]> git.proxmox.com Git - mirror_frr.git/blame - lib/filter.c
projects / mirror_frr.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #2652 from LabNConsulting/working/master/confdate_cleanup
[mirror_frr.git] / lib / filter.c
CommitLineData
718e3744 1/* Route filtering function.
2 * Copyright (C) 1998, 1999 Kunihiro Ishiguro
3 *
4 * This file is part of GNU Zebra.
5 *
6 * GNU Zebra is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published
8 * by the Free Software Foundation; either version 2, or (at your
9 * option) any later version.
10 *
11 * GNU Zebra is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * General Public License for more details.
15 *
896014f4
DL		 16 * You should have received a copy of the GNU General Public License along
17 * with this program; see the file COPYING; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
718e3744 19 */
20
21#include <zebra.h>
22
23#include "prefix.h"
24#include "filter.h"
25#include "memory.h"
26#include "command.h"
27#include "sockunion.h"
28#include "buffer.h"
fbf5d033 29#include "log.h"
518f0eb1 30#include "routemap.h"
b85120bc 31#include "libfrr.h"
718e3744 32
d62a17ae 33DEFINE_MTYPE_STATIC(LIB, ACCESS_LIST, "Access List")
4a1ab8e4 34DEFINE_MTYPE_STATIC(LIB, ACCESS_LIST_STR, "Access List Str")
d62a17ae 35DEFINE_MTYPE_STATIC(LIB, ACCESS_FILTER, "Access Filter")
36
37struct filter_cisco {
38 /* Cisco access-list */
39 int extended;
40 struct in_addr addr;
41 struct in_addr addr_mask;
42 struct in_addr mask;
43 struct in_addr mask_mask;
718e3744 44};
45
d62a17ae 46struct filter_zebra {
47 /* If this filter is "exact" match then this flag is set. */
48 int exact;
718e3744 49
d62a17ae 50 /* Prefix information. */
51 struct prefix prefix;
718e3744 52};
53
54/* Filter element of access list */
d62a17ae 55struct filter {
56 /* For doubly linked list. */
57 struct filter *next;
58 struct filter *prev;
718e3744 59
d62a17ae 60 /* Filter type information. */
61 enum filter_type type;
718e3744 62
d62a17ae 63 /* Cisco access-list */
64 int cisco;
718e3744 65
d62a17ae 66 union {
67 struct filter_cisco cfilter;
68 struct filter_zebra zfilter;
69 } u;
718e3744 70};
71
72/* List of access_list. */
d62a17ae 73struct access_list_list {
74 struct access_list *head;
75 struct access_list *tail;
718e3744 76};
77
78/* Master structure of access_list. */
d62a17ae 79struct access_master {
80 /* List of access_list which name is number. */
81 struct access_list_list num;
718e3744 82
d62a17ae 83 /* List of access_list which name is string. */
84 struct access_list_list str;
718e3744 85
d62a17ae 86 /* Hook function which is executed when new access_list is added. */
87 void (*add_hook)(struct access_list *);
718e3744 88
d62a17ae 89 /* Hook function which is executed when access_list is deleted. */
90 void (*delete_hook)(struct access_list *);
718e3744 91};
92
b34fd35d 93/* Static structure for mac access_list's master. */
d37ba549
MK		 94static struct access_master access_master_mac = {
95 {NULL, NULL},
96 {NULL, NULL},
97 NULL,
98 NULL,
99};
100
718e3744 101/* Static structure for IPv4 access_list's master. */
d62a17ae 102static struct access_master access_master_ipv4 = {
103 {NULL, NULL},
104 {NULL, NULL},
105 NULL,
106 NULL,
718e3744 107};
108
718e3744 109/* Static structure for IPv6 access_list's master. */
d62a17ae 110static struct access_master access_master_ipv6 = {
111 {NULL, NULL},
112 {NULL, NULL},
113 NULL,
114 NULL,
718e3744 115};
6b0655a2 116
d62a17ae 117static struct access_master *access_master_get(afi_t afi)
718e3744 118{
d62a17ae 119 if (afi == AFI_IP)
120 return &access_master_ipv4;
121 else if (afi == AFI_IP6)
122 return &access_master_ipv6;
d37ba549
MK		 123 else if (afi == AFI_L2VPN)
124 return &access_master_mac;
d62a17ae 125 return NULL;
718e3744 126}
127
128/* Allocate new filter structure. */
d62a17ae 129static struct filter *filter_new(void)
718e3744 130{
d62a17ae 131 return (struct filter *)XCALLOC(MTYPE_ACCESS_FILTER,
132 sizeof(struct filter));
718e3744 133}
134
d62a17ae 135static void filter_free(struct filter *filter)
718e3744 136{
d62a17ae 137 XFREE(MTYPE_ACCESS_FILTER, filter);
718e3744 138}
139
140/* Return string of filter_type. */
d62a17ae 141static const char *filter_type_str(struct filter *filter)
142{
143 switch (filter->type) {
144 case FILTER_PERMIT:
145 return "permit";
146 break;
147 case FILTER_DENY:
148 return "deny";
149 break;
150 case FILTER_DYNAMIC:
151 return "dynamic";
152 break;
153 default:
154 return "";
155 break;
156 }
718e3744 157}
158
159/* If filter match to the prefix then return 1. */
d62a17ae 160static int filter_match_cisco(struct filter *mfilter, struct prefix *p)
718e3744 161{
d62a17ae 162 struct filter_cisco *filter;
163 struct in_addr mask;
d7c0a89a
QY		 164 uint32_t check_addr;
165 uint32_t check_mask;
718e3744 166
d62a17ae 167 filter = &mfilter->u.cfilter;
168 check_addr = p->u.prefix4.s_addr & ~filter->addr_mask.s_addr;
718e3744 169
d62a17ae 170 if (filter->extended) {
171 masklen2ip(p->prefixlen, &mask);
172 check_mask = mask.s_addr & ~filter->mask_mask.s_addr;
718e3744 173
d62a17ae 174 if (memcmp(&check_addr, &filter->addr.s_addr, 4) == 0
175 && memcmp(&check_mask, &filter->mask.s_addr, 4) == 0)
176 return 1;
177 } else if (memcmp(&check_addr, &filter->addr.s_addr, 4) == 0)
178 return 1;
718e3744 179
d62a17ae 180 return 0;
718e3744 181}
182
183/* If filter match to the prefix then return 1. */
0f6476cc 184static int filter_match_zebra(struct filter *mfilter, struct prefix *p)
718e3744 185{
d37ba549 186 struct filter_zebra *filter = NULL;
718e3744 187
d62a17ae 188 filter = &mfilter->u.zfilter;
718e3744 189
3b0f6068
DL		 190 if (filter->prefix.family == p->family) {
191 if (filter->exact) {
192 if (filter->prefix.prefixlen == p->prefixlen)
d62a17ae 193 return prefix_match(&filter->prefix, p);
3b0f6068
DL		 194 else
195 return 0;
d62a17ae 196 } else
3b0f6068
DL		 197 return prefix_match(&filter->prefix, p);
198 } else
199 return 0;
718e3744 200}
6b0655a2 201
718e3744 202/* Allocate new access list structure. */
d62a17ae 203static struct access_list *access_list_new(void)
718e3744 204{
d62a17ae 205 return (struct access_list *)XCALLOC(MTYPE_ACCESS_LIST,
206 sizeof(struct access_list));
718e3744 207}
208
209/* Free allocated access_list. */
d62a17ae 210static void access_list_free(struct access_list *access)
718e3744 211{
d62a17ae 212 XFREE(MTYPE_ACCESS_LIST, access);
718e3744 213}
214
215/* Delete access_list from access_master and free it. */
d62a17ae 216static void access_list_delete(struct access_list *access)
718e3744 217{
d62a17ae 218 struct filter *filter;
219 struct filter *next;
220 struct access_list_list *list;
221 struct access_master *master;
718e3744 222
d62a17ae 223 for (filter = access->head; filter; filter = next) {
224 next = filter->next;
225 filter_free(filter);
226 }
718e3744 227
d62a17ae 228 master = access->master;
718e3744 229
d62a17ae 230 if (access->type == ACCESS_TYPE_NUMBER)
231 list = &master->num;
232 else
233 list = &master->str;
718e3744 234
d62a17ae 235 if (access->next)
236 access->next->prev = access->prev;
237 else
238 list->tail = access->prev;
718e3744 239
d62a17ae 240 if (access->prev)
241 access->prev->next = access->next;
242 else
243 list->head = access->next;
718e3744 244
d62a17ae 245 if (access->name)
246 XFREE(MTYPE_ACCESS_LIST_STR, access->name);
718e3744 247
d62a17ae 248 if (access->remark)
249 XFREE(MTYPE_TMP, access->remark);
718e3744 250
d62a17ae 251 access_list_free(access);
718e3744 252}
253
254/* Insert new access list to list of access_list. Each acceess_list
255 is sorted by the name. */
d62a17ae 256static struct access_list *access_list_insert(afi_t afi, const char *name)
257{
258 unsigned int i;
259 long number;
260 struct access_list *access;
261 struct access_list *point;
262 struct access_list_list *alist;
263 struct access_master *master;
264
265 master = access_master_get(afi);
266 if (master == NULL)
267 return NULL;
268
269 /* Allocate new access_list and copy given name. */
270 access = access_list_new();
271 access->name = XSTRDUP(MTYPE_ACCESS_LIST_STR, name);
272 access->master = master;
273
274 /* If name is made by all digit character. We treat it as
275 number. */
276 for (number = 0, i = 0; i < strlen(name); i++) {
277 if (isdigit((int)name[i]))
278 number = (number * 10) + (name[i] - '0');
279 else
280 break;
281 }
282
283 /* In case of name is all digit character */
284 if (i == strlen(name)) {
285 access->type = ACCESS_TYPE_NUMBER;
286
287 /* Set access_list to number list. */
288 alist = &master->num;
289
290 for (point = alist->head; point; point = point->next)
291 if (atol(point->name) >= number)
292 break;
293 } else {
294 access->type = ACCESS_TYPE_STRING;
295
296 /* Set access_list to string list. */
297 alist = &master->str;
298
299 /* Set point to insertion point. */
