2 * Copyright (c) 2017 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #ifndef __VOM_L3_ACL_RULE_H__
17 #define __VOM_L3_ACL_RULE_H__
19 #include "vom/acl_types.hpp"
20 #include "vom/prefix.hpp"
25 * An ACL rule is the building block of an ACL. An ACL, which is
26 * the object applied to an interface, is comprised of an ordersed
27 * sequence of ACL rules.
28 * This class is a wrapper around the VAPI generated struct and exports
29 * an API with better types.
35 * Construct a new object matching the desried state
37 l3_rule(uint32_t priority,
38 const action_t& action,
39 const route::prefix_t& src,
40 const route::prefix_t& dst,
42 uint16_t srcport_or_icmptype_first = 0,
43 uint16_t srcport_or_icmptype_last = 0,
44 uint16_t dstport_or_icmpcode_first = 0,
45 uint16_t dstport_or_icmpcode_last = 0,
46 uint8_t tcp_flags_mask = 0,
47 uint8_t tcp_flags_value = 0);
52 l3_rule(const l3_rule& o) = default;
60 * convert to string format for debug purposes
62 std::string to_string() const;
67 bool operator<(const l3_rule& rule) const;
70 * comparison operator (for testing)
72 bool operator==(const l3_rule& rule) const;
77 void set_src_ip(route::prefix_t src);
82 void set_dst_ip(route::prefix_t dst);
87 void set_proto(uint8_t proto);
90 * Set Src port or ICMP Type first
92 void set_src_from_port(uint16_t srcport_or_icmptype_first);
95 * Set Src port or ICMP Type last
97 void set_src_to_port(uint16_t srcport_or_icmptype_last);
100 * Set Dst port or ICMP code first
102 void set_dst_from_port(uint16_t dstport_or_icmpcode_first);
105 * Set Dst port or ICMP code last
107 void set_dst_to_port(uint16_t dstport_or_icmpcode_last);
112 void set_tcp_flags_mask(uint8_t tcp_flags_mask);
115 * Set TCP flags value
117 void set_tcp_flags_value(uint8_t tcp_flags_value);
122 const route::prefix_t& src() const;
123 uint32_t priority() const;
124 const action_t& action() const;
125 const route::prefix_t& dst() const;
126 uint8_t proto() const;
127 uint16_t srcport_or_icmptype_first() const;
128 uint16_t srcport_or_icmptype_last() const;
129 uint16_t dstport_or_icmpcode_first() const;
130 uint16_t dstport_or_icmpcode_last() const;
131 uint8_t tcp_flags_mask() const;
132 uint8_t tcp_flags_value() const;
136 * Priority. Used to sort the rules in a list in the order
137 * in which they are applied
149 route::prefix_t m_src;
154 route::prefix_t m_dst;
157 * L4 protocol. IANA number. 1 = ICMP, 58 = ICMPv6, 6 = TCP, 17 =
159 * 0 => ignore L4 and ignore the ports/tcpflags when matching.
164 * If the L4 protocol is TCP or UDP, the below
165 * hold ranges of ports, else if the L4 is ICMP/ICMPv6
166 * they hold ranges of ICMP(v6) types/codes.
168 * Ranges are inclusive, i.e. to match "any" TCP/UDP port,
169 * use first=0,last=65535. For ICMP(v6),
170 * use first=0,last=255.
172 uint16_t m_srcport_or_icmptype_first;
173 uint16_t m_srcport_or_icmptype_last;
174 uint16_t m_dstport_or_icmpcode_first;
175 uint16_t m_dstport_or_icmpcode_last;
178 * for proto = 6, this matches if the
179 * TCP flags in the packet, ANDed with tcp_flags_mask,
180 * is equal to tcp_flags_value.
182 uint8_t m_tcp_flags_mask;
183 uint8_t m_tcp_flags_value;
189 * fd.io coding-style-patch-verification: ON
192 * eval: (c-set-style "mozilla")