Network Working Group M. Bjorklund Internet-Draft Tail-f Systems Updates: 6241, 7950 (if approved) J. Schoenwaelder Intended status: Standards Track Jacobs University Expires: July 21, 2018 P. Shafer K. Watsen Juniper Networks R. Wilton Cisco Systems January 17, 2018 NETCONF Extensions to Support the Network Management Datastore Architecture draft-ietf-netconf-nmda-netconf-02 Abstract This document extends the NETCONF protocol defined in RFC 6241 in order to support the Network Management Datastore Architecture defined in I-D.ietf-netmod-revised-datastores. This document updates both RFC 6241 and RFC 7950. The update to RFC 6241 adds new operations and , and augments existing operations , , and . The update to RFC 7950 requires the usage of I-D.ietf-netconf-rfc7895bis by NETCONF servers implementing the Network Management Datastore Architecture. REF Editor: please replace "I-D.ietf-netmod-revised-datastores" and "I-D.ietf-netconf-rfc7895bis" above with their final RFC assignments. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on July 21, 2018. Bjorklund, et al. Expires July 21, 2018 [Page 1] Internet-Draft January 2018 Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 3 2. Datastore and YANG Library Requirements . . . . . . . . . . . 3 3. NETCONF Extensions . . . . . . . . . . . . . . . . . . . . . 4 3.1. New NETCONF Operations . . . . . . . . . . . . . . . . . 4 3.1.1. The Operation . . . . . . . . . . . . . . 4 3.1.2. The Operation . . . . . . . . . . . . . . 6 3.2. Augmentations to NETCONF Operations . . . . . . . . . . . 6 4. NETCONF Datastores YANG Module . . . . . . . . . . . . . . . 7 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13 6. Security Considerations . . . . . . . . . . . . . . . . . . . 14 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 14 7.1. Normative References . . . . . . . . . . . . . . . . . . 14 7.2. Informative References . . . . . . . . . . . . . . . . . 16 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 16 1. Introduction This document extends the NETCONF protocol defined in [RFC6241] in order to support the Network Management Datastore Architecture (NMDA) defined in [I-D.ietf-netmod-revised-datastores]. This document updates [RFC6241] in order to enable NETCONF clients to interact with all the datastores supported by a server implementing the NMDA. The update both adds new operations and , and augments existing operations , , and . This document also updates [RFC7950] in order to enable NETCONF clients to both discover which datastores are supported by the Bjorklund, et al. Expires July 21, 2018 [Page 2] Internet-Draft January 2018 NETCONF server, as well as determine which modules are supported in each datastore. The update requires NETCONF servers implementing the NMDA to support [I-D.ietf-netconf-rfc7895bis]. 1.1. Terminology This document uses the terminology defined by the NMDA [I-D.ietf-netmod-revised-datastores]. The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 1.2. Tree Diagrams Tree diagrams used in this document follow the notation defined in [I-D.ietf-netmod-yang-tree-diagrams]. 2. Datastore and YANG Library Requirements RFC Ed.: Update 201X-XX-XX below with correct date. An NMDA-compliant NETCONF server MUST support the operational state datastore and it MUST implement at least revision 201X-XX-XX of the "ietf-yang-library" module defined in [I-D.ietf-netconf-rfc7895bis]. The server MUST advertise the following capability in the message (line breaks and whitespaces are used for formatting reasons only): urn:ietf:params:netconf:capability:yang-library:1.1? revision=&checksum= The parameter "revision" has the same value as the revision date of the "ietf-yang-library" module implemented by the server. This parameter MUST be present. The parameter "checksum" has the same value as the leaf "/yang-library/checksum" from "ietf-yang-library". This parameter MUST be present. With this mechanism, a client can cache the supported modules for a server and only update the cache if the "checksum" value in the message changes. Bjorklund, et al. Expires July 21, 2018 [Page 3] Internet-Draft January 2018 This document updates [RFC7950], Section 5.6.4, to allow servers to advertise the capability :yang-library:1.1 instead of :yang- library:1.0, and to implement the subtree "/yang-library" [I-D.ietf-netconf-rfc7895bis] instead of "/modules-state". 3. NETCONF Extensions This section describes the NETCONF extensions needed to support the NMDA. These changes are defined in a new YANG ([RFC7950]) module "ietf-netconf-nmda". These changes include the use of source and target parameters based on the "datastore" identity defined in the "ietf-datastores" module [I-D.ietf-netmod-revised-datastores]. The use of identities allows future expansion in a way that the choice-based strategy from the original operations (e.g., , ) does not. 3.1. New NETCONF Operations Two new operations and are defined in this document in order to support the NMDA. These operations are similar to the and operations but they can work on an extensible set of datastores. 