300 for (point = alist->head; point; point = point->next)
301 if (strcmp(point->name, name) >= 0)
302 break;
303 }
304
305 /* In case of this is the first element of master. */
306 if (alist->head == NULL) {
307 alist->head = alist->tail = access;
308 return access;
309 }
310
311 /* In case of insertion is made at the tail of access_list. */
312 if (point == NULL) {
313 access->prev = alist->tail;
314 alist->tail->next = access;
315 alist->tail = access;
316 return access;
317 }
318
319 /* In case of insertion is made at the head of access_list. */
320 if (point == alist->head) {
321 access->next = alist->head;
322 alist->head->prev = access;
323 alist->head = access;
324 return access;
325 }
326
327 /* Insertion is made at middle of the access_list. */
328 access->next = point;
329 access->prev = point->prev;
330
331 if (point->prev)
332 point->prev->next = access;
333 point->prev = access;
334
335 return access;
718e3744 336}
337
338/* Lookup access_list from list of access_list by name. */
d62a17ae 339struct access_list *access_list_lookup(afi_t afi, const char *name)
718e3744 340{
d62a17ae 341 struct access_list *access;
342 struct access_master *master;
718e3744 343
d62a17ae 344 if (name == NULL)
345 return NULL;
718e3744 346
d62a17ae 347 master = access_master_get(afi);
348 if (master == NULL)
349 return NULL;
718e3744 350
d62a17ae 351 for (access = master->num.head; access; access = access->next)
352 if (strcmp(access->name, name) == 0)
353 return access;
718e3744 354
d62a17ae 355 for (access = master->str.head; access; access = access->next)
356 if (strcmp(access->name, name) == 0)
357 return access;
718e3744 358
d62a17ae 359 return NULL;
718e3744 360}
361
362/* Get access list from list of access_list. If there isn't matched
363 access_list create new one and return it. */
d62a17ae 364static struct access_list *access_list_get(afi_t afi, const char *name)
718e3744 365{
d62a17ae 366 struct access_list *access;
718e3744 367
d62a17ae 368 access = access_list_lookup(afi, name);
369 if (access == NULL)
370 access = access_list_insert(afi, name);
371 return access;
718e3744 372}
373
374/* Apply access list to object (which should be struct prefix *). */
d62a17ae 375enum filter_type access_list_apply(struct access_list *access, void *object)
718e3744 376{
d62a17ae 377 struct filter *filter;
0f6476cc 378 struct prefix *p = (struct prefix *)object;
718e3744 379
d62a17ae 380 if (access == NULL)
381 return FILTER_DENY;
718e3744 382
d62a17ae 383 for (filter = access->head; filter; filter = filter->next) {
384 if (filter->cisco) {
385 if (filter_match_cisco(filter, p))
386 return filter->type;
387 } else {
0f6476cc 388 if (filter_match_zebra(filter, p))
d62a17ae 389 return filter->type;
390 }
718e3744 391 }
718e3744 392
d62a17ae 393 return FILTER_DENY;
718e3744 394}
395
396/* Add hook function. */
d62a17ae 397void access_list_add_hook(void (*func)(struct access_list *access))
718e3744 398{
d62a17ae 399 access_master_ipv4.add_hook = func;
400 access_master_ipv6.add_hook = func;
d37ba549 401 access_master_mac.add_hook = func;
718e3744 402}
403
404/* Delete hook function. */
d62a17ae 405void access_list_delete_hook(void (*func)(struct access_list *access))
718e3744 406{
d62a17ae 407 access_master_ipv4.delete_hook = func;
408 access_master_ipv6.delete_hook = func;
d37ba549 409 access_master_mac.delete_hook = func;
718e3744 410}
411
412/* Add new filter to the end of specified access_list. */
d62a17ae 413static void access_list_filter_add(struct access_list *access,
414 struct filter *filter)
718e3744 415{
d62a17ae 416 filter->next = NULL;
417 filter->prev = access->tail;
718e3744 418
d62a17ae 419 if (access->tail)
420 access->tail->next = filter;
421 else
422 access->head = filter;
423 access->tail = filter;
718e3744 424
d62a17ae 425 /* Run hook function. */
426 if (access->master->add_hook)
427 (*access->master->add_hook)(access);
428 route_map_notify_dependencies(access->name, RMAP_EVENT_FILTER_ADDED);
718e3744 429}
430
431/* If access_list has no filter then return 1. */
d62a17ae 432static int access_list_empty(struct access_list *access)
718e3744 433{
d62a17ae 434 if (access->head == NULL && access->tail == NULL)
435 return 1;
436 else
437 return 0;
718e3744 438}
439
440/* Delete filter from specified access_list. If there is hook
441 function execute it. */
d62a17ae 442static void access_list_filter_delete(struct access_list *access,
443 struct filter *filter)
718e3744 444{
d62a17ae 445 struct access_master *master;
718e3744 446
d62a17ae 447 master = access->master;
718e3744 448
d62a17ae 449 if (filter->next)
450 filter->next->prev = filter->prev;
451 else
452 access->tail = filter->prev;
718e3744 453
d62a17ae 454 if (filter->prev)
455 filter->prev->next = filter->next;
456 else
457 access->head = filter->next;
718e3744 458
d62a17ae 459 filter_free(filter);
718e3744 460
d62a17ae 461 route_map_notify_dependencies(access->name, RMAP_EVENT_FILTER_DELETED);
462 /* Run hook function. */
463 if (master->delete_hook)
464 (*master->delete_hook)(access);
683de05f 465
d62a17ae 466 /* If access_list becomes empty delete it from access_master. */
467 if (access_list_empty(access))
468 access_list_delete(access);
718e3744 469}
6b0655a2 470
718e3744 471/*
472 deny Specify packets to reject
473 permit Specify packets to forward
474 dynamic ?
475*/
476
477/*
478 Hostname or A.B.C.D Address to match
479 any Any source host
480 host A single host address
481*/
482
d62a17ae 483static struct filter *filter_lookup_cisco(struct access_list *access,
484 struct filter *mnew)
485{
486 struct filter *mfilter;
487 struct filter_cisco *filter;
488 struct filter_cisco *new;
489
490 new = &mnew->u.cfilter;
491
492 for (mfilter = access->head; mfilter; mfilter = mfilter->next) {
493 filter = &mfilter->u.cfilter;
494
495 if (filter->extended) {
496 if (mfilter->type == mnew->type
497 && filter->addr.s_addr == new->addr.s_addr
498 && filter->addr_mask.s_addr == new->addr_mask.s_addr
499 && filter->mask.s_addr == new->mask.s_addr
500 && filter->mask_mask.s_addr
501 == new->mask_mask.s_addr)
502 return mfilter;
503 } else {
504 if (mfilter->type == mnew->type
505 && filter->addr.s_addr == new->addr.s_addr
506 && filter->addr_mask.s_addr
507 == new->addr_mask.s_addr)
508 return mfilter;
509 }
510 }
511
512 return NULL;
513}
514
515static struct filter *filter_lookup_zebra(struct access_list *access,
516 struct filter *mnew)
718e3744 517{
d62a17ae 518 struct filter *mfilter;
519 struct filter_zebra *filter;
520 struct filter_zebra *new;
718e3744 521
d62a17ae 522 new = &mnew->u.zfilter;
718e3744 523
d62a17ae 524 for (mfilter = access->head; mfilter; mfilter = mfilter->next) {
525 filter = &mfilter->u.zfilter;
718e3744 526
d62a17ae 527 if (filter->exact == new->exact
d37ba549 528 && mfilter->type == mnew->type) {
0f6476cc
DS		 529 if (prefix_same(&filter->prefix, &new->prefix))
530 return mfilter;
d37ba549 531 }
718e3744 532 }
d62a17ae 533 return NULL;
534}
535
536static int vty_access_list_remark_unset(struct vty *vty, afi_t afi,
537 const char *name)
538{
539 struct access_list *access;
540
541 access = access_list_lookup(afi, name);
542 if (!access) {
543 vty_out(vty, "%% access-list %s doesn't exist\n", name);
544 return CMD_WARNING_CONFIG_FAILED;
545 }
546
547 if (access->remark) {
548 XFREE(MTYPE_TMP, access->remark);
549 access->remark = NULL;
718e3744 550 }
d62a17ae 551
2e1cc436 552 if (access->head == NULL && access->tail == NULL)
d62a17ae 553 access_list_delete(access);
554
555 return CMD_SUCCESS;
556}
557
558static int filter_set_cisco(struct vty *vty, const char *name_str,
559 const char *type_str, const char *addr_str,
560 const char *addr_mask_str, const char *mask_str,
561 const char *mask_mask_str, int extended, int set)
562{
563 int ret;
564 enum filter_type type;
565 struct filter *mfilter;
566 struct filter_cisco *filter;
567 struct access_list *access;
568 struct in_addr addr;
569 struct in_addr addr_mask;
570 struct in_addr mask;
571 struct in_addr mask_mask;
572
573 /* Check of filter type. */
574 if (strncmp(type_str, "p", 1) == 0)
575 type = FILTER_PERMIT;
576 else if (strncmp(type_str, "d", 1) == 0)
577 type = FILTER_DENY;
578 else {
579 vty_out(vty, "%% filter type must be permit or deny\n");
580 return CMD_WARNING_CONFIG_FAILED;
581 }
582
583 ret = inet_aton(addr_str, &addr);
584 if (ret <= 0) {
585 vty_out(vty, "%%Inconsistent address and mask\n");
586 return CMD_WARNING_CONFIG_FAILED;
587 }
588
589 ret = inet_aton(addr_mask_str, &addr_mask);
590 if (ret <= 0) {
591 vty_out(vty, "%%Inconsistent address and mask\n");
592 return CMD_WARNING_CONFIG_FAILED;
593 }
594
595 if (extended) {
596 ret = inet_aton(mask_str, &mask);
597 if (ret <= 0) {
598 vty_out(vty, "%%Inconsistent address and mask\n");
599 return CMD_WARNING_CONFIG_FAILED;
600 }
601
602 ret = inet_aton(mask_mask_str, &mask_mask);
603 if (ret <= 0) {
604 vty_out(vty, "%%Inconsistent address and mask\n");
605 return CMD_WARNING_CONFIG_FAILED;
606 }
607 }
608
609 mfilter = filter_new();
610 mfilter->type = type;
611 mfilter->cisco = 1;
612 filter = &mfilter->u.cfilter;
613 filter->extended = extended;
614 filter->addr.s_addr = addr.s_addr & ~addr_mask.s_addr;
615 filter->addr_mask.s_addr = addr_mask.s_addr;
616
617 if (extended) {
618 filter->mask.s_addr = mask.s_addr & ~mask_mask.s_addr;
619 filter->mask_mask.s_addr = mask_mask.s_addr;
718e3744 620 }
621
d62a17ae 622 /* Install new filter to the access_list. */
623 access = access_list_get(AFI_IP, name_str);
624
625 if (set) {
626 if (filter_lookup_cisco(access, mfilter))
627 filter_free(mfilter);
628 else
629 access_list_filter_add(access, mfilter);
630 } else {
631 struct filter *delete_filter;
632
633 delete_filter = filter_lookup_cisco(access, mfilter);
634 if (delete_filter)
635 access_list_filter_delete(access, delete_filter);
636
637 filter_free(mfilter);
718e3744 638 }
d62a17ae 639
640 return CMD_SUCCESS;
718e3744 641}
642
643/* Standard access-list */
644DEFUN (access_list_standard,
645 access_list_standard_cmd,
6147e2c6 646 "access-list <(1-99)|(1300-1999)> <deny|permit> A.B.C.D A.B.C.D",
718e3744 647 "Add an access list entry\n"
648 "IP standard access list\n"
649 "IP standard access list (expanded range)\n"
650 "Specify packets to reject\n"
651 "Specify packets to forward\n"
652 "Address to match\n"
653 "Wildcard bits\n")
654{
d62a17ae 655 int idx_acl = 1;
656 int idx_permit_deny = 2;
657 int idx_ipv4 = 3;
658 int idx_ipv4_2 = 4;
659 return filter_set_cisco(vty, argv[idx_acl]->arg,
660 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
661 argv[idx_ipv4_2]->arg, NULL, NULL, 0, 1);
718e3744 662}
663
664DEFUN (access_list_standard_nomask,
665 access_list_standard_nomask_cmd,
6147e2c6 666 "access-list <(1-99)|(1300-1999)> <deny|permit> A.B.C.D",
718e3744 667 "Add an access list entry\n"
668 "IP standard access list\n"
669 "IP standard access list (expanded range)\n"
670 "Specify packets to reject\n"
671 "Specify packets to forward\n"
672 "Address to match\n")
673{
d62a17ae 674 int idx_acl = 1;
675 int idx_permit_deny = 2;
676 int idx_ipv4 = 3;
677 return filter_set_cisco(vty, argv[idx_acl]->arg,
678 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
679 "0.0.0.0", NULL, NULL, 0, 1);
718e3744 680}
681
682DEFUN (access_list_standard_host,
683 access_list_standard_host_cmd,
6147e2c6 684 "access-list <(1-99)|(1300-1999)> <deny|permit> host A.B.C.D",
718e3744 685 "Add an access list entry\n"
686 "IP standard access list\n"
687 "IP standard access list (expanded range)\n"
688 "Specify packets to reject\n"
689 "Specify packets to forward\n"
690 "A single host address\n"
691 "Address to match\n")
692{
d62a17ae 693 int idx_acl = 1;
694 int idx_permit_deny = 2;
695 int idx_ipv4 = 4;
696 return filter_set_cisco(vty, argv[idx_acl]->arg,
697 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
698 "0.0.0.0", NULL, NULL, 0, 1);
718e3744 699}
700
701DEFUN (access_list_standard_any,
702 access_list_standard_any_cmd,
6147e2c6 703 "access-list <(1-99)|(1300-1999)> <deny|permit> any",
718e3744 704 "Add an access list entry\n"
705 "IP standard access list\n"
706 "IP standard access list (expanded range)\n"
707 "Specify packets to reject\n"
708 "Specify packets to forward\n"
709 "Any source host\n")
710{
d62a17ae 711 int idx_acl = 1;
712 int idx_permit_deny = 2;
713 return filter_set_cisco(vty, argv[idx_acl]->arg,
714 argv[idx_permit_deny]->arg, "0.0.0.0",
715 "255.255.255.255", NULL, NULL, 0, 1);
718e3744 716}
717
718DEFUN (no_access_list_standard,
719 no_access_list_standard_cmd,
6147e2c6 720 "no access-list <(1-99)|(1300-1999)> <deny|permit> A.B.C.D A.B.C.D",
718e3744 721 NO_STR
722 "Add an access list entry\n"
723 "IP standard access list\n"
724 "IP standard access list (expanded range)\n"
725 "Specify packets to reject\n"
726 "Specify packets to forward\n"
727 "Address to match\n"
728 "Wildcard bits\n")
729{
d62a17ae 730 int idx_acl = 2;
731 int idx_permit_deny = 3;
732 int idx_ipv4 = 4;
733 int idx_ipv4_2 = 5;
734 return filter_set_cisco(vty, argv[idx_acl]->arg,
735 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
736 argv[idx_ipv4_2]->arg, NULL, NULL, 0, 0);
718e3744 737}
738
739DEFUN (no_access_list_standard_nomask,
740 no_access_list_standard_nomask_cmd,
6147e2c6 741 "no access-list <(1-99)|(1300-1999)> <deny|permit> A.B.C.D",
718e3744 742 NO_STR
743 "Add an access list entry\n"
744 "IP standard access list\n"
745 "IP standard access list (expanded range)\n"
746 "Specify packets to reject\n"
747 "Specify packets to forward\n"
748 "Address to match\n")
749{
d62a17ae 750 int idx_acl = 2;
751 int idx_permit_deny = 3;
752 int idx_ipv4 = 4;
753 return filter_set_cisco(vty, argv[idx_acl]->arg,
754 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
755 "0.0.0.0", NULL, NULL, 0, 0);
718e3744 756}
757
758DEFUN (no_access_list_standard_host,
759 no_access_list_standard_host_cmd,
6147e2c6 760 "no access-list <(1-99)|(1300-1999)> <deny|permit> host A.B.C.D",
718e3744 761 NO_STR
762 "Add an access list entry\n"
763 "IP standard access list\n"
764 "IP standard access list (expanded range)\n"
765 "Specify packets to reject\n"
766 "Specify packets to forward\n"
767 "A single host address\n"
768 "Address to match\n")
769{
d62a17ae 770 int idx_acl = 2;
771 int idx_permit_deny = 3;
772 int idx_ipv4 = 5;
773 return filter_set_cisco(vty, argv[idx_acl]->arg,
774 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
775 "0.0.0.0", NULL, NULL, 0, 0);
718e3744 776}
777
778DEFUN (no_access_list_standard_any,
779 no_access_list_standard_any_cmd,
6147e2c6 780 "no access-list <(1-99)|(1300-1999)> <deny|permit> any",
718e3744 781 NO_STR
782 "Add an access list entry\n"
783 "IP standard access list\n"
784 "IP standard access list (expanded range)\n"
785 "Specify packets to reject\n"
786 "Specify packets to forward\n"
787 "Any source host\n")
788{
d62a17ae 789 int idx_acl = 2;
790 int idx_permit_deny = 3;
791 return filter_set_cisco(vty, argv[idx_acl]->arg,
792 argv[idx_permit_deny]->arg, "0.0.0.0",
793 "255.255.255.255", NULL, NULL, 0, 0);
718e3744 794}
795
796/* Extended access-list */
797DEFUN (access_list_extended,
798 access_list_extended_cmd,
6147e2c6 799 "access-list <(100-199)|(2000-2699)> <deny|permit> ip A.B.C.D A.B.C.D A.B.C.D A.B.C.D",
718e3744 800 "Add an access list entry\n"
801 "IP extended access list\n"
802 "IP extended access list (expanded range)\n"
803 "Specify packets to reject\n"
804 "Specify packets to forward\n"
805 "Any Internet Protocol\n"
806 "Source address\n"
807 "Source wildcard bits\n"
808 "Destination address\n"
809 "Destination Wildcard bits\n")
810{
d62a17ae 811 int idx_acl = 1;
812 int idx_permit_deny = 2;
813 int idx_ipv4 = 4;
814 int idx_ipv4_2 = 5;
815 int idx_ipv4_3 = 6;
816 int idx_ipv4_4 = 7;
817 return filter_set_cisco(vty, argv[idx_acl]->arg,
818 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
819 argv[idx_ipv4_2]->arg, argv[idx_ipv4_3]->arg,
820 argv[idx_ipv4_4]->arg, 1, 1);
718e3744 821}
822
823DEFUN (access_list_extended_mask_any,
824 access_list_extended_mask_any_cmd,
6147e2c6 825 "access-list <(100-199)|(2000-2699)> <deny|permit> ip A.B.C.D A.B.C.D any",
718e3744 826 "Add an access list entry\n"
827 "IP extended access list\n"
828 "IP extended access list (expanded range)\n"
829 "Specify packets to reject\n"
830 "Specify packets to forward\n"
831 "Any Internet Protocol\n"
832 "Source address\n"
833 "Source wildcard bits\n"
834 "Any destination host\n")
835{
d62a17ae 836 int idx_acl = 1;
837 int idx_permit_deny = 2;
838 int idx_ipv4 = 4;
839 int idx_ipv4_2 = 5;
840 return filter_set_cisco(vty, argv[idx_acl]->arg,
841 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
842 argv[idx_ipv4_2]->arg, "0.0.0.0",
843 "255.255.255.255", 1, 1);
718e3744 844}
845
846DEFUN (access_list_extended_any_mask,
847 access_list_extended_any_mask_cmd,
6147e2c6 848 "access-list <(100-199)|(2000-2699)> <deny|permit> ip any A.B.C.D A.B.C.D",
718e3744 849 "Add an access list entry\n"
850 "IP extended access list\n"
851 "IP extended access list (expanded range)\n"
852 "Specify packets to reject\n"
853 "Specify packets to forward\n"
854 "Any Internet Protocol\n"
855 "Any source host\n"
856 "Destination address\n"
857 "Destination Wildcard bits\n")
858{
d62a17ae 859 int idx_acl = 1;
860 int idx_permit_deny = 2;
861 int idx_ipv4 = 5;
862 int idx_ipv4_2 = 6;
863 return filter_set_cisco(vty, argv[idx_acl]->arg,
864 argv[idx_permit_deny]->arg, "0.0.0.0",
865 "255.255.255.255", argv[idx_ipv4]->arg,
866 argv[idx_ipv4_2]->arg, 1, 1);
718e3744 867}
868
869DEFUN (access_list_extended_any_any,
870 access_list_extended_any_any_cmd,
6147e2c6 871 "access-list <(100-199)|(2000-2699)> <deny|permit> ip any any",
718e3744 872 "Add an access list entry\n"
