module odl-netconf-callhome-server {
  yang-version 1.1;

  namespace "urn:opendaylight:params:xml:ns:yang:netconf-callhome-server";
  prefix "callhome";

  import ietf-netconf-client {
    prefix ncc;
    reference
      "draft-ietf-netconf-netconf-client-server: A YANG Data Model for
       NETCONF Clients and Servers (ietf-netconf-client revision 2025-12-04)";
  }

  organization
   "OpenDaylight Project";

  contact
   "netconf-dev@lists.opendaylight.org";

  description
   "This module defines the northbound interface for OpenDaylight NETCONF Callhome.";

  revision 2026-06-05 {
    description
      "Begins the migration towards the standard IETF 'ietf-netconf-client'
       model (draft-ietf-netconf-netconf-client-server, work in progress;
       ietf-netconf-client revision 2025-12-04): adds 'global/endpoints',
       which reuses the IETF
       'netconf-client-listen-stack-grouping' to describe the local listening
       transport (NETCONF over SSH/TLS Call Home) and the client identity
       OpenDaylight presents to calling devices.
       The OpenDaylight-specific allow-list, inline host-keys, credentials,
       mount-point-naming-strategy and operational device-status are retained
       as-is, because the IETF model cannot express them.";
    reference
     "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
  }

  revision 2024-01-29 {
    description
      "A number of improvements to the sematics of this model. In concrete terms:
       - every device now has to have a transport
       - previously-deprecated 'ssh-host-key' is now obsolete
       - 'credentials; is obsoleted as well
       - 'host-key' is now a dedicated typedef based on 'type binary'";
  }

  revision 2023-04-28 {
    description "This revision integrates device-status leaf, formerly hosted in callhome-device.yang";
  }

  revision 2020-10-15 {
    description
     "This revision adds connectivity details for one of the supported transport protocols";
    reference
     "RFC 8071: NETCONF Call Home and RESTCONF Call Home";
  }

  revision "2016-11-09" {
    description "Initial version";
  }

  typedef ssh-public-key {
    description "An SSH public key encoded in RFC4253 format";
    reference "RFC4253 section 6.6";
    type binary {
      // Note: the format requires at least 8 bytes for length of the algo and its bytes
      length "8..max";
    }
  }

  grouping credentials {
    container credentials {
      presence "Credentials to device.";
      leaf username {
        mandatory true;
        description "Username to be used for authentication";
        type string {
          length "1..max";
        }
      }
      leaf-list passwords {
        description "Passwords to be used for authentication.";
        type string;
      }
    }
  }

  container netconf-callhome-server {
    description "Settings for call home server administration";

    container global {
      presence "global credentials are enabled.";
      uses credentials;
      leaf accept-all-ssh-keys {
        type boolean;
        default false;
      }

      leaf mount-point-naming-strategy {
        type enumeration {
          enum IP_PORT;
          enum IP_ONLY;
        }
        default IP_PORT;
        description "Mount name will be chosen as per this strategy in the absence of per device settings. Default is IP_PORT";
      }

      container endpoints {
        description
          "Listening endpoints OpenDaylight opens to accept incoming Call Home
           connections. Reuses the IETF 'netconf-client-listen-stack-grouping'
           (draft-ietf-netconf-netconf-client-server / RFC 8071), which provides the TCP server parameters
           (default ports 4334 for SSH and 4335 for TLS), the SSH/TLS client
           identity OpenDaylight presents, and is gated by the IETF
           'ssh-listen'/'tls-listen' features.";
        list endpoint {
          key "name";
          description
            "A listening endpoint for incoming Call Home connections.";
          leaf name {
            type string;
            description "An arbitrary name for the listening endpoint.";
          }
          uses ncc:netconf-client-listen-stack-grouping;
        }
      }
    }

    container allowed-devices {
      description "A list of allowed devices";
      list device {
        key unique-id;
        leaf unique-id {
          description "Identifier of device, which will be used to identify device.";
          type string;
        }

        choice transport {
          description "Provides connectivity details for one of the supported transport protocols";
          mandatory true;

          case ssh {
            container ssh-client-params {
              leaf host-key {
                mandatory true;
                description "Public key which device will use during connection.";
                type ssh-public-key;
              }
              uses credentials;
            }
          }
          case tls {
            container tls-client-params {
              leaf certificate-id {
                mandatory true;
                description "Certificate identifier which will be used during two-way TLS authentication.";
                type string;
              }
              leaf key-id {
                mandatory true;
                description "Key identifier inside the NetConf keystore which will be used during two-way TLS authentication.";
                type string;
              }
            }
          }
        }
        unique transport/ssh/ssh-client-params/host-key;
        unique transport/tls/tls-client-params/certificate-id;

        leaf device-status {
          config false;
          type enumeration {
            enum CONNECTED;
            enum FAILED_AUTH_FAILURE;
            enum FAILED_NOT_ALLOWED;
            enum FAILED;
            enum DISCONNECTED;
          }
          default DISCONNECTED;
        }

        leaf ssh-host-key {
          description "Obsolete, a 'host-key' from the 'ssh-client-params' containers should be used instead.";
          status obsolete;
          type string;
        }
        unique ssh-host-key;
        uses credentials {
          status obsolete;
        }
      }
    }
  }
}