YANG Model for BGP Flow Specification

<CODE BEGINS> file "ietf-bgp-flowspec@2026-10-29.yang"

module ietf-bgp-flowspec {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-bgp-flowspec";
  prefix bfs;

  /*
   * Import and Include
   */

  import ietf-routing {
    prefix rt;
    reference
      "RFC 8349: A YANG Data Model for Routing Management
                 (NMDA Version)";
  }
  import ietf-inet-types {
    prefix inet;
    reference
      "RFC 9911: Common YANG Data Types";
  }
  import ietf-yang-semver {
    prefix ysv;
    reference
      "RFC ZZZZ: YANG Semantic Versioning";
  }
  import ietf-bgp {
    prefix bgp;
    reference
      "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
  }
  import iana-bgp-afi-safi-types {
    prefix bast;
    reference
      "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
  }

  organization
    "IETF Inter-Domain Routing (IDR) Working Group";
  contact
    "WG Web:   <https://datatracker.ietf.org/wg/idr/>
     WG List:  IDR <mailto:idr@ietf.org>

     Author:   Changwang Lin
               <mailto:linchangwang.04414@h3c.com>";

  description
    "This module contains YANG definitions for the BGP Flow
     Specification address families.  It extends the BGP YANG
     model defined in RFC XXXX with the IPv4 Flow Specification
     (AFI, SAFI = 1, 133) and IPv6 Flow Specification (AFI,
     SAFI = 2, 133) address families, per RFC 8955 and RFC 8956,
     and adds the corresponding RIB contents.

     Copyright (c) 2026 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject to
     the license terms contained in, the Revised BSD License set
     forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC YYYY; see the
     RFC itself for full legal notices.

     All revisions of IETF and IANA published modules can be found
     at the YANG Parameters registry group
     (https://www.iana.org/assignments/yang-parameters).";

  revision 2026-10-29 {
    description
      "Initial Version";
    ysv:version 0.0.1;
    reference
      "RFC YYYY: YANG Model for BGP Flow Specification";
  }

  /*
   * Features.
   */

  feature flowspec-redirect-ip {
    description
      "The implementation supports the Redirect-to-IP extended
       community as a Flow Specification action.";
    reference
      "RFC AAAA: BGP Flow-Spec Redirect-to-IP Action";
  }

  /*
   * Identities.
   */

  identity ipv4-flowspec {
    base bast:afi-safi-type;
    description
      "IPv4 Flow Specification (AFI, SAFI = 1, 133).";
    reference
      "RFC 8955: Dissemination of Flow Specification Rules";
  }

  identity ipv6-flowspec {
    base bast:afi-safi-type;
    description
      "IPv6 Flow Specification (AFI, SAFI = 2, 133).";
    reference
      "RFC 8956: Dissemination of Flow Specification Rules
                 for IPv6";
  }

  /*
   * Typedefs.
   */

  typedef component-type {
    type enumeration {
      enum destination-prefix {
        value 1;
        description
          "Destination prefix component (Type 1).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.1";
      }
      enum source-prefix {
        value 2;
        description
          "Source prefix component (Type 2).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.2";
      }
      enum ip-protocol {
        value 3;
        description
          "IP protocol component (Type 3).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.3";
      }
      enum port {
        value 4;
        description
          "Port component (Type 4).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.4";
      }
      enum destination-port {
        value 5;
        description
          "Destination port component (Type 5).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.5";
      }
      enum source-port {
        value 6;
        description
          "Source port component (Type 6).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.6";
      }
      enum icmp-type {
        value 7;
        description
          "ICMP type component (Type 7).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.7";
      }
      enum icmp-code {
        value 8;
        description
          "ICMP code component (Type 8).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.8";
      }
      enum tcp-flags {
        value 9;
        description
          "TCP flags component (Type 9).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.9";
      }
      enum packet-length {
        value 10;
        description
          "Packet length component (Type 10).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.10";
      }
      enum dscp {
        value 11;
        description
          "DSCP component (Type 11).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.11";
      }
      enum fragment {
        value 12;
        description
          "Fragment component (Type 12).";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.12";
      }
      enum flow-label {
        value 13;
        description
          "Flow label component (Type 13); IPv6 only.";
        reference
          "RFC 8956: Dissemination of Flow Specification Rules
                     for IPv6, Section 3.7";
      }
    }
    description
      "Type of a Flow Specification component.  The value of the
       enumeration corresponds to the Flow Specification component
       type code defined in RFC 8955 and RFC 8956.";
  }

