported by the server, the If the "with-defaults" capability is supported by the server, the
semantics of editing modes is the same as for <edit-config>, as semantics of editing modes is the same as for <edit-config>, as
described in section 4.5.2 of [RFC6243]. described in Section 4.5.2 of [RFC6243].
Semantics for "with-defaults" in <edit-data> operations on any non Semantics for "with-defaults" in <edit-data> operations on any non
conventional configuration datastores should be defined by the conventional configuration datastores should be defined by the
specification for the datastore. specification for the datastore.
3.1.2.1. Example: Setting a leaf of an interface in <running> 3.1.2.1. Example: Setting a Leaf of an Interface in <running>
The following example shows the <edit-data> version of the first The following example shows the <edit-data> version of the first
<edit-config> example in Section 7.2 of [RFC6241], setting the MTU to <edit-config> example in Section 7.2 of [RFC6241]. In this example,
1500 on an interface named "Ethernet0/0" in the running configuration the MTU is set to 1500 on an interface named "Ethernet0/0" in the
datastore. running configuration datastore.
<rpc message-id="103" <rpc message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<edit-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda" <edit-data xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores"> xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores">
<datastore>ds:running</datastore> <datastore>ds:running</datastore>
<config> <config>
<top xmlns="http://example.com/schema/1.2/config"> <top xmlns="http://example.com/schema/1.2/config">
<interface> <interface>
<name>Ethernet0/0</name> <name>Ethernet0/0</name>
skipping to change at page 10, line 26 skipping to change at page 11, line 33
</top> </top>
</config> </config>
</edit-data> </edit-data>
</rpc> </rpc>
<rpc-reply message-id="103" <rpc-reply message-id="103"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<ok/> <ok/>
</rpc-reply> </rpc-reply>
The other <edit-config> examples shown in Section 7.2 can be The other <edit-config> examples shown in Section 7.2 of [RFC6241]
translated to <edit-data> examples in a similar way. can be translated to <edit-data> examples in a similar way.
3.2. Augmentations to NETCONF Operations 3.2. Augmentations to NETCONF Operations
Several of the operations defined in the base NETCONF YANG module Several of the operations defined in the base NETCONF YANG module
"ietf-netconf" [RFC6241] may be used with new datastores. Hence, the "ietf-netconf" [RFC6241] may be used with new datastores. Hence, the
<lock>, <unlock>, and <validate> operations are augmented with a new <lock>, <unlock>, and <validate> operations are augmented with a new
"datastore" leaf that can select the desired datastore. If a <lock>, "datastore" leaf that can select the desired datastore. If a <lock>,
<unlock>, or <validate> operation is not supported on a particular <unlock>, or <validate> operation is not supported on a particular
datastore then an error is returned, as specified in datastore, then an error is returned, as specified in the
"ietf-netconf-nmda" (see Section 4). "ietf-netconf-nmda" module (see Section 4).
4. NETCONF Datastores YANG Module 4. NETCONF Datastores YANG Module
This module imports definitions from [RFC6991], [RFC6241], [RFC6243], This module imports definitions from [RFC6991], [RFC6241], [RFC6243],
and [RFC8342]. and [RFC8342].
RFC Ed.: update the date below with the date of RFC publication and <CODE BEGINS> file "ietf-netconf-nmda@2019-01-07.yang"
remove this note.
