diff --git a/package/confd/confd.mk b/package/confd/confd.mk index 4309ee2d..9f34fdd6 100644 --- a/package/confd/confd.mk +++ b/package/confd/confd.mk @@ -35,13 +35,30 @@ define CONFD_INSTALL_EXTRA cp $(CONFD_PKGDIR)/avahi.service $(TARGET_DIR)/etc/avahi/services/netconf.service endef +NETOPEER2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/netopeer2/ +SYSREPO_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/sysrepo/ +LIBNETCONF2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/libnetconf2/ +CONFD_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/confd/ +TEST_MODE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/test-mode/ +ROUSETTE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/rousette/ COMMON_SYSREPO_ENV = \ SYSREPO_SHM_PREFIX=$(CONFD_SYSREPO_SHM_PREFIX) \ SYSREPOCTL_EXECUTABLE="$(HOST_DIR)/bin/sysrepoctl" \ SYSREPOCFG_EXECUTABLE="$(HOST_DIR)/bin/sysrepocfg" \ - SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/confd/" + SEARCH_PATH="$(NETOPEER2_SEARCHPATH) $(SYSREPO_SEARCHPATH) $(LIBNETCONF2_SEARCHPATH) $(TEST_MODE_SEARCHPATH) $(CONFD_SEARCHPATH) $(ROUSETTE_SEARCHPATH)" + define CONFD_INSTALL_YANG_MODULES + $(COMMON_SYSREPO_ENV) \ + $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/sysrepo.inc + $(COMMON_SYSREPO_ENV) \ + $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/libnetconf2.inc + $(COMMON_SYSREPO_ENV) \ + $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/netopeer2.inc + $(COMMON_SYSREPO_ENV) \ + $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/rousette.inc + $(COMMON_SYSREPO_ENV) \ + $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc $(COMMON_SYSREPO_ENV) \ $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/confd.inc endef @@ -57,11 +74,13 @@ define CONFD_PERMISSIONS /etc/sysrepo/data/ r 660 root wheel - - - - - /etc/sysrepo/data d 770 root wheel - - - - - endef - +define CONFD_EMPTY_SYSREPO + rm -rf $(TARGET_DIR)/etc/sysrepo/data/ +endef define CONFD_CLEANUP rm -f /dev/shm/$(CONFD_SYSREPO_SHM_PREFIX)* endef - +CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_EMPTY_SYSREPO CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_CLEANUP CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES diff --git a/src/confd/configure.ac b/src/confd/configure.ac index 2825e9f6..c00cd671 100644 --- a/src/confd/configure.ac +++ b/src/confd/configure.ac @@ -19,8 +19,11 @@ AC_CONFIG_FILES([ share/migrate/1.3/Makefile share/migrate/1.4/Makefile share/migrate/1.5/Makefile - src/Makefile yang/Makefile + yang/confd/Makefile + yang/test-mode/Makefile + yang/rousette/Makefile + src/Makefile ]) AC_PROG_CC @@ -83,7 +86,7 @@ DATAROOTDIR=`eval echo $datarootdir` DATAROOTDIR=`eval echo $DATAROOTDIR` AC_SUBST(DATAROOTDIR) -YANGDIR=`eval echo $datarootdir/yang/modules/confd` +YANGDIR=`eval echo $datarootdir/yang/modules` AC_SUBST(YANGDIR) LIBDIR=`eval echo $libdir` diff --git a/src/confd/yang/Makefile.am b/src/confd/yang/Makefile.am index 0fd59504..ca1f9fb8 100644 --- a/src/confd/yang/Makefile.am +++ b/src/confd/yang/Makefile.am @@ -1,2 +1 @@ -yangdir = $(YANGDIR) -yang_DATA = $(wildcard *@*.yang) ieee802-types.yang ieee802-dot1ab-types.yang +SUBDIRS = confd test-mode rousette diff --git a/src/confd/yang/confd.inc b/src/confd/yang/confd.inc index cb13d6c6..9aab145f 100644 --- a/src/confd/yang/confd.inc +++ b/src/confd/yang/confd.inc @@ -1,25 +1,20 @@ # -*- sh -*- # REMEMBER TO UPDATE infix-interfaces ALSO IN containers.inc -#FORCE_UPDATE="infix-interfaces" + MODULES=( "ietf-system@2014-08-06.yang -e authentication -e local-users -e ntp -e ntp-udp-port -e timezone-name" "iana-timezones@2013-11-19.yang" - "notifications@2008-07-14.yang" - "ietf-tcp-common@2023-12-28.yang -e keepalives-supported" "ietf-interfaces@2018-02-20.yang -e if-mib" "ietf-ip@2018-02-22.yang -e ipv6-privacy-autoconf" "ietf-network-instance@2019-01-21.yang" "ietf-netconf-monitoring@2010-10-04.yang" - "ietf-netconf-nmda@2019-01-07.yang -e origin -e with-defaults" - "ietf-subscribed-notifications@2019-09-09.yang -e encode-xml -e replay -e subtree -e xpath" - "ietf-yang-push@2019-09-09.yang -e on-change" "ietf-routing@2018-03-13.yang" "ietf-ipv6-unicast-routing@2018-03-13.yang" "ietf-ipv4-unicast-routing@2018-03-13.yang" "ietf-ospf@2022-10-19.yang -e bfd -e explicit-router-id" "iana-if-type@2023-01-26.yang" - # NOTE: ietf-tls-client must be version matched with ietf-tls-server, used by netopeer2! - "ietf-tls-client@2023-12-28.yang" # used by ietf-syslog (remote) + # NOTE: ietf-tls-client must be version matched with ietf-tls-server, used by netopeer2! + "ietf-tls-client@2023-12-28.yang" "ietf-syslog@2024-03-21.yang -e file-action -e file-limit-size -e remote-action" "infix-syslog@2024-07-19.yang" "iana-hardware@2018-03-13.yang" @@ -43,22 +38,4 @@ MODULES=( "infix-interfaces@2025-01-09.yang -e vlan-filtering" "infix-crypto-types@2025-02-04.yang" "infix-keystore@2025-02-04.yang" - - # from rousette - "ietf-restconf@2017-01-26.yang" - "ietf-yang-patch@2017-02-22.yang" - "ietf-restconf-monitoring@2017-01-26.yang" - - # from sysrepo - "sysrepo-plugind@2022-08-26.yang" - # from netopeer - "nc-notifications@2008-07-14.yang" - "ietf-crypto-types@2023-12-28.yang -e encrypted-private-keys" - "ietf-netconf-server@2023-12-28.yang -e ssh-listen -e tls-listen -e ssh-call-home -e tls-call-home" - "ietf-netconf-acm@2018-02-14.yang" - "ietf-netconf@2013-09-29.yang -e writable-running -e candidate -e rollback-on-error -e validate -e startup -e url -e xpath -e confirmed-commit" - "ietf-truststore@2023-12-28.yang -e central-truststore-supported -e certificates" - "ietf-keystore@2023-12-28.yang -e central-keystore-supported -e asymmetric-keys -e symmetric-keys" - "ietf-tls-server@2023-12-28.yang -e server-ident-raw-public-key -e server-ident-x509-cert" - ) diff --git a/src/confd/yang/confd/Makefile.am b/src/confd/yang/confd/Makefile.am new file mode 100644 index 00000000..28d19552 --- /dev/null +++ b/src/confd/yang/confd/Makefile.am @@ -0,0 +1,2 @@ +yangdir = $(YANGDIR)/confd +yang_DATA = $(wildcard *@*.yang) ieee802-types.yang ieee802-dot1ab-types.yang diff --git a/src/confd/yang/iana-bfd-types@2021-10-21.yang b/src/confd/yang/confd/iana-bfd-types@2021-10-21.yang similarity index 100% rename from src/confd/yang/iana-bfd-types@2021-10-21.yang rename to src/confd/yang/confd/iana-bfd-types@2021-10-21.yang diff --git a/src/confd/yang/iana-crypt-hash@2014-08-06.yang b/src/confd/yang/confd/iana-crypt-hash@2014-08-06.yang similarity index 100% rename from src/confd/yang/iana-crypt-hash@2014-08-06.yang rename to src/confd/yang/confd/iana-crypt-hash@2014-08-06.yang diff --git a/src/confd/yang/iana-hardware@2018-03-13.yang b/src/confd/yang/confd/iana-hardware@2018-03-13.yang similarity index 100% rename from src/confd/yang/iana-hardware@2018-03-13.yang rename to src/confd/yang/confd/iana-hardware@2018-03-13.yang diff --git a/src/confd/yang/iana-if-type@2023-01-26.yang b/src/confd/yang/confd/iana-if-type@2023-01-26.yang similarity index 100% rename from src/confd/yang/iana-if-type@2023-01-26.yang rename to src/confd/yang/confd/iana-if-type@2023-01-26.yang diff --git a/src/confd/yang/iana-routing-types@2017-12-04.yang b/src/confd/yang/confd/iana-routing-types@2017-12-04.yang similarity index 100% rename from src/confd/yang/iana-routing-types@2017-12-04.yang rename to src/confd/yang/confd/iana-routing-types@2017-12-04.yang diff --git a/src/confd/yang/iana-timezones@2013-11-19.yang b/src/confd/yang/confd/iana-timezones@2013-11-19.yang similarity index 100% rename from src/confd/yang/iana-timezones@2013-11-19.yang rename to src/confd/yang/confd/iana-timezones@2013-11-19.yang diff --git a/src/confd/yang/iana-tls-cipher-suite-algs@2022-06-16.yang b/src/confd/yang/confd/iana-tls-cipher-suite-algs@2022-06-16.yang similarity index 100% rename from src/confd/yang/iana-tls-cipher-suite-algs@2022-06-16.yang rename to src/confd/yang/confd/iana-tls-cipher-suite-algs@2022-06-16.yang diff --git a/src/confd/yang/ieee802-dot1ab-lldp@2022-03-15.yang b/src/confd/yang/confd/ieee802-dot1ab-lldp@2022-03-15.yang similarity index 100% rename from src/confd/yang/ieee802-dot1ab-lldp@2022-03-15.yang rename to src/confd/yang/confd/ieee802-dot1ab-lldp@2022-03-15.yang diff --git a/src/confd/yang/ieee802-dot1ab-types.yang b/src/confd/yang/confd/ieee802-dot1ab-types.yang similarity index 100% rename from src/confd/yang/ieee802-dot1ab-types.yang rename to src/confd/yang/confd/ieee802-dot1ab-types.yang diff --git a/src/confd/yang/ieee802-dot1q-types@2022-10-29.yang b/src/confd/yang/confd/ieee802-dot1q-types@2022-10-29.yang similarity index 100% rename from src/confd/yang/ieee802-dot1q-types@2022-10-29.yang rename to src/confd/yang/confd/ieee802-dot1q-types@2022-10-29.yang diff --git a/src/confd/yang/ieee802-ethernet-interface@2019-06-21.yang b/src/confd/yang/confd/ieee802-ethernet-interface@2019-06-21.yang similarity index 100% rename from src/confd/yang/ieee802-ethernet-interface@2019-06-21.yang rename to src/confd/yang/confd/ieee802-ethernet-interface@2019-06-21.yang diff --git a/src/confd/yang/ieee802-types.yang b/src/confd/yang/confd/ieee802-types.yang similarity index 100% rename from src/confd/yang/ieee802-types.yang rename to src/confd/yang/confd/ieee802-types.yang diff --git a/src/confd/yang/ietf-bfd-types@2022-09-22.yang b/src/confd/yang/confd/ietf-bfd-types@2022-09-22.yang similarity index 100% rename from src/confd/yang/ietf-bfd-types@2022-09-22.yang rename to src/confd/yang/confd/ietf-bfd-types@2022-09-22.yang diff --git a/src/confd/yang/ietf-datastores@2018-02-14.yang b/src/confd/yang/confd/ietf-datastores@2018-02-14.yang similarity index 100% rename from src/confd/yang/ietf-datastores@2018-02-14.yang rename to src/confd/yang/confd/ietf-datastores@2018-02-14.yang diff --git a/src/confd/yang/ietf-hardware@2018-03-13.yang b/src/confd/yang/confd/ietf-hardware@2018-03-13.yang similarity index 100% rename from src/confd/yang/ietf-hardware@2018-03-13.yang rename to src/confd/yang/confd/ietf-hardware@2018-03-13.yang diff --git a/src/confd/yang/ietf-inet-types@2013-07-15.yang b/src/confd/yang/confd/ietf-inet-types@2013-07-15.yang similarity index 100% rename from src/confd/yang/ietf-inet-types@2013-07-15.yang rename to src/confd/yang/confd/ietf-inet-types@2013-07-15.yang diff --git a/src/confd/yang/ietf-interfaces@2018-02-20.yang b/src/confd/yang/confd/ietf-interfaces@2018-02-20.yang similarity index 100% rename from src/confd/yang/ietf-interfaces@2018-02-20.yang rename to src/confd/yang/confd/ietf-interfaces@2018-02-20.yang diff --git a/src/confd/yang/ietf-ip@2018-02-22.yang b/src/confd/yang/confd/ietf-ip@2018-02-22.yang similarity index 100% rename from src/confd/yang/ietf-ip@2018-02-22.yang rename to src/confd/yang/confd/ietf-ip@2018-02-22.yang diff --git a/src/confd/yang/ietf-ipv4-unicast-routing@2018-03-13.yang b/src/confd/yang/confd/ietf-ipv4-unicast-routing@2018-03-13.yang similarity index 100% rename from src/confd/yang/ietf-ipv4-unicast-routing@2018-03-13.yang rename to src/confd/yang/confd/ietf-ipv4-unicast-routing@2018-03-13.yang diff --git a/src/confd/yang/ietf-ipv6-router-advertisements@2018-03-13.yang b/src/confd/yang/confd/ietf-ipv6-router-advertisements@2018-03-13.yang similarity index 100% rename from src/confd/yang/ietf-ipv6-router-advertisements@2018-03-13.yang rename to src/confd/yang/confd/ietf-ipv6-router-advertisements@2018-03-13.yang diff --git