SNMP-TLS-TM-MIB DEFINITIONS ::= BEGIN

IMPORTS

    MODULE-IDENTITY, OBJECT-TYPE,

    OBJECT-IDENTITY, mib-2, snmpDomains,

    Counter32, Unsigned32, Gauge32, NOTIFICATION-TYPE

      FROM SNMPv2-SMI                 -- RFC 2578 or any update thereof

    TEXTUAL-CONVENTION, TimeStamp, RowStatus, StorageType,

    AutonomousType

      FROM SNMPv2-TC                  -- RFC 2579 or any update thereof

    MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP

      FROM SNMPv2-CONF                -- RFC 2580 or any update thereof

    SnmpAdminString

      FROM SNMP-FRAMEWORK-MIB         -- RFC 3411 or any update thereof

    snmpTargetParamsName, snmpTargetAddrName

      FROM SNMP-TARGET-MIB            -- RFC 3413 or any update thereof

    ;

snmpTlstmMIB MODULE-IDENTITY

    LAST-UPDATED "201107190000Z"

    ORGANIZATION "ISMS Working Group"

    CONTACT-INFO "WG-EMail:   isms@lists.ietf.org

                  Subscribe:  isms-request@lists.ietf.org

                  Chairs:

                     Juergen Schoenwaelder

                     Jacobs University Bremen

                     Campus Ring 1

                     28725 Bremen

                     Germany

                     +49 421 200-3587

                     j.schoenwaelder@jacobs-university.de

                     Russ Mundy

                     SPARTA, Inc.

                     7110 Samuel Morse Drive

                     Columbia, MD  21046

                     USA

                  Editor:

                     Wes Hardaker

                     SPARTA, Inc.

                     P.O. Box 382

                     Davis, CA  95617

                     USA

                     ietf@hardakers.net

                  "

    DESCRIPTION  "

        The TLS Transport Model MIB

        Copyright (c) 2010-2011 IETF Trust and the persons identified

        as authors of the code.  All rights reserved.

        Redistribution and use in source and binary forms, with or

        without modification, is permitted pursuant to, and subject

        to the license terms contained in, the Simplified BSD License

        set forth in Section 4.c of the IETF Trust's Legal Provisions

        Relating to IETF Documents

        (http://trustee.ietf.org/license-info)."

       REVISION     "201107190000Z"

       DESCRIPTION  "This version of this MIB module is part of

                     RFC 6353; see the RFC itself for full legal

                     notices.  The only change was to introduce

                     new wording to reflect require changes for

                     IDNA addresses in the SnmpTLSAddress TC."

       REVISION     "201005070000Z"

       DESCRIPTION  "This version of this MIB module is part of

                     RFC 5953; see the RFC itself for full legal

                     notices."

    ::= { mib-2 198 }

-- ************************************************

-- subtrees of the SNMP-TLS-TM-MIB

-- ************************************************

snmpTlstmNotifications OBJECT IDENTIFIER ::= { snmpTlstmMIB 0 }

snmpTlstmIdentities    OBJECT IDENTIFIER ::= { snmpTlstmMIB 1 }

snmpTlstmObjects       OBJECT IDENTIFIER ::= { snmpTlstmMIB 2 }

snmpTlstmConformance   OBJECT IDENTIFIER ::= { snmpTlstmMIB 3 }

-- ************************************************

-- snmpTlstmObjects - Objects

-- ************************************************

snmpTLSTCPDomain OBJECT-IDENTITY

    STATUS      current

    DESCRIPTION

        "The SNMP over TLS via TCP transport domain.  The

        corresponding transport address is of type SnmpTLSAddress.

        The securityName prefix to be associated with the

        snmpTLSTCPDomain is 'tls'.  This prefix may be used by

        security models or other components to identify which secure

        transport infrastructure authenticated a securityName."

    REFERENCE

      "RFC 2579: Textual Conventions for SMIv2"

    ::= { snmpDomains 8 }

snmpDTLSUDPDomain OBJECT-IDENTITY

    STATUS      current

    DESCRIPTION

        "The SNMP over DTLS via UDP transport domain.  The

        corresponding transport address is of type SnmpTLSAddress.

        The securityName prefix to be associated with the

        snmpDTLSUDPDomain is 'dtls'.  This prefix may be used by

        security models or other components to identify which secure

        transport infrastructure authenticated a securityName."

