Merge pull request #38 from Telecominfraproject/OLS-578-Tag-ols-ucentral-client-and-ols-ucentral-schema-4.0.0-pre-release

[OLS-578] Tag ols-ucentral-client and ols-ucentral-schema 4.0.0 pre-r…

schema.json

@@ -1,5 +1,5 @@
 {
-	"major": 3,
-	"minor": 2,
-	"patch": 7
+	"major": 4,
+	"minor": 0,
+	"patch": 0 
 }

schema/ethernet.yml

@@ -368,6 +368,18 @@ properties:
         type: boolean
         description: Enables the transmission of SNMP trap notifications about LLDP changes.
         default: false
+  ip-arp-inspect-port:
+    type: object
+    description: Configuration for ARP Inspection on specific interfaces or ports in the switch.
+    properties:
+      rate-limit-pps:
+        type: integer
+        description: Sets a rate limit (packets per second) for the ARP packets received on a port. Ensures that the port does not process ARP packets beyond the configured limit.
+        minimum: 0
+        maximum: 65535
+      trusted:
+        type: boolean
+        description: Configures the port as trusted, exempting it from ARP Inspection. Trusted ports bypass ARP validation checks.
   rate-limit-port:
     type: object
     description: Configuration for ingress and egress rate limiting on a specific port (in kbps)

schema/interface.ipv4.arp-inspect.yml

@@ -0,0 +1,14 @@
+type: object
+description: Configuration for ARP Inspection on specific VLANs in the switch.
+properties:
+  vlan-enable:
+    type: boolean
+    description: Enable or disable ARP Inspection for a specified VLAN.
+  vlan-acl-rule:
+    type: string
+    description: Specifies an ARP ACL to apply to one or more VLANs.
+    maxLength: 32
+    minLength: 1
+  vlan-acl-nodhcp-bindings:
+    type: boolean
+    description: Validate ARP packets against only the specified ACL without checking address bindings in the DHCP snooping database.

schema/interface.ipv4.yml

@@ -200,6 +200,8 @@ properties:
     description: "Enables DHCP Snooping on a VLAN"
     type: boolean
     default: false
+  ip-arp-inspect-vlan:
+      $ref: "https://ucentral.io/schema/v1/interface/ipv4/arp-inspect/"
   dhcp:
     $ref: "https://ucentral.io/schema/v1/interface/ipv4/dhcp/"
   dhcp-leases:

schema/switch.arp-inspect.yml

@@ -0,0 +1,19 @@
+type: object
+description: Global configuration for ARP Inspection on the switch.
+properties:
+  ip-arp-inspect:
+    type: boolean
+    description: Enable or disable ARP Inspection globally.
+    default: false
+  validate-dst-mac:
+    type: boolean
+    description: Validate that the destination MAC address in the Ethernet header matches the target MAC address in the ARP body for ARP responses.
+  validate-ip:
+    type: boolean
+    description: Validate ARP packets for unexpected or invalid IP addresses, such as 0.0.0.0, 255.255.255.255, and IP multicast addresses.
+  validate-allow-zeros:
+    type: boolean
+    description: Allow ARP packets where the sender IP address is 0.0.0.0.
+  validate-src-mac:
+    type: boolean
+    description: Validate that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body for both ARP requests and responses.

schema/switch.yml

@@ -537,6 +537,8 @@ properties:
               minLength: 1
               examples:
                 - "A VoIP Phone"
+  arp-inspect:
+    $ref: "https://ucentral.io/schema/v1/switch/arp-inspect/"
   ip-source-guard:
     $ref: "https://ucentral.io/schema/v1/switch/ip-source-guard/"
   rt-events:

