sonic-utilities : Added support for L2_TABLE_TYPE in acl-loader

acl_loader/main.py

@@ -314,6 +314,14 @@ def is_table_l3(self, tname):
         """
         return self.tables_db_info[tname]["type"].upper() == "L3"
 
+    def is_table_l2(self, tname):
+        """
+        Check if ACL table type is L2
+        :param tname: ACL table name
+        :return: True if table type is L2 else False
+        """
+        return self.tables_db_info[tname]["type"].upper() == "L2"
+
     def is_table_ipv6(self, tname):
         """
         Check if ACL table type is IPv6 (L3V6 or MIRRORV6)
@@ -456,6 +464,15 @@ def convert_l2(self, table_name, rule_idx, rule):
 
             rule_props["VLAN_ID"] = vlan_id
 
+        if rule.l2.config.source_mac:
+            source_mac = rule.l2.config.source_mac
+            source_mac_mask = rule.l2.config.source_mac_mask
+            rule_props["SRC_MAC"] = source_mac + "/" + source_mac_mask
+        if rule.l2.config.destination_mac:
+            destination_mac = rule.l2.config.destination_mac
+            destination_mac_mask = rule.l2.config.destination_mac_mask
+            rule_props["DST_MAC"] = destination_mac + "/" + destination_mac_mask
+
         return rule_props
 
     def convert_ip(self, table_name, rule_idx, rule):
@@ -639,6 +656,8 @@ def deny_rule(self, table_name):
         rule_props["PACKET_ACTION"] = "DROP"
         if self.is_table_ipv6(table_name):
             rule_props["IP_TYPE"] = "IPV6ANY"  # ETHERTYPE is not supported for DATAACLV6
+        elif self.is_table_l2(table_name):
+            rule_props["IP_TYPE"] = "ANY"
         else:
             rule_props["ETHER_TYPE"] = str(self.ethertype_map["ETHERTYPE_IPV4"])
         return rule_data

tests/acl_input/acl_l2.json

@@ -0,0 +1,32 @@
+{
+	"acl": {
+		"acl-sets": {
+			"acl-set": {
+				"DATAACL_L2": {
+					"acl-entries": {
+						"acl-entry": {
+							"1": {
+								"config": {
+									"sequence-id": 1
+								},
+								"actions": {
+									"config": {
+										"forwarding-action": "ACCEPT"
+									}
+								},
+								"l2": {
+									"config": {
+										"source-mac": "00:00:00:11:11:12",
+										"source-mac-mask": "00:00:00:ff:ff:ff",
+										"destination-mac": "00:00:00:11:11:13",
+										"destination-mac-mask": "00:00:00:ff:ff:ff"
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+}

tests/acl_loader_test.py

@@ -148,6 +148,14 @@ def test_ingress_default_deny_rule(self, acl_loader):
             'PACKET_ACTION': 'DROP',
             'IP_TYPE': 'IPV6ANY'
         }
+        acl_loader.rules_info = {}
+        acl_loader.load_rules_from_file(os.path.join(test_path, 'acl_input/acl_l2.json'))
+        print(acl_loader.rules_info)
+        assert acl_loader.rules_info[('DATAACL_L2', 'DEFAULT_RULE')] == {
+            'PRIORITY': '1',
+            'PACKET_ACTION': 'DROP',
+            'IP_TYPE': 'ANY'
+        }
 
     def test_egress_no_default_deny_rule(self, acl_loader):
         acl_loader.rules_info = {}
@@ -217,3 +225,16 @@ def test_incremental_update(self, acl_loader):
         acl_loader.load_rules_from_file(os.path.join(test_path, 'acl_input/incremental_2.json'))
         acl_loader.incremental_update()
         assert acl_loader.rules_info[(('NTP_ACL', 'RULE_1'))]["PACKET_ACTION"] == "DROP"
+
+    def test_l2_mac_address(self, acl_loader):
+        acl_loader.rules_info = {}
+        acl_loader.load_rules_from_file(os.path.join(test_path, 'acl_input/acl_l2.json'))
+        assert acl_loader.rules_info[("DATAACL_L2", "RULE_1")]
+        assert acl_loader.rules_info[("DATAACL_L2", "RULE_1")] == {
+            "SRC_MAC": "00:00:00:11:11:12/00:00:00:ff:ff:ff",
+            "DST_MAC": "00:00:00:11:11:13/00:00:00:ff:ff:ff",
+            "PACKET_ACTION": "FORWARD",
+            "PRIORITY": "9999"
+        }
+
+

tests/aclshow_test.py

@@ -89,7 +89,7 @@
 # Expected output for aclshow -r RULE_4,RULE_6 -vv
 rule4_rule6_verbose_output = '' + \
 """Reading ACL info...
-Total number of ACL Tables: 11
+Total number of ACL Tables: 12
 Total number of ACL Rules: 20
 
 RULE NAME    TABLE NAME      PRIO    PACKETS COUNT    BYTES COUNT

tests/mock_tables/config_db.json

@@ -521,6 +521,11 @@
         "ports@": "PortChannel0002,PortChannel0005,PortChannel0008,PortChannel0011,PortChannel0014,PortChannel0017,PortChannel0020,PortChannel0023,Ethernet64,Ethernet68,Ethernet72,Ethernet76,Ethernet80,Ethernet84,Ethernet88,Ethernet92,Ethernet96,Ethernet100,Ethernet104,Ethernet108,Ethernet112,Ethernet116,Ethernet120,Ethernet124",
         "type": "L3V6"
     },
+    "ACL_TABLE|DATAACL_L2": {
+        "policy_desc": "DATAACL_L2",
+        "ports@": "PortChannel0002,PortChannel0005,PortChannel0008,PortChannel0011,PortChannel0014,PortChannel0017,PortChannel0020,PortChannel0023,Ethernet64,Ethernet68,Ethernet72,Ethernet76,Ethernet80,Ethernet84,Ethernet88,Ethernet92,Ethernet96,Ethernet100,Ethernet104,Ethernet108,Ethernet112,Ethernet116,Ethernet120,Ethernet124",
+        "type": "L2"
+    },
     "ACL_TABLE|DATAACL_3": {
         "policy_desc": "DATAACL_3",
         "ports@": "PortChannel0002,PortChannel0005,PortChannel0008,PortChannel0011,PortChannel0014,PortChannel0017,PortChannel0020,PortChannel0023,Ethernet64,Ethernet68,Ethernet72,Ethernet76,Ethernet80,Ethernet84,Ethernet88,Ethernet92,Ethernet96,Ethernet100,Ethernet104,Ethernet108,Ethernet112,Ethernet116,Ethernet120,Ethernet124",