module ietf-dots-telemetry {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-dots-telemetry";
prefix dots-telemetry;
import ietf-dots-signal-channel {
prefix ietf-signal;
reference
"RFC SSSS: Distributed Denial-of-Service Open Threat
Signaling (DOTS) Signal Channel Specification";
}
import ietf-dots-data-channel {
prefix ietf-data;
reference
"RFC DDDD: Distributed Denial-of-Service Open Threat
Signaling (DOTS) Data Channel Specification";
}
import ietf-yang-types {
prefix yang;
reference
"Section 3 of RFC 6991";
}
import ietf-inet-types {
prefix inet;
reference
"Section 4 of RFC 6991";
}
import ietf-network-topology {
prefix nt;
reference
"Section 6.2 of RFC 8345: A YANG Data Model for Network
Topologies";
}
organization
"IETF DDoS Open Threat Signaling (DOTS) Working Group";
contact
"WG Web:
WG List:
Author: Mohamed Boucadair
Author: Konda, Tirumaleswar Reddy
";
description
"This module contains YANG definitions for the signaling
of DOTS telemetry exchanged between a DOTS client and
a DOTS server, by means of the DOTS signal channel.
Copyright (c) 2020 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see
the RFC itself for full legal notices.";
revision 2020-01-23 {
description
"Initial revision.";
reference
"RFC XXXX: Distributed Denial-of-Service Open Threat
Signaling (DOTS) Telemetry";
}
feature dots-telemetry {
description
"This feature means that the DOTS signal channel is able
to convey DOTS telemetry data between DOTS clients and
servers.";
}
typedef attack-severity {
type enumeration {
enum emergency {
value 1;
description
"The attack is severe: emergency.";
}
enum critical {
value 2;
description
"The attack is critical.";
}
enum alert {
value 3;
description
"This is an alert.";
}
}
description
"Enumeration for attack severity.";
}
typedef unit {
type enumeration {
enum pps {
value 1;
description
"Packets per second (PPS).";
}
enum kilo-pps {
value 2;
description
"Kilo packets per second (Kpps).";
}
enum bps {
value 3;
description
"Bits per Second (BPS).";
}
enum kilobytes-ps {
value 4;
description
"Kilobytes per second.";
}
enum megabytes-ps {
value 5;
description
"Megabytes per second.";
}
enum gigabytes-ps {
value 6;
description
"Gigabytes per second.";
}
}
description
"Enumeration to indicate which unit is used.";
}
typedef interval {
type enumeration {
enum hour {
value 1;
description
"Hour.";
}
enum day {
value 2;
description
"Day.";
}
enum week {
value 3;
description
"Week.";
}
enum month {
value 4;
description
"Month.";
}
}
description
"Enumeration to indicate the overall measurement period.";
}
typedef sample {
type enumeration {
enum second {
value 1;
description
"Second.";
}
enum 5-seconds {
value 2;
description
"5 seconds.";
}
enum 30-seconds {
value 3;
description
"30 seconds.";
}
enum minute {
value 4;
description
"One minute.";
}
enum 5-minutes {
value 5;
description
"5 minutes.";
}
enum 10-minutes {
value 6;
description
"10 minutes.";
}
enum 30-minutes {
value 7;
description
"30 minutes.";
}
enum hour {
value 8;
description
"One hour.";
}
}
description
"Enumeration to indicate the measurement perdiod.";
}
typedef percentile {
type decimal64 {
fraction-digits 2;
}
description
"The nth percentile of a set of data is the
value at which n percent of the data is below it.";
}
grouping percentile-config {
description
"Configuration of low, mid, and high percentile values.";
leaf measurement-interval {
type interval;
description
"Defines the period on which percentiles are computed.";
}
leaf measurement-sample {
type sample;
description
"Defines the time distribution for measuring
values that are used to compute percentiles..";
}
leaf low-percentile {
type percentile;
default "10.00";
description
"Low percentile. If set to '0', this means low-percentiles
are disabled.";
}
leaf mid-percentile {
type percentile;
must '. >= ../low-percentile' {
error-message
"The mid-percentile must be greater than
or equal to the low-percentile.";
}
default "50.00";
description
"Mid percentile. If set to the same value as low-percentiles,
this means mid-percentiles are disabled.";
}
leaf high-percentile {
type percentile;
must '. >= ../mid-percentile' {
error-message
"The high-percentile must be greater than
or equal to the mid-percentile.";
}
default "90.00";
description
"High percentile. If set to the same value as mid-percentiles,
this means high-percentiles are disabled.";
}
}
grouping percentile {
description
"Generic grouping for percentile.";
leaf low-percentile-g {
type yang:gauge64;
description
"Low traffic.";
}
leaf mid-percentile-g {
type yang:gauge64;
description
"Mid percentile.";
}
leaf high-percentile-g {
type yang:gauge64;
description
"High percentile.";
}
leaf peak-g {
type yang:gauge64;
description
"Peak";
}
}
grouping unit-config {
description
