module ietf-access-control-list { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-access-control-list"; prefix acl; import ietf-yang-types { prefix yang; } import ietf-packet-fields { prefix packet-fields; } import ietf-interfaces { prefix if; } organization "IETF NETMOD (NETCONF Data Modeling Language) Working Group"; contact "WG Web: http://tools.ietf.org/wg/netmod/ WG List: netmod@ietf.org Editor: Mahesh Jethanandani mjethanandani@gmail.com Editor: Lisa Huang lyihuang16@gmail.com Editor: Sonal Agarwal sagarwal12@cisco.com Editor: Dana Blair dblair@cisco.com"; description "This YANG module defines a component that describe the configuration of Access Control Lists (ACLs). Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; revision 2017-10-03 { description "Added feature and identity statements for different types of rule matches. Split the matching rules based on the feature statement and added a must statement within each container."; reference "RFC XXX: Network Access Control List (ACL) YANG Data Model."; } /* * Identities */ /* * Forwarding actions for a packet */ identity forwarding-action { description "Base identity for actions in the forwarding category"; } identity accept { base forwarding-action; description "Accept the packet"; } identity drop { base forwarding-action; description "Drop packet without sending any ICMP error message"; } identity reject { base forwarding-action; description "Drop the packet and send an ICMP error message to the source"; } /* * Logging actions for a packet */ identity log-action { description "Base identity for defining the destination for logging actions"; } identity log-syslog { base log-action; description "System log (syslog) the information for the packet"; } identity log-none { base log-action; description "No logging for the packet"; } identity acl-base { description "Base Access Control List type for all Access Control List type identifiers."; } identity ipv4-acl { base acl:acl-base; description "ACL that primarily matches on fields from the IPv4 header (e.g. IPv4 destination address) and layer 4 headers (e.g. TCP destination port). An acl of type ipv4-acl does not contain matches on fields in the ethernet header or the IPv6 header."; } identity ipv6-acl { base acl:acl-base; description "ACL that primarily matches on fields from the IPv6 header (e.g. IPv6 destination address) and layer 4 headers (e.g. TCP destination port). An acl of type ipv6-acl does not contain matches on fields in the ethernet header or the IPv4 header."; } identity eth-acl { base acl:acl-base; description "ACL that primarily matches on fields in the ethernet header, like 10/100/1000baseT or WiFi Access Control List. An acl of type eth-acl does not contain matches on fields in the IPv4 header, IPv6 header or layer 4 headers."; } identity mixed-l2-l3-ipv4-acl { base "acl:acl-base"; description "ACL that contains a mix of entries that primarily match on fields in ethernet headers, entries that primarily match on IPv4 headers. Matching on layer 4 header fields may also exist in the list."; } identity mixed-l2-l3-ipv6-acl { base "acl:acl-base"; description "ACL that contains a mix of entries that primarily match on fields in ethernet headers, entries that primarily match on fields in IPv6 headers. Matching on layer 4 header fields may also exist in the list."; } identity mixed-l2-l3-ipv4-ipv6-acl { base "acl:acl-base"; description "ACL that contains a mix of entries that primarily match on fields in ethernet headers, entries that primarily match on fields in IPv4 headers, and entries that primarily match on fields in IPv6 headers. Matching on layer 4 header fields may also exist in the list."; } identity any-acl { base "acl:acl-base"; description "ACL that can contain any pattern to match upon"; } /* * Features */ feature l2-acl { description "Layer 2 ACL supported"; } feature ipv4-acl { description "Layer 3 IPv4 ACL supported"; } feature ipv6-acl { description "Layer 3 IPv6 ACL supported"; } feature mixed-ipv4-acl { description "Layer 2 and Layer 3 IPv4 ACL supported"; } feature mixed-ipv6-acl { description "Layer 2 and Layer 3 IPv6 ACL supported"; } feature l2-l3-ipv4-ipv6-acl { description "Layer 2 and any Layer 3 ACL supported."; } feature tcp-acl { description "TCP header ACL supported."; } feature udp-acl { description "UDP header ACL supported."; } feature icmp-acl { description "ICMP header ACL supported."; } feature any-acl { description "ACL for any pattern."; } /* * Stats Features */ feature interface-stats { description "ACL counters are available and reported only per interface"; } feature acl-aggregate-stats { description "ACL counters are aggregated over all interfaces, and reported only per ACL entry"; } feature interface-acl-aggregate { description "ACL counters are reported per interface, and also aggregated and reported per ACL entry"; } /* * Typedefs */ typedef acl-type { type identityref { base acl-base; } description "This type is used to refer to an Access Control List (ACL) type"; } typedef acl-ref { type leafref { path "/access-lists/acl/acl-name"; } description "This type is used by data models that need to reference an Access Control List"; } grouping interface-acl { description "Grouping for per-interface ingress ACL data"; container acl-sets { description "Enclosing container the list of ingress ACLs on the interface"; list acl-set { key "set-name type"; ordered-by user; description "List of ingress ACLs on the interface"; leaf set-name { type leafref { path "../../../../../../acl/acl-name"; } description "Reference to the ACL set name applied on ingress"; } leaf type { type leafref { path "../../../../../../acl/acl-type"; } description "Reference to the ACL set type applied on ingress"; } list ace { if-feature "interface-stats or interface-acl-aggregate"; key "rule-name"; description "List of access list entries(ACE)"; leaf rule-name { type leafref { path "../../../../../../../acl/aces/ace/rule-name"; } description "The ace rule-name"; } uses acl-counters; } } } } grouping acl-counters { description "Common grouping for ACL counters"; leaf matched-packets { type yang:counter64; config false; description "Count of the number of packets matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), then the value should be equal to the aggregate count across all interfaces. An implementation that provides counters per entry per interface is not required to also provide an aggregate count, e.g., per entry -- the user is expected to be able implement the required aggregation if such a count is needed."; } leaf matched-octets { type yang:counter64; config false; description "Count of the number of octets (bytes) matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), then the value should be equal to the aggregate count across all interfaces. An implementation that provides counters per entry per interface is not required to also provide an aggregate count, e.g., per entry -- the user is expected to be able implement the required aggregation if such a count is needed."; } } /* * Configuration data nodes */ container access-lists { description "This is a top level container for Access Control Lists. It can have one or more Access Control Lists."; list acl { key "acl-type acl-name"; description "An Access Control List(ACL) is an ordered list of Access List Entries (ACE). Each Access Control Entry has a list of match criteria and a list of actions. Since there are several kinds of Access Control Lists implemented with different attributes for different vendors, this model accommodates customizing Access Control Lists for each kind and for each vendor."; leaf acl-name { type string { length "1..64"; } description "The name of access-list. A device MAY restrict the length and value of this name, possibly space and special characters are not allowed."; } leaf acl-type { type acl-type; description "Type of access control list. Indicates the primary intended type of match criteria (e.g. ethernet, IPv4, IPv6, mixed, etc) used in the list instance."; } container aces { description "The access-list-entries container contains a list of access-list-entries(ACE)."; list ace { key "rule-name"; ordered-by user; description "List of access list entries(ACE)"; leaf rule-name { type string { length "1..64"; } description "A unique name identifying this Access List Entry(ACE)."; } container matches { description "The rules in this set determine what fields will be matched upon before any action is taken on them. The rules are selected based on the feature set defined by the server and the acl-type defined."; container l2-acl { if-feature l2-acl; must "derived-from(../../../../acl-type, 'acl:eth-acl')"; uses packet-fields:acl-eth-header-fields; description "Rule set for L2 ACL."; } container ipv4-acl { if-feature ipv4-acl; must "derived-from(../../../../acl-type, " + "'acl:ipv4-acl')"; uses packet-fields:acl-ip-header-fields; uses packet-fields:acl-ipv4-header-fields; description "Rule set that supports IPv4 headers."; } container ipv6-acl { if-feature ipv6-acl; must "derived-from(../../../../acl-type, " + "'acl:ipv6-acl')"; uses packet-fields:acl-ip-header-fields; uses packet-fields:acl-ipv6-header-fields; description "Rule set that supports IPv6 headers."; } container l2-l3-ipv4-acl { if-feature mixed-ipv4-acl; must "derived-from(../../../../acl-type, " + "'acl:mixed-l2-l3-ipv4-acl')"; uses packet-fields:acl-eth-header-fields; uses packet-fields:acl-ip-header-fields; uses packet-fields:acl-ipv4-header-fields; description "Rule set that is a logical AND (&&) of l2 and ipv4 headers."; } container l2-l3-ipv6-acl { if-feature mixed-ipv6-acl; must "derived-from(../../../../acl-type, " + "'acl:mixed-l2-l3-ipv6-acl')"; uses packet-fields:acl-eth-header-fields; uses packet-fields:acl-ip-header-fields; uses packet-fields:acl-ipv6-header-fields; description "Rule set that is a logical AND (&&) of L2 && IPv6 headers."; } container l2-l3-ipv4-ipv6-acl { if-feature l2-l3-ipv4-ipv6-acl; must "derived-from(../../../../acl-type, " + "'acl:mixed-l2-l3-ipv4-ipv6-acl')"; uses packet-fields:acl-eth-header-fields; uses packet-fields:acl-ip-header-fields; uses packet-fields:acl-ipv4-header-fields; uses packet-fields:acl-ipv6-header-fields; description "Rule set that is a logical AND (&&) of L2 && IPv4 && IPv6 headers."; } container tcp-acl { if-feature tcp-acl; uses packet-fields:acl-tcp-header-fields; description "Rule set that defines TCP headers."; } container udp-acl { if-feature udp-acl; uses packet-fields:acl-udp-header-fields; description "Rule set that defines UDP headers."; } container icmp-acl { if-feature icmp-acl; uses packet-fields:acl-icmp-header-fields; description "Rule set that defines ICMP headers."; } container any-acl { if-feature any-acl; must "derived-from(../../../../acl-type, 'acl:any-acl')"; presence "Matches any"; description "Rule set that allows for a any ACL."; } leaf interface { type if:interface-ref; description "Interface name that is specified to match upon."; } } container actions { if-feature "acl-aggregate-stats or interface-acl-aggregate"; description "Definitions of action criteria for this ace entry"; leaf forwarding { type identityref { base forwarding-action; } mandatory true; description "Specifies the forwarding action per ace entry"; } leaf logging { type identityref { base log-action; } default log-none; description "Specifies the log action and destination for matched packets. Default value is not to log the packet."; } leaf icmp-off { type boolean; default "false"; description "true indicates ICMP errors will never be generated in response to an ICMP error message. false indicates ICMP error will be generated."; } } uses acl-counters; } } } container interfaces { description "Enclosing container for the list of interfaces on which ACLs are set"; list interface { key "interface-id"; description "List of interfaces on which ACLs are set"; leaf interface-id { type if:interface-ref; description "Reference to the interface id list key"; } container ingress { uses interface-acl; description "The ACL's applied to ingress interface"; } container egress { uses interface-acl; description "The ACL's applied to egress interface"; } } } } }