netgate-system.yang

module netgate-system {

    yang-version 1.1;

    namespace "urn:netgate:xml:yang:netgate-system";
    prefix "ngsys";

    import ietf-inet-types {
	prefix "inet";
    }

    import netgate-cli-extensions {
	prefix "ngcliext";
    }

    import netgate-common {
	prefix "ngcom";
    }

    import netgate-radius {
	prefix "ngradius";
    }

    import netgate-ldap {
	prefix "ngldap";
    }

    organization "Netgate";

    contact "Web: <http://www.netgate.com>";

    description
	"This YANG module provides a Netgate-defined data-model
	 for SYSTEM data.

	 Copyright 2018-2024 Rubicon Communications, LLC.
	 ";

    revision 2024-02-01 {
	description
	    "TNSR Release 24.02.";
    }

    revision 2023-02-01 {
	description
	    "TNSR Release 23.02.";
    }

    revision 2022-06-15 {
	description
	    "TNSR Release 22.06.";
    }

    revision 2022-02-15 {
	description
	    "TNSR Release 22.02.";
    }

    revision 2021-11-15 {
	description
	    "TNSR Release 21.11.";
    }

    revision 2021-02-15 {
	description
	    "TNSR Release 21.02.";
    }

    revision 2020-06-15 {
	description
	    "TNSR Release 20.06.";
    }

    revision 2020-02-15 {
	description
	    "TNSR Release 20.02.";
    }

    revision 2019-08-30 {
	description
	    "TNSR Release 19.08.";
    }

    revision 2019-05-30 {
	description
	    "TNSR Release 19.05.";
    }

    revision 2017-11-01 {
	description
	    "Initial revision.";
    }


    typedef system-device-type-t {
	type enumeration {
	    enum network {
		description
		    "Network device (NIC)";
	    }
	    enum crypto-vf {
		description
		    "Crypto acceleration device - Virtual Function";
	    }
	    enum crypto-pf {
		description
		    "Crypto acceleration device - Physical Function";
	    }
	    enum unknown {
		description
		"Unknow device type";
	    }
	}
    }


    feature dns-udp-tcp-port {
        description
          "Indicates that the device supports the configuration of
           the UDP and TCP port for DNS servers.

           This is a 'feature', since many implementations do not support
           any port other than the default port.";
    }


    grouping pci-address-grouping {
	description
	    "Group of PCI addresses attributes.";

	leaf domain {
	    type string {
		length "4";
	    }
	    description
		"PCI address domain.";
	}

	leaf bus {
	    type string {
		length "2";
	    }
	    description
		"PCI address bus.";
	}

	leaf slot {
	    type string {
		length "2";
	    }
	    description
		"PCI address slot.";
	}

	leaf function {
	    type string {
		length "2";
	    }
	    description
		"PCI address function.";
	}

    }


    typedef aaa-server-type {
	type enumeration {
	    enum radius {
		description
		    "Radius authentication server.";
	    }
	    enum ldap {
		description
		    "LDAP authentication server.";
	    }
	}
	description
	    "AAA server types.";
    }


    rpc system-devices-list {
        description
            "List of the usefull PCI devices in the system.";

	output {
            list devices {
		container pci-address {
		    uses pci-address-grouping;
		    description
                        "PCI address device/bus/slot/function.";
		}
	        leaf device-type {
		    type system-device-type-t;
		    description
                        "PCI device type.";
	        }
	        leaf device-driver {
		    type string;
		    description
                        "PCI device driver.";
	        }
	        leaf host-device-name {
		    type string;
		    description
                        "PCI network device name.";
	        }
	        leaf host-device-state {
		    type string;
		    description
		        "PCI network device state.";
	        }
	    }
	}
    }

    rpc system-reboot {
	input {
	    leaf minutes {
		type uint16;
		description
		    "Time in minutes to reboot.";
	    }
	    leaf cancel {
		type boolean;
		description
		    "Cancel the reboot";
	    }
	}
    }