873 "IP extended access list\n"
874 "IP extended access list (expanded range)\n"
875 "Specify packets to reject\n"
876 "Specify packets to forward\n"
877 "Any Internet Protocol\n"
878 "Any source host\n"
879 "Any destination host\n")
880{
d62a17ae 881 int idx_acl = 1;
882 int idx_permit_deny = 2;
883 return filter_set_cisco(
884 vty, argv[idx_acl]->arg, argv[idx_permit_deny]->arg, "0.0.0.0",
885 "255.255.255.255", "0.0.0.0", "255.255.255.255", 1, 1);
718e3744 886}
887
888DEFUN (access_list_extended_mask_host,
889 access_list_extended_mask_host_cmd,
6147e2c6 890 "access-list <(100-199)|(2000-2699)> <deny|permit> ip A.B.C.D A.B.C.D host A.B.C.D",
718e3744 891 "Add an access list entry\n"
892 "IP extended access list\n"
893 "IP extended access list (expanded range)\n"
894 "Specify packets to reject\n"
895 "Specify packets to forward\n"
896 "Any Internet Protocol\n"
897 "Source address\n"
898 "Source wildcard bits\n"
899 "A single destination host\n"
900 "Destination address\n")
901{
d62a17ae 902 int idx_acl = 1;
903 int idx_permit_deny = 2;
904 int idx_ipv4 = 4;
905 int idx_ipv4_2 = 5;
906 int idx_ipv4_3 = 7;
907 return filter_set_cisco(vty, argv[idx_acl]->arg,
908 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
909 argv[idx_ipv4_2]->arg, argv[idx_ipv4_3]->arg,
910 "0.0.0.0", 1, 1);
718e3744 911}
912
913DEFUN (access_list_extended_host_mask,
914 access_list_extended_host_mask_cmd,
6147e2c6 915 "access-list <(100-199)|(2000-2699)> <deny|permit> ip host A.B.C.D A.B.C.D A.B.C.D",
718e3744 916 "Add an access list entry\n"
917 "IP extended access list\n"
918 "IP extended access list (expanded range)\n"
919 "Specify packets to reject\n"
920 "Specify packets to forward\n"
921 "Any Internet Protocol\n"
922 "A single source host\n"
923 "Source address\n"
924 "Destination address\n"
925 "Destination Wildcard bits\n")
926{
d62a17ae 927 int idx_acl = 1;
928 int idx_permit_deny = 2;
929 int idx_ipv4 = 5;
930 int idx_ipv4_2 = 6;
931 int idx_ipv4_3 = 7;
932 return filter_set_cisco(vty, argv[idx_acl]->arg,
933 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
934 "0.0.0.0", argv[idx_ipv4_2]->arg,
935 argv[idx_ipv4_3]->arg, 1, 1);
718e3744 936}
937
938DEFUN (access_list_extended_host_host,
939 access_list_extended_host_host_cmd,
6147e2c6 940 "access-list <(100-199)|(2000-2699)> <deny|permit> ip host A.B.C.D host A.B.C.D",
718e3744 941 "Add an access list entry\n"
942 "IP extended access list\n"
943 "IP extended access list (expanded range)\n"
944 "Specify packets to reject\n"
945 "Specify packets to forward\n"
946 "Any Internet Protocol\n"
947 "A single source host\n"
948 "Source address\n"
949 "A single destination host\n"
950 "Destination address\n")
951{
d62a17ae 952 int idx_acl = 1;
953 int idx_permit_deny = 2;
954 int idx_ipv4 = 5;
955 int idx_ipv4_2 = 7;
956 return filter_set_cisco(vty, argv[idx_acl]->arg,
957 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
958 "0.0.0.0", argv[idx_ipv4_2]->arg, "0.0.0.0", 1,
959 1);
718e3744 960}
961
962DEFUN (access_list_extended_any_host,
963 access_list_extended_any_host_cmd,
6147e2c6 964 "access-list <(100-199)|(2000-2699)> <deny|permit> ip any host A.B.C.D",
718e3744 965 "Add an access list entry\n"
966 "IP extended access list\n"
967 "IP extended access list (expanded range)\n"
968 "Specify packets to reject\n"
969 "Specify packets to forward\n"
970 "Any Internet Protocol\n"
971 "Any source host\n"
972 "A single destination host\n"
973 "Destination address\n")
974{
d62a17ae 975 int idx_acl = 1;
976 int idx_permit_deny = 2;
977 int idx_ipv4 = 6;
978 return filter_set_cisco(
979 vty, argv[idx_acl]->arg, argv[idx_permit_deny]->arg, "0.0.0.0",
980 "255.255.255.255", argv[idx_ipv4]->arg, "0.0.0.0", 1, 1);
718e3744 981}
982
983DEFUN (access_list_extended_host_any,
984 access_list_extended_host_any_cmd,
6147e2c6 985 "access-list <(100-199)|(2000-2699)> <deny|permit> ip host A.B.C.D any",
718e3744 986 "Add an access list entry\n"
987 "IP extended access list\n"
988 "IP extended access list (expanded range)\n"
989 "Specify packets to reject\n"
990 "Specify packets to forward\n"
991 "Any Internet Protocol\n"
992 "A single source host\n"
993 "Source address\n"
994 "Any destination host\n")
995{
d62a17ae 996 int idx_acl = 1;
997 int idx_permit_deny = 2;
998 int idx_ipv4 = 5;
999 return filter_set_cisco(vty, argv[idx_acl]->arg,
1000 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
1001 "0.0.0.0", "0.0.0.0", "255.255.255.255", 1, 1);
718e3744 1002}
1003
1004DEFUN (no_access_list_extended,
1005 no_access_list_extended_cmd,
6147e2c6 1006 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip A.B.C.D A.B.C.D A.B.C.D A.B.C.D",
718e3744 1007 NO_STR
1008 "Add an access list entry\n"
1009 "IP extended access list\n"
1010 "IP extended access list (expanded range)\n"
1011 "Specify packets to reject\n"
1012 "Specify packets to forward\n"
1013 "Any Internet Protocol\n"
1014 "Source address\n"
1015 "Source wildcard bits\n"
1016 "Destination address\n"
1017 "Destination Wildcard bits\n")
1018{
d62a17ae 1019 int idx_acl = 2;
1020 int idx_permit_deny = 3;
1021 int idx_ipv4 = 5;
1022 int idx_ipv4_2 = 6;
1023 int idx_ipv4_3 = 7;
1024 int idx_ipv4_4 = 8;
1025 return filter_set_cisco(vty, argv[idx_acl]->arg,
1026 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
1027 argv[idx_ipv4_2]->arg, argv[idx_ipv4_3]->arg,
1028 argv[idx_ipv4_4]->arg, 1, 0);
718e3744 1029}
1030
1031DEFUN (no_access_list_extended_mask_any,
1032 no_access_list_extended_mask_any_cmd,
6147e2c6 1033 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip A.B.C.D A.B.C.D any",
718e3744 1034 NO_STR
1035 "Add an access list entry\n"
1036 "IP extended access list\n"
1037 "IP extended access list (expanded range)\n"
1038 "Specify packets to reject\n"
1039 "Specify packets to forward\n"
1040 "Any Internet Protocol\n"
1041 "Source address\n"
1042 "Source wildcard bits\n"
1043 "Any destination host\n")
1044{
d62a17ae 1045 int idx_acl = 2;
1046 int idx_permit_deny = 3;
1047 int idx_ipv4 = 5;
1048 int idx_ipv4_2 = 6;
1049 return filter_set_cisco(vty, argv[idx_acl]->arg,
1050 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
1051 argv[idx_ipv4_2]->arg, "0.0.0.0",
1052 "255.255.255.255", 1, 0);
718e3744 1053}
1054
1055DEFUN (no_access_list_extended_any_mask,
1056 no_access_list_extended_any_mask_cmd,
6147e2c6 1057 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip any A.B.C.D A.B.C.D",
718e3744 1058 NO_STR
1059 "Add an access list entry\n"
1060 "IP extended access list\n"
1061 "IP extended access list (expanded range)\n"
1062 "Specify packets to reject\n"
1063 "Specify packets to forward\n"
1064 "Any Internet Protocol\n"
1065 "Any source host\n"
1066 "Destination address\n"
1067 "Destination Wildcard bits\n")
1068{
d62a17ae 1069 int idx_acl = 2;
1070 int idx_permit_deny = 3;
1071 int idx_ipv4 = 6;
1072 int idx_ipv4_2 = 7;
1073 return filter_set_cisco(vty, argv[idx_acl]->arg,
1074 argv[idx_permit_deny]->arg, "0.0.0.0",
1075 "255.255.255.255", argv[idx_ipv4]->arg,
1076 argv[idx_ipv4_2]->arg, 1, 0);
718e3744 1077}
1078
1079DEFUN (no_access_list_extended_any_any,
1080 no_access_list_extended_any_any_cmd,
6147e2c6 1081 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip any any",
718e3744 1082 NO_STR
1083 "Add an access list entry\n"
1084 "IP extended access list\n"
1085 "IP extended access list (expanded range)\n"
1086 "Specify packets to reject\n"
1087 "Specify packets to forward\n"
1088 "Any Internet Protocol\n"
1089 "Any source host\n"
1090 "Any destination host\n")
1091{
d62a17ae 1092 int idx_acl = 2;
1093 int idx_permit_deny = 3;
1094 return filter_set_cisco(
1095 vty, argv[idx_acl]->arg, argv[idx_permit_deny]->arg, "0.0.0.0",
1096 "255.255.255.255", "0.0.0.0", "255.255.255.255", 1, 0);
718e3744 1097}
1098
1099DEFUN (no_access_list_extended_mask_host,
1100 no_access_list_extended_mask_host_cmd,
6147e2c6 1101 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip A.B.C.D A.B.C.D host A.B.C.D",
718e3744 1102 NO_STR
1103 "Add an access list entry\n"
1104 "IP extended access list\n"
1105 "IP extended access list (expanded range)\n"
1106 "Specify packets to reject\n"
1107 "Specify packets to forward\n"
1108 "Any Internet Protocol\n"
1109 "Source address\n"
1110 "Source wildcard bits\n"
1111 "A single destination host\n"
1112 "Destination address\n")
1113{
d62a17ae 1114 int idx_acl = 2;
1115 int idx_permit_deny = 3;
1116 int idx_ipv4 = 5;
1117 int idx_ipv4_2 = 6;
1118 int idx_ipv4_3 = 8;
1119 return filter_set_cisco(vty, argv[idx_acl]->arg,
1120 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
1121 argv[idx_ipv4_2]->arg, argv[idx_ipv4_3]->arg,
1122 "0.0.0.0", 1, 0);
718e3744 1123}
1124
1125DEFUN (no_access_list_extended_host_mask,
1126 no_access_list_extended_host_mask_cmd,
6147e2c6 1127 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip host A.B.C.D A.B.C.D A.B.C.D",
