cddl 0.1.0 → 0.8.8

data/test-data/grasp-09.cddl

@@ -0,0 +1,108 @@
+  grasp-message = (message .within message-structure) / noop-message
+
+  message-structure = [MESSAGE_TYPE, session-id, ?initiator,
+                       *grasp-option]
+
+  MESSAGE_TYPE = 0..255
+  session-id = 0..4294967295 ;up to 32 bits
+  grasp-option = any
+
+  message /= discovery-message
+  discovery-message = [M_DISCOVERY, session-id, initiator, objective]
+
+  message /= response-message ;response to Discovery
+  response-message = [M_RESPONSE, session-id, initiator, ttl,
+                     (+locator-option // divert-option), ?objective]
+
+  message /= synch-message ;response to Synchronization request
+  synch-message = [M_SYNCH, session-id, objective]
+
+  message /= flood-message
+  flood-message = [M_FLOOD, session-id, initiator, ttl,
+                  +[objective, (locator-option / [])]]
+
+  message /= request-negotiation-message
+  request-negotiation-message = [M_REQ_NEG, session-id, objective]
+
+  message /= request-synchronization-message
+  request-synchronization-message = [M_REQ_SYN, session-id, objective]
+
+  message /= negotiation-message
+  negotiation-message = [M_NEGOTIATE, session-id, objective]
+
+  message /= end-message
+  end-message = [M_END, session-id, accept-option / decline-option ]
+
+  message /= wait-message
+  wait-message = [M_WAIT, session-id, waiting-time]
+
+  message /= invalid-message
+  invalid-message = [M_INVALID, session-id, ?any]
+
+  noop-message = [M_NOOP]
+
+  divert-option = [O_DIVERT, +locator-option]
+
+  accept-option = [O_ACCEPT]
+
+  decline-option = [O_DECLINE, ?reason]
+  reason = text  ;optional error message
+
+  waiting-time = 0..4294967295 ; in milliseconds
+  ttl = 0..4294967295 ; in milliseconds
+
+  locator-option /= [O_IPv4_LOCATOR, ipv4-address,
+                     transport-proto, port-number]
+  ipv4-address = bytes .size 4
+
+  locator-option /= [O_IPv6_LOCATOR, ipv6-address,
+                     transport-proto, port-number]
+  ipv6-address = bytes .size 16
+
+  locator-option /= [O_FQDN_LOCATOR, text, transport-proto, port-number]
+
+  transport-proto = IPPROTO_TCP / IPPROTO_UDP
+  IPPROTO_TCP = 6
+  IPPROTO_UDP = 17
+  port-number = 0..65535
+
+  locator-option /= [O_URI_LOCATOR, text]
+
+  initiator = ipv4-address / ipv6-address
+
+  objective-flags = uint .bits objective-flag
+
+  objective-flag = &(
+    F_DISC: 0    ; valid for discovery
+    F_NEG: 1     ; valid for negotiation
+    F_SYNCH: 2   ; valid for synchronization
+    F_NEG_DRY: 3 ; negotiation is dry-run
+  )
+
+  objective = [objective-name, objective-flags, loop-count, ?any]
+
+  objective-name = text ;see specification for uniqueness rules
+
+  loop-count = 0..255
+
+  ; Constants for message types and option types
+
+  M_NOOP = 0
+  M_DISCOVERY = 1
+  M_RESPONSE = 2
+  M_REQ_NEG = 3
+  M_REQ_SYN = 4
+  M_NEGOTIATE = 5
+  M_END = 6
+  M_WAIT = 7
+  M_SYNCH = 8
+  M_FLOOD = 9
+  M_INVALID = 99
+
+  O_DIVERT = 100
+  O_ACCEPT = 101
+  O_DECLINE = 102
+  O_IPv6_LOCATOR = 103
+  O_IPv4_LOCATOR = 104
+  O_FQDN_LOCATOR = 105
+  O_URI_LOCATOR = 106

data/test-data/grasp-v1.cddl

@@ -0,0 +1,97 @@
+grasp-message = message
+
+session-id = 0..16777215
+; that is still 24 bits; we could pick any size we want
+
+message /= discovery-message
+discovery-message = [M_DISCOVERY, session-id, objective]
+
+message /= response-message
+response-message = [M_RESPONSE, session-id, *locator-option / divert-option / objective]
+
+message /= request-message
+request-message = [M_REQUEST, session-id, objective]
+
+message /= negotiation-message
+negotiation-message = [M_NEGOTIATE, session-id, objective]
+
+message /= end-message
+end-message = [M_END, session-id, accept-option / decline option]
+
+message /= wait-message
+wait-message = [M_WAIT, session-id, waiting-time-option]
+
+
+M_DISCOVERY =  1
+M_RESPONSE = 2
+M_REQUEST = 3
+M_NEGOTIATE = 4
+M_END = 5
+M_WAIT = 6
+
+option /= divert-option
+divert-option = [OPTION_DIVERT, *locator-option]
+OPTION_DIVERT = 372             ; use section numbers for now
+
+option /= accept-option
+accept-option = [OPTION_ACCEPT]
+OPTION_ACCEPT = 373
+
+option /= decline-option
+decline-option = [OPTION_DECLINE]
+OPTION_DECLINE = 374
+
+option /= waiting-time-option
+waiting-time-option = [OPTION_WAITING, option-waiting-time]
+OPTION_WAITING = 375
+option-waiting-time = 0..4294967295 ; in milliseconds
+
+option /= option-device-id
+option-device-id = [OPTION_DEVICE_ID, bytes]
+OPTION_DEVICE_ID = 376
+
+locator-option /= ipv4-locator-option
+ipv4-locator-option = bytes .size 4
+; this is simpler than [OPTION_IPv4_LOCATOR, bytes .size 4] -- do we want regularity or simplicity?
+
+locator-option /= ipv6-locator-option
+ipv6-locator-option = bytes .size 16
+
+locator-option /= fqdn-locator-option
+OPTION_FQDN_LOCATOR = 3773
+fqdn-locator-option = [OPTION_FQDN_LOCATOR, text]
+
+locator-option /= url-locator-option
+OPTION_URL_LOCATOR = 3774
+url-locator-option = [OPTION_URL_LOCATOR, text]
+
+objective-flags = uint .bits objective-flag
+
+objective-flag = &(
+D: 0
+N: 1
+S: 2
+)
+
+; D means valid for discovery only
+; N means valid for discovery and negotiation
+; S means valid for discovery and synchronization
+
+option /= objective
+
+objective /= generic-obj
+generic-obj = [objective-name, objective-flags, loop-count, any]
+
+objective /= vendor-obj
+vendor-obj = [{"PEN":pen}, objective-name, objective-flags, loop-count, any]
+
+; Objectives have names rather than numbers here. But the names need
+; to be unique. Registry needed, it seems.
+
+; A PEN is used to distinguish vendor-specific options. Or we could
+; decide to use a domain name. Anything unique will do.
+
+pen = 0..4294967295
+objective-name = tstr
+loop-count = 0..255
+

data/test-data/grasp-v2X.cddl

@@ -0,0 +1,89 @@
+grasp-message = message
+
+session-id = 0..16777215
+; that is up to 24 bits
+
+message /= discovery-message
+discovery-message = [M_DISCOVERY, session-id, objective]
+
+message /= response-message
+response-message = [M_RESPONSE, session-id, +locator-option / divert-option / objective] 
+; must split to satisfy CDDL tool
+
+message /= request-message
+request-message = [M_REQUEST, session-id, objective]
+
+message /= negotiation-message
+negotiation-message = [M_NEGOTIATE, session-id, objective]
+
+message /= end-message
+end-message = [M_END, session-id, (accept-option / decline-option)]
+
+message /= wait-message
+wait-message = [M_WAIT, session-id, waiting-time-option]
+
+divert-option = [O_DIVERT, +locator-option]
+
+accept-option = [O_ACCEPT]
+
+decline-option = [O_DECLINE]
+
+waiting-time-option = [O_WAITING, option-waiting-time]
+option-waiting-time = 0..4294967295 ; in milliseconds
+
+option-device-id = [O_DEVICE_ID, bytes]
+
+locator-option /= ipv4-locator-option
+ipv4-locator-option = bytes .size 4
+; this is simpler than [O_IPv4_LOCATOR, bytes .size 4]
+
+locator-option /= ipv6-locator-option
+ipv6-locator-option = bytes .size 16
+
+locator-option /= fqdn-locator-option
+fqdn-locator-option = [O_FQDN_LOCATOR, text]
+
+locator-option /= url-locator-option
+url-locator-option = [O_URL_LOCATOR, text]
+
+objective-flags = uint .bits objective-flag
+
+objective-flag = &(
+D: 0
+N: 1
+S: 2
+)
+
+; D means valid for discovery only
+; N means valid for discovery and negotiation
+; S means valid for discovery and synchronization
+
+objective /= generic-obj
+generic-obj = [objective-name, objective-flags, loop-count, ?any]
+
+objective /= vendor-obj
+vendor-obj = [{"PEN":pen}, objective-name, objective-flags, 
+              loop-count, ?any]
+
+; A PEN is used to distinguish vendor-specific options.