state/state.yml

@@ -60,6 +60,34 @@ properties:
     type: string
     description:
       Current interface that serves as the Uplink. Example Ethernet2.
+  arp-inspect-stats:
+    type: object
+    description: Statistics related to ARP Inspection activity in the switch.
+    properties:
+      arp-pkt-rcvd:
+        type: integer
+        description: Total number of ARP packets received.
+      arp-pkt-dropped-rate-limit:
+        type: integer
+        description: Number of ARP packets dropped due to rate limiting.
+      arp-pkt-processed:
+        type: integer
+        description: Total number of ARP packets processed by ARP Inspection.
+      arp-pkt-dropped-src-mac:
+        type: integer
+        description: Number of ARP packets dropped due to source MAC address validation failures.
+      arp-pkt-dropped-dst-mac:
+        type: integer
+        description: Number of ARP packets dropped due to destination MAC address validation failures.
+      arp-pkt-dropped-ip:
+        type: integer
+        description: Number of ARP packets dropped due to IP address validation failures."
+      arp-pkt-dropped-acl:
+        type: integer
+        description: Number of ARP packets dropped due to ARP ACL rules.
+      arp-pkt-dropped-dhcp:
+        type: integer
+        description: Number of ARP packets dropped due to DHCP snooping validation failures.
   ip-source-guard:
     type: object
     description: Represents the configuration and state of IP Source Guard.
@@ -85,4 +113,4 @@ properties:
               maximum: 4095
             blocked-interface:
               type: string
-              description: The interface (e.g., port) where the blocked entry was detected.
+              description: The interface (e.g., port) where the blocked entry was detected.

ucentral.schema.full.json

@@ -589,6 +589,22 @@
                             }
                         }
                     },
+                    "ip-arp-inspect-port": {
+                        "type": "object",
+                        "description": "Configuration for ARP Inspection on specific interfaces or ports in the switch.",
+                        "properties": {
+                            "rate-limit-pps": {
+                                "type": "integer",
+                                "description": "Sets a rate limit (packets per second) for the ARP packets received on a port. Ensures that the port does not process ARP packets beyond the configured limit.",
+                                "minimum": 0,
+                                "maximum": 65535
+                            },
+                            "trusted": {
+                                "type": "boolean",
+                                "description": "Configures the port as trusted, exempting it from ARP Inspection. Trusted ports bypass ARP validation checks."
+                            }
+                        }
+                    },
                     "rate-limit-port": {
                         "type": "object",
                         "description": "Configuration for ingress and egress rate limiting on a specific port (in kbps)",
@@ -1363,6 +1379,33 @@
                         }
                     }
                 },
+                "arp-inspect": {
+                    "type": "object",
+                    "description": "Global configuration for ARP Inspection on the switch.",
+                    "properties": {
+                        "ip-arp-inspect": {
+                            "type": "boolean",
+                            "description": "Enable or disable ARP Inspection globally.",
+                            "default": false
+                        },
+                        "validate-dst-mac": {
+                            "type": "boolean",
+                            "description": "Validate that the destination MAC address in the Ethernet header matches the target MAC address in the ARP body for ARP responses."
+                        },
+                        "validate-ip": {
+                            "type": "boolean",
+                            "description": "Validate ARP packets for unexpected or invalid IP addresses, such as 0.0.0.0, 255.255.255.255, and IP multicast addresses."
+                        },
+                        "validate-allow-zeros": {
+                            "type": "boolean",
+                            "description": "Allow ARP packets where the sender IP address is 0.0.0.0."
+                        },
+                        "validate-src-mac": {
+                            "type": "boolean",
+                            "description": "Validate that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body for both ARP requests and responses."
+                        }
+                    }
+                },
                 "ip-source-guard": {
                     "type": "object",
                     "description": "Configuration for IP Source Guard global static bindings in a Layer 2 switch.",
@@ -2168,6 +2211,26 @@
                                 "type": "boolean",
                                 "default": false
                             },
+                            "ip-arp-inspect-vlan": {
+                                "type": "object",
+                                "description": "Configuration for ARP Inspection on specific VLANs in the switch.",
+                                "properties": {
+                                    "vlan-enable": {
+                                        "type": "boolean",
+                                        "description": "Enable or disable ARP Inspection for a specified VLAN."
+                                    },
+                                    "vlan-acl-rule": {
+                                        "type": "string",
+                                        "description": "Specifies an ARP ACL to apply to one or more VLANs.",
+                                        "maxLength": 32,
+                                        "minLength": 1
+                                    },
+                                    "vlan-acl-nodhcp-bindings": {
+                                        "type": "boolean",
+                                        "description": "Validate ARP packets against only the specified ACL without checking address bindings in the DHCP snooping database."
+                                    }
+                                }
+                            },
                             "dhcp": {
                                 "description": "This section describes the DHCP server configuration",
                                 "type": "object",

