Hochschule Esslingen

University of Applied Sciences Kanalstr. 33 73728 Esslingen am Neckar Germany michael.scharf@hs-esslingen.de

Kloud Services

mjethanandani@gmail.com

F5, Inc.

vmurgai@gmail.com

WIT TCPM YANG This document specifies a minimal YANG data model for TCP on devices that are configured and managed by network management protocols. The YANG data model defines a container for all TCP connections and groupings of authentication parameters that can be imported and used in TCP implementations or by other models that need to configure TCP parameters. The model also includes basic TCP statistics. The model is compliant with Network Management Datastore Architecture (NMDA) (RFC 8342).

Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at .

Copyright Notice Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents () in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.

Table of Contents

• .  Introduction
  • .  Conventions
• .  Requirements Language
• .  YANG Module Overview
  • .  Scope
  • .  Model Design
  • .  Tree Diagram
• .  TCP YANG Data Model
• .  IANA Considerations
  • .  The IETF XML Registry
  • .  The YANG Module Names Registry
• .  Security Considerations
• .  References
  • .  Normative References
  • .  Informative References
• .  Examples
  • .  Keepalive Configuration
  • .  TCP-AO Configuration
• .  Complete Tree Diagram
• Acknowledgements
• Authors' Addresses

Introduction The Transmission Control Protocol (TCP) is used by many applications in the Internet, including control and management protocols. As such, TCP is implemented on network elements that can be configured and managed via network management protocols such as Network Configuration Protocol (NETCONF) or RESTCONF . This document specifies a minimal YANG 1.1 data model for configuring and managing TCP on network elements that support YANG, a TCP connection table, a TCP listener table containing information about a particular TCP listener, and an augmentation of the YANG data model for key chains to support authentication. The YANG module specified in this document is compliant with Network Management Datastore Architecture (NMDA) . The YANG module has a narrow scope and focuses on a subset of fundamental TCP functions and basic statistics. It defines a container for a list of TCP connections that includes definitions from "YANG Groupings for TCP Clients and TCP Servers" . The model adheres to the recommendation in "BGP/MPLS IP Virtual Private Networks (VPNs)" . Therefore, it allows enabling of TCP Authentication Option (TCP-AO) and accommodates the installed base that makes use of MD5. The module can be augmented or updated to address more advanced or implementation-specific TCP features in the future. This specification does not deprecate the Management Information Base (MIB) for the Transmission Control Protocol (TCP) . The basic statistics defined in this document follow the model of the TCP MIB. A TCP extended statistics MIB is also available, but this document does not cover such extended statistics. The YANG module also omits some selected parameters included in TCP MIB, most notably Retransmission Timeout (RTO) configuration and a maximum connection limit. This is a conscious decision as these parameters hardly matter in a state-of-the-art TCP implementation. It would also be possible to translate a MIB into a YANG module, for instance, using "Translation of Structure of Management Information Version 2 (SMIv2) MIB Modules to YANG Modules" . However, this approach is not used in this document, because a translated model would not be up-to-date. There are other existing TCP-related YANG data models, which are orthogonal to this specification. Examples are:

• TCP header attributes are modeled in other security-related models, such as those described in "YANG Data Model for Network Access Control Lists (ACLs)" , "Distributed Denial-of-Service Open Threat Signaling (DOTS) Data Channel Specification" , "I2NSF Capability YANG Data Model" , or "I2NSF Network Security Function-Facing Interface YANG Data Model" .
• TCP-related configuration of a NAT (e.g., NAT44, NAT64, or Destination NAT) is defined in "A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)" and "A YANG Data Model for Dual-Stack Lite (DS-Lite)" .
• TCP-AO and TCP MD5 configuration for Layer 3 VPNs is modeled in "A YANG Network Data Model for Layer 3 VPNs" . This model assumes that TCP-AO-specific parameters are preconfigured in addition to the key chain parameters.

Conventions Various examples in this document use the XML encoding. Other encodings, such as JSON , could alternatively be used. Various examples in this document contain long lines that may be folded, as described in .

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

YANG Module Overview

Scope TCP is implemented on different system architectures. As a result, there are many different and often implementation-specific ways to configure parameters of the TCP engine. In addition, in many TCP/IP stacks, configuration exists for different scopes:

• System-wide configuration: Many TCP implementations have configuration parameters that affect all TCP connections from or to this TCP stack. Typical examples include enabling or disabling optional protocol features. For instance, many implementations can turn on or off use of window scaling (defined in "Transmission Control Protocol (TCP)" ) for all TCP connections.
• Interface configuration: It can be useful to use different TCP parameters on different interfaces, e.g., different device ports or IP interfaces. In that case, TCP parameters can be part of the interface configuration. Typical examples are the Maximum Segment Size (MSS) or configuration related to hardware offloading.
• Connection parameters: Many implementations have means to influence the behavior of each TCP connection, e.g., on the programming interface used by applications. Typical examples are socket options in the socket API, such as disabling the Nagle algorithm (as described in "Transmission Control Protocol (TCP)" ) by TCP_NODELAY. If an application uses such an interface, it is possible that the configuration of the application or application protocol includes TCP-related parameters. An example is the BGP YANG module for service provider networks .
• Application preferences: Setting of TCP parameters can also be part of application preferences, templates, or profiles. An example would be the preferences defined in "An Abstract Application Layer Interface to Transport Services" .

As a result, there is no ground truth for setting certain TCP parameters, and generally different TCP implementations have used different modeling approaches. For instance, one implementation may define a given configuration parameter globally, while another one uses per-interface settings, and both approaches work well for the corresponding use cases. Also, different systems may use different default values. In addition, TCP can be implemented in different ways and design choices by the protocol engine often affect configuration options. Nonetheless, a number of TCP stack parameters require configuration by YANG data models. This document therefore defines a minimal YANG data model with fundamental parameters. An important use case is the TCP configuration on network elements, such as routers, which often use YANG data models. The model therefore specifies TCP parameters that are important on such TCP stacks. In particular, this applies to the support of the TCP Authentication Option (TCP-AO) and the corresponding cryptographic algorithms . TCP-AO is used on routers to secure routing protocols such as BGP. In that case, a YANG data model for TCP-AO configuration is required. The model defined in this document includes the required parameters for TCP-AO configuration, such as the values of SendID and RecvID. The key chain for TCP-AO can be modeled by the YANG data model for key chains . The groupings defined in this document can be imported and used as part of such a preconfiguration. Given an installed base, the model also allows enabling of the legacy TCP MD5 signature option. The TCP MD5 signature option was obsoleted by TCP-AO in 2010. If current implementations require TCP authentication, it is RECOMMENDED to use TCP-AO . Similar to the TCP MIB , this document also specifies basic statistics, a TCP connection list, and a TCP listener list.

• Statistics: Counters for the number of active/passive opens, sent and received TCP segments, errors, and possibly other detailed debugging information.
• TCP connection list: Access to status information for all TCP connections. Note that the connection table is modeled as a list that is readable and writable, even though a connection cannot be created by adding entries to the table. Similarly, deletion of connections from this list is implementation-specific.
• TCP listener list: A list containing information about TCP listeners, i.e., applications willing to accept connections.

This allows implementations of TCP MIB to migrate to the YANG data model defined in this memo. Note that the TCP MIB does not include means to reset statistics, which are defined in this document. This is not a major addition, as a reset can simply be implemented by storing offset values for the counters. This version of the module does not model details of Multipath TCP . This could be addressed in a later version of this document.

Model Design The YANG data model defined in this document includes definitions from "YANG Groupings for TCP Clients and TCP Servers" . Similar to that model, this specification defines YANG groupings. This allows reuse of these groupings in different YANG data models. It is intended that these groupings will be used either standalone or for TCP-based protocols as part of a stack of protocol-specific configuration models. An example could be the one described in "YANG Model for Border Gateway Protocol (BGP-4)" .

Tree Diagram This section provides an abridged tree diagram for the YANG module defined in this document. Annotations used in the diagram are defined in "YANG Tree Diagrams" . A complete tree diagram can be found in . module: ietf-tcp +--rw tcp! +--rw connections | ... +--ro tcp-listeners* [type address port] | ... +--ro statistics {statistics}? ... augment /key-chain:key-chains/key-chain:key-chain/key-chain:key: +--rw authentication {authentication}? +--rw keychain? key-chain:key-chain-ref +--rw (authentication)? ...

