module ietf-dots-telemetry {

    yang-version 1.1;

    namespace
      "urn:ietf:params:xml:ns:yang:ietf-dots-telemetry";

    prefix dots-telemetry;

    import ietf-dots-signal-channel {
      prefix dots-signal;
      reference
        "RFC 9132: Distributed Denial-of-Service Open Threat
        	  Signaling (DOTS) Signal Channel Specification";


    }
    import ietf-dots-data-channel {
      prefix data-channel;
      reference
        "RFC 8783: Distributed Denial-of-Service Open Threat
        	  Signaling (DOTS) Data Channel Specification";


    }
    import ietf-yang-types {
      prefix yang;
      reference
        "RFC 6991: Common YANG Data Types, Section 3";


    }
    import ietf-inet-types {
      prefix inet;
      reference
        "RFC 6991: Common YANG Data Types, Section 4";


    }
    import ietf-network-topology {
      prefix nt;
      reference
        "RFC 8345: A YANG Data Model for Network Topologies,
        	  Section 6.2";


    }
    import ietf-yang-structure-ext {
      prefix sx;
      reference
        "RFC 8791: YANG Data Structure Extensions";


    }

    organization
      "IETF DDoS Open Threat Signaling (DOTS) Working Group";

    contact
      "WG Web:   <https://datatracker.ietf.org/wg/dots/>
     WG List:  <mailto:dots@ietf.org>

     Author:   Mohamed Boucadair
               <mailto:mohamed.boucadair@orange.com>

     Author:   Konda, Tirumaleswar Reddy.K
               <mailto:kondtir@gmail.com>";

    description
      "This module contains YANG definitions for the signaling
     of DOTS telemetry data exchanged between a DOTS client and
     a DOTS server by means of the DOTS signal channel.

     Copyright (c) 2022 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject to
     the license terms contained in, the Revised BSD License set
     forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC 9244; see the
     RFC itself for full legal notices.";

    revision "2022-06-20" {
      description "Initial revision.";
      reference
        "RFC 9244: Distributed Denial-of-Service Open Threat
        	  Signaling (DOTS) Telemetry";

    }

    sx:augment-structure "/dots-signal:dots-signal/dots-signal:message-type/dots-signal:mitigation-scope/dots-signal:scope";
    sx:structure "dots-telemetry";

    typedef attack-severity {
      type enumeration {
        enum "none" {
          value 1;
          description
            "No effect on the DOTS client domain.";
        }
        enum "low" {
          value 2;
          description
            "Minimal effect on the DOTS client domain.";
        }
        enum "medium" {
          value 3;
          description
            "A subset of DOTS client domain resources is
           out of service.";
        }
        enum "high" {
          value 4;
          description
            "The DOTS client domain is under extremely severe
           conditions.";
        }
        enum "unknown" {
          value 5;
          description
            "The impact of the attack is not known.";
        }
      }
      description
        "Enumeration for attack severity.";
      reference
        "RFC 7970: The Incident Object Description Exchange
        	  Format Version 2, Section 3.12.2";

    }

    typedef unit-class {
      type enumeration {
        enum "packet-ps" {
          value 1;
          description
            "Packets per second (pps).";
        }
        enum "bit-ps" {
          value 2;
          description
            "Bits per second (bps).";
        }
        enum "byte-ps" {
          value 3;
          description
            "Bytes per second (Bps).";
        }
      }
      description
        "Enumeration to indicate which unit class is used.
       These classes are supported: pps, bps, and Bps.";
    }

