draft-ietf-netconf-system-notifications-03.txt   draft-ietf-netconf-system-notifications-04.txt 
NETCONF A. Bierman NETCONF A. Bierman
Internet-Draft Brocade Internet-Draft Brocade
Intended status: Standards Track March 9, 2011 Intended status: Standards Track June 13, 2011
Expires: September 10, 2011 Expires: December 15, 2011
Network Configuration Protocol System Notifications Network Configuration Protocol Base Notifications
draft-ietf-netconf-system-notifications-03 draft-ietf-netconf-system-notifications-04
Abstract Abstract
The NETCONF protocol provides mechanisms to manipulate configuration The NETCONF protocol provides mechanisms to manipulate configuration
datastores. However, client applications often need to be aware of datastores. However, client applications often need to be aware of
common NETCONF system events such as a change in NETCONF common events such as a change in NETCONF server capabilities, that
capabilities, which may impact management applications. Standard may impact management applications. Standard mechanisms are needed
mechanisms are needed to support the monitoring of the NETCONF system to support the monitoring of the base system events within the
events within the NETCONF server. This document defines a YANG NETCONF server. This document defines a YANG module that allows a
module which allows a NETCONF client to receive notifications for NETCONF client to receive notifications for some common system
some common events. events.
Status of this Memo Status of this Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 10, 2011. This Internet-Draft will expire on December 15, 2011.
Copyright Notice Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
2. YANG Module for NETCONF System Notifications . . . . . . . . . 3 2. YANG Module for NETCONF Base Notifications . . . . . . . . . . 3
2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1.1. Notifications . . . . . . . . . . . . . . . . . . . . 4 2.1.1. Notifications . . . . . . . . . . . . . . . . . . . . 4
2.2. Definitions . . . . . . . . . . . . . . . . . . . . . . . 4 2.2. Definitions . . . . . . . . . . . . . . . . . . . . . . . 4
3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12
4. Security Considerations . . . . . . . . . . . . . . . . . . . 11 4. Security Considerations . . . . . . . . . . . . . . . . . . . 12
5. Normative References . . . . . . . . . . . . . . . . . . . . . 11 5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 14
Appendix A. Change Log . . . . . . . . . . . . . . . . . . . . . 12 6. Normative References . . . . . . . . . . . . . . . . . . . . . 14
A.1. 02-03 . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Appendix A. Change Log . . . . . . . . . . . . . . . . . . . . . 15
A.2. 01-02 . . . . . . . . . . . . . . . . . . . . . . . . . . 13 A.1. 03-04 . . . . . . . . . . . . . . . . . . . . . . . . . . 15
A.3. 00-01 . . . . . . . . . . . . . . . . . . . . . . . . . . 13 A.2. 02-03 . . . . . . . . . . . . . . . . . . . . . . . . . . 15
A.4. 00 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 A.3. 01-02 . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 13 A.4. 00-01 . . . . . . . . . . . . . . . . . . . . . . . . . . 16
A.5. 00 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 16
1. Introduction 1. Introduction
The NETCONF protocol [I-D.ietf-netconf-4741bis] provides mechanisms The NETCONF protocol [I-D.ietf-netconf-4741bis] provides mechanisms
to manipulate configuration datastores. However, client applications to manipulate configuration datastores. However, client applications
often need to be aware of common NETCONF system events such as a often need to be aware of common events such as a change in NETCONF
change in NETCONF capabilities, which may impact management server capabilities, that may impact management applications.
applications. Standard mechanisms are needed to support the Standard mechanisms are needed to support the monitoring of the base
monitoring of the NETCONF system events within the NETCONF server. system events within the NETCONF server. This document defines a
This document defines a YANG module [RFC6020] which allows a NETCONF YANG module [RFC6020] that allows a NETCONF client to receive
client to receive notifications for some common events. notifications for some common system events.