  typedef tcp-flags-bits {
    type bits {
      bit fin {
        position 0;
        description
          "FIN flag (bit position 0 in the wire-format octet,
           counted from the least significant bit).";
      }
      bit syn {
        position 1;
        description
          "SYN flag (bit position 1).";
      }
      bit rst {
        position 2;
        description
          "RST flag (bit position 2).";
      }
      bit psh {
        position 3;
        description
          "PSH flag (bit position 3).";
      }
      bit ack {
        position 4;
        description
          "ACK flag (bit position 4).";
      }
      bit urg {
        position 5;
        description
          "URG flag (bit position 5).";
      }
      bit ece {
        position 6;
        description
          "ECE flag (bit position 6).";
      }
      bit cwr {
        position 7;
        description
          "CWR flag (bit position 7).";
      }
      bit ns {
        position 8;
        description
          "Nonce Sum flag (bit position 8).";
      }
    }
    description
      "TCP flags as defined in RFC 8955, Section 4.2.2.9.  Bit
       positions follow the bit-numbering convention of RFC 8955,
       where bit 0 is the least significant bit of the TCP flags
       octet.";
    reference
      "RFC 8955: Dissemination of Flow Specification Rules,
                 Section 4.2.2.9";
  }

  typedef fragment-bits {
    type bits {
      bit dont-fragment {
        position 0;
        description
          "Match if the Don't Fragment (DF) bit is set.";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.12";
      }
      bit is-fragment {
        position 1;
        description
          "Match if the packet is a fragment other than the
           first fragment.";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.12";
      }
      bit first-fragment {
        position 2;
        description
          "Match if the packet is a first fragment.";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 4.2.2.12";
      }
      bit last-fragment {
        position 3;
        description
          "Match if the packet is a last fragment (IF bit
           defined in RFC 8956 for IPv6).";
        reference
          "RFC 8956: Dissemination of Flow Specification Rules
                     for IPv6, Section 3.6";
      }
    }
    description
      "Fragment flags used by the fragment component (Type 12).
       For IPv4, the four bits map to the FF (fragment) bit-field
       of RFC 8955; for IPv6, the last-fragment bit corresponds to
       the IF (last fragment) bit introduced by RFC 8956.";
    reference
      "RFC 8955: Dissemination of Flow Specification Rules,
                 Section 4.2.2.12
       RFC 8956: Dissemination of Flow Specification Rules
                 for IPv6, Section 3.6";
  }

  typedef flow-spec-value-op {
    type bits {
      bit less-than {
        position 0;
        description
          "op bit 1: less-than.";
      }
      bit greater-than {
        position 1;
        description
          "op bit 2: greater-than.";
      }
      bit equal {
        position 2;
        description
          "op bit 3: equal.";
      }
      bit and {
        position 3;
        description
          "op bit 4: logical AND of the previous operand.";
      }
      bit not {
        position 4;
        description
          "op bit 5: negate this operand.";
      }
    }
    description
      "Numeric operator bits as encoded in the least significant
       5 bits of the 'op' byte defined in Section 4.2.1 of
       RFC 8955.";
  }

  /*
   * Groupings.
   */

  grouping numeric-operand {
    description
      "A single numeric operand as defined in Section 4.2.1 of
       RFC 8955, together with its operator bits.";
    leaf op {
      type flow-spec-value-op;
      description
        "Operator flags for this operand.";
    }
    leaf value {
      type uint16;
      description
        "Numeric operand value.";
    }
  }

  grouping flowspec-match {
    description
      "Flow Specification match components, keyed by the
       component type as defined in Section 4.2.2 of RFC 8955.
       A packet matches the Flow Specification when it matches
       all components present.  The YANG tree models each
       component type as a distinct choice case; NLRI encoding
       follows the component type ordering rules of Section 4
       of RFC 8955.";

    choice component {
      description
        "One of the Flow Specification component types.  Only a
         single component of a given type code may be present in
         a Flow Specification rule, per Section 4.2 of RFC 8955.";

      case destination-prefix {
        leaf destination-prefix {
          type inet:ip-prefix;
          description
            "Destination prefix component (Type 1 for IPv4;
             Type 1 in the IPv6 Flow Specification NLRI per
             RFC 8956 with an expanded encoding when the
             prefix length exceeds 64 bits).";
        }
      }
      case source-prefix {
        leaf source-prefix {
          type inet:ip-prefix;
          description
            "Source prefix component (Type 2 for IPv4;
             Type 2 in the IPv6 Flow Specification NLRI per
             RFC 8956 with an expanded encoding when the
             offset is non-zero).";
        }
      }
      case ip-protocol {
        leaf-list ip-protocol {
          type uint8;
          description
            "IP protocol values (Type 3).  Multiple values and
             negation are encoded per the numeric operator rules
             of RFC 8955, Section 4.2.";
        }
      }
      case port {
        leaf-list port {
          type inet:port-number;
          description
            "Source or destination port component (Type 4).
             Matches either the source or the destination TCP or
             UDP port of a packet.";
        }
      }
      case destination-port {
        leaf-list destination-port {
          type inet:port-number;
          description
            "Destination port component (Type 5).";
        }
      }
      case source-port {
        leaf-list source-port {
          type inet:port-number;
          description
            "Source port component (Type 6).";
        }
      }
      case icmp-type {
        leaf-list icmp-type {
          type uint8 {
            range "0..255";
          }
          description
            "ICMP type component (Type 7).";
        }
      }
      case icmp-code {
        leaf-list icmp-code {
          type uint8 {
            range "0..255";
          }
          description
            "ICMP code component (Type 8).";
        }
      }
      case tcp-flags {
        leaf tcp-flags {
          type tcp-flags-bits;
          description
            "TCP flags component (Type 9).  The value is the
             byte used in the operand; the match/mask
             operator bits of RFC 8955 Section 4.2.1.2 apply.";
        }
      }
      case packet-length {
        leaf-list packet-length {
          type uint16;
          description
            "Packet length component (Type 10): the total IP
             packet length, excluding the Layer 2 framing but
             including the IP header.";
        }
      }
      case dscp {
        leaf-list dscp {
          type inet:dscp;
          description
            "DSCP component (Type 11).";
        }
      }
      case fragment {
        leaf fragment {
          type fragment-bits;
          description
            "Fragment component (Type 12).";
        }
      }
      case flow-label {
        leaf-list flow-label {
          type uint32 {
            range "0..1048575";
          }
          description
            "IPv6 flow label component (Type 13), per
             RFC 8956.  Applicable only to the IPv6 Flow
             Specification address family.";
        }
      }
    }
  }

  grouping flowspec-actions {
    description
      "Traffic filtering actions for a Flow Specification rule,
       encoded in Extended Communities as defined in Section 7 of
       RFC 8955.";

    container traffic-rate {
      description
        "Traffic rate action (transitive extended community,
         subtype 0x8006).  The rate is expressed in bytes per
         second as IEEE 754 single-precision floating point.";
      reference
        "RFC 8955: Dissemination of Flow Specification Rules,
                   Section 7.1";
      leaf rate {
        type decimal64 {
          fraction-digits 12;
        }
        units "bytes per second";
        description
          "Traffic rate in bytes per second.  A rate of 0 will
           discard all traffic matched by the Flow Specification.";
      }
      leaf sample {
        type boolean;
        default "false";
        description
          "When true, packets matching the Flow Specification
           must be sampled, per Section 7.3 of RFC 8955.";
      }
      leaf log {
        type boolean;
        default "false";
        description
          "When true, matching packets must be logged, per
           Section 7.3 of RFC 8955.";
      }
    }
    container redirect {
      description
        "Redirect action.  The Flow Specification rule redirects
         matching traffic to a VRF, to an IP address, or to
         another Next-Hop.";
      leaf route-target {
        type string {
          pattern '(0|([1-9][0-9]*)):[0-9]+|'
                + '(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|'
                + '25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|'
                + '2[0-4][0-9]|25[0-5]):([0-9]+)|'
                + '([0-9a-fA-F]{1,4}:){1,2}[0-9a-fA-F]{1,4}:[0-9]+';
        }
        description
          "Route Target extended community of the VRF to which
           the traffic is redirected, per Section 7.4 of
           RFC 8955.";
      }
      leaf ip-address {
        if-feature "flowspec-redirect-ip";
        type inet:ip-address;
        description
          "IPv4 or IPv6 address to which matching traffic is
           redirected, per the Redirect-to-IP action of
           RFC AAAA.";
      }
    }
    container traffic-marking {
      description
        "Traffic marking action (transitive extended community,
         subtype 0x8009), per Section 7.5 of RFC 8955.";
      leaf dscp {
        type inet:dscp;
        description
          "The DSCP value to set in transit IP packets.  The
           value 0xffffffff (reserved) has no meaning in this
           model and is not used.";
      }
    }
  }

  /*
   * Data nodes.
   */

  augment "/rt:routing/rt:control-plane-protocols/"
        + "rt:control-plane-protocol/bgp:bgp/bgp:global/"
        + "bgp:afi-safis/bgp:afi-safi" {
    when "derived-from-or-self(bgp:name, 'bfs:ipv4-flowspec') or "
       + "derived-from-or-self(bgp:name, 'bfs:ipv6-flowspec')" {
      description
        "This augmentation is valid for a Flow Specification
         AFI/SAFI instance.";
    }
    description
      "BGP Flow Specification specific configuration that applies
       to the global AFI/SAFI.";

    container flowspec {
      description
        "Flow Specification specific configuration for the
         AFI/SAFI.";
      uses bgp:mp-all-afi-safi-common;
      leaf validate-route-origin {
        type boolean;
        default "true";
        description
          "When true, the local system applies the validation
           procedure of Section 6 of RFC 8955 (or the revised
           validation procedure of RFC 9117 when configured) to
           Flow Specification routes received from BGP peers.";
        reference
          "RFC 8955: Dissemination of Flow Specification Rules,
                     Section 6
           RFC 9117: Revised Validation Procedure for BGP Flow
                     Specifications";
      }
    }
  }

  augment "/rt:routing/rt:control-plane-protocols/"
        + "rt:control-plane-protocol/bgp:bgp/bgp:rib/"
        + "bgp:afi-safis/bgp:afi-safi" {
    when "derived-from-or-self(bgp:name, 'bfs:ipv4-flowspec') or "
       + "derived-from-or-self(bgp:name, 'bfs:ipv6-flowspec')" {
      description
        "This augmentation is valid for a Flow Specification
         AFI/SAFI instance.";
    }
    description
      "BGP Flow Specification RIB augmentation.";

    container flowspec {
      config false;
      description
        "Container for the BGP Flow Specification RIB.";
      container loc-rib {
        description
          "The Flow Specification Loc-RIB: the set of Flow
           Specifications selected for local enforcement.";
        container routes {
          config false;
          description
            "Enclosing container for the list of Flow
             Specification routes.";
          list route {
            key "flow-spec-components";
            description
              "List of Flow Specification routes in the
               Loc-RIB, keyed by the encoded Flow Specification
               NLRI.";
            leaf flow-spec-components {
              type binary;
              description
                "The Flow Specification NLRI encoded per
                 Section 4 of RFC 8955 (or Section 3 of
                 RFC 8956 for IPv6), including the component
                 type codes and operator/operand bytes.  The
                 encoding of a Flow Specification is canonical
                 (components in strictly increasing type order
                 per Section 4.2 of RFC 8955), so the encoded
                 NLRI uniquely identifies the route across
                 implementations.";
            }
            leaf active {
              type boolean;
              description
                "Indicates whether the Flow Specification is
                 valid and enforced locally.";
            }
            uses bgp:bgp-common-route-annotations-state;
            uses bgp:bgp-loc-rib-common-attr-refs;
            uses bgp:rib-ext-route-annotations;
          }
        }
      }

      container neighbors {
        description
          "Enclosing container for the neighbor list.";
        list neighbor {
          key "neighbor-address";
          description
            "List of Flow Specification neighbors of the local
             BGP speaker.";
          leaf neighbor-address {
            type inet:ip-address;
            description
              "IP address of the BGP neighbor or peer.";
          }
          container adj-rib-in-pre {
            description
              "Per-neighbor table containing the Flow
               Specification NLRI updates received from the
               neighbor before any local input policy rules
               have been applied.";
            uses flowspec-adj-rib;
          }
          container adj-rib-in-post {
            description
              "Per-neighbor table containing the Flow
               Specification paths received from the neighbor
               that are eligible for best-path selection after
               local input policy rules have been applied.";
            uses flowspec-adj-rib-in-post;
          }
          container adj-rib-out-pre {
            description
              "Per-neighbor table containing Flow Specification
               paths eligible for sending to the neighbor
               before output policy rules have been applied.";
            uses flowspec-adj-rib;
          }
          container adj-rib-out-post {
            description
              "Per-neighbor table containing Flow Specification
               paths eligible for sending to the neighbor after
               output policy rules have been applied.";
            uses flowspec-adj-rib;
          }
        }
      }
    }
  }

  grouping flowspec-adj-rib {
    description
      "Common structural grouping for each Flow Specification
       Adj-RIB table.";
    container routes {
      config false;
      description
        "Enclosing container for the list of Flow Specification
         routes in the routing table.";
      list route {
        key "flow-spec-components path-id";
        description
          "List of Flow Specification routes in the table,
           keyed by the Flow Specification NLRI and path-id
           to distinguish multiple routes for the same NLRI
           (e.g., when BGP add-paths is enabled).";
        leaf flow-spec-components {
          type binary;
          description
            "The Flow Specification NLRI encoded per
             Section 4 of RFC 8955 (or Section 3 of
             RFC 8956 for IPv6), including the component
             type codes and operator/operand bytes.  The
             encoding of a Flow Specification is canonical
             (components in strictly increasing type order
             per Section 4.2 of RFC 8955), so the encoded
             NLRI uniquely identifies the route across
             implementations.";
        }
        uses bgp:bgp-adj-rib-attr-state;
        uses bgp:bgp-adj-rib-common-attr-refs;
        uses bgp:bgp-common-route-annotations-state;
        uses bgp:bgp-unknown-attr-top;
        uses bgp:rib-ext-route-annotations;
      }
    }
  }

  grouping flowspec-adj-rib-in-post {
    description
      "Common structural grouping for the Flow Specification
       Adj-RIB-In post-policy table.";
    container routes {
      config false;
      description
        "Enclosing container for the list of Flow Specification
         routes in the routing table.";
      list route {
        key "flow-spec-components path-id";
        description
          "List of Flow Specification routes in the table,
           keyed by the Flow Specification NLRI and path-id
           to distinguish multiple routes for the same NLRI
           (e.g., when BGP add-paths is enabled).";
        leaf flow-spec-components {
          type binary;
          description
            "The Flow Specification NLRI encoded per
             Section 4 of RFC 8955 (or Section 3 of
             RFC 8956 for IPv6), including the component
             type codes and operator/operand bytes.  The
             encoding of a Flow Specification is canonical
             (components in strictly increasing type order
             per Section 4.2 of RFC 8955), so the encoded
             NLRI uniquely identifies the route across
             implementations.";
        }
        uses bgp:bgp-adj-rib-attr-state;
        uses bgp:bgp-adj-rib-common-attr-refs;
        uses bgp:bgp-common-route-annotations-state;
        uses bgp:bgp-adj-rib-in-post-route-annotations-state;
        uses bgp:bgp-unknown-attr-top;
        uses bgp:rib-ext-route-annotations;
      }
    }
  }
}
<CODE ENDS>