ietf-tls-common.yang

module ietf-tls-common {
  yang-version 1.1;

  namespace "urn:ietf:params:xml:ns:yang:ietf-tls-common";
  prefix "tlscom";

  organization
   "IETF NETCONF (Network Configuration) Working Group";

  contact
   "WG Web:   <http://tools.ietf.org/wg/netconf/>
    WG List:  <mailto:netconf@ietf.org>
    Author:   Kent Watsen
              <mailto:kwatsen@juniper.net>
    Author:   Gary Wu
              <mailto:garywu@cisco.com>";


  description
   "This module defines a common features, identities, and groupings
    for Transport Layer Security (TLS).
    Copyright (c) 2017 IETF Trust and the persons identified as
    authors of the code. All rights reserved.
    Redistribution and use in source and binary forms, with or
    without modification, is permitted pursuant to, and subject
    to the license terms contained in, the Simplified BSD
    License set forth in Section 4.c of the IETF Trust's
    Legal Provisions Relating to IETF Documents
    (http://trustee.ietf.org/license-info).
    This version of this YANG module is part of RFC XXXX; see
    the RFC itself for full legal notices.";

  revision 2017-03-12 {
    description
     "Initial version";
    reference
     "RFC XXXX: TLS Client and Server Models";
  }

  // features
  feature tls-ecc {
    description
      "Elliptic Curve Cryptography (ECC) is supported for TLS.";
    reference
      "RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites
                 for Transport Layer Security (TLS)";
  }

  feature tls-dhe {
    description
      "Ephemeral Diffie-Hellman key exchange is supported for TLS.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  feature tls-3des {
    description
      "The Triple-DES block cipher is supported for TLS.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  feature tls-gcm {
    description
      "The Galois/Counter Mode authenticated encryption mode is
       supported for TLS.";
    reference
      "RFC 5288: AES Galois Counter Mode (GCM) Cipher Suites for TLS";
  }

  feature tls-sha2 {
    description
      "The SHA2 family of cryptographic hash functions is supported
       for TLS.";
    reference
      "FIPS PUB 180-4: Secure Hash Standard (SHS)";
  }

  // identities
  identity tls-version-base {
    description
      "Base identity used to identify TLS protocol versions.";
  }

  identity tls-1.2 {
    base tls-version-base;
    description
      "TLS protocol version 1.2.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity cipher-suite-base {
    description
      "Base identity used to identify TLS cipher suites.";
  }

  identity rsa-with-aes-128-cbc-sha {
    base cipher-suite-base;
    description
      "Cipher suite TLS_RSA_WITH_AES_128_CBC_SHA.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity rsa-with-aes-256-cbc-sha {
    base cipher-suite-base;
    description
      "Cipher suite TLS_RSA_WITH_AES_256_CBC_SHA.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity rsa-with-aes-128-cbc-sha256 {
    base cipher-suite-base;
    if-feature tls-sha2;
    description
      "Cipher suite TLS_RSA_WITH_AES_128_CBC_SHA256.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity rsa-with-aes-256-cbc-sha256 {
    base cipher-suite-base;
    if-feature tls-sha2;
    description
      "Cipher suite TLS_RSA_WITH_AES_256_CBC_SHA256.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity dhe-rsa-with-aes-128-cbc-sha {
    base cipher-suite-base;
    if-feature tls-dhe;
    description
      "Cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity dhe-rsa-with-aes-256-cbc-sha {
    base cipher-suite-base;
    if-feature tls-dhe;
    description
      "Cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity dhe-rsa-with-aes-128-cbc-sha256 {
    base cipher-suite-base;
    if-feature "tls-dhe and tls-sha2";
    description
      "Cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity dhe-rsa-with-aes-256-cbc-sha256 {
    base cipher-suite-base;
    if-feature "tls-dhe and tls-sha2";
    description
      "Cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA256.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity ecdhe-ecdsa-with-aes-128-cbc-sha256 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity ecdhe-ecdsa-with-aes-256-cbc-sha384 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity ecdhe-rsa-with-aes-128-cbc-sha256 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity ecdhe-rsa-with-aes-256-cbc-sha384 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity ecdhe-ecdsa-with-aes-128-gcm-sha256 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-gcm and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity ecdhe-ecdsa-with-aes-256-gcm-sha384 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-gcm and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity ecdhe-rsa-with-aes-128-gcm-sha256 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-gcm and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity ecdhe-rsa-with-aes-256-gcm-sha384 {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-gcm and tls-sha2";
    description
      "Cipher suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.";
    reference
      "RFC 5289: TLS Elliptic Curve Cipher Suites with
                 SHA-256/384 and AES Galois Counter Mode (GCM)";
  }

  identity rsa-with-3des-ede-cbc-sha {
    base cipher-suite-base;
    if-feature tls-3des;
    description
      "Cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
  }

  identity ecdhe-rsa-with-3des-ede-cbc-sha {
    base cipher-suite-base;
    if-feature "tls-ecc and tls-3des";
    description
      "Cipher suite TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA.";
    reference
      "RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites
                 for Transport Layer Security (TLS)";
  }

  identity ecdhe-rsa-with-aes-128-cbc-sha {
    base cipher-suite-base;
    if-feature "tls-ecc";
    description
      "Cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA.";
    reference
      "RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites
                 for Transport Layer Security (TLS)";
  }

  identity ecdhe-rsa-with-aes-256-cbc-sha {
    base cipher-suite-base;
    if-feature "tls-ecc";
    description
      "Cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.";
    reference
      "RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites
                 for Transport Layer Security (TLS)";
  }

  // groupings
  grouping hello-params-grouping {
    description
      "A reusable grouping for TLS hello message parameters.  For
       configurable parameters, a zero-element leaf-list indicates the
       system default configuration for that parameter.";
    reference
      "RFC 5246: The Transport Layer Security (TLS) Protocol
                 Version 1.2";
    container tls-versions {
      description
        "Parameters regarding TLS versions.";
      leaf-list tls-version {
        type identityref {
          base tls-version-base;
        }
        description
          "Allowed TLS protocol versions.";
      }
    }
    container cipher-suites {
      description
        "Parameters regarding cipher suites.";
      leaf-list cipher-suite {
        type identityref {
          base cipher-suite-base;
        }
        ordered-by user;
        description
          "Cipher suites in order of descending preference.";
      }
    }
  }
}