czechlight-network@2026-03-09.yang

module czechlight-network {
    yang-version 1.1;
    namespace "http://czechlight.cesnet.cz/yang/czechlight-network";
    prefix cla-network;

    import ietf-interfaces {
        prefix if;
    }

    import ietf-routing {
        prefix rt;
    }

    import ietf-ip {
        prefix ip;
    }

    import iana-if-type {
        prefix ianaift;
    }

    import ietf-ipv4-unicast-routing {
        prefix v4ur;
    }

    import ietf-ipv6-unicast-routing {
        prefix v6ur;
    }

    import ietf-rib-extension {
        prefix rib-ext;
    }

    revision 2026-03-09 {
        description
            "Add options to control use of DNS and NTP servers from DHCPv4,
             and to accept or reject DNS server advertisements from IPv6 RA.";
    }

    revision 2025-06-06 {
        description
            "Split into generic parts and hardware-specific parts. This module contains only
             generic constraints for CzechLight systems, hardware-specific constraints are
             in their own modules";
    }

    revision 2021-02-22 {
        description
            "Initial version. Removes interface statistics in ietf-interfaces model, removes deprecated container
             ietf-interfaces:interface-state and makes the nodes in ietf-interfaces model config false.";
    }

    // We don't support discontinuity time (yet)
    deviation /if:interfaces/if:interface/if:statistics/if:discontinuity-time { deviate not-supported; }

    // IPv6 router advertisements is not supported, as per RFC8349 App. B.
    deviation /if:interfaces/if:interface/ip:ipv6/v6ur:ipv6-router-advertisements { deviate not-supported; }

    // Remove deprecated ietf-interfaces-state and ietf-routing containers. Beware, rt:routing-state references if:interfaces-state.
    deviation /rt:routing-state { deviate not-supported; }
    deviation /if:interfaces-state { deviate not-supported; }

    // We do not support configuring some parts of if:interfaces tree
    deviation /if:interfaces/if:interface/ip:ipv4/ip:forwarding { deviate add { config false; } }
    deviation /if:interfaces/if:interface/ip:ipv4/ip:mtu { deviate add { config false; } }
    deviation /if:interfaces/if:interface/ip:ipv4/ip:neighbor { deviate add { config false; } }
    deviation /if:interfaces/if:interface/ip:ipv6/ip:forwarding { deviate add { config false; } }
    deviation /if:interfaces/if:interface/ip:ipv6/ip:mtu { deviate add { config false; } }
    deviation /if:interfaces/if:interface/ip:ipv6/ip:neighbor { deviate add { config false; } }
    deviation /if:interfaces/if:interface/ip:ipv6/ip:dup-addr-detect-transmits { deviate add { config false; } }

    deviation /if:interfaces/if:interface/if:type {
        deviate add {
            must 'not(re-match(../if:name, "br\d+")) or . = "ianaift:bridge"' {
                error-message "The if:type of a 'br*' interface must be set to ianaift:bridge";
            }

            must 'not(re-match(../if:name, "eth\d+")) or . = "ianaift:ethernetCsmacd"' {
                error-message "The if:type of a 'eth*' interface must be set to ianaift:ethernetCsmacd";
            }

            must 'not(re-match(../if:name, "osc.*")) or . = "ianaift:ethernetCsmacd"' {
                error-message "The if:type of a 'osc*' interface must be set to ianaift:ethernetCsmacd";
            }

            must 'not(re-match(../if:name, "sfp.*")) or . = "ianaift:ethernetCsmacd"' {
                error-message "The if:type of a 'sfp*' interface must be set to ianaift:ethernetCsmacd";
            }
        }
    }

    augment /if:interfaces/if:interface {
        description "Add the option to add this link to a bridge.";

        leaf bridge {
            must '../if:type = "ianaift:ethernetCsmacd"' {
                error-message "Only ethernet interfaces can be enslaved to a bridge.";
            }

            must '/if:interfaces/if:interface[if:name = current()]/if:type = "ianaift:bridge"' {
                error-message "An interface can be only enslaved to a bridge";
            }

            must '(not(../ip:ipv4) or ../ip:ipv4/ip:enabled[.="false"]) and
                  (not(../ip:ipv6) or ../ip:ipv6/ip:enabled[.="false"])' {
                error-message "IP protocols must be disabled for enslaved link.";
            }

            type if:interface-ref;
            mandatory false;
            description "The name of the bridge to add the link to.";
        }
    }

    deviation /if:interfaces {
        deviate add {
            must 'count(if:interface[if:enabled = "true"]) > 0' {
                error-message "At least one interface must be enabled.";
            }
        }
    }

