Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify policy-forwarding and routing-policy if no rules are present #1223

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Clarify policy-forwarding and routing-policy if no rules are present #1223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5a097d2
Clarify that if no rules are present, no packets will be matched.
dplore Nov 14, 2024
abd0e40
change to match all packets if no rules are specified.
dplore Nov 26, 2024
3c0ecfe
Update openconfig-policy-forwarding.yang
dplore Nov 26, 2024
552ac01
Merge branch 'master' into dplore/pf-match-clarification
dplore Nov 26, 2024
df6ab42
clarify all packets matched in routing-policy if no condition specified.
dplore Nov 26, 2024
def87eb
fix version statment
dplore Nov 26, 2024
96a3514
Merge branch 'master' into dplore/pf-match-clarification
dplore Dec 28, 2024
441428e
add description if action is missing
dplore Dec 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 16 additions & 6 deletions release/models/policy-forwarding/openconfig-policy-forwarding.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,14 @@ module openconfig-policy-forwarding {

A forwarding-policy specifies the match criteria that it intends
to use to determine the packets that it reroutes - this may
consist of a number of criteria, such as DSCP. The action of the
policy results in a forwarding action being applied to matching
packets. For example, decapsulating the packet from a GRE header.
In order to enact the policy based on particular interfaces - the
forwarding-policy is applied to an interface via referencing it
consist of a number of criteria, such as DSCP. The match criteria
is specified as rules. If no rules are specified, then the policy
will match all packets.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this the right thing to do vs. having an explicit match-all type criteria?

The downside of this API design is that the absence of something means something implicitly -- it seems a better API design to have the presence of something indicate something, which would mean that we should rather have an explicit "match everything" (can be done with matching all src/dst IP addrs)?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no right or wrong here. This proposal is made based on precedent as referenced in #1223 (comment) earlier in this PR. The industry precedent is no-condition = matches any and all. This was also discussed in the OpenConfig operator meeting on Nov 26, 2024 with some thoughtful conversation.

The precedent is pretty strong where 5 out of 5 implement that no "condition" means match all. (Not included in the gist of 4 examples is arista EOS, which also defines a route map with no match statements as match all)

I do like the idea of being explicit in general. A number of changes in OC in the last few years have been due to ambiguity. But what is better? Do something different in OC or go with the precedent? In this case, I think the precedent is so strong that it's better to go with no conditions means match all. This change makes this decision explicit via description, but not in the data model/API.


The action of the policy results in a forwarding action being applied
to matching packets. For example, decapsulating the packet from a GRE
header. In order to enact the policy based on particular interfaces -
the forwarding-policy is applied to an interface via referencing it
within an 'apply-forwarding-policy' statement associated with an
interface.

Expand All @@ -81,7 +84,13 @@ module openconfig-policy-forwarding {
The forwarding action of the corresponding policy is set to
PATH_GROUP and references the configured group of LSPs.";

oc-ext:openconfig-version "0.6.1";
oc-ext:openconfig-version "0.7.0";

revision "2024-11-14" {
description
"Clarify that if no rules are present, all packets will be matched.";
reference "0.7.0";
}

revision "2023-04-25" {
description
Expand Down Expand Up @@ -159,3 +168,4 @@ module openconfig-policy-forwarding {
}
}
}

24 changes: 18 additions & 6 deletions release/models/policy/openconfig-routing-policy.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,11 +51,17 @@ module openconfig-routing-policy {
Evaluation of each policy definition proceeds by evaluating its
corresponding individual policy statements in order. When a
condition statement in a policy statement is satisfied, the
corresponding action statement is executed. If the action
statement has a final disposition configured as policy result, either
accept-route or reject-route, evaluation of the current policy definition
stops, and no further policy statements are evaluated. In case there is a
policy chain, no further policy definitions in the chain are evaluated.
corresponding action statement is executed. A policy statement with no
conditions defined is evaluated as statisfied, meaning all routes are
matched. A routing-policy statement with no condition AND no action, or
a policy-definition without any statements should be treated as errors
(grpc error: INVALID_ARGUMENT, netconfig error missing-element).

If the action statement has a final disposition configured as
policy result, either accept-route or reject-route, evaluation of the
current policy definition stops, and no further policy statements are
evaluated. In case there is a policy chain, no further policy definitions
in the chain are evaluated.
dplore marked this conversation as resolved.
Show resolved Hide resolved

If the action statement has the NEXT_STATEMENT policy result, all the
defined actions are executed and policy evaluation proceeds to the next
Expand Down Expand Up @@ -87,8 +93,14 @@ module openconfig-routing-policy {
default value for the default-(import|export)-policy leaf must be
applied. See RFC6020 7.6.1 which applies to this model.";

oc-ext:openconfig-version "3.4.2";
oc-ext:openconfig-version "3.5.0";

revision "2024-11-26" {
description
"Clarify that a policy statement with no conditions defined is evaluated
as statisfied.";
reference "3.5.0";
}
revision "2023-11-01" {
description
"Refactor apply policy to separate default policy in it's own common
Expand Down
Loading