IDR Working Group C. Lin Internet-Draft New H3C Technologies Intended status: Standards Track A. Wang Expires: 6 May 2027 China Telecom 2 November 2026 YANG Model for BGP Flow Specification draft-lin-idr-bgp-flowspec-yang-00 Abstract This document defines a YANG data model for the BGP Flow Specification (Flowspec) address families (RFC8955 and RFC8956). The model augments the BGP YANG model to add the IPv4 Flow Specification (AFI, SAFI = 1, 133) and IPv6 Flow Specification (AFI, SAFI = 2, 133) address families, including Flowspec-specific configuration, the Flow Specification RIB, and per-neighbor Adj-RIBs. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 6 May 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. Lin & Wang Expires 6 May 2027 [Page 1] Internet-Draft YANG Model for BGP Flowspec November 2026 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology and Notation Conventions . . . . . . . . . . . . 3 2.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 2.2. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 3 3. Data Model Overview . . . . . . . . . . . . . . . . . . . . . 3 4. BGP Flow Specification YANG Module . . . . . . . . . . . . . 4 4.1. Tree View . . . . . . . . . . . . . . . . . . . . . . . . 4 4.1.1. Overall Structure . . . . . . . . . . . . . . . . . . 4 4.1.2. Flowspec Configuration . . . . . . . . . . . . . . . 5 4.1.3. Flowspec RIB . . . . . . . . . . . . . . . . . . . . 6 4.1.4. Match Components and Actions . . . . . . . . . . . . 9 4.2. YANG Module . . . . . . . . . . . . . . . . . . . . . . . 9 5. Security Considerations . . . . . . . . . . . . . . . . . . . 26 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 28 6.1. BGP Flow Specification YANG Module Registry . . . . . . . 28 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 28 7.1. Normative References . . . . . . . . . . . . . . . . . . 28 7.2. Informative References . . . . . . . . . . . . . . . . . 30 Appendix A. Full Tree of BGP Flow Specification YANG Module . . 31 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 33 1. Introduction [RFC8955] defines BGP Flow Specification (Flowspec) for IPv4 (AFI, SAFI = 1, 133), which allows the dissemination of traffic filtering rules as BGP NLRI. [RFC8956] extends Flowspec to IPv6 (AFI, SAFI = 2, 133). The revised validation procedure for Flowspec routes is defined in [RFC9117]. The BGP YANG model [I-D.ietf-idr-bgp-model] defines a vendor-neutral YANG [RFC7950] model for BGP [RFC4271] protocol configuration, policy, and operational state, including a Routing Information Base (RIB). It defines an extension pattern for adding new address families: a new identity derived from 'afi-safi-type' in the IANA- maintained 'iana-bgp-afi-safi-types' module, together with augmentations of the AFI/SAFI lists in the global configuration tree and in the RIB tree (Appendix B of [I-D.ietf-idr-bgp-model]). Lin & Wang Expires 6 May 2027 [Page 2] Internet-Draft YANG Model for BGP Flowspec November 2026 This document applies this address family extension pattern to Flowspec, whose NLRI is carried as MP_REACH_NLRI/MP_UNREACH_NLRI per [RFC4760]. It defines a YANG module, "ietf-bgp-flowspec", that registers the Flowspec address family identities, adds Flowspec- specific configuration and RIB augmentation, and defines reusable type definitions and groupings for Flow Specification match components and traffic filtering actions. 2. Terminology and Notation Conventions 2.1. Terminology The following terms are used in this document: * Flowspec: BGP Flow Specification, the dissemination of traffic filtering rules via BGP NLRI [RFC8955]. * AFI/SAFI: Address Family Identifier / Subsequent Address Family Identifier [RFC4760]. * Loc-RIB: The local RIB containing the routes selected by the local BGP speaker. * Adj-RIB-In / Adj-RIB-Out: Per-neighbor routing information bases for received and advertised routes, respectively. 2.2. Tree Diagrams Tree diagrams used in this document follow the notation defined in [RFC8340]. 3. Data Model Overview This document defines one YANG module: "ietf-bgp-flowspec". The "ietf-bgp-flowspec" YANG module extends the BGP YANG model [I-D.ietf-idr-bgp-model] with the Flowspec address families. It lives under the BGP protocol instance, reusing the base model's AFI/ SAFI configuration structure, RIB structure, and route annotations. It includes: * Flowspec address family identities: 'ipv4-flowspec' (AFI, SAFI = 1, 133) [RFC8955] and 'ipv6-flowspec' (AFI, SAFI = 2, 133) [RFC8956]. * Flowspec-specific configuration for the global AFI/SAFI, such as the prefix limit and the route-origin validation control. Lin & Wang Expires 6 May 2027 [Page 3] Internet-Draft YANG Model for BGP Flowspec November 2026 * The Flowspec RIB: a Loc-RIB of Flow Specifications selected for local enforcement and per-neighbor Adj-RIB-In/Out tables (pre- and post-policy). * Reusable type definitions and groupings for Flow Specification match components (Section 4 of [RFC8955]) and traffic filtering actions (Section 7 of [RFC8955]). Network management applications enable Flowspec on a BGP instance by creating an entry in the global 'afi-safi' list with one of the Flowspec identities as the 'name', following the same procedure as for any other address family in the base model. 4. BGP Flow Specification YANG Module 4.1. Tree View The full tree of the "ietf-bgp-flowspec" YANG module is provided in Appendix A. The following subsections list the subtree structures. 