Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sonic-mgmt-common: Support for L2 match fields for L2 ACL table #66

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ArthiGovindaraj
Copy link

@ArthiGovindaraj ArthiGovindaraj commented Nov 22, 2022

  • Added SONIC yang for src mac, dst mac, vlan id, vlan pcp, vlan dei
  • This is updated for schema reference purpose.
    Added support for L2_TABLE related match fields for configuring rules to ACL L2 TABLE

sonic-net/sonic-swss#2554
[https://github.com/sonic-net/sonic-utilities/pull/2516

Why I did it

ACL supports only L3 and L3V6 table type. There is no support for matching L2 fields.
When user wants to match fields like SRC_MAC, DST_MAC, VLAN_ID, VLAN_PCP, VLAN_DEI we do not have support for these fields in sonic yang.
Added support for these fields in sonic-acl.yang.

How I verified it

Create L2 Table from CLICK
"config acl add table -s ingress -p <table_name> L2"
Add rules using CONFIG_DB format
add rules src mac, dst mac, ether type, pcp, dei & vlan id
"L2_TABLE|RULE_2": {
"SRC_MAC": "00:00:00:11:11:11/00:00:00:ff:ff:ff",
"DST_MAC": "00:00:00:22:22:22/00:00:00:ff:ff:ff",
"ETHER_TYPE": "0x0800",
"VLAN_ID": "100",
"VLAN_PCP": "5/7",
"VLAN_DEI": "1",
"PRIORITY": "5",
"PACKET_ACTION": "DROP"
}
Validate commands "show acl table"
Validate commands and fields in "show acl rule"
Validate commands "aclshow -a" /* Ensured that the counters are hitting the relevant rule */
Add rules using openconfig json format for supported fields "config acl update full/incremental <file.json>"
"source-mac": "00:00:00:11:11:12",
"source-mac-mask": "00:00:00:ff:ff:ff",
"destination-mac": "00:00:00:11:11:13",
"destination-mac-mask": "00:00:00:ff:ff:ff",
"ethertype": "ETHERTYPE_ARP"
All the rules are added for each field and combinations as well. and each field tested with traffic in Broadcom based platform.

  • 201811
  • 201911
  • 202006
  • 202012
  • 202106
  • 202111
  • 202205

* Added SONIC yang for src mac, dst mac, vlan id, vlan pcp, vlan dei
Copy link

@tomek-US tomek-US left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thovikeerthi
Copy link

Please inform are these changes merged to master branch ? Does master code base have support for L2 ACL for MAC address ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants