YANG Data Model for Segment Routing
Extracted elements (28)
IGP control-plane SR augmentation SHOULD be part of the routing-protocol YANG modules rather than this document, to avoid creating a dependency requiring implementations to support SR extensions for all routing protocols.
The 'dual' advertise-protection option for Adj-SIDs is specifically intended for traffic engineering scenarios where a path must traverse either all protected segments or all unprotected segments, requiring explicit advertisement of both a B-flag-set and a B-flag-clear Adj-SID for the same adjacency.
The SR YANG model is split into three modules (ietf-segment-routing, ietf-segment-routing-common, ietf-segment-routing-mpls) to avoid requiring implementations to support all IGP extensions. An implementation may support IS-IS SR extensions but not OSPF SR extensions, so the generic framework is kept separate from data-plane-specific modules.
The YANG modules conform to the Network Management Datastore Architecture (NMDA) as described in RFC 8342. Implementations that do not support NMDA may not be able to fully interoperate with these models.
Support of SR extensions for a particular IGP control plane SHOULD be augmented as part of the routing-protocol YANG modules, not as a standalone dependency requiring support for all routing protocols.
The ietf-segment-routing-common module defines generic types and groupings that SHOULD be reused by IGP extension modules (e.g., IS-IS SR, OSPF SR).
Connected prefix SID mappings support a 'last-hop-behavior' leaf (conditional on feature 'sid-last-hop-behavior') with values: 'explicit-null', 'no-php', or 'php', controlling MPLS Penultimate Hop Popping behavior at the egress.
Prefix-SID values can be expressed as an index (default) or as an absolute label value, controlled by the 'value-type' leaf in the sid-value-type grouping.
The Adjacency SID (Adj-SID) interface configuration supports per-adj-sid 'protected' (boolean, default false) and 'weight' (uint8) leaves for FRR protection and load-balancing over parallel adjacencies.
The 'advertise-adj-group-sid' list allows bundling of parallel links under a common group-id, causing the IGP to advertise a shared Adj-SID for all interfaces with the same group-id value.
The 'advertise-protection' leaf controls Adj-SID protection advertisement with two options: 'single' (one Adj-SID, B-flag reflects protection state) or 'dual' (two Adj-SIDs advertised when protected — one with B-flag set, one with B-flag clear).
The ietf-segment-routing module augments /rt:routing with a 'segment-routing' container, providing the generic SR framework to be augmented by data-plane-specific modules.
The ietf-segment-routing-mpls module augments /rt:routing/sr:segment-routing with an 'sr-mpls' container that holds global SRGB/SRLB configuration, prefix-SID bindings, mapping-server policies, and operational state (label-blocks, sid-db).
The mapping-server feature allows configuration of prefix-to-SID mappings for non-local prefixes. Advertisement of those bindings must be explicitly controlled per routing-protocol instance and is not automatic upon configuration.
The Segment Routing Global Block (SRGB) is configured as a list of lower-bound/upper-bound label ranges. All local routing-protocol instances share the same SRGB since it is agnostic to the control plane used.
The segment-routing-global-sid-collision notification is raised when a newly advertised SID index is already bound to a different target. Notification generation must be throttled with at least a 5-second gap between notifications.
The segment-routing-index-out-of-range notification is raised when a received binding contains a segment index outside all locally configured SRGB ranges. Generation must also be throttled with at least a 5-second gap.
The Segment Routing Local Block (SRLB) is configured as a list of lower-bound/upper-bound label ranges reserved for local SIDs, analogous to the SRGB but locally scoped.
The segment-routing-srgb-collision notification is raised when control-plane-advertised SRGB blocks from different routers overlap, reporting the colliding lower-bound/upper-bound ranges, routing-protocol reference, and originating router ID.
The sid-db operational state list tracks all global SID bindings with fields: target (string), sid (uint32), algorithm (uint8), source (ip-address), used (boolean), source-protocol (leafref), binding-type (prefix-sid or binding-tlv), and scope (global or local).
Three YANG module namespaces are registered in the IETF XML Registry (RFC 3688): urn:ietf:params:xml:ns:yang:ietf-segment-routing-common, urn:ietf:params:xml:ns:yang:ietf-segment-routing, and urn:ietf:params:xml:ns:yang:ietf-segment-routing-mpls.
Three YANG modules are registered in the YANG Module Names registry (RFC 6020): ietf-segment-routing-common (prefix sr-cmn), ietf-segment-routing (prefix sr), and ietf-segment-routing-mpls (prefix sr-mpls), all referencing RFC 9020.
NETCONF access MUST use SSH as the mandatory-to-implement secure transport (RFC 6242); RESTCONF access MUST use HTTPS with TLS (RFC 8446). NACM (RFC 8341) SHOULD be used to restrict access to sensitive SR configuration and state nodes.
Unauthorized modification of SRGB (/segment-routing/mpls/srgb) can mount a DoS attack: reducing the SRGB size to a very small value causes many existing segments to become uninstallable, resulting in traffic disruption.
Unauthorized modification of SRLB (/segment-routing/mpls/srlb) is subject to the same DoS risk as SRGB modification. Read access to /segment-routing/mpls/sid-db should also be restricted, as knowledge of SID-to-prefix mappings enables targeted DoS or traffic redirection attacks against other routers in the SR domain.
Unauthorized write access to /segment-routing/mpls/bindings can cause a DoS attack or allow an attacker to create segment conflicts (same SID for different purposes), redirecting traffic to compromised nodes or bypassing security functions (e.g., firewalls) within the trusted SR domain.
SRGB and SRLB label ranges are each encoded as a pair of uint32 fields: lower-bound and upper-bound. The upper-bound must be greater than lower-bound (enforced by a YANG 'must' constraint with error message).
The system-id typedef (for IS-IS) uses a string pattern '[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}', while router-or-system-id is a union of OSPF/BGP router-id and the IS-IS system-id pattern.