4.1.1. Overall Structure The overall tree structure of the "ietf-bgp-flowspec" YANG module is shown in Figure 1. The "ietf-bgp-flowspec" YANG module augments the BGP YANG module "ietf-bgp" [I-D.ietf-idr-bgp-model] at two points. The first augmentation adds Flowspec-specific configuration to the global AFI/ SAFI list; the second augmentation adds the Flowspec RIB to the RIB AFI/SAFI tree. Both augmentations are active only when the AFI/SAFI name is derived from the 'ipv4-flowspec' or 'ipv6-flowspec' identities. Lin & Wang Expires 6 May 2027 [Page 4] Internet-Draft YANG Model for BGP Flowspec November 2026 module: ietf-bgp-flowspec augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi: +--rw flowspec +--rw prefix-limit | ... +--rw validate-route-origin? boolean augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib/bgp:afi-safis /bgp:afi-safi: +--ro flowspec +--ro loc-rib | ... +--ro neighbors ... Figure 1: Overall BGP Flow Specification Tree Structure The first augmentation has a container 'flowspec', which provides the Flowspec-specific configuration for a Flowspec AFI/SAFI instance. The second augmentation has a container 'flowspec', which holds the Flowspec RIB: the Loc-RIB of Flow Specifications selected for local enforcement, and the per-neighbor Adj-RIB tables. 4.1.2. Flowspec Configuration The Flowspec configuration structure is shown in Figure 2. module: ietf-bgp-flowspec augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi: +--rw flowspec +--rw prefix-limit | +--rw max-prefixes? uint32 | +--rw warning-threshold-pct? rt-types:percentage | +--rw teardown? boolean | +--rw idle-time? union | +--ro prefix-limit-exceeded? boolean +--rw validate-route-origin? boolean Figure 2: Flowspec Configuration Subtree Structure The configuration data nodes of the container 'flowspec' are described as follows: Lin & Wang Expires 6 May 2027 [Page 5] Internet-Draft YANG Model for BGP Flowspec November 2026 'prefix-limit': The prefix limit imported from the base model's 'mp- all-afi-safi-common' grouping [I-D.ietf-idr-bgp-model], which limits the number of Flowspec routes accepted from a peer. 'validate-route-origin': Enables the Flowspec route validation procedure of Section 6 of [RFC8955], or the revised validation procedure of [RFC9117] when the implementation supports it. The default is 'true', consistent with the recommendation that Flowspec routes be validated before they are used for traffic filtering. 4.1.3. Flowspec RIB The Flowspec RIB structure is shown in Figure 3. Lin & Wang Expires 6 May 2027 [Page 6] Internet-Draft YANG Model for BGP Flowspec November 2026 module: ietf-bgp-flowspec augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib/bgp:afi-safis /bgp:afi-safi: +--ro flowspec +--ro loc-rib | +--ro routes | +--ro route* [flow-spec-components] | +--ro flow-spec-components binary | +--ro active? boolean | +--ro last-modified? yang:timeticks | +--ro eligible-route? boolean | +--ro ineligible-reason? identityref | +--ro attr-index? leafref | +--ro community-index? leafref | +--ro ext-community-index? leafref | +--ro large-community-index? leafref | +--ro reject-reason? union +--ro neighbors +--ro neighbor* [neighbor-address] +--ro neighbor-address inet:ip-address +--ro adj-rib-in-pre | +--ro routes | +--ro route* [flow-spec-components path-id] | ... +--ro adj-rib-in-post | +--ro routes | +--ro route* [flow-spec-components path-id] | ... +--ro adj-rib-out-pre | +--ro routes | +--ro route* [flow-spec-components path-id] | ... +--ro adj-rib-out-post +--ro routes +--ro route* [flow-spec-components path-id] ... Figure 3: Flowspec RIB Subtree Structure The 'loc-rib' contains the set of Flow Specifications selected for local enforcement. The route entry is keyed by the encoded Flow Specification NLRI ('flow-spec-components'); because the NLRI encoding is canonical (components in strictly increasing type order per Section 4.2 of [RFC8955]), the encoded NLRI uniquely identifies the route across implementations. The 'active' leaf indicates whether the Flow Specification is valid and enforced locally. Lin & Wang Expires 6 May 2027 [Page 7] Internet-Draft YANG Model for BGP Flowspec November 2026 The 'neighbors' container lists the Flowspec neighbors. For each neighbor, the model provides four tables: Adj-RIB-In pre-policy and post-policy, and Adj-RIB-Out pre-policy and post-policy. Each table contains a list of routes keyed by 'flow-spec-components' and 'path- id'. The structure of an Adj-RIB route entry is shown in Figure 4. module: ietf-bgp-flowspec augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib/bgp:afi-safis /bgp:afi-safi: +--ro flowspec +--ro neighbors +--ro neighbor* [neighbor-address] ... +--ro adj-rib-in-pre | +--ro routes | +--ro route* [flow-spec-components path-id] | +--ro flow-spec-components binary | +--ro path-id uint32 | +--ro attr-index? leafref | +--ro community-index? leafref | +--ro ext-community-index? leafref | +--ro large-community-index? leafref | +--ro last-modified? yang:timeticks | +--ro eligible-route? boolean | +--ro ineligible-reason? identityref | +--ro unknown-attributes | | +--ro unknown-attribute* [attr-type] | | +--ro optional? boolean | | +--ro transitive? boolean | | +--ro partial? boolean | | +--ro extended? boolean | | +--ro attr-type uint8 | | +--ro attr-len? uint16 | | +--ro attr-value? binary | +--ro reject-reason? union Figure 4: Flowspec Adj-RIB Route Entry Subtree Structure Route entries reuse the base