submodule ietf-snmp-tls {

  belongs-to ietf-snmp {

    prefix snmp;

  }

  import ietf-inet-types {

    prefix inet;

  }

  import ietf-x509-cert-to-name {

    prefix x509c2n;

  }

  include ietf-snmp-common;

  include ietf-snmp-engine;

  include ietf-snmp-target;

  organization

    "IETF NETMOD (NETCONF Data Modeling Language) Working Group";

  contact

    "WG Web:   <http://tools.ietf.org/wg/netmod/>

     WG List:  <mailto:netmod@ietf.org>

     WG Chair: Thomas Nadeau

               <mailto:tnadeau@lucidvision.com>

     WG Chair: Juergen Schoenwaelder

               <mailto:j.schoenwaelder@jacobs-university.de>

     Editor:   Martin Bjorklund

               <mailto:mbj@tail-f.com>

     Editor:   Juergen Schoenwaelder

               <mailto:j.schoenwaelder@jacobs-university.de>";

  description

    "This submodule contains a collection of YANG definitions for

     configuring the Transport Layer Security Transport Model (TLSTM)

     of SNMP.

     Copyright (c) 2014 IETF Trust and the persons identified as

     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or

     without modification, is permitted pursuant to, and subject

     to the license terms contained in, the Simplified BSD License

     set forth in Section 4.c of the IETF Trust's Legal Provisions

     Relating to IETF Documents

     (http://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC 7407; see

     the RFC itself for full legal notices.";

  reference

    "RFC 6353: Transport Layer Security (TLS) Transport Model for

       the Simple Network Management Protocol (SNMP)";

  revision 2014-12-10 {

    description

      "Initial revision.";

    reference

      "RFC 7407: A YANG Data Model for SNMP Configuration";

  }

  feature tlstm {

    description

      "A server implements this feature if it supports the

      Transport Layer Security Transport Model for SNMP.";

    reference

      "RFC 6353: Transport Layer Security (TLS) Transport Model for

         the Simple Network Management Protocol (SNMP)";

  }

  augment /snmp:snmp/snmp:engine/snmp:listen/snmp:transport {

    if-feature tlstm;

    case tls {

      container tls {

        description

          "A list of IPv4 and IPv6 addresses and ports to which the

           engine listens for SNMP messages over TLS.";

        leaf ip {

          type inet:ip-address;

          mandatory true;

          description

            "The IPv4 or IPv6 address on which the engine listens

             for SNMP messages over TLS.";

        }

        leaf port {

          type inet:port-number;

          description

            "The TCP port on which the engine listens for SNMP

             messages over TLS.

             If the port is not configured, an engine that

             acts as a Command Responder uses port 10161, and

             an engine that acts as a Notification Receiver

             uses port 10162.";

        }

      }

    }

    case dtls {

      container dtls {

        description

          "A list of IPv4 and IPv6 addresses and ports to which the

           engine listens for SNMP messages over DTLS.";

        leaf ip {

          type inet:ip-address;

          mandatory true;

          description

            "The IPv4 or IPv6 address on which the engine listens

             for SNMP messages over DTLS.";

        }

        leaf port {

          type inet:port-number;

          description

            "The UDP port on which the engine listens for SNMP

             messages over DTLS.

             If the port is not configured, an engine that

             acts as a Command Responder uses port 10161, and

             an engine that acts as a Notification Receiver

             uses port 10162.";

        }

      }

    }

  }

  augment /snmp:snmp {

    if-feature tlstm;

    container tlstm {

      uses x509c2n:cert-to-name {

        description

          "Defines how certificates are mapped to names.  The

           resulting name is used as a security name.";

        refine cert-to-name/map-type {

          description

            "Mappings that use the snmpTlstmCertToTSNData column

             need to augment the cert-to-name list with

             additional configuration objects corresponding

             to the snmpTlstmCertToTSNData value.  Such objects

             should use the 'when' statement to make them

             conditional based on the map-type.";

        }

      }

    }

  }

  grouping tls-transport {

    leaf ip {

      type inet:host;

      mandatory true;

      reference

        "RFC 3413: Simple Network Management Protocol (SNMP).

           Applications.

           SNMP-TARGET-MIB.snmpTargetAddrTAddress

         RFC 6353: Transport Layer Security (TLS) Transport Model

           for the Simple Network Management Protocol (SNMP).

           SNMP-TLS-TM-MIB.SnmpTLSAddress";

    }

    leaf port {

      type inet:port-number;

      default 10161;

      reference

        "RFC 3413: Simple Network Management Protocol (SNMP).

           Applications.

           SNMP-TARGET-MIB.snmpTargetAddrTAddress

         RFC 6353: Transport Layer Security (TLS) Transport Model

           for the Simple Network Management Protocol (SNMP).

           SNMP-TLS-TM-MIB.SnmpTLSAddress";

    }

    leaf client-fingerprint {

      type x509c2n:tls-fingerprint;

      reference

        "RFC 6353: Transport Layer Security (TLS) Transport Model

           for the Simple Network Management Protocol (SNMP).

           SNMP-TLS-TM-MIB.snmpTlstmParamsClientFingerprint";

    }

    leaf server-fingerprint {

      type x509c2n:tls-fingerprint;

      reference

        "RFC 6353: Transport Layer Security (TLS) Transport Model

           for the Simple Network Management Protocol (SNMP).

           SNMP-TLS-TM-MIB.snmpTlstmAddrServerFingerprint";

    }

    leaf server-identity {

      type snmp:admin-string;

      reference

        "RFC 6353: Transport Layer Security (TLS) Transport Model

           for the Simple Network Management Protocol (SNMP).

           SNMP-TLS-TM-MIB.snmpTlstmAddrServerIdentity";

    }

  }

  augment /snmp:snmp/snmp:target/snmp:transport {

    if-feature tlstm;

    case tls {

      reference

        "RFC 6353: Transport Layer Security (TLS) Transport Model

           for the Simple Network Management Protocol (SNMP).

           SNMP-TLS-TM-MIB.snmpTLSTCPDomain";

      container tls {

        uses tls-transport;

      }

    }

  }

  augment /snmp:snmp/snmp:target/snmp:transport {

    if-feature tlstm;

    case dtls {

      reference

        "RFC 6353: Transport Layer Security (TLS) Transport Model

           for the Simple Network Management Protocol (SNMP).

           SNMP-TLS-TM-MIB.snmpDTLSUDPDomain";

      container dtls {

        uses tls-transport;

      }

    }

  }

}