TR069協(xié)議簡(jiǎn)要介紹

1、tr069協(xié)議向?qū)?1. 為什么需要tr069 隨著voip、iptv等越來(lái)越多ip終端設(shè)備的普及（尤其在家庭中的普及），大量設(shè)備的配置和維護(hù)變得越來(lái)越困難，大大提高了網(wǎng)絡(luò)產(chǎn)品運(yùn)營(yíng)商的成本，傳統(tǒng)的基于snmp的網(wǎng)管系統(tǒng)面對(duì)眾多的終端設(shè)備時(shí)顯得力不從心，限制了寬帶接入市場(chǎng)的發(fā)展速度和規(guī)模。tr069定義了一套全新的網(wǎng)管體系結(jié)構(gòu)，包括“管理模型”，“交互接口”，“管理參數(shù)”，在很大程度上減少了網(wǎng)絡(luò)產(chǎn)品的運(yùn)為成本。2. 什么是tr069協(xié)議 tr069是數(shù)字用戶線（dsl）論壇（已改名為broadband forum）制定的一個(gè)面向終端設(shè)備的網(wǎng)管協(xié)議，稱為“用戶終端設(shè)備廣域網(wǎng)管理協(xié)議（cwmp）”，

2、dsl論壇的文檔編號(hào)為tr069。3. tr069協(xié)議發(fā)展現(xiàn)狀 自2004年5月dsl論壇推出該協(xié)議以來(lái)，各大運(yùn)營(yíng)商紛紛部署基于tr069的終端設(shè)備。但從協(xié)議的發(fā)展情況看，tr069仍然處于不斷完善的過(guò)程中。 4. tr069協(xié)議網(wǎng)絡(luò)架構(gòu) acs為自動(dòng)配置服務(wù)器，負(fù)責(zé)對(duì)終端設(shè)備cpe進(jìn)行管理。acs與cpe間的接口為南向接口，acs與管理系統(tǒng)間的接口為北向接口。tr069協(xié)議主要定義了南向接口。5. tr069的實(shí)現(xiàn)（協(xié)議棧）1) tr069協(xié)議基于tcp/ip；2) 標(biāo)準(zhǔn)的internet傳輸安全協(xié)議，ssl3.0 or tls1.0 ，使用ssl/tls并不強(qiáng)制要求，確保cpe和acs之間

3、基于證書(shū)的鑒權(quán)3) acs與cpe間的消息傳輸使用http1.14) 消息的具體內(nèi)容使用soap包進(jìn)行封裝，soap包是一個(gè)包含soap head（soap頭）和 soap body （soap體）組成的xml文檔 5) acs與cpe之間通過(guò)tr069協(xié)議特有的rpc方法進(jìn)行互操作。acs遠(yuǎn)程調(diào)用cpe上的rpc函數(shù)，用來(lái)對(duì)cpe進(jìn)行管理如：設(shè)置cpe參數(shù)、獲取cpe參數(shù)、硬件升級(jí)、重啟設(shè)備等；因此需要向cpe傳輸要調(diào)用的函數(shù)名及參數(shù)，這些內(nèi)容包含在soap體中。acs并不直接對(duì)設(shè)備本身的接口進(jìn)行調(diào)用 ，acs所調(diào)用的函數(shù)為tr069的標(biāo)準(zhǔn)函數(shù)（稱作tr-069 rpc methods），c

4、pe需要通過(guò)一個(gè)設(shè)備上的中間層解析出rpc方法，再由這個(gè)中間層調(diào)用設(shè)備自身的接口，這個(gè)中間層就是tr069 agent。cpe調(diào)用acs的方法，用來(lái)向acs上報(bào)狀態(tài)信息，請(qǐng)求硬件鏡像文件下載（用來(lái)升級(jí)硬件）等等。tr069協(xié)議的rpc函數(shù)（或稱rpc方法），如下表： 6. cpe函數(shù)參數(shù)（tr069協(xié)議的數(shù)據(jù)模型） 網(wǎng)絡(luò)架構(gòu)上包含兩種設(shè)備類型，因此包含兩套數(shù)據(jù)模型：i. tr-106: data model template for tr-069-enabled devices, 13ii. tr-098: internet gateway device data model for tr-0

5、69, 24 iii. tr-104: provisioning parameters for voip cpe, 25each parameter consists of a name-value pair. the name identifies the particular parameter, and has ahierarchical structure similar to files in a directory, with each level separated by a “.” (dot). the value of a parameter may be one of se

