Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates caclmgrd to add MATCH service #131

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ashish12pant
Copy link

@ashish12pant ashish12pant commented Jun 14, 2024

A new service Type “MATCH” in caclmgrd daemon, which can be used to apply user given combination of IP_PROTOCOL, SRC_IP, DST_PORT.

  • Add support for multiple ACL RULE with different DST port numbers within single ACL TABLE for
  • Add support for setting ACL RULE any Ip Protocols like udp, ospf, vrrp, igmp.
  • Add unit tests required for this change

Sample JSON input:

{ 
    "ACL_TABLE": { 
        "control-plane-match": { 
            "policy_desc": "control plane acl match", 
            "services":[ 
                "MATCH” 
            ], 
            "stage": "ingress", 
            "type": "CTRLPLANE" 
        }, 
    "ACL_RULE": { 
        "control-plane-match|10": { 
            "IP_PROTOCOL": "112",  
            "SRC_IP": "0.0.0.0/0", 
            "PACKET_ACTION": "ACCEPT", 
            "PRIORITY": "9999" 
        }, 
        "control-plane-match|20": { 
            "SRC_IP": "0.0.0.0/0", 
            "IP_PROTOCOL": "89", 
            "PACKET_ACTION": "ACCEPT", 
            "PRIORITY": "9998" 
        }, 
        "control-plane-match|30": { 
            "IP_PROTOCOL": "17", 
            "SRC_IP": "0.0.0.0/0", 
            "L4_DST_PORT": "4784", 
            "PACKET_ACTION": "ACCEPT", 
            "PRIORITY": "9997" 
        }, 
        "control-plane-match|40": { 
            "IP_PROTOCOL": "6", 
            "SRC_IP": "0.0.0.0/0", 
            "L4_DST_PORT": "179", 
            "PACKET_ACTION": "ACCEPT", 
            "PRIORITY": "9996" 
       }, 
} 

Translated Iptables rule from caclmgrd:

iptables -A INPUT -p 112 -s 0.0.0.0/0 -j ACCEPT 
iptables -A INPUT -p 89 -s 0.0.0.0/0 -j ACCEPT 
iptables -A INPUT -p udp -s 0.0.0.0/0 --dport 4784-j ACCEPT 
iptables -A INPUT -p tcp -s 0.0.0.0/0 --dport 179-j ACCEPT 

Copy link

CLA Missing ID CLA Not Signed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant