[Docs] [txt|pdf|xml|html] [Tracker] [WG] [Email] [Diff1] [Diff2] [Nits]

Versions: (draft-boucadair-softwire-dslite-yang) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 RFC 8513

Network Working Group                                       M. Boucadair
Internet-Draft                                              C. Jacquenet
Intended status: Standards Track                                  Orange
Expires: May 16, 2018                                       S. Sivakumar
                                                           Cisco Systems
                                                       November 12, 2017


            YANG Data Modules for Dual-Stack Lite (DS-Lite)
                   draft-ietf-softwire-dslite-yang-08

Abstract

   This document defines YANG modules for the DS-Lite Address Family
   Transition Router (AFTR) and Basic Bridging BroadBand (B4) elements.

Editorial Note (To be removed by RFC Editor)

   Please update these statements with the RFC number to be assigned to
   this document:

   o  "This version of this YANG module is part of RFC XXXX;"

   o  "RFC XXXX: YANG Data Modules for Dual-Stack Lite (DS-Lite)";

   o  "reference: RFC XXXX"

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on May 16, 2018.








Boucadair, et al.         Expires May 16, 2018                  [Page 1]


Internet-Draft            DS-Lite YANG Modules             November 2017


Copyright Notice

   Copyright (c) 2017 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   4
     1.2.  Tree Diagrams . . . . . . . . . . . . . . . . . . . . . .   4
   2.  DS-Lite YANG Modules: An Overview . . . . . . . . . . . . . .   4
   3.  DS-Lite AFTR YANG Module  . . . . . . . . . . . . . . . . . .   7
   4.  DS-Lite B4 YANG Module  . . . . . . . . . . . . . . . . . . .  12
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .  15
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  16
   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  17
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  17
     8.1.  Normative references  . . . . . . . . . . . . . . . . . .  17
     8.2.  Informative references  . . . . . . . . . . . . . . . . .  18
   Appendix A.  B4 Example . . . . . . . . . . . . . . . . . . . . .  19
   Appendix B.  AFTR Examples  . . . . . . . . . . . . . . . . . . .  19
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  20

1.  Introduction

   This document defines data models for DS-Lite [RFC6333], using the
   YANG data modeling language [RFC7950].  Both the Address Family
   Transition Router (AFTR) and Basic Bridging BroadBand (B4) elements
   are covered by this specification.

   As a reminder, Figure 1 illustrates an overview of the DS-Lite
   architecture that involves AFTR and B4 elements.









Boucadair, et al.         Expires May 16, 2018                  [Page 2]


Internet-Draft            DS-Lite YANG Modules             November 2017


                      +-----------+
                      |    Host   |
                      +-----+-----+
                            |192.0.2.1
                            |
                            |
                            |192.0.2.2
                  +---------|---------+
                  |         |         |
                  |    Home router    |
                  |+--------+--------+|
                  ||       B4        ||
                  |+--------+--------+|
                  +--------|||--------+
                           |||2001:db8:0:1::1
                           |||
                           |||<-IPv4-in-IPv6 softwire
                           |||
                    -------|||-------
                  /        |||        \
                 |   ISP core network  |
                  \        |||        /
                    -------|||-------
                           |||
                           |||2001:db8:0:2::1
                  +--------|||--------+
                  |        AFTR       |
                  |+--------+--------+|
                  ||   Concentrator  ||
                  |+--------+--------+|
                  |       |NAT|       |
                  |       +-+-+       |
                  +---------|---------+
                            |198.51.100.1
                            |
                    --------|--------
                  /         |         \
                 |       Internet      |
                  \         |         /
                    --------|--------
                            |
                            |203.0.113.1
                      +-----+-----+
                      | IPv4 Host |
                      +-----------+

                    Figure 1: DS-Lite Base Architecture




Boucadair, et al.         Expires May 16, 2018                  [Page 3]


Internet-Draft            DS-Lite YANG Modules             November 2017


   DS-Lite deployment considerations are discussed in [RFC6908].

   This document follows the guidelines of [RFC6087], uses the common
   YANG types defined in [RFC6991], and adopts the Network Management
   Datastore Architecture (NMDA).

1.1.  Terminology

   This document makes use of the terms defined in Section 3 of
   [RFC6333].

   The terminology for describing YANG data modules is defined in
   [RFC7950].

