vpp: T8250: Rewrite the CLI for ACL tcp-flags

5 files changed, 112 insertions, 70 deletions

diff --git a/interface-definitions/include/version/vpp-version.xml.i b/interface-definitions/include/version/vpp-version.xml.i
index f5301f056..c12e3786c 100644
--- a/interface-definitions/include/version/vpp-version.xml.i
+++ b/interface-definitions/include/version/vpp-version.xml.i
@@ -1,3 +1,3 @@
 <!-- include start from include/version/vpp-version.xml.i -->
-<syntaxVersion component='vpp' version='5'></syntaxVersion>
-<!-- include end -->
\ No newline at end of file
+<syntaxVersion component='vpp' version='6'></syntaxVersion>
+<!-- include end -->
diff --git a/interface-definitions/include/vpp/acl_tcp_flags.xml.i b/interface-definitions/include/vpp/acl_tcp_flags.xml.i
index da17f3fe5..380df33a0 100644
--- a/interface-definitions/include/vpp/acl_tcp_flags.xml.i
+++ b/interface-definitions/include/vpp/acl_tcp_flags.xml.i
@@ -1,50 +1,41 @@
 <!-- include start from vpp/acl_tcp_flags.xml.i -->
-<leafNode name="syn">
-  <properties>
-    <help>Synchronise flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<leafNode name="ack">
-  <properties>
-    <help>Acknowledge flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<leafNode name="fin">
-  <properties>
-    <help>Finish flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<leafNode name="rst">
-  <properties>
-    <help>Reset flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<leafNode name="urg">
-  <properties>
-    <help>Urgent flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<leafNode name="psh">
-  <properties>
-    <help>Push flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<leafNode name="ecn">
-  <properties>
-    <help>Explicit Congestion Notification flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<leafNode name="cwr">
-  <properties>
-    <help>Congestion Window Reduced flag</help>
-    <valueless/>
-  </properties>
-</leafNode>
+<completionHelp>
+  <list>ack cwr ecn fin psh rst syn urg</list>
+</completionHelp>
+<valueHelp>
+  <format>ack</format>
+  <description>Acknowledge flag</description>
+</valueHelp>
+<valueHelp>
+  <format>cwr</format>
+  <description>Congestion Window Reduced flag</description>
+</valueHelp>
+<valueHelp>
+  <format>ecn</format>
+  <description>Explicit Congestion Notification flag</description>
+</valueHelp>
+<valueHelp>
+  <format>fin</format>
+  <description>Finish flag</description>
+</valueHelp>
+<valueHelp>
+  <format>psh</format>
+  <description>Push flag</description>
+</valueHelp>
+<valueHelp>
+  <format>rst</format>
+  <description>Reset flag</description>
+</valueHelp>
+<valueHelp>
+  <format>syn</format>
+  <description>Synchronise flag</description>
+</valueHelp>
+<valueHelp>
+  <format>urg</format>
+  <description>Urgent flag</description>
+</valueHelp>
+<constraint>
+  <regex>(syn|ack|fin|rst|urg|psh|ecn|cwr)</regex>
+</constraint>
+<multi/>
 <!-- include end -->
diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in
index c49488b68..14a869849 100644
--- a/interface-definitions/vpp.xml.in
+++ b/interface-definitions/vpp.xml.in
@@ -1512,18 +1512,21 @@
                     </leafNode>
                     <node name="tcp-flags">
                       <properties>
-                        <help>TCP flags</help>
+                        <help>Match TCP packet flags</help>
                       </properties>
                       <children>
-                        #include <include/vpp/acl_tcp_flags.xml.i>
-                        <node name="not">
+                        <leafNode name="is-set">
                           <properties>
-                            <help>Match flags not set</help>
+                            <help>Match TCP flags that are set</help>
+                            #include <include/vpp/acl_tcp_flags.xml.i>
                           </properties>
-                          <children>
+                        </leafNode>
+                        <leafNode name="is-not-set">
+                          <properties>
+                            <help>Match TCP flags that are not set</help>
                             #include <include/vpp/acl_tcp_flags.xml.i>
-                          </children>
-                        </node>
+                          </properties>
+                        </leafNode>
                       </children>
                     </node>
                   </children>
diff --git a/src/conf_mode/vpp_acl.py b/src/conf_mode/vpp_acl.py
index cbc915226..f075f9f5e 100644
--- a/src/conf_mode/vpp_acl.py
+++ b/src/conf_mode/vpp_acl.py
@@ -90,8 +90,8 @@ def create_ip_rules_list(rules):
         }
 
         tcp_flags = rule.get('tcp_flags', {})
-        set_flags = [flag for flag in tcp_flags if flag != 'not']
-        unet_flags = list(tcp_flags.get('not', {}).keys())
+        set_flags = tcp_flags.get('is_set', [])
+        unet_flags = tcp_flags.get('is_not_set', [])
         tcp_mask, tcp_value = get_tcp_mask_value(set_flags, unet_flags)
         r['tcp_flags_mask'] = tcp_mask
         r['tcp_flags_value'] = tcp_value
@@ -262,17 +262,17 @@ def verify(config):
                             f'{err_msg} protocol must be tcp when specifying tcp flags'
                         )
 
-                    not_flags = rule_config.get('tcp_flags').get('not', [])
-                    if not_flags:
-                        duplicates = [
-                            flag
-                            for flag in rule_config.get('tcp_flags')
-                            if flag in not_flags
-                        ]
-                        if duplicates:
-                            raise ConfigError(
-                                f'{err_msg} cannot match a tcp flag as set and not set: {duplicates}'
-                            )
+                    tcp_flags = rule_config.get('tcp_flags', {})
+                    flags_set = tcp_flags.get('is_set', [])
+                    flags_not_set = tcp_flags.get('is_not_set', [])
+
+                    # same flag cannot be both set and not set
+                    conflict = [flag for flag in flags_set if flag in flags_not_set]
+                    if conflict:
+                        raise ConfigError(
+                            f'{err_msg} cannot match a TCP flag as both set and not set: '
+                            f'{", ".join(sorted(conflict))}'
+                        )
 
         for iface, iface_config in acl.get('interface', {}).items():
             if not any(key in iface_config for key in ('input', 'output')):
diff --git a/src/migration-scripts/vpp/5-to-6 b/src/migration-scripts/vpp/5-to-6
new file mode 100644
index 000000000..4e9702996
--- /dev/null
+++ b/src/migration-scripts/vpp/5-to-6
@@ -0,0 +1,48 @@
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Migrate 'tcp-flags' to 'tcp-flags is-set' and 'tcp-flags is-not-set' multi-value nodes (T8250)
+
+
+from vyos.configtree import ConfigTree
+
+base = ['vpp', 'acl', 'ip', 'tag-name']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    for tag_name in config.list_nodes(base):
+        base_tag = base + [tag_name, 'rule']
+        for rule in config.list_nodes(base_tag):
+            base_tcp_flags = base_tag + [rule, 'tcp-flags']
+
+            if not config.exists(base_tcp_flags):
+                return
+
+            flags = config.list_nodes(base_tcp_flags)
+            set_flags = [flag for flag in flags if flag != 'not']
+            not_set_flags = config.list_nodes(base_tcp_flags + ['not'])
+
+            config.delete(base_tcp_flags)
+
+            if set_flags:
+                for flag in set_flags:
+                    config.set(base_tcp_flags + ['is-set'], value=flag, replace=False)
+
+            if not_set_flags:
+                for flag in not_set_flags:
+                    config.set(base_tcp_flags + ['is-not-set'], value=flag, replace=False)