YANG Data Model for TCP
Extracted elements (23)
The connection list is modeled as writable even though only some nodes are writable (e.g., keepalive), because different TCP implementations use different modeling approaches and there is no universal ground truth for TCP parameter configuration scope (system-wide, per-interface, per-connection, or application preference).
The module defines YANG groupings to allow reuse in different YANG data models, intended for standalone use or as part of a stack of protocol-specific configuration models (e.g., BGP). This follows the design pattern of RFC 9643.
The module intentionally omits Retransmission Timeout (RTO) configuration and a maximum connection limit from the TCP MIB, as these parameters 'hardly matter in a state-of-the-art TCP implementation.' The model is kept minimal and focused on parameters important for network elements such as routers.
This version does not model Multipath TCP (RFC 8684) details; this could be addressed in a future version. The narrow scope focuses on fundamental parameters important for network elements.
The model supports both TCP-AO (RFC 5925) and legacy TCP MD5 (RFC 2385) authentication to accommodate the installed BGP base, with TCP-AO being the recommended choice. TCP-AO parameters include SendID and RecvID matching those defined in RFC 5925 Section 3.1.
This document does not deprecate the TCP MIB (RFC 4022); the basic statistics defined follow the TCP MIB model, allowing implementations to migrate from MIB to YANG. The YANG module adds a statistics reset capability not present in the TCP MIB.
Connections that are created and match the connection list SHOULD apply the writable parameters. Implementations may not allow creation of new TCP connections simply by adding entries to the list, and behavior upon removal is implementation-specific.
If current implementations require TCP authentication, it is RECOMMENDED to use TCP-AO (RFC 5925) rather than the legacy TCP MD5 signature option, which was obsoleted by TCP-AO in 2010.
The operational state of the connection list SHOULD reflect connections that have been configured but not created and connections that have been created. Connections in the CLOSED state are not reflected on this list.
The 'aes-128' identity is defined as a base of key-chain:crypto-algorithm, representing the AES128 authentication algorithm used by TCP-AO as specified in RFC 5926.
The 'connection' list entry includes writable fields for MSS (uint16 typedef), PMTUD (boolean, default false), and keepalive parameters imported from RFC 9643, plus a read-only 'state' enumeration reflecting the TCP connection state.
The ietf-tcp YANG module defines a presence container 'tcp' containing a 'connections' list keyed by local-address, remote-address, local-port, and remote-port, along with a read-only 'tcp-listeners' list and an optional 'statistics' container.
The module augments the ietf-key-chain model at '/key-chain:key-chains/key-chain:key-chain/key-chain:key' with an 'authentication' container (feature-gated) offering a choice between 'ao' (TCP-AO) and 'md5' presence containers, plus a keychain reference.
The 'statistics' container (feature-gated) provides read-only counter64 leaves: active-opens, passive-opens, attempt-fails, establish-resets, in-segments, out-segments, retransmitted-segments, in-errors, out-resets, and auth-failures; plus a gauge32 currently-established and a 'reset' action protected by nacm:default-deny-all.
The TCP-AO grouping 'ao' defines send-id (uint8), recv-id (uint8), include-tcp-options (boolean, default true), accept-key-mismatch (boolean), and r-next-key-id (uint8, read-only) for configuring TCP Authentication Option per RFC 5925.
The 'tcp-listeners' list is keyed by type (inet:ip-version), address (union of ip-address or zero-length string), and port (inet:port-number), and is read-only, representing applications waiting to accept TCP connections.
IANA registered the module name 'ietf-tcp' with namespace 'urn:ietf:params:xml:ns:yang:ietf-tcp' and prefix 'tcp' in the YANG Module Names registry created by RFC 6020.
IANA registered the URI 'urn:ietf:params:xml:ns:yang:ietf-tcp' in the 'ns' registry of the IETF XML Registry (RFC 3688).
The statistics reset action should be restricted to users with the right permission; it is protected by nacm:default-deny-all in the module. MD5 support is included only to accommodate the installed BGP base, despite its known security weaknesses.
Unrestricted access to keepalive idle timer and other common configuration nodes included from RFC 9643 can cause connections to fail or timeout prematurely.
Unrestricted read access to connection information and statistics can be exploited by malicious users to launch attacks or exploit system vulnerabilities; access MUST be controlled via NACM (RFC 8341).
Unrestricted write access to authentication configuration nodes can prevent authenticated communication and cause connection setup failures, resulting in massive security vulnerabilities and service disruption for traffic requiring authentication.
The connection 'state' leaf enumerates eleven TCP states: closed (1), listen (2), syn-sent (3), syn-received (4), established (5), fin-wait-1 (6), fin-wait-2 (7), close-wait (8), last-ack (9), closing (10), and time-wait (11). The state is read-only and reflects the current TCP connection state as defined in RFC 9293.