idnits 2.17.1
draft-ietf-netconf-netconf-client-server-12.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
https://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
No issues found here.
Miscellaneous warnings:
----------------------------------------------------------------------------
== The copyright year in the IETF Trust and authors Copyright Line does not
match the current year
== Line 1925 has weird spacing: '...address ine...'
== Line 1932 has weird spacing: '...nterval uin...'
== Line 2068 has weird spacing: '...address ine...'
== Line 2075 has weird spacing: '...nterval uin...'
== Line 2169 has weird spacing: '...address ine...'
== (12 more instances...)
-- The document date (April 29, 2019) is 1817 days in the past. Is this
intentional?
Checking references for intended status: Proposed Standard
----------------------------------------------------------------------------
(See RFCs 3967 and 4897 for information about using normative references
to lower-maturity documents in RFCs)
== Outdated reference: A later version (-35) exists of
draft-ietf-netconf-keystore-08
== Outdated reference: A later version (-40) exists of
draft-ietf-netconf-ssh-client-server-12
== Outdated reference: A later version (-41) exists of
draft-ietf-netconf-tls-client-server-11
== Outdated reference: A later version (-02) exists of
draft-kwatsen-netconf-tcp-client-server-01
== Outdated reference: A later version (-28) exists of
draft-ietf-netconf-trust-anchors-03
Summary: 0 errors (**), 0 flaws (~~), 12 warnings (==), 1 comment (--).
Run idnits with the --verbose option for more detailed information about
the items above.
--------------------------------------------------------------------------------
2 NETCONF Working Group K. Watsen
3 Internet-Draft Watsen Networks
4 Intended status: Standards Track April 29, 2019
5 Expires: October 31, 2019
7 NETCONF Client and Server Models
8 draft-ietf-netconf-netconf-client-server-12
10 Abstract
12 This document defines two YANG modules, one module to configure a
13 NETCONF client and the other module to configure a NETCONF server.
14 Both modules support both the SSH and TLS transport protocols, and
15 support both standard NETCONF and NETCONF Call Home connections.
17 Editorial Note (To be removed by RFC Editor)
19 This draft contains many placeholder values that need to be replaced
20 with finalized values at the time of publication. This note
21 summarizes all of the substitutions that are needed. No other RFC
22 Editor instructions are specified elsewhere in this document.
24 This document contains references to other drafts in progress, both
25 in the Normative References section, as well as in body text
26 throughout. Please update the following references to reflect their
27 final RFC assignments:
29 o I-D.ietf-netconf-keystore
31 o I-D.ietf-netconf-tcp-client-server
33 o I-D.ietf-netconf-ssh-client-server
35 o I-D.ietf-netconf-tls-client-server
37 Artwork in this document contains shorthand references to drafts in
38 progress. Please apply the following replacements:
40 o "XXXX" --> the assigned RFC value for this draft
42 o "AAAA" --> the assigned RFC value for I-D.ietf-netconf-tcp-client-
43 server
45 o "YYYY" --> the assigned RFC value for I-D.ietf-netconf-ssh-client-
46 server
48 o "ZZZZ" --> the assigned RFC value for I-D.ietf-netconf-tls-client-
49 server
51 Artwork in this document contains placeholder values for the date of
52 publication of this draft. Please apply the following replacement:
54 o "2019-04-29" --> the publication date of this draft
56 The following Appendix section is to be removed prior to publication:
58 o Appendix B. Change Log
60 Status of This Memo
62 This Internet-Draft is submitted in full conformance with the
63 provisions of BCP 78 and BCP 79.
65 Internet-Drafts are working documents of the Internet Engineering
66 Task Force (IETF). Note that other groups may also distribute
67 working documents as Internet-Drafts. The list of current Internet-
68 Drafts is at https://datatracker.ietf.org/drafts/current/.
70 Internet-Drafts are draft documents valid for a maximum of six months
71 and may be updated, replaced, or obsoleted by other documents at any
72 time. It is inappropriate to use Internet-Drafts as reference
73 material or to cite them other than as "work in progress."
75 This Internet-Draft will expire on October 31, 2019.
77 Copyright Notice
79 Copyright (c) 2019 IETF Trust and the persons identified as the
80 document authors. All rights reserved.
82 This document is subject to BCP 78 and the IETF Trust's Legal
83 Provisions Relating to IETF Documents
84 (https://trustee.ietf.org/license-info) in effect on the date of
85 publication of this document. Please review these documents
86 carefully, as they describe your rights and restrictions with respect
87 to this document. Code Components extracted from this document must
88 include Simplified BSD License text as described in Section 4.e of
89 the Trust Legal Provisions and are provided without warranty as
90 described in the Simplified BSD License.
92 Table of Contents
94 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
95 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
96 3. The NETCONF Client Model . . . . . . . . . . . . . . . . . . 4
97 3.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 4
98 3.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 5
99 3.3. YANG Module . . . . . . . . . . . . . . . . . . . . . . . 8
100 4. The NETCONF Server Model . . . . . . . . . . . . . . . . . . 18
101 4.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 18
102 4.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 20
103 4.3. YANG Module . . . . . . . . . . . . . . . . . . . . . . . 26
104 5. Security Considerations . . . . . . . . . . . . . . . . . . . 37
105 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 38
106 6.1. The IETF XML Registry . . . . . . . . . . . . . . . . . . 38
107 6.2. The YANG Module Names Registry . . . . . . . . . . . . . 38
108 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 38
109 7.1. Normative References . . . . . . . . . . . . . . . . . . 38
110 7.2. Informative References . . . . . . . . . . . . . . . . . 40
111 Appendix A. Expanded Tree Diagrams . . . . . . . . . . . . . . . 41
112 A.1. Expanded Tree Diagram for 'ietf-netconf-client' . . . . . 41
113 A.2. Expanded Tree Diagram for 'ietf-netconf-server' . . . . . 50
114 Appendix B. Change Log . . . . . . . . . . . . . . . . . . . . . 61
115 B.1. 00 to 01 . . . . . . . . . . . . . . . . . . . . . . . . 61
116 B.2. 01 to 02 . . . . . . . . . . . . . . . . . . . . . . . . 61
117 B.3. 02 to 03 . . . . . . . . . . . . . . . . . . . . . . . . 61
118 B.4. 03 to 04 . . . . . . . . . . . . . . . . . . . . . . . . 61
119 B.5. 04 to 05 . . . . . . . . . . . . . . . . . . . . . . . . 62
120 B.6. 05 to 06 . . . . . . . . . . . . . . . . . . . . . . . . 62
121 B.7. 06 to 07 . . . . . . . . . . . . . . . . . . . . . . . . 62
122 B.8. 07 to 08 . . . . . . . . . . . . . . . . . . . . . . . . 62
123 B.9. 08 to 09 . . . . . . . . . . . . . . . . . . . . . . . . 62
124 B.10. 09 to 10 . . . . . . . . . . . . . . . . . . . . . . . . 63
125 B.11. 10 to 11 . . . . . . . . . . . . . . . . . . . . . . . . 63
126 B.12. 11 to 12 . . . . . . . . . . . . . . . . . . . . . . . . 63
127 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 63
128 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 64
130 1. Introduction
132 This document defines two YANG [RFC7950] modules, one module to
133 configure a NETCONF [RFC6241] client and the other module to
134 configure a NETCONF server. Both modules support both NETCONF over
135 SSH [RFC6242] and NETCONF over TLS [RFC7589] and NETCONF Call Home
136 connections [RFC8071].
138 2. Terminology
140 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
141 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
142 "OPTIONAL" in this document are to be interpreted as described in BCP
143 14 [RFC2119] [RFC8174] when, and only when, they appear in all
144 capitals, as shown here.
146 3. The NETCONF Client Model
148 The NETCONF client model presented in this section supports both
149 clients initiating connections to servers, as well as clients
150 listening for connections from servers calling home, using either the
151 SSH and TLS transport protocols.
153 YANG feature statements are used to enable implementations to
154 advertise which potentially uncommon parts of the model the NETCONF
155 client supports.
157 3.1. Tree Diagram
159 The following tree diagram [RFC8340] provides an overview of the data
160 model for the "ietf-netconf-client" module.
162 This tree diagram only shows the nodes defined in this module; it
163 does show the nodes defined by "grouping" statements used by this
164 module.
166 Please see Appendix A.1 for a tree diagram that illustrates what the
167 module looks like with all the "grouping" statements expanded.
169 module: ietf-netconf-client
170 +--rw netconf-client
171 +---u netconf-client-grouping
173 grouping netconf-client-grouping
174 +-- initiate! {ssh-initiate or tls-initiate}?
175 | +-- netconf-server* [name]
176 | +-- name? string
177 | +-- endpoints
178 | | +-- endpoint* [name]
179 | | +-- name? string
180 | | +-- (transport)
181 | | +--:(ssh) {ssh-initiate}?
182 | | | +-- ssh
183 | | | +-- tcp-client-parameters
184 | | | | +---u netconf-client-grouping
185 | | | +-- ssh-client-parameters
186 | | | +---u netconf-client-grouping
187 | | +--:(tls) {tls-initiate}?
188 | | +-- tls
189 | | +-- tcp-client-parameters
190 | | | +---u netconf-client-grouping
191 | | +-- tls-client-parameters
192 | | +---u netconf-client-grouping
193 | +-- connection-type
194 | | +-- (connection-type)
195 | | +--:(persistent-connection)
196 | | | +-- persistent!
197 | | +--:(periodic-connection)
198 | | +-- periodic!
199 | | +-- period? uint16
200 | | +-- anchor-time? yang:date-and-time
201 | | +-- idle-timeout? uint16
202 | +-- reconnect-strategy
203 | +-- start-with? enumeration
204 | +-- max-attempts? uint8
205 +-- listen! {ssh-listen or tls-listen}?
206 +-- idle-timeout? uint16
207 +-- endpoint* [name]
208 +-- name? string
209 +-- (transport)
210 +--:(ssh) {ssh-listen}?
211 | +-- ssh
212 | +-- tcp-server-parameters
213 | | +---u netconf-client-grouping
214 | +-- ssh-client-parameters
215 | +---u netconf-client-grouping
216 +--:(tls) {tls-listen}?
217 +-- tls
218 +-- tcp-server-parameters
219 | +---u netconf-client-grouping
220 +-- tls-client-parameters
221 +---u netconf-client-grouping
223 3.2. Example Usage
225 The following example illustrates configuring a NETCONF client to
226 initiate connections, using both the SSH and TLS transport protocols,
227 as well as listening for call-home connections, again using both the
228 SSH and TLS transport protocols.
230 This example is consistent with the examples presented in Section 2
231 of [I-D.ietf-netconf-trust-anchors] and Section 3.2 of
232 [I-D.ietf-netconf-keystore].
234 =========== NOTE: '\' line wrapping per BCP XX (RFC XXXX) ===========
236
239
240
241
242 corp-fw1
243
244
245 corp-fw1.example.com
246
247
248 corp-fw1.example.com
249
250 15
251 3
252 30
253
254
255
256
257 foobar
258
259
260 ct:rsa2048
262 base64encodedvalue==
263 base64encodedvalue==
264
265
266
267
268 explicitly-trusted-server-ca-certs<\
269 /pinned-ca-certs>
270 explicitly-trusted-server-certs\
271
272
273
274 30
275 3
276
277
278
279
280
281 corp-fw2.example.com
282
283
284 corp-fw2.example.com
285
286 15
287 3
288 30
289
290
291
292
293 foobar
294
295
296 ct:rsa2048
298 base64encodedvalue==
299 base64encodedvalue==
300
301
302
303
304 explicitly-trusted-server-ca-certs<\
305 /pinned-ca-certs>
306 explicitly-trusted-server-certs\
307
308
309
310 30
311 3
312
313
314
315
316
317
318
319
320
321 last-connected
322
323
324
326
327
328
329 Intranet-facing listener
330
331
332 192.0.2.7
333
334
335
336 foobar
337
338
339 ct:rsa2048
341 base64encodedvalue==
342 base64encodedvalue==
343
344
345
346
347 explicitly-trusted-server-ca-certs
349 explicitly-trusted-server-certs
351 explicitly-trusted-ssh-host-keys\
352 pinned-ssh-host-keys>
353
354
355
356
357
358
360 3.3. YANG Module
362 This YANG module has normative references to [RFC6242], [RFC6991],
363 [RFC7589], [RFC8071], [I-D.kwatsen-netconf-tcp-client-server],
364 [I-D.ietf-netconf-ssh-client-server], and
365 [I-D.ietf-netconf-tls-client-server].
