YANG Module Library
obsoleted by
- rfc-8525 — YANG Library
Extracted elements (22)
The 'module-list' grouping is defined as a grouping rather than directly in 'modules-state' so that it can be reused in configuration or other monitoring data structures beyond the current operational state container.
The 'module-set-id' caching mechanism was introduced because YANG library information changes very infrequently. Clients can cache the module list and only re-fetch it when 'module-set-id' changes, avoiding repeated large retrievals.
For a NETCONF server implementing YANG 1.1, a change in 'module-set-id' results in a new value for the ':yang-library' capability. If the server also implements NETCONF notifications (RFC 5277) and 'netconf-capability-change' (RFC 6470), a 'netconf-capability-change' notification is generated alongside 'yang-library-change'.
If the server implements multiple protocols to access YANG-defined data (e.g., NETCONF and RESTCONF), each such protocol has its own conceptual instantiation of the YANG library, which may differ between protocols.
Multiple revisions of the same module MAY be listed in the 'module' list simultaneously: one entry with conformance-type 'implement' for the revision the server implements, plus additional entries with type 'import' for other revisions imported by other modules.
A deviation module MUST be present in the 'module' list with the same name and revision values, and its 'conformance-type' value will be 'implement'.
For YANG 1.1 modules, there MUST be at most one module entry with conformance-type 'implement' for a particular module name, since YANG 1.1 requires at most one revision of a module is implemented. For YANG 1 modules, there SHOULD NOT be more than one such entry.
The name and revision of each submodule used by a module MUST be identified in the 'submodule' list within that module's entry.
The name of each YANG feature supported by the server MUST be identified in the 'feature' leaf-list, and the name of each YANG module used for deviation statements MUST be identified in the 'deviation' list.
The value of 'module-set-id' MUST change whenever the set of modules and submodules in the YANG library changes. There is no requirement that the same set always results in the same value.
There MUST be an entry in the 'module' list for each revision of each YANG module that is used by the server, including modules that are only imported (not implemented).
The 'conformance-type' leaf is a mandatory enumeration with two values: 'implement' (server implements protocol-accessible objects from this module) and 'import' (server imports definitions but does not implement protocol-accessible objects).
The 'ietf-yang-library' module exposes a read-only 'modules-state' container that holds the identifiers for all YANG data model modules supported by the server, including a 'module-set-id' leaf and a 'module' list keyed by name and revision.
The 'module' list contains one entry per revision of each YANG module supported by the server. Each entry carries: name (yang-identifier), revision (date or empty string), optional schema URI, mandatory namespace URI, feature list, deviation list, conformance-type, and submodule list.
The 'module-set-id' leaf is a mandatory string containing a unique, server-specific identifier representing the current set of modules and submodules. It changes whenever the library changes and is used by clients to detect cache staleness.
The optional 'schema' leaf (type inet:uri) in both 'module' and 'submodule' entries provides a URL for retrieval of the YANG schema resource. It is present only when such a URL is available.
The 'revision-identifier' typedef constrains revision dates to the pattern '\d{4}-\d{2}-\d{2}' (YYYY-MM-DD). A zero-length string is used in the 'revision' union leaf when no revision statement exists in the module.
The 'yang-library-change' notification is generated whenever the set of modules and submodules supported by the server changes. It carries a mandatory 'module-set-id' leafref pointing to the updated value in 'modules-state'.
This document registers the 'ietf-yang-library' module in the YANG Module Names registry (RFC 6020), with namespace 'urn:ietf:params:xml:ns:yang:ietf-yang-library', prefix 'yanglib', and reference RFC 7895.
This document registers the URI 'urn:ietf:params:xml:ns:yang:ietf-yang-library' in the IETF XML Registry (RFC 3688), designating it as an XML namespace for the YANG library module.
The '/modules-state/module' list may assist attackers in identifying server capabilities, module revisions, features, and deviations. Knowledge of specific module versions with known bugs can be used to target denial-of-service or other attacks against the server. Read access to this data should be restricted via NETCONF access control (RFC 6536).
The YANG library module is designed to be accessed via NETCONF over SSH (RFC 6242) as the mandatory secure transport. The NETCONF access control model (RFC 6536) MUST be used to restrict access to sensitive data nodes in this module.