a/src/confd/yang/ietf-ipv6-unicast-routing@2018-03-13.yang b/src/confd/yang/confd/ietf-ipv6-unicast-routing@2018-03-13.yang similarity index 100% rename from src/confd/yang/ietf-ipv6-unicast-routing@2018-03-13.yang rename to src/confd/yang/confd/ietf-ipv6-unicast-routing@2018-03-13.yang diff --git a/src/confd/yang/ietf-key-chain@2017-06-15.yang b/src/confd/yang/confd/ietf-key-chain@2017-06-15.yang similarity index 100% rename from src/confd/yang/ietf-key-chain@2017-06-15.yang rename to src/confd/yang/confd/ietf-key-chain@2017-06-15.yang diff --git a/src/confd/yang/ietf-netconf-acm@2018-02-14.yang b/src/confd/yang/confd/ietf-netconf-acm@2018-02-14.yang similarity index 100% rename from src/confd/yang/ietf-netconf-acm@2018-02-14.yang rename to src/confd/yang/confd/ietf-netconf-acm@2018-02-14.yang diff --git a/src/confd/yang/ietf-ospf@2022-10-19.yang b/src/confd/yang/confd/ietf-ospf@2022-10-19.yang similarity index 100% rename from src/confd/yang/ietf-ospf@2022-10-19.yang rename to src/confd/yang/confd/ietf-ospf@2022-10-19.yang diff --git a/src/confd/yang/ietf-routing-types@2017-12-04.yang b/src/confd/yang/confd/ietf-routing-types@2017-12-04.yang similarity index 100% rename from src/confd/yang/ietf-routing-types@2017-12-04.yang rename to src/confd/yang/confd/ietf-routing-types@2017-12-04.yang diff --git a/src/confd/yang/ietf-routing@2018-03-13.yang b/src/confd/yang/confd/ietf-routing@2018-03-13.yang similarity index 100% rename from src/confd/yang/ietf-routing@2018-03-13.yang rename to src/confd/yang/confd/ietf-routing@2018-03-13.yang diff --git a/src/confd/yang/ietf-syslog@2024-03-21.yang b/src/confd/yang/confd/ietf-syslog@2024-03-21.yang similarity index 100% rename from src/confd/yang/ietf-syslog@2024-03-21.yang rename to src/confd/yang/confd/ietf-syslog@2024-03-21.yang diff --git a/src/confd/yang/ietf-system@2014-08-06.yang b/src/confd/yang/confd/ietf-system@2014-08-06.yang similarity index 100% rename from src/confd/yang/ietf-system@2014-08-06.yang rename to src/confd/yang/confd/ietf-system@2014-08-06.yang diff --git a/src/confd/yang/ietf-tls-client@2023-12-28.yang b/src/confd/yang/confd/ietf-tls-client@2023-12-28.yang similarity index 100% rename from src/confd/yang/ietf-tls-client@2023-12-28.yang rename to src/confd/yang/confd/ietf-tls-client@2023-12-28.yang diff --git a/src/confd/yang/ietf-yang-types@2013-07-15.yang b/src/confd/yang/confd/ietf-yang-types@2013-07-15.yang similarity index 100% rename from src/confd/yang/ietf-yang-types@2013-07-15.yang rename to src/confd/yang/confd/ietf-yang-types@2013-07-15.yang diff --git a/src/confd/yang/infix-containers.yang b/src/confd/yang/confd/infix-containers.yang similarity index 100% rename from src/confd/yang/infix-containers.yang rename to src/confd/yang/confd/infix-containers.yang diff --git a/src/confd/yang/infix-containers@2024-11-15.yang b/src/confd/yang/confd/infix-containers@2024-11-15.yang similarity index 100% rename from src/confd/yang/infix-containers@2024-11-15.yang rename to src/confd/yang/confd/infix-containers@2024-11-15.yang diff --git a/src/confd/yang/infix-crypto-types.yang b/src/confd/yang/confd/infix-crypto-types.yang similarity index 100% rename from src/confd/yang/infix-crypto-types.yang rename to src/confd/yang/confd/infix-crypto-types.yang diff --git a/src/confd/yang/infix-crypto-types@2025-02-04.yang b/src/confd/yang/confd/infix-crypto-types@2025-02-04.yang similarity index 100% rename from src/confd/yang/infix-crypto-types@2025-02-04.yang rename to src/confd/yang/confd/infix-crypto-types@2025-02-04.yang diff --git a/src/confd/yang/infix-dhcp-client.yang b/src/confd/yang/confd/infix-dhcp-client.yang similarity index 100% rename from src/confd/yang/infix-dhcp-client.yang rename to src/confd/yang/confd/infix-dhcp-client.yang diff --git a/src/confd/yang/infix-dhcp-client@2025-01-29.yang b/src/confd/yang/confd/infix-dhcp-client@2025-01-29.yang similarity index 100% rename from src/confd/yang/infix-dhcp-client@2025-01-29.yang rename to src/confd/yang/confd/infix-dhcp-client@2025-01-29.yang diff --git a/src/confd/yang/infix-dhcp-common.yang b/src/confd/yang/confd/infix-dhcp-common.yang similarity index 100% rename from src/confd/yang/infix-dhcp-common.yang rename to src/confd/yang/confd/infix-dhcp-common.yang diff --git a/src/confd/yang/infix-dhcp-common@2025-01-29.yang b/src/confd/yang/confd/infix-dhcp-common@2025-01-29.yang similarity index 100% rename from src/confd/yang/infix-dhcp-common@2025-01-29.yang rename to src/confd/yang/confd/infix-dhcp-common@2025-01-29.yang diff --git a/src/confd/yang/infix-dhcp-server.yang b/src/confd/yang/confd/infix-dhcp-server.yang similarity index 100% rename from src/confd/yang/infix-dhcp-server.yang rename to src/confd/yang/confd/infix-dhcp-server.yang diff --git a/src/confd/yang/infix-dhcp-server@2025-01-29.yang b/src/confd/yang/confd/infix-dhcp-server@2025-01-29.yang similarity index 100% rename from src/confd/yang/infix-dhcp-server@2025-01-29.yang rename to src/confd/yang/confd/infix-dhcp-server@2025-01-29.yang diff --git a/src/confd/yang/infix-ethernet-interface.yang b/src/confd/yang/confd/infix-ethernet-interface.yang similarity index 100% rename from src/confd/yang/infix-ethernet-interface.yang rename to src/confd/yang/confd/infix-ethernet-interface.yang diff --git a/src/confd/yang/infix-ethernet-interface@2024-02-27.yang b/src/confd/yang/confd/infix-ethernet-interface@2024-02-27.yang similarity index 100% rename from src/confd/yang/infix-ethernet-interface@2024-02-27.yang rename to src/confd/yang/confd/infix-ethernet-interface@2024-02-27.yang diff --git a/src/confd/yang/infix-factory-default.yang b/src/confd/yang/confd/infix-factory-default.yang similarity index 100% rename from src/confd/yang/infix-factory-default.yang rename to src/confd/yang/confd/infix-factory-default.yang diff --git a/src/confd/yang/infix-factory-default@2023-06-28.yang b/src/confd/yang/confd/infix-factory-default@2023-06-28.yang similarity index 100% rename from src/confd/yang/infix-factory-default@2023-06-28.yang rename to src/confd/yang/confd/infix-factory-default@2023-06-28.yang diff --git a/src/confd/yang/infix-hardware.yang b/src/confd/yang/confd/infix-hardware.yang similarity index 100% rename from src/confd/yang/infix-hardware.yang rename to src/confd/yang/confd/infix-hardware.yang diff --git a/src/confd/yang/infix-hardware@2024-04-25.yang b/src/confd/yang/confd/infix-hardware@2024-04-25.yang similarity index 100% rename from src/confd/yang/infix-hardware@2024-04-25.yang rename to src/confd/yang/confd/infix-hardware@2024-04-25.yang diff --git a/src/confd/yang/infix-if-base.yang b/src/confd/yang/confd/infix-if-base.yang similarity index 100% rename from src/confd/yang/infix-if-base.yang rename to src/confd/yang/confd/infix-if-base.yang diff --git a/src/confd/yang/infix-if-base@2023-08-21.yang b/src/confd/yang/confd/infix-if-base@2023-08-21.yang similarity index 100% rename from src/confd/yang/infix-if-base@2023-08-21.yang rename to src/confd/yang/confd/infix-if-base@2023-08-21.yang diff --git a/src/confd/yang/infix-if-bridge.yang b/src/confd/yang/confd/infix-if-bridge.yang similarity index 100% rename from src/confd/yang/infix-if-bridge.yang rename to src/confd/yang/confd/infix-if-bridge.yang diff --git a/src/confd/yang/infix-if-bridge@2025-01-08.yang b/src/confd/yang/confd/infix-if-bridge@2025-01-08.yang similarity index 100% rename from src/confd/yang/infix-if-bridge@2025-01-08.yang rename to src/confd/yang/confd/infix-if-bridge@2025-01-08.yang diff --git a/src/confd/yang/infix-if-container.yang b/src/confd/yang/confd/infix-if-container.yang similarity index 100% rename from src/confd/yang/infix-if-container.yang rename to src/confd/yang/confd/infix-if-container.yang diff --git a/src/confd/yang/infix-if-container@2024-11-15.yang b/src/confd/yang/confd/infix-if-container@2024-11-15.yang similarity index 100% rename from src/confd/yang/infix-if-container@2024-11-15.yang rename to src/confd/yang/confd/infix-if-container@2024-11-15.yang diff --git a/src/confd/yang/infix-if-gre.yang b/src/confd/yang/confd/infix-if-gre.yang similarity index 100% rename from src/confd/yang/infix-if-gre.yang rename to src/confd/yang/confd/infix-if-gre.yang diff --git a/src/confd/yang/infix-if-gre@2024-12-20.yang b/src/confd/yang/confd/infix-if-gre@2024-12-20.yang similarity index 100% rename from src/confd/yang/infix-if-gre@2024-12-20.yang rename to src/confd/yang/confd/infix-if-gre@2024-12-20.yang diff --git a/src/confd/yang/infix-if-lag.yang b/src/confd/yang/confd/infix-if-lag.yang similarity index 100% rename from src/confd/yang/infix-if-lag.yang rename to src/confd/yang/confd/infix-if-lag.yang diff --git a/src/confd/yang/infix-if-lag@2025-03-28.yang b/src/confd/yang/confd/infix-if-lag@2025-03-28.yang similarity index 100% rename from src/confd/yang/infix-if-lag@2025-03-28.yang rename to src/confd/yang/confd/infix-if-lag@2025-03-28.yang diff --git a/src/confd/yang/infix-if-type.yang b/src/confd/yang/confd/infix-if-type.yang similarity index 100% rename from src/confd/yang/infix-if-type.yang rename to src/confd/yang/confd/infix-if-type.yang diff --git a/src/confd/yang/infix-if-type@2025-02-12.yang b/src/confd/yang/confd/infix-if-type@2025-02-12.yang similarity index 100% rename from src/confd/yang/infix-if-type@2025-02-12.yang rename to src/confd/yang/confd/infix-if-type@2025-02-12.yang diff --git a/src/confd/yang/infix-if-veth.yang b/src/confd/yang/confd/infix-if-veth.yang similarity index 100% rename from src/confd/yang/infix-if-veth.yang rename to src/confd/yang/confd/infix-if-veth.yang diff --git a/src/confd/yang/infix-if-veth@2023-06-05.yang b/src/confd/yang/confd/infix-if-veth@2023-06-05.yang similarity index 100% rename from src/confd/yang/infix-if-veth@2023-06-05.yang rename to src/confd/yang/confd/infix-if-veth@2023-06-05.yang diff --git a/src/confd/yang/infix-if-vlan.yang b/src/confd/yang/confd/infix-if-vlan.yang similarity index 100% rename from src/confd/yang/infix-if-vlan.yang rename to src/confd/yang/confd/infix-if-vlan.yang diff --git a/src/confd/yang/infix-if-vlan@2024-05-30.yang b/src/confd/yang/confd/infix-if-vlan@2024-05-30.yang similarity index 100% rename from src/confd/yang/infix-if-vlan@2024-05-30.yang rename to src/confd/yang/confd/infix-if-vlan@2024-05-30.yang diff --git a/src/confd/yang/infix-if-vxlan.yang b/src/confd/yang/confd/infix-if-vxlan.yang similarity index 100% rename from src/confd/yang/infix-if-vxlan.yang rename to src/confd/yang/confd/infix-if-vxlan.yang diff --git a/src/confd/yang/infix-if-vxlan@2025-01-13.yang b/src/confd/yang/confd/infix-if-vxlan@2025-01-13.yang similarity index 100% rename from src/confd/yang/infix-if-vxlan@2025-01-13.yang rename to src/confd/yang/confd/infix-if-vxlan@2025-01-13.yang diff --git a/src/confd/yang/infix-interfaces.yang b/src/confd/yang/confd/infix-interfaces.yang similarity index 100% rename from src/confd/yang/infix-interfaces.yang rename to src/confd/yang/confd/infix-interfaces.yang diff --git a/src/confd/yang/infix-interfaces@2025-01-09.yang b/src/confd/yang/confd/infix-interfaces@2025-01-09.yang similarity index 100% rename from src/confd/yang/infix-interfaces@2025-01-09.yang rename to src/confd/yang/confd/infix-interfaces@2025-01-09.yang diff --git a/src/confd/yang/infix-ip.yang b/src/confd/yang/confd/infix-ip.yang similarity index 100% rename from src/confd/yang/infix-ip.yang rename to src/confd/yang/confd/infix-ip.yang diff --git a/src/confd/yang/infix-ip@2024-09-16.yang b/src/confd/yang/confd/infix-ip@2024-09-16.yang similarity index 100% rename from src/confd/yang/infix-ip@2024-09-16.yang rename to src/confd/yang/confd/infix-ip@2024-09-16.yang diff --git a/src/confd/yang/infix-keystore.yang b/src/confd/yang/confd/infix-keystore.yang similarity index 100% rename from src/confd/yang/infix-keystore.yang rename to src/confd/yang/confd/infix-keystore.yang diff --git a/src/confd/yang/infix-keystore@2025-02-04.yang b/src/confd/yang/confd/infix-keystore@2025-02-04.yang similarity index 100% rename from src/confd/yang/infix-keystore@2025-02-04.yang rename to src/confd/yang/confd/infix-keystore@2025-02-04.yang diff --git a/src/confd/yang/infix-lldp.yang b/src/confd/yang/confd/infix-lldp.yang similarity index 100% rename from src/confd/yang/infix-lldp.yang rename to src/confd/yang/confd/infix-lldp.yang diff --git a/src/confd/yang/infix-lldp@2025-01-08.yang b/src/confd/yang/confd/infix-lldp@2025-01-08.yang similarity index 100% rename from src/confd/yang/infix-lldp@2025-01-08.yang rename to src/confd/yang/confd/infix-lldp@2025-01-08.yang diff --git a/src/confd/yang/infix-meta.yang b/src/confd/yang/confd/infix-meta.yang similarity index 100% rename from src/confd/yang/infix-meta.yang rename to src/confd/yang/confd/infix-meta.yang diff --git a/src/confd/yang/infix-meta@2024-10-18.yang b/src/confd/yang/confd/infix-meta@2024-10-18.yang similarity index 100% rename from src/confd/yang/infix-meta@2024-10-18.yang rename to src/confd/yang/confd/infix-meta@2024-10-18.yang diff --git a/src/confd/yang/infix-routing.yang b/src/confd/yang/confd/infix-routing.yang similarity index 100% rename from src/confd/yang/infix-routing.yang rename to src/confd/yang/confd/infix-routing.yang diff --git a/src/confd/yang/infix-routing@2024-11-27.yang b/src/confd/yang/confd/infix-routing@2024-11-27.yang similarity index 100% rename from src/confd/yang/infix-routing@2024-11-27.yang rename to src/confd/yang/confd/infix-routing@2024-11-27.yang diff --git a/src/confd/yang/infix-services.yang b/src/confd/yang/confd/infix-services.yang similarity index 100% rename from src/confd/yang/infix-services.yang rename to src/confd/yang/confd/infix-services.yang diff --git a/src/confd/yang/infix-services@2024-12-03.yang b/src/confd/yang/confd/infix-services@2024-12-03.yang similarity index 100% rename from src/confd/yang/infix-services@2024-12-03.yang rename to src/confd/yang/confd/infix-services@2024-12-03.yang diff --git a/src/confd/yang/infix-syslog.yang b/src/confd/yang/confd/infix-syslog.yang similarity index 100% rename from src/confd/yang/infix-syslog.yang rename to src/confd/yang/confd/infix-syslog.yang diff --git a/src/confd/yang/infix-syslog@2024-07-19.yang b/src/confd/yang/confd/infix-syslog@2024-07-19.yang similarity index 100% rename from src/confd/yang/infix-syslog@2024-07-19.yang rename to src/confd/yang/confd/infix-syslog@2024-07-19.yang diff --git a/src/confd/yang/infix-system-software.yang b/src/confd/yang/confd/infix-system-software.yang similarity index 100% rename from src/confd/yang/infix-system-software.yang rename to src/confd/yang/confd/infix-system-software.yang diff --git a/src/confd/yang/infix-system-software@2024-12-16.yang b/src/confd/yang/confd/infix-system-software@2024-12-16.yang similarity index 100% rename from src/confd/yang/infix-system-software@2024-12-16.yang rename to src/confd/yang/confd/infix-system-software@2024-12-16.yang diff --git a/src/confd/yang/infix-system.yang b/src/confd/yang/confd/infix-system.yang similarity index 100% rename from src/confd/yang/infix-system.yang rename to src/confd/yang/confd/infix-system.yang diff --git a/src/confd/yang/infix-system@2025-01-25.yang b/src/confd/yang/confd/infix-system@2025-01-25.yang similarity index 100% rename from src/confd/yang/infix-system@2025-01-25.yang rename to src/confd/yang/confd/infix-system@2025-01-25.yang diff --git a/src/confd/yang/ietf-crypto-types@2023-12-28.yang b/src/confd/yang/ietf-crypto-types@2023-12-28.yang deleted file mode 100644 index 2013727c..00000000 --- a/src/confd/yang/ietf-crypto-types@2023-12-28.yang +++ /dev/null @@ -1,1028 +0,0 @@ -module ietf-crypto-types { - yang-version 1.1; - namespace "urn:ietf:params:xml:ns:yang:ietf-crypto-types"; - prefix ct; - - import ietf-yang-types { - prefix yang; - reference - "RFC 6991: Common YANG Data Types"; - } - import ietf-netconf-acm { - prefix nacm; - reference - "RFC 8341: Network Configuration Access Control Model"; - } - - organization - "IETF NETCONF (Network Configuration) Working Group"; - contact - "WG Web: https://datatracker.ietf.org/wg/netconf - WG List: NETCONF WG list - Author: Kent Watsen "; - description - "This module defines common YANG types for cryptographic - applications. - - Copyright (c) 2023 IETF Trust and the persons identified - as authors of the code. All rights reserved. - - Redistribution and use in source and binary forms, with - or without modification, is permitted pursuant to, and - subject to the license terms contained in, the Revised - BSD License set forth in Section 4.c of the IETF Trust's - Legal Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info). - - This version of this YANG module is part of RFC AAAA - (https://www.rfc-editor.org/info/rfcAAAA); see the RFC - itself for full legal notices. - - The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', - 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', - 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document - are to be interpreted as described in BCP 14 (RFC 2119) - (RFC 8174) when, and only when, they appear in all - capitals, as shown here."; - - revision 2023-12-28 { - description - "Initial version"; - reference - "RFC AAAA: YANG Data Types and Groupings for Cryptography"; - } - - feature one-symmetric-key-format { - description - "Indicates that the server supports the - 'one-symmetric-key-format' identity."; - } - - feature one-asymmetric-key-format { - description - "Indicates that the server supports the - 'one-asymmetric-key-format' identity."; - } - - feature symmetrically-encrypted-value-format { - description - "Indicates that the server supports the - 'symmetrically-encrypted-value-format' identity."; - } - - feature asymmetrically-encrypted-value-format { - description - "Indicates that the server supports the - 'asymmetrically-encrypted-value-format' identity."; - } - - feature cms-enveloped-data-format { - description - "Indicates that the server supports the - 'cms-enveloped-data-format' identity."; - } - - feature cms-encrypted-data-format { - description - "Indicates that the server supports the - 'cms-encrypted-data-format' identity."; - } - - feature p10-csr-format { - description - "Indicates that the server implements support - for generating P10-based CSRs, as defined - in RFC 2986."; - reference - "RFC 2986: PKCS #10: Certification Request Syntax - Specification Version 1.7"; - } - - feature csr-generation { - description - "Indicates that the server implements the - 'generate-csr' action."; - } - - feature certificate-expiration-notification { - description - "Indicates that the server implements the - 'certificate-expiration' notification."; - } - - feature cleartext-passwords { - description - "Indicates that the server supports cleartext - passwords."; - } - - feature encrypted-passwords { - description - "Indicates that the server supports password - encryption."; - } - - feature cleartext-symmetric-keys { - description - "Indicates that the server supports cleartext - symmetric keys."; - } - - feature hidden-symmetric-keys { - description - "Indicates that the server supports hidden keys."; - } - - feature encrypted-symmetric-keys { - description - "Indicates that the server supports encryption - of symmetric keys."; - } - - feature cleartext-private-keys { - description - "Indicates that the server supports cleartext - private keys."; - } - - feature hidden-private-keys { - description - "Indicates that the server supports hidden keys."; - } - - feature encrypted-private-keys { - description - "Indicates that the server supports encryption - of private keys."; - } - - identity symmetric-key-format { - description - "Base key-format identity for symmetric keys."; - } - - identity public-key-format { - description - "Base key-format identity for public keys."; - } - - identity private-key-format { - description - "Base key-format identity for private keys."; - } - - identity rsa-private-key-format { - base private-key-format; - description - "Indicates that the private key value is encoded as - an RSAPrivateKey (from RFC 3447), encoded using ASN.1 - distinguished encoding rules (DER), as specified in - ITU-T X.690."; - reference - "RFC 3447: - PKCS #1: RSA Cryptography Specifications Version 2.2 - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - identity ec-private-key-format { - base private-key-format; - description - "Indicates that the private key value is encoded as - an ECPrivateKey (from RFC 5915), encoded using ASN.1 - distinguished encoding rules (DER), as specified in - ITU-T X.690."; - reference - "RFC 5915: - Elliptic Curve Private Key Structure - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - identity one-asymmetric-key-format { - if-feature "one-asymmetric-key-format"; - base private-key-format; - description - "Indicates that the private key value is a CMS - OneAsymmetricKey structure, as defined in RFC 5958, - encoded using ASN.1 distinguished encoding rules - (DER), as specified in ITU-T X.690."; - reference - "RFC 5958: Asymmetric Key Packages - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - identity ssh-public-key-format { - base public-key-format; - description - "Indicates that the public key value is an SSH public key, - as specified by RFC 4253, Section 6.6, i.e.: - - string certificate or public key format - identifier - byte[n] key/certificate data."; - reference - "RFC 4253: The Secure Shell (SSH) Transport Layer Protocol"; - } - - identity subject-public-key-info-format { - base public-key-format; - description - "Indicates that the public key value is a SubjectPublicKeyInfo - structure, as described in RFC 5280 encoded using ASN.1 - distinguished encoding rules (DER), as specified in - ITU-T X.690."; - reference - "RFC 5280: - Internet X.509 Public Key Infrastructure Certificate - and Certificate Revocation List (CRL) Profile - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - identity octet-string-key-format { - base symmetric-key-format; - description - "Indicates that the key is encoded as a raw octet string. - The length of the octet string MUST be appropriate for - the associated algorithm's block size. - - The identity of the associated algorithm is outside the - scope of this specification. This is also true when - the octet string has been encrypted."; - } - - identity one-symmetric-key-format { - if-feature "one-symmetric-key-format"; - base symmetric-key-format; - description - "Indicates that the private key value is a CMS - OneSymmetricKey structure, as defined in RFC 6031, - encoded using ASN.1 distinguished encoding rules - (DER), as specified in ITU-T X.690."; - reference - "RFC 6031: Cryptographic Message Syntax (CMS) - Symmetric Key Package Content Type - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - identity encrypted-value-format { - description - "Base format identity for encrypted values."; - } - - identity symmetrically-encrypted-value-format { - if-feature "symmetrically-encrypted-value-format"; - base encrypted-value-format; - description - "Base format identity for symmetrically encrypted - values."; - } - - identity asymmetrically-encrypted-value-format { - if-feature "asymmetrically-encrypted-value-format"; - base encrypted-value-format; - description - "Base format identity for asymmetrically encrypted - values."; - } - - identity cms-encrypted-data-format { - if-feature "cms-encrypted-data-format"; - base symmetrically-encrypted-value-format; - description - "Indicates that the encrypted value conforms to - the 'encrypted-data-cms' type with the constraint - that the 'unprotectedAttrs' value is not set."