3.1.1. The Operation The operation retrieves data from a specific NMDA datastore. This operation is similar to NETCONF's operation defined in [RFC6241], but it adds the flexibility to select the source datastore. +---x get-data +---w input | +---w datastore ds:datastore-ref | +---w (filter-spec)? | | +--:(subtree-filter) | | | +---w subtree-filter? | | +--:(xpath-filter) | | +---w xpath-filter? yang:xpath1.0 {nc:xpath}? | +---w config-filter? boolean | +---w origin-filter? identityref {origin}? | +---w max-depth? union | +---w with-origin? empty {origin}? | +---w with-defaults? with-defaults-mode +--ro output +--ro data? Bjorklund, et al. Expires July 21, 2018 [Page 4] Internet-Draft January 2018 The "datastore" parameter indicates the datastore which is the source of the data to be retrieved. This is a datastore identity. The operation accepts a content filter parameter, similar to the "filter" parameter of , but using explicit nodes for subtree filtering ("subtree-filter") and XPath filtering ("xpath-filter"). The "config-filter" parameter can be used to retrieve only "config true" or "config false" nodes. The "origin-filter" can be used to select nodes matching a given "origin" value. The "max-depth" parameter can be used by the client to limit the number of sub-tree levels that are returned in the reply. The operation also supports the "with-defaults" parameter as defined in [RFC6243]. The supported values follow the constraints given by the "with-defaults" capability. The "with-defaults" parameter does not apply when interacting with an operational datastore. This means that all "in use" values, as defined in [I-D.ietf-netmod-revised-datastores] section 5.3, are returned from the operational state datastore, even if a node happens to have a default statement in the YANG module, and this default value is being used by the server. If the "with-defaults" parameter is present in a request to such a datastore, then the server MUST return an error, as specified in "ietf-netconf-nmda" (see Section 4). 3.1.1.1. Origin Metadata Attribute The operation defines a parameter named "with-origin", which if present, requests that the server includes "origin" metadata anotations in its response, as detailed in the NMDA. This parameter is only valid for the operational state datastore and any datastores with identities derived from the "operational" identity. Otherwise, if an invalid datastore is specified then an error is returned, as specified in "ietf-netconf-nmda" (see Section 4). Note that "origin" metadata annotations are not included in a response unless a client explicitly requests them. Data in the operational state datastore can come from multiple sources. The server should return the most accurate value for the "origin" metadata annotation as possible, indicating the source of the operational value, as specified in Section 5.3.4 of [I-D.ietf-netmod-revised-datastores]. When encoding the origin metadata annotation for a hierarchy of returned nodes, the annotation may be omitted for a child node when Bjorklund, et al. Expires July 21, 2018 [Page 5] Internet-Draft January 2018 the value matches that of the parent node, as described in the "ietf-origin" YANG module [I-D.ietf-netmod-revised-datastores]. The "with-origin" parameter is optional to support. It is identified with the URI: urn:ietf:params:netconf:capability:with-origin:1.0 3.1.2. The Operation The operation changes the contents of a writable datastore, similar to the operation defined in [RFC6241], but with additional flexibility in naming the target datastore. If an operation is invoked on a non-writable datastore, then an error is returned, as specified in "ietf-netconf-nmda" (see Section 4). +---x edit-data +---w input +---w datastore? ds:datastore-ref +---w default-operation? enumeration +---w (edit-content) +--:(config) | +---w config? +--:(url) +---w url? inet:uri {nc:url}? The "datastore" parameter is a datastore identity that indicates the desired target datastore where changes should be made. The "default-operation" parameter is a copy of the "default-operation" parameter of the operation. The "edit-content" choice mirrors the "edit-content" choice of the operation. Note, however, that the "config" element in the "edit-content" choice of uses "anydata" (introduced in YANG 1.1) while the "config" element in the "edit-content" choice of used "anyxml". The operation does not support the "error-option" and the "test-option" parameters that were part of the operation. 3.2. Augmentations to NETCONF Operations Several of the operations defined in the base NETCONF YANG module "ietf-netconf" [RFC6241] may be used with new datastores. Hence, the , , and operations are augmented with a new Bjorklund, et al. Expires July 21, 2018 [Page 6] Internet-Draft January 2018 "datastore" leaf that can select the desired datastore. If a , , or operation is not supported on a particular datastore then an error is returned, as specified in "ietf-netconf-nmda" (see Section 4). 