--- 1/draft-ietf-netconf-netconf-client-server-02.txt 2017-06-13 17:13:11.455873259 -0700 +++ 2/draft-ietf-netconf-netconf-client-server-03.txt 2017-06-13 17:13:11.535875162 -0700 @@ -1,21 +1,21 @@ NETCONF Working Group K. Watsen Internet-Draft Juniper Networks Intended status: Standards Track G. Wu -Expires: September 14, 2017 Cisco Networks +Expires: December 15, 2017 Cisco Networks J. Schoenwaelder Jacobs University Bremen - March 13, 2017 + June 13, 2017 NETCONF Client and Server Models - draft-ietf-netconf-netconf-client-server-02 + draft-ietf-netconf-netconf-client-server-03 Abstract This document defines two YANG modules, one module to configure a NETCONF client and the other module to configure a NETCONF server. Both modules support both the SSH and TLS transport protocols, and support both standard NETCONF and NETCONF Call Home connections. Editorial Note (To be removed by RFC Editor) @@ -42,45 +42,42 @@ o "YYYY" --> the assigned RFC value for I-D.ietf-netconf-ssh-client- server o "ZZZZ" --> the assigned RFC value for I-D.ietf-netconf-tls-client- server Artwork in this document contains placeholder values for the date of publication of this draft. Please apply the following replacement: - o "2017-03-13" --> the publication date of this draft + o "2017-06-13" --> the publication date of this draft - The following two Appendix sections are to be removed prior to - publication: + The following Appendix section is to be removed prior to publication: o Appendix A. Change Log - o Appendix B. Open Issues - Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on September 14, 2017. + This Internet-Draft will expire on December 15, 2017. Copyright Notice Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents @@ -99,45 +96,45 @@ 2.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 5 2.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 8 2.3. YANG Model . . . . . . . . . . . . . . . . . . . . . . . 10 3. The NETCONF Server Model . . . . . . . . . . . . . . . . . . 19 3.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 20 3.2. Example Usage . . . . . . . . . . . . . . . . . . . . . . 23 3.3. YANG Model . . . . . . . . . . . . . . . . . . . . . . . 26 4. Design Considerations . . . . . . . . . . . . . . . . . . . . 37 4.1. Support all NETCONF transports . . . . . . . . . . . . . 37 4.2. Enable each transport to select which keys to use . . . . 37 - 4.3. Support authenticating NETCONF clients certificates . . . 37 + 4.3. Support authenticating NETCONF clients certificates . . . 38 4.4. Support mapping authenticated NETCONF client certificates to usernames . . . . . . . . . . . . . . . . . . . . . . 38 4.5. Support both listening for connections and call home . . 38 4.6. For Call Home connections . . . . . . . . . . . . . . . . 38 4.6.1. Support more than one NETCONF client . . . . . . . . 38 4.6.2. Support NETCONF clients having more than one endpoint 38 - 4.6.3. Support a reconnection strategy . . . . . . . . . . . 38 + 4.6.3. Support a reconnection strategy . . . . . . . . . . . 39 4.6.4. Support both persistent and periodic connections . . 39 4.6.5. Reconnection strategy for periodic connections . . . 39 4.6.6. Keep-alives for persistent connections . . . . . . . 39 4.6.7. Customizations for periodic connections . . . . . . . 39 - 5. Security Considerations . . . . . . . . . . . . . . . . . . . 39 + 5. Security Considerations . . . . . . . . . . . . . . . . . . . 40 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 41 6.1. The IETF XML Registry . . . . . . . . . . . . . . . . . . 41 6.2. The YANG Module Names Registry . . . . . . . . . . . . . 41 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 41 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 42 8.1. Normative References . . . . . . . . . . . . . . . . . . 42 8.2. Informative References . . . . . . . . . . . . . . . . . 43 Appendix A. Change Log . . . . . . . . . . . . . . . . . . . . . 44 A.1. server-model-09 to 00 . . . . . . . . . . . . . . . . . . 44 A.2. 00 to 01 . . . . . . . . . . . . . . . . . . . . . . . . 44 A.3. 01 to 02 . . . . . . . . . . . . . . . . . . . . . . . . 44 - Appendix B. Open Issues . . . . . . . . . . . . . . . . . . . . 44 + A.4. 02 to 03 . . . . . . . . . . . . . . . . . . . . . . . . 44 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 44 1. Introduction This document defines two YANG [RFC7950] modules, one module to configure a NETCONF client and the other module to configure a NETCONF server. Both modules support both the SSH and TLS transport protocols, and support both standard NETCONF and NETCONF Call Home connections. @@ -189,154 +186,162 @@ model defined in [I-D.ietf-netconf-keystore]. YANG feature statements are used to enable implementations to advertise which parts of the model the NETCONF client supports. 2.1. Tree Diagram Note: all lines are folded at column 71 with no '\' character. module: ietf-netconf-client - +--rw netconf-client - +--rw initiate {initiate}? - | +--rw netconf-server* [name] - | +--rw name string - | +--rw (transport) + groupings: + netconf-client + +---- initiate {initiate}? + | +---- netconf-server* [name] + | +---- name? string + | +---- (transport) | | +--:(ssh) {ssh-initiate}? - | | | +--rw ssh - | | | +--rw endpoints - | | | | +--rw endpoint* [name] - | | | | +--rw name string - | | | | +--rw address inet:host - | | | | +--rw port? inet:port-number - | | | +--rw server-auth - | | | | +--rw trusted-ssh-host-keys? + | | | +---- ssh + | | | +---- endpoints + | | | | +---- endpoint* [name] + | | | | +---- name? string + | | | | +---- address inet:host + | | | | +---- port? inet:port-number + | | | +---- server-auth + | | | | +---- trusted-ssh-host-keys? | | | | | -> /ks:keystore/trusted-host-keys/name - | | | | +--rw trusted-ca-certs? leafref + | | | | +---- trusted-ca-certs? leafref | | | | | {sshcom:ssh-x509-certs}? - | | | | +--rw trusted-server-certs? leafref + | | | | +---- trusted-server-certs? leafref | | | | {sshcom:ssh-x509-certs}? - | | | +--rw client-auth - | | | | +--rw username? string - | | | | +--rw (auth-type)? + | | | +---- client-auth + | | | | +---- username? string + | | | | +---- (auth-type)? | | | | +--:(certificate) - | | | | | +--rw certificate? leafref + | | | | | +---- certificate? leafref | | | | | {sshcom:ssh-x509-certs}? | | | | +--:(public-key) - | | | | | +--rw public-key? + | | | | | +---- public-key? | | | | | -> /ks:keystore/keys/key/name | | | | +--:(password) - | | | | +--rw password? union - | | | +--rw transport-params + | | | | +---- password? string + | | | +---- transport-params | | | {ssh-client-transport-params-config}? - | | | +--rw host-key - | | | | +--rw host-key-alg* identityref - | | | +--rw key-exchange - | | | | +--rw key-exchange-alg* identityref - | | | +--rw encryption - | | | | +--rw encryption-alg* identityref - | | | +--rw mac - | | | | +--rw mac-alg* identityref - | | | +--rw compression - | | | +--rw compression-alg* identityref + | | | +---- host-key + | | | | +---- host-key-alg* identityref + | | | +---- key-exchange + | | | | +---- key-exchange-alg* identityref + | | | +---- encryption + | | | | +---- encryption-alg* identityref + | | | +---- mac + | | | | +---- mac-alg* identityref + | | | +---- compression + | | | +---- compression-alg* identityref | | +--:(tls) {tls-initiate}? - | | +--rw tls - | | +--rw endpoints - | | | +--rw endpoint* [name] - | | | +--rw name string - | | | +--rw address inet:host - | | | +--rw port? inet:port-number - | | +--rw server-auth - | | | +--rw trusted-ca-certs? leafref - | | | +--rw trusted-server-certs? leafref - | | +--rw client-auth - | | | +--rw (auth-type)? + | | +---- tls + | | +---- endpoints + | | | +---- endpoint* [name] + | | | +---- name? string + | | | +---- address inet:host + | | | +---- port? inet:port-number + | | +---- server-auth + | | | +---- trusted-ca-certs? leafref + | | | +---- trusted-server-certs? leafref + | | +---- client-auth + | | | +---- (auth-type)? | | | +--:(certificate) - | | | +--rw certificate? leafref - | | +--rw hello-params + | | | +---- certificate? leafref + | | +---- hello-params | | {tls-client-hello-params-config}? - | | +--rw tls-versions - | | | +--rw tls-version* identityref - | | +--rw cipher-suites - | | +--rw cipher-suite* identityref - | +--rw connection-type - | | +--rw (connection-type)? + | | +---- tls-versions + | | | +---- tls-version* identityref + | | +---- cipher-suites + | | +---- cipher-suite* identityref + | +---- connection-type + | | +---- (connection-type)? | | +--:(persistent-connection) - | | | +--rw persistent! - | | | +--rw idle-timeout? uint32 - | | | +--rw keep-alives - | | | +--rw max-wait? uint16 - | | | +--rw max-attempts? uint8 + | | | +---- persistent! + | | | +---- idle-timeout? uint32 + | | | +---- keep-alives + | | | +---- max-wait? uint16 + | | | +---- max-attempts? uint8 | | +--:(periodic-connection) - | | +--rw periodic! - | | +--rw idle-timeout? uint16 - | | +--rw reconnect-timeout? uint16 - | +--rw reconnect-strategy - | +--rw start-with? enumeration - | +--rw max-attempts? uint8 - +--rw listen {listen}? - +--rw max-sessions? uint16 - +--rw idle-timeout? uint16 - +--rw endpoint* [name] - +--rw name string - +--rw (transport) + | | +---- periodic! + | | +---- idle-timeout? uint16 + | | +---- reconnect-timeout? uint16 + | +---- reconnect-strategy + | +---- start-with? enumeration + | +---- max-attempts? uint8 + +---- listen {listen}? + +---- max-sessions? uint16 + +---- idle-timeout? uint16 + +---- endpoint* [name] + +---- name? string + +---- (transport) +--:(ssh) {ssh-listen}? - | +--rw ssh - | +--rw address? inet:ip-address - | +--rw port? inet:port-number - | +--rw server-auth - | | +--rw trusted-ssh-host-keys? + | +---- ssh + | +---- address? inet:ip-address + | +---- port? inet:port-number + | +---- server-auth + | | +---- trusted-ssh-host-keys? | | | -> /ks:keystore/trusted-host-keys/name - | | +--rw trusted-ca-certs? leafref + | | +---- trusted-ca-certs? leafref | | | {sshcom:ssh-x509-certs}? - | | +--rw trusted-server-certs? leafref + | | +---- trusted-server-certs? leafref | | {sshcom:ssh-x509-certs}? - | +--rw client-auth - | | +--rw username? string - | | +--rw (auth-type)? + | +---- client-auth + | | +---- username? string + | | +---- (auth-type)? | | +--:(certificate) - | | | +--rw certificate? leafref + | | | +---- certificate? leafref | | | {sshcom:ssh-x509-certs}? | | +--:(public-key) - | | | +--rw public-key? + | | | +---- public-key? | | | -> /ks:keystore/keys/key/name | | +--:(password) - | | +--rw password? union - | +--rw transport-params + | | +---- password? string + | +---- transport-params | {ssh-client-transport-params-config}? - | +--rw host-key - | | +--rw host-key-alg* identityref - | +--rw key-exchange - | | +--rw key-exchange-alg* identityref - | +--rw encryption - | | +--rw encryption-alg* identityref - | +--rw mac - | | +--rw mac-alg* identityref - | +--rw compression - | +--rw compression-alg* identityref + | +---- host-key + | | +---- host-key-alg* identityref + | +---- key-exchange + | | +---- key-exchange-alg* identityref + | +---- encryption + | | +---- encryption-alg* identityref + | +---- mac + | | +---- mac-alg* identityref + | +---- compression + | +---- compression-alg* identityref +--:(tls) {tls-listen}? - +--rw tls - +--rw address? inet:ip-address - +--rw port? inet:port-number - +--rw server-auth - | +--rw trusted-ca-certs? leafref - | +--rw trusted-server-certs? leafref - +--rw client-auth - | +--rw (auth-type)? + +---- tls + +---- address? inet:ip-address + +---- port? inet:port-number + +---- server-auth + | +---- trusted-ca-certs? leafref + | +---- trusted-server-certs? leafref + +---- client-auth + | +---- (auth-type)? | +--:(certificate) - | +--rw certificate? leafref - +--rw hello-params + | +---- certificate? leafref + +---- hello-params {tls-client-hello-params-config}? - +--rw tls-versions - | +--rw tls-version* identityref - +--rw cipher-suites - +--rw cipher-suite* identityref + +---- tls-versions + | +---- tls-version* identityref + +---- cipher-suites + +---- cipher-suite* identityref + + endpoints-container + +---- endpoints + +---- endpoint* [name] + +---- name? string + +---- address inet:host + +---- port? inet:port-number 2.2. Example Usage The following example illustrates configuring a NETCONF client to initiate connections, using both the SSH and TLS transport protocols, as well as listening for call-home connections, again using both the SSH and TLS transport protocols. This example is consistent with the examples presented in Section 2.2 of [I-D.ietf-netconf-keystore]. @@ -386,44 +391,44 @@ ex-rsa-key 2.3. YANG Model This YANG module imports YANG types from [RFC6991] and [RFC7407]. - file "ietf-netconf-client@2017-03-13.yang" + file "ietf-netconf-client@2017-06-13.yang" module ietf-netconf-client { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-client"; prefix "ncc"; import ietf-inet-types { prefix inet; reference "RFC 6991: Common YANG Data Types"; } import ietf-ssh-client { prefix ss; - revision-date 2017-03-13; // stable grouping definitions + revision-date 2017-06-13; // stable grouping definitions reference "RFC YYYY: SSH Client and Server Models"; } import ietf-tls-client { prefix ts; - revision-date 2017-03-13; // stable grouping definitions + revision-date 2017-06-13; // stable grouping definitions reference "RFC ZZZZ: TLS Client and Server Models"; } organization "IETF NETCONF (Network Configuration) Working Group"; contact "WG Web: WG List: @@ -444,21 +449,21 @@ Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; - revision "2017-03-13" { + revision "2017-06-13" { description "Initial version"; reference "RFC XXXX: NETCONF Client and Server Models"; } // Features feature initiate { description @@ -505,23 +510,23 @@ feature tls-listen { description "The 'tls-listen' feature indicates that the NETCONF client supports opening a port to listen for incoming NETCONF server call-home TLS connections."; reference "RFC 8071: NETCONF Call Home and RESTCONF Call Home"; } - container netconf-client { + grouping netconf-client { description - "Top-level container for NETCONF client configuration."; + "Top-level grouping for NETCONF client configuration."; container initiate { if-feature initiate; description "Configures client initiating underlying TCP connections."; list netconf-server { key name; description "List of NETCONF servers the NETCONF client is to initiate connections to."; @@ -552,21 +557,27 @@ case tls { if-feature tls-initiate; container tls { description "Specifies TLS-specific transport configuration."; uses endpoints-container { refine endpoints/endpoint/port { default 6513; } } - uses ts:tls-client-grouping; + uses ts:tls-client-grouping { + refine "client-auth" { + must 'certificate'; + description + "NETCONF/TLS clients MUST pass a client certiticate."; + } + } } } // end tls } // end transport container connection-type { description "Indicates the kind of connection to use."; choice connection-type { description @@ -788,21 +799,27 @@ type inet:ip-address; description "The IP address to listen for call-home connections."; } leaf port { type inet:port-number; default 4335; description "The port number to listen for call-home connections."; } - uses ts:tls-client-grouping; + uses ts:tls-client-grouping { + refine "client-auth" { + must 'certificate'; + description + "NETCONF/TLS clients MUST pass a client certiticate."; + } + } } } } // end transport } // end endpoint } // end listen } // end netconf-client grouping endpoints-container { description @@ -1163,21 +1180,21 @@ 3 3.3. YANG Model This YANG module imports YANG types from [RFC6991] and [RFC7407]. - file "ietf-netconf-server@2017-03-13.yang" + file "ietf-netconf-server@2017-06-13.yang" module ietf-netconf-server { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-server"; prefix "ncs"; import ietf-inet-types { prefix inet; reference @@ -1185,28 +1202,28 @@ } import ietf-x509-cert-to-name { prefix x509c2n; reference "RFC 7407: A YANG Data Model for SNMP Configuration"; } import ietf-ssh-server { prefix ss; - revision-date 2017-03-13; // stable grouping definitions + revision-date 2017-06-13; // stable grouping definitions reference "RFC YYYY: SSH Client and Server Models"; } import ietf-tls-server { prefix ts; - revision-date 2017-03-13; // stable grouping definitions + revision-date 2017-06-13; // stable grouping definitions reference "RFC ZZZZ: TLS Client and Server Models"; } organization "IETF NETCONF (Network Configuration) Working Group"; contact "WG Web: WG List: @@ -1224,35 +1241,35 @@ Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; - revision "2017-03-13" { + revision "2017-06-13" { description "Initial version"; reference "RFC XXXX: NETCONF Client and Server Models"; } - // Features feature listen { description "The 'listen' feature indicates that the NETCONF server supports opening a port to accept NETCONF client connections using at least one transport (e.g., SSH, TLS, etc.)."; } + feature ssh-listen { description "The 'ssh-listen' feature indicates that the NETCONF server supports opening a port to accept NETCONF over SSH client connections."; reference "RFC 6242: Using the NETCONF Protocol over Secure Shell (SSH)"; } feature tls-listen { @@ -1893,45 +1907,45 @@ name: ietf-netconf-server namespace: urn:ietf:params:xml:ns:yang:ietf-netconf-server prefix: ncs reference: RFC XXXX 7. Acknowledgements The authors would like to thank for following for lively discussions on list and in the halls (ordered by last name): Andy Bierman, Martin - Bjorklund, Benoit Claise, Mehmet Ersue, David Lamparter, Alan Luchuk, - Ladislav Lhotka, Radek Krejci, Tom Petch, Phil Shafer, Sean Turner, - and Bert Wijnen. + Bjorklund, Benoit Claise, Mehmet Ersue, Balazs Kovacs, David + Lamparter, Alan Luchuk, Ladislav Lhotka, Radek Krejci, Tom Petch, + Phil Shafer, Sean Turner, and Bert Wijnen. Juergen Schoenwaelder and was partly funded by Flamingo, a Network of Excellence project (ICT-318488) supported by the European Commission under its Seventh Framework Programme. 8. References 8.1. Normative References [I-D.ietf-netconf-keystore] - Watsen, K. and G. Wu, "Keystore Model", draft-ietf- - netconf-keystore-00 (work in progress), October 2016. + Watsen, K., "Keystore Model", draft-ietf-netconf- + keystore-01 (work in progress), March 2017. [I-D.ietf-netconf-ssh-client-server] Watsen, K. and G. Wu, "SSH Client and Server Models", - draft-ietf-netconf-ssh-client-server-01 (work in - progress), November 2016. + draft-ietf-netconf-ssh-client-server-02 (work in + progress), March 2017. [I-D.ietf-netconf-tls-client-server] - Watsen, K., "TLS Client and Server Models", draft-ietf- - netconf-tls-client-server-01 (work in progress), November - 2016. + Watsen, K. and G. Wu, "TLS Client and Server Models", + draft-ietf-netconf-tls-client-server-02 (work in + progress), March 2017. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, . @@ -2013,24 +2027,26 @@ o Added to ietf-netconf-client ability to connected to a cluster of endpoints, including a reconnection-strategy. o Added to ietf-netconf-client the ability to configure connection- type and also keep-alive strategy. o Updated both modules to accomodate new groupings in the ssh/tls drafts. -Appendix B. Open Issues +A.4. 02 to 03 - Please see: https://github.com/netconf-wg/netconf-client-server/ - issues. + o Refined use of tls-client-grouping to add a must statement + indicating that the TLS client must specify a client-certificate. + + o Changed 'netconf-client' to be a grouping (not a container). Authors' Addresses Kent Watsen Juniper Networks EMail: kwatsen@juniper.net Gary Wu Cisco Networks