Comparison of Network Management Datastore Architecture (NMDA) Datastores
Extracted elements (20)
A possible future dampening extension would allow clients to specify a minimum persistence period for differences before they are reported, enabling distinction between fleeting transient differences and genuine persistent mismatches that indicate real operational issues.
Differences are encoded using YANG Patch (RFC 8072) rather than a custom format, leveraging existing standardized edit operations (create, replace, delete, merge, remove, move) and their associated target and value semantics.
Origin metadata is omitted by default in comparison output to reduce noise, but can be included via 'report-origin' to help explain the cause of a difference — for example, when a node in <intended> has origin 'system' in <operational>, indicating it was set by the device rather than the client.
The 'all' parameter exists because, by default, schema nodes that can appear in only one of the two datastores (e.g., config:false nodes absent from a configuration datastore) are prefiltered out, allowing clients to focus on true instance-data mismatches without complex filter constructs.
The filter-spec does not allow expressions that match against data node values, because value-matching may incur implementation difficulties and is not required for normal use cases. It acts only as a node selector scoping which subtrees are within comparison scope.
The <compare> operation is designed for use with NETCONF (RFC 6241) or RESTCONF (RFC 8040). The example in Section 5 demonstrates both NETCONF XML encoding and RESTCONF JSON encoding (RFC 7951) of equivalent requests and responses.
Server implementations SHOULD limit the number of <compare> requests served to a client in any one time interval, rejecting requests made at a higher frequency than the implementation can reasonably sustain, to guard against resource exhaustion.
The 'all' parameter, when set, includes differences pertaining to schema nodes that exist in only one datastore. When omitted, a prefiltering step automatically excludes data nodes whose schema node is not present in both datastores, specifically excluding config:false nodes when comparing a configuration datastore against <operational>.
The <compare> RPC operation compares the data tree contents of two NMDA datastores, checking for differences in values or data nodes present in either datastore, and returns differences encoded in YANG Patch format (RFC 8072).
The <compare> RPC takes mandatory 'source' and 'target' input parameters (both identityref typed against ds:datastore), plus optional 'all', 'report-origin', and 'filter-spec' (subtree-filter or xpath-filter choice) parameters.
The 'differences' output parameter encodes the list of differences using the YANG Patch data model (RFC 8072), augmented with a 'source-value' anydata element to convey the source datastore's value alongside the patch that would transform source into target.
The output choice 'compare-response' has two alternatives: 'no-matches' (empty leaf indicating the filter matched nothing and nothing was compared) or 'differences' (container with yang-patch content listing all detected differences).
The 'report-origin' parameter, when set, causes origin metadata to be included in RPC output for comparisons involving <operational>. Origin metadata is always omitted in comparisons not involving <operational>, regardless of this parameter.
When a source datastore node is absent from the target, this MAY be represented as either a 'delete' or 'remove' YANG Patch operation, as the two are equivalent for comparison purposes.
IANA has registered the URI 'urn:ietf:params:xml:ns:yang:ietf-nmda-compare' in the IETF XML Registry (RFC 3688) as an XML namespace, with the IESG as registrant contact.
IANA has registered the YANG module 'ietf-nmda-compare' in the YANG Module Names registry (RFC 6020), with namespace 'urn:ietf:params:xml:ns:yang:ietf-nmda-compare', prefix 'cmp', and reference RFC 9144.
NACM (RFC 8341) governs access to datastores and RPCs. Subtrees to which a requestor does not have read access are silently skipped and not included in the comparison result, preventing information leakage about unauthorized portions of the datastore.
NETCONF's mandatory-to-implement secure transport is SSH (RFC 6242); RESTCONF's mandatory-to-implement secure transport is TLS (RFC 8446). All access to the ietf-nmda-compare module MUST occur over these secure transports.
The <compare> operation requires processing resources; an attacker could mount a denial-of-service attack by making a high volume of comparison requests. Implementations SHOULD use NACM (RFC 8341) to enforce authorization and SHOULD rate-limit requests, rejecting those exceeding a sustainable frequency.
The ietf-nmda-compare YANG module (namespace urn:ietf:params:xml:ns:yang:ietf-nmda-compare, prefix cmp) defines a single 'compare' RPC. The YANG Patch output is augmented with 'source-value' anydata on edit entries, applicable when operation is 'delete', 'merge', 'move', 'replace', or 'remove'.