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS) - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - identity cms-enveloped-data-format { - if-feature "cms-enveloped-data-format"; - base asymmetrically-encrypted-value-format; - description - "Indicates that the encrypted value conforms to the - 'enveloped-data-cms' type with the following constraints: - - The EnvelopedData structure MUST have exactly one - 'RecipientInfo'. - - If the asymmetric key supports public key cryptography - (e.g., RSA), then the 'RecipientInfo' must be a - 'KeyTransRecipientInfo' with the 'RecipientIdentifier' - using a 'subjectKeyIdentifier' with the value set using - 'method 1' in RFC 7093 over the recipient's public key. - - Otherwise, if the asymmetric key supports key agreement - (e.g., ECC), then the 'RecipientInfo' must be a - 'KeyAgreeRecipientInfo'. The 'OriginatorIdentifierOrKey' - value must use the 'OriginatorPublicKey' alternative. - The 'UserKeyingMaterial' value must not be present. - There must be exactly one 'RecipientEncryptedKeys' value - having the 'KeyAgreeRecipientIdentifier' set to 'rKeyId' - with the value set using 'method 1' in RFC 7093 over the - recipient's public key."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS) - RFC 7093: - Additional Methods for Generating Key - Identifiers Values - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - identity csr-format { - description - "A base identity for the certificate signing request - formats. Additional derived identities MAY be defined - by future efforts."; - } - - identity p10-csr-format { - if-feature "p10-csr-format"; - base csr-format; - description - "Indicates the 'CertificationRequest' structure - defined in RFC 2986."; - reference - "RFC 2986: PKCS #10: Certification Request Syntax - Specification Version 1.7"; - } - - typedef csr-info { - type binary; - description - "A CertificationRequestInfo structure, as defined in - RFC 2986, encoded using ASN.1 distinguished encoding - rules (DER), as specified in ITU-T X.690."; - reference - "RFC 2986: PKCS #10: Certification Request Syntax - Specification Version 1.7 - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - typedef p10-csr { - type binary; - description - "A CertificationRequest structure, as specified in - RFC 2986, encoded using ASN.1 distinguished encoding - rules (DER), as specified in ITU-T X.690."; - reference - "RFC 2986: - PKCS #10: Certification Request Syntax Specification - Version 1.7 - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - typedef x509 { - type binary; - description - "A Certificate structure, as specified in RFC 5280, - encoded using ASN.1 distinguished encoding rules (DER), - as specified in ITU-T X.690."; - reference - "RFC 5280: - Internet X.509 Public Key Infrastructure Certificate - and Certificate Revocation List (CRL) Profile - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - typedef crl { - type binary; - description - "A CertificateList structure, as specified in RFC 5280, - encoded using ASN.1 distinguished encoding rules (DER), - as specified in ITU-T X.690."; - reference - "RFC 5280: - Internet X.509 Public Key Infrastructure Certificate - and Certificate Revocation List (CRL) Profile - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - typedef oscp-request { - type binary; - description - "A OCSPRequest structure, as specified in RFC 6960, - encoded using ASN.1 distinguished encoding rules - (DER), as specified in ITU-T X.690."; - reference - "RFC 6960: - X.509 Internet Public Key Infrastructure Online - Certificate Status Protocol - OCSP - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - typedef oscp-response { - type binary; - description - "A OCSPResponse structure, as specified in RFC 6960, - encoded using ASN.1 distinguished encoding rules - (DER), as specified in ITU-T X.690."; - reference - "RFC 6960: - X.509 Internet Public Key Infrastructure Online - Certificate Status Protocol - OCSP - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - typedef cms { - type binary; - description - "A ContentInfo structure, as specified in RFC 5652, - encoded using ASN.1 distinguished encoding rules (DER), - as specified in ITU-T X.690."; - reference - "RFC 5652: - Cryptographic Message Syntax (CMS) - ITU-T X.690: - Information technology - ASN.1 encoding rules: - Specification of Basic Encoding Rules (BER), - Canonical Encoding Rules (CER) and Distinguished - Encoding Rules (DER) 02/2021."; - } - - typedef data-content-cms { - type cms; - description - "A CMS structure whose top-most content type MUST be the - data content type, as described by Section 4 in RFC 5652."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS)"; - } - - typedef signed-data-cms { - type cms; - description - "A CMS structure whose top-most content type MUST be the - signed-data content type, as described by Section 5 in - RFC 5652."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS)"; - } - - typedef enveloped-data-cms { - type cms; - description - "A CMS structure whose top-most content type MUST be the - enveloped-data content type, as described by Section 6 - in RFC 5652."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS)"; - } - - typedef digested-data-cms { - type cms; - description - "A CMS structure whose top-most content type MUST be the - digested-data content type, as described by Section 7 - in RFC 5652."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS)"; - } - - typedef encrypted-data-cms { - type cms; - description - "A CMS structure whose top-most content type MUST be the - encrypted-data content type, as described by Section 8 - in RFC 5652."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS)"; - } - - typedef authenticated-data-cms { - type cms; - description - "A CMS structure whose top-most content type MUST be the - authenticated-data content type, as described by Section 9 - in RFC 5652."; - reference - "RFC 5652: Cryptographic Message Syntax (CMS)"; - } - - typedef trust-anchor-cert-x509 { - type x509; - description - "A Certificate structure that MUST encode a self-signed - root certificate."; - } - - typedef end-entity-cert-x509 { - type x509; - description - "A Certificate structure that MUST encode a certificate - that is neither self-signed nor having Basic constraint - CA true."; - } - - typedef trust-anchor-cert-cms { - type signed-data-cms; - description - "A CMS SignedData structure that MUST contain the chain of - X.509 certificates needed to authenticate the certificate - presented by a client or end-entity. - - The CMS MUST contain only a single chain of certificates. - The client or end-entity certificate MUST only authenticate - to the last intermediate CA certificate listed in the chain. - - In all cases, the chain MUST include a self-signed root - certificate. In the case where the root certificate is - itself the issuer of the client or end-entity certificate, - only one certificate is present. - - This CMS structure MAY (as applicable where this type is - used) also contain suitably fresh (as defined by local - policy) revocation objects with which the device can - verify the revocation status of the certificates. - - This CMS encodes the degenerate form of the SignedData - structure (RFC 5652, Section 5.2) that is commonly used - to disseminate X.509 certificates and revocation objects - (RFC 5280)."; - reference - "RFC 5280: - Internet X.509 Public Key Infrastructure Certificate - and Certificate Revocation List (CRL) Profile. - RFC 5652: - Cryptographic Message Syntax (CMS)"; - } - - typedef end-entity-cert-cms { - type signed-data-cms; - description - "A CMS SignedData structure that MUST contain the end - entity certificate itself, and MAY contain any number - of intermediate certificates leading up to a trust - anchor certificate. The trust anchor certificate - MAY be included as well. - - The CMS MUST contain a single end entity certificate. - The CMS MUST NOT contain any spurious certificates. - - This CMS structure MAY (as applicable where this type is - used) also contain suitably fresh (as defined by local - policy) revocation objects with which the device can - verify the revocation status of the certificates. - - This CMS encodes the degenerate form of the SignedData - structure (RFC 5652, Section 5.2) that is commonly - used to disseminate X.509 certificates and revocation - objects (RFC 5280)."; - reference - "RFC 5280: - Internet X.509 Public Key Infrastructure Certificate - and Certificate Revocation List (CRL) Profile. - RFC 5652: - Cryptographic Message Syntax (CMS)"; - } - - grouping encrypted-value-grouping { - description - "A reusable grouping for a value that has been encrypted by - a referenced symmetric or asymmetric key."; - container encrypted-by { - nacm:default-deny-write; - description - "An empty container enabling a reference to the key that - encrypted the value to be augmented in. The referenced - key MUST be a symmetric key or an asymmetric key. - - A symmetric key MUST be referenced via a leaf node called - 'symmetric-key-ref'. An asymmetric key MUST be referenced - via a leaf node called 'asymmetric-key-ref'. - - The leaf nodes MUST be direct descendants in the data tree, - and MAY be direct descendants in the schema tree (e.g., - choice/case statements are allowed, but not a container)."; - } - leaf encrypted-value-format { - type identityref { - base encrypted-value-format; - } - mandatory true; - description - "Identifies the format of the 'encrypted-value' leaf. - - If 'encrypted-by' points to a symmetric key, then a - 'symmetrically-encrypted-value-format' based identity - MUST by set (e.g., cms-encrypted-data-format). - - If 'encrypted-by' points to an asymmetric key, then an - 'asymmetrically-encrypted-value-format' based identity - MUST by set (e.g., cms-enveloped-data-format)."; - } - leaf encrypted-value { - nacm:default-deny-write; - type binary; - must '../encrypted-by'; - mandatory true; - description - "The value, encrypted using the referenced symmetric - or asymmetric key. The value MUST be encoded using - the format associated with the 'encrypted-value-format' - leaf."; - } - } - - grouping password-grouping { - description - "A password that may be encrypted."; - choice password-type { - nacm:default-deny-write; - mandatory true; - description - "Choice between password types."; - case cleartext-password { - if-feature "cleartext-passwords"; - leaf cleartext-password { - nacm:default-deny-all; - type string; - description - "The cleartext value of the password."; - } - } - case encrypted-password { - if-feature "encrypted-passwords"; - container encrypted-password { - description - "A container for the encrypted password value."; - uses encrypted-value-grouping; - } - } - } - } - - grouping symmetric-key-grouping { - description - "A symmetric key."; - leaf key-format { - nacm:default-deny-write; - type identityref { - base symmetric-key-format; - } - description - "Identifies the symmetric key's format. Implementations - SHOULD ensure that the incoming symmetric key value is - encoded in the specified format. - - For encrypted keys, the value is the decrypted key's - format (i.e., the 'encrypted-value-format' conveys the - encrypted key's format."; - } - choice key-type { - nacm:default-deny-write; - mandatory true; - description - "Choice between key types."; - case cleartext-key { - leaf cleartext-key { - nacm:default-deny-all; - if-feature "cleartext-symmetric-keys"; - type binary; - must '../key-format'; - description - "The binary value of the key. The interpretation of - the value is defined by the 'key-format' field."; - } - } - case hidden-key { - if-feature "hidden-symmetric-keys"; - leaf hidden-key { - type empty; - must 'not(../key-format)'; - description - "A hidden key. How such keys are created is outside - the scope of this module."; - } - } - case encrypted-key { - if-feature "encrypted-symmetric-keys"; - container encrypted-key { - must '../key-format'; - description - "A container for the encrypted symmetric key value. - The interpretation of the 'encrypted-value' node - is via the 'key-format' node"; - uses encrypted-value-grouping; - } - } - } - } - - grouping public-key-grouping { - description - "A public key."; - leaf public-key-format { - nacm:default-deny-write; - type identityref { - base public-key-format; - } - mandatory true; - description - "Identifies the public key's format. Implementations SHOULD - ensure that the incoming public key value is encoded in the - specified format."; - } - leaf public-key { - nacm:default-deny-write; - type binary; - mandatory true; - description - "The binary value of the public key. The interpretation - of the value is defined by 'public-key-format' field."; - } - } - - grouping private-key-grouping { - description - "A private key."; - leaf private-key-format { - nacm:default-deny-write; - type identityref { - base private-key-format; - } - description - "Identifies the private key's format. Implementations SHOULD - ensure that the incoming private key value is encoded in the - specified format. - - For encrypted keys, the value is the decrypted key's - format (i.e., the 'encrypted-value-format' conveys the - encrypted key's format."; - } - choice private-key-type { - nacm:default-deny-write; - mandatory true; - description - "Choice between key types."; - case cleartext-private-key { - if-feature "cleartext-private-keys"; - leaf cleartext-private-key { - nacm:default-deny-all; - type binary; - must '../private-key-format'; - description - "The value of the binary key The key's value is - interpreted by the 'private-key-format' field."; - } - } - case hidden-private-key { - if-feature "hidden-private-keys"; - leaf hidden-private-key { - type empty; - must 'not(../private-key-format)'; - description - "A hidden key. How such keys are created is - outside the scope of this module."; - } - } - case encrypted-private-key { - if-feature "encrypted-private-keys"; - container encrypted-private-key { - must '../private-key-format'; - description - "A container for the encrypted asymmetric private key - value. The interpretation of the 'encrypted-value' - node is via the 'private-key-format' node"; - uses encrypted-value-grouping; - } - } - } - } - - grouping asymmetric-key-pair-grouping { - description - "A private key and, optionally, its associated public key. - Implementations SHOULD ensure that the two keys, when both - are specified, are a matching pair."; - uses public-key-grouping { - refine "public-key-format" { - mandatory false; - } - refine "public-key" { - mandatory false; - } - } - uses private-key-grouping; - } - - grouping certificate-expiration-grouping { - description - "A notification for when a certificate is about to, or - already has, expired."; - notification certificate-expiration { - if-feature "certificate-expiration-notification"; - description - "A notification indicating that the configured certificate - is either about to expire or has already expired. When to - send notifications is an implementation specific decision, - but it is RECOMMENDED that a notification be sent once a - month for 3 months, then once a week for four weeks, and - then once a day thereafter until the issue is resolved."; - leaf expiration-date { - type yang:date-and-time; - mandatory true; - description - "Identifies the expiration date on the certificate."; - } - } - } - - grouping trust-anchor-cert-grouping { - description - "A trust anchor certificate, and a notification for when - it is about to (or already has) expire."; - leaf cert-data { - nacm:default-deny-write; - type trust-anchor-cert-cms; - description - "The binary certificate data for this certificate."; - } - uses certificate-expiration-grouping; - } - - grouping end-entity-cert-grouping { - description - "An end entity certificate, and a notification for when - it is about to (or already has) expire. Implementations - SHOULD assert that, where used, the end entity certificate - contains the expected public key."; - leaf cert-data { - nacm:default-deny-write; - type end-entity-cert-cms; - description - "The binary certificate data for this certificate."; - } - uses certificate-expiration-grouping; - } - - grouping generate-csr-grouping { - description - "Defines the 'generate-csr' action."; - action generate-csr { - nacm:default-deny-all; - if-feature "csr-generation"; - description - "Generates a certificate signing request structure for - the associated asymmetric key using the passed subject - and attribute values. - - This action statement is only available when the - associated 'public-key-format' node's value is - 'subject-public-key-info-format'."; - reference - "RFC 6125: - Representation and Verification of Domain-Based - Application Service Identity within Internet Public Key - Infrastructure Using X.509 (PKIX) Certificates in the - Context of Transport Layer Security (TLS)"; - - input { - leaf csr-format { - type identityref { - base csr-format; - } - mandatory true; - description - "Specifies the format for the returned certificate."; - } - leaf csr-info { - type csr-info; - mandatory true; - description - "A CertificationRequestInfo structure, as defined in - RFC 2986. - - Enables the client to provide a fully-populated - CertificationRequestInfo structure that the server - only needs to sign in order to generate the complete - 'CertificationRequest' structure to return in the - 'output'. - - The 'AlgorithmIdentifier' field contained inside - the 'SubjectPublicKeyInfo' field MUST be one known - to be supported by the device."; - reference - "RFC 2986: - PKCS #10: Certification Request Syntax Specification - RFC AAAA: - YANG Data Types and Groupings for Cryptography"; - } - } - output { - choice csr-type { - mandatory true; - description - "A choice amongst certificate signing request formats. - Additional formats MAY be augmented into this 'choice' - statement by future efforts."; - case p10-csr { - description - "A CertificationRequest, as defined in RFC 2986."; - reference - "RFC 2986: - PKCS #10: Certification Request Syntax Specification - RFC AAAA: - YANG Data Types and Groupings for Cryptography"; - leaf p10-csr { - type p10-csr; - description - "A CertificationRequest, as defined in RFC 2986."; - } - } - } - } - } - } - - grouping asymmetric-key-pair-with-cert-grouping { - description - "A private/public key pair and an associated certificate. - Implementations SHOULD assert that the certificate contains - the matching public key."; - uses asymmetric-key-pair-grouping; - uses end-entity-cert-grouping; - uses generate-csr-grouping; - } - - grouping asymmetric-key-pair-with-certs-grouping { - description - "A private/public key pair and a list of associated - certificates. Implementations SHOULD assert that - certificates contain the matching public key."; - uses asymmetric-key-pair-grouping; - container certificates { - nacm:default-deny-write; - description - "Certificates associated with this asymmetric key."; - list certificate { - key "name"; - description - "A certificate for this asymmetric key."; - leaf name { - type string; - description - "An arbitrary name for the certificate."; - } - uses end-entity-cert-grouping { - refine "cert-data" { - mandatory true; - } - } - } - } - uses generate-csr-grouping; - } -} diff --git a/src/confd/yang/ietf-keystore@2023-12-28.yang b/src/confd/yang/ietf-keystore@2023-12-28.yang deleted file mode 100644 index 8b3d1656..00000000 --- a/src/confd/yang/ietf-keystore@2023-12-28.yang +++ /dev/null @@ -1,374 +0,0 @@ -module ietf-keystore { - yang-version 1.1; - namespace "urn:ietf:params:xml:ns:yang:ietf-keystore"; - prefix ks; - - import ietf-netconf-acm { - prefix nacm; - reference - "RFC 8341: Network Configuration Access Control Model"; - } - import ietf-crypto-types { - prefix ct; - reference - "RFC AAAA: YANG Data Types and Groupings for Cryptography"; - } - - organization - "IETF NETCONF (Network Configuration) Working Group"; - contact - "WG Web: https://datatracker.ietf.org/wg/netconf - WG List: NETCONF WG list - Author: Kent Watsen "; - description - "This module defines a 'keystore' to centralize management - of security credentials. - - Copyright (c) 2023 IETF Trust and the persons identified - as authors of the code. All rights reserved. - - Redistribution and use in source and binary forms, with - or without modification, is permitted pursuant to, and - subject to the license terms contained in, the Revised - BSD License set forth in Section 4.c of the IETF Trust's - Legal Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info). - - This version of this YANG module is part of RFC CCCC - (https://www.rfc-editor.org/info/rfcCCCC); see the RFC - itself for full legal notices. - - The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', - 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', - 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document - are to be interpreted as described in BCP 14 (RFC 2119) - (RFC 8174) when, and only when, they appear in all - capitals, as shown here."; - - revision 2023-12-28 { - description - "Initial version"; - reference - "RFC CCCC: A YANG Data Model for a Keystore"; - } - - feature central-keystore-supported { - description - "The 'central-keystore-supported' feature indicates that - the server supports the central keystore (i.e., fully - implements the 'ietf-keystore' module)."; - } - - feature inline-definitions-supported { - description - "The 'inline-definitions-supported' feature indicates that - the server supports locally-defined keys."; - } - - feature asymmetric-keys { - description - "The 'asymmetric-keys' feature indicates that the server - implements the /keystore/asymmetric-keys subtree."; - } - - feature symmetric-keys { - description - "The 'symmetric-keys' feature indicates that the server - implements the /keystore/symmetric-keys subtree."; - } - - typedef symmetric-key-ref { - type leafref { - path "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:name"; - } - description - "This typedef enables modules to easily define a reference - to a symmetric key stored in the central keystore."; - } - - typedef asymmetric-key-ref { - type leafref { - path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:name"; - } - description - "This typedef enables modules to easily define a reference - to an asymmetric key stored in the central keystore."; - } - - grouping encrypted-by-grouping { - description - "A grouping that defines a 'choice' statement that can be - augmented into the 'encrypted-by' node, present in the - 'symmetric-key-grouping' and 'asymmetric-key-pair-grouping' - groupings defined in RFC AAAA, enabling references to keys - in the central keystore."; - choice encrypted-by { - nacm:default-deny-write; - mandatory true; - description - "A choice amongst other symmetric or asymmetric keys."; - case symmetric-key-ref { - if-feature "central-keystore-supported"; - if-feature "symmetric-keys"; - leaf symmetric-key-ref { - type ks:symmetric-key-ref; - description - "Identifies the symmetric key used to encrypt the - associated key."; - } - } - case asymmetric-key-ref { - if-feature "central-keystore-supported"; - if-feature "asymmetric-keys"; - leaf asymmetric-key-ref { - type ks:asymmetric-key-ref; - description - "Identifies the asymmetric key whose public key - encrypted the associated key."; - } - } - } - } - - grouping asymmetric-key-certificate-ref-grouping { - description - "Grouping for the reference to a certificate associated - with an asymmetric key stored in the central keystore."; - leaf asymmetric-key { - nacm:default-deny-write; - if-feature "central-keystore-supported"; - if-feature "asymmetric-keys"; - type ks:asymmetric-key-ref; - must '../certificate'; - description - "A reference to an asymmetric key in the keystore."; - } - leaf certificate { - nacm:default-deny-write; - type leafref { - path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key[ks:name = current()/../asymmetric-key]/ks:certificates/ks:certificate/ks:name"; - } - must '../asymmetric-key'; - description - "A reference to a specific certificate of the - asymmetric key in the keystore."; - } - } - - grouping inline-or-keystore-symmetric-key-grouping { - description - "A grouping for the configuration of a symmetric key. The - symmetric key may be defined inline or as a reference to - a symmetric key stored in the central keystore. - - Servers that do not define the 'central-keystore-supported' - feature SHOULD augment in custom 'case' statements enabling - references to alternate keystore locations."; - choice inline-or-keystore { - nacm:default-deny-write; - mandatory true; - description - "A choice between an inlined definition and a definition - that exists in the keystore."; - case inline { - if-feature "inline-definitions-supported"; - container inline-definition { - description - "Container to hold the local key definition."; - uses ct:symmetric-key-grouping; - } - } - case central-keystore { - if-feature "central-keystore-supported"; - if-feature "symmetric-keys"; - leaf central-keystore-reference { - type ks:symmetric-key-ref; - description - "A reference to an symmetric key that exists in - the central keystore."; - } - } - } - } - - grouping inline-or-keystore-asymmetric-key-grouping { - description - "A grouping for the configuration of an asymmetric key. The - asymmetric key may be defined inline or as a reference to - an asymmetric key stored in the central keystore. - - Servers that do not define the 'central-keystore-supported' - feature SHOULD augment in custom 'case' statements enabling - references to alternate keystore locations."; - choice inline-or-keystore { - nacm:default-deny-write; - mandatory true; - description - "A choice between an inlined definition and a definition - that exists in the keystore."; - case inline { - if-feature "inline-definitions-supported"; - container inline-definition { - description - "Container to hold the local key definition."; - uses ct:asymmetric-key-pair-grouping; - } - } - case central-keystore { - if-feature "central-keystore-supported"; - if-feature "asymmetric-keys"; - leaf central-keystore-reference { - type ks:asymmetric-key-ref; - description - "A reference to an asymmetric key that exists in - the central keystore. The intent is to reference - just the asymmetric key without any regard for - any certificates that may be associated with it."; - } - } - } - } - - grouping inline-or-keystore-asymmetric-key-with-certs-grouping { - description - "A grouping for the configuration of an asymmetric key and - its associated certificates. The asymmetric key and its - associated certificates may be defined inline or as a - reference to an asymmetric key (and its associated - certificates) in the central keystore. - - Servers that do not define the 'central-keystore-supported' - feature SHOULD augment in custom 'case' statements enabling - references to alternate keystore locations."; - choice inline-or-keystore { - nacm:default-deny-write; - mandatory true; - description - "A choice between an inlined definition and a definition - that exists in the keystore."; - case inline { - if-feature "inline-definitions-supported"; - container inline-definition { - description - "Container to hold the local key definition."; - uses ct:asymmetric-key-pair-with-certs-grouping; - } - } - case central-keystore { - if-feature "central-keystore-supported"; - if-feature "asymmetric-keys"; - leaf central-keystore-reference { - type ks:asymmetric-key-ref; - description - "A reference to an asymmetric-key (and all of its - associated certificates) in the keystore, when - this module is implemented."; - } - } - } - } - - grouping inline-or-keystore-end-entity-cert-with-key-grouping { - description - "A grouping for the configuration of an asymmetric key and - its associated end-entity certificate. The asymmetric key - and its associated end-entity certificate may be defined - inline or as a reference to an asymmetric key (and its - associated end-entity certificate) in the central keystore. - - Servers that do not define the 'central-keystore-supported' - feature SHOULD augment in custom 'case' statements enabling - references to alternate keystore locations."; - choice inline-or-keystore { - nacm:default-deny-write; - mandatory true; - description - "A choice between an inlined definition and a definition - that exists in the keystore."; - case inline { - if-feature "inline-definitions-supported"; - container inline-definition { - description - "Container to hold the local key definition."; - uses ct:asymmetric-key-pair-with-cert-grouping; - } - } - case central-keystore { - if-feature "central-keystore-supported"; - if-feature "asymmetric-keys"; - container central-keystore-reference { - description - "A reference to a specific certificate associated with - an asymmetric key stored in the central keystore."; - uses asymmetric-key-certificate-ref-grouping; - } - } - } - } - - grouping keystore-grouping { - description - "Grouping definition enables use in other contexts. If ever - done, implementations MUST augment new 'case' statements - into the various inline-or-keystore 'choice' statements to - supply leafrefs to the model-specific location(s)."; - container asymmetric-keys { - nacm:default-deny-write; - if-feature "asymmetric-keys"; - description - "A list of asymmetric keys."; - list asymmetric-key { - key "name"; - description - "An asymmetric key."; - leaf name { - type string; - description - "An arbitrary name for the asymmetric key."; - } - uses ct:asymmetric-key-pair-with-certs-grouping; - } - } - container symmetric-keys { - nacm:default-deny-write; - if-feature "symmetric-keys"; - description - "A list of symmetric keys."; - list symmetric-key { - key "name"; - description - "A symmetric key."; - leaf name { - type string; - description - "An arbitrary name for the symmetric key."; - } - uses ct:symmetric-key-grouping; - } - } - } - - container keystore { - nacm:default-deny-write; - if-feature "central-keystore-supported"; - description - "A central keystore containing a list of symmetric keys and - a list of asymmetric keys."; - uses keystore-grouping { - augment "symmetric-keys/symmetric-key/key-type/encrypted-key/encrypted-key/encrypted-by" { - description - "Augments in a choice statement enabling the encrypting - key to be any other symmetric or asymmetric key in the - central keystore."; - uses encrypted-by-grouping; - } - augment "asymmetric-keys/asymmetric-key/private-key-type/encrypted-private-key/encrypted-private-key/encrypted-by" { - description - "Augments in a choice statement enabling the encrypting - key to be any other symmetric or asymmetric key in the - central keystore."; - uses encrypted-by-grouping; - } - } - } -} diff --git a/src/confd/yang/ietf-tls-common@2023-12-28.yang b/src/confd/yang/ietf-tls-common@2023-12-28.yang deleted file mode 100644 index 79107ac9..00000000 --- a/src/confd/yang/ietf-tls-common@2023-12-28.yang +++ /dev/null @@ -1,316 +0,0 @@ -module ietf-tls-common { - yang-version 1.1; - namespace "urn:ietf:params:xml:ns:yang:ietf-tls-common"; - prefix tlscmn; - - import iana-tls-cipher-suite-algs { - prefix tlscsa; - reference - "RFC FFFF: YANG Groupings for TLS Clients and SSH Servers"; - } - - import ietf-crypto-types { - prefix ct; - reference - "RFC AAAA: YANG Data Types and Groupings for Cryptography"; - } - - import ietf-keystore { - prefix ks; - reference - "RFC CCCC: A YANG Data Model for a Keystore"; - } - - organization - "IETF NETCONF (Network Configuration) Working Group"; - - contact - "WG List: NETCONF WG list - WG Web: https://datatracker.ietf.org/wg/netconf - Author: Kent Watsen - Author: Jeff Hartley - Author: Gary Wu "; - - description - "This module defines a common features and groupings for - Transport Layer Security (TLS). - - Copyright (c) 2023 IETF Trust and the persons identified - as authors of the code. All rights reserved. - - Redistribution and use in source and binary forms, with - or without modification, is permitted pursuant to, and - subject to the license terms contained in, the Revised - BSD License set forth in Section 4.c of the IETF Trust's - Legal Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info). - - This version of this YANG module is part of RFC FFFF - (https://www.rfc-editor.org/info/rfcFFFF); see the RFC - itself for full legal notices. - - The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', - 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', - 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document - are to be interpreted as described in BCP 14 (RFC 2119) - (RFC 8174) when, and only when, they appear in all - capitals, as shown here."; - - revision 2023-12-28 { - description - "Initial version"; - reference - "RFC FFFF: YANG Groupings for TLS Clients and TLS Servers"; - } - - // Features - - feature tls10 { - status "obsolete"; - description - "TLS Protocol Version 1.0 is supported. TLS 1.0 is obsolete - and thus it is NOT RECOMMENDED to enable this feature."; - reference - "RFC 2246: The TLS Protocol Version 1.0"; - } - - feature tls11 { - status "obsolete"; - description - "TLS Protocol Version 1.1 is supported. TLS 1.1 is obsolete - and thus it is NOT RECOMMENDED to enable