From f94add1ee4eb7255eb5a39d33aa6314d11e8af7e Mon Sep 17 00:00:00 2001
From: Nataliia Solomko <natalirs1985@gmail.com>
Date: Tue, 10 Feb 2026 19:28:52 +0200
Subject: vpp: T8250: Rewrite the CLI for ACL tcp-flags

---
 src/conf_mode/vpp_acl.py         | 26 +++++++++++-----------
 src/migration-scripts/vpp/5-to-6 | 48 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 13 deletions(-)
 create mode 100644 src/migration-scripts/vpp/5-to-6

(limited to 'src')

diff --git a/src/conf_mode/vpp_acl.py b/src/conf_mode/vpp_acl.py
index cbc915226..f075f9f5e 100644
--- a/src/conf_mode/vpp_acl.py
+++ b/src/conf_mode/vpp_acl.py
@@ -90,8 +90,8 @@ def create_ip_rules_list(rules):
         }
 
         tcp_flags = rule.get('tcp_flags', {})
-        set_flags = [flag for flag in tcp_flags if flag != 'not']
-        unet_flags = list(tcp_flags.get('not', {}).keys())
+        set_flags = tcp_flags.get('is_set', [])
+        unet_flags = tcp_flags.get('is_not_set', [])
         tcp_mask, tcp_value = get_tcp_mask_value(set_flags, unet_flags)
         r['tcp_flags_mask'] = tcp_mask
         r['tcp_flags_value'] = tcp_value
@@ -262,17 +262,17 @@ def verify(config):
                             f'{err_msg} protocol must be tcp when specifying tcp flags'
                         )
 
-                    not_flags = rule_config.get('tcp_flags').get('not', [])
-                    if not_flags:
-                        duplicates = [
-                            flag
-                            for flag in rule_config.get('tcp_flags')
-                            if flag in not_flags
-                        ]
-                        if duplicates:
-                            raise ConfigError(
-                                f'{err_msg} cannot match a tcp flag as set and not set: {duplicates}'
-                            )
+                    tcp_flags = rule_config.get('tcp_flags', {})
+                    flags_set = tcp_flags.get('is_set', [])
+                    flags_not_set = tcp_flags.get('is_not_set', [])
+
+                    # same flag cannot be both set and not set
+                    conflict = [flag for flag in flags_set if flag in flags_not_set]
+                    if conflict:
+                        raise ConfigError(
+                            f'{err_msg} cannot match a TCP flag as both set and not set: '
+                            f'{", ".join(sorted(conflict))}'
+                        )
 
         for iface, iface_config in acl.get('interface', {}).items():
             if not any(key in iface_config for key in ('input', 'output')):
diff --git a/src/migration-scripts/vpp/5-to-6 b/src/migration-scripts/vpp/5-to-6
new file mode 100644
index 000000000..4e9702996
--- /dev/null
+++ b/src/migration-scripts/vpp/5-to-6
@@ -0,0 +1,48 @@
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Migrate 'tcp-flags' to 'tcp-flags is-set' and 'tcp-flags is-not-set' multi-value nodes (T8250)
+
+
+from vyos.configtree import ConfigTree
+
+base = ['vpp', 'acl', 'ip', 'tag-name']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    for tag_name in config.list_nodes(base):
+        base_tag = base + [tag_name, 'rule']
+        for rule in config.list_nodes(base_tag):
+            base_tcp_flags = base_tag + [rule, 'tcp-flags']
+
+            if not config.exists(base_tcp_flags):
+                return
+
+            flags = config.list_nodes(base_tcp_flags)
+            set_flags = [flag for flag in flags if flag != 'not']
+            not_set_flags = config.list_nodes(base_tcp_flags + ['not'])
+
+            config.delete(base_tcp_flags)
+
+            if set_flags:
+                for flag in set_flags:
+                    config.set(base_tcp_flags + ['is-set'], value=flag, replace=False)
+
+            if not_set_flags:
+                for flag in not_set_flags:
+                    config.set(base_tcp_flags + ['is-not-set'], value=flag, replace=False)
-- 
cgit v1.2.3