    REFERENCE

      "RFC 2579: Textual Conventions for SMIv2"

    ::= { snmpDomains 9 }

SnmpTLSAddress ::= TEXTUAL-CONVENTION

    DISPLAY-HINT "1a"

    STATUS       current

    DESCRIPTION

        "Represents an IPv4 address, an IPv6 address, or a

         US-ASCII-encoded hostname and port number.

        An IPv4 address must be in dotted decimal format followed by a

        colon ':' (US-ASCII character 0x3A) and a decimal port number

        in US-ASCII.

        An IPv6 address must be a colon-separated format (as described

        in RFC 5952), surrounded by square brackets ('[', US-ASCII

        character 0x5B, and ']', US-ASCII character 0x5D), followed by

        a colon ':' (US-ASCII character 0x3A) and a decimal port number

        in US-ASCII.

        A hostname is always in US-ASCII (as per RFC 1123);

        internationalized hostnames are encoded as A-labels as specified

        in  RFC 5890.  The hostname is followed by a

        colon ':' (US-ASCII character 0x3A) and a decimal port number

        in US-ASCII.  The name SHOULD be fully qualified whenever

        possible.

        Values of this textual convention may not be directly usable

        as transport-layer addressing information, and may require

        run-time resolution.  As such, applications that write them

        must be prepared for handling errors if such values are not

        supported, or cannot be resolved (if resolution occurs at the

        time of the management operation).

        The DESCRIPTION clause of TransportAddress objects that may

        have SnmpTLSAddress values must fully describe how (and

        when) such names are to be resolved to IP addresses and vice

        versa.

        This textual convention SHOULD NOT be used directly in object

        definitions since it restricts addresses to a specific

        format.  However, if it is used, it MAY be used either on its

        own or in conjunction with TransportAddressType or

        TransportDomain as a pair.

        When this textual convention is used as a syntax of an index

        object, there may be issues with the limit of 128

        sub-identifiers specified in SMIv2 (STD 58).  It is RECOMMENDED

        that all MIB documents using this textual convention make

        explicit any limitations on index component lengths that

        management software must observe.  This may be done either by

        including SIZE constraints on the index components or by

        specifying applicable constraints in the conceptual row

        DESCRIPTION clause or in the surrounding documentation."

    REFERENCE

      "RFC 1123: Requirements for Internet Hosts - Application and

                 Support

       RFC 5890: Internationalized Domain Names for Applications (IDNA):

                 Definitions and Document Framework

       RFC 5952: A Recommendation for IPv6 Address Text Representation

      "

    SYNTAX       OCTET STRING (SIZE (1..255))

SnmpTLSFingerprint ::= TEXTUAL-CONVENTION

    DISPLAY-HINT "1x:1x"

    STATUS       current

    DESCRIPTION

       "A fingerprint value that can be used to uniquely reference

       other data of potentially arbitrary length.

       An SnmpTLSFingerprint value is composed of a 1-octet hashing

       algorithm identifier followed by the fingerprint value.  The

       octet value encoded is taken from the IANA TLS HashAlgorithm

       Registry (RFC 5246).  The remaining octets are filled using the

       results of the hashing algorithm.

       This TEXTUAL-CONVENTION allows for a zero-length (blank)

       SnmpTLSFingerprint value for use in tables where the

       fingerprint value may be optional.  MIB definitions or

       implementations may refuse to accept a zero-length value as

       appropriate."

       REFERENCE "RFC 5246: The Transport Layer

                  Security (TLS) Protocol Version 1.2

                  http://www.iana.org/assignments/tls-parameters/

       "

    SYNTAX OCTET STRING (SIZE (0..255))

-- Identities for use in the snmpTlstmCertToTSNTable

snmpTlstmCertToTSNMIdentities OBJECT IDENTIFIER

    ::= { snmpTlstmIdentities 1 }

snmpTlstmCertSpecified OBJECT-IDENTITY

    STATUS        current

    DESCRIPTION  "Directly specifies the tmSecurityName to be used for

                  this certificate.  The value of the tmSecurityName

                  to use is specified in the snmpTlstmCertToTSNData

                  column.  The snmpTlstmCertToTSNData column must

                  contain a non-zero length SnmpAdminString compliant

                  value or the mapping described in this row must be

                  considered a failure."

    ::= { snmpTlstmCertToTSNMIdentities 1 }

snmpTlstmCertSANRFC822Name OBJECT-IDENTITY

    STATUS        current

    DESCRIPTION  "Maps a subjectAltName's rfc822Name to a

                  tmSecurityName.  The local part of the rfc822Name is

                  passed unaltered but the host-part of the name must

                  be passed in lowercase.  This mapping results in a

                  1:1 correspondence between equivalent subjectAltName

                  rfc822Name values and tmSecurityName values except

                  that the host-part of the name MUST be passed in

                  lowercase.

                  Example rfc822Name Field:  FooBar@Example.COM

                  is mapped to tmSecurityName: FooBar@example.com."

    ::= { snmpTlstmCertToTSNMIdentities 2 }

snmpTlstmCertSANDNSName OBJECT-IDENTITY

    STATUS        current

    DESCRIPTION  "Maps a subjectAltName's dNSName to a

                  tmSecurityName after first converting it to all

                  lowercase (RFC 5280 does not specify converting to

                  lowercase so this involves an extra step).  This

                  mapping results in a 1:1 correspondence between

                  subjectAltName dNSName values and the tmSecurityName

                  values."

    REFERENCE "RFC 5280 - Internet X.509 Public Key Infrastructure

                         Certificate and Certificate Revocation

                         List (CRL) Profile."

    ::= { snmpTlstmCertToTSNMIdentities 3 }

snmpTlstmCertSANIpAddress OBJECT-IDENTITY

    STATUS        current

    DESCRIPTION  "Maps a subjectAltName's iPAddress to a

                  tmSecurityName by transforming the binary encoded

                  address as follows:

                  1) for IPv4, the value is converted into a

                     decimal-dotted quad address (e.g., '192.0.2.1').

                  2) for IPv6 addresses, the value is converted into a

                     32-character all lowercase hexadecimal string

                     without any colon separators.

                  This mapping results in a 1:1 correspondence between

                  subjectAltName iPAddress values and the

                  tmSecurityName values.

                  The resulting length of an encoded IPv6 address is

                  the maximum length supported by the View-Based

                  Access Control Model (VACM).  Using both the

                  Transport Security Model's support for transport

                  prefixes (see the SNMP-TSM-MIB's

                  snmpTsmConfigurationUsePrefix object for details)

                  will result in securityName lengths that exceed what

                  VACM can handle."

    ::= { snmpTlstmCertToTSNMIdentities 4 }

snmpTlstmCertSANAny OBJECT-IDENTITY

    STATUS        current

    DESCRIPTION  "Maps any of the following fields using the

                  corresponding mapping algorithms:

                  |------------+----------------------------|

                  | Type       | Algorithm                  |

                  |------------+----------------------------|

                  | rfc822Name | snmpTlstmCertSANRFC822Name |

                  | dNSName    | snmpTlstmCertSANDNSName    |

                  | iPAddress  | snmpTlstmCertSANIpAddress  |

                  |------------+----------------------------|

                  The first matching subjectAltName value found in the

                  certificate of the above types MUST be used when

                  deriving the tmSecurityName.  The mapping algorithm

                  specified in the 'Algorithm' column MUST be used to

                  derive the tmSecurityName.

                  This mapping results in a 1:1 correspondence between

                  subjectAltName values and tmSecurityName values.  The

                  three sub-mapping algorithms produced by this

                  combined algorithm cannot produce conflicting

                  results between themselves."

    ::= { snmpTlstmCertToTSNMIdentities 5 }

snmpTlstmCertCommonName OBJECT-IDENTITY

    STATUS        current

    DESCRIPTION  "Maps a certificate's CommonName to a tmSecurityName

                  after converting it to a UTF-8 encoding.  The usage

                  of CommonNames is deprecated and users are

                  encouraged to use subjectAltName mapping methods

                  instead.  This mapping results in a 1:1

                  correspondence between certificate CommonName values

                  and tmSecurityName values."

    ::= { snmpTlstmCertToTSNMIdentities 6 }

-- The snmpTlstmSession Group

snmpTlstmSession           OBJECT IDENTIFIER ::= { snmpTlstmObjects 1 }

snmpTlstmSessionOpens  OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

       "The number of times an openSession() request has been executed

       as a (D)TLS client, regardless of whether it succeeded or

       failed."