<CODE BEGINS> file "ietf-netconf-nmda@2018-10-09"
module ietf-netconf-nmda { module ietf-netconf-nmda {
yang-version 1.1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"; namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-nmda";
prefix ncds; prefix ncds;
import ietf-yang-types { import ietf-yang-types {
prefix yang; prefix yang;
reference "RFC 6991: Common YANG Data Types."; reference
"RFC 6991: Common YANG Data Types";
} }
import ietf-inet-types { import ietf-inet-types {
prefix inet; prefix inet;
reference "RFC 6991: Common YANG Data Types."; reference
"RFC 6991: Common YANG Data Types";
} }
import ietf-datastores { import ietf-datastores {
prefix ds; prefix ds;
reference "RFC 8342: Network Management Datastore Architecture."; reference
"RFC 8342: Network Management Datastore Architecture
(NMDA)";
} }
import ietf-origin { import ietf-origin {
prefix or; prefix or;
reference "RFC 8342: Network Management Datastore Architecture."; reference
"RFC 8342: Network Management Datastore Architecture
(NMDA)";
} }
import ietf-netconf { import ietf-netconf {
prefix nc; prefix nc;
reference "RFC 6241: Network Configuration Protocol (NETCONF)"; reference
"RFC 6241: Network Configuration Protocol (NETCONF)";
} }
import ietf-netconf-with-defaults { import ietf-netconf-with-defaults {
prefix ncwd; prefix ncwd;
reference "RFC 6243: With-defaults Capability for NETCONF."; reference
"RFC 6243: With-defaults Capability for NETCONF";
} }
organization organization
"IETF NETCONF Working Group"; "IETF NETCONF Working Group";
contact contact
"WG Web: <https://datatracker.ietf.org/wg/netconf/> "WG Web: <https://datatracker.ietf.org/wg/netconf/>
WG List: <mailto:netconf@ietf.org> WG List: <mailto:netconf@ietf.org>
Author: Martin Bjorklund Author: Martin Bjorklund
<mailto:mbj@tail-f.com> <mailto:mbj@tail-f.com>
Author: Juergen Schoenwaelder Author: Juergen Schoenwaelder
<mailto:j.schoenwaelder@jacobs-university.de> <mailto:j.schoenwaelder@jacobs-university.de>
skipping to change at page 11, line 49 skipping to change at page 13, line 20
Author: Martin Bjorklund Author: Martin Bjorklund
<mailto:mbj@tail-f.com> <mailto:mbj@tail-f.com>
Author: Juergen Schoenwaelder Author: Juergen Schoenwaelder
<mailto:j.schoenwaelder@jacobs-university.de> <mailto:j.schoenwaelder@jacobs-university.de>
Author: Phil Shafer Author: Phil Shafer
<mailto:phil@juniper.net> <mailto:phil@juniper.net>
Author: Kent Watsen Author: Kent Watsen
<mailto:kwatsen@juniper.net> <mailto:kent+ietf@watsen.net>
Author: Rob Wilton Author: Robert Wilton
<rwilton@cisco.com>"; <mailto:rwilton@cisco.com>";
description description
"This YANG module defines a set of NETCONF operations to support "This YANG module defines a set of NETCONF operations to support
the Network Management Datastore Architecture (NMDA). the Network Management Datastore Architecture (NMDA).
Copyright (c) 2018 IETF Trust and the persons identified as The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
'MAY', and 'OPTIONAL' in this document are to be interpreted as
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
they appear in all capitals, as shown here.
Copyright (c) 2019 IETF Trust and the persons identified as
authors of the code. All rights reserved. authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to without modification, is permitted pursuant to, and subject to
the license terms contained in, the Simplified BSD License set the license terms contained in, the Simplified BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents Relating to IETF Documents
(http://trustee.ietf.org/license-info). (https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX This version of this YANG module is part of RFC 8526; see
(http://www.rfc-editor.org/info/rfcxxxx); see the RFC itself the RFC itself for full legal notices.";
for full legal notices.";
// RFC Ed.: update the date below with the date of RFC publication revision 2019-01-07 {
// and remove this note.
// RFC Ed.: replace XXXX with actual RFC number and remove this
// note.
revision 2018-10-09 {
description description
"Initial revision."; "Initial revision.";
reference reference
"RFC XXXX: NETCONF Extensions to Support the Network Management "RFC 8526: NETCONF Extensions to Support the Network Management
Datastore Architecture"; Datastore Architecture";
} }
feature origin { feature origin {
description description
"Indicates that the server supports the 'origin' annotation."; "Indicates that the server supports the 'origin' annotation.";
reference reference
"RFC 8342: Network Management Datastore Architecture"; "RFC 8342: Network Management Datastore Architecture (NMDA)";
} }
feature with-defaults { feature with-defaults {
description description
"NETCONF :with-defaults capability; If the server advertises "NETCONF :with-defaults capability. If the server advertises
the :with-defaults capability for a session, then this the :with-defaults capability for a session, then this
feature must also be enabled for that session. Otherwise, feature must also be enabled for that session. Otherwise,
this feature must not be enabled."; this feature must not be enabled.";
reference reference
"RFC 6243: With-defaults Capability for NETCONF, section 4; and "RFC 6243: With-defaults Capability for NETCONF, Section 4; and
RFC XXXX: NETCONF Extensions to Support the Network Management RFC 8526: NETCONF Extensions to Support the Network Management
Datastore Architecture, section 3.1.1.1."; Datastore Architecture, Section 3.1.1.2";
} }
rpc get-data { rpc get-data {
description description
"Retrieve data from an NMDA datastore. The content returned "Retrieve data from an NMDA datastore. The content returned
by get-data must satisfy all filters, i.e., the filter by get-data must satisfy all filters, i.e., the filter
criteria are logically ANDed. criteria are logically ANDed.
