From 151afffe15ce89755f3c3f81a9d2c647e487f647 Mon Sep 17 00:00:00 2001
From: "Nataliia S." <81954790+natali-rs1985@users.noreply.github.com>
Date: Tue, 13 May 2025 17:33:35 +0300
Subject: T7419: VPP ACL implementation (#31)

CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>

set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>

set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>

set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>

set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface

show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```
---
 .../include/vpp/acl_common_interface_ip_rule.xml.i |  25 ++
 .../include/vpp/acl_port_range.xml.i               |  18 ++
 interface-definitions/include/vpp/acl_prefix.xml.i |  20 ++
 .../include/vpp/acl_tcp_flags.xml.i                |  50 ++++
 interface-definitions/vpp.xml.in                   | 254 ++++++++++++++++++++-
 5 files changed, 365 insertions(+), 2 deletions(-)
 create mode 100644 interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i
 create mode 100644 interface-definitions/include/vpp/acl_port_range.xml.i
 create mode 100644 interface-definitions/include/vpp/acl_prefix.xml.i
 create mode 100644 interface-definitions/include/vpp/acl_tcp_flags.xml.i

(limited to 'interface-definitions')

diff --git a/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i
new file mode 100644
index 000000000..a719a6223
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i
@@ -0,0 +1,25 @@
+<!-- include start from vpp/acl_common_interface_ip_rule.xml.i -->
+<tagNode name="acl-tag">
+  <properties>
+    <help>ACL rule (tag) number</help>
+    <valueHelp>
+      <format>u32</format>
+      <description>Number</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 1-4294967295"/>
+    </constraint>
+    <constraintErrorMessage>Number must be between 1 and 4294967295</constraintErrorMessage>
+  </properties>
+  <children>
+    <leafNode name="tag-name">
+      <properties>
+        <help>ACL tag name</help>
+        <completionHelp>
+          <path>vpp acl ip tag-name</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+  </children>
+</tagNode>
+<!-- include end -->
diff --git a/interface-definitions/include/vpp/acl_port_range.xml.i b/interface-definitions/include/vpp/acl_port_range.xml.i
new file mode 100644
index 000000000..26bd2de45
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_port_range.xml.i
@@ -0,0 +1,18 @@
+<!-- include start from vpp/acl_port_range.xml.i -->
+<leafNode name="port">
+  <properties>
+    <help>Port number or range</help>
+    <valueHelp>
+      <format>u32:1-65535</format>
+      <description>Numeric IP port</description>
+    </valueHelp>
+    <valueHelp>
+      <format>range</format>
+      <description>Numbered port range (e.g., 1001-1005)</description>
+    </valueHelp>
+    <constraint>
+     <validator name="port-range"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/vpp/acl_prefix.xml.i b/interface-definitions/include/vpp/acl_prefix.xml.i
new file mode 100644
index 000000000..790153c8f
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_prefix.xml.i
@@ -0,0 +1,20 @@
+<!-- include start from vpp/acl_prefix.xml.i -->
+<leafNode name="prefix">
+  <properties>
+    <help>IP prefix</help>
+    <valueHelp>
+      <format>ipv4net</format>
+      <description>IPv4 prefix</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6net</format>
+      <description>IPv6 prefix</description>
+    </valueHelp>
+    <constraint>
+      <validator name="ipv4-prefix"/>
+      <validator name="ipv6-prefix"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
+
diff --git a/interface-definitions/include/vpp/acl_tcp_flags.xml.i b/interface-definitions/include/vpp/acl_tcp_flags.xml.i
new file mode 100644
index 000000000..da17f3fe5
--- /dev/null
+++ b/interface-definitions/include/vpp/acl_tcp_flags.xml.i
@@ -0,0 +1,50 @@
+<!-- include start from vpp/acl_tcp_flags.xml.i -->
+<leafNode name="syn">
+  <properties>
+    <help>Synchronise flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="ack">
+  <properties>
+    <help>Acknowledge flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="fin">
+  <properties>
+    <help>Finish flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="rst">
+  <properties>
+    <help>Reset flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="urg">
+  <properties>
+    <help>Urgent flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="psh">
+  <properties>
+    <help>Push flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="ecn">
+  <properties>
+    <help>Explicit Congestion Notification flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="cwr">
+  <properties>
+    <help>Congestion Window Reduced flag</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in
index 368405a02..dab0ea308 100644
--- a/interface-definitions/vpp.xml.in
+++ b/interface-definitions/vpp.xml.in
@@ -942,7 +942,7 @@
         <node name="cgnat" owner="${vyos_conf_scripts_dir}/vpp_nat_cgnat.py">
           <properties>
             <help>Carrier-grade NAT (CGNAT)</help>
-            <priority>321</priority>
+            <priority>331</priority>
           </properties>
           <children>
             <node name="interface">
@@ -1060,7 +1060,7 @@
     <node name="nat44" owner="${vyos_conf_scripts_dir}/vpp_nat.py">
       <properties>
         <help>NAT44</help>
-        <priority>320</priority>
+        <priority>330</priority>
       </properties>
       <children>