+
+pen = 0..4294967295
+objective-name = tstr
+loop-count = 0..255
+
+; Constants
+
+M_DISCOVERY = 1
+M_RESPONSE = 2
+M_REQUEST = 3
+M_NEGOTIATE = 4
+M_END = 5
+M_WAIT = 6
+
+O_DIVERT = 100
+O_ACCEPT = 101
+O_DECLINE = 102
+O_WAITING = 103
+O_DEVICE_ID = 104
+O_FQDN_LOCATOR = 105
+O_URL_LOCATOR = 106

data/test-data/ifmap-base-2.0v17.cddl

@@ -0,0 +1,392 @@
+messages = request / response
+
+request = new-session-request / end-session / renew-session / publish-request / search-request / subscribe-request / poll-request
+        / purge-publisher-request
+
+; response = subscribe-received / publish-received / purge-publisher-received / results
+
+;results = error-result / poll-result / search-result / new-session-result / end-session-result
+
+message<namespace,name,attributes,content> = [
+  namespace: namespace,
+  name: name,
+  attributes: attributes,
+  content: content
+]
+
+error-code = "AccessDenied" / "Failure" / "InvalidIdentifier" / "InvalidIdentifierType" /
+             "IdentifierTooLong" / "InvalidMetadata" / "InvalidSchemaVersion" / "InvalidSessionID" /
+             "MetadataTooLong" / "SearchResultsTooBig" / "PollResultsTooBig" / "SystemError"
+
+error-result =
+  message<"ifmap", "error-result",
+  [ ],
+  [ ? "name", ? tstr,
+    "error-code", error-code,
+    "error-string", tstr
+  ]>
+
+poll-result = ["", "poll-result", [], [ *(search-result / error-result)]]
+
+response-choice = error-result / poll-result / search-result / subscribe-received /
+                  publish-received / purge-publisher-received / new-session-result /
+                  renew-session-result / end-session-result 
+
+response = 
+  message<"ifmap", "response",
+    [ ? validation-attributes ],
+    [ response-choice ]>
+
+purge-publisher-received =
+  ["", "purge-publisher-received", [], []]
+
+purge-publisher-request =
+  message<"ifmap", "purge-publisher",
+    [ "ifmap-publisher-id", tstr,
+      session-attributes
+    ],
+    []>
+
+; needs to be constructed according to IF-MAP Filter syntax
+filter-type = tstr
+
+poll-request =
+  message<"ifmap", "poll",
+    [ session-attributes,
+      validation-attributes
+    ],
+    []>
+
+subscribe-received =
+  ["", "subscribe-received", [], []]
+
+subscribe-request =
+  message<"ifmap", "subscribe",
+    [ session-attributes,
+      validation-attributes
+    ],
+    [ 1*(subscribe-update / subscribe-delete)
+    ]>
+
+subscribe-delete =
+  message<"", "delete",
+    [ "name", tstr,
+    ],
+    []>
+
+subscribe-update =
+  message<"", "update",
+    [ "match-links", filter-type,
+      "max-depth", uint,
+      "terminal-identifier-type", tstr,
+      "max-size", uint,
+      "result-filter", filter-type,
+      "name", tstr,
+    ],
+    [ access-request / identity / ip-address / mac-address / device
+    ]>
+search-request =
+  message<"ifmap", "search",
+    [ session-attributes,
+      validation-attributes,
+      "match-links", filter-type,
+      "max-depth", uint,
+      "terminal-identifier-type", tstr,
+      "max-size", uint,
+      "result-filter", filter-type
+    ],
+    [ access-request / identity / ip-address / mac-address / device
+    ]>
+
+search-result =
+  ["", "search-result",
+    ["name", tstr],
+    [ *result-item]]
+
+result-item =
+  message<"", "result-item",
+    [],
+    [ 1*2(access-request / identity / ip-address / mac-address / device),
+      "metadata", metadata-list-type
+    ]>
+
+publish-request =
+  message<"ifmap", "publish",
+    [ session-attributes, validation-attributes ],
+    [+ (update-request / notify-request / delete-request) ]>
+
+update-request = message<"", "update", [ ? lifetime-attributes], [ 1*2 identifier, metadata-list-type ]>
+notify-request = message<"", "notify", [ ? lifetime-attributes], [ 1*2 identifier ]>
+delete-request = message<"", "delete", [ "filter", tstr], []>
+
+publish-received =
+  ["", "publish-received", [], []]
+
