Keychain
This section describes the configuration model of a keychain and provides examples of XML packets.
Data Model
The data model file matching a keychain is huawei-keychain.yang.
Object |
Description |
Value |
Remarks |
|---|---|---|---|
/huawei-keychain:keychain/keychain-list/name |
Specifies the name of a keychain. Applications reference keychains by keychain name. |
The value is a string of 1 to 47 case-insensitive characters, excluding question marks (?) and spaces. If spaces are used, the string must start and end with double quotation marks ("). |
N/A |
/huawei-keychain:keychain/keychain-list/mode/absolute/absolute |
Specifies that a keychain is valid within an absolute time range. |
The value is of the Boolean type:
The default value is false. |
N/A |
/huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode |
Specifies that a keychain is valid periodically. |
The value is of the enumerated type:
|
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/absolute/absolute object is set to false or left empty. |
/huawei-keychain:keychain/keychain-list/accept-tolerance/infinite/infinite |
Indicates that the acceptance tolerance is infinite. That is, the accept key never expires. |
- |
N/A |
/huawei-keychain:keychain/keychain-list/accept-tolerance/duration/duration |
Indicates the acceptance tolerance range. |
The value is an integer ranging from 1 to 14400, in minutes. |
N/A |
/huawei-keychain:keychain/keychain-list/tcp-kind |
Specifies the TCP kind value to be used for a keychain. |
The value is an integer ranging from 28 to 255. |
N/A |
/huawei-keychain:keychain/keychain-list/tcp-algorithm-id/algorithm/hmac-md5-id |
Specifies the ID of the HMAC-MD5 authentication algorithm. |
The value is an integer ranging from 1 to 63. The default value is 5. |
N/A |
/huawei-keychain:keychain/keychain-list/tcp-algorithm-id/algorithm/hmac-sha-256-id |
Specifies the ID of the HMAC-SHA-256 authentication algorithm. |
The value is an integer ranging from 1 to 63. The default value is 7. |
N/A |
/huawei-keychain:keychain/keychain-list/tcp-algorithm-id/algorithm/hmac-sha1-12-id |
Specifies the ID of the HMAC-SHA1-12 authentication algorithm. |
The value is an integer ranging from 1 to 63. The default value is 2. |
N/A |
/huawei-keychain:keychain/keychain-list/tcp-algorithm-id/algorithm/hmac-sha1-20-id |
Specifies the ID of the HMAC-SHA1-20 authentication algorithm. |
The value is an integer ranging from 1 to 63. The default value is 6. |
N/A |
/huawei-keychain:keychain/keychain-list/tcp-algorithm-id/algorithm/md5-id |
Specifies the ID of the MD5 authentication algorithm. |
The value is an integer ranging from 1 to 63. The default value is 3. |
N/A |
/huawei-keychain:keychain/keychain-list/tcp-algorithm-id/algorithm/sha-1-id |
Specifies the ID of the SHA1 authentication algorithm. |
The value is an integer ranging from 1 to 63. The default value is 4. |
This object can be delivered only after the WEAKEA plug-in is installed. You can search for Plug-in Usage Guide at the Huawei technical support website (Enterprise Network or Carrier), and choose the desired plug-in usage guide based on the switch model and software version. If you do not have permission to access the website, contact technical support personnel. |
/huawei-keychain:keychain/keychain-list/tcp-algorithm-id/algorithm/sha-256-id |
Specifies the ID of the SHA-256 authentication algorithm. |
The value is an integer ranging from 1 to 63. The default value is 8. |
N/A |
/huawei-keychain:keychain/keychain-list/keychain-entries/key-id |
Specifies the key ID to be created or an existing key ID. |
The value is an integer ranging from 0 to 63. |
N/A |
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/timesnamp-type/start-date-time |
Specifies the start send date and time for a keychain key. |
The value is in YYYY-MM-DDTHH:MM:SSZ format. YYYY-MM-DD indicates the year, month, and day. The value ranges from 1970-01-01 to 2050-12-31. HH:MM:SS indicates the hour, minute, and second. The second value does not take effect. The value ranges from 00:00 to 23:59. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/absolute/absolute object is set to true. |
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/timesnamp-type/duration-value |
Specifies the lifetime of the send key in a keychain. |
The value is an integer ranging from 1 to 26280000, in minutes. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/timesnamp-type/infinite |
Specifies that the send key in a keychain never expires from the configured start time. |
- |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/timesnamp-type/end-date-time |
Specifies the end send date and time for a keychain key. |
The value is in YYYY-MM-DDTHH:MM:SSZ format. YYYY-MM-DD indicates the year, month, and day. The value ranges from 1970-01-01 to 2050-12-31. HH:MM:SS indicates the hour, minute, and second. The second value does not take effect. The value ranges from 00:00 to 23:59. The end date and time must be later than the start date and time. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/daily-type/start-hhmm |
Specifies the daily start send time for a keychain key. |
The value is in HH:MM format. The value ranges from 00:00 to 23:59. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to daily. |
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/daily-type/end-hhmm |
Specifies the daily end send time for a keychain key. |
The value is in HH:MM format. The value ranges from 00:00 to 23:59. The end time must be later than the start time. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to daily. |
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/day-type/start-day /huawei-keychain:keychain/keychain-list/keychain-entries/send-time/day-type/end-day |
|
The options are as follows:
The end day must be later than the start day. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/day-type/day-list |
Specifies the weekly send day(s) for a keychain key. |
The options are as follows:
One or more days can be configured. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to weekly. |
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/date-type/start-date |
Specifies the monthly start send date for a keychain key. |
The value ranges from 1 to 31. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/date-type/end-date |
Specifies the monthly end send date for a keychain key. |
The value ranges from 2 to 31. The end date must be later than the start date. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/date-type/date-list |
Specifies the monthly send date(s) for a keychain key. |
The value ranges from 1 to 31. One or more dates can be configured. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to monthly. |
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/month-type/start-month /huawei-keychain:keychain/keychain-list/keychain-entries/send-time/month-type/end-month |
|
The options are as follows:
The end month must be later than the start month. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/month-type/month-list |
Specifies the yearly send month(s) for a keychain key. |
The options are as follows:
One or more months can be configured. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to yearly. |
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/timesnamp-type/start-date-time |
Specifies the start receive date and time for a keychain key. |
The value is in YYYY-MM-DDTHH:MM:SSZ format. YYYY-MM-DD indicates the year, month, and day. The value ranges from 1970-01-01 to 2050-12-31. HH:MM:SS indicates the hour, minute, and second. The second value does not take effect. The value ranges from 00:00 to 23:59. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/absolute/absolute object is set to true. |
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/timesnamp-type/duration-value |
Specifies the lifetime of the accept key in a keychain. |
The value ranges from 1 to 26280000. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/timesnamp-type/infinite |
Specifies that the accept key in a keychain never expires from the configured start time. |
- |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/timesnamp-type/end-date-time |
Specifies the end receive date and time for a keychain key. |
The value is in YYYY-MM-DDTHH:MM:SSZ format. YYYY-MM-DD indicates the year, month, and day. The value ranges from 1970-01-01 to 2050-12-31. HH:MM:SS indicates the hour, minute, and second. The second value does not take effect. The value ranges from 00:00 to 23:59. The end date and time must be later than the start date and time. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/daily-type/start-hhmm |
Specifies the start receive time for a keychain key. |
The value is in HH:MM format. The value ranges from 00:00 to 23:59. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to daily. |
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/daily-type/end-hhmm |
Specifies the end receive time for a keychain key. |
The value is in HH:MM format. The value ranges from 00:00 to 23:59. The end time must be later than the start time. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to daily. |
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/day-type/start-day /huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/day-type/end-day |
|
The options are as follows:
The end day must be later than the start day. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/day-type/day-list |
Specifies the weekly receive day(s) for a keychain key. |
The options are as follows:
One or more days can be configured. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to weekly. |
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/date-type/start-date |
Specifies the monthly start receive date for a keychain key. |
The value ranges from 1 to 31. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/date-type/end-date |
Specifies the monthly end receive date for a keychain key. |
The value ranges from 2 to 31. The end date must be later than the start date. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/date-type/date-list |
Specifies the monthly receive date(s) for a keychain key. |
The value ranges from 1 to 31. One or more dates can be configured. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to monthly. |
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/month-type/start-month /huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/month-type/end-month |
|
The options are as follows:
The end month must be later than the start month. |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/month-type/month-list |
Specifies the yearly receive month(s) for a keychain key. |
The options are as follows:
One or more months can be configured. |
This object can be configured only when the /huawei-keychain:keychain/keychain-list/mode/period-mode/period-mode object is set to yearly. |
/huawei-keychain:keychain/keychain-list/keychain-entries/algorithm |
Specifies the authentication algorithm of a key. You can configure the authentication algorithm through the sub-objects of this object.
|
- |
The SHA-1 authentication algorithm can be specified only after the WEAKEA plug-in is installed. You can search for Plug-in Usage Guide at the Huawei technical support website (Enterprise Network or Carrier), and choose the desired plug-in usage guide based on the switch model and software version. If you do not have permission to access the website, contact technical support personnel. |
/huawei-keychain:keychain/keychain-list/keychain-entries/cipher-text |
Specifies the ciphertext key string for keychain authentication. |
The value is a string of case-sensitive characters, including letters and digits. The value can be entered in clear-text or ciphertext but displayed in ciphertext. A clear-text key string can contain 1 to 255 characters, whereas a ciphertext key string can contain 20 to 392 characters. If spaces are used, the key string must start and end with double quotation marks ("). Only one pair of double quotation marks can be used in each key string. |
N/A |
/huawei-keychain:keychain/keychain-list/keychain-entries/plain-text |
Specifies the clear-text key string for keychain authentication. |
The value is a string of 1 to 255 case-sensitive characters, excluding spaces. If spaces are used, the key string must start and end with double quotation marks ("). Only one pair of double quotation marks can be used in each key string. |
N/A |
Configuring a Keychain
This section provides samples of configuring and deleting a keychain using the edit-config method.
Operation |
XPATH |
|---|---|
edit-config |
/huawei-keychain:keychain/keychain-list/name |
/huawei-keychain:keychain/keychain-list/mode/absolute/absolute |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/key-id |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/timesnamp-type/start-date-time |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/send-time/timesnamp-type/end-date-time |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/timesnamp-type/start-date-time |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/receive-time/timesnamp-type/duration-value |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/algorithm/hmac-md5 |
|
/huawei-keychain:keychain/keychain-list/keychain-entries/cipher-text |
Data Requirement
Item |
Data |
Description |
|---|---|---|
Name of a keychain |
abs |
- |
Whether a keychain is valid within an absolution time range |
true |
- |
Key ID to be created |
0 |
- |
Start send date and time for a keychain key |
2020-02-07T13:13:13Z |
Set the start send date and time for a keychain key to 13:13 on February 7, 2020. |
End send date and time for a keychain key |
2020-02-08T13:13:13Z |
Set the end send date and time for a keychain key to 13:13 on February 8, 2020. |
Start receive date and time for a keychain key |
2020-02-07T13:13:13Z |
Set the start receive date and time for a keychain key to 13:13 on February 7, 2020. |
Lifetime of the accept key in a keychain |
2 |
- |
HMAC-MD5 as the key authentication algorithm. |
- |
- |
Ciphertext key string for keychain authentication |
Example@123 |
- |
Request Example
<?xml version="1.0" encoding="utf-8"?>
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="2">
<edit-config>
<target>
<running/>
</target>
<config>
<hw-keychain:keychain xmlns:hw-keychain="urn:huawei:params:xml:ns:yang:huawei-keychain">
<hw-keychain:keychain-list>
<hw-keychain:name>abs</hw-keychain:name>
<hw-keychain:absolute>true</hw-keychain:absolute>
<hw-keychain:keychain-entries>
<hw-keychain:key-id>0</hw-keychain:key-id>
<hw-keychain:send-time>
<hw-keychain:timesnamp-type>
<hw-keychain:start-date-time>2020-02-07T13:13:13Z</hw-keychain:start-date-time>
<hw-keychain:end-date-time>2020-02-08T13:13:13Z</hw-keychain:end-date-time>
</hw-keychain:timesnamp-type>
</hw-keychain:send-time>
<hw-keychain:receive-time>
<hw-keychain:timesnamp-type>
<hw-keychain:start-date-time>2020-02-07T13:13:13Z</hw-keychain:start-date-time>
<hw-keychain:duration-value>2</hw-keychain:duration-value>
</hw-keychain:timesnamp-type>
</hw-keychain:receive-time>
<hw-keychain:algorithm>
<hw-keychain:hmac-md5/>
</hw-keychain:algorithm>
<hw-keychain:cipher-text>Example@123</hw-keychain:cipher-text>
</hw-keychain:keychain-entries>
</hw-keychain:keychain-list>
</hw-keychain:keychain>
</config>
</edit-config>
</rpc>
Deletion Example
<?xml version="1.0" encoding="utf-8"?>
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="2">
<edit-config>
<target>
<running/>
</target>
<config>
<hw-keychain:keychain xmlns:hw-keychain="urn:huawei:params:xml:ns:yang:huawei-keychain">
<hw-keychain:keychain-list nc:operation="remove" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0">
<hw-keychain:name>abs</hw-keychain:name>
<hw-keychain:absolute>true</hw-keychain:absolute>
<hw-keychain:keychain-entries>
<hw-keychain:key-id>0</hw-keychain:key-id>
<hw-keychain:send-time>
<hw-keychain:timesnamp-type>
<hw-keychain:start-date-time>2020-02-07T13:13:13Z</hw-keychain:start-date-time>
<hw-keychain:end-date-time>2020-02-08T13:13:13Z</hw-keychain:end-date-time>
</hw-keychain:timesnamp-type>
</hw-keychain:send-time>
<hw-keychain:receive-time>
<hw-keychain:timesnamp-type>
<hw-keychain:start-date-time>2020-02-07T13:13:13Z</hw-keychain:start-date-time>
<hw-keychain:duration-value>2</hw-keychain:duration-value>
</hw-keychain:timesnamp-type>
</hw-keychain:receive-time>
<hw-keychain:algorithm>
<hw-keychain:hmac-md5/>
</hw-keychain:algorithm>
<hw-keychain:cipher-text>Example@123</hw-keychain:cipher-text>
</hw-keychain:keychain-entries>
</hw-keychain:keychain-list>
</hw-keychain:keychain>
</config>
</edit-config>
</rpc>
Response Example
# Sample of successful response
<?xml version='1.0' encoding='UTF-8'?> <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="2"> <ok/> </rpc-reply>
# Sample of failed response
<?xml version="1.0" encoding="utf-8"?>
<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="2">
<rpc-error>
<error-app-tag>-1</error-app-tag>
<error-message>The receive-time start-date-time format is illegal.</error-message>
<error-info>Error on node /huawei-keychain:keychain/keychain-list[name="abs"]/keychain-entries[key-id="0"]/receive-time</error-info>
</rpc-error>
</rpc-reply>