         <node name="interface">
@@ -1265,6 +1265,256 @@
         </node>
       </children>
     </node>
+    <node name="acl" owner="${vyos_conf_scripts_dir}/vpp_acl.py">
+      <properties>
+        <help>Access Control Lists (ACLs)</help>
+        <priority>332</priority>
+      </properties>
+      <children>
+        <node name="ip">
+          <properties>
+            <help>Access Control List by IPv4/IPv6</help>
+          </properties>
+          <children>
+            <tagNode name="tag-name">
+              <properties>
+                <help>ACL tag name</help>
+                <valueHelp>
+                  <format>txt</format>
+                  <description>Tag name</description>
+                </valueHelp>
+              </properties>
+              <children>
+                #include <include/generic-description.xml.i>
+                <tagNode name="rule">
+                  <properties>
+                    <help>Rule number for Access control element (ACE)</help>
+                    <valueHelp>
+                      <format>u32</format>
+                      <description>Number of ACE</description>
+                    </valueHelp>
+                    <constraint>
+                      <validator name="numeric" argument="--range 1-4294967295"/>
+                    </constraint>
+                    <constraintErrorMessage>Rule number must be between 1 and 4294967295</constraintErrorMessage>
+                  </properties>
+                  <children>
+                    #include <include/generic-description.xml.i>
+                    <leafNode name="action">
+                      <properties>
+                        <help>Rule action</help>
+                        <completionHelp>
+                          <list>permit deny permit-reflect</list>
+                        </completionHelp>
+                        <valueHelp>
+                          <format>permit</format>
+                          <description>Permit matching traffic</description>
+                        </valueHelp>
+                        <valueHelp>
+                          <format>deny</format>
+                          <description>Deny matching traffic</description>
+                        </valueHelp>
+                        <valueHelp>
+                          <format>permit-reflect</format>
+                          <description>Permit the matching outbound traffic and allow the reverse traffic</description>
+                        </valueHelp>
+                        <constraint>
+                          <regex>(permit|deny|permit-reflect)</regex>
+                        </constraint>
+                      </properties>
+                    </leafNode>
+                    <node name="source">
+                      <properties>
+                        <help>Source parameters</help>
+                      </properties>
+                      <children>
+                        #include <include/vpp/acl_prefix.xml.i>
+                        #include <include/vpp/acl_port_range.xml.i>
+                      </children>
+                    </node>
+                    <node name="destination">
+                      <properties>
+                        <help>Destination parameters</help>
+                      </properties>
+                      <children>
+                        #include <include/vpp/acl_prefix.xml.i>
+                        #include <include/vpp/acl_port_range.xml.i>
+                      </children>
+                    </node>
+                    <leafNode name="protocol">
+                      <properties>
+                        <help>Protocol</help>
+                        <completionHelp>
+                          <script>${vyos_completion_dir}/list_protocols.sh</script>
+                          <list>all</list>
+                        </completionHelp>
+                        <valueHelp>
+                          <format>all</format>
+                          <description>All IP protocols</description>
+                        </valueHelp>
+                        <valueHelp>
+                          <format>&lt;protocol&gt;</format>
+                          <description>IP protocol name</description>
+                        </valueHelp>
+                        <constraint>
+                          <validator name="ip-protocol"/>
+                        </constraint>
+                      </properties>
+                      <defaultValue>all</defaultValue>
+                    </leafNode>
+                    <node name="tcp-flags">
+                      <properties>
+                        <help>TCP flags</help>
+                      </properties>
+                      <children>
+                        #include <include/vpp/acl_tcp_flags.xml.i>
+                        <node name="not">
+                          <properties>
+                            <help>Match flags not set</help>
+                          </properties>
+                          <children>
+                            #include <include/vpp/acl_tcp_flags.xml.i>
+                          </children>
+                        </node>
+                      </children>
+                    </node>
+                  </children>
+                </tagNode>
+              </children>
+            </tagNode>
+            <tagNode name="interface">
+              <properties>
+                <help>Apply an ACL to an interface</help>