    typedef unit {
      type enumeration {
        enum "packet-ps" {
          value 1;
          description
            "Packets per second (pps).";
        }
        enum "bit-ps" {
          value 2;
          description
            "Bits per second (bps).";
        }
        enum "byte-ps" {
          value 3;
          description
            "Bytes per second (Bps).";
        }
        enum "kilopacket-ps" {
          value 4;
          description
            "Kilo packets per second (kpps).";
        }
        enum "kilobit-ps" {
          value 5;
          description
            "Kilobits per second (kbps).";
        }
        enum "kilobyte-ps" {
          value 6;
          description
            "Kilobytes per second (kBps).";
        }
        enum "megapacket-ps" {
          value 7;
          description
            "Mega packets per second (Mpps).";
        }
        enum "megabit-ps" {
          value 8;
          description
            "Megabits per second (Mbps).";
        }
        enum "megabyte-ps" {
          value 9;
          description
            "Megabytes per second (MBps).";
        }
        enum "gigapacket-ps" {
          value 10;
          description
            "Giga packets per second (Gpps).";
        }
        enum "gigabit-ps" {
          value 11;
          description
            "Gigabits per second (Gbps).";
        }
        enum "gigabyte-ps" {
          value 12;
          description
            "Gigabytes per second (GBps).";
        }
        enum "terapacket-ps" {
          value 13;
          description
            "Tera packets per second (Tpps).";
        }
        enum "terabit-ps" {
          value 14;
          description
            "Terabits per second (Tbps).";
        }
        enum "terabyte-ps" {
          value 15;
          description
            "Terabytes per second (TBps).";
        }
        enum "petapacket-ps" {
          value 16;
          description
            "Peta packets per second (Ppps).";
        }
        enum "petabit-ps" {
          value 17;
          description
            "Petabits per second (Pbps).";
        }
        enum "petabyte-ps" {
          value 18;
          description
            "Petabytes per second (PBps).";
        }
        enum "exapacket-ps" {
          value 19;
          description
            "Exa packets per second (Epps).";
        }
        enum "exabit-ps" {
          value 20;
          description
            "Exabits per second (Ebps).";
        }
        enum "exabyte-ps" {
          value 21;
          description
            "Exabytes per second (EBps).";
        }
        enum "zettapacket-ps" {
          value 22;
          description
            "Zetta packets per second (Zpps).";
        }
        enum "zettabit-ps" {
          value 23;
          description
            "Zettabits per second (Zbps).";
        }
        enum "zettabyte-ps" {
          value 24;
          description
            "Zettabytes per second (ZBps).";
        }
      }
      description
        "Enumeration to indicate which unit is used.
       Only one unit per unit class is used owing to
       unit auto-scaling.";
    }

    typedef interval {
      type enumeration {
        enum "5-minutes" {
          value 1;
          description "5 minutes.";
        }
        enum "10-minutes" {
          value 2;
          description "10 minutes.";
        }
        enum "30-minutes" {
          value 3;
          description "30 minutes.";
        }
        enum "hour" {
          value 4;
          description "Hour.";
        }
        enum "day" {
          value 5;
          description "Day.";
        }
        enum "week" {
          value 6;
          description "Week.";
        }
        enum "month" {
          value 7;
          description "Month.";
        }
      }
      description
        "Enumeration to indicate the overall measurement period.";
    }

    typedef sample {
      type enumeration {
        enum "second" {
          value 1;
          description
            "One-second measurement period.";
        }
        enum "5-seconds" {
          value 2;
          description
            "5-second measurement period.";
        }
        enum "30-seconds" {
          value 3;
          description
            "30-second measurement period.";
        }
        enum "minute" {
          value 4;
          description
            "One-minute measurement period.";
        }
        enum "5-minutes" {
          value 5;
          description
            "5-minute measurement period.";
        }
        enum "10-minutes" {
          value 6;
          description
            "10-minute measurement period.";
        }
        enum "30-minutes" {
          value 7;
          description
            "30-minute measurement period.";
        }
        enum "hour" {
          value 8;
          description
            "One-hour measurement period.";
        }
      }
      description
        "Enumeration to indicate the sampling period.";
    }

    typedef percentile {
      type decimal64 {
        fraction-digits 2;
      }
      description
        "The nth percentile of a set of data is the
       value at which n percent of the data is below it.";
    }

    typedef query-type {
      type enumeration {
        enum "target-prefix" {
          value 1;
          description
            "Query based on target prefix.";
        }
        enum "target-port" {
          value 2;
          description
            "Query based on target port number.";
        }
        enum "target-protocol" {
          value 3;
          description
            "Query based on target protocol.";
        }
        enum "target-fqdn" {
          value 4;
          description
            "Query based on target FQDN.";
        }
        enum "target-uri" {
          value 5;
          description
            "Query based on target URI.";
        }
        enum "target-alias" {
          value 6;
          description
            "Query based on target alias.";
        }
        enum "mid" {
          value 7;
          description
            "Query based on mitigation identifier (mid).";
        }
        enum "source-prefix" {
          value 8;
          description
            "Query based on source prefix.";
        }
        enum "source-port" {
          value 9;
          description
            "Query based on source port number.";
        }
        enum "source-icmp-type" {
          value 10;
          description
            "Query based on ICMP type.";
        }
        enum "content" {
          value 11;
          description
            "Query based on the 'c' (content) Uri-Query option,
           which is used to control the selection of configuration
           and non-configuration data nodes.";
          reference
            "RFC 9132: Distributed Denial-of-Service Open Threat
            	  Signaling (DOTS) Signal Channel
            	  Specification, Section 4.4.2";

        }
      }
      description
        "Enumeration of support for query types that can be used
       in a GET request to filter out data.  Requests with
       invalid query types (e.g., not supported, malformed)
       received by the DOTS server are rejected with
       a 4.00 (Bad Request) Response Code.";
    }

    grouping telemetry-parameters {
      description
        "A grouping that includes a set of parameters that
       are used to prepare the reported telemetry data.

       The grouping indicates a measurement interval,
       a measurement sample period, and
       low-percentile/mid-percentile/high-percentile values.";
      leaf measurement-interval {
        type interval;
        description
          "Defines the period during which percentiles are
         computed.";
      }

      leaf measurement-sample {
        type sample;
        description
          "Defines the time distribution for measuring
         values that are used to compute percentiles.

         The measurement sample value must be less than the
         measurement interval value.";
      }

      leaf low-percentile {
        type percentile;
        default "10.00";
        description
          "Low-percentile.  If set to '0', this means that
         the use of low-percentile values is disabled.";
      }

      leaf mid-percentile {
        type percentile;
        must '. >= ../low-percentile' {
          error-message
            "The mid-percentile must be greater than
           or equal to the low-percentile.";
        }
        default "50.00";
        description
          "Mid-percentile.  If set to the same value as
         'low-percentile', this means that the use of
         mid-percentile values is disabled.";
      }

      leaf high-percentile {
        type percentile;
        must '. >= ../mid-percentile' {
          error-message
            "The high-percentile must be greater than
           or equal to the mid-percentile.";
        }
        default "90.00";
        description
          "High-percentile.  If set to the same value as
         'mid-percentile', this means that the use of
         high-percentile values is disabled.";
      }
    }  // grouping telemetry-parameters

    grouping percentile-and-peak {
      description
        "Generic grouping for percentile and peak values.";
      leaf low-percentile-g {
        type yang:gauge64;
        description "Low-percentile value.";
      }

      leaf mid-percentile-g {
        type yang:gauge64;
        description "Mid-percentile value.";
      }

      leaf high-percentile-g {
        type yang:gauge64;
        description "High-percentile value.";
      }

      leaf peak-g {
        type yang:gauge64;
        description "Peak value.";
      }
    }  // grouping percentile-and-peak

    grouping percentile-peak-and-current {
      description
        "Generic grouping for percentile and peak values.";
      uses percentile-and-peak;

      leaf current-g {
        type yang:gauge64;
        description "Current value.";
      }
    }  // grouping percentile-peak-and-current

    grouping unit-config {
      description
        "Generic grouping for unit configuration.";
      list unit-config {
        key "unit";
        description
          "Controls which unit classes are allowed when sharing
         telemetry data.";
        leaf unit {
          type unit-class;
          description
            "Can be 'packet-ps', 'bit-ps', or 'byte-ps'.";
        }

        leaf unit-status {
          type boolean;
          mandatory true;
          description
            "Enable/disable the use of the measurement unit class.";
        }
      }  // list unit-config
    }  // grouping unit-config

    grouping traffic-unit {
      description
        "Grouping of traffic as a function of the
       measurement unit.";
      leaf unit {
        type unit;
        description
          "The traffic can be measured using unit classes:
         'packet-ps', 'bit-ps', or 'byte-ps'.  DOTS agents
         auto-scale to the appropriate units (e.g., 'megabit-ps',
         'kilobit-ps').";
      }

      uses percentile-and-peak;
    }  // grouping traffic-unit

    grouping traffic-unit-all {
      description
        "Grouping of traffic as a function of the measurement unit,
       including current values.";
      uses traffic-unit;

      leaf current-g {
        type yang:gauge64;
        description
          "Current observed value.";
      }
    }  // grouping traffic-unit-all

    grouping traffic-unit-protocol {
      description
        "Grouping of traffic of a given transport protocol as
       a function of the measurement unit.";
      leaf protocol {
        type uint8;
        description
          "The transport protocol.
         Values are taken from the IANA 'Protocol Numbers'
         registry:
         <https://www.iana.org/assignments/protocol-numbers/>.

         For example, this parameter contains 6 for TCP,
         17 for UDP, 33 for the Datagram Congestion Control
         Protocol (DCCP), or 132 for the Stream Control
         Transmission Protocol (SCTP).";
      }

      uses traffic-unit;
    }  // grouping traffic-unit-protocol

    grouping traffic-unit-protocol-all {
      description
        "Grouping of traffic of a given transport protocol as
       a function of the measurement unit, including current
       values.";
      uses traffic-unit-protocol;

      leaf current-g {
        type yang:gauge64;
        description
          "Current observed value.";
      }
    }  // grouping traffic-unit-protocol-all

    grouping traffic-unit-port {
      description
        "Grouping of traffic bound to a port number as
       a function of the measurement unit.";
      leaf port {
        type inet:port-number;
        description
          "Port number used by a transport protocol.";
      }

      uses traffic-unit;
    }  // grouping traffic-unit-port

    grouping traffic-unit-port-all {
      description
        "Grouping of traffic bound to a port number as
       a function of the measurement unit, including
       current values.";
      uses traffic-unit-port;

      leaf current-g {
        type yang:gauge64;
        description
          "Current observed value.";
      }
    }  // grouping traffic-unit-port-all

    grouping total-connection-capacity {
      description
        "Total connection capacities for various types of
       connections, as well as overall capacity.  These data nodes
       are useful for detecting resource-consuming DDoS attacks.";
      leaf connection {
        type uint64;
        description
          "The maximum number of simultaneous connections that
         are allowed to the target server.";
      }

      leaf connection-client {
        type uint64;
        description
          "The maximum number of simultaneous connections that
         are allowed to the target server per client.";
      }

      leaf embryonic {
        type uint64;
        description
          "The maximum number of simultaneous embryonic connections
         that are allowed to the target server.  The term
         'embryonic connection' refers to a connection whose
         connection handshake is not finished.  Embryonic
         connections are only possible in connection-oriented
         transport protocols like TCP or SCTP.";
      }

      leaf embryonic-client {
        type uint64;
        description
          "The maximum number of simultaneous embryonic connections
         that are allowed to the target server per client.";
      }

      leaf connection-ps {
        type uint64;
        description
          "The maximum number of new connections allowed per second
         to the target server.";
      }

      leaf connection-client-ps {
        type uint64;
        description
          "The maximum number of new connections allowed per second
         to the target server per client.";
      }

      leaf request-ps {
        type uint64;
        description
          "The maximum number of requests allowed per second
         to the target server.";
      }

      leaf request-client-ps {
        type uint64;
        description
          "The maximum number of requests allowed per second
         to the target server per client.";
      }

      leaf partial-request-max {
        type uint64;
        description
          "The maximum number of outstanding partial requests
         that are allowed to the target server.";
      }

      leaf partial-request-client-max {
        type uint64;
        description
          "The maximum number of outstanding partial requests
         that are allowed to the target server per client.";
      }
    }  // grouping total-connection-capacity

    grouping total-connection-capacity-protocol {
      description
        "Total connection capacity per protocol.  These data nodes
       are useful for detecting resource-consuming DDoS attacks.";
      leaf protocol {
        type uint8;
        description
          "The transport protocol.
         Values are taken from the IANA 'Protocol Numbers'
         registry:
         <https://www.iana.org/assignments/protocol-numbers/>.";
      }

      uses total-connection-capacity;
    }  // grouping total-connection-capacity-protocol

    grouping connection-percentile-and-peak {
      description
        "A set of data nodes that represent the attack
       characteristics.";
      container connection-c {
        description
          "The number of simultaneous attack connections to
         the target server.";
        uses percentile-and-peak;
      }  // container connection-c

      container embryonic-c {
        description
          "The number of simultaneous embryonic connections to
         the target server.";
        uses percentile-and-peak;
      }  // container embryonic-c

      container connection-ps-c {
        description
          "The number of attack connections per second to
         the target server.";
        uses percentile-and-peak;
      }  // container connection-ps-c

      container request-ps-c {
        description
          "The number of attack requests per second to
         the target server.";
        uses percentile-and-peak;
      }  // container request-ps-c

      container partial-request-c {
        description
          "The number of attack partial requests to
         the target server.";
        uses percentile-and-peak;
      }  // container partial-request-c
    }  // grouping connection-percentile-and-peak

    grouping connection-all {
      description
        "Total attack connections, including current values.";
      container connection-c {
        description
          "The number of simultaneous attack connections to
         the target server.";
        uses percentile-peak-and-current;
      }  // container connection-c

      container embryonic-c {
        description
          "The number of simultaneous embryonic connections to
         the target server.";
        uses percentile-peak-and-current;
      }  // container embryonic-c

      container connection-ps-c {
        description
          "The number of attack connections per second to
         the target server.";
        uses percentile-peak-and-current;
      }  // container connection-ps-c

      container request-ps-c {
        description
          "The number of attack requests per second to
         the target server.";
        uses percentile-peak-and-current;
      }  // container request-ps-c

      container partial-request-c {
        description
          "The number of attack partial requests to
         the target server.";
        uses percentile-peak-and-current;
      }  // container partial-request-c
    }  // grouping connection-all

    grouping connection-protocol {
      description
        "Total attack connections.";
      leaf protocol {
        type uint8;
        description
          "The transport protocol.
         Values are taken from the IANA 'Protocol Numbers'
         registry:
         <https://www.iana.org/assignments/protocol-numbers/>.";
      }

      uses connection-percentile-and-peak;
    }  // grouping connection-protocol

    grouping connection-port {
      description
        "Total attack connections per port number.";
      leaf protocol {
        type uint8;
        description
          "The transport protocol.
         Values are taken from the IANA 'Protocol Numbers'
         registry:
         <https://www.iana.org/assignments/protocol-numbers/>.";
      }

      leaf port {
        type inet:port-number;
        description "Port number.";
      }

      uses connection-percentile-and-peak;
    }  // grouping connection-port

    grouping connection-protocol-all {
      description
        "Total attack connections per protocol, including current
       values.";
      leaf protocol {
        type uint8;
        description
          "The transport protocol.
         Values are taken from the IANA 'Protocol Numbers'
         registry:
         <https://www.iana.org/assignments/protocol-numbers/>.";
      }

      uses connection-all;
    }  // grouping connection-protocol-all

    grouping connection-protocol-port-all {
      description
        "Total attack connections per port number, including current
       values.";
      leaf protocol {
        type uint8;
        description
          "The transport protocol.
         Values are taken from the IANA 'Protocol Numbers'
         registry:
         <https://www.iana.org/assignments/protocol-numbers/>.";
      }

      leaf port {
        type inet:port-number;
        description "Port number.";
      }

      uses connection-all;
    }  // grouping connection-protocol-port-all

    grouping attack-detail {
      description
        "Various details that describe the ongoing
       attacks that need to be mitigated by the DOTS server.
       The attack details need to cover well-known and common
       attacks (such as a SYN flood) along with new emerging or
       vendor-specific attacks.";
      leaf vendor-id {
        type uint32;
        description
          "The Vendor ID is a security vendor's Private Enterprise
         Number as registered with IANA.";
        reference
          "IANA: Private Enterprise Numbers
          (https://www.iana.org/assignments/enterprise-numbers/)";

      }

      leaf attack-id {
        type uint32;
        description
          "Unique identifier assigned by the vendor for the attack.";
      }

      leaf description-lang {
        type string {
          pattern
            '((([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3})'
              + '{0,2})?)|[A-Za-z]{4}|[A-Za-z]{5,8})(-[A-Za-z]{4})'
              + '?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}'
              + '|([0-9][A-Za-z0-9]{3})))*(-[0-9A-WYZa-wyz]'
              + '(-([A-Za-z0-9]{2,8}))+)*(-[Xx](-([A-Za-z0-9]'
              + '{1,8}))+)?|[Xx](-([A-Za-z0-9]{1,8}))+|'
              + '(([Ee][Nn]-[Gg][Bb]-[Oo][Ee][Dd]|[Ii]-'
              + '[Aa][Mm][Ii]|[Ii]-[Bb][Nn][Nn]|[Ii]-'
              + '[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-'
              + '[Ee][Nn][Oo][Cc][Hh][Ii][Aa][Nn]'
              + '|[Ii]-[Hh][Aa][Kk]|'
              + '[Ii]-[Kk][Ll][Ii][Nn][Gg][Oo][Nn]|'
              + '[Ii]-[Ll][Uu][Xx]|[Ii]-[Mm][Ii][Nn][Gg][Oo]|'
              + '[Ii]-[Nn][Aa][Vv][Aa][Jj][Oo]|[Ii]-[Pp][Ww][Nn]|'
              + '[Ii]-[Tt][Aa][Oo]|[Ii]-[Tt][Aa][Yy]|'
              + '[Ii]-[Tt][Ss][Uu]|[Ss][Gg][Nn]-[Bb][Ee]-[Ff][Rr]|'
              + '[Ss][Gg][Nn]-[Bb][Ee]-[Nn][Ll]|[Ss][Gg][Nn]-'
              + '[Cc][Hh]-[Dd][Ee])|([Aa][Rr][Tt]-'
              + '[Ll][Oo][Jj][Bb][Aa][Nn]|[Cc][Ee][Ll]-'
              + '[Gg][Aa][Uu][Ll][Ii][Ss][Hh]|'
              + '[Nn][Oo]-[Bb][Oo][Kk]|[Nn][Oo]-'
              + '[Nn][Yy][Nn]|[Zz][Hh]-[Gg][Uu][Oo][Yy][Uu]|'
              + '[Zz][Hh]-[Hh][Aa][Kk][Kk][Aa]|[Zz][Hh]-'
              + '[Mm][Ii][Nn]|[Zz][Hh]-[Mm][Ii][Nn]-'
              + '[Nn][Aa][Nn]|[Zz][Hh]-[Xx][Ii][Aa][Nn][Gg])))';
        }
        default "en-US";
        description
          "Indicates the language tag that is used for
         'attack-description'.";
        reference
          "RFC 5646: Tags for Identifying Languages, Section 2.1";

      }

      leaf attack-description {
        type string;
        description
          "Textual representation of the attack description.
         Natural Language Processing techniques (e.g.,
         word embedding) might provide some utility in mapping
         the attack description to an attack type.";
      }

      leaf attack-severity {
        type attack-severity;
        description
          "Severity level of an attack.  How this level is
         determined is implementation specific.";
      }

      leaf start-time {
        type uint64;
        description
          "The time the attack started.  The start time is
         represented in seconds relative to
         1970-01-01T00:00:00Z.";
      }

      leaf end-time {
        type uint64;
        description
          "The time the attack ended.  The end time is represented
         in seconds relative to 1970-01-01T00:00:00Z.";
      }

      container source-count {
        description
          "Indicates the count of unique sources involved
         in the attack.";
        uses percentile-and-peak;

        leaf current-g {
          type yang:gauge64;
          description
            "Current observed value.";
        }
      }  // container source-count
    }  // grouping attack-detail

    grouping talker {
      description
        "Defines generic data related to top talkers.";
      leaf spoofed-status {
        type boolean;
        description
          "When set to 'true', it indicates whether this address
         is spoofed.";
      }

      leaf source-prefix {
        type inet:ip-prefix;
        description
          "IPv4 or IPv6 prefix identifying the attacker(s).";
      }

      list source-port-range {
        key "lower-port";
        description
          "Port range.  When only 'lower-port' is
         present, it represents a single port number.";
        leaf lower-port {
          type inet:port-number;
          description
            "Lower port number of the port range.";
        }

        leaf upper-port {
          type inet:port-number;
          must '. >= ../lower-port' {
            error-message
              "The upper port number must be greater than
             or equal to the lower port number.";
          }
          description
            "Upper port number of the port range.";
        }
      }  // list source-port-range

      list source-icmp-type-range {
        key "lower-type";
        description
          "ICMP type range.  When only 'lower-type' is
         present, it represents a single ICMP type.";
        leaf lower-type {
          type uint8;
          description
            "Lower ICMP type of the ICMP type range.";
        }

        leaf upper-type {
          type uint8;
          must '. >= ../lower-type' {
            error-message
              "The upper ICMP type must be greater than
             or equal to the lower ICMP type.";
          }
          description
            "Upper type of the ICMP type range.";
        }
      }  // list source-icmp-type-range

      list total-attack-traffic {
        key "unit";
        description
          "Total attack traffic issued from this source.";
        uses traffic-unit-all;
      }  // list total-attack-traffic
    }  // grouping talker

    grouping top-talker-aggregate {
      description
        "An aggregate of top attack sources.  This aggregate is
       typically used when included in a mitigation request.";
      list talker {
        key "source-prefix";
        description
          "Refers to a top talker that is identified by an IPv4
         or IPv6 prefix identifying the attacker(s).";
        uses talker;

        container total-attack-connection {
          description
            "Total attack connections issued from this source.";
          uses connection-all;
        }  // container total-attack-connection
      }  // list talker
    }  // grouping top-talker-aggregate

    grouping top-talker {
      description
        "Top attack sources with detailed per-protocol
       structure.";
      list talker {
        key "source-prefix";
        description
          "Refers to a top talker that is identified by an IPv4
         or IPv6 prefix identifying the attacker(s).";
        uses talker;

        list total-attack-connection-protocol {
          key "protocol";
          description
            "Total attack connections issued from this source.";
          uses connection-protocol-all;
        }  // list total-attack-connection-protocol
      }  // list talker
    }  // grouping top-talker

    grouping baseline {
      description
        "Grouping for the telemetry baseline.";
      uses data-channel:target;

      leaf-list alias-name {
        type string;
        description
          "An alias name that points to an IP resource.
         An IP resource can be a router, a host,
         an Internet of Things (IoT) object, a server, etc.";
      }

      list total-traffic-normal {
        key "unit";
        description
          "Total traffic normal baselines.";
        uses traffic-unit;
      }  // list total-traffic-normal

      list total-traffic-normal-per-protocol {
        key "unit protocol";
        description
          "Total traffic normal baselines per protocol.";
        uses traffic-unit-protocol;
      }  // list total-traffic-normal-per-protocol

      list total-traffic-normal-per-port {
        key "unit port";
        description
          "Total traffic normal baselines per port number.";
        uses traffic-unit-port;
      }  // list total-traffic-normal-per-port

      list total-connection-capacity {
        key "protocol";
        description
          "Total connection capacity.";
        uses total-connection-capacity-protocol;
      }  // list total-connection-capacity

      list total-connection-capacity-per-port {
        key "protocol port";
        description
          "Total connection capacity per port number.";
        leaf port {
          type inet:port-number;
          description
            "The target port number.";
        }

        uses total-connection-capacity-protocol;
      }  // list total-connection-capacity-per-port
    }  // grouping baseline

    grouping pre-or-ongoing-mitigation {
      description
        "Grouping for the telemetry data.";
      list total-traffic {
        key "unit";
        description "Total traffic.";
        uses traffic-unit-all;
      }  // list total-traffic

      list total-traffic-protocol {
        key "unit protocol";
        description
          "Total traffic per protocol.";
        uses traffic-unit-protocol-all;
      }  // list total-traffic-protocol

      list total-traffic-port {
        key "unit port";
        description
          "Total traffic per port number.";
        uses traffic-unit-port-all;
      }  // list total-traffic-port

      list total-attack-traffic {
        key "unit";
        description "Total attack traffic.";
        uses traffic-unit-all;
      }  // list total-attack-traffic

      list total-attack-traffic-protocol {
        key "unit protocol";
        description
          "Total attack traffic per protocol.";
        uses traffic-unit-protocol-all;
      }  // list total-attack-traffic-protocol

      list total-attack-traffic-port {
        key "unit port";
        description
          "Total attack traffic per port number.";
        uses traffic-unit-port-all;
      }  // list total-attack-traffic-port

      list total-attack-connection-protocol {
        key "protocol";
        description
          "Total attack connections.";
        uses connection-protocol-all;
      }  // list total-attack-connection-protocol

      list total-attack-connection-port {
        key "protocol port";
        description
          "Total attack connections per target port number.";
        uses connection-protocol-port-all;
      }  // list total-attack-connection-port

      list attack-detail {
        key "vendor-id attack-id";
        description
          "Provides a set of attack details.";
        uses attack-detail;

        container top-talker {
          description
            "Lists the top attack sources.";
          uses top-talker;
        }  // container top-talker
      }  // list attack-detail
    }  // grouping pre-or-ongoing-mitigation

    augment /dots-signal:dots-signal/dots-signal:message-type/dots-signal:mitigation-scope/dots-signal:scope {
      description
        "Extends mitigation scope with telemetry update data.";
      choice direction {
        description
          "Indicates the communication direction in which the
         data nodes can be included.";
        case server-to-client-only {
          description
            "These data nodes appear only in a mitigation message
           sent from the server to the client.";
          list total-traffic {
            key "unit";
            description "Total traffic.";
            uses traffic-unit-all;
          }  // list total-traffic

          container total-attack-connection {
            description
              "Total attack connections.";
            uses connection-all;
          }  // container total-attack-connection
        }  // case server-to-client-only
      }  // choice direction

      list total-attack-traffic {
        key "unit";
        description "Total attack traffic.";
        uses traffic-unit-all;
      }  // list total-attack-traffic

      list attack-detail {
        key "vendor-id attack-id";
        description "Attack details.";
        uses attack-detail;

        container top-talker {
          description "Top attack sources.";
          uses top-talker-aggregate;
        }  // container top-talker
      }  // list attack-detail
    }

    container dots-telemetry {
      description
        "Main structure for DOTS telemetry messages.";
      choice telemetry-message-type {
        description
          "Can be 'telemetry-setup' or telemetry data.";
        case telemetry-setup {
          description
            "Indicates that the message is about telemetry setup.";
          choice direction {
            description
              "Indicates the communication direction in which the
             data nodes can be included.";
            case server-to-client-only {
              description
                "These data nodes appear only in a telemetry message
               sent from the server to the client.";
              container max-config-values {
                description
                  "Maximum acceptable configuration values.";
                uses telemetry-parameters;

                leaf server-originated-telemetry {
                  type boolean;
                  default "false";
                  description
                    "Indicates whether the DOTS server can be
                   instructed to send pre-or-ongoing-mitigation
                   telemetry.  If set to 'false' or the data node
                   is not present, this is an indication that
                   the server does not support this capability.";
                }

                leaf telemetry-notify-interval {
                  type uint16 {
                    range "1 .. 3600";
                  }
                  units "seconds";
                  must
                    '. >= ../../min-config-values'
                      + '/telemetry-notify-interval' {
                    error-message
                      "The value must be greater than or equal
                     to the 'telemetry-notify-interval' value in
                     the 'min-config-values' attribute";
                  }
                  description
                    "Minimum number of seconds between successive
                   telemetry notifications.";
                }
              }  // container max-config-values

              container min-config-values {
                description
                  "Minimum acceptable configuration values.";
                uses telemetry-parameters;

                leaf telemetry-notify-interval {
                  type uint16 {
                    range "1 .. 3600";
                  }
                  units "seconds";
                  description
                    "Minimum number of seconds between successive
                   telemetry notifications.";
                }
              }  // container min-config-values

              container supported-unit-classes {
                description
                  "Supported unit classes and default activation
                 status.";
                uses unit-config;
              }  // container supported-unit-classes

              leaf-list supported-query-type {
                type query-type;
                description
                  "Indicates which query types are supported by
                 the server.  If the server does not announce
                 the query types it supports, the client will
                 be unable to use any of the potential
                 'query-type' values to reduce the returned data
                 content from the server.";
              }
            }  // case server-to-client-only
          }  // choice direction

          list telemetry {
            description
              "The telemetry data per DOTS client.  The keys
             of the list are 'cuid' and 'tsid', but these keys are
             not represented here because these keys are conveyed
             as mandatory Uri-Paths in requests.  Omitting keys
             is compliant with RFC 8791.";
            reference
              "RFC 8791: YANG Data Structure Extensions";

            choice direction {
              description
                "Indicates the communication direction in which the
               data nodes can be included.";
              case server-to-client-only {
                description
                  "These data nodes appear only in a telemetry
                 message sent from the server to the client.";
                leaf tsid {
                  type uint32;
                  description
                    "A client-assigned identifier for the DOTS
                   telemetry setup data.";
                }
              }  // case server-to-client-only
            }  // choice direction

            choice setup-type {
              description
                "Can be a mitigation configuration, a pipe capacity,
               or a baseline message.";
              case telemetry-config {
                description
                  "Used to set telemetry parameters such as setting
                 low-, mid-, and high-percentile values.";
                container current-config {
                  description
                    "Current telemetry configuration values.";
                  uses telemetry-parameters;

                  uses unit-config;

                  leaf server-originated-telemetry {
                    type boolean;
                    description
                      "Used by a DOTS client to enable/disable
                     whether it requests pre-or-ongoing-mitigation
                     telemetry from the DOTS server.";
                  }

                  leaf telemetry-notify-interval {
                    type uint16 {
                      range "1 .. 3600";
                    }
                    units "seconds";
                    description
                      "Minimum number of seconds between successive
                     telemetry notifications.";
                  }
                }  // container current-config
              }  // case telemetry-config

              case pipe {
                description
                  "Total pipe capacity of a DOTS client domain.";
                list total-pipe-capacity {
                  key "link-id unit";
                  description
                    "Total pipe capacity of a DOTS client domain.";
                  leaf link-id {
                    type nt:link-id;
                    description
                      "Identifier of an interconnection link of
                     the DOTS client domain.";
                  }

                  leaf capacity {
                    type uint64;
                    mandatory true;
                    description
                      "Pipe capacity.  This attribute is mandatory
                     when 'total-pipe-capacity' is included in a
                     message.";
                  }

                  leaf unit {
                    type unit;
                    description
                      "The traffic can be measured using unit
                     classes: packets per second (pps), bits per
                     second (bps), and/or bytes per second
                     (Bps).

                     For a given unit class, the DOTS agents
                     auto-scale to the appropriate units (e.g.,
                     'megabit-ps', 'kilobit-ps').";
                  }
                }  // list total-pipe-capacity
              }  // case pipe

              case baseline {
                description
                  "Traffic baseline information related to a DOTS
                 client domain.";
                list baseline {
                  key "id";
                  description
                    "Traffic baseline information related to a DOTS
                   client domain.";
                  leaf id {
                    type uint32;
                    must '. >= 1';
                    description
                      "An identifier that uniquely identifies a
                     baseline entry communicated by a
                     DOTS client.";
                  }

                  uses baseline;
                }  // list baseline
              }  // case baseline
            }  // choice setup-type
          }  // list telemetry
        }  // case telemetry-setup

        case telemetry {
          description
            "Telemetry information.";
          list pre-or-ongoing-mitigation {
            description
              "Pre-or-ongoing-mitigation telemetry per DOTS client.
             The keys of the list are 'cuid' and 'tmid', but these
             keys are not represented here because these keys are
             conveyed as mandatory Uri-Paths in requests.
             Omitting keys is compliant with RFC 8791.";
            reference
              "RFC 8791: YANG Data Structure Extensions";

            choice direction {
              description
                "Indicates the communication direction in which the
               data nodes can be included.";
              case server-to-client-only {
                description
                  "These data nodes appear only in a telemetry
                 message sent from the server to the client.";
                leaf tmid {
                  type uint32;
                  description
                    "A client-assigned identifier for the DOTS
                   telemetry data.";
                }
              }  // case server-to-client-only
            }  // choice direction

            container target {
              description
                "Indicates the target.  At least one of the
               attributes 'target-prefix', 'target-fqdn',
               'target-uri', 'alias-name', or 'mid-list'
               must be present in the target definition.";
              uses data-channel:target;

              leaf-list alias-name {
                type string;
                description
                  "An alias name that points to a resource.";
              }

              leaf-list mid-list {
                type uint32;
                description
                  "Reference to a list of associated mitigation
                 requests.";
                reference
                  "RFC 9132: Distributed Denial-of-Service Open
                  	  Threat Signaling (DOTS) Signal Channel
                  	  Specification, Section 4.4.1";

              }
            }  // container target

            uses pre-or-ongoing-mitigation;
          }  // list pre-or-ongoing-mitigation
        }  // case telemetry
      }  // choice telemetry-message-type
    }  // container dots-telemetry
  }  // module ietf-dots-telemetry