matthieu/frr
1
0
Fork 0
forked from Mirror/frr
Code Pull requests Activity
frr/lib/filter_cli.c
Wesley Coakley 6907bb6bbf
lib: ip prefix-list enforce expected ge le behavior 
When specifying only an "le" for an existing ip prefix-list qualified with
both an "le" and "ge" make sure to remove the "ge" property so it does
not stay in the tree.

E.g. Saying these two things in order:

ip prefix-list test seq 1 permit 1.1.0.0/16 ge 18 le 24
ip prefix-list test seq 1 permit 1.1.0.0/16 ge 18

... should result in the second statement "overwriting" the first like
this:

vxdev-arch# do show ip prefix-list
ZEBRA: ip prefix-list foobar: 3 entries
   seq 1 permit 15.0.0.0/16 ge 18

Previously this did not happen and "le" would stick around since it was
never given NB_OP_DESTROY and purged from the data tree.

Signed-off-by: Wesley Coakley <wcoakley@nvidia.com>
2021-05-06 14:07:06 -04:00

1854 lines
49 KiB
C
Raw Blame History

/*
* FRR filter CLI implementation.
*
* Copyright (C) 2019 Network Device Education Foundation, Inc. ("NetDEF")
* Rafael Zalamena
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301 USA.
*/
#include "zebra.h"
#include "northbound.h"
#include "prefix.h"
#include "lib/command.h"
#include "lib/filter.h"
#include "lib/northbound_cli.h"
#include "lib/plist.h"
#include "lib/plist_int.h"
#include "lib/printfrr.h"
#ifndef VTYSH_EXTRACT_PL
#include "lib/filter_cli_clippy.c"
#endif /* VTYSH_EXTRACT_PL */
#define ACCESS_LIST_STR "Access list entry\n"
#define ACCESS_LIST_LEG_STR "IP standard access list\n"
#define ACCESS_LIST_ELEG_STR "IP extended access list\n"
#define ACCESS_LIST_ELEG_EXT_STR "IP extended access list (expanded range)\n"
#define ACCESS_LIST_ZEBRA_STR "Access list entry\n"
#define ACCESS_LIST_SEQ_STR \
"Sequence number of an entry\n" \
"Sequence number\n"
#define ACCESS_LIST_ACTION_STR \
"Specify packets to reject\n" \
"Specify packets to forward\n"
#define ACCESS_LIST_REMARK_STR "Access list entry comment\n"
#define ACCESS_LIST_REMARK_LINE_STR "Comment up to 100 characters\n"
#define PREFIX_LIST_NAME_STR "Prefix list entry name\n"
/*
* Helper function to generate a sequence number for legacy commands.
*/
static int acl_get_seq_cb(const struct lyd_node *dnode, void *arg)
{
int64_t *seq = arg;
int64_t cur_seq = yang_dnode_get_uint32(dnode, "sequence");
if (cur_seq > *seq)
*seq = cur_seq;
return YANG_ITER_CONTINUE;
}
/**
* Helper function that iterates over the XPath `xpath` on the candidate
* configuration in `vty->candidate_config`.
*
* \param[in] vty shell context with the candidate configuration.
* \param[in] xpath the XPath to look for the sequence leaf.
* \returns next unused sequence number.
*/
static long acl_get_seq(struct vty *vty, const char *xpath)
{
int64_t seq = 0;
yang_dnode_iterate(acl_get_seq_cb, &seq, vty->candidate_config->dnode,
"%s/entry", xpath);
return seq + 5;
}
static int acl_remove_if_empty(struct vty *vty, const char *iptype,
const char *name)
{
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='%s'][name='%s']/remark",
iptype, name);
/* List is not empty if there is a remark, check that: */
if (yang_dnode_exists(vty->candidate_config->dnode, xpath))
return CMD_SUCCESS;
/* Check if we have any entries: */
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='%s'][name='%s']", iptype,
name);
/*
* NOTE: if the list is empty it will return the first sequence
* number: 5.
*/
if (acl_get_seq(vty, xpath) != 5)
return CMD_SUCCESS;
/* Nobody is using this list, lets remove it. */
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
return nb_cli_apply_changes(vty, NULL);
}
static int acl_remove(struct vty *vty, const char *iptype, const char *name,
int64_t sseq)
{
char xpath[XPATH_MAXLEN];
int rv;
snprintfrr(
xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='%s'][name='%s']/entry[sequence='%" PRId64 "']",
iptype, name, sseq);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return acl_remove_if_empty(vty, iptype, name);
return rv;
}
/*
* Cisco (legacy) access lists.
*/
DEFPY_YANG(
access_list_std, access_list_std_cmd,
"access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <[host] A.B.C.D$host|A.B.C.D$host A.B.C.D$mask>",
ACCESS_LIST_STR
ACCESS_LIST_LEG_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"A single host address\n"
"Address to match\n"
"Address to match\n"
"Wildcard bits\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 128];
/*
* Backward compatibility: don't complain about duplicated values,
* just silently accept.
*/
if (seq_str == NULL) {
ada.ada_type = "ipv4";
ada.ada_name = name;
ada.ada_action = action;
if (host_str && mask_str == NULL) {
ada.ada_xpath[0] = "./host";
ada.ada_value[0] = host_str;
} else if (host_str && mask_str) {
ada.ada_xpath[0] = "./network/address";
ada.ada_value[0] = host_str;
ada.ada_xpath[1] = "./network/mask";
ada.ada_value[1] = mask_str;
} else {
ada.ada_xpath[0] = "./source-any";
ada.ada_value[0] = "";
}
/* Duplicated entry without sequence, just quit. */
if (acl_is_dup(vty->candidate_config->dnode, &ada))
return CMD_SUCCESS;
}
/*
* Create the access-list first, so we can generate sequence if
* none given (backward compatibility).
