A YANG Data Model for the Multicast Source Discovery Protocol (MSDP)
Extracted elements (29)
Authentication supports both key-chain references and direct key/algorithm specification to accommodate different deployment practices; MD5 is constrained to be the only permissible algorithm, consistent with the TCP MD5 signatures used in RFC 3618 and RFC 5925.
Occasionally implemented MSDP parameters are modeled as optional YANG features (filter-policy, peer-as-verification, peer-authentication) rather than mandatory nodes, acknowledging that some implementations may not support all advanced configuration options.
The default-peer mechanism with optional prefix-policy exists to handle topologies where MSDP peers do not coexist with BGP peers, causing RPF checks on SA messages to fail; configuring a default peer bypasses those RPF checks.
No protocol-specific notifications are defined in this model; instead, the subscription and push mechanisms defined in RFC 8639 and RFC 8641 can be used to subscribe to notifications on data nodes in this model.
The model is designed to be used alongside other multicast YANG data models such as PIM YANG; it does not cover PIM configuration and management, which are handled by those complementary models.
The YANG data model conforms to NMDA (RFC 8342) and combines operational state with associated configuration data in the same hierarchy per RFC 8407; the module augments ietf-routing (RFC 8349).
Both peers of a connection SHOULD be configured to the same authentication algorithm for the connection to be established; when the crypto-algorithm leaf is not configured, unauthenticated TCP is used.
Only the MD5 algorithm can be used for MSDP authentication; the crypto-algorithm leaf carries a 'must' constraint requiring it to be derived-from-or-self 'key-chain:md5', enforced with an error-message.
The keepalive-interval MUST be smaller than the holdtime-interval; a YANG 'must' constraint enforces this with an error-message: 'The keepalive interval must be smaller than the hold-time interval.'
The tcp-connection-source interface MUST have IPv4 enabled; a YANG 'must' constraint checks that the referenced interface's ip:ipv4/ip:enabled is not 'false', applying to both global and per-peer configuration.
Each MSDP peer is configured as a list entry keyed by IPv4 address and supports authentication, enabled flag, tcp-connection-source, description, mesh-group name, peer-as (ASN), sa-filter, sa-limit, timer, and ttl-threshold attributes.
Peer authentication supports a choice between key-chain reference (via key-chain:key-chain-ref) and direct password specification (key string plus crypto-algorithm identityref); the feature 'peer-authentication' guards the entire authentication container.
Peer timer configuration provides connect-retry-interval (default 30 seconds), holdtime-interval (range 3..65535, default 75 seconds), and keepalive-interval (range 1..65535, default 60 seconds), corresponding to RFC 3618 Section 5.
Per-peer read-only state includes elapsed-time (gauge32, seconds in current state), connect-retry-expire, hold-expire, keepalive-expire, is-default-peer boolean, and reset-count (zero-based-counter32).
Per-peer statistics container (read-only) tracks discontinuity-time, RPF failure count, input/output queue sizes, and per-message-type counters (keepalive, notification, sa-message, sa-response, sa-request, total) in both 'received' and 'sent' sub-containers using yang:counter64.
The default-peer list (guarded by 'filter-policy' feature) identifies peers that accept all MSDP SA messages and bypass RPF checks; it is keyed by peer-addr and prefix-policy (an ACL reference), used in topologies where MSDP peers do not coexist with BGP peers.
The global configuration container provides MSDP-wide attributes including tcp-connection-source (interface reference), default-peer list, originating-rp interface, SA filter (in/out ACL references), sa-limit (uint32, 0 means unlimited), and ttl-threshold (uint8, range 1..255).
The originating-rp container holds an interface reference whose IPv4 address is used in the RP field of SA message entries; particularly useful when anycast RPs are deployed and each MSDP peer needs a unique RP address.
The peer-as leaf (guarded by 'peer-as-verification' feature) configures a peer's AS number for verification; if the configured ASN differs from the BGP peer's ASN, SA information from that peer may be rejected.
The SA cache (read-only) is a list keyed by (group, source-addr) where group is an IPv4 multicast group address and source-addr is an IPv4 multicast source address; each entry contains origin-rp list, up-time, expire, holddown-interval, peer-learned-from, and rpf-peer attributes.
The sa-filter container provides 'in' and 'out' leafref leaves referencing ACL names (ietf-access-control-list) to filter incoming and outgoing SA messages respectively; available at both global and per-peer levels.
The top-level 'msdp' container augments /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol and is conditioned on the control-plane-protocol type being derived from 'msdp:msdp'. The presence of this container is expected to enable MSDP protocol functionality.
Three YANG actions are defined: 'clear-peer' (clears TCP connection to a specific peer), 'clear-all-peers' (clears all peer TCP connections), and 'clear' on sa-cache (clears SA cache entries filterable by group, source-addr, peer-address, or peer-as).
IANA registered the URI 'urn:ietf:params:xml:ns:yang:ietf-msdp' in the 'ns' subregistry of the IETF XML Registry, and registered the YANG module 'ietf-msdp' with prefix 'msdp' in the 'YANG Module Names' subregistry of the YANG Parameters registry.
NETCONF access requires SSH as mandatory secure transport (RFC 6242); RESTCONF requires HTTPS with TLS (RFC 8446). NACM (RFC 8341) provides access control for NETCONF/RESTCONF users. Authentication configuration inherits security considerations from RFC 8177 including local key storage and handling.
The clear-peer and clear-sa-cache RPC/action operations are sensitive; unauthorized access can force rebuilding of all MSDP peer connections or deletion of SA cache records, disrupting multicast service. Access must be restricted via NACM (RFC 8341).
Unauthorized read access to any MSDP data node can disclose operational state, potentially enabling forged connection attacks via exposed peer information; unauthorized read of the 'key' field leaks authentication credentials.
Write access to msdp:global and msdp:peers subtrees must be protected: modifying global config can delete default peers or rebuild connections with unexpected SA filtering; modifying peer config allows unexpected peer establishment and SA learning/advertisement. The 'key' field writeability must be strictly controlled as misoperation breaks connections and deletes associated SA caches.
The peer session-state leaf (read-only) enumerates five states: disabled, inactive, listen, connecting, and established, corresponding to the MSDP finite state machine defined in RFC 3618 Section 11.