draft-ietf-netconf-restconf-client-server-04.txt   draft-ietf-netconf-restconf-client-server-05.txt 
NETCONF Working Group K. Watsen NETCONF Working Group K. Watsen
Internet-Draft Juniper Networks Internet-Draft Juniper Networks
Intended status: Standards Track J. Schoenwaelder Intended status: Standards Track G. Wu
Expires: January 4, 2018 Jacobs University Bremen Expires: May 3, 2018 Cisco Networks
July 3, 2017 October 30, 2017
RESTCONF Client and Server Models RESTCONF Client and Server Models
draft-ietf-netconf-restconf-client-server-04 draft-ietf-netconf-restconf-client-server-05
Abstract Abstract
This document defines two YANG modules, one module to configure a This document defines two YANG modules, one module to configure a
RESTCONF client and the other module to configure a RESTCONF server. RESTCONF client and the other module to configure a RESTCONF server.
Both modules support the TLS transport protocol with both standard Both modules support the TLS transport protocol with both standard
RESTCONF and RESTCONF Call Home connections. RESTCONF and RESTCONF Call Home connections.
Editorial Note (To be removed by RFC Editor) Editorial Note (To be removed by RFC Editor)
skipping to change at page 1, line 46 skipping to change at page 1, line 46
progress. Please apply the following replacements: progress. Please apply the following replacements:
o "XXXX" --> the assigned RFC value for this draft o "XXXX" --> the assigned RFC value for this draft
o "ZZZZ" --> the assigned RFC value for I-D.ietf-netconf-tls-client- o "ZZZZ" --> the assigned RFC value for I-D.ietf-netconf-tls-client-
server server
Artwork in this document contains placeholder values for the date of Artwork in this document contains placeholder values for the date of
publication of this draft. Please apply the following replacement: publication of this draft. Please apply the following replacement:
o "2017-07-03" --> the publication date of this draft o "2017-10-30" --> the publication date of this draft
The following Appendix section is to be removed prior to publication: The following Appendix section is to be removed prior to publication:
o Appendix A. Change Log o Appendix A. Change Log
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 4, 2018. This Internet-Draft will expire on May 3, 2018.
Copyright Notice Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the Copyright (c) 2017 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
1.2. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 3 2. The RESTCONF Client Model . . . . . . . . . . . . . . . . . . 3
2. The RESTCONF Client Model . . . . . . . . . . . . . . . . . . 4
2.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 4 2.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 4
2.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 6 2.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 6
2.3. YANG Model . . . . . . . . . . . . . . . . . . . . . . . 8 2.3. YANG Module . . . . . . . . . . . . . . . . . . . . . . . 8
3. The RESTCONF Server Model . . . . . . . . . . . . . . . . . . 16 3. The RESTCONF Server Model . . . . . . . . . . . . . . . . . . 17
3.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 17 3.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 17
3.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 18 3.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 20
3.3. YANG Model . . . . . . . . . . . . . . . . . . . . . . . 20 3.3. YANG Module . . . . . . . . . . . . . . . . . . . . . . . 23
4. Security Considerations . . . . . . . . . . . . . . . . . . . 29 4. Security Considerations . . . . . . . . . . . . . . . . . . . 33
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 30 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 34
5.1. The IETF XML Registry . . . . . . . . . . . . . . . . . . 30 5.1. The IETF XML Registry . . . . . . . . . . . . . . . . . . 34
5.2. The YANG Module Names Registry . . . . . . . . . . . . . 31 5.2. The YANG Module Names Registry . . . . . . . . . . . . . 34
6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 31 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 34
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 31 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 34
7.1. Normative References . . . . . . . . . . . . . . . . . . 31 7.1. Normative References . . . . . . . . . . . . . . . . . . 34
7.2. Informative References . . . . . . . . . . . . . . . . . 32 7.2. Informative References . . . . . . . . . . . . . . . . . 35
Appendix A. Change Log . . . . . . . . . . . . . . . . . . . . . 34 Appendix A. Change Log . . . . . . . . . . . . . . . . . . . . . 37
A.1. server-model-09 to 00 . . . . . . . . . . . . . . . . . . 34 A.1. 00 to 01 . . . . . . . . . . . . . . . . . . . . . . . . 37
A.2. 00 to 01 . . . . . . . . . . . . . . . . . . . . . . . . 34 A.2. 01 to 02 . . . . . . . . . . . . . . . . . . . . . . . . 37
A.3. 01 to 02 . . . . . . . . . . . . . . . . . . . . . . . . 34 A.3. 02 to 03 . . . . . . . . . . . . . . . . . . . . . . . . 37
A.4. 02 to 03 . . . . . . . . . . . . . . . . . . . . . . . . 34 A.4. 03 to 04 . . . . . . . . . . . . . . . . . . . . . . . . 37
A.5. 03 to 04 . . . . . . . . . . . . . . . . . . . . . . . . 34 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 37
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 34
1. Introduction 1. Introduction
This document defines two YANG [RFC7950] modules, one module to This document defines two YANG [RFC7950] modules, one module to
configure a RESTCONF client and the other module to configure a configure a RESTCONF client and the other module to configure a
RESTCONF server [RFC8040]. Both modules support the TLS [RFC5246] RESTCONF server [RFC8040]. Both modules support the TLS [RFC5246]
transport protocol with both standard RESTCONF and RESTCONF Call Home transport protocol with both standard RESTCONF and RESTCONF Call Home
connections [RFC8071]. connections [RFC8071].
1.1. Terminology 1.1. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP "OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
1.2. Tree Diagrams
A simplified graphical representation of the data models is used in
this document. The meaning of the symbols in these diagrams is as
follows:
o Brackets "[" and "]" enclose list keys.
o Braces "{" and "}" enclose feature names, and indicate that the
named feature must be present for the subtree to be present.
o Abbreviations before data node names: "rw" means configuration
(read-write) and "ro" state data (read-only).
o Symbols after data node names: "?" means an optional node, "!"
means a presence container, and "*" denotes a list and leaf-list.
o Parentheses enclose choice and case nodes, and case nodes are also
marked with a colon (":").
o Ellipsis ("...") stands for contents of subtrees that are not
shown.
2. The RESTCONF Client Model 2. The RESTCONF Client Model
EDITOR NOTE: Please ignore this section, it is incomplete.
The RESTCONF client model presented in this section supports both The RESTCONF client model presented in this section supports both
clients initiating connections to servers, as well as clients clients initiating connections to servers, as well as clients
listening for connections from servers calling home. listening for connections from servers calling home.
This model supports the TLS transport protocol using the TLS client This model, like that presented in
groupings defined in [I-D.ietf-netconf-tls-client-server]. [I-D.ietf-netconf-netconf-client-server], is designed to support any
number of possible transports. RESTCONF only supports the TLS
transport currently, thus this model only supports the TLS transport.
All private keys and trusted certificates are held in the keystore All private keys and trusted certificates are held in the keystore
model defined in [I-D.ietf-netconf-keystore]. model defined in [I-D.ietf-netconf-keystore].
YANG feature statements are used to enable implementations to YANG feature statements are used to enable implementations to
advertise which parts of the model the RESTCONF client supports. advertise which parts of the model the RESTCONF client supports.
2.1. Tree Diagram 2.1. Tree Diagram
Just the container is displayed below, but there is also a grouping The following tree diagram [I-D.ietf-netmod-yang-tree-diagrams]
that the container is using. provides an overview of the data model for the "ietf-restconf-client"
module. Just the container is displayed below, but there is also a
reuable grouping by the same name that the container is using.
Note: all lines are folded at column 71 with no '\' character. [ note: '\' line wrapping for formatting only]
module: ietf-restconf-client module: ietf-restconf-client
+--rw restconf-client +--rw restconf-client
+--rw initiate {initiate}? +--rw initiate {initiate}?
| +--rw restconf-server* [name] | +--rw restconf-server* [name]
| +--rw name string | +--rw name string
| +--rw (transport) | +--rw endpoints
| | +--:(tls) {tls-initiate}? | +--rw endpoint* [name]
| | +--rw tls | +--rw name string
| | +--rw endpoints | +--rw (transport)
| | | +--rw endpoint* [name] | | +--:(tls) {tls-initiate}?
| | | +--rw name string | | +--rw tls
| | | +--rw address inet:host | | +--rw address inet:host
| | | +--rw port? inet:port-number | | +--rw port? inet:port-number\
| | +--rw server-auth
| | | +--rw trusted-ca-certs? leafref | | +--rw client-identity
| | | +--rw trusted-server-certs? leafref | | | +--rw (auth-type)
| | +--rw client-auth | | | +--:(certificate)
| | | +--rw (auth-type) | | | +--rw certificate
| | | +--:(certificate) | | | +--rw algorithm?
| | | +--rw certificate? leafref | | | | identityref
| | +--rw hello-params | | | +--rw private-key?
| | {tls-client-hello-params-config}? | | | | union
| | +--rw tls-versions | | | +--rw public-key?
| | | +--rw tls-version* identityref | | | | binary
| | +--rw cipher-suites | | | +---x generate-private-key
| | +--rw cipher-suite* identityref | | | | +---w input
| +--rw connection-type | | | | +---w algorithm
| | +--rw (connection-type)? | | | | identityref
| | +--:(persistent-connection) | | | +--rw certificates
| | | +--rw persistent! | | | | +--rw certificate* [name]
| | | +--rw idle-timeout? uint32 | | | | +--rw name string
| | | +--rw keep-alives | | | | +--rw value? binary
| | | +--rw max-wait? uint16 | | | +---x generate-certificate-si\
| | | +--rw max-attempts? uint8 gning-request
| | +--:(periodic-connection) | | | +---w input
| | +--rw periodic! | | | | +---w subject
| | +--rw idle-timeout? uint16 | | | | | binary
| | +--rw reconnect-timeout? uint16 | | | | +---w attributes?
| +--rw reconnect-strategy | | | | binary
| +--rw start-with? enumeration | | | +--ro output
| +--rw max-attempts? uint8 | | | +--ro certificate-signi\
+--rw listen {listen}? ng-request
+--rw max-sessions? uint16 | | | binary
+--rw idle-timeout? uint16 | | +--rw server-auth
+--rw endpoint* [name] | | | +--rw pinned-ca-certs?
+--rw name string | | | | ks:pinned-certificates
+--rw (transport) | | | +--rw pinned-server-certs?
+--:(tls) {tls-listen}? | | | ks:pinned-certificates
+--rw tls | | +--rw hello-params
+--rw address? inet:ip-address | | {tls-client-hello-params-config}?\
+--rw port? inet:port-number
+--rw server-auth | | +--rw tls-versions
| +--rw trusted-ca-certs? leafref | | | +--rw tls-version* identityref
| +--rw trusted-server-certs? leafref | | +--rw cipher-suites
+--rw client-auth | | +--rw cipher-suite* identityref
| +--rw (auth-type) | +--rw connection-type
| +--:(certificate) | | +--rw (connection-type)?
| +--rw certificate? leafref | | +--:(persistent-connection)
+--rw hello-params | | | +--rw persistent!
{tls-client-hello-params-config}? | | | +--rw idle-timeout? uint32
+--rw tls-versions | | | +--rw keep-alives
| +--rw tls-version* identityref | | | +--rw max-wait? uint16
+--rw cipher-suites | | | +--rw max-attempts? uint8
+--rw cipher-suite* identityref | | +--:(periodic-connection)
| | +--rw periodic!
| | +--rw idle-timeout? uint16
| | +--rw reconnect-timeout? uint16
| +--rw reconnect-strategy
| +--rw start-with? enumeration
| +--rw max-attempts? uint8
+--rw listen {listen}?
+--rw idle-timeout? uint16
+--rw endpoint* [name]
+--rw name string
+--rw (transport)
+--:(tls) {tls-listen}?
+--rw tls
+--rw address? inet:ip-address
+--rw port? inet:port-number
+--rw client-identity
| +--rw (auth-type)
| +--:(certificate)
| +--rw certificate
| +--rw algorithm?
| | identityref
| +--rw private-key?
| | union
| +--rw public-key?
| | binary
| +---x generate-private-key
| | +---w input
| | +---w algorithm identityre\
f
| +--rw certificates
| | +--rw certificate* [name]
| | +--rw name string
| | +--rw value? binary
| +---x generate-certificate-signing-\
request
| +---w input
| | +---w subject binary
| | +---w attributes? binary
| +--ro output
| +--ro certificate-signing-req\
uest
| binary
+--rw server-auth
| +--rw pinned-ca-certs?
| | ks:pinned-certificates
| +--rw pinned-server-certs?
| ks:pinned-certificates
+--rw hello-params
{tls-client-hello-params-config}?
+--rw tls-versions
| +--rw tls-version* identityref
+--rw cipher-suites
+--rw cipher-suite* identityref
2.2. Example Usage 2.2. Example Usage
The following example illustrates configuring a RESTCONF client to The following example illustrates configuring a RESTCONF client to
initiate connections, as well as listening for call-home connections. initiate connections, as well as listening for call-home connections.
This example is consistent with the examples presented in Section 2.2 This example is consistent with the examples presented in Section 2.2
of [I-D.ietf-netconf-keystore]. of [I-D.ietf-netconf-keystore].
<restconf-client [ note: '\' line wrapping for formatting only]
xmlns="urn:ietf:params:xml:ns:yang:ietf-restconf-client">
<!-- RESTCONF servers to initiate connections to -->
<initiate>
<restconf-server>
<name>corp-fw1</name>
<tls>
<endpoints>
<endpoint>
<name>corp-fw1.example.com</name>
<address>corp-fw1.example.com</address>
</endpoint>
<endpoint>
<name>corp-fw2.example.com</name>
<address>corp-fw2.example.com</address>
</endpoint>
</endpoints>
<server-auth>
<trusted-server-certs>deployment-specific-ca-certs</trusted-server-certs>
</server-auth>
<client-auth>
<certificate>tls-ec-cert</certificate>
</client-auth>
</tls>
</restconf-server>
</initiate>
<!-- endpoints to listen for RESTCONF Call Home connections on -->
<listen>
<endpoint>
<name>Intranet-facing listener</name>
<tls>
<address>11.22.33.44</address>
<server-auth>
<trusted-ca-certs>deployment-specific-ca-certs</trusted-ca-certs>
<trusted-server-certs>explicitly-trusted-server-certs</trusted-server-certs>
</server-auth>
<client-auth>
<certificate>tls-ec-cert</certificate>
</client-auth>
</tls>
</endpoint>
</listen>
</restconf-client>
2.3. YANG Model
This YANG module imports YANG types from [RFC6991] and [RFC7407].
<CODE BEGINS> file "ietf-restconf-client@2017-07-03.yang"
module ietf-restconf-client {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-restconf-client";
prefix "rcc";
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-tls-client {
prefix ts;
revision-date 2017-06-13; // stable grouping definitions
reference
"RFC ZZZZ: TLS Client and Server Models";
}
organization
"IETF NETCONF (Network Configuration) Working Group";
contact
"WG Web: <http://tools.ietf.org/wg/restconf/>
WG List: <mailto:restconf@ietf.org>
Author: Kent Watsen <restconf-client
<mailto:kwatsen@juniper.net> xmlns="urn:ietf:params:xml:ns:yang:ietf-restconf-client">
Author: Gary Wu <!-- RESTCONF servers to initiate connections to -->
<mailto:garywu@cisco.com>"; <initiate>
<restconf-server>
<name>corp-fw1</name>
<endpoints>
<endpoint>
<name>corp-fw1.example.com</name>
<tls>
<address>corp-fw1.example.com</address>
<client-identity>
<certificate>
<algorithm xmlns:ks="urn:ietf:params:xml:ns:yang:ie\
tf-keystore">ks:secp521r1</algorithm>
<private-key>base64encodedvalue==</private-key>
<public-key>base64encodedvalue==</public-key>
<certificates>
<certificate>
<name>domain certificate</name>
<value>base64encodedvalue==</value>
</certificate>
</certificates>
</certificate>
</client-identity>
<server-auth>
<pinned-server-certs>deployment-specific-ca-certs</pi\
nned-server-certs>
</server-auth>
</tls>
</endpoint>
<endpoint>
<name>corp-fw2.example.com</name>
<tls>
<address>corp-fw2.example.com</address>
<client-identity>
<certificate>
<algorithm xmlns:ks="urn:ietf:params:xml:ns:yang:ie\
tf-keystore">ks:secp521r1</algorithm>
<private-key>base64encodedvalue==</private-key>
<public-key>base64encodedvalue==</public-key>
<certificates>
<certificate>
<name>domain certificate</name>
<value>base64encodedvalue==</value>
</certificate>
</certificates>
</certificate>
</client-identity>
<server-auth>
<pinned-server-certs>deployment-specific-ca-certs</pi\
nned-server-certs>
</server-auth>
</tls>
description </endpoint>
"This module contains a collection of YANG definitions for </endpoints>
configuring RESTCONF clients. </restconf-server>
</initiate>
Copyright (c) 2014 IETF Trust and the persons identified as <!-- endpoints to listen for RESTCONF Call Home connections on -->
authors of the code. All rights reserved. <listen>
<endpoint>
<name>Intranet-facing listener</name>
<tls>
<address>11.22.33.44</address>
<client-identity>
<certificate>
<algorithm xmlns:ks="urn:ietf:params:xml:ns:yang:ietf-key\
store">ks:secp521r1</algorithm>
<private-key>base64encodedvalue==</private-key>
<public-key>base64encodedvalue==</public-key>
<certificates>
<certificate>
<name>domain certificate</name>
<value>base64encodedvalue==</value>
</certificate>
</certificates>
</certificate>
</client-identity>
<server-auth>
<pinned-ca-certs>deployment-specific-ca-certs</pinned-ca-ce\
rts>
<pinned-server-certs>explicitly-trusted-server-certs</pinne\
d-server-certs>
</server-auth>
</tls>
</endpoint>
</listen>
</restconf-client>
Redistribution and use in source and binary forms, with or 2.3. YANG Module
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD
License set forth in Section 4.c of the IETF Trust's
Legal Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see This YANG module imports YANG types from [RFC6991] and [RFC7407], and
the RFC itself for full legal notices."; groupings from [I-D.ietf-netconf-tls-client-server].
revision "2017-07-03" { <CODE BEGINS> file "ietf-restconf-client@2017-10-30.yang"
description module ietf-restconf-client {
"Initial version"; yang-version 1.1;
reference
"RFC XXXX: RESTCONF Client and Server Models";
}
// Features namespace "urn:ietf:params:xml:ns:yang:ietf-restconf-client";
prefix "rcc";
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types";
}
feature initiate { import ietf-tls-client {
description prefix ts;
"The 'initiate' feature indicates that the RESTCONF client revision-date 2017-10-30; // stable grouping definitions
supports initiating RESTCONF connections to RESTCONF servers reference
using at least one transport (e.g., TLS, etc.)."; "RFC ZZZZ: YANG Groupings for TLS Clients and TLS Servers";
} }
feature tls-initiate { organization
description "IETF NETCONF (Network Configuration) Working Group";
"The 'tls-initiate' feature indicates that the RESTCONF client
supports initiating TLS connections to RESTCONF servers.";
reference
"RFC 8040: RESTCONF Protocol";
}
feature listen { contact
description "WG Web: <http://tools.ietf.org/wg/restconf/>
"The 'listen' feature indicates that the RESTCONF client WG List: <mailto:restconf@ietf.org>
supports opening a port to accept RESTCONF server call
home connections using at least one transport (e.g.,
TLS, etc.).";
}
feature tls-listen { Author: Kent Watsen
description <mailto:kwatsen@juniper.net>
"The 'tls-listen' feature indicates that the RESTCONF client
supports opening a port to listen for incoming RESTCONF
server call-home TLS connections.";
reference
"RFC 8071: NETCONF Call Home and RESTCONF Call Home";
} Author: Gary Wu
<mailto:garywu@cisco.com>";
container restconf-client { description
uses restconf-client; "This module contains a collection of YANG definitions for
description configuring RESTCONF clients.