*/
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
if (seq_str == NULL) {
/* Use XPath to find the next sequence number. */
sseq = acl_get_seq(vty, xpath);
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%" PRId64 "']", xpath, sseq);
} else
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%s']", xpath, seq_str);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_CREATE, NULL);
nb_cli_enqueue_change(vty, "./action", NB_OP_MODIFY, action);
if (host_str != NULL && mask_str == NULL) {
nb_cli_enqueue_change(vty, "./host", NB_OP_MODIFY, host_str);
} else if (host_str != NULL && mask_str != NULL) {
nb_cli_enqueue_change(vty, "./network/address", NB_OP_MODIFY,
host_str);
nb_cli_enqueue_change(vty, "./network/mask", NB_OP_MODIFY,
mask_str);
} else {
nb_cli_enqueue_change(vty, "./source-any", NB_OP_CREATE, NULL);
}
return nb_cli_apply_changes(vty, xpath_entry);
}
DEFPY_YANG(
no_access_list_std, no_access_list_std_cmd,
"no access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <[host] A.B.C.D$host|A.B.C.D$host A.B.C.D$mask>",
NO_STR
ACCESS_LIST_STR
ACCESS_LIST_LEG_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"A single host address\n"
"Address to match\n"
"Address to match\n"
"Wildcard bits\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
/* If the user provided sequence number, then just go for it. */
if (seq_str != NULL)
return acl_remove(vty, "ipv4", name, seq);
/* Otherwise, to keep compatibility, we need to figure it out. */
ada.ada_type = "ipv4";
ada.ada_name = name;
ada.ada_action = action;
if (host_str && mask_str == NULL) {
ada.ada_xpath[0] = "./host";
ada.ada_value[0] = host_str;
} else if (host_str && mask_str) {
ada.ada_xpath[0] = "./network/address";
ada.ada_value[0] = host_str;
ada.ada_xpath[1] = "./network/mask";
ada.ada_value[1] = mask_str;
} else {
ada.ada_xpath[0] = "./source-any";
ada.ada_value[0] = "";
}
if (acl_is_dup(vty->candidate_config->dnode, &ada))
sseq = ada.ada_seq;
else
return CMD_WARNING_CONFIG_FAILED;
return acl_remove(vty, "ipv4", name, sseq);
}
DEFPY_YANG(
access_list_ext, access_list_ext_cmd,
"access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action ip <A.B.C.D$src A.B.C.D$src_mask|host A.B.C.D$src|any> <A.B.C.D$dst A.B.C.D$dst_mask|host A.B.C.D$dst|any>",
ACCESS_LIST_STR
ACCESS_LIST_ELEG_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"IPv4 address\n"
"Source address to match\n"
"Source address mask to apply\n"
"Single source host\n"
"Source address to match\n"
"Any source host\n"
"Destination address to match\n"
"Destination address mask to apply\n"
"Single destination host\n"
"Destination address to match\n"
"Any destination host\n")
{
int idx = 0;
int64_t sseq;
struct acl_dup_args ada = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 128];
/*
* Backward compatibility: don't complain about duplicated values,
* just silently accept.
*/
if (seq_str == NULL) {
ada.ada_type = "ipv4";
ada.ada_name = name;
ada.ada_action = action;
if (src_str && src_mask_str == NULL) {
ada.ada_xpath[idx] = "./host";
ada.ada_value[idx] = src_str;
idx++;
} else if (src_str && src_mask_str) {
ada.ada_xpath[idx] = "./network/address";
ada.ada_value[idx] = src_str;
idx++;
ada.ada_xpath[idx] = "./network/mask";
ada.ada_value[idx] = src_mask_str;
idx++;
} else {
ada.ada_xpath[idx] = "./source-any";
ada.ada_value[idx] = "";
idx++;
}
if (dst_str && dst_mask_str == NULL) {
ada.ada_xpath[idx] = "./destination-host";
ada.ada_value[idx] = dst_str;
idx++;
} else if (dst_str && dst_mask_str) {
ada.ada_xpath[idx] = "./destination-network/address";
ada.ada_value[idx] = dst_str;
idx++;
ada.ada_xpath[idx] = "./destination-network/mask";
ada.ada_value[idx] = dst_mask_str;
idx++;
} else {
ada.ada_xpath[idx] = "./destination-any";
ada.ada_value[idx] = "";
idx++;
}
/* Duplicated entry without sequence, just quit. */
if (acl_is_dup(vty->candidate_config->dnode, &ada))
return CMD_SUCCESS;
}
/*
* Create the access-list first, so we can generate sequence if
* none given (backward compatibility).
*/
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
if (seq_str == NULL) {
/* Use XPath to find the next sequence number. */
sseq = acl_get_seq(vty, xpath);
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%" PRId64 "']", xpath, sseq);
} else
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%s']", xpath, seq_str);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_CREATE, NULL);
nb_cli_enqueue_change(vty, "./action", NB_OP_MODIFY, action);
if (src_str != NULL && src_mask_str == NULL) {
nb_cli_enqueue_change(vty, "./host", NB_OP_MODIFY, src_str);
} else if (src_str != NULL && src_mask_str != NULL) {
nb_cli_enqueue_change(vty, "./network/address", NB_OP_MODIFY,
src_str);
nb_cli_enqueue_change(vty, "./network/mask", NB_OP_MODIFY,
src_mask_str);
} else {
nb_cli_enqueue_change(vty, "./source-any", NB_OP_CREATE, NULL);
}
if (dst_str != NULL && dst_mask_str == NULL) {
nb_cli_enqueue_change(vty, "./destination-host", NB_OP_MODIFY,
dst_str);
} else if (dst_str != NULL && dst_mask_str != NULL) {
nb_cli_enqueue_change(vty, "./destination-network/address",
NB_OP_MODIFY, dst_str);
nb_cli_enqueue_change(vty, "./destination-network/mask",
NB_OP_MODIFY, dst_mask_str);
} else {
nb_cli_enqueue_change(vty, "./destination-any", NB_OP_CREATE,
NULL);
}
return nb_cli_apply_changes(vty, xpath_entry);
}
DEFPY_YANG(
no_access_list_ext, no_access_list_ext_cmd,
"no access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action ip <A.B.C.D$src A.B.C.D$src_mask|host A.B.C.D$src|any> <A.B.C.D$dst A.B.C.D$dst_mask|host A.B.C.D$dst|any>",
NO_STR
ACCESS_LIST_STR
ACCESS_LIST_ELEG_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"Any Internet Protocol\n"
"Source address to match\n"
"Source address mask to apply\n"
"Single source host\n"
"Source address to match\n"
"Any source host\n"
"Destination address to match\n"
"Destination address mask to apply\n"
"Single destination host\n"
"Destination address to match\n"
"Any destination host\n")
{
int idx = 0;
int64_t sseq;
struct acl_dup_args ada = {};
/* If the user provided sequence number, then just go for it. */
if (seq_str != NULL)
return acl_remove(vty, "ipv4", name, seq);
/* Otherwise, to keep compatibility, we need to figure it out. */
ada.ada_type = "ipv4";
ada.ada_name = name;
ada.ada_action = action;
if (src_str && src_mask_str == NULL) {
ada.ada_xpath[idx] = "./host";
ada.ada_value[idx] = src_str;
idx++;
} else if (src_str && src_mask_str) {
ada.ada_xpath[idx] = "./network/address";
ada.ada_value[idx] = src_str;
idx++;
ada.ada_xpath[idx] = "./network/mask";
ada.ada_value[idx] = src_mask_str;
idx++;
} else {
ada.ada_xpath[idx] = "./source-any";
ada.ada_value[idx] = "";
idx++;
}
if (dst_str && dst_mask_str == NULL) {
ada.ada_xpath[idx] = "./destination-host";
ada.ada_value[idx] = dst_str;
idx++;
} else if (dst_str && dst_mask_str) {
ada.ada_xpath[idx] = "./destination-network/address";
ada.ada_value[idx] = dst_str;
idx++;
ada.ada_xpath[idx] = "./destination-network/mask";
ada.ada_value[idx] = dst_mask_str;
idx++;
} else {
ada.ada_xpath[idx] = "./destination-any";
ada.ada_value[idx] = "";
idx++;
}
if (acl_is_dup(vty->candidate_config->dnode, &ada))
sseq = ada.ada_seq;
else
return CMD_WARNING_CONFIG_FAILED;
return acl_remove(vty, "ipv4", name, sseq);
}
/*
* Zebra access lists.
