RFC 8525 | YANG Library | January 2019 |
Bierman, et al. | Standards Track | [Page] |
This document describes a YANG library that provides information about the YANG modules, datastores, and datastore schemas used by a network management server. Simple caching mechanisms are provided to allow clients to minimize retrieval of this information. This version of the YANG library supports the Network Management Datastore Architecture (NMDA) by listing all datastores supported by a network management server and the schema that is used by each of these datastores. ¶
This document obsoletes RFC 7895. ¶
This is an Internet Standards Track document. ¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. ¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8525. ¶
Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved. ¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. ¶
There is a need for a standard mechanism to expose which YANG modules [RFC7950], datastores [RFC8342], and datastore schemas [RFC8342] are in use by a network management server. ¶
This document defines the YANG module "ietf‑yang‑library" that provides this information. This version of the YANG library is compatible with the Network Management Datastore Architecture (NMDA) [RFC8342]. The previous version of the YANG library, defined in [RFC7895], is not compatible with the NMDA since it assumes that all datastores have exactly the same schema. This is not necessarily true in the NMDA since dynamic configuration datastores may have their own datastore schema. Furthermore, the operational state datastore may support non-configurable YANG modules in addition to the YANG modules supported by conventional configuration datastores. ¶
The old YANG library definitions have been retained (for backwards-compatibility reasons), but the definitions have been marked as deprecated. For backwards compatibility, an NMDA-supporting server SHOULD populate the deprecated "/modules‑state" tree in a backwards-compatible manner. The new "/yang‑library" tree will be ignored by legacy clients but will provide all the data needed for NMDA-aware clients (which will ignore the "/modules‑state" tree). The recommended approach to populate "/modules-state" is to report the YANG modules with "config true" data nodes that are configurable via conventional configuration datastores and the YANG modules with "config false" data nodes that are returned via a Network Configuration Protocol (NETCONF) <get> operation or equivalent. ¶
The YANG library information can be different on every server, and it can change at runtime or across a server reboot. If a server implements multiple network management protocols to access the server's datastores, then each such protocol may have its own conceptual instantiation of the YANG library. ¶
If a large number of YANG modules are utilized by a server, then the YANG library contents can be relatively large. Since the YANG library contents change very infrequently, it is important that clients be able to cache the YANG library contents and easily identify whether their cache is out of date. ¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. ¶
The following terms are defined in [RFC7950]: ¶
This document uses the phrase "implement a module" as defined in Section 5.6.5 of [RFC7950]. ¶
The following terms are defined in [RFC8342]: ¶
The following terms are used within this document: ¶
Tree diagrams in this document use the notation defined in [RFC8340]. ¶
The following information is needed by a client application (for each YANG module in the library) to fully utilize the YANG data modeling language: ¶
In addition, the following information is needed by a client application for each datastore supported by a server: ¶
In order to select one out of several possible designs for the YANG library data model, the following criteria were used: ¶
The "ietf‑yang‑library" YANG module provides information about the modules, submodules, datastores, and datastore schemas supported by a server. All data nodes in the "ietf‑yang‑library" module are "config false" and thus only accessible in the operational state datastore. ¶
The conceptual model of the YANG library is depicted in Figure 1. Following the NMDA, every datastore has an associated datastore schema. A datastore schema is a union of module sets, and every module set is a collection of modules and submodules, including the modules and submodules used for imports. Note that multiple datastores may refer to the same datastore schema. Furthermore, it is possible for individual datastore schemas to share module sets. A common use case is the operational state datastore schema, which is a superset of the schema used by conventional configuration datastores. ¶
Below is the YANG tree diagram for the "ietf‑yang‑library" module, excluding the deprecated "/modules‑state" tree: ¶