"Generic grouping for unit configuration.";
list unit-config {
key "unit";
description
"Controls which units are allowed when sharing telemetry
data.";
leaf unit {
type unit;
description
"The traffic can be measured in packets per
second (PPS) or kilo packets per second (Kpps) and Bits per
Second (BPS), and kilobytes per second or megabytes per second
or gigabytes per second.";
}
leaf unit-status {
type boolean;
description
"Enable/disable the use of the measurement unit.";
}
}
}
grouping traffic-unit {
description
"Grouping of traffic as a function of measurement unit.";
leaf unit {
type unit;
description
"The traffic can be measured in packets per
second (PPS) or kilo packets per second (Kpps) and Bits per
Second (BPS), and kilobytes per second or megabytes per second
or gigabytes per second.";
}
uses percentile;
}
grouping traffic-unit-protocol {
description
"Grouping of traffic of a given transport protocol as
a function of measurement unit.";
leaf unit {
type unit;
description
"The traffic can be measured in packets per
second (PPS) or kilo packets per second (Kpps) and Bits per
Second (BPS), and kilobytes per second or megabytes per second
or gigabytes per second.";
}
leaf protocol {
type uint8;
description
"The transport protocol.
Values are taken from the IANA Protocol Numbers registry:
.
For example, this field contains 6 for TCP,
17 for UDP, 33 for DCCP, or 132 for SCTP.";
}
uses percentile;
}
grouping total-connection-capacity {
description
"Total Connections Capacity. If the target is subjected
to resource consuming DDoS attack, these attributes are
useful to detect resource consuming DDoS attacks";
leaf connection {
type uint64;
description
"The maximum number of simultaneous connections that
are allowed to the target server. The threshold is
transport-protocol specific because the target server
could support multiple protocols.";
}
leaf connection-client {
type uint64;
description
"The maximum number of simultaneous connections that
are allowed to the target server per client.";
}
leaf embryonic {
type uint64;
description
"The maximum number of simultaneous embryonic connections
that are allowed to the target server. The term 'embryonic
connection' refers to a connection whose connection handshake
is not finished and embryonic connection is only possible in
connection-oriented transport protocols like TCP or SCTP.";
}
leaf embryonic-client {
type uint64;
description
"The maximum number of simultaneous embryonic connections
that are allowed to the target server per client.";
}
leaf connection-ps {
type uint64;
description
"The maximum number of connections allowed per second
to the target server.";
}
leaf connection-client-ps {
type uint64;
description
"The maximum number of connections allowed per second
to the target server per client.";
}
leaf request-ps {
type uint64;
description
"The maximum number of requests allowed per second
to the target server.";
}
leaf request-client-ps {
type uint64;
description
"The maximum number of requests allowed per second
to the target server per client.";
}
leaf partial-request-ps {
type uint64;
description
"The maximum number of partial requests allowed per
second to the target server.";
}
leaf partial-request-client-ps {
type uint64;
description
"The maximum number of partial requests allowed per
second to the target server per client.";
}
}
grouping connection {
description
"A set of attributes which represent the attack
characteristics";
leaf connection {
type yang:gauge64;
description
"The number of simultaneous attack connections to
the target server.";
}
leaf embryonic {
type yang:gauge64;
description
"The number of simultaneous embryonic connections to
the target server.";
}
leaf connection-ps {
type yang:gauge64;
description
"The number of attack connections per second to
the target server.";
}
leaf request-ps {
type yang:gauge64;
description
"The number of attack requests per second to
the target server.";
}
leaf partial-request-ps {
type yang:gauge64;
description
"The number of attack partial requests to
the target server.";
}
}
grouping connection-percentile {
description
"Total attack connections.";
container low-percentile-c {
description
"Low percentile of attack connections.";
uses connection;
}
container mid-percentile-c {
description
"Mid percentile of attack connections.";
uses connection;
}
container high-percentile-c {
description
"High percentile of attack connections.";
uses connection;
}
container peak-c {
description
"Peak attack connections.";
uses connection;
}
}
grouping connection-protocol-percentile {
description
"Total attack connections.";
list low-percentile-l {
key "protocol";
description
"Low percentile of attack connections.";
leaf protocol {
type uint8;
description
"The transport protocol.