*/
DEFPY_YANG(
access_list, access_list_cmd,
"access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <A.B.C.D/M$prefix [exact-match$exact]|any>",
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"Prefix to match. e.g. 10.0.0.0/8\n"
"Exact match of the prefixes\n"
"Match any IPv4\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 128];
/*
* Backward compatibility: don't complain about duplicated values,
* just silently accept.
*/
if (seq_str == NULL) {
ada.ada_type = "ipv4";
ada.ada_name = name;
ada.ada_action = action;
if (prefix_str) {
ada.ada_xpath[0] = "./ipv4-prefix";
ada.ada_value[0] = prefix_str;
if (exact) {
ada.ada_xpath[1] = "./ipv4-exact-match";
ada.ada_value[1] = "true";
}
} else {
ada.ada_xpath[0] = "./any";
ada.ada_value[0] = "";
}
/* Duplicated entry without sequence, just quit. */
if (acl_is_dup(vty->candidate_config->dnode, &ada))
return CMD_SUCCESS;
}
/*
* Create the access-list first, so we can generate sequence if
* none given (backward compatibility).
*/
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
if (seq_str == NULL) {
/* Use XPath to find the next sequence number. */
sseq = acl_get_seq(vty, xpath);
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%" PRId64 "']", xpath, sseq);
} else
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%s']", xpath, seq_str);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_CREATE, NULL);
nb_cli_enqueue_change(vty, "./action", NB_OP_MODIFY, action);
if (prefix_str != NULL) {
nb_cli_enqueue_change(vty, "./ipv4-prefix", NB_OP_MODIFY,
prefix_str);
nb_cli_enqueue_change(vty, "./ipv4-exact-match", NB_OP_MODIFY,
exact ? "true" : "false");
} else {
nb_cli_enqueue_change(vty, "./any", NB_OP_CREATE, NULL);
}
return nb_cli_apply_changes(vty, xpath_entry);
}
DEFPY_YANG(
no_access_list, no_access_list_cmd,
"no access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <A.B.C.D/M$prefix [exact-match$exact]|any>",
NO_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"Prefix to match. e.g. 10.0.0.0/8\n"
"Exact match of the prefixes\n"
"Match any IPv4\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
/* If the user provided sequence number, then just go for it. */
if (seq_str != NULL)
return acl_remove(vty, "ipv4", name, seq);
/* Otherwise, to keep compatibility, we need to figure it out. */
ada.ada_type = "ipv4";
ada.ada_name = name;
ada.ada_action = action;
if (prefix_str) {
ada.ada_xpath[0] = "./ipv4-prefix";
ada.ada_value[0] = prefix_str;
if (exact) {
ada.ada_xpath[1] = "./ipv4-exact-match";
ada.ada_value[1] = "true";
}
} else {
ada.ada_xpath[0] = "./any";
ada.ada_value[0] = "";
}
if (acl_is_dup(vty->candidate_config->dnode, &ada))
sseq = ada.ada_seq;
else
return CMD_WARNING_CONFIG_FAILED;
return acl_remove(vty, "ipv4", name, sseq);
}
DEFPY_YANG(
no_access_list_all, no_access_list_all_cmd,
"no access-list WORD$name",
NO_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR)
{
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
return nb_cli_apply_changes(vty, NULL);
}
DEFPY_YANG(
access_list_remark, access_list_remark_cmd,
"access-list WORD$name remark LINE...",
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
{
int rv;
char *remark;
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
remark = argv_concat(argv, argc, 3);
nb_cli_enqueue_change(vty, "./remark", NB_OP_CREATE, remark);
rv = nb_cli_apply_changes(vty, xpath);
XFREE(MTYPE_TMP, remark);
return rv;
}
DEFPY_YANG(
no_access_list_remark, no_access_list_remark_cmd,
"no access-list WORD$name remark",
NO_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR)
{
char xpath[XPATH_MAXLEN];
int rv;
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv4'][name='%s']/remark",
name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return acl_remove_if_empty(vty, "ipv4", name);
return rv;
}
ALIAS(
no_access_list_remark, no_access_list_remark_line_cmd,
"no access-list WORD$name remark LINE...",
NO_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
DEFPY_YANG(
ipv6_access_list, ipv6_access_list_cmd,
"ipv6 access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <X:X::X:X/M$prefix [exact-match$exact]|any>",
IPV6_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"IPv6 prefix\n"
"Exact match of the prefixes\n"
"Match any IPv6\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 128];
/*
* Backward compatibility: don't complain about duplicated values,
* just silently accept.
*/
if (seq_str == NULL) {
ada.ada_type = "ipv6";
ada.ada_name = name;
ada.ada_action = action;
if (prefix_str) {
ada.ada_xpath[0] = "./ipv6-prefix";
ada.ada_value[0] = prefix_str;
if (exact) {
ada.ada_xpath[1] = "./ipv6-exact-match";
ada.ada_value[1] = "true";
}
} else {
ada.ada_xpath[0] = "./any";
ada.ada_value[0] = "";
}
/* Duplicated entry without sequence, just quit. */
if (acl_is_dup(vty->candidate_config->dnode, &ada))
return CMD_SUCCESS;
}
/*
* Create the access-list first, so we can generate sequence if
* none given (backward compatibility).
