YANG Modules Describing Capabilities for Systems and Datastore Update NotificationsEricssonMagyar Tudosok korutja 11BudapestHungary1117balazs.lengyel@ericsson.comFuturewei2330 Central ExpresswaySanta ClaraCA95050United States of Americaludwig@clemm.orgHuaweiGeorge's Court Townsend StreetDublin 2Irelandbenoit.claise@huawei.com
OPS
NETCONFNMDANETCONFRESTCONF
This document defines two YANG modules, "ietf-system-capabilities" and
"ietf-notification-capabilities".
The module "ietf-system-capabilities" provides a placeholder structure that
can be used to discover YANG-related system capabilities for servers.
The module can be used to report capability information from the server
at runtime or at implementation time by making use of the YANG instance data file format.
The module "ietf-notification-capabilities" augments "ietf-system-capabilities"
to specify capabilities related to "Subscription to YANG Notifications
for Datastore Updates" (RFC 8641).
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by
the Internet Engineering Steering Group (IESG). Further
information on Internet Standards is available in Section 2 of
RFC 7841.
Information about the current status of this document, any
errata, and how to provide feedback on it may be obtained at
.
Copyright Notice
Copyright (c) 2022 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
() in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with
respect to this document. Code Components extracted from this
document must include Revised BSD License text as described in
Section 4.e of the Trust Legal Provisions and are provided without
warranty as described in the Revised BSD License.
Table of Contents
. Introduction
. Terminology
. Providing System Capability Information
. Providing YANG-Push Notification Capabilities Information
. System Capabilities Model
. Tree Diagram
. YANG Module
. Notification Capabilities Model
. Tree Diagram
. YANG Module
. Security Considerations
. IANA Considerations
. The IETF XML Registry
. The YANG Module Names Registry
. References
. Normative References
. Informative References
. Instance Data Example #1
. Instance Data Example #2
Acknowledgments
Authors' Addresses
Introduction
Servers and/or publishers often have capabilities, which can be represented by values that designate operational behavior, that need to be conveyed to clients. The YANG modules that are defined in this document facilitate this.
There is a need to publish this capability information as it is part of
the API contract between the server and client. Examples include the maximum
size of data that can be stored or transferred, information about counters (whether a node supports "on-change" telemetry), etc. Such capabilities are often dependent on a vendor's implementation or the available resources at deployment.
Many such capabilities are specific to the complete system,
individual YANG datastores , specific parts of the YANG
schema, or even individual data nodes. It is a goal of this document to provide a
common way to represent such capabilities in a format that is:
vendor independent,
machine readable, and
available in an identical format both at implementation time and at runtime.
Implementation-time information is needed by Network Management System
(NMS) implementers.
An NMS implementation that supports notifications needs information
about a system's capability so it can send "on-change" notifications.
If the information is not documented
in a way that is readily available to the NMS designer, but only as instance data from
the network node once it is deployed,
the NMS implementation will be delayed because it has to wait for the
network node to be ready. In addition, the assumption that all
NMS implementers will
have a correctly configured network node available from which to retrieve data is an expensive proposition and may not always hold. (An NMS may need
to be able to handle many dozens of network node types.)
Often, a fully functional NMS is a requirement for introducing a new
network node type
into a network, so delaying NMS readiness effectively also delays the
time at which a new network node type can be introduced into the network.
Implementation-time information is needed by system integrators.
When introducing a network node type into their network,
operators often need to integrate the node type into their own
management system. The NMS may have management functions that depend
on "on-change" notifications. The network operators need to plan their
management practices and NMS implementation before they decide to
buy the specific network node type. Moreover, the decision to buy the node
type sometimes depends on these management possibilities.
Runtime capability information is needed:
for any "purely model-driven" application, e.g., a NETCONF browser.
Such applications depend on reading models and capabilities at runtime
to support all the publisher's available functionality.
in case the capability might change during runtime,
e.g., due to licensing, hardware constraints, etc.
to check that that capability information provided earlier, at
implementation time, is what the publisher has implemented.
Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
"MAY", and "OPTIONAL" in this document are to be interpreted as
described in BCP 14
when, and only when, they appear in all capitals, as shown here.
The terms "YANG-Push", "on-change subscription", and "periodic
subscription" are used as defined in .
