| module openconfig-acl { |
| |
| yang-version "1"; |
| |
| // namespace |
| namespace "http://openconfig.net/yang/acl"; |
| |
| prefix "oc-acl"; |
| |
| import openconfig-packet-match { prefix oc-match; } |
| import openconfig-interfaces { prefix oc-if; } |
| import openconfig-yang-types { prefix oc-yang; } |
| import openconfig-extensions { prefix oc-ext; } |
| |
| // meta |
| organization "OpenConfig working group"; |
| |
| contact |
| "OpenConfig working group |
| www.openconfig.net"; |
| |
| description |
| "This module defines configuration and operational state |
| data for network access control lists (i.e., filters, rules, |
| etc.). ACLs are organized into ACL sets, with each set |
| containing one or more ACL entries. ACL sets are identified |
| by a unique name, while each entry within a set is assigned |
| a sequence-id that determines the order in which the ACL |
| rules are applied to a packet. |
| |
| Individual ACL rules specify match criteria based on fields in |
| the packet, along with an action that defines how matching |
| packets should be handled. Entries have a type that indicates |
| the type of match criteria, e.g., MAC layer, IPv4, IPv6, etc."; |
| |
| oc-ext:openconfig-version "1.0.0"; |
| |
| revision "2017-05-26" { |
| description |
| "Separated ACL entries by type"; |
| reference "1.0.0"; |
| } |
| |
| revision "2016-08-08" { |
| description |
| "OpenConfig public release"; |
| reference "0.2.0"; |
| } |
| |
| revision "2016-01-22" { |
| description |
| "Initial revision"; |
| reference "TBD"; |
| } |
| |
| |
| identity ACL_TYPE { |
| description |
| "Base identity for types of ACL sets"; |
| } |
| |
| identity ACL_IPV4 { |
| base ACL_TYPE; |
| description |
| "IP-layer ACLs with IPv4 addresses"; |
| } |
| |
| identity ACL_IPV6 { |
| base ACL_TYPE; |
| description |
| "IP-layer ACLs with IPv6 addresses"; |
| } |
| |
| identity ACL_L2 { |
| base ACL_TYPE; |
| description |
| "MAC-layer ACLs"; |
| } |
| |
| identity ACL_MIXED { |
| base ACL_TYPE; |
| description |
| "Mixed-mode ACL that specifies L2 and L3 protocol |
| fields. This ACL type is not implemented by many |
| routing/switching devices."; |
| } |
| |
| // ACL action type |
| |
| identity FORWARDING_ACTION { |
| description |
| "Base identity for actions in the forwarding category"; |
| } |
| |
| identity ACCEPT { |
| base FORWARDING_ACTION; |
| description |
| "Accept the packet"; |
| } |
| |
| identity DROP { |
| base FORWARDING_ACTION; |
| description |
| "Drop packet without sending any ICMP error message"; |
| } |
| |
| identity REJECT { |
| base FORWARDING_ACTION; |
| description |
| "Drop the packet and send an ICMP error message to the source"; |
| } |
| |
| identity LOG_ACTION { |
| description |
| "Base identity for defining the destination for logging |
| actions"; |
| } |
| |
| identity LOG_SYSLOG { |
| base LOG_ACTION; |
| description |
| "Log the packet in Syslog"; |
| } |
| |
| identity LOG_NONE { |
| base LOG_ACTION; |
| description |
| "No logging"; |
| } |
| |
| identity ACL_COUNTER_CAPABILITY { |
| description |
| "Base identity for system to indicate how it is able to report |
| counters"; |
| } |
| |
| identity INTERFACE_ONLY { |
| base ACL_COUNTER_CAPABILITY; |
| description |
| "ACL counters are available and reported only per interface"; |
| } |
| |
| identity AGGREGATE_ONLY { |
| base ACL_COUNTER_CAPABILITY; |
| description |
| "ACL counters are aggregated over all interfaces, and reported |
| only per ACL entry"; |
| } |
| |
| identity INTERFACE_AGGREGATE { |
| base ACL_COUNTER_CAPABILITY; |
| description |
| "ACL counters are reported per interface, and also aggregated |
| and reported per ACL entry."; |
| } |
| |
| // grouping statements |
| |
| // input interface |
| grouping input-interface-config { |
| description |
| "Config of interface"; |
| |
| } |
| |
| grouping input-interface-state { |
| description |
| "State information of interface"; |
| } |
| |
| grouping input-interface-top { |
| description |
| "Input interface top level container"; |
| |
| container input-interface { |
| description |
| "Input interface container"; |
| |
| container config { |
| description |
| "Config data"; |
| uses input-interface-config; |
| } |
| |
| container state { |
| config false; |
| description |
| "State information"; |
| uses input-interface-config; |
| uses input-interface-state; |
| } |
| |
| uses oc-if:interface-ref; |
| |
| } |
| } |
| |
| // Action Type |
| grouping action-config { |
| description |
| "Config of action type"; |
| |
