draft-ietf-netmod-ip-cfg-03.txt | draft-ietf-netmod-ip-cfg-04.txt | |||
---|---|---|---|---|
Network Working Group M. Bjorklund | Network Working Group M. Bjorklund | |||
Internet-Draft Tail-f Systems | Internet-Draft Tail-f Systems | |||
Intended status: Standards Track April 29, 2012 | Intended status: Standards Track July 14, 2012 | |||
Expires: October 31, 2012 | Expires: January 15, 2013 | |||
A YANG Data Model for IP Configuration | A YANG Data Model for IP Configuration | |||
draft-ietf-netmod-ip-cfg-03 | draft-ietf-netmod-ip-cfg-04 | |||
Abstract | Abstract | |||
This document defines a YANG data model for configuration of IP | This document defines a YANG data model for configuration of IP | |||
implementations. | implementations. | |||
Status of this Memo | Status of this Memo | |||
This Internet-Draft is submitted in full conformance with the | This Internet-Draft is submitted in full conformance with the | |||
provisions of BCP 78 and BCP 79. | provisions of BCP 78 and BCP 79. | |||
skipping to change at page 1, line 31 | skipping to change at page 1, line 31 | |||
Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
Drafts is at http://datatracker.ietf.org/drafts/current/. | Drafts is at http://datatracker.ietf.org/drafts/current/. | |||
Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
This Internet-Draft will expire on October 31, 2012. | This Internet-Draft will expire on January 15, 2013. | |||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2012 IETF Trust and the persons identified as the | Copyright (c) 2012 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
(http://trustee.ietf.org/license-info) in effect on the date of | (http://trustee.ietf.org/license-info) in effect on the date of | |||
publication of this document. Please review these documents | publication of this document. Please review these documents | |||
skipping to change at page 2, line 10 | skipping to change at page 2, line 10 | |||
to this document. Code Components extracted from this document must | to this document. Code Components extracted from this document must | |||
include Simplified BSD License text as described in Section 4.e of | include Simplified BSD License text as described in Section 4.e of | |||
the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
described in the Simplified BSD License. | described in the Simplified BSD License. | |||
Table of Contents | Table of Contents | |||
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 | |||
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 | 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 | |||
2. IP Data Model . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. IP Data Model . . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
3. Relationship to IP-MIB . . . . . . . . . . . . . . . . . . . . 5 | 3. Relationship to IP-MIB . . . . . . . . . . . . . . . . . . . . 6 | |||
4. IP configuration YANG Module . . . . . . . . . . . . . . . . . 6 | 4. IP configuration YANG Module . . . . . . . . . . . . . . . . . 7 | |||
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 | 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13 | |||
6. Security Considerations . . . . . . . . . . . . . . . . . . . 13 | 6. Security Considerations . . . . . . . . . . . . . . . . . . . 14 | |||
7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 14 | 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 15 | |||
7.1. Normative References . . . . . . . . . . . . . . . . . . . 14 | 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 16 | |||
7.2. Informative References . . . . . . . . . . . . . . . . . . 14 | 8.1. Normative References . . . . . . . . . . . . . . . . . . . 16 | |||
Appendix A. Example: NETCONF <get> reply . . . . . . . . . . . . 15 | 8.2. Informative References . . . . . . . . . . . . . . . . . . 16 | |||
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 16 | Appendix A. Example: NETCONF <get> reply . . . . . . . . . . . . 18 | |||
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 19 | ||||
1. Introduction | 1. Introduction | |||
This document defines a YANG [RFC6020] data model for configuration | This document defines a YANG [RFC6020] data model for configuration | |||
of IP implementations. | of IP implementations. | |||
The initial version of this data model focuses on configuration | ||||
parameters for interfaces. Future revisions of this data model might | ||||
add other kinds of IP configuration parameters. | ||||
Configuration parameters to control IP routing are defined in | ||||
[I-D.ietf-netmod-routing-cfg]. | ||||
1.1. Terminology | 1.1. Terminology | |||
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | |||
"OPTIONAL" in this document are to be interpreted as described in BCP | "OPTIONAL" in this document are to be interpreted as described in BCP | |||
14, [RFC2119]. | 14, [RFC2119]. | |||
The following terms are defined in [RFC6241] and are not redefined | The following terms are defined in [RFC6241] and are not redefined | |||
here: | here: | |||
skipping to change at page 4, line 9 | skipping to change at page 4, line 9 | |||
o augment | o augment | |||
o data model | o data model | |||
o data node | o data node | |||
2. IP Data Model | 2. IP Data Model | |||
The module "ietf-ip" augments the "interface" list defined in the | The module "ietf-ip" augments the "interface" list defined in the | |||
"ietf-interfaces" module [I-D.ietf-netmod-interfaces-cfg] with the | "ietf-interfaces" module [I-D.ietf-netmod-interfaces-cfg] with the | |||
following nodes, where square brackets are used to enclose a list's | following data nodes, where square brackets are used to enclose a | |||
keys, and "?" means that the node is optional. Choice and case nodes | list's keys, and "?" means that the node is optional. Choice and | |||
are enclosed in parenthesis, and a case node is marked with a colon | case nodes are enclosed in parenthesis, and a case node is marked | |||
(":"). | with a colon (":"). | |||
+--rw if:interfaces | +--rw if:interfaces | |||
+--rw if:interface [name] | +--rw if:interface [name] | |||
... | ... | |||
+--rw ipv4 | +--rw ipv4 | |||
| +--rw enabled? boolean | | +--rw enabled? boolean | |||
| +--rw ip-forwarding? boolean | | +--rw ip-forwarding? boolean | |||
| +--rw address [ip] | | +--rw address [ip] | |||
| | +--rw ip inet:ipv4-address | ||||
| | +--rw (subnet)? | ||||
| | +--:(prefix-length) | ||||
| | | +--rw ip:prefix-length? uint8 | ||||
| | +--:(netmask) | ||||
| | +--rw ip:netmask? inet:ipv4-address | ||||
| +--rw neighbor [ip] | ||||
| +--rw ip inet:ipv4-address | | +--rw ip inet:ipv4-address | |||
| +--rw (subnet)? | | +--rw phys-address? yang:phys-address | |||
| +--:(prefix-length) | ||||
| | +--rw ip:prefix-length? uint8 | ||||
| +--:(netmask) | ||||
| +--rw ip:netmask? inet:ipv4-address | ||||
+--rw ipv6 | +--rw ipv6 | |||
+--rw enabled? boolean | +--rw enabled? boolean | |||
| +--rw ip-forwarding? boolean | +--rw ip-forwarding? boolean | |||
+--rw address [ip] | +--rw address [ip] | |||
| +--rw ip inet:ipv6-address | | +--rw ip inet:ipv6-address | |||
| +--rw prefix-length? uint8 | | +--rw prefix-length? uint8 | |||
+--rw neighbor [ip] | ||||
| +--rw ip inet:ipv6-address | ||||
| +--rw phys-address? yang:phys-address | ||||
+--rw dup-addr-detect-transmits? uint32 | +--rw dup-addr-detect-transmits? uint32 | |||
+--rw autoconf | +--rw autoconf | |||
+--rw create-global-addresses? boolean | +--rw create-global-addresses? boolean | |||
+--rw create-temporary-addressed? boolean | +--rw create-temporary-addresses? boolean | |||
+--rw temporary-valid-lifetime? uint32 | +--rw temporary-valid-lifetime? uint32 | |||
+--rw temporary-preferred-lifetime? uint32 | +--rw temporary-preferred-lifetime? uint32 | |||
The data model defines two containers, "ipv4" and "ipv6", | The data model defines two containers, "ipv4" and "ipv6", | |||
representing the IPv4 and IPv6 address families. In each container, | representing the IPv4 and IPv6 address families. In each container, | |||
there is a leaf "enabled" that controls if the address family is | there is a leaf "enabled" that controls if the address family is | |||
enabled on that interface, and a leaf "ip-forwarding" that controls | enabled on that interface, and a leaf "ip-forwarding" that controls | |||