6、veral defined data types (see 13). 參數(shù)名 ：使用由類似樹(shù)型的點(diǎn)分層關(guān)系組織起來(lái)。樹(shù)干為需要配置的對(duì)象，樹(shù)葉為具體的配置參數(shù)，所有配置參數(shù)都具有是否可讀寫(xiě)屬性。 如：internetgatewaydevice.ippingdiagnostics.interface參數(shù)類型：基于soap的數(shù)據(jù)類型參數(shù)有只讀、只寫(xiě)兩種狀態(tài)。且可擴(kuò)展tr069協(xié)議就是一個(gè)基于tcp/ip,通過(guò)http或者h(yuǎn)ttps發(fā)送soap消息來(lái)遠(yuǎn)程調(diào)用cpe或者acs rpc方法,從而可以達(dá)到獲取配置和業(yè)務(wù)信息，監(jiān)控狀態(tài)，故障診斷等目的的一種協(xié)議。7. 詳解tr069規(guī)則：cpe和acs都可以

7、發(fā)起會(huì)話，acs發(fā)起的會(huì)話是異步的。a. 建立連接cpe發(fā)起的連接： cpe必需滿足如下任何一個(gè)條件的情況下向acs地址發(fā)起連接，并調(diào)用acs的inform方法。 the cpe首次入網(wǎng)first time the cpe establishes a connection to the access network on initial installation on cpe加電或重啟power-up or reset once 定時(shí)任務(wù)every periodicinforminterval (for example, every 24-hours) when the optional sc

8、heduleinform method的指示so instructed by the optional scheduleinform method whenever cpe收到acs的連接請(qǐng)求the cpe receives a valid connection request from an acs (see section 3.2.2) whenever acs的url發(fā)生改變the url of the acs changes whenever 某些參數(shù)發(fā)生了變更a parameter is modified that is required to initiate an inform

9、on change. whenever valuechange事件，所以cpe必需發(fā)起連接the value of a parameter that the acs has marked for “active notification” via thesetparameterattributes method is modified by an external cause (a cause other than the acsitself).whenever 不正常的會(huì)話終結(jié)，導(dǎo)致會(huì)話重新發(fā)起時(shí)。an unsuccessfully terminated session is retried

10、 according to the session retry policyspecified in section .重建會(huì)話為了遞交上次提交失敗的事件。重試的次數(shù)必需通知acs【inform時(shí)已經(jīng)提交】。.acs發(fā)起的連接：滿足如下條件 the必須使用http1.1 get。獲取只讀的cpe狀態(tài) connection request must use an http 1.1 get to a specific url designated by the cpe. theurl value is available as read-only parameter on the c

11、pe. the path of this url value should be randomly generated by the cpe so that it is unique per cpe. the 不能使用httpsconnection request must make use of http, not https. the associated url must be anhttp url. no 不能帶參數(shù)，cpe 應(yīng)該忽略參數(shù)data is conveyed in the connection request http get. any data that might be

12、 containedshould be ignored by the cpe. the 摘要認(rèn)證cpe must use digest-authentication to authenticate the acs before proceedingthe cpemust not initiate a connection to the acs due to an unsuccessfully authenticated request. the cpe接受任何正確鑒權(quán)的請(qǐng)求cpe must accept connection requests from any source that has

13、the correct authenticationparameters for the target cpe. the 鑒權(quán)成功后必選返回200或者204，且長(zhǎng)度必須為0cpes response to a successfully authenticated connection request must use either a “200(ok)” or a “204 (no content)” http status code. the cpe must send this response immediatelyupon successful authentication, prio

14、r to it initiating the resulting session. the length of the messagebody in the http response must be zero. the cpe需限制周期內(nèi)acs請(qǐng)求的次數(shù)，如果超出這個(gè)次數(shù)返回503狀態(tài)碼，且忽略header中帶的retry-aftercpe should restrict the number of connection requests it accepts during a given period oftime in order to further reduce the possib

15、ility of a denial of service attack. if the cpe chooses to rejecta connection request for this reason, the cpe must respond to that connection request with anhttp 503 status code (service unavailable). in this case, the cpe should not include the httpretry-after header in the response. if 正確鑒權(quán)，并已經(jīng)做出

16、響應(yīng)，但是會(huì)話超時(shí)，30s內(nèi)發(fā)起響應(yīng)，即call acs inform,eventcode=6 connection requestthe cpe successfully authenticates and responds to a connection request as described above, and if it is not already in a session, then it must, within 30 seconds of sending the response, attempt toestablish a session with the pre-det

