Extensions to the YANG Data Model for Access Control Lists (ACLs)
Extracted elements (28)
RFC 8519 does not support a rate-limit action; it only allows accept, drop, or reject. A new 'rate-limit' leaf (decimal64, bytes per second) was added as an augmentation to actions, valid only when the forwarding action is 'accept'.
RFC 8519 does not support aliases or defined sets, forcing operators to duplicate match criteria across ACLs. The enhanced module introduces reusable defined sets (prefix, port, protocol, ICMP, aliases) to decouple rule creation from set management, enabling add/remove of entries without redefining parent ACL rules.
RFC 8519 does not support matching on MPLS header fields. The enhanced module adds MPLS match parameters (traffic-class, label-position, upper/lower-label-range, label-block-name, ttl-value) guarded by a 'match-on-mpls' feature.
RFC 8519 does not support payload-based filtering or filtering of encapsulated traffic (e.g., QUIC over UDP). A new 'match-on-payload' feature was introduced using offset type, length, operator, and binary pattern to inspect packet payloads at L2/L3/L4/payload offsets.
RFC 8519's ACL model does not support lists of IP prefixes, requiring a separate ACE per prefix. This leads to suboptimal configuration for DDoS mitigation and large-scale networks where hundreds of prefixes may be involved. The enhanced module introduces prefix sets to address this gap.
RFC 8519's TCP flags field does not support bitmask operations as provided by BGP Flow Spec. A new 'flags-bitmask' container with an operator type (not, match, any) was added to support efficient TCP flags filtering, including detection of null attacks (all flags unset).
IPv6 extension header matching uses the 'extension-header' leaf with type 'iana-ipv6-ext-types:ipv6-extension-header-type', which is maintained by IANA. The 'df' fragment-type bit must be set to 0 when used in IPv6 filters, as it applies only to IPv4.
The 'ietf-acl-enh' module augments RFC 8519's 'ietf-access-control-list' and imports from RFC 6991 (ietf-inet-types), RFC 8519 (ietf-packet-fields), and RFC 8294 (ietf-routing-types). Implementations must also import the three new IANA-maintained modules (iana-icmpv4-types, iana-icmpv6-types, iana-ipv6-ext-types) created by this document.
Clients that support both 'flags-bitmask' and 'flags' (RFC 8519) matching fields MUST NOT set these fields in the same request.
Clients that support both 'ipv4-fragment' and 'flags' (RFC 8519) matching fields MUST NOT set these fields in the same request.
Additional actions augment ACE actions: 'log-action' container (log-type identityref, log-id string conditional on local-log type), 'counter-action' container (counter-type identityref, counter-name leaf-list), and 'rate-limit' leaf (decimal64, bytes per second) valid only when forwarding is 'accept'.
Fragment handling uses the 'fragment-fields' grouping with an 'operator' leaf (default 'match') and a 'type' leaf of type fragment-type (bits: df, isf, ff, lf). Applied separately for IPv4 ('ipv4-fragment') and IPv6 ('ipv6-fragment') as containers augmenting the L3 match nodes. The YANG must constraint prevents simultaneous use with RFC 8519 'flags'.
I-SID filtering augments L2 match with an 'isid-filter' container (guarded by 'match-on-isid-filter') supporting PBB Provider Backbone Bridging. Provides range (lower-isid/upper-isid uint16) or operator-based (operator + leaf-list isid uint16) matching on the 24-bit Instance Service Identifier.
MPLS match parameters are provided via 'mpls-match-parameters-config' grouping: traffic-class (uint8, range 0..7), label-position (identityref: top/bottom), upper-label-range and lower-label-range (rt-types:mpls-label), label-block-name (string), ttl-value (uint8). Guarded by 'match-on-mpls' feature.
Payload-based filtering uses the 'payload-match' grouping with: 'offset' (identityref: layer2, layer3, layer4, payload), 'length' (uint16, bytes to skip from offset), 'operator' (match/any/not), and 'pattern' (binary). Guarded by the 'match-on-payload' feature.
The 'alias' grouping combines multiple parameters—VLAN IDs, IP prefixes, port ranges, protocol numbers, FQDNs, and URIs—into a single named object. Aliases are referenced from ACE match criteria via the 'alias-name' leaf-list using the alias-ref typedef.
The 'defined-sets' container augments /acl:acls and provides reusable named sets: ipv4-prefix-sets, ipv6-prefix-sets, port-sets, protocol-sets, icmpv4-type-sets, icmpv6-type-sets, and aliases. Each set is identified by a unique name and referenced from ACE match criteria via leafref typedefs.
The 'flags-bitmask' container augments L4 TCP match fields and provides two modes: 'explicit' (a leaf-list of tcp-flag identityrefs: ack, syn, fin, urg, psh, rst, ece, cwr, ae) and 'builtin' (a uint16 bitmask covering bytes 13–14 of the TCP header). An 'operator' leaf (bits: not, match, any) controls evaluation semantics.
The 'fragment-type' typedef is a bits type with four bits: 'df' (position 0, Don't Fragment for IPv4, must be 0 in IPv6 filters), 'isf' (position 1, Is a Fragment), 'ff' (position 2, First Fragment), 'lf' (position 3, Last Fragment).
The 'operator' typedef is a bits type with three bits: 'not' (position 0, logical negation), 'match' (position 1, bitwise '(data & value) == value'), and 'any' (position 2, '(data & value) != 0'). The 'any' and 'match' bits must not be set simultaneously.
VLAN filtering augments L2 match with a 'vlan-filter' container (guarded by 'match-on-vlan-filter') providing frame-type (string) and a choice of range (lower-vlan/upper-vlan uint16) or operator-based (operator + leaf-list vlan uint16) VLAN matching.
This document creates the 'iana-icmpv4-types' IANA-maintained YANG module (namespace urn:ietf:params:xml:ns:yang:iana-icmpv4-types) as the initial version. Future ICMPv4 type additions must be made to the 'ICMP Type Numbers' registry, which then triggers an update to this YANG module.
This document creates the 'iana-icmpv6-types' IANA-maintained YANG module (namespace urn:ietf:params:xml:ns:yang:iana-icmpv6-types) as the initial version. Future ICMPv6 type additions must be made to the 'ICMPv6 type Numbers' registry, which then triggers an update to this YANG module.
This document creates the 'iana-ipv6-ext-types' IANA-maintained YANG module (namespace urn:ietf:params:xml:ns:yang:iana-ipv6-ext-types) as the initial version. Future IPv6 Extension Header Type additions must be made to the 'IPv6 Extension Header Types' registry, which then triggers an update to this YANG module.
This document registers the 'ietf-acl-enh' YANG module in the 'YANG Module Names' registry with namespace urn:ietf:params:xml:ns:yang:ietf-acl-enh, prefix acl-enh. This module is not IANA-maintained (N).
The 'defined-sets' container is tagged with 'nacm:default-deny-write'. Unauthorized write access could allow intruders to modify prefix, port, or protocol sets to permit traffic that should be blocked (enabling DoS or device compromise) or block traffic that should be allowed (also a DoS vector).
Unauthorized read access to 'defined-sets' reveals actual network resources (IP addresses, core router addresses) bound to ACLs, helping attackers scope targeted attacks and potentially nullifying topology-hiding strategies. Read access to these nodes should be controlled via NACM.
YANG-based management protocols accessing 'ietf-acl-enh' must use a secure transport layer (SSH, TLS, or QUIC) and mutual authentication. Payload-based pattern matching is deterministic for unencrypted traffic but its effectiveness against encrypted traffic depends on the presence of an unvarying pattern.