Skip to content

Commit

Permalink
[acl] Add IN_PORTS qualifier for L3 table (sonic-net#3078)
Browse files Browse the repository at this point in the history
* Apply IN_PORTS qualifiier for L3 table

Why I did it
IN_PORTS qualifier was allowed for L3 table in 202012 release and below. Changes in sonic-net#1982 removed that support leading to regression in some of our testcases. The following error was observed
ERR swss#orchagent: :- validateAclRuleMatch: Match SAI_ACL_ENTRY_ATTR_FIELD_IN_PORTS in rule RULE_1 is not supported by table DATAACL
  • Loading branch information
neethajohn authored Mar 18, 2024
1 parent a13e081 commit 9d4a3ad
Show file tree
Hide file tree
Showing 2 changed files with 44 additions and 0 deletions.
2 changes: 2 additions & 0 deletions orchagent/aclorch.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3223,6 +3223,7 @@ void AclOrch::initDefaultTableTypes()
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_L4_SRC_PORT))
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_L4_DST_PORT))
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_TCP_FLAGS))
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_IN_PORTS))
.build()
);

Expand All @@ -3240,6 +3241,7 @@ void AclOrch::initDefaultTableTypes()
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_L4_SRC_PORT))
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_L4_DST_PORT))
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_TCP_FLAGS))
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_IN_PORTS))
.build()
);

Expand Down
42 changes: 42 additions & 0 deletions tests/test_acl.py
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,29 @@ def test_AclRuleInPorts(self, dvs_acl, mirror_acl_table):
dvs_acl.verify_acl_rule_status(MIRROR_TABLE_NAME, MIRROR_RULE_NAME, None)
dvs_acl.verify_no_acl_rules()

def test_AclRuleInPortsL3(self, dvs_acl, l3_acl_table):
"""
Verify IN_PORTS matches on ACL rule.
Using L3 table type for IN_PORTS matches.
"""
config_qualifiers = {
"IN_PORTS": "Ethernet8,Ethernet12",
}

expected_sai_qualifiers = {
"SAI_ACL_ENTRY_ATTR_FIELD_IN_PORTS": dvs_acl.get_port_list_comparator(["Ethernet8", "Ethernet12"])
}

dvs_acl.create_acl_rule(L3_TABLE_NAME, L3_RULE_NAME, config_qualifiers)
# Verify status is written into STATE_DB
dvs_acl.verify_acl_rule_status(L3_TABLE_NAME, L3_RULE_NAME, "Active")
dvs_acl.verify_acl_rule(expected_sai_qualifiers)

dvs_acl.remove_acl_rule(L3_TABLE_NAME, L3_RULE_NAME)
# Verify the STATE_DB entry is removed
dvs_acl.verify_acl_rule_status(L3_TABLE_NAME, L3_RULE_NAME, None)
dvs_acl.verify_no_acl_rules()

def test_AclRuleOutPorts(self, dvs_acl, mclag_acl_table):
"""
Verify OUT_PORTS matches on ACL rule.
Expand Down Expand Up @@ -546,6 +569,25 @@ def test_V6AclRuleVlanId(self, dvs_acl, l3v6_acl_table):
dvs_acl.verify_acl_rule_status(L3V6_TABLE_NAME, L3V6_RULE_NAME, None)
dvs_acl.verify_no_acl_rules()

def test_v6AclRuleInPorts(self, dvs_acl, l3v6_acl_table):
config_qualifiers = {
"IN_PORTS": "Ethernet8,Ethernet12",
}

expected_sai_qualifiers = {
"SAI_ACL_ENTRY_ATTR_FIELD_IN_PORTS": dvs_acl.get_port_list_comparator(["Ethernet8", "Ethernet12"])
}

dvs_acl.create_acl_rule(L3V6_TABLE_NAME, L3V6_RULE_NAME, config_qualifiers)
dvs_acl.verify_acl_rule(expected_sai_qualifiers)
# Verify status is written into STATE_DB
dvs_acl.verify_acl_rule_status(L3V6_TABLE_NAME, L3V6_RULE_NAME, "Active")

dvs_acl.remove_acl_rule(L3V6_TABLE_NAME, L3V6_RULE_NAME)
# Verify the STATE_DB entry is removed
dvs_acl.verify_acl_rule_status(L3V6_TABLE_NAME, L3V6_RULE_NAME, None)
dvs_acl.verify_no_acl_rules()

def test_InsertAclRuleBetweenPriorities(self, dvs_acl, l3_acl_table):
rule_priorities = ["10", "20", "30", "40"]

Expand Down

0 comments on commit 9d4a3ad

Please sign in to comment.