summaryrefslogtreecommitdiffstats
path: root/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
diff options
context:
space:
mode:
Diffstat (limited to 'vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang')
-rw-r--r--vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang125
1 files changed, 5 insertions, 120 deletions
diff --git a/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang b/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
index f817dad81..6dc028e16 100644
--- a/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
+++ b/vpp-classifier/api/src/main/yang/vpp-classifier-acl.yang
@@ -3,13 +3,14 @@ module vpp-classifier-acl {
namespace "urn:opendaylight:params:xml:ns:yang:vpp:classifier:acl";
prefix "vpp-classifier-acl";
- revision "2017-03-15" {
+ revision "2017-05-03" {
description
- "Initial revision of vpp-classifier-acl model.";
+ "Removed support for ietf based acls.";
}
- import ietf-access-control-list {
- prefix "acl";
+ revision "2017-03-15" {
+ description
+ "Initial revision of vpp-classifier-acl model.";
}
import vpp-classifier {
@@ -20,16 +21,6 @@ module vpp-classifier-acl {
prefix "ext";
}
- import ietf-packet-fields {
- prefix packet-fields;
- }
-
- identity mixed-acl {
- base acl:acl-base;
- description
- "ACL that can match on any of L2/L3/L4 fields.";
- }
-
typedef interface-mode {
type enumeration {
enum "l2";
@@ -64,79 +55,6 @@ module vpp-classifier-acl {
}
}
- grouping ietf-acl-base-attributes {
- description
- "Provides limited support for ietf-acl model.";
-
- container access-lists {
- description
- "Defines references to ietf-acl lists.
- ACLs are translated into classify tables and sessions when assigned to interface.
-
- In case of L2 interfaces, acls are translated into a chain of classify tables and assigned as L2 table.
- In case of L3 interfaces, acls are translated into ip4 and ip6 chains (eth only rules go to both chains,
- rest - depending on ip-version).
- User ordering is preserved in both cases.
-
- Assignment update/delete removes all created tables and sessions and repeats process described above.
- Update/delete of ACL lists referenced here is not permitted (assignment needs to be removed first).
-
- Read is supported only for acls that were created and assigned by Honeycomb agent
- (corresponding metadata is present).
-
- Extensions:
- - mixing ACEs of different type in one list is permited
- - mixing L2/L3/L4 rules in one ACE is permited
-
- Limitations (due to vpp limitations):
- - egress rules are currently ignored (HONEYCOMB-234)
- - L4 rules support is limited (every <src,dst> port pair from provided ranges is translated to single classify
- session; which can very slow or even crash vpp if ranges are big, see HONEYCOMB-260)
- - ace-ip-version needs to be provided for all aces (consequence of posibility to mix ACEs of different types,
- and vpp classfier api limitation: common header fields for IP4/IP6 have different offsets)
- - L2 rules on L3 interfaces are applied only to IP traffic (vpp classfier limitation)
- - vlan tags are supported only for sub-interfaces defined as exact-match";
-
- list acl {
- key "type name";
- ordered-by user;
-
- leaf type {
- type acl:acl-type;
- }
-
- leaf name {
- type acl:access-control-list-ref;
- }
- }
-
- leaf default-action {
- type enumeration {
- enum "deny";
- enum "permit";
- }
- default "deny";
- description
- "Default action applied to packet that does not match any of rules defined in assigned ACLs.
- It is translated to single classify table and applied at the end of assigned chains.";
- }
-
- leaf mode {
- type interface-mode;
- default l3;
- description
- "The way ACLs are translated depends on the interface mode.
- In case of L2 interfaces (bridge/interconnection)
- classify tables are assigned as l2_table using input_acl_set_interface (ether type matching is automatically
- added in case of L3 rules).
- In case of L3 interfaces, classify tables are assigned as ip4/ip6 tables.
-
- It is the user responsibility to choose mode that matches target interface.
- ";
- }
- }
- }
-
grouping vpp-acl-attributes {
container acl {
container ingress {
@@ -146,38 +64,5 @@ module vpp-classifier-acl {
uses vpp-classifier-acl:acl-base-attributes;
}
}
-
- container ietf-acl {
- container ingress {
- uses vpp-classifier-acl:ietf-acl-base-attributes;
- }
- container egress {
- uses vpp-classifier-acl:ietf-acl-base-attributes;
- }
- }
- }
-
- augment /acl:access-lists/acl:acl/acl:access-list-entries/acl:ace/acl:matches/acl:ace-type {
- ext:augment-identifier "vpp-classfier-acl-type-augmentation";
- case ace-ip-and-eth {
- description
- "Access List entry that can define both ip and eth rules.";
- container ace-ip-and-eth-nodes {
-
- choice ace-ip-version {
- description
- "IP version used in this Access List Entry.";
- mandatory true;
- case ace-ipv4 {
- uses packet-fields:acl-ipv4-header-fields;
- }
- case ace-ipv6 {
- uses packet-fields:acl-ipv6-header-fields;
- }
- }
- uses packet-fields:acl-ip-header-fields;
- uses packet-fields:acl-eth-header-fields;
- }
- }
}
} \ No newline at end of file