Skip to content

Commit d1fdf39

Browse files
oleksandrivantsivShuotian Cheng
oleksandrivantsiv
authored and
Shuotian Cheng
committed
[aclorch]: Allow to create mirror ACL rules in L3 table (sonic-net#243)
Mirror action now could be applied to any type of ACL rules.
1 parent 316b333 commit d1fdf39

File tree

3 files changed

+67
-32
lines changed

3 files changed

+67
-32
lines changed

‎doc/swss-schema.md

-2
Original file line numberDiff line numberDiff line change
@@ -455,8 +455,6 @@ Stores rules associated with a specific ACL table on the switch.
455455
: next-hop group set of addresses Example: "10.0.0.1,10.0.0.3"
456456

457457
mirror_action = 1*255VCHAR ; refer to the mirror session
458-
; (only available to mirror acl
459-
; table type)
460458

461459
ether_type = h16 ; Ethernet type field
462460

‎orchagent/aclorch.cpp

+61-26
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,11 @@ inline string trim(const std::string& str, const std::string& whitespace = " \t"
8686
return str.substr(strBegin, strRange);
8787
}
8888

89-
AclRule::AclRule(AclOrch *aclOrch, string rule, string table) :
89+
AclRule::AclRule(AclOrch *aclOrch, string rule, string table, acl_table_type_t type) :
9090
m_pAclOrch(aclOrch),
9191
m_id(rule),
9292
m_tableId(table),
93+
m_tableType(type),
9394
m_tableOid(SAI_NULL_OBJECT_ID),
9495
m_ruleOid(SAI_NULL_OBJECT_ID),
9596
m_counterOid(SAI_NULL_OBJECT_ID),
@@ -420,18 +421,45 @@ AclRuleCounters AclRule::getCounters()
420421
return AclRuleCounters(counter_attr[0].value.u64, counter_attr[1].value.u64);
421422
}
422423

423-
shared_ptr<AclRule> AclRule::makeShared(acl_table_type_t type, AclOrch *acl, MirrorOrch *mirror, string rule, string table)
424+
shared_ptr<AclRule> AclRule::makeShared(acl_table_type_t type, AclOrch *acl, MirrorOrch *mirror, const string& rule, const string& table, const KeyOpFieldsValuesTuple& data)
424425
{
425-
switch (type)
426+
string action;
427+
bool action_found = false;
428+
/* Find action configured by user. Based on action type create rule. */
429+
for (const auto& itr : kfvFieldsValues(data))
430+
{
431+
string attr_name = toUpper(fvField(itr));
432+
string attr_value = fvValue(itr);
433+
if (attr_name == ACTION_PACKET_ACTION || attr_name == ACTION_MIRROR_ACTION)
434+
{
435+
action_found = true;
436+
action = attr_name;
437+
break;
438+
}
439+
}
440+
441+
if (!action_found)
442+
{
443+
throw runtime_error("ACL rule action is not found in rule " + rule);
444+
}
445+
446+
if (type != ACL_TABLE_L3 && type != ACL_TABLE_MIRROR)
447+
{
448+
throw runtime_error("Unknown table type.");
449+
}
450+
451+
/* Mirror rules can exist in both tables*/
452+
if (action == ACTION_MIRROR_ACTION)
453+
{
454+
return make_shared<AclRuleMirror>(acl, mirror, rule, table, type);
455+
}
456+
/* L3 rules can exist only in L3 table */
457+
else if (type == ACL_TABLE_L3)
426458
{
427-
case ACL_TABLE_L3:
428-
return make_shared<AclRuleL3>(acl, rule, table);
429-
case ACL_TABLE_MIRROR:
430-
return make_shared<AclRuleMirror>(acl, mirror, rule, table);
431-
case ACL_TABLE_UNKNOWN:
432-
default:
433-
throw runtime_error("Unknown rule type.");
459+
return make_shared<AclRuleL3>(acl, rule, table, type);
434460
}
461+
462+
throw runtime_error("Wrong combination of table type and action in rule " + rule);
435463
}
436464

437465
bool AclRule::createCounter()
@@ -499,8 +527,8 @@ bool AclRule::removeCounter()
499527
return true;
500528
}
501529

502-
AclRuleL3::AclRuleL3(AclOrch *aclOrch, string rule, string table) :
503-
AclRule(aclOrch, rule, table)
530+
AclRuleL3::AclRuleL3(AclOrch *aclOrch, string rule, string table, acl_table_type_t type) :
531+
AclRule(aclOrch, rule, table, type)
504532
{
505533
}
506534

@@ -662,8 +690,8 @@ void AclRuleL3::update(SubjectType, void *)
662690
// Do nothing
663691
}
664692

665-
AclRuleMirror::AclRuleMirror(AclOrch *aclOrch, MirrorOrch *mirror, string rule, string table) :
666-
AclRule(aclOrch, rule, table),
693+
AclRuleMirror::AclRuleMirror(AclOrch *aclOrch, MirrorOrch *mirror, string rule, string table, acl_table_type_t type) :
694+
AclRule(aclOrch, rule, table, type),
667695
m_state(false),
668696
m_pMirrorOrch(mirror)
669697
{
@@ -688,6 +716,17 @@ bool AclRuleMirror::validateAddAction(string attr_name, string attr_value)
688716
return true;
689717
}
690718

719+
bool AclRuleMirror::validateAddMatch(string attr_name, string attr_value)
720+
{
721+
if (m_tableType == ACL_TABLE_L3 && attr_name == MATCH_DSCP)
722+
{
723+
SWSS_LOG_ERROR("DSCP match is not supported for the tables of type L3");
724+
return false;
725+
}
726+
727+
return AclRule::validateAddMatch(attr_name, attr_value);
728+
}
729+
691730
bool AclRuleMirror::validate()
692731
{
693732
SWSS_LOG_ENTER();
@@ -749,11 +788,6 @@ bool AclRuleMirror::create()
749788

750789
bool AclRuleMirror::remove()
751790
{
752-
if (!m_pMirrorOrch->decreaseRefCount(m_sessionName))
753-
{
754-
throw runtime_error("Failed to decrease mirror session reference count");
755-
}
756-
757791
if (!m_state)
758792
{
759793
return true;
@@ -764,6 +798,11 @@ bool AclRuleMirror::remove()
764798
return false;
765799
}
766800

801+
if (!m_pMirrorOrch->decreaseRefCount(m_sessionName))
802+
{
803+
throw runtime_error("Failed to decrease mirror session reference count");
804+
}
805+
767806
m_state = false;
768807

769808
return true;
@@ -991,11 +1030,6 @@ void AclOrch::update(SubjectType type, void *cntx)
9911030

9921031
for (const auto& table : m_AclTables)
9931032
{
994-
if (table.second.type != ACL_TABLE_MIRROR)
995-
{
996-
continue;
997-
}
998-
9991033
for (auto& rule : table.second.rules)
10001034
{
10011035
rule.second->update(type, cntx);
@@ -1169,9 +1203,9 @@ void AclOrch::doAclRuleTask(Consumer &consumer)
11691203

11701204
if (bAllAttributesOk)
11711205
{
1172-
newRule = AclRule::makeShared(m_AclTables[table_oid].type, this, m_mirrorOrch, rule_id, table_id);
1206+
newRule = AclRule::makeShared(m_AclTables[table_oid].type, this, m_mirrorOrch, rule_id, table_id, t);
11731207

1174-
for (auto itr : kfvFieldsValues(t))
1208+
for (const auto& itr : kfvFieldsValues(t))
11751209
{
11761210
string attr_name = toUpper(fvField(itr));
11771211
string attr_value = fvValue(itr);
@@ -1198,6 +1232,7 @@ void AclOrch::doAclRuleTask(Consumer &consumer)
11981232
}
11991233
}
12001234
}
1235+
12011236
// validate and create ACL rule
12021237
if (bAllAttributesOk && newRule->validate())
12031238
{

‎orchagent/aclorch.h

+6-4
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ struct AclRuleCounters
124124
class AclRule
125125
{
126126
public:
127-
AclRule(AclOrch *m_pAclOrch, string rule, string table);
127+
AclRule(AclOrch *m_pAclOrch, string rule, string table, acl_table_type_t type);
128128
virtual bool validateAddPriority(string attr_name, string attr_value);
129129
virtual bool validateAddMatch(string attr_name, string attr_value);
130130
virtual bool validateAddAction(string attr_name, string attr_value) = 0;
@@ -156,7 +156,7 @@ class AclRule
156156
return m_counterOid;
157157
}
158158

159-
static shared_ptr<AclRule> makeShared(acl_table_type_t type, AclOrch *acl, MirrorOrch *mirror, string rule, string table);
159+
static shared_ptr<AclRule> makeShared(acl_table_type_t type, AclOrch *acl, MirrorOrch *mirror, const string& rule, const string& table, const KeyOpFieldsValuesTuple&);
160160
virtual ~AclRule() {}
161161

162162
protected:
@@ -171,6 +171,7 @@ class AclRule
171171
AclOrch *m_pAclOrch;
172172
string m_id;
173173
string m_tableId;
174+
acl_table_type_t m_tableType;
174175
sai_object_id_t m_tableOid;
175176
sai_object_id_t m_ruleOid;
176177
sai_object_id_t m_counterOid;
@@ -184,7 +185,7 @@ class AclRule
184185
class AclRuleL3: public AclRule
185186
{
186187
public:
187-
AclRuleL3(AclOrch *m_pAclOrch, string rule, string table);
188+
AclRuleL3(AclOrch *m_pAclOrch, string rule, string table, acl_table_type_t type);
188189

189190
bool validateAddAction(string attr_name, string attr_value);
190191
bool validateAddMatch(string attr_name, string attr_value);
@@ -197,8 +198,9 @@ class AclRuleL3: public AclRule
197198
class AclRuleMirror: public AclRule
198199
{
199200
public:
200-
AclRuleMirror(AclOrch *m_pAclOrch, MirrorOrch *m_pMirrorOrch, string rule, string table);
201+
AclRuleMirror(AclOrch *m_pAclOrch, MirrorOrch *m_pMirrorOrch, string rule, string table, acl_table_type_t type);
201202
bool validateAddAction(string attr_name, string attr_value);
203+
bool validateAddMatch(string attr_name, string attr_value);
202204
bool validate();
203205
bool create();
204206
bool remove();

0 commit comments

Comments
 (0)