Add ACL tables schema (sonic-net#204) (sonic-net#211)

doc/swss-schema.md

@@ -409,6 +409,145 @@ It's possible to create separate configuration files for different ASIC platform
 
 ----------------------------------------------
 
+###ACL\_TABLE
+Stores information about ACL tables on the switch. Port names are defined in [port_config.ini](../portsyncd/port_config.ini).
+
+ key = ACL_TABLE:name ; acl_table_name must be unique
+ ;field = value
+ policy_desc = 1*255VCHAR ; name of the ACL policy table description
+ type = "mirror"/"l3" ; type of acl table, every type of
+  ; table defines the match/action a
+  ; specific set of match and actions.
+ ports = [0-max_ports]*port_name ; the ports to which this ACL
+  ; table is applied, can be emtry
+  ; value annotations
+ port_name = 1*64VCHAR ; name of the port, must be unique
+ max_ports = 1*5DIGIT ; number of ports supported on the chip
+
+
+
+###ACL\_RULE\_TABLE
+Stores rules associated with a specific ACL table on the switch.
+
+ key: ACL_RULE_TABLE:table_name:rule_name ; key of the rule entry in the table,
+  ; seq is the order of the rules
+  ; when the packet is filtered by the
+  ; ACL "policy_name".
+  ; A rule is always assocaited with a
+  ; policy.
+
+ ;field = value
+ priority = 1*3DIGIT ; rule priority. Valid values range
+  ; could be platform dependent
+
+ packet_action = "forward"/"drop"/"mirror" ; action when the fields are
+  ; matched (mirror action only
+  ; available to mirror acl table
+  ; type)
+
+ mirror_action = 1*255VCHAR ; refer to the mirror session
+  ; (only available to mirror acl
+  ; table type)
+
+ ether_type = h16 ; Ethernet type field
+
+ ip_type = ip_types ; options of the l2_protocol_type
+  ; field. Only v4 is support for
+  ; this stage.
+
+ ip_protocol = h8 ; options of the l3_protocol_type field
+
+ src_ip = ipv4_prefix ; options of the source ipv4
+  ; address (and mask) field
+
+ dst_ip = ipv4_prefix ; options of the destination ipv4
+  ; address (and mask) field
+
+ l4_src_port = port_num ; source L4 port or the
+ l4_dst_port = port_num ; destination L4 port
+
+ l4_src_port_range = port_num_L-port_num_H ; source ports range of L4 ports field
+ l4_dst_port_range = port_num_L-port_num_H ; destination ports range of L4 ports field
+
+ tcp_flags = h8/h8 ; TCP flags field and mask
+ dscp = h8 ; DSCP field (only available for mirror
+  ; table type)
+
+ ;value annotations
+ ip_types = any | ip | ipv4 | ipv4any | non_ipv4 | ipv6any | non_ipv6
+ port_num = 1*5DIGIT ; a number between 0 and 65535
+ port_num_L = 1*5DIGIT ; a number between 0 and 65535,
+  ; port_num_L < port_num_H
+ port_num_H = 1*5DIGIT ; a number between 0 and 65535,
+  ; port_num_L < port_num_H
+ ipv6_prefix = 6( h16 ":" ) ls32
+  / "::" 5( h16 ":" ) ls32
+  / [ h16 ] "::" 4( h16 ":" ) ls32
+  / [ *1( h16 ":" ) h16 ] "::" 3( h16 ":" ) ls32
+  / [ *2( h16 ":" ) h16 ] "::" 2( h16 ":" ) ls32
+  / [ *3( h16 ":" ) h16 ] "::" h16 ":" ls32
+  / [ *4( h16 ":" ) h16 ] "::" ls32
+  / [ *5( h16 ":" ) h16 ] "::" h16
+  / [ *6( h16 ":" ) h16 ] "::"
+ h8 = 1*2HEXDIG
+ h16 = 1*4HEXDIG
+ ls32 = ( h16 ":" h16 ) / IPv4address
+ ipv4_prefix = dec-octet "." dec-octet "." dec-octet "." dec-octet “/” %d1-32
+ dec-octet = DIGIT ; 0-9
+  / %x31-39 DIGIT ; 10-99
+  / "1" 2DIGIT ; 100-199
+  / "2" %x30-34 DIGIT ; 200-249
+
+Example:
+
+ [
+  {
+  "ACL_TABLE:Drop_IP": {
+  "policy_desc" : "Drop_Traffic",
+  "type" : "L3",
+  "ports" : "Ethernet0,Ethernet4"
+  },
+  "OP": "SET"
+  },
+  {
+  "ACL_RULE_TABLE:Drop_IP:TheDrop": {
+  "priority" : "55",
+  "SRC_IP" : "20.0.0.0/25",
+  "DST_IP" : "20.0.0.0/23",
+  "L4_SRC_PORT" : "80",
+  "PACKET_ACTION" : "DROP"
+  },
+  "OP": "SET"
+  }
+ ]
+
+Equivalent RedisDB entry:
+
+ 127.0.0.1:6379> KEYS *ACL*
+ 1) "ACL_TABLE:Drop_IP"
+ 2) "ACL_RULE_TABLE:Drop_IP:TheDrop"
+ 127.0.0.1:6379> HGETALL ACL_TABLE:Drop_IP
+ 1) "policy_desc"
+ 2) "Drop_Traffic"
+ 3) "ports"
+ 4) "Ethernet0,Ethernet4"
+ 5) "type"
+ 6) "L3"
+ 127.0.0.1:6379> HGETALL ACL_RULE_TABLE:Drop_IP:TheDrop
+  1) "DST_IP"
+  2) "20.0.0.0/23"
+  3) "L4_SRC_PORT"
+  4) "80"
+  5) "PACKET_ACTION"
+  6) "DROP"
+  7) "SRC_IP"
+  8) "20.0.0.0/25"
+  9) "priority"
+ 10) "55"
+ 127.0.0.1:6379>
+
+----------------------------------------------
+
 ###Configuration files
 What configuration files should we have? Do apps, orch agent each need separate files?