TCP YANG Data Model This YANG module references "The TCP Authentication Option" , "Protection of BGP Sessions via the TCP MD5 Signature Option" , and "Transmission Control Protocol (TCP)" and imports "Common YANG Data Types" , "Network Configuration Access Control Model" , and "YANG Groupings for TCP Clients and TCP Servers" . module ietf-tcp { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-tcp"; prefix tcp; import ietf-yang-types { prefix yang; reference "RFC 6991: Common YANG Data Types."; } import ietf-tcp-common { prefix tcpcmn; reference "RFC 9643: YANG Groupings for TCP Clients and TCP Servers."; } import ietf-inet-types { prefix inet; reference "RFC 6991: Common YANG Data Types."; } import ietf-netconf-acm { prefix nacm; reference "RFC 8341: Network Configuration Access Control Model."; } import ietf-key-chain { prefix key-chain; reference "RFC 8177: YANG Data Model for Key Chains."; } organization "IETF TCPM Working Group"; contact "WG Web: https://datatracker.ietf.org/wg/tcpm/about WG List: TCPM WG <tcpm@ietf.org> Authors: Michael Scharf <michael.scharf@hs-esslingen.de> Mahesh Jethanandani <mjethanandani@gmail.com> Vishal Murgai <vmurgai@gmail.com>"; description "This module focuses on fundamental TCP functions and basic statistics. The model can be augmented to address more advanced or implementation-specific TCP features. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here. Copyright (c) 2024 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC 9648 (https://www.rfc-editor.org/info/rfc9648); see the RFC itself for full legal notices."; revision 2024-10-10 { description "Initial version."; reference "RFC 9648: YANG Data Model for TCP."; } // Typedefs typedef mss { type uint16; description "Type definition for the Maximum Segment Size."; } // Features feature statistics { description "This implementation supports statistics reporting."; } feature authentication { description "This implementation supports authentication."; } // Identities identity aes-128 { base key-chain:crypto-algorithm; description "AES128 authentication algorithm used by TCP-AO."; reference "RFC 5926: Cryptographic Algorithms for the TCP Authentication Option (TCP-AO)."; } // TCP-AO Groupings grouping ao { leaf send-id { type uint8 { range "0..max"; } description "The SendID is inserted as the KeyID of the TCP-AO option of outgoing segments. In a consistent configuration, the SendID matches the RecvID at the other endpoint."; reference "RFC 5925: The TCP Authentication Option, Section 3.1."; } leaf recv-id { type uint8 { range "0..max"; } description "The RecvID is matched against the TCP-AO KeyID of incoming segments. In a consistent configuration, the RecvID matches the SendID at the other endpoint."; reference "RFC 5925: The TCP Authentication Option, Section 3.1."; } leaf include-tcp-options { type boolean; default "true"; description "When set to true, TCP options are included in the message authentication code (MAC) calculation."; reference "RFC 5925: The TCP Authentication Option, Section 3.1."; } leaf accept-key-mismatch { type boolean; description "Accept, when set to true, TCP segments with a Master Key Tuple (MKT) that is not configured."; reference "RFC 5925: The TCP Authentication Option, Section 7.3."; } leaf r-next-key-id { type uint8; config false; description "A field indicating the Master Key Tuple (MKT) that is ready at the sender to be used to authenticate received segments, i.e., the desired 'receive next' key ID."; reference "RFC 5925: The TCP Authentication Option."; } description "Authentication Option (AO) for TCP."; reference "RFC 5925: The TCP Authentication Option."; } // TCP configuration container tcp { presence "The container for TCP configuration."; description "TCP container."; container connections { list connection { key "local-address remote-address local-port remote-port"; leaf local-address { type inet:ip-address; description "Identifies the address that is used by the local endpoint for the connection and is one of the four elements that form the connection identifier."; } leaf remote-address { type inet:ip-address; description "Identifies the address that is used by the remote endpoint for the connection and is one of the four elements that form the connection identifier."; } leaf local-port { type inet:port-number; description "Identifies the local TCP port used for the connection and is one of the four elements that form the connection identifier."; } leaf remote-port { type inet:port-number; description "Identifies the remote TCP port used for the connection and is one of the four elements that form the connection identifier."; } leaf mss { type mss; description "Maximum Segment Size (MSS) desired on this connection. Note that the 'effective send MSS' can be smaller than what is configured here."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf pmtud { type boolean; default "false"; description "Turns Path Maximum Transmission Unit Discovery (PMTUD) on (true) or off (false)."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } uses tcpcmn:tcp-common-grouping; leaf state { type enumeration { enum closed { value 1; description "Connection is closed. Connections in this state may not appear in this list."; } enum listen { value 2; description "Represents waiting for a connection request from any remote TCP peer and port."; } enum syn-sent { value 3; description "Represents waiting for a matching connection request after having sent a connection request."; } enum syn-received { value 4; description "Represents waiting for a confirming connection request acknowledgment after having both received and sent a connection request."; } enum established { value 5; description "Represents an open connection; data received can be delivered to the user. The normal state for the data transfer phase of the connection."; } enum fin-wait-1 { value 6; description "Represents waiting for a connection termination request from the remote TCP peer or an acknowledgment of the connection termination request previously sent."; } enum fin-wait-2 { value 7; description "Represents waiting for a connection termination request from the remote TCP peer."; } enum close-wait { value 8; description "Represents waiting for a connection termination request from the local user."; } enum last-ack { value 9; description "Represents waiting for an acknowledgment of the connection termination request previously sent to the remote TCP peer (this termination request sent to the remote TCP peer already included an acknowledgment of the termination request sent from the remote TCP peer)."; } enum closing { value 10; description "Represents waiting for a connection termination request acknowledgment from the remote TCP peer."; } enum time-wait { value 11; description "Represents waiting for enough time to pass to be sure the remote TCP peer received the acknowledgment of its connection termination request and to avoid new connections being impacted by delayed segments from previous connections."; } } config false; description "The state of this TCP connection."; } description "List of TCP connections with their parameters. The list is modeled as writable even though only some of the nodes are writable, e.g., keepalive. Connections that are created and match this list SHOULD apply the writable parameters. At the same time, implementations may not allow creation of new TCP connections simply by adding entries to the list. Furthermore, the behavior upon removal is implementation-specific. Implementations may not support closing or resetting a TCP connection upon an operation that removes the entry from the list. The operational state of this list SHOULD reflect connections that have configured but not created and connections that have been created. Connections in the CLOSED state are not reflected on this list."; } description "A container of all TCP connections."; } list tcp-listeners { key "type address port"; config false; description "A table containing information about a particular TCP listener."; leaf type { type inet:ip-version; description "The address type of address. The value should be unspecified (0) if connection initiations to all local IP addresses are accepted."; } leaf address { type union { type inet:ip-address; type string { length "0"; } } description "The local IP address for this TCP connection. The value of this node can be represented in three possible ways, depending on the characteristics of the listening application: 1. For an application willing to accept both IPv4 and IPv6 datagrams, the value of this node must be ''h (a zero-length octet string), with the value of the corresponding 'type' object being unspecified (0). 2. For an application willing to accept only IPv4 or IPv6 datagrams, the value of this node must be '0.0.0.0' or '::' respectively, with 'type' representing the appropriate address type. 3. For an application that is listening for data destined only to a specific IP address, the value of this node is the specific local address, with 'type' representing the appropriate address type."; } leaf port { type inet:port-number; description "The local port number for this TCP connection."; } } container statistics { if-feature "statistics"; config false; leaf active-opens { type yang:counter64; description "The number of times that TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf passive-opens { type yang:counter64; description "The number of times TCP connections have made a direct transition to the SYN-RCVD state from the LISTEN state."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf attempt-fails { type yang:counter64; description "The number of times that TCP connections have made a direct transition to the CLOSED state from either the SYN-SENT state or the SYN-RCVD state, plus the number of times that TCP connections have made a direct transition to the LISTEN state from the SYN-RCVD state."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf establish-resets { type yang:counter64; description "The number of times that TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf currently-established { type yang:gauge32; description "The number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf in-segments { type yang:counter64; description "The total number of TCP segments received, including those received in error. This count includes TCP segments received on currently established connections."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf out-segments { type yang:counter64; description "The total number of TCP segments sent, including those on current connections but excluding those containing only retransmitted octets."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf retransmitted-segments { type yang:counter64; description "The total number of TCP segments retransmitted; that is, the number of TCP segments transmitted containing one or more previously transmitted octets."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf in-errors { type yang:counter64; description "The total number of TCP segments received in error (e.g., bad TCP checksums)."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf out-resets { type yang:counter64; description "The number of TCP segments sent containing the RST flag."; reference "RFC 9293: Transmission Control Protocol (TCP)."; } leaf auth-failures { if-feature "authentication"; type yang:counter64; description "The number of times that authentication has failed either with TCP-AO or MD5."; } action reset { nacm:default-deny-all; description "Reset statistics action command."; input { leaf reset-at { type yang:date-and-time; description "Time when the reset action needs to be executed."; } } output { leaf reset-finished-at { type yang:date-and-time; description "Time when the reset action command completed."; } } } description "Statistics across all connections."; } } augment "/key-chain:key-chains/key-chain:key-chain/key-chain:key" { description "Augmentation of the key-chain model to add TCP-AO and TCP-MD5 authentication."; container authentication { if-feature "authentication"; leaf keychain { type key-chain:key-chain-ref; description "Reference to the key chain that will be used by this model. Applicable for TCP-AO and TCP-MD5 only."; reference "RFC 8177: YANG Data Model for Key Chains."; } choice authentication { container ao { presence "Presence container for all TCP-AO related" + " configuration"; uses ao; description "Use TCP-AO to secure the connection."; } container md5 { presence "Presence container for all MD5 related" + " configuration"; description "Use TCP-MD5 to secure the connection. As the TCP MD5 signature option is obsoleted by TCP-AO, it is RECOMMENDED to use TCP-AO instead."; reference "RFC 2385: Protection of BGP Sessions via the TCP MD5 Signature Option."; } description "Choice of TCP authentication."; } description "Authentication definitions for TCP configuration. This includes parameters such as how to secure the connection, which can be part of either the client or server."; } } }