+renew-session = message<"ifmap", "renew-session", [ ? session-attributes ], []>
+renew-session-result = ["", "renew-session-result", [], []]
+
+end-session = message<"ifmap", "end-session", [], []>
+end-session-result =
+  ["", "end-session-result", [], []]
+
+new-session-request =
+  message<"ifmap", "new-session",
+    [ "max-poll-result-size", uint],
+    []>
+
+new-session-result =
+  ["", "new-session-result",
+    [ session-attributes,
+      "ifmap-publisher-id", tstr,
+      "max-poll-result-size", uint,
+    ],
+    []]
+
+identifier = access-request / device / identity / ip-address / mac-address
+
+session-attributes = (
+  "session-id", tstr
+)
+
+validation-attributes = (
+  "validation", ("None" / "BaseOnly" / "MetadataOnly" / "All")
+)
+
+adm-dom = (
+  "administrative-domain", tstr,
+)
+
+lifetime-attributes = (
+  "lifetime", ("session" / "forever")
+)
+
+access-request =
+  message<"ifmap", "access-request",
+    [ ? adm-dom,
+     "name", tstr
+    ],
+    []>
+
+device = message<"ifmap", "device", [], [device-type]>
+device-type =
+  message<"ifmap","aik-name", [], tstr> /
+  message<"ifmap","name", [], tstr>
+
+identity = message<"ifmap", "identity",
+    [ ? adm-dom,
+     "name", tstr,
+     "type", ("aik-name" / "distinguished-name" / "dns-name" / "email-address" /
+                "hip-hit" / "kerberos-principal" / "trusted-platform-module" /
+                "username" / "other"),
+     "other-type-definition", tstr
+    ],
+    []>
+
+ip-address = message<"ifmap", "ip-address",
+    [ ? adm-dom,
+      "value", tstr,
+      "type", ("IPv4" / "IPv6")
+    ],
+    []>
+
+mac-address = message<"ifmap", "mac-address",
+    [ ? adm-dom,
+      "value", tstr,
+    ],
+    []>
+
+metadata-attributes = (
+    "ifmap-publisher-id", tstr,
+    "ifmap-timestamp", tdate,
+    "ifmap-timestamp-fraction", tstr
+    )
+
+; optional metadata attributes? not yet possible
+single-value-metadata-attributes = (
+    ? metadata-attributes,
+    "ifmap-cardinality", "singleValue"
+    )
+
+multi-value-metadata-attributes = (
+    ? metadata-attributes,
+    "ifmap-cardinality", "multiValue"
+    )
+
+access-request-device = message<"meta", "access-request-device",
+    [ single-value-metadata-attributes ], []>
+
+access-request-ip = message<"meta", "access-request-ip",
+    [ single-value-metadata-attributes ], []>
+
+access-request-mac = message<"meta", "access-request-mac",
+    [ single-value-metadata-attributes ], []>
+
+authenticated-as = message<"meta", "authenticated-as",
+    [ single-value-metadata-attributes ], []>
+
+authenticated-by = message<"meta", "authenticated-by",
+    [ single-value-metadata-attributes ], []>
+
+capability = message<"meta", "capability",
+    [ multi-value-metadata-attributes ],
+    [ ? adm-dom,
+      "name", tstr
+    ]>
+
+device-attribute = message<"meta", "device-attribute",
+    [ multi-value-metadata-attributes ], 
+    [ "name", tstr
+    ]>
+
+manufacturer = message<"", "manufacturer", [], tstr>
+model = message<"", "model", [], tstr>
+os = message<"", "os", [], tstr>
+os-version = message<"", "os-version", [], tstr>
+type = message<"", "type", [],
+     ("p2p" / "cve" / "botnet infection" / "worm infection" / "excessive flows" /
+      "behavioral change" / "policy violation" / "other")>
+discovered-time = message<"", "discovered-time", [], tdate>
+discoverer-id = message<"", "discoverer-id", [], tstr>
+discovery-method = message<"", "discovery-method", [], tstr>
+name = message<"", "name", [], tstr>
+magnitude = message<"", "magnitude", [], 0..100>
+confidence = message<"", "confidence", [], 0..100>
+significance = message<"", "significance", [], ("critical" / "important" / "informational")>
+information = message<"", "information", [], tstr>
+vulnerability-uri = message<"", "vulnerability-uri", [], uri>
+enforcement-action = message<"", "enforcement-action", [], tstr>
+other-type-definition = message<"", "other-type-definition", [], tstr>