1.2.  Tree Diagrams

   The meaning of the symbols in these diagrams is as follows:

   o  Brackets "[" and "]" enclose list keys.

   o  Curly braces "{" and "}" contain names of optional features that
      make the corresponding node conditional.

   o  Abbreviations before data node names: "rw" means configuration
      (read-write), "ro" state data (read-only).

   o  Symbols after data node names: "?" means an optional node, "!" a
      container with presence, and "*" denotes a "list" or "leaf-list".

   o  Parentheses enclose choice and case nodes, and case nodes are also
      marked with a colon (":").

   o  Ellipsis ("...") stands for contents of subtrees that are not
      shown.

2.  DS-Lite YANG Modules: An Overview

   As shown in Figure 1:

   o  The AFTR element is a combination of an IPv4-in-IPv6 tunnel and a
      NAPT function (Section 2.2 of [RFC3022]).

   o  The B4 element is an IPv4-in-IPv6 tunnel.

   Therefore, the AFTR YANG module is designed to augment both the
   Interfaces YANG module [RFC7223] and the NAT YANG module
   [I-D.ietf-opsawg-nat-yang] with DS-Lite specific features.  The B4
   YANG module augments the interfaces YANG module.



Boucadair, et al.         Expires May 16, 2018                  [Page 4]


Internet-Draft            DS-Lite YANG Modules             November 2017


   Concretely, the AFTR YANG module (Figure 2) augments the Interfaces
   YANG module with the following:

   o  An IPv6 address used by the AFTR for sending and receiving IPv4-
      in-IPv6 packets (aftr-ipv6-address).

   o  An IPv4 address that is used by the AFTR for troubleshooting
      purposes (aftr-ipv4-address).

   o  The tunnel MTU, used to avoid fragmentation (tunnel-mtu).

   o  A policy to limit the number of DS-Lite softwires per subscriber
      (max-softwire-per-subscriber).

   o  A policy to instruct the AFTR whether it must preserve DSCP
      marking when encapsulating/decapsulating packets (v6-v4-dscp-
      preservation).

   In addition, the AFTR YANG module augments the NAT YANG module
   (policy, in particular) with the following:

   o  A policy to instruct the AFTR whether a state can be automatically
      migrated (state-migrate).

   o  Further, in order to prevent a denial-of-service by frequently
      changing the source IPv6 address, 'b4-address-change-limit' is
      used to rate-lmite such changes.

   o  An instruction to rewrite the TCP Maximum Segment Size (MSS)
      option (mss-clamping) to avoid TCP fragmentation.

   Given that the NAPT table of the AFTR element is extended to include
   the source IPv6 address of incoming packets, the AFTR YANG module
   augments the NAPT44 mapping-entry with the following:

   o  b4-ipv6-address which is used to record the source IPv6 address of
      a packet received from a B4 element.  This IPv6 address is
      required to disambiguate between the overlapping IPv4 address
      space of subscribers.

   o  The value of the Traffic Class field in the IPv6 header as
      received from a B4 element (v6-dscp): This information is used to
      preserve DSCP marking when encapsulating/decapsulationg at the
      AFTR.

   o  The IPv4 DSCP marking of the IPv4 packet received from a B4
      element (internal-v4-dscp): This information can be used by the
      AFTR for setting the DSCP of packets relayed to a B4 element.



Boucadair, et al.         Expires May 16, 2018                  [Page 5]


Internet-Draft            DS-Lite YANG Modules             November 2017


   o  The IPv4 DSCP marking as set by the AFTR in its external interface
      (external-v4-dscp): An AFTR can be instructed to preserve the same
      marking or to set it to another value when forwarding an IPv4
      packet upstream.

   Access Control List (ACL) and Quality of Service (QoS) policies
   discussed in Section 2.5 of [RFC6908] are out of scope.  A YANG
   module for ACLs is documented in [I-D.ietf-netmod-acl-model].

