draft-ietf-netmod-routing-cfg.xml

<?xml version="1.0"?>
<!DOCTYPE rfc SYSTEM '.tools/schema/rfc2629.dtd' [
<!ENTITY % COMMON SYSTEM ".tools/bplate/common.ent">
%COMMON;
<!ENTITY % WG SYSTEM ".tools/bplate/ietf-wg.ent">
%WG;
<!ENTITY % stdrefs SYSTEM "stdrefs.ent">
%stdrefs;
<!ENTITY % figures SYSTEM "figures.ent">
%figures;
<!ENTITY % yang SYSTEM "yang.ent">
%yang;
]>

<?rfc strict="yes"?>
<?rfc toc="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>

<rfc category="std">

  <front>
    <title abbrev="YANG Routing Management">A YANG Data Model for
    Routing Management</title>

    <author initials="L." surname="Lhotka" fullname="Ladislav Lhotka">
      <organization>CZ.NIC</organization>
      <address>
        <email>lhotka@nic.cz</email>
      </address>
    </author>
    <author initials="A." surname="Lindem" fullname="Acee Lindem">
      <organization>Cisco Systems</organization>
      <address>
        <email>acee@cisco.com</email>
      </address>
    </author>
    <date day="21" month="October" year="2014"/>
    &netmod-wg;
    <abstract>
      <t>This document contains a specification of three YANG modules
      and one submodule. Together they form the core routing data
      model which serves as a framework for configuring and managing a
      routing subsystem. It is expected that these modules will be
      augmented by additional YANG modules defining data models for
      control plane protocols, route filters and other functions. The core
      routing data model provides common building blocks for such
      extensions -- routes, routing information bases (RIB), and
      control plane protocols.</t>
    </abstract>
  </front>
  <middle>

    <section anchor="sec.introduction" title="Introduction">

      <t>This document contains a specification of the following YANG
      modules:
      <list style="symbols">
        <t>Module "ietf-routing" provides generic components of a
        routing data model.</t>
        <t>Module "ietf-ipv4-unicast-routing" augments the
        "ietf-routing" module with additional data specific to IPv4
        unicast.</t>
        <t>Module "ietf-ipv6-unicast-routing" augments the
        "ietf-routing" module with additional data specific to IPv6
        unicast. Its submodule "ietf-ipv6-router-advertisements" also
        augments the "ietf-interfaces" <xref target="RFC7223"/> and
        "ietf-ip" <xref target="RFC7277"/> modules with IPv6 router
        configuration variables required by <xref
        target="RFC4861"/>.</t>
      </list></t>

      <t>These modules together define the so-called core routing data
      model, which is intended as a basis for future data model
      development covering more sophisticated routing systems. While
      these three modules can be directly used for simple IP devices
      with static routing (see <xref target="app.minimum"/>), their
      main purpose is to provide essential building blocks for more
      complicated data models involving multiple control plane protocols,
      multicast routing, additional address families, and advanced
      functions such as route filtering or policy routing. To this
      end, it is expected that the core routing data model will be
      augmented by numerous modules developed by other IETF working
      groups.</t>

    </section>

    <section anchor="sec.term-not" title="Terminology and Notation">

      &kw-2119;

      <t>The following terms are defined in <xref target="RFC6241"/>:
      <list style="symbols">
        <t>client,</t>
        <t>message,</t>
        <t>protocol operation,</t>
        <t>server.</t>
      </list></t>

      <t>The following terms are defined in <xref target="RFC7950"/>:
      <list style="symbols">
	<t>action,</t>
        <t>augment,</t>
        <t>configuration data,</t>
        <t>container,</t>
        <t>container with presence,</t>
        <t>data model,</t>
        <t>data node,</t>
        <t>feature,</t>
        <t>leaf,</t>
        <t>list,</t>
        <t>mandatory node,</t>
        <t>module,</t>
        <t>schema tree,</t>
        <t>state data,</t>
        <t>RPC operation.</t>
      </list></t>

      <section anchor="sec.new-terms" title="Glossary of New Terms">
        <t><list style="hanging">
          <t hangText="core routing data model:"> YANG data model
          comprising "ietf-routing", "ietf-ipv4-unicast-routing" and
          "ietf-ipv6-unicast-routing" modules.</t>
          <t hangText="direct route:">a route to a directly connected
          network.</t>
          <t hangText="routing information base (RIB):">An object
          containing a list of routes together with other
          information. See <xref target="sec.rib"/> for details.</t>
          <t hangText="system-controlled entry:">An entry of a list in
          state data ("config false") that is created by the system
          independently of what has been explicitly configured. See
          <xref target="sec.system-user"/> for details.</t>
          <t hangText="user-controlled entry:">An entry of a list in
          state data ("config false") that is created and deleted as a
          direct consequence of certain configuration changes. See
          <xref target="sec.system-user"/> for details.</t>
        </list></t>
      </section>

      <section anchor="sec.tree-symbols" title="Tree Diagrams">
        <t>A simplified graphical representation of the complete data
        tree is presented in <xref target="app.data-tree"/>, and similar
        diagrams of its various subtrees appear in the main text.</t>
        &treesym;
      </section>

      <section anchor="sec.prefixes" title="Prefixes in Data Node Names">
        <t>In this document, names of data nodes, actions and other
        data model objects are often used without a prefix, as long as
        it is clear from the context in which YANG module each name is
        defined. Otherwise, names are prefixed using the standard prefix
        associated with the corresponding YANG module, as shown in <xref
        target="tab.prefixes"/>.</t>

