/* autogenerated by embedmodel.py.  DO NOT EDIT */

#include <zebra.h>
#include "yang.h"

static const char model[] =
	"// SPDX-License-Identifier: BSD-3-Clause\n"
	"module ietf-netconf-acm {\n"
	"\n"
	"  namespace \"urn:ietf:params:xml:ns:yang:ietf-netconf-acm\";\n"
	"\n"
	"  prefix nacm;\n"
	"\n"
	"  import ietf-yang-types {\n"
	"    prefix yang;\n"
	"  }\n"
	"\n"
	"  organization\n"
	"    \"IETF NETCONF (Network Configuration) Working Group\";\n"
	"\n"
	"  contact\n"
	"    \"WG Web:   <https://datatracker.ietf.org/wg/netconf/>\n"
	"     WG List:  <mailto:netconf@ietf.org>\n"
	"\n"
	"     Author:   Andy Bierman\n"
	"               <mailto:andy@yumaworks.com>\n"
	"\n"
	"     Author:   Martin Bjorklund\n"
	"               <mailto:mbj@tail-f.com>\";\n"
	"\n"
	"  description\n"
	"    \"Network Configuration Access Control Model.\n"
	"\n"
	"     Copyright (c) 2012 - 2018 IETF Trust and the persons\n"
	"     identified as authors of the code.  All rights reserved.\n"
	"\n"
	"     Redistribution and use in source and binary forms, with or\n"
	"     without modification, is permitted pursuant to, and subject\n"
	"     to the license terms contained in, the Simplified BSD\n"
	"     License set forth in Section 4.c of the IETF Trust\'s\n"
	"     Legal Provisions Relating to IETF Documents\n"
	"     (https://trustee.ietf.org/license-info).\n"
	"\n"
	"     This version of this YANG module is part of RFC 8341; see\n"
	"     the RFC itself for full legal notices.\";\n"
	"\n"
	"  revision 2018-02-14 {\n"
	"    description\n"
	"      \"Added support for YANG 1.1 actions and notifications tied to\n"
	"       data nodes.  Clarified how NACM extensions can be used by\n"
	"       other data models.\";\n"
	"    reference\n"
	"      \"RFC 8341: Network Configuration Access Control Model\";\n"
	"  }\n"
	"\n"
	"  revision 2012-02-22 {\n"
	"    description\n"
	"      \"Initial version.\";\n"
	"    reference\n"
	"      \"RFC 6536: Network Configuration Protocol (NETCONF)\n"
	"                 Access Control Model\";\n"
	"  }\n"
	"\n"
	"  /*\n"
	"   * Extension statements\n"
	"   */\n"
	"\n"
	"  extension default-deny-write {\n"
	"    description\n"
	"      \"Used to indicate that the data model node\n"
	"       represents a sensitive security system parameter.\n"
	"\n"
	"       If present, the NETCONF server will only allow the designated\n"
	"       \'recovery session\' to have write access to the node.  An\n"
	"       explicit access control rule is required for all other users.\n"
	"\n"
	"       If the NACM module is used, then it must be enabled (i.e.,\n"
	"       /nacm/enable-nacm object equals \'true\'), or this extension\n"
	"       is ignored.\n"
	"\n"
	"       The \'default-deny-write\' extension MAY appear within a data\n"
	"       definition statement.  It is ignored otherwise.\";\n"
	"  }\n"
	"\n"
	"  extension default-deny-all {\n"
	"    description\n"
	"      \"Used to indicate that the data model node\n"
	"       controls a very sensitive security system parameter.\n"
	"\n"
	"       If present, the NETCONF server will only allow the designated\n"
	"       \'recovery session\' to have read, write, or execute access to\n"
	"       the node.  An explicit access control rule is required for all\n"
	"       other users.\n"
	"\n"
	"       If the NACM module is used, then it must be enabled (i.e.,\n"
	"       /nacm/enable-nacm object equals \'true\'), or this extension\n"
	"       is ignored.\n"
	"\n"
	"       The \'default-deny-all\' extension MAY appear within a data\n"
	"       definition statement, \'rpc\' statement, or \'notification\'\n"
	"       statement.  It is ignored otherwise.\";\n"
	"  }\n"
	"\n"
	"  /*\n"
	"   * Derived types\n"
	"   */\n"
	"\n"
	"  typedef user-name-type {\n"
	"    type string {\n"
	"      length \"1..max\";\n"
	"    }\n"
	"    description\n"
	"      \"General-purpose username string.\";\n"
	"  }\n"
	"\n"
	"  typedef matchall-string-type {\n"
	"    type string {\n"
	"      pattern \'\\*\';\n"
	"    }\n"
	"    description\n"
	"      \"The string containing a single asterisk \'*\' is used\n"
