module ietf-netconf-client {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-netconf-client";
  prefix ncc;

  import ietf-yang-types {
    prefix yang;
    reference
      "RFC 6991: Common YANG Data Types";
  }

  import ietf-tcp-client {
    prefix tcpc;
    reference
      "RFC DDDD: YANG Groupings for TCP Clients and TCP Servers";
  }

  import ietf-tcp-server {
    prefix tcps;
    reference
      "RFC DDDD: YANG Groupings for TCP Clients and TCP Servers";
  }

  import ietf-ssh-client {
    prefix sshc;
    revision-date 2022-05-24; // stable grouping definitions
    reference
      "RFC EEEE: YANG Groupings for SSH Clients and SSH Servers";
  }

  import ietf-tls-client {
    prefix tlsc;
    revision-date 2022-05-24; // stable grouping definitions
    reference
      "RFC FFFF: YANG Groupings for TLS Clients and TLS Servers";
  }

  organization
    "IETF NETCONF (Network Configuration) Working Group";

  contact
    "WG Web:   https://datatracker.ietf.org/wg/netconf
     WG List:  NETCONF WG list <mailto:netconf@ietf.org>
     Author:   Kent Watsen <mailto:kent+ietf@watsen.net>
     Author:   Gary Wu <mailto:garywu@cisco.com>";

  description
    "This module contains a collection of YANG definitions
     for configuring NETCONF clients.

     Copyright (c) 2022 IETF Trust and the persons identified
     as authors of the code. All rights reserved.

     Redistribution and use in source and binary forms, with
     or without modification, is permitted pursuant to, and
     subject to the license terms contained in, the Revised
     BSD License set forth in Section 4.c of the IETF Trust's
     Legal Provisions Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC HHHH
     (https://www.rfc-editor.org/info/rfcHHHH); see the RFC
     itself for full legal notices.

     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
     'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
     'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
     are to be interpreted as described in BCP 14 (RFC 2119)
     (RFC 8174) when, and only when, they appear in all
     capitals, as shown here.";

  revision 2022-05-24 {
    description
      "Initial version";
    reference
      "RFC HHHH: NETCONF Client and Server Models";
  }

  // Features

  feature ssh-initiate {
    description
      "The 'ssh-initiate' feature indicates that the NETCONF client
       supports initiating SSH connections to NETCONF servers.";
    reference
      "RFC 6242:
         Using the NETCONF Protocol over Secure Shell (SSH)";
  }

  feature tls-initiate {
    description
      "The 'tls-initiate' feature indicates that the NETCONF client
       supports initiating TLS connections to NETCONF servers.";
    reference
      "RFC 7589: Using the NETCONF Protocol over Transport
         Layer Security (TLS) with Mutual X.509 Authentication";
  }

  feature ssh-listen {
    description
      "The 'ssh-listen' feature indicates that the NETCONF client
       supports opening a port to listen for incoming NETCONF
       server call-home SSH connections.";
    reference
      "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
  }

  feature tls-listen {
    description
      "The 'tls-listen' feature indicates that the NETCONF client
       supports opening a port to listen for incoming NETCONF
       server call-home TLS connections.";
    reference
      "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
  }

  feature central-netconf-client-supported {
    description
      "The 'central-netconf-client-supported' feature indicates
       that the server supports the top-level 'netconf-client'
       node.

       This feature is needed as some servers may want to use
       features defined in this module, which requires this
       module to be implemented, without having to support
       the top-level 'netconf-client' node.";
  }

  // Groupings

  grouping netconf-client-grouping {
    description
      "A reusable grouping for configuring a NETCONF client
       without any consideration for how underlying transport
       sessions are established.

       This grouping currently does not define any nodes. It
       exists only so the model can be consistent with other
       'client-server' models.";
  }

  grouping netconf-client-initiate-stack-grouping {
    description
      "A reusable grouping for configuring a NETCONF client
       'initiate' protocol stack for a single connection.";
    choice transport {
      mandatory true;
      description
        "Selects between available transports.";
      case ssh {
        if-feature "ssh-initiate";
        container ssh {
          description
            "Specifies IP and SSH specific configuration
             for the connection.";
          container tcp-client-parameters {
            description
              "A wrapper around the TCP client parameters
               to avoid name collisions.";
            uses tcpc:tcp-client-grouping {
              refine "remote-port" {
                default "830";
                description
                  "The NETCONF client will attempt to connect
                   to the IANA-assigned well-known port value
                   for 'netconf-ssh' (830) if no value is
                   specified.";
              }
            }
          }
          container ssh-client-parameters {
            description
              "A wrapper around the SSH client parameters to
               avoid name collisions.";
            uses sshc:ssh-client-grouping;
          }
          container netconf-client-parameters {
            description
              "A wrapper around the NETCONF client parameters
               to avoid name collisions.

               This container does not define any nodes.  It
               exists as a potential augmentation target by
               other modules.";
            uses ncc:netconf-client-grouping;
          }
        }
      }
      case tls {
        if-feature "tls-initiate";
        container tls {
          description
            "Specifies IP and TLS specific configuration
             for the connection.";
          container tcp-client-parameters {
            description
              "A wrapper around the TCP client parameters
               to avoid name collisions.";
            uses tcpc:tcp-client-grouping {
              refine "remote-port" {
                default "6513";
                description
                  "The NETCONF client will attempt to connect
                   to the IANA-assigned well-known port value
                   for 'netconf-tls' (6513) if no value is
                   specified.";
              }
            }
          }
          container tls-client-parameters {
            must client-identity {
              description
                "NETCONF/TLS clients MUST pass some
                 authentication credentials.";
            }
            description
              "A wrapper around the TLS client parameters
               to avoid name collisions.";
            uses tlsc:tls-client-grouping;
          }
          container netconf-client-parameters {
            description
              "A wrapper around the NETCONF client parameters
               to avoid name collisions.

               This container does not define any nodes.  It
               exists as a potential augmentation target by
               other modules.";
            uses ncc:netconf-client-grouping;
          }
        }
      }
    }
  } // netconf-client-initiate-stack-grouping

  grouping netconf-client-listen-stack-grouping {
    description
      "A reusable grouping for configuring a NETCONF client
       'listen' protocol stack for a single connection.  The
       'listen' stack supports call home connections, as
       described in RFC 8071";
    reference
      "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
    choice transport {
      mandatory true;
      description
        "Selects between available transports.";
      case ssh {
        if-feature "ssh-listen";
        container ssh {
          description
            "SSH-specific listening configuration for inbound
             connections.";
          container tcp-server-parameters {
            description
              "A wrapper around the TCP server parameters
               to avoid name collisions.";
            uses tcps:tcp-server-grouping {
              refine "local-port" {
                default "4334";
                description
                  "The NETCONF client will listen on the IANA-
                   assigned well-known port for 'netconf-ch-ssh'
                   (4334) if no value is specified.";
              }
            }
          }
          container ssh-client-parameters {
            description
              "A wrapper around the SSH client parameters
               to avoid name collisions.";
            uses sshc:ssh-client-grouping;
          }
          container netconf-client-parameters {
            description
              "A wrapper around the NETCONF client parameters
               to avoid name collisions.

               This container does not define any nodes.  It
               exists as a potential augmentation target by
               other modules.";
            uses ncc:netconf-client-grouping;
          }
        }
      }
      case tls {
        if-feature "tls-listen";
        container tls {
          description
            "TLS-specific listening configuration for inbound
             connections.";
          container tcp-server-parameters {
            description
              "A wrapper around the TCP server parameters
               to avoid name collisions.";
            uses tcps:tcp-server-grouping {
              refine "local-port" {
                default "4334";
                description
                  "The NETCONF client will listen on the IANA-
                    assigned well-known port for 'netconf-ch-ssh'
                    (4334) if no value is specified.";
              }
            }
          }
          container tls-client-parameters {
            must client-identity {
              description
                "NETCONF/TLS clients MUST pass some
                 authentication credentials.";
            }
            description
              "A wrapper around the TLS client parameters
               to avoid name collisions.";
            uses tlsc:tls-client-grouping;
          }
          container netconf-client-parameters {
            description
              "A wrapper around the NETCONF client parameters
               to avoid name collisions.

               This container does not define any nodes.  It
               exists as a potential augmentation target by
               other modules.";
            uses ncc:netconf-client-grouping;
          }
        }
      }
    }
  } // netconf-client-listen-stack-grouping

  grouping netconf-client-app-grouping {
    description
      "A reusable grouping for configuring a NETCONF client
       application that supports both 'initiate' and 'listen'
       protocol stacks for a multiplicity of connections.";
    container initiate {
      if-feature "ssh-initiate or tls-initiate";
      presence
        "Indicates that client-initiated connections have been
         configured.  This statement is present so the mandatory
         descendant nodes do not imply that this node must be
         configured.";
      description
        "Configures client initiating underlying TCP connections.";
      list netconf-server {
        key "name";
        min-elements 1;
        description
          "List of NETCONF servers the NETCONF client is to
           maintain simultaneous connections with.";
        leaf name {
          type string;
          description
            "An arbitrary name for the NETCONF server.";
        }
        container endpoints {
          description
            "Container for the list of endpoints.";
          list endpoint {
            key "name";
            min-elements 1;
            ordered-by user;
            description
              "A user-ordered list of endpoints that the NETCONF
               client will attempt to connect to in the specified
               sequence.  Defining more than one enables
               high-availability.";
            leaf name {
              type string;
              description
                "An arbitrary name for the endpoint.";
            }
            uses netconf-client-initiate-stack-grouping;
          } // list endpoint
        } // container endpoints

        container connection-type {
          description
            "Indicates the NETCONF client's preference for how the
             NETCONF connection is maintained.";
          choice connection-type {
            mandatory true;
            description
              "Selects between available connection types.";
            case persistent-connection {
              container persistent {
                presence
                  "Indicates that a persistent connection is to be
                   maintained.";
                description
                  "Maintain a persistent connection to the NETCONF
                   server.  If the connection goes down, immediately
                   start trying to reconnect to the NETCONF server,
                   using the reconnection strategy.