ucentral.schema.json

@@ -529,6 +529,19 @@
                         }
                     }
                 },
+                "ip-arp-inspect-port": {
+                    "type": "object",
+                    "properties": {
+                        "rate-limit-pps": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 65535
+                        },
+                        "trusted": {
+                            "type": "boolean"
+                        }
+                    }
+                },
                 "rate-limit-port": {
                     "type": "object",
                     "properties": {
@@ -658,6 +671,27 @@
                 }
             }
         },
+        "switch.arp-inspect": {
+            "type": "object",
+            "properties": {
+                "ip-arp-inspect": {
+                    "type": "boolean",
+                    "default": false
+                },
+                "validate-dst-mac": {
+                    "type": "boolean"
+                },
+                "validate-ip": {
+                    "type": "boolean"
+                },
+                "validate-allow-zeros": {
+                    "type": "boolean"
+                },
+                "validate-src-mac": {
+                    "type": "boolean"
+                }
+            }
+        },
         "switch.ip-source-guard": {
             "type": "object",
             "properties": {
@@ -1519,6 +1553,9 @@
                         }
                     }
                 },
+                "arp-inspect": {
+                    "$ref": "#/$defs/switch.arp-inspect"
+                },
                 "ip-source-guard": {
                     "$ref": "#/$defs/switch.ip-source-guard"
                 },
@@ -1624,6 +1661,22 @@
                 }
             }
         },
+        "interface.ipv4.arp-inspect": {
+            "type": "object",
+            "properties": {
+                "vlan-enable": {
+                    "type": "boolean"
+                },
+                "vlan-acl-rule": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 1
+                },
+                "vlan-acl-nodhcp-bindings": {
+                    "type": "boolean"
+                }
+            }
+        },
         "interface.ipv4.dhcp": {
             "type": "object",
             "properties": {
@@ -1928,6 +1981,9 @@
                     "type": "boolean",
                     "default": false
                 },
+                "ip-arp-inspect-vlan": {
+                    "$ref": "#/$defs/interface.ipv4.arp-inspect"
+                },
                 "dhcp": {
                     "$ref": "#/$defs/interface.ipv4.dhcp"
                 },

