NETCONF Extensions to Support the Network Management Datastore Architecture
updates
Extracted elements (22)
New operations use 'datastore' identity parameters (from 'ietf-datastores') rather than the choice-based strategy from original operations (e.g., <get-config>/<edit-config>), because identities allow future expansion to new datastores without protocol changes.
Origin metadata annotations may be omitted for child nodes when the value matches the parent node's origin, reducing response verbosity while preserving full information for differing nodes.
The <edit-data> operation omits the 'error-option' and 'test-option' parameters present in <edit-config>; error behavior is fixed to 'rollback-on-error', simplifying the operation for NMDA datastores.
Support for 'with-defaults' in <get-data> operations on <operational> is OPTIONAL and requires both the ':with-defaults' and ':with-operational-defaults:1.0' capabilities to be advertised.
The 'config' element in <edit-data>'s edit-content choice uses 'anydata' (YANG 1.1, RFC 7950), whereas <edit-config>'s corresponding element used 'anyxml'. Implementations must account for this difference.
This document updates RFC 7950 Section 5.6.4 to allow NETCONF servers to advertise ':yang-library:1.1' instead of ':yang-library:1.0' and to implement the subtree '/yang-library' (RFC 8525) instead of '/modules-state'.
An NMDA-compliant NETCONF server MUST implement the 'ietf-netconf-nmda' module, MUST support the operational state datastore, and MUST implement at least revision 2019-01-04 of the 'ietf-yang-library' module defined in RFC 8525.
If a <lock>, <unlock>, or <validate> operation is not supported on a particular datastore, the server MUST return an <rpc-error> element with an <error-tag> value of 'invalid-value'.
If the target datastore for <edit-data> is not writable or not supported by the server, then the server MUST return an <rpc-error> element with an <error-tag> value of 'invalid-value'.
If the 'with-defaults' parameter is present in a <get-data> request for which it is not supported, then the server MUST return an <rpc-error> element with an <error-tag> value of 'invalid-value'.
If the 'with-origin' parameter is used with an invalid (non-operational) datastore, the server MUST return an <rpc-error> with <error-tag> value of 'invalid-value'.
The server MUST advertise the capability 'urn:ietf:params:netconf:capability:yang-library:1.1' in the <hello> message, with both 'revision' and 'content-id' parameters present.
The 'config-filter' parameter in <get-data> filters nodes by their 'config' property: 'true' selects only 'config true' nodes, 'false' selects only 'config false' nodes, and absent means no filtering.
The <edit-data> operation changes the contents of a writable datastore, accepting parameters: 'datastore' (mandatory), 'default-operation' (merge/replace/none, default merge), and 'edit-content' (config or url). It does not support 'error-option' or 'test-option'; error behavior is always rollback-on-error.
The <get-data> operation retrieves data from a specific NMDA datastore, accepting parameters: 'datastore' (mandatory), 'subtree-filter' or 'xpath-filter', 'config-filter', 'origin-filter' or 'negated-origin-filter', 'max-depth', 'with-origin', and 'with-defaults'.
The <lock>, <unlock>, and <validate> operations are augmented with a new 'datastore' leaf of type 'ds:datastore-ref' to allow targeting NMDA datastores beyond those supported by the original choice-based mechanism.
The 'max-depth' parameter in <get-data> limits subtree levels returned: depth 1 returns selected nodes without children; 'unbounded' (default) returns all descendants. Range is 1..65535 or 'unbounded'.
The 'origin-filter' and 'negated-origin-filter' parameters select or exclude nodes based on their NMDA origin annotation; they cannot be used together in the same request.
The 'with-origin' parameter in <get-data>, when present, requests that the server include 'origin' metadata annotations in the response. It is only valid for the operational state datastore or datastores derived from the 'operational' identity.
A URI is registered in the IETF XML Registry: 'urn:ietf:params:xml:ns:yang:ietf-netconf-nmda', and the YANG module 'ietf-netconf-nmda' is registered in the YANG Module Names registry with prefix 'ncds'.
Two NETCONF Capability URNs are registered: 'urn:ietf:params:netconf:capability:yang-library:1.1' (:yang-library:1.1) and 'urn:ietf:params:netconf:capability:with-operational-defaults:1.0' (:with-operational-defaults).
The lowest NETCONF layer is the secure transport layer; the mandatory-to-implement secure transport is SSH (RFC 6242). The Network Configuration Access Control Model (NACM, RFC 8341) restricts access for NETCONF users to authorized protocol operations and content. Security considerations from RFC 6241 Section 9 apply to the new <get-data> and <edit-data> operations.