	"       to conceptually represent all possible values\n"
	"       for the particular leaf using this data type.\";\n"
	"  }\n"
	"\n"
	"  typedef access-operations-type {\n"
	"    type bits {\n"
	"      bit create {\n"
	"        description\n"
	"          \"Any protocol operation that creates a\n"
	"           new data node.\";\n"
	"      }\n"
	"      bit read {\n"
	"        description\n"
	"          \"Any protocol operation or notification that\n"
	"           returns the value of a data node.\";\n"
	"      }\n"
	"      bit update {\n"
	"        description\n"
	"          \"Any protocol operation that alters an existing\n"
	"           data node.\";\n"
	"      }\n"
	"      bit delete {\n"
	"        description\n"
	"          \"Any protocol operation that removes a data node.\";\n"
	"      }\n"
	"      bit exec {\n"
	"        description\n"
	"          \"Execution access to the specified protocol operation.\";\n"
	"      }\n"
	"    }\n"
	"    description\n"
	"      \"Access operation.\";\n"
	"  }\n"
	"\n"
	"  typedef group-name-type {\n"
	"    type string {\n"
	"      length \"1..max\";\n"
	"      pattern \'[^\\*].*\';\n"
	"    }\n"
	"    description\n"
	"      \"Name of administrative group to which\n"
	"       users can be assigned.\";\n"
	"  }\n"
	"\n"
	"  typedef action-type {\n"
	"    type enumeration {\n"
	"      enum permit {\n"
	"        description\n"
	"          \"Requested action is permitted.\";\n"
	"      }\n"
	"      enum deny {\n"
	"        description\n"
	"          \"Requested action is denied.\";\n"
	"      }\n"
	"    }\n"
	"    description\n"
	"      \"Action taken by the server when a particular\n"
	"       rule matches.\";\n"
	"  }\n"
	"\n"
	"  typedef node-instance-identifier {\n"
	"    type yang:xpath1.0;\n"
	"    description\n"
	"      \"Path expression used to represent a special\n"
	"       data node, action, or notification instance-identifier\n"
	"       string.\n"
	"\n"
	"       A node-instance-identifier value is an\n"
	"       unrestricted YANG instance-identifier expression.\n"
	"       All the same rules as an instance-identifier apply,\n"
	"       except that predicates for keys are optional.  If a key\n"
	"       predicate is missing, then the node-instance-identifier\n"
	"       represents all possible server instances for that key.\n"
	"\n"
	"       This XML Path Language (XPath) expression is evaluated in the\n"
	"       following context:\n"
	"\n"
	"          o  The set of namespace declarations are those in scope on\n"
	"             the leaf element where this type is used.\n"
	"\n"
	"          o  The set of variable bindings contains one variable,\n"
	"             \'USER\', which contains the name of the user of the\n"
	"             current session.\n"
	"\n"
	"          o  The function library is the core function library, but\n"
	"             note that due to the syntax restrictions of an\n"
	"             instance-identifier, no functions are allowed.\n"
	"\n"
	"          o  The context node is the root node in the data tree.\n"
	"\n"
	"       The accessible tree includes actions and notifications tied\n"
	"       to data nodes.\";\n"
	"  }\n"
	"\n"
	"  /*\n"
	"   * Data definition statements\n"
	"   */\n"
	"\n"
	"  container nacm {\n"
	"    nacm:default-deny-all;\n"
	"\n"
	"    description\n"
	"      \"Parameters for NETCONF access control model.\";\n"
	"\n"
	"    leaf enable-nacm {\n"
	"      type boolean;\n"
	"      default \"true\";\n"
	"      description\n"
	"        \"Enables or disables all NETCONF access control\n"
	"         enforcement.  If \'true\', then enforcement\n"
	"         is enabled.  If \'false\', then enforcement\n"
	"         is disabled.\";\n"
	"    }\n"
	"\n"
	"    leaf read-default {\n"
	"      type action-type;\n"
	"      default \"permit\";\n"
	"      description\n"
	"        \"Controls whether read access is granted if\n"
	"         no appropriate rule is found for a\n"
	"         particular read request.\";\n"
	"    }\n"
	"\n"
	"    leaf write-default {\n"
	"      type action-type;\n"
	"      default \"deny\";\n"