module: ietf-yang-library +--ro yang-library +--ro module-set* [name] | +--ro name string | +--ro module* [name] | | +--ro name yang:yang-identifier | | +--ro revision? revision-identifier | | +--ro namespace inet:uri | | +--ro location* inet:uri | | +--ro submodule* [name] | | | +--ro name yang:yang-identifier | | | +--ro revision? revision-identifier | | | +--ro location* inet:uri | | +--ro feature* yang:yang-identifier | | +--ro deviation* -> ../../module/name | +--ro import-only-module* [name revision] | +--ro name yang:yang-identifier | +--ro revision union | +--ro namespace inet:uri | +--ro location* inet:uri | +--ro submodule* [name] | +--ro name yang:yang-identifier | +--ro revision? revision-identifier | +--ro location* inet:uri +--ro schema* [name] | +--ro name string | +--ro module-set* -> ../../module-set/name +--ro datastore* [name] | +--ro name ds:datastore-ref | +--ro schema -> ../../schema/name +--ro content-id string notifications: +---n yang-library-update +--ro content-id -> /yang-library/content-id¶
The "/yang‑library" container holds the entire YANG library. The container has the following child nodes: ¶
Note that for a NETCONF server implementing the NETCONF extensions to support the NMDA [RFC8526], a change of the YANG library content identifier results in a new value for the :yang-library:1.1 capability defined in [RFC8526]. Thus, if such a server implements NETCONF notifications [RFC5277] and the "netconf‑capability‑change" notification [RFC6470], a "netconf‑capability‑change" notification is generated whenever the YANG library content identifier changes. ¶
The "ietf‑yang‑library" YANG module imports definitions from the "ietf‑yang‑types" and "ietf‑inet‑types" modules defined in [RFC6991] and from the "ietf‑datastores" module defined in [RFC8342]. While the YANG module is defined using YANG version 1.1, the YANG library supports YANG modules written in any version of YANG. ¶
Adding SVG diagram for testing purposes.¶
<CODE BEGINS> file "ietf-yang-library@2019-01-04.yang"¶
<CODE ENDS>¶
RFC 7895 previously registered one URI in the "IETF XML Registry" [RFC3688]. This document takes over this registration entry made by RFC 7895 and changes the Registrant Contact to the IESG according to Section 4 of [RFC3688]. ¶
URI: urn:ietf:params:xml:ns:yang:ietf-yang-library Registrant Contact: The IESG. XML: N/A, the requested URI is an XML namespace.¶
This document registers a YANG module in the "YANG Module Names" registry [RFC6020]: ¶
name: ietf-yang-library namespace: urn:ietf:params:xml:ns:yang:ietf-yang-library prefix: yanglib reference: RFC 7895¶
This document takes over this registration entry made by RFC 7895. ¶
The YANG module specified in this document defines a schema for data that is designed to be accessed via network management protocols such as NETCONF [RFC6241] or RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure transport is TLS [RFC8446]. ¶
The Network Configuration Access Control Model (NACM) [RFC8341] provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. ¶
Some of the readable data nodes in this YANG module may be considered sensitive or vulnerable in some network environments. It is thus important to control read access (e.g., via get, get-config, or notification) to these data nodes. These are the subtrees and data nodes and their sensitivity/vulnerability: ¶
The "/yang‑library" subtree of the YANG library may help an attacker identify the server capabilities and server implementations with known bugs since the set of YANG modules supported by a server may reveal the kind of device and the manufacturer of the device. Although some of this information may be available to all NETCONF users via the NETCONF <hello> message (or similar messages in other management protocols), this YANG module potentially exposes additional details that could be of some assistance to an attacker. Server vulnerabilities may be specific to particular modules, module revisions, module features, or even module deviations. For example, if a particular operation on a particular data node is known to cause a server to crash or significantly degrade device performance, then the "module" list information will help an attacker identify server implementations with such a defect, in order to launch a denial-of-service attack on the device. ¶
This document changes [RFC7895] in the following ways: ¶
The following example shows the YANG library of a basic server implementing the "ietf‑interfaces" [RFC8343] and "ietf‑ip" [RFC8344] modules in the <running>, <startup>, and <operational> datastores and the "ietf‑hardware" [RFC8348] module in the <operational> datastore. ¶
Newline characters in leaf values are added for formatting reasons. ¶