Values are taken from the IANA Protocol Numbers registry:
.";
}
uses connection;
}
list mid-percentile-l {
key "protocol";
description
"Mid percentile of attack connections.";
leaf protocol {
type uint8;
description
"The transport protocol.
Values are taken from the IANA Protocol Numbers registry:
.";
}
uses connection;
}
list high-percentile-l {
key "protocol";
description
"Highg percentile of attack connections.";
leaf protocol {
type uint8;
description
"The transport protocol.
Values are taken from the IANA Protocol Numbers registry:
.";
}
uses connection;
}
list peak-l {
key "protocol";
description
"Peak attack connections.";
leaf protocol {
type uint8;
description
"The transport protocol.
Values are taken from the IANA Protocol Numbers registry:
.";
}
uses connection;
}
}
grouping attack-detail {
description
"Various information and details that describe the on-going
attacks that needs to be mitigated by the DOTS server.
The attack details need to cover well-known and common attacks
(such as a SYN Flood) along with new emerging or vendor-specific
attacks.";
leaf id {
type uint32;
description
"Vendor ID is a security vendor's Enterprise Number.";
}
leaf attack-id {
type string;
description
"Unique identifier assigned by the vendor for the attack.";
}
leaf attack-name {
type string;
description
"Textual representation of attack description. Natural Language
Processing techniques (e.g., word embedding) can possibly be used
to map the attack description to an attack type.";
}
leaf attack-severity {
type attack-severity;
description
"Severity level of an attack";
}
leaf start-time {
type uint64;
description
"The time the attack started. Start time is represented in seconds
relative to 1970-01-01T00:00:00Z in UTC time.";
}
leaf end-time {
type uint64;
description
"The time the attack ended. End time is represented in seconds
relative to 1970-01-01T00:00:00Z in UTC time.";
}
container source-count {
description
"Indicates the count of unique sources involved
in the attack.";
uses percentile;
}
}
grouping top-talker-aggregate {
description
"Top attack sources.";
list source-prefix {
key "source-prefix";
description
"IPv4 or IPv6 prefix identifying the attacker(s).";
leaf spoofed-status {
type boolean;
description
"Indicates whether this address is spoofed.";
}
leaf source-prefix {
type inet:ip-prefix;
description
"IPv4 or IPv6 prefix identifying the attacker(s).";
}
list total-attack-traffic {
key "unit";
description
"Total attack traffic issued from this source.";
uses traffic-unit;
}
container total-attack-connection {
description
"Total attack connections issued from this source.";
uses connection-percentile;
}
}
}
grouping top-talker {
description
"Top attack sources.";
list source-prefix {
key "source-prefix";
description
"IPv4 or IPv6 prefix identifying the attacker(s).";
leaf spoofed-status {
type boolean;
description
"Indicates whether this address is spoofed.";
}
leaf source-prefix {
type inet:ip-prefix;
description
"IPv4 or IPv6 prefix identifying the attacker(s).";
}
list total-attack-traffic {
key "unit";
description
"Total attack traffic issued from this source.";
uses traffic-unit;
}
container total-attack-connection {
description
"Total attack connections issued from this source.";
uses connection-protocol-percentile;
}
}
}
grouping baseline {
description
"Grouping for the telemetry baseline.";
uses ietf-data:target;
list total-traffic-normal-baseline {
key "unit protocol";
description
"Total traffic normal baselines.";
uses traffic-unit-protocol;
}
list total-connection-capacity {
key "protocol";
description
"Total connection capacity.";
leaf protocol {
type uint8;
description
"The transport protocol.
Values are taken from the IANA Protocol Numbers registry:
.";
}
uses total-connection-capacity;
}
}
grouping pre-mitigation {
description
"Grouping for the telemetry data.";
list total-traffic {
key "unit protocol";
description
"Total traffic.";
uses traffic-unit-protocol;
}
list total-attack-traffic {
key "unit protocol";
description
"Total attack traffic per protocol.";
uses traffic-unit-protocol;
}
container total-attack-connection {
description
"Total attack connections.";
uses connection-protocol-percentile;
}
container attack-detail {
description
"Attack details.";
uses attack-detail;
container top-talker {
description
"Top attack sources.";
uses top-talker;
}
}
}
augment "/ietf-signal:dots-signal/ietf-signal:message-type/"
+ "ietf-signal:mitigation-scope/ietf-signal:scope" {
if-feature "dots-telemetry";
description
"Extends mitigation scope with telemetry update data.";
list total-traffic {
key "unit protocol";
description
"Total traffic.";
uses traffic-unit-protocol;
}
list total-attack-traffic {
key "unit";
description
"Total attack traffic.";
uses traffic-unit;
}
container total-attack-connection {
description
"Total attack connections.";
uses connection-percentile;
}
container attack-detail {
description
"Atatck details";
uses attack-detail;
container top-talker {
description
"Top attack sources.";
uses top-talker-aggregate;
}
}
}
augment "/ietf-signal:dots-signal/ietf-signal:message-type" {
if-feature "dots-telemetry";
description
"Add a new choice to enclose telemetry data in DOTS
signal channel.";
case telemetry-setup {
description
"Indicates the message is about telemetry.";
list telemetry {
key "cuid tsid";
description
"The telemetry data per DOTS client.";
leaf cuid {
type string;
description
"A unique identifier that is
generated by a DOTS client to prevent
request collisions. It is expected that the
cuid will remain consistent throughout the
lifetime of the DOTS client.";
}
leaf cdid {
type string;
description
"The cdid should be included by a server-domain
DOTS gateway to propagate the client domain
identification information from the
gateway's client-facing-side to the gateway's
server-facing-side, and from the gateway's
server-facing-side to the DOTS server.
It may be used by the final DOTS server
for policy enforcement purposes.";
}
leaf tsid {
type uint32;
description
"An identifier for the DOTS telemetry setup
data.";
}
choice setup-type {
description
"Can be a mitigation configuration, a pipe capacity,
or baseline message.";
case telemetry-config {
description
"Uses to set low, mid, and high percentile values.";
container current-config {
description
"Current configuration values.";
uses percentile-config;
uses unit-config;
leaf server-initiated-telemetry {
type boolean;
description
"Used by a DOTS client to enable/disable whether it
accepts pre-mitigation telemetry from the DOTS
server.";
}
leaf telemetry-notify-interval {
type uint32 {
range "1 .. 3600";
}
units "seconds";
description
"Minimum number of seconds between successive
telemetry notifications.";
}
}
container max-config-values {
description
"Maximum acceptable configuration values.";
config false;
uses percentile-config;
// Check if this is right place for indciating this capability
leaf server-initiated-telemetry {
type boolean;
description
"Indicates whether the DOTS server can be instructed
to send pre-mitigation telemetry. If set to FALSE
or the attribute is not present, this is an indication
that the server does not support this capability.";
}
leaf telemetry-notify-interval {
type uint32 {
range "1 .. 3600";
}
units "seconds";
description
"Minimum number of seconds between successive
telemetry notifications.";
}
}
container min-config-values {
description
"Minimum acceptable configuration values.";
config false;
uses percentile-config;
leaf telemetry-notify-interval {
type uint32 {
range "1 .. 3600";
}
units "seconds";
description
"Minimum number of seconds between successive
telemetry notifications.";
}
}
container supported-units {
description
"Supported units and default activation status.";
config false;
uses unit-config;
}
}
case pipe {
description
"Total pipe capacity of a DOTS client domain";
list total-pipe-capacity {
key "link-id unit";
description
"Total pipe capacity of a DOTS client domain.";
leaf link-id {
type nt:link-id;
description
"Identifier of an interconnection link.";
}
leaf capacity {
type uint64;
mandatory true;
description
"Pipe capacity.";
}
leaf unit {
type unit;
description
"The traffic can be measured in packets per
second (PPS) or kilo packets per second (Kpps) and Bits per
Second (BPS), and kilobytes per second or megabytes per second
or gigabytes per second.";
}
}
}
case baseline {
description
"Traffic baseline information";
list baseline {
key "id";
description
"Traffic baseline information";
leaf id {
type uint32;
must '. >= 1';
description
"A baseline entry identifier.";
}
uses baseline;
}
}
}
}
}
case telemetry {
description
"Indicates the message is about telemetry.";
list pre-mitigation {
key "cuid id";
description
"Pre-mitigation telemetry per DOTS client.";
leaf cuid {
type string;
description
"A unique identifier that is
generated by a DOTS client to prevent
request collisions. It is expected that the
cuid will remain consistent throughout the
lifetime of the DOTS client.";
}
leaf cdid {
type string;
description
"The cdid should be included by a server-domain
DOTS gateway to propagate the client domain
identification information from the
gateway's client-facing-side to the gateway's
server-facing-side, and from the gateway's
server-facing-side to the DOTS server.
It may be used by the final DOTS server
for policy enforcement purposes.";
}
leaf id {
type uint32;
description
"An identifier to uniquely demux telemetry data send using
the same message.";
}
container target {
description
"Indicates the target.";
uses ietf-data:target;
}
uses pre-mitigation;
}
}
}
}