An HTTPS-based Transport for Configured Subscriptions

Subscription to YANG Notifications defines a YANG data module for configuring subscribed notifications. It defines a "subscriptions" container that contains a list of receivers, but it defers the configuration and management of those receivers to other documents. This document defines two YANG 1.1 data modules, one for augmenting the Subscription to YANG Notifications to add a transport type, and another for configuring and managing HTTPS based receivers for the notifications. The first module allows for different transports to be configured for the same receiver instance. The second module describes how to enable the transmission of YANG modeled notifications, in the configured encoding (i.e., XML, JSON) over HTTPS. Notifications are delivered in the form of a HTTPS POST. The use of HTTPS maximizes transport-level interoperability, while the encoding selection pivots between implementation simplicity (XML, JSON) and throughput (text versus binary). Configured subscriptions enable a server, acting as a publisher of notifications, to proactively push notifications to external receivers without the receivers needing to first connect to the server, as is the case with dynamic subscriptions.

While the YANG modules have been defined as an augmentation of Subscription to YANG Notifications, the notification method defined in this document MAY be used outside of Subscription to YANG Notifications by using some of the definitions from this module along with the grouping defined in Groupings for HTTP Clients and Servers. For an example on how that can be done, see Section 8.2.

This document uses several placeholder values throughout the document. Please replace them as follows and remove this section before publication. RFC XXXX, where XXXX is the number assigned to this document at the time of publication. 2020-10-21 with the actual date of the publication of this document.

Acronym Expansion HTTP Hyper Text Transport Protocol HTTPS Hyper Text Transport Protocol Secure TCP Transmission Control Protocol TLS Transport Layer Security

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The following terms are defined in Subscription to YANG Notifications. Subscribed Notifications

The interaction between the receiver and the publisher can be of type "pipelining" or send multiple notifications as part of a "bundled-message", as defined in Notification Message Headers and Bundles

In the case of "pipelining", the flow of messages would look something like this. This example shows the flow assuming that Subscribed Notifications is used and therefore a <subscription-started> notification is sent before sending the first notification. The example would be the same for when Subscribed Notification is not used by removing the first POST message for <susbscription-started>.

Establish TLS ------> Send HTTPS POST message with started> notification Send 200 (OK) for <------ Send HTTPS POST message with YANG defined ------> notification #1 Send HTTPS POST message with YANG defined ------> notification #2 Send 204 (No Content) <------ for notification #1 Send 204 (No Content) <------ for notification #2 Send HTTPS POST message with YANG defined -------> notification #3 Send 204 (No Content) <------ for notification #3]]> The content of the exchange would look something like this.

2019-03-22T12:35:00Z ... 2019-03-22T12:35:00Z ... 2019-03-22T12:35:01Z ... Response: HTTP/1.1 204 No Content Date: Fri, 03 Mar 2019 12:35:00 GMT Server: my-receiver.my-domain.com HTTP/1.1 204 No Content Date: Fri, 03 Mar 2019 12:35:00 GMT Server: my-receiver.my-domain.com HTTP/1.1 204 No Content Date: Fri, 03 Mar 2019 12:35:01 GMT Server: my-receiver.my-domain.com]]>

To learn the capabilities of the receiver, the publisher can issue a HTTPS GET request with Accept-Type set to application/ietf-https-notif-cap+xml or application/ietf-https-notif-cap+json, with latter as the mandatory to implement, and the default in case the type is not specified. If the receiver supports capabilities such as binary encoding of data, it can return that as a capability in a response. Please note that, when used in conjunction with Subscription to YANG Notifications, dynamic discovery of the receiver’s supported encoding is considered only when the "/subscriptions/subscription/encoding” leaf is not configured, per the “encoding” leaf’s description statement.

The publisher can send the following request to learn the receiver capabilities. The Accept-Type states its preferred order for Content-Type that it wants to receive starting with XML, and if not supported, to use JSON encoding. Currently, there is only one capability of binary encoding defined.