*/
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv6'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
if (seq_str == NULL) {
/* Use XPath to find the next sequence number. */
sseq = acl_get_seq(vty, xpath);
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%" PRId64 "']", xpath, sseq);
} else
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%s']", xpath, seq_str);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_CREATE, NULL);
nb_cli_enqueue_change(vty, "./action", NB_OP_MODIFY, action);
if (prefix_str != NULL) {
nb_cli_enqueue_change(vty, "./ipv6-prefix", NB_OP_MODIFY,
prefix_str);
nb_cli_enqueue_change(vty, "./ipv6-exact-match", NB_OP_MODIFY,
exact ? "true" : "false");
} else {
nb_cli_enqueue_change(vty, "./any", NB_OP_CREATE, NULL);
}
return nb_cli_apply_changes(vty, xpath_entry);
}
DEFPY_YANG(
no_ipv6_access_list, no_ipv6_access_list_cmd,
"no ipv6 access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <X:X::X:X/M$prefix [exact-match$exact]|any>",
NO_STR
IPV6_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"IPv6 prefix\n"
"Exact match of the prefixes\n"
"Match any IPv6\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
/* If the user provided sequence number, then just go for it. */
if (seq_str != NULL)
return acl_remove(vty, "ipv6", name, seq);
/* Otherwise, to keep compatibility, we need to figure it out. */
ada.ada_type = "ipv6";
ada.ada_name = name;
ada.ada_action = action;
if (prefix_str) {
ada.ada_xpath[0] = "./ipv6-prefix";
ada.ada_value[0] = prefix_str;
if (exact) {
ada.ada_xpath[1] = "./ipv6-exact-match";
ada.ada_value[1] = "true";
}
} else {
ada.ada_xpath[0] = "./any";
ada.ada_value[0] = "";
}
if (acl_is_dup(vty->candidate_config->dnode, &ada))
sseq = ada.ada_seq;
else
return CMD_WARNING_CONFIG_FAILED;
return acl_remove(vty, "ipv6", name, sseq);
}
DEFPY_YANG(
no_ipv6_access_list_all, no_ipv6_access_list_all_cmd,
"no ipv6 access-list WORD$name",
NO_STR
IPV6_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR)
{
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv6'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
return nb_cli_apply_changes(vty, NULL);
}
DEFPY_YANG(
ipv6_access_list_remark, ipv6_access_list_remark_cmd,
"ipv6 access-list WORD$name remark LINE...",
IPV6_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
{
int rv;
char *remark;
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv6'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
remark = argv_concat(argv, argc, 4);
nb_cli_enqueue_change(vty, "./remark", NB_OP_CREATE, remark);
rv = nb_cli_apply_changes(vty, xpath);
XFREE(MTYPE_TMP, remark);
return rv;
}
DEFPY_YANG(
no_ipv6_access_list_remark, no_ipv6_access_list_remark_cmd,
"no ipv6 access-list WORD$name remark",
NO_STR
IPV6_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR)
{
char xpath[XPATH_MAXLEN];
int rv;
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='ipv6'][name='%s']/remark",
name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return acl_remove_if_empty(vty, "ipv6", name);
return rv;
}
ALIAS(
no_ipv6_access_list_remark, no_ipv6_access_list_remark_line_cmd,
"no ipv6 access-list WORD$name remark LINE...",
NO_STR
IPV6_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
DEFPY_YANG(
mac_access_list, mac_access_list_cmd,
"mac access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <X:X:X:X:X:X$mac|any>",
MAC_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"MAC address\n"
"Match any MAC address\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 128];
/*
* Backward compatibility: don't complain about duplicated values,
* just silently accept.
*/
if (seq_str == NULL) {
ada.ada_type = "mac";
ada.ada_name = name;
ada.ada_action = action;
if (mac_str) {
ada.ada_xpath[0] = "./mac";
ada.ada_value[0] = mac_str;
} else {
ada.ada_xpath[0] = "./any";
ada.ada_value[0] = "";
}
/* Duplicated entry without sequence, just quit. */
if (acl_is_dup(vty->candidate_config->dnode, &ada))
return CMD_SUCCESS;
}
/*
* Create the access-list first, so we can generate sequence if
* none given (backward compatibility).
*/
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='mac'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
if (seq_str == NULL) {
/* Use XPath to find the next sequence number. */
sseq = acl_get_seq(vty, xpath);
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%" PRId64 "']", xpath, sseq);
} else
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%s']", xpath, seq_str);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_CREATE, NULL);
nb_cli_enqueue_change(vty, "./action", NB_OP_MODIFY, action);
if (mac_str != NULL) {
nb_cli_enqueue_change(vty, "./mac", NB_OP_MODIFY, mac_str);
} else {
nb_cli_enqueue_change(vty, "./any", NB_OP_CREATE, NULL);
}
return nb_cli_apply_changes(vty, xpath_entry);
}
DEFPY_YANG(
no_mac_access_list, no_mac_access_list_cmd,
"no mac access-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <X:X:X:X:X:X$mac|any>",
NO_STR
MAC_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"MAC address\n"
"Match any MAC address\n")
{
int64_t sseq;
struct acl_dup_args ada = {};
/* If the user provided sequence number, then just go for it. */
if (seq_str != NULL)
return acl_remove(vty, "mac", name, seq);
/* Otherwise, to keep compatibility, we need to figure it out. */
ada.ada_type = "mac";
ada.ada_name = name;
ada.ada_action = action;
if (mac_str) {
ada.ada_xpath[0] = "./mac";
ada.ada_value[0] = mac_str;
} else {
ada.ada_xpath[0] = "./any";
ada.ada_value[0] = "";
}
if (acl_is_dup(vty->candidate_config->dnode, &ada))
sseq = ada.ada_seq;
else
return CMD_WARNING_CONFIG_FAILED;
