A YANG Data Model for NTP
Extracted elements (29)
Deprecated algorithms (MD5, SHA-1, HMAC-SHA-1, HMAC-SHA1-12) and ASCII keystrings are modeled but gated behind a 'deprecated' YANG feature to support legacy compatibility when secure cryptographic algorithms are not available, while clearly marking them as deprecated per RFC 8573.
Hexadecimal key strings are preferred over ASCII keystrings because hexadecimal affords greater key entropy with the same number of internal key-string octets and discourages use of well-known words or numbers. ASCII keystrings are gated behind the 'deprecated' feature.
NTP operational state is included in the same tree as NTP configuration, consistent with NMDA (RFC 8342), rather than placing it in a separate operational datastore tree. This unifies configuration and running state access.
The association list uses a three-part key {address, local-mode, isconfigured} because all three are needed to uniquely identify an association: a broadcast client (isconfigured=false) and a configured unicast client (isconfigured=true) to the same address are distinct associations.
The module can manage NTPv3 (RFC 1305, now obsoleted) as well as NTPv4 (RFC 5905) by allowing the version to be configured per association, supporting legacy system interoperability.
The /ntp container includes a 'when' condition that makes it applicable only when /sys:system/sys:ntp is not in use, preventing dual management of NTP via both this module and RFC 7317's /system/ntp subtree.
YANG data nodes in this module map to NTPv4-MIB (RFC 5907) objects: clock-state maps to ntpEntStatusCurrentMode, clock-stratum to ntpEntStatusStratum, associations/offset to ntpAssocOffset, and packet statistics to ntpAssocStatOutPkts/InPkts/ProtocolError.
If the YANG data model defined in this document is implemented, then /system/ntp SHOULD NOT be used and MUST be ignored, preventing conflicting NTP configuration from RFC 7317's system management model.
The keyid (authentication key identifier) is a 32-bit unsigned integer that MUST be configured on NTP peers before authentication can be used.
RFC 9249 defines the YANG module 'ietf-ntp' with namespace 'urn:ietf:params:xml:ns:yang:ietf-ntp', providing a single top-level container that unifies NTP configuration and operational state including access rules, authentication, associations, unicast configurations, interfaces, and system status.
The key grouping uses 'nacm:default-deny-all' and offers a choice between a keystring leaf (ASCII format, gated by 'deprecated' feature) and a hexadecimal-string leaf (gated by 'hex-key-string' feature), with hexadecimal preferred for greater key entropy.
The 'log2seconds' typedef is an int8 representing signed log2 seconds, used for poll intervals (minpoll default 6, maxpoll default 10) and clock-precision fields.
The manycast-client configuration includes TTL (for expanding ring search), minclock (minimum manycast survivors), maxclock (maximum manycast candidates), and beacon (upper poll limit; when TTL reaches its limit without finding minclock servers, poll increases until beacon then restarts).
The module defines an 'ntp-version' typedef (uint8, range 3..max, default 4), allowing per-association version control to enable backward compatibility with NTPv3 deployments.
The module defines crypto-algorithm identities: aes-cmac (required by RFC 8573), hmac-sha-256, hmac-sha-384, hmac-sha-512, plus deprecated identities md5, sha-1, hmac-sha-1, and hmac-sha1-12 gated behind the 'deprecated' feature.
The module defines four NTP access modes via YANG identities: peer-access-mode (full access, bidirectional sync plus control queries), server-access-mode (unidirectional sync plus control queries), server-only-access-mode (unidirectional sync, no control queries), and query-only-access-mode (control queries only).
The module defines six NTP association modes as YANG identities: active (symmetric active, mode 1), passive (symmetric passive, mode 2), client (mode 3), server (mode 4), broadcast-server (mode 5), and broadcast-client (mode 6/multicast client).
The /ntp/associations/association list (config false) is keyed by {address, local-mode, isconfigured}, uniquely identifying dynamic and configured associations. It exposes per-association timing fields (offset, delay, dispersion, originate-time T1, receive-time T2, transmit-time T3, input-time T4), plus reach (8-bit shift register), unreach counter, and per-peer ntp-statistics.
The /ntp/authentication container (guarded by the 'authentication' feature) holds an auth-enabled boolean (default false) and a list of authentication-keys keyed by keyid (uint32). Each key entry includes algorithm (identityref), key material, and istrusted boolean.
The /ntp/clock-state/system-status container (config false) exposes mandatory operational leaves: clock-state (synchronized/unsynchronized), clock-stratum, clock-refid, nominal-freq and actual-freq (decimal64 in Hz), clock-precision (log2seconds), and sync-state (granular states including clock-never-set, freq-set-by-cfg, spike, freq, clock-synchronized).
The /ntp/interfaces/interface list supports per-interface configuration of broadcast-server, broadcast-client, multicast-server, multicast-client, manycast-server, and manycast-client modes, each gated by a corresponding YANG feature.
The 'ntp-stratum' typedef is a uint8 restricted to range 1..16, where primary servers are stratum 1 and each lower level increments by one; stratum 16 indicates unsynchronized.
The 'refid' typedef is a union type that can be an IPv4 address, a uint32 (first 32 bits of MD5 hash of IPv6 address), or a 4-character string (for reference identifiers and kiss codes such as 'AUTH', 'DROP', 'RATE', 'NIST', 'ATOM'). The MD5 hash use here is not for cryptographic purposes.
The 'statistics-reset' RPC resets collected NTP statistics, accepting either a specific association reference (by address, local-mode, and isconfigured leaves) or an 'all' case to reset all statistics.
RFC 9249 registers the URI 'urn:ietf:params:xml:ns:yang:ietf-ntp' in the IETF XML Registry (RFC 3688) as an XML namespace.
RFC 9249 registers the YANG module 'ietf-ntp' in the YANG Module Names registry (RFC 6020) with namespace 'urn:ietf:params:xml:ns:yang:ietf-ntp' and prefix 'ntp'.
Readable sensitive data nodes include /ntp/clock-state (reveals synchronization topology), /ntp/associations (exposes peer relationships and network topology), and /ntp/ntp-statistics (reveals traffic patterns). Unauthorized read access should be restricted via NACM.
The mandatory-to-implement secure transport for NETCONF access is SSH (RFC 6242) and for RESTCONF is TLS (RFC 8446). NACM (RFC 8341) must be used to restrict access; 'nacm:default-deny-all' is applied to authentication key material to prevent key retrieval after configuration.
Writable sensitive data nodes include /ntp/port (unexpected changes disrupt service), /ntp/authentication and /ntp/access-rules (authentication and access control), /ntp/unicast-configuration (modifies NTP associations), and /ntp/interfaces/interface (could cause synchronization over an untrusted source over trusted ones).