1.1. Terminology 1.1. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
The following terms are defined in [I-D.ietf-netconf-4741bis]: The following terms are defined in [I-D.ietf-netconf-4741bis]:
o client o client
o datastore o datastore
skipping to change at page 3, line 36 skipping to change at page 3, line 36
o server o server
The following terms are defined in [RFC5277]: The following terms are defined in [RFC5277]:
o event o event
o stream o stream
o subscription o subscription
The following term is defined in [RFC6020]: The following term is defined in [RFC6020]:
o data node o data node
2. YANG Module for NETCONF System Notifications 2. YANG Module for NETCONF Base Notifications
2.1. Overview 2.1. Overview
The YANG module defined within this document specifies a small number The YANG module defined within this document specifies a small number
of notification event messages for use within the 'NETCONF' stream, of notification event messages for use within the 'NETCONF' stream,
and accessible to clients via the subscription mechanism in and accessible to clients via the subscription mechanism in
[RFC5277]. [RFC5277].
These notifications pertain to the NETCONF portion of the managed These notifications pertain to configuration and monitoring portion
system, not the entire system. of the managed system, not the entire system. A server MUST report
events that are directly related to the NETCONF protocol. A server
MAY report events for non-NETCONF management sessions, using the
'session-id' value of zero.
The YANG language is defined in [RFC6020]. The YANG language is defined in [RFC6020].
2.1.1. Notifications 2.1.1. Notifications
This module defines some events for the 'NETCONF' stream to notify a This module defines some events for the 'NETCONF' stream to notify a
client application that the NETCONF server state has changed. client application that the NETCONF server state has changed.
o netconf-config-change: Generated when the NETCONF server detects netconf-config-change:
that the <running> or <startup> configuration datastore has Generated when the NETCONF server detects that the <running> or
changed. Summarizes each edit being reported. <startup> configuration datastore has changed. Summarizes each
o netconf-capability-change: Generated when the NETCONF server edit being reported.
capabilities are changed. Indicates which capabilities have been netconf-capability-change:
Generated when the NETCONF server detects that the server
capabilities have changed. Indicates which capabilities have been
added, deleted, and/or modified. added, deleted, and/or modified.
o netconf-session-start: Generated when a NETCONF session is netconf-session-start:
started. Indicates the identity of the user that started the Generated when a NETCONF server detects that a NETCONF session has
session. started. A server MAY generate this event for non-NETCONF
o netconf-session-end: Generated when a NETCONF server detects that management sessions. Indicates the identity of the user that
a session has terminated. Indicates the identity of the user that started the session.
owned the session, and why the session was terminated. netconf-session-end:
o netconf-confirmed-commit: Generated when a NETCONF confirmed- Generated when a NETCONF server detects that a NETCONF session has
commit event occurs. Indicates the current state of the terminated. A server MAY optionally generate this event for non-
confirmed-commit operation in progress. NETCONF management sessions. Indicates the identity of the user
that owned the session, and why the session was terminated.
netconf-confirmed-commit:
Generated when a NETCONF server detects that a confirmed-commit
event has occurred. Indicates the event and the current state of
the confirmed-commit operation in progress.
2.2. Definitions 2.2. Definitions
<CODE BEGINS> file="ietf-netconf-system-notifications@2011-03-08.yang" <CODE BEGINS> file="ietf-netconf-base-notifications@2011-06-13.yang"
module ietf-netconf-system-notifications { module ietf-netconf-base-notifications {
namespace namespace
"urn:ietf:params:xml:ns:yang:ietf-netconf-system-notifications"; "urn:ietf:params:xml:ns:yang:ietf-netconf-base-notifications";
prefix ncsys; prefix ncbase;
import ietf-inet-types { prefix inet; } import ietf-inet-types { prefix inet; }
import ietf-netconf { prefix nc; } import ietf-netconf { prefix nc; }
organization organization
"IETF NETCONF (Network Configuration Protocol) Working Group"; "IETF NETCONF (Network Configuration Protocol) Working Group";
contact contact
"WG Web: <http://tools.ietf.org/wg/netconf/> "WG Web: <http://tools.ietf.org/wg/netconf/>
WG List: <mailto:netconf@ietf.org> WG List: <mailto:netconf@ietf.org>
skipping to change at page 5, line 11 skipping to change at page 5, line 18
WG Chair: Mehmet Ersue WG Chair: Mehmet Ersue
<mailto:mehmet.ersue@nsn.com> <mailto:mehmet.ersue@nsn.com>
Editor: Andy Bierman Editor: Andy Bierman
<mailto:andy.bierman@brocade.com>"; <mailto:andy.bierman@brocade.com>";
description description
"This module defines an YANG data model for use with the "This module defines an YANG data model for use with the
NETCONF protocol that allows the NETCONF client to NETCONF protocol that allows the NETCONF client to
receive common NETCONF system notification events. receive common NETCONF base notification events.
Copyright (c) 2011 IETF Trust and the persons identified as Copyright (c) 2011 IETF Trust and the persons identified as
the document authors. All rights reserved. the document authors. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents Relating to IETF Documents
(http://trustee.ietf.org/license-info). (http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see This version of this YANG module is part of RFC XXXX; see
the RFC itself for full legal notices."; the RFC itself for full legal notices.";
// RFC Ed.: replace XXXX with actual RFC number and remove this note // RFC Ed.: replace XXXX with actual RFC number and remove this note
// RFC Ed.: remove this note // RFC Ed.: remove this note
// Note: extracted from // Note: extracted from
// draft-ietf-netconf-system-notifications-03.txt // draft-ietf-netconf-system-notifications-04.txt
revision 2011-03-08 { revision 2011-06-13 {
description description
"Initial version."; "Initial version.";
reference reference
"RFC XXXX: NETCONF System Notifications"; "RFC XXXX: NETCONF Base Notifications";
} }
// RFC Ed.: replace XXXX with actual // RFC Ed.: replace XXXX with actual
// RFC number and remove this note // RFC number and remove this note
grouping common-session-parms { grouping common-session-parms {
description
"Common session parameters to identity a
management session.";
leaf username { leaf username {
description description
"Name of the user for the session."; "Name of the user for the session.";
type string; type string;
mandatory true; mandatory true;
} }
leaf session-id { leaf session-id {
description description
"Identifier of the session. "Identifier of the session.
skipping to change at page 6, line 17 skipping to change at page 6, line 28
} }
leaf source-host { leaf source-host {
description description
"Address of the remote host for the session."; "Address of the remote host for the session.";
type inet:ip-address; type inet:ip-address;
} }
} }
grouping changed-by-parms { grouping changed-by-parms {
description
"Common parameters to identify the source
of a change event, such as a configuration
or capability change.";
container changed-by { container changed-by {
description description
"Indicates who caused this change. "Indicates the source of the change.
If caused by internal action, then the If caused by internal action, then the
empty leaf 'server' will be present. empty leaf 'server' will be present.
If caused by a management session, then If caused by a management session, then
the name, remote host address, and session ID the name, remote host address, and session ID
of the session that made the change will be reported."; of the session that made the change will be reported.";
choice server-or-user { choice server-or-user {
mandatory true; mandatory true;
leaf server { leaf server {
type empty; type empty;
description description
skipping to change at page 6, line 36 skipping to change at page 7, line 4
mandatory true; mandatory true;
leaf server { leaf server {
type empty; type empty;
description description
"If present, the change was caused "If present, the change was caused
by the server."; by the server.";
} }
case by-user { case by-user {
uses common-session-parms; uses common-session-parms;
} }
} // choice server-or-user } // choice server-or-user
} // container changed-by-parms; } // container changed-by-parms;
} }
notification netconf-config-change { notification netconf-config-change {
description description
"Generated when the NETCONF server detects that the "Generated when the NETCONF server detects that the
<running> or <startup> configuration datastore has changed."; <running> or <startup> configuration datastore
has changed by a management session.
Summarizes each edit being reported.
The server MAY choose to also generate this
notification while loading a datastore during the
boot process for the device.";
uses changed-by-parms; uses changed-by-parms;
leaf target-datastore { leaf target-datastore {
type enumeration { type enumeration {
enum running { enum running {
description "The running datastore has changed."; description "The <running> datastore has changed.";
} }
enum startup { enum startup {
description "The startup datastore has changed"; description "The <startup> datastore has changed";
} }
} }
description description
"Indicates which configuration datastore has changed."; "Indicates which configuration datastore has changed.";
default "running"; default "running";
} }
list edit { list edit {
description description
"An edit record will be present for each distinct "An edit record SHOULD be present for each distinct
edit operation on the target datastore."; edit operation that the server has detected on
the target datastore. This list MAY be omitted
if the detailed edit operations are not known.