| |
| leaf forwarding-action { |
| type identityref { |
| base FORWARDING_ACTION; |
| } |
| mandatory true; |
| description |
| "Specifies the forwarding action. One forwarding action |
| must be specified for each ACL entry"; |
| } |
| |
| leaf log-action { |
| type identityref { |
| base LOG_ACTION; |
| } |
| default LOG_NONE; |
| description |
| "Specifies the log action and destination for |
| matched packets. The default is not to log the |
| packet."; |
| } |
| |
| |
| } |
| |
| grouping action-state { |
| description |
| "State information of action type"; |
| |
| } |
| |
| grouping action-top { |
| description |
| "ACL action type top level container"; |
| |
| container actions { |
| description |
| "Enclosing container for list of ACL actions associated |
| with an entry"; |
| |
| container config { |
| description |
| "Config data for ACL actions"; |
| uses action-config; |
| } |
| |
| container state { |
| config false; |
| description |
| "State information for ACL actions"; |
| uses action-config; |
| uses action-state; |
| } |
| } |
| } |
| |
| grouping acl-counters-state { |
| description |
| "Common grouping for ACL counters"; |
| |
| leaf matched-packets { |
| type oc-yang:counter64; |
| description |
| "Count of the number of packets matching the current ACL |
| entry. |
| |
| An implementation should provide this counter on a |
| per-interface per-ACL-entry if possible. |
| |
| If an implementation only supports ACL counters per entry |
| (i.e., not broken out per interface), then the value |
| should be equal to the aggregate count across all interfaces. |
| |
| An implementation that provides counters per entry per |
| interface is not required to also provide an aggregate count, |
| e.g., per entry -- the user is expected to be able implement |
| the required aggregation if such a count is needed."; |
| } |
| |
| leaf matched-octets { |
| type oc-yang:counter64; |
| description |
| "Count of the number of octets (bytes) matching the current |
| ACL entry. |
| |
| An implementation should provide this counter on a |
| per-interface per-ACL-entry if possible. |
| |
| If an implementation only supports ACL counters per entry |
| (i.e., not broken out per interface), then the value |
| should be equal to the aggregate count across all interfaces. |
| |
| An implementation that provides counters per entry per |
| interface is not required to also provide an aggregate count, |
| e.g., per entry -- the user is expected to be able implement |
| the required aggregation if such a count is needed."; |
| } |
| |
| } |
| |
| // Access List Entries |
| grouping access-list-entries-config { |
| description |
| "Access List Entries (ACE) config."; |
| |
| leaf sequence-id { |
| type uint32; |
| description |
| "The sequence id determines the order in which ACL entries |
| are applied. The sequence id must be unique for each entry |
| in an ACL set. Target devices should apply the ACL entry |
| rules in the order determined by sequence id, rather than |
| the relying only on order in the list."; |
| } |
| |
| leaf description { |
| type string; |
| description |
| "A user-defined description, or comment, for this Access List |
| Entry."; |
| } |
| |
| } |
| |
| grouping access-list-entries-state { |
| description |
| "Access List Entries state."; |
| |
| uses acl-counters-state; |
| |
| } |
| |
| grouping access-list-entries-top { |
| description |
| "Access list entries to level container"; |
| |
| container acl-entries { |
| description |
| "Access list entries container"; |
| |
| list acl-entry { |
| key "sequence-id"; |
| description |
| "List of ACL entries comprising an ACL set"; |
| |
| leaf sequence-id { |
| type leafref { |
| path "../config/sequence-id"; |
| } |
| description |
| "references the list key"; |
| } |
| |
| container config { |
| description |
| "Access list entries config"; |
| uses access-list-entries-config; |
| } |
| |
| container state { |
| config false; |
| description |
| "State information for ACL entries"; |
| uses access-list-entries-config; |
| uses access-list-entries-state; |
| } |
| |
| uses oc-match:ethernet-header-top { |
| when "../../config/type='ACL_L2'" { |
| description |
| "MAC-layer fields are valid when the ACL type is L2"; |
| } |
| } |
| uses oc-match:ipv4-protocol-fields-top { |
| when "../../config/type='ACL_IPV4'" { |
| description |
| "IPv4-layer fields are valid when the ACL type is |
| IPv4"; |
| } |
| } |
| uses oc-match:ipv6-protocol-fields-top { |
| when "../../config/type='ACL_IPV6'" { |
