ietf-sztp-csr.yang

module ietf-sztp-csr {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-sztp-csr";
  prefix sztp-csr;

  import ietf-sztp-bootstrap-server {
    prefix sztp-svr;
    reference
      "RFC 8572: Secure Zero Touch Provisioning (SZTP)";
  }

  import ietf-yang-structure-ext {
    prefix sx;
    reference
      "RFC 8791: YANG Data Structure Extensions";
  }

  import ietf-ztp-types {
    prefix zt;
    reference
      "RFC XXXX: Conveying a Certificate Signing Request (CSR)
                 in a Secure Zero Touch Provisioning (SZTP)
                 Bootstrapping Request";
  }

  organization
    "IETF NETCONF (Network Configuration) Working Group";

  contact
    "WG Web:   https://datatracker.ietf.org/wg/netconf
     WG List:  NETCONF WG list <mailto:netconf@ietf.org>
     Authors:  Kent Watsen <mailto:kent+ietf@watsen.net>
               Russ Housley <mailto:housley@vigilsec.com>
               Sean Turner <mailto:sean@sn3rd.com>";

  description
    "This module augments the 'get-bootstrapping-data' RPC,
     defined in the 'ietf-sztp-bootstrap-server' module from
     SZTP (RFC 8572), enabling the SZTP-client to obtain a
     signed identity certificate (e.g., an LDevID from IEEE
     802.1AR) as part of the SZTP onboarding information
     response.

     Copyright (c) 2022 IETF Trust and the persons identified
     as authors of the code. All rights reserved.

     Redistribution and use in source and binary forms, with
     or without modification, is permitted pursuant to, and
     subject to the license terms contained in, the Revised
     BSD License set forth in Section 4.c of the IETF Trust's
     Legal Provisions Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC XXXX
     (https://www.rfc-editor.org/info/rfcXXXX); see the RFC
     itself for full legal notices.

     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
     'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
     'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this
     document are to be interpreted as described in BCP 14
     (RFC 2119) (RFC 8174) when, and only when, they appear
     in all capitals, as shown here.";

  revision YYYY-MM-DD {
    description
      "Initial version";
    reference
      "RFC XXXX: Conveying a Certificate Signing Request (CSR)
                 in a Secure Zero Touch Provisioning (SZTP)
                 Bootstrapping Request";
  }

  // Protocol-accessible nodes

  augment "/sztp-svr:get-bootstrapping-data/sztp-svr:input" {
    description
      "This augmentation adds the 'csr-support' and 'csr' nodes to
       the SZTP (RFC 8572) 'get-bootstrapping-data' request message,
       enabling the SZTP-client to obtain an identity certificate
       (e.g., an LDevID from IEEE 802.1AR) as part of the onboarding
       information response provided by the SZTP-server.

       The 'csr-support' node enables the SZTP-client to indicate
       that it supports generating certificate signing requests
       (CSRs), and to provide details around the CSRs it is able
       to generate.

       The 'csr' node enables the SZTP-client to relay a CSR to
       the SZTP-server.";
    reference
      "IEEE 802.1AR: IEEE Standard for Local and metropolitan
                     area networks - Secure Device Identity
       RFC 8572: Secure Zero Touch Provisioning (SZTP)";
    choice msg-type {
      description
        "Messages are mutually exclusive.";
      case csr-support {
        description
          "Indicates how the SZTP-client supports generating CSRs.

           If present and a SZTP-server wishes to request the
           SZTP-client generate a CSR, the SZTP-server MUST
           respond with HTTP code 400 Bad Request with an
           'ietf-restconf:errors' message having the 'error-tag'
           value 'missing-attribute' and the 'error-info' node
           containing the 'csr-request' structure described
           in this module.";
        uses zt:csr-support-grouping;
      }
      case csr {
        description
          "Provides the CSR generated by the SZTP-client.

           When present, the SZTP-server SHOULD respond with
           an SZTP onboarding information message containing
           a signed certificate for the conveyed CSR.  The
           SZTP-server MAY alternatively respond with another
           HTTP error containing another 'csr-request', in
           which case the SZTP-client MUST delete any key
           generated for the previously generated CSR.";
        uses zt:csr-grouping;
      }
    }
  }

  sx:structure csr-request {
    description
      "A YANG data structure, per RFC 8791, that specifies
       details for the CSR that the ZTP-client is to generate.";
    reference
      "RFC 8791: YANG Data Structure Extensions";
    uses zt:csr-request-grouping;
  }

}