From 151afffe15ce89755f3c3f81a9d2c647e487f647 Mon Sep 17 00:00:00 2001
From: "Nataliia S." <81954790+natali-rs1985@users.noreply.github.com>
Date: Tue, 13 May 2025 17:33:35 +0300
Subject: T7419: VPP ACL implementation (#31)

CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>

set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>

set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>

set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>

set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface

show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```
---
 .../include/vpp/acl_common_interface_ip_rule.xml.i | 25 +++++++++++
 .../include/vpp/acl_port_range.xml.i               | 18 ++++++++
 interface-definitions/include/vpp/acl_prefix.xml.i | 20 +++++++++
 .../include/vpp/acl_tcp_flags.xml.i                | 50 ++++++++++++++++++++++
 4 files changed, 113 insertions(+)
 create mode 100644 interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i
 create mode 100644 interface-definitions/include/vpp/acl_port_range.xml.i
 create mode 100644 interface-definitions/include/vpp/acl_prefix.xml.i
 create mode 100644 interface-definitions/include/vpp/acl_tcp_flags.xml.i

(limited to 'interface-definitions/include')

diff --git a/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i
new file mode 100644
index 000000000..a719a6223
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i
@@ -0,0 +1,25 @@
+<!-- include start from vpp/acl_common_interface_ip_rule.xml.i -->
+<tagNode name="acl-tag">
+  <properties>
+    <help>ACL rule (tag) number</help>
+    <valueHelp>
+      <format>u32</format>
+      <description>Number</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 1-4294967295"/>
+    </constraint>
+    <constraintErrorMessage>Number must be between 1 and 4294967295</constraintErrorMessage>
+  </properties>
+  <children>
+    <leafNode name="tag-name">
+      <properties>
+        <help>ACL tag name</help>
+        <completionHelp>
+          <path>vpp acl ip tag-name</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+  </children>
+</tagNode>
+<!-- include end -->
diff --git a/interface-definitions/include/vpp/acl_port_range.xml.i b/interface-definitions/include/vpp/acl_port_range.xml.i
new file mode 100644
index 000000000..26bd2de45
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_port_range.xml.i
@@ -0,0 +1,18 @@
+<!-- include start from vpp/acl_port_range.xml.i -->
+<leafNode name="port">
+  <properties>
+    <help>Port number or range</help>
+    <valueHelp>
+      <format>u32:1-65535</format>
+      <description>Numeric IP port</description>
+    </valueHelp>
+    <valueHelp>
+      <format>range</format>
+      <description>Numbered port range (e.g., 1001-1005)</description>
+    </valueHelp>
+    <constraint>
+     <validator name="port-range"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/vpp/acl_prefix.xml.i b/interface-definitions/include/vpp/acl_prefix.xml.i
new file mode 100644
index 000000000..790153c8f
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_prefix.xml.i
@@ -0,0 +1,20 @@
+<!-- include start from vpp/acl_prefix.xml.i -->
+<leafNode name="prefix">
+  <properties>
+    <help>IP prefix</help>
+    <valueHelp>
+      <format>ipv4net</format>
+      <description>IPv4 prefix</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6net</format>
+      <description>IPv6 prefix</description>
+    </valueHelp>
+    <constraint>
+      <validator name="ipv4-prefix"/>
+      <validator name="ipv6-prefix"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
+
diff --git a/interface-definitions/include/vpp/acl_tcp_flags.xml.i b/interface-definitions/include/vpp/acl_tcp_flags.xml.i
new file mode 100644
index 000000000..da17f3fe5
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_tcp_flags.xml.i
@@ -0,0 +1,50 @@
+<!-- include start from vpp/acl_tcp_flags.xml.i -->
+<leafNode name="syn">
+  <properties>
+    <help>Synchronise flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="ack">
+  <properties>
+    <help>Acknowledge flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="fin">
+  <properties>
+    <help>Finish flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="rst">
+  <properties>
+    <help>Reset flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="urg">
+  <properties>
+    <help>Urgent flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="psh">
+  <properties>
+    <help>Push flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="ecn">
+  <properties>
+    <help>Explicit Congestion Notification flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="cwr">
+  <properties>
+    <help>Congestion Window Reduced flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- include end -->
-- 
cgit v1.2.3