4. NETCONF Datastores YANG Module This module imports definitions from [RFC6991], [RFC6241], [RFC6243], and [I-D.ietf-netmod-revised-datastores]. RFC Ed.: update the date below with the date of RFC publication and remove this note. file "ietf-netconf-nmda@2018-01-17.yang" module ietf-netconf-nmda { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-nmda"; prefix ncds; import ietf-yang-types { prefix yang; } import ietf-inet-types { prefix inet; } import ietf-datastores { prefix ds; } import ietf-origin { prefix or; } import ietf-netconf { prefix nc; } import ietf-netconf-with-defaults { prefix ncwd; } organization "IETF NETCONF Working Group"; contact "WG Web: WG List: Author: Martin Bjorklund Bjorklund, et al. Expires July 21, 2018 [Page 7] Internet-Draft January 2018 Author: Juergen Schoenwaelder Author: Phil Shafer Author: Kent Watsen Author: Rob Wilton "; description "This YANG module defines a set of NETCONF operations to support the Network Management Datastore Architecture (NMDA). Copyright (c) 2018 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX (http://www.rfc-editor.org/info/rfcxxxx); see the RFC itself for full legal notices."; revision 2018-01-17 { description "Initial revision."; reference "RFC XXXX: NETCONF Extensions to Support the Network Management Datastore Architecture"; } feature origin { description "Indicates that the server supports the 'origin' annotation."; reference "RFC XXXX: Network Management Datastore Architecture"; } rpc get-data { description "Retrieve data from an NMDA datastore. The content returned by get-data must satisfy all filters, i.e., the filter Bjorklund, et al. Expires July 21, 2018 [Page 8] Internet-Draft January 2018 criteria are logically ANDed. The 'with-origin' parameter is only valid for an operational datastore. If 'with-origin' is used with an invalid datastore, then the server MUST return an element with an value of 'invalid-value'. The 'with-defaults' parameter does not apply to operational datastores. If the 'with-defaults' parameter is present in a request to an operational datastore, then the server MUST return an element with an value of 'invalid-value'."; input { leaf datastore { type ds:datastore-ref; mandatory true; description "Datastore from which to retrieve data."; } choice filter-spec { description "The content filter specification for this request."; anydata subtree-filter { description "This parameter identifies the portions of the target datastore to retrieve."; reference "RFC 6241: Network Configuration Protocol, Section 6."; } leaf xpath-filter { if-feature nc:xpath; type yang:xpath1.0; description "This parameter contains an XPath expression identifying the portions of the target datastore to retrieve. If the expression returns a node-set, all nodes in the node-set are selected by the filter. Otherwise, if the expression does not return a node-set, then the get-data operation fails. The expression is evaluated in the following XPath context: o The set of namespace declarations are those in scope on the 'xpath-filter' leaf element. Bjorklund, et al. Expires July 21, 2018 [Page 9] Internet-Draft January 2018 o The set of variable bindings is empty. o The function library is the core function library, and the XPath functions defined in section 10 in RFC 7950. o The context node is the root node of the target datastore."; } } leaf config-filter { type boolean; description "Filter for nodes with the given value for their 'config' property."; } leaf origin-filter { when 'derived-from-or-self(../datastore, "or:operational")'; if-feature origin; type identityref { base or:origin; } description "Filter based on 'origin' annotation. A node matches the filter if its 'origin' annotation is derived from or equal to the given filter value."; } leaf max-depth { type union { type uint16 { range "1..65535"; } type enumeration { enum "unbounded"; } } default "unbounded"; description "For each node selected by the filter, this parameter selects how many conceptual sub-tree levels should be returned in the reply. If the depth is 1, the reply includes just the selected nodes but no children. If the depth is 'unbounded', all descendant nodes are included."; } leaf with-origin { Bjorklund, et al. Expires July 21, 2018 [Page 10] Internet-Draft January 2018 when 'derived-from-or-self(../datastore, "or:operational")'; if-feature origin; type empty; description "If this parameter is present, the server will return the 'origin' annotation for the nodes that has one."; } uses ncwd:with-defaults-parameters; } output { anydata data { description "Copy of the source datastore subset which matched the filter criteria (if any). An empty data container indicates that the request did not produce any results."; } } } rpc edit-data { description "Edit data in an NMDA datastore."; input { leaf datastore { type ds:datastore-ref; description "Datastore which is the target of the edit-data operation. If the target datastore is not writable, then the server MUST return an element with an value of 'invalid-value'"; } leaf default-operation { type enumeration { enum "merge" { description "The default operation is merge."; } enum "replace" { description "The default operation is replace."; } enum "none" { description Bjorklund, et al. Expires July 21, 2018 [Page 11] Internet-Draft