IDR Working Group Y. Liu Internet Draft China Mobile Intended status: Standards Track C. Lin Expires: April 21, 2025 New H3C Technologies H. Wang Huawei J. Roy J. Haas Juniper Networks, Inc. H. Liu ZTE D. Ma ZDNS October 21, 2024 YANG Data Model for BGP about RPKI draft-liu-idr-bgp-rpki-yang-00 Abstract This document defines YANG data models for configuring and managing BGP information about Resource Public Key Infrastructure (RPKI). Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on April 21, 2025. Copyright Notice Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of Liu, et al. Expire April 21, 2025 [Page 1] Internet-Draft YANG Data Model for BGP about RPKI October 2024 publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction...................................................2 1.1. Terminology...............................................3 2. Model Overview.................................................3 3. BGP Origin AS Validation YANG Module...........................3 3.1. Tree View.................................................3 3.2. Yang Module...............................................8 4. BGPSec YANG Module............................................19 4.1. Tree View................................................19 4.2. Yang Module..............................................22 5. BGP ASPA YANG Module..........................................28 5.1. Tree View................................................28 5.2. Yang Module..............................................31 6. Security Considerations.......................................38 7. IANA Considerations...........................................38 8. References....................................................38 8.1. Normative References.....................................38 8.2. Informative References...................................39 Contributors.....................................................40 Authors' Addresses...............................................40 1. Introduction [RFC6810] and [RFC8210] describes a protocol to deliver Resource Public Key Infrastructure (RPKI) prefix origin data and router keys from a trusted cache server to a router, referred to as RPKI-Router protocol. [I-D.ietf-sidrops-8210bis] updates [RFC8210]. [RFC6811] validates the origination Autonomous System (AS) of BGP routes based on the Validated ROA Payload (VRP) received from the RPKI cache server. [I-D.ietf-sidrops-aspa-verification] makes use of Autonomous System Provider Authorization (ASPA) objects in the Resource Public Key Infrastructure (RPKI) to verify the Border Gateway Protocol (BGP) AS_PATH attribute of advertised routes. [RFC8635] describes that the public key is published in the Resource Liu, et al. Expires April 21, 2025 [Page 2] Internet-Draft YANG Data Model for BGP about RPKI October 2024 Public Key Infrastructure (RPKI) and sent to the router via the RPKI to Router protocol for verifying the signature of BGPsec announcements. This document defines YANG [RFC7950] data models for configuring and managing BGP information about RPKI. 1.1. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2. Model Overview Three YANG data models are defined in this document. The ietf-bgp-origin-as-validation.yang data model provides the methods for configuring BGP origin AS validation. o Origin AS validation parameters for BGP routes. o Origin AS validity states of BGP routes. The ietf-bgp-sec.yang data model provides the methods for configuring BGPSec. o BGPSec parameters for BGP routes. o BGPSec validity states of BGP routes. The ietf-bgp-aspa.yang data model provides the methods for configuring BGP AS PATH Verification Based on ASPA. o BGP ASPA parameters for BGP routes. o AS PATH validity states of BGP routes. 3. BGP Origin AS Validation YANG Module 3.1. Tree View The complete tree of the ietf-bgp-origin-as-validation.yang data model is represented as following. See [RFC8340] for an explanation of the symbols used. Liu, et al. Expires April 21, 2025 [Page 3] Internet-Draft YANG Data Model for BGP about RPKI October 2024 module: ietf-bgp-origin-as-validation augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast: +--rw origin-as-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref +--rw redistribution-as? inet:as-number augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast: +--rw origin-as-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref +--rw redistribution-as? inet:as-number augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:rib-in-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:rib-in-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib/bgp:afi-safis /bgp:afi-safi/bgp:ipv4-unicast /bgp:rib-in-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 Liu, et al. Expires April 21, 2025 [Page 4] Internet-Draft YANG Data Model for BGP about RPKI October 2024 