model's route-annotation groupings ('bgp-common-route-annotations-state', 'bgp-adj-rib-attr-state', attribute and community index references, 'bgp-unknown-attr-top', and 'rib-ext-route-annotations') [I-D.ietf-idr-bgp-model], so that operators see the same operational state attributes for Flowspec routes as for any other address family. The Adj-RIB-In post-policy table additionally uses the 'bgp-adj-rib-in-post-route-annotations- state' grouping, which provides the 'best-path' flag. Lin & Wang Expires 6 May 2027 [Page 8] Internet-Draft YANG Model for BGP Flowspec November 2026 4.1.4. Match Components and Actions The module defines the 'flowspec-match' grouping, which models the Flow Specification match components of Section 4 of [RFC8955] as a YANG choice with one case per component type, and the 'flowspec- actions' grouping, which models the traffic filtering actions of Section 7 of [RFC8955] (traffic-rate, traffic-action sample/log bits, redirect, and traffic-marking). These groupings are defined in this revision as reusable building blocks for policy models and for future revisions of this document that attach decoded match and action trees to the configuration and operational state. This initial version provides the Flowspec address family infrastructure as a basic subset: the full numeric-operator and set-operation semantics of [RFC8955], as well as the relation between the match and action groupings and the routing policy framework of [RFC9067], are left to future revisions of this document. 4.2. YANG Module This YANG module has normative references to [RFC7950], [RFC8349], [RFC9911], [I-D.ietf-idr-bgp-model], [I-D.ietf-idr-flowspec-redirect-ip], and [I-D.ietf-netmod-yang-semver] (the 'ysv:version' extension used to tag the module revision with a semantic version). Note that the "RFC XXXX" in this YANG module must be replaced by the publication RFC number of [I-D.ietf-idr-bgp-model], "RFC YYYY" must be replaced by the RFC number assigned to this document, "RFC ZZZZ" must be replaced by the publication RFC number of [I-D.ietf-netmod-yang-semver], and "RFC AAAA" must be replaced by the publication RFC number of [I-D.ietf-idr-flowspec-redirect-ip]. This note is to be removed after the publication of those documents. file "ietf-bgp-flowspec@2026-10-29.yang" module ietf-bgp-flowspec { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-bgp-flowspec"; prefix bfs; /* * Import and Include */ import ietf-routing { prefix rt; reference "RFC 8349: A YANG Data Model for Routing Management Lin & Wang Expires 6 May 2027 [Page 9] Internet-Draft YANG Model for BGP Flowspec November 2026 (NMDA Version)"; } import ietf-inet-types { prefix inet; reference "RFC 9911: Common YANG Data Types"; } import ietf-yang-semver { prefix ysv; reference "RFC ZZZZ: YANG Semantic Versioning"; } import ietf-bgp { prefix bgp; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import iana-bgp-afi-safi-types { prefix bast; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } organization "IETF Inter-Domain Routing (IDR) Working Group"; contact "WG Web: WG List: IDR Author: Changwang Lin "; description "This module contains YANG definitions for the BGP Flow Specification address families. It extends the BGP YANG model defined in RFC XXXX with the IPv4 Flow Specification (AFI, SAFI = 1, 133) and IPv6 Flow Specification (AFI, SAFI = 2, 133) address families, per RFC 8955 and RFC 8956, and adds the corresponding RIB contents. Copyright (c) 2026 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents Lin & Wang Expires 6 May 2027 [Page 10] Internet-Draft YANG Model for BGP Flowspec November 2026 (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC YYYY; see the RFC itself for full legal notices. All revisions of IETF and IANA published modules can be found at the YANG Parameters registry group (https://www.iana.org/assignments/yang-parameters)."; revision 2026-10-29 { description "Initial Version"; ysv:version 0.0.1; reference "RFC YYYY: YANG Model for BGP Flow Specification"; } /* * Features. */ feature flowspec-redirect-ip { description "The implementation supports the Redirect-to-IP extended community as a Flow Specification action."; reference "RFC AAAA: BGP Flow-Spec Redirect-to-IP Action"; } /* * Identities. */ identity ipv4-flowspec { base bast:afi-safi-type; description "IPv4 Flow Specification (AFI, SAFI = 1, 133)."; reference "RFC 8955: Dissemination of Flow Specification Rules"; } identity ipv6-flowspec { base bast:afi-safi-type; description "IPv6 Flow Specification (AFI, SAFI = 2, 133)."; reference "RFC 8956: Dissemination of Flow Specification Rules for IPv6"; Lin & Wang Expires 6 May 2027 [Page 11] Internet-Draft YANG Model for BGP Flowspec November 2026 } /* * Typedefs. */ typedef component-type { type enumeration { enum destination-prefix { value 1; description "Destination prefix component (Type 1)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.1"; } enum source-prefix { value 2; description "Source prefix component (Type 2)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.2"; } enum ip-protocol { value 3; description "IP protocol component (Type 3)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.3"; } enum port { value 4; description "Port component (Type 4)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.4"; } enum destination-port { value 5; description "Destination port component (Type 5)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.5"; } Lin & Wang Expires 6 May 2027 [Page 12] Internet-Draft YANG Model for BGP Flowspec November 2026 enum source-port { value 6; description "Source port component (Type 6)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.6"; } enum icmp-type { value 7; description "ICMP type component (Type 7)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.7"; } enum icmp-code { value 8; description "ICMP code component (Type 8)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.8"; } enum tcp-flags { value 9; description "TCP flags component (Type 9)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.9"; } enum packet-length { value 10; description "Packet length component (Type 10)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.10"; } enum dscp { value 11; description "DSCP component (Type 11)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.11"; } Lin & Wang Expires 6 May 2027 [Page 13] Internet-Draft YANG Model for BGP Flowspec November 2026 enum fragment { value 12; description "Fragment component (Type 12)."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.12"; } enum flow-label { value 13; description "Flow label component (Type 13); IPv6 only."; reference "RFC 8956: Dissemination of Flow Specification Rules for IPv6, Section 3.7"; } } description "Type of a Flow Specification component. The value of the enumeration corresponds to the Flow Specification component type code defined in RFC 8955 and RFC 8956."; } typedef tcp-flags-bits { type bits { bit fin { position 0; description "FIN flag (bit position 0 in the wire-format octet, counted from the least significant bit)."; } bit syn { position 1; description "SYN flag (bit position 1)."; } bit rst { position 2; description "RST flag (bit position 2)."; } bit psh { position 3; description "PSH flag (bit position 3)."; } bit ack { position 4; Lin & Wang Expires 6 May 2027 [Page 14] Internet-Draft YANG Model for BGP Flowspec November 2026 description "ACK flag (bit position 4)."; } bit urg { position 5; description "URG flag (bit position 5)."; } bit ece { position 6; description "ECE flag (bit position 6)."; } bit cwr { position 7; description "CWR flag (bit position 7)."; } bit ns { position 8; description "Nonce Sum flag (bit position 8)."; } } description "TCP flags as defined in RFC 8955, Section 4.2.2.9. Bit positions follow the bit-numbering convention of RFC 8955, where bit 0 is the least significant bit of the TCP flags octet."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.9"; } typedef fragment-bits { type bits { bit dont-fragment { position 0; description "Match if the Don't Fragment (DF) bit is set."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.12"; } bit is-fragment { position 1; description "Match if the packet is a fragment other than the Lin & Wang Expires 6 May 2027 [Page 15] Internet-Draft YANG Model for BGP Flowspec November 2026 first fragment."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.12"; } bit first-fragment { position 2; description "Match if the packet is a first fragment."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.12"; } bit last-fragment { position 3; description "Match if the packet is a last fragment (IF bit defined in RFC 8956 for IPv6)."; reference "RFC 8956: Dissemination of Flow Specification Rules for IPv6, Section 3.6"; } } description "Fragment flags used by the fragment component (Type 12). For IPv4, the four bits map to the FF (fragment) bit-field of RFC 8955; for IPv6, the last-fragment bit corresponds to the IF (last fragment) bit introduced by RFC 8956."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 4.2.2.12 RFC 8956: Dissemination of Flow Specification Rules for IPv6, Section 3.6"; } typedef flow-spec-value-op { type bits { bit less-than { position 0; description "op bit 1: less-than."; } bit greater-than { position 1; description "op bit 2: greater-than."; } bit equal { Lin & Wang Expires 6 May 2027 [Page 16] Internet-Draft YANG Model for BGP Flowspec November 2026 position 2; description "op bit 3: equal."; } bit and { position 3; description "op bit 4: logical AND of the previous operand."; } bit not { position 4; description "op bit 5: negate this operand."; } } description "Numeric operator bits as encoded in the least significant 5 bits of the 'op' byte defined in Section 4.2.1 of RFC 8955."; } /* * Groupings. */ grouping numeric-operand { description "A single numeric operand as defined in Section 4.2.1 of RFC 8955, together with its operator bits."; leaf op { type flow-spec-value-op; description "Operator flags for this operand."; } leaf value { type uint16; description "Numeric operand value."; } } grouping flowspec-match { description "Flow Specification match components, keyed by the component type as defined in Section 4.2.2 of RFC 8955. A packet matches the Flow Specification when it matches all components present. The YANG tree models each component type as a distinct choice case; NLRI encoding Lin & Wang Expires 6 May 2027 [Page 17] Internet-Draft YANG Model for BGP Flowspec November 2026 follows the component type ordering rules of Section 4 of RFC 8955."; choice component { description "One of the Flow Specification component types. Only a single component of a given type code may be present in a Flow Specification rule, per Section 4.2 of RFC 8955."; case destination-prefix { leaf destination-prefix { type inet:ip-prefix; description "Destination prefix component (Type 1 for IPv4; Type 1 in the IPv6 Flow Specification NLRI per RFC 8956 with an expanded encoding when the prefix length exceeds 64 bits)."; } } case source-prefix { leaf source-prefix { type inet:ip-prefix; description "Source prefix component (Type 2 for IPv4; Type 2 in the IPv6 Flow Specification NLRI per RFC 8956 with an expanded encoding when the offset is non-zero)."; } } case ip-protocol { leaf-list ip-protocol { type uint8; description "IP protocol values (Type 3). Multiple values and negation are encoded per the numeric operator rules of RFC 8955, Section 4.2."; } } case port { leaf-list port { type inet:port-number; description "Source or destination port component (Type 4). Matches either the source or the destination TCP or UDP port of a packet."; } } case destination-port { Lin & Wang Expires 6 May 2027 [Page 18] Internet-Draft YANG Model for BGP Flowspec November 2026 leaf-list destination-port { type inet:port-number; description "Destination port component (Type 5)."; } } case source-port { leaf-list source-port { type inet:port-number; description "Source port component (Type 6)."; } } case icmp-type { leaf-list icmp-type { type uint8 { range "0..255"; } description "ICMP type component (Type 7)."; } } case icmp-code { leaf-list icmp-code { type uint8 { range "0..255"; } description "ICMP code component (Type 8)."; } } case tcp-flags { leaf tcp-flags { type tcp-flags-bits; description "TCP flags component (Type 9). The value is the byte used in the operand; the match/mask operator bits of RFC 8955 Section 4.2.1.2 apply."; } } case packet-length { leaf-list packet-length { type uint16; description "Packet length component (Type 10): the total IP packet length, excluding the Layer 2 framing but including the IP header."; } Lin & Wang Expires 6 May 2027 [Page 19] Internet-Draft YANG Model for BGP Flowspec November 2026 } case dscp { leaf-list dscp { type inet:dscp; description "DSCP component (Type 11)."; } } case fragment { leaf fragment { type fragment-bits; description "Fragment component (Type 12)."; } } case flow-label { leaf-list flow-label { type uint32 { range "0..1048575"; } description "IPv6 flow label component (Type 13), per RFC 8956. Applicable only to the IPv6 Flow Specification address family."; } } } } grouping flowspec-actions { description "Traffic filtering actions for a Flow Specification rule, encoded in Extended Communities as defined in Section 7 of RFC 8955."; container traffic-rate { description "Traffic rate action (transitive extended community, subtype 0x8006). The rate is expressed in bytes per second as IEEE 754 single-precision floating point."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 7.1"; leaf rate { type decimal64 { fraction-digits 12; } units "bytes per second"; Lin & Wang Expires 6 May 2027 [Page 20] Internet-Draft YANG Model for BGP Flowspec November 2026 description "Traffic rate in bytes per second. A rate of 0 will discard all traffic matched by the Flow Specification."; } leaf sample { type boolean; default "false"; description "When true, packets matching the Flow Specification must be sampled, per Section 7.3 of RFC 8955."; } leaf log { type boolean; default "false"; description "When true, matching packets must be logged, per Section 7.3 of RFC 8955."; } } container redirect { description "Redirect action. The Flow Specification rule redirects matching traffic to a VRF, to an IP address, or to another Next-Hop."; leaf route-target { type string { pattern '(0|([1-9][0-9]*)):[0-9]+|' + '(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|' + '25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|' + '2[0-4][0-9]|25[0-5]):([0-9]+)|' + '([0-9a-fA-F]{1,4}:){1,2}[0-9a-fA-F]{1,4}:[0-9]+'; } description "Route Target extended community of the VRF to which the traffic is redirected, per Section 7.4 of RFC 8955."; } leaf ip-address { if-feature "flowspec-redirect-ip"; type inet:ip-address; description "IPv4 or IPv6 address to which matching traffic is redirected, per the Redirect-to-IP action of RFC AAAA."; } } container traffic-marking { description Lin & Wang Expires 6 May 2027 [Page 21] Internet-Draft YANG Model for BGP Flowspec November 2026 "Traffic marking action (transitive extended community, subtype 0x8009), per Section 7.5 of RFC 8955."; leaf dscp { type inet:dscp; description "The DSCP value to set in transit IP packets. The value 0xffffffff (reserved) has no meaning in this model and is not used."; } } } /* * Data nodes. */ augment "/rt:routing/rt:control-plane-protocols/" + "rt:control-plane-protocol/bgp:bgp/bgp:global/" + "bgp:afi-safis/bgp:afi-safi" { when "derived-from-or-self(bgp:name, 'bfs:ipv4-flowspec') or " + "derived-from-or-self(bgp:name, 'bfs:ipv6-flowspec')" { description "This augmentation is valid for a Flow Specification AFI/SAFI instance."; } description "BGP Flow Specification specific configuration that applies to the global AFI/SAFI."; container flowspec { description "Flow Specification specific configuration for the AFI/SAFI."; uses bgp:mp-all-afi-safi-common; leaf validate-route-origin { type boolean; default "true"; description "When true, the local system applies the validation procedure of Section 6 of RFC 8955 (or the revised validation procedure of RFC 9117 when configured) to Flow Specification routes received from BGP peers."; reference "RFC 8955: Dissemination of Flow Specification Rules, Section 6 RFC 9117: Revised Validation Procedure for BGP Flow Specifications"; } Lin & Wang Expires 6 May 2027 [Page 22] Internet-Draft YANG Model for BGP Flowspec November 2026 } } augment "/rt:routing/rt:control-plane-protocols/" + "rt:control-plane-protocol/bgp:bgp/bgp:rib/" + "bgp:afi-safis/bgp:afi-safi" { when "derived-from-or-self(bgp:name, 'bfs:ipv4-flowspec') or " + "derived-from-or-self(bgp:name, 'bfs:ipv6-flowspec')" { description "This augmentation is valid for a Flow Specification AFI/SAFI instance."; } description "BGP Flow Specification RIB augmentation."; container flowspec { config false; description "Container for the BGP Flow Specification RIB."; container loc-rib { description "The Flow Specification Loc-RIB: the set of Flow Specifications selected for local enforcement."; container routes { config false; description "Enclosing container for the list of Flow Specification routes."; list route { key "flow-spec-components"; description "List of Flow Specification routes in the Loc-RIB, keyed by the encoded Flow Specification NLRI."; leaf flow-spec-components { type binary; description "The Flow Specification NLRI encoded per Section 4 of RFC 8955 (or Section 3 of RFC 8956 for IPv6), including the component type codes and operator/operand bytes. The encoding of a Flow Specification is canonical (components in strictly increasing type order per Section 4.2 of RFC 8955), so the encoded NLRI uniquely identifies the route across implementations."; } leaf active { Lin & Wang Expires 6 May 2027 [Page 23] Internet-Draft YANG Model for BGP Flowspec November 2026 type boolean; description "Indicates whether the Flow Specification is valid and enforced locally."; } uses bgp:bgp-common-route-annotations-state; uses bgp:bgp-loc-rib-common-attr-refs; uses bgp:rib-ext-route-annotations; } } } container neighbors { description "Enclosing container for the neighbor list."; list neighbor { key "neighbor-address"; description "List of Flow Specification neighbors of the local BGP speaker."; leaf neighbor-address { type inet:ip-address; description "IP address of the BGP neighbor or peer."; } container adj-rib-in-pre { description "Per-neighbor table containing the Flow Specification NLRI updates received from the neighbor before any local input policy rules have been applied."; uses flowspec-adj-rib; } container adj-rib-in-post { description "Per-neighbor table containing the Flow Specification paths received from the neighbor that are eligible for best-path selection after local input policy rules have been applied."; uses flowspec-adj-rib-in-post; } container adj-rib-out-pre { description "Per-neighbor table containing Flow Specification paths eligible for sending to the neighbor before output policy rules have been applied."; uses flowspec-adj-rib; } Lin & Wang Expires 6 May 2027 [Page 24] Internet-Draft YANG Model for BGP Flowspec November 2026 container adj-rib-out-post { description "Per-neighbor table containing Flow Specification paths eligible for sending to the neighbor after output policy rules have been applied."; uses flowspec-adj-rib; } } } } } grouping flowspec-adj-rib { description "Common structural grouping for each Flow Specification Adj-RIB table."; container routes { config false; description "Enclosing container for the list of Flow Specification routes in the routing table."; list route { key "flow-spec-components path-id"; description "List of Flow Specification routes in the table, keyed by the Flow Specification NLRI and path-id to distinguish multiple routes for the same NLRI (e.g., when BGP add-paths is enabled)."; leaf flow-spec-components { type binary; description "The Flow Specification NLRI encoded per Section 4 of RFC 8955 (or Section 3 of RFC 8956 for IPv6), including the component type codes and operator/operand bytes. The encoding of a Flow Specification is canonical (components in strictly increasing type order per Section 4.2 of RFC 8955), so the encoded NLRI uniquely identifies the route across implementations."; } uses bgp:bgp-adj-rib-attr-state; uses bgp:bgp-adj-rib-common-attr-refs; uses bgp:bgp-common-route-annotations-state; uses bgp:bgp-unknown-attr-top; uses bgp:rib-ext-route-annotations; } } Lin & Wang Expires 6 May 2027 [Page 25] Internet-Draft YANG Model for BGP Flowspec November 2026 } grouping flowspec-adj-rib-in-post { description "Common structural grouping for the Flow Specification Adj-RIB-In post-policy table."; container routes { config false; description "Enclosing container for the list of Flow Specification routes in the routing table."; list route { key "flow-spec-components path-id"; description "List of Flow Specification routes in the table, keyed by the Flow Specification NLRI and path-id to distinguish multiple routes for the same NLRI (e.g., when BGP add-paths is enabled)."; leaf flow-spec-components { type binary; description "The Flow Specification NLRI encoded per Section 4 of RFC 8955 (or Section 3 of RFC 8956 for IPv6), including the component type codes and operator/operand bytes. The encoding of a Flow Specification is canonical (components in strictly increasing type order per Section 4.2 of RFC 8955), so the encoded NLRI uniquely identifies the route across implementations."; } uses bgp:bgp-adj-rib-attr-state; uses bgp:bgp-adj-rib-common-attr-refs; uses bgp:bgp-common-route-annotations-state; uses bgp:bgp-adj-rib-in-post-route-annotations-state; uses bgp:bgp-unknown-attr-top; uses bgp:rib-ext-route-annotations; } } } } 5. Security Considerations This section is modeled after the template described in Section 3.7.1 of [RFC9907]. Lin & Wang Expires 6 May 2027 [Page 26] Internet-Draft YANG Model for BGP Flowspec November 2026 The "ietf-bgp-flowspec" YANG module defines a data model that is designed to be accessed via YANG-based management protocols, such as Network Configuration Protocol (NETCONF) [RFC6241] and RESTCONF [RFC8040]. These YANG-based management protocols (1) have to use a secure transport layer (e.g., Secure Shell (SSH) [RFC4252], TLS [RFC9846]) and (2) have to use mutual authentication. The Network Configuration Access Control Model (NACM) [RFC8341] provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. There are a number of data nodes defined in this YANG module that are writable/creatable/deletable (i.e., config true, which is the default). All writable data nodes are likely to be sensitive or vulnerable in some network environments. Write operations (e.g., edit-config) and delete operations to these data nodes without proper protection or authentication can have a negative effect on network operations. In particular, the ability to enable or disable a Flowspec address family, to change the 'validate-route-origin' setting, or to modify prefix limits may lead to traffic being filtered, redirected, or dropped. The following subtrees and data nodes have particular sensitivities/vulnerabilities: bfs:flowspec/bfs:prefix-limit bfs:flowspec/bfs:validate-route-origin Disabling 'validate-route-origin' weakens the validation procedure of Section 6 of [RFC8955], allowing unvalidated Flowspec routes to affect traffic handling. Changing prefix limits may cause BGP sessions to be torn down or allow an excessive number of Flowspec routes to be installed, exhausting device resources. Some of the readable data nodes in this YANG module may be considered sensitive or vulnerable in some network environments. It is thus important to control read access (e.g., via get, get-config, or notification) to these data nodes. The Flowspec RIB contents (the 'flow-spec-components' NLRI, the per-neighbor Adj-RIB tables, and the route annotations) reveal traffic filtering policy information about the network, which may be considered sensitive. The following subtrees and data nodes have particular sensitivities/ vulnerabilities: Lin & Wang Expires 6 May 2027 [Page 27] Internet-Draft YANG Model for BGP Flowspec November 2026 /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/ bgp:bgp/bgp:rib/bgp:afi-safis/bgp:afi-safi/bfs:flowspec/bfs:loc-rib /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/ bgp:bgp/bgp:rib/bgp:afi-safis/bgp:afi-safi/bfs:flowspec/ bfs:neighbors There are no particularly sensitive RPC or action operations. The Flowspec mechanism itself allows traffic to be filtered or redirected on the basis of rules disseminated via BGP; the security considerations of [RFC8955], [RFC8956], and [RFC9117] apply to any deployment that uses the data model defined in this document. 6. IANA Considerations 6.1. BGP Flow Specification YANG Module Registry IANA is requested to register the following URI in the "ns" registry within the "IETF XML Registry" group ([RFC3688]): URI: urn:ietf:params:xml:ns:yang:ietf-bgp-flowspec Registrant Contact: The IESG. XML: N/A; the requested URI is an XML namespace IANA is requested to register the following YANG module in the "YANG Module Names" registry ([RFC6020]) within the "YANG Parameters" registry group. Name: ietf-bgp-flowspec Maintained by IANA? N Namespace: urn:ietf:params:xml:ns:yang:ietf-bgp-flowspec Prefix: bfs Reference: RFC YYYY 7. References 7.1. Normative References [I-D.ietf-idr-bgp-model] Jethanandani, M., Patel, K., Hares, S., and J. Haas, "YANG Model for Border Gateway Protocol (BGP-4)", Work in Progress, Internet-Draft, draft-ietf-idr-bgp-model-23, 30 October 2026, . Lin & Wang Expires 6 May 2027 [Page 28] Internet-Draft YANG Model for BGP Flowspec November 2026 [I-D.ietf-idr-flowspec-redirect-ip] Haas, J., Henderickx, W., and A. Simpson, "BGP Flow-Spec Redirect-to-IP Action", Work in Progress, Internet-Draft, draft-ietf-idr-flowspec-redirect-ip-16, 21 May 2026, . [I-D.ietf-netmod-yang-semver] Clarke, J., Ed., Wilton, R., Ed., Rahman, R., Lengyel, B., Sterne, J., and B. Claise, "YANG Semantic Versioning", Work in Progress, Internet-Draft, draft-ietf-netmod-yang- semver-29, 6 October 2026, . [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004, . [RFC4252] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Authentication Protocol", RFC 4252, DOI 10.17487/RFC4252, January 2006, . [RFC4760] Bates, T., Chandra, R., Katz, D., and Y. Rekhter, "Multiprotocol Extensions for BGP-4", RFC 4760, DOI 10.17487/RFC4760, January 2007, . [RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI 10.17487/RFC6020, October 2010, . [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, . [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016, . [RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017, . Lin & Wang Expires 6 May 2027 [Page 29] Internet-Draft YANG Model for BGP Flowspec November 2026 [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, . [RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration Access Control Model", STD 91, RFC 8341, DOI 10.17487/RFC8341, March 2018, . [RFC8349] Lhotka, L., Lindem, A., and Y. Qu, "A YANG Data Model for Routing Management (NMDA Version)", RFC 8349, DOI 10.17487/RFC8349, March 2018, . [RFC8955] Loibl, C., Hares, S., Raszuk, R., McPherson, D., and M. Bacher, "Dissemination of Flow Specification Rules", RFC 8955, DOI 10.17487/RFC8955, December 2020, . [RFC8956] Loibl, C., Ed., Raszuk, R., Ed., and S. Hares, Ed., "Dissemination of Flow Specification Rules for IPv6", RFC 8956, DOI 10.17487/RFC8956, December 2020, . [RFC9117] Uttaro, J., Alcaide, J., Filsfils, C., Smith, D., and P. Mohapatra, "Revised Validation Procedure for BGP Flow Specifications", RFC 9117, DOI 10.17487/RFC9117, August 2021, . [RFC9846] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 9846, DOI 10.17487/RFC9846, July 2026, . [RFC9911] Schowalder, J., Ed., "Common YANG Data Types", RFC 9911, DOI 10.17487/RFC9911, December 2025, . 7.2. Informative References [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border Gateway Protocol 4 (BGP-4)", RFC 4271, DOI 10.17487/RFC4271, January 2006, . [RFC9067] Qu, Y., Tantsura, J., Lindem, A., and X. Liu, "A YANG Data Model for Routing Policy", RFC 9067, DOI 10.17487/RFC9067, October 2021, . Lin & Wang Expires 6 May 2027 [Page 30] Internet-Draft YANG Model for BGP Flowspec November 2026 [RFC9907] Bierman, A., Boucadair, M., Ed., and Q. Wu, "Guidelines for Authors and Reviewers of Documents Containing YANG Data Models", BCP 216, RFC 9907, DOI 10.17487/RFC9907, March 2026, . Appendix A. Full Tree of BGP Flow Specification YANG Module module: ietf-bgp-flowspec augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi: +--rw flowspec +--rw prefix-limit | +--rw max-prefixes? uint32 | +--rw warning-threshold-pct? rt-types:percentage | +--rw teardown? boolean | +--rw idle-time? union | +--ro prefix-limit-exceeded? boolean +--rw validate-route-origin? boolean augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib/bgp:afi-safis /bgp:afi-safi: +--ro flowspec +--ro loc-rib | +--ro routes | +--ro route* [flow-spec-components] | +--ro flow-spec-components binary | +--ro active? boolean | +--ro last-modified? yang:timeticks | +--ro eligible-route? boolean | +--ro ineligible-reason? identityref | +--ro attr-index? leafref | +--ro community-index? leafref | +--ro ext-community-index? leafref | +--ro large-community-index? leafref | +--ro reject-reason? union +--ro neighbors +--ro neighbor* [neighbor-address] +--ro neighbor-address inet:ip-address +--ro adj-rib-in-pre | +--ro routes | +--ro route* [flow-spec-components path-id] | +--ro flow-spec-components binary | +--ro path-id uint32 | +--ro attr-index? leafref | +--ro community-index? leafref | +--ro ext-community-index? leafref Lin & Wang Expires 6 May 2027 [Page 31] Internet-Draft YANG Model for BGP Flowspec November 2026 | +--ro large-community-index? leafref | +--ro last-modified? yang:timeticks | +--ro eligible-route? boolean | +--ro ineligible-reason? identityref | +--ro unknown-attributes | | +--ro unknown-attribute* [attr-type] | | +--ro optional? boolean | | +--ro transitive? boolean | | +--ro partial? boolean | | +--ro extended? boolean | | +--ro attr-type uint8 | | +--ro attr-len? uint16 | | +--ro attr-value? binary | +--ro reject-reason? union +--ro adj-rib-in-post | +--ro routes | +--ro route* [flow-spec-components path-id] | +--ro flow-spec-components binary | +--ro path-id uint32 | +--ro attr-index? leafref | +--ro community-index? leafref | +--ro ext-community-index? leafref | +--ro large-community-index? leafref | +--ro last-modified? yang:timeticks | +--ro eligible-route? boolean | +--ro ineligible-reason? identityref | +--ro best-path? boolean | +--ro unknown-attributes | | +--ro unknown-attribute* [attr-type] | | +--ro optional? boolean | | +--ro transitive? boolean | | +--ro partial? boolean | | +--ro extended? boolean | | +--ro attr-type uint8 | | +--ro attr-len? uint16 | | +--ro attr-value? binary | +--ro reject-reason? union +--ro adj-rib-out-pre | +--ro routes | +--ro route* [flow-spec-components path-id] | +--ro flow-spec-components binary | +--ro path-id uint32 | +--ro attr-index? leafref | +--ro community-index? leafref | +--ro ext-community-index? leafref | +--ro large-community-index? leafref | +--ro last-modified? yang:timeticks | +--ro eligible-route? boolean Lin & Wang Expires 6 May 2027 [Page 32] Internet-Draft YANG Model for BGP Flowspec November 2026 | +--ro ineligible-reason? identityref | +--ro unknown-attributes | | +--ro unknown-attribute* [attr-type] | | +--ro optional? boolean | | +--ro transitive? boolean | | +--ro partial? boolean | | +--ro extended? boolean | | +--ro attr-type uint8 | | +--ro attr-len? uint16 | | +--ro attr-value? binary | +--ro reject-reason? union +--ro adj-rib-out-post +--ro routes +--ro route* [flow-spec-components path-id] +--ro flow-spec-components binary +--ro path-id uint32 +--ro attr-index? leafref +--ro community-index? leafref +--ro ext-community-index? leafref +--ro large-community-index? leafref +--ro last-modified? yang:timeticks +--ro eligible-route? boolean +--ro ineligible-reason? identityref +--ro unknown-attributes | +--ro unknown-attribute* [attr-type] | +--ro optional? boolean | +--ro transitive? boolean | +--ro partial? boolean | +--ro extended? boolean | +--ro attr-type uint8 | +--ro attr-len? uint16 | +--ro attr-value? binary +--ro reject-reason? union Authors' Addresses Changwang Lin New H3C Technologies China Email: linchangwang.04414@h3c.com Aijun Wang China Telecom Beiqijia Town, Changping District Beijing Beijing, 102209 China Lin & Wang Expires 6 May 2027 [Page 33] Internet-Draft YANG Model for BGP Flowspec November 2026 Email: wangaj3@chinatelecom.cn Lin & Wang Expires 6 May 2027 [Page 34]