lib/filter.c

   1 /* Route filtering function.
   2  * Copyright (C) 1998, 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published
   8  * by the Free Software Foundation; either version 2, or (at your
   9  * option) any later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "prefix.h"
  24 #include "filter.h"
  25 #include "memory.h"
  26 #include "command.h"
  27 #include "sockunion.h"
  28 #include "buffer.h"
  29 #include "log.h"
  30 #include "routemap.h"
  31 #include "libfrr.h"
  32 #include "northbound_cli.h"
  33 #include "json.h"
  34
  35 DEFINE_MTYPE_STATIC(LIB, ACCESS_LIST, "Access List");
  36 DEFINE_MTYPE_STATIC(LIB, ACCESS_LIST_STR, "Access List Str");
  37 DEFINE_MTYPE_STATIC(LIB, ACCESS_FILTER, "Access Filter");
  38
  39 /* Static structure for mac access_list's master. */
  40 static struct access_master access_master_mac = {
  41         {NULL, NULL},
  42         NULL,
  43         NULL,
  44 };
  45
  46 /* Static structure for IPv4 access_list's master. */
  47 static struct access_master access_master_ipv4 = {
  48         {NULL, NULL},
  49         NULL,
  50         NULL,
  51 };
  52
  53 /* Static structure for IPv6 access_list's master. */
  54 static struct access_master access_master_ipv6 = {
  55         {NULL, NULL},
  56         NULL,
  57         NULL,
  58 };
  59
  60 static struct access_master *access_master_get(afi_t afi)
  61 {
  62         if (afi == AFI_IP)
  63                 return &access_master_ipv4;
  64         else if (afi == AFI_IP6)
  65                 return &access_master_ipv6;
  66         else if (afi == AFI_L2VPN)
  67                 return &access_master_mac;
  68         return NULL;
  69 }
  70
  71 /* Allocate new filter structure. */
  72 struct filter *filter_new(void)
  73 {
  74         return XCALLOC(MTYPE_ACCESS_FILTER, sizeof(struct filter));
  75 }
  76
  77 static void filter_free(struct filter *filter)
  78 {
  79         XFREE(MTYPE_ACCESS_FILTER, filter);
  80 }
  81
  82 /* Return string of filter_type. */
  83 static const char *filter_type_str(struct filter *filter)
  84 {
  85         switch (filter->type) {
  86         case FILTER_PERMIT:
  87                 return "permit";
  88         case FILTER_DENY:
  89                 return "deny";
  90         case FILTER_DYNAMIC:
  91                 return "dynamic";
  92         default:
  93                 return "";
  94         }
  95 }
  96
  97 /* If filter match to the prefix then return 1. */
  98 static int filter_match_cisco(struct filter *mfilter, const struct prefix *p)
  99 {
 100         struct filter_cisco *filter;
 101         struct in_addr mask;
 102         uint32_t check_addr;
 103         uint32_t check_mask;
 104
 105         filter = &mfilter->u.cfilter;
 106         check_addr = p->u.prefix4.s_addr & ~filter->addr_mask.s_addr;
 107
 108         if (filter->extended) {
 109                 masklen2ip(p->prefixlen, &mask);
 110                 check_mask = mask.s_addr & ~filter->mask_mask.s_addr;
 111
 112                 if (memcmp(&check_addr, &filter->addr.s_addr, IPV4_MAX_BYTELEN)
 113                             == 0
 114                     && memcmp(&check_mask, &filter->mask.s_addr,
 115                               IPV4_MAX_BYTELEN)
 116                                == 0)
 117                         return 1;
 118         } else if (memcmp(&check_addr, &filter->addr.s_addr, IPV4_MAX_BYTELEN)
 119                    == 0)
 120                 return 1;
 121
 122         return 0;
 123 }
 124
 125 /* If filter match to the prefix then return 1. */
 126 static int filter_match_zebra(struct filter *mfilter, const struct prefix *p)
 127 {
 128         struct filter_zebra *filter = NULL;
 129
 130         filter = &mfilter->u.zfilter;
 131
 132         if (filter->prefix.family == p->family) {
 133                 if (filter->exact) {
 134                         if (filter->prefix.prefixlen == p->prefixlen)
 135                                 return prefix_match(&filter->prefix, p);
 136                         else
 137                                 return 0;
 138                 } else
 139                         return prefix_match(&filter->prefix, p);
 140         } else
 141                 return 0;
 142 }
 143
 144 /* Allocate new access list structure. */
 145 static struct access_list *access_list_new(void)
 146 {
 147         return XCALLOC(MTYPE_ACCESS_LIST, sizeof(struct access_list));
 148 }
 149
 150 /* Free allocated access_list. */
 151 static void access_list_free(struct access_list *access)
 152 {
 153         XFREE(MTYPE_ACCESS_LIST, access);
 154 }
 155
 156 /* Delete access_list from access_master and free it. */
 157 void access_list_delete(struct access_list *access)
 158 {
 159         struct filter *filter;
 160         struct filter *next;