ucentral.schema.pretty.json

@@ -623,6 +623,22 @@
                         }
                     }
                 },
+                "ip-arp-inspect-port": {
+                    "type": "object",
+                    "description": "Configuration for ARP Inspection on specific interfaces or ports in the switch.",
+                    "properties": {
+                        "rate-limit-pps": {
+                            "type": "integer",
+                            "description": "Sets a rate limit (packets per second) for the ARP packets received on a port. Ensures that the port does not process ARP packets beyond the configured limit.",
+                            "minimum": 0,
+                            "maximum": 65535
+                        },
+                        "trusted": {
+                            "type": "boolean",
+                            "description": "Configures the port as trusted, exempting it from ARP Inspection. Trusted ports bypass ARP validation checks."
+                        }
+                    }
+                },
                 "rate-limit-port": {
                     "type": "object",
                     "description": "Configuration for ingress and egress rate limiting on a specific port (in kbps)",
@@ -774,6 +790,33 @@
                 }
             }
         },
+        "switch.arp-inspect": {
+            "type": "object",
+            "description": "Global configuration for ARP Inspection on the switch.",
+            "properties": {
+                "ip-arp-inspect": {
+                    "type": "boolean",
+                    "description": "Enable or disable ARP Inspection globally.",
+                    "default": false
+                },
+                "validate-dst-mac": {
+                    "type": "boolean",
+                    "description": "Validate that the destination MAC address in the Ethernet header matches the target MAC address in the ARP body for ARP responses."
+                },
+                "validate-ip": {
+                    "type": "boolean",
+                    "description": "Validate ARP packets for unexpected or invalid IP addresses, such as 0.0.0.0, 255.255.255.255, and IP multicast addresses."
+                },
+                "validate-allow-zeros": {
+                    "type": "boolean",
+                    "description": "Allow ARP packets where the sender IP address is 0.0.0.0."
+                },
+                "validate-src-mac": {
+                    "type": "boolean",
+                    "description": "Validate that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body for both ARP requests and responses."
+                }
+            }
+        },
         "switch.ip-source-guard": {
             "type": "object",
             "description": "Configuration for IP Source Guard global static bindings in a Layer 2 switch.",
@@ -1794,6 +1837,9 @@
                         }
                     }
                 },
+                "arp-inspect": {
+                    "$ref": "#/$defs/switch.arp-inspect"
+                },
                 "ip-source-guard": {
                     "$ref": "#/$defs/switch.ip-source-guard"
                 },
@@ -1913,6 +1959,26 @@
                 }
             }
         },
+        "interface.ipv4.arp-inspect": {
+            "type": "object",
+            "description": "Configuration for ARP Inspection on specific VLANs in the switch.",
+            "properties": {
+                "vlan-enable": {
+                    "type": "boolean",
+                    "description": "Enable or disable ARP Inspection for a specified VLAN."
+                },
+                "vlan-acl-rule": {
+                    "type": "string",
+                    "description": "Specifies an ARP ACL to apply to one or more VLANs.",
+                    "maxLength": 32,
+                    "minLength": 1
+                },
+                "vlan-acl-nodhcp-bindings": {
+                    "type": "boolean",
+                    "description": "Validate ARP packets against only the specified ACL without checking address bindings in the DHCP snooping database."
+                }
+            }
+        },
         "interface.ipv4.dhcp": {
             "description": "This section describes the DHCP server configuration",
             "type": "object",
@@ -2264,6 +2330,9 @@
                     "type": "boolean",
                     "default": false
                 },
+                "ip-arp-inspect-vlan": {
+                    "$ref": "#/$defs/interface.ipv4.arp-inspect"
+                },
                 "dhcp": {
                     "$ref": "#/$defs/interface.ipv4.dhcp"
                 },

ucentral.state.pretty.json

@@ -86,6 +86,44 @@
             "type": "string",
             "description": "Current interface that serves as the Uplink. Example Ethernet2."
         },
+        "arp-inspect-stats": {
+            "type": "object",
+            "description": "Statistics related to ARP Inspection activity in the switch.",
+            "properties": {
+                "arp-pkt-rcvd": {
+                    "type": "integer",
+                    "description": "Total number of ARP packets received."
+                },
+                "arp-pkt-dropped-rate-limit": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to rate limiting."
+                },
+                "arp-pkt-processed": {
+                    "type": "integer",
+                    "description": "Total number of ARP packets processed by ARP Inspection."
+                },
+                "arp-pkt-dropped-src-mac": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to source MAC address validation failures."
+                },
+                "arp-pkt-dropped-dst-mac": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to destination MAC address validation failures."
+                },
+                "arp-pkt-dropped-ip": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to IP address validation failures.\""
+                },
+                "arp-pkt-dropped-acl": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to ARP ACL rules."
+                },
+                "arp-pkt-dropped-dhcp": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to DHCP snooping validation failures."
+                }
+            }
+        },
         "ip-source-guard": {
             "type": "object",
             "description": "Represents the configuration and state of IP Source Guard.",