YANG Modules for IPv4-in-IPv6 Address plus Port (A+P) Softwires
Extracted elements (25)
Earlier draft versions combined softwire mechanisms by associated technologies rather than by function. The document was revised to divide modules by architectural role (CE or BR) because this better follows the intended function and existing implementation approaches.
The softwire modules only provide configuration relevant to softwires; full CE provisioning also requires separate YANG modules for IPv6 routing (RFC 8349), IPv4 routing (RFC 8349), stateful NAT44/NAPT (RFC 8512), and stateless NAT46 (RFC 8512), which are not duplicated here.
The CE module augments ietf-interfaces (RFC 8343) only when the interface type is derived from 'iana-tunnel-type:aplusp'. Full CE provisioning requires coordinating with separate YANG modules for routing (RFC 8349) and NAT (RFC 8512); these are not embedded in the softwire modules.
The YANG modules adopt the Network Management Datastore Architecture (NMDA, RFC 8342), meaning operational state and configuration are represented in separate datastores and the modules are compatible with NMDA-aware NETCONF/RESTCONF servers.
NETCONF access to these modules MUST use SSH (RFC 6242) as the mandatory-to-implement secure transport; RESTCONF MUST use TLS (RFC 8446) as the mandatory-to-implement secure transport.
The softwire-num-max leaf in the BR binding module MUST have a range of 1..max; setting it to zero is equivalent to disabling the BR instance and is not permitted.
The algo-versioning container optionally associates a version number (uint64) and timestamp (yang:date-and-time) to a MAP-E/MAP-T algorithm instance or binding table, enabling forensic identification of which customer was mapped to an external address/port at the time of an abuse incident.
The algorithm-instance grouping (in ietf-softwire-common) includes: enable flag, algo-versioning (version uint64 + date timestamp), data-plane choice (encapsulation with br-ipv6-addr for MAP-E, or translation with dmr-ipv6-prefix for MAP-T), ea-len (uint8, mandatory), rule-ipv6-prefix, rule-ipv4-prefix, and forwarding boolean.
The binding-entry grouping defines the 3-tuple relationship for lw4o6: CE's IPv6 address/prefix (binding-ipv6info, type union of ipv6-address or ipv6-prefix), allocated IPv4 address (binding-ipv4-addr), and restricted port-set (PSID offset, length, and value).
The binding-table-versioning container on the BR binding instance records a version number (uint64) and activation timestamp (yang:date-and-time) to support forensic identification per RFC 7422: the timestamp is used as a key to find the appropriate binding table active when an abuse event occurred.
The BR binding module adds BR-specific traffic-stat leaves: dropped-icmpv4-packets/bytes (ICMP policy drops), hairpin-ipv4-packets/bytes (locally forwarded CE-to-CE traffic), and active-softwire-num (current active softwires on the binding instance).
The ce-type choice statement in the CE module selects between 'binding' (for lw4o6, using binding-ipv6info and br-ipv6-addr) and 'algo' (for MAP-E or MAP-T, using the algo-instances container with one or more algo-instance entries).
The forwarding boolean leaf in algorithm-instance specifies whether a MAP rule may be used as a Forwarding Mapping Rule (FMR); if false, the rule is a Basic Mapping Rule (BMR) only and must not be used for forwarding (per RFC 7598, Section 4.1).
The icmp-policy container on the BR binding instance configures ICMPv4 processing (allow-incoming-icmpv4 boolean, icmpv4-rate limit in msg/s, generate-icmpv4-errors boolean) and ICMPv6 error generation (generate-icmpv6-errors boolean, icmpv6-rate limit).
The ietf-softwire-br YANG module provides configuration and monitoring for softwire BR elements covering lw4o6, MAP-E, and MAP-T. The br-type choice statement selects between 'binding' (lw4o6) and 'algo' (MAP-E/MAP-T) modes.
The ietf-softwire-ce YANG module provides configuration and monitoring for softwire CE elements, augmenting the ietf-interfaces module. It covers Lightweight 4over6, MAP-E, and MAP-T mechanisms and uses YANG feature statements to distinguish which mechanism is relevant.
The ietf-softwire-common YANG module contains groupings shared by both CE and BR modules, including algorithm-instance (for MAP-E/MAP-T parameters) and traffic-stat (packet/byte counters).
The port-set grouping describes a set of Layer 4 ports using the PSID algorithm: psid-offset (0–16 bits, default 0 for lw4o6, default 6 for MAP-E/T), psid-len (0–15, mandatory), and psid (uint16, mandatory).
The softwire-algorithm-instance-event notification (BR, map-e or map-t feature) reports algorithm instance changes with leaf-lists for invalid-entry-id, added-entry, and modified-entry, all referencing algo-instance names.
The softwire-binding-instance-event notification (BR, binding-mode) reports binding table changes with leaf-lists for invalid-entry, added-entry (inet:ipv6-address), and modified-entry, keyed to a specific bind-instance by name.
The softwire-ce-event YANG notification (binding-mode feature) fires whenever the CE's binding IPv6 address changes for any reason; it carries the new inet:ipv6-address as a mandatory leaf.
The traffic-stat grouping provides read-only (config false) counters (yang:zero-based-counter64) for sent/received/dropped IPv4 and IPv6 packets and bytes, dropped IPv4 fragments, reassembled IPv6 fragments, and outgoing ICMPv4/ICMPv6 error packets and bytes.
IANA assigned tunnel type 'aplusp' (Decimal 18, reference RFC 6346) under the tunnelType subregistry of the 'ifType Definitions' registry in the SMI Numbers registry. Three YANG module namespace URIs were also registered in the IETF XML Registry and the YANG Module Names subregistry for ietf-softwire-ce, ietf-softwire-br, and ietf-softwire-common.
All config-true data nodes in the softwire YANG modules are considered sensitive. An attacker with NETCONF/RESTCONF write access could redirect CE traffic to a rogue BR (by changing br-ipv6-addr), set a low MTU to increase fragmentation, disable hairpinning, inflate softwire-num-max to enable a DoS on the BR, suppress ICMP handling by lowering rate limits, or trigger DDoS via maliciously crafted binding table notifications.
Read access to the binding table (/br-instances/binding/bind-instance/binding-table) and algorithm configuration (/br-instances/algorithm/algo-instance/) must be controlled, as these data nodes can be misused to track host activity. NACM (RFC 8341) is the recommended access control mechanism.