Commit 49ae9fee authored by Lluis Gifre Renom's avatar Lluis Gifre Renom
Browse files

Merge branch... 

Merge branch 'feat/113-cttc-implement-nbi-connector-to-manage-network-access-control-lists-acls' into 'develop'

Resolve "(CTTC) Implement NBI connector to manage Network Access Control Lists (ACLs)"

See merge request !213
parents 0f1ecf6d c2bc875a

proto/acl.proto

+1 −0
Original line number Diff line number Diff line
@@ -46,6 +46,7 @@ message AclMatch { 
  uint32 dst_port         = 6;

  uint32 start_mpls_label = 7;

  uint32 end_mpls_label   = 8;

  string tcp_flags        = 9;

}



message AclAction {

src/device/service/drivers/openconfig/templates/__init__.py

+28 −8
Original line number Diff line number Diff line
@@ -27,6 +27,9 @@ from .NetworkInstances import parse as parse_network_instances 
from .RoutingPolicy import parse as parse_routing_policy

from .Acl import parse as parse_acl

from .Inventory import parse as parse_inventory

from .acl.acl_adapter import acl_cr_to_dict

from .acl.acl_adapter_ipinfusion_proprietary import acl_cr_to_dict_ipinfusion_proprietary



LOGGER = logging.getLogger(__name__)



ALL_RESOURCE_KEYS = [
@@ -113,14 +116,31 @@ def compose_config( # template generation 


    elif (message_renderer == "jinja"):

        templates = []

        if "acl_ruleset" in resource_key:                                               # MANAGING ACLs

            if vendor == 'ipinfusion': # ipinfusion proprietary netconf receipe is used temporarily

                enable_ingress_filter_path = 'acl/interfaces/ingress/enable_ingress_filter.xml'

                acl_entry_path = 'acl/acl-set/acl-entry/edit_config_ipinfusion_proprietary.xml'

                acl_ingress_path = 'acl/interfaces/ingress/edit_config_ipinfusion_proprietary.xml'

                data : Dict[str, Any] = acl_cr_to_dict_ipinfusion_proprietary(resource_value, delete=delete)

            else:

                enable_ingress_filter_path = 'acl/interfaces/ingress/enable_ingress_filter.xml'

                acl_entry_path = 'acl/acl-set/acl-entry/edit_config.xml'

                acl_ingress_path = 'acl/interfaces/ingress/edit_config.xml'

                data : Dict[str, Any] = acl_cr_to_dict(resource_value, delete=delete)



            if delete: # unpair acl and interface before removing acl

                templates.append(JINJA_ENV.get_template(acl_ingress_path))

                templates.append(JINJA_ENV.get_template(acl_entry_path))

                templates.append(JINJA_ENV.get_template(enable_ingress_filter_path))

            else:

                templates.append(JINJA_ENV.get_template(enable_ingress_filter_path))

                templates.append(JINJA_ENV.get_template(acl_entry_path))

                templates.append(JINJA_ENV.get_template(acl_ingress_path))

        else:

            template_name = '{:s}/edit_config.xml'.format(RE_REMOVE_FILTERS.sub('', resource_key))

            templates.append(JINJA_ENV.get_template(template_name))



        if "acl_ruleset" in resource_key:                                               # MANAGING ACLs

            templates =[]

            templates.append(JINJA_ENV.get_template('acl/acl-set/acl-entry/edit_config.xml'))

            templates.append(JINJA_ENV.get_template('acl/interfaces/ingress/edit_config.xml'))

            data : Dict[str, Any] = json.loads(resource_value)



        operation = 'delete' if delete else 'merge' # others

        #operation = 'delete' if delete else '' # ipinfusion?

src/device/service/drivers/openconfig/templates/acl/__init__.py

0 → 100644
+13 −0
Original line number Diff line number Diff line 
# Copyright 2022-2024 ETSI OSG/SDG TeraFlowSDN (TFS) (https://tfs.etsi.org/)

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#      http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.
 