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:rib-in-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast/bgp:loc- rib: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast/bgp:loc- rib: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:rib-out-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:rib-out-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 Liu, et al. Expires April 21, 2025 [Page 5] Internet-Draft YANG Data Model for BGP about RPKI October 2024 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:rib-out-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:rib-out-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro origin-as-validity? origin-as-validity-state +--ro validity-invalid-reason? route-validity-invalid-reason augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro origin-as-validity? origin-as-validity-state +--ro validity-invalid-reason? route-validity-invalid-reason augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options: +--rw origin-as +--rw enabled? boolean +--rw allow-invalid? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi Liu, et al. Expires April 21, 2025 [Page 6] Internet-Draft YANG Data Model for BGP about RPKI October 2024 /bgp:ipv4-unicast: +--rw send-origin-as-validity? boolean +--rw export-origin-as-validation | +--rw enabled? boolean | +--rw allow-not-found? boolean | +--rw eligible-prefix-policy? leafref +--rw statistics +--rw validation-state-unverified? yang:gauge32 +--rw validation-state-unknown? yang:gauge32 +--rw validation-state-invalid? yang:gauge32 +--rw validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw send-origin-as-validity? boolean +--rw export-origin-as-validation | +--rw enabled? boolean | +--rw allow-not-found? boolean | +--rw eligible-prefix-policy? leafref +--rw statistics +--rw validation-state-unverified? yang:gauge32 +--rw validation-state-unknown? yang:gauge32 +--rw validation-state-invalid? yang:gauge32 +--rw validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw send-origin-as-validity? boolean +--rw export-origin-as-validation +--rw enabled? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw send-origin-as-validity? boolean +--rw export-origin-as-validation +--rw enabled? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? leafref Liu, et al. Expires April 21, 2025 [Page 7] Internet-Draft YANG Data Model for BGP about RPKI October 2024 3.2. Yang Module file "ietf-bgp-origin-as-validation@2022-10-18.yang" module ietf-bgp-origin-as-validation { yang-version "1.1"; namespace "urn:ietf:params:xml:ns:yang:" + "ietf-bgp-origin-as-validation"; prefix "oav"; import ietf-yang-types { prefix "yang"; reference "RFC 6991: Common YANG Data Types."; } import ietf-inet-types { prefix "inet"; reference "RFC 6991: Common YANG Data Types"; } import ietf-routing { prefix "rt"; reference "RFC 8349, A YANG Data Model for Routing Management (NMDA Version)."; } import ietf-bgp { prefix "bgp"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import iana-bgp-types { prefix "bt"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import iana-bgp-rib-types { prefix "brt"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import ietf-routing-policy { Liu, et al. Expires April 21, 2025 [Page 8] Internet-Draft YANG Data Model for BGP about RPKI October 2024 prefix rt-pol; reference "RFC 9067: A YANG Data Model for Routing Policy Management."; } organization "IETF SIDROPS Working Group"; contact "TBD"; description "This module describes configuration of the BGP origin AS validation. This YANG model conforms to the Network Management Datastore Architecture (NMDA) as described in RFC 8342. Copyright (c) 2022 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here."; reference "RFC XXXX"; revision 2022-10-18 { description "Initial Version"; reference "RFC XXXX, YANG Data Model for RPKI to Router Protocol"; } identity ineligible-orgin-as { base brt:ineligible-route-reason; Liu, et al. Expires April 21, 2025 [Page 9] Internet-Draft YANG Data Model for BGP about RPKI October 2024 description "Route was ineligible due to origin as validation"; } typedef route-validity-invalid-reason { type enumeration { enum ineligible-orgin-as { description "Route was ineligible due to origin as validation"; } enum ineligible-max-len { description "Route was ineligible due to max-length of the prefix as validation"; } } description "Origin AS validation state invalid reason of BGP routes."; } typedef origin-as-validity-state { type enumeration { enum not-found { description "No VRP Covers the Route Prefix."; } enum valid { description "At least one VRP Matches the Route Prefix."; } enum invalid { description "At least one VRP Covers the Route Prefix, but no VRP Matches it."; } enum disabled { description "BGP origin AS validation is not enabled."; } } description "Origin AS validation state of BGP routes."; reference "RFC 6811, BGP Prefix Origin Validation."; } grouping origin-as-validation-config { description Liu, et al. Expires April 21, 2025 [Page 10] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "Origin AS validation of BGP prefix."; container origin-as-validation { leaf enabled { type boolean; default "false"; description "Whether origin-AS validation of BGP prefix is enabled."