file "ietf-system-capabilities@2022-02-17.yang" module ietf-system-capabilities { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-system-capabilities"; prefix sysc; import ietf-netconf-acm { prefix nacm; reference "RFC 8341: Network Configuration Access Control Model"; } import ietf-yang-library { prefix yanglib; description "This module requires ietf-yang-library to be implemented. Revision 2019-01-04 or a revision derived from it is REQUIRED."; reference "RFC8525: YANG Library"; } organization "IETF NETCONF (Network Configuration) Working Group"; contact "WG Web: WG List: Editor: Balazs Lengyel "; description "This module specifies a structure to specify system capabilities for a server or a publisher. System capabilities may include capabilities of a NETCONF or RESTCONF server or a notification publisher. This module does not contain any specific capabilities; it only provides a structure where containers containing the actual capabilities are augmented in. Capability values can be specified at the system level, at the datastore level (by selecting all nodes in the datastore), or for specific data nodes of a specific datastore (and their contained subtrees). Capability values specified for a specific datastore or node-set override values specified on the system/publisher level. The same grouping MUST be used to define hierarchical capabilities supported both at the system level and at the datastore/data-node level. To find a capability value for a specific data node in a specific datastore, the user SHALL: 1) search for a datastore-capabilities list entry for the specific datastore. When stating a specific capability, the relative path for any specific capability must be the same under the system-capabilities container and under the per-node-capabilities list. 2) If the datastore entry is found within that entry, process all per-node-capabilities entries in the order they appear in the list. The first entry that specifies the specific capability and has a node-selector selecting the specific data node defines the capability value. 3) If the capability value is not found above and the specific capability is specified under the system-capabilities container (outside the datastore-capabilities list), this value shall be used. 4) If no values are found in the previous steps, the system/publisher is not capable of providing a value. Possible reasons are that it is unknown, the capability is changing for some reason, there is no specified limit, etc. In this case, the system's behavior is unspecified. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here. Copyright (c) 2022 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC 9196 (https://www.rfc-editor.org/info/rfc9196); see the RFC itself for full legal notices."; revision 2022-02-17 { description "Initial version"; reference "RFC 9196: YANG Modules Describing Capabilities for Systems and Datastore Update Notifications"; } container system-capabilities { config false; description "System capabilities. Capability values specified here at the system level are valid for all datastores and are used when the capability is not specified at the datastore level or for specific data nodes."; /* * "Augmentation point for system-level capabilities." */ list datastore-capabilities { key "datastore"; description "Capabilities values per datastore. For non-NMDA servers/publishers, 'config false' data is considered as if it were part of the running datastore."; leaf datastore { type leafref { path "/yanglib:yang-library/yanglib:datastore/yanglib:name"; } description "The datastore for which capabilities are defined. Only one specific datastore can be specified, e.g., ds:conventional must not be used, as it represents a set of configuration datastores."; } list per-node-capabilities { description "Each list entry specifies capabilities for the selected data nodes. The same capabilities apply to the data nodes in the subtree below the selected nodes. The system SHALL order the entries according to their precedence. The order of the entries MUST NOT change unless the underlying capabilities also change. Note that the longest patch matching can be achieved by ordering more specific matches before less specific ones."; choice node-selection { description "A method to select some or all nodes within a datastore."; leaf node-selector { type nacm:node-instance-identifier; description "Selects the data nodes for which capabilities are specified. The special value '/' denotes all data nodes in the datastore, consistent with the path leaf node on page 41 of [RFC8341]."; reference "RFC 8341: Network Configuration Access Control Model"; } } /* * "Augmentation point for datastore- or data-node-level * capabilities." */ } } } } 5. Notification Capabilities Model The YANG module "ietf-notification-capabilities" provides information related to the YANG-Push capability. 5.1. Tree Diagram The following tree diagram [RFC8340] provides an overview of the data model. module: ietf-notification-capabilities augment /sysc:system-capabilities: +--ro subscription-capabilities +--ro max-nodes-per-update? uint32 +--ro periodic-notifications-supported? notification-support +--ro (update-period)? | +--:(minimum-update-period) | | +--ro minimum-update-period? uint32 | +--:(supported-update-period) | +--ro supported-update-period* uint32 +--ro on-change-supported? notification-support | {yp:on-change}? +--ro minimum-dampening-period? uint32 | {yp:on-change}? +--ro supported-excluded-change-type* union {yp:on-change}? augment /sysc:system-capabilities/sysc:datastore-capabilities /sysc:per-node-capabilities: +--ro subscription-capabilities +--ro max-nodes-per-update? uint32 +--ro periodic-notifications-supported? notification-support +--ro (update-period)? | +--:(minimum-update-period) | | +--ro minimum-update-period? uint32 | +--:(supported-update-period) | +--ro supported-update-period* uint32 +--ro on-change-supported? notification-support | {yp:on-change}? +--ro minimum-dampening-period? uint32 | {yp:on-change}? +--ro supported-excluded-change-type* union {yp:on-change}? 5.2. YANG Module This YANG module imports a feature and typedefs from [RFC8641] and also imports the "ietf-system-capabilities" specified in this document. file "ietf-notification-capabilities@2022-02-17.yang" module ietf-notification-capabilities { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-notification-capabilities"; prefix notc; import ietf-yang-push { prefix yp; description "This module requires ietf-yang-push to be implemented."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates"; } import ietf-system-capabilities { prefix sysc; description "This module requires ietf-system-capabilities to be implemented."; reference "RFC 9196: YANG Modules Describing Capabilities for Systems and Datastore Update Notifications"; } organization "IETF NETCONF (Network Configuration) Working Group"; contact "WG Web: WG List: Editor: Balazs Lengyel "; description "This module specifies publisher capabilities related to YANG-Push (RFC 8641). The module contains: - a specification of the data nodes that support 'on-change' or 'periodic' notifications. - capabilities related to the throughput of notification data that the publisher can support. (Note that for a specific subscription, the publisher MAY allow only longer periods or smaller updates depending on, e.g., actual load conditions.) Capability values can be specified at the system/publisher level, at the datastore level, or for specific data nodes of a specific datastore (and their contained subtrees), as defined in the ietf-system-capabilities module. If different data nodes covered by a single subscription have different values for a specific capability, then using values that are only acceptable for some of these data nodes, but not for others, may result in the rejection of the subscription. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here. Copyright (c) 2022 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC 9196 (https://www.rfc-editor.org/info/rfc9196); see the RFC itself for full legal notices."; revision 2022-02-17 { description "Initial version"; reference "RFC 9196: YANG Modules Describing Capabilities for Systems and Datastore Update Notifications"; } grouping subscription-capabilities { description "Capabilities related to YANG-Push subscriptions and notifications"; container subscription-capabilities { description "Capabilities related to YANG-Push subscriptions and notifications"; typedef notification-support { type bits { bit config-changes { description "The publisher is capable of sending notifications for 'config true' nodes for the relevant scope and subscription type."; } bit state-changes { description "The publisher is capable of sending notifications for 'config false' nodes for the relevant scope and subscription type."; } } description "Type for defining whether 'on-change' or 'periodic' notifications are supported for all data nodes, 'config false' data nodes, 'config true' data nodes, or no data nodes. The bits config-changes or state-changes have no effect when they are set for a datastore or for a set of nodes that does not contain nodes with the indicated config value. In those cases, the effect is the same as if no support was declared. One example of this is indicating support for state-changes for a candidate datastore that has no effect."; } leaf max-nodes-per-update { type uint32 { range "1..max"; } description "Maximum number of data nodes that can be sent in an update. The publisher MAY support more data nodes but SHOULD support at least this number. May be used to avoid the 'update-too-big' error during subscription."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates, the 'update-too-big' error/identity"; } leaf periodic-notifications-supported { type notification-support; description "Specifies whether the publisher is capable of sending 'periodic' notifications for the selected data nodes, including any subtrees that may exist below them."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates, 'periodic' subscription concept"; } choice update-period { description "Supported update period value or values for 'periodic' subscriptions."; leaf minimum-update-period { type uint32; units "centiseconds"; description "Indicates the minimal update period that is supported for a 'periodic' subscription. A subscription request to the selected data nodes with a smaller period than what this leaf specifies is likely to result in a 'period-unsupported' error."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates, the period leaf in the ietf-yang-push YANG module"; } leaf-list supported-update-period { type uint32; units "centiseconds"; description "Supported update period values for a 'periodic' subscription. A subscription request to the selected data nodes with a period not included in the leaf-list will result in a 'period-unsupported' error."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates, the period leaf in the ietf-yang-push YANG module"; } } leaf on-change-supported { if-feature "yp:on-change"; type notification-support; description "Specifies whether the publisher is capable of sending 'on-change' notifications for the selected data nodes and the subtree below them."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates, on-change concept"; } leaf minimum-dampening-period { if-feature "yp:on-change"; type uint32; units "centiseconds"; description "The minimum dampening period supported for 'on-change' subscriptions for the selected data nodes. If this value is present and greater than zero, that implies dampening is mandatory."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates, the dampening-period leaf in the ietf-yang-push YANG module"; } leaf-list supported-excluded-change-type { if-feature "yp:on-change"; type union { type enumeration { enum none { value -2; description "None of the change types can be excluded."; } enum all { value -1; description "Any combination of change types can be excluded."; } } type yp:change-type; } description "The change types that can be excluded in YANG-Push subscriptions for the selected data nodes."; reference "RFC 8641: Subscription to YANG Notifications for Datastore Updates, the change-type typedef in the ietf-yang-push YANG module"; } } } augment "/sysc:system-capabilities" { description "Add system level capabilities"; uses subscription-capabilities { refine "subscription-capabilities/supported-excluded-change-type" { default "none"; } } } augment "/sysc:system-capabilities/sysc:datastore-capabilities" + "/sysc:per-node-capabilities" { description "Add datastore and node-level capabilities"; uses subscription-capabilities { refine "subscription-capabilities/supported-excluded-change-type" { default "none"; } } } } 6. Security Considerations The YANG modules specified in this document define a schema for data that is designed to be accessed via network management protocols such as NETCONF [RFC6241] or RESTCONF [RFC8040] or as YANG instance data. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-to- implement secure transport is TLS [RFC8446]. The Network Configuration Access Control Model (NACM) [RFC8341] provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. This document outlines a framework for conveying system capability information that is inherently flexible and extensible. While the full set of use cases is not known now, they may range as wide as conveying the minimum update period for periodic subscription updates and what protocols might be used for such notifications. Knowledge of this type of value might, for example, allow an attacker to gain insight into how long unauthorized configuration changes might be active prior to detection and what communications channels might be disrupted to extend the period of non-detection. Documents adding additional capabilities via augmenting this module are encouraged to document the security considerations of the new YANG nodes, according to the guidance in BCP 216 [RFC8407]. All protocol-accessible data nodes in augmented modules are read-only and cannot be modified. Access control may be configured to avoid exposing any read-only data that is defined by the augmenting module documentation as being security sensitive. When that data is in file format, the data should be protected against modification or unauthorized access using normal file- handling mechanisms. The data in file format also inherits all the security considerations of [RFC9195], which includes additional considerations about read protections and distinguishes between data at rest and in motion. 7. IANA Considerations 7.1. The IETF XML Registry This document registers the following URIs in the "IETF XML Registry" [RFC3688]: URI: urn:ietf:params:xml:ns:yang:ietf-system-capabilities Registrant Contact: The IESG. XML: N/A, the requested URI is an XML namespace. URI: urn:ietf:params:xml:ns:yang:ietf-notification-capabilities Registrant Contact: The IESG. XML: N/A, the requested URI is an XML namespace. 7.2. The YANG Module Names Registry This document registers the following YANG modules in the "YANG Module Names" registry [RFC6020]: name: ietf-system-capabilities namespace: urn:ietf:params:xml:ns:yang:ietf-system-capabilities prefix: sysc reference: RFC 9196 name: ietf-notification-capabilities namespace: urn:ietf:params:xml:ns:yang:ietf-notification- capabilities prefix: notc reference: RFC 9196 8. References 8.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004, . [RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI 10.17487/RFC6020, October 2010, . [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, . [RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011, . [RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration Access Control Model", STD 91, RFC 8341, DOI 10.17487/RFC8341, March 2018, . [RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K., and R. Wilton, "Network Management Datastore Architecture (NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018, . [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, . [RFC8525] Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K., and R. Wilton, "YANG Library", RFC 8525, DOI 10.17487/RFC8525, March 2019, . [RFC8639] Voit, E., Clemm, A., Gonzalez Prieto, A., Nilsen-Nygaard, E., and A. Tripathy, "Subscription to YANG Notifications", RFC 8639, DOI 10.17487/RFC8639, September 2019, . [RFC8641] Clemm, A. and E. Voit, "Subscription to YANG Notifications for Datastore Updates", RFC 8641, DOI 10.17487/RFC8641, September 2019, . [RFC9195] Lengyel, B. and B. Claise, "A File Format for YANG Instance Data", RFC 9195, DOI 10.17487/RFC9195, February 2022, . 8.2. Informative References [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, . [RFC8407] Bierman, A., "Guidelines for Authors and Reviewers of Documents Containing YANG Data Models", BCP 216, RFC 8407, DOI 10.17487/RFC8407, October 2018, . [RFC8792] Watsen, K., Auerswald, E., Farrel, A., and Q. Wu, "Handling Long Lines in Content of Internet-Drafts and RFCs", RFC 8792, DOI 10.17487/RFC8792, June 2020, . Appendix A. Instance Data Example #1 The following examples use artwork folding [RFC8792] for better formatting. The following instance data example describes the notification capabilities of a hypothetical "acme-router". The router implements the running and operational datastores. Every change can be reported "on-change" from the running datastore, but only "config false" nodes and some "config false" data can be reported on-change from the operational datastore. Interface statistics are not reported "on- change"; only two important counters are. Datastore subscription capabilities are not reported "on-change", as they never change on the acme-router during runtime. ========== NOTE: '\' line wrapping per RFC 8792) =========== acme-router-notification-capabilities ietf-system-capabilities@2022-02-17 ietf-notification-capabilities@2022-02-17 Defines the notification capabilities of an acme-router. The router only has running and operational datastores. Every change can be reported on-change from the running datastore, but only "config false" nodes and some "config false" data can be reported on-change from the operational datastore. Statistics are not reported on-change except for two important counters, where a small dampening period is mandated. 500 2000 \ 100\ \ config-changes state-changes\ \ config-changes state-changes\ \ all\ ds:operational \ /if:interfaces/if:interface[if:name='lo']\ \ /if:interfaces/if:interface/if:statistics/if:in-octets\ 10 \ state-changes\ \ /if:interfaces/if:interface/if:statistics/if:out-octets\ 10 \ state-changes\ \ /if:interfaces/if:interface/if:statistics\ Figure 1: Notification Capabilities with Settings Specific to the Data Node Appendix B. Instance Data Example #2 The following examples use artwork folding [RFC8792] for better formatting. The following instance data example describes the notification capabilities of a hypothetical "acme-switch". The switch implements the running, candidate, and operational datastores. Every change can be reported "on-change" from the running datastore, nothing can be reported on-change from the candidate datastore, and all "config false" data can be reported on-change from the operational datastore. "Periodic" subscriptions are supported for running and operational but not for candidate datastores. ========== NOTE: '\' line wrapping per RFC 8792) =========== acme-switch-notification-capabilities ietf-system-capabilities@2022-02-17 ietf-notification-capabilities@2022-02-17 Notification capabilities of acme-switch. Acme-switch implements the running, candidate, and operational datastores. Every change can be reported on-change from the running datastore, nothing from the candidate datastore and all "config false" data from the operational datastore. Periodic subscriptions are supported for running and operational, but not for candidate datastore. 500 2000 \ 100\ \ config-changes state-changes\ ds:operational / \ state-changes\ ds:candidate / ds:running / \ config-changes\ Figure 2: Notification Capabilities with Datastore-Level Settings Acknowledgments For their valuable comments, discussions, and feedback, we wish to acknowledge Andy Bierman, Juergen Schoenwaelder, Rob Wilton, Kent Watsen, Eric Voit, Joe Clarke, Martin Bjorklund, Ladislav Lhotka, Qin Wu, Mahesh Jethanandani, Ran Tao, Reshad Rahman, and other members of the Netmod Working Group. Authors' Addresses Balazs Lengyel Ericsson Budapest Magyar Tudosok korutja 11 1117 Hungary Email: balazs.lengyel@ericsson.com Alexander Clemm Futurewei 2330 Central Expressway Santa Clara, CA 95050 United States of America Email: ludwig@clemm.org Benoit Claise Huawei George's Court Townsend Street Dublin 2 Ireland Email: benoit.claise@huawei.com
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4