Merging upstream version 3.5.5 (Closes: #1098233).
Signed-off-by: Daniel Baumann <daniel@debian.org>
This commit is contained in:
parent
c86ae7dcba
commit
6af28b7e8e
GPG key ID:
FBB4F0E80A80222F
144 changed files with 43534 additions and 11497 deletions
391
modules/ietf-truststore@2023-12-28.yang
Normal file
391
modules/ietf-truststore@2023-12-28.yang
Normal file
|
|
@ -0,0 +1,391 @@
|
|||
module ietf-truststore {
|
||||
yang-version 1.1;
|
||||
namespace "urn:ietf:params:xml:ns:yang:ietf-truststore";
|
||||
prefix ts;
|
||||
|
||||
import ietf-netconf-acm {
|
||||
prefix nacm;
|
||||
reference
|
||||
"RFC 8341: Network Configuration Access Control Model";
|
||||
}
|
||||
|
||||
import ietf-crypto-types {
|
||||
prefix ct;
|
||||
reference
|
||||
"RFC AAAA: YANG Data Types and Groupings for Cryptography";
|
||||
}
|
||||
|
||||
organization
|
||||
"IETF NETCONF (Network Configuration) Working Group";
|
||||
|
||||
contact
|
||||
"WG Web : https://datatracker.ietf.org/wg/netconf
|
||||
WG List : NETCONF WG list <mailto:netconf@ietf.org>
|
||||
Author : Kent Watsen <kent+ietf@watsen.net>";
|
||||
|
||||
description
|
||||
"This module defines a 'truststore' to centralize management
|
||||
of trust anchors including certificates and public keys.
|
||||
|
||||
Copyright (c) 2023 IETF Trust and the persons identified
|
||||
as authors of the code. All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with
|
||||
or without modification, is permitted pursuant to, and
|
||||
subject to the license terms contained in, the Revised
|
||||
BSD License set forth in Section 4.c of the IETF Trust's
|
||||
Legal Provisions Relating to IETF Documents
|
||||
(https://trustee.ietf.org/license-info).
|
||||
|
||||
This version of this YANG module is part of RFC BBBB
|
||||
(https://www.rfc-editor.org/info/rfcBBBB); see the RFC
|
||||
itself for full legal notices.
|
||||
|
||||
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
|
||||
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
|
||||
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
|
||||
are to be interpreted as described in BCP 14 (RFC 2119)
|
||||
(RFC 8174) when, and only when, they appear in all
|
||||
capitals, as shown here.";
|
||||
|
||||
revision 2023-12-28 {
|
||||
description
|
||||
"Initial version";
|
||||
reference
|
||||
"RFC BBBB: A YANG Data Model for a Truststore";
|
||||
}
|
||||
|
||||
/****************/
|
||||
/* Features */
|
||||
/****************/
|
||||
|
||||
feature central-truststore-supported {
|
||||
description
|
||||
"The 'central-truststore-supported' feature indicates that
|
||||
the server supports the truststore (i.e., implements the
|
||||
'ietf-truststore' module).";
|
||||
}
|
||||
|
||||
feature inline-definitions-supported {
|
||||
description
|
||||
"The 'inline-definitions-supported' feature indicates that
|
||||
the server supports locally-defined trust anchors.";
|
||||
}
|
||||
|
||||
feature certificates {
|
||||
description
|
||||
"The 'certificates' feature indicates that the server
|
||||
implements the /truststore/certificate-bags subtree.";
|
||||
}
|
||||
|
||||
feature public-keys {
|
||||
description
|
||||
"The 'public-keys' feature indicates that the server
|
||||
implements the /truststore/public-key-bags subtree.";
|
||||
}
|
||||
|
||||
/****************/
|
||||
/* Typedefs */
|
||||
/****************/
|
||||
|
||||
typedef certificate-bag-ref {
|
||||
type leafref {
|
||||
path "/ts:truststore/ts:certificate-bags/"
|
||||
+ "ts:certificate-bag/ts:name";
|
||||
}
|
||||
description
|
||||
"This typedef defines a reference to a certificate bag
|
||||
in the central truststore.";
|
||||
}
|
||||
|
||||
typedef certificate-ref {
|
||||
type leafref {
|
||||
path "/ts:truststore/ts:certificate-bags/ts:certificate-bag"
|
||||
+ "[ts:name = current()/../certificate-bag]/"
|
||||
+ "ts:certificate/ts:name";
|
||||
}
|
||||
description
|
||||
"This typedef defines a reference to a specific certificate
|
||||
in a certificate bag in the central truststore. This typedef
|
||||
requires that there exist a sibling 'leaf' node called
|
||||
'certificate-bag' that SHOULD have the typedef
|
||||
'certificate-bag-ref'.";
|
||||
}
|
||||
|
||||
typedef public-key-bag-ref {
|
||||
type leafref {
|
||||
path "/ts:truststore/ts:public-key-bags/"
|
||||
+ "ts:public-key-bag/ts:name";
|
||||
}
|
||||
description
|
||||
"This typedef defines a reference to a public key bag
|
||||
in the central truststore.";
|
||||
}
|
||||
|
||||
typedef public-key-ref {
|
||||
type leafref {
|
||||
path "/ts:truststore/ts:public-key-bags/ts:public-key-bag"
|
||||
+ "[ts:name = current()/../public-key-bag]/"
|
||||
+ "ts:public-key/ts:name";
|
||||
}
|
||||
description
|
||||
"This typedef defines a reference to a specific public key
|
||||
in a public key bag in the truststore. This typedef
|
||||
requires that there exist a sibling 'leaf' node called
|
||||
'public-key-bag' that SHOULD have the typedef
|
||||
'public-key-bag-ref'.";
|
||||
}
|
||||
|
||||
/*****************/
|
||||
/* Groupings */
|
||||
/*****************/
|
||||
|
||||
// *-ref groupings
|
||||
|
||||
grouping certificate-ref-grouping {
|
||||
description
|
||||
"Grouping for the reference to a certificate in a
|
||||
certificate-bag in the central truststore.";
|
||||
leaf certificate-bag {
|
||||
nacm:default-deny-write;
|
||||
if-feature "central-truststore-supported";
|
||||
if-feature "certificates";
|
||||
type ts:certificate-bag-ref;
|
||||
must "../certificate";
|
||||
description
|
||||
"Reference to a certificate-bag in the truststore.";
|
||||
}
|
||||
leaf certificate {
|
||||
nacm:default-deny-write;
|
||||
type ts:certificate-ref;
|
||||
must "../certificate-bag";
|
||||
description
|
||||
"Reference to a specific certificate in the
|
||||
referenced certificate-bag.";
|
||||
}
|
||||
}
|
||||
|
||||
grouping public-key-ref-grouping {
|
||||
description
|
||||
"Grouping for the reference to a public key in a
|
||||
public-key-bag in the central truststore.";
|
||||
leaf public-key-bag {
|
||||
nacm:default-deny-write;
|
||||
if-feature "central-truststore-supported";
|
||||
if-feature "public-keys";
|
||||
type ts:public-key-bag-ref;
|
||||
description
|
||||
"Reference of a public key bag in the truststore inlucding
|
||||
the certificate to authenticate the TLS client.";
|
||||
}
|
||||
leaf public-key {
|
||||
nacm:default-deny-write;
|
||||
type ts:public-key-ref;
|
||||
description
|
||||
"Reference to a specific public key in the
|
||||
referenced public-key-bag.";
|
||||
}
|
||||
}
|
||||
|
||||
// inline-or-truststore-* groupings
|
||||
|
||||
grouping inline-or-truststore-certs-grouping {
|
||||
description
|
||||
"A grouping for the configuration of a list of certificates.
|
||||
The list of certificate may be defined inline or as a
|
||||
reference to a certificate bag in the central truststore.
|
||||
|
||||
Servers that do not define the 'central-truststore-supported'
|
||||
feature SHOULD augment in custom 'case' statements enabling
|
||||
references to alternate truststore locations.";
|
||||
choice inline-or-truststore {
|
||||
nacm:default-deny-write;
|
||||
mandatory true;
|
||||
description
|
||||
"A choice between an inlined definition and a definition
|
||||
that exists in the truststore.";
|
||||
case inline {
|
||||
if-feature "inline-definitions-supported";
|
||||
container inline-definition {
|
||||
description
|
||||
"A container for locally configured trust anchor
|
||||
certificates.";
|
||||
list certificate {
|
||||
key "name";
|
||||
min-elements 1;
|
||||
description
|
||||
"A trust anchor certificate.";
|
||||
leaf name {
|
||||
type string;
|
||||
description
|
||||
"An arbitrary name for this certificate.";
|
||||
}
|
||||
uses ct:trust-anchor-cert-grouping {
|
||||
refine "cert-data" {
|
||||
mandatory true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
case central-truststore {
|
||||
if-feature "central-truststore-supported";
|
||||
if-feature "certificates";
|
||||
leaf central-truststore-reference {
|
||||
type ts:certificate-bag-ref;
|
||||
description
|
||||
"A reference to a certificate bag that exists in the
|
||||
central truststore.";
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
grouping inline-or-truststore-public-keys-grouping {
|
||||
description
|
||||
"A grouping that allows the public keys to be either
|
||||
configured locally, within the using data model, or be a
|
||||
reference to a public key bag stored in the truststore.