	"      description\n"
	"        \"Controls whether create, update, or delete access\n"
	"         is granted if no appropriate rule is found for a\n"
	"         particular write request.\";\n"
	"    }\n"
	"\n"
	"    leaf exec-default {\n"
	"      type action-type;\n"
	"      default \"permit\";\n"
	"      description\n"
	"        \"Controls whether exec access is granted if no appropriate\n"
	"         rule is found for a particular protocol operation request.\";\n"
	"    }\n"
	"\n"
	"    leaf enable-external-groups {\n"
	"      type boolean;\n"
	"      default \"true\";\n"
	"      description\n"
	"        \"Controls whether the server uses the groups reported by the\n"
	"         NETCONF transport layer when it assigns the user to a set of\n"
	"         NACM groups.  If this leaf has the value \'false\', any group\n"
	"         names reported by the transport layer are ignored by the\n"
	"         server.\";\n"
	"    }\n"
	"\n"
	"    leaf denied-operations {\n"
	"      type yang:zero-based-counter32;\n"
	"      config false;\n"
	"      mandatory true;\n"
	"      description\n"
	"        \"Number of times since the server last restarted that a\n"
	"         protocol operation request was denied.\";\n"
	"    }\n"
	"\n"
	"    leaf denied-data-writes {\n"
	"      type yang:zero-based-counter32;\n"
	"      config false;\n"
	"      mandatory true;\n"
	"      description\n"
	"        \"Number of times since the server last restarted that a\n"
	"         protocol operation request to alter\n"
	"         a configuration datastore was denied.\";\n"
	"    }\n"
	"\n"
	"    leaf denied-notifications {\n"
	"      type yang:zero-based-counter32;\n"
	"      config false;\n"
	"      mandatory true;\n"
	"      description\n"
	"        \"Number of times since the server last restarted that\n"
	"         a notification was dropped for a subscription because\n"
	"         access to the event type was denied.\";\n"
	"    }\n"
	"\n"
	"    container groups {\n"
	"      description\n"
	"        \"NETCONF access control groups.\";\n"
	"\n"
	"      list group {\n"
	"        key name;\n"
	"\n"
	"        description\n"
	"          \"One NACM group entry.  This list will only contain\n"
	"           configured entries, not any entries learned from\n"
	"           any transport protocols.\";\n"
	"\n"
	"        leaf name {\n"
	"          type group-name-type;\n"
	"          description\n"
	"            \"Group name associated with this entry.\";\n"
	"        }\n"
	"\n"
	"        leaf-list user-name {\n"
	"          type user-name-type;\n"
	"          description\n"
	"            \"Each entry identifies the username of\n"
	"             a member of the group associated with\n"
	"             this entry.\";\n"
	"        }\n"
	"      }\n"
	"    }\n"
	"\n"
	"    list rule-list {\n"
	"      key name;\n"
	"      ordered-by user;\n"
	"      description\n"
	"        \"An ordered collection of access control rules.\";\n"
	"\n"
	"      leaf name {\n"
	"        type string {\n"
	"          length \"1..max\";\n"
	"        }\n"
	"        description\n"
	"          \"Arbitrary name assigned to the rule-list.\";\n"
	"      }\n"
	"      leaf-list group {\n"
	"        type union {\n"
	"          type matchall-string-type;\n"
	"          type group-name-type;\n"
	"        }\n"
	"        description\n"
	"          \"List of administrative groups that will be\n"
	"           assigned the associated access rights\n"
	"           defined by the \'rule\' list.\n"
	"\n"
	"           The string \'*\' indicates that all groups apply to the\n"
	"           entry.\";\n"
	"      }\n"
	"\n"
	"      list rule {\n"
	"        key name;\n"
	"        ordered-by user;\n"
	"        description\n"
	"          \"One access control rule.\n"
	"\n"
	"           Rules are processed in user-defined order until a match is\n"
	"           found.  A rule matches if \'module-name\', \'rule-type\', and\n"
	"           \'access-operations\' match the request.  If a rule\n"
	"           matches, the \'action\' leaf determines whether or not\n"