        <texttable anchor="tab.prefixes"
                   title="Prefixes and corresponding YANG modules">
          <ttcol>Prefix</ttcol>
          <ttcol>YANG module</ttcol>
          <ttcol>Reference</ttcol>
          <c>if</c><c>ietf-interfaces</c><c><xref target="RFC7223"/></c>
          <c>ip</c><c>ietf-ip</c><c><xref target="RFC7277"/></c>
          <c>rt</c><c>ietf-routing</c><c><xref target="sec.mod-rt"/></c>
          <c>v4ur</c><c>ietf-ipv4-unicast-routing</c>
          <c><xref target="sec.mod-v4ur"/></c>
          <c>v6ur</c><c>ietf-ipv6-unicast-routing</c>
          <c><xref target="sec.mod-v6ur"/></c>
          <c>yang</c><c>ietf-yang-types</c><c><xref target="RFC6991"/></c>
          <c>inet</c><c>ietf-inet-types</c><c><xref target="RFC6991"/></c>
        </texttable>
      </section>

    </section>

    <section anchor="sec.objectives" title="Objectives">
      <t>The initial design of the core routing data model was driven by
      the following objectives:
      <list style="symbols">
        <t>The data model should be suitable for the common address
        families, in particular IPv4 and IPv6, and for unicast and
        multicast routing, as well as Multiprotocol Label Switching
        (MPLS).</t>
        <t>A simple IP routing system, such as one that uses only
        static routing, should be configurable in a simple way,
        ideally without any need to develop additional YANG
        modules.</t>
        <t>On the other hand, the core routing framework must allow
        for complicated implementations involving multiple routing
        information bases (RIB) and multiple control plane protocols, as
        well as controlled redistributions of routing information.</t>
        <t>Device vendors will want to map the data models built on this
        generic framework to their proprietary data models and
        configuration interfaces. Therefore, the framework should be
        flexible enough to facilitate such a mapping and accommodate
        data models with different logic.</t>
      </list>
      </t>
    </section>

    <section anchor="sec.design"
             title="The Design of the Core Routing Data Model">

      <t>The core routing data model consists of three YANG modules
      and one submodule. The first module, "ietf-routing", defines the
      generic components of a routing system. The other two modules,
      "ietf-ipv4-unicast-routing" and "ietf-ipv6-unicast-routing",
      augment the "ietf-routing" module with additional data nodes
      that are needed for IPv4 and IPv6 unicast routing,
      respectively. Module "ietf-ipv6-unicast-routing" has a
      submodule, "ietf-ipv6-router-advertisements", that augments the
      "ietf-interfaces" <xref target="RFC7223"/> and "ietf-ip" <xref
      target="RFC7277"/> modules with configuration variables for IPv6
      router advertisements as required by <xref
      target="RFC4861"/>. Figures <xref target="fig.confdata"
      format="counter"/> and <xref target="fig.statedata"
      format="counter"/> show abridged views of the configuration and
      state data hierarchies. See <xref target="app.data-tree"/> for
      the complete data trees.</t>

      <figure
          anchor="fig.confdata"
          title="Configuration data hierarchy.">
        &config-coll-tree.txt;
      </figure>

      <figure
          anchor="fig.statedata"
          title="State data hierarchy.">
        &state-coll-tree.txt;
      </figure>

      <t>As can be seen from Figures <xref target="fig.confdata"
      format="counter"/> and <xref target="fig.statedata"
      format="counter"/>, the core routing data model introduces
      several generic components of a routing framework: routes, RIBs
      containing lists of routes, and control plane protocols. <xref
      target="sec.building-blocks"/> describes these components in
      more detail.</t>

      <section anchor="sec.system-user"
               title="System-Controlled and User-Controlled List Entries">
        <t>The core routing data model defines several lists in the
        schema tree, such as "rib", that have to be populated with at
        least one entry in any properly functioning device, and
        additional entries may be configured by a client.</t>
        <t>In such a list, the server creates the required item as a
        so-called system-controlled entry in state data, i.e., inside
        the "routing-state" container.</t>
        <t>An example can be seen in <xref target="app.get-reply"/>: the
        "/routing-state/ribs/rib" list has two
        system-controlled entries named "ipv4-master" and
        "ipv6-master".</t>
        <t>Additional entries may be created in the configuration by
        a client, e.g., via the NETCONF protocol. These are so-called
        user-controlled entries. If the server accepts a configured
        user-controlled entry, then this entry also appears in the
        state data version of the list.</t>
        <t>Corresponding entries in both versions of the list (in
        state data and configuration) have the same value of the list
        key.</t>
        <t>A client may also provide supplemental configuration of
        system-controlled entries. To do so, the client creates a new
        entry in the configuration with the desired contents. In order
        to bind this entry to the corresponding entry in the state
        data list, the key of the configuration entry has to be set to
        the same value as the key of the state entry.</t>
        <t>Deleting a user-controlled entry from the configuration list
        results in the removal of the corresponding entry in the
        state data list. In contrast, if a system-controlled
        entry is deleted from the configuration list, only the extra
        configuration specified in that entry is removed but the
        corresponding state data entry remains in the list.</t>
      </section>

    </section>

    <section anchor="sec.building-blocks"
             title="Basic Building Blocks">

      <t>This section describes the essential components of the core
      routing data model.</t>