   Likewise, PCP-related considerations discussed in Section 8.5 of
   [RFC6333] are out of scope.  A YANG module for PCP is documented in
   [I-D.boucadair-pcp-yang].

module: ietf-dslite-aftr
  augment /if:interfaces/if:interface:
    +--rw aftr-ipv6-address?             inet:ipv6-address
    +--rw aftr-ipv4-address?             inet:ipv4-address
    +--rw tunnel-mtu?                    uint16
    +--rw max-softwire-per-subscriber?   uint8
    +--rw v6-v4-dscp-preservation?       boolean
  augment /nat:nat/nat:instances/nat:instance/nat:policy:
    +--rw state-migrate?             boolean
    +--rw b4-address-change-limit?   uint32
    +--rw mss-clamping
       +--rw enable?      boolean
       +--rw mss-value?   uint16
  augment /nat:nat/nat:instances/nat:instance/nat:mapping-table/nat:mapping-entry:
    +--rw b4-ipv6-address?    inet:ipv6-address
    +--rw v6-dscp?            uint8
    +--rw internal-v4-dscp?   uint8
    +--rw external-v4-dscp?   uint8

                  Figure 2: YANG Module for DS-Lite AFTR

   Examples to illustrate the use of this module are provided in
   Appendix B.

   The B4 YANG module (Figure 3) augments the Interfaces YANG module
   with the following:

   o  An IPv6 address used by a B4 element for sending and receiving
      IPv4-in-IPv6 packets (b4-ipv6-address).

   o  The IPv6 address of the AFTR to use by a B4 element (aftr-
      ipv6-addr).

   o  An IPv4 address that is used by a B4 element for troubleshooting
      purposes (b4-ipv4-address).



Boucadair, et al.         Expires May 16, 2018                  [Page 6]


Internet-Draft            DS-Lite YANG Modules             November 2017


   o  The tunnel MTU at the B4 side to avoid fragmentation (tunnel-mtu).

   o  An instruction whether DSCP marking is to be preserved when
      encapsulating an IPv4 packet in an IPv6 packet (v6-v4-dscp-
      preservation).

   module: ietf-dslite-b4
     augment /if:interfaces/if:interface:
       +--rw b4-ipv6-address?           inet:ipv6-address
       +--rw aftr-ipv6-addr?            inet:ipv6-address
       +--rw b4-ipv4-address?           inet:ipv4-address
       +--rw tunnel-mtu?                uint16
       +--rw v6-v4-dscp-preservation?   boolean

                   Figure 3: YANG Module for DS-Lite B4

   An example to illustrate the use of this module is provided in
   Appendix A.

3.  DS-Lite AFTR YANG Module

 <CODE BEGINS> file "ietf-dslite-aftr@2017-11-13.yang"

 module ietf-dslite-aftr {
   yang-version 1.1;

   namespace "urn:ietf:params:xml:ns:yang:ietf-dslite-aftr";
   prefix dslite-aftr;

   import ietf-inet-types { prefix inet; }
   import ietf-interfaces { prefix if; }
   import iana-if-type { prefix ianaift; }
   import ietf-nat {prefix nat;}

   organization "IETF Softwire Working Group";

   contact

     "WG Web:   <https://datatracker.ietf.org/wg/softwire/>
      WG List:  <mailto:softwires@ietf.org>

      WG Chair: Ian Farrer
                <mailto:ianfarrer@gmx.com>

      WG Chair: Yong Cui
                <mailto:cuiyong@tsinghua.edu.cn>

      Editor:  Mohamed Boucadair



Boucadair, et al.         Expires May 16, 2018                  [Page 7]


Internet-Draft            DS-Lite YANG Modules             November 2017


               <mailto:mohamed.boucadair@orange.com>

      Editor:  Christian Jacquenet
               <mailto:christian.jacquenet@orange.com>

      Editor:  Senthil Sivakumar
               <mailto:ssenthil@cisco.com>";

    description
       "This module is a YANG module for DS-Lite AFTR
       implementations.

       Copyright (c) 2017 IETF Trust and the persons identified as
       authors of the code.  All rights reserved.

       Redistribution and use in source and binary forms, with or
       without modification, is permitted pursuant to, and subject
       to the license terms contained in, the Simplified BSD License
       set forth in Section 4.c of the IETF Trust's Legal Provisions
       Relating to IETF Documents
       (http://trustee.ietf.org/license-info).

       This version of this YANG module is part of RFC XXXX; see
       the RFC itself for full legal notices.";

   revision 2017-11-13 {
     description
       "Initial revision.";
     reference
       "RFC XXXX: YANG Data Modules for Dual-Stack Lite (DS-Lite)";
   }

 augment "/if:interfaces/if:interface" {
   when "if:type = 'ianaift:tunnel'";
   description
     "Augments Interface module with AFTR parameters.
      IANA interface types are maintained at this registry:
      https://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib.

        tunnel (131),       -- Encapsulation interface";

   leaf aftr-ipv6-address {
     type inet:ipv6-address;
     description
       "IPv6 address of the DS-Lite AFTR.";
     reference
       "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                  IPv4 Exhaustion";



Boucadair, et al.         Expires May 16, 2018                  [Page 8]


Internet-Draft            DS-Lite YANG Modules             November 2017


   }

   leaf aftr-ipv4-address {
     type inet:ipv4-address;
     default "192.0.0.1";
     description
       "IPv4 address of the DS-Lite AFTR.

        192.0.0.1 is reserved for the AFTR element.

        This address can be used to report ICMP problems and will
        appear in traceroute outputs.";
     reference
       "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                  IPv4 Exhaustion";
     }

   leaf tunnel-mtu {
     type uint16;
     description
       "Configures a tunnel MTU.
        [RFC6908] specifies that since fragmentation and reassembly
        is not optimal, the operator should do everything possible
        to eliminate the need for it.  If the operator uses simple
        IPv4-in-IPv6 softwire, it is recommended that the MTU size
        of the IPv6 network between the B4 and the AFTR accounts for
        the additional overhead (40 bytes).";
     reference
       "RFC 6908: Deployment Considerations for Dual-Stack Lite";
   }

   leaf max-softwire-per-subscriber {
     type uint8;
     default 1;
     description
       "Configures the maximum softwires per subscriber feature.

        A subscriber is uniquely identified by means
        of subscriber-mask.

        This policy aims to prevent a misbehaving subscriber from
        mounting several DS-Lite softwires that would consume
        additional AFTR resources (e.g., get more external ports
        if the quota were enforced on a per-softwire basis,
        consume extra processing due to a large number of active
        softwires).";

     reference



Boucadair, et al.         Expires May 16, 2018                  [Page 9]


Internet-Draft            DS-Lite YANG Modules             November 2017


       "Section 4 of RFC 7785.";
   }

   leaf v6-v4-dscp-preservation {
     type boolean;
     description
       "Copies the DSCP value from the IPv6 header and vice versa.

        According to Section 2.10 of [RFC6908], operators should
        use this model by provisioning the network such that the AFTR
        copies the DSCP value in the IPv4 header to the Traffic Class
        field in the IPv6 header, after the encapsulation for
        the downstream traffic.";
     reference
       "Section 2.10 of RFC 6908.";
   }
 }

 augment "/nat:nat/nat:instances/"+
            "nat:instance/nat:policy" {
   description
     "Augments the NAPT44 module with AFTR parameters.";

   leaf state-migrate {
     type boolean;
     default true;
     description
       "State migration is enabled by default.

        In the event a new IPv6 address is assigned to the B4 element,
        the AFTR should migrate existing state to be bound to the new
        IPv6 address.  This operation ensures that traffic destined to
        the previous B4's IPv6 address will be redirected to the newer
        B4's IPv6 address.  The destination IPv6 address for tunneling
        return traffic from the AFTR should be the last seen as the B4's
        IPv6 source address from the CPE.

        The AFTR uses the subscriber-mask to determine whether two
        IPv6 addresses belong to the same CPE (e.g., if the
        subscriber-mask is set to 56, the AFTR concludes that
        2001:db8:100:100::1 and 2001:db8:100:100::2 belong to the same
        CPE assigned with 2001:db8:100:100::/56).";

     reference
       "RFC 7785: Recommendations for Prefix Binding in the Context
                  of Softwire Dual-Stack Lite";
   }




Boucadair, et al.         Expires May 16, 2018                 [Page 10]


Internet-Draft            DS-Lite YANG Modules             November 2017


   leaf b4-address-change-limit {
     type uint32;
     units "seconds";
     default '1800';
     description
       "Minimum number of seconds between successive B4's IPv6 address
        change from the same prefix.

        Changing the source B4's IPv6 address may be used as an attack
        vector.  Packets with a new B4's IPv6 address from the same
        prefix should be rate-limited.

        It is recommended to set this rate limit to 30 minutes; other
        values can be set on a per-deployment basis.";

     reference
       "RFC 7785: Recommendations for Prefix Binding in the Context
                  of Softwire Dual-Stack Lite";
   }

   container mss-clamping {
     description
       "MSS rewriting configuration to avoid IPv6 fragmentation.";

     leaf enable {
       type boolean;
       description
         "Enable/disable MSS rewriting feature.";
     }

     leaf mss-value {
       type uint16;
       units "octets";
       description
         "Sets the MSS value to be used for MSS rewriting.";
     }
   }
  }

 augment "/nat:nat/nat:instances/nat:instance/"+
             "nat:mapping-table/nat:mapping-entry"{
   description
     "Augments the NAPT44 mapping table with DS-Lite specifics.";

   leaf b4-ipv6-address {
     type inet:ipv6-address;
     description
       "Corresponds to the IPv6 address used by the B4 element.";



Boucadair, et al.         Expires May 16, 2018                 [Page 11]


Internet-Draft            DS-Lite YANG Modules             November 2017


     reference
       "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                  IPv4 Exhaustion";
   }

   leaf v6-dscp {
     when "/if:interfaces/if:interface/" +
           "dslite-aftr:v6-v4-dscp-preservation='true'";
     type uint8;
     description
       "DSCP value used at the softwire level (i.e., IPv6 header).";
    }

    leaf internal-v4-dscp {
     when "/if:interfaces/if:interface/" +
           "dslite-aftr:v6-v4-dscp-preservation='true'";
      type uint8;
      description
        "DSCP value of the encapsulated IPv4 packet.";
    }

    leaf external-v4-dscp {
     when "/if:interfaces/if:interface/" +
           "dslite-aftr:v6-v4-dscp-preservation='true'";
      type uint8;
      description
        "DSCP value of the translated IPv4 packet as marked by
         the AFTR.";
    }
  }
 }
 <CODE ENDS>

4.  DS-Lite B4 YANG Module

 <CODE BEGINS> file "ietf-dslite-b4@2017-11-13.yang"

 module ietf-dslite-b4 {
   yang-version 1.1;
   namespace "urn:ietf:params:xml:ns:yang:ietf-dslite-b4";
   prefix dslite-b4;

   import ietf-inet-types { prefix inet; }
   import ietf-interfaces { prefix if; }
   import iana-if-type { prefix ianaift; }

   organization "IETF Softwire Working Group";




Boucadair, et al.         Expires May 16, 2018                 [Page 12]


Internet-Draft            DS-Lite YANG Modules             November 2017


   contact

     "WG Web:   <https://datatracker.ietf.org/wg/softwire/>
      WG List:  <mailto:softwires@ietf.org>

      WG Chair: Ian Farrer
                <mailto:ianfarrer@gmx.com>

      WG Chair: Yong Cui
                <mailto:cuiyong@tsinghua.edu.cn>

      Editor:  Mohamed Boucadair
               <mailto:mohamed.boucadair@orange.com>

      Editor:  Christian Jacquenet
               <mailto:christian.jacquenet@orange.com>

      Editor:  Senthil Sivakumar
               <mailto:ssenthil@cisco.com>";

   description
     "This module is a YANG module for DS-Lite B4 implementations.

      Copyright (c) 2017 IETF Trust and the persons identified as
      authors of the code.  All rights reserved.

      Redistribution and use in source and binary forms, with or
      without modification, is permitted pursuant to, and subject
      to the license terms contained in, the Simplified BSD License
      set forth in Section 4.c of the IETF Trust's Legal Provisions
      Relating to IETF Documents
      (http://trustee.ietf.org/license-info).

      This version of this YANG module is part of RFC XXXX; see
      the RFC itself for full legal notices.";

   revision 2017-11-13 {
     description
       "Initial revision.";
     reference
       "RFC XXXX: YANG Data Modules for Dual-Stack Lite (DS-Lite)";
   }

 augment "/if:interfaces/if:interface" {
   when "if:type = 'ianaift:tunnel'";
   description
     "Augments Interface module with B4 parameters.
      IANA interface types are maintained at this registry:



Boucadair, et al.         Expires May 16, 2018                 [Page 13]


Internet-Draft            DS-Lite YANG Modules             November 2017


      https://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib.

        tunnel (131),       -- Encapsulation interface";

   leaf b4-ipv6-address {
     type inet:ipv6-address;
     description
       "The IPv6 address used by the B4 element.";
     reference
       "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                  IPv4 Exhaustion";
   }

   leaf aftr-ipv6-addr {
     type inet:ipv6-address;
     description
       "The AFTR's IPv6 address.";
     reference
       "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                  IPv4 Exhaustion";
   }

   leaf b4-ipv4-address {
     type inet:ipv4-address;
     default "192.0.0.2";
     description
       "IPv4 address of the DS-Lite B4.

        192.0.0.0/29 is reserved for the B4 element.

        This address can be used to report ICMP problems and will
        appear in traceroute outputs.";
      reference
        "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                   IPv4 Exhaustion";
   }

   leaf tunnel-mtu {
     type uint16;
     description
       "Configures a tunnel MTU.

        [RFC6908] specifies that since fragmentation and reassembly is
        not optimal, the operator should do everything possible to
        eliminate the need for it.  If the operator uses simple
        IPv4-in-IPv6 softwire, it is recommended that the MTU size of
        the IPv6 network between the B4 and the AFTR accounts for
        the additional overhead (40 bytes).";



Boucadair, et al.         Expires May 16, 2018                 [Page 14]


Internet-Draft            DS-Lite YANG Modules             November 2017


      reference
        "RFC 6908: Deployment Considerations for Dual-Stack Lite";
   }

   leaf v6-v4-dscp-preservation {
     type boolean;
     description
       "Copies the DSCP value from the IPv6 header and vice versa.

        Operators should use this model by provisioning the network such
        that the AFTR copies the DSCP value in the IPv4 header to
        the Traffic Class field in the IPv6 header, after the
        encapsulation for the downstream traffic.";
     reference
       "Section 2.10 of RFC 6908.";
   }
  }
 }
 <CODE ENDS>

5.  Security Considerations

   The YANG module defined in this document is designed to be accessed
   via network management protocols such as NETCONF [RFC6241] or
   RESTCONF [RFC8040].  The lowest NETCONF layer is the secure transport
   layer, and the mandatory-to-implement secure transport is Secure
   Shell (SSH) [RFC6242].  The lowest RESTCONF layer is HTTPS, and the
   mandatory-to-implement secure transport is TLS [RFC5246].

   The NETCONF access control model [RFC6536] provides the means to
   restrict access for particular NETCONF or RESTCONF users to a
   preconfigured subset of all available NETCONF or RESTCONF protocol
   operations and content.

   All data nodes defined in the YANG module which can be created,
   modified and deleted (i.e., config true, which is the default) are
   considered sensitive.  Write operations (e.g., edit-config) applied
   to these data nodes without proper protection can negatively affect
   network operations.  An attacker who is able to access to the B4/AFTR
   can undertake various attacks, such as:

   o  Set the value of 'aftr-ipv6-addr' on the B4 to point to an
      illegitimate AFTR so that it can intercept all the traffic sent by
      a B4.  Illegitimately intercepting users' traffic is a attack with
      severe implications on privacy.

   o  Set the MTU to a low value which may increase the number of
      fragments (tunnel-mtu for both B4 and AFTR).



Boucadair, et al.         Expires May 16, 2018                 [Page 15]


Internet-Draft            DS-Lite YANG Modules             November 2017


   o  Set 'max-softwire-per-subscriber' to an arbitrary high value,
      which will be exploited by a misbehaving user to grab more
      resources (by mounting as many softwires as required to get more
      external IP addresses/ports) or to perform a Denial-of-Service on
      the AFTR by mounting a massive number of softwires.

   o  Set 'state-migrate' to 'false' on the AFTR.  This action may lead
      to a service degradation for the users.

   o  Set 'b4-address-change-limit" to an arbitrary low value can ease
      DoS attacks based on frequent change of B4 IPv6 address.

   o  Set 'v6-v4-dscp-preservation' to 'false" may lead to a service
      degradation if some policies are applied on the network based on
      the DSCP value.

   Additional security considerations are discussed in
   [I-D.ietf-opsawg-nat-yang].

   Security considerations related to DS-Lite are discussed in
   [RFC6333].

6.  IANA Considerations

   This document requests IANA to register the following URIs in the
   "IETF XML Registry" [RFC3688]:

            URI: urn:ietf:params:xml:ns:yang:ietf-dslite-aftr
            Registrant Contact: The IESG.
            XML: N/A; the requested URI is an XML namespace.

            URI: urn:ietf:params:xml:ns:yang:ietf-dslite-b4
            Registrant Contact: The IESG.
            XML: N/A; the requested URI is an XML namespace.

   This document requests IANA to register the following YANG modules in
   the "YANG Module Names" registry [RFC7950].

            name: ietf-dslite-aftr
            namespace: urn:ietf:params:xml:ns:yang:ietf-dslite-aftr
            prefix: dslite-aftr
            reference: RFC XXXX

            name: ietf-dslite-b4
            namespace: urn:ietf:params:xml:ns:yang:ietf-dslite-b4
            prefix: dslite-b4
            reference: RFC XXXX




Boucadair, et al.         Expires May 16, 2018                 [Page 16]


Internet-Draft            DS-Lite YANG Modules             November 2017


7.  Acknowledgements

   Thanks to Qin Wu for identifying a compiling error.  Mahesh
   Jethanandani provided an early yangdoctors review; many thanks to
   him.

   Many thanks to Ian Farrer for the review and comments.

8.  References

8.1.  Normative references

   [I-D.ietf-opsawg-nat-yang]
              Boucadair, M., Sivakumar, S., Jacquenet, C., Vinapamula,
              S., and Q. Wu, "A YANG Data Model for Network Address
              Translation (NAT) and Network Prefix Translation (NPT)",
              draft-ietf-opsawg-nat-yang-06 (work in progress), October
              2017.

   [RFC3688]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
              DOI 10.17487/RFC3688, January 2004,
              <https://www.rfc-editor.org/info/rfc3688>.

   [RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
              (TLS) Protocol Version 1.2", RFC 5246,
              DOI 10.17487/RFC5246, August 2008,
              <https://www.rfc-editor.org/info/rfc5246>.

   [RFC6241]  Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
              and A. Bierman, Ed., "Network Configuration Protocol
              (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
              <https://www.rfc-editor.org/info/rfc6241>.

   [RFC6242]  Wasserman, M., "Using the NETCONF Protocol over Secure
              Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
              <https://www.rfc-editor.org/info/rfc6242>.

   [RFC6333]  Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual-
              Stack Lite Broadband Deployments Following IPv4
              Exhaustion", RFC 6333, DOI 10.17487/RFC6333, August 2011,
              <https://www.rfc-editor.org/info/rfc6333>.

   [RFC6536]  Bierman, A. and M. Bjorklund, "Network Configuration
              Protocol (NETCONF) Access Control Model", RFC 6536,
              DOI 10.17487/RFC6536, March 2012,
              <https://www.rfc-editor.org/info/rfc6536>.





Boucadair, et al.         Expires May 16, 2018                 [Page 17]


Internet-Draft            DS-Lite YANG Modules             November 2017


   [RFC6991]  Schoenwaelder, J., Ed., "Common YANG Data Types",
              RFC 6991, DOI 10.17487/RFC6991, July 2013,
              <https://www.rfc-editor.org/info/rfc6991>.

   [RFC7223]  Bjorklund, M., "A YANG Data Model for Interface
              Management", RFC 7223, DOI 10.17487/RFC7223, May 2014,
              <https://www.rfc-editor.org/info/rfc7223>.

   [RFC7950]  Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
              RFC 7950, DOI 10.17487/RFC7950, August 2016,
              <https://www.rfc-editor.org/info/rfc7950>.

   [RFC8040]  Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
              Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
              <https://www.rfc-editor.org/info/rfc8040>.

8.2.  Informative references

   [I-D.boucadair-pcp-yang]
              Boucadair, M., Jacquenet, C., Sivakumar, S., and S.
              Vinapamula, "YANG Modules for the Port Control Protocol
              (PCP)", draft-boucadair-pcp-yang-05 (work in progress),
              October 2017.

   [I-D.ietf-netmod-acl-model]
              Jethanandani, M., Huang, L., Agarwal, S., and D. Blair,
              "Network Access Control List (ACL) YANG Data Model",
              draft-ietf-netmod-acl-model-14 (work in progress), October
              2017.

   [RFC3022]  Srisuresh, P. and K. Egevang, "Traditional IP Network
              Address Translator (Traditional NAT)", RFC 3022,
              DOI 10.17487/RFC3022, January 2001,
              <https://www.rfc-editor.org/info/rfc3022>.

   [RFC6087]  Bierman, A., "Guidelines for Authors and Reviewers of YANG
              Data Model Documents", RFC 6087, DOI 10.17487/RFC6087,
              January 2011, <https://www.rfc-editor.org/info/rfc6087>.

   [RFC6908]  Lee, Y., Maglione, R., Williams, C., Jacquenet, C., and M.
              Boucadair, "Deployment Considerations for Dual-Stack
              Lite", RFC 6908, DOI 10.17487/RFC6908, March 2013,
              <https://www.rfc-editor.org/info/rfc6908>.

   [RFC7785]  Vinapamula, S. and M. Boucadair, "Recommendations for
              Prefix Binding in the Context of Softwire Dual-Stack
              Lite", RFC 7785, DOI 10.17487/RFC7785, February 2016,
              <https://www.rfc-editor.org/info/rfc7785>.



Boucadair, et al.         Expires May 16, 2018                 [Page 18]


Internet-Draft            DS-Lite YANG Modules             November 2017


Appendix A.  B4 Example

   The following example shows a B4 element (2001:db8:0:1::1) that is
   configured with an AFTR element (2001:db8:0:2::1).  The B4 element is
   also instructed to preserve the DSCP marking.

   <interface>
      <name>myB4</name>
      <type>ianaift:tunnel</type>
      <enabled>true</enabled>
      <b4-ipv6-address>2001:db8:0:1::1</b4-ipv6-address>
      <aftr-ipv6-addr>2001:db8:0:2::1</aftr-ipv6-addr>
      <v6-v4-dscp-preservation>true</v6-v4-dscp-preservation>
   </interface>

Appendix B.  AFTR Examples

   The following example shows an AFTR that is reachable at
   2001:db8:0:2::1.  Also, this XML snippet indicates that the AFTR is
   provided with an IPv4 address (192.0.0.1) to be used for
   troubleshooting purposes such as reporting problems to B4s.
   Moreover, the AFTR is instructed to limit the number of softwires per
   subscriber to '1'.

   Note that a subscriber is identified by a subscriber-mask ([RFC7785])
   that can be configured by means of [I-D.ietf-opsawg-nat-yang].

   <interface>
      <name>myAFTR</name>
      <type>ianaift:tunnel</type>
      <enabled>true</enabled>
      <aftr-ipv6-address>2001:db8:0:2::1</aftr-ipv6-address>
      <aftr-ipv4-address>192.0.0.1</aftr-ipv4-address>
      <max-softwire-per-subscriber>1</max-softwire-per-subscriber>
   </interface>

   The following shows an XML excerpt depicting a dynamic UDP mapping
   entry maintained by a DS-Lite AFTR for a packet received from the B4
   element introduced in Appendix A.  Concretely, this UDP packet
   received with a source IPv6 address (2001:db8:0:1::1), a source IPv4
   address (192.0.2.1), and source port number (1568) is translated into
   a UDP packet having a source IPv4 address (198.51.100.1) and source
   port number (15000).  The remaining lifetime of this mapping is 300
   seconds.







Boucadair, et al.         Expires May 16, 2018                 [Page 19]


Internet-Draft            DS-Lite YANG Modules             November 2017


   <mapping-entry>
     <index>15</index>
     <type>
        dynamic-explicit
     </type>
     <transport-protocol>
        17
     </transport-protocol>
     <b4-ipv6-address>
        2001:db8:0:1::1
     </b4-ipv6-address>
     <internal-src-address>
        192.0.2.1
     </internal-src-address>
     <internal-src-port>
        <start-port-number>
           1568
        </start-port-number>
     </internal-src-port>
     <external-src-address>
        198.51.100.1
     </external-src-address>
     <external-src-port>
        <start-port-number>
           15000
        </start-port-number>
     </external-src-port>
     <lifetime>
        300
     </lifetime>
   </mapping-entry>

Authors' Addresses

   Mohamed Boucadair
   Orange
   Rennes  35000
   France

   EMail: mohamed.boucadair@orange.com


   Christian Jacquenet
   Orange
   Rennes  35000
   France

   EMail: christian.jacquenet@orange.com



Boucadair, et al.         Expires May 16, 2018                 [Page 20]


Internet-Draft            DS-Lite YANG Modules             November 2017


   Senthil Sivakumar
   Cisco Systems
   7100-8 Kit Creek Road
   Research Triangle Park, North Carolina  27709
   USA

   Phone: +1 919 392 5158
   EMail: ssenthil@cisco.com











































Boucadair, et al.         Expires May 16, 2018                 [Page 21]


Html markup produced by rfcmarkup 1.129c, available from https://tools.ietf.org/tools/rfcmarkup/