Extensions

Used with object definitions to indicate that they
do not represent CLI or NETCONF configuration database
data instances.  Instead, the node is simply an object
identifier, an 'error-info' extension, or some other
abstract data structure.

Used within a container definition to indicate it is
only used as a conceptual container for a set of CLI parameters.
A top-level container containing this extension will not
be included in any NETCONF configuration databases.

DEFVAL value provided in an OBJECT-TYPE macro.

DEFVAL value provided in an OBJECT-TYPE macro.

Used to indicate that the data model node
controls a very sensitive security system parameter.

If present, and the NACM module is enabled (i.e.,
/nacm/enable-nacm object equals 'true'), the NETCONF server
will only allow the designated 'recovery session' to have
read, write, or execute access to the node.  An explicit
access control rule is required for all other users.

The 'default-deny-all' extension MAY appear within a data
definition statement, 'rpc' statement, or 'notification'
statement.  It is ignored otherwise.

Used to indicate that the data model node
represents a sensitive security system parameter.

If present, and the NACM module is enabled (i.e.,
/nacm/enable-nacm object equals 'true'), the NETCONF server
will only allow the designated 'recovery session' to have
write access to the node.  An explicit access control rule is
required for all other users.

The 'default-deny-write' extension MAY appear within a data
definition statement.  It is ignored otherwise.

Used within a CLI container or rpc definition to specify a
leaf parameter within the CLI container or rpc input
section, that is used as the default if no parameter name
is entered.

These values must not begin with a dash (-) or
double dash (--) sequence or they will be mistaken
for CLI parameter names.

This option is somewhat risky because any unrecognized
parameter without any prefix (- or --) will be tried
as the default parameter type, instead of catching
the unknown parameter error.  It can also be useful though,
for assigning file name parameters through shell expansion,
or if there is only one parameter.

Used within a CLI container or rpc definition to specify a
leaf parameter within the CLI container or rpc input
section, that is used as the default if no parameter name
is entered.

This can be used in addition to ncx:default-parm to
allow an equals sign '=' in the default parm string value.

This option is quite risky because any unrecognized
parameter without any prefix (- or --) will be tried
as the default parameter type, instead of catching
the unknown parameter error.  This includes strings containing
an equals sign, so an unknown parameter error will never
be generated.

     rpc foo {
       input {
	 ncx:default-parm a;
	 ncx:default-parm-equals-ok;
	 leaf a { type string; }
	 leaf b { type int32; }
       }
     }

     yangcli> foo bogus-parm=fred

This will interpreted as if parameter 'a' were entered:

     yangcli> foo a='bogus-parm=fred'

DISPLAY-HINT value provided in a TEXTUAL-CONVENTION macro.

DISPLAY-HINT value provided in a TEXTUAL-CONVENTION macro.

If this extension is present within the
an 'anyxml' statement named 'filter', which must be
conceptually defined within the RPC input section
for the 'get' and 'get-config' protocol operations,
then the following unqualified XML attribute is
supported within the 'filter' element, within
a 'get' or 'get-config' protocol operation:

  type : optional attribute with allowed
	 value strings 'subtree' and 'xpath'.
	 If missing, the default value is 'subtree'.

If the 'xpath' feature is supported, then the
following unqualified XML attribute is
also supported:

  select: optional attribute containing a
	  string representing an XPath expression.
	  The 'type' attribute must be equal to 'xpath'
	  if this attribute is present.

If this extension is present within the
an 'anyxml' statement named 'filter', which must be
conceptually defined within the RPC input section
for the 'get' and 'get-config' RPC operations,
then the following unqualified XML attribute is
supported within the 'filter' element, within
a 'get' or 'get-config' protocol operation:

  type : optional attribute with allowed
	 value strings 'subtree' and 'xpath'.
	 If missing, the default value is 'subtree'.

If the 'xpath' feature is supported, then the
following unqualified XML attribute is
also supported:

  select: optional attribute containing a
	  string representing an XPath expression.
	  The 'type' attribute must be equal to 'xpath'
	  if this attribute is present.

Used to prevent publication of a YANG data object.
Will be ignored for typedefs and other constructs.
If present, that node and any sub-nodes will be ignored
when generating HTML documentation or cYANG output.

The yangdump -f=copy mode will not be affected by
this extension. 

MAX-ACCESS value provided in an OBJECT-TYPE macro.

Used to define an XML attribute to be associated with a
data-def-stmt node.  Only optional metadata can be
defined.  Errors for missing XML attributes (except
as specified by the YANG language) will not be
checked automatically.

The syntax string has the following format:

   [prefix:]typename  attribute-name

Any YANG typedef of builtin type can be specified as
the type name, except 'empty'.

Example from get command in netconf.yang:
   ncx:metadata 'FilterType type';   

Used to indicate that no duplicate values are allowed
in an ncx:xsdlist leaf or leaf-list object.