17、ermined acs address (see section 3.1) in which it includes the“6 connection request” eventcode in the inform.note in practice there might be exceptional circumstances that would cause a cpe to fail tomeet this requirement on rare occasions. if 上面會(huì)話建立仍然不成立，換acs重試the acs receives a successful response

18、 to a connection request but after at least 30 seconds thecpe has not successfully established a session that includes the “6 connection request”eventcode in the inform, the acs may retry the connection request to that cpe. ifcpe和acs在建立會(huì)話之前，收到了多個(gè)連接請(qǐng)求，cpe必需正常響應(yīng)這些請(qǐng)求，但是不能建立會(huì)話。也就是說(shuō)對(duì)于cpe來(lái)說(shuō)會(huì)話只能有一個(gè)。, once

19、the cpe successfully authenticates and responds to a connection request, but before itestablishes a session to the acs, it receives one or more successfully authenticated connectionrequests, the cpe must return a successful response for each of those connection requests, butmust not initiate any add

20、itional sessions as a result of these additional connection requests,regardless of how many it receives during this time. if cpe和acs會(huì)話期間收到多個(gè)請(qǐng)求，cpe不能立即能釋放會(huì)話，處理的方式1、503的響應(yīng)，response header中不能包含retry-after2、會(huì)話完成，call acs inform,eventcode=6 connection request,因此需要cpe記錄在此期間的請(qǐng)求。the cpe is already in a sess

21、ion with the acs when it receives one or more connection requests, itmust not terminate that session prematurely as a result. the cpe must instead take one of thefollowing alternative actions: reject each connection request by responding with an http 503 status code (serviceunavailable). in this cas

22、e, the cpe should not include the http retry-after header in theresponse. following the completion of the session, initiate exactly one new session (regardless of how many connection requests had been received during the previous session) in which it includes thecpe wan management protocol v1.1 tr-0

23、69 issue 1 amendment 2 “6 connection request” eventcode in the inform. in this case, the cpe must initiate the session immediately after the existing session is complete and all changes from that session have been applied. this requirement holds for connection requests received any time during the i

24、nterval that the cpeconsiders itself in a session, including the period in which the cpe is in the process of establishing thesession. the cpe不能拒絕一個(gè)經(jīng)過(guò)鑒權(quán)的請(qǐng)求。cpe must not reject a properly authenticated connection request for any reason other thanthose described above. if the cpe rejects a connection

25、request for any of the reasons describedabove, it must not initiate a session with the acs as a result of that connection request.acs發(fā)起的連接還必需依賴 cpe之前已經(jīng)和acs建立過(guò)會(huì)話，因?yàn)橹挥羞@樣acs才能知道cpe的連接url。b. encoding soap over http a 當(dāng)acs向cpe發(fā)出一個(gè)soap請(qǐng)求，則cpe必需向acs發(fā)出soap響應(yīng)soap request from an acs to a cpe is sent over an

26、http response, while the cpes soapresponse to an acs request is sent over a subsequent http post. when 無(wú)論一個(gè)正確的soap響應(yīng)還是錯(cuò)誤的soap響應(yīng)，其sopaaction必需沒(méi)有值，即不泄露soap消息的意圖there is a soap response in an http request, or when there is a soap fault response inan http request, the soapaction header in the http reque

27、st must have no value (with noquotes), indicating that this header provides no information as to the intent of the message. thatis, it must appear as follows:soapaction: when 包含soap的請(qǐng)求或響應(yīng)，其content-type必需為”text/xml”an http request or response contains a soap envelope, the http content-type headermust

28、 have a type/subtype of “text/xml”. an 一個(gè)空的http請(qǐng)求不能包含soapactionempty http post must not contain a soapaction header. an 一個(gè)空的http請(qǐng)求不能包含content-typeempty http post must not contain a content-type header. an 一個(gè)承載cwmp的響應(yīng)，其響應(yīng)狀態(tài)碼必需為200http response that contains any cpe wan management protocol payload (a

29、soap requestto the cpe, a successful soap response to the cpe, or a soap fault response containing a faultelement defined in section 3.5) must use the http status code 200 (ok).below is an example http response from an acs containing a soap request:http/1.1 200 okcontent-type: text/xml; charset=utf-

30、8content-length: xyzvaluenote in the above example, the xml namespace prefixes used are only examples. the actualnamespace prefix values are arbitrary, and are used only to refer to a namespace declaration.note in the above example, the cwmp namespace identifier “urn:dslforum-org:cwmp-1-0” isonly an