The terms "subscriber", "publisher", and "receiver" are used as
defined in .
The term "server" is used as defined in .
The terms "YANG instance data file format", "instance data", and
"instance data set" are used as defined in
.
In addition, this document defines the following terms:
Implementation-time information:
Information about the server's
behavior that is made available during the implementation of the server,
available from a source other than a running server.
Runtime information:
Information about the server's
behavior that is available from the running server via management protocols
such as NETCONF or RESTCONF .
Providing System Capability Information
Capability information is represented by instance data based on one or
more "capability-defining YANG modules". This allows a user to discover
capabilities both at implementation time and at runtime.
For the implementation-time use case:
Capabilities SHOULD be provided by the
implementer as YANG instance data files complying with
.
When provided, the file MUST already be available at implementation time and retrievable in a way that does not depend
on a live network node, e.g., downloading from a product website.
For the runtime use case:
Capabilities SHOULD be available via
NETCONF or
RESTCONF from the live server (implementing
the publisher) during runtime.
Implementations that support changing these capabilities at
runtime SHOULD support "on-change" notifications about the
system-capabilities container.
The module "ietf-system-capabilities" provides a placeholder structure to be used to specify any YANG-related system capability.
The module "ietf-notification-capabilities" is defined to allow a publisher to
specify capabilities related to "Subscription to YANG Notifications for Datastore Updates" , also known as YANG-Push, augmenting "ietf-system-capabilities".
The YANG data models in this document conform to the Network
Management Datastore Architecture (NMDA) defined in .
Providing YANG-Push Notification Capabilities InformationA specific case is the need to specify capabilities in the YANG-Push
functionality. As defined in , a publisher may allow
subscribers to subscribe to updates from a datastore and will subsequently push
such update notifications to the receiver. Notifications may be sent
periodically or "on change" (more or less immediately after each change).
A publisher supporting YANG-Push has a number of capabilities defined in
that are often determined during the implementation of the publisher. These include:
supported (reporting) periods for "periodic" subscriptions.
the maximum number of objects that can be sent in an update.
the set of datastores or data nodes for which "periodic" notification is supported.
Additional capabilities if the optional "on-change" feature is supported include:
supported dampening periods for "on-change" subscriptions.
the set of datastores or data nodes for which "on-change" notification is supported.
Publishers might have some capabilities (or limitations) to document -- for example, how many update notifications and how many datastore node
updates they can send out in a certain time period. Other publishers might
not support "periodic" subscriptions to all datastores. In some cases, a publisher supporting "on-change" notifications will not
be able to push updates for some object types "on change". Reasons for
this might be that the value of the datastore node changes frequently
(e.g., in-octet counter), that small object changes are
frequent and irrelevant to the receiver (e.g., a temperature gauge changing 0.1
degrees within a predetermined and acceptable range), or
that the implementation is not capable of on-change notification for
a particular object. In all those cases, it will be important for
subscriber applications to have a way to identify the objects for which "on-change" notifications are supported and the objects for which they are not.
Support for "on-change" notifications does not
mean that such notifications will be sent for any specific data node, as the ability to do so may not be supported for every data node. Therefore, subscriber/management applications cannot rely on the "on-change"
functionality unless the subscriber has some means to identify the objects for which "on-change" notifications are in fact supported. YANG data models are meant to be used as an
interface contract.
Without identification of the data nodes actually supporting "on-change" notifications,
this contract would be incomplete.
Clients of a server (and subscribers to a publisher, as subscribers are also clients) need a method to gather capability information.
System Capabilities ModelThe module "ietf-system-capabilities" is defined to provide a
structure that can be used to discover (as a read-only operational state) any YANG-related system capability.This module itself does not contain any capabilities; it provides
augmentation points for capabilities to be defined in subsequent YANG
modules. "ietf-system-capabilities" is used by other modules to augment in specific
capability information. Every set of such capabilities MUST be
wrapped in a container under the augment statement to cleanly
separate different groups of capabilities. These "wrapper containers" SHALL be
augmented at /sysc:system-capabilities and /sysc:system-capabilities/sysc:datastore-capabilities/sysc:per-node-capabilities.