<yang-library xmlns="urn:ietf:params:xml:ns:yang:ietf-yang-library" xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores"> <module-set> <name>config-modules</name> <module> <name>ietf-interfaces</name> <revision>2018-02-20</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-interfaces </namespace> </module> <module> <name>ietf-ip</name> <revision>2018-02-22</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-ip </namespace> </module> <import-only-module> <name>ietf-yang-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-yang-types </namespace> </import-only-module> <import-only-module> <name>ietf-inet-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-inet-types </namespace> </import-only-module> </module-set> <module-set> <name>state-modules</name> <module> <name>ietf-hardware</name> <revision>2018-03-13</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-hardware </namespace> </module> <import-only-module> <name>ietf-inet-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-inet-types </namespace> </import-only-module> <import-only-module> <name>ietf-yang-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-yang-types </namespace> </import-only-module> <import-only-module> <name>iana-hardware</name> <revision>2018-03-13</revision> <namespace> urn:ietf:params:xml:ns:yang:iana-hardware </namespace> </import-only-module> </module-set> <schema> <name>config-schema</name> <module-set>config-modules</module-set> </schema> <schema> <name>state-schema</name> <module-set>config-modules</module-set> <module-set>state-modules</module-set> </schema> <datastore> <name>ds:startup</name> <schema>config-schema</schema> </datastore> <datastore> <name>ds:running</name> <schema>config-schema</schema> </datastore> <datastore> <name>ds:operational</name> <schema>state-schema</schema> </datastore> <content-id>75a43df9bd56b92aacc156a2958fbe12312fb285</content-id> </yang-library>¶
The following example extends the example in Appendix B by using modules from [RFC8345] and [RFC8349] to illustrate a slightly more advanced server that: ¶
<yang-library xmlns="urn:ietf:params:xml:ns:yang:ietf-yang-library" xmlns:ds="urn:ietf:params:xml:ns:yang:ietf-datastores" xmlns:ex-ds-eph="urn:example:ds-ephemeral"> <module-set> <name>config-state-modules</name> <module> <name>ietf-interfaces</name> <revision>2018-02-20</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-interfaces </namespace> </module> <module> <name>ietf-ip</name> <revision>2018-02-22</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-ip </namespace> </module> <module> <name>ietf-routing</name> <revision>2018-03-13</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-routing </namespace> </module> <import-only-module> <name>ietf-yang-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-yang-types </namespace> </import-only-module> <import-only-module> <name>ietf-inet-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-inet-types </namespace> </import-only-module> </module-set> <module-set> <name>config-only-modules</name> <module> <name>ietf-routing</name> <revision>2018-03-13</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-routing </namespace> </module> </module-set> <module-set> <name>dynamic-config-state-modules</name> <module> <name>ietf-network</name> <revision>2018-02-26</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-network </namespace> </module> <module> <name>ietf-network-topology</name> <revision>2018-02-26</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-network-topology </namespace> </module> <import-only-module> <name>ietf-inet-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-inet-types </namespace> </import-only-module> </module-set> <module-set> <name>state-only-modules</name> <module> <name>ietf-hardware</name> <revision>2018-03-13</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-hardware </namespace> <deviation>example-vendor-hardware-deviations</deviation> </module> <module> <name>ietf-routing</name> <revision>2018-03-13</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-routing </namespace> <feature>multiple-ribs</feature> <feature>router-id</feature> </module> <module> <name>example-vendor-hardware-deviations</name> <revision>2018-01-31</revision> <namespace> urn:example:example-vendor-hardware-deviations </namespace> </module> <import-only-module> <name>ietf-inet-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-inet-types </namespace> </import-only-module> <import-only-module> <name>ietf-yang-types</name> <revision>2013-07-15</revision> <namespace> urn:ietf:params:xml:ns:yang:ietf-yang-types </namespace> </import-only-module> <import-only-module> <name>iana-hardware</name> <revision>2018-03-13</revision> <namespace> urn:ietf:params:xml:ns:yang:iana-hardware </namespace> </import-only-module> </module-set> <schema> <name>config-schema</name> <module-set>config-state-modules</module-set> <module-set>config-only-modules</module-set> </schema> <schema> <name>dynamic-config-schema</name> <module-set>dynamic-config-state-modules</module-set> </schema> <schema> <name>state-schema</name> <module-set>config-state-modules</module-set> <module-set>dynamic-config-state-modules</module-set> <module-set>state-only-modules</module-set> </schema> <datastore> <name>ds:startup</name> <schema>config-schema</schema> </datastore> <datastore> <name>ds:running</name> <schema>config-schema</schema> </datastore> <datastore> <name>ex-ds-eph:ds-ephemeral</name> <schema>dynamic-config-schema</schema> </datastore> <datastore> <name>ds:operational</name> <schema>state-schema</schema> </datastore> <content-id>14782ab9bd56b92aacc156a2958fbe12312fb285</content-id> </yang-library>¶