848 lines
19 KiB
YANG
848 lines
19 KiB
YANG
module openconfig-acl {
|
|
|
|
yang-version "1";
|
|
|
|
// namespace
|
|
namespace "http://openconfig.net/yang/acl";
|
|
|
|
prefix "oc-acl";
|
|
|
|
import openconfig-packet-match { prefix oc-match; }
|
|
import openconfig-interfaces { prefix oc-if; }
|
|
import openconfig-yang-types { prefix oc-yang; }
|
|
import openconfig-extensions { prefix oc-ext; }
|
|
|
|
// meta
|
|
organization "OpenConfig working group";
|
|
|
|
contact
|
|
"OpenConfig working group
|
|
www.openconfig.net";
|
|
|
|
description
|
|
"This module defines configuration and operational state
|
|
data for network access control lists (i.e., filters, rules,
|
|
etc.). ACLs are organized into ACL sets, with each set
|
|
containing one or more ACL entries. ACL sets are identified
|
|
by a unique name, while each entry within a set is assigned
|
|
a sequence-id that determines the order in which the ACL
|
|
rules are applied to a packet. Note that ACLs are evaluated
|
|
in ascending order based on the sequence-id (low to high).
|
|
|
|
Individual ACL rules specify match criteria based on fields in
|
|
the packet, along with an action that defines how matching
|
|
packets should be handled. Entries have a type that indicates
|
|
the type of match criteria, e.g., MAC layer, IPv4, IPv6, etc.";
|
|
|
|
oc-ext:openconfig-version "1.0.2";
|
|
|
|
revision "2018-11-21" {
|
|
description
|
|
"Add OpenConfig module metadata extensions.";
|
|
reference "1.0.2";
|
|
}
|
|
|
|
revision "2018-04-24" {
|
|
description
|
|
"Clarified order of ACL evaluation";
|
|
reference "1.0.1";
|
|
}
|
|
|
|
revision "2017-05-26" {
|
|
description
|
|
"Separated ACL entries by type";
|
|
reference "1.0.0";
|
|
}
|
|
|
|
revision "2016-08-08" {
|
|
description
|
|
"OpenConfig public release";
|
|
reference "0.2.0";
|
|
}
|
|
|
|
revision "2016-01-22" {
|
|
description
|
|
"Initial revision";
|
|
reference "TBD";
|
|
}
|
|
|
|
// OpenConfig specific extensions for module metadata.
|
|
oc-ext:regexp-posix;
|
|
oc-ext:catalog-organization "openconfig";
|
|
oc-ext:origin "openconfig";
|
|
|
|
identity ACL_TYPE {
|
|
description
|
|
"Base identity for types of ACL sets";
|
|
}
|
|
|
|
identity ACL_IPV4 {
|
|
base ACL_TYPE;
|
|
description
|
|
"IP-layer ACLs with IPv4 addresses";
|
|
}
|
|
|
|
identity ACL_IPV6 {
|
|
base ACL_TYPE;
|
|
description
|
|
"IP-layer ACLs with IPv6 addresses";
|
|
}
|
|
|
|
identity ACL_L2 {
|
|
base ACL_TYPE;
|
|
description
|
|
"MAC-layer ACLs";
|
|
}
|
|
|
|
identity ACL_MIXED {
|
|
base ACL_TYPE;
|
|
description
|
|
"Mixed-mode ACL that specifies L2 and L3 protocol
|
|
fields. This ACL type is not implemented by many
|
|
routing/switching devices.";
|
|
}
|
|
|
|
// ACL action type
|
|
|
|
identity FORWARDING_ACTION {
|
|
description
|
|
"Base identity for actions in the forwarding category";
|
|
}
|
|
|
|
identity ACCEPT {
|
|
base FORWARDING_ACTION;
|
|
description
|
|
"Accept the packet";
|
|
}
|
|
|
|
identity DROP {
|
|
base FORWARDING_ACTION;
|
|
description
|
|
"Drop packet without sending any ICMP error message";
|
|
}
|
|
|
|
identity REJECT {
|
|
base FORWARDING_ACTION;
|
|
description
|
|
"Drop the packet and send an ICMP error message to the source";
|
|
}
|
|
|
|
identity LOG_ACTION {
|
|
description
|
|
"Base identity for defining the destination for logging
|
|
actions";
|
|
}
|
|
|
|
identity LOG_SYSLOG {
|
|
base LOG_ACTION;
|
|
description
|
|
"Log the packet in Syslog";
|
|
}
|
|
|
|
identity LOG_NONE {
|
|
base LOG_ACTION;
|
|
description
|
|
"No logging";
|
|
}
|
|
|
|
identity ACL_COUNTER_CAPABILITY {
|
|
description
|
|
"Base identity for system to indicate how it is able to report
|
|