 No newline at end of file

src/device/service/drivers/openconfig/templates/acl/acl-set/acl-entry/edit_config_ipinfusion_proprietary.xml

0 → 100644
+34 −0
Original line number Diff line number Diff line 
<acl xmlns="http://www.ipinfusion.com/yang/ocnos/ipi-acl">

  <acl-sets>

    <acl-set {% if operation == 'delete' %}operation="delete"{% endif %}>

      <name>{{name}}</name>

      {% if type is defined %}<type>{{type}}</type>{% endif %}

      <config>

        <name>{{name}}</name>

        {% if type is defined %}<type>{{type}}</type>{% endif %}

      </config>

      {% if operation != 'delete' %}

      <acl-entries>

        <acl-entry>

          <sequence-id>{{sequence_id}}</sequence-id>

          <config>

            <sequence-id>{{sequence_id}}</sequence-id>

          </config>

          <ipv4>

            <config>

              <source-address>{{source_address}}</source-address>

              <destination-address>{{destination_address}}</destination-address>

              <dscp>{{dscp}}</dscp>

              <protocol-tcp />

              <tcp-source-port>{{source_port}}</tcp-source-port>

              <tcp-destination-port>{{destination_port}}</tcp-destination-port>

              <tcp-flags>{{tcp_flags}}</tcp-flags>

              <forwarding-action>{{forwarding_action}}</forwarding-action>

            </config>

          </ipv4>

        </acl-entry>

      </acl-entries>

      {% endif %}

    </acl-set>

  </acl-sets>

</acl>
 
 No newline at end of file

src/device/service/drivers/openconfig/templates/acl/acl_adapter.py

0 → 100644
+73 −0
Original line number Diff line number Diff line 
# Copyright 2022-2024 ETSI OSG/SDG TeraFlowSDN (TFS) (https://tfs.etsi.org/)

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#      http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.



from typing import Dict, TypedDict



from ..ACL.ACL_multivendor import RULE_TYPE_MAPPING, FORWARDING_ACTION_MAPPING, LOG_ACTION_MAPPING



class ACLRequestData(TypedDict):

    name: str  # acl-set name

    type: str  # acl-set type

    sequence_id: int  # acl-entry sequence-id

    source_address: str

    destination_address: str

    forwarding_action: str

    id: str  # interface id

    interface: str

    subinterface: int

    set_name_ingress: str  # ingress-acl-set name

    type_ingress: str  # ingress-acl-set type

    all: bool

    dscp: int

    protocol: int

    tcp_flags: str

    source_port: int

    destination_port: int



def acl_cr_to_dict(acl_cr_dict: Dict, subinterface:int = 0) -> Dict:

    rule_set = acl_cr_dict['rule_set']

    rule_set_entry = rule_set['entries'][0]

    rule_set_entry_match = rule_set_entry['match']

    rule_set_entry_action = rule_set_entry['action']



    name: str = rule_set['name']

    type: str = RULE_TYPE_MAPPING[rule_set["type"]]

    sequence_id = rule_set_entry['sequence_id']

    source_address = rule_set_entry_match['src_address']

    destination_address = rule_set_entry_match['dst_address']

    forwarding_action: str = FORWARDING_ACTION_MAPPING[rule_set_entry_action['forward_action']]

    interface_id = acl_cr_dict['interface']

    interface = interface_id

    set_name_ingress = name

    type_ingress = type



    return ACLRequestData(

        name=name,

        type=type,

        sequence_id=sequence_id,

        source_address=source_address,

        destination_address=destination_address,

        forwarding_action=forwarding_action,

        id=interface_id,

        interface=interface,

        # subinterface=subinterface,

        set_name_ingress=set_name_ingress,

        type_ingress=type_ingress,

        all=True,

        dscp=18,

        protocol=6,

        tcp_flags='TCP_SYN',

        source_port=22,

        destination_port=80

    )