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which Origin AS validation is enabled."; } leaf redistribution-as { type inet:as-number; description "Uses this AS number in the origin-AS validation for redistributed routes since they have no AS-PATH."; reference "RFC 8481, Clarifications to BGP Origin Validation Based on Resource Public Key Infrastructure (RPKI)."; } description "Origin AS validation of BGP prefix."; } } grouping origin-as-selection-option { description "Origin AS option for BGP route selection."; container origin-as { leaf enabled { type boolean; default "false"; description "When enabled allows the origin AS validity states to be taken into consideration in the best-path calculation."; } leaf allow-invalid { type boolean; default "false"; description "When enabled allows the route with 'invalid' origin AS Liu, et al. Expires April 21, 2025 [Page 11] Internet-Draft YANG Data Model for BGP about RPKI October 2024 to be taken into consideration in the best-path calculation."; } leaf allow-not-found { type boolean; default "true"; description "When enabled allows the route with 'not-found' origin AS to be taken into consideration in the best-path calculation."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which Origin AS option is enabled for BGP route selection."; } description "Origin AS option for BGP route selection."; } } grouping origin-as-validity-advertisement { description "Advertisement of Origin Validation State Extended Community to neighbor(s)."; leaf send-origin-as-validity { type boolean; default "false"; description "If set to true, send the origin AS validity to the neighbor(s) using Origin Validation State Extended Community"; reference "RFC 8097, BGP Prefix Origin Validation State Extended Community."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to Liu, et al. Expires April 21, 2025 [Page 12] Internet-Draft YANG Data Model for BGP about RPKI October 2024 restrict the prefixes for which Origin Validation State Extended Community is advertised."; } } grouping export-origin-as-validation-config { description "Export Origin AS validation of BGP prefix."; container export-origin-as-validation { leaf enabled { type boolean; default "false"; description "When enabled allows the origin AS validity states to be taken into consideration in BGP export."; } leaf allow-not-found { type boolean; default "false"; description "When enabled allows the route with 'not-found' origin AS to be sent to the neighbor."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which Origin AS validity states are considered in BGP export."; } description "Export Origin AS validation of BGP prefix."; reference "RFC 8893, Resource Public Key Infrastructure (RPKI) Origin Validation for BGP Export."; } } grouping origin-as-validity-statistics { description "Origin-AS validation statistics."; container statistics { leaf validation-state-unverified { type yang:gauge32; description Liu, et al. Expires April 21, 2025 [Page 13] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "The number of routes with validation state as unverified."; } leaf validation-state-unknown { type yang:gauge32; description "The number of routes with validation state as unknown."; } leaf validation-state-invalid { type yang:gauge32; description "The number of routes with validation state as invalid."; } leaf validation-state-valid { type yang:gauge32; description "The number of routes with validation state as valid."; } description "Statistical data for Origin-AS validation states."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" { description "Origin AS validation augmentation of BGP IPv4 Unicast Address Family."; uses origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" { description "Origin AS validation augmentation of BGP IPv6 Unicast Address Family."; uses origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:rib-in-pre" { description Liu, et al. Expires April 21, 2025 [Page 14] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:rib-in-pre" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:rib-in-post" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:rib-in-post" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" Liu, et al. Expires April 21, 2025 [Page 15] Internet-Draft YANG Data Model for BGP about RPKI October 2024 + "/bgp:loc-rib" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:rib-out-pre" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:rib-out-pre" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:rib-out-post" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:rib-out-post" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" Liu, et al. Expires April 21, 2025 [Page 16] Internet-Draft YANG Data Model for BGP about RPKI October 2024 + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "Origin AS validity augmentation of BGP IPv4 Unicast route."; leaf origin-as-validity { type origin-as-validity-state; description "Origin AS validity of BGP IPv4 Unicast prefix"; } leaf validity-invalid-reason { type route-validity-invalid-reason; description "Reason for marking a BGP IPv4 Unicast prefix as invalid"; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "Origin AS validity augmentation of BGP IPv6 Unicast route."; leaf origin-as-validity { type origin-as-validity-state; description "Origin AS validity of BGP IPv6 Unicast prefix"; } leaf validity-invalid-reason { type route-validity-invalid-reason; description "Reason for marking a BGP IPv6 Unicast prefix as invalid"; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi" + "/bgp:route-selection-options" { when "derived-from-or-self(../bgp:name, 'bt:ipv4-unicast') or " + "derived-from-or-self(../bgp:name, 'bt:ipv6-unicast')" { description "This augmentation is valid for IPv4 and IPv6 Unicast."; } Liu, et al. Expires April 21, 2025 [Page 17] Internet-Draft YANG Data Model for BGP about RPKI October 2024 description "augmentation of BGP route selection options"; uses origin-as-selection-option; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "augmentation of Origin Validation State Extended Community advertisement for IPv4 Unicast neighbor"; uses origin-as-validity-advertisement; uses export-origin-as-validation-config; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "augmentation of Origin Validation State Extended Community advertisement for IPv6 Unicast neighbor"; uses origin-as-validity-advertisement; uses export-origin-as-validation-config; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "augmentation of Origin Validation State Extended Community advertisement for IPv4 Unicast peer group"; uses origin-as-validity-advertisement; uses export-origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "augmentation of Origin Validation State Extended Community advertisement for IPv6 Unicast peer group"; uses origin-as-validity-advertisement; Liu, et al. Expires April 21, 2025 [Page 18] Internet-Draft YANG Data Model for BGP about RPKI October 2024 uses export-origin-as-validation-config; } } 4. BGPSec YANG Module 4.1. Tree View The complete tree of the ietf-bgp-sec.yang data model is represented as following. See [RFC8340] for an explanation of the symbols used. Liu, et al. Expires April 21, 2025 [Page 19] Internet-Draft YANG Data Model for BGP about RPKI October 2024 module: ietf-bgp-sec augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast: +--rw bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast: +--rw bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro bgpsec-validity? bgpsec-validity-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro bgpsec-validity? bgpsec-validity-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options: +--rw bgpsec +--rw enabled? boolean +--rw allow-invalid? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: Liu, et al. Expires April 21, 2025 [Page 20] Internet-Draft YANG Data Model for BGP about RPKI October 2024 +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref Liu, et al. Expires April 21, 2025 [Page 21] Internet-Draft YANG Data Model for BGP about RPKI October 2024 4.2. Yang Module file "ietf-bgp-sec@2022-10-18.yang" module ietf-bgp-sec { yang-version "1.1"; namespace "urn:ietf:params:xml:ns:yang:" + "ietf-bgp-sec"; prefix "oav"; import ietf-routing { prefix "rt"; reference "RFC 8349, A YANG Data Model for Routing Management (NMDA Version)."; } import ietf-bgp { prefix "bgp"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import iana-bgp-types { prefix "bt"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import iana-bgp-rib-types { prefix "brt"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import ietf-routing-policy { prefix rt-pol; reference "RFC 9067: A YANG Data Model for Routing Policy Management."; } organization "IETF SIDROPS Working Group"; contact "TBD"; description Liu, et al. Expires April 21, 2025 [Page 22] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "This module describes configuration of BGPsec. This YANG model conforms to the Network Management Datastore Architecture (NMDA) as described in RFC 8342. Copyright (c) 2022 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here."; reference "RFC XXXX"; revision 2022-10-18 { description "Initial Version"; reference "RFC XXXX, YANG Data Model for RPKI to Router Protocol"; } identity ineligible-bgp { base brt:ineligible-route-reason; description "Route was ineligible due to bgpsec"; } typedef bgpsec-validity-state { type enumeration { enum valid { description "The BGPsec UPDATE message is valid."; } enum invalid { description "The BGPsec UPDATE message is invalid."; Liu, et al. Expires April 21, 2025 [Page 23] Internet-Draft YANG Data Model for BGP about RPKI October 2024 } enum disabled { description "BGPsec validation is not enabled."; } } description "BGPsec validation state of BGP routes."; reference "RFC 8205, BGPsec Protocol Specification."; } grouping bgpsec-validation-config { description "BGPsec validation of BGP prefix."; container bgpsec-validation { leaf enabled { type boolean; default "false"; description "Whether BGPsec validation of BGP prefix is enabled."