Skip to content

Security Analysis Changes Part 3 #1292

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Security Analysis Changes Part 3 #1292

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0ec5a71
BGP Changes
mihirra Apr 30, 2025
801d080
Bugfixes from automated checks
mihirra May 1, 2025
3d1c1c3
Bugfixes from automated checks
mihirra May 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 36 additions & 1 deletion release/models/bgp/openconfig-bgp-common-multiprotocol.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,13 @@ submodule openconfig-bgp-common-multiprotocol {
for multiple protocols in BGP. The groupings are common across
multiple contexts.";

oc-ext:openconfig-version "9.9.0";
oc-ext:openconfig-version "9.10.0";

revision "2025-04-13" {
description
"Add additional security features.";
reference "9.10.0";
}

revision "2025-03-30" {
description
Expand Down Expand Up @@ -477,6 +483,24 @@ submodule openconfig-bgp-common-multiprotocol {
}
}

grouping bgp-common-mp-l2vpn-vpls-group-config {
description
"Configuration options for vpls.";

leaf mac-limit {
type uint64;
description
"Maximum limit for size of mac table";
}

leaf enforce-split-horizon-rule {
type boolean;
// Default is device specific
description
"Indicates that the split-horizon rule should be followed for VPLS";
}
}

grouping bgp-common-mp-l2vpn-vpls-group {
description
"Group for BGP-signalled VPLS configuration options";
Expand All @@ -495,6 +519,17 @@ submodule openconfig-bgp-common-multiprotocol {

// placeholder for BGP-signalled VPLS specific configuration
// options
container config {
description
"Configuration parameters relating to VPLS";
uses bgp-common-mp-l2vpn-vpls-group-config;
}
container state {
description
"State relating to VPLS";
config false;
uses bgp-common-mp-l2vpn-vpls-group-config;
}
}
}

Expand Down
8 changes: 7 additions & 1 deletion release/models/bgp/openconfig-bgp-common-structure.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,13 @@ submodule openconfig-bgp-common-structure {
"This sub-module contains groupings that are common across multiple BGP
contexts and provide structure around other primitive groupings.";

oc-ext:openconfig-version "9.9.0";
oc-ext:openconfig-version "9.10.0";

revision "2025-04-13" {
description
"Add additional security features.";
reference "9.10.0";
}

revision "2025-03-30" {
description
Expand Down
8 changes: 7 additions & 1 deletion release/models/bgp/openconfig-bgp-common.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,13 @@ submodule openconfig-bgp-common {
may be application to a subset of global, peer-group or neighbor
contexts.";

oc-ext:openconfig-version "9.9.0";
oc-ext:openconfig-version "9.10.0";

revision "2025-04-13" {
description
"Add additional security features.";
reference "9.10.0";
}

revision "2025-03-30" {
description
Expand Down
8 changes: 7 additions & 1 deletion release/models/bgp/openconfig-bgp-errors.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,13 @@ submodule openconfig-bgp-errors {
"This module defines BGP NOTIFICATION message error codes
and subcodes";

oc-ext:openconfig-version "6.1.0";
oc-ext:openconfig-version "6.2.0";

revision "2025-05-01" {
description
"Add additional security features.";
reference "6.2.0";
}

revision "2024-09-06" {
description
Expand Down
22 changes: 21 additions & 1 deletion release/models/bgp/openconfig-bgp-global.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,13 @@ submodule openconfig-bgp-global {
"This sub-module contains groupings that are specific to the
global context of the OpenConfig BGP module";

oc-ext:openconfig-version "9.9.0";
oc-ext:openconfig-version "9.10.0";

revision "2025-04-13" {
description
"Add additional security features.";
reference "9.10.0";
}

revision "2025-03-30" {
description
Expand Down Expand Up @@ -232,6 +238,20 @@ submodule openconfig-bgp-global {
"RFC4271 - A Border Gateway Protocol 4 (BGP-4),
Section 4.2";
}

leaf enforce-peer-as-first-as {
type boolean;
default false;
description
"Ensure that the peer's AS is the first AS listed in the AS_PATH
attribute";
}

leaf max-prefixes {
type uint64;
description
"Maximum amount of prefixes allowed for this BGP instance";
}
}

grouping bgp-global-state {
Expand Down
8 changes: 7 additions & 1 deletion release/models/bgp/openconfig-bgp-neighbor.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,13 @@ submodule openconfig-bgp-neighbor {
"This sub-module contains groupings that are specific to the
neighbor context of the OpenConfig BGP module.";

oc-ext:openconfig-version "9.9.0";
oc-ext:openconfig-version "9.10.0";

revision "2025-04-13" {
description
"Add additional security features.";
reference "9.10.0";
}

revision "2025-03-30" {
description
Expand Down
8 changes: 7 additions & 1 deletion release/models/bgp/openconfig-bgp-peer-group.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,13 @@ submodule openconfig-bgp-peer-group {
"This sub-module contains groupings that are specific to the
peer-group context of the OpenConfig BGP module.";

oc-ext:openconfig-version "9.9.0";
oc-ext:openconfig-version "9.10.0";

revision "2025-04-13" {
description
"Add additional security features.";
reference "9.10.0";
}

revision "2025-03-30" {
description
Expand Down
18 changes: 16 additions & 2 deletions release/models/bgp/openconfig-bgp-policy.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,13 @@ module openconfig-bgp-policy {
It augments the base routing-policy module with BGP-specific
options for conditions and actions.";

oc-ext:openconfig-version "8.1.0";
oc-ext:openconfig-version "8.2.0";

revision "2025-05-01" {
description
"Add additional security features.";
reference "8.2.0";
}

revision "2024-11-13" {
description
Expand Down Expand Up @@ -836,11 +842,19 @@ module openconfig-bgp-policy {
the set in match conditions";
}

leaf-list as-path-set-member-range {
type oc-bgp-types:as-path-set-member-type;
description
"AS path expression -- list of ASes in the set.";
}

leaf-list as-path-set-member {
// TODO: need to refine typedef for AS path expressions
type string;
status deprecated;
description
"AS path expression -- list of ASes in the set";
"AS path expression -- list of ASes in the set.
Use the field above instead.";
}
}

