Refresh IETF client/server models

[netconf.git] / transport / transport-ssh / src / main / yang / ietf-ssh-server@2023-12-28.yang

diff --git a/transport/transport-ssh/src/main/yang/ietf-ssh-server@2023-04-17.yang b/transport/transport-ssh/src/main/yang/ietf-ssh-server@2023-12-28.yang
similarity index 91%
rename from transport/transport-ssh/src/main/yang/ietf-ssh-server@2023-04-17.yang
rename to transport/transport-ssh/src/main/yang/ietf-ssh-server@2023-12-28.yang
index b5b564e72564977ea8211aa26b6d4629a4baf2fa..5f5c685eeeff7f49bb522d4eb2665a7b5d438622 100644 (file)
--- a/transport/transport-ssh/src/main/yang/ietf-ssh-server@2023-04-17.yang
+++ b/transport/transport-ssh/src/main/yang/ietf-ssh-server@2023-12-28.yang
@@ -72,7 +72,7 @@ module ietf-ssh-server {
      (RFC 8174) when, and only when, they appear in all
      capitals, as shown here.";
 
-  revision 2023-04-17 {
+  revision 2023-12-28 {
     description
       "Initial version";
     reference
@@ -99,9 +99,8 @@ module ietf-ssh-server {
     description
       "Indicates that the 'publickey' authentication type,
        per RFC 4252, is supported for locally-defined users.
-
        The 'publickey' authentication type is required by
-       RFC 4252, but common implementations enable it to
+       RFC 4252, but common implementations allow it to
        be disabled.";
     reference
       "RFC 4252:
@@ -127,6 +126,7 @@ module ietf-ssh-server {
       "RFC 4252:
         The Secure Shell (SSH) Authentication Protocol";
   }
+
   feature local-user-auth-none {
     if-feature "local-users-supported";
     description
@@ -190,13 +190,14 @@ module ietf-ssh-server {
               "RFC CCCC: A YANG Data Model for a Keystore";
             uses ks:inline-or-keystore-asymmetric-key-grouping {
               refine "inline-or-keystore/inline/inline-definition" {
-                must 'derived-from-or-self(public-key-format,'
-                   + ' "ct:ssh-public-key-format")';
+                must 'not(public-key-format) or derived-from-or-self'
+                 + '(public-key-format, "ct:ssh-public-key-format")';
 
               }
-              refine "inline-or-keystore/keystore/"
-                   + "keystore-reference" {
-                must 'derived-from-or-self(deref(.)/../ks:public-'
+              refine "inline-or-keystore/central-keystore/"
+                   + "central-keystore-reference" {
+                must 'not(deref(.)/../ks:public-key-format) or '
+                   + 'derived-from-or-self(deref(.)/../ks:public-'
                    + 'key-format, "ct:ssh-public-key-format")';
               }
             }
@@ -210,16 +211,17 @@ module ietf-ssh-server {
             reference
               "RFC CCCC: A YANG Data Model for a Keystore";
             uses
-            ks:inline-or-keystore-end-entity-cert-with-key-grouping{
+            ks:inline-or-keystore-end-entity-cert-with-key-grouping{ 
               refine "inline-or-keystore/inline/inline-definition" {
-                must 'derived-from-or-self(public-key-format,'
-                   + ' "ct:subject-public-key-info-format")';
+                must 'not(public-key-format) or derived-from-or-self'
+                   + '(public-key-format, "ct:subject-public-key-'
+                   + 'info-format")';
               }
-              refine "inline-or-keystore/keystore/keystore-reference"
-                   + "/asymmetric-key" {
-                must
-                  'derived-from-or-self(deref(.)/../ks:public-key-'
-                  + 'format, "ct:subject-public-key-info-format")';
+              refine "inline-or-keystore/central-keystore/"
+                   + "central-keystore-reference/asymmetric-key" {
+                must 'not(deref(.)/../ks:public-key-format) or '
+                   + 'derived-from-or-self(deref(.)/../ks:public-key'
+                   + '-format, "ct:subject-public-key-info-format")';
               }
             }
           }
@@ -250,7 +252,7 @@ module ietf-ssh-server {
              5.1 and 5.2 in RFC 4252.
 
              The authentication methods are unordered.  Clients
-             must authenticate to all configured methods.
+             must authenticate to all configured methods. 
              Whenever a choice amongst methods arises,
              implementations SHOULD use a default ordering
              that prioritizes automation over human-interaction.";
@@ -283,8 +285,8 @@ module ietf-ssh-server {
                 must 'derived-from-or-self(public-key-format,'
                    + ' "ct:ssh-public-key-format")';
               }
-              refine "inline-or-truststore/truststore/truststore-"
-                   + "reference" {
+              refine "inline-or-truststore/central-truststore/"
+                   + "central-truststore-reference" {
                 must 'not(deref(.)/../ts:public-key/ts:public-key-'
                    + 'format[not(derived-from-or-self(., "ct:ssh-'
                    + 'public-key-format"))])';
@@ -318,8 +320,8 @@ module ietf-ssh-server {
                 must 'derived-from-or-self(public-key-format,'
                    + ' "ct:ssh-public-key-format")';
               }
-              refine "inline-or-truststore/truststore/truststore-"
-                   + "reference" {
+              refine "inline-or-truststore/central-truststore/"
+                   + "central-truststore-reference" {
                 must 'not(deref(.)/../ts:public-key/ts:public-key-'
                    + 'format[not(derived-from-or-self(., "ct:ssh-'
                    + 'public-key-format"))])';
@@ -337,7 +339,7 @@ module ietf-ssh-server {
                          Protocol.";
           }
         }
-      }
+      } // users
       container ca-certs {
         if-feature "sshcmn:ssh-x509-certs";
         presence