| description |
| "IPv6-layer fields are valid when the ACL type is |
| IPv6"; |
| } |
| } |
| uses oc-match:transport-fields-top { |
| when "../../config/type='ACL_IPV6' or " + |
| "../../config/type='ACL_IPV4'" { |
| description |
| "Transport-layer fields are valid when specifying |
| L3 ACL types"; |
| } |
| } |
| uses input-interface-top; |
| |
| uses action-top; |
| } |
| } |
| } |
| |
| grouping acl-set-config { |
| description |
| "Access Control List config"; |
| |
| leaf name { |
| type string; |
| description |
| "The name of the access-list set"; |
| } |
| |
| leaf type { |
| type identityref { |
| base ACL_TYPE; |
| } |
| description |
| "The type determines the fields allowed in the ACL entries |
| belonging to the ACL set (e.g., IPv4, IPv6, etc.)"; |
| } |
| |
| leaf description { |
| type string; |
| description |
| "Description, or comment, for the ACL set"; |
| } |
| |
| } |
| |
| grouping acl-set-state { |
| description |
| "Access Control List state"; |
| } |
| |
| grouping acl-set-top { |
| description |
| "Access list entries variables top level container"; |
| |
| container acl-sets { |
| description |
| "Access list entries variables enclosing container"; |
| |
| list acl-set { |
| key "name type"; |
| description |
| "List of ACL sets, each comprising of a list of ACL |
| entries"; |
| |
| leaf name { |
| type leafref { |
| path "../config/name"; |
| } |
| description |
| "Reference to the name list key"; |
| } |
| |
| leaf type { |
| type leafref { |
| path "../config/type"; |
| } |
| description |
| "Reference to the type list key"; |
| } |
| |
| container config { |
| description |
| "Access list config"; |
| uses acl-set-config; |
| } |
| |
| container state { |
| config false; |
| description |
| "Access list state information"; |
| uses acl-set-config; |
| uses acl-set-state; |
| } |
| uses access-list-entries-top; |
| } |
| } |
| } |
| |
| grouping interface-acl-entries-config { |
| description |
| "Configuration data for per-interface ACLs"; |
| |
| } |
| |
| grouping interface-acl-entries-state { |
| description |
| "Operational state data for per-interface ACL entries"; |
| |
| leaf sequence-id { |
| type leafref { |
| path "/acl/acl-sets/" + |
| "acl-set[name=current()/../../../../set-name]" + |
| "[type=current()/../../../../type]/" + |
| "acl-entries/acl-entry/sequence-id"; |
| } |
| description |
| "Reference to an entry in the ACL set applied to an |
| interface"; |
| } |
| |
| uses acl-counters-state; |
| |
| } |
| |
| grouping interface-acl-entries-top { |
| description |
| "Top-level grouping for per-interface ACL entries"; |
| |
| container acl-entries { |
| config false; |
| description |
| "Enclosing container for list of references to ACLs"; |
| |
| list acl-entry { |
| key "sequence-id"; |
| description |
| "List of ACL entries assigned to an interface"; |
| |
| leaf sequence-id { |
| type leafref { |
| path "../state/sequence-id"; |
| } |
| description |
| "Reference to per-interface acl entry key"; |
| } |
| |
| // no config container since the enclosing container is |
| // read-only |
| |
| container state { |
| |
| config false; |
| |
| description |
| "Operational state data for per-interface ACL entries"; |
| |
| uses interface-acl-entries-config; |
| uses interface-acl-entries-state; |
| } |
| } |
| } |
| } |
| |
| grouping interface-ingress-acl-config { |
| description |
| "Configuration data for per-interface ingress ACLs"; |
| |
| leaf set-name { |
| type leafref { |
| path "../../../../../../acl-sets/acl-set/config/name"; |
| } |
| description |
| "Reference to the ACL set name applied on ingress"; |
| } |
| |
| leaf type { |
| type leafref { |
| path "../../../../../../acl-sets/acl-set[name=current()/../set-name]" + |
| "/config/type"; |
| } |
| description |
| "Reference to the ACL set type applied on ingress"; |
| } |
| } |
| |
| grouping interface-ingress-acl-state { |
| description |
| "Operational state data for the per-interface ingress ACL"; |
| } |
| |
| grouping interface-ingress-acl-top { |
| description |
| "Top-level grouping for per-interface ingress ACL data"; |
| |
| container ingress-acl-sets { |
| description |
| "Enclosing container the list of ingress ACLs on the |
| interface"; |
| |
| list ingress-acl-set { |
| key "set-name type"; |
| description |
| "List of ingress ACLs on the interface"; |
| |
| leaf set-name { |
| type leafref { |
| path "../config/set-name"; |
| } |
| description |
| "Reference to set name list key"; |
| } |
| |
| leaf type { |
| type leafref { |
| path "../config/type"; |
| } |
| description |
| "Reference to type list key"; |
| } |
| |
| container config { |
| description |
| "Configuration data "; |
| |
| uses interface-ingress-acl-config; |
| } |
| |
| container state { |
| |
| config false; |
| |
| description |
| "Operational state data for interface ingress ACLs"; |
| |
| uses interface-ingress-acl-config; |
| uses interface-ingress-acl-state; |
| } |
| |
| uses interface-acl-entries-top; |
| } |
| } |
| } |
| |
| grouping interface-egress-acl-config { |
| description |
| "Configuration data for per-interface egress ACLs"; |
| |
| leaf set-name { |
| type leafref { |
| path "../../../../../../acl-sets/acl-set/config/name"; |
| } |
| description |
| "Reference to the ACL set name applied on egress"; |
| } |
| |
| leaf type { |
| type leafref { |
| path "../../../../../../acl-sets/acl-set[name=current()/../set-name]" + |
| "/config/type"; |
| } |
| description |
| "Reference to the ACL set type applied on egress."; |
| } |
| } |
| |
| grouping interface-egress-acl-state { |
| description |
| "Operational state data for the per-interface egress ACL"; |
| } |
| |
| grouping interface-egress-acl-top { |
| description |
| "Top-level grouping for per-interface egress ACL data"; |
| |
| container egress-acl-sets { |
| description |
| "Enclosing container the list of egress ACLs on the |
| interface"; |
| |
| list egress-acl-set { |
| key "set-name type"; |
| description |
| "List of egress ACLs on the interface"; |
| |
| leaf set-name { |
| type leafref { |
| path "../config/set-name"; |
| } |
| description |
| "Reference to set name list key"; |
| } |
| |
| leaf type { |
| type leafref { |
| path "../config/type"; |
| } |
| description |
| "Reference to type list key"; |
| } |
| |
| container config { |
| description |
| "Configuration data "; |
| |
| uses interface-egress-acl-config; |
| } |
| |
| container state { |
| |
| config false; |
| |
| description |
| "Operational state data for interface egress ACLs"; |
| |
| uses interface-egress-acl-config; |
| uses interface-egress-acl-state; |
| } |
| |
| uses interface-acl-entries-top; |
| } |
| } |
| } |
| |
| grouping acl-interfaces-config { |
| description |
| "Configuration data for interface references"; |
| |
| leaf id { |
| type oc-if:interface-id; |
| description |
| "User-defined identifier for the interface -- a common |
| convention could be '<if name>.<subif index>'"; |
| } |
| } |
| |
| grouping acl-interfaces-state { |
| description |
| "Operational state data for interface references"; |
| } |
| |
| grouping acl-interfaces-top { |
| description |
| "Top-level grouping for interface-specific ACL data"; |
| |
| container interfaces { |
| description |
| "Enclosing container for the list of interfaces on which |
| ACLs are set"; |
| |
| list interface { |
| key "id"; |
| description |
| "List of interfaces on which ACLs are set"; |
| |
| leaf id { |
| type leafref { |
| path "../config/id"; |
| } |
| description |
| "Reference to the interface id list key"; |
| } |
| |
| container config { |
| description |
| "Configuration for ACL per-interface data"; |
| |
| uses acl-interfaces-config; |
| } |
| |
| container state { |
| |
| config false; |
| |
| description |
| "Operational state for ACL per-interface data"; |
| |
| uses acl-interfaces-config; |
| uses acl-interfaces-state; |
| } |
| |
| uses oc-if:interface-ref; |
| uses interface-ingress-acl-top; |
| uses interface-egress-acl-top; |
| } |
| } |
| } |
| |
| grouping acl-config { |
| description |
| "Global configuration data for ACLs"; |
| } |
| |
| grouping acl-state { |
| description |
| "Global operational state data for ACLs"; |
| |
| leaf counter-capability { |
| type identityref { |
| base ACL_COUNTER_CAPABILITY; |
| } |
| description |
| "System reported indication of how ACL counters are reported |
| by the target"; |
| } |
| } |
| grouping acl-top { |
| description |
| "Top level grouping for ACL data and structure"; |
| |
| container acl { |
| description |
| "Top level enclosing container for ACL model config |
| and operational state data"; |
| |
| container config { |
| description |
| "Global config data for ACLs"; |
| |
| uses acl-config; |
| } |
| |
| container state { |
| |
| config false; |
| |
| description |
| "Global operational state data for ACLs"; |
| |
| uses acl-config; |
| uses acl-state; |
| } |
| |
| uses acl-set-top; |
| uses acl-interfaces-top; |
| } |
| } |
| |
| // data definition statements |
| uses acl-top; |
| |
| // augment statements |
| |
| |
| } |