Capability values can be specified at the system level,
at the datastore level (by selecting all nodes in the datastore),
or for specific data nodes of a specific datastore
(and their contained subtrees).
Capability values specified for a specific datastore or
node-set override values specified at the system level.
Note: The solution is usable for both NMDA and non-NMDA systems.
For non-NMDA servers, "config false" data is
considered as if it were part of the running datastore.
Tree Diagram
The following tree diagram
provides an overview of the data model.
module: ietf-system-capabilities
+--ro system-capabilities
+--ro datastore-capabilities* [datastore]
+--ro datastore -> /yanglib:yang-library/datastore/name
+--ro per-node-capabilities* []
+--ro (node-selection)?
+--:(node-selector)
+--ro node-selector? nacm:node-instance-identifier
YANG ModuleThis YANG module imports typedefs from and
a reference path from .
module ietf-system-capabilities {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-system-capabilities";
prefix sysc;
import ietf-netconf-acm {
prefix nacm;
reference
"RFC 8341: Network Configuration Access Control Model";
}
import ietf-yang-library {
prefix yanglib;
description
"This module requires ietf-yang-library to be implemented.
Revision 2019-01-04 or a revision derived from it
is REQUIRED.";
reference
"RFC8525: YANG Library";
}
organization
"IETF NETCONF (Network Configuration) Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/netconf/>
WG List: <mailto:netconf@ietf.org>
Editor: Balazs Lengyel
<mailto:balazs.lengyel@ericsson.com>";
description
"This module specifies a structure to specify system
capabilities for a server or a publisher. System capabilities
may include capabilities of a NETCONF or RESTCONF server or a
notification publisher.
This module does not contain any specific capabilities; it only
provides a structure where containers containing the actual
capabilities are augmented in.
Capability values can be specified at the system level, at the
datastore level (by selecting all nodes in the datastore), or
for specific data nodes of a specific datastore (and their
contained subtrees).
Capability values specified for a specific datastore or
node-set override values specified on the system/publisher
level.
The same grouping MUST be used to define hierarchical
capabilities supported both at the system level and at the
datastore/data-node level.
To find a capability value for a specific data node in a
specific datastore, the user SHALL:
1) search for a datastore-capabilities list entry for
the specific datastore. When stating a specific capability, the
relative path for any specific capability must be the same
under the system-capabilities container and under the
per-node-capabilities list.
2) If the datastore entry is found within that entry, process
all per-node-capabilities entries in the order they appear in
the list. The first entry that specifies the specific
capability and has a node-selector selecting the specific data
node defines the capability value.
3) If the capability value is not found above and the specific
capability is specified under the system-capabilities container
(outside the datastore-capabilities list), this value shall be
used.
4) If no values are found in the previous steps, the
system/publisher is not capable of providing a value. Possible
reasons are that it is unknown, the capability is changing for
some reason, there is no specified limit, etc. In this case,
the system's behavior is unspecified.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all
capitals, as shown here.
Copyright (c) 2022 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Revised BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 9196
(https://www.rfc-editor.org/info/rfc9196); see the RFC itself
for full legal notices.";
revision 2022-02-17 {
description
"Initial version";
reference
"RFC 9196: YANG Modules Describing Capabilities for Systems
and Datastore Update Notifications";
}
container system-capabilities {
config false;
description
"System capabilities.
Capability values specified here at the system level
are valid for all datastores and are used when the
capability is not specified at the datastore level
or for specific data nodes.";
/*
* "Augmentation point for system-level capabilities."
*/
list datastore-capabilities {
key "datastore";
description
"Capabilities values per datastore.
For non-NMDA servers/publishers, 'config false' data is
considered as if it were part of the running datastore.";
leaf datastore {
type leafref {
path
"/yanglib:yang-library/yanglib:datastore/yanglib:name";
}
description
"The datastore for which capabilities are defined.
Only one specific datastore can be specified,
e.g., ds:conventional must not be used, as it
represents a set of configuration datastores.";
}
list per-node-capabilities {
description
"Each list entry specifies capabilities for the selected
data nodes. The same capabilities apply to the data nodes
in the subtree below the selected nodes.
The system SHALL order the entries according to their
precedence. The order of the entries MUST NOT change
unless the underlying capabilities also change.
Note that the longest patch matching can be achieved
by ordering more specific matches before less
specific ones.";
choice node-selection {
description
"A method to select some or all nodes within a
datastore.";
leaf node-selector {
type nacm:node-instance-identifier;
description
"Selects the data nodes for which capabilities are
specified. The special value '/' denotes all data
nodes in the datastore, consistent with the path
leaf node on page 41 of [RFC8341].";
reference
"RFC 8341: Network Configuration Access Control Model";
}
}
/*
* "Augmentation point for datastore- or data-node-level
* capabilities."
*/
}
}
}
}
Notification Capabilities Model
The YANG module "ietf-notification-capabilities" provides information related to the YANG-Push capability.
Tree Diagram
The following tree diagram
provides an overview of the data model.
module: ietf-notification-capabilities
augment /sysc:system-capabilities:
+--ro subscription-capabilities
+--ro max-nodes-per-update? uint32
+--ro periodic-notifications-supported? notification-support
+--ro (update-period)?
| +--:(minimum-update-period)
| | +--ro minimum-update-period? uint32
| +--:(supported-update-period)
| +--ro supported-update-period* uint32
+--ro on-change-supported? notification-support
| {yp:on-change}?
+--ro minimum-dampening-period? uint32
| {yp:on-change}?
+--ro supported-excluded-change-type* union
{yp:on-change}?
augment /sysc:system-capabilities/sysc:datastore-capabilities
/sysc:per-node-capabilities:
+--ro subscription-capabilities
+--ro max-nodes-per-update? uint32
+--ro periodic-notifications-supported? notification-support
+--ro (update-period)?
| +--:(minimum-update-period)
| | +--ro minimum-update-period? uint32
| +--:(supported-update-period)
| +--ro supported-update-period* uint32
+--ro on-change-supported? notification-support
| {yp:on-change}?
+--ro minimum-dampening-period? uint32
| {yp:on-change}?
+--ro supported-excluded-change-type* union
{yp:on-change}?
YANG ModuleThis YANG module imports a feature and typedefs from
and also imports the "ietf-system-capabilities" specified in this document.
module ietf-notification-capabilities {
yang-version 1.1;
namespace
"urn:ietf:params:xml:ns:yang:ietf-notification-capabilities";
prefix notc;
import ietf-yang-push {
prefix yp;
description
"This module requires ietf-yang-push to be implemented.";
reference
"RFC 8641: Subscription to YANG Notifications for
Datastore Updates";
}
import ietf-system-capabilities {
prefix sysc;
description
"This module requires ietf-system-capabilities to be
implemented.";
reference
"RFC 9196: YANG Modules Describing Capabilities for Systems
and Datastore Update Notifications";
}
organization
"IETF NETCONF (Network Configuration) Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/netconf/>
WG List: <mailto:netconf@ietf.org>
Editor: Balazs Lengyel
<mailto:balazs.lengyel@ericsson.com>";
description
"This module specifies publisher capabilities related to
YANG-Push (RFC 8641).
The module contains:
- a specification of the data nodes that support 'on-change' or
'periodic' notifications.
- capabilities related to the throughput of notification data
that the publisher can support. (Note that for a specific
subscription, the publisher MAY allow only longer periods
or smaller updates depending on, e.g., actual load conditions.)
Capability values can be specified at the system/publisher
level, at the datastore level, or for specific data nodes of
a specific datastore (and their contained subtrees), as defined
in the ietf-system-capabilities module.
If different data nodes covered by a single subscription
have different values for a specific capability, then using
values that are only acceptable for some of these data nodes,
but not for others, may result in the rejection of the
subscription.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all
capitals, as shown here.
Copyright (c) 2022 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Revised BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 9196
(https://www.rfc-editor.org/info/rfc9196); see the RFC itself
for full legal notices.";
revision 2022-02-17 {
description
"Initial version";
reference
"RFC 9196: YANG Modules Describing Capabilities for Systems
and Datastore Update Notifications";
}
grouping subscription-capabilities {
description
"Capabilities related to YANG-Push subscriptions
and notifications";
container subscription-capabilities {
description
"Capabilities related to YANG-Push subscriptions
and notifications";
typedef notification-support {
type bits {
bit config-changes {
description
"The publisher is capable of sending
notifications for 'config true' nodes for the
relevant scope and subscription type.";
}
bit state-changes {
description
"The publisher is capable of sending
notifications for 'config false' nodes for the
relevant scope and subscription type.";
}
}
description
"Type for defining whether 'on-change' or
'periodic' notifications are supported for all data nodes,
'config false' data nodes, 'config true' data nodes, or
no data nodes.
The bits config-changes or state-changes have no effect
when they are set for a datastore or for a set of nodes
that does not contain nodes with the indicated config
value. In those cases, the effect is the same as if no
support was declared. One example of this is indicating
support for state-changes for a candidate datastore that
has no effect.";
}
leaf max-nodes-per-update {
type uint32 {
range "1..max";
}
description
"Maximum number of data nodes that can be sent
in an update. The publisher MAY support more data nodes
but SHOULD support at least this number.
May be used to avoid the 'update-too-big' error
during subscription.";
reference
"RFC 8641: Subscription to YANG Notifications for
Datastore Updates, the 'update-too-big' error/identity";
}
leaf periodic-notifications-supported {
type notification-support;
description
"Specifies whether the publisher is capable of
sending 'periodic' notifications for the selected
data nodes, including any subtrees that may exist
below them.";
reference
"RFC 8641: Subscription to YANG Notifications for
Datastore Updates, 'periodic' subscription concept";
}
choice update-period {
description
"Supported update period value or values for
'periodic' subscriptions.";
leaf minimum-update-period {
type uint32;
units "centiseconds";
description
"Indicates the minimal update period that is
supported for a 'periodic' subscription.
A subscription request to the selected data nodes with
a smaller period than what this leaf specifies is
likely to result in a 'period-unsupported' error.";
reference
"RFC 8641: Subscription to YANG Notifications for
Datastore Updates, the period leaf in the ietf-yang-push
YANG module";
}
leaf-list supported-update-period {
type uint32;
units "centiseconds";
description
"Supported update period values for a 'periodic'
subscription.
A subscription request to the selected data nodes with a
period not included in the leaf-list will result in a
'period-unsupported' error.";
reference
"RFC 8641: Subscription to YANG Notifications for
Datastore Updates, the period leaf in the ietf-yang-push
YANG module";
}
}
leaf on-change-supported {
if-feature "yp:on-change";
type notification-support;
description
"Specifies whether the publisher is capable of
sending 'on-change' notifications for the selected
data nodes and the subtree below them.";
reference
"RFC 8641: Subscription to YANG Notifications for Datastore
Updates, on-change concept";
}
leaf minimum-dampening-period {
if-feature "yp:on-change";
type uint32;
units "centiseconds";
description
"The minimum dampening period supported for 'on-change'
subscriptions for the selected data nodes.
If this value is present and greater than zero,
that implies dampening is mandatory.";
reference
"RFC 8641: Subscription to YANG Notifications for
Datastore Updates, the dampening-period leaf in the
ietf-yang-push YANG module";
}
leaf-list supported-excluded-change-type {
if-feature "yp:on-change";
type union {
type enumeration {
enum none {
value -2;
description
"None of the change types can be excluded.";
}
enum all {
value -1;
description
"Any combination of change types can be excluded.";
}
}
type yp:change-type;
}
description
"The change types that can be excluded in
YANG-Push subscriptions for the selected data nodes.";
reference
"RFC 8641: Subscription to YANG Notifications for Datastore
Updates, the change-type typedef in the ietf-yang-push
YANG module";
}
}
}
augment "/sysc:system-capabilities" {
description
"Add system level capabilities";
uses subscription-capabilities {
refine
"subscription-capabilities/supported-excluded-change-type" {
default "none";
}
}
}
augment "/sysc:system-capabilities/sysc:datastore-capabilities"
+ "/sysc:per-node-capabilities" {
description
"Add datastore and node-level capabilities";
uses subscription-capabilities {
refine
"subscription-capabilities/supported-excluded-change-type" {
default "none";
}
}
}
}
<CODE ENDS>Security Considerations
The YANG modules specified in this document define a schema for data
that is designed to be accessed via network management protocols such
as NETCONF or RESTCONF
or as YANG instance data.
