A YANG Data Model for IP Management
obsoletes
- rfc-7277 — A YANG Data Model for IP Management
Extracted elements (25)
RFC 8344 updates RFC 7277 to support the Network Management Datastore Architecture (NMDA, RFC 8342). All 'config false' operational state data nodes are consolidated into the '/interfaces/interface' subtree rather than the separate '/interfaces-state/interface' subtree, eliminating the pre-NMDA split between configuration and operational state trees.
The deprecated '/interfaces-state/interface/ipv4' and 'ipv6' subtrees are retained (marked 'status deprecated') to allow servers to support clients that do not implement NMDA, enabling a migration path from RFC 7277 without immediately breaking existing deployments.
Each entry in the 'ipv4/address' and 'ipv6/address' lists maps to one ipAddressEntry in the IP-MIB (RFC 4293), where ipAddressIfIndex refers to the entry's interface. The 'ipv4/neighbor' and 'ipv6/neighbor' lists map to ipNetToPhysicalTable.
If an interface is not capable of running IP, the server must not allow the client to configure the IP parameters defined in the augmentation.
Servers that do not implement NMDA or that wish to support clients that do not implement NMDA MAY implement the deprecated 'ipv4' and 'ipv6' subtrees in the '/interfaces-state/interface' subtree.
The IPv4 address list requires a mandatory 'subnet' choice — either prefix-length or (if the feature is supported) netmask must be configured for each address entry.
The IPv6 address list requires 'prefix-length' (uint8, 0..128) to be present (mandatory true) for each address entry, and 'link-layer-address' is mandatory true for each neighbor entry.
The mandatory-to-implement secure transport for NETCONF access is SSH (RFC 6242); for RESTCONF access it is TLS (RFC 5246). Access control is provided by the NETCONF access control model (RFC 8341).
Modification of 'ipv6/autoconf' leaves — particularly whether temporary addresses per RFC 4941 are created — can impact which IPv6 addresses a node uses and thereby indirectly affect the privacy of users on that node.
The 'autoconf' container within 'ipv6' controls IPv6 SLAAC per RFC 4862: 'create-global-addresses' (boolean, default true) and, under the 'ipv6-privacy-autoconf' feature, 'create-temporary-addresses' (boolean, default false), 'temporary-valid-lifetime' (uint32, default 604800 seconds), and 'temporary-preferred-lifetime' (uint32, default 86400 seconds).
The 'ietf-ip' YANG module augments the 'interface' list from 'ietf-interfaces' (RFC 8343) with two presence containers per interface: 'ipv4' and 'ipv6', each containing enabled, forwarding, mtu, address list, and neighbor list data nodes.
The 'ip-address-origin' typedef enumerates four values: 'other', 'static' (configured via NETCONF/CLI), 'dhcp' (assigned by DHCP server), 'link-layer' (IPv6 SLAAC embedding link-layer address), and 'random' (system-chosen, e.g., 169.254/16, RFC 4941 temporary, or RFC 7217 opaque).
The 'ipv4' container includes leaf 'enabled' (boolean, default true), leaf 'forwarding' (boolean, default false), leaf 'mtu' (uint16, range 68..max, units octets), list 'address' keyed by ip, and list 'neighbor' keyed by ip for ARP cache management.
The 'ipv4-non-contiguous-netmasks' feature indicates support for configuring non-contiguous subnet masks. When supported, the 'subnet' choice in the IPv4 address list allows either 'prefix-length' (uint8, 0..32) or 'netmask' (yang:dotted-quad); otherwise only prefix-length is available.
The 'ipv6' container includes leaf 'enabled' (boolean, default true), leaf 'forwarding' (boolean, default false), leaf 'mtu' (uint32, range 1280..max, units octets), list 'address', list 'neighbor', leaf 'dup-addr-detect-transmits' (uint32, default 1), and container 'autoconf'.
The 'ipv6-privacy-autoconf' feature indicates support for privacy extensions per RFC 4941. When declared, the 'create-temporary-addresses', 'temporary-valid-lifetime', and 'temporary-preferred-lifetime' leaves in the 'autoconf' container are available.
The 'neighbor-origin' typedef enumerates three values: 'other', 'static' (configured via NETCONF/CLI), and 'dynamic' (resolved via IPv4 ARP or IPv6 Neighbor Discovery). This applies to both IPv4 ARP cache and IPv6 Neighbor Cache entries.
Registers the URI 'urn:ietf:params:xml:ns:yang:ietf-ip' in the IETF XML Registry (RFC 3688) as an XML namespace. Registrant: NETMOD WG of the IETF.
Registers the YANG module 'ietf-ip' in the 'YANG Module Names' registry (RFC 6020) with namespace 'urn:ietf:params:xml:ns:yang:ietf-ip', prefix 'ip', and reference RFC 8344.
Setting 'ipv4/mtu' or 'ipv6/mtu' to very small values (while still within the allowed range: ≥68 for IPv4, ≥1280 for IPv6) can be used to slow down interfaces, constituting a potential denial-of-service vector.
The 'ipv4/enabled' and 'ipv6/enabled' leaves can be exploited to create unsecured paths into or through a node (by enabling a protocol) or deny access via that protocol (by disabling it). Unauthorized write access could be used to route traffic through unintended interfaces.
The 'ipv4/forwarding' and 'ipv6/forwarding' leaves allow enabling or disabling IP forwarding. An attacker enabling forwarding could open a conduit bypassing security safeguards; disabling it could cause denial of service.
Unauthorized modification of 'ipv4/address' and 'ipv6/address' lists can cause a node to ignore legitimate messages or accept messages it would otherwise discard. Filtering or security associations may reduce damage from address spoofing.
IPv6 address status defines eight states: 'preferred' (valid, usable as source/destination), 'deprecated' (valid but should not be used as new source), 'invalid' (not a valid address), 'inaccessible' (interface not operational), 'unknown', 'tentative' (DAD in progress, not for general use), 'duplicate' (DAD failed, must not be used), and 'optimistic' (available with restrictions while DAD is in progress). States correspond to RFC 4862 SLAAC protocol.
IPv6 neighbor state defines five Neighbor Unreachability Detection (NUD) states per RFC 4861 Section 7.3.2: 'incomplete' (address resolution in progress), 'reachable' (recently confirmed reachable), 'stale' (reachability unknown, no probe yet), 'delay' (traffic sent, waiting for upper-layer confirmation before probing), and 'probe' (unicast Neighbor Solicitation probes being sent).