return acl_remove(vty, "mac", name, sseq);
}
DEFPY_YANG(
no_mac_access_list_all, no_mac_access_list_all_cmd,
"no mac access-list WORD$name",
NO_STR
MAC_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR)
{
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='mac'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
return nb_cli_apply_changes(vty, NULL);
}
DEFPY_YANG(
mac_access_list_remark, mac_access_list_remark_cmd,
"mac access-list WORD$name remark LINE...",
MAC_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
{
int rv;
char *remark;
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='mac'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
remark = argv_concat(argv, argc, 4);
nb_cli_enqueue_change(vty, "./remark", NB_OP_CREATE, remark);
rv = nb_cli_apply_changes(vty, xpath);
XFREE(MTYPE_TMP, remark);
return rv;
}
DEFPY_YANG(
no_mac_access_list_remark, no_mac_access_list_remark_cmd,
"no mac access-list WORD$name remark",
NO_STR
MAC_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR)
{
char xpath[XPATH_MAXLEN];
int rv;
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/access-list[type='mac'][name='%s']/remark",
name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return acl_remove_if_empty(vty, "mac", name);
return rv;
}
ALIAS(
no_mac_access_list_remark, no_mac_access_list_remark_line_cmd,
"no mac access-list WORD$name remark LINE...",
NO_STR
MAC_STR
ACCESS_LIST_STR
ACCESS_LIST_ZEBRA_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
int access_list_cmp(struct lyd_node *dnode1, struct lyd_node *dnode2)
{
uint32_t seq1 = yang_dnode_get_uint32(dnode1, "./sequence");
uint32_t seq2 = yang_dnode_get_uint32(dnode2, "./sequence");
return seq1 - seq2;
}
void access_list_show(struct vty *vty, struct lyd_node *dnode,
bool show_defaults)
{
int type = yang_dnode_get_enum(dnode, "../type");
struct prefix p;
bool is_any;
bool is_exact = false;
bool cisco_style = false;
bool cisco_extended = false;
struct in_addr addr, mask;
char macstr[PREFIX2STR_BUFFER];
is_any = yang_dnode_exists(dnode, "./any");
switch (type) {
case YALT_IPV4:
if (is_any)
break;
if (yang_dnode_exists(dnode, "./host")
|| yang_dnode_exists(dnode, "./network/address")
|| yang_dnode_exists(dnode, "./source-any")) {
cisco_style = true;
if (yang_dnode_exists(dnode, "./destination-host")
|| yang_dnode_exists(
dnode, "./destination-network/address")
|| yang_dnode_exists(dnode, "./destination-any"))
cisco_extended = true;
} else {
yang_dnode_get_prefix(&p, dnode, "./ipv4-prefix");
is_exact = yang_dnode_get_bool(dnode,
"./ipv4-exact-match");
}
break;
case YALT_IPV6: /* ipv6 */
vty_out(vty, "ipv6 ");
if (is_any)
break;
yang_dnode_get_prefix(&p, dnode, "./ipv6-prefix");
is_exact = yang_dnode_get_bool(dnode, "./ipv6-exact-match");
break;
case YALT_MAC: /* mac */
vty_out(vty, "mac ");
if (is_any)
break;
yang_dnode_get_prefix(&p, dnode, "./mac");
break;
}
vty_out(vty, "access-list %s seq %s %s",
yang_dnode_get_string(dnode, "../name"),
yang_dnode_get_string(dnode, "./sequence"),
yang_dnode_get_string(dnode, "./action"));
/* Handle Cisco style access lists. */
if (cisco_style) {
if (cisco_extended)
vty_out(vty, " ip");
if (yang_dnode_exists(dnode, "./network")) {
yang_dnode_get_ipv4(&addr, dnode, "./network/address");
yang_dnode_get_ipv4(&mask, dnode, "./network/mask");
vty_out(vty, " %pI4 %pI4", &addr, &mask);
} else if (yang_dnode_exists(dnode, "./host")) {
if (cisco_extended)
vty_out(vty, " host");
vty_out(vty, " %s",
yang_dnode_get_string(dnode, "./host"));
} else if (yang_dnode_exists(dnode, "./source-any"))
vty_out(vty, " any");
/* Not extended, exit earlier. */
if (!cisco_extended) {
vty_out(vty, "\n");
return;
}
/* Handle destination address. */
if (yang_dnode_exists(dnode, "./destination-network")) {
yang_dnode_get_ipv4(&addr, dnode,
"./destination-network/address");
yang_dnode_get_ipv4(&mask, dnode,
"./destination-network/mask");
vty_out(vty, " %pI4 %pI4", &addr, &mask);
} else if (yang_dnode_exists(dnode, "./destination-host"))
vty_out(vty, " host %s",
yang_dnode_get_string(dnode,
"./destination-host"));
else if (yang_dnode_exists(dnode, "./destination-any"))
vty_out(vty, " any");
vty_out(vty, "\n");
return;
}
/* Zebra style access list. */
if (!is_any) {
/* If type is MAC don't show '/mask'. */
if (type == 2 /* mac */) {
prefix_mac2str(&p.u.prefix_eth, macstr, sizeof(macstr));
vty_out(vty, " %s", macstr);
} else
vty_out(vty, " %pFX", &p);
} else
vty_out(vty, " any");
if (is_exact)
vty_out(vty, " exact-match");
vty_out(vty, "\n");
}
void access_list_remark_show(struct vty *vty, struct lyd_node *dnode,
bool show_defaults)
{
int type = yang_dnode_get_enum(dnode, "../type");
switch (type) {
case YALT_IPV4:
break;
case YALT_IPV6:
vty_out(vty, "ipv6 ");
break;
case YALT_MAC:
vty_out(vty, "mac ");
break;
}
vty_out(vty, "access-list %s remark %s\n",
yang_dnode_get_string(dnode, "../name"),
yang_dnode_get_string(dnode, NULL));
}
/*
* Prefix lists.
*/
/**
* Remove main data structure prefix list if there are no more entries or
* remark. This fixes compatibility with old CLI and tests.
*/
static int plist_remove_if_empty(struct vty *vty, const char *iptype,
const char *name)
{
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='%s'][name='%s']/remark",
iptype, name);
/* List is not empty if there is a remark, check that: */
if (yang_dnode_exists(vty->candidate_config->dnode, xpath))
return CMD_SUCCESS;
/* Check if we have any entries: */
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='%s'][name='%s']", iptype,
name);
/*
* NOTE: if the list is empty it will return the first sequence
* number: 5.