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which BGPsec validation is enabled."; } description "BGPsec validation of BGP prefix."; } } grouping bgpsec-selection-option { description "BGPsec option for BGP route selection."; container bgpsec { leaf enabled { type boolean; default "false"; description "When enabled allows the BGPsec validity states to be taken into consideration in the best-path calculation."; } Liu, et al. Expires April 21, 2025 [Page 24] Internet-Draft YANG Data Model for BGP about RPKI October 2024 leaf allow-invalid { type boolean; default "false"; description "When enabled allows the route with 'invalid' BGPsec to be taken into consideration in the best-path calculation."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which BGPsec option is enabled in BGP route selection."; } description "BGPsec option for BGP route selection."; } } grouping export-bgpsec-validation-config { description "Export BGPsec validation of BGP prefix."; container export-bgpsec-validation { leaf enabled { type boolean; default "false"; description "When enabled allows the BGPsec validity states to be taken into consideration in BGP export."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which BGPsec validity states are considered in BGP export."; } description "Export BGPsec validation of BGP prefix."; } } Liu, et al. Expires April 21, 2025 [Page 25] Internet-Draft YANG Data Model for BGP about RPKI October 2024 augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" { description "BGPSec augmentation of BGP IPv4 Unicast Address Family."; uses bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" { description " BGPSec augmentation of BGP IPv6 Unicast Address Family."; uses bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description " BGPSec augmentation of BGP IPv4 Unicast route."; leaf bgpsec-validity { type bgpsec-validity-state; description "BGPsec validity of BGP IPv4 Unicast prefix"; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "BGPSec augmentation of BGP IPv6 Unicast route."; leaf bgpsec-validity { type bgpsec-validity-state; description "BGPsec validity of BGP IPv6 Unicast prefix"; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi" + "/bgp:route-selection-options" { when "derived-from-or-self(../bgp:name, 'bt:ipv4-unicast') or " Liu, et al. Expires April 21, 2025 [Page 26] Internet-Draft YANG Data Model for BGP about RPKI October 2024 + "derived-from-or-self(../bgp:name, 'bt:ipv6-unicast')" { description "This augmentation is valid for IPv4 and IPv6 Unicast."; } description "augmentation of BGP route selection options"; uses bgpsec-selection-option; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "augmentation of BGPSec for IPv4 Unicast neighbor"; uses export-bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "augmentation of BGPSec for IPv6 Unicast neighbor"; uses export-bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "augmentation of BGPSec for IPv4 Unicast peer group"; uses export-bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "augmentation of BGPSec for IPv6 Unicast peer group"; uses export-bgpsec-validation-config; } } Liu, et al. Expires April 21, 2025 [Page 27] Internet-Draft YANG Data Model for BGP about RPKI October 2024 5. BGP ASPA YANG Module 5.1. Tree View The complete tree of the ietf-bgp-aspa.yang data model is represented as following. See [RFC8340] for an explanation of the symbols used. Liu, et al. Expires April 21, 2025 [Page 28] Internet-Draft YANG Data Model for BGP about RPKI October 2024 module: ietf-bgp-aspa augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor: +--rw peer-role? peer-role augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group: +--rw peer-role? peer-role augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast: +--rw aspa-verification +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast: +--rw aspa-verification +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro aspa-verification-state? aspa-verification-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro aspa-verification-state? aspa-verification-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options: +--rw aspa +--rw enabled? boolean +--rw allow-invalid? boolean +--rw allow-unknown? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols Liu, et al. Expires April 21, 2025 [Page 29] Internet-Draft YANG Data Model for BGP about RPKI October 2024 /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? leafref Liu, et al. Expires April 21, 2025 [Page 30] Internet-Draft YANG Data Model for BGP about RPKI October 2024 5.2. Yang Module file "ietf-bgp-aspa@2022-10-18.yang" module ietf-bgp-aspa { yang-version "1.1"; namespace "urn:ietf:params:xml:ns:yang:" + "ietf-bgp-aspa"; prefix "oav"; import ietf-routing { prefix "rt"; reference "RFC 8349, A YANG Data Model for Routing Management (NMDA Version)."; } import ietf-bgp { prefix "bgp"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import iana-bgp-types { prefix "bt"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import iana-bgp-rib-types { prefix "brt"; reference "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)"; } import ietf-routing-policy { prefix rt-pol; reference "RFC 9067: A YANG Data Model for Routing Policy Management."; } organization "IETF SIDROPS Working Group"; contact "TBD"; description Liu, et al. Expires April 21, 2025 [Page 31] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "This module describes configuration of the BGP AS PATH Verification Based on ASPA. This YANG model conforms to the Network Management Datastore Architecture (NMDA) as described in RFC 8342. Copyright (c) 2022 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here."; reference "RFC XXXX"; revision 2022-10-18 { description "Initial Version"; reference "RFC XXXX, YANG Data Model for RPKI to Router Protocol"; } identity ineligible-aspa { base brt:ineligible-route-reason; description "Route was ineligible due to ASPA verification"; } typedef peer-role { type enumeration { enum customer { description "The role of the BGP peer is customer."; } enum provider { description Liu, et al. Expires April 21, 2025 [Page 32] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "The role of the BGP peer is provider."; } enum lateral-peer { description "The role of the BGP peer is lateral peer."; } enum rs { description "The role of the BGP peer is Route Server (RS)."; } enum rs-client { description "The role of the BGP peer is RS-client."; } enum mutual-transit { description "The role of the BGP peer is mutual-transit."; } } description "Roles of BGP peers."; reference "RFC XXXX, BGP AS_PATH Verification Based on Autonomous System Provider Authorization (ASPA) Objects."; } typedef aspa-verification-state { type enumeration { enum valid { description "The ASPA verification outcome is valid."; } enum invalid { description "The ASPA verification outcome is invalid."; } enum unknown { description "The ASPA verification outcome is unknown."; } enum disabled { description "BGP ASPA verification is not enabled."; } } description "ASPA verification state of BGP routes."; reference Liu, et al. Expires April 21, 2025 [Page 33] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "RFC XXXX, BGP AS_PATH Verification Based on Autonomous System Provider Authorization (ASPA) Objects."; } grouping aspa-config { description "ASPA verification of BGP prefix."; container aspa-verification { leaf enabled { type boolean; default "false"; description "Whether ASPA verification of BGP prefix is enabled."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which ASPA verification is enabled."; } description "ASPA verification of BGP prefix."; } } grouping aspa-selection-option { description "ASPA option for BGP route selection."; container aspa { leaf enabled { type boolean; default "false"; description "When enabled allows the ASPA verification states to be taken into consideration in the best-path calculation."; } leaf allow-invalid { type boolean; default "false"; description "When enabled allows the route with 'invalid' ASPA verification state to be taken into consideration in the best-path calculation."; } Liu, et al. Expires April 21, 2025 [Page 34] Internet-Draft YANG Data Model for BGP about RPKI October 2024 leaf allow-unknown { type boolean; default "true"; description "When enabled allows the route with 'unknown' ASPA verification state to be taken into consideration in the best-path calculation."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which ASPA option is enabled in BGP route selection."; } description "ASPA option for BGP route selection."; } } grouping export-aspa-validation-config { description "Export AS PATH validation of BGP prefix."; container export-aspa-validation { leaf enabled { type boolean; default "false"; description "When enabled allows the AS PATH validity states to be taken into consideration in BGP export."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which AS PATH validity states are considered in BGP export."; } description "Export AS PATH validation of BGP prefix."; } } Liu, et al. Expires April 21, 2025 [Page 35] Internet-Draft YANG Data Model for BGP about RPKI October 2024 augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor" { description "augmentation of BGP peer roles for neighbors"; leaf peer-role { type peer-role; description "Role of the peer"; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group" { description "augmentation of BGP peer roles for peer groups"; leaf peer-role { type peer-role; description "Role of the peer group"; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" { description "ASPA verification augmentation of BGP IPv4 Unicast Address Family."; uses aspa-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" { description "ASPA verification augmentation of BGP IPv6 Unicast Address Family."; uses aspa-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description Liu, et al. Expires April 21, 2025 [Page 36] Internet-Draft YANG Data Model for BGP about RPKI October 2024 "ASPA verification state augmentation of BGP IPv4 Unicast route."; leaf aspa-verification-state { type aspa-verification-state; description "ASPA verification state of BGP IPv4 Unicast prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "ASPA verification state augmentation of BGP IPv6 Unicast route."; leaf aspa-verification-state { type aspa-verification-state; description "ASPA verification state of BGP IPv6 Unicast prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi" + "/bgp:route-selection-options" { when "derived-from-or-self(../bgp:name, 'bt:ipv4-unicast') or " + "derived-from-or-self(../bgp:name, 'bt:ipv6-unicast')" { description "This augmentation is valid for IPv4 and IPv6 Unicast."; } description "augmentation of BGP route selection options"; uses aspa-selection-option; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "augmentation of AS PATH for IPv4 Unicast neighbor"; uses export-aspa-validation-config; } augment "/rt:routing/rt:control-plane-protocols" Liu, et al. Expires April 21, 2025 [Page 37] Internet-Draft YANG Data Model for BGP about RPKI October 2024 + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "augmentation of AS PATH for IPv6 Unicast neighbor"; uses export-aspa-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "augmentation of AS PATH for IPv4 Unicast peer group"; uses export-aspa-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "augmentation of AS PATH for IPv6 Unicast peer group"; uses export-aspa-validation-config; } } 6. Security Considerations TBD 7. IANA Considerations TBD 8. References 8.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . Liu, et al. Expires April 21, 2025 [Page 38] Internet-Draft YANG Data Model for BGP about RPKI October 2024 [RFC6810] Bush, R. and R. Austein, "The Resource Public Key Infrastructure (RPKI) to Router Protocol", RFC 6810, DOI 10.17487/RFC6810, January 2013, . [RFC6811] Mohapatra, P., Scudder, J., Ward, D., Bush, R., and R. Austein, "BGP Prefix Origin Validation", RFC 6811, DOI 10.17487/RFC6811, January 2013, . [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8210] Bush, R. and R. Austein, "The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 1", RFC 8210, DOI 10.17487/RFC8210, September 2017, . [RFC8635] Bush, R., Turner, S., and K. Patel, "Router Keying for BGPsec", RFC 8635, DOI 10.17487/RFC8635, August 2019, . [I-D.ietf-sidrops-8210bis] Bush, R. and R. Austein, "The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 2", Work in Progress, Internet-Draft, draft-ietf- sidrops-8210bis-11, 21 September 2023, . [I-D.ietf-sidrops-aspa-verification] Azimov, A., Bogomazov, E., Bush, R., Patel, K., Snijders, J., and K. Sriram, "BGP AS_PATH Verification Based on Autonomous System Provider Authorization (ASPA) Objects", Work in Progress, Internet- Draft, draft-ietf-sidrops-aspa-verification-19, 27 September 2024, . 8.2. Informative References [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, . Liu, et al. Expires April 21, 2025 [Page 39] Internet-Draft YANG Data Model for BGP about RPKI October 2024 Contributors Mengxiao Chen H3C China Email: chen.mengxiao@h3c.com Authors' Addresses Yisong Liu China Mobile China Email: liuyisong@chinamobile.com Changwang Lin New H3C Technologies China Email: linchangwang.04414@h3c.com Haibo Wang Huawei Technologies China Email: rainsword.wang@huawei.com Jishnu Roy Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, CA 94089 United States of America Email: jishnur@juniper.net Jeffrey Haas Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, CA 94089 United States of America Email: jhaas@juniper.net Liu, et al. Expires April 21, 2025 [Page 40] Internet-Draft YANG Data Model for BGP about RPKI October 2024 Hongwei Liu ZTE Corporation China Email: liu.hongwei3@zte.com.cn Di Ma ZDNS Floor 21, Block B, Greenland Center Chaoyang Beijing, 100102 China Email: madi@zdns.cn Liu, et al. Expires April 21, 2025 [Page 41]