summaryrefslogtreecommitdiffstats
path: root/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
diff options
context:
space:
mode:
authorJan Srnicek <jsrnicek@cisco.com>2017-03-08 14:01:34 +0100
committerMarek Gradzki <mgradzki@cisco.com>2017-03-09 07:09:36 +0000
commitbf1d5db448edc1ae352960f14bca9ccb41612186 (patch)
treecdf6f5feebf650050bde23ffe7a9a2f8d6389a94 /vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
parent6532b1524bb841cac2b559415b85ac6e9d2ff934 (diff)
HC2VPP-7 - split vpp-classifiers to separate module
Split vpp-classifiers and vpp-classifiers acls' to separate modules. Contains TODO's for future change of dependencies Change-Id: I94f92ce2ec8960c67bd406f085f2fe928079ee23 Signed-off-by: Jan Srnicek <jsrnicek@cisco.com>
Diffstat (limited to 'vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang')
-rw-r--r--vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang183
1 files changed, 183 insertions, 0 deletions
diff --git a/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang b/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
new file mode 100644
index 000000000..ccf3e286a
--- /dev/null
+++ b/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
@@ -0,0 +1,183 @@
+module vpp-classifier-acl {
+ yang-version 1;
+ namespace "urn:opendaylight:params:xml:ns:yang:vpp:classifier:acl";
+ prefix "vpp-classifier-acl";
+
+ revision "2016-12-14" {
+ description
+ "Initial revision of vpp-classfier-acl model.";
+ }
+
+ import ietf-access-control-list {
+ prefix "acl";
+ }
+
+ import vpp-classifier {
+ prefix "vpp-classifier";
+ }
+
+ import yang-ext {
+ prefix "ext";
+ }
+
+ import ietf-packet-fields {
+ prefix packet-fields;
+ }
+
+ identity mixed-acl {
+ base acl:acl-base;
+ description
+ "ACL that can match on any of L2/L3/L4 fields.";
+ }
+
+ typedef interface-mode {
+ type enumeration {
+ enum "l2";
+ enum "l3";
+ }
+ }
+
+ grouping acl-base-attributes {
+ description
+ "Defines references to classify tables.
+ At least one table reference should be specified.";
+ container l2-acl {
+ leaf classify-table {
+ type vpp-classifier:classify-table-ref;
+ description
+ "An L2 ACL table";
+ }
+ }
+ container ip4-acl {
+ leaf classify-table {
+ type vpp-classifier:classify-table-ref;
+ description
+ "An IPv4 ACL table";
+ }
+ }
+ container ip6-acl {
+ leaf classify-table {
+ type vpp-classifier:classify-table-ref;
+ description
+ "An IPv6 ACL table";
+ }
+ }
+ }
+
+ grouping ietf-acl-base-attributes {
+ description
+ "Provides limited support for ietf-acl model.";
+
+ container access-lists {
+ description
+ "Defines references to ietf-acl lists.
+ ACLs are translated into classify tables and sessions when assigned to interface.
+
+ In case of L2 interfaces, acls are translated into a chain of classify tables and assigned as L2 table.
+ In case of L3 interfaces, acls are translated into ip4 and ip6 chains (eth only rules go to both chains,
+ rest - depending on ip-version).
+ User ordering is preserved in both cases.
+
+ Assignment update/delete removes all created tables and sessions and repeats process described above.
+ Update/delete of ACL lists referenced here is not permitted (assignment needs to be removed first).
+
+ Read is supported only for acls that were created and assigned by Honeycomb agent
+ (corresponding metadata is present).
+
+ Extensions:
+ - mixing ACEs of different type in one list is permited
+ - mixing L2/L3/L4 rules in one ACE is permited
+
+ Limitations (due to vpp limitations):
+ - egress rules are currently ignored (HONEYCOMB-234)
+ - L4 rules support is limited (every <src,dst> port pair from provided ranges is translated to single classify
+ session; which can very slow or even crash vpp if ranges are big, see HONEYCOMB-260)
+ - ace-ip-version needs to be provided for all aces (consequence of posibility to mix ACEs of different types,
+ and vpp classfier api limitation: common header fields for IP4/IP6 have different offsets)
+ - L2 rules on L3 interfaces are applied only to IP traffic (vpp classfier limitation)
+ - vlan tags are supported only for sub-interfaces defined as exact-match";
+
+ list acl {
+ key "type name";
+ ordered-by user;
+
+ leaf type {
+ type acl:acl-type;
+ }
+
+ leaf name {
+ type acl:access-control-list-ref;
+ }
+ }
+
+ leaf default-action {
+ type enumeration {
+ enum "deny";
+ enum "permit";
+ }
+ default "deny";
+ description
+ "Default action applied to packet that does not match any of rules defined in assigned ACLs.
+ It is translated to single classify table and applied at the end of assigned chains.";
+ }
+
+ leaf mode {
+ type interface-mode;
+ default l3;
+ description
+ "The way ACLs are translated depends on the interface mode.
+ In case of L2 interfaces (bridge/interconnection)
+ classify tables are assigned as l2_table using input_acl_set_interface (ether type matching is automatically
+ added in case of L3 rules).
+ In case of L3 interfaces, classify tables are assigned as ip4/ip6 tables.
+
+ It is the user responsibility to choose mode that matches target interface.
+ ";
+ }
+ }
+ }
+
+ grouping vpp-acl-attributes {
+ container acl {
+ container ingress {
+ uses vpp-classifier-acl:acl-base-attributes;
+ }
+ container egress {
+ uses vpp-classifier-acl:acl-base-attributes;
+ }
+ }
+
+ container ietf-acl {
+ container ingress {
+ uses vpp-classifier-acl:ietf-acl-base-attributes;
+ }
+ container egress {
+ uses vpp-classifier-acl:ietf-acl-base-attributes;
+ }
+ }
+ }
+
+ augment /acl:access-lists/acl:acl/acl:access-list-entries/acl:ace/acl:matches/acl:ace-type {
+ ext:augment-identifier "vpp-classfier-acl-type-augmentation";
+ case ace-ip-and-eth {
+ description
+ "Access List entry that can define both ip and eth rules.";
+ container ace-ip-and-eth-nodes {
+
+ choice ace-ip-version {
+ description
+ "IP version used in this Access List Entry.";
+ mandatory true;
+ case ace-ipv4 {
+ uses packet-fields:acl-ipv4-header-fields;
+ }
+ case ace-ipv6 {
+ uses packet-fields:acl-ipv6-header-fields;
+ }
+ }
+ uses packet-fields:acl-ip-header-fields;
+ uses packet-fields:acl-eth-header-fields;
+ }
+ }
+ }
+} \ No newline at end of file