OBJECT IDENTIFIER value assigned to a particular node.

OBJECT IDENTIFIER value assigned to a particular node.

Used to indicate the data type for the leaf is really
a password.  Only the encrypted version of the password
is allowed to be generated in any output.

Used to indicate that the content of a data type
is a Qualified Name.  This is needed to properly
evaluate the namespace prefix, if used.

The qname extension may appear within the type-stmt,
within a typedef, leaf, or leaf-list.  The builtin
data type must be 'string', or the 'qname' extension
will be ignored.

Used within a container definition to indicate it is
really a root container for a conceptual NETCONF database,
instead of just an empty container.  This is needed
for yuma to correctly process any RPC method
that contains a 'config' parameter.

Used to indicate that the typedef or type statement
for a string data type really identifies a
special schema-instance node, not a generic string.

A schema-instance value string is an unrestricted YANG
instance-identifier expression.  All the same rules
as an instance-identifier apply except:

    * predicates for keys are optional;
      The dataRule will apply to all instances
      of any missing key leaf predicate.

This extension will be ignored unless it is present
in the type-stmt of a typedef-stmt, leaf-stmt,
or leaf-list-stmt, or directly within a leaf-stmt or
leaf-list-stmt.

Used to indicate that the data model node
represents a sensitive security system parameter.

If present, the NETCONF server will only allow
the designated 'superuser' to have write or execute
default nacm-rights for the node.  An explicit access
control rule is required for all other users.

The 'secure' extension may appear within a data, rpc,
or notification node definition.  It is ignored
otherwise.

Used within a container or list definition to indicate
that the SIL callbacks for descendant nodes should
be invoked first, when a data node instance of
the object containing this extension is deleted.

Normally, the parent node is expected to delete all its
own sub-structures when the SIL edit callback is
invoked.  If this extension is present, then any
SIL callbacks for any of the child nodes will be
invoked first instead.

If a child node is a list or a container, and
it also contains an 'ncx:sil-delete-children-first'
extension, then its children will be checked first.

The SIL edit callback will not be invoked for leaf,
leaf-list, or anyxml descendant nodes in this mode.
They will only will called if their parent node
is not getting deleted.

  container foo {
    ncx:sil-delete-children-first;
    list foos {
      ncx:sil-delete-children-first;
      key a;
      leaf a { type string; }
      container b {
	list c { ... }
      }
      leaf d { type empty; }
    }
  }

In this example, assume node /foo gets deleted.
Then the SIL edit callbacks would be done as follows:

1) /foo/foos[a='n']/b   (called for row 'n' of /foo/foos)
2) /foo/foos[a='n']     (called for row 'n' of /foo/foos)
3) repeat (1,2) until all rows in /foo/foos are deleted
4) /foo

Note that the SIL edit callback is not done for list
/foo/foos[a='n']/b/c because this extension is
not present in container '/foo/foos/b'.

Note that the SIL edit callback is not done for
nodes /foo/foos[a='n']/a or /foo/foos[a='n']/d because
they are leafs.

Used within database configuration data definition
statements to control user write access to the
database object containing this statement.

The 'permitted' argument is a list of operations
that users are permitted to invoke for the specified node.
These permissions will over-ride all NACM access control rules,
even if NACM is disabled.

This extension does not apply to descendant nodes!
This extension has no effect if config-stmt is false!

The following values are supported:

  * create : allow users to create instances of the object
  * update : allow users to modify instances of the object
  * delete : allow users to delete instances of the object

To dis-allow all user access, provide an empty string
for the 'permitted' parameter (user-write '';)

To allow only create and delete user access, provide
the string 'create delete' for the 'permitted' parameter.
Use this for parameters that cannot be changed once they
are set.

Providing all 3 parameters has the same affect as not using
this extension at all, but can be used anyway.

leaf user-write {
  description 'equivalent YANG definition';
  type bits {
   bit create;
   bit update;
   bit delete;
 }
 default 'create update delete';
}

Used to indicate that the data model node
controls a very sensitive security system parameter.

If present, the NETCONF server will only allow
the designated 'superuser' to have read, write, or execute
default nacm-rights for the node.  An explicit access
control rule is required for all other users.

The 'very-secure' extension may appear within a data, rpc,
or notification node definition.  It is ignored
otherwise.

Used to indicate that the content of a data type
is an XPath expression.  This is needed to properly
evaluate the namespace prefixes within the expression.

The xpath extension may appear within the type-stmt,
within a typedef, leaf, or leaf-list.  The builtin
data type must be 'string', or the 'xpath' extension
will be ignored.

All data using the 'instance-identifier' built-in type
will automatically be processed as an XPath string,
so the xpath extension is not needed in that case.

Used to indicate the leaf string type is really an
XSD list, which is a series of whitespace separated
strings. The type argument represents the data type
to use for the list members, for validation purposes.

Allowed to be present within the type sub-section
for a string.