718e3744 1128 NO_STR
1129 "Add an access list entry\n"
1130 "IP extended access list\n"
1131 "IP extended access list (expanded range)\n"
1132 "Specify packets to reject\n"
1133 "Specify packets to forward\n"
1134 "Any Internet Protocol\n"
1135 "A single source host\n"
1136 "Source address\n"
1137 "Destination address\n"
1138 "Destination Wildcard bits\n")
1139{
d62a17ae 1140 int idx_acl = 2;
1141 int idx_permit_deny = 3;
1142 int idx_ipv4 = 6;
1143 int idx_ipv4_2 = 7;
1144 int idx_ipv4_3 = 8;
1145 return filter_set_cisco(vty, argv[idx_acl]->arg,
1146 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
1147 "0.0.0.0", argv[idx_ipv4_2]->arg,
1148 argv[idx_ipv4_3]->arg, 1, 0);
718e3744 1149}
1150
1151DEFUN (no_access_list_extended_host_host,
1152 no_access_list_extended_host_host_cmd,
6147e2c6 1153 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip host A.B.C.D host A.B.C.D",
718e3744 1154 NO_STR
1155 "Add an access list entry\n"
1156 "IP extended access list\n"
1157 "IP extended access list (expanded range)\n"
1158 "Specify packets to reject\n"
1159 "Specify packets to forward\n"
1160 "Any Internet Protocol\n"
1161 "A single source host\n"
1162 "Source address\n"
1163 "A single destination host\n"
1164 "Destination address\n")
1165{
d62a17ae 1166 int idx_acl = 2;
1167 int idx_permit_deny = 3;
1168 int idx_ipv4 = 6;
1169 int idx_ipv4_2 = 8;
1170 return filter_set_cisco(vty, argv[idx_acl]->arg,
1171 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
1172 "0.0.0.0", argv[idx_ipv4_2]->arg, "0.0.0.0", 1,
1173 0);
718e3744 1174}
1175
1176DEFUN (no_access_list_extended_any_host,
1177 no_access_list_extended_any_host_cmd,
6147e2c6 1178 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip any host A.B.C.D",
718e3744 1179 NO_STR
1180 "Add an access list entry\n"
1181 "IP extended access list\n"
1182 "IP extended access list (expanded range)\n"
1183 "Specify packets to reject\n"
1184 "Specify packets to forward\n"
1185 "Any Internet Protocol\n"
1186 "Any source host\n"
1187 "A single destination host\n"
1188 "Destination address\n")
1189{
d62a17ae 1190 int idx_acl = 2;
1191 int idx_permit_deny = 3;
1192 int idx_ipv4 = 7;
1193 return filter_set_cisco(
1194 vty, argv[idx_acl]->arg, argv[idx_permit_deny]->arg, "0.0.0.0",
1195 "255.255.255.255", argv[idx_ipv4]->arg, "0.0.0.0", 1, 0);
718e3744 1196}
1197
1198DEFUN (no_access_list_extended_host_any,
1199 no_access_list_extended_host_any_cmd,
6147e2c6 1200 "no access-list <(100-199)|(2000-2699)> <deny|permit> ip host A.B.C.D any",
718e3744 1201 NO_STR
1202 "Add an access list entry\n"
1203 "IP extended access list\n"
1204 "IP extended access list (expanded range)\n"
1205 "Specify packets to reject\n"
1206 "Specify packets to forward\n"
1207 "Any Internet Protocol\n"
1208 "A single source host\n"
1209 "Source address\n"
1210 "Any destination host\n")
1211{
d62a17ae 1212 int idx_acl = 2;
1213 int idx_permit_deny = 3;
1214 int idx_ipv4 = 6;
1215 return filter_set_cisco(vty, argv[idx_acl]->arg,
1216 argv[idx_permit_deny]->arg, argv[idx_ipv4]->arg,
1217 "0.0.0.0", "0.0.0.0", "255.255.255.255", 1, 0);
1218}
1219
1220static int filter_set_zebra(struct vty *vty, const char *name_str,
1221 const char *type_str, afi_t afi,
1222 const char *prefix_str, int exact, int set)
1223{
1224 int ret;
1225 enum filter_type type;
1226 struct filter *mfilter;
1227 struct filter_zebra *filter;
1228 struct access_list *access;
1229 struct prefix p;
1230
1231 if (strlen(name_str) > ACL_NAMSIZ) {
1232 vty_out(vty,
1233 "%% ACL name %s is invalid: length exceeds "
1234 "%d characters\n",
1235 name_str, ACL_NAMSIZ);
1236 return CMD_WARNING_CONFIG_FAILED;
718e3744 1237 }
718e3744 1238
d62a17ae 1239 /* Check of filter type. */
1240 if (strncmp(type_str, "p", 1) == 0)
1241 type = FILTER_PERMIT;
1242 else if (strncmp(type_str, "d", 1) == 0)
1243 type = FILTER_DENY;
1244 else {
1245 vty_out(vty, "filter type must be [permit|deny]\n");
1246 return CMD_WARNING_CONFIG_FAILED;
1247 }
718e3744 1248
d62a17ae 1249 /* Check string format of prefix and prefixlen. */
1250 if (afi == AFI_IP) {
1251 ret = str2prefix_ipv4(prefix_str, (struct prefix_ipv4 *)&p);
1252 if (ret <= 0) {
1253 vty_out(vty,
1254 "IP address prefix/prefixlen is malformed\n");
1255 return CMD_WARNING_CONFIG_FAILED;
1256 }
1257 } else if (afi == AFI_IP6) {
1258 ret = str2prefix_ipv6(prefix_str, (struct prefix_ipv6 *)&p);
1259 if (ret <= 0) {
1260 vty_out(vty,
1261 "IPv6 address prefix/prefixlen is malformed\n");
1262 return CMD_WARNING_CONFIG_FAILED;
1263 }
d37ba549
MK		 1264 } else if (afi == AFI_L2VPN) {
1265 ret = str2prefix_eth(prefix_str, (struct prefix_eth *)&p);
1266 if (ret <= 0) {
1267 vty_out(vty, "MAC address is malformed\n");
1268 return CMD_WARNING;
1269 }
d62a17ae 1270 } else
1271 return CMD_WARNING_CONFIG_FAILED;
1272
1273 mfilter = filter_new();
1274 mfilter->type = type;
1275 filter = &mfilter->u.zfilter;
1276 prefix_copy(&filter->prefix, &p);
1277
1278 /* "exact-match" */
1279 if (exact)
1280 filter->exact = 1;
1281
1282 /* Install new filter to the access_list. */
1283 access = access_list_get(afi, name_str);
1284
1285 if (set) {
1286 if (filter_lookup_zebra(access, mfilter))
1287 filter_free(mfilter);
1288 else
1289 access_list_filter_add(access, mfilter);
1290 } else {
1291 struct filter *delete_filter;
d62a17ae 1292 delete_filter = filter_lookup_zebra(access, mfilter);
1293 if (delete_filter)
1294 access_list_filter_delete(access, delete_filter);
1295
1296 filter_free(mfilter);
1297 }
718e3744 1298
d62a17ae 1299 return CMD_SUCCESS;
718e3744 1300}
1301
d37ba549
MK		 1302DEFUN (mac_access_list,
1303 mac_access_list_cmd,
1304 "mac access-list WORD <deny|permit> MAC",
1305 "Add a mac access-list\n"
1306 "Add an access list entry\n"
1307 "MAC zebra access-list name\n"
1308 "Specify packets to reject\n"
1309 "Specify packets to forward\n"
1310 "MAC address to match. e.g. 00:01:00:01:00:01\n")
1311{
1312 return filter_set_zebra(vty, argv[2]->arg, argv[3]->arg, AFI_L2VPN,
1313 argv[4]->arg, 0, 1);
1314}
1315
1316DEFUN (no_mac_access_list,
1317 no_mac_access_list_cmd,
1318 "no mac access-list WORD <deny|permit> MAC",
1319 NO_STR
1320 "Remove a mac access-list\n"
1321 "Remove an access list entry\n"
1322 "MAC zebra access-list name\n"
1323 "Specify packets to reject\n"
1324 "Specify packets to forward\n"
1325 "MAC address to match. e.g. 00:01:00:01:00:01\n")
1326{
1327 return filter_set_zebra(vty, argv[3]->arg, argv[4]->arg, AFI_L2VPN,
1328 argv[5]->arg, 0, 0);
1329}
1330
1331DEFUN (mac_access_list_any,
1332 mac_access_list_any_cmd,
1333 "mac access-list WORD <deny|permit> any",
1334 "Add a mac access-list\n"
1335 "Add an access list entry\n"
1336 "MAC zebra access-list name\n"
1337 "Specify packets to reject\n"
1338 "Specify packets to forward\n"
1339 "MAC address to match. e.g. 00:01:00:01:00:01\n")
1340{
1341 return filter_set_zebra(vty, argv[2]->arg, argv[3]->arg, AFI_L2VPN,
1342 "00:00:00:00:00:00", 0, 1);
1343}
1344
1345DEFUN (no_mac_access_list_any,
1346 no_mac_access_list_any_cmd,
1347 "no mac access-list WORD <deny|permit> any",
1348 NO_STR
1349 "Remove a mac access-list\n"
1350 "Remove an access list entry\n"
1351 "MAC zebra access-list name\n"
1352 "Specify packets to reject\n"
1353 "Specify packets to forward\n"
1354 "MAC address to match. e.g. 00:01:00:01:00:01\n")
1355{
69b61704 1356 return filter_set_zebra(vty, argv[3]->arg, argv[4]->arg, AFI_L2VPN,
d37ba549
MK		 1357 "00:00:00:00:00:00", 0, 0);
1358}
1359
718e3744 1360DEFUN (access_list_exact,
1361 access_list_exact_cmd,
a1198921 1362 "access-list WORD <deny|permit> A.B.C.D/M [exact-match]",
718e3744 1363 "Add an access list entry\n"
1364 "IP zebra access-list name\n"
1365 "Specify packets to reject\n"
1366 "Specify packets to forward\n"
1367 "Prefix to match. e.g. 10.0.0.0/8\n"
1368 "Exact match of the prefixes\n")
1369{
8367c327 1370 int idx = 0;
d62a17ae 1371 int exact = 0;
1372 int idx_word = 1;
1373 int idx_permit_deny = 2;
1374 int idx_ipv4_prefixlen = 3;
1375 idx = idx_ipv4_prefixlen;
a1198921 1376
d62a17ae 1377 if (argv_find(argv, argc, "exact-match", &idx))
1378 exact = 1;
a1198921 1379
d62a17ae 1380 return filter_set_zebra(vty, argv[idx_word]->arg,
1381 argv[idx_permit_deny]->arg, AFI_IP,
1382 argv[idx_ipv4_prefixlen]->arg, exact, 1);
718e3744 1383}
1384
1385DEFUN (access_list_any,
1386 access_list_any_cmd,
6147e2c6 1387 "access-list WORD <deny|permit> any",
718e3744 1388 "Add an access list entry\n"
1389 "IP zebra access-list name\n"
1390 "Specify packets to reject\n"
1391 "Specify packets to forward\n"
1392 "Prefix to match. e.g. 10.0.0.0/8\n")
1393{
d62a17ae 1394 int idx_word = 1;
1395 int idx_permit_deny = 2;
1396 return filter_set_zebra(vty, argv[idx_word]->arg,
1397 argv[idx_permit_deny]->arg, AFI_IP, "0.0.0.0/0",
1398 0, 1);
718e3744 1399}
1400
718e3744 1401DEFUN (no_access_list_exact,
1402 no_access_list_exact_cmd,