"Top-level container for RESTCONF client configuration.";
}
grouping restconf-client { Copyright (c) 2017 IETF Trust and the persons identified as
description authors of the code. All rights reserved.
"Top-level grouping for RESTCONF client configuration.";
container initiate { Redistribution and use in source and binary forms, with or
if-feature initiate; without modification, is permitted pursuant to, and subject
description to the license terms contained in, the Simplified BSD
"Configures client initiating underlying TCP connections."; License set forth in Section 4.c of the IETF Trust's
list restconf-server { Legal Provisions Relating to IETF Documents
key name; (http://trustee.ietf.org/license-info).
description
"List of RESTCONF servers the RESTCONF client is to initiate
connections to.";
leaf name {
type string;
description
"An arbitrary name for the RESTCONF server.";
}
choice transport {
mandatory true;
description
"Selects between available transports.";
case tls { This version of this YANG module is part of RFC XXXX; see
if-feature tls-initiate; the RFC itself for full legal notices.";
container tls {
description
"Specifies TLS-specific transport configuration.";
uses endpoints-container {
refine endpoints/endpoint/port {
default 443;
}
}
uses ts:tls-client-grouping {
refine "client-auth/auth-type" {
mandatory true;
description
"RESTCONF clients MUST pass some authentication
credentials.";
}
} revision "2017-10-30" {
} description
} // end tls "Initial version";
reference
"RFC XXXX: RESTCONF Client and Server Models";
}
} // end transport // Features
container connection-type { feature initiate {
description description
"Indicates the kind of connection to use."; "The 'initiate' feature indicates that the RESTCONF client
choice connection-type { supports initiating RESTCONF connections to RESTCONF servers
description using at least one transport (e.g., TLS, etc.).";
"Selects between available connection types."; }
case persistent-connection {
container persistent {
presence true;
description
"Maintain a persistent connection to the RESTCONF
server. If the connection goes down, immediately
start trying to reconnect to it, using the
reconnection strategy.
This connection type minimizes any RESTCONF server feature tls-initiate {
to RESTCONF client data-transfer delay, albeit at if-feature initiate;
the expense of holding resources longer."; description
leaf idle-timeout { "The 'tls-initiate' feature indicates that the RESTCONF client
type uint32; supports initiating TLS connections to RESTCONF servers. This
units "seconds"; feature exists as TLS might not be a mandatory-to-implement
default 86400; // one day; transport in the future.";
description reference
"Specifies the maximum number of seconds that a "RFC 8040: RESTCONF Protocol";
a RESTCONF session may remain idle. A RESTCONF }
session will be dropped if it is idle for an
interval longer than this number of seconds.
If set to zero, then the client will never drop
a session because it is idle. Sessions that
have a notification subscription active are
never dropped.";
}
container keep-alives {
description
"Configures the keep-alive policy, to proactively
test the aliveness of the SSH/TLS server. An
unresponsive SSH/TLS server will be dropped after
approximately max-attempts * max-wait seconds.";
reference
"RFC 8071: NETCONF Call Home and RESTCONF Call
Home, Section 3.1, item S6";
leaf max-wait {
type uint16 {
range "1..max";
}
units seconds;
default 30;
description
"Sets the amount of time in seconds after which
if no data has been received from the SSH/TLS
server, a SSH/TLS-level message will be sent
to test the aliveness of the SSH/TLS server.";
}
leaf max-attempts {
type uint8;
default 3;
description
"Sets the maximum number of sequential keep-alive
messages that can fail to obtain a response from
the SSH/TLS server before assuming the SSH/TLS
server is no longer alive.";
}
}
}
}
case periodic-connection {
container periodic {
presence true;
description
"Periodically connect to the RESTCONF server, so that
the RESTCONF server may deliver messages pending for
the RESTCONF client. The RESTCONF server must close
the connection when it is ready to release it. Once
the connection has been closed, the RESTCONF client
will restart its timer until the next connection.";
leaf idle-timeout {
type uint16;
units "seconds";
default 300; // five minutes
description
"Specifies the maximum number of seconds that a
a RESTCONF session may remain idle. A RESTCONF
session will be dropped if it is idle for an
interval longer than this number of seconds.
If set to zero, then the server will never drop
a session because it is idle. Sessions that
have a notification subscription active are
never dropped.";
}
leaf reconnect-timeout {
type uint16 {
range "1..max";
}
units minutes;
default 60;
description
"Sets the maximum amount of unconnected time the
RESTCONF client will wait before re-establishing
a connection to the RESTCONF server. The RESTCONF
client may initiate a connection before this
time if desired (e.g., to set configuration).";
}
}
}
}
}
container reconnect-strategy {
description
"The reconnection strategy directs how a RESTCONF client
reconnects to a RESTCONF server, after discovering its
connection to the server has dropped, even if due to a
reboot. The RESTCONF client starts with the specified
endpoint and tries to connect to it max-attempts times
before trying the next endpoint in the list (round
robin).";
leaf start-with {
type enumeration {
enum first-listed {
description
"Indicates that reconnections should start with
the first endpoint listed.";
}
enum last-connected {
description
"Indicates that reconnections should start with
the endpoint last connected to. If no previous
connection has ever been established, then the
first endpoint configured is used. RESTCONF
clients SHOULD be able to remember the last
endpoint connected to across reboots.";
}
}
default first-listed;
description
"Specifies which of the RESTCONF server's endpoints the
RESTCONF client should start with when trying to connect
to the RESTCONF server.";
}
leaf max-attempts {
type uint8 {
range "1..max";
}
default 3;
description
"Specifies the number times the RESTCONF client tries to
connect to a specific endpoint before moving on to the
next endpoint in the list (round robin).";
}
}
} // end restconf-server
} // end initiate
container listen { feature listen {
if-feature listen; description
description "The 'listen' feature indicates that the RESTCONF client
"Configures client accepting call-home TCP connections."; supports opening a port to accept RESTCONF server call
home connections using at least one transport (e.g.,
TLS, etc.).";
}
leaf max-sessions { feature tls-listen {
type uint16; if-feature listen;
default 0; description
description "The 'tls-listen' feature indicates that the RESTCONF client
"Specifies the maximum number of concurrent sessions supports opening a port to listen for incoming RESTCONF
that can be active at one time. The value 0 indicates server call-home TLS connections. This feature exists as
that no artificial session limit should be used."; TLS might not be a mandatory-to-implement transport in the
} future.";
reference
"RFC 8071: NETCONF Call Home and RESTCONF Call Home";
}
leaf idle-timeout { container restconf-client {
type uint16; uses restconf-client;
units "seconds"; description
default 3600; // one hour "Top-level container for RESTCONF client configuration.";
description }
"Specifies the maximum number of seconds that a RESTCONF grouping restconf-client {
session may remain idle. A RESTCONF session will be dropped description
if it is idle for an interval longer than this number of "Top-level grouping for RESTCONF client configuration.";
seconds. If set to zero, then the server will never drop
a session because it is idle. Sessions that have a
notification subscription active are never dropped.";
}
list endpoint { container initiate {
key name; if-feature initiate;
description description
"List of endpoints to listen for RESTCONF connections."; "Configures client initiating underlying TCP connections.";
leaf name { list restconf-server {
type string; key name;
description min-elements 1;
"An arbitrary name for the RESTCONF listen endpoint."; description
} "List of RESTCONF servers the RESTCONF client is to initiate
choice transport { connections to in parallel.";
mandatory true; leaf name {
description type string;
"Selects between available transports."; description
case tls { "An arbitrary name for the RESTCONF server.";
if-feature tls-listen; }
container tls { container endpoints {
description description
"TLS-specific listening configuration for inbound "Container for the list of endpoints.";
connections."; list endpoint {
leaf address { key name;
type inet:ip-address; min-elements 1;
description ordered-by user;
"The IP address to listen for call-home connections."; description
} "A non-empty user-ordered list of endpoints for this
leaf port { RESTCONF client to try to connect to in sequence.
type inet:port-number; Defining more than one enables high-availability.";
default 4336; leaf name {
description type string;
"The port number to listen for call-home connections."; description
} "An arbitrary name for this endpoint.";
uses ts:tls-client-grouping { }
refine "client-auth/auth-type" { choice transport {
mandatory true; mandatory true;
description description
"RESTCONF clients MUST pass some authentication "Selects between available transports. This is a
credentials."; 'choice' statement so as to support additional
} transport options to be augmented in.";
} case tls {
} if-feature tls-initiate;
} container tls {
} // end transport description
} // end endpoint "Specifies TLS-specific transport configuration.";
} // end listen leaf address {
type inet:host;
mandatory true;
description
"The IP address or hostname of the endpoint.
If a domain name is configured, then the DNS
resolution should happen on each usage attempt.
If the the DNS resolution results in multiple
IP addresses, the IP addresses will be tried
according to local preference order until a
connection has been established or until all
IP addresses have failed.";
}
leaf port {
type inet:port-number;
default 443;
description
"The IP port for this endpoint. The RESTCONF
client will use the IANA-assigned well-known
port for 'https' (443) if no value is
specified.";
}
uses ts:tls-client-grouping {
refine "client-identity/auth-type" {
mandatory true;
description
"RESTCONF clients MUST pass some authentication
credentials.";
}
}
}
} // end tls
} // end transport
container connection-type {
description
"Indicates the kind of connection to use.";
choice connection-type {
description
"Selects between available connection types.";
case persistent-connection {
container persistent {
presence true;
description
"Maintain a persistent connection to the RESTCONF
server. If the connection goes down, immediately
start trying to reconnect to it, using the
reconnection strategy. This connection type
minimizes any RESTCONF server to RESTCONF client
data-transfer delay, albeit at the expense of
holding resources longer.";
} // end restconf-client leaf idle-timeout {
type uint32;
units "seconds";
default 86400; // one day;
description
"Specifies the maximum number of seconds that
the underlying TLS session may remain idle.