counters";
|
|
}
|
|
|
|
identity INTERFACE_ONLY {
|
|
base ACL_COUNTER_CAPABILITY;
|
|
description
|
|
"ACL counters are available and reported only per interface";
|
|
}
|
|
|
|
identity AGGREGATE_ONLY {
|
|
base ACL_COUNTER_CAPABILITY;
|
|
description
|
|
"ACL counters are aggregated over all interfaces, and reported
|
|
only per ACL entry";
|
|
}
|
|
|
|
identity INTERFACE_AGGREGATE {
|
|
base ACL_COUNTER_CAPABILITY;
|
|
description
|
|
"ACL counters are reported per interface, and also aggregated
|
|
and reported per ACL entry.";
|
|
}
|
|
|
|
// grouping statements
|
|
|
|
// input interface
|
|
grouping input-interface-config {
|
|
description
|
|
"Config of interface";
|
|
|
|
}
|
|
|
|
grouping input-interface-state {
|
|
description
|
|
"State information of interface";
|
|
}
|
|
|
|
grouping input-interface-top {
|
|
description
|
|
"Input interface top level container";
|
|
|
|
container input-interface {
|
|
description
|
|
"Input interface container";
|
|
|
|
container config {
|
|
description
|
|
"Config data";
|
|
uses input-interface-config;
|
|
}
|
|
|
|
container state {
|
|
config false;
|
|
description
|
|
"State information";
|
|
uses input-interface-config;
|
|
uses input-interface-state;
|
|
}
|
|
|
|
uses oc-if:interface-ref;
|
|
|
|
}
|
|
}
|
|
|
|
// Action Type
|
|
grouping action-config {
|
|
description
|
|
"Config of action type";
|
|
|
|
|
|
leaf forwarding-action {
|
|
type identityref {
|
|
base FORWARDING_ACTION;
|
|
}
|
|
mandatory true;
|
|
description
|
|
"Specifies the forwarding action. One forwarding action
|
|
must be specified for each ACL entry";
|
|
}
|
|
|
|
leaf log-action {
|
|
type identityref {
|
|
base LOG_ACTION;
|
|
}
|
|
default LOG_NONE;
|
|
description
|
|
"Specifies the log action and destination for
|
|
matched packets. The default is not to log the
|
|
packet.";
|
|
}
|
|
|
|
|
|
}
|
|
|
|
grouping action-state {
|
|
description
|
|
"State information of action type";
|
|
|
|
}
|
|
|
|
grouping action-top {
|
|
description
|
|
"ACL action type top level container";
|
|
|
|
container actions {
|
|
description
|
|
"Enclosing container for list of ACL actions associated
|
|
with an entry";
|
|
|
|
container config {
|
|
description
|
|
"Config data for ACL actions";
|
|
uses action-config;
|
|
}
|
|
|
|
container state {
|
|
config false;
|
|
description
|
|
"State information for ACL actions";
|
|
uses action-config;
|
|
uses action-state;
|
|
}
|
|
}
|
|
}
|
|
|
|
grouping acl-counters-state {
|
|
description
|
|
"Common grouping for ACL counters";
|
|
|
|
leaf matched-packets {
|
|
type oc-yang:counter64;
|
|
description
|
|
"Count of the number of packets matching the current ACL
|
|
entry.
|
|
|
|
An implementation should provide this counter on a
|
|
per-interface per-ACL-entry if possible.
|
|
|
|
If an implementation only supports ACL counters per entry
|
|
(i.e., not broken out per interface), then the value
|
|
should be equal to the aggregate count across all interfaces.
|
|
|
|
An implementation that provides counters per entry per
|
|
interface is not required to also provide an aggregate count,
|
|
e.g., per entry -- the user is expected to be able implement
|
|
the required aggregation if such a count is needed.";
|
|
}
|
|
|
|
leaf matched-octets {
|
|
type oc-yang:counter64;
|
|
description
|
|
"Count of the number of octets (bytes) matching the current
|
|
ACL entry.
|
|
|
|
An implementation should provide this counter on a
|
|
per-interface per-ACL-entry if possible.
|
|
|
|
If an implementation only supports ACL counters per entry
|
|
(i.e., not broken out per interface), then the value
|
|
should be equal to the aggregate count across all interfaces.
|
|
|
|
An implementation that provides counters per entry per
|
|
interface is not required to also provide an aggregate count,
|
|
e.g., per entry -- the user is expected to be able implement
|
|
the required aggregation if such a count is needed.";
|
|
}
|
|
|
|
}
|
|
|
|
// Access List Entries
|
|
grouping access-list-entries-config {
|
|
description
|
|
"Access List Entries (ACE) config.";
|
|
|
|
leaf sequence-id {
|
|
type uint32;
|
|
description
|
|
"The sequence id determines the order in which ACL entries
|
|
are applied. The sequence id must be unique for each entry
|
|
in an ACL set. Target devices should apply the ACL entry
|
|
rules in ascending order determined by sequence id (low to
|
|
high), rather than the relying only on order in the list.";
|
|
}
|
|
|
|
leaf description {
|
|
type string;
|
|
description
|
|
"A user-defined description, or comment, for this Access List
|
|
Entry.";
|
|
}
|
|
|
|
}
|
|
|
|
grouping access-list-entries-state {
|
|
description
|
|
"Access List Entries state.";
|
|
|
|
uses acl-counters-state;
|
|
|
|
}
|
|
|
|
grouping access-list-entries-top {
|
|
description
|
|
"Access list entries to level container";
|
|
|
|
container acl-entries {
|
|
description
|
|
"Access list entries container";
|
|
|
|
list acl-entry {
|
|
key "sequence-id";
|
|
description
|
|
"List of ACL entries comprising an ACL set";
|
|
|
|
leaf sequence-id {
|
|
type leafref {
|
|
path "../config/sequence-id";
|
|
}
|
|
description
|
|
"references the list key";
|
|
}
|
|
|
|
container config {
|
|
description
|
|
"Access list entries config";
|
|
uses access-list-entries-config;
|
|
}
|
|
|
|
container state {
|
|
config false;
|
|
description
|
|
"State information for ACL entries";
|
|
uses access-list-entries-config;
|
|
uses access-list-entries-state;
|
|
}
|
|
|
|
uses oc-match:ethernet-header-top {
|
|
when "../../config/type='ACL_L2'" {
|
|
description
|
|
"MAC-layer fields are valid when the ACL type is L2";
|
|
}
|
|
}
|
|
uses oc-match:ipv4-protocol-fields-top {
|
|
when "../../config/type='ACL_IPV4'" {
|
|
description
|
|
"IPv4-layer fields are valid when the ACL type is
|
|
IPv4";
|
|
}
|
|
}
|
|
uses oc-match:ipv6-protocol-fields-top {
|
|
when "../../config/type='ACL_IPV6'" {
|
|
description
|
|
"IPv6-layer fields are valid when the ACL type is
|
|
IPv6";
|
|
}
|
|
}
|
|
uses oc-match:transport-fields-top {
|
|
when "../../config/type='ACL_IPV6' or " +
|
|
"../../config/type='ACL_IPV4'" {
|
|
description
|
|
"Transport-layer fields are valid when specifying
|
|
L3 ACL types";
|
|
}
|
|
}
|
|
uses input-interface-top;
|
|
|
|
uses action-top;
|
|
}
|
|
}
|
|
}
|
|
|
|
grouping acl-set-config {
|
|
description
|
|
"Access Control List config";
|
|
|
|
leaf name {
|
|
type string;
|
|
description
|
|
"The name of the access-list set";
|
|
}
|
|
|
|
leaf type {
|
|
type identityref {
|
|
base ACL_TYPE;
|
|
}
|
|
description
|
|
"The type determines the fields allowed in the ACL entries
|
|
belonging to the ACL set (e.g., IPv4, IPv6, etc.)";
|
|
}
|
|
|
|
leaf description {
|
|
type string;
|
|
description
|
|
"Description, or comment, for the ACL set";
|
|
}
|
|
|
|
}
|
|
|
|
grouping acl-set-state {
|
|
description
|
|
"Access Control List state";
|
|
}
|
|
|
|
grouping acl-set-top {
|
|
description
|
|
"Access list entries variables top level container";
|
|
|
|
container acl-sets {
|
|
description
|
|
"Access list entries variables enclosing container";
|
|
|
|
list acl-set {
|
|
key "name type";
|
|
description
|
|
"List of ACL sets, each comprising of a list of ACL
|
|
entries";
|
|
|
|
leaf name {
|
|
type leafref {
|
|
path "../config/name";
|
|
}
|
|
description
|
|
"Reference to the name list key";
|
|
}
|
|
|
|
leaf type {
|
|
type leafref {
|
|
path "../config/type";
|
|
}
|
|
description
|
|
"Reference to the type list key";
|
|
}
|
|
|
|
container config {
|
|
description
|
|
"Access list config";
|
|
uses acl-set-config;
|
|
}
|
|
|
|
container state {
|
|
config false;
|
|
description
|
|
"Access list state information";
|
|
uses acl-set-config;
|
|
uses acl-set-state;
|
|
}
|
|
uses access-list-entries-top;
|
|
}
|
|
}
|
|
}
|
|
|
|
grouping interface-acl-entries-config {
|
|
description
|
|
"Configuration data for per-interface ACLs";
|
|
|
|
}
|
|
|
|
grouping interface-acl-entries-state {
|
|
description
|
|
"Operational state data for per-interface ACL entries";
|
|
|
|
leaf sequence-id {
|
|
type leafref {
|
|
path "/acl/acl-sets/" +
|
|
"acl-set[name=current()/../../../../set-name]" +
|
|
"[type=current()/../../../../type]/" +
|
|
"acl-entries/acl-entry/sequence-id";
|
|
}
|
|
description
|
|
"Reference to an entry in the ACL set applied to an
|
|
interface";
|
|
}
|
|
|
|
uses acl-counters-state;
|
|
|
|
}
|
|
|
|
grouping interface-acl-entries-top {
|
|
description
|
|
"Top-level grouping for per-interface ACL entries";
|
|
|
|
container acl-entries {
|
|
config false;
|
|
description
|
|
"Enclosing container for list of references to ACLs";
|
|
|
|
list acl-entry {
|
|
key "sequence-id";
|
|
description
|
|
"List of ACL entries assigned to an interface";
|
|
|
|
leaf sequence-id {
|
|
type leafref {
|
|
path "../state/sequence-id";
|
|
}
|
|
description
|
|
"Reference to per-interface acl entry key";
|
|
}
|
|
|
|
// no config container since the enclosing container is
|
|
// read-only
|
|
|
|
container state {
|
|
|
|
config false;
|
|
|
|
description
|
|
"Operational state data for per-interface ACL entries";
|
|
|
|
uses interface-acl-entries-config;
|
|
uses interface-acl-entries-state;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
grouping interface-ingress-acl-config {
|
|
description
|
|
"Configuration data for per-interface ingress ACLs";
|
|
|
|
leaf set-name {
|
|
type leafref {
|
|
path "../../../../../../acl-sets/acl-set/config/name";
|
|
}
|
|
description
|
|
"Reference to the ACL set name applied on ingress";
|
|
}
|
|
|
|
leaf type {
|
|
type leafref {
|
|
path "../../../../../../acl-sets/acl-set[name=current()/../set-name]" +
|
|
"/config/type";
|
|
}
|
|
description
|
|
"Reference to the ACL set type applied on ingress";
|
|
}
|
|
}
|
|
|
|
grouping interface-ingress-acl-state {
|
|
description
|
|
"Operational state data for the per-interface ingress ACL";
|
|
}
|
|
|
|
grouping interface-ingress-acl-top {
|
|
description
|
|
"Top-level grouping for per-interface ingress ACL data";
|
|
|
|
container ingress-acl-sets {
|
|
description
|
|
"Enclosing container the list of ingress ACLs on the
|
|
interface";
|
|
|
|
list ingress-acl-set {
|
|
key "set-name type";
|
|
description
|
|
"List of ingress ACLs on the interface";
|
|
|
|
leaf set-name {
|
|
type leafref {
|
|
path "../config/set-name";
|
|
}
|
|
description
|
|
"Reference to set name list key";
|
|
}
|
|
|
|
leaf type {
|
|
type leafref {
|
|
path "../config/type";
|
|
}
|
|
description
|
|
"Reference to type list key";
|
|
}
|
|
|
|
container config {
|
|
description
|
|
"Configuration data ";
|
|
|
|
uses interface-ingress-acl-config;
|
|
}
|
|
|
|
container state {
|
|
|
|
config false;
|
|
|
|
description
|
|
"Operational state data for interface ingress ACLs";
|
|
|
|
uses interface-ingress-acl-config;
|
|
uses interface-ingress-acl-state;
|
|
}
|
|
|
|
uses interface-acl-entries-top;
|
|
}
|
|
}
|
|
}
|
|
|
|
grouping interface-egress-acl-config {
|
|
description
|
|
"Configuration data for per-interface egress ACLs";
|
|
|
|
leaf set-name {
|
|
type leafref {
|
|
path "../../../../../../acl-sets/acl-set/config/name";
|
|
}
|
|
description
|
|
"Reference to the ACL set name applied on egress";