a1198921 1403 "no access-list WORD <deny|permit> A.B.C.D/M [exact-match]",
718e3744 1404 NO_STR
1405 "Add an access list entry\n"
1406 "IP zebra access-list name\n"
1407 "Specify packets to reject\n"
1408 "Specify packets to forward\n"
1409 "Prefix to match. e.g. 10.0.0.0/8\n"
1410 "Exact match of the prefixes\n")
1411{
8367c327 1412 int idx = 0;
d62a17ae 1413 int exact = 0;
1414 int idx_word = 2;
1415 int idx_permit_deny = 3;
1416 int idx_ipv4_prefixlen = 4;
1417 idx = idx_ipv4_prefixlen;
a1198921 1418
d62a17ae 1419 if (argv_find(argv, argc, "exact-match", &idx))
1420 exact = 1;
a1198921 1421
d62a17ae 1422 return filter_set_zebra(vty, argv[idx_word]->arg,
1423 argv[idx_permit_deny]->arg, AFI_IP,
1424 argv[idx_ipv4_prefixlen]->arg, exact, 0);
718e3744 1425}
1426
1427DEFUN (no_access_list_any,
1428 no_access_list_any_cmd,
6147e2c6 1429 "no access-list WORD <deny|permit> any",
718e3744 1430 NO_STR
1431 "Add an access list entry\n"
1432 "IP zebra access-list name\n"
1433 "Specify packets to reject\n"
1434 "Specify packets to forward\n"
1435 "Prefix to match. e.g. 10.0.0.0/8\n")
1436{
d62a17ae 1437 int idx_word = 2;
1438 int idx_permit_deny = 3;
1439 return filter_set_zebra(vty, argv[idx_word]->arg,
1440 argv[idx_permit_deny]->arg, AFI_IP, "0.0.0.0/0",
1441 0, 0);
718e3744 1442}
1443
1444DEFUN (no_access_list_all,
1445 no_access_list_all_cmd,
6147e2c6 1446 "no access-list <(1-99)|(100-199)|(1300-1999)|(2000-2699)|WORD>",
718e3744 1447 NO_STR
1448 "Add an access list entry\n"
1449 "IP standard access list\n"
1450 "IP extended access list\n"
1451 "IP standard access list (expanded range)\n"
1452 "IP extended access list (expanded range)\n"
1453 "IP zebra access-list name\n")
1454{
d62a17ae 1455 int idx_acl = 2;
1456 struct access_list *access;
1457 struct access_master *master;
718e3744 1458
d62a17ae 1459 /* Looking up access_list. */
1460 access = access_list_lookup(AFI_IP, argv[idx_acl]->arg);
1461 if (access == NULL) {
1462 vty_out(vty, "%% access-list %s doesn't exist\n",
1463 argv[idx_acl]->arg);
1464 return CMD_WARNING_CONFIG_FAILED;
1465 }
1466
1467 master = access->master;
718e3744 1468
d62a17ae 1469 route_map_notify_dependencies(access->name, RMAP_EVENT_FILTER_DELETED);
1470 /* Run hook function. */
1471 if (master->delete_hook)
1472 (*master->delete_hook)(access);
718e3744 1473
d62a17ae 1474 /* Delete all filter from access-list. */
1475 access_list_delete(access);
6a2e0f36 1476
d62a17ae 1477 return CMD_SUCCESS;
718e3744 1478}
1479
1480DEFUN (access_list_remark,
1481 access_list_remark_cmd,
e961923c 1482 "access-list <(1-99)|(100-199)|(1300-1999)|(2000-2699)|WORD> remark LINE...",
718e3744 1483 "Add an access list entry\n"
1484 "IP standard access list\n"
1485 "IP extended access list\n"
1486 "IP standard access list (expanded range)\n"
1487 "IP extended access list (expanded range)\n"
1488 "IP zebra access-list\n"
1489 "Access list entry comment\n"
1490 "Comment up to 100 characters\n")
1491{
d62a17ae 1492 int idx_acl = 1;
1493 int idx_remark = 3;
1494 struct access_list *access;
718e3744 1495
d62a17ae 1496 access = access_list_get(AFI_IP, argv[idx_acl]->arg);
718e3744 1497
d62a17ae 1498 if (access->remark) {
1499 XFREE(MTYPE_TMP, access->remark);
1500 access->remark = NULL;
1501 }
1502 access->remark = argv_concat(argv, argc, idx_remark);
718e3744 1503
d62a17ae 1504 return CMD_SUCCESS;
718e3744 1505}
1506
1507DEFUN (no_access_list_remark,
1508 no_access_list_remark_cmd,
6147e2c6 1509 "no access-list <(1-99)|(100-199)|(1300-1999)|(2000-2699)|WORD> remark",
718e3744 1510 NO_STR
1511 "Add an access list entry\n"
1512 "IP standard access list\n"
1513 "IP extended access list\n"
1514 "IP standard access list (expanded range)\n"
1515 "IP extended access list (expanded range)\n"
1516 "IP zebra access-list\n"
1517 "Access list entry comment\n")
1518{
d62a17ae 1519 int idx_acl = 2;
1520 return vty_access_list_remark_unset(vty, AFI_IP, argv[idx_acl]->arg);
718e3744 1521}
f667a580
QY		 1522
1523/* ALIAS_FIXME */
1524DEFUN (no_access_list_remark_comment,
1525 no_access_list_remark_comment_cmd,
1526 "no access-list <(1-99)|(100-199)|(1300-1999)|(2000-2699)|WORD> remark LINE...",
1527 NO_STR
1528 "Add an access list entry\n"
1529 "IP standard access list\n"
1530 "IP extended access list\n"
1531 "IP standard access list (expanded range)\n"
1532 "IP extended access list (expanded range)\n"
1533 "IP zebra access-list\n"
1534 "Access list entry comment\n"
1535 "Comment up to 100 characters\n")
1536{
d62a17ae 1537 return no_access_list_remark(self, vty, argc, argv);
f667a580 1538}
718e3744 1539
1540DEFUN (ipv6_access_list_exact,
1541 ipv6_access_list_exact_cmd,
a1198921 1542 "ipv6 access-list WORD <deny|permit> X:X::X:X/M [exact-match]",
718e3744 1543 IPV6_STR
1544 "Add an access list entry\n"
1545 "IPv6 zebra access-list\n"
1546 "Specify packets to reject\n"
1547 "Specify packets to forward\n"
5435e6e8 1548 "IPv6 prefix\n"
718e3744 1549 "Exact match of the prefixes\n")
1550{
8367c327 1551 int idx = 0;
d62a17ae 1552 int exact = 0;
1553 int idx_word = 2;
1554 int idx_allow = 3;
1555 int idx_addr = 4;
1556 idx = idx_addr;
a1198921 1557
d62a17ae 1558 if (argv_find(argv, argc, "exact-match", &idx))
1559 exact = 1;
a1198921 1560
d62a17ae 1561 return filter_set_zebra(vty, argv[idx_word]->arg, argv[idx_allow]->text,
1562 AFI_IP6, argv[idx_addr]->arg, exact, 1);
718e3744 1563}
1564
1565DEFUN (ipv6_access_list_any,
1566 ipv6_access_list_any_cmd,
6147e2c6 1567 "ipv6 access-list WORD <deny|permit> any",
718e3744 1568 IPV6_STR
1569 "Add an access list entry\n"
1570 "IPv6 zebra access-list\n"
1571 "Specify packets to reject\n"
1572 "Specify packets to forward\n"
1573 "Any prefixi to match\n")
1574{
d62a17ae 1575 int idx_word = 2;
1576 int idx_permit_deny = 3;
1577 return filter_set_zebra(vty, argv[idx_word]->arg,
1578 argv[idx_permit_deny]->arg, AFI_IP6, "::/0", 0,
1579 1);
718e3744 1580}
1581
718e3744 1582DEFUN (no_ipv6_access_list_exact,
1583 no_ipv6_access_list_exact_cmd,
a1198921 1584 "no ipv6 access-list WORD <deny|permit> X:X::X:X/M [exact-match]",
718e3744 1585 NO_STR
1586 IPV6_STR
1587 "Add an access list entry\n"
1588 "IPv6 zebra access-list\n"
1589 "Specify packets to reject\n"
1590 "Specify packets to forward\n"
1591 "Prefix to match. e.g. 3ffe:506::/32\n"
1592 "Exact match of the prefixes\n")
1593{
8367c327 1594 int idx = 0;
d62a17ae 1595 int exact = 0;
1596 int idx_word = 3;
1597 int idx_permit_deny = 4;
1598 int idx_ipv6_prefixlen = 5;
1599 idx = idx_ipv6_prefixlen;
a1198921 1600
d62a17ae 1601 if (argv_find(argv, argc, "exact-match", &idx))
1602 exact = 1;
a1198921 1603
d62a17ae 1604 return filter_set_zebra(vty, argv[idx_word]->arg,
1605 argv[idx_permit_deny]->arg, AFI_IP6,
1606 argv[idx_ipv6_prefixlen]->arg, exact, 0);
718e3744 1607}
1608
1609DEFUN (no_ipv6_access_list_any,
1610 no_ipv6_access_list_any_cmd,
6147e2c6 1611 "no ipv6 access-list WORD <deny|permit> any",
718e3744 1612 NO_STR
1613 IPV6_STR
1614 "Add an access list entry\n"
1615 "IPv6 zebra access-list\n"
1616 "Specify packets to reject\n"
1617 "Specify packets to forward\n"
1618 "Any prefixi to match\n")
1619{
d62a17ae 1620 int idx_word = 3;
1621 int idx_permit_deny = 4;
1622 return filter_set_zebra(vty, argv[idx_word]->arg,
1623 argv[idx_permit_deny]->arg, AFI_IP6, "::/0", 0,
1624 0);
718e3744 1625}
1626
1627
1628DEFUN (no_ipv6_access_list_all,
1629 no_ipv6_access_list_all_cmd,
1630 "no ipv6 access-list WORD",
1631 NO_STR
1632 IPV6_STR
1633 "Add an access list entry\n"
1634 "IPv6 zebra access-list\n")
1635{
d62a17ae 1636 int idx_word = 3;
1637 struct access_list *access;
1638 struct access_master *master;
718e3744 1639
d62a17ae 1640 /* Looking up access_list. */
1641 access = access_list_lookup(AFI_IP6, argv[idx_word]->arg);
1642 if (access == NULL) {
1643 vty_out(vty, "%% access-list %s doesn't exist\n",
1644 argv[idx_word]->arg);
1645 return CMD_WARNING_CONFIG_FAILED;
1646 }
718e3744 1647
d62a17ae 1648 master = access->master;
718e3744 1649
d62a17ae 1650 route_map_notify_dependencies(access->name, RMAP_EVENT_FILTER_DELETED);
1651 /* Run hook function. */
1652 if (master->delete_hook)
1653 (*master->delete_hook)(access);
718e3744 1654
d62a17ae 1655 /* Delete all filter from access-list. */
1656 access_list_delete(access);
6a2e0f36 1657
d62a17ae 1658 return CMD_SUCCESS;
718e3744 1659}
1660
1661DEFUN (ipv6_access_list_remark,
1662 ipv6_access_list_remark_cmd,
e961923c 1663 "ipv6 access-list WORD remark LINE...",
718e3744 1664 IPV6_STR
1665 "Add an access list entry\n"
1666 "IPv6 zebra access-list\n"
1667 "Access list entry comment\n"
1668 "Comment up to 100 characters\n")
1669{
d62a17ae 1670 int idx_word = 2;
1671 int idx_line = 4;
1672 struct access_list *access;
718e3744 1673
d62a17ae 1674 access = access_list_get(AFI_IP6, argv[idx_word]->arg);
718e3744 1675
d62a17ae 1676 if (access->remark) {