    rpc system-ping {
	input {
	    leaf destination {
		type union {
		    type inet:domain-name;
		    type inet:ip-address-no-zone;
		}
		mandatory true;
		description
		    "Destination being pinged.";
	    }
	    leaf interface {
		type ngcom:if-identifier-63;
		description
		    "Interface source";
	    }
	    leaf source {
		type inet:ip-address-no-zone;
		description
		    "IP address source";
	    }
	    leaf count {
		type uint32;
		description
		    "Number of ECHO requests";
	    }
	    leaf interval {
		type decimal64 {
		    fraction-digits 6;
		    range "0.000001..6000";
		}
		description
		    "interval between pings
                     in seconds";
	    }
	    leaf ipv4-only {
		type boolean;
		description
		    "Only use IPv4 addressing.";
	    }
	    leaf ipv6-only {
		type boolean;
		description
		    "Only use IPv6 addressing.";
	    }
	    leaf packet-size {
		type uint32;
		description
		    "Ping packet (data) size";
	    }
	    leaf ttl {
		type uint8;
		description
		    "Time to live";
	    }
	    leaf timeout {
		type uint32;
		description
		    "Absolute wait time.";
	    }
	    leaf namespace {
		type ngcom:network-namespace;
		description
		    "Network namespace.";
	    }
	}
	output {
	    leaf stdout {
		type string;
	    }
	}
    }

    rpc system-traceroute {
	input {
	    leaf destination {
		type union {
		    type inet:domain-name;
		    type inet:ip-address-no-zone;
		}
		mandatory true;
		description
		    "Destination being pinged.";
	    }
	    leaf interface {
		type ngcom:if-identifier-63;
		description
		    "Interface source";
	    }
	    leaf source {
		type inet:ip-address-no-zone;
		description
		    "IP address source";
	    }
	    leaf ipv4-only {
		type boolean;
		description
		    "Only use IPv4 addressing.";
	    }
	    leaf ipv6-only {
		type boolean;
		description
		    "Only use IPv6 addressing.";
	    }
	    leaf packet-size {
		type uint32;
		description
		    "Ping packet (data) size";
	    }
	    leaf ttl {
		type uint8;
		description
		    "Time to live";
	    }
	    leaf no-dns {
		type boolean;
		description
		    "Do not perform name lookup.";
	    }
	    leaf wait-time {
		type uint32;
		description
		    "Probe response wait time.";
	    }
	    leaf namespace {
		type ngcom:network-namespace;
		description
		    "Network namespace.";
	    }
	}
	output {
	    leaf stdout {
		type string;
	    }
	}
    }


    rpc system-nft {
	input {
	    leaf command {
		type string;
		description
		    "Netfilter utility command";
	    }
	    leaf timeout {
		type uint32;
		description
		    "Timeout for response";
	    }
	}
	output {
	    leaf stdout {
		type string;
	    }
	}
    }

    container system {
	description
	    "System group configuration.";

	ngcliext:parent-fmt "$%";

	leaf description {
	    type ngcom:description-63;
	    description
		"A textual description of the entity. This value should
		 include the full name and version identification of the
		 system's hardware type, software operating-system, and
		 networking software. It is mandatory that this only contain
		 printable ASCII characters.";
	    ngcliext:node-fmt "$< $% @@$n";
	}

	leaf contact {
	    type ngcom:description-63;
	    description
		"The administrator contact information for the system.
		 A server implementation MAY map this leaf to the sysContact
		 MIB object. Such an implementation needs to use some
		 mechanism to handle the differences in size and characters
		 allowed between this leaf and sysContact.  The definition of
		such a mechanism is outside the scope of this document.";
	   reference
	       "RFC 3418: Management Information Base (MIB) for the
		Simple Network Management Protocol (SNMP)
		SNMPv2-MIB.sysContact";
	    ngcliext:node-fmt "$< $% @@$n";
	}

	leaf name {
	    type inet:domain-name;
	    description
		"The name of the host. This name can be a single domain
		 label or the fully qualified domain name of the host.";
	    ngcliext:node-fmt "$< $% @@$n";
	}

	leaf location {
	    type ngcom:string-xml-no-escape {
		length 1..127;
	    }
	    description
		"The system location.

		 A server implementation MAY map this leaf to the sysLocation
		 MIB object.  Such an implementation needs to use some
		 mechanism to handle the differences in size and characters
		 allowed between this leaf and sysLocation.  The definition
		 of such a mechanism is outside the scope of this document.";

	    reference
		"RFC 3418: Management Information Base (MIB) for the
		 Simple Network Management Protocol (SNMP)
		 SNMPv2-MIB.sysLocation";
	    ngcliext:node-fmt "$< $% @@$n";
	}

	list dns-resolver {
	    key namespace;
	    description
		"Configuration of the DNS resolver.";
	    reference
		"RFC 7317: A YANG Data Model for System Management";

	    ngcliext:node-fmt "$< $% @{namespace}$n";
	    ngcliext:pre-children-op "push";

	    leaf namespace {
		type ngcom:network-namespace;
		description
		    "Network namespace to be used.";
	    }

	    leaf-list search {
		type inet:domain-name;
		ordered-by user;
		description
		    "An ordered list of domains to search when resolving
		     a host name.";
		ngcliext:node-fmt "^$% @@$n";
	    }

	    list server {
		key name;
		ordered-by user;

		ngcliext:parent-fmt "^$% @{name}";

		description
		    "List of the DNS servers that the resolver should query.

		     When the resolver is invoked by a calling application, it
		     sends the query to the first name server in this list.  If
		     no response has been received within 'timeout' seconds,
		     the resolver continues with the next server in the list.
		     If no response is received from any server, the resolver
		     continues with the first server again.  When the resolver
		     has traversed the list 'attempts' times without receiving
		     any response, it gives up and returns an error to the
		     calling application.

		     Implementations MAY limit the number of entries in this
		     list.";

		leaf name {
		    type union {
			type ngcom:identifier-31;
			type inet:ip-address-no-zone;
		    }
		    description
			"An arbitrary name for the DNS server.";
		}

		choice transport {
		    mandatory true;
		    description
			"The transport-protocol-specific parameters for this
			 server.";
		    ngcliext:parent-fmt "$<";

		    case udp-and-tcp {
			container udp-and-tcp {
			    description
				"Contains UDP- and TCP-specific configuration
				 parameters for DNS.";
			    reference
				"RFC 1035: Domain Names - Implementation and
				 Specification
				 RFC 5966: DNS Transport over TCP - 
				 Implementation Requirements";
			    ngcliext:parent-fmt "$<";

			    leaf address {
				type inet:ip-address;
				mandatory true;
				description
				    "The address of the DNS server.";
				ngcliext:node-fmt "$< @@%{port-number}$n";
			    }
			    leaf port {
				if-feature dns-udp-tcp-port;
				type inet:port-number;
				default 53;
				description
				    "The UDP and TCP port number of the
				     DNS server.";
				ngcliext:sibling-fmt " @@";
			    }
			}
		    }
		}
	    }

	}

	leaf login-banner {
	    type string {
		    length 1..4096;
	    }
	    description
		"A banner message to be displayed at user login, as part
		 of update-motd.";
	    ngcliext:node-fmt "$< banner .$n@@.$n";
	}

	container kernel {
	    ngcliext:context "system-kernel";
	    ngcliext:parent-fmt "system $%";

	    container arguments {
		description
		    "Linux kernel arguments";
		ngcliext:parent-fmt "$< $%";

		choice config-type {
		    ngcliext:parent-fmt "$<";

		    case auto {
			container auto {
			    ngcliext:parent-fmt "$< $%";

			    leaf isolcpus {
				type boolean;
				description
				    "Enable or disable isolcpus";
				    ngcliext:node-op "bool";
				    ngcliext:node-fmt "|$< $%$n";
			    }
			}
		    }

		    case manual {
			leaf manual {
			    type string {
				pattern '[a-zA-Z0-9_\-=.,\/ ]+';
			    }
			    description
				"String to be added to kernel command line";
		    	    ngcliext:node-fmt "$< $% @@$n";
			}
		    }
		}
	    }
	}

	container auth {
	    ngcliext:parent-fmt "$%";

	    list user {
		key "user-name";
		description
		    "allowed users of the system";

		ngcliext:node-fmt "$< $% @{user-name}$n";
		ngcliext:pre-children-op "push";

		leaf user-name {
		    type string {
			pattern '[a-zA-Z0-9_]([-a-zA-Z0-9_]){1,31}';
		    }
		    description
			"user name identifying user";
		}

		leaf user-password {
		    type ngcom:string-xml-no-escape {
			length 6..256;
		    }
		    description
			"The hash of the users password.";
		    ngcliext:node-fmt "^password @@$n";
		}

		list user-keys {
		    key "key-name";
		    description
			"A list of user's public keys.";

		    ngcliext:node-fmt "^$% @{key-name}$n";

		    leaf key-name {
			type ngcom:identifier-31;
			description
			    "A unique identifier for this key.";
		    }

		    leaf key-data {
			type string {
			    length 1..5000;
			}
			description
			    "ASCII encoded data for user key.";
			ngcliext:node-fmt "@@$n$n";
		    }
		}
	    }

	    container server-groups {
		description
		    "Server groups to use for authentication methods.";

		ngcliext:parent-fmt "$<";

		list server-group {
		    key "name";

		    max-elements 5;

		    ngcliext:node-fmt "$< $% @{name}$n";
		    ngcliext:pre-children-op "push";

		    leaf name {
			type string {
			    length "1..16";
			    pattern '[a-zA-Z0-9_]([-a-zA-Z0-9_]){0,15}';
			}
			description
			    "Server group name.";
		    }

		    leaf type {
			type aaa-server-type;
			mandatory true;
			description
			    "Type of AAA server.";

			ngcliext:node-fmt "^$% @@$n";
		    }

		    container servers {
			description
			    "Servers in this group.";

			choice server-list-type {
			    mandatory true;

			    case subset {
				list server {
				    key "priority";

				    description
					"Configured auth server of the type used by this group.";

				    unique radius-server;
				    unique ldap-server;

				    max-elements 5;
				    must "radius-server or ldap-server" {
					error-message "A server in a server-group must contain an available radius or ldap server";
				    }

				    ngcliext:node-fmt "^priority @{priority}";

				    leaf priority {
					type uint8 {
					    range "1..255";
					}
					description
					    "Server priority (lowest to highest).";
				    }

				    leaf radius-server {
					when "../../../type = 'radius'";

					type leafref {
					    path "/ngradius:radius-client/ngradius:client/ngradius:servers/ngradius:name";
					}

					description
					    "Radius server name.";

					ngcliext:node-fmt " radius @@$n";
				    }

				    leaf ldap-server {
					when "../../../type = 'ldap'";
	
					type leafref {
					    path "/ngldap:ldap-client/ngldap:client/ngldap:servers/ngldap:name";
					}

					description
					    "LDAP server name.";

					ngcliext:node-fmt " ldap @@$n";
				    }
				}
			    }
			    case all {
				leaf all-servers {
				    type empty;
				    description
					"All configured servers for the auth type used by this group.";
				    ngcliext:node-fmt "^$%$n";
				}
			    }
			}
		    }
		}
	    }


	    container authentication-methods {
		ngcliext:parent-fmt "$< method";

		container radius {
		    description
			"Radius server-group to use.";

		    ngcliext:pre-child-fmt "$< $%";
		    ngcliext:post-child-fmt "$n";

		    leaf server-group {
			type leafref {
			    path "/ngsys:system/auth/server-groups/server-group/name";
			}

			must "/ngsys:system/ngsys:auth/ngsys:server-groups/ngsys:server-group[ngsys:name=current()]/ngsys:type = 'radius'" {
			    error-message "System authentication Radius server group must have type 'radius'";
			}

			ngcliext:node-fmt " $% @@";
		    }
		}

		container ldap {
		    description
			"LDAP server-group to use.";

		    ngcliext:pre-child-fmt "$< $%";
		    ngcliext:post-child-fmt "$n";

		    leaf server-group {
			type leafref {
			    path "/ngsys:system/auth/server-groups/server-group/name";
			}

			must "/ngsys:system/ngsys:auth/ngsys:server-groups/ngsys:server-group[ngsys:name=current()]/ngsys:type = 'ldap'" {
			    error-message "System authentication LDAP server group must have type 'ldap'";
			}

			ngcliext:node-fmt " $% @@";
		    }
		}
	    }
	}
    }

    container system-state {
	config false;
	description
	    "System group operational state.";

	leaf object-id {
	    type string;
	    config false;
	    description
		"The vendor's authoritative identification of the network
		 management subsystem contained in the entity. This value
		 is allocated within the SMI enterprises subtree (1.3.6.1.4.1)
		 and provides an easy and unambiguous means for determining
		 `what kind of box' is being managed. For example, if vendor
		 `Flintstones, Inc.' was assigned the subtree 1.3.6.1.4.1.4242,
		 it could assign the identifier 1.3.6.1.4.1.4242.1.1 to its
		 `Fred Router'.";
	}

	leaf uptime {
	    type uint64;
	    description
		"The time (in hundredths of a second) since the network
		 management portion of the system was last re-initialized.";
	}

	leaf total-ram {
	    type uint64;
	    description
		"Total usable main memory size.";
	}

	leaf free-ram {
	    type uint64;
	    description
		"Available memory size.";
	}

	leaf shared-ram {
	    type uint64;
	    description
		"Shared memory size.";
	}

	leaf buffer-ram {
	    type uint64;
	    description
		"Memory used by buffers.";
	}

	leaf total-swap {
	    type uint64;
	    description
		"Total swap space allocated for this host.";
	}

	leaf free-swap {
	    type uint64;
	    description
		"Free swap space for this host.";
	}

	container product {
	    description
		"Product specific information.";

	    leaf product-vendor {
	        type string;
		description
		    "product vendor name.";
	    }

	    leaf product-name {
	        type string;
		description
		    "product name.";
 	    }

	    leaf product-model {
	        type string;
		description
		    "product model.";
 	    }

	    leaf product-version {
	        type string;
		description
		    "product version.";
 	    }

	    leaf product-serial {
	        type string;
		description
		    "product serial number.";
 	    }
	}

	container platform {
	    description
		"Contains vendor-specific information for
		 identifying the system platform and operating system.";
	    reference
		"IEEE Std 1003.1-2008 - sys/utsname.h";

	    leaf os-name {
		type string;
		description
		    "The name of the operating system in use -
		     for example, 'Linux'.";
		reference
		    "IEEE Std 1003.1-2008 - utsname.sysname";
	    }

	    leaf os-release {
		type string;
		description
		    "The current release level of the operating
		     system in use.  This string MAY indicate
		     the OS source code revision.";
		reference
		    "IEEE Std 1003.1-2008 - utsname.release";
	    }

	    leaf os-version {
		type string;
		description
		    "The current version level of the operating
		     system in use.  This string MAY indicate
		     the specific OS build date and target variant
		     information.";
		reference
		    "IEEE Std 1003.1-2008 - utsname.version";
	    }

	    leaf machine {
		type string;
		description
		    "A vendor-specific identifier string representing
		     the hardware in use.";
		reference
		    "IEEE Std 1003.1-2008 - utsname.machine";
	    }
	}
    }
}