367 file "ietf-netconf-client@2019-04-29.yang"
368 module ietf-netconf-client {
369 yang-version 1.1;
370 namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-client";
371 prefix ncc;
373 import ietf-yang-types {
374 prefix yang;
375 reference
376 "RFC 6991: Common YANG Data Types";
377 }
378 import ietf-tcp-client {
379 prefix tcpc;
380 reference
381 "RFC AAAA: YANG Groupings for TCP Clients and TCP Servers";
382 }
383 import ietf-tcp-server {
384 prefix tcps;
385 reference
386 "RFC AAAA: YANG Groupings for TCP Clients and TCP Servers";
387 }
389 import ietf-ssh-client {
390 prefix sshc;
391 revision-date 2019-04-29; // stable grouping definitions
392 reference
393 "RFC BBBB: YANG Groupings for SSH Clients and SSH Servers";
394 }
396 import ietf-tls-client {
397 prefix tlsc;
398 revision-date 2019-04-29; // stable grouping definitions
399 reference
400 "RFC CCCC: YANG Groupings for TLS Clients and TLS Servers";
401 }
403 organization
404 "IETF NETCONF (Network Configuration) Working Group";
406 contact
407 "WG Web:
408 WG List:
409 Author: Kent Watsen
410 Author: Gary Wu ";
412 description
413 "This module contains a collection of YANG definitions
414 for configuring NETCONF clients.
416 Copyright (c) 2019 IETF Trust and the persons identified
417 as authors of the code. All rights reserved.
419 Redistribution and use in source and binary forms, with
420 or without modification, is permitted pursuant to, and
421 subject to the license terms contained in, the Simplified
422 BSD License set forth in Section 4.c of the IETF Trust's
423 Legal Provisions Relating to IETF Documents
424 (https://trustee.ietf.org/license-info).
426 This version of this YANG module is part of RFC XXXX
427 (https://www.rfc-editor.org/info/rfcXXXX); see the RFC
428 itself for full legal notices.;
430 The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
431 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
432 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
433 are to be interpreted as described in BCP 14 (RFC 2119)
434 (RFC 8174) when, and only when, they appear in all
435 capitals, as shown here.";
437 revision 2019-04-29 {
438 description
439 "Initial version";
440 reference
441 "RFC XXXX: NETCONF Client and Server Models";
442 }
444 // Features
446 feature ssh-initiate {
447 description
448 "The 'ssh-initiate' feature indicates that the NETCONF client
449 supports initiating SSH connections to NETCONF servers.";
450 reference
451 "RFC 6242:
452 Using the NETCONF Protocol over Secure Shell (SSH)";
453 }
455 feature tls-initiate {
456 description
457 "The 'tls-initiate' feature indicates that the NETCONF client
458 supports initiating TLS connections to NETCONF servers.";
459 reference
460 "RFC 7589: Using the NETCONF Protocol over Transport
461 Layer Security (TLS) with Mutual X.509 Authentication";
462 }
464 feature ssh-listen {
465 description
466 "The 'ssh-listen' feature indicates that the NETCONF client
467 supports opening a port to listen for incoming NETCONF
468 server call-home SSH connections.";
469 reference
470 "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
471 }
473 feature tls-listen {
474 description
475 "The 'tls-listen' feature indicates that the NETCONF client
476 supports opening a port to listen for incoming NETCONF
477 server call-home TLS connections.";
478 reference
479 "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
480 }
482 // Groupings
484 grouping netconf-client-grouping {
485 description
486 "Top-level grouping for NETCONF client configuration.";
487 container initiate {
488 if-feature "ssh-initiate or tls-initiate";
489 presence "Enables client to initiate TCP connections";
490 description
491 "Configures client initiating underlying TCP connections.";
492 list netconf-server {
493 key "name";
494 min-elements 1;
495 description
496 "List of NETCONF servers the NETCONF client is to
497 initiate connections to in parallel.";
498 leaf name {
499 type string;
500 description
501 "An arbitrary name for the NETCONF server.";
502 }
503 container endpoints {
504 description
505 "Container for the list of endpoints.";
506 list endpoint {
507 key "name";
508 min-elements 1;
509 ordered-by user;
510 description
511 "A user-ordered list of endpoints that the NETCONF
512 client will attempt to connect to in the specified
513 sequence. Defining more than one enables
514 high-availability.";
515 leaf name {
516 type string;
517 description
518 "An arbitrary name for the endpoint.";
519 }
520 choice transport {
521 mandatory true;
522 description
523 "Selects between available transports.";
524 case ssh {
525 if-feature "ssh-initiate";
526 container ssh {
527 description
528 "Specifies IP and SSH specific configuration
529 for the connection.";
530 container tcp-client-parameters {
531 description
532 "A wrapper around the TCP client parameters
533 to avoid name collisions.";
534 uses tcpc:tcp-client-grouping {
535 refine "remote-port" {
536 default "830";
537 description
538 "The NETCONF client will attempt to connect
539 to the IANA-assigned well-known port value
540 for 'netconf-ssh' (443) if no value is
541 specified.";
542 }
543 }
544 }
545 container ssh-client-parameters {
546 description
547 "A wrapper around the SSH client parameters to
548 avoid name collisions.";
549 uses sshc:ssh-client-grouping;
550 }
551 }
552 }
553 case tls {
554 if-feature "tls-initiate";
555 container tls {
556 description
557 "Specifies IP and TLS specific configuration
558 for the connection.";
559 container tcp-client-parameters {
560 description
561 "A wrapper around the TCP client parameters
562 to avoid name collisions.";
563 uses tcpc:tcp-client-grouping {
564 refine "remote-port" {
565 default "6513";
566 description
567 "The NETCONF client will attempt to connect
568 to the IANA-assigned well-known port value
569 for 'netconf-tls' (6513) if no value is
570 specified.";
571 }
572 }
573 }
574 container tls-client-parameters {
575 description
576 "A wrapper around the TLS client parameters
577 to avoid name collisions.";
578 uses tlsc:tls-client-grouping {
579 refine "client-identity"
580 + "/auth-type" {
581 mandatory true;
582 description
583 "NETCONF/TLS clients MUST pass some
584 authentication credentials.";
585 }
586 }
587 }
588 }
589 }
590 } // choice transport
591 } // list endpoint
592 } // container endpoints
594 container connection-type {
595 description
596 "Indicates the NETCONF client's preference for how the
597 NETCONF connection is maintained.";
598 choice connection-type {
599 mandatory true;
600 description
601 "Selects between available connection types.";
602 case persistent-connection {
603 container persistent {
604 presence "Indicates that a persistent connection is
605 to be maintained.";
606 description
607 "Maintain a persistent connection to the NETCONF
608 server. If the connection goes down, immediately
609 start trying to reconnect to the NETCONF server,
610 using the reconnection strategy.
612 This connection type minimizes any NETCONF server
613 to NETCONF client data-transfer delay, albeit at
614 the expense of holding resources longer.";
615 }
616 }
617 case periodic-connection {
618 container periodic {
619 presence "Indicates that a periodic connection is
620 to be maintained.";
621 description
622 "Periodically connect to the NETCONF server.
624 This connection type increases resource
625 utilization, albeit with increased delay in
626 NETCONF server to NETCONF client interactions.
628 The NETCONF client should close the underlying
629 TCP connection upon completing planned activities.
631 In the case that the previous connection is still
632 active, establishing a new connection is NOT
633 RECOMMENDED.";
634 leaf period {
635 type uint16;
636 units "minutes";
637 default "60";
638 description
639 "Duration of time between periodic connections.";
640 }
641 leaf anchor-time {
642 type yang:date-and-time {
643 // constrained to minute-level granularity
644 pattern '\d{4}-\d{2}-\d{2}T\d{2}:\d{2}'
645 + '(Z|[\+\-]\d{2}:\d{2})';
646 }
647 description
648 "Designates a timestamp before or after which a
649 series of periodic connections are determined.
650 The periodic connections occur at a whole
651 multiple interval from the anchor time. For
652 example, for an anchor time is 15 minutes past
653 midnight and a period interval of 24 hours, then
654 a periodic connection will occur 15 minutes past
655 midnight everyday.";
656 }
657 leaf idle-timeout {
658 type uint16;
659 units "seconds";
660 default 120; // two minutes
661 description
662 "Specifies the maximum number of seconds that
663 a NETCONF session may remain idle. A NETCONF
664 session will be dropped if it is idle for an
665 interval longer then this number of seconds.
667 If set to zero, then the NETCONF client will
668 never drop a session because it is idle.";
669 }
670 }
671 }
672 }
673 }
674 container reconnect-strategy {
675 description
676 "The reconnection strategy directs how a NETCONF client
677 reconnects to a NETCONF server, after discovering its
678 connection to the server has dropped, even if due to a
679 reboot. The NETCONF client starts with the specified
680 endpoint and tries to connect to it max-attempts times
681 before trying the next endpoint in the list (round
682 robin).";
683 leaf start-with {
684 type enumeration {
685 enum first-listed {
686 description
687 "Indicates that reconnections should start with
688 the first endpoint listed.";
689 }
690 enum last-connected {
691 description
692 "Indicates that reconnections should start with
693 the endpoint last connected to. If no previous
694 connection has ever been established, then the
695 first endpoint configured is used. NETCONF
696 clients SHOULD be able to remember the last
697 endpoint connected to across reboots.";
698 }
699 enum random-selection {
700 description
701 "Indicates that reconnections should start with
702 a random endpoint.";
703 }
704 }
705 default "first-listed";
706 description
707 "Specifies which of the NETCONF server's endpoints
708 the NETCONF client should start with when trying
709 to connect to the NETCONF server.";
710 }
711 leaf max-attempts {
712 type uint8 {
713 range "1..max";
714 }
715 default "3";
716 description
717 "Specifies the number times the NETCONF client tries
718 to connect to a specific endpoint before moving on
719 to the next endpoint in the list (round robin).";
720 }
721 }
722 } // netconf-server
723 } // initiate
725 container listen {
726 if-feature "ssh-listen or tls-listen";
727 presence "Enables client to accept call-home connections";
728 description
729 "Configures client accepting call-home TCP connections.";
730 leaf idle-timeout {
731 type uint16;
732 units "seconds";
733 default "3600"; // one hour
734 description
735 "Specifies the maximum number of seconds that a NETCONF
736 session may remain idle. A NETCONF session will be
737 dropped if it is idle for an interval longer than this
738 number of seconds. If set to zero, then the server
739 will never drop a session because it is idle. Sessions
740 that have a notification subscription active are never
741 dropped.";
742 }
743 list endpoint {
744 key "name";
745 min-elements 1;
746 description
747 "List of endpoints to listen for NETCONF connections.";
748 leaf name {
749 type string;
750 description
751 "An arbitrary name for the NETCONF listen endpoint.";
752 }
753 choice transport {
754 mandatory true;
755 description
756 "Selects between available transports.";
757 case ssh {
758 if-feature "ssh-listen";
759 container ssh {
760 description
761 "SSH-specific listening configuration for inbound
762 connections.";
764 container tcp-server-parameters {
765 description
766 "A wrapper around the TCP server parameters
767 to avoid name collisions.";
768 uses tcps:tcp-server-grouping {
769 refine "local-port" {
770 default "4334";
771 description
772 "The NETCONF client will listen on the IANA-
773 assigned well-known port for 'netconf-ch-ssh'
774 (4334) if no value is specified.";
775 }
776 }
777 }
778 container ssh-client-parameters {
779 description
780 "A wrapper around the SSH client parameters
781 to avoid name collisions.";
782 uses sshc:ssh-client-grouping;
783 }
784 }
785 }
786 case tls {
787 if-feature "tls-listen";
788 container tls {
789 description
790 "TLS-specific listening configuration for inbound
791 connections.";
792 container tcp-server-parameters {
793 description
794 "A wrapper around the TCP server parameters
795 to avoid name collisions.";
796 uses tcps:tcp-server-grouping {
797 refine "local-port" {
798 default "4334";
799 description
800 "The NETCONF client will listen on the IANA-
801 assigned well-known port for 'netconf-ch-ssh'
802 (4334) if no value is specified.";
803 }
804 }
805 }
806 container tls-client-parameters {
807 description
808 "A wrapper around the TLS client parameters
809 to avoid name collisions.";
810 uses tlsc:tls-client-grouping {
811 refine "client-identity/auth-type" {
812 mandatory true;
813 description
814 "NETCONF/TLS clients MUST pass some
815 authentication credentials.";
816 }
817 }
818 }
819 }
820 }
821 } // transport
822 } // endpoint
823 } // listen
824 } // netconf-client
826 // Protocol accessible node, for servers that implement this
827 // module.