 161         struct access_list_list *list;
 162         struct access_master *master;
 163
 164         for (filter = access->head; filter; filter = next) {
 165                 next = filter->next;
 166                 filter_free(filter);
 167         }
 168
 169         master = access->master;
 170
 171         list = &master->str;
 172
 173         if (access->next)
 174                 access->next->prev = access->prev;
 175         else
 176                 list->tail = access->prev;
 177
 178         if (access->prev)
 179                 access->prev->next = access->next;
 180         else
 181                 list->head = access->next;
 182
 183         route_map_notify_dependencies(access->name, RMAP_EVENT_FILTER_DELETED);
 184
 185         if (master->delete_hook)
 186                 master->delete_hook(access);
 187
 188         XFREE(MTYPE_ACCESS_LIST_STR, access->name);
 189
 190         XFREE(MTYPE_TMP, access->remark);
 191
 192         access_list_free(access);
 193 }
 194
 195 /* Insert new access list to list of access_list.  Each acceess_list
 196    is sorted by the name. */
 197 static struct access_list *access_list_insert(afi_t afi, const char *name)
 198 {
 199         struct access_list *access;
 200         struct access_list *point;
 201         struct access_list_list *alist;
 202         struct access_master *master;
 203
 204         master = access_master_get(afi);
 205         if (master == NULL)
 206                 return NULL;
 207
 208         /* Allocate new access_list and copy given name. */
 209         access = access_list_new();
 210         access->name = XSTRDUP(MTYPE_ACCESS_LIST_STR, name);
 211         access->master = master;
 212
 213         /* Set access_list to string list. */
 214         alist = &master->str;
 215
 216         /* Set point to insertion point. */
 217         for (point = alist->head; point; point = point->next)
 218                 if (strcmp(point->name, name) >= 0)
 219                         break;
 220
 221         /* In case of this is the first element of master. */
 222         if (alist->head == NULL) {
 223                 alist->head = alist->tail = access;
 224                 return access;
 225         }
 226
 227         /* In case of insertion is made at the tail of access_list. */
 228         if (point == NULL) {
 229                 access->prev = alist->tail;
 230                 alist->tail->next = access;
 231                 alist->tail = access;
 232                 return access;
 233         }
 234
 235         /* In case of insertion is made at the head of access_list. */
 236         if (point == alist->head) {
 237                 access->next = alist->head;
 238                 alist->head->prev = access;
 239                 alist->head = access;
 240                 return access;
 241         }
 242
 243         /* Insertion is made at middle of the access_list. */
 244         access->next = point;
 245         access->prev = point->prev;
 246
 247         if (point->prev)
 248                 point->prev->next = access;
 249         point->prev = access;
 250
 251         return access;
 252 }
 253
 254 /* Lookup access_list from list of access_list by name. */
 255 struct access_list *access_list_lookup(afi_t afi, const char *name)
 256 {
 257         struct access_list *access;
 258         struct access_master *master;
 259
 260         if (name == NULL)
 261                 return NULL;
 262
 263         master = access_master_get(afi);
 264         if (master == NULL)
 265                 return NULL;
 266
 267         for (access = master->str.head; access; access = access->next)
 268                 if (strcmp(access->name, name) == 0)
 269                         return access;
 270
 271         return NULL;
 272 }
 273
 274 /* Get access list from list of access_list.  If there isn't matched
 275    access_list create new one and return it. */
 276 struct access_list *access_list_get(afi_t afi, const char *name)
 277 {
 278         struct access_list *access;
 279
 280         access = access_list_lookup(afi, name);
 281         if (access == NULL)
 282                 access = access_list_insert(afi, name);
 283         return access;
 284 }
 285
 286 /* Apply access list to object (which should be struct prefix *). */
 287 enum filter_type access_list_apply(struct access_list *access,
 288                                    const void *object)
 289 {
 290         struct filter *filter;
 291         const struct prefix *p = (const struct prefix *)object;
 292
 293         if (access == NULL)
 294                 return FILTER_DENY;
 295
 296         for (filter = access->head; filter; filter = filter->next) {
 297                 if (filter->cisco) {
 298                         if (filter_match_cisco(filter, p))
 299                                 return filter->type;
 300                 } else {
 301                         if (filter_match_zebra(filter, p))
 302                                 return filter->type;
 303                 }
 304         }
 305
 306         return FILTER_DENY;
 307 }
 308
 309 /* Add hook function. */
 310 void access_list_add_hook(void (*func)(struct access_list *access))
 311 {
 312         access_master_ipv4.add_hook = func;
 313         access_master_ipv6.add_hook = func;
 314         access_master_mac.add_hook = func;
 315 }
 316
 317 /* Delete hook function. */
 318 void access_list_delete_hook(void (*func)(struct access_list *access))
 319 {
 320         access_master_ipv4.delete_hook = func;
 321         access_master_ipv6.delete_hook = func;
 322         access_master_mac.delete_hook = func;
 323 }
 324
 325 /* Calculate new sequential number. */
 326 int64_t filter_new_seq_get(struct access_list *access)
 327 {
 328         int64_t maxseq;
 329         int64_t newseq;
 330         struct filter *filter;
 331
 332         maxseq = 0;
 333
 334         for (filter = access->head; filter; filter = filter->next) {
 335                 if (maxseq < filter->seq)
 336                         maxseq = filter->seq;
 337         }
 338
 339         newseq = ((maxseq / 5) * 5) + 5;
 340
 341         return (newseq > UINT_MAX) ? UINT_MAX : newseq;
 342 }
 343
 344 /* Return access list entry which has same seq number. */
 345 static struct filter *filter_seq_check(struct access_list *access,
 346                                                   int64_t seq)
 347 {
 348         struct filter *filter;
 349
 350         for (filter = access->head; filter; filter = filter->next)
 351                 if (filter->seq == seq)
 352                         return filter;
 353         return NULL;
 354 }
 355
 356 /* Delete filter from specified access_list.  If there is hook
 357    function execute it. */
 358 void access_list_filter_delete(struct access_list *access,
 359                                struct filter *filter)
 360 {
 361         struct access_master *master;
 362
 363         master = access->master;
 364
 365         if (filter->next)
 366                 filter->next->prev = filter->prev;
 367         else
 368                 access->tail = filter->prev;
 369
 370         if (filter->prev)
 371                 filter->prev->next = filter->next;
 372         else
 373                 access->head = filter->next;
 374
 375         filter_free(filter);
 376
 377         route_map_notify_dependencies(access->name, RMAP_EVENT_FILTER_DELETED);
 378         /* Run hook function. */
 379         if (master->delete_hook)
 380                 (*master->delete_hook)(access);
 381 }
 382
 383 /* Add new filter to the end of specified access_list. */
 384 void access_list_filter_add(struct access_list *access,
 385                             struct filter *filter)
 386 {
 387         struct filter *replace;
 388         struct filter *point;
 389
 390         /* Automatic asignment of seq no. */
 391         if (filter->seq == -1)
 392                 filter->seq = filter_new_seq_get(access);
 393
 394         if (access->tail && filter->seq > access->tail->seq)
 395                 point = NULL;
 396         else {
 397                 /* Is there any same seq access list filter? */
 398                 replace = filter_seq_check(access, filter->seq);
 399                 if (replace)
 400                         access_list_filter_delete(access, replace);
 401
 402                 /* Check insert point. */
 403                 for (point = access->head; point; point = point->next)
 404                         if (point->seq >= filter->seq)
 405                                 break;
 406         }
 407
 408         /* In case of this is the first element of the list. */
 409         filter->next = point;
 410
 411         if (point) {
 412                 if (point->prev)
 413                         point->prev->next = filter;
 414                 else
 415                         access->head = filter;
 416
 417                 filter->prev = point->prev;
 418                 point->prev = filter;
 419         } else {
 420                 if (access->tail)
 421                         access->tail->next = filter;
 422                 else
 423                         access->head = filter;
 424
 425                 filter->prev = access->tail;
 426                 access->tail = filter;
 427         }
 428
 429         /* Run hook function. */
 430         if (access->master->add_hook)
 431                 (*access->master->add_hook)(access);
 432         route_map_notify_dependencies(access->name, RMAP_EVENT_FILTER_ADDED);
 433 }
 434
 435 /*
 436   deny    Specify packets to reject
 437   permit  Specify packets to forward
 438   dynamic ?
 439 */
 440
 441 /*
 442   Hostname or A.B.C.D  Address to match
 443   any                  Any source host
 444   host                 A single host address
 445 */
 446
 447 static void config_write_access_zebra(struct vty *, struct filter *,
 448                                       json_object *);
 449 static void config_write_access_cisco(struct vty *, struct filter *,
 450                                       json_object *);
 451
 452 static const char *filter_type2str(struct filter *filter)
 453 {
 454         if (filter->cisco) {
 455                 if (filter->u.cfilter.extended)
 456                         return "Extended";
 457                 else
 458                         return "Standard";
 459         } else
 460                 return "Zebra";
 461 }
 462
 463 /* show access-list command. */
 464 static int filter_show(struct vty *vty, const char *name, afi_t afi,
 465                        bool use_json)
 466 {
 467         struct access_list *access;
 468         struct access_master *master;
 469         struct filter *mfilter;
 470         struct filter_cisco *filter;
 471         bool first;
 472         json_object *json = NULL;
 473         json_object *json_proto = NULL;
 474
 475         master = access_master_get(afi);
 476         if (master == NULL) {
 477                 if (use_json)
 478                         vty_out(vty, "{}\n");
 479                 return 0;
 480         }
 481
 482         if (use_json)
 483                 json = json_object_new_object();
 484
 485         /* Print the name of the protocol */
 486         if (json) {
 487                 json_proto = json_object_new_object();
 488                 json_object_object_add(json, frr_protoname, json_proto);
 489         } else
 490                 vty_out(vty, "%s:\n", frr_protoname);
 491
 492         for (access = master->str.head; access; access = access->next) {
 493                 json_object *json_acl = NULL;
 494                 json_object *json_rules = NULL;
 495
 496                 if (name && strcmp(access->name, name) != 0)
 497                         continue;
 498
 499                 first = true;
 500
 501                 for (mfilter = access->head; mfilter; mfilter = mfilter->next) {
 502                         json_object *json_rule = NULL;
 503
 504                         filter = &mfilter->u.cfilter;
 505
 506                         if (first) {
 507                                 const char *type = filter_type2str(mfilter);
 508
 509                                 if (json) {
 510                                         json_acl = json_object_new_object();
 511                                         json_object_object_add(json_proto,
 512                                                                access->name,
 513                                                                json_acl);
 514
 515                                         json_object_string_add(json_acl, "type",
 516                                                                type);
 517                                         json_object_string_add(json_acl,
 518                                                                "addressFamily",
 519                                                                afi2str(afi));
 520                                         json_rules = json_object_new_array();
 521                                         json_object_object_add(
 522                                                 json_acl, "rules", json_rules);
 523                                 } else {
 524                                         vty_out(vty, "%s %s access list %s\n",
 525                                                 type,
 526                                                 (afi == AFI_IP)
 527                                                         ? ("IP")
 528                                                         : ((afi == AFI_IP6)
 529                                                                    ? ("IPv6 ")
 530                                                                    : ("MAC ")),
 531                                                 access->name);
 532                                 }
 533
 534                                 first = false;
 535                         }
 536
 537                         if (json) {
 538                                 json_rule = json_object_new_object();
 539                                 json_object_array_add(json_rules, json_rule);
 540