IANA Considerations

The IETF XML Registry IANA has registered the following URI in the "ns" registry defined in the "IETF XML Registry" .

URI:

urn:ietf:params:xml:ns:yang:ietf-tcp

Registrant Contact:

The IESG

XML:

N/A; the requested URI is an XML namespace.

The YANG Module Names Registry IANA has registered the following in the "YANG Module Names" registry created by "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)" .

Name:

ietf-tcp

Namespace:

urn:ietf:params:xml:ns:yang:ietf-tcp

Prefix:

tcp

Reference:

RFC 9648

This is not an IANA maintained module; however, the URI and other details of the module are maintained by IANA.

Security Considerations This section is modeled after the template defined in . The "ietf-tcp" YANG module defines a schema for data that is designed to be accessed via YANG-based management protocols, such as NETCONF and RESTCONF . These protocols have mandatory-to-implement secure transport layers (e.g., Secure Shell (SSH) , TLS , and QUIC ) and mandatory-to-implement mutual authentication. The Network Configuration Access Control Model (NACM) provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. There are a number of data nodes defined in this YANG module that are writable/creatable/deletable (i.e., "config true", which is the default). These data nodes may be considered sensitive or vulnerable in some network environments. Write operations (e.g., edit-config) to these data nodes without proper protection can have a negative effect on network operations. These are the subtrees and data nodes and their sensitivity/vulnerability:

• Common configuration included from NETCONF client and server models . Unrestricted access to all the nodes, e.g., keepalive idle timer, can cause connections to fail or to timeout prematurely.
• Authentication configuration. Unrestricted access to the nodes under authentication configuration can prevent the use of authenticated communication and cause connection setups to fail. This can result in massive security vulnerabilities and service disruption for the traffic requiring authentication.

Some of the readable data nodes in this YANG module may be considered sensitive or vulnerable in some network environments. It is thus important to control read access (e.g., via get, get-config, or notification) to these data nodes. These are the subtrees and data nodes and their sensitivity/vulnerability:

• Unrestricted access to connection information of the client or server can be used by a malicious user to launch an attack.
• Similarly, unrestricted access to statistics of the client or server can be used by a malicious user to exploit any vulnerabilities of the system.

Some of the RPC operations in this YANG module may be considered sensitive or vulnerable in some network environments. It is thus important to control access to these operations. These are the operations and their sensitivity/vulnerability:

• The YANG module allows for the statistics to be cleared by executing the reset action. This action should be restricted to users with the right permission.

The module specified in this document supports MD5 to basically accommodate the installed BGP base. MD5 suffers from the security weaknesses discussed in or .