The server MAY report entries in this list for
changes not made by a NETCONF session (e.g., CLI).";
leaf target { leaf target {
type instance-identifier; type instance-identifier;
description description
"Topmost node associated with the configuration change. "Topmost node associated with the configuration change.
A server SHOULD set this object to the node within A server SHOULD set this object to the node within
the datastore which is being altered. A server MAY the datastore that is being altered. A server MAY
set this object to one of the ancestors of the actual set this object to one of the ancestors of the actual
node that was changed, or omit this object, if the node that was changed, or omit this object, if the
exact node is not known."; exact node is not known.";
} }
leaf operation { leaf operation {
type nc:edit-operation-type; type nc:edit-operation-type;
description description
"Type of edit operation performed. "Type of edit operation performed.
A server MUST set this object to the NETCONF edit A server MUST set this object to the NETCONF edit
operation performed on the target datastore."; operation performed on the target datastore.";
} }
} // list edit } // list edit
} // notification netconf-config-change } // notification netconf-config-change
notification netconf-capability-change { notification netconf-capability-change {
description description
"Generated when a <capability> is added, deleted, "Generated when the NETCONF server detects that
or modified."; the server capabilities have changed.
Indicates which capabilities have been added, deleted,
and/or modified.";
uses changed-by-parms; uses changed-by-parms;
leaf-list added-capability { leaf-list added-capability {
type inet:uri; type inet:uri;
description description
"List of capabilities that have just been added."; "List of capabilities that have just been added.";
} }
leaf-list deleted-capability { leaf-list deleted-capability {
skipping to change at page 8, line 24 skipping to change at page 9, line 4
type inet:uri; type inet:uri;
description description
"List of capabilities that have just been modified. "List of capabilities that have just been modified.
A capability is considered to be modified if the A capability is considered to be modified if the
base URI for the capability has not changed, but base URI for the capability has not changed, but
one or more of the parameters encoded at the end of one or more of the parameters encoded at the end of
the capability URI has changed. the capability URI has changed.
The new modified value of the complete URI is returned."; The new modified value of the complete URI is returned.";
} }
} // notification netconf-capability-change } // notification netconf-capability-change
notification netconf-session-start { notification netconf-session-start {
description description
"Generated when a new NETCONF session is started."; "Generated when a NETCONF server detects that a
NETCONF session has started. A server MAY generate
this event for non-NETCONF management sessions.
Indicates the identity of the user that started
the session.";
uses common-session-parms; uses common-session-parms;
} // notification netconf-session-start } // notification netconf-session-start
notification netconf-session-end { notification netconf-session-end {
description description
"Generated when a NETCONF session is terminated."; "Generated when a NETCONF server detects that a
NETCONF session has terminated.
A server MAY optionally generate this event for
non-NETCONF management sessions. Indicates the
identity of the user that owned the session,
and why the session was terminated.";
uses common-session-parms; uses common-session-parms;
leaf killed-by { leaf killed-by {
when "../termination-reason = 'killed'"; when "../termination-reason = 'killed'";
type nc:session-id-type; type nc:session-id-type;
description description
"Session ID that issued the <kill-session> "The session ID that issued the <kill-session>,
if the session was terminated by this operation."; if the session was terminated by this operation.
If the session was abnormally terminated by a
non-NETCONF client operation, the value '0' will be
used instead.";
} }
leaf termination-reason { leaf termination-reason {
type enumeration { type enumeration {
enum "closed" { enum "closed" {
value 0; value 0;
description description
"The session was terminated with "The session was terminated by the client in normal
the NETCONF <close-session> operation."; fashion, e.g., by the NETCONF <close-session>
operation.";
} }
enum "killed" { enum "killed" {
value 1; value 1;
description description
"The session was terminated with "The session was terminated by the client in abnormal
the NETCONF <kill-session> operation."; fashion, e.g., by the NETCONF <kill-session>
operation.";
} }
enum "dropped" { enum "dropped" {
value 2; value 2;
description description
"The session was terminated because "The session was terminated because the transport layer
the transport layer connection was connection was unexpectedly closed.";
unexpectedly closed.";
} }
enum "timeout" { enum "timeout" {
value 3; value 3;
description description
"The session was terminated because "The session was terminated because of inactivity,
of inactivity, either waiting for e.g., waiting for the <hello> message or <rpc>
the <hello> or <rpc> messages."; messages.";
} }
enum "bad-hello" { enum "bad-hello" {
value 4; value 4;
description description
"The client's <hello> message was invalid."; "The client's <hello> message was invalid.";
} }
enum "other" { enum "other" {
value 5; value 5;
description description
"The session was terminated for "The session was terminated for some other reason.";
some other reason.";
} }
} }
mandatory "true"; mandatory true;
description "Reason the session was terminated."; description
"Reason the session was terminated.";
} }
} // notification netconf-session-end } // notification netconf-session-end
notification netconf-confirmed-commit { notification netconf-confirmed-commit {
description description
"Generated when a confirmed-commit event occurs."; "Generated when a NETCONF server detects that a confirmed-commit
event has occurred. Indicates the event and the current state
of the confirmed-commit operation in progress.";
reference reference
"I-D draft-ietf-netconf-4741bis section 8.4"; "I-D draft-ietf-netconf-4741bis section 8.4";
uses common-session-parms { uses common-session-parms {
when "../confirm-event != 'timeout'"; when "../confirm-event != 'timeout'";
} }
leaf confirm-event { leaf confirm-event {
description description
"Indicates the event that caused the notification."; "Indicates the event that caused the notification.";
type enumeration { type enumeration {
enum "start" { enum "start" {
value 0; value 0;
description description
"The confirm-commit procedure has started."; "The confirmed-commit procedure has started.";
} }
enum "cancel" { enum "cancel" {
value 1; value 1;
description description
"The confirm-commit procedure has been canceled, "The confirmed-commit procedure has been canceled,
due to the session being terminated, or an e.g., due to the session being terminated, or an
explicit <cancel-commit> operation."; explicit <cancel-commit> operation.";
} }
enum "timeout" { enum "timeout" {
value 2; value 2;
description description
"The confirm-commit procedure has been canceled, "The confirmed-commit procedure has been canceled,
due to the confirm-timeout interval expiring. due to the confirm-timeout interval expiring.
The common session parameters will not be present The common session parameters will not be present
in this sub-mode."; in this sub-mode.";
} }
enum "extend" { enum "extend" {
value 3; value 3;
description description
"The confirm-commit timeout has been extended."; "The confirmed-commit timeout has been extended,
e.g., by a new <confirmed-commit> operation.";
} }
enum "complete" { enum "complete" {
value 4; value 4;
description description
"The confirm-commit procedure has been completed."; "The confirmed-commit procedure has been completed.";
} }
} }
mandatory "true"; mandatory true;
} }
leaf timeout { leaf timeout {
when when
"../confirm-event = 'start' or ../confirm-event = 'extend'"; "../confirm-event = 'start' or ../confirm-event = 'extend'";
description description
"The configured timeout value if the event type "The configured timeout value if the event type
is 'start' or 'extend'. This value represents the is 'start' or 'extend'. This value represents the
the approximate number of seconds from the event the approximate number of seconds from the event
time when the 'timeout' event might occur."; time when the 'timeout' event might occur.";
skipping to change at page 11, line 19 skipping to change at page 12, line 14
} }
<CODE ENDS> <CODE ENDS>
3. IANA Considerations 3. IANA Considerations
This document registers one XML namespace URN in the 'IETF XML This document registers one XML namespace URN in the 'IETF XML
registry', following the format defined in [RFC3688]. registry', following the format defined in [RFC3688].
URI: urn:ietf:params:xml:ns:yang:ietf-netconf-system-notifications URI: urn:ietf:params:xml:ns:yang:ietf-netconf-base-notifications
Registrant Contact: The NETCONF WG of the IETF. Registrant Contact: The NETCONF WG of the IETF.
XML: N/A, the requested URI is an XML namespace. XML: N/A, the requested URI is an XML namespace.
This document registers one module name in the 'YANG Module Names' This document registers one module name in the 'YANG Module Names'
registry, defined in [RFC6020] . registry, defined in [RFC6020] .
name: ietf-netconf-system-notifications name: ietf-netconf-base-notifications
prefix: ncsys prefix: ncbase
namespace: namespace:
urn:ietf:params:xml:ns:yang:ietf-netconf-system-notifications urn:ietf:params:xml:ns:yang:ietf-netconf-base-notifications
RFC: XXXX // RFC Ed.: replace XXXX and remove this comment RFC: XXXX // RFC Ed.: replace XXXX and remove this comment
4. Security Considerations 4. Security Considerations
This document defines a YANG module for reporting of particular The YANG module defined in this memo is designed to be accessed via
system events. Although unlikely, it is possible that data obtained the NETCONF protocol [RFC4741]. The lowest NETCONF layer is the
from this module could be used in an attack of some kind, although no secure transport layer and the mandatory-to-implement secure
specific information in this module is considered sensitive. transport is SSH [RFC4742].
TBD: follow Security Consideration guidelines from new template text. Some of the readable data nodes in this YANG module may be considered
sensitive or vulnerable in some network environments. It is thus
important to control read access (e.g., via <get>, <get-config>, or
<notification>) to these data nodes. These are the subtrees and data
nodes and their sensitivity/vulnerability:
5. Normative References /netconf-config-change:
Event type itself indicates that the system configuration has
changed, and may be now be vulnerable to unspecified attacks.
/netconf-config-change/changed-by:
Indicates whether the server or a specific user management session
made the configuration change. Identifies the user name,
session-id, and source host address associated with the
configuration change, if any.
/netconf-config-change/datastore:
Indicates which datastore has been changed. This data can be used
to determine if the non-volatile startup configuration data has
been changed.
/netconf-config-change/edit:
Identifies the specific edit operations and specific datastore
subtree(s) that have changed. This data could be used to
determine if specific server vulnerabilities may now be present.
/netconf-capability-change:
Event type itself indicates that the system capabilities have
changed, and may be now be vulnerable to unspecified attacks.
/netconf-capability-change/changed-by:
Indicates whether the server or a specific user management session
made the capability change. Identifies the user name, session-id,
and source host address associated with the capability change, if
any.
/netconf-capability-change/added-capability:
Indicates the specific capability URIs that have been added. This
data could be used to determine if specific server vulnerabilities
may now be present.
/netconf-capability-change/deleted-capability:
Indicates the specific capability URIs that have been deleted.
This data could be used to determine if specific server
vulnerabilities may now be present.
/netconf-capability-change/modified-capability:
Indicates the specific capability URIs that have been modified.
This data could be used to determine if specific server
vulnerabilities may now be present.
/netconf-session-start:
Event type itself indicates that a NETCONF or other management
session may start altering the device configuration and/or state.
/netconf-session-start/username:
Indicates the user name associated with the session.
/netconf-session-start/source-host:
Indicates the source host address associated with the session.
/netconf-session-end:
Event type itself indicates that a NETCONF or other management
session may be finished altering the device configuration and/or
state.
/netconf-session-end/username:
Indicates the user name associated with the session.
/netconf-session-end/source-host:
Indicates the source host address associated with the session.
/netconf-confirmed-commit:
Event type itself indicates that the <running> datastore may have
changed.
/netconf-confirmed-commit/username:
Indicates the user name associated with the session.
/netconf-confirmed-commit/source-host:
Indicates the source host address associated with the session.
/netconf-confirmed-commit/confirm-event:
Indicates the specific confirmed-commit state change that
occurred. A value of 'complete' probably indicates that the
<running> datastore has changed.
/netconf-confirmed-commit/timeout:
Indicates the number of seconds in the future when the <running>
datastore may change, due to the server reverting to an older
configuration.
5. Acknowledgements
Thanks to Martin Bjorklund, Juergen Schoenwaelder, Kent Watsen, and
many other members of the NETCONF WG for providing important input to
this document.
6. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
January 2004. January 2004.
[RFC5277] Chisholm, S. and H. Trevino, "NETCONF Event [RFC5277] Chisholm, S. and H. Trevino, "NETCONF Event
Notifications", RFC 5277, July 2008. Notifications", RFC 5277, July 2008.
[RFC6020] Bjorklund, M., "YANG - A Data Modeling Language for the [RFC6020] Bjorklund, M., "YANG - A Data Modeling Language for the
Network Configuration Protocol (NETCONF)", RFC 6020, Network Configuration Protocol (NETCONF)", RFC 6020,
October 2010. October 2010.
[RFC6021] Schoenwaelder, J., "Common YANG Data Types", RFC 6021, [RFC6021] Schoenwaelder, J., "Common YANG Data Types", RFC 6021,
October 2010. October 2010.
[I-D.ietf-netconf-4741bis] [I-D.ietf-netconf-4741bis]
Enns, R., Bjorklund, M., Schoenwaelder, J., and A. Enns, R., Bjorklund, M., Schoenwaelder, J., and A.
Bierman, "Network Configuration Protocol (NETCONF)", Bierman, "Network Configuration Protocol (NETCONF)",
draft-ietf-netconf-4741bis-09 (work in progress), draft-ietf-netconf-4741bis-10 (work in progress),
February 2011. March 2011.
Appendix A. Change Log Appendix A. Change Log
-- RFC Ed.: remove this section before publication. -- RFC Ed.: remove this section before publication.
A.1. 02-03 A.1. 03-04
Renamed module to NETCONF Base Notifications. The module is now
ietf-netconf-base-notifications. The namespace and prefix are now
changed as well.
Changed notifications so a server can report non-NETCONF initiated
events.
Replaced security considerations, according to template in RFC 6087.
Added Acknowledgements section.
A.2. 02-03
Renamed module back to NETCONF system notifications. The module is Renamed module back to NETCONF system notifications. The module is
now ietf-netconf-system-notifications. The namespace and prefix are now ietf-netconf-system-notifications. The namespace and prefix are
now changed as well. now changed as well.
Leaf user-name is now username, and is now mandatory, to be Leaf user-name is now username, and is now mandatory, to be
consistent with netconf monitoring module. consistent with netconf monitoring module.
Leaf remote-host is now source-host to be consistent with netconf Leaf remote-host is now source-host to be consistent with netconf
monitoring module. monitoring module.
skipping to change at page 13, line 5 skipping to change at page 16, line 5
The netconf-config-change description was updated and leaf target- The netconf-config-change description was updated and leaf target-
database is now named target-datastore. database is now named target-datastore.
Term 'database' changed to term 'datastore' in text. Term 'database' changed to term 'datastore' in text.
netconf-confirmed-commit: changed uses common-session-parms to use netconf-confirmed-commit: changed uses common-session-parms to use
when-stmt not refine-stmt. when-stmt not refine-stmt.
netconf-capability-change: updated description text. netconf-capability-change: updated description text.
A.2. 01-02 A.3. 01-02
Renamed module NETCONF Events instead of NETCONF system Renamed module NETCONF Events instead of NETCONF system
notifications. Note that ietf-netconf-notifications is being notifications. Note that ietf-netconf-notifications is being
reserved for the XML content defined in RFC 5277. reserved for the XML content defined in RFC 5277.
Made changes based on mailing list comments and latest WG consensus. Made changes based on mailing list comments and latest WG consensus.
Filled in IANA section. Filled in IANA section.
A.3. 00-01 A.4. 00-01
Removed sys-startup notification. Removed sys-startup notification.
Make changed-by into a grouping, and added usage to sys-config-change Make changed-by into a grouping, and added usage to sys-config-change
notification. notification.
Added target-database leaf to sys-config-change to distinguish Added target-database leaf to sys-config-change to distinguish
between running and startup changes. between running and startup changes.
Removed 'bad-start' from termination-reason leaf in sys-session-end Removed 'bad-start' from termination-reason leaf in sys-session-end
notification. notification.
A.4. 00 A.5. 00
Initial version, based on Initial version, based on
draft-bierman-netconf-system-monitoring-00.txt. draft-bierman-netconf-system-monitoring-00.txt.
Author's Address Author's Address
Andy Bierman Andy Bierman
Brocade Brocade
Email: andy.bierman@brocade.com Email: andy.bierman@brocade.com
 End of changes. 57 change blocks. 
104 lines changed or deleted 249 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/