      <section anchor="sec.route" title="Route">
        <t>Routes are basic elements of information in a routing
        system. The core routing data model defines only the following
        minimal set of route attributes:
        <list style="symbols">
          <t>"destination-prefix": address prefix specifying the set
          of destination addresses for which the route may be
          used. This attribute is mandatory.</t>
          <t>"route-preference": an integer value (also known as
          administrative distance) that is used for selecting a
          preferred route among routes with the same destination
          prefix. A lower value means a more preferred route.</t>
          <t>"next-hop": determines the outgoing interface and/or
          next-hop address(es), other operation to be performed with a
          packet.</t>
        </list>
        </t>
        <t>Routes are primarily state data that appear as entries of
        RIBs (<xref target="sec.rib"/>) but they may also be found in
        configuration data, for example as manually configured static
        routes. In the latter case, configurable route attributes are
        generally a subset of attributes defined for RIB routes.</t>
      </section>

      <section anchor="sec.rib" title="Routing Information Base (RIB)">
        <t>Every implementation of the core routing data model manages
        one or more routing information bases (RIB). A RIB is a list
        of routes complemented with administrative data. Each RIB
        contains only routes of one address family. An address family
        is represented by an identity derived from the
        "rt:address-family" base identity.</t>
        <t>In the core routing data model, RIBs are state data
        represented as entries of the list
        "/routing-state/ribs/rib". The contents of
        RIBs are controlled and manipulated by control plane protocol
        operations which may result in route additions, removals and
        modifications. This also includes manipulations via the
        "static" and/or "direct" pseudo-protocols, see <xref
        target="sec.pseudoproto"/>.</t>
        <t>For every supported address family, exactly one RIB MUST be
        marked as the so-called default RIB. Its role is explained in
        <xref target="sec.proto"/>.</t>
        <t>Simple router implementations that do not advertise the
        feature "multiple-ribs" will typically create one
        system-controlled RIB per supported address family, and mark
        it as the default RIB.</t>

        <t>More complex router implementations advertising the
        "multiple-ribs" feature support multiple RIBs per address
        family that can be used for policy routing and other
        purposes.</t>

        <t>The following action (see Section 7.15 of <xref
        target="RFC7950"/>) is defined for the "rib" list:
        <list style="symbols">
          <t>active-route -- return the active RIB route for the
          destination address that is specified as the action's input
          parameter.</t>
        </list></t>

      </section>

      <section anchor="sec.proto" title="Control Plane Protocol">

        <t>The core routing data model provides an open-ended
        framework for defining multiple control plane protocol
        instances, e.g., for Layer 3 routing protocols. Each control
        plane protocol instance MUST be assigned a type, which is an
        identity derived from the "rt:control-plane-protocol" base
        identity. The core routing data model defines two identities
        for the direct and static pseudo-protocols (<xref
        target="sec.pseudoproto"/>).</t>
        <t>Multiple control plane protocol instances of the same type MAY be
        configured.</t>

        <section anchor="sec.pseudoproto"
                 title="Routing Pseudo-Protocols">

          <t>The core routing data model defines two special routing
          protocol types -- "direct" and "static". Both are in fact
          pseudo-protocols, which means that they are confined to the
          local device and do not exchange any routing information
          with adjacent routers.</t>
          <t>Every implementation of the core routing data model MUST
          provide exactly one instance of the "direct" pseudo-protocol
          type. It is the source of direct routes for all configured
          address families. Direct routes are normally supplied by the
          operating system kernel, based on the configuration of
          network interface addresses, see <xref
          target="sec.ietf-ip"/>.</t>
          <t>A pseudo-protocol of the type "static" allows for specifying
          routes manually. It MAY be configured in zero or multiple
          instances, although a typical configuration will have exactly
          one instance.</t>
        </section>

        <section anchor="sec.newproto"
                 title="Defining New Control Plane Protocols">
          <t>It is expected that future YANG modules will create data
          models for additional control plane protocol types. Such a new
          module has to define the protocol-specific configuration and
          state data, and it has to integrate it into the core routing
          framework in the following way:
          <list style="symbols">
            <t>A new identity MUST be defined for the control plane protocol
            and its base identity MUST be set to "rt:control-plane-protocol",
            or to an identity derived from "rt:control-plane-protocol".</t>
            <t>Additional route attributes MAY be defined, preferably in
            one place by means of defining a YANG grouping. The new
            attributes have to be inserted by augmenting the definitions
            of the nodes
            <figure>
              <artwork><![CDATA[
    /rt:routing-state/rt:ribs/rt:rib/rt:routes/rt:route]]>
              </artwork>
            </figure>
            and
            <figure>
              <artwork><![CDATA[
    /rt:routing-state/rt:ribs/rt:rib/rt:output/rt:route,]]>
              </artwork>
            </figure>
            and possibly other places in the configuration, state
            data, notifications, and input/output parameters of
            actions or RPC operations.</t>
            <t>Configuration parameters and/or state data for the new
            protocol can be defined by augmenting the
            "control-plane-protocol" data node under both "/routing"
            and "/routing-state".</t>
          </list></t>
          <t>By using a "when" statement, the augmented configuration
          parameters and state data specific to the new protocol
          SHOULD be made conditional and valid only if the value of
          "rt:type" or "rt:source-protocol" is equal to (or derived
          from) the new protocol's identity.</t>
          <t>It is also RECOMMENDED that protocol-specific data nodes
          be encapsulated in an appropriately named container with
          presence. Such a container may contain mandatory data nodes
          that are otherwise forbidden at the top level of an
          augment.</t>
          <t>The above steps are implemented by the example YANG module
          for the RIP routing protocol in <xref
          target="app.rip"/>.</t>
        </section>
      </section>

      <section anchor="sec.4861"
               title="Parameters of IPv6 Router Advertisements">

        <t>YANG module "ietf-ipv6-router-advertisements" (<xref
        target="sec.mod-v6ra"/>), which is a submodule of the
        "ietf-ipv6-unicast-routing" module, augments the configuration
        and state data of IPv6 interfaces with definitions of the
        following variables as required by <xref target="RFC4861"/>,
        sec. 6.2.1:
        <list style="symbols">
          <t>send-advertisements,</t>
          <t>max-rtr-adv-interval,</t>
          <t>min-rtr-adv-interval,</t>
          <t>managed-flag,</t>
          <t>other-config-flag,</t>
          <t>link-mtu,</t>
          <t>reachable-time,</t>
          <t>retrans-timer,</t>
          <t>cur-hop-limit,</t>
          <t>default-lifetime,</t>
          <t>prefix-list: a list of prefixes to be advertised.<vspace
          blankLines="1"/>The
          following parameters are associated with each prefix in the
          list:
          <list style="symbols">
            <t>valid-lifetime,</t>
            <t>on-link-flag,</t>
            <t>preferred-lifetime,</t>
            <t>autonomous-flag.</t>
          </list></t>
        </list></t>
        <t>NOTES:</t>
        <t><list style="numbers">
          <t>The "IsRouter" flag, which is also required by <xref
          target="RFC4861"/>, is implemented in the "ietf-ip" module
          <xref target="RFC7277"/> (leaf "ip:forwarding").</t>
          <t>The original specification <xref target="RFC4861"/>
          allows the implementations to decide whether the
          "valid-lifetime" and "preferred-lifetime" parameters remain
          the same in consecutive advertisements, or decrement in real
          time. However, the latter behavior seems problematic because
          the values might be reset again to the (higher) configured
          values after a configuration is reloaded. Moreover, no
          implementation is known to use the decrementing
          behavior. The "ietf-ipv6-router-advertisements" submodule
          therefore stipulates the former behavior with constant
          values.</t>
        </list></t>

      </section>

    </section>

    <section anchor="sec.interactions"
             title="Interactions with Other YANG Modules">
      <t>The semantics of the core routing data model also depends on
      several configuration parameters that are defined in other YANG
      modules.</t>

      <section anchor="sec.ietf-if" title='Module "ietf-interfaces"'>
        <t>The following boolean switch is defined in the
        "ietf-interfaces" YANG module <xref target="RFC7223"/>:
        <list style="hanging">
          <t hangText="/if:interfaces/if:interface/if:enabled">
            <vspace blankLines="1"/>
            If this switch is set to "false" for a network layer
            interface, then all routing and forwarding functions MUST
            be disabled on that interface.
          </t>
        </list>
        </t>
      </section>

      <section anchor="sec.ietf-ip" title='Module "ietf-ip"'>
        <t>The following boolean switches are defined in the "ietf-ip"
        YANG module <xref target="RFC7277"/>:
        <list style="hanging">
          <t hangText="/if:interfaces/if:interface/ip:ipv4/ip:enabled">
            <vspace blankLines="1"/>
            If this switch is set to "false" for a network layer
            interface, then all IPv4 routing and forwarding functions
            MUST be disabled on that interface.
          </t>
          <t hangText="/if:interfaces/if:interface/ip:ipv4/ip:forwarding">
            <vspace blankLines="1"/>
            If this switch is set to "false" for a network layer
            interface, then the forwarding of IPv4 datagrams through
            this interface MUST be disabled. However, the interface MAY
            participate in other IPv4 routing functions, such as routing
            protocols.
          </t>
          <t hangText="/if:interfaces/if:interface/ip:ipv6/ip:enabled">
            <vspace blankLines="1"/>
            If this switch is set to "false" for a network layer
            interface, then all IPv6 routing and forwarding functions
            MUST be disabled on that interface.
          </t>
          <t hangText="/if:interfaces/if:interface/ip:ipv6/ip:forwarding">
            <vspace blankLines="1"/>
            If this switch is set to "false" for a network layer
            interface, then the forwarding of IPv6 datagrams through
            this interface MUST be disabled. However, the interface MAY
            participate in other IPv6 routing functions, such as routing
            protocols.
          </t>
        </list>
        </t>
        <t>In addition, the "ietf-ip" module allows for configuring IPv4
        and IPv6 addresses and network prefixes or masks on network
        layer interfaces. Configuration of these parameters on an
        enabled interface MUST result in an immediate creation of the
        corresponding direct route. The destination prefix of this route
        is set according to the configured IP address and network
        prefix/mask, and the interface is set as the outgoing interface
        for that route.</t>
      </section>

    </section>

    <section anchor="sec.mod-rt"
             title="Routing Management YANG Module">

      &ed-hint-fill-in;

      <figure>
        &ietf-routing.yang;
      </figure>

    </section>

    <section anchor="sec.mod-v4ur"
             title="IPv4 Unicast Routing Management YANG Module">

      &ed-hint-fill-in;

      <figure>
        &ietf-ipv4-unicast-routing.yang;
      </figure>

    </section>

    <section anchor="sec.mod-v6ur"
             title="IPv6 Unicast Routing Management YANG Module">

      &ed-hint-fill-in;

      <figure>
        &ietf-ipv6-unicast-routing.yang;
      </figure>

      <section anchor="sec.mod-v6ra"
             title="IPv6 Router Advertisements Submodule">

      &ed-hint-fill-in;

      <figure>
        &ietf-ipv6-router-advertisements.yang;
      </figure>

    </section>

    </section>

    <section anchor="sec.iana" title="IANA Considerations">

      <t>RFC Ed.: In this section, replace all occurrences of 'XXXX' with
      the actual RFC number (and remove this note).</t>

      <t>This document registers the following namespace URIs in the
      IETF XML registry <xref target="RFC3688"/>:</t>
      <figure>
        <artwork>
--------------------------------------------------------------------
URI: urn:ietf:params:xml:ns:yang:ietf-routing

Registrant Contact: The IESG.