*/
if (acl_get_seq(vty, xpath) != 5)
return CMD_SUCCESS;
/* Nobody is using this list, lets remove it. */
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
return nb_cli_apply_changes(vty, NULL);
}
static int plist_remove(struct vty *vty, const char *iptype, const char *name,
const char *seq, const char *action,
const char *prefix_str, const char *ge_str,
const char *le_str)
{
int64_t sseq;
int arg_idx = 0;
struct plist_dup_args pda = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 32];
int rv;
/* If the user provided sequence number, then just go for it. */
if (seq != NULL) {
snprintf(
xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='%s'][name='%s']/entry[sequence='%s']",
iptype, name, seq);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return plist_remove_if_empty(vty, iptype, name);
return rv;
}
/* Otherwise, to keep compatibility, we need to figure it out. */
pda.pda_type = iptype;
pda.pda_name = name;
pda.pda_action = action;
if (prefix_str) {
if (strmatch(iptype, "ipv4")) {
pda.pda_xpath[arg_idx] = "./ipv4-prefix";
pda.pda_value[arg_idx] = prefix_str;
arg_idx++;
if (ge_str) {
pda.pda_xpath[arg_idx] =
"./ipv4-prefix-length-greater-or-equal";
pda.pda_value[arg_idx] = ge_str;
arg_idx++;
}
if (le_str) {
pda.pda_xpath[arg_idx] =
"./ipv4-prefix-length-lesser-or-equal";
pda.pda_value[arg_idx] = le_str;
arg_idx++;
}
} else {
pda.pda_xpath[arg_idx] = "./ipv6-prefix";
pda.pda_value[arg_idx] = prefix_str;
arg_idx++;
if (ge_str) {
pda.pda_xpath[arg_idx] =
"./ipv6-prefix-length-greater-or-equal";
pda.pda_value[arg_idx] = ge_str;
arg_idx++;
}
if (le_str) {
pda.pda_xpath[arg_idx] =
"./ipv6-prefix-length-lesser-or-equal";
pda.pda_value[arg_idx] = le_str;
arg_idx++;
}
}
} else {
pda.pda_xpath[0] = "./any";
pda.pda_value[0] = "";
}
if (plist_is_dup(vty->candidate_config->dnode, &pda))
sseq = pda.pda_seq;
else
return CMD_WARNING_CONFIG_FAILED;
snprintfrr(
xpath_entry, sizeof(xpath_entry),
"/frr-filter:lib/prefix-list[type='%s'][name='%s']/entry[sequence='%" PRId64 "']",
iptype, name, sseq);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return plist_remove_if_empty(vty, iptype, name);
return rv;
}
DEFPY_YANG(
ip_prefix_list, ip_prefix_list_cmd,
"ip prefix-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <any|A.B.C.D/M$prefix [{ge (0-32)$ge|le (0-32)$le}]>",
IP_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"Any prefix match. Same as \"0.0.0.0/0 le 32\"\n"
"IP prefix <network>/<length>, e.g., 35.0.0.0/8\n"
"Minimum prefix length to be matched\n"
"Minimum prefix length\n"
"Maximum prefix length to be matched\n"
"Maximum prefix length\n")
{
int64_t sseq;
int arg_idx = 0;
struct plist_dup_args pda = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 128];
/*
* Backward compatibility: don't complain about duplicated values,
* just silently accept.
*/
if (seq_str == NULL) {
pda.pda_type = "ipv4";
pda.pda_name = name;
pda.pda_action = action;
if (prefix_str) {
pda.pda_xpath[arg_idx] = "./ipv4-prefix";
pda.pda_value[arg_idx] = prefix_str;
arg_idx++;
if (ge_str) {
pda.pda_xpath[arg_idx] =
"./ipv4-prefix-length-greater-or-equal";
pda.pda_value[arg_idx] = ge_str;
arg_idx++;
}
if (le_str) {
pda.pda_xpath[arg_idx] =
"./ipv4-prefix-length-lesser-or-equal";
pda.pda_value[arg_idx] = le_str;
arg_idx++;
}
} else {
pda.pda_xpath[0] = "./any";
pda.pda_value[0] = "";
}
/* Duplicated entry without sequence, just quit. */
if (plist_is_dup(vty->candidate_config->dnode, &pda))
return CMD_SUCCESS;
}
/*
* Create the prefix-list first, so we can generate sequence if
* none given (backward compatibility).
*/
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
if (seq_str == NULL) {
/* Use XPath to find the next sequence number. */
sseq = acl_get_seq(vty, xpath);
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%" PRId64 "']", xpath, sseq);
} else
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%s']", xpath, seq_str);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_CREATE, NULL);
nb_cli_enqueue_change(vty, "./action", NB_OP_MODIFY, action);
if (prefix_str != NULL) {
nb_cli_enqueue_change(vty, "./ipv4-prefix", NB_OP_MODIFY,
prefix_str);
if (ge_str) {
nb_cli_enqueue_change(
vty, "./ipv4-prefix-length-greater-or-equal",
NB_OP_MODIFY, ge_str);
} else {
/*
* Remove old ge if not being modified
*/
nb_cli_enqueue_change(
vty, "./ipv4-prefix-length-greater-or-equal",
NB_OP_DESTROY, NULL);
}
if (le_str) {
nb_cli_enqueue_change(
vty, "./ipv4-prefix-length-lesser-or-equal",
NB_OP_MODIFY, le_str);
} else {
/*
* Remove old le if not being modified
*/
nb_cli_enqueue_change(
vty, "./ipv4-prefix-length-lesser-or-equal",
NB_OP_DESTROY, NULL);
}
} else {
nb_cli_enqueue_change(vty, "./any", NB_OP_CREATE, NULL);
}
return nb_cli_apply_changes(vty, xpath_entry);
}
DEFPY_YANG(
no_ip_prefix_list, no_ip_prefix_list_cmd,
"no ip prefix-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <any|A.B.C.D/M$prefix [{ge (0-32)|le (0-32)}]>",
NO_STR
IP_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"Any prefix match. Same as \"0.0.0.0/0 le 32\"\n"
"IP prefix <network>/<length>, e.g., 35.0.0.0/8\n"
"Minimum prefix length to be matched\n"
"Minimum prefix length\n"
"Maximum prefix length to be matched\n"
"Maximum prefix length\n")
{
return plist_remove(vty, "ipv4", name, seq_str, action, prefix_str,
ge_str, le_str);
}
DEFPY_YANG(
no_ip_prefix_list_seq, no_ip_prefix_list_seq_cmd,
"no ip prefix-list WORD$name seq (1-4294967295)$seq",
NO_STR
IP_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_SEQ_STR)
{
return plist_remove(vty, "ipv4", name, seq_str, NULL, NULL, NULL, NULL);
}
DEFPY_YANG(
no_ip_prefix_list_all, no_ip_prefix_list_all_cmd,
"no ip prefix-list WORD$name",
NO_STR
IP_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR)
{
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
return nb_cli_apply_changes(vty, NULL);
}
DEFPY_YANG(
ip_prefix_list_remark, ip_prefix_list_remark_cmd,
"ip prefix-list WORD$name description LINE...",
IP_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
{
int rv;
char *remark;
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv4'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
remark = argv_concat(argv, argc, 4);
nb_cli_enqueue_change(vty, "./remark", NB_OP_CREATE, remark);
rv = nb_cli_apply_changes(vty, xpath);
XFREE(MTYPE_TMP, remark);
return rv;
}
DEFPY_YANG(
no_ip_prefix_list_remark, no_ip_prefix_list_remark_cmd,
"no ip prefix-list WORD$name description",
NO_STR
IP_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_REMARK_STR)
{
char xpath[XPATH_MAXLEN];
int rv;
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv4'][name='%s']/remark",
name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return plist_remove_if_empty(vty, "ipv4", name);
return rv;
}
ALIAS(
no_ip_prefix_list_remark, no_ip_prefix_list_remark_line_cmd,
"no ip prefix-list WORD$name description LINE...",
NO_STR
IP_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
DEFPY_YANG(
ipv6_prefix_list, ipv6_prefix_list_cmd,
"ipv6 prefix-list WORD$name [seq (1-4294967295)] <deny|permit>$action <any|X:X::X:X/M$prefix [{ge (0-128)$ge|le (0-128)$le}]>",
IPV6_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"Any prefix match. Same as \"::0/0 le 128\"\n"
"IPv6 prefix <network>/<length>, e.g., 3ffe::/16\n"
"Maximum prefix length to be matched\n"
"Maximum prefix length\n"
"Minimum prefix length to be matched\n"
"Minimum prefix length\n")
{
int64_t sseq;
int arg_idx = 0;
struct plist_dup_args pda = {};
char xpath[XPATH_MAXLEN];
char xpath_entry[XPATH_MAXLEN + 128];
/*
* Backward compatibility: don't complain about duplicated values,
* just silently accept.
