Skip to content

Add vxlan source port security attribute #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gpunathilell wants to merge 2 commits into
base: master
Choose a base branch
from
+32 −10
Open

Add vxlan source port security attribute #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9135c12
Add vxlan security
gpunathilell Feb 23, 2026
5496311
Fix crash
gpunathilell Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion orchagent/switchorch.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,8 @@ const map<string, sai_switch_attr_t> switch_attribute_map =
const map<string, sai_switch_tunnel_attr_t> switch_tunnel_attribute_map =
{
{"vxlan_sport", SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT},
{"vxlan_mask", SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_MASK}
{"vxlan_mask", SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_MASK},
{"vxlan_security", SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_SECURITY}
};

const map<string, sai_packet_action_t> packet_action_map =
Expand Down Expand Up @@ -502,6 +503,7 @@ void SwitchOrch::setSwitchNonSaiAttributes(swss::FieldValueTuple &val)
return;
}
}

sai_status_t SwitchOrch::setSwitchTunnelVxlanParams(swss::FieldValueTuple &val)
{
auto attribute = fvField(val);
Expand All @@ -519,6 +521,9 @@ sai_status_t SwitchOrch::setSwitchTunnelVxlanParams(swss::FieldValueTuple &val)
attr.id = SAI_SWITCH_TUNNEL_ATTR_TUNNEL_VXLAN_UDP_SPORT_MODE;
attr.value.s32 = SAI_TUNNEL_VXLAN_UDP_SPORT_MODE_USER_DEFINED;
attrs.push_back(attr);
attr.id = SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_SECURITY;
attr.value.booldata = false;
attrs.push_back(attr);

status = sai_switch_api->create_switch_tunnel(&m_switchTunnelId, gSwitchId, static_cast<uint32_t>(attrs.size()), attrs.data());

Expand All @@ -540,6 +545,22 @@ sai_status_t SwitchOrch::setSwitchTunnelVxlanParams(swss::FieldValueTuple &val)
case SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_MASK:
attr.value.u8 = to_uint<uint8_t>(value);
break;
case SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_SECURITY:
// Config must use string "true" or "false"
Copy link

@dgsudharsan dgsudharsan Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove this comment

if (value == "true")
{
attr.value.booldata = true;
}
else if (value == "false")
{
attr.value.booldata = false;
}
else
{
SWSS_LOG_ERROR("vxlan_security invalid value '%s' (use string \"true\" or \"false\"); defaulting to false", value.c_str());
attr.value.booldata = false;
}
break;
default:
SWSS_LOG_ERROR("Invalid switch tunnel attribute id %d", attr.id);
return SAI_STATUS_SUCCESS;
Expand Down
19 changes: 10 additions & 9 deletions tests/test_switch.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ def check_object(db, table, key, expected_attributes):
(value, name, expected_attributes[name])


def vxlan_switch_test(dvs, oid, port, mac, mask, sport):
def vxlan_switch_test(dvs, oid, port, mac, mask, sport, security="false"):
app_db = swsscommon.DBConnector(swsscommon.APPL_DB, dvs.redis_sock, 0)
create_entry_pst(
app_db,
Expand All @@ -50,19 +50,20 @@ def vxlan_switch_test(dvs, oid, port, mac, mask, sport):
("vxlan_router_mac", mac),
("vxlan_mask", mask),
("vxlan_sport", sport),
("vxlan_security", security),
],
)
time.sleep(2)

asic_db = swsscommon.DBConnector(swsscommon.ASIC_DB, dvs.redis_sock, 0)
check_object(asic_db, "ASIC_STATE:SAI_OBJECT_TYPE_SWITCH", oid,
{
'SAI_SWITCH_ATTR_VXLAN_DEFAULT_PORT': port,
'SAI_SWITCH_ATTR_VXLAN_DEFAULT_ROUTER_MAC': mac,
'SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_MASK': mask,
'SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT': sport,
}
)
expected_attrs = {
'SAI_SWITCH_ATTR_VXLAN_DEFAULT_PORT': port,
'SAI_SWITCH_ATTR_VXLAN_DEFAULT_ROUTER_MAC': mac,
'SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_MASK': mask,
'SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT': sport,
'SAI_SWITCH_TUNNEL_ATTR_VXLAN_UDP_SPORT_SECURITY': security,
}
check_object(asic_db, "ASIC_STATE:SAI_OBJECT_TYPE_SWITCH", oid, expected_attrs)


def ecmp_lag_hash_offset_test(dvs, oid, lag_offset, ecmp_offset):
Expand Down