XML: N/A, the requested URI is an XML namespace.
--------------------------------------------------------------------
        </artwork>
      </figure>
      <figure>
        <artwork>
--------------------------------------------------------------------
URI: urn:ietf:params:xml:ns:yang:ietf-ipv4-unicast-routing

Registrant Contact: The IESG.

XML: N/A, the requested URI is an XML namespace.
--------------------------------------------------------------------
        </artwork>
      </figure>
      <figure>
        <artwork>
--------------------------------------------------------------------
URI: urn:ietf:params:xml:ns:yang:ietf-ipv6-unicast-routing

Registrant Contact: The IESG.

XML: N/A, the requested URI is an XML namespace.
--------------------------------------------------------------------
        </artwork>
      </figure>

      <t>This document registers the following YANG modules in the YANG
      Module Names registry <xref target="RFC6020"/>:</t>

      <figure>
        <artwork>
--------------------------------------------------------------------
name:         ietf-routing
namespace:    urn:ietf:params:xml:ns:yang:ietf-routing
prefix:       rt
reference:    RFC XXXX
--------------------------------------------------------------------
        </artwork>
      </figure>
      <figure>
        <artwork>
--------------------------------------------------------------------
name:         ietf-ipv4-unicast-routing
namespace:    urn:ietf:params:xml:ns:yang:ietf-ipv4-unicast-routing
prefix:       v4ur
reference:    RFC XXXX
--------------------------------------------------------------------
        </artwork>
      </figure>
      <figure>
        <artwork>
--------------------------------------------------------------------
name:         ietf-ipv6-unicast-routing
namespace:    urn:ietf:params:xml:ns:yang:ietf-ipv6-unicast-routing
prefix:       v6ur
reference:    RFC XXXX
--------------------------------------------------------------------
        </artwork>
      </figure>

      <t>This document registers the following YANG submodule in the YANG
      Module Names registry <xref target="RFC6020"/>:</t>

      <figure>
        <artwork>
--------------------------------------------------------------------
name:         ietf-ipv6-router-advertisements
parent:       ietf-ipv6-unicast-routing
reference:    RFC XXXX
--------------------------------------------------------------------
        </artwork>
      </figure>
    </section>

    <section anchor="sec-cons" title="Security Considerations">

      <t>Configuration and state data conforming to the core routing
      data model (defined in this document) are designed to be
      accessed via a management protocol with secure transport layer,
      such as NETCONF <xref target="RFC6241"/>. The NETCONF access
      control model <xref target="RFC6536"/> provides the means to
      restrict access for particular NETCONF users to a pre-configured
      subset of all available NETCONF protocol operations and
      content.</t>
      <t>A number of configuration data nodes defined in the YANG
      modules belonging to the core routing data model are
      writable/creatable/deletable (i.e., "config true" in YANG terms,
      which is the default).  These data nodes may be considered
      sensitive or vulnerable in some network environments.  Write
      operations to these data nodes, such as "edit-config" in
      NETCONF, can have negative effects on the network if the
      protocol operations are not properly protected.</t>
      <t>The vulnerable "config true" parameters and subtrees are the
      following:
      <list style="hanging">

        <t
        hangText="/routing/control-plane-protocols/control-plane-protocol:">This
        list specifies the control plane protocols configured on a
        device.</t>

        <t hangText="/routing/ribs/rib:">This list
        specifies the RIBs configured for the device.</t>
      </list>

      Unauthorised access to any of these lists can adversely affect the
      routing subsystem of both the local device and the network. This
      may lead to network malfunctions, delivery of packets to
      inappropriate destinations and other problems.</t>

    </section>

    <section anchor="acknowledgments" title="Acknowledgments">
      <t>The authors wish to thank Nitin Bahadur, Martin Bjorklund,
      Dean Bogdanovic, Jeff Haas, Joel Halpern, Wes Hardaker,
      Sriganesh Kini, David Lamparter, Andrew McGregor, Jan Medved,
      Xiang Li, Stephane Litkowski, Thomas Morin, Tom Petch,
      Yingzhen Qu, Bruno Rijsman, Juergen Schoenwaelder, Phil Shafer,
      Dave Thaler, Yi Yang, Derek Man-Kit Yeung and Jeffrey Zhang for
      their helpful comments and suggestions.</t>
    </section>

  </middle>

  <back>

    <references title="Normative References">
      &RFC2119;
      &RFC3688;
      &RFC4861;
      &RFC6020;
      &RFC6991;
      &RFC6241;
      &RFC7223;
      &RFC7277;
      &RFC7950;
    </references>

    <references title="Informative References">

      &RFC6087;
      &RFC6536;
      &RFC7895;
      &RFC7951;
    </references>

    <section anchor="app.data-tree" title="The Complete Data Trees">

      <t>This appendix presents the complete configuration and
      state data trees of the core routing data model.
      See <xref target="sec.tree-symbols"/> for an explanation of the
      symbols used. Data type of every leaf node is shown near the right
      end of the corresponding line.</t>

      <section anchor="app.config-tree" title="Configuration Data">

        <figure>
          &config-tree.txt;
        </figure>

      </section>

      <section anchor="app.state-tree" title="State Data">

        <figure>
          &state-tree.txt;
        </figure>

      </section>

    </section>

    <section anchor="app.minimum"
             title="Minimum Implementation">

      <t>Some parts and options of the core routing model, such as
      user-defined RIBs, are intended only for advanced routers. This
      appendix gives basic non-normative guidelines for implementing a
      bare minimum of available functions. Such an implementation may
      be used for hosts or very simple routers.</t>
      <t>A minimum implementation does not support the feature
      "multiple-ribs". This means that a single system-controlled RIB
      is available for each supported address family - IPv4, IPv6 or
      both. These RIBs are also the default RIBs. No user-controlled
      RIBs are allowed.</t>
      <t>In addition to the mandatory instance of the "direct"
      pseudo-protocol, a minimum implementation should support
      configuring instance(s) of the "static" pseudo-protocol.</t>
      <t>For hosts that are never intended to act as routers, the
      ability to turn on sending IPv6 router advertisements (<xref
      target="sec.4861"/>) should be removed.</t>
      <t>Platforms with severely constrained resources may use
      deviations for restricting the data model, e.g., limiting the
      number of "static" control plane protocol instances.</t>

    </section>

    <section anchor="app.rip"
             title="Example: Adding a New Control Plane Protocol">

      <t>This appendix demonstrates how the core routing data model
      can be extended to support a new control plane protocol. The YANG
      module "example-rip" shown below is intended as an illustration
      rather than a real definition of a data model for the RIP
      routing protocol. For the sake of brevity, this module does not
      obey all the guidelines specified in <xref
      target="RFC6087"/>. See also <xref target="sec.newproto"/>.</t>

      <figure>
        &example-rip.yang;
      </figure>

    </section>

    <section anchor="app.get-reply"
             title="Data Tree Example">

      <t>This section contains an example instance data tree in the
      JSON encoding <xref target="RFC7951"/>,
      containing both configuration and state data. The data conforms
      to a data model that is defined by the following YANG library
      specification <xref target="RFC7895"/>:

      <figure>
	&yang-library.json;
      </figure></t>

      <t>A simple network set-up as shown in <xref
      target="fig.exnet"/> is assumed: router "A" uses static default
      routes with the "ISP" router as the next-hop. IPv6 router
      advertisements are configured only on the "eth1" interface and
      disabled on the upstream "eth0" interface.</t>

      <figure anchor="fig.exnet"
              title="Example network configuration">
        &example-net.txt;
      </figure>

      <t>The instance data tree could then be as follows:</t>

      <figure>
        &example-get-reply.json;
      </figure>

    </section>

    <section anchor="change-log" title="Change Log">

      &ed-hint-remove-sec;

      <section title="Changes Between Versions -24 and -25">
        <t>
          <list style="symbols">
            <t>Minor edits based on IETF Last Call reviews.</t>
	  </list>
	</t>
      </section>

      <section title="Changes Between Versions -23 and -24">
        <t>
          <list style="symbols">
            <t>Fix paths in "when" expressions due to errata 4749 of
            RFC 7950.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -22 and -23">
        <t>
          <list style="symbols">
	    <t>Removed "route-tag" feature.</t>
	    <t>Removed next-hop classifiers.</t>
	    <t>Fixed invalid when expressions in augments.</t>
	    <t>In simple-next-hop, an address, outgoing interface or
	    both can be specified.</t>
	    <t>RPC "fib-route" changed into RIB action
	    "active-route".</t>
	    <t>The requirement that direct routes be always placed in
	    default RIBs.</t>
	  </list>
	</t>
      </section>

      <section title="Changes Between Versions -21 and -22">
        <t>
          <list style="symbols">
	    <t>Added "next-hop-list" as a new case of the
	    "next-hop-options" choice.</t>
	    <t>Renamed "routing protocol" to "control plane
	    protocol" in both the YANG modules and I-D text.</t>
	  </list>
	</t>
      </section>

      <section title="Changes Between Versions -20 and -21">
        <t>
          <list style="symbols">
            <t>Routing instances were removed.</t>
            <t>IPv6 RA parameters were moved to the
            "ietf-ipv6-router-advertisements".</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -19 and -20">
        <t>
          <list style="symbols">
            <t>Assignment of L3 interfaces to routing instances is now
            part of interface configuration.</t>
            <t>Next-hop options in configuration were aligned with
            state data.</t>
            <t>It is recommended to enclose protocol-specific
            configuration in a presence container.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -18 and -19">
        <t>
          <list style="symbols">
            <t>The leaf "route-preference" was removed from the
            "routing-protocol" container in both "routing" and
            "routing-state".</t>
            <t>The "vrf-routing-instance" identity was added in
            support of a common routing-instance type in addition to
            the "default-routing-instance".</t>
            <t>Removed "enabled" switch from "routing-protocol".</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -17 and -18">
        <t>
          <list style="symbols">
            <t>The container "ribs" was moved under "routing-instance"
            (in both "routing" and "routing-state").</t>
            <t>Typedefs "rib-ref" and "rib-state-ref" were removed.</t>
            <t>Removed "recipient-ribs" (both state and configuration).</t>
            <t>Removed "connected-ribs" from "routing-protocol" (both
            state and configuration).</t>
            <t>Configuration and state data for IPv6 RA were moved
            under "if:interface" and "if:interface-state".</t>
            <t>Assignment of interfaces to routing instances now use
            leaf-list rather than list (both config and state). The
            opposite reference from "if:interface" to
            "rt:routing-instance" was changed to a single leaf (an
            interface cannot belong to multiple routing instances).</t>
            <t>Specification of a default RIB is now a simple flag
            under "rib" (both config and state).</t>
            <t>Default RIBs are marked by a flag in state data.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -16 and -17">
        <t>
          <list style="symbols">
            <t>Added Acee as a co-author.</t>
            <t>Removed all traces of route filters.</t>
            <t>Removed numeric IDs of list entries in state data.</t>
            <t>Removed all next-hop cases except "simple-next-hop" and
            "special-next-hop".</t>
            <t>Removed feature "multipath-routes".</t>
            <t>Augmented "ietf-interfaces" module with a leaf-list of
            leafrefs pointing form state data of an interface entry to
            the routing instance(s) to which the interface is
            assigned.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -15 and -16">
        <t>
          <list style="symbols">
            <t>Added 'type' as the second key component of
            'routing-protocol', both in configuration and state
            data.</t>
            <t>The restriction of no more than one connected RIB per
            address family was removed.</t>
            <t>Removed the 'id' key of routes in RIBs. This list has
            no keys anymore.</t>
            <t>Remove the 'id' key from static routes and make
            'destination-prefix' the only key.</t>
            <t>Added 'route-preference' as a new attribute of routes
            in RIB.</t>
            <t>Added 'active' as a new attribute of routes in
            RIBs.</t>
            <t>Renamed RPC operation 'active-route' to 'fib-route'.</t>
            <t>Added 'route-preference' as a new parameter of routing
            protocol instances, both in configuration and state data.</t>
            <t>Renamed identity 'rt:standard-routing-instance' to
            'rt:default-routing-instance'.</t>
            <t>Added next-hop lists to state data.</t>
            <t>Added two cases for specifying next-hops indirectly -
            via a new RIB or a recursive list of next-hops.</t>
            <t>Reorganized next-hop in static routes.</t>
            <t>Removed all 'if-feature' statements from state data.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -14 and -15">
        <t>
          <list style="symbols">
            <t>Removed all defaults from state data.</t>
            <t>Removed default from 'cur-hop-limit' in config.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -13 and -14">
        <t>
          <list style="symbols">
            <t>Removed dependency of 'connected-ribs' on the
            'multiple-ribs' feature.</t>
            <t>Removed default value of 'cur-hop-limit' in state data.</t>
            <t>Moved parts of descriptions and all references on IPv6 RA
            parameters from state data to configuration.</t>
            <t>Added reference to RFC 6536 in the Security section.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -12 and -13">
        <t>
          <list style="symbols">
            <t>Wrote appendix about minimum implementation.</t>
            <t>Remove "when" statement for IPv6 router interface
            state data - it was dependent on a config value that
            may not be present.</t>
            <t>Extra container for the next-hop list.</t>
            <t>Names rather than numeric ids are used for referring to
            list entries in state data.</t>
            <t>Numeric ids are always declared as mandatory and
            unique. Their description states that they are ephemeral.</t>
            <t>Descriptions of "name" keys in state data lists
            are required to be persistent.</t>
            <t></t>
            <t>Removed "if-feature multiple-ribs;" from connected-ribs.</t>
            <t>"rib-name" instead of "name" is used as the name of
            leafref nodes.</t>
            <t>"next-hop" instead of "nexthop" or "gateway" used
            throughout, both in node names and text.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -11 and -12">
        <t>
          <list style="symbols">
            <t>Removed feature "advanced-router" and introduced two
            features instead: "multiple-ribs" and "multipath-routes".</t>
            <t>Unified the keys of config and state versions of
            "routing-instance" and "rib" lists.</t>
            <t>Numerical identifiers of state list entries are not keys
            anymore, but they are constrained using the "unique" statement.</t>
            <t>Updated acknowledgements.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -10 and -11">
        <t>
          <list style="symbols">
            <t>Migrated address families from IANA enumerations to
            identities.</t> <t>Terminology and node names aligned with
            the I2RS RIB model: router -&gt; routing instance, routing
            table -&gt; RIB.</t>
            <t>Introduced uint64 keys for state lists: routing-instance,
            rib, route, nexthop.</t>
            <t>Described the relationship between system-controlled and
            user-controlled list entries.</t>
            <t>Feature "user-defined-routing-tables" changed into "advanced-router".</t>
            <t>Made nexthop into a choice in order to allow for
            nexthop-list (I2RS requirement).</t>
            <t>Added nexthop-list with entries having priorities
            (backup) and weights (load balancing).</t>
            <t>Updated bibliography references.</t>
          </list>
        </t>
      </section>


      <section title="Changes Between Versions -09 and -10">
        <t>
          <list style="symbols">
            <t>Added subtree for state data ("/routing-state").</t>
            <t>Terms "system-controlled entry" and "user-controlled
            entry" defined and used.</t>
            <t>New feature "user-defined-routing-tables". Nodes that are
            useful only with user-defined routing tables are now conditional.</t>
            <t>Added grouping "router-id".</t>
            <t>In routing tables, "source-protocol" attribute of routes
            now reports only protocol type, and its datatype is
            "identityref".</t>
            <t>Renamed "main-routing-table" to "default-routing-table".</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -08 and -09">
        <t>
          <list style="symbols">
            <t>Fixed "must" expression for "connected-routing-table".</t>
            <t>Simplified "must" expression for "main-routing-table".</t>
            <t>Moved per-interface configuration of a new routing
            protocol under 'routing-protocol'. This also affects the
            'example-rip' module.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -07 and -08">
        <t>
          <list style="symbols">
            <t>Changed reference from RFC6021 to RFC6021bis.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -06 and -07">
        <t>
          <list style="symbols">
            <t>The contents of &lt;get-reply&gt; in <xref
            target="app.get-reply"/> was updated: "eth[01]" is used as
            the value of "location", and "forwarding" is on for both
            interfaces and both IPv4 and IPv6.</t>
            <t>The "must" expression for "main-routing-table" was
            modified to avoid redundant error messages reporting address
            family mismatch when "name" points to a non-existent routing
            table.</t>
            <t>The default behavior for IPv6 RA prefix advertisements
            was clarified.</t>
            <t>Changed type of "rt:router-id" to "ip:dotted-quad".</t>
            <t>Type of "rt:router-id" changed to "yang:dotted-quad".</t>
            <t>Fixed missing prefixes in XPath expressions.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -05 and -06">
        <t>
          <list style="symbols">
            <t>Document title changed: "Configuration" was replaced by
            "Management".</t>
            <t>New typedefs "routing-table-ref" and "route-filter-ref".</t>
            <t>Double slashes "//" were removed from XPath expressions
            and replaced with the single "/".</t>
            <t>Removed uniqueness requirement for "router-id".</t>
            <t>Complete data tree is now in <xref target="app.data-tree"/>.</t>
            <t>Changed type of "source-protocol" from "leafref" to "string".</t>
            <t>Clarified the relationship between routing protocol
            instances and connected routing tables.</t>
            <t>Added a must constraint saying that a routing table
            connected to the direct pseudo-protocol must not be a main
            routing table.</t>
          </list>
        </t>
      </section>

      <section title="Changes Between Versions -04 and -05">
        <t>
          <list style="symbols">
            <t>Routing tables are now global, i.e., "routing-tables" is
            a child of "routing" rather than "router".</t>
            <t>"must" statement for "static-routes" changed to "when".</t>
            <t>Added "main-routing-tables" containing references to main
            routing tables for each address family.</t>
            <t>Removed the defaults for "address-family" and "safi" and
            made them mandatory.</t>
            <t>Removed the default for route-filter/type and made this
            leaf mandatory.</t>
            <t>If there is no active route for a given destination, the
            "active-route" RPC returns no output.</t>
            <t>Added "enabled" switch under "routing-protocol".</t>
            <t>Added "router-type" identity and "type" leaf under
            "router".</t>
            <t>Route attribute "age" changed to "last-updated", its type
            is "yang:date-and-time".</t>
            <t>The "direct" pseudo-protocol is always connected to main
            routing tables.</t>
            <t>Entries in the list of connected routing tables renamed
            from "routing-table" to "connected-routing-table".</t>
            <t>Added "must" constraint saying that a routing table must
            not be its own recipient.</t>
          </list>
        </t>
      </section>
      <section title="Changes Between Versions -03 and -04">
        <t>
          <list style="symbols">
            <t>Changed "error-tag" for both RPC operations from "missing
            element" to "data-missing".</t>
            <t>Removed the decrementing behavior for advertised IPv6
            prefix parameters "valid-lifetime" and
            "preferred-lifetime".</t>
            <t>Changed the key of the static route lists from "seqno" to
            "id" because the routes needn't be sorted.</t>
            <t>Added 'must' constraint saying that "preferred-lifetime"
            must not be greater than "valid-lifetime".</t>
          </list>
        </t>
      </section>
      <section title="Changes Between Versions -02 and -03">
        <t>
          <list style="symbols">
            <t>Module "iana-afn-safi" moved to I-D "iana-if-type".</t>
            <t>Removed forwarding table.</t>
            <t>RPC "get-route" changed to "active-route". Its output is
            a list of routes (for multi-path routing).</t>
            <t>New RPC "route-count".</t>
            <t>For both RPCs, specification of negative responses was
            added.</t>
            <t>Relaxed separation of router instances.</t>
            <t>Assignment of interfaces to router instances needn't be
            disjoint.</t>
            <t>Route filters are now global.</t>
            <t>Added "allow-all-route-filter" for symmetry.</t>
            <t>Added <xref target="sec.interactions"/> about
            interactions with "ietf-interfaces" and "ietf-ip".</t>
            <t>Added "router-id" leaf.</t>
            <t>Specified the names for IPv4/IPv6 unicast main routing
            tables.</t>
            <t>Route parameter "last-modified" changed to "age".</t>
            <t>Added container "recipient-routing-tables".</t>
          </list>
        </t>
      </section>
      <section title="Changes Between Versions -01 and -02">
        <t><list style="symbols">
          <t>Added module "ietf-ipv6-unicast-routing".</t>
          <t>The example in <xref target="app.get-reply"/> now uses
          IP addresses from blocks reserved for documentation.</t>
          <t>Direct routes appear by default in the forwarding
          table.</t>
          <t>Network layer interfaces must be assigned to a router
          instance. Additional interface configuration may be present.</t>
          <t>The "when" statement is only used with "augment", "must" is
          used elsewhere.</t>
          <t>Additional "must" statements were added.</t>
          <t>The "route-content" grouping for IPv4 and IPv6 unicast now
          includes the material from the "ietf-routing" version via
          "uses rt:route-content".</t>
          <t>Explanation of symbols in the tree representation of data
          model hierarchy.</t>
        </list></t>
      </section>

      <section title="Changes Between Versions -00 and -01">
        <t><list style="symbols">
          <t>AFN/SAFI-independent stuff was moved to the "ietf-routing"
          module.</t>
          <t>Typedefs for AFN and SAFI were placed in a separate
          "iana-afn-safi" module.</t>
          <t>Names of some data nodes were changed, in particular
          "routing-process" is now "router".</t>
          <t>The restriction of a single AFN/SAFI per router was
          lifted.</t>
          <t>RPC operation "delete-route" was removed.</t>
          <t>Illegal XPath references from "get-route" to the datastore
          were fixed.</t>
          <t>Section "Security Considerations" was written.</t>
        </list></t>
      </section>

    </section>

  </back>

</rfc>