The lowest NETCONF layer is the secure transport layer, and the
mandatory-to-implement secure transport is Secure Shell (SSH)
. The lowest RESTCONF layer is HTTPS, and
the mandatory-to-implement secure transport is TLS .
The Network Configuration Access Control Model (NACM)
provides the means to restrict access for particular NETCONF or
RESTCONF users to a preconfigured subset of all available NETCONF or
RESTCONF protocol operations and content.
This document outlines a framework for conveying system capability
information that is inherently flexible and extensible. While the full
set of use cases is not known now, they may range as wide as conveying
the minimum update period for periodic subscription updates and what
protocols might be used for such notifications. Knowledge of this type
of value might, for example, allow an attacker to gain insight into how
long unauthorized configuration changes might be active prior to detection
and what communications channels might be disrupted to extend the period
of non-detection. Documents adding additional capabilities via augmenting
this module are encouraged to document the security considerations of the
new YANG nodes, according to the guidance in BCP 216 .
All protocol-accessible data nodes in augmented modules are read-only
and cannot be modified. Access control may be configured to avoid exposing any read-only data that is defined by the augmenting module
documentation as being security sensitive.
When that data is in file format, the data should be protected against
modification or unauthorized access using normal file-handling mechanisms.
The data in file format also inherits all the security considerations of
, which includes additional
considerations about read protections and distinguishes between data at
rest and in motion.
IANA ConsiderationsThe IETF XML RegistryThis document registers the following URIs in the "IETF XML
Registry" :
ReferencesNormative ReferencesKey words for use in RFCs to Indicate Requirement LevelsIn many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.The IETF XML RegistryThis document describes an IANA maintained registry for IETF standards which use Extensible Markup Language (XML) related items such as Namespaces, Document Type Declarations (DTDs), Schemas, and Resource Description Framework (RDF) Schemas.YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)YANG is a data modeling language used to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), NETCONF remote procedure calls, and NETCONF notifications. [STANDARDS-TRACK]Network Configuration Protocol (NETCONF)The Network Configuration Protocol (NETCONF) defined in this document provides mechanisms to install, manipulate, and delete the configuration of network devices. It uses an Extensible Markup Language (XML)-based data encoding for the configuration data as well as the protocol messages. The NETCONF protocol operations are realized as remote procedure calls (RPCs). This document obsoletes RFC 4741. [STANDARDS-TRACK]Using the NETCONF Protocol over Secure Shell (SSH)This document describes a method for invoking and running the Network Configuration Protocol (NETCONF) within a Secure Shell (SSH) session as an SSH subsystem. This document obsoletes RFC 4742. [STANDARDS-TRACK]RESTCONF ProtocolThis document describes an HTTP-based protocol that provides a programmatic interface for accessing data defined in YANG, using the datastore concepts defined in the Network Configuration Protocol (NETCONF).Ambiguity of Uppercase vs Lowercase in RFC 2119 Key WordsRFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.Network Configuration Access Control ModelThe standardization of network configuration interfaces for use with the Network Configuration Protocol (NETCONF) or the RESTCONF protocol requires a structured and secure operating environment that promotes human usability and multi-vendor interoperability. There is a need for standard mechanisms to restrict NETCONF or RESTCONF protocol access for particular users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. This document defines such an access control model.This document obsoletes RFC 6536.Network Management Datastore Architecture (NMDA)Datastores are a fundamental concept binding the data models written in the YANG data modeling language to network management protocols such as the Network Configuration Protocol (NETCONF) and RESTCONF. This document defines an architectural framework for datastores based on the experience gained with the initial simpler model, addressing requirements that were not well supported in the initial model. This document updates RFC 7950.The Transport Layer Security (TLS) Protocol Version 1.3This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery.This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations.YANG LibraryThis document describes a YANG library that provides information about the YANG modules, datastores, and datastore schemas used by a network management server. Simple caching mechanisms are provided to allow clients to minimize retrieval of this information. This version of the YANG library supports the Network Management Datastore Architecture (NMDA) by listing all datastores supported by a network management server and the schema that is used by each of these datastores.Subscription to YANG NotificationsThis document defines a YANG data model and associated mechanisms enabling subscriber-specific subscriptions to a publisher's event streams. Applying these elements allows a subscriber to request and receive a continuous, customized feed of publisher-generated