Any ancestor nodes (including list keys) of nodes selected by Any ancestor nodes (including list keys) of nodes selected by
the filters are included in the response. the filters are included in the response.
The 'with-origin' parameter is only valid for an operational The 'with-origin' parameter is only valid for an operational
datastore. If 'with-origin' is used with an invalid datastore, datastore. If 'with-origin' is used with an invalid
then the server MUST return an <rpc-error> element with an datastore, then the server MUST return an <rpc-error> element
<error-tag> value of 'invalid-value'. with an <error-tag> value of 'invalid-value'.
The 'with-defaults' parameter only applies to the operational The 'with-defaults' parameter only applies to the operational
datastore if the NETCONF :with-defaults and datastore if the NETCONF :with-defaults and
:with-operational-defaults capabilities are both advertised. :with-operational-defaults capabilities are both advertised.
If the 'with-defaults' parameter is present in a request for If the 'with-defaults' parameter is present in a request for
which it is not supported, then the server MUST return an which it is not supported, then the server MUST return an
<rpc-error> element with an <error-tag> value of <rpc-error> element with an <error-tag> value of
'invalid-value'."; 'invalid-value'.";
input { input {
leaf datastore { leaf datastore {
skipping to change at page 13, line 39 skipping to change at page 15, line 11
leaf datastore { leaf datastore {
type ds:datastore-ref; type ds:datastore-ref;
mandatory true; mandatory true;
description description
"Datastore from which to retrieve data. "Datastore from which to retrieve data.
If the datastore is not supported by the server, then the If the datastore is not supported by the server, then the
server MUST return an <rpc-error> element with an server MUST return an <rpc-error> element with an
<error-tag> value of 'invalid-value'."; <error-tag> value of 'invalid-value'.";
} }
choice filter-spec { choice filter-spec {
description description
"The content filter specification for this request."; "The content filter specification for this request.";
anydata subtree-filter { anydata subtree-filter {
description description
"This parameter identifies the portions of the "This parameter identifies the portions of the
target datastore to retrieve."; target datastore to retrieve.";
reference reference
"RFC 6241: Network Configuration Protocol, Section 6."; "RFC 6241: Network Configuration Protocol (NETCONF),
Section 6";
} }
leaf xpath-filter { leaf xpath-filter {
if-feature nc:xpath; if-feature "nc:xpath";
type yang:xpath1.0; type yang:xpath1.0;
description description
"This parameter contains an XPath expression identifying "This parameter contains an XPath expression identifying
the portions of the target datastore to retrieve. the portions of the target datastore to retrieve.
If the expression returns a node-set, all nodes in the If the expression returns a node-set, all nodes in the
node-set are selected by the filter. Otherwise, if the node-set are selected by the filter. Otherwise, if the
expression does not return a node-set, then the get-data expression does not return a node-set, then the
operation fails. <get-data> operation fails.
The expression is evaluated in the following XPath The expression is evaluated in the following XPath
context: context:
o The set of namespace declarations are those in o The set of namespace declarations are those in
scope on the 'xpath-filter' leaf element. scope on the 'xpath-filter' leaf element.
o The set of variable bindings is empty. o The set of variable bindings is empty.
o The function library is the core function library, o The function library is the core function library,
and the XPath functions defined in section 10 in and the XPath functions are defined in Section 10
RFC 7950. of RFC 7950.
o The context node is the root node of the target o The context node is the root node of the target
datastore."; datastore.";
} }
} }
leaf config-filter { leaf config-filter {
type boolean; type boolean;
description description
"Filter for nodes with the given value for their "Filter for nodes with the given value for their 'config'
'config' property. If this leaf is not present, all property. When this leaf is set to 'true', only 'config
nodes are selected. true' nodes are selected, and when set to 'false', only
'config false' nodes are selected. If this leaf is not
For example, when this leaf is set to 'true', only 'config present, no nodes are filtered.";
true' nodes are selected.";
} }
choice origin-filters { choice origin-filters {
when 'derived-from-or-self(datastore, "ds:operational")'; when 'derived-from-or-self(datastore, "ds:operational")';
if-feature origin; if-feature "origin";
description description
"Filters based on the 'origin' annotation."; "Filters configuration nodes based on the 'origin'
annotation. Configuration nodes that do not have an
'origin' annotation are treated as if they have the
'origin' annotation 'or:unknown'.