|
|
}
|
|
|
|
leaf type {
|
|
type leafref {
|
|
path "../../../../../../acl-sets/acl-set[name=current()/../set-name]" +
|
|
"/config/type";
|
|
}
|
|
description
|
|
"Reference to the ACL set type applied on egress.";
|
|
}
|
|
}
|
|
|
|
grouping interface-egress-acl-state {
|
|
description
|
|
"Operational state data for the per-interface egress ACL";
|
|
}
|
|
|
|
grouping interface-egress-acl-top {
|
|
description
|
|
"Top-level grouping for per-interface egress ACL data";
|
|
|
|
container egress-acl-sets {
|
|
description
|
|
"Enclosing container the list of egress ACLs on the
|
|
interface";
|
|
|
|
list egress-acl-set {
|
|
key "set-name type";
|
|
description
|
|
"List of egress ACLs on the interface";
|
|
|
|
leaf set-name {
|
|
type leafref {
|
|
path "../config/set-name";
|
|
}
|
|
description
|
|
"Reference to set name list key";
|
|
}
|
|
|
|
leaf type {
|
|
type leafref {
|
|
path "../config/type";
|
|
}
|
|
description
|
|
"Reference to type list key";
|
|
}
|
|
|
|
container config {
|
|
description
|
|
"Configuration data ";
|
|
|
|
uses interface-egress-acl-config;
|
|
}
|
|
|
|
container state {
|
|
|
|
config false;
|
|
|
|
description
|
|
"Operational state data for interface egress ACLs";
|
|
|
|
uses interface-egress-acl-config;
|
|
uses interface-egress-acl-state;
|
|
}
|
|
|
|
uses interface-acl-entries-top;
|
|
}
|
|
}
|
|
}
|
|
|
|
grouping acl-interfaces-config {
|
|
description
|
|
"Configuration data for interface references";
|
|
|
|
leaf id {
|
|
type oc-if:interface-id;
|
|
description
|
|
"User-defined identifier for the interface -- a common
|
|
convention could be '<if name>.<subif index>'";
|
|
}
|
|
}
|
|
|
|
grouping acl-interfaces-state {
|
|
description
|
|
"Operational state data for interface references";
|
|
}
|
|
|
|
grouping acl-interfaces-top {
|
|
description
|
|
"Top-level grouping for interface-specific ACL data";
|
|
|
|
container interfaces {
|
|
description
|
|
"Enclosing container for the list of interfaces on which
|
|
ACLs are set";
|
|
|
|
list interface {
|
|
key "id";
|
|
description
|
|
"List of interfaces on which ACLs are set";
|
|
|
|
leaf id {
|
|
type leafref {
|
|
path "../config/id";
|
|
}
|
|
description
|
|
"Reference to the interface id list key";
|
|
}
|
|
|
|
container config {
|
|
description
|
|
"Configuration for ACL per-interface data";
|
|
|
|
uses acl-interfaces-config;
|
|
}
|
|
|
|
container state {
|
|
|
|
config false;
|
|
|
|
description
|
|
"Operational state for ACL per-interface data";
|
|
|
|
uses acl-interfaces-config;
|
|
uses acl-interfaces-state;
|
|
}
|
|
|
|
uses oc-if:interface-ref;
|
|
uses interface-ingress-acl-top;
|
|
uses interface-egress-acl-top;
|
|
}
|
|
}
|
|
}
|
|
|
|
grouping acl-config {
|
|
description
|
|
"Global configuration data for ACLs";
|
|
}
|
|
|
|
grouping acl-state {
|
|
description
|
|
"Global operational state data for ACLs";
|
|
|
|
leaf counter-capability {
|
|
type identityref {
|
|
base ACL_COUNTER_CAPABILITY;
|
|
}
|
|
description
|
|
"System reported indication of how ACL counters are reported
|
|
by the target";
|
|
}
|
|
}
|
|
grouping acl-top {
|
|
description
|
|
"Top level grouping for ACL data and structure";
|
|
|
|
container acl {
|
|
description
|
|
"Top level enclosing container for ACL model config
|
|
and operational state data";
|
|
|
|
container config {
|
|
description
|
|
"Global config data for ACLs";
|
|
|
|
uses acl-config;
|
|
}
|
|
|
|
container state {
|
|
|
|
config false;
|
|
|
|
description
|
|
"Global operational state data for ACLs";
|
|
|
|
uses acl-config;
|
|
uses acl-state;
|
|
}
|
|
|
|
uses acl-set-top;
|
|
uses acl-interfaces-top;
|
|
}
|
|
}
|
|
|
|
// data definition statements
|
|
uses acl-top;
|
|
|
|
// augment statements
|
|
|
|
|
|
}
|