In case the receiver supports the first Accept-Type, its response should look like this:

]]>

This YANG module augments ietf-subscribed-notifications module to define a choice of transport types that other modules such as the ietf-https-notif module can use to define a transport specific receiver.

file "ietf-sub-notif-recv-list@2020-10-21.yang" module ietf-sub-notif-recv-list { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-sub-notif-recv-list"; prefix "snrl"; import ietf-subscribed-notifications { prefix sn; reference "I-D.ietf-netconf-subscribed-notifications"; } organization "IETF NETCONF Working Group"; contact "WG Web: WG List: Authors: Mahesh Jethanandani (mjethanandani at gmail dot com) Kent Watsen (kent plus ietf at watsen dot net)"; description "YANG module for augmenting Subscribed Notifications to add a transport type. Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here."; revision "2020-10-21" { description "Initial Version."; reference "RFC XXXX, YANG Data Module for HTTPS Notifications."; } augment "/sn:subscriptions" { container receiver-instances { description "A container for all instances of receivers."; list receiver-instance { key "name"; leaf name { type string; description "An arbitrary but unique name for this receiver instance."; } choice transport-type { mandatory true; description "Choice of different types of transports used to send notifications."; } description "A list of all receiver instances."; } } description "Augment the subscriptions container to define the transport type."; } augment "/sn:subscriptions/sn:subscription/sn:receivers/sn:receiver" { leaf receiver-instance-ref { type leafref { path "/sn:subscriptions/snrl:receiver-instances/" + "snrl:receiver-instance/snrl:name"; } description "Reference to a receiver instance."; } description "Augment the subscriptions container to define an optional reference to a receiver instance."; } }

]]>



    
      
        This YANG module is a definition of a set of receivers that are
        interested in the notifications published by the publisher. The module
        contains the TCP, TLS and HTTPS parameters that are needed to
        communicate with the receiver. The module augments the
        ietf-sub-notif-recv-list module to define a transport specific
        receiver. As mentioned earlier, it uses POST method to deliver the
        notification. The attribute 'path' defines the path for the resource
        on the receiver, as defined by 'path-absolute' in URI Generic Syntax. The user-id used by Network Configuration Access Control Model, is
        that of the receiver and is derived from the certificate presented by
        the receiver as part of 'receiver-identity'.

        An abridged tree diagram representing the module is shown
        below.

        
          
        
      

      
        The YANG module imports Common YANG Data
        Types, A YANG Data Model for SNMP
        Configuration, JSON Encoding of Data
        Modeled with YANG, and Subscription to
        YANG Notifications.

        The YANG module is shown below.

        
           file "ietf-https-notif@2020-10-21.yang"
module ietf-https-notif {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-https-notif";
  prefix "hn";

  import ietf-subscribed-notifications {
    prefix sn;
    reference
      "I-D.ietf-netconf-subscribed-notifications";
  }

  import ietf-http-client {
    prefix httpc;

    reference
      "I-D.ietf-netconf-http-client-server";
  }

  import ietf-sub-notif-recv-list {
    prefix snrl;

    reference
      "RFC XXXX, YANG Data Module for HTTPS Notifications.";
  }

  import ietf-x509-cert-to-name {
    prefix x509c2n;

    reference
      "RFC 7407: YANG Data Model for SNMP Configuration.";
  }
  
  organization
    "IETF NETCONF Working Group";

  contact
    "WG Web:   
     WG List:  

     Authors: Mahesh Jethanandani (mjethanandani at gmail dot com)
              Kent Watsen (kent plus ietf at watsen dot net)";
  description
    "YANG module for configuring HTTPS base configuration.

     Copyright (c) 2018 IETF Trust and the persons identified as
     the document authors.  All rights reserved.
     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject
     to the license terms contained in, the Simplified BSD
     License set forth in Section 4.c of the IETF Trust's Legal
     Provisions Relating to IETF Documents
     (http://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC XXXX; see
     the RFC itself for full legal notices.

     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
     NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
     'MAY', and 'OPTIONAL' in this document are to be interpreted as
     described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
     they appear in all capitals, as shown here.";

  revision "2020-10-21" {
    description
      "Initial Version.";
    reference
      "RFC XXXX, YANG Data Module for HTTPS Notifications.";
  }

  identity https {
    base sn:transport;
    description
      "HTTPS transport for notifications.";
  }

  augment "/sn:subscriptions/snrl:receiver-instances/" +
          "snrl:receiver-instance/snrl:transport-type" {
    case https {
      container https-receiver {
	description
	  "HTTPS receiver for notification";

	uses httpc:http-client-stack-grouping {
	  refine "transport/tcp" {
	    // create the logical impossibility of enabling "tcp"
	    // transport
	    if-feature "not httpc:tcp-supported";
	  }
	  augment "transport/tls/tls/http-client-parameters" {
	    leaf path {
	      type string;
	      description
		"Relative URI to the target resource.";
	    }
	    description
	      "Augmentation to add a path to the target resource.";
	  }
	}

        container receiver-identity {
          description
            "Specifies mechanism for identifying the receiver.
             The publisher MUST NOT include any content in a
             notification that the user is not authorized to view.";

          container cert-maps {
            uses x509c2n:cert-to-name;
            description
              "The cert-maps container is used by a TLS-based HTTP
               server to map the HTTPS client's presented X.509
               certificate to a 'local' username. If no matching and
               valid cert-to-name list entry is found, the publisher
               MUST close the connection, and MUST NOT
               not send any notifications over it.";
            reference
              "RFC 7407: A YANG Data Model for SNMP Configuration.";
          }
	}
      }
    }
    description
      "Augment the transport-type choice to define this transport.";
  }
}


]]>
        

      

    


    
      The YANG module specified in this document defines a schema for data
      that is designed to be accessed via network management protocols such as
      NETCONF or RESTCONF. The lowest NETCONF layer is the secure
      transport layer, and the mandatory-to-implement secure transport is
      Secure Shell (SSH). The lowest RESTCONF
      layer is HTTPS, and the mandatory-to-implement secure transport is TLS. The NETCONF Access
      Control Model (NACM)  provides the means to restrict access for
      particular NETCONF or RESTCONF users to a preconfigured subset of all
      available NETCONF or RESTCONF protocol operations and content.

      There are a number of data nodes defined in this YANG module that are
      writable/creatable/deletable (i.e., config true, which is the default).
      These data nodes may be considered sensitive or vulnerable in some
      network environments. Write operations (e.g., edit-config) to these data
      nodes without proper protection can have a negative effect on network
      operations. These are the subtrees and data nodes and their
      sensitivity/vulnerability:

      Some of the readable data nodes in this YANG module may be considered
      sensitive or vulnerable in some network environments. It is thus
      important to control read access (e.g., via get, get-config, or
      notification) to these data nodes. These are the subtrees and data nodes
      and their sensitivity/vulnerability:

      Some of the RPC operations in this YANG module may be considered
      sensitive or vulnerable in some network environments. It is thus
      important to control access to these operations. These are the
      operations and their sensitivity/vulnerability:
    

    
      Notifications are encoded as defined in RESTCONF  Section 6.4. The examples in that
      section apply for sending notifications over the "https-notif" based
      transport.

      An example of YANG-Push in JSON would look something like this:

      
          
        

      An example of YANG-Push in XML would look something like this:

      
        
     data:  2017-10-25T08:00:11.22Z
     data:  
     data:   1011
     data:   
     data:     
     data:      
     data:       eth0
     data:        up
     data:       
     data:      
     data:      state
     data:      
     data:       Ethernet0
     data:      
     data:      minor
     data:    
     data:   
     data:  
]]>
      
    

    
      This document registers two URI, two YANG module and two Media
      Types.

      
        in the IETF XML registry. Following
        the format in RFC 3688, the following registration is requested to be
        made: 
            
          

        Registrant Contact: The IESG. XML: N/A, the requested URI is an XML
        namespace.
      

