From 871e5a7d8b6cf16454f108f57dac83cf005d51f3 Mon Sep 17 00:00:00 2001
From: Pim van Pelt <pim@ipng.nl>
Date: Mon, 16 Jan 2023 17:12:48 +0000
Subject: [PATCH] acl: add dumper for acls

A reasonable attempt will be made to shorten the output of terms, but
due to the nature of the ACL plugin in VPP, all ACLs will be unrolled
into their individual ACEs (called 'terms').

- src/dst-port will only be emitted with UDP/TCP
- icmp-typc/code will only be emitted with ICMP/ICMPv6
- icmp-code/type and source/destination-ports ranges will be collapsed
  where appropriate.
- if protocol is 0, only L3 information will be emitted

NOTE: a bug in the VPP plugin will allow for ICMP 'sport' and 'dport'
upper value to be 16 bits. If an ACE is retrieved from the dataplane
regarding an ICMP or ICMPv6 (referring the 16 bit values to icmp type
and code), they will be truncated and a warning issued.
---
 vppcfg/vpp/vppapi.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/vppcfg/vpp/vppapi.py b/vppcfg/vpp/vppapi.py
index 007256d..639c3f1 100644
--- a/vppcfg/vpp/vppapi.py
+++ b/vppcfg/vpp/vppapi.py
@@ -119,8 +119,8 @@ class VPPApi:
             "interface_names": {},
             "interfaces": {},
             "interface_addresses": {},
-            "interface_acls": {},
             "interface_mpls": {},
+            "interface_acls": {},
             "bondethernets": {},
             "bondethernet_members": {},
             "bridgedomains": {},
@@ -382,6 +382,19 @@ class VPPApi:
                 f"MPLS state retrieval requires https://gerrit.fd.io/r/c/vpp/+/39022"
             )
 
+        try:
+            self.logger.debug("Retrieving ACLs")
+            api_response = self.vpp.api.acl_dump(acl_index=0xFFFFFFFF)
+            for acl in api_response:
+                self.cache["acls"][acl.acl_index] = acl
+
+            self.logger.debug("Retrieving interface ACLs")
+            api_response = self.vpp.api.acl_interface_list_dump()
+            for iface in api_response:
+                self.cache["interface_acls"][iface.sw_if_index] = iface
+        except AttributeError:
+            self.logger.warning(f"ACL API not found - missing plugin: {err}")
+
         self.logger.debug("Retrieving bondethernets")
         api_response = self.vpp.api.sw_bond_interface_dump()
         for iface in api_response: