RFC 9046 | Babel Information Model | June 2021 |
Stark & Jethanandani | Informational | [Page] |
The Babel information model provides structured data elementsfor a Babel implementation reporting its current state and mayallow limited configuration of some such data elements.This information model can be used as a basis for creating datamodels under various data modeling regimes. This informationmodel only includes parameters and parameter values useful formanaging Babel over IPv6.¶
This document is not an Internet Standards Track specification; it is published for informational purposes.¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are candidates for any level of Internet Standard; see Section 2 of RFC 7841.¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained athttps://www.rfc-editor.org/info/rfc9046.¶
Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶
Babel is a loop-avoiding, distance-vector routing protocol defined in[RFC8966].[RFC8967] defines a securitymechanism that allows Babel packets to be cryptographicallyauthenticated, and[RFC8968] defines a security mechanismthat allows Babel packets to be both authenticated and encrypted.This document describes an information model for Babel (including implementationsusing one or both of these security mechanisms) that can be used to create managementprotocol data models (such as a NETCONF[RFC6241] YANG[RFC7950] data model).¶
Due to the simplicity of the Babel protocol, most of the information modelis focused on reporting the Babel protocol operational state, and very little ofthat is considered mandatory to implement for an implementation claimingcompliance with this information model. Some parameters may be configurable.However, it is up to the Babel implementation whether to allow any of theseto be configured within its implementation. Where the implementation doesnot allow configuration of these parameters, itMAY still choose to exposethem as read-only.¶
The information model is presented using a hierarchical structure. This doesnot preclude a data model based on this information model from using a referentialor other structure.¶
This information model only includes parameters and parameter valuesuseful for managing Babel over IPv6. This model has no parametersor values specific to operating Babel over IPv4, even though[RFC8966] does define a multicast group forsending and listening to multicast announcements on IPv4.There is less likelihood of breakage due to inconsistentconfiguration and increased implementation simplicity ifBabel is operated always and only over IPv6. Running Babelover IPv6 requires IPv6 at the link layer and does not needadvertised prefixes, router advertisements, or DHCPv6 to bepresent in the network. Link-local IPv6 is widely supportedamong devices where Babel is expected to be used. Note thatBabel over IPv6 can be used for configuration of both IPv4and IPv6 routes.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14[RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.¶
This document uses a programming-language-like notation to define the propertiesof the objects of the information model. An optional property is enclosedby square brackets, [ ], and a list property is indicated by two numbersin angle brackets, <m..n>, where m indicates the minimal numberof list elements,and n indicates the maximum number of list elements. The symbol "*" for nmeans there are no defined limits on the number of list elements. Each parameterand object includes an indication of "ro" or "rw". "ro" means the parameteror object is read-only. "rw" means it is read-write. For an object, read-writemeans instances of the object can be created or deleted.If an implementation is allowed to chooseto implement a "rw" parameter as read-only, this is noted in the parameter description.¶
The object definitions use base types that are defined as follows:¶
A binary string (sequence of octets).¶
A type representing a Boolean (true or false) value.¶
A type representing a date and time using the Gregorian calendar. The datetimeformatMUST conform to[RFC3339],Section 5.6.¶
A type representing an IP address. This type supports both IPv4 and IPv6addresses.¶
A type representing a remote procedure call or other action that can be usedto manipulate data elements or system behaviors.¶
A type representing a reference to another information or data model elementor to some other device resource.¶
A type representing a human-readable string consisting of a (possibly restricted)subset of Unicode and ISO/IEC 10646[ISO.10646] characters.¶
A type representing an unsigned integer number. This informationmodel does not define a precision.¶
The information model is hierarchically structured as follows:¶
+-- babel-information +-- babel-implementation-version +-- babel-enable +-- router-id +-- self-seqno +-- babel-metric-comp-algorithms +-- babel-security-supported +-- babel-mac-algorithms +-- babel-dtls-cert-types +-- babel-stats-enable +-- babel-stats-reset +-- babel-constants | +-- babel-udp-port | +-- babel-mcast-group +-- babel-interfaces | +-- babel-interface-reference | +-- babel-interface-enable | +-- babel-interface-metric-algorithm | +-- babel-interface-split-horizon | +-- babel-mcast-hello-seqno | +-- babel-mcast-hello-interval | +-- babel-update-interval | +-- babel-mac-enable | +-- babel-if-mac-key-sets | +-- babel-mac-verify | +-- babel-dtls-enable | +-- babel-if-dtls-cert-sets | +-- babel-dtls-cached-info | +-- babel-dtls-cert-prefer | +-- babel-packet-log-enable | +-- babel-packet-log | +-- babel-if-stats | | +-- babel-sent-mcast-hello | | +-- babel-sent-mcast-update | | +-- babel-sent-ucast-hello | | +-- babel-sent-ucast-update | | +-- babel-sent-IHU | | +-- babel-received-packets | +-- babel-neighbors | +-- babel-neighbor-address | +-- babel-hello-mcast-history | +-- babel-hello-ucast-history | +-- babel-txcost | +-- babel-exp-mcast-hello-seqno | +-- babel-exp-ucast-hello-seqno | +-- babel-ucast-hello-seqno | +-- babel-ucast-hello-interval | +-- babel-rxcost | +-- babel-cost +-- babel-routes | +-- babel-route-prefix | +-- babel-route-prefix-length | +-- babel-route-router-id | +-- babel-route-neighbor | +-- babel-route-received-metric | +-- babel-route-calculated-metric | +-- babel-route-seqno | +-- babel-route-next-hop | +-- babel-route-feasible | +-- babel-route-selected +-- babel-mac-key-sets | +-- babel-mac-default-apply | +-- babel-mac-keys | +-- babel-mac-key-name | +-- babel-mac-key-use-send | +-- babel-mac-key-use-verify | +-- babel-mac-key-value | +-- babel-mac-key-algorithm | +-- babel-mac-key-test +-- babel-dtls-cert-sets +-- babel-dtls-default-apply +-- babel-dtls-certs +-- babel-cert-name +-- babel-cert-value +-- babel-cert-type +-- babel-cert-private-key¶
Most parameters are read-only. The following is a descriptive list of the parameters that are not required to be read-only:¶
The following parameters are required to return no value when read:¶
Note that this overview is intended simply to be informative and is not normative.If there is any discrepancy between this overview and the detailed informationmodel definitions in subsequent sections, the error is in this overview.¶
object { string ro babel-implementation-version; boolean rw babel-enable; binary ro babel-self-router-id; [uint ro babel-self-seqno;] string ro babel-metric-comp-algorithms<1..*>; string ro babel-security-supported<0..*>; [string ro babel-mac-algorithms<1..*>;] [string ro babel-dtls-cert-types<1..*>;] [boolean rw babel-stats-enable;] [operation babel-stats-reset;] babel-constants-obj ro babel-constants; babel-interface-obj ro babel-interfaces<0..*>; babel-route-obj ro babel-routes<0..*>; [babel-mac-key-set-obj rw babel-mac-key-sets<0..*>;] [babel-dtls-cert-set-obj rw babel-dtls-cert-sets<0..*>;]} babel-information-obj;¶
The name and version of this implementation of the Babel protocol.¶
When written, it configures whether the protocol should be enabled(true) or disabled (false).A read from the running or intended datastore indicates theconfigured administrative value of whether the protocol is enabled(true) or not (false). A read from the operational datastore indicates whetherthe protocol is actually running (true) or not (i.e., it indicates theoperational state of the protocol).A data model that does not replicate parameters for running and operationaldatastores can implement this as two separate parameters.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
The router-id used by this instance of the Babel protocolto identify itself.[RFC8966]describes this as an arbitrary string of 8 octets.¶
The current sequence number included in route updates for routesoriginated by this node. This is a 16-bit unsigned integer.¶
List of supported cost computation algorithms. Possiblevalues include "2-out-of-3", as described in[RFC8966],Appendix A.2.1, and "ETX", as described in[RFC8966],Appendix A.2.2.¶
List of supported security mechanisms. Possible values include"MAC" to indicate support of[RFC8967] and "DTLS"to indicate support of[RFC8968].¶
List of supported MAC computation algorithms. Possible valuesinclude "HMAC-SHA256" and "BLAKE2s-128" to indicate support foralgorithms indicated in[RFC8967].¶
List of supported certificate types. Possible values include"X.509" and "RawPublicKey" to indicate support for typesindicated in[RFC8968].¶
Indicates whether statistics collection is enabled(true) or disabled (false) on all interfaces. Whenenabled, existing statistics values are not clearedand will be incremented as new packets are counted.¶
An operation that resets all babel-if-statsparameters to zero. Thisoperation has no input or output parameters.¶
A babel-constants-obj object.¶
A set of babel-interface-obj objects.¶
A set of babel-route-obj objects. Contains the routes known to thisnode.¶
A set of babel-mac-key-set-obj objects. If thisobject is implemented, itprovides access to parameters related to the MAC security mechanism.An implementationMAY chooseto expose this object as read-only ("ro").¶
A set of babel-dtls-cert-set-obj objects. If thisobject is implemented, itprovides access to parameters related to the DTLS security mechanism.An implementationMAY chooseto expose this object as read-only ("ro").¶
object { uint rw babel-udp-port; [ip-address rw babel-mcast-group;]} babel-constants-obj;¶
UDP port for sending and listening for Babel packets. Defaultis 6696. An implementationMAY chooseto expose this parameter as read-only ("ro").This is a 16-bit unsigned integer.¶
Multicast group for sending and listening to multicastannouncements on IPv6. Default is ff02::1:6.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
object { reference ro babel-interface-reference; [boolean rw babel-interface-enable;] string rw babel-interface-metric-algorithm; [boolean rw babel-interface-split-horizon;] [uint ro babel-mcast-hello-seqno;] [uint ro babel-mcast-hello-interval;] [uint ro babel-update-interval;] [boolean rw babel-mac-enable;] [reference rw babel-if-mac-key-sets<0..*>;] [boolean rw babel-mac-verify;] [boolean rw babel-dtls-enable;] [reference rw babel-if-dtls-cert-sets<0..*>;] [boolean rw babel-dtls-cached-info;] [string rw babel-dtls-cert-prefer<0..*>;] [boolean rw babel-packet-log-enable;] [reference ro babel-packet-log;] [babel-if-stats-obj ro babel-if-stats;] babel-neighbor-obj ro babel-neighbors<0..*>;} babel-interface-obj;¶
Reference to an interface object that can be used to send andreceive IPv6 packets, as defined bythe data model (e.g., YANG[RFC7950] and Broadband Forum (BBF)[TR-181]).Referencing syntax will be specific to the data model. If there isno set of interface objects available, this should be a string that indicatesthe interface name used by the underlying operating system.¶
When written, it configures whether the protocol should be enabled(true) or disabled (false) on this interface.A read from the running or intended datastore indicates theconfigured administrative value of whether the protocol is enabled(true) or not (false). A read from the operational datastore indicates whetherthe protocol is actually running (true) or not (i.e., it indicates theoperational state of the protocol).A data model that does not replicate parameters for running and operationaldatastores can implement this as two separate parameters.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
Indicates the metric computation algorithm used on this interface.The valueMUST be one of those listed in the babel-metric-comp-algorithms parameter.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
Indicates whether or not the split-horizon optimization is usedwhen calculating metrics on this interface. A value of "true"indicates split-horizon optimization is used.Split-horizon optimization is described in[RFC8966],Section 3.7.4.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
The current sequence number in use for multicastHellos sent on this interface.This is a 16-bit unsigned integer.¶
The current interval in use for multicast Hellossent on this interface. Units are centiseconds.This is a 16-bit unsigned integer.¶
The current interval in use for all updates (multicastand unicast) sent on this interface. Units are centiseconds.This is a 16-bit unsigned integer.¶
Indicates whether the MAC security mechanism is enabled(true) or disabled (false).An implementationMAY chooseto expose this parameter as read-only ("ro").¶
