From 151afffe15ce89755f3c3f81a9d2c647e487f647 Mon Sep 17 00:00:00 2001
From: "Nataliia S." <81954790+natali-rs1985@users.noreply.github.com>
Date: Tue, 13 May 2025 17:33:35 +0300
Subject: T7419: VPP ACL implementation (#31)

CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>

set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>

set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>

set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>

set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface

show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```
---
 data/config-mode-dependencies/vyos-vpp.json | 8 ++++++++
 data/templates/vpp/startup.conf.j2          | 2 ++
 2 files changed, 10 insertions(+)

(limited to 'data')

diff --git a/data/config-mode-dependencies/vyos-vpp.json b/data/config-mode-dependencies/vyos-vpp.json
index 0f1d8af34..2a5613559 100644
--- a/data/config-mode-dependencies/vyos-vpp.json
+++ b/data/config-mode-dependencies/vyos-vpp.json
@@ -10,41 +10,48 @@
         "vpp_interfaces_loopback": ["vpp_interfaces_loopback"],
         "vpp_interfaces_vxlan": ["vpp_interfaces_vxlan"],
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
     },
     "vpp_interfaces_bonding": {
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
     },
     "vpp_interfaces_ethernet": {
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
     },
     "vpp_interfaces_geneve": {
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
     },
     "vpp_interfaces_gre": {
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
     },
     "vpp_interfaces_ipip": {
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
     },
     "vpp_interfaces_loopback": {
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
@@ -52,6 +59,7 @@
     "vpp_interfaces_vxlan": {
         "vpp_interfaces_bridge": ["vpp_interfaces_bridge"],
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
+        "vpp_acl": ["vpp_acl"],
         "vpp_nat": ["vpp_nat"],
         "vpp_nat_cgnat": ["vpp_nat_cgnat"],
         "vpp_kernel_interface": ["vpp_kernel-interfaces"]
diff --git a/data/templates/vpp/startup.conf.j2 b/data/templates/vpp/startup.conf.j2
index 589afa67b..79a551338 100644
--- a/data/templates/vpp/startup.conf.j2
+++ b/data/templates/vpp/startup.conf.j2
@@ -114,6 +114,8 @@ plugins {
     plugin crypto_openssl_plugin.so { enable }
 {% endif %}
     # plugin wireguard_plugin.so { enable }
+    # ACL
+    plugin acl_plugin.so { enable }
 }
 
 linux-cp {
-- 
cgit v1.2.3