information.Subscription to YANG Notifications for Datastore UpdatesThis document describes a mechanism that allows subscriber applications to request a continuous and customized stream of updates from a YANG datastore. Providing such visibility into updates enables new capabilities based on the remote mirroring and monitoring of configuration and operational state.A File Format for YANG Instance DataInformative ReferencesYANG Tree DiagramsThis document captures the current syntax used in YANG module tree diagrams. The purpose of this document is to provide a single location for this definition. This syntax may be updated from time to time based on the evolution of the YANG language.Guidelines for Authors and Reviewers of Documents Containing YANG Data ModelsThis memo provides guidelines for authors and reviewers of specifications containing YANG modules. Recommendations and procedures are defined, which are intended to increase interoperability and usability of Network Configuration Protocol (NETCONF) and RESTCONF protocol implementations that utilize YANG modules. This document obsoletes RFC 6087.Handling Long Lines in Content of Internet-Drafts and RFCsThis document defines two strategies for handling long lines in width-bounded text content. One strategy, called the "single backslash" strategy, is based on the historical use of a single backslash ('\') character to indicate where line-folding has occurred, with the continuation occurring with the first character that is not a space character (' ') on the next line. The second strategy, called the "double backslash" strategy, extends the first strategy by adding a second backslash character to identify where the continuation begins and is thereby able to handle cases not supported by the first strategy. Both strategies use a self-describing header enabling automated reconstitution of the original content.Instance Data Example #1The following examples use artwork folding
for better formatting.
The following instance data example describes the notification
capabilities of a hypothetical "acme-router". The router implements
the running and operational datastores.
Every change can be reported "on-change" from the running datastore,
but only "config false" nodes and some "config false" data can be reported on-change from the
operational datastore.
Interface statistics are not reported "on-change"; only two important counters are.
Datastore subscription capabilities are not reported "on-change", as they
never change on the acme-router during runtime.
Notification Capabilities with Settings Specific to the Data Node
========== NOTE: '\' line wrapping per RFC 8792) ===========
<?xml version="1.0" encoding="UTF-8"?>
<instance-data-set xmlns=\
"urn:ietf:params:xml:ns:yang:ietf-yang-instance-data">
<name>acme-router-notification-capabilities</name>
<content-schema>
<module>ietf-system-capabilities@2022-02-17</module>
<module>ietf-notification-capabilities@2022-02-17</module>
</content-schema>
<description>Defines the notification capabilities of an
acme-router. The router only has running and operational
datastores. Every change can be reported on-change from the
running datastore, but only "config false" nodes and some
"config false" data can be reported on-change from the
operational datastore. Statistics
are not reported on-change except for two important counters,
where a small dampening period is mandated.
</description>
<content-data>
<system-capabilities \
xmlns="urn:ietf:params:xml:ns:yang:ietf-system-capabilities" \
xmlns:notc=\
"urn:ietf:params:xml:ns:yang:ietf-notification-capabilities" \
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores">
<notc:subscription-capabilities>
<notc:minimum-update-period>500</notc:minimum-update-period>
<notc:max-nodes-per-update>2000</notc:max-nodes-per-update>
<notc:minimum-dampening-period>\
100\
</notc:minimum-dampening-period>
<notc:periodic-notifications-supported>\
config-changes state-changes\
</notc:periodic-notifications-supported>
<notc:on-change-supported>\
config-changes state-changes\
</notc:on-change-supported>
<notc:supported-excluded-change-type>\
all\
</notc:supported-excluded-change-type>
</notc:subscription-capabilities>
<datastore-capabilities>
<datastore>ds:operational</datastore>
<per-node-capabilities>
<node-selector>\
/if:interfaces/if:interface[if:name='lo']\
</node-selector>
<notc:subscription-capabilities>
<notc:on-change-supported/>
<notc:periodic-notifications-supported/>
</notc:subscription-capabilities>
</per-node-capabilities>
<per-node-capabilities>
<node-selector>\
/if:interfaces/if:interface/if:statistics/if:in-octets\
</node-selector>
<notc:subscription-capabilities>
<notc:minimum-dampening-period>10
</notc:minimum-dampening-period>
<notc:on-change-supported>\
state-changes\
</notc:on-change-supported>
</notc:subscription-capabilities>
</per-node-capabilities>
<per-node-capabilities>
<node-selector>\
/if:interfaces/if:interface/if:statistics/if:out-octets\
</node-selector>
<notc:subscription-capabilities>
<notc:minimum-dampening-period>10
</notc:minimum-dampening-period>
<notc:on-change-supported>\
state-changes\
</notc:on-change-supported>
</notc:subscription-capabilities>
</per-node-capabilities>
<per-node-capabilities>
<node-selector>\
/if:interfaces/if:interface/if:statistics\
</node-selector>
<notc:subscription-capabilities>
<notc:on-change-supported/>
</notc:subscription-capabilities>
</per-node-capabilities>
</datastore-capabilities>
</system-capabilities>
</content-data>
</instance-data-set>
Instance Data Example #2The following examples use artwork folding
for better formatting.