31、 example and is not necessarily the version that is defined by this specification.c. transaction sessionsfor tcp連接的斷開(kāi)，并不代表session結(jié)束a sequence of transactions forming a single session, a cpe should maintain a tcp connection that persists throughout the duration of the session. however, if the tcp con

32、nection is cleanly closed after an http request/response round trip, and if the session has not otherwise terminated (either successfully or unsuccessfully) at the time of the last http response, the cpe must continue the session by sending the next http request in a new tcp connection.after 鑒權(quán)通過(guò)，cp

33、e的請(qǐng)求必需帶上authorization http header receiving an authentication challenge, the cpe must send the next http request (including theauthorization http header) in the same tcp connection unless the acs specifically requested, via a connection: close http header, that the tcp connection be closed. 3 in the

34、 latter case, the cpe must honor the acs request, close the tcp connection, and send the next http request (including the authorization http header) in a new tcp connection.if cpe必需在未接到http response 或者send http message 失敗30s后才能宣告tcp連接失敗the cpe for any reason fails to establish a tcp connection, fail

35、s to send an http message, or fails to receive an http response, the cpe must consider the session unsuccessfully terminated. the cpemust wait a minimum of 30 seconds before declaring a failure to establish a tcp connection, or failure to receive an http response.the acs可以使用cookie來(lái)維護(hù)會(huì)話acs should mak

36、e use of a session cookie to maintain session state as described in 7. the acs may make use of old-style “netscape” cookies as well as, or instead of, the new-style cookies of 7. the acs should use only cookies marked for discard, and should not assume that a cpe will maintain a cookie beyond the du

37、ration of the session.to 確信acs使用會(huì)話cookie,那么cpe必需按照tr-2965標(biāo)準(zhǔn)支持，http post方式，cpe沒(méi)有必要存儲(chǔ)超過(guò)會(huì)話期限的cookie.cpe cookie兼容性需支持，多cookie,最少能512kbensure that an acs can make use of a session cookie, a cpe must support the use of cookies asdefined in 7 including the return of the cookie value in each subsequent http

38、 post, with the exception that a cpe need not support storage of cookies beyond the duration of a session. in particular, because the acs might send old-style, new-style, or a mixture of old-style and new-style cookies, the cpe must support the compatibility requirements of section 9.1 of 7. the cpe

39、 must support the use of multiple cookies by the acs, and must make available at least 512 bytes for storage of cookies.when 當(dāng)一個(gè)會(huì)話事務(wù)正?；蚍钦５耐瓿?，cpe必需關(guān)閉tcp連接，并且將所有的cookie標(biāo)記為discarda transaction session is completed successfully or terminated unsuccessfully, a cpe must close the associated tcp connectio

40、n to the acs and discard all cookies marked for discard.a cpe必須支持重定向。具體略cpe must support the use of http redirection by the acs. the cpe and acs requirements associated with the use of http redirection are as follows:all 所有會(huì)話開(kāi)始都是起源于cpe post acs的infrom方法。一個(gè)會(huì)話中不能出現(xiàn)兩次及以上調(diào)用infrom方法transaction sessions m

41、ust begin with an inform message from the cpe contained in the initial http post. this serves to initiate the set of transactions and communicate the limitations of the cpe with regard to message encoding. an inform message must not occur more than once during a sessionthe 在即沒(méi)有請(qǐng)求和響應(yīng)存在時(shí)，應(yīng)停止會(huì)話。在同一時(shí)間ac

42、s和cpe之間只能有一個(gè)會(huì)話。session ceases when both the acs and cpe have no more requests to send and no responses remain due from either the acs or the cpe. at such time, the cpe must close the connection.no more than one transaction session between a cpe and its associated acs can exist at a time.d. authentic

43、ation1.、如果cpe沒(méi)有經(jīng)過(guò)ssl/tls認(rèn)證，那么acs必須使用http對(duì)cpe進(jìn)行認(rèn)證，并且必須是摘要認(rèn)證，如果經(jīng)過(guò)ssl/tls認(rèn)證，則基本認(rèn)證和摘要認(rèn)證都可以。2、cpe必須支持基本認(rèn)證和摘要認(rèn)證3、cpe收到質(zhì)詢后，必須帶認(rèn)證頭，而且以后的請(qǐng)求都必須帶。4、http認(rèn)證的userid必須是如下兩種格式中的一種： - - - 5、userid是數(shù)字和字母的組合，如果不是需要使用rfc3986之uri percent encoding進(jìn)行轉(zhuǎn)碼.即如下形式符合：012345-0123456789012345-stb-0123456789012345-set%2dtop%2dbox-0

44、1234567896、每個(gè)cpe的密碼應(yīng)該是唯一，此密碼為共享密碼，acs和cpe應(yīng)該都知道。7、this 如果cwmp使用摘要認(rèn)證，那么cpe和acs需支持rfc2617section outlines requirements for use of digest authentication within the cpe wan management protocol.the cpe and the acs must support the rfc 2617 “qop” option containing the value “auth”. according to rfc 2617, t

45、his means that the http client must use a new style digest mechanism when this option is provided to it by the http server.when using digest authentication, for each new tcp connection opened, the acs should use a newnonce value and the cpe should use a new cnonce value.the acs和cpe必需支持md5算法，cpe還必需支持

46、md5-sess算法cpe and the acs must support the md5 digest algorithm. the cpe must additionally support the md5-sess digest algorithm.e. use of soapthe following describes the mapping of rpc methods to soap encoding: the soap命名空間envelope,encodingencoding must use the standard soap 1.1 envelope and serial

47、ization namespaces: envelope namespace identifier /soap/envelope/ serialization namespace identifier /soap/encoding/ all cwmp元素和屬性的命名空間: “urn:dslforum-org:cwmp-1-1”后面的1-1即版本號(hào)1.1elements and attributes defined as part of this version of the cpe wan ma

48、nagement protocol are associated with the following namespace identifier: “urn:dslforum-org:cwmp-1-1” the namespace identifier for cpe wan management protocol version 1.n is always “urn:dslforumorg:cwmp:1-n”, e.g. for v1.0 it was “urn:dslforum-org:cwmp:1-0” and for v1.42 it will be“urn:dslforum-org:

49、cwmp:1-42”. the 下表的數(shù)據(jù)類型在/soap/encoding/有明確的定義data types used in annex a correspond directly to the data types defined in the soap 1.1serialization namespace. (in general, the types used in annex a are restricted subsets of thecorresponding soap types.) 【 for 數(shù)組的數(shù)組名必需是數(shù)組元素的名字

50、an array argument, the argument name specified in the table in which the array is defined mustbe used as the name of the overall array element. the name of the member elements of an arraymust be the data type of the array as specified in the table in which the array is defined (excludingthe brackets

51、 and any length limitation given in parentheses), and must not be namespace qualified.for example, an argument named parameterlist, which is an array of parametervaluestruct structures,would be encoded as:as a second example, the methodlist array in the getrpcmethodsresponse would be encoded as: the

52、 rpc方法根據(jù)soap的命名規(guī)則，響應(yīng)的名字是在請(qǐng)求的基礎(chǔ)上加response后綴rpc methods defined use the standard soap naming convention whereby the response message corresponding to a given method is named by adding the “response” suffix to the name of the method. a soap必需有bodysoap envelope must contain exactly one body element. a s

53、oap請(qǐng)求的最大長(zhǎng)度為32kb，而soap響應(yīng)沒(méi)有長(zhǎng)度的限制.cpe must be able to accept a soap request with a total envelope size of at least 32 kilobytes(32768 bytes) without resulting in a “resources exceeded” response. a cpe must be able to generate a soap response of any required length without resulting in a“resources excee

54、ded” response, i.e. there is no maximum cpe soap response length. an acs must be able to accept a soap request with a total envelope size of at least 32 kilobytes(32768 bytes) without resulting in a “resources exceeded” response. an acs must be able to generate a soap response of any required length

55、 without resulting in a“resources exceeded” response, i.e. there is no maximum acs soap response length. a soap錯(cuò)誤的響應(yīng)，格式如下faultcode元素:client和server二選一faultstring元素:必需包含“cwmp fault”detail:必需包含一個(gè)cwmp命名空間的fault結(jié)構(gòu)fault response must make use of the soap fault element using the following conventions:below

56、 is an example envelope containing a fault response:below is an example envelope containing a fault response for a setparametervalues method call:a 一個(gè)soap錯(cuò)誤響應(yīng)比針對(duì)一個(gè)soap請(qǐng)求，而不是soap響應(yīng)。如果一個(gè)錯(cuò)誤響應(yīng)不符合上面格式，即無(wú)效，應(yīng)該忽略fault response must only be sent in response to a soap request. a fault response must not besent in response to a soap response or another fault response.if a fault response does not follow all of the above requirements, the soap message must be deemedinvalid by the recipient. the consequences of invalid soap on the c