|
||||
|
||||
Servers that do not define the 'central-truststore-supported'
|
||||
feature SHOULD augment in custom 'case' statements enabling
|
||||
references to alternate truststore locations.";
|
||||
choice inline-or-truststore {
|
||||
nacm:default-deny-write;
|
||||
mandatory true;
|
||||
description
|
||||
"A choice between an inlined definition and a definition
|
||||
that exists in the truststore.";
|
||||
case inline {
|
||||
if-feature "inline-definitions-supported";
|
||||
container inline-definition {
|
||||
description
|
||||
"A container to hold local public key definitions.";
|
||||
list public-key {
|
||||
key "name";
|
||||
description
|
||||
"A public key definition.";
|
||||
leaf name {
|
||||
type string;
|
||||
description
|
||||
"An arbitrary name for this public key.";
|
||||
}
|
||||
uses ct:public-key-grouping;
|
||||
}
|
||||
}
|
||||
}
|
||||
case central-truststore {
|
||||
if-feature "central-truststore-supported";
|
||||
if-feature "public-keys";
|
||||
leaf central-truststore-reference {
|
||||
type ts:public-key-bag-ref;
|
||||
description
|
||||
"A reference to a bag of public keys that exists
|
||||
in the central truststore.";
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// the truststore grouping
|
||||
|
||||
grouping truststore-grouping {
|
||||
description
|
||||
"A grouping definition that enables use in other contexts.
|
||||
Where used, implementations MUST augment new 'case'
|
||||
statements into the various inline-or-truststore 'choice'
|
||||
statements to supply leafrefs to the model-specific
|
||||
location(s).";
|
||||
container certificate-bags {
|
||||
nacm:default-deny-write;
|
||||
if-feature "certificates";
|
||||
description
|
||||
"A collection of certificate bags.";
|
||||
list certificate-bag {
|
||||
key "name";
|
||||
description
|
||||
"A bag of certificates. Each bag of certificates SHOULD
|
||||
be for a specific purpose. For instance, one bag could
|
||||
be used to authenticate a specific set of servers, while
|
||||
another could be used to authenticate a specific set of
|
||||
clients.";
|
||||
leaf name {
|
||||
type string;
|
||||
description
|
||||
"An arbitrary name for this bag of certificates.";
|
||||
}
|
||||
leaf description {
|
||||
type string;
|
||||
description
|
||||
"A description for this bag of certificates. The
|
||||
intended purpose for the bag SHOULD be described.";
|
||||
}
|
||||
list certificate {
|
||||
key "name";
|
||||
description
|
||||
"A trust anchor certificate.";
|
||||
leaf name {
|
||||
type string;
|
||||
description
|
||||
"An arbitrary name for this certificate.";
|
||||
}
|
||||
uses ct:trust-anchor-cert-grouping {
|
||||
refine "cert-data" {
|
||||
mandatory true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
container public-key-bags {
|
||||
nacm:default-deny-write;
|
||||
if-feature "public-keys";
|
||||
description
|
||||
"A collection of public key bags.";
|
||||
list public-key-bag {
|
||||
key "name";
|
||||
description
|
||||
"A bag of public keys. Each bag of keys SHOULD be for
|
||||
a specific purpose. For instance, one bag could be used
|
||||
authenticate a specific set of servers, while another
|
||||
could be used to authenticate a specific set of clients.";
|
||||
leaf name {
|
||||
type string;
|
||||
description
|
||||
"An arbitrary name for this bag of public keys.";
|
||||
}
|
||||
leaf description {
|
||||
type string;
|
||||
description
|
||||
"A description for this bag public keys. The
|
||||
intended purpose for the bag SHOULD be described.";
|
||||
}
|
||||
list public-key {
|
||||
key "name";
|
||||
description
|
||||
"A public key.";
|
||||
leaf name {
|
||||
type string;
|
||||
description
|
||||
"An arbitrary name for this public key.";
|
||||
}
|
||||
uses ct:public-key-grouping;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*********************************/
|
||||
/* Protocol accessible nodes */
|
||||
/*********************************/
|
||||
|
||||
container truststore {
|
||||
if-feature central-truststore-supported;
|
||||
nacm:default-deny-write;
|
||||
description
|
||||
"The truststore contains bags of certificates and
|
||||
public keys.";
|
||||
uses truststore-grouping;
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue