0
The diagram above shows how the
Cumulus Linux 3.4 HTTP API can be extended to include the functionality described in
REST API for Cumulus Linux ACLs. Fast programmatic control of Cumulus Linux ACLs addresses a number of interesting use cases, including:
DDoS mitigation,
Elephant flow marking, and
Triggered remote packet capture using filtered ERSPAN.
The Github
pphaal/acl_server project
INSTALL page describes how to install the
acl_server daemon and configure the NGINX web server front end for the Cumulus Linux REST API to include the
acl_server functions. The integration ensures that the same access controls configured for the REST API apply to the acl_server functions, which appear under the
/acl/ path.
The following examples demonstrate the REST API.
Create an ACL
curl -X PUT -H 'Content-Type:application/json' --data '["[iptables]","-A FORWARD --in-interface swp+ -d 10.10.100.10 -p udp --sport 53 -j DROP"]' -k -u 'cumulus:CumulusLinux!' https://10.0.0.52:8080/acl/ddos1
ACLs are sent as a JSON encoded array of strings. Each string will be written as a line in a file stored under
/etc/cumulus/acl/policy.d/ - See Cumulus Linux:
Netfilter - ACLs. For example, the rule above will be written to the file
50rest-ddos1.rules with the following
Continue reading