829 container netconf-client {
830 uses netconf-client-grouping;
831 description
832 "Top-level container for NETCONF client configuration.";
833 }
834 }
835
837 4. The NETCONF Server Model
839 The NETCONF server model presented in this section supports both
840 listening for connections as well as initiating call-home
841 connections, using either the SSH and TLS transport protocols.
843 YANG feature statements are used to enable implementations to
844 advertise which potentially uncommon parts of the model the NETCONF
845 server supports.
847 4.1. Tree Diagram
849 The following tree diagram [RFC8340] provides an overview of the data
850 model for the "ietf-netconf-server" module.
852 This tree diagram only shows the nodes defined in this module; it
853 does show the nodes defined by "grouping" statements used by this
854 module.
856 Please see Appendix A.2 for a tree diagram that illustrates what the
857 module looks like with all the "grouping" statements expanded.
859 module: ietf-netconf-server
860 +--rw netconf-server
861 +---u netconf-server-grouping
863 grouping netconf-server-grouping
864 +-- listen! {ssh-listen or tls-listen}?
865 | +-- idle-timeout? uint16
866 | +-- endpoint* [name]
867 | +-- name? string
868 | +-- (transport)
869 | +--:(ssh) {ssh-listen}?
870 | | +-- ssh
871 | | +-- tcp-server-parameters
872 | | | +---u netconf-server-grouping
873 | | +-- ssh-server-parameters
874 | | +---u netconf-server-grouping
875 | +--:(tls) {tls-listen}?
876 | +-- tls
877 | +-- tcp-server-parameters
878 | | +---u netconf-server-grouping
879 | +-- tls-server-parameters
880 | +---u netconf-server-grouping
881 +-- call-home! {ssh-call-home or tls-call-home}?
882 +-- netconf-client* [name]
883 +-- name? string
884 +-- endpoints
885 | +-- endpoint* [name]
886 | +-- name? string
887 | +-- (transport)
888 | +--:(ssh) {ssh-call-home}?
889 | | +-- ssh
890 | | +-- tcp-client-parameters
891 | | | +---u netconf-server-grouping
892 | | +-- ssh-server-parameters
893 | | +---u netconf-server-grouping
894 | +--:(tls) {tls-call-home}?
895 | +-- tls
896 | +-- tcp-client-parameters
897 | | +---u netconf-server-grouping
898 | +-- tls-server-parameters
899 | +---u netconf-server-grouping
900 +-- connection-type
901 | +-- (connection-type)
902 | +--:(persistent-connection)
903 | | +-- persistent!
904 | +--:(periodic-connection)
905 | +-- periodic!
906 | +-- period? uint16
907 | +-- anchor-time? yang:date-and-time
908 | +-- idle-timeout? uint16
909 +-- reconnect-strategy
910 +-- start-with? enumeration
911 +-- max-attempts? uint8
913 4.2. Example Usage
915 The following example illustrates configuring a NETCONF server to
916 listen for NETCONF client connections using both the SSH and TLS
917 transport protocols, as well as configuring call-home to two NETCONF
918 clients, one using SSH and the other using TLS.
920 This example is consistent with the examples presented in Section 2
921 of [I-D.ietf-netconf-trust-anchors] and Section 3.2 of
922 [I-D.ietf-netconf-keystore].
924 =========== NOTE: '\' line wrapping per BCP XX (RFC XXXX) ===========
926
930
931
932
933 netconf/ssh
934
935
936 192.0.2.7
937
938
939
940
941 deployment-specific-certificate
942
943
944 ct:rsa2048
946 base64encodedvalue==
947 base64encodedvalue==
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962 netconf/tls
963
964
965 192.0.2.7
966
967
968
969
970 ct:rsa2048
972 base64encodedvalue==
973 base64encodedvalue==
974 base64encodedvalue==
975
976
977
978
979 explicitly-trusted-client-ca-certs
981 explicitly-trusted-client-certs
983
984
985 1
986 11:0A:05:11:00
987 x509c2n:san-any
988
989
990 2
991 B3:4F:A1:8C:54
992 x509c2n:specified
993 scooby-doo
994
995
996
997
998
999
1000
1002
1003
1004
1005 config-mgr
1006
1007
1008 east-data-center
1009
1010
1011 east.config-mgr.example.com
1013
1014
1015
1016
1017 deployment-specific-certificate
1018
1019
1020 ct:rsa2048
1022 base64encodedvalue==
1023 base64encodedvalue==
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038 west-data-center
1039
1040
1041 west.config-mgr.example.com
1043
1044
1045
1046
1047 deployment-specific-certificate
1048
1049
1050 ct:rsa2048
1052 base64encodedvalue==
1053 base64encodedvalue==
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070 300
1071 60
1072
1073
1074
1075 last-connected
1076 3
1077
1078
1079
1080 data-collector
1081
1082
1083 east-data-center
1084
1085
1086 east.analytics.example.com
1088
1089 15
1090 3
1091 30
1092
1093
1094
1095
1096
1097 ct:rsa2048
1099 base64encodedvalue==
1100 base64encodedvalue==
1101 base64encodedvalue==
1102
1103
1104
1105
1106 explicitly-trusted-client-ca-certs<\
1107 /pinned-ca-certs>
1108 explicitly-trusted-client-certs\
1109
1110
1111
1112 1
1113 11:0A:05:11:00
1114 x509c2n:san-any
1115
1116
1117 2
1118 B3:4F:A1:8C:54
1119 x509c2n:specified
1120 scooby-doo
1121
1122
1123
1124
1125 30
1126 3
1127
1128
1129
1130
1131
1132 west-data-center
1133
1134
1135 west.analytics.example.com
1137
1138 15
1139 3
1140 30
1141
1142
1143
1144
1145
1146 ct:rsa2048
1148 base64encodedvalue==
1149 base64encodedvalue==
1150 base64encodedvalue==
1151
1152
1153
1154
1155 explicitly-trusted-client-ca-certs<\
1156 /pinned-ca-certs>
1157 explicitly-trusted-client-certs\
1158
1159
1160
1161 1
1162 11:0A:05:11:00
1163 x509c2n:san-any
1164
1165
1166 2
1167 B3:4F:A1:8C:54
1168 x509c2n:specified
1169 scooby-doo
1170
1171
1172
1173
1174 30
1175 3
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185 first-listed
1186 3
1187
1188
1189
1190
1192 4.3. YANG Module
1194 This YANG module has normative references to [RFC6242], [RFC6991],
1195 [RFC7407], [RFC7589], [RFC8071],
1196 [I-D.kwatsen-netconf-tcp-client-server],
1197 [I-D.ietf-netconf-ssh-client-server], and
1198 [I-D.ietf-netconf-tls-client-server].
1200 file "ietf-netconf-server@2019-04-29.yang"
1201 module ietf-netconf-server {
1202 yang-version 1.1;
1203 namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-server";
1204 prefix ncs;
1206 import ietf-yang-types {
1207 prefix yang;
1208 reference
1209 "RFC 6991: Common YANG Data Types";
1210 }
1212 import ietf-x509-cert-to-name {
1213 prefix x509c2n;
1214 reference
1215 "RFC 7407: A YANG Data Model for SNMP Configuration";
1216 }
1218 import ietf-tcp-client {
1219 prefix tcpc;
1220 reference
1221 "RFC AAAA: YANG Groupings for TCP Clients and TCP Servers";
1222 }
1224 import ietf-tcp-server {
1225 prefix tcps;
1226 reference
1227 "RFC AAAA: YANG Groupings for TCP Clients and TCP Servers";
1228 }
1230 import ietf-ssh-server {
1231 prefix sshs;
1232 revision-date 2019-04-29; // stable grouping definitions
1233 reference
1234 "RFC BBBB: YANG Groupings for SSH Clients and SSH Servers";
1235 }
1237 import ietf-tls-server {
1238 prefix tlss;
1239 revision-date 2019-04-29; // stable grouping definitions
1240 reference
1241 "RFC CCCC: YANG Groupings for TLS Clients and TLS Servers";
1242 }
1244 organization
1245 "IETF NETCONF (Network Configuration) Working Group";
1247 contact
1248 "WG Web:
1249 WG List:
1250 Author: Kent Watsen
1251 Author: Gary Wu
1252 Author: Juergen Schoenwaelder
1253 ";
1254 description
1255 "This module contains a collection of YANG definitions
1256 for configuring NETCONF servers.
1258 Copyright (c) 2019 IETF Trust and the persons identified
1259 as authors of the code. All rights reserved.
1261 Redistribution and use in source and binary forms, with
1262 or without modification, is permitted pursuant to, and
1263 subject to the license terms contained in, the Simplified
1264 BSD License set forth in Section 4.c of the IETF Trust's
1265 Legal Provisions Relating to IETF Documents
1266 (https://trustee.ietf.org/license-info).
1268 This version of this YANG module is part of RFC XXXX
1269 (https://www.rfc-editor.org/info/rfcXXXX); see the RFC
1270 itself for full legal notices.;
1272 The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
1273 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
1274 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
1275 are to be interpreted as described in BCP 14 (RFC 2119)
1276 (RFC 8174) when, and only when, they appear in all
1277 capitals, as shown here.";
1279 revision 2019-04-29 {
1280 description
1281 "Initial version";
1282 reference
1283 "RFC XXXX: NETCONF Client and Server Models";
1284 }
1286 // Features
1287 feature ssh-listen {
1288 description
1289 "The 'ssh-listen' feature indicates that the NETCONF server
1290 supports opening a port to accept NETCONF over SSH
1291 client connections.";
1292 reference
1293 "RFC 6242:
1294 Using the NETCONF Protocol over Secure Shell (SSH)";
1295 }
1297 feature tls-listen {
1298 description
1299 "The 'tls-listen' feature indicates that the NETCONF server
1300 supports opening a port to accept NETCONF over TLS
1301 client connections.";
1302 reference
1303 "RFC 7589: Using the NETCONF Protocol over Transport
1304 Layer Security (TLS) with Mutual X.509
1305 Authentication";
1306 }
1308 feature ssh-call-home {
1309 description
1310 "The 'ssh-call-home' feature indicates that the NETCONF
1311 server supports initiating a NETCONF over SSH call
1312 home connection to NETCONF clients.";
1313 reference
1314 "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
1315 }
1317 feature tls-call-home {
1318 description
1319 "The 'tls-call-home' feature indicates that the NETCONF
1320 server supports initiating a NETCONF over TLS call
1321 home connection to NETCONF clients.";
1322 reference
1323 "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
1324 }
1326 // Groupings
1328 grouping netconf-server-grouping {
1329 description
1330 "Top-level grouping for NETCONF server configuration.";
1331 container listen {
1332 if-feature "ssh-listen or tls-listen";
1333 presence
1334 "Enables server to listen for NETCONF client connections.";
1336 description
1337 "Configures listen behavior";
1338 leaf idle-timeout {
1339 type uint16;
1340 units "seconds";
1341 default 3600; // one hour
1342 description
1343 "Specifies the maximum number of seconds that a NETCONF
1344 session may remain idle. A NETCONF session will be
1345 dropped if it is idle for an interval longer than this
1346 number of seconds. If set to zero, then the server
1347 will never drop a session because it is idle. Sessions
1348 that have a notification subscription active are never
1349 dropped.";
1350 }
1351 list endpoint {
1352 key "name";
1353 min-elements 1;
1354 description
1355 "List of endpoints to listen for NETCONF connections.";
1356 leaf name {
1357 type string;
1358 description
1359 "An arbitrary name for the NETCONF listen endpoint.";
1360 }
1361 choice transport {
1362 mandatory true;
1363 description
1364 "Selects between available transports.";
1365 case ssh {
1366 if-feature "ssh-listen";
1367 container ssh {
1368 description
1369 "SSH-specific listening configuration for inbound
1370 connections.";
1371 container tcp-server-parameters {
1372 description
1373 "A wrapper around the TCP client parameters
1374 to avoid name collisions.";
1375 uses tcps:tcp-server-grouping {
1376 refine "local-port" {
1377 default "830";
1378 description
1379 "The NETCONF server will listen on the
1380 IANA-assigned well-known port value
1381 for 'netconf-ssh' (830) if no value
1382 is specified.";
1383 }
1385 }
1386 }
1387 container ssh-server-parameters {
1388 description
1389 "A wrapper around the SSH server parameters
1390 to avoid name collisions.";
1391 uses sshs:ssh-server-grouping;
1392 }
1393 }
1394 }
1395 case tls {
1396 if-feature "tls-listen";
1397 container tls {
1398 description
1399 "TLS-specific listening configuration for inbound
1400 connections.";
1401 container tcp-server-parameters {
1402 description
1403 "A wrapper around the TCP client parameters
1404 to avoid name collisions.";
1405 uses tcps:tcp-server-grouping {
1406 refine "local-port" {
1407 default "6513";
1408 description
1409 "The NETCONF server will listen on the
1410 IANA-assigned well-known port value
1411 for 'netconf-tls' (6513) if no value
1412 is specified.";
1413 }
1414 }
1415 }
1416 container tls-server-parameters {
1417 description
1418 "A wrapper around the TLS server parameters to
1419 avoid name collisions.";
1420 uses tlss:tls-server-grouping {
1421 refine "client-authentication" {
1422 //must 'pinned-ca-certs or pinned-client-certs';
1423 description
1424 "NETCONF/TLS servers MUST validate client
1425 certificates.";
1426 }
1427 augment "client-authentication" {
1428 description
1429 "Augments in the cert-to-name structure.";
1430 container cert-maps {
1431 uses x509c2n:cert-to-name;
1432 description
1433 "The cert-maps container is used by a TLS-
1434 based NETCONF server to map the NETCONF
1435 client's presented X.509 certificate to
1436 a NETCONF username. If no matching and
1437 valid cert-to-name list entry can be found,
1438 then the NETCONF server MUST close the
1439 connection, and MUST NOT accept NETCONF
1440 messages over it.";
1441 reference
1442 "RFC WWWW: NETCONF over TLS, Section 7";
1443 }
1444 }
1445 }
1446 }
1447 }
1448 }
1449 }
1450 }
1451 }
1452 container call-home {
1453 if-feature "ssh-call-home or tls-call-home";
1454 presence
1455 "Enables the NETCONF server to initiate the underlying
1456 transport connection to NETCONF clients.";
1457 description "Configures call home behavior.";
1458 list netconf-client {
1459 key "name";
1460 min-elements 1;
1461 description
1462 "List of NETCONF clients the NETCONF server is to
1463 initiate call-home connections to in parallel.";
1464 leaf name {
1465 type string;
1466 description
1467 "An arbitrary name for the remote NETCONF client.";
1468 }
1469 container endpoints {
1470 description
1471 "Container for the list of endpoints.";
1472 list endpoint {
1473 key "name";
1474 min-elements 1;
1475 ordered-by user;
1476 description
1477 "A non-empty user-ordered list of endpoints for this
1478 NETCONF server to try to connect to in sequence.
1479 Defining more than one enables high-availability.";
1480 leaf name {
1481 type string;
1482 description
1483 "An arbitrary name for this endpoint.";
1484 }
1485 choice transport {
1486 mandatory true;
1487 description
1488 "Selects between available transports.";
1489 case ssh {
1490 if-feature "ssh-call-home";
1491 container ssh {
1492 description
1493 "Specifies SSH-specific call-home transport
1494 configuration.";
1495 container tcp-client-parameters {
1496 description
1497 "A wrapper around the TCP client parameters
1498 to avoid name collisions.";
1499 uses tcpc:tcp-client-grouping {
1500 refine "remote-port" {
1501 default "4334";
1502 description
1503 "The NETCONF server will attempt to connect
1504 to the IANA-assigned well-known port for
1505 'netconf-ch-tls' (4334) if no value is
1506 specified.";
1507 }
1508 }
1509 }
1510 container ssh-server-parameters {
1511 description
1512 "A wrapper around the SSH server parameters
1513 to avoid name collisions.";
1514 uses sshs:ssh-server-grouping;
1515 }
1516 }
1517 }
1518 case tls {
1519 if-feature "tls-call-home";
1520 container tls {
1521 description
1522 "Specifies TLS-specific call-home transport
1523 configuration.";
1524 container tcp-client-parameters {
1525 description
1526 "A wrapper around the TCP client parameters
1527 to avoid name collisions.";
1528 uses tcpc:tcp-client-grouping {
1529 refine "remote-port" {
1530 default "4335";
1531 description
1532 "The NETCONF server will attempt to connect
1533 to the IANA-assigned well-known port for
1534 'netconf-ch-tls' (4335) if no value is
1535 specified.";
1536 }
1537 }
1538 }
1539 container tls-server-parameters {
1540 description
1541 "A wrapper around the TLS server parameters
1542 to avoid name collisions.";
1543 uses tlss:tls-server-grouping {
1544 refine "client-authentication" {
1545 /* commented out since auth could be external
1546 must 'pinned-ca-certs or pinned-client-certs';
1547 */
1548 description
1549 "NETCONF/TLS servers MUST validate client
1550 certificates.";
1551 }
1552 augment "client-authentication" {
1553 description
1554 "Augments in the cert-to-name structure.";
1555 container cert-maps {
1556 uses x509c2n:cert-to-name;
1557 description
1558 "The cert-maps container is used by a
1559 TLS-based NETCONF server to map the
1560 NETCONF client's presented X.509
1561 certificate to a NETCONF username. If
1562 no matching and valid cert-to-name list
1563 entry can be found, then the NETCONF
1564 server MUST close the connection, and
1565 MUST NOT accept NETCONF messages over
1566 it.";
1567 reference
1568 "RFC WWWW: NETCONF over TLS, Section 7";
1569 }
1570 }
1571 }
1572 }
1573 }
1574 } // tls
1575 } // choice
1576 } // endpoint
1578 } // endpoints
1579 container connection-type {
1580 description
1581 "Indicates the NETCONF server's preference for how the
1582 NETCONF connection is maintained.";
1583 choice connection-type {
1584 mandatory true;
1585 description
1586 "Selects between available connection types.";
1587 case persistent-connection {
1588 container persistent {
1589 presence "Indicates that a persistent connection is
1590 to be maintained.";
1591 description
1592 "Maintain a persistent connection to the NETCONF
1593 client. If the connection goes down, immediately
1594 start trying to reconnect to the NETCONF client,
1595 using the reconnection strategy.
1597 This connection type minimizes any NETCONF client
1598 to NETCONF server data-transfer delay, albeit at
1599 the expense of holding resources longer.";
1600 } // container persistent
1601 } // case persistent-connection
1602 case periodic-connection {
1603 container periodic {
1604 presence "Indicates that a periodic connection is
1605 to be maintained.";
1606 description
1607 "Periodically connect to the NETCONF client.
1609 This connection type increases resource
1610 utilization, albeit with increased delay in
1611 NETCONF client to NETCONF client interactions.
1613 The NETCONF client SHOULD gracefully close the
1614 connection using upon completing
1615 planned activities. If the NETCONF session is
1616 not closed gracefully, the NETCONF server MUST
1617 immediately attempt to reestablish the connection.
1619 In the case that the previous connection is still
1620 active (i.e., the NETCONF client has not closed
1621 it yet), establishing a new connection is NOT
1622 RECOMMENDED.";
1623 leaf period {
1624 type uint16;
1625 units "minutes";
1626 default "60";
1627 description
1628 "Duration of time between periodic connections.";
1629 }
1630 leaf anchor-time {
1631 type yang:date-and-time {
1632 // constrained to minute-level granularity
1633 pattern '\d{4}-\d{2}-\d{2}T\d{2}:\d{2}'
1634 + '(Z|[\+\-]\d{2}:\d{2})';
1635 }
1636 description
1637 "Designates a timestamp before or after which a
1638 series of periodic connections are determined.
1639 The periodic connections occur at a whole
1640 multiple interval from the anchor time. For
1641 example, for an anchor time is 15 minutes past
1642 midnight and a period interval of 24 hours, then
1643 a periodic connection will occur 15 minutes past
1644 midnight everyday.";
1645 }
1646 leaf idle-timeout {
1647 type uint16;
1648 units "seconds";
1649 default 120; // two minutes
1650 description
1651 "Specifies the maximum number of seconds that
1652 a NETCONF session may remain idle. A NETCONF
1653 session will be dropped if it is idle for an
1654 interval longer than this number of seconds.
1655 If set to zero, then the server will never
1656 drop a session because it is idle.";
1657 }
1658 } // container periodic
1659 } // case periodic-connection
1660 } // choice connection-type
1661 } // container connection-type
1662 container reconnect-strategy {
1663 description
1664 "The reconnection strategy directs how a NETCONF server
1665 reconnects to a NETCONF client, after discovering its
1666 connection to the client has dropped, even if due to a
1667 reboot. The NETCONF server starts with the specified
1668 endpoint and tries to connect to it max-attempts times
1669 before trying the next endpoint in the list (round
1670 robin).";
1671 leaf start-with {
1672 type enumeration {
1673 enum first-listed {
1674 description
1675 "Indicates that reconnections should start with
1676 the first endpoint listed.";
1677 }
1678 enum last-connected {
1679 description
1680 "Indicates that reconnections should start with
1681 the endpoint last connected to. If no previous
1682 connection has ever been established, then the
1683 first endpoint configured is used. NETCONF
1684 servers SHOULD be able to remember the last
1685 endpoint connected to across reboots.";
1686 }
1687 enum random-selection {
1688 description
1689 "Indicates that reconnections should start with
1690 a random endpoint.";
1691 }
1692 }
1693 default "first-listed";
1694 description
1695 "Specifies which of the NETCONF client's endpoints
1696 the NETCONF server should start with when trying
1697 to connect to the NETCONF client.";
1698 }
1699 leaf max-attempts {
1700 type uint8 {
1701 range "1..max";
1702 }
1703 default "3";
1704 description
1705 "Specifies the number times the NETCONF server tries
1706 to connect to a specific endpoint before moving on
1707 to the next endpoint in the list (round robin).";
1708 }
1709 } // container reconnect-strategy
1710 } // list netconf-client
1711 } // container call-home
1712 } // grouping netconf-server-grouping
1714 // Protocol accessible node, for servers that implement this
1715 // module.
