CLI: what does cExtendedCmdSearch mean?

Other Northbound Interfaces
1

Hi tail-f support,
In confd.conf, cExtendedCmdSearch is explained as below:

Extend the available submode commands to all commands in
parent (and grand-parent) modes. These commands are not
visible during completion but will be executed if entered.
If set to “false” then only commands for entering other
submodes are available in parent and grand-parent modes,
if set to “true” all commands in parent and grand-parent
modes are available.

What does all commands in parent modes mean? Does it mean the following commands at top level:

admin@E-5CG23641SM>
Possible completions:
  clear          - Clear parameter
  compare        - Compare running configuration to another configuration or a file
  configure      - Manipulate software configuration information
  describe       - Display transparent command information
  exit           - Exit the management session
  file           - Perform file operations
  help           - Provide help information
  id             - Show user id information
  leaf-prompting - Automatically query for leaf values
  monitor        - Real-time debugging
  ping           - Ping a host
  quit           - Exit the management session
  request        - Make system-level requests
  script         - Script actions
  set            - Set CLI properties
  set-path       - Set relative show path
  show           - Show information about the system
  source         - File to source
  top            - Exit to top level and optionally run command
  traceroute     - Trace the route to a remote host
  up             - Exit one level of configuration

Would you please give an example of this parameter?
BRs
Michael

2

Need your help on the sentence below:

If set to 'false' then only commands for entering other submodes are available in parent and grand-parent modes

Does this mean that it have the same effect as the parameter topLevelCmdsInSubMode?

And also it does not take effect when setting the following configuration which is to prevent non-local commands from being executed:

<cSuppressCmdSearch>false</cSuppressCmdSearch>

Thank you in advance.

3

Using the $CONFD_DIR/examples.confd/intro/1-2-3-start-query-model example:
(config)# dhcp shared-networks shared-network sn1
From this mode::
(config-shared-network-sn1)# dhcp shared-networks shared-network sn2
and so on:

(config-shared-network-sn2)# dhcp shared-networks shared-network sn3
(config-shared-network-sn3)# dhcp shared-networks shared-network sn4 subnets subnet 1.1.1.1 255.255.255.255
(config-subnet-1.1.1.1/255.255.255.255)# dhcp shared-networks shared-network sn5 subnets subnet 2.2.2.2 255.255.255.255
(config-subnet-2.2.2.2/255.255.255.255)#

This is a “short-cut” to execute commands that are not in the current mode.

1 Like
4

Hi cohult,
Thank you very much. I have tried your suggestion. It works.
So only the commands defined in yang modules are controlled by the 2 parameters cExtendCmdSearch and cSuppressCmdSearch? The commands defined in clispec file commands-c.cli and other buillt-in comands such as abort, clear and so on are not impacted by them?
BRs
Michael

5

Hi @hzpfly

They are reachable from submodes too.

6

Yes, but these commands defined in clispec file and other built-in commands cannot be disabled in submodes by these 2 parameters. Right?

7

I believe you need to provide an example to explain what you want to do or not do.

8

Here is an example:
I add the following lines in confd.conf:

<cli>                                           
  <cExtendedCmdSearch>false</cExtendedCmdSearch>
  <cSuppressCmdSearch>true</cSuppressCmdSearch> 
  <cModeExitFormat>exit</cModeExitFormat>       
</cli>

I think the top level commands such as do, clear and so on is not available in submode. But it is not the case:

E-5CG23641SM(config)# dhcp shared-networks shared-network sn5
E-5CG23641SM(config-shared-network-sn5)#
Possible completions:
  subnets
  ---
  commit     Commit current set of changes
  describe   Display transparent command information
  exit       Exit from current mode
  help       Provide help information
  no         Negate a command or set its defaults
  pwd        Display current mode path
  top        Exit to top level and optionally run command
E-5CG23641SM(config-shared-network-sn5)# do show running-config dhcp
dhcp shared-networks shared-network sn1
exit

BRs
Michael

9

You need to use NACM to disallow the execution of a specific command (built-in or clispec command) in a submode.
Set modeInfoInAAA to true in your confd.conf

<cli>                                           
  <modeInfoInAAA>true</modeInfoInAAA>     
</cli>

Then, add a cmd rule to the aaa config, e.g., in aaa_init.xml. Something like:

    <cmdrule xmlns="http://tail-f.com/yang/acm">
      <name>no-do-cmd-in-config-submode</name>
      <context>cli</context>
      <command>configure ^config-.*$ do</command>   
      <access-operations>read exec</access-operations>
      <action>deny</action>
    </cmdrule>
10

Thank you very much @cohult. Now I can answer my questions now:

What does all commands in parent modes mean? Does it mean the following commands at top level

My answer: if cExtendedCmdSearch is true, in submode, all commands in parent modes are also can be executed. All commands here is the commands defined in user defined Yang modules, not the built-in or clispec defined commands.

Does this mean that it have the same effect as the parameter topLevelCmdsInSubMode?

My answer: No, they are different. topLevelCmdsInSubMode is only for built-in or clispec defined commands.

So only the commands defined in yang modules are controlled by the 2 parameters cExtendCmdSearch and cSuppressCmdSearch? The commands defined in clispec file commands-c.cli and other buillt-in comands such as abort, clear and so on are not impacted by them?

My answer: Yes. And all commands can be authorized by nacm rules.

@cohult, do you think my answer is right or not?

11

@hzpfly Seems correct

1 Like