List of references to the babel-mac-key-sets entries that apply to thisinterface. When an interface instance is created, all babel-mac-key-setsinstances with babel-mac-default-apply "true" will be includedin this list.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
A Boolean flag indicating whether MACs in incoming Babel packetsare required to be present and are verified. If this parameter is "true",incoming packets are required to have a valid MAC.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
Indicates whether the DTLS security mechanism is enabled(true) or disabled (false).An implementationMAY chooseto expose this parameter as read-only ("ro").¶
List of references to the babel-dtls-cert-sets entries that apply to thisinterface. When an interface instance is created, all babel-dtls-cert-setsinstances with babel-dtls-default-apply "true" will be includedin this list.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
Indicates whether the cached_info extension(see[RFC8968],Appendix A) is included in ClientHelloand ServerHello packets. The extension is included if the valueis "true".An implementationMAY chooseto expose this parameter as read-only ("ro").¶
List of supported certificate types, in order of preference.The valuesMUST be among thoselisted in the babel-dtls-cert-types parameter.This list is used to populate the server_certificate_typeextension (see[RFC8968],Appendix A)in a ClientHello. Values that are present inat least one instance in the babel-dtls-certs object of areferenced babel-dtls instance and that havea non-empty babel-cert-private-key will be used to populatethe client_certificate_type extension in a ClientHello.¶
Indicates whether packet logging is enabled(true) or disabled (false) on this interface.¶
A reference or URL link to a file that contains a timestamped logof packets received and sent on babel-udp-port on this interface.The[libpcap] file format with a .pcap file extensionSHOULD be supported forpacket log files. Logging isenabled/disabled by babel-packet-log-enable.Implementations will need to carefully manage and limitmemory used by packet logs.¶
Statistics collection object for this interface.¶
A set of babel-neighbor-obj objects.¶
object { uint ro babel-sent-mcast-hello; uint ro babel-sent-mcast-update; uint ro babel-sent-ucast-hello; uint ro babel-sent-ucast-update; uint ro babel-sent-IHU; uint ro babel-received-packets;} babel-if-stats-obj;¶
A count of the number of multicast Hello packets sent on this interface.¶
A count of the number of multicast update packets sent on this interface.¶
A count of the number of unicast Hello packets sent on this interface.¶
A count of the number of unicast update packets sent on this interface.¶
A count of the number of "I Heard You" (IHU) packets sent on this interface.¶
A count of the number of Babel packets received on this interface.¶
object { ip-address ro babel-neighbor-address; [binary ro babel-hello-mcast-history;] [binary ro babel-hello-ucast-history;] uint ro babel-txcost; uint ro babel-exp-mcast-hello-seqno; uint ro babel-exp-ucast-hello-seqno; [uint ro babel-ucast-hello-seqno;] [uint ro babel-ucast-hello-interval;] [uint ro babel-rxcost;] [uint ro babel-cost;]} babel-neighbor-obj;¶
IPv4 or IPv6 address the neighbor sends packets from.¶
The multicast Hello history of whether or notthe multicast Hello packets prior to babel-exp-mcast-hello-seqnowere received.A binary sequence where the most recently received Hellois expressed as a "1" placed in the leftmost bit, with prior bits shiftedright (and "0" bits placed between prior Hello bits and most recent Hellofor any not-received Hellos). This value should be displayed usinghex digits ([0-9a-fA-F]). See[RFC8966],Appendix A.1.¶
The unicast Hello history of whether or not theunicast Hello packets prior to babel-exp-ucast-hello-seqno were received.A binary sequence where the most recently received Hellois expressed as a "1" placed in the leftmost bit, with prior bits shiftedright (and "0" bits placed between prior Hello bits and the most recent Hellofor any not-received Hellos). This value should be displayed usinghex digits ([0-9a-fA-F]). See[RFC8966],Appendix A.1.¶
Transmission cost value from the last IHU packet received fromthis neighbor, or the maximum value to indicate the IHU hold timerfor this neighbor has expired. See[RFC8966],Section 3.4.2.This is a 16-bit unsigned integer.¶