A TLS session will be dropped if it is idle
for an interval longer than this number of
seconds. If set to zero, then the client
will never drop a session because it is idle.
Sessions that have a notification subscription
active are never dropped.";
}
container keep-alives {
description
"Configures the keep-alive policy, to
proactively test the aliveness of the TLS
server. An unresponsive TLS server will be
dropped after approximately max-attempts *
max-wait seconds.";
reference
"RFC 8071: NETCONF Call Home and RESTCONF Call
Home, Section 3.1, item S6";
leaf max-wait {
type uint16 {
range "1..max";
}
units seconds;
default 30;
description
"Sets the amount of time in seconds after
which if no data has been received from
the TLS server, a TLS-level message will
be sent to test the aliveness of the TLS
server.";
}
leaf max-attempts {
type uint8;
default 3;
description
"Sets the maximum number of sequential keep-
alive messages that can fail to obtain a
response from the TLS server before assuming
the TLS server is no longer alive.";
}
}
}
grouping endpoints-container { }
description case periodic-connection {
"This grouping is used to configure a set of RESTCONF servers container periodic {
a RESTCONF client may initiate connections to."; presence true;
container endpoints { description
description "Periodically connect to the RESTCONF server, so
"Container for the list of endpoints."; that, e.g., the RESTCONF client can collect data
list endpoint { (logs) from the RESTCONF server. Once the
key name; connection is closed, for whatever reason, the
unique "address port"; RESTCONF client will restart its timer until the
min-elements 1; next connection.";
ordered-by user; leaf idle-timeout {
description type uint16;
"A non-empty user-ordered list of endpoints for this RESTCONF units "seconds";
client to try to connect to. Defining more than one enables default 300; // five minutes
high-availability."; description
leaf name { "Specifies the maximum number of seconds that
type string; the underlying TLS session may remain idle. A
description TLS session will be dropped if it is idle for
"An arbitrary name for this endpoint."; an interval longer than this number of seconds
} If set to zero, then the server will never
leaf address { drop a session because it is idle.";
type inet:host; }
mandatory true; leaf reconnect-timeout {
description type uint16 {
"The IP address or hostname of the endpoint. If a range "1..max";
hostname is configured and the DNS resolution results }
in more than one IP address, the RESTCONF client units minutes;
will process the IP addresses as if they had been default 60;
explicitly configured in place of the hostname."; description
} "Sets the maximum amount of unconnected time
leaf port { the RESTCONF client will wait before re-
type inet:port-number; establishing a connection to the RESTCONF
description server. The RESTCONF client may initiate a
"The IP port for this endpoint. The RESTCONF client will connection before this time if desired (e.g.,
use the IANA-assigned well-known port (set via a refine to set configuration).";
statement when uses) if no value is specified."; }
} }
} } // end periodic-connection
} } // end connection-type
} } // end connection-type
} container reconnect-strategy {
description
"The reconnection strategy directs how a RESTCONF client
reconnects to a RESTCONF server, after discovering its
connection to the server has dropped, even if due to a
reboot. The RESTCONF client starts with the specified
endpoint and tries to connect to it max-attempts times
before trying the next endpoint in the list (round
robin).";
leaf start-with {
type enumeration {
enum first-listed {
description
"Indicates that reconnections should start with
the first endpoint listed.";
}
enum last-connected {
description
"Indicates that reconnections should start with
the endpoint last connected to. If no previous
connection has ever been established, then the
first endpoint configured is used. RESTCONF
clients SHOULD be able to remember the last
endpoint connected to across reboots.";
}
}
default first-listed;
description
"Specifies which of the RESTCONF server's endpoints
the RESTCONF client should start with when trying
to connect to the RESTCONF server.";
}
leaf max-attempts {
type uint8 {
range "1..max";
}
default 3;
description
"Specifies the number times the RESTCONF client tries
to connect to a specific endpoint before moving on
to the next endpoint in the list (round robin).";
}
} // end reconnect-strategy
} // end endpoint
} // end endpoints
} // end restconf-server
} // end initiate
<CODE ENDS> container listen {
if-feature listen;
description
"Configures client accepting call-home TCP connections.";
leaf idle-timeout {
type uint16;
units "seconds";
default 3600; // one hour
description
"Specifies the maximum number of seconds that an underlying
TLS session may remain idle. A TLS session will be dropped
if it is idle for an interval longer than this number of
seconds. If set to zero, then the server will never drop
a session because it is idle. Sessions that have a
notification subscription active are never dropped.";
}
list endpoint {
key name;
description
"List of endpoints to listen for RESTCONF connections.";
leaf name {
type string;
description
"An arbitrary name for the RESTCONF listen endpoint.";
}
choice transport {
mandatory true;
description
"Selects between available transports. This is a 'choice'
statement so as to support additional transport options
to be augmented in.";
case tls {
if-feature tls-listen;
container tls {
description
"TLS-specific listening configuration for inbound
connections.";
leaf address {
type inet:ip-address;
description
"The IP address to listen on for incoming call-home
connections. The RESTCONF client will listen on
all configured interfaces if no value is specified.
INADDR_ANY (0.0.0.0) or INADDR6_ANY (0:0:0:0:0:0:0:0
a.k.a. ::) MUST be used when the server is to listen
on all IPv4 or IPv6 addresses, respectively.";
}
leaf port {
type inet:port-number;
default 4336;
description
"The port number to listen on for call-home
connections. The RESTCONF client will listen
on the IANA-assigned well-known port for
'restconf-ch-tls' (4336) if no value is
specified.";
}
uses ts:tls-client-grouping {
refine "client-identity/auth-type" {
mandatory true;
description
"RESTCONF clients MUST pass some authentication
credentials.";
}
}
}
}
} // end transport
} // end endpoint
} // end listen
} // end restconf-client
}
<CODE ENDS>
3. The RESTCONF Server Model 3. The RESTCONF Server Model
The RESTCONF Server model presented in this section supports servers The RESTCONF server model presented in this section supports servers
both listening for connections as well as initiating call-home both listening for connections as well as initiating call-home
connections. connections.
This model supports the TLS transport protocol using the TLS server
groupings defined in [I-D.ietf-netconf-tls-client-server].
All private keys and trusted certificates are held in the keystore All private keys and trusted certificates are held in the keystore
model defined in [I-D.ietf-netconf-keystore]. model defined in [I-D.ietf-netconf-keystore].
YANG feature statements are used to enable implementations to YANG feature statements are used to enable implementations to
advertise which parts of the model the RESTCONF server supports. advertise which parts of the model the RESTCONF server supports.
3.1. Tree Diagram 3.1. Tree Diagram
Just the container is displayed below, but there is also a grouping The following tree diagram [I-D.ietf-netmod-yang-tree-diagrams]
that the container is using. provides an overview of the data model for the "ietf-restconf-client"
module. Just the container is displayed below, but there is also a
reuable grouping by the same name that the container is using.
Note: all lines are folded at column 71 with no '\' character. [ note: '\' line wrapping for formatting only]
module: ietf-restconf-server module: ietf-restconf-server
+--rw restconf-server +--rw restconf-server
+--rw listen {listen}? +--rw listen {listen}?
| +--rw max-sessions? uint16 | +--rw endpoint* [name]
| +--rw endpoint* [name] | +--rw name string
| +--rw name string | +--rw (transport)
| +--rw (transport) | +--:(tls) {tls-listen}?
| +--:(tls) {tls-listen}? | +--rw tls
| +--rw tls | +--rw address? inet:ip-address
| +--rw address? inet:ip-address | +--rw port? inet:port-number
| +--rw port? inet:port-number | +--rw server-identity
| +--rw certificates | | +--rw algorithm?
| | +--rw certificate* [name] | | | identityref
| | +--rw name leafref | | +--rw private-key?
| +--rw client-auth | | | union
| | +--rw trusted-ca-certs? leafref | | +--rw public-key?
| | +--rw trusted-client-certs? leafref | | | binary
| | +--rw cert-maps | | +---x generate-private-key
| | +--rw cert-to-name* [id] | | | +---w input
| | +--rw id uint32 | | | +---w algorithm identityref
| | +--rw fingerprint x509c2n:tls-fingerprint | | +--rw certificates
| | +--rw map-type identityref | | | +--rw certificate* [name]
| | +--rw name string | | | +--rw name string
| +--rw hello-params | | | +--rw value? binary
| {tls-server-hello-params-config}? | | +---x generate-certificate-signing-request
| +--rw tls-versions | | +---w input
| | +--rw tls-version* identityref | | | +---w subject binary
| +--rw cipher-suites | | | +---w attributes? binary
| +--rw cipher-suite* identityref | | +--ro output
+--rw call-home {call-home}? | | +--ro certificate-signing-request
+--rw restconf-client* [name] | | binary
+--rw name string | +--rw client-auth
+--rw (transport) | | +--rw pinned-ca-certs?
| +--:(tls) {tls-call-home}? | | | ks:pinned-certificates
| +--rw tls | | +--rw pinned-client-certs?
| +--rw endpoints | | | ks:pinned-certificates
| | +--rw endpoint* [name] | | +--rw cert-maps
| | +--rw name string | | +--rw cert-to-name* [id]
| | +--rw address inet:host | | +--rw id uint32
| | +--rw port? inet:port-number | | +--rw fingerprint
| +--rw certificates | | | x509c2n:tls-fingerprint
| | +--rw certificate* [name] | | +--rw map-type identityref
| | +--rw name leafref | | +--rw name string
| +--rw client-auth | +--rw hello-params
| | +--rw trusted-ca-certs? leafref | {tls-server-hello-params-config}?
| | +--rw trusted-client-certs? leafref | +--rw tls-versions
| | +--rw cert-maps | | +--rw tls-version* identityref
| | +--rw cert-to-name* [id] | +--rw cipher-suites
| | +--rw id uint32 | +--rw cipher-suite* identityref
| | +--rw fingerprint x509c2n:tls-fingerprint +--rw call-home {call-home}?
| | +--rw map-type identityref +--rw restconf-client* [name]
| | +--rw name string +--rw name string
| +--rw hello-params +--rw endpoints
| {tls-server-hello-params-config}? | +--rw endpoint* [name]
| +--rw tls-versions | +--rw name string
| | +--rw tls-version* identityref | +--rw (transport)
| +--rw cipher-suites | +--:(tls) {tls-call-home}?
| +--rw cipher-suite* identityref | +--rw tls
+--rw connection-type | +--rw address inet:host
| +--rw (connection-type)? | +--rw port? inet:port-number\
| +--:(persistent-connection)
| | +--rw persistent! | +--rw server-identity
| | +--rw keep-alives | | +--rw algorithm?
| | +--rw max-wait? uint16 | | | identityref
| | +--rw max-attempts? uint8 | | +--rw private-key?
| +--:(periodic-connection) | | | union
| +--rw periodic! | | +--rw public-key?
| +--rw reconnect-timeout? uint16 | | | binary
+--rw reconnect-strategy | | +---x generate-private-key
+--rw start-with? enumeration | | | +---w input
+--rw max-attempts? uint8 | | | +---w algorithm identityref
| | +--rw certificates
| | | +--rw certificate* [name]
| | | +--rw name string
| | | +--rw value? binary
| | +---x generate-certificate-signing-req\
uest
| | +---w input
| | | +---w subject binary
| | | +---w attributes? binary
| | +--ro output
| | +--ro certificate-signing-reques\
t
| | binary
| +--rw client-auth
| | +--rw pinned-ca-certs?
| | | ks:pinned-certificates
| | +--rw pinned-client-certs?
| | | ks:pinned-certificates
| | +--rw cert-maps
| | +--rw cert-to-name* [id]
| | +--rw id uint32
| | +--rw fingerprint
| | | x509c2n:tls-fingerprint
| | +--rw map-type identityref\
| | +--rw name string
| +--rw hello-params
| {tls-server-hello-params-config}?\
| +--rw tls-versions
| | +--rw tls-version* identityref
| +--rw cipher-suites
| +--rw cipher-suite* identityref
+--rw connection-type
| +--rw (connection-type)?
| +--:(persistent-connection)
| | +--rw persistent!
| | +--rw idle-timeout? uint32
| | +--rw keep-alives
| | +--rw max-wait? uint16
| | +--rw max-attempts? uint8
| +--:(periodic-connection)
| +--rw periodic!
| +--rw idle-timeout? uint16
| +--rw reconnect-timeout? uint16
+--rw reconnect-strategy
+--rw start-with? enumeration
+--rw max-attempts? uint8
3.2. Example Usage 3.2. Example Usage
The following example illustrates configuring a RESTCONF server to The following example illustrates configuring a RESTCONF server to
listen for RESTCONF client connections, as well as configuring call- listen for RESTCONF client connections, as well as configuring call-
home to one RESTCONF client. home to one RESTCONF client.
This example is consistent with the examples presented in Section 2.2 This example is consistent with the examples presented in Section 2.2
of [I-D.ietf-netconf-keystore]. of [I-D.ietf-netconf-keystore].
<restconf-server [ note: '\' line wrapping for formatting only]
xmlns="urn:ietf:params:xml:ns:yang:ietf-restconf-server"
xmlns:x509c2n="urn:ietf:params:xml:ns:yang:ietf-x509-cert-to-name">
<!-- listening for TLS (HTTPS) connections --> <restconf-server
<listen> xmlns="urn:ietf:params:xml:ns:yang:ietf-restconf-server"
<endpoint> xmlns:x509c2n="urn:ietf:params:xml:ns:yang:ietf-x509-cert-to-name">\
<name>netconf/tls</name>
<tls>
<address>11.22.33.44</address>
<certificates>
<certificate>
<name>tls-ec-cert</name>
</certificate>
</certificates>
<client-auth>
<trusted-ca-certs>deployment-specific-ca-certs</trusted-ca-certs>
<trusted-client-certs>explicitly-trusted-client-certs</trusted-client-certs>
<cert-maps>
<cert-to-name>
<id>1</id>
<fingerprint>11:0A:05:11:00</fingerprint>
<map-type>x509c2n:san-any</map-type>
</cert-to-name>
<cert-to-name>
<id>2</id>
<fingerprint>B3:4F:A1:8C:54</fingerprint>
<map-type>x509c2n:specified</map-type>
<name>scooby-doo</name>
</cert-to-name>
</cert-maps>
</client-auth>
</tls>
</endpoint>
</listen>
<!-- calling home to a RESTCONF client --> <!-- listening for TLS (HTTPS) connections -->
<call-home> <listen>
<restconf-client> <endpoint>
<name>config-manager</name> <name>netconf/tls</name>
<tls> <tls>
<address>11.22.33.44</address>
<server-identity>
<algorithm xmlns:ks="urn:ietf:params:xml:ns:yang:ietf-keyst\
ore">ks:secp521r1</algorithm>
<private-key>base64encodedvalue==</private-key>
<public-key>base64encodedvalue==</public-key>
<certificates>
<certificate>
<name>domain certificate</name>
<value>base64encodedvalue==</value>
</certificate>
</certificates>
</server-identity>
<client-auth>
<pinned-ca-certs>deployment-specific-ca-certs</pinned-ca-ce\
rts>
<pinned-client-certs>explicitly-trusted-client-certs</pinne\
d-client-certs>
<cert-maps>
<cert-to-name>
<id>1</id>
<fingerprint>11:0A:05:11:00</fingerprint>
<map-type>x509c2n:san-any</map-type>
</cert-to-name>
<cert-to-name>
<id>2</id>
<fingerprint>B3:4F:A1:8C:54</fingerprint>
<map-type>x509c2n:specified</map-type>
<name>scooby-doo</name>
</cert-to-name>
</cert-maps>
</client-auth>
</tls>
</endpoint>
</listen>
<!-- calling home to a RESTCONF client -->
<call-home>
<restconf-client>
<name>config-manager</name>
<endpoints> <endpoints>
<endpoint> <endpoint>
<name>east-data-center</name> <name>east-data-center</name>
<address>22.33.44.55</address> <tls>
<address>22.33.44.55</address>
<server-identity>
<algorithm xmlns:ks="urn:ietf:params:xml:ns:yang:ietf-k\
eystore">ks:secp521r1</algorithm>
<private-key>base64encodedvalue==</private-key>
<public-key>base64encodedvalue==</public-key>
<certificates>
<certificate>
<name>domain certificate</name>
<value>base64encodedvalue==</value>
</certificate>
</certificates>
</server-identity>
<client-auth>
<pinned-ca-certs>deployment-specific-ca-certs</pinned-c\
a-certs>
<pinned-client-certs>explicitly-trusted-client-certs</p\
inned-client-certs>
<cert-maps>
<cert-to-name>
<id>1</id>
<fingerprint>11:0A:05:11:00</fingerprint>
<map-type>x509c2n:san-any</map-type>
</cert-to-name>
<cert-to-name>
<id>2</id>
<fingerprint>B3:4F:A1:8C:54</fingerprint>
<map-type>x509c2n:specified</map-type>
<name>scooby-doo</name>
</cert-to-name>
</cert-maps>
</client-auth>
</tls>
</endpoint> </endpoint>
<endpoint> <endpoint>
<name>west-data-center</name> <name>west-data-center</name>
<address>33.44.55.66</address> <tls>
<address>33.44.55.66</address>
<server-identity>
<algorithm xmlns:ks="urn:ietf:params:xml:ns:yang:ietf-k\
eystore">ks:secp521r1</algorithm>
<private-key>base64encodedvalue==</private-key>
<public-key>base64encodedvalue==</public-key>
<certificates>
<certificate>
<name>domain certificate</name>
<value>base64encodedvalue==</value>
</certificate>
</certificates>
</server-identity>
<client-auth>
<pinned-ca-certs>deployment-specific-ca-certs</pinned-c\
a-certs>
<pinned-client-certs>explicitly-trusted-client-certs</p\
inned-client-certs>
<cert-maps>
<cert-to-name>
<id>1</id>
<fingerprint>11:0A:05:11:00</fingerprint>
<map-type>x509c2n:san-any</map-type>
</cert-to-name>
<cert-to-name>
<id>2</id>
<fingerprint>B3:4F:A1:8C:54</fingerprint>
<map-type>x509c2n:specified</map-type>
<name>scooby-doo</name>
</cert-to-name>
</cert-maps>
</client-auth>
</tls>
</endpoint> </endpoint>
</endpoints> </endpoints>
<certificates> <connection-type>
<certificate> <periodic>
<name>tls-ec-cert</name> <idle-timeout>300</idle-timeout>
</certificate> <reconnect-timeout>60</reconnect-timeout>
</certificates> </periodic>
<client-auth> </connection-type>
<trusted-ca-certs>deployment-specific-ca-certs</trusted-ca-certs> <reconnect-strategy>
<trusted-client-certs>explicitly-trusted-client-certs</trusted-client-certs> <start-with>last-connected</start-with>
<cert-maps> <max-attempts>3</max-attempts>
<cert-to-name> </reconnect-strategy>
<id>1</id> </restconf-client>
<fingerprint>11:0A:05:11:00</fingerprint> </call-home>
<map-type>x509c2n:san-any</map-type> </restconf-server>
</cert-to-name>
<cert-to-name>
<id>2</id>
<fingerprint>B3:4F:A1:8C:54</fingerprint>
<map-type>x509c2n:specified</map-type>
<name>scooby-doo</name>
</cert-to-name>
</cert-maps>
</client-auth>
</tls>
<connection-type>
<periodic>
<idle-timeout>300</idle-timeout>
<reconnect-timeout>60</reconnect-timeout>
</periodic>
</connection-type>
<reconnect-strategy>
<start-with>last-connected</start-with>
<max-attempts>3</max-attempts>
</reconnect-strategy>
</restconf-client>
</call-home>
</restconf-server>
3.3. YANG Model
This YANG module imports YANG types from [RFC6991] and [RFC7407].
<CODE BEGINS> file "ietf-restconf-server@2017-07-03.yang"
module ietf-restconf-server {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-restconf-server";
prefix "rcs";
//import ietf-netconf-acm {
// prefix nacm;
// reference
// "RFC 6536: Network Configuration Protocol (NETCONF)
// Access Control Model";
//}
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-x509-cert-to-name { 3.3. YANG Module
prefix x509c2n;
reference
"RFC 7407: A YANG Data Model for SNMP Configuration";
}
import ietf-tls-server { This YANG module imports YANG types from [RFC6991] and [RFC7407], and
prefix ts; groupings from [I-D.ietf-netconf-tls-client-server].
revision-date 2017-06-13; // stable grouping definitions
reference
"RFC ZZZZ: TLS Client and Server Models";
}
organization <CODE BEGINS> file "ietf-restconf-server@2017-10-30.yang"
"IETF NETCONF (Network Configuration) Working Group"; module ietf-restconf-server {
yang-version 1.1;
contact namespace "urn:ietf:params:xml:ns:yang:ietf-restconf-server";
"WG Web: <http://tools.ietf.org/wg/netconf/> prefix "rcs";
WG List: <mailto:netconf@ietf.org>
WG Chair: Mehmet Ersue import ietf-inet-types {
<mailto:mehmet.ersue@nsn.com> prefix inet;
reference
"RFC 6991: Common YANG Data Types";
}
WG Chair: Mahesh Jethanandani import ietf-x509-cert-to-name {
<mailto:mjethanandani@gmail.com> prefix x509c2n;
reference
"RFC 7407: A YANG Data Model for SNMP Configuration";
}
import ietf-tls-server {
prefix ts;
revision-date 2017-10-30; // stable grouping definitions
reference
"RFC ZZZZ: YANG Groupings for TLS Clients and TLS Servers";
}
Editor: Kent Watsen organization
<mailto:kwatsen@juniper.net>"; "IETF NETCONF (Network Configuration) Working Group";
description contact
"This module contains a collection of YANG definitions for "WG Web: <http://tools.ietf.org/wg/netconf/>
configuring RESTCONF servers. WG List: <mailto:netconf@ietf.org>
Copyright (c) 2014 IETF Trust and the persons identified as Author: Kent Watsen
authors of the code. All rights reserved. <mailto:kwatsen@juniper.net>
Redistribution and use in source and binary forms, with or Author: Gary Wu
without modification, is permitted pursuant to, and subject <mailto:garywu@cisco.com>
to the license terms contained in, the Simplified BSD
License set forth in Section 4.c of the IETF Trust's
Legal Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see Author: Juergen Schoenwaelder
the RFC itself for full legal notices."; <mailto:j.schoenwaelder@jacobs-university.de>";
revision "2017-07-03" {
description description
"Initial version"; "This module contains a collection of YANG definitions for
reference configuring RESTCONF servers.
"RFC XXXX: RESTCONF Client and Server Models";
}
// Features Copyright (c) 2017 IETF Trust and the persons identified as
authors of the code. All rights reserved.
feature listen { Redistribution and use in source and binary forms, with or
description without modification, is permitted pursuant to, and subject
"The 'listen' feature indicates that the RESTCONF server to the license terms contained in, the Simplified BSD
supports opening a port to accept RESTCONF client connections License set forth in Section 4.c of the IETF Trust's
using at least one transport (e.g., TLS, etc.)."; Legal Provisions Relating to IETF Documents
} (http://trustee.ietf.org/license-info).
feature tls-listen { This version of this YANG module is part of RFC XXXX; see
description the RFC itself for full legal notices.";
"The 'tls-listen' feature indicates that the RESTCONF server
supports opening a port to listen for incoming RESTCONF
client connections.";
reference
"RFC XXXX: RESTCONF Protocol";
}
feature call-home { revision "2017-10-30" {
description description
"The 'call-home' feature indicates that the RESTCONF server "Initial version";
supports initiating RESTCONF call home connections to REETCONF reference
clients using at least one transport (e.g., TLS, etc.)."; "RFC XXXX: RESTCONF Client and Server Models";
reference }
"RFC 8071: NETCONF Call Home and RESTCONF Call Home"; // Features
}
feature tls-call-home { feature listen {
description description
"The 'tls-call-home' feature indicates that the RESTCONF server "The 'listen' feature indicates that the RESTCONF server
supports initiating connections to RESTCONF clients."; supports opening a port to accept RESTCONF client connections
reference using at least one transport (e.g., TLS, etc.).";
"RFC 8071: NETCONF Call Home and RESTCONF Call Home"; }
}
feature client-cert-auth { feature tls-listen {
description if-feature listen;
"The client-cert-auth feature indicates that the RESTCONF description
server supports the ClientCertificate authentication scheme."; "The 'tls-listen' feature indicates that the RESTCONF server
reference supports opening a port to listen for incoming RESTCONF
"RFC ZZZZ: Client Authentication over New TLS Connection"; client connections. This feature exists as TLS might not
} be a mandatory-to-implement transport in the future.";
reference
"RFC 8040: RESTCONF Protocol";
}
// top-level container feature call-home {
container restconf-server { description
uses restconf-server; "The 'call-home' feature indicates that the RESTCONF server
description supports initiating RESTCONF call home connections to RESTCONF
"Top-level container for RESTCONF server configuration."; clients using at least one transport (e.g., TLS, etc.).";
} reference
"RFC 8071: NETCONF Call Home and RESTCONF Call Home";
}
grouping restconf-server { feature tls-call-home {
description if-feature call-home;
"Top-level grouping for RESTCONF server configuration."; description
"The 'tls-call-home' feature indicates that the RESTCONF server
supports initiating connections to RESTCONF clients. This
feature exists as TLS might not be a mandatory-to-implement
transport in the future.";
reference
"RFC 8071: NETCONF Call Home and RESTCONF Call Home";
}
container listen { container restconf-server {
if-feature listen; uses restconf-server;
description description
"Configures listen behavior"; "Top-level container for RESTCONF server configuration.";
leaf max-sessions { }
type uint16;
default 0; // should this be 'max'? grouping restconf-server {
description description
"Specifies the maximum number of concurrent sessions "Top-level grouping for RESTCONF server configuration.";
that can be active at one time. The value 0 indicates
that no artificial session limit should be used."; container listen {
} if-feature listen;
list endpoint {
key name;
description description
"List of endpoints to listen for RESTCONF connections."; "Configures listen behavior";
leaf name { list endpoint {
type string; key name;
description
"An arbitrary name for the RESTCONF listen endpoint.";
}
choice transport {
mandatory true;
description description
"Selects between available transports."; "List of endpoints to listen for RESTCONF connections.";
case tls { leaf name {
if-feature tls-listen; type string;
container tls { description
description "An arbitrary name for the RESTCONF listen endpoint.";
"TLS-specific listening configuration for inbound }
connections."; choice transport {
leaf address { mandatory true;
type inet:ip-address; description
"Selects between available transports. This is a 'choice'
statement so as to support additional transport options
to be augmented in.";
case tls {
if-feature tls-listen;
container tls {
description description
"The IP address of the interface to listen on. The "TLS-specific listening configuration for inbound
TLS server will listen on all interfaces if no value connections.";
is specified. Please note that some addresses have leaf address {
special meanings (e.g., '0.0.0.0' and '::')."; type inet:ip-address;
}
leaf port {
type inet:port-number;
default 443;
description description
"The local port number on this interface the TLS server "The IP address to listen on for incoming connections.
listens on."; The RESTCONF server will listen on all configured
} interfaces if no value is specified. INADDR_ANY
uses ts:tls-server-grouping { (0.0.0.0) or INADDR6_ANY (0:0:0:0:0:0:0:0 a.k.a. ::)
refine "client-auth" { MUST be used when the server is to listen on all IPv4
must 'trusted-ca-certs or trusted-client-certs'; or IPv6 addresses, respectively.";
description
"RESTCONF servers MUST be able to validate clients.";
} }
augment "client-auth" { leaf port {
type inet:port-number;
default 443;
description description
"Augments in the cert-to-name structure."; "The local port number to listen on. If no value is
uses cert-maps-grouping; specified, the IANA-assigned port value for 'https'
(443) is used.";
} }
} uses ts:tls-server-grouping {
} // end tls container refine "client-auth" {
} // end tls case must 'pinned-ca-certs or pinned-client-certs';
} // end transport description
} // end endpoint "RESTCONF servers MUST be able to validate
} // end listen clients.";
}
augment "client-auth" {
description
"Augments in the cert-to-name structure,
so the RESTCONF server can map TLS-layer
client certificates to RESTCONF usernames.";
container cert-maps {
uses x509c2n:cert-to-name;
description
"The cert-maps container is used by a TLS-based
RESTCONF server to map the RESTCONF client's
presented X.509 certificate to a RESTCONF
username. If no matching and valid
cert-to-name list entry can be found, then
the RESTCONF server MUST close the connection,
and MUST NOT accept RESTCONF messages over
it.";
reference
"RFC 7407: A YANG Data Model for SNMP
Configuration.";
}
}
}
} // end tls container
} // end tls case
} // end transport
} // end endpoint
} // end listen
container call-home { container call-home {
if-feature call-home; if-feature call-home;
description
"Configures call-home behavior";
list restconf-client {
key name;
description description
"List of RESTCONF clients the RESTCONF server is to "Configures call-home behavior";
initiate call-home connections to."; list restconf-client {
leaf name { key name;
type string;
description
"An arbitrary name for the remote RESTCONF client.";
}
choice transport {
mandatory true;
description description
"Selects between TLS and any transports augmented in."; "List of RESTCONF clients the RESTCONF server is to
case tls { initiate call-home connections to in parallel.";
if-feature tls-call-home; leaf name {
container tls { type string;
description
"An arbitrary name for the remote RESTCONF client.";
}
container endpoints {
description
"Container for the list of endpoints.";
list endpoint {
key name;
min-elements 1;
ordered-by user;
description description
"Specifies TLS-specific call-home transport "User-ordered list of endpoints for this RESTCONF
configuration."; client. Defining more than one enables high-
uses endpoints-container { availability.";
refine endpoints/endpoint/port { leaf name {
default 4336; type string;
} description
"An arbitrary name for this endpoint.";
} }
uses ts:tls-server-grouping { choice transport {
refine "client-auth" { mandatory true;
must 'trusted-ca-certs or trusted-client-certs'; description
description "Selects between available transports. This is a
"RESTCONF servers MUST be able to validate clients."; 'choice' statement so as to support additional
transport options to be augmented in.";
case tls {
if-feature tls-call-home;
container tls {
description
"Specifies TLS-specific call-home transport
configuration.";
leaf address {
type inet:host;
mandatory true;
description
"The IP address or hostname of the endpoint.
If a domain name is configured, then the DNS
resolution should happen on each usage attempt.
If the DNS resolution results in multiple IP
addresses, the IP addresses will be tried
according to local preference order until a
connection has been established or until all
IP addresses have failed.";
}
leaf port {
type inet:port-number;
default 4336;
description
"The IP port for this endpoint. The RESTCONF
server will use the IANA-assigned well-known
port for 'restconf-ch-tls' (4336) if no value
is specified.";
}
uses ts:tls-server-grouping {
refine "client-auth" {
must 'pinned-ca-certs or pinned-client-certs';
description
"RESTCONF servers MUST be able to validate
clients.";
}
augment "client-auth" {
description
"Augments in the cert-to-name structure,
so the RESTCONF server can map TLS-layer
client certificates to RESTCONF usernames.";
container cert-maps {
uses x509c2n:cert-to-name;
description
"The cert-maps container is used by a
TLS-based RESTCONF server to map the
RESTCONF client's presented X.509
certificate to a RESTCONF username. If
no matching and valid cert-to-name list
entry can be found, then the RESTCONF
server MUST close the connection, and
MUST NOT accept RESTCONF messages over
it.";
reference
"RFC 7407: A YANG Data Model for SNMP
Configuration.";
}
}
}
}
} }
augment "client-auth" { } // end transport
} // end endpoint
} // end endpoints
container connection-type {
description
"Indicates the RESTCONF client's preference for how the
RESTCONF server's connection is maintained.";
choice connection-type {
description
"Selects between available connection types.";
case persistent-connection {
container persistent {
presence true;
description description
"Augments in the cert-to-name structure."; "Maintain a persistent connection to the RESTCONF
uses cert-maps-grouping; client. If the connection goes down, immediately
start trying to reconnect to it, using the
reconnection strategy.
This connection type minimizes any RESTCONF client
to RESTCONF server data-transfer delay, albeit at
the expense of holding resources longer.";
leaf idle-timeout {
type uint32;
units "seconds";
default 86400; // one day;
description
"Specifies the maximum number of seconds that the
underlying TLS session may remain idle. A TLS
session will be dropped if it is idle for an
interval longer than this number of seconds.
If set to zero, then the server will never drop
a session because it is idle. Sessions that
have a notification subscription active are
never dropped.";
}
container keep-alives {
description
"Configures the keep-alive policy, to proactively
test the aliveness of the TLS client. An
unresponsive TLS client will be dropped after
approximately (max-attempts * max-wait)
seconds.";
reference
"RFC 8071: NETCONF Call Home and RESTCONF Call
Home, Section 3.1, item S6";
leaf max-wait {
type uint16 {
range "1..max";
}
units seconds;
default 30;
description
"Sets the amount of time in seconds after which
if no data has been received from the TLS
client, a TLS-level message will be sent to
test the aliveness of the TLS client.";
}
leaf max-attempts {
type uint8;
default 3;
description
"Sets the maximum number of sequential keep-alive
messages that can fail to obtain a response from
the TLS client before assuming the TLS client is
no longer alive.";
}
}
} }
} }
} case periodic-connection {
} container periodic {
} presence true;
container connection-type {
description
"Indicates the RESTCONF client's preference for how the
RESTCONF server's connection is maintained.";
choice connection-type {
description
"Selects between available connection types.";
case persistent-connection {
container persistent {
presence true;
description
"Maintain a persistent connection to the RESTCONF
client. If the connection goes down, immediately
start trying to reconnect to it, using the
reconnection strategy.
This connection type minimizes any RESTCONF client
to RESTCONF server data-transfer delay, albeit at
the expense of holding resources longer.";
container keep-alives {
description description
"Configures the keep-alive policy, to proactively "Periodically connect to the RESTCONF client, so that
test the aliveness of the TLS client. An the RESTCONF client may send requests pending for
unresponsive TLS client will be dropped after the RESTCONF server. Once the connection has been
approximately (max-attempts * max-wait) closed, for whatever reason, the server will restart
seconds."; its timer until the next connection.";
reference leaf idle-timeout {
"RFC 8071: NETCONF Call Home and RESTCONF Call type uint16;
Home, Section 3.1, item S6"; units "seconds";
leaf max-wait { default 300; // five minutes
description
"Specifies the maximum number of seconds that the
underlying TLS session may remain idle. A TLS
session will be dropped if it is idle for an
interval longer than this number of seconds.
If set to zero, then the server will never drop
a session because it is idle. Sessions that
have a notification subscription active are
never dropped.";
}
leaf reconnect-timeout {
type uint16 { type uint16 {
range "1..max"; range "1..max";
} }
units seconds; units minutes;
default 30; default 60;
description
"Sets the amount of time in seconds after which
if no data has been received from the TLS
client, a TLS-level message will be sent to
test the aliveness of the TLS client.";
}
leaf max-attempts {
type uint8;
default 3;
description description
"Sets the maximum number of sequential keep-alive "The maximum amount of unconnected time the
messages that can fail to obtain a response from RESTCONF server will wait before re-establishing
the TLS client before assuming the TLS client is a connection to the RESTCONF client. The
no longer alive."; RESTCONF server may initiate a connection to
the RESTCONF client before this time if desired
(e.g., to deliver a notification).";
} }
} }
} }
} }
case periodic-connection { }
container periodic { container reconnect-strategy {
presence true; description
description "The reconnection strategy directs how a RESTCONF server
"Periodically connect to the RESTCONF client, so that reconnects to a RESTCONF client after after discovering
the RESTCONF client may deliver messages pending for its connection to the client has dropped, even if due to
the RESTCONF server. The client must close the a reboot. The RESTCONF server starts with the specified
connection when it's ready to release it. Once the endpoint and tries to connect to it max-attempts times
connection has been closed, the server will restart before trying the next endpoint in the list (round
its timer until the next connection."; robin).";
leaf reconnect-timeout { leaf start-with {
type uint16 { type enumeration {
range "1..max"; enum first-listed {
}
units minutes;
default 60;
description description
"The maximum amount of unconnected time the "Indicates that reconnections should start with
RESTCONF server will wait before re-establishing the first endpoint listed.";
a connection to the RESTCONF client. The }
RESTCONF server may initiate a connection to enum last-connected {
the RESTCONF client before this time if desired description
(e.g., to deliver a notification)."; "Indicates that reconnections should start with
the endpoint last connected to. If no previous
connection has ever been established, then the
first endpoint configured is used. RESTCONF
servers SHOULD be able to remember the last
endpoint connected to across reboots.";
} }
} }
default first-listed;
description
"Specifies which of the RESTCONF client's endpoints the
RESTCONF server should start with when trying to connect
to the RESTCONF client.";
} }
} leaf max-attempts {
} type uint8 {
container reconnect-strategy { range "1..max";
description
"The reconnection strategy directs how a RESTCONF server
reconnects to a RESTCONF client after after discovering
its connection to the client has dropped, even if due to
a reboot. The RESTCONF server starts with the specified
endpoint and tries to connect to it max-attempts times
before trying the next endpoint in the list (round
robin).";
leaf start-with {
type enumeration {
enum first-listed {
description
"Indicates that reconnections should start with
the first endpoint listed.";
}
enum last-connected {
description
"Indicates that reconnections should start with
the endpoint last connected to. If no previous
connection has ever been established, then the
first endpoint configured is used. RESTCONF
servers SHOULD be able to remember the last
endpoint connected to across reboots.";
} }
default 3;
description
"Specifies the number times the RESTCONF server tries to
connect to a specific endpoint before moving on to the
next endpoint in the list (round robin).";
} }
default first-listed;
description
"Specifies which of the RESTCONF client's endpoints the
RESTCONF server should start with when trying to connect
to the RESTCONF client.";
}
leaf max-attempts {
type uint8 {
range "1..max";
}
default 3;
description
"Specifies the number times the RESTCONF server tries to
connect to a specific endpoint before moving on to the
next endpoint in the list (round robin).";
} }
} }
} }
} }
} }
<CODE ENDS>
grouping cert-maps-grouping {
description
"A grouping that defines a container around the
cert-to-name structure defined in RFC 7407.";
container cert-maps {
uses x509c2n:cert-to-name;
description
"The cert-maps container is used by a TLS-based RESTCONF
server to map the RESTCONF client's presented X.509
certificate to a RESTCONF username. If no matching and
valid cert-to-name list entry can be found, then the
RESTCONF server MUST close the connection, and MUST NOT
accept RESTCONF messages over it.";
reference
"RFC XXXX: The RESTCONF Protocol";
}
}
grouping endpoints-container {
description
"This grouping is used by tls container for call-home
configurations.";
container endpoints {
description
"Container for the list of endpoints.";
list endpoint {
key name;
unique "address port";
min-elements 1;
ordered-by user;
description
"User-ordered list of endpoints for this RESTCONF client.
Defining more than one enables high-availability.";
leaf name {
type string;
description
"An arbitrary name for this endpoint.";
}
leaf address {
type inet:host;
mandatory true;
description
"The IP address or hostname of the endpoint. If a
hostname is configured and the DNS resolution results
in more than one IP address, the RESTCONF server
will process the IP addresses as if they had been
explicitly configured in place of the hostname.";
}
leaf port {
type inet:port-number;
description
"The IP port for this endpoint. The RESTCONF server will
use the IANA-assigned well-known port if no value is
specified.";
}
}
}
}
}
<CODE ENDS>
4. Security Considerations 4. Security Considerations
The YANG module defined in this document uses a grouping defined in The YANG module defined in this document uses a grouping defined in
[I-D.ietf-netconf-tls-client-server]. Please see the Security [I-D.ietf-netconf-tls-client-server]. Please see the Security
Considerations section in that document for concerns related that Considerations section in that document for concerns related that
grouping. grouping.
The YANG module defined in this document is designed to be accessed The YANG module defined in this document is designed to be accessed
via YANG based management protocols, such as NETCONF [RFC6241] and via YANG based management protocols, such as NETCONF [RFC6241] and
skipping to change at page 30, line 25 skipping to change at page 33, line 30
all available protocol operations and content. all available protocol operations and content.
There are a number of data nodes defined in this YANG module that are There are a number of data nodes defined in this YANG module that are
writable/creatable/deletable (i.e., config true, which is the writable/creatable/deletable (i.e., config true, which is the
default). These data nodes may be considered sensitive or vulnerable default). These data nodes may be considered sensitive or vulnerable
in some network environments. Write operations (e.g., edit-config) in some network environments. Write operations (e.g., edit-config)
to these data nodes without proper protection can have a negative to these data nodes without proper protection can have a negative
effect on network operations. These are the subtrees and data nodes effect on network operations. These are the subtrees and data nodes
and their sensitivity/vulnerability: and their sensitivity/vulnerability:
NONE /: The entire data trees defined by the modules defined in this
draft are sensitive to write operations. For instance, the
addition or removal of references to keys, certificates,
trusted anchors, etc., can dramatically alter the implemented
security policy. However, no NACM annotations are applied as
the data SHOULD be editable by users other than a designated
'recovery session'.
Some of the readable data nodes in this YANG module may be considered Some of the readable data nodes in this YANG module may be considered
sensitive or vulnerable in some network environments. It is thus sensitive or vulnerable in some network environments. It is thus
important to control read access (e.g., via get, get-config, or important to control read access (e.g., via get, get-config, or
notification) to these data nodes. These are the subtrees and data notification) to these data nodes. These are the subtrees and data
nodes and their sensitivity/vulnerability: nodes and their sensitivity/vulnerability:
NONE NONE
Some of the RPC operations in this YANG module may be considered Some of the RPC operations in this YANG module may be considered
skipping to change at page 31, line 35 skipping to change at page 34, line 43
namespace: urn:ietf:params:xml:ns:yang:ietf-restconf-server namespace: urn:ietf:params:xml:ns:yang:ietf-restconf-server
prefix: ncs prefix: ncs
reference: RFC XXXX reference: RFC XXXX
6. Acknowledgements 6. Acknowledgements
The authors would like to thank for following for lively discussions The authors would like to thank for following for lively discussions
on list and in the halls (ordered by last name): Andy Bierman, Martin on list and in the halls (ordered by last name): Andy Bierman, Martin
Bjorklund, Benoit Claise, Mehmet Ersue, Balazs Kovacs, David Bjorklund, Benoit Claise, Mehmet Ersue, Balazs Kovacs, David
Lamparter, Alan Luchuk, Ladislav Lhotka, Radek Krejci, Tom Petch, Lamparter, Alan Luchuk, Ladislav Lhotka, Radek Krejci, Tom Petch,
Phil Shafer, Sean Turner, and Bert Wijnen. Juergen Schoenwaelder, Phil Shafer, Sean Turner, and Bert Wijnen.
Juergen Schoenwaelder and was partly funded by Flamingo, a Network of
Excellence project (ICT-318488) supported by the European Commission
under its Seventh Framework Programme.
7. References 7. References
7.1. Normative References 7.1. Normative References
[I-D.ietf-netconf-keystore] [I-D.ietf-netconf-keystore]
Watsen, K., "Keystore Model", draft-ietf-netconf- Watsen, K., "Keystore Model", draft-ietf-netconf-
keystore-02 (work in progress), June 2017. keystore-02 (work in progress), June 2017.
[I-D.ietf-netconf-tls-client-server] [I-D.ietf-netconf-tls-client-server]
Watsen, K. and G. Wu, "TLS Client and Server Models", Watsen, K. and G. Wu, "YANG Groupings for TLS Clients and
draft-ietf-netconf-tls-client-server-03 (work in TLS Servers", draft-ietf-netconf-tls-client-server-04
progress), June 2017. (work in progress), October 2017.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997, DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>. <https://www.rfc-editor.org/info/rfc2119>.
[RFC6536] Bierman, A. and M. Bjorklund, "Network Configuration
Protocol (NETCONF) Access Control Model", RFC 6536,
DOI 10.17487/RFC6536, March 2012,
<http://www.rfc-editor.org/info/rfc6536>.
[RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types", [RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types",
RFC 6991, DOI 10.17487/RFC6991, July 2013, RFC 6991, DOI 10.17487/RFC6991, July 2013,
<http://www.rfc-editor.org/info/rfc6991>. <https://www.rfc-editor.org/info/rfc6991>.
[RFC7407] Bjorklund, M. and J. Schoenwaelder, "A YANG Data Model for [RFC7407] Bjorklund, M. and J. Schoenwaelder, "A YANG Data Model for
SNMP Configuration", RFC 7407, DOI 10.17487/RFC7407, SNMP Configuration", RFC 7407, DOI 10.17487/RFC7407,
December 2014, <http://www.rfc-editor.org/info/rfc7407>. December 2014, <https://www.rfc-editor.org/info/rfc7407>.
[RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
RFC 7950, DOI 10.17487/RFC7950, August 2016, RFC 7950, DOI 10.17487/RFC7950, August 2016,
<http://www.rfc-editor.org/info/rfc7950>. <https://www.rfc-editor.org/info/rfc7950>.
[RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
<https://www.rfc-editor.org/info/rfc8040>.
[RFC8071] Watsen, K., "NETCONF Call Home and RESTCONF Call Home",
RFC 8071, DOI 10.17487/RFC8071, February 2017,
<https://www.rfc-editor.org/info/rfc8071>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <http://www.rfc-editor.org/info/rfc8174>. May 2017, <https://www.rfc-editor.org/info/rfc8174>.
7.2. Informative References 7.2. Informative References
[I-D.ietf-netconf-netconf-client-server]
Watsen, K., Wu, G., and J. Schoenwaelder, "NETCONF Client
and Server Models", draft-ietf-netconf-netconf-client-
server-04 (work in progress), July 2017.
[I-D.ietf-netmod-yang-tree-diagrams]
Bjorklund, M. and L. Berger, "YANG Tree Diagrams", draft-
ietf-netmod-yang-tree-diagrams-02 (work in progress),
October 2017.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
DOI 10.17487/RFC3688, January 2004, DOI 10.17487/RFC3688, January 2004,
<http://www.rfc-editor.org/info/rfc3688>. <https://www.rfc-editor.org/info/rfc3688>.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, (TLS) Protocol Version 1.2", RFC 5246,
DOI 10.17487/RFC5246, August 2008, DOI 10.17487/RFC5246, August 2008,
<http://www.rfc-editor.org/info/rfc5246>. <https://www.rfc-editor.org/info/rfc5246>.
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<http://www.rfc-editor.org/info/rfc6241>. <https://www.rfc-editor.org/info/rfc6241>.
[RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
<http://www.rfc-editor.org/info/rfc8040>.
[RFC8071] Watsen, K., "NETCONF Call Home and RESTCONF Call Home", [RFC6536] Bierman, A. and M. Bjorklund, "Network Configuration
RFC 8071, DOI 10.17487/RFC8071, February 2017, Protocol (NETCONF) Access Control Model", RFC 6536,
<http://www.rfc-editor.org/info/rfc8071>. DOI 10.17487/RFC6536, March 2012,
<https://www.rfc-editor.org/info/rfc6536>.
Appendix A. Change Log Appendix A. Change Log
A.1. server-model-09 to 00 A.1. 00 to 01
o This draft was split out from draft-ietf-netconf-server-model-09.
o Added in new features 'listen' and 'call-home' so future
transports can be augmented in.
A.2. 00 to 01
o Renamed "keychain" to "keystore". o Renamed "keychain" to "keystore".
A.3. 01 to 02 A.2. 01 to 02
o Filled in previously missing 'ietf-restconf-client' module. o Filled in previously missing 'ietf-restconf-client' module.
o Updated the ietf-restconf-server module to accomodate new grouping o Updated the ietf-restconf-server module to accomodate new grouping
'ietf-tls-server-grouping'. 'ietf-tls-server-grouping'.
A.4. 02 to 03 A.3. 02 to 03
o Refined use of tls-client-grouping to add a must statement o Refined use of tls-client-grouping to add a must statement
indicating that the TLS client must specify a client-certificate. indicating that the TLS client must specify a client-certificate.
o Changed restconf-client??? to be a grouping (not a container). o Changed restconf-client??? to be a grouping (not a container).
A.5. 03 to 04 A.4. 03 to 04
o Added RFC 8174 to Requirements Language Section. o Added RFC 8174 to Requirements Language Section.
o Replaced refine statement in ietf-restconf-client to add a o Replaced refine statement in ietf-restconf-client to add a
mandatory true. mandatory true.
o Added refine statement in ietf-restconf-server to add a must o Added refine statement in ietf-restconf-server to add a must
statement. statement.
o Now there are containers and groupings, for both the client and o Now there are containers and groupings, for both the client and
server models. server models.
o Now tree diagrams reference ietf-netmod-yang-tree-diagrams
o Updated examples to inline key and certificates (no longer a
leafref to keystore)
Authors' Addresses Authors' Addresses
Kent Watsen Kent Watsen
Juniper Networks Juniper Networks
EMail: kwatsen@juniper.net EMail: kwatsen@juniper.net
Juergen Schoenwaelder Gary Wu
Jacobs University Bremen Cisco Networks
EMail: j.schoenwaelder@jacobs-university.de EMail: garywu@cisco.com
 End of changes. 123 change blocks. 
1130 lines changed or deleted 1336 lines changed or added

This html diff was produced by rfcdiff 1.46. The latest version is available from http://tools.ietf.org/tools/rfcdiff/