January 2018 "There is no default operation."; } } default "merge"; description "The default operation to use."; } choice edit-content { mandatory true; description "The content for the edit operation."; anydata config { description "Inline config content."; } leaf url { if-feature nc:url; type inet:uri; description "URL based config content."; } } } } /* * Augment the lock and unlock operations with a * "datastore" parameter. */ augment "/nc:lock/nc:input/nc:target/nc:config-target" { description "Add NMDA Datastore as target."; leaf datastore { type ds:datastore-ref; description "Datastore to lock. If the lock operation is not supported by the server on the specified target datastore, then the server MUST return an element with an value of 'invalid-value'"; } } augment "/nc:unlock/nc:input/nc:target/nc:config-target" { description "Add NMDA Datastore as target."; Bjorklund, et al. Expires July 21, 2018 [Page 12] Internet-Draft January 2018 leaf datastore { type ds:datastore-ref; description "Datastore to unlock. If the unlock operation is not supported by the server on the specified target datastore, then the server MUST return an element with an value of 'invalid-value'"; } } /* * Augment the validate operation with a * "datastore" parameter. */ augment "/nc:validate/nc:input/nc:source/nc:config-source" { description "Add NMDA Datastore as source."; leaf datastore { type ds:datastore-ref; description "Datastore to validate. If the validate operation is not supported by the server on the specified target datastore, then the server MUST return an element with an value of 'invalid-value'"; } } } 5. IANA Considerations This document registers two capability identifier URNs in the "Network Configuration Protocol (NETCONF) Capability URNs" registry: Index Capability Identifier ------------- --------------------------------------------------- :yang-library urn:ietf:params:netconf:capability:yang-library:1.1 :with-origin urn:ietf:params:netconf:capability:with-origin:1.0 Bjorklund, et al. Expires July 21, 2018 [Page 13] Internet-Draft January 2018 This document registers a URI in the "IETF XML Registry" [RFC3688]. Following the format in RFC 3688, the following registration has been made. URI: urn:ietf:params:xml:ns:yang:ietf-netconf-nmda Registrant Contact: The IESG. XML: N/A, the requested URI is an XML namespace. This document registers a YANG module in the "YANG Module Names" registry [RFC6020]. name: ietf-netconf-nmda namespace: urn:ietf:params:xml:ns:yang:ietf-netconf-nmda prefix: ncds reference: RFC XXXX 6. Security Considerations The YANG module defined in this document extends the base operations of the NETCONF [RFC6241] protocol. The lowest NETCONF layer is the secure transport layer and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The network configuration access control model [I-D.ietf-netconf-rfc6536bis] provides the means to restrict access for particular NETCONF users to a preconfigured subset of all available NETCONF protocol operations and content. The security considerations for the base NETCONF protocol operations (see Section 9 of [RFC6241]) apply to the new NETCONF and operations defined in this document. 7. References 7.1. Normative References [I-D.ietf-netconf-rfc6536bis] Bierman, A. and M. Bjorklund, "Network Configuration Access Control Module", draft-ietf-netconf-rfc6536bis-09 (work in progress), December 2017. [I-D.ietf-netconf-rfc7895bis] Bierman, A., Bjorklund, M., and K. Watsen, "YANG Library", draft-ietf-netconf-rfc7895bis-02 (work in progress), October 2017. Bjorklund, et al. Expires July 21, 2018 [Page 14] Internet-Draft January 2018 [I-D.ietf-netmod-revised-datastores] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K., and R. Wilton, "Network Management Datastore Architecture", draft-ietf-netmod-revised-datastores-10 (work in progress), January 2018. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/ RFC2119, March 1997, . [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004, . [RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI 10.17487/RFC6020, October 2010, . [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, . [RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011, . [RFC6243] Bierman, A. and B. Lengyel, "With-defaults Capability for NETCONF", RFC 6243, DOI 10.17487/RFC6243, June 2011, . [RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types", RFC 6991, DOI 10.17487/RFC6991, July 2013, . [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . Bjorklund, et al. Expires July 21, 2018 [Page 15] Internet-Draft January 2018 7.2. Informative References [I-D.ietf-netmod-yang-tree-diagrams] Bjorklund, M. and L. Berger, "YANG Tree Diagrams", draft- ietf-netmod-yang-tree-diagrams-04 (work in progress), December 2017. Authors' Addresses Martin Bjorklund Tail-f Systems Email: mbj@tail-f.com Juergen Schoenwaelder Jacobs University Email: j.schoenwaelder@jacobs-university.de Phil Shafer Juniper Networks Email: phil@juniper.net Kent Watsen Juniper Networks Email: kwatsen@juniper.net Robert Wilton Cisco Systems Email: rwilton@cisco.com Bjorklund, et al. Expires July 21, 2018 [Page 16]