Expected multicast Hello sequence number ofnext Hello to be received from this neighbor. If multicast Hello packetsare not expected or processing of multicast packets is not enabled, thisMUST be NULL.This is a 16-bit unsigned integer; if the data model useszero (0) to represent NULL values for unsigned integers,the data modelMAY use a different data type that allowsdifferentiation between zero (0) and NULL.¶
Expected unicast Hello sequence number of nextHello to be received from this neighbor. If unicast Hello packets are notexpected or processing of unicast packets is not enabled, thisMUST beNULL.This is a 16-bit unsigned integer; if the data model useszero (0) to represent NULL values for unsigned integers,the data modelMAY use a different data type that allowsdifferentiation between zero (0) and NULL.¶
The current sequence number in use for unicast Hellossent to this neighbor. If unicast Hellos are not being sent,thisMUST be NULL.This is a 16-bit unsigned integer; if the data model useszero (0) to represent NULL values for unsigned integers,the data modelMAY use a different data type that allowsdifferentiation between zero (0) and NULL.¶
The current interval in use for unicast Hellossent to this neighbor. Units are centiseconds.This is a 16-bit unsigned integer.¶
Reception cost calculated for this neighbor. This value isusually derived from the Hello history, which may be combined with otherdata, such as statistics maintained by the link layer. The rxcost is sentto a neighbor in each IHU. See[RFC8966],Section 3.4.3.This is a 16-bit unsigned integer.¶
The link cost, as computed from the valuesmaintained in the neighbor table: the statistics kept in theneighbor table about the reception of Hellos and the txcostcomputed from received IHU packets.This is a 16-bit unsigned integer.¶
object { ip-address ro babel-route-prefix; uint ro babel-route-prefix-length; binary ro babel-route-router-id; reference ro babel-route-neighbor; uint ro babel-route-received-metric; uint ro babel-route-calculated-metric; uint ro babel-route-seqno; ip-address ro babel-route-next-hop; boolean ro babel-route-feasible; boolean ro babel-route-selected;} babel-route-obj;¶
Prefix (expressed in IP address format) for which thisroute is advertised.¶
Length of the prefix for which this route is advertised.¶
The router-id of the router that originated this route.¶
Reference to the babel-neighbors entry for the neighborthat advertised this route.¶
The metric with which this route was advertisedby the neighbor, or the maximum value to indicate the route wasrecently retracted and is temporarily unreachable (seeSection 3.5.4 of [RFC8966]). This metric will beNULL if the route was not received from a neighborbut was generated through other means. At least one of the followingMUST be non-NULL: babel-route-calculated-metricor babel-route-received-metric.Having both be non-NULL is expected for a route that is received andsubsequently advertised.This is a 16-bit unsigned integer; if the data model useszero (0) to represent NULL values for unsigned integers,the data modelMAY use a different data type that allowsdifferentiation between zero (0) and NULL.¶
A calculated metric for this route. How themetric is calculated is implementation specific. The maximum valueindicates the route was recently retracted and is temporarily unreachable(seeSection 3.5.4 of [RFC8966]).At least one of the followingMUST be non-NULL: babel-route-calculated-metric or babel-route-received-metric.Having both be non-NULL is expected for a route that is received andsubsequently advertised.This is a 16-bit unsigned integer; if the data model useszero (0) to represent NULL values for unsigned integers,the data modelMAY use a different data type that allowsdifferentiation between zero (0) and NULL.¶
The sequence number with which this route was advertised.This is a 16-bit unsigned integer.¶
The next-hop address of this route. This will be emptyif this route has no next-hop address.¶
A Boolean flag indicating whether this route is feasible,as defined inSection 3.5.1 of [RFC8966]).¶
A Boolean flag indicating whether this route is selected(i.e., whether it is currently being used for forwarding andis being advertised).¶
object { boolean rw babel-mac-default-apply; babel-mac-key-obj rw babel-mac-keys<0..*>;} babel-mac-key-set-obj;¶
A Boolean flag indicating whether this object instance isapplied to all new babel-interfaces instances by default.If "true", this instance is applied tonew babel-interfaces instances at the time they are created by includingit in the babel-if-mac-key-sets list.If "false", this instance is not applied to new babel-interfacesinstances when they are created.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
A set of babel-mac-key-obj objects.¶
object { string rw babel-mac-key-name; boolean rw babel-mac-key-use-send; boolean rw babel-mac-key-use-verify; binary -- babel-mac-key-value; string rw babel-mac-key-algorithm; [operation babel-mac-key-test;]} babel-mac-key-obj;¶
A unique name for this MAC key that can be used to identifythe key in this object instance since the key value is notallowed to be read. This valueMUST NOT be empty and can only be provided when thisinstance is created (i.e., it is not subsequently writable).The valueMAY be auto-generated if not explicitly supplied when the instance is created.¶
Indicates whether this key value is used to compute a MACand include that MAC in the sent Babelpacket. A MAC for sent packets is computed using this key if the valueis "true". If the value is "false", this key is not used tocompute a MAC to include in sent Babel packets.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
Indicates whether this key value is used to verifyincoming Babel packets. This key is used to verifyincoming packets if the value is "true". If the valueis "false", no MAC is computed from this key forcomparison with the MAC in an incoming packet.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
The value of the MAC key. An implementationMUST NOT allowthis parameter to be read. This can be done by always providingan empty string when read, through permissions, or by other means.This valueMUST be provided when thisinstance is created and is not subsequently writable.This value is of a length suitable for the associatedbabel-mac-key-algorithm.If the algorithm is based on the Hashed Message Authentication Code (HMAC) construction[RFC2104],the lengthMUST be between 0 and an upper limit that is at leastthe size of the output length (where the "HMAC-SHA256" output lengthis 32 octets as described in[RFC4868]). Longer lengthsMAY besupported but are not necessary if the management system has theability to generate a suitably random value (e.g., by randomlygenerating a value or by using a key derivation technique asrecommended in the security considerations inSection 7 of [RFC8967]). If thealgorithm is "BLAKE2s-128", the lengthMUST be between 0 and 32bytes inclusive as specified by[RFC7693].¶
The name of the MAC algorithm used with this key.The valueMUST be the same as one of the enumerationslisted in the babel-mac-algorithms parameter.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
An operation that allows the MAC key and MAC algorithm to be tested to see if they produce an expected outcome. Inputto this operation is a binary string and a calculated MAC(also in the format of a binary string) for the binary string.The implementation isexpected to create a MAC over the binary string using thebabel-mac-key-value and the babel-mac-key-algorithm. Theoutput of this operation is a Boolean indication that thecalculated MAC matched the input MAC (true) orthe MACs did not match (false).¶
object { boolean rw babel-dtls-default-apply; babel-dtls-cert-obj rw babel-dtls-certs<0..*>;} babel-dtls-cert-set-obj;¶
A Boolean flag indicating whether this object instance isapplied to all new babel-interfaces instances by default.If "true", this instance is applied tonew babel-interfaces instances at the time they are created by includingit in the babel-interface-dtls-certs list.If "false", this instance is not applied to new babel-interfacesinstances when they are created.An implementationMAY chooseto expose this parameter as read-only ("ro").¶
A set of babel-dtls-cert-obj objects. This contains both certificatesfor this implementation to present for authentication and those to acceptfrom others. Certificates with a non-empty babel-cert-private-key canbe presented by this implementation for authentication.¶
object { string rw babel-cert-name; string rw babel-cert-value; string rw babel-cert-type; binary -- babel-cert-private-key;} babel-dtls-cert-obj;¶
A unique name for this certificate that can be used to identifythe certificate in this object instance since the value is too longto be useful for identification. This valueMUST NOT be empty and canonly be provided when this instance is created (i.e., it is notsubsequently writable). The valueMAY be auto-generated if notexplicitly supplied when the instance is created.¶
The certificate in Privacy-Enhanced Mail (PEM) format[RFC7468].This valueMUST be provided when thisinstance is created and is not subsequently writable.¶
The name of the certificate type of this objectinstance. The valueMUST be the same as one of the enumerationslisted in the babel-dtls-cert-types parameter.This value can only be provided when thisinstance is created and is not subsequently writable.¶
The value of the private key. If this is non-empty, thiscertificate can be used by this implementationto provide a certificate during DTLS handshaking.An implementationMUST NOT allowthis parameter to be read. This can be done by always providingan empty string when read, through permissions, or by other means.This value can only be provided when thisinstance is created and is not subsequently writable.¶
ImplementationsMAY extend this information model with other parameters orobjects. For example, an implementationMAY choose to expose Babel routefiltering rules by adding a route filtering object with parameters appropriateto how route filtering is done in that implementation. The precise meansused to extend the information model would be specific to the data modelthe implementation uses to expose this information.¶
This document defines a set of information model objects and parameters thatmay be exposed and visible from other devices. Some of these information model objects and parameters may be configured. Securing access to and ensuring the integrity of this datais in scope of and the responsibility of any data model derived from thisinformation model. Specifically, any YANG[RFC7950] data model is expectedto define security exposure of the various parameters, and a[TR-181] data modelwill be secured by the mechanisms defined for the management protocol used totransport it.¶
Misconfiguration (whether unintentional or malicious) can prevent reachabilityor cause poor network performance (increased latency, jitter, etc.).Misconfiguration of security credentials can cause a denial-of-service conditionfor the Babel routing protocol.The information in this model discloses network topology, which can be usedto mount subsequent attacks on traffic traversing the network.¶
This information model defines objects that can allow credentials (for thisdevice, for trusted devices, and for trusted certificate authorities) tobe added and deleted. Public keys may be exposed throughthis model. This model requires that private keys and MACkeys never be exposed. Certificates used by[RFC8968]implementations use separate parameters to model the publicparts (including the public key) and the private key.¶
MAC keys are allowed to be as short as zero length. This isuseful for testing. It isRECOMMENDED that network operators follow current best practices for key length and generation ofkeys related to the MAC algorithm associated with the key.Short (and zero-length) keys are highly susceptible to brute-force attacksand thereforeSHOULD NOT be used.See the security considerations as described inSection 7 of [RFC8967] for additional considerations related to MAC keys; note that there are some specific key value recommendations in the fifth paragraph.It says that if it is necessary to derive keys from a human-readablepassphrase, "only the derived keys should be communicated to the routers"and "the original passphrase itself should be kept on the host used toperform the key generation" (which would be the management system in thecase of a remote management protocol). It also recommends that keys "shouldhave a length of 32 octets (both for HMAC-SHA256 and BLAKE2s), and bechosen randomly".¶
This information model uses key sets and certification sets to provide a means of grouping keys and certificates. This makes it easy to usea different set per interface, use the same set for one or more interfaces, havea default set in case a new interface is instantiated, andchange keys and certificates as needed.¶
This document has no IANA actions.¶
Juliusz Chroboczek,Toke Høiland-Jørgensen,David Schinazi,Antonin Décimo,Roman Danyliw,Benjamin Kaduk,Valery Smyslov,Alvaro Retana,Donald Eastlake,Martin Vigoureux,Acee Lindem, andCarsten Bormann have been very helpful inrefining this information model.¶
The language in the"Notation" section was mostly taken from[RFC8193].¶