Expand Down
53 changes: 52 additions & 1 deletion release/models/bgp/openconfig-bgp-types.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,13 @@ module openconfig-bgp-types {
policy. It can be imported by modules that make use of BGP
attributes";

oc-ext:openconfig-version "6.1.0";
oc-ext:openconfig-version "6.2.0";

revision "2025-05-01" {
description
"Add additional security features.";
reference "6.2.0";
}

revision "2024-09-06" {
description
Expand Down Expand Up @@ -657,6 +663,51 @@ module openconfig-bgp-types {
draft-ietf-idr-link-bandwidth-07";
}

typedef as-path-set-member-type {
type union {
type oc-inet:as-number;
type string {
// Range
pattern '(429496729[0-5]|42949672[0-8][0-9]|4294967[0-1][0-9]{2}' +
'|429496[0-6][0-9]{3}|42949[0-5][0-9]{4}|4294[0-8][0-9]{5}|' +
'429[0-3][0-9]{6}|42[0-8][0-9]{7}|4[0-1][0-9]{8}|[1-3][0-9]{9}|' +
'0{0,8}[1-9][0-9]|0{0,7}[1-9][0-9]{2}|0{0,6}[1-9][0-9]{3}|' +
'0{0,5}[1-9][0-9]{4}|0{0,4}[1-9][0-9]{5}|0{0,3}[1-9][0-9]{6}|' +
'0{0,2}[1-9][0-9]{7}|0{0,1}[1-9][0-9]{8}|0{0,9}[0-9])\.\.' +
'(429496729[0-5]|42949672[0-8][0-9]|4294967[0-1][0-9]{2}' +
'|429496[0-6][0-9]{3}|42949[0-5][0-9]{4}|4294[0-8][0-9]{5}|' +
'429[0-3][0-9]{6}|42[0-8][0-9]{7}|4[0-1][0-9]{8}|[1-3][0-9]{9}|' +
'0{0,8}[1-9][0-9]|0{0,7}[1-9][0-9]{2}|0{0,6}[1-9][0-9]{3}|' +
'0{0,5}[1-9][0-9]{4}|0{0,4}[1-9][0-9]{5}|0{0,3}[1-9][0-9]{6}|' +
'0{0,2}[1-9][0-9]{7}|0{0,1}[1-9][0-9]{8}|0{0,9}[0-9])';
oc-ext:posix-pattern '^(429496729[0-5]|42949672[0-8][0-9]|4294967[0-1][0-9]{2}' +
'|429496[0-6][0-9]{3}|42949[0-5][0-9]{4}|4294[0-8][0-9]{5}|' +
'429[0-3][0-9]{6}|42[0-8][0-9]{7}|4[0-1][0-9]{8}|[1-3][0-9]{9}|' +
'0{0,8}[1-9][0-9]|0{0,7}[1-9][0-9]{2}|0{0,6}[1-9][0-9]{3}|' +
'0{0,5}[1-9][0-9]{4}|0{0,4}[1-9][0-9]{5}|0{0,3}[1-9][0-9]{6}|' +
'0{0,2}[1-9][0-9]{7}|0{0,1}[1-9][0-9]{8}|0{0,9}[0-9])\.\.' +
'(429496729[0-5]|42949672[0-8][0-9]|4294967[0-1][0-9]{2}' +
'|429496[0-6][0-9]{3}|42949[0-5][0-9]{4}|4294[0-8][0-9]{5}|' +
'429[0-3][0-9]{6}|42[0-8][0-9]{7}|4[0-1][0-9]{8}|[1-3][0-9]{9}|' +
'0{0,8}[1-9][0-9]|0{0,7}[1-9][0-9]{2}|0{0,6}[1-9][0-9]{3}|' +
'0{0,5}[1-9][0-9]{4}|0{0,4}[1-9][0-9]{5}|0{0,3}[1-9][0-9]{6}|' +
'0{0,2}[1-9][0-9]{7}|0{0,1}[1-9][0-9]{8}|0{0,9}[0-9])$';
}
type enumeration {
enum ANY_ONE {
description
"Matches one AS number of any value.";
}
enum ANY_ALL {
description
"Matches any number of AS numbers of any value.";
}
}
}
description
"Type definition for AS set member type.";
}

typedef bgp-ext-community-recv-type {
type union {
type bgp-ext-community-type;
Expand Down
8 changes: 7 additions & 1 deletion release/models/bgp/openconfig-bgp.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,13 @@ module openconfig-bgp {
whereas leaf not present inherits its value from the leaf present
at the next higher level in the hierarchy.";

oc-ext:openconfig-version "9.9.0";
oc-ext:openconfig-version "9.10.0";

revision "2025-04-13" {
description
"Add additional security features.";
reference "9.10.0";
}

revision "2025-03-30" {
description
Expand Down
Loading