1717 container netconf-server {
1718 uses netconf-server-grouping;
1719 description
1720 "Top-level container for NETCONF server configuration.";
1721 }
1723 }
1724
1726 5. Security Considerations
1728 The YANG module defined in this document uses groupings defined in
1729 [I-D.kwatsen-netconf-tcp-client-server],
1730 [I-D.ietf-netconf-ssh-client-server], and
1731 [I-D.ietf-netconf-tls-client-server]. Please see the Security
1732 Considerations section in those documents for concerns related those
1733 groupings.
1735 The YANG modules defined in this document are designed to be accessed
1736 via YANG based management protocols, such as NETCONF [RFC6241] and
1737 RESTCONF [RFC8040]. Both of these protocols have mandatory-to-
1738 implement secure transport layers (e.g., SSH, TLS) with mutual
1739 authentication.
1741 The NETCONF access control model (NACM) [RFC8341] provides the means
1742 to restrict access for particular users to a pre-configured subset of
1743 all available protocol operations and content.
1745 There are a number of data nodes defined in the YANG modules that are
1746 writable/creatable/deletable (i.e., config true, which is the
1747 default). Some of these data nodes may be considered sensitive or
1748 vulnerable in some network environments. Write operations (e.g.,
1749 edit-config) to these data nodes without proper protection can have a
1750 negative effect on network operations. These are the subtrees and
1751 data nodes and their sensitivity/vulnerability:
1753 None of the subtrees or data nodes in the modules defined in this
1754 document need to be protected from write operations.
1756 Some of the readable data nodes in the YANG modules may be considered
1757 sensitive or vulnerable in some network environments. It is thus
1758 important to control read access (e.g., via get, get-config, or
1759 notification) to these data nodes. These are the subtrees and data
1760 nodes and their sensitivity/vulnerability:
1762 None of the subtrees or data nodes in the modules defined in this
1763 document need to be protected from read operations.
1765 Some of the RPC operations in the YANG modules may be considered
1766 sensitive or vulnerable in some network environments. It is thus
1767 important to control access to these operations. These are the
1768 operations and their sensitivity/vulnerability:
1770 The modules defined in this document do not define any 'RPC' or
1771 'action' statements.
1773 6. IANA Considerations
1775 6.1. The IETF XML Registry
1777 This document registers two URIs in the "ns" subregistry of the IETF
1778 XML Registry [RFC3688]. Following the format in [RFC3688], the
1779 following registrations are requested:
1781 URI: urn:ietf:params:xml:ns:yang:ietf-netconf-client
1782 Registrant Contact: The NETCONF WG of the IETF.
1783 XML: N/A, the requested URI is an XML namespace.
1785 URI: urn:ietf:params:xml:ns:yang:ietf-netconf-server
1786 Registrant Contact: The NETCONF WG of the IETF.
1787 XML: N/A, the requested URI is an XML namespace.
1789 6.2. The YANG Module Names Registry
1791 This document registers two YANG modules in the YANG Module Names
1792 registry [RFC6020]. Following the format in [RFC6020], the the
1793 following registrations are requested:
1795 name: ietf-netconf-client
1796 namespace: urn:ietf:params:xml:ns:yang:ietf-netconf-client
1797 prefix: ncc
1798 reference: RFC XXXX
1800 name: ietf-netconf-server
1801 namespace: urn:ietf:params:xml:ns:yang:ietf-netconf-server
1802 prefix: ncs
1803 reference: RFC XXXX
1805 7. References
1807 7.1. Normative References
1809 [I-D.ietf-netconf-keystore]
1810 Watsen, K., "YANG Data Model for a Centralized Keystore
1811 Mechanism", draft-ietf-netconf-keystore-08 (work in
1812 progress), March 2019.
1814 [I-D.ietf-netconf-ssh-client-server]
1815 Watsen, K., Wu, G., and L. Xia, "YANG Groupings for SSH
1816 Clients and SSH Servers", draft-ietf-netconf-ssh-client-
1817 server-12 (work in progress), April 2019.
1819 [I-D.ietf-netconf-tls-client-server]
1820 Watsen, K., Wu, G., and L. Xia, "YANG Groupings for TLS
1821 Clients and TLS Servers", draft-ietf-netconf-tls-client-
1822 server-11 (work in progress), April 2019.
1824 [I-D.kwatsen-netconf-tcp-client-server]
1825 Watsen, K., "YANG Groupings for TCP Clients and TCP
1826 Servers", draft-kwatsen-netconf-tcp-client-server-01 (work
1827 in progress), April 2019.
1829 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
1830 Requirement Levels", BCP 14, RFC 2119,
1831 DOI 10.17487/RFC2119, March 1997,
1832 .
1834 [RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for
1835 the Network Configuration Protocol (NETCONF)", RFC 6020,
1836 DOI 10.17487/RFC6020, October 2010,
1837 .
1839 [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
1840 and A. Bierman, Ed., "Network Configuration Protocol
1841 (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
1842 .
1844 [RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure
1845 Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
1846 .
1848 [RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types",
1849 RFC 6991, DOI 10.17487/RFC6991, July 2013,
1850 .
1852 [RFC7407] Bjorklund, M. and J. Schoenwaelder, "A YANG Data Model for
1853 SNMP Configuration", RFC 7407, DOI 10.17487/RFC7407,
1854 December 2014, .
1856 [RFC7589] Badra, M., Luchuk, A., and J. Schoenwaelder, "Using the
1857 NETCONF Protocol over Transport Layer Security (TLS) with
1858 Mutual X.509 Authentication", RFC 7589,
1859 DOI 10.17487/RFC7589, June 2015,
1860 .
1862 [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
1863 RFC 7950, DOI 10.17487/RFC7950, August 2016,
1864 .
1866 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
1867 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
1868 May 2017, .
1870 7.2. Informative References
1872 [I-D.ietf-netconf-trust-anchors]
1873 Watsen, K., "YANG Data Model for Global Trust Anchors",
1874 draft-ietf-netconf-trust-anchors-03 (work in progress),
1875 March 2019.
1877 [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
1878 DOI 10.17487/RFC3688, January 2004,
1879 .
1881 [RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
1882 Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
1883 .
1885 [RFC8071] Watsen, K., "NETCONF Call Home and RESTCONF Call Home",
1886 RFC 8071, DOI 10.17487/RFC8071, February 2017,
1887 .
1889 [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
1890 BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
1891 .
1893 [RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration
1894 Access Control Model", STD 91, RFC 8341,
1895 DOI 10.17487/RFC8341, March 2018,
1896 .
1898 Appendix A. Expanded Tree Diagrams
1900 A.1. Expanded Tree Diagram for 'ietf-netconf-client'
1902 The following tree diagram [RFC8340] provides an overview of the data
1903 model for the "ietf-netconf-client" module.
1905 This tree diagram shows all the nodes defined in this module,
1906 including those defined by "grouping" statements used by this module.
1908 Please see Section 3.1 for a tree diagram that illustrates what the
1909 module looks like without all the "grouping" statements expanded.
1911 =========== NOTE: '\' line wrapping per BCP XX (RFC XXXX) ===========
1913 module: ietf-netconf-client
1914 +--rw netconf-client
1915 +--rw initiate! {ssh-initiate or tls-initiate}?
1916 | +--rw netconf-server* [name]
1917 | +--rw name string
1918 | +--rw endpoints
1919 | | +--rw endpoint* [name]
1920 | | +--rw name string
1921 | | +--rw (transport)
1922 | | +--:(ssh) {ssh-initiate}?
1923 | | | +--rw ssh
1924 | | | +--rw tcp-client-parameters
1925 | | | | +--rw remote-address inet:host
1926 | | | | +--rw remote-port? inet:port-number
1927 | | | | +--rw local-address? inet:ip-address
1928 | | | | +--rw local-port? inet:port-number
1929 | | | | +--rw keepalives!
1930 | | | | +--rw idle-time uint16
1931 | | | | +--rw max-probes uint16
1932 | | | | +--rw probe-interval uint16
1933 | | | +--rw ssh-client-parameters
1934 | | | +--rw client-identity
1935 | | | | +--rw username? string
1936 | | | | +--rw (auth-type)
1937 | | | | +--:(password)
1938 | | | | | +--rw password? string
1939 | | | | +--:(public-key)
1940 | | | | | +--rw public-key
1941 | | | | | +--rw (local-or-keystore)
1942 | | | | | +--:(local)
1943 | | | | | | {local-keys-sup\
1944 ported}?
1945 | | | | | | +--rw local-definition
1946 | | | | | | +--rw algorithm?
1947 | | | | | | | asymmetric\
1948 -key-algorithm-ref
1949 | | | | | | +--rw public-key?
1950 | | | | | | | binary
1951 | | | | | | +--rw private-key?
1952 | | | | | | | union
1953 | | | | | | +---x generate-hid\
1954 den-key
1955 | | | | | | | +---w input
1956 | | | | | | | +---w algori\
1957 thm
1958 | | | | | | | asym\
1959 metric-key-algorithm-ref
1960 | | | | | | +---x install-hidd\
1961 en-key
1962 | | | | | | +---w input
1963 | | | | | | +---w algori\
1964 thm
1965 | | | | | | | asym\
1966 metric-key-algorithm-ref
1967 | | | | | | +---w public\
1968 -key?
1969 | | | | | | | bina\
1970 ry
1971 | | | | | | +---w privat\
1972 e-key?
1973 | | | | | | bina\
1974 ry
1975 | | | | | +--:(keystore)
1976 | | | | | {keystore-suppo\
1977 rted}?
1978 | | | | | +--rw keystore-refere\
1979 nce?
1980 | | | | | ks:asymmetric\
1981 -key-ref
1982 | | | | +--:(certificate)
1983 | | | | +--rw certificate
1984 | | | | {sshcmn:ssh-x509-certs\
1985 }?
1986 | | | | +--rw (local-or-keystore)
1987 | | | | +--:(local)
1988 | | | | | {local-keys-sup\
1989 ported}?
1990 | | | | | +--rw local-definition
1991 | | | | | +--rw algorithm?
1992 | | | | | | asymmetric\
1993 -key-algorithm-ref
1994 | | | | | +--rw public-key?
1995 | | | | | | binary
1996 | | | | | +--rw private-key?
1997 | | | | | | union
1998 | | | | | +---x generate-hid\
1999 den-key
2000 | | | | | | +---w input
2001 | | | | | | +---w algori\
2002 thm
2003 | | | | | | asym\
2004 metric-key-algorithm-ref
2005 | | | | | +---x install-hidd\
2006 en-key
2007 | | | | | | +---w input
2008 | | | | | | +---w algori\
2009 thm
2010 | | | | | | | asym\
2011 metric-key-algorithm-ref
2012 | | | | | | +---w public\
2013 -key?
2014 | | | | | | | bina\
2015 ry
2016 | | | | | | +---w privat\
2017 e-key?
2018 | | | | | | bina\
2019 ry
2020 | | | | | +--rw cert?
2021 | | | | | | end-entity\
2022 -cert-cms
2023 | | | | | +---n certificate-\
2024 expiration
2025 | | | | | +-- expiration-\
2026 date
2027 | | | | | yang:da\
2028 te-and-time
2029 | | | | +--:(keystore)
2030 | | | | {keystore-suppo\
2031 rted}?
2032 | | | | +--rw keystore-refere\
2033 nce?
2034 | | | | ks:asymmetric\
2035 -key-certificate-ref
2036 | | | +--rw server-authentication
2037 | | | | +--rw pinned-ssh-host-keys?
2038 | | | | | ta:pinned-host-keys-ref
2039 | | | | | {ta:ssh-host-keys}?
2040 | | | | +--rw pinned-ca-certs?
2041 | | | | | ta:pinned-certificates-ref
2042 | | | | | {sshcmn:ssh-x509-certs,ta:x5\
2043 09-certificates}?
2044 | | | | +--rw pinned-server-certs?
2045 | | | | ta:pinned-certificates-ref
2046 | | | | {sshcmn:ssh-x509-certs,ta:x5\
2047 09-certificates}?
2048 | | | +--rw transport-params
2049 | | | | {ssh-client-transport-params-co\
2050 nfig}?
2051 | | | | +--rw host-key
2052 | | | | | +--rw host-key-alg* identityref
2053 | | | | +--rw key-exchange
2054 | | | | | +--rw key-exchange-alg*
2055 | | | | | identityref
2056 | | | | +--rw encryption
2057 | | | | | +--rw encryption-alg*
2058 | | | | | identityref
2059 | | | | +--rw mac
2060 | | | | +--rw mac-alg* identityref
2061 | | | +--rw keepalives!
2062 | | | {ssh-client-keepalives}?
2063 | | | +--rw max-wait? uint16
2064 | | | +--rw max-attempts? uint8
2065 | | +--:(tls) {tls-initiate}?
2066 | | +--rw tls
2067 | | +--rw tcp-client-parameters
2068 | | | +--rw remote-address inet:host
2069 | | | +--rw remote-port? inet:port-number
2070 | | | +--rw local-address? inet:ip-address
2071 | | | +--rw local-port? inet:port-number
2072 | | | +--rw keepalives!
2073 | | | +--rw idle-time uint16
2074 | | | +--rw max-probes uint16
2075 | | | +--rw probe-interval uint16
2076 | | +--rw tls-client-parameters
2077 | | +--rw client-identity
2078 | | | +--rw (auth-type)
2079 | | | +--:(certificate)
2080 | | | +--rw certificate
2081 | | | +--rw (local-or-keystore)
2082 | | | +--:(local)
2083 | | | | {local-keys-sup\
2084 ported}?
2085 | | | | +--rw local-definition
2086 | | | | +--rw algorithm?
2087 | | | | | asymmetric\
2088 -key-algorithm-ref
2089 | | | | +--rw public-key?
2090 | | | | | binary
2091 | | | | +--rw private-key?
2092 | | | | | union
2093 | | | | +---x generate-hid\
2094 den-key
2095 | | | | | +---w input
2096 | | | | | +---w algori\
2097 thm
2098 | | | | | asym\
2099 metric-key-algorithm-ref
2100 | | | | +---x install-hidd\
2101 en-key
2102 | | | | | +---w input
2103 | | | | | +---w algori\
2104 thm
2105 | | | | | | asym\
2106 metric-key-algorithm-ref
2107 | | | | | +---w public\
2108 -key?
2109 | | | | | | bina\
2110 ry
2111 | | | | | +---w privat\
2112 e-key?
2113 | | | | | bina\
2114 ry
2115 | | | | +--rw cert?
2116 | | | | | end-entity\
2117 -cert-cms
2118 | | | | +---n certificate-\
2119 expiration
2120 | | | | +-- expiration-\
2121 date
2122 | | | | yang:da\
2123 te-and-time
2124 | | | +--:(keystore)
2125 | | | {keystore-suppo\
2126 rted}?
2127 | | | +--rw keystore-refere\
2128 nce?
2129 | | | ks:asymmetric\
2130 -key-certificate-ref
2131 | | +--rw server-authentication
2132 | | | +--rw pinned-ca-certs?
2133 | | | | ta:pinned-certificates-ref
2134 | | | | {ta:x509-certificates}?
2135 | | | +--rw pinned-server-certs?
2136 | | | ta:pinned-certificates-ref
2137 | | | {ta:x509-certificates}?
2138 | | +--rw hello-params
2139 | | | {tls-client-hello-params-config\
2140 }?
2141 | | | +--rw tls-versions
2142 | | | | +--rw tls-version* identityref
2143 | | | +--rw cipher-suites
2144 | | | +--rw cipher-suite* identityref
2145 | | +--rw keepalives!
2146 | | {tls-client-keepalives}?
2147 | | +--rw max-wait? uint16
2148 | | +--rw max-attempts? uint8
2149 | +--rw connection-type
2150 | | +--rw (connection-type)
2151 | | +--:(persistent-connection)
2152 | | | +--rw persistent!
2153 | | +--:(periodic-connection)
2154 | | +--rw periodic!
2155 | | +--rw period? uint16
2156 | | +--rw anchor-time? yang:date-and-time
2157 | | +--rw idle-timeout? uint16
2158 | +--rw reconnect-strategy
2159 | +--rw start-with? enumeration
2160 | +--rw max-attempts? uint8
2161 +--rw listen! {ssh-listen or tls-listen}?
2162 +--rw idle-timeout? uint16
2163 +--rw endpoint* [name]
2164 +--rw name string
2165 +--rw (transport)
2166 +--:(ssh) {ssh-listen}?
2167 | +--rw ssh
2168 | +--rw tcp-server-parameters
2169 | | +--rw local-address inet:ip-address
2170 | | +--rw local-port? inet:port-number
2171 | | +--rw keepalives!
2172 | | +--rw idle-time uint16
2173 | | +--rw max-probes uint16
2174 | | +--rw probe-interval uint16
2175 | +--rw ssh-client-parameters
2176 | +--rw client-identity
2177 | | +--rw username? string
2178 | | +--rw (auth-type)
2179 | | +--:(password)
2180 | | | +--rw password? string
2181 | | +--:(public-key)
2182 | | | +--rw public-key
2183 | | | +--rw (local-or-keystore)
2184 | | | +--:(local)
2185 | | | | {local-keys-supported\
2187 }?
2188 | | | | +--rw local-definition
2189 | | | | +--rw algorithm?
2190 | | | | | asymmetric-key-a\
2191 lgorithm-ref
2192 | | | | +--rw public-key?
2193 | | | | | binary
2194 | | | | +--rw private-key?
2195 | | | | | union
2196 | | | | +---x generate-hidden-key
2197 | | | | | +---w input
2198 | | | | | +---w algorithm
2199 | | | | | asymmetric\
2200 -key-algorithm-ref
2201 | | | | +---x install-hidden-key
2202 | | | | +---w input
2203 | | | | +---w algorithm
2204 | | | | | asymmetric\
2205 -key-algorithm-ref
2206 | | | | +---w public-key?
2207 | | | | | binary
2208 | | | | +---w private-key?
2209 | | | | binary
2210 | | | +--:(keystore)
2211 | | | {keystore-supported}?
2212 | | | +--rw keystore-reference?
2213 | | | ks:asymmetric-key-r\
2214 ef
2215 | | +--:(certificate)
2216 | | +--rw certificate
2217 | | {sshcmn:ssh-x509-certs}?
2218 | | +--rw (local-or-keystore)
2219 | | +--:(local)
2220 | | | {local-keys-supported\
2221 }?
2222 | | | +--rw local-definition
2223 | | | +--rw algorithm?
2224 | | | | asymmetric-key-a\
2225 lgorithm-ref
2226 | | | +--rw public-key?
2227 | | | | binary
2228 | | | +--rw private-key?
2229 | | | | union
2230 | | | +---x generate-hidden-key
2231 | | | | +---w input
2232 | | | | +---w algorithm
2233 | | | | asymmetric\
2234 -key-algorithm-ref
2235 | | | +---x install-hidden-key
2236 | | | | +---w input
2237 | | | | +---w algorithm
2238 | | | | | asymmetric\
2239 -key-algorithm-ref
2240 | | | | +---w public-key?
2241 | | | | | binary
2242 | | | | +---w private-key?
2243 | | | | binary
2244 | | | +--rw cert?
2245 | | | | end-entity-cert-\
2246 cms
2247 | | | +---n certificate-expira\
2248 tion
2249 | | | +-- expiration-date
2250 | | | yang:date-and\
2251 -time
2252 | | +--:(keystore)
2253 | | {keystore-supported}?
2254 | | +--rw keystore-reference?
2255 | | ks:asymmetric-key-c\
2256 ertificate-ref
2257 | +--rw server-authentication
2258 | | +--rw pinned-ssh-host-keys?
2259 | | | ta:pinned-host-keys-ref
2260 | | | {ta:ssh-host-keys}?
2261 | | +--rw pinned-ca-certs?
2262 | | | ta:pinned-certificates-ref
2263 | | | {sshcmn:ssh-x509-certs,ta:x509-cer\
2264 tificates}?
2265 | | +--rw pinned-server-certs?
2266 | | ta:pinned-certificates-ref
2267 | | {sshcmn:ssh-x509-certs,ta:x509-cer\
2268 tificates}?
2269 | +--rw transport-params
2270 | | {ssh-client-transport-params-config}?
2271 | | +--rw host-key
2272 | | | +--rw host-key-alg* identityref
2273 | | +--rw key-exchange
2274 | | | +--rw key-exchange-alg* identityref
2275 | | +--rw encryption
2276 | | | +--rw encryption-alg* identityref
2277 | | +--rw mac
2278 | | +--rw mac-alg* identityref
2279 | +--rw keepalives! {ssh-client-keepalives}?
2280 | +--rw max-wait? uint16
2281 | +--rw max-attempts? uint8
2282 +--:(tls) {tls-listen}?
2283 +--rw tls
2284 +--rw tcp-server-parameters
2285 | +--rw local-address inet:ip-address
2286 | +--rw local-port? inet:port-number
2287 | +--rw keepalives!
2288 | +--rw idle-time uint16
2289 | +--rw max-probes uint16
2290 | +--rw probe-interval uint16
2291 +--rw tls-client-parameters
2292 +--rw client-identity
2293 | +--rw (auth-type)
2294 | +--:(certificate)
2295 | +--rw certificate
2296 | +--rw (local-or-keystore)
2297 | +--:(local)
2298 | | {local-keys-supported\
2299 }?
2300 | | +--rw local-definition
2301 | | +--rw algorithm?
2302 | | | asymmetric-key-a\
2303 lgorithm-ref
2304 | | +--rw public-key?
2305 | | | binary
2306 | | +--rw private-key?
2307 | | | union
2308 | | +---x generate-hidden-key
2309 | | | +---w input
2310 | | | +---w algorithm
2311 | | | asymmetric\
2312 -key-algorithm-ref
2313 | | +---x install-hidden-key
2314 | | | +---w input
2315 | | | +---w algorithm
2316 | | | | asymmetric\
2317 -key-algorithm-ref
2318 | | | +---w public-key?
2319 | | | | binary
2320 | | | +---w private-key?
2321 | | | binary
2322 | | +--rw cert?
2323 | | | end-entity-cert-\
2324 cms
2325 | | +---n certificate-expira\
2326 tion
2327 | | +-- expiration-date
2328 | | yang:date-and\
2329 -time
2330 | +--:(keystore)
2331 | {keystore-supported}?
2332 | +--rw keystore-reference?
2333 | ks:asymmetric-key-c\
2334 ertificate-ref
2335 +--rw server-authentication
2336 | +--rw pinned-ca-certs?
2337 | | ta:pinned-certificates-ref
2338 | | {ta:x509-certificates}?
2339 | +--rw pinned-server-certs?
2340 | ta:pinned-certificates-ref
2341 | {ta:x509-certificates}?
2342 +--rw hello-params
2343 | {tls-client-hello-params-config}?
2344 | +--rw tls-versions
2345 | | +--rw tls-version* identityref
2346 | +--rw cipher-suites
2347 | +--rw cipher-suite* identityref
2348 +--rw keepalives! {tls-client-keepalives}?
2349 +--rw max-wait? uint16
2350 +--rw max-attempts? uint8
2352 A.2. Expanded Tree Diagram for 'ietf-netconf-server'
2354 The following tree diagram [RFC8340] provides an overview of the data
2355 model for the "ietf-netconf-server" module.
2357 This tree diagram shows all the nodes defined in this module,
2358 including those defined by "grouping" statements used by this module.
2360 Please see Section 4.1 for a tree diagram that illustrates what the
2361 module looks like without all the "grouping" statements expanded.
2363 =========== NOTE: '\' line wrapping per BCP XX (RFC XXXX) ===========
2365 module: ietf-netconf-server
2366 +--rw netconf-server
2367 +--rw listen! {ssh-listen or tls-listen}?
2368 | +--rw idle-timeout? uint16
2369 | +--rw endpoint* [name]
2370 | +--rw name string
2371 | +--rw (transport)
2372 | +--:(ssh) {ssh-listen}?
2373 | | +--rw ssh
2374 | | +--rw tcp-server-parameters
2375 | | | +--rw local-address inet:ip-address
2376 | | | +--rw local-port? inet:port-number
2377 | | | +--rw keepalives!
2378 | | | +--rw idle-time uint16
2379 | | | +--rw max-probes uint16
2380 | | | +--rw probe-interval uint16
2381 | | +--rw ssh-server-parameters
2382 | | +--rw server-identity
2383 | | | +--rw host-key* [name]
2384 | | | +--rw name string
2385 | | | +--rw (host-key-type)
2386 | | | +--:(public-key)
2387 | | | | +--rw public-key
2388 | | | | +--rw (local-or-keystore)
2389 | | | | +--:(local)
2390 | | | | | {local-keys-suppor\
2391 ted}?
2392 | | | | | +--rw local-definition
2393 | | | | | +--rw algorithm?
2394 | | | | | | asymmetric-ke\
2395 y-algorithm-ref
2396 | | | | | +--rw public-key?
2397 | | | | | | binary
2398 | | | | | +--rw private-key?
2399 | | | | | | union
2400 | | | | | +---x generate-hidden\
2401 -key
2402 | | | | | | +---w input
2403 | | | | | | +---w algorithm
2404 | | | | | | asymmet\
2405 ric-key-algorithm-ref
2406 | | | | | +---x install-hidden-\
2407 key
2408 | | | | | +---w input
2409 | | | | | +---w algorithm
2410 | | | | | | asymmet\
2411 ric-key-algorithm-ref
2412 | | | | | +---w public-ke\
2413 y?
2414 | | | | | | binary
2415 | | | | | +---w private-k\
2416 ey?
2417 | | | | | binary
2418 | | | | +--:(keystore)
2419 | | | | {keystore-supporte\
2420 d}?
2421 | | | | +--rw keystore-reference?
2422 | | | | ks:asymmetric-ke\
2423 y-ref
2424 | | | +--:(certificate)
2425 | | | +--rw certificate
2426 | | | {sshcmn:ssh-x509-certs}?
2427 | | | +--rw (local-or-keystore)
2428 | | | +--:(local)
2429 | | | | {local-keys-suppor\
2430 ted}?
2431 | | | | +--rw local-definition
2432 | | | | +--rw algorithm?
2433 | | | | | asymmetric-ke\
2434 y-algorithm-ref
2435 | | | | +--rw public-key?
2436 | | | | | binary
2437 | | | | +--rw private-key?
2438 | | | | | union
2439 | | | | +---x generate-hidden\
2440 -key
2441 | | | | | +---w input
2442 | | | | | +---w algorithm
2443 | | | | | asymmet\
2444 ric-key-algorithm-ref
2445 | | | | +---x install-hidden-\
2446 key
2447 | | | | | +---w input
2448 | | | | | +---w algorithm
2449 | | | | | | asymmet\
2450 ric-key-algorithm-ref
2451 | | | | | +---w public-ke\
2452 y?
2453 | | | | | | binary
2454 | | | | | +---w private-k\
2455 ey?
2456 | | | | | binary
2457 | | | | +--rw cert?
2458 | | | | | end-entity-ce\
2459 rt-cms
2460 | | | | +---n certificate-exp\
2461 iration
2462 | | | | +-- expiration-date
2463 | | | | yang:date-\
2464 and-time
2465 | | | +--:(keystore)
2466 | | | {keystore-supporte\
2467 d}?
2468 | | | +--rw keystore-reference?
2469 | | | ks:asymmetric-ke\
2470 y-certificate-ref
2471 | | +--rw client-authentication
2472 | | | +--rw supported-authentication-methods
2473 | | | | +--rw publickey? empty
2474 | | | | +--rw passsword? empty
2475 | | | | +--rw hostbased? empty
2476 | | | | +--rw none? empty
2477 | | | | +--rw other* string
2478 | | | +--rw (local-or-external)
2479 | | | +--:(local)
2480 | | | | {local-client-auth-supported}?
2481 | | | | +--rw users
2482 | | | | +--rw user* [name]
2483 | | | | +--rw name string
2484 | | | | +--rw password?
2485 | | | | | ianach:crypt-hash
2486 | | | | +--rw authorized-key* [name]
2487 | | | | +--rw name string
2488 | | | | +--rw algorithm string
2489 | | | | +--rw key-data binary
2490 | | | +--:(external)
2491 | | | {external-client-auth-supporte\
2492 d}?
2493 | | | +--rw client-auth-defined-elsewhere?
2494 | | | empty
2495 | | +--rw transport-params
2496 | | | {ssh-server-transport-params-config}?
2497 | | | +--rw host-key
2498 | | | | +--rw host-key-alg* identityref
2499 | | | +--rw key-exchange
2500 | | | | +--rw key-exchange-alg* identityref
2501 | | | +--rw encryption
2502 | | | | +--rw encryption-alg* identityref
2503 | | | +--rw mac
2504 | | | +--rw mac-alg* identityref
2505 | | +--rw keepalives! {ssh-server-keepalives}?
2506 | | +--rw max-wait? uint16
2507 | | +--rw max-attempts? uint8
2508 | +--:(tls) {tls-listen}?
2509 | +--rw tls
2510 | +--rw tcp-server-parameters
2511 | | +--rw local-address inet:ip-address
2512 | | +--rw local-port? inet:port-number
2513 | | +--rw keepalives!
2514 | | +--rw idle-time uint16
2515 | | +--rw max-probes uint16
2516 | | +--rw probe-interval uint16
2517 | +--rw tls-server-parameters
2518 | +--rw server-identity
2519 | | +--rw (local-or-keystore)
2520 | | +--:(local) {local-keys-supported}?
2521 | | | +--rw local-definition
2522 | | | +--rw algorithm?
2523 | | | | asymmetric-key-algorithm-\
2524 ref
2525 | | | +--rw public-key?
2526 | | | | binary
2527 | | | +--rw private-key?
2528 | | | | union
2529 | | | +---x generate-hidden-key
2530 | | | | +---w input
2531 | | | | +---w algorithm
2532 | | | | asymmetric-key-algo\
2533 rithm-ref
2534 | | | +---x install-hidden-key
2535 | | | | +---w input
2536 | | | | +---w algorithm
2537 | | | | | asymmetric-key-algo\
2538 rithm-ref
2539 | | | | +---w public-key? binary
2540 | | | | +---w private-key? binary
2541 | | | +--rw cert?
2542 | | | | end-entity-cert-cms
2543 | | | +---n certificate-expiration
2544 | | | +-- expiration-date
2545 | | | yang:date-and-time
2546 | | +--:(keystore) {keystore-supported}?
2547 | | +--rw keystore-reference?
2548 | | ks:asymmetric-key-certificat\
2549 e-ref
2550 | +--rw client-authentication!
2551 | | +--rw (required-or-optional)
2552 | | | +--:(required)
2553 | | | | +--rw required?
2554 | | | | empty
2555 | | | +--:(optional)
2556 | | | +--rw optional?
2557 | | | empty
2558 | | +--rw (local-or-external)
2559 | | | +--:(local)
2560 | | | | {local-client-auth-supported}?
2561 | | | | +--rw pinned-ca-certs?
2562 | | | | | ta:pinned-certificates-ref
2563 | | | | | {ta:x509-certificates}?
2564 | | | | +--rw pinned-client-certs?
2565 | | | | ta:pinned-certificates-ref
2566 | | | | {ta:x509-certificates}?
2567 | | | +--:(external)
2568 | | | {external-client-auth-supporte\
2569 d}?
2570 | | | +--rw client-auth-defined-elsewhere?
2571 | | | empty
2572 | | +--rw cert-maps
2573 | | +--rw cert-to-name* [id]
2574 | | +--rw id uint32
2575 | | +--rw fingerprint
2576 | | | x509c2n:tls-fingerprint
2577 | | +--rw map-type identityref
2578 | | +--rw name string
2579 | +--rw hello-params
2580 | | {tls-server-hello-params-config}?
2581 | | +--rw tls-versions
2582 | | | +--rw tls-version* identityref
2583 | | +--rw cipher-suites
2584 | | +--rw cipher-suite* identityref
2585 | +--rw keepalives! {tls-server-keepalives}?
2586 | +--rw max-wait? uint16
2587 | +--rw max-attempts? uint8
2588 +--rw call-home! {ssh-call-home or tls-call-home}?
2589 +--rw netconf-client* [name]
2590 +--rw name string
2591 +--rw endpoints
2592 | +--rw endpoint* [name]
2593 | +--rw name string
2594 | +--rw (transport)
2595 | +--:(ssh) {ssh-call-home}?
2596 | | +--rw ssh
2597 | | +--rw tcp-client-parameters
2598 | | | +--rw remote-address inet:host
2599 | | | +--rw remote-port? inet:port-number
2600 | | | +--rw local-address? inet:ip-address
2601 | | | +--rw local-port? inet:port-number
2602 | | | +--rw keepalives!
2603 | | | +--rw idle-time uint16
2604 | | | +--rw max-probes uint16
2605 | | | +--rw probe-interval uint16
2606 | | +--rw ssh-server-parameters
2607 | | +--rw server-identity
2608 | | | +--rw host-key* [name]
2609 | | | +--rw name string
2610 | | | +--rw (host-key-type)
2611 | | | +--:(public-key)
2612 | | | | +--rw public-key
2613 | | | | +--rw (local-or-keystore)
2614 | | | | +--:(local)
2615 | | | | | {local-keys-\
2616 supported}?
2617 | | | | | +--rw local-defini\
2618 tion
2619 | | | | | +--rw algorithm?
2620 | | | | | | asymmet\
2621 ric-key-algorithm-ref
2622 | | | | | +--rw public-ke\
2623 y?
2624 | | | | | | binary
2625 | | | | | +--rw private-k\
2626 ey?
2627 | | | | | | union
2628 | | | | | +---x generate-\
2629 hidden-key
2630 | | | | | | +---w input
2631 | | | | | | +---w alg\
2632 orithm
2633 | | | | | | a\
2634 symmetric-key-algorithm-ref
2635 | | | | | +---x install-h\
2636 idden-key
2637 | | | | | +---w input
2638 | | | | | +---w alg\
2639 orithm
2640 | | | | | | a\
2641 symmetric-key-algorithm-ref
2642 | | | | | +---w pub\
2643 lic-key?
2644 | | | | | | b\
2645 inary
2646 | | | | | +---w pri\
2647 vate-key?
2648 | | | | | b\
2649 inary
2650 | | | | +--:(keystore)
2651 | | | | {keystore-su\
2652 pported}?
2653 | | | | +--rw keystore-ref\
2654 erence?
2655 | | | | ks:asymmet\
2656 ric-key-ref
2657 | | | +--:(certificate)
2658 | | | +--rw certificate
2659 | | | {sshcmn:ssh-x509-ce\
2660 rts}?
2661 | | | +--rw (local-or-keystore)
2662 | | | +--:(local)
2663 | | | | {local-keys-\
2664 supported}?
2665 | | | | +--rw local-defini\
2666 tion
2667 | | | | +--rw algorithm?
2668 | | | | | asymmet\
2669 ric-key-algorithm-ref
2670 | | | | +--rw public-ke\
2671 y?
2672 | | | | | binary
2673 | | | | +--rw private-k\
2674 ey?
2675 | | | | | union
2676 | | | | +---x generate-\
2677 hidden-key
2678 | | | | | +---w input
2679 | | | | | +---w alg\
2680 orithm
2681 | | | | | a\
2682 symmetric-key-algorithm-ref
2683 | | | | +---x install-h\
2684 idden-key
2685 | | | | | +---w input
2686 | | | | | +---w alg\
2687 orithm
2688 | | | | | | a\
2689 symmetric-key-algorithm-ref
2690 | | | | | +---w pub\
2691 lic-key?
2692 | | | | | | b\
2693 inary
2694 | | | | | +---w pri\
2695 vate-key?
2696 | | | | | b\
2697 inary
2698 | | | | +--rw cert?
2699 | | | | | end-ent\
2700 ity-cert-cms
2701 | | | | +---n certifica\
2702 te-expiration
2703 | | | | +-- expirati\
2704 on-date
2705 | | | | yang\
2706 :date-and-time
2707 | | | +--:(keystore)
2708 | | | {keystore-su\
2709 pported}?
2710 | | | +--rw keystore-ref\
2711 erence?
2712 | | | ks:asymmet\
2713 ric-key-certificate-ref
2714 | | +--rw client-authentication
2715 | | | +--rw supported-authentication-metho\
2716 ds
2717 | | | | +--rw publickey? empty
2718 | | | | +--rw passsword? empty
2719 | | | | +--rw hostbased? empty
2720 | | | | +--rw none? empty
2721 | | | | +--rw other* string
2722 | | | +--rw (local-or-external)
2723 | | | +--:(local)
2724 | | | | {local-client-auth-suppo\
2725 rted}?
2726 | | | | +--rw users
2727 | | | | +--rw user* [name]
2728 | | | | +--rw name
2729 | | | | | string
2730 | | | | +--rw password?
2731 | | | | | ianach:crypt-hash
2732 | | | | +--rw authorized-key*
2733 | | | | [name]
2734 | | | | +--rw name
2735 | | | | | string
2736 | | | | +--rw algorithm
2737 | | | | | string
2738 | | | | +--rw key-data
2739 | | | | binary
2740 | | | +--:(external)
2741 | | | {external-client-auth-su\
2742 pported}?
2743 | | | +--rw client-auth-defined-else\
2744 where?
2745 | | | empty
2746 | | +--rw transport-params
2747 | | | {ssh-server-transport-params-co\
2748 nfig}?
2749 | | | +--rw host-key
2750 | | | | +--rw host-key-alg* identityref
2751 | | | +--rw key-exchange
2752 | | | | +--rw key-exchange-alg*
2753 | | | | identityref
2754 | | | +--rw encryption
2755 | | | | +--rw encryption-alg*
2756 | | | | identityref
2757 | | | +--rw mac
2758 | | | +--rw mac-alg* identityref
2759 | | +--rw keepalives!
2760 | | {ssh-server-keepalives}?
2761 | | +--rw max-wait? uint16
2762 | | +--rw max-attempts? uint8
2763 | +--:(tls) {tls-call-home}?
2764 | +--rw tls
2765 | +--rw tcp-client-parameters
2766 | | +--rw remote-address inet:host
2767 | | +--rw remote-port? inet:port-number
2768 | | +--rw local-address? inet:ip-address
2769 | | +--rw local-port? inet:port-number
2770 | | +--rw keepalives!
2771 | | +--rw idle-time uint16
2772 | | +--rw max-probes uint16
2773 | | +--rw probe-interval uint16
2774 | +--rw tls-server-parameters
2775 | +--rw server-identity
2776 | | +--rw (local-or-keystore)
2777 | | +--:(local)
2778 | | | {local-keys-supported}?
2779 | | | +--rw local-definition
2780 | | | +--rw algorithm?
2781 | | | | asymmetric-key-algo\
2782 rithm-ref
2783 | | | +--rw public-key?
2784 | | | | binary
2785 | | | +--rw private-key?
2786 | | | | union
2787 | | | +---x generate-hidden-key
2788 | | | | +---w input
2789 | | | | +---w algorithm
2790 | | | | asymmetric-ke\
2791 y-algorithm-ref
2792 | | | +---x install-hidden-key
2793 | | | | +---w input
2794 | | | | +---w algorithm
2795 | | | | | asymmetric-ke\
2796 y-algorithm-ref
2797 | | | | +---w public-key?
2798 | | | | | binary
2799 | | | | +---w private-key?
2800 | | | | binary
2801 | | | +--rw cert?
2802 | | | | end-entity-cert-cms
2803 | | | +---n certificate-expiration
2804 | | | +-- expiration-date
2805 | | | yang:date-and-ti\
2806 me
2807 | | +--:(keystore)
2808 | | {keystore-supported}?
2809 | | +--rw keystore-reference?
2810 | | ks:asymmetric-key-cert\
2812 ificate-ref
2813 | +--rw client-authentication!
2814 | | +--rw (required-or-optional)
2815 | | | +--:(required)
2816 | | | | +--rw required?
2817 | | | | empty
2818 | | | +--:(optional)
2819 | | | +--rw optional?
2820 | | | empty
2821 | | +--rw (local-or-external)
2822 | | | +--:(local)
2823 | | | | {local-client-auth-suppo\
2824 rted}?
2825 | | | | +--rw pinned-ca-certs?
2826 | | | | | ta:pinned-certificates\
2827 -ref
2828 | | | | | {ta:x509-certificates}?
2829 | | | | +--rw pinned-client-certs?
2830 | | | | ta:pinned-certificates\
2831 -ref
2832 | | | | {ta:x509-certificates}?
2833 | | | +--:(external)
2834 | | | {external-client-auth-su\
2835 pported}?
2836 | | | +--rw client-auth-defined-else\
2837 where?
2838 | | | empty
2839 | | +--rw cert-maps
2840 | | +--rw cert-to-name* [id]
2841 | | +--rw id uint32
2842 | | +--rw fingerprint
2843 | | | x509c2n:tls-fingerprint
2844 | | +--rw map-type
2845 | | | identityref
2846 | | +--rw name string
2847 | +--rw hello-params
2848 | | {tls-server-hello-params-config\
2849 }?
2850 | | +--rw tls-versions
2851 | | | +--rw tls-version* identityref
2852 | | +--rw cipher-suites
2853 | | +--rw cipher-suite* identityref
2854 | +--rw keepalives!
2855 | {tls-server-keepalives}?
2856 | +--rw max-wait? uint16
2857 | +--rw max-attempts? uint8
2858 +--rw connection-type
2859 | +--rw (connection-type)
2860 | +--:(persistent-connection)
2861 | | +--rw persistent!
2862 | +--:(periodic-connection)
2863 | +--rw periodic!
2864 | +--rw period? uint16
2865 | +--rw anchor-time? yang:date-and-time
2866 | +--rw idle-timeout? uint16
2867 +--rw reconnect-strategy
2868 +--rw start-with? enumeration
2869 +--rw max-attempts? uint8
2871 Appendix B. Change Log
2873 B.1. 00 to 01
2875 o Renamed "keychain" to "keystore".
2877 B.2. 01 to 02
2879 o Added to ietf-netconf-client ability to connected to a cluster of
2880 endpoints, including a reconnection-strategy.
2882 o Added to ietf-netconf-client the ability to configure connection-
2883 type and also keep-alive strategy.
2885 o Updated both modules to accommodate new groupings in the ssh/tls
2886 drafts.
2888 B.3. 02 to 03
2890 o Refined use of tls-client-grouping to add a must statement
2891 indicating that the TLS client must specify a client-certificate.
2893 o Changed 'netconf-client' to be a grouping (not a container).
2895 B.4. 03 to 04
2897 o Added RFC 8174 to Requirements Language Section.
2899 o Replaced refine statement in ietf-netconf-client to add a
2900 mandatory true.
2902 o Added refine statement in ietf-netconf-server to add a must
2903 statement.
2905 o Now there are containers and groupings, for both the client and
2906 server models.
2908 B.5. 04 to 05
2910 o Now tree diagrams reference ietf-netmod-yang-tree-diagrams
2912 o Updated examples to inline key and certificates (no longer a
2913 leafref to keystore)
2915 B.6. 05 to 06
2917 o Fixed change log missing section issue.
2919 o Updated examples to match latest updates to the crypto-types,
2920 trust-anchors, and keystore drafts.
2922 o Reduced line length of the YANG modules to fit within 69 columns.
2924 B.7. 06 to 07
2926 o Removed "idle-timeout" from "persistent" connection config.
2928 o Added "random-selection" for reconnection-strategy's "starts-with"
2929 enum.
2931 o Replaced "connection-type" choice default (persistent) with
2932 "mandatory true".
2934 o Reduced the periodic-connection's "idle-timeout" from 5 to 2
2935 minutes.
2937 o Replaced reconnect-timeout with period/anchor-time combo.
2939 B.8. 07 to 08
2941 o Modified examples to be compatible with new crypto-types algs
2943 B.9. 08 to 09
2945 o Corrected use of "mandatory true" for "address" leafs.
2947 o Updated examples to reflect update to groupings defined in the
2948 keystore draft.
2950 o Updated to use groupings defined in new TCP and HTTP drafts.
2952 o Updated copyright date, boilerplate template, affiliation, and
2953 folding algorithm.
2955 B.10. 09 to 10
2957 o Reformatted YANG modules.
2959 B.11. 10 to 11
2961 o Adjusted for the top-level "demux container" added to groupings
2962 imported from other modules.
2964 o Added "must" expressions to ensure that keepalives are not
2965 configured for "periodic" connections.
2967 o Updated the boilerplate text in module-level "description"
2968 statement to match copyeditor convention.
2970 o Moved "expanded" tree diagrams to the Appendix.
2972 B.12. 11 to 12
2974 o Removed the "Design Considerations" section.
2976 o Removed the 'must' statement limiting keepalives in periodic
2977 connections.
2979 o Updated models and examples to reflect removal of the "demux"
2980 containers in the imported models.
2982 o Updated the "periodic-connnection" description statements to be
2983 more like the RESTCONF draft, especially where it described
2984 dropping the underlying TCP connection.
2986 o Updated text to better reference where certain examples come from
2987 (e.g., which Section in which draft).
2989 o In the server model, commented out the "must 'pinned-ca-certs or
2990 pinned-client-certs'" statement to reflect change made in the TLS
2991 draft whereby the trust anchors MAY be defined externally.
2993 o Replaced the 'listen', 'initiate', and 'call-home' features with
2994 boolean expressions.
2996 Acknowledgements
2998 The authors would like to thank for following for lively discussions
2999 on list and in the halls (ordered by last name): Andy Bierman, Martin
3000 Bjorklund, Benoit Claise, Ramkumar Dhanapal, Mehmet Ersue, Balazs
3001 Kovacs, David Lamparter, Alan Luchuk, Ladislav Lhotka, Radek Krejci,
3002 Tom Petch, Juergen Schoenwaelder, Phil Shafer, Sean Turner, and Bert
3003 Wijnen.
3005 Author's Address
3007 Kent Watsen
3008 Watsen Networks
3010 EMail: kent+ietf@watsen.net