                   This connection type minimizes any NETCONF server
                   to NETCONF client data-transfer delay, albeit at
                   the expense of holding resources longer.";
              }
            }
            case periodic-connection {
              container periodic {
                presence "Indicates that a periodic connection is
                          to be maintained.";
                description
                  "Periodically connect to the NETCONF server.

                   This connection type increases resource
                   utilization, albeit with increased delay in
                   NETCONF server to NETCONF client interactions.

                   The NETCONF client should close the underlying
                   TCP connection upon completing planned activities.

                   In the case that the previous connection is still
                   active, establishing a new connection is NOT
                   RECOMMENDED.";
                leaf period {
                  type uint16;
                  units "minutes";
                  default "60";
                  description
                    "Duration of time between periodic connections.";
                }
                leaf anchor-time {
                  type yang:date-and-time {
                    // constrained to minute-level granularity
                    pattern '\d{4}-\d{2}-\d{2}T\d{2}:\d{2}'
                          + '(Z|[\+\-]\d{2}:\d{2})';
                  }
                  description
                    "Designates a timestamp before or after which a
                     series of periodic connections are determined.
                     The periodic connections occur at a whole
                     multiple interval from the anchor time.  For
                     example, for an anchor time is 15 minutes past
                     midnight and a period interval of 24 hours, then
                     a periodic connection will occur 15 minutes past
                     midnight everyday.";
                }
                leaf idle-timeout {
                  type uint16;
                  units "seconds";
                  default 120; // two minutes
                  description
                    "Specifies the maximum number of seconds that
                     a NETCONF session may remain idle. A NETCONF
                     session will be dropped if it is idle for an
                     interval longer then this number of seconds.
                     If set to zero, then the NETCONF client will
                     never drop a session because it is idle.";
                }
              }
            }
          }
        }
        container reconnect-strategy {
          description
            "The reconnection strategy directs how a NETCONF client
             reconnects to a NETCONF server, after discovering its
             connection to the server has dropped, even if due to a
             reboot.  The NETCONF client starts with the specified
             endpoint and tries to connect to it max-attempts times
             before trying the next endpoint in the list (round
             robin).";
          leaf start-with {
            type enumeration {
              enum first-listed {
                description
                  "Indicates that reconnections should start with
                   the first endpoint listed.";
              }
              enum last-connected {
                description
                  "Indicates that reconnections should start with
                   the endpoint last connected to.  If no previous
                   connection has ever been established, then the
                   first endpoint configured is used.   NETCONF
                   clients SHOULD be able to remember the last
                   endpoint connected to across reboots.";
              }
              enum random-selection {
                description
                  "Indicates that reconnections should start with
                   a random endpoint.";
              }
            }
            default "first-listed";
            description
              "Specifies which of the NETCONF server's endpoints
               the NETCONF client should start with when trying
               to connect to the NETCONF server.";
          }
          leaf max-attempts {
            type uint8 {
              range "1..max";
            }
            default "3";
            description
              "Specifies the number times the NETCONF client tries
               to connect to a specific endpoint before moving on
               to the next endpoint in the list (round robin).";
          }
        }
      } // netconf-server
    } // initiate

    container listen {
      if-feature "ssh-listen or tls-listen";
      presence
        "Indicates that client-listening ports have been configured.
         This statement is present so the mandatory descendant nodes
         do not imply that this node must be configured.";
      description
        "Configures the client to accept call-home TCP connections.";
      leaf idle-timeout {
        type uint16;
        units "seconds";
        default "3600"; // one hour
        description
          "Specifies the maximum number of seconds that a NETCONF
           session may remain idle. A NETCONF session will be
           dropped if it is idle for an interval longer than this
           number of seconds.  If set to zero, then the server
           will never drop a session because it is idle.  Sessions
           that have a notification subscription active are never
           dropped.";
      }
      list endpoint {
        key "name";
        min-elements 1;
        description
          "List of endpoints to listen for NETCONF connections.";
        leaf name {
          type string;
          description
            "An arbitrary name for the NETCONF listen endpoint.";
        }
        uses netconf-client-listen-stack-grouping;
      } // endpoint
    } // listen
  } // netconf-client-app-grouping

  // Protocol accessible node for clients that implement this module.
  container netconf-client {
    if-feature central-netconf-client-supported;
    uses netconf-client-app-grouping;
    description
      "Top-level container for NETCONF client configuration.";
  }
}