References Normative References In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This memo describes a TCP extension to enhance security for BGP. [STANDARDS-TRACK] This document describes an IANA maintained registry for IETF standards which use Extensible Markup Language (XML) related items such as Namespaces, Document Type Declarations (DTDs), Schemas, and Resource Description Framework (RDF) Schemas. The Secure Shell Protocol (SSH) is a protocol for secure remote login and other secure network services over an insecure network. This document describes the SSH authentication protocol framework and public key, password, and host-based client authentication methods. Additional authentication methods are described in separate documents. The SSH authentication protocol runs on top of the SSH transport layer protocol and provides a single authenticated tunnel for the SSH connection protocol. [STANDARDS-TRACK] This document specifies the TCP Authentication Option (TCP-AO), which obsoletes the TCP MD5 Signature option of RFC 2385 (TCP MD5). TCP-AO specifies the use of stronger Message Authentication Codes (MACs), protects against replays even for long-lived TCP connections, and provides more details on the association of security with TCP connections than TCP MD5. TCP-AO is compatible with either a static Master Key Tuple (MKT) configuration or an external, out-of-band MKT management mechanism; in either case, TCP-AO also protects connections when using the same MKT across repeated instances of a connection, using traffic keys derived from the MKT, and coordinates MKT changes between endpoints. The result is intended to support current infrastructure uses of TCP MD5, such as to protect long-lived connections (as used, e.g., in BGP and LDP), and to support a larger set of MACs with minimal other system and operational changes. TCP-AO uses a different option identifier than TCP MD5, even though TCP-AO and TCP MD5 are never permitted to be used simultaneously. TCP-AO supports IPv6, and is fully compatible with the proposed requirements for the replacement of TCP MD5. [STANDARDS-TRACK] The TCP Authentication Option (TCP-AO) relies on security algorithms to provide authentication between two end-points. There are many such algorithms available, and two TCP-AO systems cannot interoperate unless they are using the same algorithms. This document specifies the algorithms and attributes that can be used in TCP-AO's current manual keying mechanism and provides the interface for future message authentication codes (MACs). [STANDARDS-TRACK] YANG is a data modeling language used to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), NETCONF remote procedure calls, and NETCONF notifications. [STANDARDS-TRACK] The Network Configuration Protocol (NETCONF) defined in this document provides mechanisms to install, manipulate, and delete the configuration of network devices. It uses an Extensible Markup Language (XML)-based data encoding for the configuration data as well as the protocol messages. The NETCONF protocol operations are realized as remote procedure calls (RPCs). This document obsoletes RFC 4741. [STANDARDS-TRACK] This document introduces a collection of common data types to be used with the YANG data modeling language. This document obsoletes RFC 6021. YANG is a data modeling language used to model configuration data, state data, Remote Procedure Calls, and notifications for network management protocols. This document describes the syntax and semantics of version 1.1 of the YANG language. YANG version 1.1 is a maintenance release of the YANG language, addressing ambiguities and defects in the original specification. There are a small number of backward incompatibilities from YANG version 1. This document also specifies the YANG mappings to the Network Configuration Protocol (NETCONF). This document describes an HTTP-based protocol that provides a programmatic interface for accessing data defined in YANG, using the datastore concepts defined in the Network Configuration Protocol (NETCONF). RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document describes the key chain YANG data model. Key chains are commonly used for routing protocol authentication and other applications requiring symmetric keys. A key chain is a list containing one or more elements containing a Key ID, key string, send/accept lifetimes, and the associated authentication or encryption algorithm. By properly overlapping the send and accept lifetimes of multiple key chain elements, key strings and algorithms may be gracefully updated. By representing them in a YANG data model, key distribution can be automated. This document captures the current syntax used in YANG module tree diagrams. The purpose of this document is to provide a single location for this definition. This syntax may be updated from time to time based on the evolution of the YANG language. The standardization of network configuration interfaces for use with the Network Configuration Protocol (NETCONF) or the RESTCONF protocol requires a structured and secure operating environment that promotes human usability and multi-vendor interoperability. There is a need for standard mechanisms to restrict NETCONF or RESTCONF protocol access for particular users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. This document defines such an access control model. This document obsoletes RFC 6536. Datastores are a fundamental concept binding the data models written in the YANG data modeling language to network management protocols such as the Network Configuration Protocol (NETCONF) and RESTCONF. This document defines an architectural framework for datastores based on the experience gained with the initial simpler model, addressing requirements that were not well supported in the initial model. This document updates RFC 7950. This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. This document defines the core of the QUIC transport protocol. QUIC provides applications with flow-controlled streams for structured communication, low-latency connection establishment, and network path migration. QUIC includes security measures that ensure confidentiality, integrity, and availability in a range of deployment circumstances. Accompanying documents describe the integration of TLS for key negotiation, loss detection, and an exemplary congestion control algorithm. This document specifies the Transmission Control Protocol (TCP). TCP is an important transport-layer protocol in the Internet protocol stack, and it has continuously evolved over decades of use and growth of the Internet. Over this time, a number of changes have been made to TCP as it was specified in RFC 793, though these have only been documented in a piecemeal fashion. This document collects and brings those changes together with the protocol specification from RFC 793. This document obsoletes RFC 793, as well as RFCs 879, 2873, 6093, 6429, 6528, and 6691 that updated parts of RFC 793. It updates RFCs 1011 and 1122, and it should be considered as a replacement for the portions of those documents dealing with TCP requirements. It also updates RFC 5961 by adding a small clarification in reset handling while in the SYN-RECEIVED state. The TCP header control bits from RFC 793 have also been updated based on RFC 3168. Informative References Kloud Services Arrcus Huawei Juniper Networks This document defines a YANG data model for configuring and managing BGP, including protocol, policy, and operational aspects, such as RIB, based on data center, carrier, and content provider operational requirements. Work in Progress Huawei Department of Computer Science and Engineering Department of