this feature."; - reference - "RFC 4346: The Transport Layer Security (TLS) Protocol - Version 1.1"; - } - - feature tls12 { - status "deprecated"; - description - "TLS Protocol Version 1.2 is supported. TLS 1.2 is obsolete - and thus it is NOT RECOMMENDED to enable this feature."; - reference - "RFC 5246: The Transport Layer Security (TLS) Protocol - Version 1.2"; - } - - feature tls13 { - description - "TLS Protocol Version 1.3 is supported."; - reference - "RFC 8446: The Transport Layer Security (TLS) - Protocol Version 1.3"; - } - - feature hello-params { - description - "TLS hello message parameters are configurable."; - } - - feature public-key-generation { - description - "Indicates that the server implements the - 'generate-public-key' RPC."; - } - - // Identities - - identity tls-version-base { - description - "Base identity used to identify TLS protocol versions."; - } - - identity tls10 { - if-feature "tls10"; - base tls-version-base; - status "obsolete"; - description - "TLS Protocol Version 1.0."; - reference - "RFC 2246: The TLS Protocol Version 1.0"; - } - - identity tls11 { - if-feature "tls11"; - base tls-version-base; - status "obsolete"; - description - "TLS Protocol Version 1.1."; - reference - "RFC 4346: The Transport Layer Security (TLS) Protocol - Version 1.1"; - } - - identity tls12 { - if-feature "tls12"; - base tls-version-base; - status "deprecated"; - description - "TLS Protocol Version 1.2."; - reference - "RFC 5246: The Transport Layer Security (TLS) Protocol - Version 1.2"; - } - - identity tls13 { - if-feature "tls13"; - base tls-version-base; - description - "TLS Protocol Version 1.3."; - reference - "RFC 8446: The Transport Layer Security (TLS) - Protocol Version 1.3"; - } - - // Typedefs - - typedef epsk-supported-hash { - type enumeration { - enum sha-256 { - description - "The SHA-256 Hash."; - } - enum sha-384 { - description - "The SHA-384 Hash."; - } - } - description - "As per Section 4.2.11 of RFC 8446, the hash algorithm - supported by an instance of an External Pre-Shared - Key (EPSK)."; - reference - "RFC 8446: The Transport Layer Security (TLS) - Protocol Version 1.3"; - } - - - // Groupings - - grouping hello-params-grouping { - description - "A reusable grouping for TLS hello message parameters."; - reference - "RFC 5246: The Transport Layer Security (TLS) Protocol - Version 1.2 - RFC 8446: The Transport Layer Security (TLS) Protocol - Version 1.3"; - container tls-versions { - description - "Parameters regarding TLS versions."; - leaf-list tls-version { - type identityref { - base tls-version-base; - } - ordered-by user; - description - "Acceptable TLS protocol versions. - - If this leaf-list is not configured (has zero elements) - the acceptable TLS protocol versions are implementation- - defined."; - } - } - container cipher-suites { - description - "Parameters regarding cipher suites."; - leaf-list cipher-suite { - type identityref { - base tlscsa:cipher-suite-alg-base; - } - ordered-by user; - description - "Acceptable cipher suites in order of descending - preference. The configured host key algorithms should - be compatible with the algorithm used by the configured - private key. Please see Section 5 of RFC FFFF for - valid combinations. - - If this leaf-list is not configured (has zero elements) - the acceptable cipher suites are implementation- - defined."; - reference - "RFC FFFF: YANG Groupings for TLS Clients and TLS Servers"; - } - } - } // hello-params-grouping - - rpc generate-public-key { - if-feature "public-key-generation"; - description - "Requests the device to generate an public key using - the specified key algorithm."; - input { - leaf algorithm { - type tlscsa:cipher-suite-algorithm-ref; - mandatory true; - description - "The cipher suite algorithm that the generated key is - to work with. Implementations derive the public key - algorithm from the cipher suite algorithm. Example: - cipher suite 'tls-rsa-with-aes-256-cbc-sha256' maps - to the RSA public key."; - } - leaf num-bits { - type uint16; - description - "Specifies the number of bits in the key to create. - For RSA keys, the minimum size is 1024 bits and - the default is 3072 bits. Generally, 3072 bits is - considered sufficient. DSA keys must be exactly 1024 - bits as specified by FIPS 186-2. For elliptical - keys, the 'num-bits' value determines the key length - of the curve (e.g., 256, 384 or 521), where valid - values supported by the server are conveyed via an - unspecified mechanism. For some public algorithms, - the keys have a fixed length and thus the 'num-bits' - value is not specified."; - } - container private-key-encoding { - description - "Indicates how the private key is to be encoded."; - choice private-key-encoding { - mandatory true; - description - "A choice amongst optional private key handling."; - case cleartext { - if-feature "ct:cleartext-private-keys"; - leaf cleartext { - type empty; - description - "Indicates that the private key is to be returned - as a cleartext value."; - } - } - case encrypted { - if-feature "ct:encrypted-private-keys"; - container encrypted { - description - "Indicates that the key is to be encrypted using - the specified symmetric or asymmetric key."; - uses ks:encrypted-by-grouping; - } - } - case hidden { - if-feature "ct:hidden-private-keys"; - leaf hidden { - type empty; - description - "Indicates that the private key is to be hidden. - - Unlike the 'cleartext' and 'encrypt' options, the - key returned is a placeholder for an internally - stored key. See the 'Support for Built-in Keys' - section in RFC CCCC for information about hidden - keys."; - } - } - } - } - } - output { - uses ct:asymmetric-key-pair-grouping; - } - } // end generate-public-key - -} diff --git a/src/confd/yang/ietf-truststore@2023-12-28.yang b/src/confd/yang/ietf-truststore@2023-12-28.yang deleted file mode 100644 index f1dfb796..00000000 --- a/src/confd/yang/ietf-truststore@2023-12-28.yang +++ /dev/null @@ -1,359 +0,0 @@ -module ietf-truststore { - yang-version 1.1; - namespace "urn:ietf:params:xml:ns:yang:ietf-truststore"; - prefix ts; - - import ietf-netconf-acm { - prefix nacm; - reference - "RFC 8341: Network Configuration Access Control Model"; - } - import ietf-crypto-types { - prefix ct; - reference - "RFC AAAA: YANG Data Types and Groupings for Cryptography"; - } - - organization - "IETF NETCONF (Network Configuration) Working Group"; - contact - "WG Web : https://datatracker.ietf.org/wg/netconf - WG List : NETCONF WG list - Author : Kent Watsen "; - description - "This module defines a 'truststore' to centralize management - of trust anchors including certificates and public keys. - - Copyright (c) 2023 IETF Trust and the persons identified - as authors of the code. All rights reserved. - - Redistribution and use in source and binary forms, with - or without modification, is permitted pursuant to, and - subject to the license terms contained in, the Revised - BSD License set forth in Section 4.c of the IETF Trust's - Legal Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info). - - This version of this YANG module is part of RFC BBBB - (https://www.rfc-editor.org/info/rfcBBBB); see the RFC - itself for full legal notices. - - The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', - 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', - 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document - are to be interpreted as described in BCP 14 (RFC 2119) - (RFC 8174) when, and only when, they appear in all - capitals, as shown here."; - - revision 2023-12-28 { - description - "Initial version"; - reference - "RFC BBBB: A YANG Data Model for a Truststore"; - } - - feature central-truststore-supported { - description - "The 'central-truststore-supported' feature indicates that - the server supports the truststore (i.e., implements the - 'ietf-truststore' module)."; - } - - feature inline-definitions-supported { - description - "The 'inline-definitions-supported' feature indicates that - the server supports locally-defined trust anchors."; - } - - feature certificates { - description - "The 'certificates' feature indicates that the server - implements the /truststore/certificate-bags subtree."; - } - - feature public-keys { - description - "The 'public-keys' feature indicates that the server - implements the /truststore/public-key-bags subtree."; - } - - typedef certificate-bag-ref { - type leafref { - path "/ts:truststore/ts:certificate-bags/ts:certificate-bag/ts:name"; - } - description - "This typedef defines a reference to a certificate bag - in the central truststore."; - } - - typedef certificate-ref { - type leafref { - path "/ts:truststore/ts:certificate-bags/ts:certificate-bag[ts:name = current()/../certificate-bag]/ts:certificate/ts:name"; - } - description - "This typedef defines a reference to a specific certificate - in a certificate bag in the central truststore. This typedef - requires that there exist a sibling 'leaf' node called - 'certificate-bag' that SHOULD have the typedef - 'certificate-bag-ref'."; - } - - typedef public-key-bag-ref { - type leafref { - path "/ts:truststore/ts:public-key-bags/ts:public-key-bag/ts:name"; - } - description - "This typedef defines a reference to a public key bag - in the central truststore."; - } - - typedef public-key-ref { - type leafref { - path "/ts:truststore/ts:public-key-bags/ts:public-key-bag[ts:name = current()/../public-key-bag]/ts:public-key/ts:name"; - } - description - "This typedef defines a reference to a specific public key - in a public key bag in the truststore. This typedef - requires that there exist a sibling 'leaf' node called - 'public-key-bag' that SHOULD have the typedef - 'public-key-bag-ref'."; - } - - grouping certificate-ref-grouping { - description - "Grouping for the reference to a certificate in a - certificate-bag in the central truststore."; - leaf certificate-bag { - nacm:default-deny-write; - if-feature "central-truststore-supported"; - if-feature "certificates"; - type ts:certificate-bag-ref; - must "../certificate"; - description - "Reference to a certificate-bag in the truststore."; - } - leaf certificate { - nacm:default-deny-write; - type ts:certificate-ref; - must "../certificate-bag"; - description - "Reference to a specific certificate in the - referenced certificate-bag."; - } - } - - grouping public-key-ref-grouping { - description - "Grouping for the reference to a public key in a - public-key-bag in the central truststore."; - leaf public-key-bag { - nacm:default-deny-write; - if-feature "central-truststore-supported"; - if-feature "public-keys"; - type ts:public-key-bag-ref; - description - "Reference of a public key bag in the truststore inlucding - the certificate to authenticate the TLS client."; - } - leaf public-key { - nacm:default-deny-write; - type ts:public-key-ref; - description - "Reference to a specific public key in the - referenced public-key-bag."; - } - } - - grouping inline-or-truststore-certs-grouping { - description - "A grouping for the configuration of a list of certificates. - The list of certificate may be defined inline or as a - reference to a certificate bag in the central truststore. - - Servers that do not define the 'central-truststore-supported' - feature SHOULD augment in custom 'case' statements enabling - references to alternate truststore