blob: f94dfa29adc3667565f6b61e20792e3d2aff0d88 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
|
module vpp-acl {
yang-version 1;
namespace "http://fd.io/hc2vpp/yang/vpp/acl";
prefix "vpp-acl";
import ietf-access-control-list {
prefix "acl";
}
import yang-ext {
prefix "ext";
}
import ietf-packet-fields {
prefix packet-fields;
}
import ietf-inet-types {
prefix inet;
}
import ietf-yang-types {
prefix yang;
}
organization
"FD.io - The Fast Data Project";
contact
"Hc2vpp Wiki <https://wiki.fd.io/view/Hc2vpp>
Mailing List <hc2vpp@lists.fd.io>";
description
"This module contains a collection of YANG definitions
that extend ietf-access-control-list module
with VPP specific features provided by the VPP ACL plugin.
Copyright (c) 2016-2017 Cisco and/or its affiliates.
Licensed under the Apache License, Version 2.0 (the 'License');
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an 'AS IS' BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.";
revision "2018-10-22" {
description
"Updated vpp dependencies to match changes in ietf-access-control-list@2018-10-01 yang model.";
}
revision "2017-06-15" {
description
"Renamed stateful/permit leaf to permit-and-reflect";
}
revision "2016-12-14" {
description
"Initial revision of vpp-acl model.";
}
identity vpp-acl {
base acl:acl-base;
description
"ACL that contains only aces of vpp-ace type.";
}
identity vpp-macip-acl {
base acl:acl-base;
description
"ACL that contains only aces of vpp-macip-acl type.";
}
identity accept-and-reflect {
base acl:forwarding-action;
description
"Permits egress TCP/UDP traffic and ingress in reverse direction by creating reflexive ACEs.";
}
grouping value-range {
description "Defines value range with first and last value defined";
leaf first {
type uint8;
mandatory true;
description "Lower boundary for range";
}
leaf last {
type uint8;
mandatory true;
description "Upper boundary for range";
must "last >= first";
}
}
grouping acl-icmp-header-fields {
description
"ICMP header fields";
container icmp-type-range {
presence "Enables setting icmp-type";
description
"Inclusive range representing icmp types to be used.";
uses value-range;
}
container icmp-code-range {
presence "Enables setting icmp-code";
description
"Inclusive range representing icmp codes to be used.";
uses value-range;
}
}
grouping acl-tcp-header-fields {
description "ICMP header fields";
leaf flags-mask {
type bits {
bit cwr {
position 1;
description
"Congestion Window Reduced (CWR) flag is set by
the sending host to indicate that it received
a TCP segment with the ECE flag set and had
responded in congestion control mechanism.";
reference
"RFC 3168: The Addition of Explicit Congestion
Notification (ECN) to IP.";
}
bit ece {
position 2;
description
"ECN-Echo has a dual role, depending on the value
of the SYN flag. It indicates:
If the SYN flag is set (1), that the TCP peer is ECN
capable. If the SYN flag is clear (0), that a packet
with Congestion Experienced flag set (ECN=11) in IP
header was received during normal transmission
(added to header by RFC 3168). This serves as an
indication of network congestion (or impending
congestion) to the TCP sender.";
reference
"RFC 3168: The Addition of Explicit Congestion
Notification (ECN) to IP.";
}
bit urg {
position 3;
description
"Indicates that the Urgent pointer field is significant.";
}
bit ack {
position 4;
description
"Indicates that the Acknowledgment field is significant.
All packets after the initial SYN packet sent by the
client should have this flag set.";
}
bit psh {
position 5;
description
"Push function. Asks to push the buffered data to the
receiving application.";
}
bit rst {
position 6;
description
"Reset the connection.";
}
bit syn {
position 7;
description
"Synchronize sequence numbers. Only the first packet
sent from each end should have this flag set. Some
other flags and fields change meaning based on this
flag, and some are only valid for when it is set,
and others when it is clear.";
}
bit fin {
position 8;
description
"Last package from sender.";
}
}
description
"Also known as Control Bits. Contains 9 1-bit flags.";
reference
"RFC 793: Transmission Control Protocol (TCP).";
}
}
augment /acl:acls/acl:acl/acl:aces/acl:ace/acl:matches/acl:l4/acl:icmp/acl:icmp {
ext:augment-identifier "vpp-icmp-ace-augmentation";
container vpp-icmp-ace {
description
"Access List entry that can define:
- icmp code range fields
- icmp type range fields.";
uses acl-icmp-header-fields;
}
}
augment /acl:acls/acl:acl/acl:aces/acl:ace/acl:matches/acl:l4/acl:tcp/acl:tcp {
ext:augment-identifier "vpp-tcp-ace-augmentation";
container vpp-tcp-ace {
description
"Access List entry that can define:
- Flag mask";
uses acl-tcp-header-fields;
}
}
augment /acl:acls/acl:acl {
ext:augment-identifier "vpp-acl-augmentation";
leaf tag {
type string {
length 1..63;
}
description
"ASCII tag that can be used as a placeholder for ACL metadata. Value is stored in vpp,
and returned in read requests. No processing involved.";
}
}
}
|