Electronic, Electrical and Computer Engineering HTT Consulting Huawei Work in Progress Department of Electronic, Electrical and Computer Engineering Department of Computer Science and Engineering Electronics and Telecommunications Research Institute Huawei Huawei Work in Progress This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes managed objects used for implementations of the Transmission Control Protocol (TCP) in an IP version independent manner. This memo obsoletes RFCs 2452 and 2012. [STANDARDS-TRACK] This document describes a method by which a Service Provider may use an IP backbone to provide IP Virtual Private Networks (VPNs) for its customers. This method uses a "peer model", in which the customers' edge routers (CE routers) send their routes to the Service Provider's edge routers (PE routers); there is no "overlay" visible to the customer's routing algorithm, and CE routers at different sites do not peer with each other. Data packets are tunneled through the backbone, so that the core routers do not need to know the VPN routes. [STANDARDS-TRACK] This document describes extended performance statistics for TCP. They are designed to use TCP's ideal vantage point to diagnose performance problems in both the network and the application. If a network-based application is performing poorly, TCP can determine if the bottleneck is in the sender, the receiver, or the network itself. If the bottleneck is in the network, TCP can provide specific information about its nature. [STANDARDS-TRACK] This document updates the security considerations for the MD5 message digest algorithm. It also updates the security considerations for HMAC-MD5. This document is not an Internet Standards Track specification; it is published for informational purposes. YANG is a data modeling language used to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), NETCONF remote procedure calls, and NETCONF notifications. The Structure of Management Information (SMIv2) defines fundamental data types, an object model, and the rules for writing and revising MIB modules for use with the Simple Network Management Protocol (SNMP). This document defines a translation of SMIv2 MIB modules into YANG modules, enabling read-only (config false) access to data objects defined in SMIv2 MIB modules via NETCONF. [STANDARDS-TRACK] This document analyzes TCP-based routing protocols, the Border Gateway Protocol (BGP), the Label Distribution Protocol (LDP), the Path Computation Element Communication Protocol (PCEP), and the Multicast Source Distribution Protocol (MSDP), according to guidelines set forth in Section 4.2 of "Keying and Authentication for Routing Protocols Design Guidelines", RFC 6518. JavaScript Object Notation (JSON) is a lightweight, text-based, language-independent data interchange format. It was derived from the ECMAScript Programming Language Standard. JSON defines a small set of formatting rules for the portable representation of structured data. This document removes inconsistencies with other specifications of JSON, repairs specification errors, and offers experience-based interoperability guidance. This memo provides guidelines for authors and reviewers of specifications containing YANG modules. Recommendations and procedures are defined, which are intended to increase interoperability and usability of Network Configuration Protocol (NETCONF) and RESTCONF protocol implementations that utilize YANG modules. This document obsoletes RFC 6087. This document defines a YANG module for the Network Address Translation (NAT) function. Network Address Translation from IPv4 to IPv4 (NAT44), Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (NAT64), customer-side translator (CLAT), Stateless IP/ICMP Translation (SIIT), Explicit Address Mappings (EAM) for SIIT, IPv6-to-IPv6 Network Prefix Translation (NPTv6), and Destination NAT are covered in this document. This document defines a YANG module for the Dual-Stack Lite (DS-Lite) Address Family Transition Router (AFTR) and Basic Bridging BroadBand (B4) elements. This document defines a data model for Access Control Lists (ACLs). An ACL is a user-ordered set of rules used to configure the forwarding behavior in a device. Each rule is used to find a match on a packet and define actions that will be performed on the packet. TCP/IP communication is currently restricted to a single path per connection, yet multiple paths often exist between peers. The simultaneous use of these multiple paths for a TCP/IP session would improve resource usage within the network and thus improve user experience through higher throughput and improved resilience to network failure. Multipath TCP provides the ability to simultaneously use multiple paths between peers. This document presents a set of extensions to traditional TCP to support multipath operation. The protocol offers the same type of service to applications as TCP (i.e., a reliable bytestream), and it provides the components necessary to establish and use multiple TCP flows across potentially disjoint paths. This document specifies v1 of Multipath TCP, obsoleting v0 as specified in RFC 6824, through clarifications and modifications primarily driven by deployment experience. The document specifies a Distributed Denial-of-Service Open Threat Signaling (DOTS) data channel used for bulk exchange of data that cannot easily or appropriately communicated through the DOTS signal channel under attack conditions. This is a companion document to "Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Specification" (RFC 8782). This document defines two strategies for handling long lines in width-bounded text content. One strategy, called the "single backslash" strategy, is based on the historical use of a single backslash ('\') character to indicate where line-folding has occurred, with the continuation occurring with the first character that is not a space character (' ') on the next line. The second strategy, called the "double backslash" strategy, extends the first strategy by adding a second backslash character to identify where the continuation begins and is thereby able to handle cases not supported by the first strategy. Both strategies use a self-describing header enabling automated reconstitution of the original content. As a complement to the Layer 3 Virtual Private Network Service Model (L3SM), which is used for communication between customers and service providers, this document defines an L3VPN Network Model (L3NM) that can be used for the provisioning of Layer 3 Virtual Private Network (L3VPN) services within a service provider network. The model provides a network-centric view of L3VPN services. The L3NM is meant to be used by a network controller to derive the configuration information that will be sent to relevant network devices. The model can also facilitate communication between a service orchestrator and a network controller/orchestrator. This document provides test vectors to validate implementations of the two mandatory authentication algorithms specified for the TCP Authentication Option over both IPv4 and IPv6. This includes validation of the key derivation function (KDF) based on a set of test connection parameters as well as validation of the message authentication code (MAC). Vectors are provided for both currently required pairs of KDF and MAC algorithms: KDF_HMAC_SHA1 and HMAC- SHA-1-96, and KDF_AES_128_CMAC and AES-128-CMAC-96. The vectors also validate both whole TCP segments as well as segments whose options are excluded for middlebox traversal. Google Switzerland GmbH University of Oslo Netflix University of Aberdeen Ericsson University of Glasgow SAP SE Apple Inc. Work in Progress

Examples

Keepalive Configuration This particular example demonstrates how a particular connection can be configured for keepalives. NOTE: '\' line wrapping per RFC 8792 <?xml version="1.0" encoding="UTF-8"?> <!-- This example shows how TCP keepalive, MSS, and PMTU can be configure\ d for a given connection. An idle connection is dropped after idle-time + (max-probes * probe-interval). --> <tcp xmlns="urn:ietf:params:xml:ns:yang:ietf-tcp"> <connections> <connection> <local-address>192.0.2.1</local-address> <remote-address>192.0.2.2</remote-address> <local-port>1025</local-port> <remote-port>22</remote-port> <mss>1400</mss> <pmtud>true</pmtud> <keepalives> <idle-time>5</idle-time> <max-probes>5</max-probes> <probe-interval>10</probe-interval> </keepalives> </connection> </connections> </tcp>

TCP-AO Configuration The following example demonstrates how to model a TCP-AO configuration for the example in "TCP Authentication Option (TCP-AO) Test Vectors" . The IP addresses and other parameters are taken from the test vectors. NOTE: '\' line wrapping per RFC 8792 <?xml version="1.0" encoding="UTF-8"?> <!-- This example sets TCP-AO configuration parameters similarly to the examples in RFC 9235. --> <key-chains xmlns="urn:ietf:params:xml:ns:yang:ietf-key-chain"> <key-chain> <name>ao-config</name> <description>"An example for TCP-AO configuration."</description> <key> <key-id>55</key-id> <lifetime> <send-lifetime> <start-date-time>2017-01-01T00:00:00Z</start-date-time> <end-date-time>2017-02-01T00:00:00Z</end-date-time> </send-lifetime> <accept-lifetime> <start-date-time>2016-12-31T23:59:55Z</start-date-time> <end-date-time>2017-02-01T00:00:05Z</end-date-time> </accept-lifetime> </lifetime> <crypto-algorithm xmlns:tcp= "urn:ietf:params:xml:ns:yang:ietf-tcp">tcp:aes-128</crypto\ -algorithm> <key-string> <keystring>testvector</keystring> </key-string> <authentication xmlns="urn:ietf:params:xml:ns:yang:ietf-tcp"> <keychain>ao-config</keychain> <ao> <send-id>61</send-id> <recv-id>84</recv-id> </ao> </authentication> </key> </key-chain> </key-chains>

Complete Tree Diagram Here is the complete tree diagram for the TCP YANG data model. module: ietf-tcp +--rw tcp! +--rw connections | +--rw connection* | [local-address remote-address local-port remote-port] | +--rw local-address inet:ip-address | +--rw remote-address inet:ip-address | +--rw local-port inet:port-number | +--rw remote-port inet:port-number | +--rw mss? mss | +--rw pmtud? boolean | +--rw keepalives! {keepalives-supported}? | | +--rw idle-time uint16 | | +--rw max-probes uint16 | | +--rw probe-interval uint16 | +--ro state? enumeration +--ro tcp-listeners* [type address port] | +--ro type inet:ip-version | +--ro address union | +--ro port inet:port-number +--ro statistics {statistics}? +--ro active-opens? yang:counter64 +--ro passive-opens? yang:counter64 +--ro attempt-fails? yang:counter64 +--ro establish-resets? yang:counter64 +--ro currently-established? yang:gauge32 +--ro in-segments? yang:counter64 +--ro out-segments? yang:counter64 +--ro retransmitted-segments? yang:counter64 +--ro in-errors? yang:counter64 +--ro out-resets? yang:counter64 +--ro auth-failures? yang:counter64 | {authentication}? +---x reset +---w input | +---w reset-at? yang:date-and-time +--ro output +--ro reset-finished-at? yang:date-and-time augment /key-chain:key-chains/key-chain:key-chain/key-chain:key: +--rw authentication {authentication}? +--rw keychain? key-chain:key-chain-ref +--rw (authentication)? +--:(ao) | +--rw ao! | +--rw send-id? uint8 | +--rw recv-id? uint8 | +--rw include-tcp-options? boolean | +--rw accept-key-mismatch? boolean | +--ro r-next-key-id? uint8 +--:(md5) +--rw md5!

Acknowledgements was supported by the StandICT.eu project, which is funded by the European Commission under the Horizon 2020 Programme. The following persons have contributed to this document by reviews (in alphabetical order): , , , and .

Authors' Addresses Hochschule Esslingen

University of Applied Sciences Kanalstr. 33 73728 Esslingen am Neckar Germany michael.scharf@hs-esslingen.de

Kloud Services

mjethanandani@gmail.com

F5, Inc.

vmurgai@gmail.com