Question: yang-diff vs. netconf diff.

[hyberdk]

First of all, thank you for awesome software.. Amazing..

Im using libyang 4.4.2 and the latest libyang-python wrapper to parse my configuration of my Cisco routers and switches. I can also generate my intent, and then I can diff the two with libyang

I have two DNodes base (intent) and running (actual), I diff them like this:

base = running.diff(base)
print_yang(out_fmt=format, data=base)

    def print_yang(
        self,
        data: str | dict,
        out_fmt: DataFormat = DataFormat.JSON,
        with_siblings: bool = True,
        pretty: bool = True,
        keep_empty_containers: bool = False,
    ) -> str:
        """Prints the YANG data in the specified format.

        Args:
            data (str | dict): The YANG data to print.
            out_fmt (DataFormat, optional): The output format. Defaults to DataFormat.JSON.
            with_siblings (bool, optional): Whether to include sibling in containers. Defaults to True.
            pretty (bool, optional): Whether to pretty-print the output. Defaults to True.
            keep_empty_containers (bool, optional): Whether to keep empty containers in the output. Defaults to False.

        Returns:
            str: The printed YANG data as string.
        """
        tree = self.parse(data)

        return tree.print_mem(str(out_fmt).lower(), with_siblings=with_siblings, pretty=pretty, keep_empty_containers=keep_empty_containers)

The print gives an output like this:

<nacm xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm" xmlns:yang="urn:ietf:params:xml:ns:yang:1" yang:operation="none">
  <write-default yang:operation="replace" yang:orig-default="false" yang:orig-value="permit">deny</write-default>
  <rule-list yang:operation="none">
    <name>readonly</name>
    <group yang:operation="delete">PRIV06</group>
    <group yang:operation="create">PRIV05</group>
    <rule yang:operation="none">
      <name>deny-cisco-rpc</name>
      <action yang:operation="replace" yang:orig-default="false" yang:orig-value="permit">deny</action>
    </rule>
  </rule-list>
</nacm>

Anyways, I know this is the c-version of libyang, but it was just for context..

my questions is as follows: I really really would like to make my diff a "netconf" compliant xml, so I can send that to my router or switch.. Since the yang:operation="none" yang:orig-default="false" yang:orig-value="permit" etc is not really "allowed" netconf commands, I would like to convert it to something I can actually send to my equipment..

I cannot find a way to do, this.. Am I just shit out of luck or what would you guys do in my situation? can it be solved within libyang?

Any help is appreciated, and ohh yeah.. awesome work guys (did I say that?)

Esben

[michalvasko]

Glad you find the library useful. I am wondering why exactly you are trying to do what you are asking about. And I assume by "netconf-diff" you mean a configuration you can use as content of an edit-config, which we use the term edit for in libyang/sysrepo. It is quite simple to do but there is no API for it because we are not aware of any use-case. The NETCONF edit-config has the generation of diff as one of the internal steps, essentially, so there is no need to generate it beforehand. Just send the new configuration with merge operation and the NETCONF server will apply it correctly.

[hyberdk]

Hi @michalvasko,

many thanks for the quick reply.. you are correct in your assumption that I want to push config via netconf edit-config, sorry if I dont know all the terminology yet, so please bear with me.

So the reason why a merge operation is not always enough for me is that it will not remove configuration, only merge my new config in with the other.. its like CLI on Cisco, if I just paste in the new configuration it will merge it, but it will not remove stuff. Obviously I could use the replace instead, but I really need to be surgical as I do not have the option to generate a full config.

let me try and explain a little more the way I attach my problem.

My system generates a intent configuration, this is for the full config, but unfortunately not all parts of our config are yet ready to be fully automated (there are lots of corner cases where its wrong), so it will not cover all use-cases.. The running config obviously have the running config, but it can also be wrong (human mistakes). So to eat the elephant so to speak, Im doing "features", where we filter down certain areas of configuration and diff those.

an example could be "dot1x" on switches, here our xpath would look like this:

            case "dot1x":
                return (
                    "/native/dot1x"
                    + "|/native/mab"
                    + "|/native/policy/policy-map[type='control']"
                    + "|/native/policy/class-map[type='control']"
                    + "|/native/aaa/authentication/dot1x"
                    + "|/native/aaa/accounting/update"
                    + "|/native/aaa/accounting/identity"
                    + "|/native/aaa/accounting/system"
                    + "|/native/template/template_details[contains(template_name, 'DOT1X') or template_name='SECURE_EDGE_PORT']"
                )

We know for sure that these parts are correct, but the plan is to generate a diff, that a human can validate that something is not totally out there (part of our change control).. My plan was to use the libyang diff to show and ultimately send to the equipment.. it has all the details of what needs to be added, changed or removed.