System state nodes are not affected by origin-filters and
thus not filtered. Note that system state nodes can be
filtered with the 'config-filter' leaf.";
leaf-list origin-filter { leaf-list origin-filter {
type or:origin-ref; type or:origin-ref;
description description
"Filter based on the 'origin' annotation. A node matches "Filter based on the 'origin' annotation. A
the filter if its 'origin' annotation is derived from or configuration node matches the filter if its 'origin'
equal to any of the given filter values."; annotation is derived from or equal to any of the given
filter values.";
} }
leaf-list negated-origin-filter { leaf-list negated-origin-filter {
type or:origin-ref; type or:origin-ref;
description description
"Filter based on the 'origin' annotation. A node matches "Filter based on the 'origin' annotation. A
the filter if its 'origin' annotation is not derived configuration node matches the filter if its 'origin'
from and not equal to any of the given filter values."; annotation is neither derived from nor equal to any of
the given filter values.";
} }
} }
leaf max-depth { leaf max-depth {
type union { type union {
type uint16 { type uint16 {
range "1..65535"; range "1..65535";
} }
type enumeration { type enumeration {
enum "unbounded" { enum unbounded {
description description
"All descendant nodes are included."; "All descendant nodes are included.";
} }
} }
} }
default "unbounded"; default "unbounded";
description description
"For each node selected by the filters, this parameter "For each node selected by the filters, this parameter
selects how many conceptual sub-tree levels should be selects how many conceptual subtree levels should be
returned in the reply. If the depth is 1, the reply returned in the reply. If the depth is 1, the reply
includes just the selected nodes but no children. If the includes just the selected nodes but no children. If the
depth is 'unbounded', all descendant nodes are included."; depth is 'unbounded', all descendant nodes are included.";
} }
leaf with-origin { leaf with-origin {
when 'derived-from-or-self(../datastore, "ds:operational")'; when 'derived-from-or-self(../datastore, "ds:operational")';
if-feature origin; if-feature "origin";
type empty; type empty;
description description
"If this parameter is present, the server will return "If this parameter is present, the server will return
the 'origin' annotation for the nodes that has one."; the 'origin' annotation for the nodes that have one.";
} }
uses ncwd:with-defaults-parameters { uses ncwd:with-defaults-parameters {
if-feature with-defaults; if-feature "with-defaults";
} }
} }
output { output {
anydata data { anydata data {
description description
"Copy of the source datastore subset which matched "Copy of the source datastore subset that matched
the filter criteria (if any). An empty data the filter criteria (if any). An empty data
container indicates that the request did not container indicates that the request did not
produce any results."; produce any results.";
} }
} }
} }
rpc edit-data { rpc edit-data {
description description
"Edit data in an NMDA datastore. "Edit data in an NMDA datastore.
skipping to change at page 16, line 28 skipping to change at page 18, line 5
If an error condition occurs such that an error severity If an error condition occurs such that an error severity
<rpc-error> element is generated, the server will stop <rpc-error> element is generated, the server will stop
processing the <edit-data> operation and restore the processing the <edit-data> operation and restore the
specified configuration to its complete state at specified configuration to its complete state at
the start of this <edit-data> operation."; the start of this <edit-data> operation.";
input { input {
leaf datastore { leaf datastore {
type ds:datastore-ref; type ds:datastore-ref;
mandatory true; mandatory true;
description description
"Datastore which is the target of the edit-data operation. "Datastore that is the target of the <edit-data> operation.
If the target datastore is not writable, or is not If the target datastore is not writable, or is not
supported by the server, then the server MUST return an supported by the server, then the server MUST return an
<rpc-error> element with an <error-tag> value of <rpc-error> element with an <error-tag> value of
'invalid-value'."; 'invalid-value'.";
} }
leaf default-operation { leaf default-operation {
type enumeration { type enumeration {
enum "merge" { enum merge {
description description
"The default operation is merge."; "The default operation is merge.";
} }
enum "replace" { enum replace {
description description
"The default operation is replace."; "The default operation is replace.";
} }
enum "none" { enum none {
description description
"There is no default operation."; "There is no default operation.";
} }
} }
default "merge"; default "merge";
description description
"The default operation to use."; "The default operation to use.";
} }
choice edit-content { choice edit-content {
mandatory true; mandatory true;
skipping to change at page 17, line 10 skipping to change at page 18, line 35
} }
} }
default "merge"; default "merge";
description description
"The default operation to use."; "The default operation to use.";
} }
choice edit-content { choice edit-content {
mandatory true; mandatory true;
description description
"The content for the edit operation."; "The content for the edit operation.";
anydata config { anydata config {
description description
"Inline config content."; "Inline config content.";
} }
leaf url { leaf url {
if-feature nc:url; if-feature "nc:url";
type inet:uri; type inet:uri;
description description
"URL based config content."; "URL-based config content.";
} }
} }
} }
} }
/* /*
* Augment the lock and unlock operations with a * Augment the <lock> and <unlock> operations with a
* "datastore" parameter. * "datastore" parameter.
