YANG Data Model for Routing in Fat Trees (RIFT)
Extracted elements (29)
Occasionally-implemented RIFT features—nonce-delta-adjust, label-switching, tie-security, and link-security—are declared as optional YANG features rather than mandatory nodes, allowing implementations to advertise which capabilities they support without exposing non-functional configuration.
The ietf-rift module is explicitly designed as a vendor-extensible baseline: the module description states it is 'intended that the module will be extended by vendors to define vendor-specific RIFT configuration parameters and policies—for example, route maps or route policies.' Vendors augment the standard module rather than forking it.
The model is NMDA-compatible (RFC 8342), merging configuration and operational state into a single schema hierarchy per RFC 8407 rather than maintaining separate configuration and operational data trees. This avoids duplication and simplifies client implementation.
The ietf-rift module imports seven external YANG modules: ietf-inet-types and ietf-yang-types (RFC 6991), ietf-routing (RFC 8349), ietf-interfaces (RFC 8343), ietf-routing-types and iana-routing-types (RFC 8294), and ietf-key-chain (RFC 8177). Conforming implementations must support all imported modules.
If nonces in a received packet exceed the range defined by maximum-nonce-delta (range 1..5), the packet MUST be discarded. This configurable window defines the replay-protection vulnerability surface per RFC 9692 Section 6.9.4.
Multiple Node TIEs from a ToF may carry disjoint subsets of same-plane ToF system-ids in same-plane-tofs; these disjoint sets MUST be joined to form a single complete set of ToFs in the same plane.
The adjusted-lifetime parameter SHOULD be prohibited from being set to less than 2×purge-lifetime, as doing so can destabilize TIE propagation.
When not-a-ztp-offer is set to 'true' in a received LIE, the level value carried in that LIE MUST NOT be used by the receiving node to derive a ZTP level (RFC 9692 Section 6.7).
When the you-are-sending-too-quickly flag is received in a LIE, the receiver SHOULD temporarily slow down flooding rates, as the sender is detecting packet losses or excessive rate.
Interface-level security envelope checking is configurable with four modes: no-checking, permissive, loose, and strict (per RFC 9692 Section 6.9). Only one mode may be active at a time. Separate tie-security (feature-gated) and link-security (feature-gated) lists apply PKI security to TIE exchange and per-link traffic respectively.
LIE multicast receive and transmit addresses are separately configurable. Receive defaults are 224.0.0.121 (IPv4) and ff02::a1f7 (IPv6); transmit addresses have no defaults and may differ from receive addresses, enabling asymmetric LIE multicast configurations.
LIE packets are sent on UDP port 914 (default, configurable via lie-tx-port); TIEs are flooded using UDP port 915 (default, configurable per interface via rx-flood-port and reflected per neighbor in nbr-flood-port and tx-flood-port).
The error-set YANG notification carries two sub-trees: tie-level-error (listing TIEs with level inconsistencies per RIFT instance) and neighbor-error (listing neighbors with errors per interface). Per Section 2.6, implementations should notify on unexpected TIE and neighbor layer errors.
The hop-limit leaf configures IPv4 TTL or IPv6 Hop Limit for LIE and TIE sending/receiving. Its range is restricted to the values 1 or 255 only, with a default of 1.
The ieee802-1as-timestamp typedef is a uint64 in seconds representing an IEEE 802.1AS timestamp, used for prefix origination-time and mobility sequencing per RFC 9692 Section 6.8.4.
The ietf-rift YANG module augments the /rt:routing/rt:control-plane-protocols/rt:control-plane-protocol path from ietf-routing (RFC 8349), conditioned on the routing protocol type being derived from 'rift:rift'. RIFT instances are declared as a keyed list with a unique string 'name', supporting multiple instances per device.
The level typedef is a uint8 in range 0..24 with default 0; level 0 always indicates a leaf node, ToF nodes have the highest value, and values may be manually configured or automatically derived via ZTP.
The overload container supports two timeout modalities: on-startup (node enters overload until a timer expires at startup) and immediate (overload set and cleared after a configurable timer). The overload bit being set causes the node's TIEs to carry the overload indication.
The prefix-attribute grouping includes metric (uint32), tags (uint64 leaf-list), a monotonic-clock container with IEEE 802.1AS timestamp and RFC 8505 Transaction ID (TID) for mobile address sequencing, loopback and directly-attached flags, from-link (uint32), and an optional per-prefix label (uint32).
The read-only database container stores the full TIE list keyed by (tie-direction-type, originator, tie-type, tie-number). Node TIEs include neighbor adjacencies, capabilities, overload-flag, miscabled-links, same-plane-tofs, and fabric-id; prefix TIEs hold prefix attributes; key-value TIEs hold binary key/value pairs.
The read-only statistics container covers: global north/south route counts, per-direction SPF statistics with triggering-TIE identification, per-interface LIE send/receive/drop-by-reason counters and flood-repeater change tracking, and per-neighbor TIE/TIDE/TIRE exchange counters including flood-reduced and security-drop subcategories.
The security grouping supports PKI-based authentication with public or private key types and an optional shared-key flag. Authentication key material is supplied either via a key-chain reference (RFC 8177) or an explicit string key with a crypto-algorithm identityref derived from key-chain:crypto-algorithm.
The system-id typedef is a 64-bit node identifier encoded as a string matching the pattern '[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}' (e.g., '0021.2FFF.FEB5.6E10').
The TIE header grouping captures: tie-direction-type (north/south), originator system-id, tie-type, tie-number (uint32), sequence number (uint64), size (uint32), origination-time (ieee802-1as-timestamp), origination-lifetime (seconds), and remaining-lifetime (seconds). This grouping is reused in the database, statistics, and notification subtrees.
TIE types are modeled as an enumeration: illegal, min-tie-type, node, prefix, positive-disaggregation-prefix, negative-disaggregation-prefix, pgp-prefix, key-value, external-prefix, positive-external-disaggregation-prefix, and max-tie-type.
IANA registers the ietf-rift YANG module in the 'IETF XML Registry' with namespace urn:ietf:params:xml:ns:yang:ietf-rift, and in the 'YANG Module Names' registry with name 'ietf-rift', prefix 'rift', and reference to RFC 9719.
Nonce-based replay protection parameters (maximum-nonce-delta, nonce-increasing-interval) are configurable via the model. Overly large nonce-delta values widen the replay-attack window; implementations should apply operational constraints consistent with RFC 9692 Section 6.9.4.
The YANG model exposes sensitive cryptographic configuration nodes—explicit authentication keys and key-chain references for TIE security and link security. NETCONF/RESTCONF access control must restrict read and write access to these subtrees to prevent unauthorized key disclosure or modification.
The LIE finite state machine has four states: one-way (initial), two-way (valid LIE received but ThreeWay not yet established), three-way (valid ThreeWay LIE received and adjacency fully formed), and multiple-neighbors-wait (more than two neighbors detected on the same link). State is read-only (config false) per RFC 9692 Section 6.2.1.