if ip packet forwarding for the address family is enabled on the | if ip packet forwarding for the address family is enabled on the | |||
interface. In each container, there is also a list of manually | interface. In each container, there is also a list of manually | |||
configured addresses. | configured addresses, and a list of manually configured mappings from | |||
ip addresses to physical addresses. | ||||
Configuration parameters to control IP routing are defined in | ||||
[I-D.ietf-netmod-routing-cfg]. | ||||
3. Relationship to IP-MIB | 3. Relationship to IP-MIB | |||
If the device implements IP-MIB [RFC4293], each entry in the "ipv4/ | If the device implements IP-MIB [RFC4293], each entry in the "ipv4/ | |||
address" and "ipv6/address" lists is mapped to one ipAddressEntry, | address" and "ipv6/address" lists is mapped to one ipAddressEntry, | |||
where the ipAddressIfIndex refers to the interface where the | where the ipAddressIfIndex refers to the interface where the | |||
"address" entry is configured. | "address" entry is configured. | |||
The IP-MIB defines objects to control IPv6 Router Advertisement. The | The IP-MIB defines objects to control IPv6 Router Advertisement. The | |||
corresponding YANG nodes are defined in | corresponding YANG data nodes are defined in | |||
[I-D.ietf-netmod-routing-cfg]. | [I-D.ietf-netmod-routing-cfg]. | |||
The objects ipNetToPhysicalTable and ipAddressStatus are writable in | The entries in "ipv4/neighbor" and "ipv6/neighbor" are mapped to | |||
the IP-MIB but do not represent configuration, and are thus not | ipNetToPhysicalTable. | |||
mapped to the YANG module. | ||||
The following table lists the YANG nodes with corresponding objects | The object ipAddressStatus is writable in the IP-MIB but does not | |||
in the IP-MIB. | represent configuration, and is thus not mapped to the YANG module. | |||
The following table lists the YANG data nodes with corresponding | ||||
objects in the IP-MIB. | ||||
+--------------------+-----------------------------------+ | +--------------------+-----------------------------------+ | |||
| YANG node | IP-MIB object | | | YANG data node | IP-MIB object | | |||
+--------------------+-----------------------------------+ | +--------------------+-----------------------------------+ | |||
| ipv4/enabled | ipv4InterfaceEnableStatus | | | ipv4/enabled | ipv4InterfaceEnableStatus | | |||
| ipv4/address | ipAddressEntry | | | ipv4/address | ipAddressEntry | | |||
| ipv4/address/ip | ipAddressAddrType / ipAddressAddr | | | ipv4/address/ip | ipAddressAddrType / ipAddressAddr | | |||
| ipv4/neighbor | ipNetToPhysicalTable | | ||||
| ipv6/enabled | ipv6InterfaceEnableStatus | | | ipv6/enabled | ipv6InterfaceEnableStatus | | |||
| ipv6/ip-forwarding | ipv6InterfaceForwarding | | | ipv6/ip-forwarding | ipv6InterfaceForwarding | | |||
| ipv6/address | ipAddressEntry | | | ipv6/address | ipAddressEntry | | |||
| ipv6/address/ip | ipAddressAddrType / ipAddressAddr | | | ipv6/address/ip | ipAddressAddrType / ipAddressAddr | | |||
| ipv6/neighbor | ipNetToPhysicalTable | | ||||
+--------------------+-----------------------------------+ | +--------------------+-----------------------------------+ | |||
Mapping of YANG nodes to IP-MIB objects | Mapping of YANG data nodes to IP-MIB objects | |||
4. IP configuration YANG Module | 4. IP configuration YANG Module | |||
This module imports typedefs from [RFC6021] and | This module imports typedefs from [RFC6021] and | |||
[I-D.ietf-netmod-interfaces-cfg], and references [RFC4861] and | [I-D.ietf-netmod-interfaces-cfg], and references [RFC0826], [RFC4861] | |||
[RFC4862]. | and [RFC4862]. | |||
RFC Ed.: update the date below with the date of RFC publication and | RFC Ed.: update the date below with the date of RFC publication and | |||
remove this note. | remove this note. | |||
<CODE BEGINS> file "ietf-ip@2012-04-29.yang" | <CODE BEGINS> file "ietf-ip@2012-07-14.yang" | |||
module ietf-ip { | module ietf-ip { | |||
namespace "urn:ietf:params:xml:ns:yang:ietf-ip"; | namespace "urn:ietf:params:xml:ns:yang:ietf-ip"; | |||
prefix ip; | prefix ip; | |||
import ietf-interfaces { | import ietf-interfaces { | |||
prefix if; | prefix if; | |||
} | } | |||
import ietf-inet-types { | import ietf-inet-types { | |||
prefix inet; | prefix inet; | |||
} | } | |||
import ietf-yang-types { | ||||
prefix yang; | ||||
} | ||||
organization | organization | |||
"IETF NETMOD (NETCONF Data Modeling Language) Working Group"; | "IETF NETMOD (NETCONF Data Modeling Language) Working Group"; | |||
contact | contact | |||
"WG Web: <http://tools.ietf.org/wg/netmod/> | "WG Web: <http://tools.ietf.org/wg/netmod/> | |||
WG List: <mailto:netmod@ietf.org> | WG List: <mailto:netmod@ietf.org> | |||
WG Chair: David Kessens | WG Chair: David Kessens | |||
<mailto:david.kessens@nsn.com> | <mailto:david.kessens@nsn.com> | |||
skipping to change at page 6, line 48 | skipping to change at page 7, line 51 | |||
WG Chair: Juergen Schoenwaelder | WG Chair: Juergen Schoenwaelder | |||
<mailto:j.schoenwaelder@jacobs-university.de> | <mailto:j.schoenwaelder@jacobs-university.de> | |||
Editor: Martin Bjorklund | Editor: Martin Bjorklund | |||
<mailto:mbj@tail-f.com>"; | <mailto:mbj@tail-f.com>"; | |||
description | description | |||
"This module contains a collection of YANG definitions for | "This module contains a collection of YANG definitions for | |||
configuring IP implementations. | configuring IP implementations. | |||
Copyright (c) 2011 IETF Trust and the persons identified as | Copyright (c) 2012 IETF Trust and the persons identified as | |||
authors of the code. All rights reserved. | authors of the code. All rights reserved. | |||
Redistribution and use in source and binary forms, with or | Redistribution and use in source and binary forms, with or | |||
without modification, is permitted pursuant to, and subject | without modification, is permitted pursuant to, and subject | |||
to the license terms contained in, the Simplified BSD License | to the license terms contained in, the Simplified BSD License | |||
set forth in Section 4.c of the IETF Trust's Legal Provisions | set forth in Section 4.c of the IETF Trust's Legal Provisions | |||
Relating to IETF Documents | Relating to IETF Documents | |||
(http://trustee.ietf.org/license-info). | (http://trustee.ietf.org/license-info). | |||
This version of this YANG module is part of RFC XXXX; see | This version of this YANG module is part of RFC XXXX; see | |||
the RFC itself for full legal notices."; | the RFC itself for full legal notices."; | |||
// RFC Ed.: replace XXXX with actual RFC number and remove this | // RFC Ed.: replace XXXX with actual RFC number and remove this | |||
// note. | // note. | |||
// RFC Ed.: update the date below with the date of RFC publication | // RFC Ed.: update the date below with the date of RFC publication | |||
// and remove this note. | // and remove this note. | |||
revision 2012-04-29 { | revision 2012-07-14 { | |||
description | description | |||
"Initial revision."; | "Initial revision."; | |||
reference | reference | |||
"RFC XXXX: A YANG Data Model for IP Configuration"; | "RFC XXXX: A YANG Data Model for IP Configuration"; | |||
} | } | |||
/* Features */ | /* Features */ | |||
feature non-contiguous-netmasks { | feature non-contiguous-netmasks { | |||
description | description | |||
skipping to change at page 8, line 45 | skipping to change at page 9, line 48 | |||
"The length of the subnet prefix."; | "The length of the subnet prefix."; | |||
} | } | |||
leaf netmask { | leaf netmask { | |||
if-feature non-contiguous-netmasks; | if-feature non-contiguous-netmasks; | |||
type inet:ipv4-address; | type inet:ipv4-address; | |||
description | description | |||
"The subnet specified as a netmask."; | "The subnet specified as a netmask."; | |||
} | } | |||
} | } | |||
} | } | |||
list neighbor { | ||||
key "ip"; | ||||
description | ||||
"A list of manually configured mappings from IPv4 | ||||
addresses to physical addresses. | ||||
Entries in this list are used as static entries in the | ||||
ARP cache."; | ||||
reference | ||||
"RFC 826: An Ethernet Address Resolution Protocol"; | ||||
leaf ip { | ||||
type inet:ipv4-address; | ||||
description | ||||
"The IPv4 address of a neighbor node."; | ||||
} | ||||
