--- 1/draft-ietf-netmod-factory-default-09.txt 2020-02-09 21:13:12.429165852 -0800 +++ 2/draft-ietf-netmod-factory-default-10.txt 2020-02-09 21:13:12.449166370 -0800 @@ -1,57 +1,56 @@ NETMOD Working Group Q. Wu Internet-Draft Huawei Intended status: Standards Track B. Lengyel -Expires: June 8, 2020 Ericsson Hungary +Expires: August 12, 2020 Ericsson Hungary Y. Niu Huawei - December 6, 2019 + February 9, 2020 Factory Default Setting - draft-ietf-netmod-factory-default-09 + draft-ietf-netmod-factory-default-10 Abstract This document defines a method to reset a server to its factory- default content. The reset operation may be used, e.g., when the existing configuration has major errors so re-starting the configuration process from scratch is the best option. - A new factory-reset RPC is defined. When resetting a datastore, all + A new factory-reset RPC is defined. When resetting a device, all previous configuration settings will be lost and replaced by the factory-default content. A new optional "factory-default" read-only datastore is defined, that - contains the data that will be copied over to the running datastore - at reset. + contains the factory default configuration for the device. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on June 8, 2020. + This Internet-Draft will expire on August 12, 2020. Copyright Notice - Copyright (c) 2019 IETF Trust and the persons identified as the + Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as @@ -59,48 +58,43 @@ Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 2. Factory-Reset RPC . . . . . . . . . . . . . . . . . . . . . . 3 3. Factory-Default Datastore . . . . . . . . . . . . . . . . . . 4 4. YANG Module . . . . . . . . . . . . . . . . . . . . . . . . . 5 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 6. Security Considerations . . . . . . . . . . . . . . . . . . . 7 - 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 + 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7 8. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 8 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 9.1. Normative References . . . . . . . . . . . . . . . . . . 8 - 9.2. Informative References . . . . . . . . . . . . . . . . . 9 - Appendix A. Changes between revisions . . . . . . . . . . . . . 9 + 9.2. Informative References . . . . . . . . . . . . . . . . . 8 + Appendix A. Changes between revisions . . . . . . . . . . . . . 8 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11 1. Introduction This document defines a method to reset a server to its factory- default content. The reset operation may be used, e.g., when the existing configuration has major errors so re-starting the configuration process from scratch is the best option. - A factory-reset RPC is defined. When resetting a datastore, all + A factory-reset RPC is defined. When resetting a device, all previous configuration settings will be lost and replaced by the factory-default content. A "factory-default" read-only datastore is defined, that contains the data to replace the contents of implemented read-write conventional configuration datastores at reset. This datastore can also be used - in operation. - - NETCONF defines the RPC operation, but that only acts - on the , whereas the RPC operation - can perform additional changes to the device to fully reset the - device back to a factory-default state + in the operation. The YANG data model in this document conforms to the Network Management Datastore Architecture defined in [RFC8342]. 1.1. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all @@ -120,115 +114,119 @@ o intended configuration datastore o operational state datastore o conventional configuration datastore o RPC operation The following terms are defined in this document as follows: + o factory-default: a preconfigured initial configuration that is + used to initialize the configuration of a server. + o factory-default datastore: A read-only configuration datastore - holding a preconfigured minimal initial configuration that can be - used to initialize the configuration of a server. The content of - the datastore is usually static, but MAY depend on external - factors like available HW. + holding a preconfigured initial configuration that is used to + initialize the configuration of a server. 2. Factory-Reset RPC A new "factory-reset" RPC is introduced. Upon receiving the RPC + o All supported conventional read-write configuration datastores (i.e. , , and ) are all reset to the contents of . o Read-only datastores receive their content from other datastores(e.g. gets its content from ). o All data in any ephemeral datastores MUST be discarded. - o The contents of the datastore MUST be reset back to - an appropriate factory-default state. + o The contents of the datastore MUST reflect the + operational state of the device after applying the factory default + configuration. - In addition, the "factory-reset" RPC MUST restore storage to factory - condition, including remove log files, remove temporary files (from - datastore or elsewhere). It MUST also remove security credentials - and restoring default security settings including remove - certificates, keys, zero passwords, etc. The process invoked by the - "factory-reset" RPC SHOULD zero/pattern-write than remove sensitive - files such as the TLS keys, configuration stores, etc. The "factory- + In addition, the "factory-reset" RPC MUST restore non-volatile + storage to factory condition. Depending on the system, this may + entail deleting dynamically generated files, such as those containing + keys (e.g., /etc/ssl/private), certificates (e.g., /etc/ssl), and + logs (e.g., /var/log), temporary files (e.g., /tmp/*). All security + sensitive data (i.e., private keys, passwords, etc.) SHOULD be + overwritten with zeros or a pattern before deletion. The "factory- reset" RPC MAY also be used to trigger some other resetting tasks such as restarting the node or some of the software processes. Note that operators should be aware that since all read-write - datastores are immediately reset to factory default, the device may + datastores are immediately reset to factory-default, the device may become unreachable on the network. It is important to understand how a given vendor's device will behave after the RPC is executed. Implementors SHOULD reboot the device or otherwise restart processes needed to bootstrap it. 3. Factory-Default Datastore - Following guidelines for defining Datastores in the appendix A of + Following the guidelines for defining Datastores in the appendix A of [RFC8342], this document introduces a new optional datastore resource - named 'factory-default' that represents a preconfigured minimal + named "factory-default" that represents a preconfigured minimal initial configuration that can be used to initialize the - configuration of a server. A device MAY only implement the RPC without implementing the 'factory-default' datastore, - which make it lose the ability to see what configuration the device - would be reset back to. + configuration of a server. A device MAY implement the RPC without implementing the "factory-default" datastore, + which would only eliminate the ability to programmatically determine + the factory-default configuration. o Name: "factory-default" o YANG modules: all o YANG nodes: all "config true" data nodes o Management operations: The content of the datastore is set by the server in an implementation dependent manner. The content can not be changed by management operations via NETCONF, RESTCONF,the CLI - etcunless specialized, dedicated operations are provided. The + etc. unless specialized, dedicated operations are provided. The datastore can be read using the standard NETCONF/RESTCONF protocol operations. The operation copies the factory - default content to and, if present, and then - the content of these datastores is propagated automatically to any - other read only datastores, e.g., and . + default content to and, if present, + and then the content of these datastores is propagated + automatically to any other read only datastores, e.g., + and . o Origin: This document does not define a new origin identity as it does not interact with datastore. o Protocols: RESTCONF, NETCONF and other management protocol. o Defining YANG module: "ietf-factory-default". - The datastore content is usually defined by the device vendor. It is - usually static, but MAY change e.g., depending on external factors - like HW available or during device upgrade. - - The contents of MUST persist across device - restarts. + The contents of is defined by the device vendor and + MUST persist across device restarts. 4. YANG Module This module imports typedefs from [RFC8342], and it references [RFC6421],[RFC8341]. file "ietf-factory-default@2019-11-27.yang" module ietf-factory-default { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-factory-default"; prefix fd; import ietf-datastores { prefix ds; + reference + "RFC 8342: Network Management Datastore Architecture (NMDA)"; } import ietf-netconf-acm { prefix nacm; + reference + "RFC8341: Network Configuration Access Control Model"; } organization "IETF NETMOD (Network Modeling) Working Group"; contact "WG Web: WG List: Editor: Qin Wu @@ -225,29 +223,27 @@ } organization "IETF NETMOD (Network Modeling) Working Group"; contact "WG Web: WG List: Editor: Qin Wu - Editor: Balazs Lengyel Editor: Ye Niu "; description - "This module defines the - - factory-reset RPC - - factory-default datastore + "This module defines an RPC called 'factory-reset', a + datastore identity called 'factory-default-datastore'. It provides functionality to reset a server to its factory-default content. Copyright (c) 2019 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License @@ -260,64 +256,59 @@ revision 2019-11-27 { description "Initial revision."; reference "RFC XXXX: Factory default Setting"; } feature factory-default-datastore { description - "Indicates that the factory default configuration is + "Indicates that the factory-default configuration is available as a datastore."; } rpc factory-reset { nacm:default-deny-all; description "The server resets the content of all read-write - configuration datastores (i.e., , ,and - ) to their factory default content."; + configuration datastores (i.e., , , + and ) to their factory-default content."; } identity factory-default { if-feature "factory-default-datastore"; base ds:datastore; description - "This read-only datastore contains the configuration data used to - replace the contents ofthe read-write conventional configuration - datastores during a factory-reset RPC operation."; + "This read-only datastore contains the factory-default + configuration for the device used to replace the contents + of the read-write conventional configuration datastores + during a factory-reset RPC operation."; } } - 5. IANA Considerations This document registers one URI in the IETF XML Registry [RFC3688]. The following registration has been made: URI: urn:ietf:params:xml:ns:yang:ietf-factory-default - Registrant Contact: The IESG. - XML: N/A, the requested URI is an XML namespace. This document registers one YANG module in the YANG Module Names Registry [RFC6020]. The following registration has been made: name: ietf-factory-default - namespace: urn:ietf:params:xml:ns:yang:ietf-factory-default - prefix: fd - RFC: xxxx 6. Security Considerations The YANG module defined in this document extends the base operations for NETCONF [RFC6241] and RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure transport is TLS [RFC8446]. @@ -315,28 +306,25 @@ 6. Security Considerations The YANG module defined in this document extends the base operations for NETCONF [RFC6241] and RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure transport is TLS [RFC8446]. - The RPC operation may be considered sensitive in some - network enviroments,e.g., remote access to reset the device or - overwrite security sensitive information in one of the other - datastores, e.g. running, therefore it is important to restrict - access to this RPC using the standard access control methods. - [RFC8341] + Access to the RPC operation is considered sensitive + in and therefore has been restricted using the "default- deny-all" + access control defined in . [RFC8341] - The 'factory-reset' RPC can prevent any further management of the + The "factory-reset" RPC can prevent any further management of the device if the session and client config is included in the factory- reset contents. The operational disruption caused by setting the config to factory- reset contents varies greatly depending on the implementation and current config. 7. Acknowledgements Thanks to Juergen Schoenwaelder, Ladislav Lhotka, Alex Campbell, Joe @@ -381,20 +369,24 @@ [I-D.ietf-netmod-yang-instance-file-format] Lengyel, B. and B. Claise, "YANG Instance Data File Format", draft-ietf-netmod-yang-instance-file-format-06 (work in progress), December 2019. Appendix A. Changes between revisions Editorial Note (To be removed by RFC Editor) + v09 - 10 + + o Incorporate Shepherd review's comments. + v08 - 09 o Provide some guideline for operators and implementor who implement factory defaut method. v07 - 08 o Provide clarification and recommendation on the relationship between factory-reset RPC and reboot.