Skip to content

Add prefix-set description and prefix entry sequence/action #1524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Verma-Anukul wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add prefix-set description and prefix entry sequence/action #1524

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 50 additions & 1 deletion release/models/policy/openconfig-routing-policy.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,14 @@ module openconfig-routing-policy {
default value for the default-(import|export)-policy leaf must be
applied. See RFC6020 7.6.1 which applies to this model.";

oc-ext:openconfig-version "3.5.0";
oc-ext:openconfig-version "3.6.0";

revision "2026-07-22" {
description
"Add prefix-set description and prefix entry sequence-number and
action leaves to support ordered BGP-style prefix lists.";
reference "3.6.0";
}

revision "2024-11-26" {
description
Expand Down Expand Up @@ -224,6 +231,22 @@ module openconfig-routing-policy {

// grouping statements

typedef prefix-set-prefix-action-type {
type enumeration {
enum PERMIT {
description
"Permit routes that match the prefix entry.";
}
enum DENY {
description
"Deny routes that match the prefix entry.";
}
}
default PERMIT;
description
"Action to take for routes matching a prefix list entry.";
}

grouping prefix-set-config {
description
"Configuration data for prefix sets used in policy
Expand Down Expand Up @@ -261,6 +284,12 @@ module openconfig-routing-policy {
prefix sets to be of only one address family.";
}

leaf description {
type string;
description
"Optional human-readable description of the prefix set.";
}

}

grouping prefix-set-state {
Expand Down Expand Up @@ -345,6 +374,26 @@ module openconfig-routing-policy {
prefix: 10.3.192.0/21,
masklength-range: exact";
}

leaf sequence-number {
type uint32 {
range "1..4294967295";
}
description
"Sequence number for the prefix entry within the prefix set.
Prefix list implementations evaluate entries in ascending
sequence order. The list key for prefix entries remains
ip-prefix and masklength-range; sequence-number is an
additional attribute used by implementations that require
explicit ordering or permit/deny semantics per entry.";
}
Comment on lines +378 to +389

@gemini-code-assist gemini-code-assist Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since sequence-number is an optional leaf, the model should clarify the expected behavior when it is omitted for some or all entries in a prefix-set.

For example:

  • Are entries without a sequence number evaluated in a system-defined order, or is their evaluation order undefined?
  • Does the system automatically assign sequence numbers to entries that lack them?
  • Is it invalid to mix entries with and without sequence numbers in the same prefix-set?

Specifying this behavior in the description will prevent vendor-specific discrepancies.

    leaf sequence-number {
      type uint32 {
        range "1..4294967295";
      }
      description
        "Sequence number for the prefix entry within the prefix set.
         Prefix list implementations evaluate entries in ascending
         sequence order. If sequence numbers are omitted, the evaluation
         order of those entries is system-dependent. The list key for
         prefix entries remains ip-prefix and masklength-range;
         sequence-number is an additional attribute used by
         implementations that require explicit ordering or permit/deny
         semantics per entry.";
    }


leaf action {
type prefix-set-prefix-action-type;
description
"Action applied to routes matching this prefix entry within
the prefix set.";
}
Comment on lines +391 to +396

@gemini-code-assist gemini-code-assist Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Adding action (PERMIT/DENY) and sequence-number to prefix-set entries introduces a major ambiguity in how match-prefix-set conditions are evaluated.

Historically, a prefix-set was a simple unordered set of prefixes used for matching (i.e., match-prefix-set returns true if the route's prefix matches any prefix in the set). With the introduction of action (PERMIT/DENY) and sequence-number (ordering):

  1. Evaluation Semantics: How does match-prefix-set behave when a route matches a DENY entry? Does the match-prefix-set condition return false (not matched), or does it stop evaluation of the entire policy statement?
  2. Interaction with Match Options: How does this interact with match-set-options (e.g., INVERT)?
  3. Default Behavior: What is the behavior if a route does not match any entry in the prefix-set? (Usually, standard prefix lists have an implicit deny at the end, but in OpenConfig, a non-match in a condition simply means the condition is not met, and evaluation proceeds to the next statement or policy).

To ensure consistent implementation across different platforms, the description of the action leaf (or the module's general description) must explicitly define the evaluation semantics of these new fields within the context of routing policy conditions.

    leaf action {
      type prefix-set-prefix-action-type;
      description
        "Action applied to routes matching this prefix entry within
         the prefix set. If the action is PERMIT, a match on this entry
         causes the match-prefix-set condition to evaluate to true. If
         the action is DENY, a match on this entry causes the
         match-prefix-set condition to evaluate to false, terminating
         further evaluation of the prefix-set.";
    }

}

grouping prefix-state {
Expand Down