The following instance data example describes the notification
capabilities of a hypothetical "acme-switch". The switch implements
the running, candidate, and operational
datastores.
Every change can be reported "on-change" from the
running datastore, nothing can be reported on-change from the candidate datastore, and all
"config false" data can be reported on-change from the operational datastore.
"Periodic" subscriptions are supported for running and
operational but not for candidate datastores.
Notification Capabilities with Datastore-Level Settings
========== NOTE: '\' line wrapping per RFC 8792) ===========
<?xml version="1.0" encoding="UTF-8"?>
<instance-data-set xmlns=\
"urn:ietf:params:xml:ns:yang:ietf-yang-instance-data">
<name>acme-switch-notification-capabilities</name>
<content-schema>
<module>ietf-system-capabilities@2022-02-17</module>
<module>ietf-notification-capabilities@2022-02-17</module>
</content-schema>
<description>Notification capabilities of acme-switch.
Acme-switch implements the running, candidate, and operational
datastores. Every change can be reported on-change from the
running datastore, nothing from the candidate datastore and
all "config false" data from the operational datastore. Periodic
subscriptions are supported for running and operational, but not
for candidate datastore.
</description>
<content-data>
<system-capabilities \
xmlns="urn:ietf:params:xml:ns:yang:ietf-system-capabilities" \
xmlns:notc=\
"urn:ietf:params:xml:ns:yang:ietf-notification-capabilities" \
xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores">
<notc:subscription-capabilities>
<notc:minimum-update-period>500</notc:minimum-update-period>
<notc:max-nodes-per-update>2000</notc:max-nodes-per-update>
<notc:minimum-dampening-period>\
100\
</notc:minimum-dampening-period>
<notc:periodic-notifications-supported>\
config-changes state-changes\
</notc:periodic-notifications-supported>
</notc:subscription-capabilities>
<datastore-capabilities>
<datastore>ds:operational</datastore>
<per-node-capabilities>
<node-selector>/</node-selector>
<notc:subscription-capabilities>
<notc:on-change-supported>\
state-changes\
</notc:on-change-supported>
</notc:subscription-capabilities>
</per-node-capabilities>
</datastore-capabilities>
<datastore-capabilities>
<datastore>ds:candidate</datastore>
<per-node-capabilities>
<node-selector>/</node-selector>
<notc:subscription-capabilities>
<notc:on-change-supported/>
<notc:periodic-notifications-supported/>
</notc:subscription-capabilities>
</per-node-capabilities>
</datastore-capabilities>
<datastore-capabilities>
<datastore>ds:running</datastore>
<per-node-capabilities>
<node-selector>/</node-selector>
<notc:subscription-capabilities>
<notc:on-change-supported>\
config-changes\
</notc:on-change-supported>
</notc:subscription-capabilities>
</per-node-capabilities>
</datastore-capabilities>
</system-capabilities>
</content-data>
</instance-data-set>
AcknowledgmentsFor their valuable comments, discussions, and feedback, we wish to
acknowledge , , , ,
, , , , ,
, , , and other members of the Netmod Working Group.Authors' AddressesEricssonMagyar Tudosok korutja 11BudapestHungary1117balazs.lengyel@ericsson.comFuturewei2330 Central ExpresswaySanta ClaraCA95050United States of Americaludwig@clemm.orgHuaweiGeorge's Court Townsend StreetDublin 2Irelandbenoit.claise@huawei.com