*/
if (seq_str == NULL) {
pda.pda_type = "ipv6";
pda.pda_name = name;
pda.pda_action = action;
if (prefix_str) {
pda.pda_xpath[arg_idx] = "./ipv6-prefix";
pda.pda_value[arg_idx] = prefix_str;
arg_idx++;
if (ge_str) {
pda.pda_xpath[arg_idx] =
"./ipv6-prefix-length-greater-or-equal";
pda.pda_value[arg_idx] = ge_str;
arg_idx++;
}
if (le_str) {
pda.pda_xpath[arg_idx] =
"./ipv6-prefix-length-lesser-or-equal";
pda.pda_value[arg_idx] = le_str;
arg_idx++;
}
} else {
pda.pda_xpath[0] = "./any";
pda.pda_value[0] = "";
}
/* Duplicated entry without sequence, just quit. */
if (plist_is_dup(vty->candidate_config->dnode, &pda))
return CMD_SUCCESS;
}
/*
* Create the prefix-list first, so we can generate sequence if
* none given (backward compatibility).
*/
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv6'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
if (seq_str == NULL) {
/* Use XPath to find the next sequence number. */
sseq = acl_get_seq(vty, xpath);
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%" PRId64 "']", xpath, sseq);
} else
snprintfrr(xpath_entry, sizeof(xpath_entry),
"%s/entry[sequence='%s']", xpath, seq_str);
nb_cli_enqueue_change(vty, xpath_entry, NB_OP_CREATE, NULL);
nb_cli_enqueue_change(vty, "./action", NB_OP_MODIFY, action);
if (prefix_str != NULL) {
nb_cli_enqueue_change(vty, "./ipv6-prefix", NB_OP_MODIFY,
prefix_str);
if (ge_str) {
nb_cli_enqueue_change(
vty, "./ipv6-prefix-length-greater-or-equal",
NB_OP_MODIFY, ge_str);
} else {
/*
* Remove old ge if not being modified
*/
nb_cli_enqueue_change(
vty, "./ipv6-prefix-length-greater-or-equal",
NB_OP_DESTROY, NULL);
}
if (le_str) {
nb_cli_enqueue_change(
vty, "./ipv6-prefix-length-lesser-or-equal",
NB_OP_MODIFY, le_str);
} else {
/*
* Remove old le if not being modified
*/
nb_cli_enqueue_change(
vty, "./ipv6-prefix-length-lesser-or-equal",
NB_OP_DESTROY, NULL);
}
} else {
nb_cli_enqueue_change(vty, "./any", NB_OP_CREATE, NULL);
}
return nb_cli_apply_changes(vty, xpath_entry);
}
DEFPY_YANG(
no_ipv6_prefix_list, no_ipv6_prefix_list_cmd,
"no ipv6 prefix-list WORD$name [seq (1-4294967295)$seq] <deny|permit>$action <any|X:X::X:X/M$prefix [{ge (0-128)$ge|le (0-128)$le}]>",
NO_STR
IPV6_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_SEQ_STR
ACCESS_LIST_ACTION_STR
"Any prefix match. Same as \"::0/0 le 128\"\n"
"IPv6 prefix <network>/<length>, e.g., 3ffe::/16\n"
"Maximum prefix length to be matched\n"
"Maximum prefix length\n"
"Minimum prefix length to be matched\n"
"Minimum prefix length\n")
{
return plist_remove(vty, "ipv6", name, seq_str, action, prefix_str,
ge_str, le_str);
}
DEFPY_YANG(
no_ipv6_prefix_list_seq, no_ipv6_prefix_list_seq_cmd,
"no ipv6 prefix-list WORD$name seq (1-4294967295)$seq",
NO_STR
IPV6_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_SEQ_STR)
{
return plist_remove(vty, "ipv6", name, seq_str, NULL, NULL, NULL, NULL);
}
DEFPY_YANG(
no_ipv6_prefix_list_all, no_ipv6_prefix_list_all_cmd,
"no ipv6 prefix-list WORD$name",
NO_STR
IPV6_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR)
{
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv6'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
return nb_cli_apply_changes(vty, NULL);
}
DEFPY_YANG(
ipv6_prefix_list_remark, ipv6_prefix_list_remark_cmd,
"ipv6 prefix-list WORD$name description LINE...",
IPV6_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
{
int rv;
char *remark;
char xpath[XPATH_MAXLEN];
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv6'][name='%s']", name);
nb_cli_enqueue_change(vty, xpath, NB_OP_CREATE, NULL);
remark = argv_concat(argv, argc, 4);
nb_cli_enqueue_change(vty, "./remark", NB_OP_CREATE, remark);
rv = nb_cli_apply_changes(vty, xpath);
XFREE(MTYPE_TMP, remark);
return rv;
}
DEFPY_YANG(
no_ipv6_prefix_list_remark, no_ipv6_prefix_list_remark_cmd,
"no ipv6 prefix-list WORD$name description",
NO_STR
IPV6_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_REMARK_STR)
{
char xpath[XPATH_MAXLEN];
int rv;
snprintf(xpath, sizeof(xpath),
"/frr-filter:lib/prefix-list[type='ipv6'][name='%s']/remark",
name);
nb_cli_enqueue_change(vty, xpath, NB_OP_DESTROY, NULL);
rv = nb_cli_apply_changes(vty, NULL);
if (rv == CMD_SUCCESS)
return plist_remove_if_empty(vty, "ipv6", name);
return rv;
}
ALIAS(
no_ipv6_prefix_list_remark, no_ipv6_prefix_list_remark_line_cmd,
"no ipv6 prefix-list WORD$name description LINE...",
NO_STR
IPV6_STR
PREFIX_LIST_STR
PREFIX_LIST_NAME_STR
ACCESS_LIST_REMARK_STR
ACCESS_LIST_REMARK_LINE_STR)
int prefix_list_cmp(struct lyd_node *dnode1, struct lyd_node *dnode2)
{
uint32_t seq1 = yang_dnode_get_uint32(dnode1, "./sequence");
uint32_t seq2 = yang_dnode_get_uint32(dnode2, "./sequence");
return seq1 - seq2;
}
void prefix_list_show(struct vty *vty, struct lyd_node *dnode,
bool show_defaults)
{
int type = yang_dnode_get_enum(dnode, "../type");
const char *ge_str = NULL, *le_str = NULL;
bool is_any;
struct prefix p;
is_any = yang_dnode_exists(dnode, "./any");
switch (type) {
case YPLT_IPV4:
if (!is_any)
yang_dnode_get_prefix(&p, dnode, "./ipv4-prefix");
if (yang_dnode_exists(dnode,
"./ipv4-prefix-length-greater-or-equal"))
ge_str = yang_dnode_get_string(
dnode, "./ipv4-prefix-length-greater-or-equal");
if (yang_dnode_exists(dnode,
"./ipv4-prefix-length-lesser-or-equal"))
le_str = yang_dnode_get_string(
dnode, "./ipv4-prefix-length-lesser-or-equal");
vty_out(vty, "ip ");
break;
case YPLT_IPV6:
if (!is_any)
yang_dnode_get_prefix(&p, dnode, "ipv6-prefix");
if (yang_dnode_exists(dnode,
"./ipv6-prefix-length-greater-or-equal"))
ge_str = yang_dnode_get_string(
dnode, "./ipv6-prefix-length-greater-or-equal");
if (yang_dnode_exists(dnode,
"./ipv6-prefix-length-lesser-or-equal"))
le_str = yang_dnode_get_string(
dnode, "./ipv6-prefix-length-lesser-or-equal");
vty_out(vty, "ipv6 ");
break;
}
vty_out(vty, "prefix-list %s seq %s %s",
yang_dnode_get_string(dnode, "../name"),
yang_dnode_get_string(dnode, "./sequence"),
yang_dnode_get_string(dnode, "./action"));
if (is_any) {
vty_out(vty, " any\n");
return;
}
vty_out(vty, " %pFX", &p);
if (ge_str)
vty_out(vty, " ge %s", ge_str);
if (le_str)
vty_out(vty, " le %s", le_str);
vty_out(vty, "\n");
}
void prefix_list_remark_show(struct vty *vty, struct lyd_node *dnode,
bool show_defaults)
{
int type = yang_dnode_get_enum(dnode, "../type");
switch (type) {
case YPLT_IPV4:
vty_out(vty, "ip ");
break;
case YPLT_IPV6:
vty_out(vty, "ipv6 ");
break;
}
vty_out(vty, "prefix-list %s description %s\n",
yang_dnode_get_string(dnode, "../name"),
yang_dnode_get_string(dnode, NULL));
}
void filter_cli_init(void)
{
/* access-list cisco-style (legacy). */
install_element(CONFIG_NODE, &access_list_std_cmd);
install_element(CONFIG_NODE, &no_access_list_std_cmd);
install_element(CONFIG_NODE, &access_list_ext_cmd);
install_element(CONFIG_NODE, &no_access_list_ext_cmd);
/* access-list zebra-style. */
install_element(CONFIG_NODE, &access_list_cmd);
install_element(CONFIG_NODE, &no_access_list_cmd);
install_element(CONFIG_NODE, &no_access_list_all_cmd);
install_element(CONFIG_NODE, &access_list_remark_cmd);
install_element(CONFIG_NODE, &no_access_list_remark_cmd);
install_element(CONFIG_NODE, &no_access_list_remark_line_cmd);
install_element(CONFIG_NODE, &ipv6_access_list_cmd);
install_element(CONFIG_NODE, &no_ipv6_access_list_cmd);
install_element(CONFIG_NODE, &no_ipv6_access_list_all_cmd);
install_element(CONFIG_NODE, &ipv6_access_list_remark_cmd);
install_element(CONFIG_NODE, &no_ipv6_access_list_remark_cmd);
install_element(CONFIG_NODE, &no_ipv6_access_list_remark_line_cmd);
install_element(CONFIG_NODE, &mac_access_list_cmd);
install_element(CONFIG_NODE, &no_mac_access_list_cmd);
install_element(CONFIG_NODE, &no_mac_access_list_all_cmd);
install_element(CONFIG_NODE, &mac_access_list_remark_cmd);
install_element(CONFIG_NODE, &no_mac_access_list_remark_cmd);
install_element(CONFIG_NODE, &no_mac_access_list_remark_line_cmd);
/* prefix lists. */
install_element(CONFIG_NODE, &ip_prefix_list_cmd);
install_element(CONFIG_NODE, &no_ip_prefix_list_cmd);
install_element(CONFIG_NODE, &no_ip_prefix_list_seq_cmd);
install_element(CONFIG_NODE, &no_ip_prefix_list_all_cmd);
install_element(CONFIG_NODE, &ip_prefix_list_remark_cmd);
install_element(CONFIG_NODE, &no_ip_prefix_list_remark_cmd);
install_element(CONFIG_NODE, &no_ip_prefix_list_remark_line_cmd);
install_element(CONFIG_NODE, &ipv6_prefix_list_cmd);
install_element(CONFIG_NODE, &no_ipv6_prefix_list_cmd);
install_element(CONFIG_NODE, &no_ipv6_prefix_list_seq_cmd);
install_element(CONFIG_NODE, &no_ipv6_prefix_list_all_cmd);
install_element(CONFIG_NODE, &ipv6_prefix_list_remark_cmd);
install_element(CONFIG_NODE, &no_ipv6_prefix_list_remark_cmd);
install_element(CONFIG_NODE, &no_ipv6_prefix_list_remark_line_cmd);
}
View git blame Copy permalink