      
        This document registers one YANG module in the YANG Module Names
        registry YANG.

        
            
          
      

      
        
          
              
            
        

        
          
              
            
        
      
    

    
      This section shows some examples in how the module can be used.

      
        This example shows how a HTTPS client can be configured to send
        notifications to a receiver at address 192.0.2.1, port 443, a 'path',
        with server certificates, and the corresponding trust store that is
        used to authenticate a connection.

        
            

  
    
      
	foo
	
	  
	    
	      my-receiver.my-domain.com
	      443
	    
	    
	      
		
		  
		    
		      Server Cert Issuer #1
		      base64encodedvalue==
		    
		  
		
	      
	    
	    
              
		
		  my-name
		  my-password
		
              
              /some/path
	    
	  
	  
            
	      
		1
		11:0A:05:11:00
		x509c2n:san-any
	      
            
	  
	
      
    
    
      6666
      
	hn:https
      
      foo
      some-stream
      
	
	  my-receiver
	  \
foo
	
      
    
  
  
  
    
      
	explicitly-trusted-server-ca-certs
	
          Trust anchors (i.e. CA certs) that are used to authenticat\
e
          server connections.  Servers are authenticated if their
          certificate has a chain of trust to one of these CA
          certificates.
	
	
          ca.example.com
          base64encodedvalue==
	
	
          Fred Flintstone
          base64encodedvalue==
	
      
    
  


]]>
          
      

      
        In the case that it is desired to use HTTPS notif outside of
        Subscribed Notifications, there would have to be a module to define
        the configuration for where and how to send the notification, such as
        the following:

        
            
          

        This example shows how a HTTPS client can be configured to send
        notifications to a receiver at address 192.0.2.1, port 443, a 'path',
        with server certificates, and the corresponding trust store that is
        used to authenticate a connection.

        
            

  
    
      
	foo
	
	  
	    my-receiver.my-domain.com
	    443
	  
	  
	    
	      
		
		  
		    Server Cert Issuer #1
		    base64encodedvalue==
		  
		
	      
	    
	  
	  
            
	      
		my-name
		my-password
	      
            
            /some/path
	  
	
      
    
  
  
  
    
      
	explicitly-trusted-server-ca-certs
	
          Trust anchors (i.e. CA certs) that are used to authenticat\
e
          server connections.  Servers are authenticated if their
          certificate has a chain of trust to one of these CA
          certificates.
	
	
          ca.example.com
          base64encodedvalue==
	
	
          Fred Flintstone
          base64encodedvalue==
	
      
    
  


]]>
          
      

      
        In the case of "bundled-message" as defined in Notification Message
        Headers and Bundles, something that this module supports, the
        flow of messages would look something like this.

        
            
       Establish TLS             ------>
       Send HTTPS POST message
       with YANG defined         ------>
       notification #1
       Send HTTPS POST message
       with YANG defined         ------>
       notification #2
                                                   Send 204 (No Content)
                                 <------           for notification #1

                                                   Send 204 (No Content)
                                 <------           for notification #2
       Send HTTPS POST message
       with YANG defined         ------->
       notification #3
                                                   Send 204 (No Content)
                                 <------           for notification #3]]>
          

        The content of the exchange would look something like this.

        
          
      2019-03-22T12:35:00Z
      
        ...
      
    
    
      2019-03-22T12:35:00Z
      
        ...
      
    
    
      2019-03-22T12:35:01Z
      
        ...
      
    
Response:
      HTTP/1.1 204 No Content
      Date: Fri, 03 Mar 2019 12:35:00 GMT
      Server: my-receiver.my-domain.com
      HTTP/1.1 204 No Content
      Date: Fri, 03 Mar 2019 12:35:00 GMT
      Server: my-receiver.my-domain.com
      HTTP/1.1 204 No Content
      Date: Fri, 03 Mar 2019 12:35:01 GMT
      Server: my-receiver.my-domain.com]]>