submodule ietf-snmp-usm {

  belongs-to ietf-snmp {

    prefix snmp;

  }

  import ietf-yang-types {

    prefix yang;

  }

  import ietf-netconf-acm {

    prefix nacm;

  }

  include ietf-snmp-common;

  include ietf-snmp-target;

  include ietf-snmp-proxy;

  organization

    "IETF NETMOD (NETCONF Data Modeling Language) Working Group";

  contact

    "WG Web:   <http://tools.ietf.org/wg/netmod/>

     WG List:  <mailto:netmod@ietf.org>

     WG Chair: Thomas Nadeau

               <mailto:tnadeau@lucidvision.com>

     WG Chair: Juergen Schoenwaelder

               <mailto:j.schoenwaelder@jacobs-university.de>

     Editor:   Martin Bjorklund

               <mailto:mbj@tail-f.com>

     Editor:   Juergen Schoenwaelder

               <mailto:j.schoenwaelder@jacobs-university.de>";

  description

    "This submodule contains a collection of YANG definitions for

     configuring the User-based Security Model (USM) of SNMP.

     Copyright (c) 2014 IETF Trust and the persons identified as

     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or

     without modification, is permitted pursuant to, and subject

     to the license terms contained in, the Simplified BSD License

     set forth in Section 4.c of the IETF Trust's Legal Provisions

     Relating to IETF Documents

     (http://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC 7407; see

     the RFC itself for full legal notices.";

  reference

    "RFC 3414: User-based Security Model (USM) for version 3 of the

       Simple Network Management Protocol (SNMPv3)";

  revision 2014-12-10 {

    description

      "Initial revision.";

    reference

      "RFC 7407: A YANG Data Model for SNMP Configuration";

  }

  grouping key {

    leaf key {

      type yang:hex-string;

      mandatory true;

      nacm:default-deny-all;

      description

        "Localized key specified as a list of colon-specified

         hexadecimal octets.";

    }

  }

  grouping user-list {

    list user {

      key "name";

      reference

        "RFC 3414: User-based Security Model (USM) for version 3

           of the Simple Network Management Protocol (SNMPv3).

           SNMP-USER-BASED-SM-MIB.usmUserTable";

      leaf name {

        type snmp:identifier;

        reference

          "RFC 3414: User-based Security Model (USM) for version 3

             of the Simple Network Management Protocol (SNMPv3).

             SNMP-USER-BASED-SM-MIB.usmUserName";

      }

      container auth {

        presence "enables authentication";

        description

          "Enables authentication of the user.";

        choice protocol {

          mandatory true;

          reference

            "RFC 3414: User-based Security Model (USM) for version 3

               of the Simple Network Management Protocol (SNMPv3).

               SNMP-USER-BASED-SM-MIB.usmUserAuthProtocol";

          container md5 {

            uses key;

            reference

              "RFC 3414: User-based Security Model (USM) for

                 version 3 of the Simple Network Management Protocol

                 (SNMPv3).

                 SNMP-USER-BASED-SM-MIB.usmHMACMD5AuthProtocol";

          }

          container sha {

            uses key;

            reference

              "RFC 3414: User-based Security Model (USM) for

                 version 3 of the Simple Network Management Protocol

                 (SNMPv3).

                 SNMP-USER-BASED-SM-MIB.usmHMACSHAAuthProtocol";

          }

        }

      }

      container priv {

        must "../auth" {

          error-message

            "when privacy (confidentiality) is used, "

          + "authentication must also be used";

        }

        presence "enables encryption";

        description

          "Enables encryption of SNMP messages.";

        choice protocol {

          mandatory true;

          reference

            "RFC 3414: User-based Security Model (USM) for version 3

               of the Simple Network Management Protocol (SNMPv3).

               SNMP-USER-BASED-SM-MIB.usmUserPrivProtocol";

          container des {

            uses key;

            reference

              "RFC 3414: User-based Security Model (USM) for

                 version 3 of the Simple Network Management Protocol

                 (SNMPv3).

                 SNMP-USER-BASED-SM-MIB.usmDESPrivProtocol";

          }

          container aes {

            uses key;

            reference

              "RFC 3826: The Advanced Encryption Standard (AES)

                 Cipher Algorithm in the SNMP User-based Security

                 Model.

                 SNMP-USM-AES-MIB.usmAesCfb128Protocol";

          }

        }

      }

    }

  }

  augment /snmp:snmp {

    container usm {

      description

        "Configuration of the User-based Security Model.";

      container local {

        uses user-list;

      }

      list remote {

        key "engine-id";

        leaf engine-id {

          type snmp:engine-id;

          reference

            "RFC 3414: User-based Security Model (USM) for version 3

               of the Simple Network Management Protocol (SNMPv3).

               SNMP-USER-BASED-SM-MIB.usmUserEngineID";

        }

        uses user-list;

      }

    }

  }

  grouping usm-target-params {

    container usm {

      description

        "User-based SNMPv3 parameters type.

         Represents snmpTargetParamsMPModel '3' and

         snmpTargetParamsSecurityModel '3'.";

      leaf user-name {

        type snmp:security-name;

        mandatory true;

        reference

          "RFC 3413: Simple Network Management Protocol (SNMP).

             Applications.

             SNMP-TARGET-MIB.snmpTargetParamsSecurityName";

      }

      leaf security-level {

        type snmp:security-level;

        mandatory true;

        reference

          "RFC 3413: Simple Network Management Protocol (SNMP).

             Applications.

             SNMP-TARGET-MIB.snmpTargetParamsSecurityLevel";

      }

    }

  }

  augment /snmp:snmp/snmp:target-params/snmp:params {

    case usm {

      uses usm-target-params;

    }

  }

}