    ::= { snmpTlstmSession 1 }

snmpTlstmSessionClientCloses  OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of times a closeSession() request has been

        executed as a (D)TLS client, regardless of whether it

        succeeded or failed."

    ::= { snmpTlstmSession 2 }

snmpTlstmSessionOpenErrors  OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of times an openSession() request failed to open a

        session as a (D)TLS client, for any reason."

    ::= { snmpTlstmSession 3 }

snmpTlstmSessionAccepts  OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

       "The number of times a (D)TLS server has accepted a new

       connection from a client and has received at least one SNMP

       message through it."

    ::= { snmpTlstmSession 4 }

snmpTlstmSessionServerCloses  OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of times a closeSession() request has been

        executed as a (D)TLS server, regardless of whether it

        succeeded or failed."

    ::= { snmpTlstmSession 5 }

snmpTlstmSessionNoSessions  OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of times an outgoing message was dropped because

        the session associated with the passed tmStateReference was no

        longer (or was never) available."

    ::= { snmpTlstmSession 6 }

snmpTlstmSessionInvalidClientCertificates OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of times an incoming session was not established

        on a (D)TLS server because the presented client certificate

        was invalid.  Reasons for invalidation include, but are not

        limited to, cryptographic validation failures or lack of a

        suitable mapping row in the snmpTlstmCertToTSNTable."

    ::= { snmpTlstmSession 7 }

snmpTlstmSessionUnknownServerCertificate OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of times an outgoing session was not established

         on a (D)TLS client because the server certificate presented

         by an SNMP over (D)TLS server was invalid because no

         configured fingerprint or Certification Authority (CA) was

         acceptable to validate it.

         This may result because there was no entry in the

         snmpTlstmAddrTable or because no path could be found to a

         known CA."

    ::= { snmpTlstmSession 8 }

snmpTlstmSessionInvalidServerCertificates OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of times an outgoing session was not established

         on a (D)TLS client because the server certificate presented

         by an SNMP over (D)TLS server could not be validated even if

         the fingerprint or expected validation path was known.  That

         is, a cryptographic validation error occurred during

         certificate validation processing.

        Reasons for invalidation include, but are not

        limited to, cryptographic validation failures."

    ::= { snmpTlstmSession 9 }

snmpTlstmSessionInvalidCaches OBJECT-TYPE

    SYNTAX       Counter32

    MAX-ACCESS   read-only

    STATUS       current

    DESCRIPTION

        "The number of outgoing messages dropped because the

        tmStateReference referred to an invalid cache."

    ::= { snmpTlstmSession 10 }

-- Configuration Objects

snmpTlstmConfig             OBJECT IDENTIFIER ::= { snmpTlstmObjects 2 }

-- Certificate mapping

snmpTlstmCertificateMapping OBJECT IDENTIFIER ::= { snmpTlstmConfig 1 }

snmpTlstmCertToTSNCount OBJECT-TYPE

    SYNTAX      Gauge32

    MAX-ACCESS  read-only

    STATUS      current

    DESCRIPTION

        "A count of the number of entries in the

        snmpTlstmCertToTSNTable."

    ::= { snmpTlstmCertificateMapping 1 }

snmpTlstmCertToTSNTableLastChanged OBJECT-TYPE

    SYNTAX      TimeStamp

    MAX-ACCESS  read-only

    STATUS      current

    DESCRIPTION

        "The value of sysUpTime.0 when the snmpTlstmCertToTSNTable was

        last modified through any means, or 0 if it has not been

        modified since the command responder was started."

    ::= { snmpTlstmCertificateMapping 2 }

snmpTlstmCertToTSNTable OBJECT-TYPE

    SYNTAX      SEQUENCE OF SnmpTlstmCertToTSNEntry

    MAX-ACCESS  not-accessible

    STATUS      current

    DESCRIPTION

        "This table is used by a (D)TLS server to map the (D)TLS

        client's presented X.509 certificate to a tmSecurityName.

        On an incoming (D)TLS/SNMP connection, the client's presented

        certificate must either be validated based on an established

        trust anchor, or it must directly match a fingerprint in this

        table.  This table does not provide any mechanisms for

        configuring the trust anchors; the transfer of any needed

        trusted certificates for path validation is expected to occur

        through an out-of-band transfer.

