Add initial prefix filter

release/models/aft/.spec.yml

@@ -4,9 +4,11 @@
     - yang/aft/openconfig-aft-counters.yang
     - yang/aft/openconfig-aft-types.yang
     - yang/aft/openconfig-aft-summary.yang
+    - yang/aft/openconfig-aft-global-filter.yang
   build:
     - yang/network-instance/openconfig-network-instance.yang
     - yang/aft/openconfig-aft-network-instance.yang
     - yang/aft/openconfig-aft-counters.yang
     - yang/aft/openconfig-aft-summary.yang
+    - yang/aft/openconfig-aft-global-filter.yang
   run-ci: true

release/models/aft/openconfig-aft-common.yang

@@ -23,7 +23,13 @@ submodule openconfig-aft-common {
     "Submodule containing definitions of groupings that are re-used
     across multiple contexts within the AFT model.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description
@@ -203,6 +209,7 @@ submodule openconfig-aft-common {
       "Structural grouping describing a next-hop entry.";
 
     container next-hops {
+      config false;
       description
         "The list of next-hops that are to be used for entry within
         the AFT table. The structure of each next-hop is address
@@ -935,6 +942,7 @@ submodule openconfig-aft-common {
       "Logical grouping for groups of next-hops.";
 
     container next-hop-groups {
+      config false;
       description
         "Surrounding container for groups of next-hops.";
 

release/models/aft/openconfig-aft-ethernet.yang

@@ -20,7 +20,13 @@ submodule openconfig-aft-ethernet {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for Ethernet.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description

release/models/aft/openconfig-aft-global-filter.yang

@@ -0,0 +1,103 @@
+module openconfig-aft-global-filter {
+  namespace "http://openconfig.net/yang/aft/global-filter";
+  prefix "oc-aft-gf";
+
+  import openconfig-extensions { prefix "oc-ext"; }
+  import openconfig-network-instance { prefix "oc-ni"; }
+  import openconfig-routing-policy { prefix "oc-rpol"; }
+
+  organization
+    "OpenConfig working group";
+
+  contact
+    "OpenConfig working group
+    www.openconfig.net";
+
+  description
+    "Module containing definitions of groupings for the global
+     filter configuration applicable to abstract forwarding tables.";
+
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance and per
+       AFT filtering, with routing policy split by address family.";
+    reference "3.3.0";
+  }
+
+  grouping aft-global-filter-config {
+    description
+      "Configuration parameters for the AFT global filter.";
+    leaf ipv6-policy {
+      type leafref {
+        path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
+             "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
+      }
+      description
+        "Reference to a routing policy that is used to filter the
+         IPv6 prefixes that are streamed from the FIB. This does
+         not affect which prefixes are installed in the FIB. The
+         policy may, for example, use an explicit prefix set to
+         match prefixes, or match prefixes that are more specific than
+         a given prefix.";
+    }
+
+    leaf ipv4-policy {
+      type leafref {
+        path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
+             "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
+      }
+      description
+        "Reference to a routing policy that is used to filter the
+         IPv4 prefixes that are streamed from the FIB. This does
+         not affect which prefixes are installed in the FIB. The
+         policy may, for example, use an explicit prefix set to
+         match prefixes, or match prefixes that are more specific than
+         a given prefix.";
+    }
+  }
+
+
+  grouping aft-global-filter-structural {
+    description
+      "Structural grouping defining the schema for the global filter
+       applied to the abstract forwarding tables.";
+
+    container global-filter {
+      description
+        "Configuration and state for a global filter applied to the
+         AFT. The filter is used to restrict which prefixes from the
+         network instance's AFT are streamed via gNMI; it does not
+         affect which prefixes are installed in the forwarding plane
+         (hardware FIB). All gNMI clients subscribing to the IPv4 or
+         IPv6 AFT for this network instance will only receive data
+         corresponding to prefixes accepted by the configured
+         filter policy. Prefixes rejected by the policy are omitted
+         from the streamed AFT state for every subscriber, regardless
+         of the client.";
+
+      container config {
+        description
+          "Configuration parameters for the AFT global filter.";
+
+        uses aft-global-filter-config;
+      }
+
+      container state {
+        config false;
+        description
+          "Operational state parameters for the AFT global filter.";
+
+        uses aft-global-filter-config;
+      }
+    }
+  }
+
+  augment "/oc-ni:network-instances/oc-ni:network-instance/oc-ni:afts" {
+    description
+      "Add global filter to AFT tree.";
+
+    uses aft-global-filter-structural;
+  }
+}

release/models/aft/openconfig-aft-ipv4.yang

@@ -20,7 +20,13 @@ submodule openconfig-aft-ipv4 {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for IPv4.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description

release/models/aft/openconfig-aft-ipv6.yang

@@ -20,7 +20,13 @@ submodule openconfig-aft-ipv6 {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for IPv6.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description

release/models/aft/openconfig-aft-mpls.yang

@@ -21,7 +21,13 @@ submodule openconfig-aft-mpls {
     "Submodule containing definitions of groupings for the abstract
     forwarding table for MPLS label forwarding.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description

release/models/aft/openconfig-aft-pf.yang

@@ -28,7 +28,13 @@ submodule openconfig-aft-pf {
     fields other than the destination address that is used in
     other forwarding tables.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description

release/models/aft/openconfig-aft-state-synced.yang

@@ -16,7 +16,13 @@ submodule openconfig-aft-state-synced {
     "Submodule containing definitions of groupings for the state
     synced signals corresponding to various abstract forwarding tables.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description

release/models/aft/openconfig-aft-summary.yang

@@ -20,7 +20,13 @@ module openconfig-aft-summary {
     "This module provides summary of aft entry counts per protocol type for each network
     instance.";
 
-  oc-ext:openconfig-version "0.2.0";
+  oc-ext:openconfig-version "0.2.1";
+
+  revision "2026-03-11" {
+    description
+      "Add config false to protocols and state containers.";
+    reference "0.2.1";
+  }
 
   revision "2024-01-12" {
     description
@@ -49,7 +55,7 @@ module openconfig-aft-summary {
 
     container counters {
       description
-      "Enclosing container for aft entry counters";
+        "Enclosing container for aft entry counters";
 
       leaf aft-entries {
         description
@@ -64,6 +70,7 @@ module openconfig-aft-summary {
       "A summary of aft entries by protocol type.";
 
     container protocols {
+      config false;
       description
         "Enclosing container for a list of protocols";
       list protocol {
@@ -81,6 +88,7 @@ module openconfig-aft-summary {
         }
 
         container state {
+          config false;
           description
             "State parameters for the aft entry list.";
           uses protocols-state;

release/models/aft/openconfig-aft.yang

@@ -42,7 +42,13 @@ module openconfig-aft {
     is referred to as an Abstract Forwarding Table (AFT), rather than
     the FIB.";
 
-  oc-ext:openconfig-version "3.3.0";
+  oc-ext:openconfig-version "3.4.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.4.0";
+  }
 
   revision "2026-02-09" {
     description
@@ -231,7 +237,6 @@ module openconfig-aft {
       AFT.";
 
     container afts {
-      config false;
       description
         "The abstract forwarding tables (AFTs) that are associated
         with the network instance. An AFT is instantiated per-protocol
@@ -243,6 +248,7 @@ module openconfig-aft {
         forwarding entry.";
 
       container ipv4-unicast {
+        config false;
         description
           "The abstract forwarding table for IPv4 unicast. Entries
           within this table are uniquely keyed on the IPv4 unicast
@@ -257,6 +263,7 @@ module openconfig-aft {
       }
 
       container ipv6-unicast {
+        config false;
         description
           "The abstract forwarding table for IPv6 unicast. Entries
           within this table are uniquely keyed on the IPv6 unicast
@@ -271,6 +278,7 @@ module openconfig-aft {
       }
 
       container policy-forwarding {
+        config false;
         description
           "The abstract forwarding table for policy-based forwarding
           entries. Since multiple match criteria can be utilised
@@ -288,6 +296,7 @@ module openconfig-aft {
       }
 
       container mpls {
+        config false;
         description
           "The abstract forwarding table for MPLS label based
           forwarding entries. Entries within the table are keyed based
@@ -298,6 +307,7 @@ module openconfig-aft {
       }
 
       container ethernet {
+        config false;
         description
           "The abstract forwarding table for Ethernet based forwarding
           entries. Entries within the table are keyed based on the
@@ -307,6 +317,7 @@ module openconfig-aft {
       }
 
       container state-synced {
+        config false;
         description
           "In some cases AFT streaming (e.g., over gNMI) is an eventually consistent system.
           When the device updates an entry it is usually expected to