*/ */
augment "/nc:lock/nc:input/nc:target/nc:config-target" { augment "/nc:lock/nc:input/nc:target/nc:config-target" {
description description
"Add NMDA Datastore as target."; "Add NMDA datastore as target.";
leaf datastore { leaf datastore {
type ds:datastore-ref; type ds:datastore-ref;
description description
"Datastore to lock. "Datastore to lock.
The lock operation is only supported on writable datastores. The <lock> operation is only supported on writable
datastores.
If the lock operation is not supported by the server on the If the <lock> operation is not supported by the server on
specified target datastore, then the server MUST return an the specified target datastore, then the server MUST return
<rpc-error> element with an <error-tag> value of an <rpc-error> element with an <error-tag> value of
'invalid-value'."; 'invalid-value'.";
} }
} }
augment "/nc:unlock/nc:input/nc:target/nc:config-target" { augment "/nc:unlock/nc:input/nc:target/nc:config-target" {
description description
"Add NMDA Datastore as target."; "Add NMDA datastore as target.";
leaf datastore { leaf datastore {
type ds:datastore-ref; type ds:datastore-ref;
description description
"Datastore to unlock. "Datastore to unlock.
The unlock operation is only supported on writable The <unlock> operation is only supported on writable
datastores. datastores.
If the unlock operation is not supported by the server on If the <unlock> operation is not supported by the server on
the specified target datastore, then the server MUST return the specified target datastore, then the server MUST return
an <rpc-error> element with an <error-tag> value of an <rpc-error> element with an <error-tag> value of
'invalid-value'."; 'invalid-value'.";
} }
} }
/* /*
* Augment the validate operation with a * Augment the <validate> operation with a
* "datastore" parameter. * "datastore" parameter.
*/ */
augment "/nc:validate/nc:input/nc:source/nc:config-source" { augment "/nc:validate/nc:input/nc:source/nc:config-source" {
description description
"Add NMDA Datastore as source."; "Add NMDA datastore as source.";
leaf datastore { leaf datastore {
type ds:datastore-ref; type ds:datastore-ref;
description description
"Datastore to validate. "Datastore to validate.
The validate operation is supported only on configuration The <validate> operation is supported only on configuration
datastores. datastores.
If the validate operation is not supported by the server on If the <validate> operation is not supported by the server
the specified target datastore, then the server MUST return on the specified target datastore, then the server MUST
an <rpc-error> element with an <error-tag> value of return an <rpc-error> element with an <error-tag> value of
'invalid-value'."; 'invalid-value'.";
} }
} }
} }
<CODE ENDS> <CODE ENDS>
5. IANA Considerations 5. IANA Considerations
This document registers two capability identifier URNs in the This document registers two capability identifier URNs in the
"Network Configuration Protocol (NETCONF) Capability URNs" registry: "Network Configuration Protocol (NETCONF) Capability URNs" registry:
skipping to change at page 19, line 30 skipping to change at page 20, line 50
Registrant Contact: The IESG. Registrant Contact: The IESG.
XML: N/A, the requested URI is an XML namespace. XML: N/A, the requested URI is an XML namespace.
This document registers a YANG module in the "YANG Module Names" This document registers a YANG module in the "YANG Module Names"
registry [RFC6020]. registry [RFC6020].
name: ietf-netconf-nmda name: ietf-netconf-nmda
namespace: urn:ietf:params:xml:ns:yang:ietf-netconf-nmda namespace: urn:ietf:params:xml:ns:yang:ietf-netconf-nmda
prefix: ncds prefix: ncds
reference: RFC XXXX reference: RFC 8526
6. Security Considerations 6. Security Considerations
The YANG module defined in this document extends the base operations The YANG module defined in this document extends the base operations
of the NETCONF [RFC6241] protocol. The lowest NETCONF layer is the of the NETCONF [RFC6241] protocol. The lowest NETCONF layer is the
secure transport layer and the mandatory-to-implement secure secure transport layer and the mandatory-to-implement secure
transport is Secure Shell (SSH) [RFC6242]. transport is Secure Shell (SSH) [RFC6242].
