A YANG Data Model for IP Traffic Flow Security
Extracted elements (25)
IP-TFS operation is controlled by the sender independently per direction; both peers independently decide whether to use IP-TFS on their outbound SA. This is reflected in the model by providing separate per-direction counters that may be zero or idle when IP-TFS is used only one-way.
Rather than defining a standalone IPsec YANG module, this document augments the existing RFC 9061 IPsec YANG modules (ietf-i2nsf-ike and ietf-i2nsf-ikeless). This approach reuses the established IPsec management framework and adds only the small set of IP-TFS-specific parameters, minimizing redundancy.
The current YANG module is scoped to the simple fixed-size, fixed-rate operating mode of IP-TFS (as defined in RFC 9347), but the structure is explicitly designed for future augmentation to support other IP-TFS operational schemes. The choice node for tunnel-rate and the extensible packet-size container both accommodate this.
The YANG data model conforms to the Network Management Datastore Architecture (NMDA, RFC 8342), ensuring that configuration and operational state are represented in separate datastores and that the module integrates correctly with NMDA-aware management systems.
As defined in RFC 9347, an SA configured for IP-TFS supports only IP-TFS packets — mixed IPsec mode operation on the same SA is not permitted. This constraint is not enforced by the YANG model itself but must be observed by implementations applying this configuration.
The ietf-ipsec-iptfs module augments both the IKE-based model (ietf-i2nsf-ike, augmenting SPD conn-entry/spd/spd-entry and child-sa-info) and the IKE-less model (ietf-i2nsf-ikeless, augmenting spd/spd-entry and sad/sad-entry), covering deployments with and without automated key management.
Read access to the iptfs-inner-pkt-stats and iptfs-outer-pkt-stats counters must be controlled because those statistics can reveal the true traffic activity that IP-TFS is designed to obscure, undermining traffic-flow confidentiality. An adversary with read access to these counters can infer flow activity patterns despite the fixed-size fixed-rate tunnel.
The congestion-control leaf (boolean, default true) enables or disables on-the-wire congestion control data exchange as required by RFC 5348 (TFRC). When false, IP-TFS sends fixed-size packets at a constant rate with no congestion adaptation.
The dont-fragment leaf (boolean, default false) disables inner-packet fragmentation across consecutive IP-TFS tunnel packets on transmission. When enabled, inner packets that exceed the outer packet capacity are dropped rather than fragmented and spread across multiple outer packets.
The ietf-ipsec-iptfs YANG module (namespace urn:ietf:params:xml:ns:yang:ietf-ipsec-iptfs, prefix iptfs) augments the IPsec YANG modules from RFC 9061 to add IP Traffic Flow Security configuration and operational state. It supports both the IKE model (ietf-i2nsf-ike) and the IKE-less model (ietf-i2nsf-ikeless), augmenting SPD entries and SAD entries in each.
The ipsec-stats feature (if-feature ipsec-stats) gates per-SA IPsec packet counters: tx-pkts, tx-octets, tx-drop-pkts, rx-pkts, rx-octets, and rx-drop-pkts (all yang:counter64). These are read-only and augment child-sa-info (IKE) and sad-entry (IKE-less).
The iptfs-stats feature gates two per-SA counter containers. iptfs-inner-pkt-stats tracks inner (user) packet tx-pkts, tx-octets, rx-pkts, rx-octets, and rx-incomplete-pkts. iptfs-outer-pkt-stats tracks outer tunnel packet padding efficiency via tx-all-pad-pkts/octets, tx-extra-pad-pkts/octets, rx-all-pad-pkts/octets, rx-extra-pad-pkts/octets, rx-errored-pkts, and rx-missed-pkts.
The lost-packet-timer-interval leaf (decimal64 with 6 fraction-digits, units milliseconds, precision to 1 nanosecond) sets how long the receiver waits for a missing outer packet before declaring it lost. When send-immediately is false, each lost packet delays inner-packet delivery until this timer expires; setting it too low can degrade reordering and reassembly.
The max-aggregation-time leaf (decimal64 with 6 fraction-digits, units milliseconds, precision down to 1 nanosecond) specifies the maximum time a received inner packet may be held before transmission. Inner packets that would exceed this hold time under the current tunnel configuration are dropped rather than queued.
The packet-size container holds two leaves: use-path-mtu-discovery (boolean, default true) to enable PMTUD-based automatic sizing, and outer-packet-size (uint16, units bytes) for explicit manual configuration. If outer-packet-size is set and use-path-mtu-discovery is also true, the configured size is only adjusted downward by PMTUD.
The rx-incomplete-pkts counter (yang:counter64, in iptfs-inner-pkt-stats) records inner packets that could not be fully reassembled, typically due to missing fragments caused by lost, misordered, or errored outer packets.
The rx-missed-pkts counter (yang:counter64, in iptfs-outer-pkt-stats) records outer IP-TFS packets detected as missing via a gap in the sequence number space, as distinct from rx-errored-pkts which counts packets that arrived but were dropped due to errors.
The send-immediately leaf (boolean, default false) instructs the receiver to deliver inner packets as soon as they are available without waiting for lost or misordered outer packets. This reduces inner-packet latency at the cost of potentially amplified out-of-order delivery when aggregation and reordering interact.
The traffic-flow-security container is the top-level IP-TFS configuration grouping, placed under ipsec-sa-cfg in both IKE and IKE-less SPD entries for read-write configuration, and under child-sa-info and sad-entry as read-only operational state. It holds all IP-TFS control parameters including congestion-control, packet-size, tunnel-rate, dont-fragment, max-aggregation-time, window-size, send-immediately, and lost-packet-timer-interval.
The tunnel-rate choice offers two mutually exclusive leaves: l2-fixed-rate (yang:gauge64, bits/second) specifying the layer-2 wire rate, and l3-fixed-rate (yang:gauge64, bits/second) specifying the layer-3 IP data rate. The chosen rate sets the nominal transmission interval for fixed-size packets and may be adjusted by congestion control.
The window-size leaf (uint16, range 0..65535) configures the maximum number of out-of-order outer packets that the receiver will buffer for reordering. Setting it to 0 disables reordering entirely, causing packets to be delivered in received order.
IANA registered a URI in the IETF XML Registry (RFC 3688): URI urn:ietf:params:xml:ns:yang:ietf-ipsec-iptfs, registrant IESG, designating an XML namespace with no associated XML schema file.
IANA registered one entry in the YANG Module Names registry (RFC 6020): Name ietf-ipsec-iptfs, Namespace urn:ietf:params:xml:ns:yang:ietf-ipsec-iptfs, Prefix iptfs, Reference RFC 9348.
Access to the YANG module MUST be via NETCONF or RESTCONF with mandatory-to-implement secure transports: SSH (RFC 6242) for NETCONF and TLS 1.3 (RFC 8446) for RESTCONF. Unprotected write access to the traffic-flow-security subtree can negatively affect network operations by altering IP-TFS congestion sensitivity or fixed-rate parameters.
The Network Configuration Access Control Model (NACM, RFC 8341) SHOULD be used to restrict NETCONF/RESTCONF access to the writable traffic-flow-security data nodes, which control whether IP-TFS operates in congestion-sensitive or fixed-rate mode.