+                <completionHelp>
+                  <script>${vyos_completion_dir}/list_interfaces</script>
+                </completionHelp>
+              </properties>
+              <children>
+                <node name="input">
+                  <properties>
+                    <help>Input direction</help>
+                  </properties>
+                  <children>
+                    #include <include/vpp/acl_common_interface_ip_rule.xml.i>
+                  </children>
+                </node>
+                <node name="output">
+                  <properties>
+                    <help>Output direction</help>
+                  </properties>
+                  <children>
+                    #include <include/vpp/acl_common_interface_ip_rule.xml.i>
+                  </children>
+                </node>
+              </children>
+            </tagNode>
+          </children>
+        </node>
+        <node name="macip">
+          <properties>
+            <help>Access Control List by mac address</help>
+          </properties>
+          <children>
+            <tagNode name="tag-name">
+              <properties>
+                <help>ACL tag name</help>
+                <valueHelp>
+                  <format>txt</format>
+                  <description>ACL name</description>
+                </valueHelp>
+              </properties>
+              <children>
+                #include <include/generic-description.xml.i>
+                <tagNode name="rule">
+                  <properties>
+                    <help>Rule number for Access control element (ACE)</help>
+                    <valueHelp>
+                      <format>u32</format>
+                      <description>Number of ACE</description>
+                    </valueHelp>
+                    <constraint>
+                      <validator name="numeric" argument="--range 1-4294967295"/>
+                    </constraint>
+                    <constraintErrorMessage>Rule number must be between 1 and 4294967295</constraintErrorMessage>
+                  </properties>
+                  <children>
+                    #include <include/generic-description.xml.i>
+                    <leafNode name="action">
+                      <properties>
+                        <help>Rule action</help>
+                        <completionHelp>
+                          <list>permit deny</list>
+                        </completionHelp>
+                        <valueHelp>
+                          <format>permit</format>
+                          <description>Permit matching traffic</description>
+                        </valueHelp>
+                        <valueHelp>
+                          <format>deny</format>
+                          <description>Deny matching traffic</description>
+                        </valueHelp>
+                        <constraint>
+                          <regex>(permit|deny)</regex>
+                        </constraint>
+                      </properties>
+                    </leafNode>
+                    #include <include/vpp/acl_prefix.xml.i>
+                    <leafNode name="prefix">
+                      <properties>
+                        <help>Source IP prefix</help>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="mac-address">
+                      <properties>
+                        <help>Source MAC address</help>
+                        <valueHelp>
+                          <format>macaddr</format>
+                          <description>MAC address</description>
+                        </valueHelp>
+                        <constraint>
+                          <validator name="mac-address"/>
+                        </constraint>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="mac-mask">
+                      <properties>
+                        <help>Source MAC mask (default ff:ff:ff:ff:ff:ff)</help>
+                        <valueHelp>
+                          <format>macaddr</format>
+                          <description>MAC mask</description>
+                        </valueHelp>
+                        <constraint>
+                          <validator name="mac-address"/>
+                        </constraint>
+                      </properties>
+                      <defaultValue>ff:ff:ff:ff:ff:ff</defaultValue>
+                    </leafNode>
+                  </children>
+                </tagNode>
+              </children>
+            </tagNode>
+            <tagNode name="interface">
+              <properties>
+                <help>Apply an ACL to an input interface</help>
+                <completionHelp>
+                  <script>${vyos_completion_dir}/list_interfaces</script>
+                </completionHelp>
+              </properties>
+              <children>
+                <leafNode name="tag-name">
+                  <properties>
+                    <help>ACL tag name</help>
+                    <completionHelp>
+                      <path>vpp acl macip tag-name</path>
+                    </completionHelp>
+                  </properties>
+                </leafNode>
+              </children>
+            </tagNode>
+          </children>
+        </node>
+      </children>
+    </node>
     <tagNode name="kernel-interfaces" owner="${vyos_conf_scripts_dir}/vpp_kernel-interfaces.py">
       <properties>
         <help>VPP kernel interface settings</help>
-- 
cgit v1.2.3