        Once the certificate has been found acceptable (either by path

        validation or directly matching a fingerprint in this table),

        this table is consulted to determine the appropriate

        tmSecurityName to identify with the remote connection.  This

        is done by considering each active row from this table in

        prioritized order according to its snmpTlstmCertToTSNID value.

        Each row's snmpTlstmCertToTSNFingerprint value determines

        whether the row is a match for the incoming connection:

            1) If the row's snmpTlstmCertToTSNFingerprint value

               identifies the presented certificate, then consider the

               row as a successful match.

            2) If the row's snmpTlstmCertToTSNFingerprint value

               identifies a locally held copy of a trusted CA

               certificate and that CA certificate was used to

               validate the path to the presented certificate, then

               consider the row as a successful match.

        Once a matching row has been found, the

        snmpTlstmCertToTSNMapType value can be used to determine how

        the tmSecurityName to associate with the session should be

        determined.  See the snmpTlstmCertToTSNMapType column's

        DESCRIPTION for details on determining the tmSecurityName

        value.  If it is impossible to determine a tmSecurityName from

        the row's data combined with the data presented in the

        certificate, then additional rows MUST be searched looking for

        another potential match.  If a resulting tmSecurityName mapped

        from a given row is not compatible with the needed

        requirements of a tmSecurityName (e.g., VACM imposes a

        32-octet-maximum length and the certificate derived

        securityName could be longer), then it must be considered an

        invalid match and additional rows MUST be searched looking for

        another potential match.

        If no matching and valid row can be found, the connection MUST

        be closed and SNMP messages MUST NOT be accepted over it.

        Missing values of snmpTlstmCertToTSNID are acceptable and

        implementations should continue to the next highest numbered

        row.  It is recommended that administrators skip index values

        to leave room for the insertion of future rows (for example,

        use values of 10 and 20 when creating initial rows).

        Users are encouraged to make use of certificates with

        subjectAltName fields that can be used as tmSecurityNames so

        that a single root CA certificate can allow all child

        certificate's subjectAltName to map directly to a

        tmSecurityName via a 1:1 transformation.  However, this table

        is flexible to allow for situations where existing deployed

        certificate infrastructures do not provide adequate

        subjectAltName values for use as tmSecurityNames.

        Certificates may also be mapped to tmSecurityNames using the

        CommonName portion of the Subject field.  However, the usage

        of the CommonName field is deprecated and thus this usage is

        NOT RECOMMENDED.  Direct mapping from each individual

        certificate fingerprint to a tmSecurityName is also possible

        but requires one entry in the table per tmSecurityName and

        requires more management operations to completely configure a

        device."

    ::= { snmpTlstmCertificateMapping 3 }

snmpTlstmCertToTSNEntry OBJECT-TYPE

    SYNTAX      SnmpTlstmCertToTSNEntry

    MAX-ACCESS  not-accessible

    STATUS      current

    DESCRIPTION

        "A row in the snmpTlstmCertToTSNTable that specifies a mapping

        for an incoming (D)TLS certificate to a tmSecurityName to use

        for a connection."

    INDEX   { snmpTlstmCertToTSNID }

    ::= { snmpTlstmCertToTSNTable 1 }

SnmpTlstmCertToTSNEntry ::= SEQUENCE {

    snmpTlstmCertToTSNID           Unsigned32,

    snmpTlstmCertToTSNFingerprint  SnmpTLSFingerprint,

    snmpTlstmCertToTSNMapType      AutonomousType,

    snmpTlstmCertToTSNData         OCTET STRING,

    snmpTlstmCertToTSNStorageType  StorageType,

    snmpTlstmCertToTSNRowStatus    RowStatus

}

snmpTlstmCertToTSNID OBJECT-TYPE

    SYNTAX      Unsigned32 (1..4294967295)

    MAX-ACCESS  not-accessible

    STATUS      current

    DESCRIPTION

        "A unique, prioritized index for the given entry.  Lower

        numbers indicate a higher priority."

    ::= { snmpTlstmCertToTSNEntry 1 }

snmpTlstmCertToTSNFingerprint OBJECT-TYPE

    SYNTAX      SnmpTLSFingerprint (SIZE(1..255))

    MAX-ACCESS  read-create

    STATUS      current

    DESCRIPTION

        "A cryptographic hash of an X.509 certificate.  The results of

        a successful matching fingerprint to either the trusted CA in

        the certificate validation path or to the certificate itself

        is dictated by the snmpTlstmCertToTSNMapType column."

    ::= { snmpTlstmCertToTSNEntry 2 }

snmpTlstmCertToTSNMapType OBJECT-TYPE

    SYNTAX      AutonomousType

    MAX-ACCESS  read-create

    STATUS      current

    DESCRIPTION

        "Specifies the mapping type for deriving a tmSecurityName from

        a certificate.  Details for mapping of a particular type SHALL

        be specified in the DESCRIPTION clause of the OBJECT-IDENTITY

        that describes the mapping.  If a mapping succeeds it will

        return a tmSecurityName for use by the TLSTM model and

        processing stops.

        If the resulting mapped value is not compatible with the

        needed requirements of a tmSecurityName (e.g., VACM imposes a

        32-octet-maximum length and the certificate derived

        securityName could be longer), then future rows MUST be

        searched for additional snmpTlstmCertToTSNFingerprint matches

        to look for a mapping that succeeds.

        Suitable values for assigning to this object that are defined

        within the SNMP-TLS-TM-MIB can be found in the

        snmpTlstmCertToTSNMIdentities portion of the MIB tree."

    DEFVAL { snmpTlstmCertSpecified }

    ::= { snmpTlstmCertToTSNEntry 3 }

snmpTlstmCertToTSNData OBJECT-TYPE

    SYNTAX      OCTET STRING (SIZE(0..1024))

    MAX-ACCESS  read-create

    STATUS      current

    DESCRIPTION

        "Auxiliary data used as optional configuration information for

        a given mapping specified by the snmpTlstmCertToTSNMapType

        column.  Only some mapping systems will make use of this

        column.  The value in this column MUST be ignored for any

        mapping type that does not require data present in this

        column."

    DEFVAL { "" }

    ::= { snmpTlstmCertToTSNEntry 4 }

snmpTlstmCertToTSNStorageType OBJECT-TYPE

    SYNTAX       StorageType

    MAX-ACCESS   read-create

    STATUS       current

    DESCRIPTION

        "The storage type for this conceptual row.  Conceptual rows

        having the value 'permanent' need not allow write-access to

        any columnar objects in the row."

    DEFVAL      { nonVolatile }

    ::= { snmpTlstmCertToTSNEntry 5 }

snmpTlstmCertToTSNRowStatus OBJECT-TYPE

    SYNTAX      RowStatus

    MAX-ACCESS  read-create

    STATUS      current

    DESCRIPTION

        "The status of this conceptual row.  This object may be used

        to create or remove rows from this table.

        To create a row in this table, an administrator must set this

        object to either createAndGo(4) or createAndWait(5).

        Until instances of all corresponding columns are appropriately

        configured, the value of the corresponding instance of the

        snmpTlstmParamsRowStatus column is notReady(3).

        In particular, a newly created row cannot be made active until

        the corresponding snmpTlstmCertToTSNFingerprint,

        snmpTlstmCertToTSNMapType, and snmpTlstmCertToTSNData columns

        have been set.

        The following objects may not be modified while the

        value of this object is active(1):

            - snmpTlstmCertToTSNFingerprint

            - snmpTlstmCertToTSNMapType

            - snmpTlstmCertToTSNData

        An attempt to set these objects while the value of

        snmpTlstmParamsRowStatus is active(1) will result in

        an inconsistentValue error."

    ::= { snmpTlstmCertToTSNEntry 6 }

-- Maps tmSecurityNames to certificates for use by the SNMP-TARGET-MIB

snmpTlstmParamsCount OBJECT-TYPE

    SYNTAX      Gauge32

    MAX-ACCESS  read-only

    STATUS      current

    DESCRIPTION

        "A count of the number of entries in the snmpTlstmParamsTable."

    ::= { snmpTlstmCertificateMapping 4 }

snmpTlstmParamsTableLastChanged OBJECT-TYPE

    SYNTAX      TimeStamp

    MAX-ACCESS  read-only

    STATUS      current

    DESCRIPTION

        "The value of sysUpTime.0 when the snmpTlstmParamsTable

        was last modified through any means, or 0 if it has not been

        modified since the command responder was started."

    ::= { snmpTlstmCertificateMapping 5 }

snmpTlstmParamsTable OBJECT-TYPE

    SYNTAX      SEQUENCE OF SnmpTlstmParamsEntry

    MAX-ACCESS  not-accessible

    STATUS      current

    DESCRIPTION

        "This table is used by a (D)TLS client when a (D)TLS

        connection is being set up using an entry in the

        SNMP-TARGET-MIB.  It extends the SNMP-TARGET-MIB's

        snmpTargetParamsTable with a fingerprint of a certificate to

        use when establishing such a (D)TLS connection."

    ::= { snmpTlstmCertificateMapping 6 }

snmpTlstmParamsEntry OBJECT-TYPE

    SYNTAX      SnmpTlstmParamsEntry

    MAX-ACCESS  not-accessible

    STATUS      current

    DESCRIPTION

        "A conceptual row containing a fingerprint hash of a locally

        held certificate for a given snmpTargetParamsEntry.  The

        values in this row should be ignored if the connection that

        needs to be established, as indicated by the SNMP-TARGET-MIB

        infrastructure, is not a certificate and (D)TLS based

        connection.  The connection SHOULD NOT be established if the

        certificate fingerprint stored in this entry does not point to

        a valid locally held certificate or if it points to an

        unusable certificate (such as might happen when the

        certificate's expiration date has been reached)."

    INDEX    { IMPLIED snmpTargetParamsName }

    ::= { snmpTlstmParamsTable 1 }

SnmpTlstmParamsEntry ::= SEQUENCE {

    snmpTlstmParamsClientFingerprint SnmpTLSFingerprint,

    snmpTlstmParamsStorageType       StorageType,

    snmpTlstmParamsRowStatus         RowStatus

}

snmpTlstmParamsClientFingerprint OBJECT-TYPE

    SYNTAX      SnmpTLSFingerprint

    MAX-ACCESS  read-create

    STATUS      current

    DESCRIPTION

        "This object stores the hash of the public portion of a

        locally held X.509 certificate.  The X.509 certificate, its

        public key, and the corresponding private key will be used

        when initiating a (D)TLS connection as a (D)TLS client."

    ::= { snmpTlstmParamsEntry 1 }

snmpTlstmParamsStorageType OBJECT-TYPE

    SYNTAX       StorageType

    MAX-ACCESS   read-create

    STATUS       current

    DESCRIPTION

        "The storage type for this conceptual row.  Conceptual rows

        having the value 'permanent' need not allow write-access to

        any columnar objects in the row."

    DEFVAL      { nonVolatile }

    ::= { snmpTlstmParamsEntry 2 }

snmpTlstmParamsRowStatus OBJECT-TYPE

    SYNTAX      RowStatus

    MAX-ACCESS  read-create

    STATUS      current

    DESCRIPTION

        "The status of this conceptual row.  This object may be used

        to create or remove rows from this table.

        To create a row in this table, an administrator must set this

        object to either createAndGo(4) or createAndWait(5).

        Until instances of all corresponding columns are appropriately

        configured, the value of the corresponding instance of the

        snmpTlstmParamsRowStatus column is notReady(3).

        In particular, a newly created row cannot be made active until

        the corresponding snmpTlstmParamsClientFingerprint column has

        been set.

        The snmpTlstmParamsClientFingerprint object may not be modified

        while the value of this object is active(1).

        An attempt to set these objects while the value of

        snmpTlstmParamsRowStatus is active(1) will result in

        an inconsistentValue error."

    ::= { snmpTlstmParamsEntry 3 }

snmpTlstmAddrCount OBJECT-TYPE

    SYNTAX      Gauge32

    MAX-ACCESS  read-only

    STATUS      current

    DESCRIPTION

        "A count of the number of entries in the snmpTlstmAddrTable."

    ::= { snmpTlstmCertificateMapping 7 }

snmpTlstmAddrTableLastChanged OBJECT-TYPE

    SYNTAX      TimeStamp

    MAX-ACCESS  read-only

    STATUS      current

    DESCRIPTION

        "The value of sysUpTime.0 when the snmpTlstmAddrTable

        was last modified through any means, or 0 if it has not been

        modified since the command responder was started."

    ::= { snmpTlstmCertificateMapping 8 }

snmpTlstmAddrTable OBJECT-TYPE

    SYNTAX      SEQUENCE OF SnmpTlstmAddrEntry

    MAX-ACCESS  not-accessible

    STATUS      current

    DESCRIPTION

        "This table is used by a (D)TLS client when a (D)TLS

        connection is being set up using an entry in the

        SNMP-TARGET-MIB.  It extends the SNMP-TARGET-MIB's

        snmpTargetAddrTable so that the client can verify that the

        correct server has been reached.  This verification can use

        either a certificate fingerprint, or an identity

        authenticated via certification path validation.

        If there is an active row in this table corresponding to the

        entry in the SNMP-TARGET-MIB that was used to establish the

        connection, and the row's snmpTlstmAddrServerFingerprint

        column has non-empty value, then the server's presented

        certificate is compared with the

        snmpTlstmAddrServerFingerprint value (and the

        snmpTlstmAddrServerIdentity column is ignored).  If the

        fingerprint matches, the verification has succeeded.  If the

        fingerprint does not match, then the connection MUST be

        closed.

        If the server's presented certificate has passed

        certification path validation [RFC5280] to a configured

        trust anchor, and an active row exists with a zero-length

        snmpTlstmAddrServerFingerprint value, then the

        snmpTlstmAddrServerIdentity column contains the expected

        host name.  This expected host name is then compared against

        the server's certificate as follows:

          - Implementations MUST support matching the expected host

          name against a dNSName in the subjectAltName extension

          field and MAY support checking the name against the

          CommonName portion of the subject distinguished name.

          - The '*' (ASCII 0x2a) wildcard character is allowed in the

          dNSName of the subjectAltName extension (and in common

          name, if used to store the host name), but only as the

          left-most (least significant) DNS label in that value.

          This wildcard matches any left-most DNS label in the

          server name.  That is, the subject *.example.com matches

          the server names a.example.com and b.example.com, but does

          not match example.com or a.b.example.com.  Implementations

          MUST support wildcards in certificates as specified above,

          but MAY provide a configuration option to disable them.

          - If the locally configured name is an internationalized

          domain name, conforming implementations MUST convert it to

          the ASCII Compatible Encoding (ACE) format for performing

          comparisons, as specified in Section 7 of [RFC5280].

        If the expected host name fails these conditions then the

        connection MUST be closed.

        If there is no row in this table corresponding to the entry

        in the SNMP-TARGET-MIB and the server can be authorized by

        another, implementation-dependent means, then the connection

        MAY still proceed."

    ::= { snmpTlstmCertificateMapping 9 }

snmpTlstmAddrEntry OBJECT-TYPE

    SYNTAX      SnmpTlstmAddrEntry

    MAX-ACCESS  not-accessible

    STATUS      current

    DESCRIPTION

        "A conceptual row containing a copy of a certificate's

        fingerprint for a given snmpTargetAddrEntry.  The values in

        this row should be ignored if the connection that needs to be

        established, as indicated by the SNMP-TARGET-MIB

        infrastructure, is not a (D)TLS based connection.  If an

        snmpTlstmAddrEntry exists for a given snmpTargetAddrEntry, then

        the presented server certificate MUST match or the connection

        MUST NOT be established.  If a row in this table does not

        exist to match an snmpTargetAddrEntry row, then the connection

        SHOULD still proceed if some other certificate validation path

        algorithm (e.g., RFC 5280) can be used."

    INDEX    { IMPLIED snmpTargetAddrName }

    ::= { snmpTlstmAddrTable 1 }

SnmpTlstmAddrEntry ::= SEQUENCE {

    snmpTlstmAddrServerFingerprint    SnmpTLSFingerprint,

    snmpTlstmAddrServerIdentity       SnmpAdminString,

    snmpTlstmAddrStorageType          StorageType,

    snmpTlstmAddrRowStatus            RowStatus

}

snmpTlstmAddrServerFingerprint OBJECT-TYPE

    SYNTAX      SnmpTLSFingerprint

    MAX-ACCESS  read-create

    STATUS      current

    DESCRIPTION

        "A cryptographic hash of a public X.509 certificate.  This

        object should store the hash of the public X.509 certificate

        that the remote server should present during the (D)TLS

        connection setup.  The fingerprint of the presented

        certificate and this hash value MUST match exactly or the

        connection MUST NOT be established."

    DEFVAL { "" }

    ::= { snmpTlstmAddrEntry 1 }

snmpTlstmAddrServerIdentity OBJECT-TYPE

    SYNTAX      SnmpAdminString