I hope that makes sense.

Writing all this, I think I understand what you are saying. Instead of pushing the diff.. I could just push the "filtered" config with a replace operation and the router/switch would look at it and do the diff internally?

Im not sure it will work in my case (but I will try and test it), what I believe will be the problem is that if I do a global replace operation on a list (say the /native/policy/policy-map), it would replace my entire list and not just the elements I wanted to edit (in this case all the control-type policy-maps), so what I need to do is to add the replace nc attribute in each of the elements in the list and not on the list itself. That is why I wanted to use the yang-diff as it gives me exactly what I need and I can control that very granular.

I hope that makes sense.. and sorry about the long post..

Esben

[michalvasko]

Fine, then you will have to write the conversion function yourself. For the common use-cases it is quite simple, just replace yang operations with netconf operations, which actually have the same values. But be careful about user-ordered lists (if you have any), for those it is more complex with the insert metadata. And you can leave the rest of metadata in the edit, I think (such as orig-value, orig-default), they should be ignored. But if not, you can easily delete those when traversing the tree and changing the operations.

[hyberdk]

Hey again,

I think I have a poc running now. it turns out that (at least) Cisco devices does not like the orig-value or orig-default, so Im removing those.

About the user-ordered, I assume you are talking about the "ordered-by user" statement here: https://datatracker.ietf.org/doc/html/rfc7950#section-7.7.1 right?

I have not yet found a insert attribute, but I have not gone through everything, however I did find the yang:key attribute, it looks like the key is how libyang knows where to insert it into the list..

here is an example xml of a libyang-diff

<nacm xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm" xmlns:yang="urn:ietf:params:xml:ns:yang:1" yang:operation="none">
  <read-default yang:operation="replace" yang:orig-default="false" yang:orig-value="permit">deny</read-default>
  <write-default yang:operation="replace" yang:orig-default="false" yang:orig-value="permit">deny</write-default>
  <rule-list yang:operation="create" yang:key="">
    <name>admin</name>
    <group>PRIV15</group>
    <rule yang:key="">
      <name>permit-all</name>
      <module-name>*</module-name>
      <access-operations>*</access-operations>
      <action>permit</action>
    </rule>
  </rule-list>
  <rule-list yang:operation="create" yang:key="[name='admin']">
    <name>readonly</name>
    <group>PRIV05</group>
    <rule yang:key="">
      <name>deny-cisco-ia</name>
      <module-name>cisco-ia</module-name>
      <access-operations>*</access-operations>
      <action>deny</action>
    </rule>
    <rule yang:key="[name='deny-cisco-ia']">
      <name>deny-cisco-rpc</name>
      <module-name>Cisco-IOS-XE-platform-rpc</module-name>
      <access-operations>*</access-operations>
      <action>deny</action>
    </rule>
    <rule yang:key="[name='deny-cisco-rpc']">
      <name>deny-cisco-rpc2</name>
      <module-name>Cisco-IOS-XE-rpc</module-name>
      <access-operations>*</access-operations>
      <action>deny</action>
    </rule>
    <rule yang:key="[name='deny-cisco-rpc2']">
      <name>read-exec-all</name>
      <module-name>*</module-name>
      <access-operations>read exec</access-operations>
      <action>permit</action>
    </rule>
  </rule-list>
</nacm>

the rule-list (and rule) has the ordered-by user in the model:

    list rule-list {
      key "name";
      ordered-by user;
      description
        "An ordered collection of access control rules.";

      leaf name {
        type string {
          length "1..max";
        }
        description
          "Arbitrary name assigned to the rule-list.";
      }

from what I can tell in the previous xml example, it would look something like this as netconf format:

    <rule yang:insert=first nc:operation=insert>  <--- remove key, add yang:insert=first + nc:op
      <name>deny-cisco-ia</name>
      <module-name>cisco-ia</module-name>
      <access-operations>*</access-operations>
      <action>deny</action>
    </rule>
    <rule yang:key="[name='deny-cisco-ia']" yang:insert="after" nc:operation=insert> <-- add the insert after and nc:op
      <name>deny-cisco-rpc</name>
      <module-name>Cisco-IOS-XE-platform-rpc</module-name>
      <access-operations>*</access-operations>
      <action>deny</action>
    </rule>

does that look about right?

again I cannot thank you enough for your help, its amazing then projects like this exist and replies on questions/issues are faster than most companies.. kudos from here!

[michalvasko]

I assume you are talking about the "ordered-by user" statement

Yes.

I have not yet found a insert attribute

I was talking about this. Together with the description of edit-config you should have all the information you need. Your example is not right and a basic hint I can give you, you need to use only ietf-netconf metadata (prefix nc), only those are recognized by edit-config.