A YANG Data Model for LMAP Measurement Agents
Extracted elements (28)
It is recommended to always configure an end time on Event objects and refresh it as needed, so that MAs that lose connectivity to their Controller do not continue executing Schedules forever. This is non-normative guidance embedded in the end leaf's description.
Logging Information (success/failure/warning messages from Controller interactions) is not formally modeled; the document assumes runtime logging will be communicated via protocols that do not require a formal data model, such as the syslog protocol (RFC 5424).
NETCONF Channels are not modeled in the LMAP YANG modules because the NETCONF client/server configuration data model already provides a mechanism to configure NETCONF server Channels, making a parallel LMAP-specific channel model redundant.
Preconfiguration (bootstrapping) information is explicitly out of scope for the YANG data model; implementations may reuse Configuration Information data for bootstrapping, but no dedicated preconfiguration subtree is defined.
The parameters container in both Action (control) and result (report) uses a YANG choice/extension pattern rather than fixed leaves, enabling Task-specific data models to augment the base LMAP modules with complex parameters without modifying the core schema.
Capability and hardware/firmware information is not duplicated in the LMAP model; implementors should obtain network interface data from ietf-interfaces (RFC 7223), system data from ietf-system (RFC 7317), and hardware data from the ietf-hardware YANG module.
The NACM (RFC 6536) default-deny-write extension is applied to the program leaf in the tasks list, restricting write access to the local program path even when other task configuration is writable by the Controller.
A configured Task MUST resolve to a Task listed in the /lmap/capabilities/tasks list. Attempts to execute a configured Task that is not listed in the capabilities result in a runtime execution error.
Implementations MUST ensure that LMAP identifiers (set by the Controller and potentially used to identify file-system resources) are properly mapped into safe identifiers, because identifier characters may receive special interpretation in specific contexts.
Shell expansions that may alter option names and values MUST NOT be performed when passing options to programs. Implementors ought to take care that option names and values are passed literally.
The mandatory-to-implement secure transport for NETCONF access to the LMAP data model is SSH (RFC 6242). The mandatory-to-implement secure transport for RESTCONF access is TLS (RFC 5246).
A Schedule specifies a start event-ref, an optional stop (end event-ref or duration in seconds), an execution-mode (sequential=1, parallel=2, pipelined=3; default pipelined), suppression-tag leaf-list, and a list of Actions. Each Action references a Task and may pass output to destination Schedules.
Result tables in the report RPC carry a function registry list (URI+roles), an ordered column label list, and rows of string values. The column order is determined by the system and must match the row value order.
Seven event types are defined in the /lmap/events subtree: periodic (interval in seconds), calendar (cron-like with month/day-of-month/day-of-week/hour/minute/second wildcards and timezone-offset), one-off (single date-and-time), immediate (empty leaf), startup (empty leaf), controller-lost (empty leaf), and controller-connected (empty leaf).
The cycle-number typedef uses the pattern '[0-9]{8}\.[0-9]{6}' encoding YYYYMMDD.HHMMSS in UTC, identifying the time interval multiple closest to the trigger event time when a cycle-interval is defined on the event.
The glob-pattern typedef follows POSIX.2 fnmatch() semantics (without special file-path treatment), supporting *, ?, [seq], [!seq], and backslash escaping. It is used by Suppression match fields to select Schedules and Actions by tag.
The /lmap/agent subtree configures global MA properties: agent-id (yang:uuid), group-id (string), measurement-point (string), boolean flags controlling whether each identity field is reported to Collectors, controller-timeout (uint32 seconds), and a read-only last-started timestamp.
The /lmap/suppressions subtree allows a Controller to define Suppression objects that temporarily disable Schedules or Actions whose suppression-tags match a glob-pattern. The stop-running boolean controls whether already-running Schedules/Actions are terminated when Suppression activates.
The LMAP YANG data model is split into three modules: ietf-lmap-common (shared typedefs and groupings), ietf-lmap-control (Controller-to-MA data structures), and ietf-lmap-report (MA-to-Collector data structures). Controllers implement common+control as clients; MAs implement common+control as servers and common+report as clients; Collectors implement common+report as servers.
The report RPC (in ietf-lmap-report) is invoked by a Measurement Agent on a Collector. Its input includes date, optional agent-id/group-id/measurement-point, and a list of result records each containing schedule/action/task identifiers, options, tags, event time, start/end times, cycle-number, status-code, conflict list, and tabular result data.
Three URIs are registered in the IETF XML Registry (RFC 3688): urn:ietf:params:xml:ns:yang:ietf-lmap-common, urn:ietf:params:xml:ns:yang:ietf-lmap-control, and urn:ietf:params:xml:ns:yang:ietf-lmap-report.
Three YANG modules are registered in the YANG Module Names registry (RFC 6020): ietf-lmap-common (prefix: lmap), ietf-lmap-control (prefix: lmapc), and ietf-lmap-report (prefix: lmapr), all referencing RFC 8194.
Read access to /lmap/agent may reveal identity information usable to select targets; read access to /lmap/capabilities may reveal software version and supported Tasks enabling targeted implementation attacks; read access to /lmap/suppressions may allow prediction of measurement-active vs. measurement-inactive time windows.
The /lmap/schedules subtree is writable by the Controller; unauthorized write access can cause unwanted load on the device or network, or direct measurement traffic to targets that become victims of an attack. The /lmap/suppressions subtree can either disable legitimate measurements or trigger unauthorized ones.
The /lmap/tasks subtree configures Tasks invokable by a Controller and SHOULD have write access only for the system responsible for configuring the MA. Care must be taken to not expose Tasks to a Controller that can cause damage to the system or network.
The report RPC sends locally collected measurement results to a remote Collector; unauthorized access to this operation may leak measurement results, including those from passive measurements.
A Schedule and each of its Actions independently track one of four states: enabled (configured but not currently running), disabled, running (currently executing), suppressed (matching Suppression is active). State is read-only config false.
A Suppression object transitions among three states: enabled (configured but suppression period not active), disabled, active (within the suppression start–end window). State is read-only. If no end event is configured, Suppression continues indefinitely.