 541                                 json_object_int_add(json_rule, "sequenceNumber",
 542                                                     mfilter->seq);
 543                                 json_object_string_add(
 544                                         json_rule, "filterType",
 545                                         filter_type_str(mfilter));
 546                         } else {
 547                                 vty_out(vty, "    seq %" PRId64, mfilter->seq);
 548                                 vty_out(vty, " %s%s", filter_type_str(mfilter),
 549                                         mfilter->type == FILTER_DENY ? "  "
 550                                                                      : "");
 551                         }
 552
 553                         if (!mfilter->cisco)
 554                                 config_write_access_zebra(vty, mfilter,
 555                                                           json_rule);
 556                         else if (filter->extended)
 557                                 config_write_access_cisco(vty, mfilter,
 558                                                           json_rule);
 559                         else {
 560                                 if (json) {
 561                                         char buf[BUFSIZ];
 562
 563                                         json_object_string_add(
 564                                                 json_rule, "address",
 565                                                 inet_ntop(AF_INET,
 566                                                           &filter->addr, buf,
 567                                                           sizeof(buf)));
 568                                         json_object_string_add(
 569                                                 json_rule, "mask",
 570                                                 inet_ntop(AF_INET,
 571                                                           &filter->addr_mask,
 572                                                           buf, sizeof(buf)));
 573                                 } else {
 574                                         if (filter->addr_mask.s_addr
 575                                             == 0xffffffff)
 576                                                 vty_out(vty, " any\n");
 577                                         else {
 578                                                 vty_out(vty, " %pI4",
 579                                                         &filter->addr);
 580                                                 if (filter->addr_mask.s_addr
 581                                                     != INADDR_ANY)
 582                                                         vty_out(vty,
 583                                                                 ", wildcard bits %pI4",
 584                                                                 &filter->addr_mask);
 585                                                 vty_out(vty, "\n");
 586                                         }
 587                                 }
 588                         }
 589                 }
 590         }
 591
 592         if (json) {
 593                 vty_out(vty, "%s\n",
 594                         json_object_to_json_string_ext(
 595                                 json, JSON_C_TO_STRING_PRETTY));
 596                 json_object_free(json);
 597         }
 598
 599         return CMD_SUCCESS;
 600 }
 601
 602 /* show MAC access list - this only has MAC filters for now*/
 603 DEFUN (show_mac_access_list,
 604        show_mac_access_list_cmd,
 605        "show mac access-list",
 606        SHOW_STR
 607        "mac access lists\n"
 608        "List mac access lists\n")
 609 {
 610         return filter_show(vty, NULL, AFI_L2VPN, false);
 611 }
 612
 613 DEFUN (show_mac_access_list_name,
 614        show_mac_access_list_name_cmd,
 615        "show mac access-list WORD",
 616        SHOW_STR
 617        "mac access lists\n"
 618        "List mac access lists\n"
 619        "mac address\n")
 620 {
 621         return filter_show(vty, argv[3]->arg, AFI_L2VPN, false);
 622 }
 623
 624 DEFUN (show_ip_access_list,
 625        show_ip_access_list_cmd,
 626        "show ip access-list [json]",
 627        SHOW_STR
 628        IP_STR
 629        "List IP access lists\n"
 630        JSON_STR)
 631 {
 632         bool uj = use_json(argc, argv);
 633         return filter_show(vty, NULL, AFI_IP, uj);
 634 }
 635