1677 XFREE(MTYPE_TMP, access->remark);
1678 access->remark = NULL;
1679 }
1680 access->remark = argv_concat(argv, argc, idx_line);
718e3744 1681
d62a17ae 1682 return CMD_SUCCESS;
718e3744 1683}
1684
1685DEFUN (no_ipv6_access_list_remark,
1686 no_ipv6_access_list_remark_cmd,
1687 "no ipv6 access-list WORD remark",
1688 NO_STR
1689 IPV6_STR
1690 "Add an access list entry\n"
1691 "IPv6 zebra access-list\n"
1692 "Access list entry comment\n")
1693{
d62a17ae 1694 int idx_word = 3;
1695 return vty_access_list_remark_unset(vty, AFI_IP6, argv[idx_word]->arg);
718e3744 1696}
f667a580
QY		 1697
1698/* ALIAS_FIXME */
1699DEFUN (no_ipv6_access_list_remark_comment,
1700 no_ipv6_access_list_remark_comment_cmd,
1701 "no ipv6 access-list WORD remark LINE...",
1702 NO_STR
1703 IPV6_STR
1704 "Add an access list entry\n"
1705 "IPv6 zebra access-list\n"
1706 "Access list entry comment\n"
1707 "Comment up to 100 characters\n")
1708{
d62a17ae 1709 return no_ipv6_access_list_remark(self, vty, argc, argv);
f667a580 1710}
718e3744 1711
d62a17ae 1712void config_write_access_zebra(struct vty *, struct filter *);
1713void config_write_access_cisco(struct vty *, struct filter *);
718e3744 1714
1715/* show access-list command. */
d62a17ae 1716static int filter_show(struct vty *vty, const char *name, afi_t afi)
1717{
1718 struct access_list *access;
1719 struct access_master *master;
1720 struct filter *mfilter;
1721 struct filter_cisco *filter;
1722 int write = 0;
1723
1724 master = access_master_get(afi);
1725 if (master == NULL)
1726 return 0;
1727
1728 /* Print the name of the protocol */
1729 vty_out(vty, "%s:\n", frr_protoname);
1730
1731 for (access = master->num.head; access; access = access->next) {
1732 if (name && strcmp(access->name, name) != 0)
1733 continue;
1734
1735 write = 1;
1736
1737 for (mfilter = access->head; mfilter; mfilter = mfilter->next) {
1738 filter = &mfilter->u.cfilter;
1739
1740 if (write) {
d37ba549 1741 vty_out(vty, "%s %s access list %s\n",
d62a17ae 1742 mfilter->cisco ? (filter->extended
1743 ? "Extended"
1744 : "Standard")
1745 : "Zebra",
d37ba549 1746 (afi == AFI_IP)
3b0f6068
DL		 1747 ? ("IP")
1748 : ((afi == AFI_IP6) ? ("IPv6 ")
1749 : ("MAC ")),
d62a17ae 1750 access->name);
1751 write = 0;
1752 }
1753
1754 vty_out(vty, " %s%s", filter_type_str(mfilter),
1755 mfilter->type == FILTER_DENY ? " " : "");
1756
1757 if (!mfilter->cisco)
1758 config_write_access_zebra(vty, mfilter);
1759 else if (filter->extended)
1760 config_write_access_cisco(vty, mfilter);
1761 else {
1762 if (filter->addr_mask.s_addr == 0xffffffff)
1763 vty_out(vty, " any\n");
1764 else {
1765 vty_out(vty, " %s",
1766 inet_ntoa(filter->addr));
1767 if (filter->addr_mask.s_addr != 0)
1768 vty_out(vty,
1769 ", wildcard bits %s",
1770 inet_ntoa(
1771 filter->addr_mask));
1772 vty_out(vty, "\n");
1773 }
1774 }
718e3744 1775 }
718e3744 1776 }
d62a17ae 1777
1778 for (access = master->str.head; access; access = access->next) {
1779 if (name && strcmp(access->name, name) != 0)
1780 continue;
1781
1782 write = 1;
1783
1784 for (mfilter = access->head; mfilter; mfilter = mfilter->next) {
1785 filter = &mfilter->u.cfilter;
1786
1787 if (write) {
d37ba549 1788 vty_out(vty, "%s %s access list %s\n",
d62a17ae 1789 mfilter->cisco ? (filter->extended
1790 ? "Extended"
1791 : "Standard")
1792 : "Zebra",
d37ba549 1793 (afi == AFI_IP)
3b0f6068
DL		 1794 ? ("IP")
1795 : ((afi == AFI_IP6) ? ("IPv6 ")
1796 : ("MAC ")),
d62a17ae 1797 access->name);
1798 write = 0;
1799 }
1800
1801 vty_out(vty, " %s%s", filter_type_str(mfilter),
1802 mfilter->type == FILTER_DENY ? " " : "");
1803
1804 if (!mfilter->cisco)
1805 config_write_access_zebra(vty, mfilter);
1806 else if (filter->extended)
1807 config_write_access_cisco(vty, mfilter);
1808 else {
1809 if (filter->addr_mask.s_addr == 0xffffffff)
1810 vty_out(vty, " any\n");
1811 else {
1812 vty_out(vty, " %s",
1813 inet_ntoa(filter->addr));
1814 if (filter->addr_mask.s_addr != 0)
1815 vty_out(vty,
1816 ", wildcard bits %s",
1817 inet_ntoa(
1818 filter->addr_mask));
1819 vty_out(vty, "\n");
1820 }
1821 }
718e3744 1822 }
718e3744 1823 }
d62a17ae 1824 return CMD_SUCCESS;
718e3744 1825}
1826
d37ba549
MK		 1827/* show MAC access list - this only has MAC filters for now*/
1828DEFUN (show_mac_access_list,
1829 show_mac_access_list_cmd,
1830 "show mac access-list",
1831 SHOW_STR
1832 "mac access lists\n"
1833 "List mac access lists\n")
1834{
1835 return filter_show(vty, NULL, AFI_L2VPN);
1836}
1837
1838DEFUN (show_mac_access_list_name,
1839 show_mac_access_list_name_cmd,
1840 "show mac access-list WORD",
1841 SHOW_STR
1667fc40 1842 "mac access lists\n"
d37ba549 1843 "List mac access lists\n"
1667fc40 1844 "mac address\n")
d37ba549
MK		 1845{
1846 return filter_show(vty, argv[3]->arg, AFI_L2VPN);
1847}
1848
718e3744 1849DEFUN (show_ip_access_list,
1850 show_ip_access_list_cmd,
1851 "show ip access-list",
1852 SHOW_STR
1853 IP_STR
1854 "List IP access lists\n")
1855{
d62a17ae 1856 return filter_show(vty, NULL, AFI_IP);
718e3744 1857}
1858
1859DEFUN (show_ip_access_list_name,
1860 show_ip_access_list_name_cmd,
6147e2c6 1861 "show ip access-list <(1-99)|(100-199)|(1300-1999)|(2000-2699)|WORD>",
718e3744 1862 SHOW_STR
1863 IP_STR
1864 "List IP access lists\n"
1865 "IP standard access list\n"
1866 "IP extended access list\n"
1867 "IP standard access list (expanded range)\n"
1868 "IP extended access list (expanded range)\n"
1869 "IP zebra access-list\n")
1870{
d62a17ae 1871 int idx_acl = 3;
1872 return filter_show(vty, argv[idx_acl]->arg, AFI_IP);
718e3744 1873}
1874
718e3744 1875DEFUN (show_ipv6_access_list,
1876 show_ipv6_access_list_cmd,
1877 "show ipv6 access-list",
1878 SHOW_STR
1879 IPV6_STR
1880 "List IPv6 access lists\n")
1881{
d62a17ae 1882 return filter_show(vty, NULL, AFI_IP6);
718e3744 1883}
1884
1885DEFUN (show_ipv6_access_list_name,
1886 show_ipv6_access_list_name_cmd,
1887 "show ipv6 access-list WORD",
1888 SHOW_STR
1889 IPV6_STR
1890 "List IPv6 access lists\n"
1891 "IPv6 zebra access-list\n")
1892{
d62a17ae 1893 int idx_word = 3;
1894 return filter_show(vty, argv[idx_word]->arg, AFI_IP6);
1895}
1896
1897void config_write_access_cisco(struct vty *vty, struct filter *mfilter)
1898{
1899 struct filter_cisco *filter;
1900
1901 filter = &mfilter->u.cfilter;
1902
1903 if (filter->extended) {
1904 vty_out(vty, " ip");
1905 if (filter->addr_mask.s_addr == 0xffffffff)
1906 vty_out(vty, " any");
1907 else if (filter->addr_mask.s_addr == 0)
1908 vty_out(vty, " host %s", inet_ntoa(filter->addr));
1909 else {
1910 vty_out(vty, " %s", inet_ntoa(filter->addr));
1911 vty_out(vty, " %s", inet_ntoa(filter->addr_mask));
1912 }
1913
1914 if (filter->mask_mask.s_addr == 0xffffffff)
1915 vty_out(vty, " any");
1916 else if (filter->mask_mask.s_addr == 0)
1917 vty_out(vty, " host %s", inet_ntoa(filter->mask));
1918 else {
1919 vty_out(vty, " %s", inet_ntoa(filter->mask));
1920 vty_out(vty, " %s", inet_ntoa(filter->mask_mask));
1921 }
1922 vty_out(vty, "\n");
1923 } else {
1924 if (filter->addr_mask.s_addr == 0xffffffff)
1925 vty_out(vty, " any\n");
1926 else {
1927 vty_out(vty, " %s", inet_ntoa(filter->addr));
1928 if (filter->addr_mask.s_addr != 0)
1929 vty_out(vty, " %s",
1930 inet_ntoa(filter->addr_mask));
1931 vty_out(vty, "\n");
1932 }
718e3744 1933 }
718e3744 1934}
1935
d62a17ae 1936void config_write_access_zebra(struct vty *vty, struct filter *mfilter)
718e3744 1937{
d62a17ae 1938 struct filter_zebra *filter;
1939 struct prefix *p;
1940 char buf[BUFSIZ];
718e3744 1941
d62a17ae 1942 filter = &mfilter->u.zfilter;
1943 p = &filter->prefix;
718e3744 1944
d62a17ae 1945 if (p->prefixlen == 0 && !filter->exact)
1946 vty_out(vty, " any");
d37ba549 1947 else if (p->family == AF_INET6 || p->family == AF_INET)
d62a17ae 1948 vty_out(vty, " %s/%d%s",
1949 inet_ntop(p->family, &p->u.prefix, buf, BUFSIZ),
1950 p->prefixlen, filter->exact ? " exact-match" : "");
69b61704 1951 else if (p->family == AF_ETHERNET) {
3b0f6068 1952 if (p->prefixlen == 0)
69b61704
MK		 1953 vty_out(vty, " any");
1954 else
1955 vty_out(vty, " %s", prefix_mac2str(&(p->u.prefix_eth),
1956 buf, sizeof(buf)));
1957 }
718e3744 1958
d62a17ae 1959 vty_out(vty, "\n");
718e3744 1960}
1961
d62a17ae 1962static int config_write_access(struct vty *vty, afi_t afi)
718e3744 1963{
d62a17ae 1964 struct access_list *access;
1965 struct access_master *master;
1966 struct filter *mfilter;
1967 int write = 0;
718e3744 1968
d62a17ae 1969 master = access_master_get(afi);
1970 if (master == NULL)
1971 return 0;
718e3744 1972
d62a17ae 1973 for (access = master->num.head; access; access = access->next) {
1974 if (access->remark) {
1975 vty_out(vty, "%saccess-list %s remark %s\n",
d37ba549
MK		 1976 (afi == AFI_IP) ? ("")
1977 : ((afi == AFI_IP6) ? ("ipv6 ")
1978 : ("mac ")),
1979 access->name, access->remark);
d62a17ae 1980 write++;
1981 }
718e3744 1982
