"Overhaul Architecture"

Closes #67 (closed)

api/models/openconfig-acl.yang

+module openconfig-acl {
+
+  yang-version "1";
+
+  // namespace
+  namespace "http://openconfig.net/yang/acl";
+
+  prefix "oc-acl";
+
+  import openconfig-packet-match { prefix oc-match; }
+  import openconfig-interfaces { prefix oc-if; }
+  import openconfig-yang-types { prefix oc-yang; }
+  import openconfig-extensions { prefix oc-ext; }
+
+  // meta
+  organization "OpenConfig working group";
+
+  contact
+    "OpenConfig working group
+    www.openconfig.net";
+
+  description
+    "This module defines configuration and operational state
+    data for network access control lists (i.e., filters, rules,
+    etc.).  ACLs are organized into ACL sets, with each set
+    containing one or more ACL entries.  ACL sets are identified
+    by a unique name, while each entry within a set is assigned
+    a sequence-id that determines the order in which the ACL
+    rules are applied to a packet.  Note that ACLs are evaluated
+    in ascending order based on the sequence-id (low to high).
+
+    Individual ACL rules specify match criteria based on fields in
+    the packet, along with an action that defines how matching
+    packets should be handled. Entries have a type that indicates
+    the type of match criteria, e.g., MAC layer, IPv4, IPv6, etc.";
+
+  oc-ext:openconfig-version "1.1.1";
+
+  revision "2019-11-27" {
+    description
+      "Fix xpaths in when statements.";
+    reference "1.1.1";
+  }
+
+  revision "2019-10-25" {
+    description
+      "Update when statements.";
+    reference "1.1.0";
+  }
+
+  revision "2018-11-21" {
+    description
+      "Add OpenConfig module metadata extensions.";
+    reference "1.0.2";
+  }
+
+  revision "2018-04-24" {
+    description
+      "Clarified order of ACL evaluation";
+    reference "1.0.1";
+  }
+
+  revision "2017-05-26" {
+    description
+      "Separated ACL entries by type";
+    reference "1.0.0";
+  }
+
+  revision "2016-08-08" {
+    description
+      "OpenConfig public release";
+    reference "0.2.0";
+  }
+
+  revision "2016-01-22" {
+    description
+      "Initial revision";
+    reference "TBD";
+  }
+
+  // OpenConfig specific extensions for module metadata.
+  oc-ext:regexp-posix;
+  oc-ext:catalog-organization "openconfig";
+  oc-ext:origin "openconfig";
+
+  identity ACL_TYPE {
+    description
+      "Base identity for types of ACL sets";
+  }
+
+  identity ACL_IPV4 {
+    base ACL_TYPE;
+    description
+      "IP-layer ACLs with IPv4 addresses";
+  }
+
+  identity ACL_IPV6 {
+    base ACL_TYPE;
+    description
+      "IP-layer ACLs with IPv6 addresses";
+  }
+
+  identity ACL_L2 {
+    base ACL_TYPE;
+    description
+      "MAC-layer ACLs";
+  }
+
+  identity ACL_MIXED {
+    base ACL_TYPE;
+    description
+      "Mixed-mode ACL that specifies L2 and L3 protocol
+      fields.  This ACL type is not implemented by many
+      routing/switching devices.";
+  }
+
+  // ACL action type
+
+  identity FORWARDING_ACTION {
+    description
+      "Base identity for actions in the forwarding category";
+  }
+
+  identity ACCEPT {
+    base FORWARDING_ACTION;
+    description
+      "Accept the packet";
+  }
+
+  identity DROP {
+    base FORWARDING_ACTION;
+    description
+      "Drop packet without sending any ICMP error message";
+  }
+
+  identity REJECT {
+    base FORWARDING_ACTION;
+    description
+      "Drop the packet and send an ICMP error message to the source";
+  }
+
+  identity LOG_ACTION {
+    description
+      "Base identity for defining the destination for logging
+      actions";
+  }
+
+  identity LOG_SYSLOG {
+    base LOG_ACTION;
+    description
+      "Log the packet in Syslog";
+  }
+
+  identity LOG_NONE {
+    base LOG_ACTION;
+    description
+      "No logging";
+  }
+
+  identity ACL_COUNTER_CAPABILITY {
+    description
+      "Base identity for system to indicate how it is able to report
+      counters";
+  }
+
+  identity INTERFACE_ONLY {
+    base ACL_COUNTER_CAPABILITY;
+    description
+      "ACL counters are available and reported only per interface";
+  }
+
+  identity AGGREGATE_ONLY {
+    base ACL_COUNTER_CAPABILITY;
+    description
+      "ACL counters are aggregated over all interfaces, and reported
+      only per ACL entry";
+  }
+
+  identity INTERFACE_AGGREGATE {
+    base ACL_COUNTER_CAPABILITY;
+    description
+      "ACL counters are reported per interface, and also aggregated
+      and reported per ACL entry.";
+  }
+
+  // grouping statements
+
+  // input interface
+  grouping input-interface-config {
+    description
+      "Config of interface";
+
+  }
+
+  grouping input-interface-state {
+    description
+      "State information of interface";
+  }
+
+  grouping input-interface-top {
+    description
+      "Input interface top level container";
+
+    container input-interface {
+      description
+        "Input interface container";
+
+      container config {
+        description
+          "Config data";
+        uses input-interface-config;
+      }
+
+      container state {
+        config false;
+        description
+          "State information";
+        uses input-interface-config;
+        uses input-interface-state;
+      }
+
+      uses oc-if:interface-ref;
+
+    }
+  }
+
+  // Action Type
+  grouping action-config {
+    description
+      "Config of action type";
+
+
+    leaf forwarding-action {
+      type identityref {
+        base FORWARDING_ACTION;
+      }
+      mandatory true;
+      description
+        "Specifies the forwarding action.  One forwarding action
+        must be specified for each ACL entry";
+    }
+
+    leaf log-action {
+      type identityref {
+        base LOG_ACTION;
+      }
+      default LOG_NONE;
+      description
+        "Specifies the log action and destination for
+        matched packets.  The default is not to log the
+        packet.";
+    }
+
+
+  }
+
+  grouping action-state {
+    description
+      "State information of action type";
+
+  }
+
+  grouping action-top {
+    description
+      "ACL action type top level container";
+
+    container actions {
+      description
+        "Enclosing container for list of ACL actions associated
+        with an entry";
+
+      container config {
+        description
+          "Config data for ACL actions";
+        uses action-config;
+      }
+
+      container state {
+        config false;
+        description
+          "State information for ACL actions";
+        uses action-config;
+        uses action-state;
+      }
+    }
+  }
+
+  grouping acl-counters-state {
+    description
+      "Common grouping for ACL counters";
+
+    leaf matched-packets {
+      type oc-yang:counter64;
+      description
+        "Count of the number of packets matching the current ACL
+        entry.
+
+        An implementation should provide this counter on a
+        per-interface per-ACL-entry if possible.
+
+        If an implementation only supports ACL counters per entry
+        (i.e., not broken out per interface), then the value
+        should be equal to the aggregate count across all interfaces.
+
+        An implementation that provides counters per entry per
+        interface is not required to also provide an aggregate count,
+        e.g., per entry -- the user is expected to be able implement
+        the required aggregation if such a count is needed.";
+    }
+
+    leaf matched-octets {
+      type oc-yang:counter64;
+      description
+        "Count of the number of octets (bytes) matching the current
+        ACL entry.
+
+        An implementation should provide this counter on a
+        per-interface per-ACL-entry if possible.
+
+        If an implementation only supports ACL counters per entry
+        (i.e., not broken out per interface), then the value
+        should be equal to the aggregate count across all interfaces.
+
+        An implementation that provides counters per entry per
+        interface is not required to also provide an aggregate count,
+        e.g., per entry -- the user is expected to be able implement
+        the required aggregation if such a count is needed.";
+    }
+
+  }
+
+  // Access List Entries
+  grouping access-list-entries-config {
+    description
+      "Access List Entries (ACE) config.";
+
+    leaf sequence-id {
+      type uint32;
+      description
+        "The sequence id determines the order in which ACL entries
+        are applied.  The sequence id must be unique for each entry
+        in an ACL set.  Target devices should apply the ACL entry
+        rules in ascending order determined by sequence id (low to
+        high), rather than the relying only on order in the list.";
+    }
+
+    leaf description {
+      type string;
+      description
+        "A user-defined description, or comment, for this Access List
+        Entry.";
+    }
+
+  }
+
+  grouping access-list-entries-state {
+    description
+      "Access List Entries state.";
+
+    uses acl-counters-state;
+
+  }
+
+  grouping access-list-entries-top {
+    description
+      "Access list entries to level container";
+
+    container acl-entries {
+      description
+        "Access list entries container";
+
+      list acl-entry {
+        key "sequence-id";
+        description
+          "List of ACL entries comprising an ACL set";
+
+        leaf sequence-id {
+          type leafref {
+            path "../config/sequence-id";
+          }
+          description
+            "references the list key";
+        }
+
+        container config {
+          description
+            "Access list entries config";
+          uses access-list-entries-config;
+        }
+
+        container state {
+          config false;
+          description
+            "State information for ACL entries";
+          uses access-list-entries-config;
+          uses access-list-entries-state;
+        }
+
+        uses oc-match:ethernet-header-top {
+          when "../../config/type='ACL_L2'" {
+            description
+              "MAC-layer fields are valid when the ACL type is L2";
+          }
+        }
+        uses oc-match:ipv4-protocol-fields-top {
+          when "../../config/type='ACL_IPV4'" {
+            description
+              "IPv4-layer fields are valid when the ACL type is
+              IPv4";
+          }
+        }
+        uses oc-match:ipv6-protocol-fields-top {
+          when "../../config/type='ACL_IPV6'" {
+            description
+              "IPv6-layer fields are valid when the ACL type is
+              IPv6";
+          }
+        }
+        uses oc-match:transport-fields-top {
+          when "../../config/type='ACL_IPV6' or " +
+            "../../config/type='ACL_IPV4'" {
+            description
+              "Transport-layer fields are valid when specifying
+              L3 ACL types";
+          }
+        }
+        uses input-interface-top;
+
+        uses action-top;
+      }
+    }
+  }
+
+  grouping acl-set-config {
+    description
+      "Access Control List config";
+
+    leaf name {
+      type string;
+      description
+        "The name of the access-list set";
+    }
+
+    leaf type {
+      type identityref {
+        base ACL_TYPE;
+      }
+      description
+        "The type determines the fields allowed in the ACL entries
+        belonging to the ACL set (e.g., IPv4, IPv6, etc.)";
+    }
+
+    leaf description {
+      type string;
+      description
+        "Description, or comment, for the ACL set";
+    }
+
+  }
+
+  grouping acl-set-state {
+    description
+      "Access Control List state";
+  }
+
+  grouping acl-set-top {
+    description
+      "Access list entries variables top level container";
+
+    container acl-sets {
+      description
+        "Access list entries variables enclosing container";
+
+      list acl-set {
+        key "name type";
+        description
+          "List of ACL sets, each comprising of a list of ACL
+          entries";
+
+        leaf name {
+          type leafref {
+            path "../config/name";
+          }
+          description
+            "Reference to the name list key";
+        }
+
+        leaf type {
+          type leafref {
+            path "../config/type";
+          }
+          description
+            "Reference to the type list key";
+        }
+
+        container config {
+          description
+            "Access list config";
+          uses acl-set-config;
+        }
+
+        container state {
+          config false;
+          description
+            "Access list state information";
+          uses acl-set-config;
+          uses acl-set-state;
+        }
+        uses access-list-entries-top;
+      }
+    }
+  }
+
+  grouping interface-acl-entries-config {
+    description
+      "Configuration data for per-interface ACLs";
+
+  }
+
+  grouping interface-acl-entries-state {
+    description
+      "Operational state data for per-interface ACL entries";
+
+    leaf sequence-id {
+      type leafref {
+        path "/acl/acl-sets/" +
+          "acl-set[name=current()/../../../../set-name]" +
+          "[type=current()/../../../../type]/" +
+          "acl-entries/acl-entry/sequence-id";
+      }
+      description
+        "Reference to an entry in the ACL set applied to an
+        interface";
+    }
+
+    uses acl-counters-state;
+
+  }
+
+  grouping interface-acl-entries-top {
+    description
+      "Top-level grouping for per-interface ACL entries";
+
+    container acl-entries {
+      config false;
+      description
+        "Enclosing container for list of references to ACLs";
+
+      list acl-entry {
+        key "sequence-id";
+        description
+          "List of ACL entries assigned to an interface";
+
+        leaf sequence-id {
+          type leafref {
+            path "../state/sequence-id";
+          }
+          description
+            "Reference to per-interface acl entry key";
+        }
+
+        // no config container since the enclosing container is
+        // read-only
+
+        container state {
+
+          config false;
+
+          description
+            "Operational state data for per-interface ACL entries";
+
+          uses interface-acl-entries-config;
+          uses interface-acl-entries-state;
+        }
+      }
+    }
+  }
+
+  grouping interface-ingress-acl-config {
+    description
+      "Configuration data for per-interface ingress ACLs";
+
+    leaf set-name {
+      type leafref {
+        path "../../../../../../acl-sets/acl-set/config/name";
+      }
+      description
+        "Reference to the ACL set name applied on ingress";
+    }
+
+    leaf type {
+      type leafref {
+        path "../../../../../../acl-sets/acl-set[name=current()/../set-name]" +
+          "/config/type";
+      }
+      description
+        "Reference to the ACL set type applied on ingress";
+    }
+  }
+
+  grouping interface-ingress-acl-state {
+    description
+      "Operational state data for the per-interface ingress ACL";
+  }
+
+  grouping interface-ingress-acl-top {
+    description
+      "Top-level grouping for per-interface ingress ACL data";
+
+    container ingress-acl-sets {
+      description
+        "Enclosing container the list of ingress ACLs on the
+        interface";
+
+      list ingress-acl-set {
+        key "set-name type";
+        description
+          "List of ingress ACLs on the interface";
+
+        leaf set-name {
+          type leafref {
+            path "../config/set-name";
+          }
+          description
+            "Reference to set name list key";
+        }
+
+        leaf type {
+          type leafref {
+            path "../config/type";
+          }
+          description
+            "Reference to type list key";
+        }
+
+        container config {
+          description
+            "Configuration data ";
+
+          uses interface-ingress-acl-config;
+        }
+
+        container state {
+
+          config false;
+
+          description
+            "Operational state data for interface ingress ACLs";
+
+          uses interface-ingress-acl-config;
+          uses interface-ingress-acl-state;
+        }
+
+        uses interface-acl-entries-top;
+      }
+    }
+  }
+
+  grouping interface-egress-acl-config {
+    description
+      "Configuration data for per-interface egress ACLs";
+
+    leaf set-name {
+      type leafref {
+        path "../../../../../../acl-sets/acl-set/config/name";
+      }
+      description
+        "Reference to the ACL set name applied on egress";
+    }
+
+    leaf type {
+      type leafref {
+        path "../../../../../../acl-sets/acl-set[name=current()/../set-name]" +
+          "/config/type";
+      }
+      description
+        "Reference to the ACL set type applied on egress.";
+    }
+  }
+
+  grouping interface-egress-acl-state {
+    description
+      "Operational state data for the per-interface egress ACL";
+  }
+
+  grouping interface-egress-acl-top {
+    description
+      "Top-level grouping for per-interface egress ACL data";
+
+    container egress-acl-sets {
+      description
+        "Enclosing container the list of egress ACLs on the
+        interface";
+
+      list egress-acl-set {
+        key "set-name type";
+        description
+          "List of egress ACLs on the interface";
+
+        leaf set-name {
+          type leafref {
+            path "../config/set-name";
+          }
+          description
+            "Reference to set name list key";
+        }
+
+        leaf type {
+          type leafref {
+            path "../config/type";
+          }
+          description
+            "Reference to type list key";
+        }
+
+        container config {
+          description
+            "Configuration data ";
+
+          uses interface-egress-acl-config;
+        }
+
+        container state {
+
+          config false;
+
+          description
+            "Operational state data for interface egress ACLs";
+
+          uses interface-egress-acl-config;
+          uses interface-egress-acl-state;
+        }
+
+        uses interface-acl-entries-top;
+      }
+    }
+  }
+
+  grouping acl-interfaces-config {
+    description
+      "Configuration data for interface references";
+
+    leaf id {
+      type oc-if:interface-id;
+      description
+        "User-defined identifier for the interface -- a common
+        convention could be '<if name>.<subif index>'";
+    }
+  }
+
+  grouping acl-interfaces-state {
+    description
+      "Operational state data for interface references";
+  }
+
+  grouping acl-interfaces-top {
+    description
+      "Top-level grouping for interface-specific ACL data";
+
+    container interfaces {
+      description
+        "Enclosing container for the list of interfaces on which
+        ACLs are set";
+
+      list interface {
+        key "id";
+        description
+          "List of interfaces on which ACLs are set";
+
+        leaf id {
+          type leafref {
+            path "../config/id";
+          }
+          description
+            "Reference to the interface id list key";
+        }
+
+        container config {
+          description
+            "Configuration for ACL per-interface data";
+
+          uses acl-interfaces-config;
+        }
+
+        container state {
+
+          config false;
+
+          description
+            "Operational state for ACL per-interface data";
+
+          uses acl-interfaces-config;
+          uses acl-interfaces-state;
+        }
+
+        uses oc-if:interface-ref;
+        uses interface-ingress-acl-top;
+        uses interface-egress-acl-top;
+      }
+    }
+  }
+
+  grouping acl-config {
+    description
+      "Global configuration data for ACLs";
+  }
+
+  grouping acl-state {
+    description
+      "Global operational state data for ACLs";
+
+    leaf counter-capability {
+      type identityref {
+        base ACL_COUNTER_CAPABILITY;
+      }
+      description
+        "System reported indication of how ACL counters are reported
+        by the target";
+    }
+  }
+  grouping acl-top {
+    description
+      "Top level grouping for ACL data and structure";
+
+    container acl {
+      description
+        "Top level enclosing container for ACL model config
+        and operational state data";
+
+      container config {
+        description
+          "Global config data for ACLs";
+
+        uses acl-config;
+      }
+
+      container state {
+
+        config false;
+
+        description
+          "Global operational state data for ACLs";
+
+        uses acl-config;
+        uses acl-state;
+      }
+
+      uses acl-set-top;
+      uses acl-interfaces-top;
+    }
+  }
+
+  // data definition statements
+  uses acl-top;
+
+  // augment statements
+
+
+}