 636 DEFUN (show_ip_access_list_name,
 637        show_ip_access_list_name_cmd,
 638        "show ip access-list WORD [json]",
 639        SHOW_STR
 640        IP_STR
 641        "List IP access lists\n"
 642        "IP access-list name\n"
 643        JSON_STR)
 644 {
 645         bool uj = use_json(argc, argv);
 646         int idx_acl = 3;
 647         return filter_show(vty, argv[idx_acl]->arg, AFI_IP, uj);
 648 }
 649
 650 DEFUN (show_ipv6_access_list,
 651        show_ipv6_access_list_cmd,
 652        "show ipv6 access-list [json]",
 653        SHOW_STR
 654        IPV6_STR
 655        "List IPv6 access lists\n"
 656        JSON_STR)
 657 {
 658         bool uj = use_json(argc, argv);
 659         return filter_show(vty, NULL, AFI_IP6, uj);
 660 }
 661
 662 DEFUN (show_ipv6_access_list_name,
 663        show_ipv6_access_list_name_cmd,
 664        "show ipv6 access-list WORD [json]",
 665        SHOW_STR
 666        IPV6_STR
 667        "List IPv6 access lists\n"
 668        "IPv6 access-list name\n"
 669        JSON_STR)
 670 {
 671         bool uj = use_json(argc, argv);
 672         int idx_word = 3;
 673         return filter_show(vty, argv[idx_word]->arg, AFI_IP6, uj);
 674 }
 675
 676 static void config_write_access_cisco(struct vty *vty, struct filter *mfilter,
 677                                       json_object *json)
 678 {
 679         struct filter_cisco *filter;
 680
 681         filter = &mfilter->u.cfilter;
 682
 683         if (json) {
 684                 char buf[BUFSIZ];
 685
 686                 json_object_boolean_add(json, "extended", !!filter->extended);
 687                 json_object_string_add(
 688                         json, "sourceAddress",
 689                         inet_ntop(AF_INET, &filter->addr, buf, sizeof(buf)));
 690                 json_object_string_add(json, "sourceMask",
 691                                        inet_ntop(AF_INET, &filter->addr_mask,
 692                                                  buf, sizeof(buf)));
 693                 json_object_string_add(
 694                         json, "destinationAddress",
 695                         inet_ntop(AF_INET, &filter->mask, buf, sizeof(buf)));
 696                 json_object_string_add(json, "destinationMask",
 697                                        inet_ntop(AF_INET, &filter->mask_mask,
 698                                                  buf, sizeof(buf)));
 699         } else {
 700                 vty_out(vty, " ip");
 701                 if (filter->addr_mask.s_addr == 0xffffffff)
 702                         vty_out(vty, " any");
 703                 else if (filter->addr_mask.s_addr == INADDR_ANY)
 704                         vty_out(vty, " host %pI4", &filter->addr);
 705                 else {
 706                         vty_out(vty, " %pI4", &filter->addr);
 707                         vty_out(vty, " %pI4", &filter->addr_mask);
 708                 }
 709
 710                 if (filter->mask_mask.s_addr == 0xffffffff)
 711                         vty_out(vty, " any");
 712                 else if (filter->mask_mask.s_addr == INADDR_ANY)
 713                         vty_out(vty, " host %pI4", &filter->mask);
 714                 else {
 715                         vty_out(vty, " %pI4", &filter->mask);
 716                         vty_out(vty, " %pI4", &filter->mask_mask);
 717                 }
 718                 vty_out(vty, "\n");
 719         }
 720 }
 721
 722 static void config_write_access_zebra(struct vty *vty, struct filter *mfilter,
 723                                       json_object *json)
 724 {
 725         struct filter_zebra *filter;
 726         struct prefix *p;
 727         char buf[BUFSIZ];
 728
 729         filter = &mfilter->u.zfilter;
 730         p = &filter->prefix;
 731
 732         if (json) {
 733                 json_object_string_add(json, "prefix",
 734                                        prefix2str(p, buf, sizeof(buf)));
 735                 json_object_boolean_add(json, "exact-match", !!filter->exact);
 736         } else {
 737                 if (p->prefixlen == 0 && !filter->exact)
 738                         vty_out(vty, " any");
 739                 else if (p->family == AF_INET6 || p->family == AF_INET)
 740                         vty_out(vty, " %s/%d%s",
 741                                 inet_ntop(p->family, &p->u.prefix, buf, BUFSIZ),
 742                                 p->prefixlen,
 743                                 filter->exact ? " exact-match" : "");
 744                 else if (p->family == AF_ETHERNET) {
 745                         if (p->prefixlen == 0)
 746                                 vty_out(vty, " any");
 747                         else
 748                                 vty_out(vty, " %s",
 749                                         prefix_mac2str(&(p->u.prefix_eth), buf,
 750                                                        sizeof(buf)));
 751                 }
 752
 753                 vty_out(vty, "\n");
 754         }
 755 }
 756
 757 static struct cmd_node access_mac_node = {
 758         .name = "MAC access list",
 759         .node = ACCESS_MAC_NODE,
 760         .prompt = "",
 761 };
 762
 763 static void access_list_reset_mac(void)
 764 {
 765         struct access_list *access;
 766         struct access_list *next;
 767         struct access_master *master;
 768
 769         master = access_master_get(AFI_L2VPN);
 770         if (master == NULL)
 771                 return;
 772
 773         for (access = master->str.head; access; access = next) {
 774                 next = access->next;
 775                 access_list_delete(access);
 776         }
 777
 778         assert(master->str.head == NULL);
 779         assert(master->str.tail == NULL);
 780 }
 781
 782 /* Install vty related command. */
 783 static void access_list_init_mac(void)
 784 {
 785         install_node(&access_mac_node);
 786
 787         install_element(ENABLE_NODE, &show_mac_access_list_cmd);
 788         install_element(ENABLE_NODE, &show_mac_access_list_name_cmd);
 789 }
 790
 791 /* Access-list node. */
 792 static int config_write_access(struct vty *vty);
 793 static struct cmd_node access_node = {
 794         .name = "ipv4 access list",
 795         .node = ACCESS_NODE,
 796         .prompt = "",
 797         .config_write = config_write_access,
 798 };
 799
 800 static int config_write_access(struct vty *vty)
 801 {
 802         struct lyd_node *dnode;
 803         int written = 0;
 804
 805         dnode = yang_dnode_get(running_config->dnode, "/frr-filter:lib");
 806         if (dnode) {
 807                 nb_cli_show_dnode_cmds(vty, dnode, false);
 808                 written = 1;
 809         }
 810
 811         return written;
 812 }
 813
 814 static void access_list_reset_ipv4(void)
 815 {
 816         struct access_list *access;
 817         struct access_list *next;
 818         struct access_master *master;
 819
 820         master = access_master_get(AFI_IP);
 821         if (master == NULL)
 822                 return;
 823
 824         for (access = master->str.head; access; access = next) {
 825                 next = access->next;
 826                 access_list_delete(access);
 827         }
 828
 829         assert(master->str.head == NULL);
 830         assert(master->str.tail == NULL);
 831 }
 832
 833 /* Install vty related command. */
 834 static void access_list_init_ipv4(void)
 835 {
 836         install_node(&access_node);
 837
 838         install_element(ENABLE_NODE, &show_ip_access_list_cmd);
 839         install_element(ENABLE_NODE, &show_ip_access_list_name_cmd);
 840 }
 841
 842 static struct cmd_node access_ipv6_node = {
 843         .name = "ipv6 access list",
 844         .node = ACCESS_IPV6_NODE,
 845         .prompt = "",
 846 };
 847
 848 static void access_list_reset_ipv6(void)
 849 {
 850         struct access_list *access;
 851         struct access_list *next;
 852         struct access_master *master;
 853
 854         master = access_master_get(AFI_IP6);
 855         if (master == NULL)
 856                 return;
 857
 858         for (access = master->str.head; access; access = next) {
 859                 next = access->next;
 860                 access_list_delete(access);
 861         }
 862
 863         assert(master->str.head == NULL);
 864         assert(master->str.tail == NULL);
 865 }
 866
 867 static void access_list_init_ipv6(void)
 868 {
 869         install_node(&access_ipv6_node);
 870
 871         install_element(ENABLE_NODE, &show_ipv6_access_list_cmd);
 872         install_element(ENABLE_NODE, &show_ipv6_access_list_name_cmd);
 873 }
 874
 875 void access_list_init(void)
 876 {
 877         access_list_init_ipv4();
 878         access_list_init_ipv6();
 879         access_list_init_mac();
 880
 881         filter_cli_init();
 882 }
 883
 884 void access_list_reset(void)
 885 {
 886         access_list_reset_ipv4();
 887         access_list_reset_ipv6();
 888         access_list_reset_mac();
 889 }