    // Make it hard to accidentally lose connection by removing ipv4/ipv6 presence containers or all IP addresses
    deviation /if:interfaces/if:interface {
        deviate add {
            must 'if:enabled = "false" or
                  ip:ipv4/ip:enabled = "true" or
                  ip:ipv6/ip:enabled = "true" or
                  cla-network:bridge' {
                error-message "Enabled interface must always have at least one protocol active or it must be connected in the bridge.";
            }
        }

        deviate add {
            must 'if:type != "ianaift:bridge" or
                  (if:enabled != "true") or
                  (count(../if:interface[(if:enabled = "true") and (cla-network:bridge = current()/name)]) > 0)' {
                error-message "All enabled bridges must have at least one enabled enslaved interface";
            }
        }
    }

    augment /if:interfaces/if:interface/ip:ipv4 {
        description "Add the IPv4 autoconfiguration option (DHCP client).";

        container dhcp-client {
            presence
              "Enables DHCPv4 client unless the 'enabled' leaf
               (which defaults to 'true') is set to 'false'";
            description
              "Parameters for the DHCPv4 client.";

            leaf enabled {
              type boolean;
              default true;
              description "Enable DHCP client.";
            }

            leaf use-dns {
              type boolean;
              default true;
              description "Use DNS servers provided by DHCP server.";
            }

            leaf use-ntp {
              type boolean;
              default true;
              description "Use NTP servers provided by DHCP server.";
            }
        }
    }

    augment /if:interfaces/if:interface/ip:ipv6/ip:autoconf {
        description "Add the option to accept DNS advertising from router advertisements.";

        leaf accept-dns-advertisements {
            type boolean;
            default true;
            description "Accept DNS server addresses from router advertisements.";
        }
    }

    deviation /if:interfaces/if:interface/ip:ipv4 {
        deviate add {
            must 'ip:enabled = "false" or ../if:enabled = "false" or count(ip:address) > 0 or cla-network:dhcp-client/cla-network:enabled = "true"' {
                error-message "There must always be at least one IPv4 address or the autoconfiguration must be turned on unless the interface or protocol is disabled.";
            }
        }
    }

    deviation /if:interfaces/if:interface/ip:ipv6 {
        deviate add {
            must 'ip:enabled = "false" or ../if:enabled = "false" or count(ip:address) > 0 or ip:autoconf/ip:create-global-addresses = "true"' {
                error-message "There must always be at least one IPv6 address or the autoconfiguration must be turned on unless the interface or protocol is disabled.";
            }
        }
    }

    identity dhcp {
        base rt:routing-protocol;
        description "Identity for route installed by DHCP.";
    }
    identity ra {
        base rt:routing-protocol;
        description "Identity for route installed by router advertisement.";
    }

    // We do not support user defined RIBs (RFC 8349, App. B)
    deviation /rt:routing/rt:ribs {
      deviate add {
        config false;
      }
    }

    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol {
        deviate add {
            must '(./rt:name = "static") and (./rt:type = "rt:static")' {
                error-message "Only one control-plane-protocol named 'static' with type 'ietf-routing:static' is supported.";
            }
        }
    }

    // Special routing options are not supported
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v4ur:ipv4/v4ur:route/v4ur:next-hop/v4ur:next-hop-options/v4ur:special-next-hop {
        deviate not-supported;
    }
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v4ur:ipv4/v4ur:route/v4ur:next-hop/v4ur:next-hop-options/v4ur:next-hop-list {
        deviate not-supported;
    }
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v6ur:ipv6/v6ur:route/v6ur:next-hop/v6ur:next-hop-options/v6ur:special-next-hop {
        deviate not-supported;
    }
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v6ur:ipv6/v6ur:route/v6ur:next-hop/v6ur:next-hop-options/v6ur:next-hop-list {
        deviate not-supported;
    }

    // Our implementation requires that the static routes have both interfaces and next hop address specified.
    // Please note that this model intentionally does not require static routes to be configured when the interface is configured with static IP address.
    // If the interface is configured with static IP address, the routing protocol will automatically add a route to the network of the interface.
    // This is done to avoid confusion and to keep the configuration simple. On the other hand, administrators must be careful not to lock themselves out.
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v4ur:ipv4/v4ur:route/v4ur:next-hop/v4ur:next-hop-options/v4ur:simple-next-hop/v4ur:outgoing-interface {
        deviate add {
            mandatory true;
        }
    }
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v4ur:ipv4/v4ur:route/v4ur:next-hop/v4ur:next-hop-options/v4ur:simple-next-hop/v4ur:next-hop-address {
        deviate add {
            mandatory true;
        }
    }
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v6ur:ipv6/v6ur:route/v6ur:next-hop/v6ur:next-hop-options/v6ur:simple-next-hop/v6ur:outgoing-interface {
        deviate add {
            mandatory true;
        }
    }
    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v6ur:ipv6/v6ur:route/v6ur:next-hop/v6ur:next-hop-options/v6ur:simple-next-hop/v6ur:next-hop-address {
        deviate add {
            mandatory true;
        }
    }

    // Executing active-route is not supported
    deviation /rt:routing/rt:ribs/rt:rib/rt:active-route {
        deviate not-supported;
    }

    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v4ur:ipv4/v4ur:route/v4ur:next-hop/v4ur:next-hop-options/v4ur:simple-next-hop/rib-ext:tag {
        deviate not-supported;
    }

    deviation /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/rt:static-routes/v6ur:ipv6/v6ur:route/v6ur:next-hop/v6ur:next-hop-options/v6ur:simple-next-hop/rib-ext:tag {
        deviate not-supported;
    }

    deviation /rt:routing/rt:ribs/rt:rib/rt:routes/rt:route/rt:next-hop/rt:next-hop-options/rt:simple-next-hop/rib-ext:repair-path {
        deviate not-supported;
    }

    deviation /rt:routing/rt:ribs/rt:rib/rt:routes/rt:route/rt:next-hop/rt:next-hop-options/rt:next-hop-list/rt:next-hop-list/rt:next-hop/rib-ext:repair-path {
        deviate not-supported;
    }
}