leaf phys-address { | ||||
type yang:phys-address; | ||||
} | ||||
} | ||||
} | } | |||
container ipv6 { | container ipv6 { | |||
description | description | |||
"Parameters for the IPv6 address family."; | "Parameters for the IPv6 address family."; | |||
leaf enabled { | leaf enabled { | |||
type boolean; | type boolean; | |||
default true; | default true; | |||
description | description | |||
"Controls if IPv6 is enabled or disabled on this | "Controls if IPv6 is enabled or disabled on this | |||
skipping to change at page 9, line 39 | skipping to change at page 11, line 13 | |||
} | } | |||
leaf prefix-length { | leaf prefix-length { | |||
type uint8 { | type uint8 { | |||
range "0..128"; | range "0..128"; | |||
} | } | |||
default 128; | default 128; | |||
description | description | |||
"The length of the subnet prefix."; | "The length of the subnet prefix."; | |||
} | } | |||
} | } | |||
list neighbor { | ||||
key "ip"; | ||||
description | ||||
"A list of manually configured mappings from IPv6 | ||||
addresses to physical addresses. | ||||
Entries in this list are used as static entries in the | ||||
Neighbor Cache."; | ||||
reference | ||||
"RFC 4861: Neighbor Discovery for IP version 6 (IPv6)"; | ||||
leaf ip { | ||||
type inet:ipv6-address; | ||||
} | ||||
leaf phys-address { | ||||
type yang:phys-address; | ||||
} | ||||
} | ||||
leaf dup-addr-detect-transmits { | leaf dup-addr-detect-transmits { | |||
type uint32; | type uint32; | |||
default 1; | default 1; | |||
description | description | |||
"The number of consecutive Neighbor Solicitation messages | "The number of consecutive Neighbor Solicitation messages | |||
sent while performing Duplicate Address Detection on a | sent while performing Duplicate Address Detection on a | |||
tentative address. A value of zero indicates that | tentative address. A value of zero indicates that | |||
Duplicate Address Detection is not performed on | Duplicate Address Detection is not performed on | |||
tentative addresses. A value of one indicates a single | tentative addresses. A value of one indicates a single | |||
transmission with no follow-up retransmissions."; | transmission with no follow-up retransmissions."; | |||
skipping to change at page 10, line 20 | skipping to change at page 12, line 12 | |||
leaf create-global-addresses { | leaf create-global-addresses { | |||
type boolean; | type boolean; | |||
default true; | default true; | |||
description | description | |||
"If enabled, the host creates global addresses as | "If enabled, the host creates global addresses as | |||
described in section 5.5 of RFC 4862."; | described in section 5.5 of RFC 4862."; | |||
reference | reference | |||
"RFC 4862: IPv6 Stateless Address Autoconfiguration"; | "RFC 4862: IPv6 Stateless Address Autoconfiguration"; | |||
} | } | |||
leaf create-temporary-addressed { | leaf create-temporary-addresses { | |||
type boolean; | type boolean; | |||
default false; | default false; | |||
description | description | |||
"If enabled, the host creates temporary addresses as | "If enabled, the host creates temporary addresses as | |||
described in RFC 4941."; | described in RFC 4941."; | |||
reference | reference | |||
"RFC 4941: Privacy Extensions for Stateless Address | "RFC 4941: Privacy Extensions for Stateless Address | |||
Autoconfiguration in IPv6"; | Autoconfiguration in IPv6"; | |||
} | } | |||
leaf temporary-valid-lifetime { | leaf temporary-valid-lifetime { | |||
skipping to change at page 13, line 20 | skipping to change at page 14, line 20 | |||
transport is SSH [RFC6242]. | transport is SSH [RFC6242]. | |||
There are a number of data nodes defined in the YANG module which are | There are a number of data nodes defined in the YANG module which are | |||
writable/creatable/deletable (i.e., config true, which is the | writable/creatable/deletable (i.e., config true, which is the | |||
default). These data nodes may be considered sensitive or vulnerable | default). These data nodes may be considered sensitive or vulnerable | |||
in some network environments. Write operations (e.g., edit-config) | in some network environments. Write operations (e.g., edit-config) | |||
to these data nodes without proper protection can have a negative | to these data nodes without proper protection can have a negative | |||
effect on network operations. These are the subtrees and data nodes | effect on network operations. These are the subtrees and data nodes | |||
and their sensitivity/vulnerability: | and their sensitivity/vulnerability: | |||
ipv4/enabled and ipv6/enabled: These nodes are used to enable or | ipv4/enabled and ipv6/enabled: These leafs are used to enable or | |||
disable IPv4 and IPv6 on a specific interface. By enabling a | disable IPv4 and IPv6 on a specific interface. By enabling a | |||
protocol on an interface, an attacker might be able to create an | protocol on an interface, an attacker might be able to create an | |||
unsecured path into a node (or through it if routing is also | unsecured path into a node (or through it if routing is also | |||
enabled). By disabling a protocol on an interface, an attacker | enabled). By disabling a protocol on an interface, an attacker | |||
might be able to force packets to be routed through some other | might be able to force packets to be routed through some other | |||
interface or deny access to some or all of the network via that | interface or deny access to some or all of the network via that | |||
protocol. | protocol. | |||
ipv4/address and ipv6/address: These lists specify the configured IP | ipv4/address and ipv6/address: These lists specify the configured IP | |||
addresses on an interface. By modifying this information, an | addresses on an interface. By modifying this information, an | |||
attacker can cause a node to either ignore messages destined to it | attacker can cause a node to either ignore messages destined to it | |||
or accept (at least at the IP layer) messages it would otherwise | or accept (at least at the IP layer) messages it would otherwise | |||
ignore. The use of filtering or security associations may reduce | ignore. The use of filtering or security associations may reduce | |||
the potential damage in the latter case. | the potential damage in the latter case. | |||
7. References | ipv4/ip-forwarding and ipv6/ip-forwarding: These leafs allow a | |||
client to enable or disable the routing functions on the entity. | ||||
By disabling the routing functions, an attacker would possibly be | ||||
able to deny service to users. By enabling the routing functions, | ||||
an attacker could open a conduit into an area. This might result | ||||
in the area providing transit for packets it shouldn't or might | ||||
allow the attacker access to the area bypassing security | ||||
safeguards. =ipv6/autoconf: The leafs in this branch control the | ||||
autoconfiguration of IPv6 addresses and in particular whether | ||||
temporary addresses are used or not. By modifying the | ||||
corresponding leafs, an attacker might impact the addresses used | ||||
by a node and thus indirectly the privacy of the users using the | ||||
node. | ||||
7.1. Normative References | 7. Acknowledgments | |||
The author wishes to thank Ladislav Lhotka, Juergen Schoenwaelder, | ||||
and Dave Thaler for their helpful comments. | ||||
8. References | ||||
8.1. Normative References | ||||
[I-D.ietf-netmod-interfaces-cfg] | [I-D.ietf-netmod-interfaces-cfg] | |||
Bjorklund, M., "A YANG Data Model for Interface | Bjorklund, M., "A YANG Data Model for Interface | |||
Configuration", draft-ietf-netmod-interfaces-cfg-04 (work | Configuration", draft-ietf-netmod-interfaces-cfg-05 (work | |||
in progress), April 2011. | in progress), July 2012. | |||
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
Requirement Levels", BCP 14, RFC 2119, March 1997. | Requirement Levels", BCP 14, RFC 2119, March 1997. | |||
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, | [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, | |||
January 2004. | January 2004. | |||
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, | [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, | |||
"Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, | "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, | |||
September 2007. | September 2007. | |||
skipping to change at page 14, line 34 | skipping to change at page 16, line 34 | |||
[RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless | [RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless | |||
Address Autoconfiguration", RFC 4862, September 2007. | Address Autoconfiguration", RFC 4862, September 2007. | |||
[RFC6020] Bjorklund, M., "YANG - A Data Modeling Language for the | [RFC6020] Bjorklund, M., "YANG - A Data Modeling Language for the | |||
Network Configuration Protocol (NETCONF)", RFC 6020, | Network Configuration Protocol (NETCONF)", RFC 6020, | |||
October 2010. | October 2010. | |||
[RFC6021] Schoenwaelder, J., "Common YANG Data Types", RFC 6021, | [RFC6021] Schoenwaelder, J., "Common YANG Data Types", RFC 6021, | |||
October 2010. | October 2010. | |||
[RFC6241] Enns, R., Bjorklund, M., Schoenwaelder, J., and A. | 8.2. Informative References | |||
Bierman, "Network Configuration Protocol (NETCONF)", | ||||
RFC 6241, June 2011. | ||||
[RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure | ||||
Shell (SSH)", RFC 6242, June 2011. | ||||
7.2. Informative References | ||||
[I-D.ietf-netmod-routing-cfg] | [I-D.ietf-netmod-routing-cfg] | |||
Lhotka, L., "A YANG Data Model for Routing Configuration", | Lhotka, L., "A YANG Data Model for Routing Configuration", | |||
draft-ietf-netmod-routing-cfg-02 (work in progress), | draft-ietf-netmod-routing-cfg-04 (work in progress), | |||
February 2012. | July 2012. | |||
[RFC0826] Plummer, D., "Ethernet Address Resolution Protocol: Or | ||||
converting network protocol addresses to 48.bit Ethernet | ||||
address for transmission on Ethernet hardware", STD 37, | ||||
RFC 826, November 1982. | ||||
[RFC4293] Routhier, S., "Management Information Base for the | [RFC4293] Routhier, S., "Management Information Base for the | |||
Internet Protocol (IP)", RFC 4293, April 2006. | Internet Protocol (IP)", RFC 4293, April 2006. | |||
[RFC6241] Enns, R., Bjorklund, M., Schoenwaelder, J., and A. | ||||
Bierman, "Network Configuration Protocol (NETCONF)", | ||||
RFC 6241, June 2011. | ||||
[RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure | ||||
Shell (SSH)", RFC 6242, June 2011. | ||||
Appendix A. Example: NETCONF <get> reply | Appendix A. Example: NETCONF <get> reply | |||
This section gives an example of a reply to the NETCONF <get> request | This section gives an example of a reply to the NETCONF <get> request | |||
for a device that implements the data model defined in this document. | for a device that implements the data model defined in this document. | |||
<rpc-reply | <rpc-reply | |||
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" | xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" | |||
message-id="101"> | message-id="101"> | |||
<data> | <data> | |||
<interfaces | <interfaces | |||
skipping to change at page 15, line 27 | skipping to change at page 18, line 27 | |||
<name>eth0</name> | <name>eth0</name> | |||
<type>ethernetCsmacd</type> | <type>ethernetCsmacd</type> | |||
<location>0</location> | <location>0</location> | |||
<if-index>2</if-index> | <if-index>2</if-index> | |||
<ipv4 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip"> | <ipv4 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip"> | |||
<address> | <address> | |||
<ip>192.0.2.1</ip> | <ip>192.0.2.1</ip> | |||
<prefix-length>24</prefix-length> | <prefix-length>24</prefix-length> | |||
</address> | </address> | |||
</ipv4> | </ipv4> | |||
<ipv6 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip"> | ||||
<address> | ||||
<ip>2001:DB8::1</ip> | ||||
<prefix-length>32</prefix-length> | ||||
</address> | ||||
<dup-addr-detect-transmits>0</dup-addr-detect-transmits> | ||||
</ipv6> | ||||
</interface> | </interface> | |||
</interfaces> | </interfaces> | |||
</data> | </data> | |||
</rpc-reply> | </rpc-reply> | |||
Author's Address | Author's Address | |||
Martin Bjorklund | Martin Bjorklund | |||
Tail-f Systems | Tail-f Systems | |||
End of changes. 35 change blocks. | ||||
57 lines changed or deleted | 146 lines changed or added | |||
This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ |