module ietf-tcp {

    yang-version 1.1;

    namespace
      "urn:ietf:params:xml:ns:yang:ietf-tcp";

    prefix tcp;

    import ietf-yang-types {
      prefix yang;
      reference
        "RFC 6991: Common YANG Data Types.";


    }
    import ietf-tcp-common {
      prefix tcpcmn;
      reference
        "I-D.ietf-netconf-tcp-client-server: YANG Groupings for TCP
        Clients and TCP Servers.";


    }
    import ietf-inet-types {
      prefix inet;
      reference
        "RFC 6991: Common YANG Data Types.";


    }
    import ietf-netconf-acm {
      prefix nacm;
      reference
        "RFC 8341: Network Configuration Access Control Model";


    }

    organization "IETF TCPM Working Group";

    contact
      "WG Web:   <https://datatracker.ietf.org/wg/tcpm/about>
WG List:  <tcpm@ietf.org>

Authors: Michael Scharf (michael.scharf at hs-esslingen dot de)
	 Mahesh Jethanandani (mjethanandani at gmail dot com)
	 Vishal Murgai (vmurgai at gmail dot com)";

    description
      "This module focuses on fundamental TCP functions and basic
statistics. The model can be augmented to address more advanced
or implementation specific TCP features.

Copyright (c) 2021 IETF Trust and the persons identified as
authors of the code.  All rights reserved.

Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Simplified BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).

This version of this YANG module is part of RFC XXXX
(https://www.rfc-editor.org/info/rfcXXXX); see the RFC itself
for full legal notices.

The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
'MAY', and 'OPTIONAL' in this document are to be interpreted as
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
they appear in all capitals, as shown here.";

    revision "2022-02-04" {
      description "Initial Version";
      reference
        "RFC XXXX, A YANG Model for Transmission Control Protocol (TCP)
        	  Configuration.";

    }


    feature statistics {
      description
        "This implementation supports statistics reporting.";
    }

    container tcp {
      presence
        "The container for TCP configuration.";
      description "TCP container.";
      container connections {
        description
          "A container of all TCP connections.";
        list connection {
          key "local-address remote-address local-port remote-port";
          description
            "List of TCP connections with their parameters. The list
is modeled as writeable, but implementations may not
allow creation of new TCP connections by adding entries to
the list. Furthermore, the behavior upon removal is
implementation-specific. Implementations may support
closing or resetting a TCP connection upon an operation
that removes the entry from the list.";
          leaf local-address {
            type inet:ip-address;
            description
              "Identifies the address that is used by the local
endpoint for the connection, and is one of the four
elements that form the connection identifier.";
          }

          leaf remote-address {
            type inet:ip-address;
            description
              "Identifies the address that is used by the remote
endpoint for the connection, and is one of the four
elements that form the connection identifier.";
          }

          leaf local-port {
            type inet:port-number;
            description
              "Identifies the local TCP port used for the connection,
and is one of the four elements that form the
connection identifier.";
          }

          leaf remote-port {
            type inet:port-number;
            description
              "Identifies the remote TCP port used for the connection,
and is one of the four elements that form the
connection identifier.";
          }

          container common {
            description
              "Common definitions of TCP configuration. This includes
parameters such as how to secure the connection,
that can be part of either the client or server.";
            container keepalives {
              if-feature keepalives-supported;
              presence
                "Indicates that keepalives are enabled.  This statement is
present so the mandatory descendant nodes do not imply that
this node must be configured.";
              description
                "Configures the keep-alive policy, to proactively test the
aliveness of the TCP peer.  An unresponsive TCP peer is
dropped after approximately (idle-time + max-probes
* probe-interval) seconds.";
              leaf idle-time {
                type uint16 {
                  range "1..max";
                }
                units "seconds";
                mandatory true;
                description
                  "Sets the amount of time after which if no data has been
received from the TCP peer, a TCP-level probe message
will be sent to test the aliveness of the TCP peer.
Two hours (7200 seconds) is safe value, per RFC 1122.";
                reference
                  "RFC 1122:
                   Requirements for Internet Hosts -- Communication Layers";

              }

              leaf max-probes {
                type uint16 {
                  range "1..max";
                }
                mandatory true;
                description
                  "Sets the maximum number of sequential keep-alive probes
that can fail to obtain a response from the TCP peer
before assuming the TCP peer is no longer alive.";
              }

              leaf probe-interval {
                type uint16 {
                  range "1..max";
                }
                units "seconds";
                mandatory true;
                description
                  "Sets the time interval between failed probes. The interval
SHOULD be significantly longer than one second in order to
avoid harm on a congested link.";
              }
            }  // container keepalives

            choice authentication {
              description
                "Choice of TCP authentication.";
              case ao {
                description
                  "Use TCP-AO to secure the connection.";
                leaf enable-ao {
                  type boolean;
                  default "false";
                  description
                    "When set to true, TCP-Authentication Option (TCP-AO) is
enabled.";
                }

                leaf send-id {
                  type uint8 {
                    range "0..max";
                  }
                  must
                    "../enable-ao = 'true'";
                  description
                    "The SendID is inserted as the KeyID of the TCP-AO option
of outgoing segments. The SendID must match the RecvID
at the other endpoint.";
                  reference
                    "RFC 5925: The TCP Authentication Option, Section 3.1.";

                }

                leaf recv-id {
                  type uint8 {
                    range "0..max";
                  }
                  must
                    "../enable-ao = 'true'";
                  description
                    "The RecvID is matched against the TCP-AO KeyID of incoming
segments. The RecvID must match the SendID at the other
endpoint.";
                  reference
                    "RFC 5925: The TCP Authentication Option, Section 3.1.";

                }

                leaf include-tcp-options {
                  type boolean;
                  must
                    "../enable-ao = 'true'";
                  default "true";
                  description
                    "When set to true, TCP options are included in MAC
calculation.";
                  reference
                    "RFC 5925: The TCP Authentication Option, Section 3.1.";

                }

                leaf accept-key-mismatch {
                  type boolean;
                  must
                    "../enable-ao = 'true'";
                  description
                    "Accept, when set to true, TCP segments with a Master Key
Tuple (MKT) that is not configured.";
                  reference
                    "RFC 5925: The TCP Authentication Option, Section 7.3.";

                }
              }  // case ao

              case md5 {
                description
                  "Use TCP-MD5 to secure the connection.";
                leaf enable-md5 {
                  type boolean;
                  default "false";
                  description
                    "Enables, when set to true, support of MD5 to authenticate a
TCP session. As the TCP MD5 signature option is obsoleted by
TCP-AO, it is strongly RECOMMENDED to use TCP-AO instead.";
                }
              }  // case md5
            }  // choice authentication
          }  // container common
        }  // list connection
      }  // container connections

      container statistics {
        if-feature statistics;
        config false;
        description
          "Statistics across all connections.";
        leaf active-opens {
          type yang:counter32;
          description
            "The number of times that TCP connections have made a
direct transition to the SYN-SENT state from the CLOSED
state.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf passive-opens {
          type yang:counter32;
          description
            "The number of times TCP connections have made a direct
transition to the SYN-RCVD state from the LISTEN state.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf attempt-fails {
          type yang:counter32;
          description
            "The number of times that TCP connections have made a
direct transition to the CLOSED state from either the
SYN-SENT state or the SYN-RCVD state, plus the number of
times that TCP connections have made a direct transition
to the LISTEN state from the SYN-RCVD state.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf establish-resets {
          type yang:counter32;
          description
            "The number of times that TCP connections have made a
direct transition to the CLOSED state from either the
ESTABLISHED state or the CLOSE-WAIT state.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf currently-established {
          type yang:gauge32;
          description
            "The number of TCP connections for which the current state
is either ESTABLISHED or CLOSE-WAIT.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf in-segments {
          type yang:counter64;
          description
            "The total number of segments received, including those
received in error.  This count includes segments received
on currently established connections.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf out-segments {
          type yang:counter64;
          description
            "The total number of segments sent, including those on
current connections but excluding those containing only
retransmitted octets.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf retransmitted-segments {
          type yang:counter32;
          description
            "The total number of segments retransmitted; that is, the
number of TCP segments transmitted containing one or more
previously transmitted octets.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf in-errors {
          type yang:counter32;
          description
            "The total number of segments received in error (e.g., bad
TCP checksums).";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        leaf out-resets {
          type yang:counter32;
          description
            "The number of TCP segments sent containing the RST flag.";
          reference
            "I-D.ietf-tcpm-rfc793bis: Transmission Control Protocol
            (TCP) Specification.";

        }

        action reset {
          nacm:default-deny-all;
          description
            "Reset statistics action command.";
          input {
            leaf reset-at {
              type yang:date-and-time;
              description
                "Time when the reset action needs to be
executed.";
            }
          }

          output {
            leaf reset-finished-at {
              type yang:date-and-time;
              description
                "Time when the reset action command completed.";
            }
          }
        }  // rpc reset
      }  // container statistics
    }  // container tcp
  }  // module ietf-tcp