+enforcement-reason = message<"", "enforcement-reason", [], tstr>
+start-time = message<"", "start-time", [], tdate>
+end-time = message<"", "end-time", [], tdate>
+dhcp-server = message<"", "dhcp-server", [], tstr>
+vlan = message<"", "vlan", [], uint>
+vlan-name = message<"", "vlan-name", [], uint>
+port = message<"", "port", [], uint>
+location-information = message<"", "location-information",
+    [ "type", tstr,
+      "value", tstr], []>
+qualifier = message<"", "qualifier", [], tstr>
+
+device-characteristic = message<"meta", "device-characteristic",
+    [ multi-value-metadata-attributes ],
+    [ ? manufacturer,
+      ? model,
+      ? os,
+      ? os-version,
+      * type,
+      discovered-time,
+      discoverer-id,
+      + discovery-method
+    ]>
+
+device-ip = message<"meta", "device-ip",
+    [ single-value-metadata-attributes ], [ device, ip-address]>
+
+discovered-by = message<"meta", "discovered-by",
+    [ single-value-metadata-attributes ], []>
+
+enforcement-report = message<"meta", "enforcement-report",
+    [ multi-value-metadata-attributes ],
+    [ enforcement-action,
+      other-type-definition,
+      enforcement-reason
+    ]>
+
+event = message<"meta", "event",
+    [ multi-value-metadata-attributes ],
+    [ name,
+      discovered-time,
+      discoverer-id,
+      magnitude,
+      confidence,
+      significance,
+      ? type,
+      ? other-type-definition,
+      ? information,
+      ? vulnerability-uri
+    ]>
+
+ip-mac = message<"meta", "ip-mac",
+    [ multi-value-metadata-attributes ],
+    [ ? start-time,
+      ? end-time,
+      ? dhcp-server
+    ]>
+
+layer2-information = message<"meta", "layer2-information",
+    [ multi-value-metadata-attributes ],
+    [ ? vlan,
+      ? vlan-name,
+      ? port,
+      ? adm-dom
+    ]>
+
+location = message<"meta", "location",
+    [ multi-value-metadata-attributes ],
+    [ discovered-time,
+      discoverer-id,
+      + location-information
+    ]>
+
+request-for-investigation = message<"meta", "request-for-investigation",
+    [ multi-value-metadata-attributes ],
+    [ ? qualifier ]>
+
+role = message<"meta", "role",
+    [ multi-value-metadata-attributes ],
+    [ ? adm-dom,
+      name
+    ]>
+
+unexpected-behavior = message<"meta", "unexpected-behavior",
+    [ multi-value-metadata-attributes ],
+    [ discovered-time,
+      discoverer-id,
+      ? information,
+      magnitude,
+      ? confidence,
+      significance,
+      ? type
+    ]>
+
+wlan-security-type = "open" / "wep" / "tkip" / "ccmp" / "bip" / "other"
+
+ssid = message<"", "ssid", [], tstr>
+ssid-unicast-security = message<"", "ssid-unicast-security",
+    [ ? other-type-definition ],
+    [ wlan-security-type ]>
+ssid-group-security = message<"", "ssid-group-security",
+    [ ? other-type-definition ],
+    [ wlan-security-type ]>
+ssid-management-security = message<"", "ssid-management-security",
+    [ ? other-type-definition ],
+    [ wlan-security-type ]>
+
+wlan-information = message<"meta", "wlan-information",
+    [ single-value-metadata-attributes ],
+    [ ? ssid,
+      + ssid-unicast-security,
+      ssid-group-security,
+      + ssid-management-security
+    ]>
+
+client-time = message<"opmeta", "client-time",
+    [ single-value-metadata-attributes,
+      "current-time", tdate
+    ], []>
+
+; list every capability explicitly?
+server-capability = message<"opmeta", "server-capability",
+    [ single-value-metadata-attributes,
+    ],
+    [ message<"", "capability", [], tstr>,
+    ]>
+
+metadata-list-type = [
+  *(access-request-device / access-request-ip / access-request-mac /
+    authenticated-as / authenticated-by / capability / device-attribute /
+    device-characteristic / device-ip / discovered-by / enforcement-report /
+    event / ip-mac / layer2-information / location / request-for-investigation /
+    role / unexpected-behavior / wlan-information
+    )]