locations."; - choice inline-or-truststore { - nacm:default-deny-write; - mandatory true; - description - "A choice between an inlined definition and a definition - that exists in the truststore."; - case inline { - if-feature "inline-definitions-supported"; - container inline-definition { - description - "A container for locally configured trust anchor - certificates."; - list certificate { - key "name"; - min-elements 1; - description - "A trust anchor certificate."; - leaf name { - type string; - description - "An arbitrary name for this certificate."; - } - uses ct:trust-anchor-cert-grouping { - refine "cert-data" { - mandatory true; - } - } - } - } - } - case central-truststore { - if-feature "central-truststore-supported"; - if-feature "certificates"; - leaf central-truststore-reference { - type ts:certificate-bag-ref; - description - "A reference to a certificate bag that exists in the - central truststore."; - } - } - } - } - - grouping inline-or-truststore-public-keys-grouping { - description - "A grouping that allows the public keys to be either - configured locally, within the using data model, or be a - reference to a public key bag stored in the truststore. - - Servers that do not define the 'central-truststore-supported' - feature SHOULD augment in custom 'case' statements enabling - references to alternate truststore locations."; - choice inline-or-truststore { - nacm:default-deny-write; - mandatory true; - description - "A choice between an inlined definition and a definition - that exists in the truststore."; - case inline { - if-feature "inline-definitions-supported"; - container inline-definition { - description - "A container to hold local public key definitions."; - list public-key { - key "name"; - description - "A public key definition."; - leaf name { - type string; - description - "An arbitrary name for this public key."; - } - uses ct:public-key-grouping; - } - } - } - case central-truststore { - if-feature "central-truststore-supported"; - if-feature "public-keys"; - leaf central-truststore-reference { - type ts:public-key-bag-ref; - description - "A reference to a bag of public keys that exists - in the central truststore."; - } - } - } - } - - grouping truststore-grouping { - description - "A grouping definition that enables use in other contexts. - Where used, implementations MUST augment new 'case' - statements into the various inline-or-truststore 'choice' - statements to supply leafrefs to the model-specific - location(s)."; - container certificate-bags { - nacm:default-deny-write; - if-feature "certificates"; - description - "A collection of certificate bags."; - list certificate-bag { - key "name"; - description - "A bag of certificates. Each bag of certificates SHOULD - be for a specific purpose. For instance, one bag could - be used to authenticate a specific set of servers, while - another could be used to authenticate a specific set of - clients."; - leaf name { - type string; - description - "An arbitrary name for this bag of certificates."; - } - leaf description { - type string; - description - "A description for this bag of certificates. The - intended purpose for the bag SHOULD be described."; - } - list certificate { - key "name"; - description - "A trust anchor certificate."; - leaf name { - type string; - description - "An arbitrary name for this certificate."; - } - uses ct:trust-anchor-cert-grouping { - refine "cert-data" { - mandatory true; - } - } - } - } - } - container public-key-bags { - nacm:default-deny-write; - if-feature "public-keys"; - description - "A collection of public key bags."; - list public-key-bag { - key "name"; - description - "A bag of public keys. Each bag of keys SHOULD be for - a specific purpose. For instance, one bag could be used - authenticate a specific set of servers, while another - could be used to authenticate a specific set of clients."; - leaf name { - type string; - description - "An arbitrary name for this bag of public keys."; - } - leaf description { - type string; - description - "A description for this bag public keys. The - intended purpose for the bag SHOULD be described."; - } - list public-key { - key "name"; - description - "A public key."; - leaf name { - type string; - description - "An arbitrary name for this public key."; - } - uses ct:public-key-grouping; - } - } - } - } - - container truststore { - nacm:default-deny-write; - if-feature "central-truststore-supported"; - description - "The truststore contains bags of certificates and - public keys."; - uses truststore-grouping; - } -} diff --git a/src/confd/yang/libnetconf2.inc b/src/confd/yang/libnetconf2.inc new file mode 100644 index 00000000..4c176688 --- /dev/null +++ b/src/confd/yang/libnetconf2.inc @@ -0,0 +1,25 @@ +# -*- sh -*- +# Modules from libnetconf2 +# INFO: CHANGED FEATURE FLAGS FROM ORIGINAL: ietf-keystore and ietf-ssh-server + +MODULES=( + "iana-ssh-encryption-algs@2022-06-16.yang" + "iana-ssh-key-exchange-algs@2022-06-16.yang" + "iana-ssh-mac-algs@2022-06-16.yang" + "iana-ssh-public-key-algs@2022-06-16.yang" + "iana-tls-cipher-suite-algs@2022-06-16.yang" + "ietf-x509-cert-to-name@2014-12-10.yang" + "iana-crypt-hash@2014-04-04.yang -e crypt-hash-md5 -e crypt-hash-sha-256 -e crypt-hash-sha-512" + "ietf-crypto-types@2023-12-28.yang -e cleartext-passwords -e cleartext-private-keys" + "ietf-keystore@2023-12-28.yang -e central-keystore-supported -e asymmetric-keys" + "ietf-truststore@2023-12-28.yang -e central-truststore-supported -e certificates -e public-keys" + "ietf-tcp-common@2023-12-28.yang -e keepalives-supported" + "ietf-tcp-server@2023-12-28.yang -e tcp-server-keepalives" + "ietf-tcp-client@2023-12-28.yang -e local-binding-supported -e tcp-client-keepalives" + "ietf-ssh-common@2023-12-28.yang -e transport-params" + "ietf-ssh-server@2023-12-28.yang" + "ietf-tls-common@2023-12-28.yang -e tls10 -e tls11 -e tls12 -e tls13 -e hello-params" + "ietf-tls-server@2023-12-28.yang -e server-ident-x509-cert -e client-auth-supported -e client-auth-x509-cert" + "ietf-netconf-server@2023-12-28.yang -e ssh-listen -e tls-listen -e ssh-call-home -e tls-call-home -e central-netconf-server-supported" + "libnetconf2-netconf-server@2024-07-09.yang" +) diff --git a/src/confd/yang/netopeer2.inc b/src/confd/yang/netopeer2.inc new file mode 100644 index 00000000..3e615126 --- /dev/null +++ b/src/confd/yang/netopeer2.inc @@ -0,0 +1,15 @@ +# -*- sh -*- +# Modules from netopeer2 + +MODULES=( + "ietf-interfaces@2018-02-20.yang" + "ietf-ip@2018-02-22.yang" + "ietf-netconf@2013-09-29.yang -e writable-running -e candidate -e rollback-on-error -e validate -e startup -e url -e xpath -e confirmed-commit" + "ietf-netconf-nmda@2019-01-07.yang -e origin -e with-defaults" + "notifications@2008-07-14.yang" + "nc-notifications@2008-07-14.yang" + "ietf-netconf-monitoring@2010-10-04.yang" + "ietf-network-instance@2019-01-21.yang" + "ietf-subscribed-notifications@2019-09-09.yang -e encode-xml -e replay -e subtree -e xpath" + "ietf-yang-push@2019-09-09.yang -e on-change" +) diff --git a/src/confd/yang/rousette.inc b/src/confd/yang/rousette.inc new file mode 100644 index 00000000..ce51a754 --- /dev/null +++ b/src/confd/yang/rousette.inc @@ -0,0 +1,5 @@ +MODULES=( + "ietf-restconf@2017-01-26.yang" + "ietf-yang-patch@2017-02-22.yang" + "ietf-restconf-monitoring@2017-01-26.yang" +) \ No newline at end of file diff --git a/src/confd/yang/rousette/Makefile.am b/src/confd/yang/rousette/Makefile.am new file mode 100644 index 00000000..42519ffb --- /dev/null +++ b/src/confd/yang/rousette/Makefile.am @@ -0,0 +1,2 @@ +yangdir = $(YANGDIR)/rousette +yang_DATA = $(wildcard *@*.yang) diff --git a/src/confd/yang/ietf-restconf-monitoring@2017-01-26.yang b/src/confd/yang/rousette/ietf-restconf-monitoring@2017-01-26.yang similarity index 100% rename from src/confd/yang/ietf-restconf-monitoring@2017-01-26.yang rename to src/confd/yang/rousette/ietf-restconf-monitoring@2017-01-26.yang diff --git a/src/confd/yang/ietf-restconf@2017-01-26.yang b/src/confd/yang/rousette/ietf-restconf@2017-01-26.yang similarity index 100% rename from src/confd/yang/ietf-restconf@2017-01-26.yang rename to src/confd/yang/rousette/ietf-restconf@2017-01-26.yang diff --git a/src/confd/yang/ietf-yang-patch@2017-02-22.yang b/src/confd/yang/rousette/ietf-yang-patch@2017-02-22.yang similarity index 100% rename from src/confd/yang/ietf-yang-patch@2017-02-22.yang rename to src/confd/yang/rousette/ietf-yang-patch@2017-02-22.yang diff --git a/src/confd/yang/sysrepo.inc b/src/confd/yang/sysrepo.inc new file mode 100644 index 00000000..1fcbf1b7 --- /dev/null +++ b/src/confd/yang/sysrepo.inc @@ -0,0 +1,30 @@ +# -*- sh -*- +# Modules from sysrepo + +MODULES=( + "sysrepo@2024-10-25.yang" + "sysrepo-factory-default@2024-05-02.yang" + "sysrepo-monitoring@2023-08-11.yang" + "sysrepo-notifications@2025-01-10.yang" + "sysrepo-plugind@2022-08-26.yang" + + "ietf-datastores@2018-02-14.yang" + "ietf-factory-default@2020-08-31.yang" + "ietf-netconf@2013-09-29.yang" + "ietf-netconf-acm@2018-02-14.yang" + "ietf-netconf-notifications@2012-02-06.yang" + "ietf-netconf-with-defaults@2011-06-01.yang" + "ietf-origin@2018-02-14.yang" + "ietf-yang-library@2016-06-21.yang" + "ietf-yang-library@2019-01-04.yang" + + + "iana-if-type@2014-05-08.yang" + "ietf-interfaces@2018-02-20.yang" + "ietf-ip@2018-02-22.yang" + "ietf-network-instance@2019-01-21.yang" + "ietf-restconf@2017-01-26.yang" + "ietf-subscribed-notifications@2019-09-09.yang" + "ietf-yang-patch@2017-02-22.yang" + "ietf-yang-push@2019-09-09.yang" +) diff --git a/src/confd/yang/test-mode.inc b/src/confd/yang/test-mode.inc new file mode 100644 index 00000000..41fe1556 --- /dev/null +++ b/src/confd/yang/test-mode.inc @@ -0,0 +1,5 @@ +# -*- sh -*- + +MODULES=( + "infix-test@2024-08-16.yang" +) diff --git a/src/confd/yang/test-mode/Makefile.am b/src/confd/yang/test-mode/Makefile.am new file mode 100644 index 00000000..4cd834fa --- /dev/null +++ b/src/confd/yang/test-mode/Makefile.am @@ -0,0 +1,2 @@ +yangdir = $(YANGDIR)/test-mode +yang_DATA = $(wildcard *@*.yang) diff --git a/src/test-mode/yang/infix-test@2024-08-16.yang b/src/confd/yang/test-mode/infix-test@2024-08-16.yang similarity index 100% rename from src/test-mode/yang/infix-test@2024-08-16.yang rename to src/confd/yang/test-mode/infix-test@2024-08-16.yang diff --git a/src/test-mode/Makefile.am b/src/test-mode/Makefile.am index 226487df..2f89caf5 100644 --- a/src/test-mode/Makefile.am +++ b/src/test-mode/Makefile.am @@ -1,4 +1,4 @@ -SUBDIRS = src yang +SUBDIRS = src dist_doc_DATA = LICENSE DISTCLEANFILES = *~ *.d ACLOCAL_AMFLAGS = -I m4 diff --git a/src/test-mode/configure.ac b/src/test-mode/configure.ac index accdfc92..71280daa 100644 --- a/src/test-mode/configure.ac +++ b/src/test-mode/configure.ac @@ -6,7 +6,6 @@ AM_SILENT_RULES(yes) AC_CONFIG_FILES([ Makefile src/Makefile - yang/Makefile ]) AC_PROG_CC diff --git a/src/test-mode/yang/Makefile.am b/src/test-mode/yang/Makefile.am deleted file mode 100644 index 3e287aca..00000000 --- a/src/test-mode/yang/Makefile.am +++ /dev/null @@ -1,2 +0,0 @@ -yangdir = $(YANGDIR) -yang_DATA = $(wildcard *.yang) diff --git a/src/test-mode/yang/test-mode.inc b/src/test-mode/yang/test-mode.inc deleted file mode 100644 index 37999bf5..00000000 --- a/src/test-mode/yang/test-mode.inc +++ /dev/null @@ -1,4 +0,0 @@ -# -*- sh -*- -MODULES=( - "infix-test@2024-08-16.yang" -)