	"           access is granted.\";\n"
	"\n"
	"        leaf name {\n"
	"          type string {\n"
	"            length \"1..max\";\n"
	"          }\n"
	"          description\n"
	"            \"Arbitrary name assigned to the rule.\";\n"
	"        }\n"
	"\n"
	"        leaf module-name {\n"
	"          type union {\n"
	"            type matchall-string-type;\n"
	"            type string;\n"
	"          }\n"
	"          default \"*\";\n"
	"          description\n"
	"            \"Name of the module associated with this rule.\n"
	"\n"
	"             This leaf matches if it has the value \'*\' or if the\n"
	"             object being accessed is defined in the module with the\n"
	"             specified module name.\";\n"
	"        }\n"
	"        choice rule-type {\n"
	"          description\n"
	"            \"This choice matches if all leafs present in the rule\n"
	"             match the request.  If no leafs are present, the\n"
	"             choice matches all requests.\";\n"
	"          case protocol-operation {\n"
	"            leaf rpc-name {\n"
	"              type union {\n"
	"                type matchall-string-type;\n"
	"                type string;\n"
	"              }\n"
	"              description\n"
	"                \"This leaf matches if it has the value \'*\' or if\n"
	"                 its value equals the requested protocol operation\n"
	"                 name.\";\n"
	"            }\n"
	"          }\n"
	"          case notification {\n"
	"            leaf notification-name {\n"
	"              type union {\n"
	"                type matchall-string-type;\n"
	"                type string;\n"
	"              }\n"
	"              description\n"
	"                \"This leaf matches if it has the value \'*\' or if its\n"
	"                 value equals the requested notification name.\";\n"
	"            }\n"
	"          }\n"
	"\n"
	"          case data-node {\n"
	"            leaf path {\n"
	"              type node-instance-identifier;\n"
	"              mandatory true;\n"
	"              description\n"
	"                \"Data node instance-identifier associated with the\n"
	"                 data node, action, or notification controlled by\n"
	"                 this rule.\n"
	"\n"
	"                 Configuration data or state data\n"
	"                 instance-identifiers start with a top-level\n"
	"                 data node.  A complete instance-identifier is\n"
	"                 required for this type of path value.\n"
	"\n"
	"                 The special value \'/\' refers to all possible\n"
	"                 datastore contents.\";\n"
	"            }\n"
	"          }\n"
	"        }\n"
	"\n"
	"        leaf access-operations {\n"
	"          type union {\n"
	"            type matchall-string-type;\n"
	"            type access-operations-type;\n"
	"          }\n"
	"          default \"*\";\n"
	"          description\n"
	"            \"Access operations associated with this rule.\n"
	"\n"
	"             This leaf matches if it has the value \'*\' or if the\n"
	"             bit corresponding to the requested operation is set.\";\n"
	"        }\n"
	"\n"
	"        leaf action {\n"
	"          type action-type;\n"
	"          mandatory true;\n"
	"          description\n"
	"            \"The access control action associated with the\n"
	"             rule.  If a rule has been determined to match a\n"
	"             particular request, then this object is used\n"
	"             to determine whether to permit or deny the\n"
	"             request.\";\n"
	"        }\n"
	"\n"
	"        leaf comment {\n"
	"          type string;\n"
	"          description\n"
	"            \"A textual description of the access rule.\";\n"
	"        }\n"
	"      }\n"
	"    }\n"
	"  }\n"
	"}\n"
	"";

static struct yang_module_embed embed = {
	.mod_name = "ietf-netconf-acm",
	.mod_rev = "2018-02-14",
	.sub_mod_name = "",
	.sub_mod_rev = "",
	.data = model,
	.format = LYS_IN_YANG,
};

static void embed_register(void) __attribute__((_CONSTRUCTOR(2000)));
static void embed_register(void)
{
	yang_module_embed(&embed);
}