d62a17ae 1983 for (mfilter = access->head; mfilter; mfilter = mfilter->next) {
1984 vty_out(vty, "%saccess-list %s %s",
d37ba549
MK		 1985 (afi == AFI_IP) ? ("")
1986 : ((afi == AFI_IP6) ? ("ipv6 ")
1987 : ("mac ")),
1988 access->name, filter_type_str(mfilter));
718e3744 1989
d62a17ae 1990 if (mfilter->cisco)
1991 config_write_access_cisco(vty, mfilter);
1992 else
1993 config_write_access_zebra(vty, mfilter);
718e3744 1994
d62a17ae 1995 write++;
1996 }
718e3744 1997 }
1998
d62a17ae 1999 for (access = master->str.head; access; access = access->next) {
2000 if (access->remark) {
2001 vty_out(vty, "%saccess-list %s remark %s\n",
d37ba549
MK		 2002 (afi == AFI_IP) ? ("")
2003 : ((afi == AFI_IP6) ? ("ipv6 ")
2004 : ("mac ")),
2005 access->name, access->remark);
d62a17ae 2006 write++;
2007 }
2008
2009 for (mfilter = access->head; mfilter; mfilter = mfilter->next) {
2010 vty_out(vty, "%saccess-list %s %s",
d37ba549
MK		 2011 (afi == AFI_IP) ? ("")
2012 : ((afi == AFI_IP6) ? ("ipv6 ")
2013 : ("mac ")),
2014 access->name, filter_type_str(mfilter));
718e3744 2015
d62a17ae 2016 if (mfilter->cisco)
2017 config_write_access_cisco(vty, mfilter);
2018 else
2019 config_write_access_zebra(vty, mfilter);
718e3744 2020
d62a17ae 2021 write++;
2022 }
718e3744 2023 }
d62a17ae 2024 return write;
718e3744 2025}
2026
d37ba549
MK		 2027static struct cmd_node access_mac_node = {
2028 ACCESS_MAC_NODE, "", /* Access list has no interface. */
2029 1};
2030
2031static int config_write_access_mac(struct vty *vty)
2032{
2033 return config_write_access(vty, AFI_L2VPN);
2034}
2035
2036static void access_list_reset_mac(void)
2037{
2038 struct access_list *access;
2039 struct access_list *next;
2040 struct access_master *master;
2041
2042 master = access_master_get(AFI_L2VPN);
2043 if (master == NULL)
2044 return;
2045
2046 for (access = master->num.head; access; access = next) {
2047 next = access->next;
2048 access_list_delete(access);
2049 }
2050 for (access = master->str.head; access; access = next) {
2051 next = access->next;
2052 access_list_delete(access);
2053 }
2054
2055 assert(master->num.head == NULL);
2056 assert(master->num.tail == NULL);
2057
2058 assert(master->str.head == NULL);
2059 assert(master->str.tail == NULL);
2060}
2061
2062/* Install vty related command. */
2063static void access_list_init_mac(void)
2064{
2065 install_node(&access_mac_node, config_write_access_mac);
2066
2067 install_element(ENABLE_NODE, &show_mac_access_list_cmd);
2068 install_element(ENABLE_NODE, &show_mac_access_list_name_cmd);
2069
2070 /* Zebra access-list */
2071 install_element(CONFIG_NODE, &mac_access_list_cmd);
2072 install_element(CONFIG_NODE, &no_mac_access_list_cmd);
2073 install_element(CONFIG_NODE, &mac_access_list_any_cmd);
2074 install_element(CONFIG_NODE, &no_mac_access_list_any_cmd);
2075}
2076
718e3744 2077/* Access-list node. */
d62a17ae 2078static struct cmd_node access_node = {ACCESS_NODE,
2079 "", /* Access list has no interface. */
2080 1};
718e3744 2081
d62a17ae 2082static int config_write_access_ipv4(struct vty *vty)
718e3744 2083{
d62a17ae 2084 return config_write_access(vty, AFI_IP);
718e3744 2085}
2086
d62a17ae 2087static void access_list_reset_ipv4(void)
718e3744 2088{
d62a17ae 2089 struct access_list *access;
2090 struct access_list *next;
2091 struct access_master *master;
718e3744 2092
d62a17ae 2093 master = access_master_get(AFI_IP);
2094 if (master == NULL)
2095 return;
718e3744 2096
d62a17ae 2097 for (access = master->num.head; access; access = next) {
2098 next = access->next;
2099 access_list_delete(access);
2100 }
2101 for (access = master->str.head; access; access = next) {
2102 next = access->next;
2103 access_list_delete(access);
2104 }
718e3744 2105
d62a17ae 2106 assert(master->num.head == NULL);
2107 assert(master->num.tail == NULL);
718e3744 2108
d62a17ae 2109 assert(master->str.head == NULL);
2110 assert(master->str.tail == NULL);
718e3744 2111}
2112
2113/* Install vty related command. */
d62a17ae 2114static void access_list_init_ipv4(void)
2115{
2116 install_node(&access_node, config_write_access_ipv4);
2117
2118 install_element(ENABLE_NODE, &show_ip_access_list_cmd);
2119 install_element(ENABLE_NODE, &show_ip_access_list_name_cmd);
2120
2121 /* Zebra access-list */
2122 install_element(CONFIG_NODE, &access_list_exact_cmd);
2123 install_element(CONFIG_NODE, &access_list_any_cmd);
2124 install_element(CONFIG_NODE, &no_access_list_exact_cmd);
2125 install_element(CONFIG_NODE, &no_access_list_any_cmd);
2126
2127 /* Standard access-list */
2128 install_element(CONFIG_NODE, &access_list_standard_cmd);
2129 install_element(CONFIG_NODE, &access_list_standard_nomask_cmd);
2130 install_element(CONFIG_NODE, &access_list_standard_host_cmd);
2131 install_element(CONFIG_NODE, &access_list_standard_any_cmd);
2132 install_element(CONFIG_NODE, &no_access_list_standard_cmd);
2133 install_element(CONFIG_NODE, &no_access_list_standard_nomask_cmd);
2134 install_element(CONFIG_NODE, &no_access_list_standard_host_cmd);
2135 install_element(CONFIG_NODE, &no_access_list_standard_any_cmd);
2136
2137 /* Extended access-list */
2138 install_element(CONFIG_NODE, &access_list_extended_cmd);
2139 install_element(CONFIG_NODE, &access_list_extended_any_mask_cmd);
2140 install_element(CONFIG_NODE, &access_list_extended_mask_any_cmd);
2141 install_element(CONFIG_NODE, &access_list_extended_any_any_cmd);
2142 install_element(CONFIG_NODE, &access_list_extended_host_mask_cmd);
2143 install_element(CONFIG_NODE, &access_list_extended_mask_host_cmd);
2144 install_element(CONFIG_NODE, &access_list_extended_host_host_cmd);
2145 install_element(CONFIG_NODE, &access_list_extended_any_host_cmd);
2146 install_element(CONFIG_NODE, &access_list_extended_host_any_cmd);
2147 install_element(CONFIG_NODE, &no_access_list_extended_cmd);
2148 install_element(CONFIG_NODE, &no_access_list_extended_any_mask_cmd);
2149 install_element(CONFIG_NODE, &no_access_list_extended_mask_any_cmd);
2150 install_element(CONFIG_NODE, &no_access_list_extended_any_any_cmd);
2151 install_element(CONFIG_NODE, &no_access_list_extended_host_mask_cmd);
2152 install_element(CONFIG_NODE, &no_access_list_extended_mask_host_cmd);
2153 install_element(CONFIG_NODE, &no_access_list_extended_host_host_cmd);
2154 install_element(CONFIG_NODE, &no_access_list_extended_any_host_cmd);
2155 install_element(CONFIG_NODE, &no_access_list_extended_host_any_cmd);
2156
2157 install_element(CONFIG_NODE, &access_list_remark_cmd);
2158 install_element(CONFIG_NODE, &no_access_list_all_cmd);
2159 install_element(CONFIG_NODE, &no_access_list_remark_cmd);
2160 install_element(CONFIG_NODE, &no_access_list_remark_comment_cmd);
2161}
2162
2163static struct cmd_node access_ipv6_node = {ACCESS_IPV6_NODE, "", 1};
2164
2165static int config_write_access_ipv6(struct vty *vty)
2166{
2167 return config_write_access(vty, AFI_IP6);
2168}
2169
2170static void access_list_reset_ipv6(void)
2171{
2172 struct access_list *access;
2173 struct access_list *next;
2174 struct access_master *master;
2175
2176 master = access_master_get(AFI_IP6);
2177 if (master == NULL)
2178 return;
2179
2180 for (access = master->num.head; access; access = next) {
2181 next = access->next;
2182 access_list_delete(access);
2183 }
2184 for (access = master->str.head; access; access = next) {
2185 next = access->next;
2186 access_list_delete(access);
2187 }
718e3744 2188
d62a17ae 2189 assert(master->num.head == NULL);
2190 assert(master->num.tail == NULL);
718e3744 2191
d62a17ae 2192 assert(master->str.head == NULL);
2193 assert(master->str.tail == NULL);
718e3744 2194}
2195
d62a17ae 2196static void access_list_init_ipv6(void)
718e3744 2197{
d62a17ae 2198 install_node(&access_ipv6_node, config_write_access_ipv6);
718e3744 2199
d62a17ae 2200 install_element(ENABLE_NODE, &show_ipv6_access_list_cmd);
2201 install_element(ENABLE_NODE, &show_ipv6_access_list_name_cmd);
718e3744 2202
d62a17ae 2203 install_element(CONFIG_NODE, &ipv6_access_list_exact_cmd);
2204 install_element(CONFIG_NODE, &ipv6_access_list_any_cmd);
2205 install_element(CONFIG_NODE, &no_ipv6_access_list_exact_cmd);
2206 install_element(CONFIG_NODE, &no_ipv6_access_list_any_cmd);
718e3744 2207
d62a17ae 2208 install_element(CONFIG_NODE, &no_ipv6_access_list_all_cmd);
2209 install_element(CONFIG_NODE, &ipv6_access_list_remark_cmd);
2210 install_element(CONFIG_NODE, &no_ipv6_access_list_remark_cmd);
2211 install_element(CONFIG_NODE, &no_ipv6_access_list_remark_comment_cmd);
718e3744 2212}
718e3744 2213
d62a17ae 2214void access_list_init()
718e3744 2215{
d62a17ae 2216 access_list_init_ipv4();
2217 access_list_init_ipv6();
d37ba549 2218 access_list_init_mac();
718e3744 2219}
2220
d62a17ae 2221void access_list_reset()
718e3744 2222{
d62a17ae 2223 access_list_reset_ipv4();
2224 access_list_reset_ipv6();
d37ba549 2225 access_list_reset_mac();
718e3744 2226}
FRRouting mirror