The network configuration access control model [RFC8341] provides the The Network Configuration Access Control Model (NACM) [RFC8341]
means to restrict access for particular NETCONF users to a provides the means to restrict access for particular NETCONF users to
preconfigured subset of all available NETCONF protocol operations and a preconfigured subset of all available NETCONF protocol operations
content. and content.
The security considerations for the base NETCONF protocol operations The security considerations for the base NETCONF protocol operations
(see Section 9 of [RFC6241]) apply to the new NETCONF <get-data> and (see Section 9 of [RFC6241]) apply to the new NETCONF <get-data> and
<edit-data> operations defined in this document. <edit-data> operations defined in this document.
7. References 7. References
7.1. Normative References
[I-D.ietf-netconf-rfc7895bis] 7.1. Normative References
Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K.,
and R. Wilton, "YANG Library", draft-ietf-netconf-
rfc7895bis-06 (work in progress), April 2018.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997, <https://www.rfc- DOI 10.17487/RFC2119, March 1997,
editor.org/info/rfc2119>. <https://www.rfc-editor.org/info/rfc2119>.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
DOI 10.17487/RFC3688, January 2004, <https://www.rfc- DOI 10.17487/RFC3688, January 2004,
editor.org/info/rfc3688>. <https://www.rfc-editor.org/info/rfc3688>.
[RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for [RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for
the Network Configuration Protocol (NETCONF)", RFC 6020, the Network Configuration Protocol (NETCONF)", RFC 6020,
DOI 10.17487/RFC6020, October 2010, <https://www.rfc- DOI 10.17487/RFC6020, October 2010,
editor.org/info/rfc6020>. <https://www.rfc-editor.org/info/rfc6020>.
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<https://www.rfc-editor.org/info/rfc6241>. <https://www.rfc-editor.org/info/rfc6241>.
[RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure [RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure
Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011, Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
<https://www.rfc-editor.org/info/rfc6242>. <https://www.rfc-editor.org/info/rfc6242>.
skipping to change at page 21, line 7 skipping to change at page 22, line 19
[RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
RFC 7950, DOI 10.17487/RFC7950, August 2016, RFC 7950, DOI 10.17487/RFC7950, August 2016,
<https://www.rfc-editor.org/info/rfc7950>. <https://www.rfc-editor.org/info/rfc7950>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>. May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration [RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration
Access Control Model", STD 91, RFC 8341, Access Control Model", STD 91, RFC 8341,
DOI 10.17487/RFC8341, March 2018, <https://www.rfc- DOI 10.17487/RFC8341, March 2018,
editor.org/info/rfc8341>. <https://www.rfc-editor.org/info/rfc8341>.
[RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K., [RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,
and R. Wilton, "Network Management Datastore Architecture and R. Wilton, "Network Management Datastore Architecture
(NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018, (NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018,
<https://www.rfc-editor.org/info/rfc8342>. <https://www.rfc-editor.org/info/rfc8342>.
[RFC8525] Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K.,
and R. Wilton, "YANG Library", RFC 8525,
DOI 10.17487/RFC8525, March 2019,
<https://www.rfc-editor.org/info/rfc8525>.
7.2. Informative References 7.2. Informative References
[RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
<https://www.rfc-editor.org/info/rfc8340>. <https://www.rfc-editor.org/info/rfc8340>.
Authors' Addresses Authors' Addresses
Martin Bjorklund Martin Bjorklund
Tail-f Systems Tail-f Systems
skipping to change at page 21, line 39 skipping to change at page 23, line 23
Jacobs University Jacobs University
Email: j.schoenwaelder@jacobs-university.de Email: j.schoenwaelder@jacobs-university.de
Phil Shafer Phil Shafer
Juniper Networks Juniper Networks
Email: phil@juniper.net Email: phil@juniper.net
Kent Watsen Kent Watsen
Juniper Networks Watsen Networks
Email: kwatsen@juniper.net Email: kent+ietf@watsen.net
Robert Wilton Robert Wilton
Cisco Systems Cisco Systems
Email: rwilton@cisco.com Email: rwilton@cisco.com
 End of changes. 127 change blocks. 
235 lines changed or deleted 269 lines changed or added

This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/